Skip to content

L
linux
Switch branch/tag
  1. 03 Nov, 2022 2 commits
  3. 14 Oct, 2022 2 commits
  5. 12 Oct, 2022 1 commit
  7. 11 Oct, 2022 4 commits
  9. 10 Oct, 2022 1 commit
  11. 07 Oct, 2022 3 commits
  13. 06 Oct, 2022 5 commits
    • M. Vefa Bicakci's avatar
      xen/gntdev: Accommodate VMA splitting · 5c13a4a0
      M. Vefa Bicakci authored 
      Prior to this commit, the gntdev driver code did not handle the
following scenario correctly with paravirtualized (PV) Xen domains:

* User process sets up a gntdev mapping composed of two grant mappings
  (i.e., two pages shared by another Xen domain).
* User process munmap()s one of the pages.
* User process munmap()s the remaining page.
* User process exits.

In the scenario above, the user process would cause the kernel to log
the following messages in dmesg for the first munmap(), and the second
munmap() call would result in similar log messages:

  BUG: Bad page map in process doublemap.test  pte:... pmd:...
  page:0000000057c97bff refcount:1 mapcount:-1 \
    mapping:0000000000000000 index:0x0 pfn:...
  ...
  page dumped because: bad pte
  ...
  file:gntdev fault:0x0 mmap:gntdev_mmap [xen_gntdev] readpage:0x0
  ...
  Call Trace:
   <TASK>
   dump_stack_lvl+0x46/0x5e
   print_bad_pte.cold+0x66/0xb6
   unmap_page_range+0x7e5/0xdc0
   unmap_vmas+0x78/0xf0
   unmap_region+0xa8/0x110
   __do_munmap+0x1ea/0x4e0
   __vm_munmap+0x75/0x120
   __x64_sys_munmap+0x28/0x40
   do_syscall_64+0x38/0x90
   entry_SYSCALL_64_after_hwframe+0x61/0xcb
   ...

For each munmap() call, the Xen hypervisor (if built with CONFIG_DEBUG)
would print out the following and trigger a general protection fault in
the affected Xen PV domain:

  (XEN) d0v... Attempt to implicitly unmap d0's grant PTE ...
  (XEN) d0v... Attempt to implicitly unmap d0's grant PTE ...

As of this writing, gntdev_grant_map structure's vma field (referred to
as map->vma below) is mainly used for checking the start and end
addresses of mappings. However, with split VMAs, these may change, and
there could be more than one VMA associated with a gntdev mapping.
Hence, remove the use of map->vma and rely on map->pages_vm_start for
the original start address and on (map->count << PAGE_SHIFT) for the
original mapping size. Let the invalidate() and find_special_page()
hooks use these.

Also, given that there can be multiple VMAs associated with a gntdev
mapping, move the "mmu_interval_notifier_remove(&map->notifier)" call to
the end of gntdev_put_map, so that the MMU notifier is only removed
after the closing of the last remaining VMA.

Finally, use an atomic to prevent inadvertent gntdev mapping re-use,
instead of using the map->live_grants atomic counter and/or the map->vma
pointer (the latter of which is now removed). This prevents the
userspace from mmap()'ing (with MAP_FIXED) a gntdev mapping over the
same address range as a previously set up gntdev mapping. This scenario
can be summarized with the following call-trace, which was valid prior
to this commit:

  mmap
    gntdev_mmap
  mmap (repeat mmap with MAP_FIXED over the same address range)
    gntdev_invalidate
      unmap_grant_pages (sets 'being_removed' entries to true)
        gnttab_unmap_refs_async
    unmap_single_vma
    gntdev_mmap (maps the shared pages again)
  munmap
    gntdev_invalidate
      unmap_grant_pages
        (no-op because 'being_removed' entries are true)
    unmap_single_vma (For PV domains, Xen reports that a granted page
      is being unmapped and triggers a general protection fault in the
      affected domain, if Xen was built with CONFIG_DEBUG)

The fix for this last scenario could be worth its own commit, but we
opted for a single commit, because removing the gntdev_grant_map
structure's vma field requires guarding the entry to gntdev_mmap(), and
the live_grants atomic counter is not sufficient on its own to prevent
the mmap() over a pre-existing mapping.

Link: https://github.com/QubesOS/qubes-issues/issues/7631
Fixes: ab31523c ("xen/gntdev: allow usermode to map granted pages")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarM. Vefa Bicakci <m.v.b@runbox.com>
Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20221002222006.2077-3-m.v.b@runbox.comSigned-off-by: default avatarJuergen Gross <jgross@suse.com>
      5c13a4a0
    • M. Vefa Bicakci's avatar
      xen/gntdev: Prevent leaking grants · 0991028c
      M. Vefa Bicakci authored 
      Prior to this commit, if a grant mapping operation failed partially,
some of the entries in the map_ops array would be invalid, whereas all
of the entries in the kmap_ops array would be valid. This in turn would
cause the following logic in gntdev_map_grant_pages to become invalid:

  for (i = 0; i < map->count; i++) {
    if (map->map_ops[i].status == GNTST_okay) {
      map->unmap_ops[i].handle = map->map_ops[i].handle;
      if (!use_ptemod)
        alloced++;
    }
    if (use_ptemod) {
      if (map->kmap_ops[i].status == GNTST_okay) {
        if (map->map_ops[i].status == GNTST_okay)
          alloced++;
        map->kunmap_ops[i].handle = map->kmap_ops[i].handle;
      }
    }
  }
  ...
  atomic_add(alloced, &map->live_grants);

Assume that use_ptemod is true (i.e., the domain mapping the granted
pages is a paravirtualized domain). In the code excerpt above, note that
the "alloced" variable is only incremented when both kmap_ops[i].status
and map_ops[i].status are set to GNTST_okay (i.e., both mapping
operations are successful).  However, as also noted above, there are
cases where a grant mapping operation fails partially, breaking the
assumption of the code excerpt above.

The aforementioned causes map->live_grants to be incorrectly set. In
some cases, all of the map_ops mappings fail, but all of the kmap_ops
mappings succeed, meaning that live_grants may remain zero. This in turn
makes it impossible to unmap the successfully grant-mapped pages pointed
to by kmap_ops, because unmap_grant_pages has the following snippet of
code at its beginning:

  if (atomic_read(&map->live_grants) == 0)
    return; /* Nothing to do */

In other cases where only some of the map_ops mappings fail but all
kmap_ops mappings succeed, live_grants is made positive, but when the
user requests unmapping the grant-mapped pages, __unmap_grant_pages_done
will then make map->live_grants negative, because the latter function
does not check if all of the pages that were requested to be unmapped
were actually unmapped, and the same function unconditionally subtracts
"data->count" (i.e., a value that can be greater than map->live_grants)
from map->live_grants. The side effects of a negative live_grants value
have not been studied.

The net effect of all of this is that grant references are leaked in one
of the above conditions. In Qubes OS v4.1 (which uses Xen's grant
mechanism extensively for X11 GUI isolation), this issue manifests
itself with warning messages like the following to be printed out by the
Linux kernel in the VM that had granted pages (that contain X11 GUI
window data) to dom0: "g.e. 0x1234 still pending", especially after the
user rapidly resizes GUI VM windows (causing some grant-mapping
operations to partially or completely fail, due to the fact that the VM
unshares some of the pages as part of the window resizing, making the
pages impossible to grant-map from dom0).

The fix for this issue involves counting all successful map_ops and
kmap_ops mappings separately, and then adding the sum to live_grants.
During unmapping, only the number of successfully unmapped grants is
subtracted from live_grants. The code is also modified to check for
negative live_grants values after the subtraction and warn the user.

Link: https://github.com/QubesOS/qubes-issues/issues/7631
Fixes: dbe97cff ("xen/gntdev: Avoid blocking in unmap_grant_pages()")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarM. Vefa Bicakci <m.v.b@runbox.com>
Acked-by: default avatarDemi Marie Obenour <demi@invisiblethingslab.com>
Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20221002222006.2077-2-m.v.b@runbox.comSigned-off-by: default avatarJuergen Gross <jgross@suse.com>
      0991028c
    • Oleksandr Tyshchenko's avatar
      xen/virtio: Fix potential deadlock when accessing xen_grant_dma_devices · 77be00f1
      Oleksandr Tyshchenko authored 
      As find_xen_grant_dma_data() is called from both interrupt and process
contexts, the access to xen_grant_dma_devices XArray must be protected
by xa_lock_irqsave to avoid deadlock scenario.
As XArray API doesn't provide xa_store_irqsave helper, call lockless
__xa_store directly and guard it externally.

Also move the storage of the XArray's entry to a separate helper.

Fixes: d6aca350 ("xen/grant-dma-ops: Add option to restrict memory access under Xen")
Signed-off-by: default avatarOleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Reviewed-by: default avatarStefano Stabellini <sstabellini@kernel.org>
Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20221005174823.1800761-3-olekstysh@gmail.comSigned-off-by: default avatarJuergen Gross <jgross@suse.com>
      77be00f1
    • Oleksandr Tyshchenko's avatar
      xen/virtio: Fix n_pages calculation in xen_grant_dma_map(unmap)_page() · e433715b
      Oleksandr Tyshchenko authored 
      Take page offset into the account when calculating the number of pages
to be granted.

Fixes: d6aca350 ("xen/grant-dma-ops: Add option to restrict memory access under Xen")
Signed-off-by: default avatarOleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Reviewed-by: default avatarStefano Stabellini <sstabellini@kernel.org>
Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20221005174823.1800761-2-olekstysh@gmail.comSigned-off-by: default avatarJuergen Gross <jgross@suse.com>
      e433715b
    • Colin Ian King's avatar
      xen/xenbus: Fix spelling mistake "hardward" -> "hardware" · 06c62f8c
      Colin Ian King authored 
      There is a spelling mistake in the module description. Fix it.
Signed-off-by: default avatarColin Ian King <colin.i.king@gmail.com>
Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20221004160639.154421-1-colin.i.king@gmail.comSigned-off-by: default avatarJuergen Gross <jgross@suse.com>
      06c62f8c
  15. 04 Oct, 2022 1 commit
    • Jason Andryuk's avatar
      xen-pcifront: Handle missed Connected state · 728c2edf
      Jason Andryuk authored 
      An HVM guest with linux stubdomain and 2 PCI devices failed to start as
libxl timed out waiting for the PCI devices to be added.  It happens
intermittently but with some regularity.  libxl wrote the two xenstore
entries for the devices, but then timed out waiting for backend state 4
(Connected) - the state stayed at 7 (Reconfiguring).  (PCI passthrough
to an HVM with stubdomain is PV passthrough to the stubdomain and then
HVM passthrough with the QEMU inside the stubdomain.)

The stubdomain kernel never printed "pcifront pci-0: Installing PCI
frontend", so it seems to have missed state 4 which would have
called pcifront_try_connect() -> pcifront_connect_and_init_dma()

Have pcifront_detach_devices() special-case state Initialised and call
pcifront_connect_and_init_dma().  Don't use pcifront_try_connect()
because that sets the xenbus state which may throw off the backend.
After connecting, skip the remainder of detach_devices since none have
been initialized yet.  When the backend switches to Reconfigured,
pcifront_attach_devices() will pick them up again.
Signed-off-by: default avatarJason Andryuk <jandryuk@gmail.com>
Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20220829151536.8578-1-jandryuk@gmail.comSigned-off-by: default avatarJuergen Gross <jgross@suse.com>
      728c2edf
  17. 02 Oct, 2022 4 commits
  19. 01 Oct, 2022 9 commits
  21. 30 Sep, 2022 8 commits
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2022-10-01' of git://anongit.freedesktop.org/drm/drm · ffb4d94b
      Linus Torvalds authored 
      Pull drm fixes from Daniel Vetter:
 "Some last minute amd fixes:

   - VCN 4.x and GC 11.x fixes, mostly around fw"

* tag 'drm-fixes-2022-10-01' of git://anongit.freedesktop.org/drm/drm:
  drm/amdgpu/gfx11: switch to amdgpu_gfx_rlc_init_microcode
  drm/amdgpu: add helper to init rlc firmware
  drm/amdgpu: add helper to init rlc fw in header v2_4
  drm/amdgpu: add helper to init rlc fw in header v2_3
  drm/amdgpu: add helper to init rlc fw in header v2_2
  drm/amdgpu: add helper to init rlc fw in header v2_1
  drm/amdgpu: add helper to init rlc fw in header v2_0
  drm/amdgpu: save rlcv/rlcp ucode version in amdgpu_gfx
  drm/amdgpu: Enable sram on vcn_4_0_2
  drm/amdgpu: Enable VCN DPG for GC11_0_1
      ffb4d94b
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · e5fa173f
      Linus Torvalds authored 
      Pull clk driver fixes from Stephen Boyd:
 "Here's the last batch of clk driver fixes for this release.

  These patches fix serious problems, for example, i.MX has an issue
  where changing the NAND clk frequency hangs the system. On Allwinner
  H6 the GPU is being overclocked which could lead to long term hardware
  damage.

  And finally on some Broadcom SoCs the serial console stopped working
  because the clk tree hierarchy description got broken by an
  inadvertant DT node name change. That's fixed by using
  'clock-output-names' to generate a stable and unique name for clks so
  the framework can properly link things up.

  There's also a couple build fixes in here. One to fix CONFIG_OF=n
  builds and one to avoid an array out of bounds bug that happens during
  clk registration on microchip. I hope that KASAN would have found that
  OOB problem, but probably KASAN wasn't attempted. Instead LLVM/clang
  compilation caused an oops, while GCC didn't"

* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
  clk: imx93: drop of_match_ptr
  clk: iproc: Do not rely on node name for correct PLL setup
  clk: sunxi-ng: h6: Fix default PLL GPU rate
  clk: imx: imx6sx: remove the SET_RATE_PARENT flag for QSPI clocks
  clk: microchip: mpfs: make the rtc's ahb clock critical
  clk: microchip: mpfs: fix clk_cfg array bounds violation
  clk: ingenic-tcu: Properly enable registers before accessing timers
      e5fa173f
    • Linus Torvalds's avatar
      Merge tag 'perf-tools-fixes-for-v6.0-2022-09-29' of... · c816f2e9
      Linus Torvalds authored 
      Merge tag 'perf-tools-fixes-for-v6.0-2022-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux

Pull perf tools fixes from Arnaldo Carvalho de Melo:

 - Fail the 'perf test record' entry on error, fixing a regression where
   just setup stuff like allocating memory and not the actual things
   being tested failed.

 - Fixup disabling of -Wdeprecated-declarations for the python scripting
   engine, the previous attempt had a brown paper bag thinko.

 - Fix branch stack sampling test to include sanity check for branch
   filter on PowerPC.

 - Update is_ignored_symbol function to match the kernel ignored list,
   fixing running the 'perf test' entry that compares resolving symbols
   from kallsyms to resolving from vmlinux.

 - Augment the data source type with ARM's neoverse_spe list, the
   previous code was limited in its search resolving the data source.

 - Fix some clang 5 variable set but unused cases.

 - Get a perf cgroup more portably in BPF as the
   __builtin_preserve_enum_value builtin is not available in older
   versions of clang. In those cases we can forgo BPF's CO-RE (Compile
   Once, Run Everywhere).

 - More Fixes for Intel's hybrid CPU model.

* tag 'perf-tools-fixes-for-v6.0-2022-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
  perf build: Fixup disabling of -Wdeprecated-declarations for the python scripting engine
  perf tests mmap-basic: Remove unused variable to address clang 15 warning
  perf parse-events: Ignore clang 15 warning about variable set but unused in bison produced code
  perf tests record: Fail the test if the 'errs' counter is not zero
  perf test: Fix test case 87 ("perf record tests") for hybrid systems
  perf arm-spe: augment the data source type with neoverse_spe list
  perf tests vmlinux-kallsyms: Update is_ignored_symbol function to match the kernel ignored list
  perf tests powerpc: Fix branch stack sampling test to include sanity check for branch filter
  perf parse-events: Remove "not supported" hybrid cache events
  perf print-events: Fix "perf list" can not display the PMU prefix for some hybrid cache events
  perf tools: Get a perf cgroup more portably in BPF
      c816f2e9
    • Linus Torvalds's avatar
      Merge tag 'for-linus-6.0' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 920541bb
      Linus Torvalds authored 
      Pull kvm fixes from Paolo Bonzini:
 "A small fix to the reported set of supported CPUID bits, and selftests
  fixes:

   - Skip tests that require EPT when it is not available

   - Do not hang when a test fails with an empty stack trace

   - avoid spurious failure when running access_tracking_perf_test in a
     KVM guest

   - work around GCC's tendency to optimize loops into mem*() functions,
     which breaks because the guest code in selftests cannot call into
     PLTs

   - fix -Warray-bounds error in fix_hypercall_test"

* tag 'for-linus-6.0' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: selftests: Compare insn opcodes directly in fix_hypercall_test
  KVM: selftests: Implement memcmp(), memcpy(), and memset() for guest use
  KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest
  KVM: selftests: Gracefully handle empty stack traces
  KVM: selftests: replace assertion with warning in access_tracking_perf_test
  KVM: selftests: Skip tests that require EPT when it is not available
      920541bb
    • Daniel Vetter's avatar
      Merge tag 'amd-drm-fixes-6.0-2022-09-30-1' of... · 414208e4
      Daniel Vetter authored 
      Merge tag 'amd-drm-fixes-6.0-2022-09-30-1' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes

amd-drm-fixes-6.0-2022-09-30-1:

amdgpu:
- VCN 4.x fixes
- RLC fixes for GC 11.x
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220930210454.542719-1-alexander.deucher@amd.com
      414208e4
    • Hawking Zhang's avatar
      drm/amdgpu/gfx11: switch to amdgpu_gfx_rlc_init_microcode · 0fd85e89
      Hawking Zhang authored 
      switch to common helper to initialize rlc firmware
for gfx11
Signed-off-by: default avatarHawking Zhang <Hawking.Zhang@amd.com>
Acked-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      0fd85e89
    • Hawking Zhang's avatar
      drm/amdgpu: add helper to init rlc firmware · 04fa38cc
      Hawking Zhang authored 
      To initialzie rlc firmware according to rlc
firmware header version

v2: squash in backwards compat fix
Signed-off-by: default avatarHawking Zhang <Hawking.Zhang@amd.com>
Acked-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      04fa38cc
    • Hawking Zhang's avatar
      drm/amdgpu: add helper to init rlc fw in header v2_4 · b33139ee
      Hawking Zhang authored 
      To initialize rlc firmware in header v2_4
Signed-off-by: default avatarHawking Zhang <Hawking.Zhang@amd.com>
Acked-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      b33139ee
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7