1. 12 Oct, 2022 1 commit
  2. 11 Oct, 2022 4 commits
  3. 10 Oct, 2022 1 commit
  4. 07 Oct, 2022 3 commits
  5. 06 Oct, 2022 5 commits
    • M. Vefa Bicakci's avatar
      xen/gntdev: Accommodate VMA splitting · 5c13a4a0
      M. Vefa Bicakci authored
      Prior to this commit, the gntdev driver code did not handle the
      following scenario correctly with paravirtualized (PV) Xen domains:
      
      * User process sets up a gntdev mapping composed of two grant mappings
        (i.e., two pages shared by another Xen domain).
      * User process munmap()s one of the pages.
      * User process munmap()s the remaining page.
      * User process exits.
      
      In the scenario above, the user process would cause the kernel to log
      the following messages in dmesg for the first munmap(), and the second
      munmap() call would result in similar log messages:
      
        BUG: Bad page map in process doublemap.test  pte:... pmd:...
        page:0000000057c97bff refcount:1 mapcount:-1 \
          mapping:0000000000000000 index:0x0 pfn:...
        ...
        page dumped because: bad pte
        ...
        file:gntdev fault:0x0 mmap:gntdev_mmap [xen_gntdev] readpage:0x0
        ...
        Call Trace:
         <TASK>
         dump_stack_lvl+0x46/0x5e
         print_bad_pte.cold+0x66/0xb6
         unmap_page_range+0x7e5/0xdc0
         unmap_vmas+0x78/0xf0
         unmap_region+0xa8/0x110
         __do_munmap+0x1ea/0x4e0
         __vm_munmap+0x75/0x120
         __x64_sys_munmap+0x28/0x40
         do_syscall_64+0x38/0x90
         entry_SYSCALL_64_after_hwframe+0x61/0xcb
         ...
      
      For each munmap() call, the Xen hypervisor (if built with CONFIG_DEBUG)
      would print out the following and trigger a general protection fault in
      the affected Xen PV domain:
      
        (XEN) d0v... Attempt to implicitly unmap d0's grant PTE ...
        (XEN) d0v... Attempt to implicitly unmap d0's grant PTE ...
      
      As of this writing, gntdev_grant_map structure's vma field (referred to
      as map->vma below) is mainly used for checking the start and end
      addresses of mappings. However, with split VMAs, these may change, and
      there could be more than one VMA associated with a gntdev mapping.
      Hence, remove the use of map->vma and rely on map->pages_vm_start for
      the original start address and on (map->count << PAGE_SHIFT) for the
      original mapping size. Let the invalidate() and find_special_page()
      hooks use these.
      
      Also, given that there can be multiple VMAs associated with a gntdev
      mapping, move the "mmu_interval_notifier_remove(&map->notifier)" call to
      the end of gntdev_put_map, so that the MMU notifier is only removed
      after the closing of the last remaining VMA.
      
      Finally, use an atomic to prevent inadvertent gntdev mapping re-use,
      instead of using the map->live_grants atomic counter and/or the map->vma
      pointer (the latter of which is now removed). This prevents the
      userspace from mmap()'ing (with MAP_FIXED) a gntdev mapping over the
      same address range as a previously set up gntdev mapping. This scenario
      can be summarized with the following call-trace, which was valid prior
      to this commit:
      
        mmap
          gntdev_mmap
        mmap (repeat mmap with MAP_FIXED over the same address range)
          gntdev_invalidate
            unmap_grant_pages (sets 'being_removed' entries to true)
              gnttab_unmap_refs_async
          unmap_single_vma
          gntdev_mmap (maps the shared pages again)
        munmap
          gntdev_invalidate
            unmap_grant_pages
              (no-op because 'being_removed' entries are true)
          unmap_single_vma (For PV domains, Xen reports that a granted page
            is being unmapped and triggers a general protection fault in the
            affected domain, if Xen was built with CONFIG_DEBUG)
      
      The fix for this last scenario could be worth its own commit, but we
      opted for a single commit, because removing the gntdev_grant_map
      structure's vma field requires guarding the entry to gntdev_mmap(), and
      the live_grants atomic counter is not sufficient on its own to prevent
      the mmap() over a pre-existing mapping.
      
      Link: https://github.com/QubesOS/qubes-issues/issues/7631
      Fixes: ab31523c ("xen/gntdev: allow usermode to map granted pages")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarM. Vefa Bicakci <m.v.b@runbox.com>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Link: https://lore.kernel.org/r/20221002222006.2077-3-m.v.b@runbox.comSigned-off-by: default avatarJuergen Gross <jgross@suse.com>
      5c13a4a0
    • M. Vefa Bicakci's avatar
      xen/gntdev: Prevent leaking grants · 0991028c
      M. Vefa Bicakci authored
      Prior to this commit, if a grant mapping operation failed partially,
      some of the entries in the map_ops array would be invalid, whereas all
      of the entries in the kmap_ops array would be valid. This in turn would
      cause the following logic in gntdev_map_grant_pages to become invalid:
      
        for (i = 0; i < map->count; i++) {
          if (map->map_ops[i].status == GNTST_okay) {
            map->unmap_ops[i].handle = map->map_ops[i].handle;
            if (!use_ptemod)
              alloced++;
          }
          if (use_ptemod) {
            if (map->kmap_ops[i].status == GNTST_okay) {
              if (map->map_ops[i].status == GNTST_okay)
                alloced++;
              map->kunmap_ops[i].handle = map->kmap_ops[i].handle;
            }
          }
        }
        ...
        atomic_add(alloced, &map->live_grants);
      
      Assume that use_ptemod is true (i.e., the domain mapping the granted
      pages is a paravirtualized domain). In the code excerpt above, note that
      the "alloced" variable is only incremented when both kmap_ops[i].status
      and map_ops[i].status are set to GNTST_okay (i.e., both mapping
      operations are successful).  However, as also noted above, there are
      cases where a grant mapping operation fails partially, breaking the
      assumption of the code excerpt above.
      
      The aforementioned causes map->live_grants to be incorrectly set. In
      some cases, all of the map_ops mappings fail, but all of the kmap_ops
      mappings succeed, meaning that live_grants may remain zero. This in turn
      makes it impossible to unmap the successfully grant-mapped pages pointed
      to by kmap_ops, because unmap_grant_pages has the following snippet of
      code at its beginning:
      
        if (atomic_read(&map->live_grants) == 0)
          return; /* Nothing to do */
      
      In other cases where only some of the map_ops mappings fail but all
      kmap_ops mappings succeed, live_grants is made positive, but when the
      user requests unmapping the grant-mapped pages, __unmap_grant_pages_done
      will then make map->live_grants negative, because the latter function
      does not check if all of the pages that were requested to be unmapped
      were actually unmapped, and the same function unconditionally subtracts
      "data->count" (i.e., a value that can be greater than map->live_grants)
      from map->live_grants. The side effects of a negative live_grants value
      have not been studied.
      
      The net effect of all of this is that grant references are leaked in one
      of the above conditions. In Qubes OS v4.1 (which uses Xen's grant
      mechanism extensively for X11 GUI isolation), this issue manifests
      itself with warning messages like the following to be printed out by the
      Linux kernel in the VM that had granted pages (that contain X11 GUI
      window data) to dom0: "g.e. 0x1234 still pending", especially after the
      user rapidly resizes GUI VM windows (causing some grant-mapping
      operations to partially or completely fail, due to the fact that the VM
      unshares some of the pages as part of the window resizing, making the
      pages impossible to grant-map from dom0).
      
      The fix for this issue involves counting all successful map_ops and
      kmap_ops mappings separately, and then adding the sum to live_grants.
      During unmapping, only the number of successfully unmapped grants is
      subtracted from live_grants. The code is also modified to check for
      negative live_grants values after the subtraction and warn the user.
      
      Link: https://github.com/QubesOS/qubes-issues/issues/7631
      Fixes: dbe97cff ("xen/gntdev: Avoid blocking in unmap_grant_pages()")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarM. Vefa Bicakci <m.v.b@runbox.com>
      Acked-by: default avatarDemi Marie Obenour <demi@invisiblethingslab.com>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Link: https://lore.kernel.org/r/20221002222006.2077-2-m.v.b@runbox.comSigned-off-by: default avatarJuergen Gross <jgross@suse.com>
      0991028c
    • Oleksandr Tyshchenko's avatar
      xen/virtio: Fix potential deadlock when accessing xen_grant_dma_devices · 77be00f1
      Oleksandr Tyshchenko authored
      As find_xen_grant_dma_data() is called from both interrupt and process
      contexts, the access to xen_grant_dma_devices XArray must be protected
      by xa_lock_irqsave to avoid deadlock scenario.
      As XArray API doesn't provide xa_store_irqsave helper, call lockless
      __xa_store directly and guard it externally.
      
      Also move the storage of the XArray's entry to a separate helper.
      
      Fixes: d6aca350 ("xen/grant-dma-ops: Add option to restrict memory access under Xen")
      Signed-off-by: default avatarOleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
      Reviewed-by: default avatarStefano Stabellini <sstabellini@kernel.org>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Link: https://lore.kernel.org/r/20221005174823.1800761-3-olekstysh@gmail.comSigned-off-by: default avatarJuergen Gross <jgross@suse.com>
      77be00f1
    • Oleksandr Tyshchenko's avatar
      xen/virtio: Fix n_pages calculation in xen_grant_dma_map(unmap)_page() · e433715b
      Oleksandr Tyshchenko authored
      Take page offset into the account when calculating the number of pages
      to be granted.
      
      Fixes: d6aca350 ("xen/grant-dma-ops: Add option to restrict memory access under Xen")
      Signed-off-by: default avatarOleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
      Reviewed-by: default avatarStefano Stabellini <sstabellini@kernel.org>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Link: https://lore.kernel.org/r/20221005174823.1800761-2-olekstysh@gmail.comSigned-off-by: default avatarJuergen Gross <jgross@suse.com>
      e433715b
    • Colin Ian King's avatar
      xen/xenbus: Fix spelling mistake "hardward" -> "hardware" · 06c62f8c
      Colin Ian King authored
      There is a spelling mistake in the module description. Fix it.
      Signed-off-by: default avatarColin Ian King <colin.i.king@gmail.com>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Link: https://lore.kernel.org/r/20221004160639.154421-1-colin.i.king@gmail.comSigned-off-by: default avatarJuergen Gross <jgross@suse.com>
      06c62f8c
  6. 04 Oct, 2022 1 commit
    • Jason Andryuk's avatar
      xen-pcifront: Handle missed Connected state · 728c2edf
      Jason Andryuk authored
      An HVM guest with linux stubdomain and 2 PCI devices failed to start as
      libxl timed out waiting for the PCI devices to be added.  It happens
      intermittently but with some regularity.  libxl wrote the two xenstore
      entries for the devices, but then timed out waiting for backend state 4
      (Connected) - the state stayed at 7 (Reconfiguring).  (PCI passthrough
      to an HVM with stubdomain is PV passthrough to the stubdomain and then
      HVM passthrough with the QEMU inside the stubdomain.)
      
      The stubdomain kernel never printed "pcifront pci-0: Installing PCI
      frontend", so it seems to have missed state 4 which would have
      called pcifront_try_connect() -> pcifront_connect_and_init_dma()
      
      Have pcifront_detach_devices() special-case state Initialised and call
      pcifront_connect_and_init_dma().  Don't use pcifront_try_connect()
      because that sets the xenbus state which may throw off the backend.
      After connecting, skip the remainder of detach_devices since none have
      been initialized yet.  When the backend switches to Reconfigured,
      pcifront_attach_devices() will pick them up again.
      Signed-off-by: default avatarJason Andryuk <jandryuk@gmail.com>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Link: https://lore.kernel.org/r/20220829151536.8578-1-jandryuk@gmail.comSigned-off-by: default avatarJuergen Gross <jgross@suse.com>
      728c2edf
  7. 02 Oct, 2022 4 commits
  8. 01 Oct, 2022 9 commits
  9. 30 Sep, 2022 12 commits