linux-stable.git/drivers/vfio, branch linux-5.6.y

vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()

2020-05-06T06:16:44+00:00

commit 5cbf3264bc715e9eb384e2b68601f8c02bb9a61d upstream.

Use follow_pfn() to get the PFN of a PFNMAP VMA instead of assuming that
vma->vm_pgoff holds the base PFN of the VMA.  This fixes a bug where
attempting to do VFIO_IOMMU_MAP_DMA on an arbitrary PFNMAP'd region of
memory calculates garbage for the PFN.

Hilariously, this only got detected because the first "PFN" calculated
by vaddr_get_pfn() is PFN 0 (vma->vm_pgoff==0), and iommu_iova_to_phys()
uses PA==0 as an error, which triggers a WARN in vfio_unmap_unpin()
because the translation "failed".  PFN 0 is now unconditionally reserved
on x86 in order to mitigate L1TF, which causes is_invalid_reserved_pfn()
to return true and in turns results in vaddr_get_pfn() returning success
for PFN 0.  Eventually the bogus calculation runs into PFNs that aren't
reserved and leads to failure in vfio_pin_map_dma().  The subsequent
call to vfio_remove_dma() attempts to unmap PFN 0 and WARNs.

  WARNING: CPU: 8 PID: 5130 at drivers/vfio/vfio_iommu_type1.c:750 vfio_unmap_unpin+0x2e1/0x310 [vfio_iommu_type1]
  Modules linked in: vfio_pci vfio_virqfd vfio_iommu_type1 vfio ...
  CPU: 8 PID: 5130 Comm: sgx Tainted: G        W         5.6.0-rc5-705d787c7fee-vfio+ #3
  Hardware name: Intel Corporation Mehlow UP Server Platform/Moss Beach Server, BIOS CNLSE2R1.D00.X119.B49.1803010910 03/01/2018
  RIP: 0010:vfio_unmap_unpin+0x2e1/0x310 [vfio_iommu_type1]
  Code: <0f> 0b 49 81 c5 00 10 00 00 e9 c5 fe ff ff bb 00 10 00 00 e9 3d fe
  RSP: 0018:ffffbeb5039ebda8 EFLAGS: 00010246
  RAX: 0000000000000000 RBX: ffff9a55cbf8d480 RCX: 0000000000000000
  RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff9a52b771c200
  RBP: 0000000000000000 R08: 0000000000000040 R09: 00000000fffffff2
  R10: 0000000000000001 R11: ffff9a51fa896000 R12: 0000000184010000
  R13: 0000000184000000 R14: 0000000000010000 R15: ffff9a55cb66ea08
  FS:  00007f15d3830b40(0000) GS:ffff9a55d5600000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000561cf39429e0 CR3: 000000084f75f005 CR4: 00000000003626e0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   vfio_remove_dma+0x17/0x70 [vfio_iommu_type1]
   vfio_iommu_type1_ioctl+0x9e3/0xa7b [vfio_iommu_type1]
   ksys_ioctl+0x92/0xb0
   __x64_sys_ioctl+0x16/0x20
   do_syscall_64+0x4c/0x180
   entry_SYSCALL_64_after_hwframe+0x44/0xa9
  RIP: 0033:0x7f15d04c75d7
  Code: <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48

Fixes: 73fa0d10d077 ("vfio: Type1 IOMMU implementation")
Signed-off-by: Sean Christopherson 
Signed-off-by: Alex Williamson 
Signed-off-by: Greg Kroah-Hartman

vfio: avoid possible overflow in vfio_iommu_type1_pin_pages

2020-05-06T06:16:44+00:00

commit 0ea971f8dcd6dee78a9a30ea70227cf305f11ff7 upstream.

add parentheses to avoid possible vaddr overflow.

Fixes: a54eb55045ae ("vfio iommu type1: Add support for mediated devices")
Signed-off-by: Yan Zhao 
Signed-off-by: Alex Williamson 
Signed-off-by: Greg Kroah-Hartman

vfio: platform: Switch to platform_get_irq_optional()

2020-04-17T14:13:41+00:00

commit 723fe298ad85ad1278bd2312469ad14738953cc6 upstream.

Since commit 7723f4c5ecdb ("driver core: platform: Add an error
message to platform_get_irq*()"), platform_get_irq() calls dev_err()
on an error. As we enumerate all interrupts until platform_get_irq()
fails, we now systematically get a message such as:
"vfio-platform fff51000.ethernet: IRQ index 3 not found" which is
a false positive.

Let's use platform_get_irq_optional() instead.

Signed-off-by: Eric Auger 
Cc: stable@vger.kernel.org # v5.3+
Reviewed-by: Andre Przywara 
Tested-by: Andre Przywara 
Signed-off-by: Alex Williamson 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'vfio-v5.6-rc1' of git://github.com/awilliam/linux-vfio

2020-02-03T22:22:05+00:00

Pull VFIO updates from Alex Williamson:

 - Fix nvlink error path (Alexey Kardashevskiy)

 - Update nvlink and spapr to use mmgrab() (Julia Lawall)

 - Update static declaration (Ben Dooks)

 - Annotate __iomem to fix sparse warnings (Ben Dooks)

* tag 'vfio-v5.6-rc1' of git://github.com/awilliam/linux-vfio:
  vfio: platform: fix __iomem in vfio_platform_amdxgbe.c
  vfio/mdev: make create attribute static
  vfio/spapr_tce: use mmgrab
  vfio: vfio_pci_nvlink2: use mmgrab
  vfio/spapr/nvlink2: Skip unpinning pages on error exit

mm, tree-wide: rename put_user_page() to unpin_user_page()

2020-01-31T18:30:38+00:00

In order to provide a clearer, more symmetric API for pinning and
unpinning DMA pages.  This way, pin_user_pages*() calls match up with
unpin_user_pages*() calls, and the API is a lot closer to being
self-explanatory.

Link: http://lkml.kernel.org/r/20200107224558.2362728-23-jhubbard@nvidia.com
Signed-off-by: John Hubbard 
Reviewed-by: Jan Kara 
Cc: Alex Williamson 
Cc: Aneesh Kumar K.V 
Cc: Björn Töpel 
Cc: Christoph Hellwig 
Cc: Daniel Vetter 
Cc: Dan Williams 
Cc: Hans Verkuil 
Cc: Ira Weiny 
Cc: Jason Gunthorpe 
Cc: Jason Gunthorpe 
Cc: Jens Axboe 
Cc: Jerome Glisse 
Cc: Jonathan Corbet 
Cc: Kirill A. Shutemov 
Cc: Leon Romanovsky 
Cc: Mauro Carvalho Chehab 
Cc: Mike Rapoport 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

vfio, mm: pin_user_pages (FOLL_PIN) and put_user_page() conversion

2020-01-31T18:30:38+00:00

1. Change vfio from get_user_pages_remote(), to
   pin_user_pages_remote().

2. Because all FOLL_PIN-acquired pages must be released via
   put_user_page(), also convert the put_page() call over to
   put_user_pages_dirty_lock().

Note that this effectively changes the code's behavior in
vfio_iommu_type1.c: put_pfn(): it now ultimately calls
set_page_dirty_lock(), instead of set_page_dirty().  This is probably
more accurate.

As Christoph Hellwig put it, "set_page_dirty() is only safe if we are
dealing with a file backed page where we have reference on the inode it
hangs off." [1]

[1] https://lore.kernel.org/r/20190723153640.GB720@lst.de

Link: http://lkml.kernel.org/r/20200107224558.2362728-20-jhubbard@nvidia.com
Signed-off-by: John Hubbard 
Tested-by: Alex Williamson 
Acked-by: Alex Williamson 
Cc: Aneesh Kumar K.V 
Cc: Björn Töpel 
Cc: Christoph Hellwig 
Cc: Daniel Vetter 
Cc: Dan Williams 
Cc: Hans Verkuil 
Cc: Ira Weiny 
Cc: Jan Kara 
Cc: Jason Gunthorpe 
Cc: Jason Gunthorpe 
Cc: Jens Axboe 
Cc: Jerome Glisse 
Cc: Jonathan Corbet 
Cc: Kirill A. Shutemov 
Cc: Leon Romanovsky 
Cc: Mauro Carvalho Chehab 
Cc: Mike Rapoport 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

vfio: fix FOLL_LONGTERM use, simplify get_user_pages_remote() call

2020-01-31T18:30:37+00:00

Update VFIO to take advantage of the recently loosened restriction on
FOLL_LONGTERM with get_user_pages_remote().  Also, now it is possible to
fix a bug: the VFIO caller is logically a FOLL_LONGTERM user, but it
wasn't setting FOLL_LONGTERM.

Also, remove an unnessary pair of calls that were releasing and
reacquiring the mmap_sem.  There is no need to avoid holding mmap_sem
just in order to call page_to_pfn().

Also, now that the the DAX check ("if a VMA is DAX, don't allow long
term pinning") is in the internals of get_user_pages_remote() and
__gup_longterm_locked(), there's no need for it at the VFIO call site.  So
remove it.

Link: http://lkml.kernel.org/r/20200107224558.2362728-8-jhubbard@nvidia.com
Signed-off-by: John Hubbard 
Tested-by: Alex Williamson 
Acked-by: Alex Williamson 
Reviewed-by: Jason Gunthorpe 
Reviewed-by: Ira Weiny 
Suggested-by: Jason Gunthorpe 
Cc: Dan Williams 
Cc: Jerome Glisse 
Cc: Aneesh Kumar K.V 
Cc: Björn Töpel 
Cc: Christoph Hellwig 
Cc: Daniel Vetter 
Cc: Hans Verkuil 
Cc: Jan Kara 
Cc: Jens Axboe 
Cc: Jonathan Corbet 
Cc: Kirill A. Shutemov 
Cc: Leon Romanovsky 
Cc: Mauro Carvalho Chehab 
Cc: Mike Rapoport 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

vfio: platform: fix __iomem in vfio_platform_amdxgbe.c

2020-01-09T18:32:14+00:00

The ioaddr should have __iomem marker on it, so add that to fix
the following sparse warnings:

drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:33:44: warning: incorrect type in argument 2 (different address spaces)
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:33:44:    expected void volatile [noderef]  *addr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:33:44:    got void *
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:34:33: warning: incorrect type in argument 1 (different address spaces)
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:34:33:    expected void const volatile [noderef]  *addr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:34:33:    got void *
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:44:44: warning: incorrect type in argument 2 (different address spaces)
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:44:44:    expected void volatile [noderef]  *addr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:44:44:    got void *
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:45:33: warning: incorrect type in argument 2 (different address spaces)
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:45:33:    expected void volatile [noderef]  *addr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:45:33:    got void *
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:69:41: warning: incorrect type in argument 1 (different address spaces)
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:69:41:    expected void *ioaddr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:69:41:    got void [noderef]  *ioaddr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:71:30: warning: incorrect type in argument 1 (different address spaces)
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:71:30:    expected void *ioaddr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:71:30:    got void [noderef]  *ioaddr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:76:49: warning: incorrect type in argument 1 (different address spaces)
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:76:49:    expected void *ioaddr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:76:49:    got void [noderef]  *ioaddr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:85:37: warning: incorrect type in argument 1 (different address spaces)
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:85:37:    expected void *ioaddr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:85:37:    got void [noderef]  *ioaddr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:87:30: warning: incorrect type in argument 1 (different address spaces)
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:87:30:    expected void *ioaddr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:87:30:    got void [noderef]  *ioaddr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:90:30: warning: incorrect type in argument 1 (different address spaces)
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:90:30:    expected void *ioaddr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:90:30:    got void [noderef]  *ioaddr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:93:30: warning: incorrect type in argument 1 (different address spaces)
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:93:30:    expected void *ioaddr
drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:93:30:    got void [noderef]  *ioaddr

Signed-off-by: Ben Dooks (Codethink) 
Acked-by: Eric Auger 
Signed-off-by: Alex Williamson

vfio/mdev: make create attribute static

2020-01-09T18:30:57+00:00

The create attribute is not exported, so make it
static to avoid the following sparse warning:

drivers/vfio/mdev/mdev_sysfs.c:77:1: warning: symbol 'mdev_type_attr_create' was not declared. Should it be static?

Signed-off-by: Ben Dooks (Codethink) 
Reviewed-by: Cornelia Huck 
Signed-off-by: Alex Williamson

vfio/spapr_tce: use mmgrab

2020-01-07T20:03:12+00:00

Mmgrab was introduced in commit f1f1007644ff ("mm: add new mmgrab()
helper") and most of the kernel was updated to use it. Update a
remaining file.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)


@@ expression e; @@
- atomic_inc(&e->mm_count);
+ mmgrab(e);


Signed-off-by: Julia Lawall 
Reviewed-by: Cornelia Huck 
Signed-off-by: Alex Williamson