linux-stable.git/kernel/irq/msi.c, branch linux-6.2.y

genirq/msi: Take the per-device MSI lock before validating the control structure

2023-03-10T08:29:48+00:00

commit 0af2795f936f1ea1f9f1497447145dfcc7ed2823 upstream.

Calling msi_ctrl_valid() ultimately results in calling
msi_get_device_domain(), which requires holding the device MSI lock.

However, in msi_domain_populate_irqs() the lock is taken right after having
called msi_ctrl_valid(), which is just a tad too late.

Take the lock before invoking msi_ctrl_valid().

Fixes: 40742716f294 ("genirq/msi: Make msi_add_simple_msi_descs() device domain aware")
Reported-by: "Russell King (Oracle)" 
Signed-off-by: Marc Zyngier 
Signed-off-by: Thomas Gleixner 
Tested-by: Russell King (Oracle) 
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/Y/Opu6ETe3ZzZ/8E@shell.armlinux.org.uk
Link: https://lore.kernel.org/r/20230220190101.314446-1-maz@kernel.org
Signed-off-by: Greg Kroah-Hartman

genirq/msi, platform-msi: Ensure that MSI descriptors are unreferenced

2023-03-10T08:29:48+00:00

commit 0fb7fb713461e44b12e72c292bf90ee300f40710 upstream.

Miquel reported a warning in the MSI core which is triggered when
interrupts are freed via platform_msi_device_domain_free().

This code got reworked to use core functions for freeing the MSI
descriptors, but nothing took care to clear the msi_desc->irq entry, which
then triggers the warning in msi_free_msi_desc() which uses desc->irq to
validate that the descriptor has been torn down. The same issue exists in
msi_domain_populate_irqs().

Up to the point that msi_free_msi_descs() grew a warning for this case,
this went un-noticed.

Provide the counterpart of msi_domain_populate_irqs() and invoke it in
platform_msi_device_domain_free() before freeing the interrupts and MSI
descriptors and also in the error path of msi_domain_populate_irqs().

Fixes: 2f2940d16823 ("genirq/msi: Remove filter from msi_free_descs_free_range()")
Reported-by: Miquel Raynal 
Signed-off-by: Thomas Gleixner 
Tested-by: Miquel Raynal 
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/87mt4wkwnv.ffs@tglx
Signed-off-by: Greg Kroah-Hartman

genirq/msi: Free the fwnode created by msi_create_device_irq_domain()

2023-01-17T21:57:04+00:00

msi_create_device_irq_domain() creates a firmware node for the new domain,
which is never freed. kmemleak reports:

unreferenced object 0xffff888120ba9a00 (size 96):
  comm "systemd-modules", pid 221, jiffies 4294893411 (age 635.732s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 e0 19 8b 83 ff ff ff ff  ................
    00 00 00 00 00 00 00 00 18 9a ba 20 81 88 ff ff  ........... ....
  backtrace:
    [<000000008cdbc98d>] __irq_domain_alloc_fwnode+0x51/0x2b0
    [<00000000c57acf9d>] msi_create_device_irq_domain+0x283/0x670
    [<000000009b567982>] __pci_enable_msix_range+0x49e/0xdb0
    [<0000000077cc1445>] pci_alloc_irq_vectors_affinity+0x11f/0x1c0
    [<00000000532e9ef5>] mlx5_irq_table_create+0x24c/0x940 [mlx5_core]
    [<00000000fabd2b80>] mlx5_load+0x1fa/0x680 [mlx5_core]
    [<000000006bb22ae4>] mlx5_init_one+0x485/0x670 [mlx5_core]
    [<00000000eaa5e1ad>] probe_one+0x4c2/0x720 [mlx5_core]
    [<00000000df8efb43>] local_pci_probe+0xd6/0x170
    [<0000000085cb9924>] pci_device_probe+0x231/0x6e0

Use the proper free operation for the firmware wnode so the name is freed
during error unwind of msi_create_device_irq_domain() and also free the
node in msi_remove_device_irq_domain() if it was automatically allocated.

To avoid extra NULL pointer checks make irq_domain_free_fwnode() tolerant
of NULL.

Fixes: 27a6dea3ebaa ("genirq/msi: Provide msi_create/free_device_irq_domain()")
Reported-by: Omri Barazi 
Signed-off-by: Jason Gunthorpe 
Signed-off-by: Thomas Gleixner 
Tested-by: Kalle Valo 
Tested-by: Leon Romanovsky 
Link: https://lore.kernel.org/r/0-v2-24af6665e2da+c9-msi_leak_jgg@nvidia.com

genirq/msi: Return MSI_XA_DOMAIN_SIZE as the maximum MSI index when no domain is present

2022-12-16T14:04:04+00:00

On architectures such as s390 that do not use irq domains for MSI,
returning 0 as the maximum MSI index is a bit counter-productive,
as it indicates that no MSI can be allocated. Bad idea.

Instead, return the maximum we're willing to support in the MSI
backing store (MSI_XA_DOMAIN_SIZE), and let the arch code do its
usual thing.

Thanks to Matthew Rosato for fixing the fix.

Reported-by: Guenter Roeck 
Signed-off-by: Thomas Gleixner 
[maz: commit message]
Signed-off-by: Marc Zyngier 
Link: https://lore.kernel.org/r/87fsdgzpqs.ffs@tglx

genirq/msi: Check for the presence of an irq domain when validating msi_ctrl

2022-12-16T13:27:18+00:00

For architectures such as s390 and powerpc that do not use
irq domains for MSIs, dev->msi.domain is always NULL, so
the per-device, per-bus MSI domain is also guaranteed to
be NULL.

So checking one without checking the other is bound to result
in a splat, followed by a memory leak as we don't free the MSI
descriptors.

Add the missing check.

Reported-by: Matthew Rosato 
Signed-off-by: Marc Zyngier 
Link: https://lore.kernel.org/r/e570e70d-19bc-101b-0481-ff9a3cab3504@linux.ibm.com

genirq/msi: Provide msi_domain_alloc_irq_at()

2022-12-05T21:22:34+00:00

For supporting post MSI-X enable allocations and for the upcoming PCI/IMS
support a separate interface is required which allows not only the
allocation of a specific index, but also the allocation of any, i.e. the
next free index. The latter is especially required for IMS because IMS
completely does away with index to functionality mappings which are
often found in MSI/MSI-X implementation.

But even with MSI-X there are devices where only the first few indices have
a fixed functionality and the rest is freely assignable by software,
e.g. to queues.

msi_domain_alloc_irq_at() is also different from the range based interfaces
as it always enforces that the MSI descriptor is allocated by the core code
and not preallocated by the caller like the PCI/MSI[-X] enable code path
does.

msi_domain_alloc_irq_at() can be invoked with the index argument set to
MSI_ANY_INDEX which makes the core code pick the next free index. The irq
domain can provide a prepare_desc() operation callback in it's
msi_domain_ops to do domain specific post allocation initialization before
the actual Linux interrupt and the associated interrupt descriptor and
hierarchy alloccations are conducted.

The function also takes an optional @icookie argument which is of type
union msi_instance_cookie. This cookie is not used by the core code and is
stored in the allocated msi_desc::data::icookie. The meaning of the cookie
is completely implementation defined. In case of IMS this might be a PASID
or a pointer to a device queue, but for the MSI core it's opaque and not
used in any way.

The function returns a struct msi_map which on success contains the
allocated index number and the Linux interrupt number so the caller can
spare the index to Linux interrupt number lookup.

On failure map::index contains the error code and map::virq is 0.

Signed-off-by: Thomas Gleixner 
Reviewed-by: Kevin Tian 
Acked-by: Marc Zyngier 
Link: https://lore.kernel.org/r/20221124232326.501359457@linutronix.de

genirq/msi: Provide msi_domain_ops:: Prepare_desc()

2022-12-05T21:22:33+00:00

The existing MSI domain ops msi_prepare() and set_desc() turned out to be
unsuitable for implementing IMS support.

msi_prepare() does not operate on the MSI descriptors. set_desc() lacks
an irq_domain pointer and has a completely different purpose.

Introduce a prepare_desc() op which allows IMS implementations to amend an
MSI descriptor which was allocated by the core code, e.g. by adjusting the
iomem base or adding some data based on the allocated index. This is way
better than requiring that all IMS domain implementations preallocate the
MSI descriptor and then allocate the interrupt.

Signed-off-by: Thomas Gleixner 
Reviewed-by: Kevin Tian 
Acked-by: Marc Zyngier 
Link: https://lore.kernel.org/r/20221124232326.444560717@linutronix.de

genirq/msi: Provide BUS_DEVICE_PCI_MSI[X]

2022-12-05T21:22:32+00:00

Provide new bus tokens for the upcoming per device PCI/MSI and PCI/MSIX
interrupt domains.

Signed-off-by: Thomas Gleixner 
Reviewed-by: Kevin Tian 
Acked-by: Marc Zyngier 
Link: https://lore.kernel.org/r/20221124232325.917219885@linutronix.de

genirq/msi: Add range checking to msi_insert_desc()

2022-12-05T21:22:32+00:00

Per device domains provide the real domain size to the core code. This
allows range checking on insertion of MSI descriptors and also paves the
way for dynamic index allocations which are required e.g. for IMS. This
avoids external mechanisms like bitmaps on the device side and just
utilizes the core internal MSI descriptor storxe for it.

Signed-off-by: Thomas Gleixner 
Reviewed-by: Kevin Tian 
Acked-by: Marc Zyngier 
Link: https://lore.kernel.org/r/20221124232325.798556374@linutronix.de

genirq/msi: Provide msi_match_device_domain()

2022-12-05T18:21:01+00:00

Provide an interface to match a per device domain bus token. This allows to
query which type of domain is installed for a particular domain id. Will be
used for PCI to avoid frequent create/remove cycles for the MSI resp. MSI-X
domains.

Signed-off-by: Thomas Gleixner 
Reviewed-by: Kevin Tian 
Acked-by: Marc Zyngier 
Link: https://lore.kernel.org/r/20221124232325.738047902@linutronix.de