The following changes since commit 8ab2afa23bd197df47819a87f0265c0ac95c5b6a:
Merge tag 'for-5.19/fbdev-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev (2022-05-30 12:46:49 -0700)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git tags/for_linus
for you to fetch changes up to bd8bb9aed56b1814784a975e2dfea12a9adcee92:
vdpa: ifcvf: set pci driver data in probe (2022-06-01 02:16:38 -0400)
----------------------------------------------------------------
vhost,virtio,vdpa: features, fixes, cleanups
mac vlan filter and stats support in mlx5 vdpa
irq hardening in virtio
performance improvements in virtio crypto
polling i/o support in virtio blk
ASID support in vhost
fixes, cleanups all over the place
Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
----------------------------------------------------------------
Andrey Ryabinin (4):
vhost: get rid of vhost_poll_flush() wrapper
vhost_net: get rid of vhost_net_flush_vq() and extra flush calls
vhost_test: remove vhost_test_flush_vq()
vhost_vsock: simplify vhost_vsock_flush()
Christophe JAILLET (1):
virtio: pci: Fix an error handling path in vp_modern_probe()
Cindy Lu (1):
vdpa/vp_vdpa : add vdpa tool support in vp_vdpa
Dan Carpenter (2):
vdpasim: Off by one in vdpasim_set_group_asid()
vhost-vdpa: return -EFAULT on copy_to_user() failure
Eli Cohen (8):
vdpa: Fix error logic in vdpa_nl_cmd_dev_get_doit
vdpa: Add support for querying vendor statistics
net/vdpa: Use readers/writers semaphore instead of vdpa_dev_mutex
net/vdpa: Use readers/writers semaphore instead of cf_mutex
vdpa/mlx5: Add support for reading descriptor statistics
vdpa/mlx5: Use readers/writers semaphore instead of mutex
vdpa/mlx5: Remove flow counter from steering
vdpa/mlx5: Add RX MAC VLAN filter support
Eugenio Pérez (1):
vdpasim: allow to enable a vq repeatedly
Gautam Dawar (19):
vhost: move the backend feature bits to vhost_types.h
virtio-vdpa: don't set callback if virtio doesn't need it
vhost-vdpa: passing iotlb to IOMMU mapping helpers
vhost-vdpa: switch to use vhost-vdpa specific IOTLB
vdpa: introduce virtqueue groups
vdpa: multiple address spaces support
vdpa: introduce config operations for associating ASID to a virtqueue group
vhost_iotlb: split out IOTLB initialization
vhost: support ASID in IOTLB API
vhost-vdpa: introduce asid based IOTLB
vhost-vdpa: introduce uAPI to get the number of virtqueue groups
vhost-vdpa: introduce uAPI to get the number of address spaces
vhost-vdpa: uAPI to get virtqueue group id
vhost-vdpa: introduce uAPI to set group ASID
vhost-vdpa: support ASID based IOTLB API
vdpa_sim: advertise VIRTIO_NET_F_MTU
vdpa_sim: factor out buffer completion logic
vdpa_sim: filter destination mac address
vdpasim: control virtqueue support
Jason Wang (9):
virtio: use virtio_reset_device() when possible
virtio: introduce config op to synchronize vring callbacks
virtio-pci: implement synchronize_cbs()
virtio-mmio: implement synchronize_cbs()
virtio-ccw: implement synchronize_cbs()
virtio: allow to unbreak virtqueue
virtio: harden vring IRQ
virtio: use WARN_ON() to warning illegal status value
vdpa: ifcvf: set pci driver data in probe
Mike Christie (4):
vhost: flush dev once during vhost_dev_stop
vhost-scsi: drop flush after vhost_dev_cleanup
vhost-test: drop flush after vhost_dev_cleanup
vhost: rename vhost_work_dev_flush
Murilo Opsfelder Araujo (1):
virtio-pci: Remove wrong address verification in vp_del_vqs()
Solomon Tan (2):
virtio: Replace unsigned with unsigned int
virtio: Replace long long int with long long
Stefano Garzarella (1):
virtio: use virtio_device_ready() in virtio_device_restore()
Suwan Kim (2):
virtio-blk: support polling I/O
virtio-blk: support mq_ops->queue_rqs()
Xianting Tian (2):
virtio_ring: remove unnecessary to_vvq call in vring hot path
virtio_ring: add unlikely annotation for free descs check
Zhu Lingshan (1):
vDPA/ifcvf: fix uninitialized config_vector warning
keliu (1):
virtio: Directly use ida_alloc()/free()
lei he (2):
virtio-crypto: adjust dst_len at ops callback
virtio-crypto: enable retry for virtio-crypto-dev
zhenwei pi (3):
virtio-crypto: change code style
virtio-crypto: use private buffer for control request
virtio-crypto: wait ctrl queue instead of busy polling
drivers/block/virtio_blk.c | 224 +++++++++-
.../crypto/virtio/virtio_crypto_akcipher_algs.c | 95 ++--
drivers/crypto/virtio/virtio_crypto_common.h | 21 +-
drivers/crypto/virtio/virtio_crypto_core.c | 55 ++-
.../crypto/virtio/virtio_crypto_skcipher_algs.c | 138 +++---
drivers/s390/virtio/virtio_ccw.c | 34 ++
drivers/vdpa/alibaba/eni_vdpa.c | 2 +-
drivers/vdpa/ifcvf/ifcvf_main.c | 23 +-
drivers/vdpa/mlx5/core/mlx5_vdpa.h | 2 +
drivers/vdpa/mlx5/net/mlx5_vnet.c | 491 +++++++++++++++++----
drivers/vdpa/vdpa.c | 257 +++++++++--
drivers/vdpa/vdpa_sim/vdpa_sim.c | 107 ++++-
drivers/vdpa/vdpa_sim/vdpa_sim.h | 3 +
drivers/vdpa/vdpa_sim/vdpa_sim_net.c | 169 +++++--
drivers/vdpa/vdpa_user/vduse_dev.c | 3 +-
drivers/vdpa/virtio_pci/vp_vdpa.c | 161 +++++--
drivers/vhost/iotlb.c | 23 +-
drivers/vhost/net.c | 11 +-
drivers/vhost/scsi.c | 4 +-
drivers/vhost/test.c | 14 +-
drivers/vhost/vdpa.c | 271 +++++++++---
drivers/vhost/vhost.c | 45 +-
drivers/vhost/vhost.h | 7 +-
drivers/vhost/vsock.c | 7 +-
drivers/virtio/virtio.c | 32 +-
drivers/virtio/virtio_balloon.c | 12 +-
drivers/virtio/virtio_mmio.c | 27 +-
drivers/virtio/virtio_pci_common.c | 15 +-
drivers/virtio/virtio_pci_common.h | 10 +-
drivers/virtio/virtio_pci_legacy.c | 11 +-
drivers/virtio/virtio_pci_modern.c | 14 +-
drivers/virtio/virtio_pci_modern_dev.c | 6 +
drivers/virtio/virtio_ring.c | 55 ++-
drivers/virtio/virtio_vdpa.c | 12 +-
include/linux/mlx5/mlx5_ifc.h | 1 +
include/linux/mlx5/mlx5_ifc_vdpa.h | 39 ++
include/linux/vdpa.h | 61 ++-
include/linux/vhost_iotlb.h | 2 +
include/linux/virtio.h | 1 +
include/linux/virtio_config.h | 47 +-
include/uapi/linux/vdpa.h | 6 +
include/uapi/linux/vhost.h | 26 +-
include/uapi/linux/vhost_types.h | 11 +-
43 files changed, 1964 insertions(+), 591 deletions(-)
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 4b6313cf99b0d51b49aeaea98ec76ca8161ecb80 Mon Sep 17 00:00:00 2001
From: Alexei Starovoitov <ast(a)kernel.org>
Date: Thu, 12 May 2022 18:10:24 -0700
Subject: [PATCH] bpf: Fix combination of jit blinding and pointers to bpf
subprogs.
The combination of jit blinding and pointers to bpf subprogs causes:
[ 36.989548] BUG: unable to handle page fault for address: 0000000100000001
[ 36.990342] #PF: supervisor instruction fetch in kernel mode
[ 36.990968] #PF: error_code(0x0010) - not-present page
[ 36.994859] RIP: 0010:0x100000001
[ 36.995209] Code: Unable to access opcode bytes at RIP 0xffffffd7.
[ 37.004091] Call Trace:
[ 37.004351] <TASK>
[ 37.004576] ? bpf_loop+0x4d/0x70
[ 37.004932] ? bpf_prog_3899083f75e4c5de_F+0xe3/0x13b
The jit blinding logic didn't recognize that ld_imm64 with an address
of bpf subprogram is a special instruction and proceeded to randomize it.
By itself it wouldn't have been an issue, but jit_subprogs() logic
relies on two step process to JIT all subprogs and then JIT them
again when addresses of all subprogs are known.
Blinding process in the first JIT phase caused second JIT to miss
adjustment of special ld_imm64.
Fix this issue by ignoring special ld_imm64 instructions that don't have
user controlled constants and shouldn't be blinded.
Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper")
Reported-by: Andrii Nakryiko <andrii(a)kernel.org>
Signed-off-by: Alexei Starovoitov <ast(a)kernel.org>
Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net>
Acked-by: Andrii Nakryiko <andrii(a)kernel.org>
Acked-by: Martin KaFai Lau <kafai(a)fb.com>
Link: https://lore.kernel.org/bpf/20220513011025.13344-1-alexei.starovoitov@gmail…
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 76f68d0a7ae8..9cc91f0f3115 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1434,6 +1434,16 @@ struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *prog)
insn = clone->insnsi;
for (i = 0; i < insn_cnt; i++, insn++) {
+ if (bpf_pseudo_func(insn)) {
+ /* ld_imm64 with an address of bpf subprog is not
+ * a user controlled constant. Don't randomize it,
+ * since it will conflict with jit_subprogs() logic.
+ */
+ insn++;
+ i++;
+ continue;
+ }
+
/* We temporarily need to hold the original ld64 insn
* so that we can still access the first part in the
* second blinding run.
The patch below does not apply to the 5.17-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From be77354a3d7ebd4897ee18eca26dca6df9224c76 Mon Sep 17 00:00:00 2001
From: Kumar Kartikeya Dwivedi <memxor(a)gmail.com>
Date: Sat, 19 Mar 2022 13:38:23 +0530
Subject: [PATCH] bpf: Do write access check for kfunc and global func
When passing pointer to some map value to kfunc or global func, in
verifier we are passing meta as NULL to various functions, which uses
meta->raw_mode to check whether memory is being written to. Since some
kfunc or global funcs may also write to memory pointers they receive as
arguments, we must check for write access to memory. E.g. in some case
map may be read only and this will be missed by current checks.
However meta->raw_mode allows for uninitialized memory (e.g. on stack),
since there is not enough info available through BTF, we must perform
one call for read access (raw_mode = false), and one for write access
(raw_mode = true).
Fixes: e5069b9c23b3 ("bpf: Support pointers in global func args")
Fixes: d583691c47dc ("bpf: Introduce mem, size argument pair support for kfunc")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com>
Link: https://lore.kernel.org/r/20220319080827.73251-2-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast(a)kernel.org>
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index d175b70067b3..e9807e6e1090 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4919,8 +4919,7 @@ static int check_mem_size_reg(struct bpf_verifier_env *env,
* out. Only upper bounds can be learned because retval is an
* int type and negative retvals are allowed.
*/
- if (meta)
- meta->msize_max_value = reg->umax_value;
+ meta->msize_max_value = reg->umax_value;
/* The register is SCALAR_VALUE; the access check
* happens using its boundaries.
@@ -4963,24 +4962,33 @@ static int check_mem_size_reg(struct bpf_verifier_env *env,
int check_mem_reg(struct bpf_verifier_env *env, struct bpf_reg_state *reg,
u32 regno, u32 mem_size)
{
+ bool may_be_null = type_may_be_null(reg->type);
+ struct bpf_reg_state saved_reg;
+ struct bpf_call_arg_meta meta;
+ int err;
+
if (register_is_null(reg))
return 0;
- if (type_may_be_null(reg->type)) {
- /* Assuming that the register contains a value check if the memory
- * access is safe. Temporarily save and restore the register's state as
- * the conversion shouldn't be visible to a caller.
- */
- const struct bpf_reg_state saved_reg = *reg;
- int rv;
-
+ memset(&meta, 0, sizeof(meta));
+ /* Assuming that the register contains a value check if the memory
+ * access is safe. Temporarily save and restore the register's state as
+ * the conversion shouldn't be visible to a caller.
+ */
+ if (may_be_null) {
+ saved_reg = *reg;
mark_ptr_not_null_reg(reg);
- rv = check_helper_mem_access(env, regno, mem_size, true, NULL);
- *reg = saved_reg;
- return rv;
}
- return check_helper_mem_access(env, regno, mem_size, true, NULL);
+ err = check_helper_mem_access(env, regno, mem_size, true, &meta);
+ /* Check access for BPF_WRITE */
+ meta.raw_mode = true;
+ err = err ?: check_helper_mem_access(env, regno, mem_size, true, &meta);
+
+ if (may_be_null)
+ *reg = saved_reg;
+
+ return err;
}
int check_kfunc_mem_size_reg(struct bpf_verifier_env *env, struct bpf_reg_state *reg,
@@ -4989,16 +4997,22 @@ int check_kfunc_mem_size_reg(struct bpf_verifier_env *env, struct bpf_reg_state
struct bpf_reg_state *mem_reg = &cur_regs(env)[regno - 1];
bool may_be_null = type_may_be_null(mem_reg->type);
struct bpf_reg_state saved_reg;
+ struct bpf_call_arg_meta meta;
int err;
WARN_ON_ONCE(regno < BPF_REG_2 || regno > BPF_REG_5);
+ memset(&meta, 0, sizeof(meta));
+
if (may_be_null) {
saved_reg = *mem_reg;
mark_ptr_not_null_reg(mem_reg);
}
- err = check_mem_size_reg(env, reg, regno, true, NULL);
+ err = check_mem_size_reg(env, reg, regno, true, &meta);
+ /* Check access for BPF_WRITE */
+ meta.raw_mode = true;
+ err = err ?: check_mem_size_reg(env, reg, regno, true, &meta);
if (may_be_null)
*mem_reg = saved_reg;