- Linux-stable-mirror - lists.linaro.org

[net-next 05/15] e1000: Do not perform reset in reset_task if we are already down

by Jeff Kirsher

From: Alexander Duyck <alexander.h.duyck(a)linux.intel.com> We are seeing a deadlock in e1000 down when NAPI is being disabled. Looking over the kernel function trace of the system it appears that the interface is being closed and then a reset is hitting which deadlocks the interface as the NAPI interface is already disabled. To prevent this from happening I am disabling the reset task when __E1000_DOWN is already set. In addition code has been added so that we set the __E1000_DOWN while holding the __E1000_RESET flag in e1000_close in order to guarantee that the reset task will not run after we have started the close call. CC: stable <stable(a)vger.kernel.org> Signed-off-by: Alexander Duyck <alexander.h.duyck(a)linux.intel.com> Tested-by: Maxim Zhukov <mussitantesmortem(a)gmail.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher(a)intel.com> --- drivers/net/ethernet/intel/e1000/e1000_main.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c index 05bc6e216bca..d9fa4600f745 100644 --- a/drivers/net/ethernet/intel/e1000/e1000_main.c +++ b/drivers/net/ethernet/intel/e1000/e1000_main.c @@ -542,8 +542,13 @@ void e1000_reinit_locked(struct e1000_adapter *adapter) WARN_ON(in_interrupt()); while (test_and_set_bit(__E1000_RESETTING, &adapter->flags)) msleep(1); - e1000_down(adapter); - e1000_up(adapter); + + /* only run the task if not already down */ + if (!test_bit(__E1000_DOWN, &adapter->flags)) { + e1000_down(adapter); + e1000_up(adapter); + } + clear_bit(__E1000_RESETTING, &adapter->flags); } @@ -1433,10 +1438,15 @@ int e1000_close(struct net_device *netdev) struct e1000_hw *hw = &adapter->hw; int count = E1000_CHECK_RESET_COUNT; - while (test_bit(__E1000_RESETTING, &adapter->flags) && count--) + while (test_and_set_bit(__E1000_RESETTING, &adapter->flags) && count--) usleep_range(10000, 20000); - WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags)); + WARN_ON(count < 0); + + /* signal that we're down so that the reset task will no longer run */ + set_bit(__E1000_DOWN, &adapter->flags); + clear_bit(__E1000_RESETTING, &adapter->flags); + e1000_down(adapter); e1000_power_down_phy(adapter); e1000_free_irq(adapter); -- 2.26.2

5 years, 7 months

1
0
0 0

[PATCH 4.19.y] riscv: set max_pfn to the PFN of the last page

by Palmer Dabbelt

From: Vincent Chen <vincent.chen(a)sifive.com> commit c749bb2d554825e007cbc43b791f54e124dadfce upstream. The current max_pfn equals to zero. In this case, I found it caused users cannot get some page information through /proc such as kpagecount in v5.6 kernel because of new sanity checks. The following message is displayed by stress-ng test suite with the command "stress-ng --verbose --physpage 1 -t 1" on HiFive unleashed board. # stress-ng --verbose --physpage 1 -t 1 stress-ng: debug: [109] 4 processors online, 4 processors configured stress-ng: info: [109] dispatching hogs: 1 physpage stress-ng: debug: [109] cache allocate: reducing cache level from L3 (too high) to L0 stress-ng: debug: [109] get_cpu_cache: invalid cache_level: 0 stress-ng: info: [109] cache allocate: using built-in defaults as no suitable cache found stress-ng: debug: [109] cache allocate: default cache size: 2048K stress-ng: debug: [109] starting stressors stress-ng: debug: [109] 1 stressor spawned stress-ng: debug: [110] stress-ng-physpage: started [110] (instance 0) stress-ng: error: [110] stress-ng-physpage: cannot read page count for address 0x3fd34de000 in /proc/kpagecount, errno=0 (Success) stress-ng: error: [110] stress-ng-physpage: cannot read page count for address 0x3fd32db078 in /proc/kpagecount, errno=0 (Success) ... stress-ng: error: [110] stress-ng-physpage: cannot read page count for address 0x3fd32db078 in /proc/kpagecount, errno=0 (Success) stress-ng: debug: [110] stress-ng-physpage: exited [110] (instance 0) stress-ng: debug: [109] process [110] terminated stress-ng: info: [109] successful run completed in 1.00s # After applying this patch, the kernel can pass the test. # stress-ng --verbose --physpage 1 -t 1 stress-ng: debug: [104] 4 processors online, 4 processors configured stress-ng: info: [104] dispatching hogs: 1 physpage stress-ng: info: [104] cache allocate: using defaults, can't determine cache details from sysfs stress-ng: debug: [104] cache allocate: default cache size: 2048K stress-ng: debug: [104] starting stressors stress-ng: debug: [104] 1 stressor spawned stress-ng: debug: [105] stress-ng-physpage: started [105] (instance 0) stress-ng: debug: [105] stress-ng-physpage: exited [105] (instance 0) stress-ng: debug: [104] process [105] terminated stress-ng: info: [104] successful run completed in 1.01s # Cc: stable(a)vger.kernel.org Signed-off-by: Vincent Chen <vincent.chen(a)sifive.com> Reviewed-by: Anup Patel <anup(a)brainfault.org> Reviewed-by: Yash Shah <yash.shah(a)sifive.com> Tested-by: Yash Shah <yash.shah(a)sifive.com> [Palmer: back-ported to 4.19] Signed-off-by: Palmer Dabbelt <palmerdabbelt(a)google.com> --- arch/riscv/kernel/setup.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c index 9713d4e8c22b..6558617bd2ce 100644 --- a/arch/riscv/kernel/setup.c +++ b/arch/riscv/kernel/setup.c @@ -19,6 +19,7 @@ * to the Free Software Foundation, Inc., */ +#include <linux/bootmem.h> #include <linux/init.h> #include <linux/mm.h> #include <linux/memblock.h> @@ -187,6 +188,7 @@ static void __init setup_bootmem(void) set_max_mapnr(PFN_DOWN(mem_size)); max_low_pfn = PFN_DOWN(memblock_end_of_DRAM()); + max_pfn = max_low_pfn; #ifdef CONFIG_BLK_DEV_INITRD setup_initrd(); -- 2.26.2.761.g0e0b3e54be-goog

5 years, 7 months

2
1
0 0

[stable] KVM: SVM: Fix potential memory leak in svm_cpu_init()

by Ben Hutchings

Please pick this fix for 4.19 and 5.4 stable branches: commit d80b64ff297e40c2b6f7d7abc1b3eba70d22a068 Author: Miaohe Lin <linmiaohe(a)huawei.com> Date: Sat Jan 4 16:56:49 2020 +0800 KVM: SVM: Fix potential memory leak in svm_cpu_init() It applies cleanly to both. Ben. -- Ben Hutchings, Software Developer Codethink Ltd https://www.codethink.co.uk/ Dale House, 35 Dale Street Manchester, M1 2HF, United Kingdom

5 years, 7 months

2
1
0 0

[4.14-stable] watchdog: Fix the race between the release of watchdog_core_data and cdev

by Ben Hutchings

Please queue up the attached backport of commit 2351c88f8296 "watchdog: Fix the race between the release of watchdog_core_data and cdev" for 4.14. Ben. -- Ben Hutchings, Software Developer Codethink Ltd https://www.codethink.co.uk/ Dale House, 35 Dale Street Manchester, M1 2HF, United Kingdom

5 years, 7 months

2
3
0 0

[4.14-stable] Security fixes

by Ben Hutchings

Here are some fixes that required backporting for 4.14. All of them are already present in later stable branches. Ben. -- Ben Hutchings, Software Developer Codethink Ltd https://www.codethink.co.uk/ Dale House, 35 Dale Street Manchester, M1 2HF, United Kingdom

5 years, 7 months

2
3
0 0

+ z3fold-fix-use-after-free-when-freeing-handles.patch added to -mm tree

by Andrew Morton

The patch titled Subject: z3fold: fix use-after-free when freeing handles has been added to the -mm tree. Its filename is z3fold-fix-use-after-free-when-freeing-handles.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/z3fold-fix-use-after-free-when-fre… and later at http://ozlabs.org/~akpm/mmotm/broken-out/z3fold-fix-use-after-free-when-fre… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Uladzislau Rezki <uladzislau.rezki(a)sony.com> Subject: z3fold: fix use-after-free when freeing handles free_handle() for a foreign handle may race with inter-page compaction, what can lead to memory corruption. To avoid that, take write lock not read lock in free_handle to be synchronized with __release_z3fold_page(). For example KASAN can detect it: [ 33.723357] ================================================================== [ 33.723401] BUG: KASAN: use-after-free in LZ4_decompress_safe+0x2c4/0x3b8 [ 33.723418] Read of size 1 at addr ffffffc976695ca3 by task GoogleApiHandle/4121 [ 33.723428] [ 33.723449] CPU: 0 PID: 4121 Comm: GoogleApiHandle Tainted: P S OE 4.19.81-perf+ #162 [ 33.723461] Hardware name: Sony Mobile Communications. PDX-203(KONA) (DT) [ 33.723473] Call trace: [ 33.723495] dump_backtrace+0x0/0x288 [ 33.723512] show_stack+0x14/0x20 [ 33.723533] dump_stack+0xe4/0x124 [ 33.723551] print_address_description+0x80/0x2e0 [ 33.723566] kasan_report+0x268/0x2d0 [ 33.723584] __asan_load1+0x4c/0x58 [ 33.723601] LZ4_decompress_safe+0x2c4/0x3b8 [ 33.723619] lz4_decompress_crypto+0x3c/0x70 [ 33.723636] crypto_decompress+0x58/0x70 [ 33.723656] zcomp_decompress+0xd4/0x120 ... Apart from that, initialize zhdr->mapped_count in init_z3fold_page() and remove "newpage" variable because it is not used anywhere. Link: http://lkml.kernel.org/r/20200520082100.28876-1-vitaly.wool@konsulko.com Signed-off-by: Uladzislau Rezki <uladzislau.rezki(a)sony.com> Signed-off-by: Vitaly Wool <vitaly.wool(a)konsulko.com> Cc: Qian Cai <cai(a)lca.pw> Cc: Raymond Jennings <shentino(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/z3fold.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/mm/z3fold.c~z3fold-fix-use-after-free-when-freeing-handles +++ a/mm/z3fold.c @@ -318,16 +318,16 @@ static inline void free_handle(unsigned slots = handle_to_slots(handle); write_lock(&slots->lock); *(unsigned long *)handle = 0; - write_unlock(&slots->lock); - if (zhdr->slots == slots) + if (zhdr->slots == slots) { + write_unlock(&slots->lock); return; /* simple case, nothing else to do */ + } /* we are freeing a foreign handle if we are here */ zhdr->foreign_handles--; is_free = true; - read_lock(&slots->lock); if (!test_bit(HANDLES_ORPHANED, &slots->pool)) { - read_unlock(&slots->lock); + write_unlock(&slots->lock); return; } for (i = 0; i <= BUDDY_MASK; i++) { @@ -336,7 +336,7 @@ static inline void free_handle(unsigned break; } } - read_unlock(&slots->lock); + write_unlock(&slots->lock); if (is_free) { struct z3fold_pool *pool = slots_to_pool(slots); @@ -422,6 +422,7 @@ static struct z3fold_header *init_z3fold zhdr->start_middle = 0; zhdr->cpu = -1; zhdr->foreign_handles = 0; + zhdr->mapped_count = 0; zhdr->slots = slots; zhdr->pool = pool; INIT_LIST_HEAD(&zhdr->buddy); _ Patches currently in -mm which might be from uladzislau.rezki(a)sony.com are z3fold-fix-use-after-free-when-freeing-handles.patch

5 years, 7 months

1
0
0 0

[PATCH AUTOSEL 5.6 01/62] kbuild: avoid concurrency issue in parallel building dtbs and dtbs_check

by Sasha Levin

From: Masahiro Yamada <masahiroy(a)kernel.org> [ Upstream commit b5154bf63e5577faaaca1d942df274f7de91dd2a ] 'make dtbs_check' checks the shecma in addition to building *.dtb files, in other words, 'make dtbs_check' is a super-set of 'make dtbs'. So, you do not have to do 'make dtbs dtbs_check', but I want to keep the build system as robust as possible in any use. Currently, 'dtbs' and 'dtbs_check' are independent of each other. In parallel building, two threads descend into arch/*/boot/dts/, one for dtbs and the other for dtbs_check, then end up with building the same DTB simultaneously. This commit fixes the concurrency issue. Otherwise, I see build errors like follows: $ make ARCH=arm64 defconfig $ make -j16 ARCH=arm64 DT_SCHEMA_FILES=Documentation/devicetree/bindings/arm/psci.yaml dtbs dtbs_check <snip> DTC arch/arm64/boot/dts/qcom/sdm845-cheza-r2.dtb DTC arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtb DTC arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-lite2.dtb DTC arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-lite2.dtb DTC arch/arm64/boot/dts/freescale/imx8mn-evk.dtb DTC arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-one-plus.dtb DTC arch/arm64/boot/dts/zte/zx296718-pcbox.dtb DTC arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dt.yaml DTC arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dtb DTC arch/arm64/boot/dts/xilinx/zynqmp-zc1254-revA.dtb DTC arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dtb DTC arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-inx.dtb DTC arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-one-plus.dtb CHECK arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dt.yaml fixdep: error opening file: arch/arm64/boot/dts/allwinner/.sun50i-h6-orangepi-lite2.dtb.d: No such file or directory make[2]: *** [scripts/Makefile.lib:296: arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-lite2.dtb] Error 2 make[2]: *** Deleting file 'arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-lite2.dtb' make[2]: *** Waiting for unfinished jobs.... DTC arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-kd.dtb DTC arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p231.dtb DTC arch/arm64/boot/dts/xilinx/zynqmp-zc1275-revA.dtb DTC arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dtb fixdep: parse error; no targets found make[2]: *** [scripts/Makefile.lib:296: arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-one-plus.dtb] Error 1 make[2]: *** Deleting file 'arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-one-plus.dtb' make[1]: *** [scripts/Makefile.build:505: arch/arm64/boot/dts/allwinner] Error 2 make[1]: *** Waiting for unfinished jobs.... DTC arch/arm64/boot/dts/renesas/r8a77951-salvator-xs.dtb Signed-off-by: Masahiro Yamada <masahiroy(a)kernel.org> Reviewed-by: Rob Herring <robh(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- Makefile | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index d252219666fdd..6a8f0b278f1bb 100644 --- a/Makefile +++ b/Makefile @@ -1240,11 +1240,15 @@ ifneq ($(dtstree),) $(Q)$(MAKE) $(build)=$(dtstree) $(dtstree)/$@ PHONY += dtbs dtbs_install dtbs_check -dtbs dtbs_check: include/config/kernel.release scripts_dtc +dtbs: include/config/kernel.release scripts_dtc $(Q)$(MAKE) $(build)=$(dtstree) +ifneq ($(filter dtbs_check, $(MAKECMDGOALS)),) +dtbs: dt_binding_check +endif + dtbs_check: export CHECK_DTBS=1 -dtbs_check: dt_binding_check +dtbs_check: dtbs dtbs_install: $(Q)$(MAKE) $(dtbinst)=$(dtstree) -- 2.20.1

5 years, 7 months

4
65
0 0

+ sparc32-use-pud-rather-than-pgd-to-get-pmd-in-srmmu_nocache_init.patch added to -mm tree

by Andrew Morton

The patch titled Subject: sparc32: use PUD rather than PGD to get PMD in srmmu_nocache_init() has been added to the -mm tree. Its filename is sparc32-use-pud-rather-than-pgd-to-get-pmd-in-srmmu_nocache_init.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/sparc32-use-pud-rather-than-pgd-to… and later at http://ozlabs.org/~akpm/mmotm/broken-out/sparc32-use-pud-rather-than-pgd-to… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Mike Rapoport <rppt(a)linux.ibm.com> Subject: sparc32: use PUD rather than PGD to get PMD in srmmu_nocache_init() The kbuild test robot reported the following warning: arch/sparc/mm/srmmu.c: In function 'srmmu_nocache_init': >> arch/sparc/mm/srmmu.c:300:9: error: variable 'pud' set but not used >> [-Werror=unused-but-set-variable] 300 | pud_t *pud; This warning is caused by misprint in the page table traversal in srmmu_nocache_init() function which accessed a PMD entry using PGD rather than PUD. Since sparc32 has only 3 page table levels, the PGD and PUD are essentially the same and usage of __nocache_fix() removed the type checking. Use PUD for the consistency and to silence the compiler warning. Link: http://lkml.kernel.org/r/20200520132005.GM1059226@linux.ibm.com Fixes: 7235db268a2777bc38 ("sparc32: use pgtable-nopud instead of 4level-fixup") Signed-off-by: Mike Rapoport <rppt(a)linux.ibm.com> Reported-by: kbuild test robot <lkp(a)intel.com> Cc: David S. Miller <davem(a)davemloft.net> Cc: Anatoly Pugachev <matorola(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- arch/sparc/mm/srmmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/sparc/mm/srmmu.c~sparc32-use-pud-rather-than-pgd-to-get-pmd-in-srmmu_nocache_init +++ a/arch/sparc/mm/srmmu.c @@ -333,7 +333,7 @@ static void __init srmmu_nocache_init(vo pgd = pgd_offset_k(vaddr); p4d = p4d_offset(__nocache_fix(pgd), vaddr); pud = pud_offset(__nocache_fix(p4d), vaddr); - pmd = pmd_offset(__nocache_fix(pgd), vaddr); + pmd = pmd_offset(__nocache_fix(pud), vaddr); pte = pte_offset_kernel(__nocache_fix(pmd), vaddr); pteval = ((paddr >> 4) | SRMMU_ET_PTE | SRMMU_PRIV); _ Patches currently in -mm which might be from rppt(a)linux.ibm.com are sparc32-use-pud-rather-than-pgd-to-get-pmd-in-srmmu_nocache_init.patch mm-memblock-replace-dereferences-of-memblock_regionnid-with-api-calls.patch mm-make-early_pfn_to_nid-and-related-defintions-close-to-each-other.patch mm-remove-config_have_memblock_node_map-option.patch mm-free_area_init-use-maximal-zone-pfns-rather-than-zone-sizes.patch mm-use-free_area_init-instead-of-free_area_init_nodes.patch alpha-simplify-detection-of-memory-zone-boundaries.patch arm-simplify-detection-of-memory-zone-boundaries.patch arm64-simplify-detection-of-memory-zone-boundaries-for-uma-configs.patch csky-simplify-detection-of-memory-zone-boundaries.patch m68k-mm-simplify-detection-of-memory-zone-boundaries.patch parisc-simplify-detection-of-memory-zone-boundaries.patch sparc32-simplify-detection-of-memory-zone-boundaries.patch unicore32-simplify-detection-of-memory-zone-boundaries.patch xtensa-simplify-detection-of-memory-zone-boundaries.patch mm-remove-early_pfn_in_nid-and-config_nodes_span_other_nodes.patch mm-free_area_init-allow-defining-max_zone_pfn-in-descending-order.patch mm-free_area_init-allow-defining-max_zone_pfn-in-descending-order-fix-2.patch mm-rename-free_area_init_node-to-free_area_init_memoryless_node.patch mm-clean-up-free_area_init_node-and-its-helpers.patch mm-simplify-find_min_pfn_with_active_regions.patch docs-vm-update-memory-models-documentation.patch h8300-remove-usage-of-__arch_use_5level_hack.patch arm-add-support-for-folded-p4d-page-tables.patch arm-add-support-for-folded-p4d-page-tables-fix.patch arm64-add-support-for-folded-p4d-page-tables.patch hexagon-remove-__arch_use_5level_hack.patch ia64-add-support-for-folded-p4d-page-tables.patch nios2-add-support-for-folded-p4d-page-tables.patch openrisc-add-support-for-folded-p4d-page-tables.patch powerpc-add-support-for-folded-p4d-page-tables.patch powerpc-add-support-for-folded-p4d-page-tables-fix.patch powerpc-add-support-for-folded-p4d-page-tables-fix-2.patch sh-drop-__pxd_offset-macros-that-duplicate-pxd_index-ones.patch sh-add-support-for-folded-p4d-page-tables.patch unicore32-remove-__arch_use_5level_hack.patch asm-generic-remove-pgtable-nop4d-hackh.patch mm-remove-__arch_has_5level_hack-and-include-asm-generic-5level-fixuph.patch mm-dont-include-asm-pgtableh-if-linux-mmh-is-already-included.patch mm-introduce-include-linux-pgtableh.patch mm-reorder-includes-after-introduction-of-linux-pgtableh.patch csky-replace-definitions-of-__pxd_offset-with-pxd_index.patch m68k-mm-motorola-move-comment-about-page-table-allocation-funcitons.patch m68k-mm-move-cachenocahe_page-definitions-close-to-their-user.patch x86-mm-simplify-init_trampoline-and-surrounding-logic.patch mm-pgtable-add-shortcuts-for-accessing-kernel-pmd-and-pte.patch mm-pgtable-add-shortcuts-for-accessing-kernel-pmd-and-pte-fix.patch mm-pgtable-add-shortcuts-for-accessing-kernel-pmd-and-pte-fix-2.patch mm-consolidate-pte_index-and-pte_offset_-definitions.patch mm-consolidate-pmd_index-and-pmd_offset-definitions.patch mm-consolidate-pud_index-and-pud_offset-definitions.patch mm-consolidate-pgd_index-and-pgd_offset_k-definitions.patch

5 years, 7 months

1
0
0 0

[PATCH 1/8] virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers to match upstream

by Hans de Goede

Until this commit the mainline kernel version (this version) of the vboxguest module contained a bug where it defined VBGL_IOCTL_VMMDEV_REQUEST_BIG and VBGL_IOCTL_LOG using _IOC(_IOC_READ | _IOC_WRITE, 'V', ...) instead of _IO(V, ...) as the out of tree VirtualBox upstream version does. Since the VirtualBox userspace bits are always built against VirtualBox upstream's headers, this means that so far the mainline kernel version of the vboxguest module has been failing these 2 ioctls with -ENOTTY. I guess that VBGL_IOCTL_VMMDEV_REQUEST_BIG is never used causing us to not hit that one and sofar the vboxguest driver has failed to actually log any log messages passed it through VBGL_IOCTL_LOG. This commit changes the VBGL_IOCTL_VMMDEV_REQUEST_BIG and VBGL_IOCTL_LOG defines to match the out of tree VirtualBox upstream vboxguest version, while keeping compatibility with the old wrong request defines so as to not break the kernel ABI in case someone has been using the old request defines. Fixes: f6ddd094f579 ("virt: Add vboxguest driver for Virtual Box Guest integration UAPI") Cc: stable(a)vger.kernel.org Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> --- drivers/virt/vboxguest/vboxguest_core.c | 4 +++- drivers/virt/vboxguest/vboxguest_core.h | 15 +++++++++++++++ drivers/virt/vboxguest/vboxguest_linux.c | 3 ++- include/uapi/linux/vboxguest.h | 4 ++-- 4 files changed, 22 insertions(+), 4 deletions(-) diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c index b690a8a4bf9e..8fab04e76c14 100644 --- a/drivers/virt/vboxguest/vboxguest_core.c +++ b/drivers/virt/vboxguest/vboxguest_core.c @@ -1520,7 +1520,8 @@ int vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data) /* For VMMDEV_REQUEST hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT */ if (req_no_size == VBG_IOCTL_VMMDEV_REQUEST(0) || - req == VBG_IOCTL_VMMDEV_REQUEST_BIG) + req == VBG_IOCTL_VMMDEV_REQUEST_BIG || + req == VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT) return vbg_ioctl_vmmrequest(gdev, session, data); if (hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT) @@ -1558,6 +1559,7 @@ int vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data) case VBG_IOCTL_HGCM_CALL(0): return vbg_ioctl_hgcm_call(gdev, session, f32bit, data); case VBG_IOCTL_LOG(0): + case VBG_IOCTL_LOG_ALT(0): return vbg_ioctl_log(data); } diff --git a/drivers/virt/vboxguest/vboxguest_core.h b/drivers/virt/vboxguest/vboxguest_core.h index 4188c12b839f..77c3a9c8255d 100644 --- a/drivers/virt/vboxguest/vboxguest_core.h +++ b/drivers/virt/vboxguest/vboxguest_core.h @@ -15,6 +15,21 @@ #include <linux/vboxguest.h> #include "vmmdev.h" +/* + * The mainline kernel version (this version) of the vboxguest module + * contained a bug where it defined VBGL_IOCTL_VMMDEV_REQUEST_BIG and + * VBGL_IOCTL_LOG using _IOC(_IOC_READ | _IOC_WRITE, 'V', ...) instead + * of _IO(V, ...) as the out of tree VirtualBox upstream version does. + * + * These _ALT definitions keep compatibility with the wrong defines the + * mainline kernel version used for a while. + * Note the VirtualBox userspace bits have always been built against + * VirtualBox upstream's headers, so this is likely not necessary. But + * we must never break our ABI so we keep these around to be 100% sure. + */ +#define VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT _IOC(_IOC_READ | _IOC_WRITE, 'V', 3, 0) +#define VBG_IOCTL_LOG_ALT(s) _IOC(_IOC_READ | _IOC_WRITE, 'V', 9, s) + struct vbg_session; /** VBox guest memory balloon. */ diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c index 6e8c0f1c1056..32c2c52f7e84 100644 --- a/drivers/virt/vboxguest/vboxguest_linux.c +++ b/drivers/virt/vboxguest/vboxguest_linux.c @@ -131,7 +131,8 @@ static long vbg_misc_device_ioctl(struct file *filp, unsigned int req, * the need for a bounce-buffer and another copy later on. */ is_vmmdev_req = (req & ~IOCSIZE_MASK) == VBG_IOCTL_VMMDEV_REQUEST(0) || - req == VBG_IOCTL_VMMDEV_REQUEST_BIG; + req == VBG_IOCTL_VMMDEV_REQUEST_BIG || + req == VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT; if (is_vmmdev_req) buf = vbg_req_alloc(size, VBG_IOCTL_HDR_TYPE_DEFAULT, diff --git a/include/uapi/linux/vboxguest.h b/include/uapi/linux/vboxguest.h index 9cec58a6a5ea..f79d7abe27db 100644 --- a/include/uapi/linux/vboxguest.h +++ b/include/uapi/linux/vboxguest.h @@ -103,7 +103,7 @@ VMMDEV_ASSERT_SIZE(vbg_ioctl_driver_version_info, 24 + 20); /* IOCTL to perform a VMM Device request larger then 1KB. */ -#define VBG_IOCTL_VMMDEV_REQUEST_BIG _IOC(_IOC_READ | _IOC_WRITE, 'V', 3, 0) +#define VBG_IOCTL_VMMDEV_REQUEST_BIG _IO('V', 3) /** VBG_IOCTL_HGCM_CONNECT data structure. */ @@ -198,7 +198,7 @@ struct vbg_ioctl_log { } u; }; -#define VBG_IOCTL_LOG(s) _IOC(_IOC_READ | _IOC_WRITE, 'V', 9, s) +#define VBG_IOCTL_LOG(s) _IO('V', 9) /** VBG_IOCTL_WAIT_FOR_EVENTS data structure. */ -- 2.26.2

5 years, 7 months

2
2
0 0

DMA API stable backports for AMD SEV

by David Rientjes

Hi Greg and everyone, On all kernels, SEV enabled guests hit might_sleep() warnings when a driver (nvme in this case) allocates through the DMA API in a non-blockable context: BUG: sleeping function called from invalid context at mm/vmalloc.c:1710 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3383, name: fio 2 locks held by fio/3383: #0: ffff93b6a8568348 (&sb->s_type->i_mutex_key#16){+.+.}, at: ext4_file_write_iter+0xa2/0x5d0 #1: ffffffffa52a61a0 (rcu_read_lock){....}, at: hctx_lock+0x1a/0xe0 CPU: 0 PID: 3383 Comm: fio Tainted: G W 5.5.10 #14 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: dump_stack+0x98/0xd5 ___might_sleep+0x175/0x260 __might_sleep+0x4a/0x80 _vm_unmap_aliases+0x45/0x250 vm_unmap_aliases+0x19/0x20 __set_memory_enc_dec+0xa4/0x130 set_memory_decrypted+0x10/0x20 dma_direct_alloc_pages+0x148/0x150 dma_direct_alloc+0xe/0x10 dma_alloc_attrs+0x86/0xc0 dma_pool_alloc+0x16f/0x2b0 nvme_queue_rq+0x878/0xc30 [nvme] __blk_mq_try_issue_directly+0x135/0x200 blk_mq_request_issue_directly+0x4f/0x80 blk_mq_try_issue_list_directly+0x46/0xb0 blk_mq_sched_insert_requests+0x19b/0x2b0 blk_mq_flush_plug_list+0x22f/0x3b0 blk_flush_plug_list+0xd1/0x100 blk_finish_plug+0x2c/0x40 iomap_dio_rw+0x427/0x490 ext4_file_write_iter+0x181/0x5d0 aio_write+0x109/0x1b0 io_submit_one+0x7d0/0xfa0 __x64_sys_io_submit+0xa2/0x280 do_syscall_64+0x5f/0x250 entry_SYSCALL_64_after_hwframe+0x49/0xbe There is a series of patches in Christoph's dma-mapping.git repo in the for-next branch on track for 5.8: 1d659236fb43 dma-pool: scale the default DMA coherent pool size with memory capacity 82fef0ad811f x86/mm: unencrypted non-blocking DMA allocations use coherent pools 2edc5bb3c5cc dma-pool: add pool sizes to debugfs 76a19940bd62 dma-direct: atomic allocations must come from atomic coherent pools 54adadf9b085 dma-pool: dynamically expanding atomic pools c84dc6e68a1d dma-pool: add additional coherent pools to map to gfp mask e860c299ac0d dma-remap: separate DMA atomic pools from direct remap code We'd like to prepare backports to LTS kernels so that our guest images are not modified by us and don't exhibit this issue. They are bigger than we'd like: arch/x86/Kconfig | 1 + drivers/iommu/dma-iommu.c | 5 +- include/linux/dma-direct.h | 2 + include/linux/dma-mapping.h | 6 +- kernel/dma/Kconfig | 6 +- kernel/dma/Makefile | 1 + kernel/dma/direct.c | 56 ++++++-- kernel/dma/pool.c | 264 ++++++++++++++++++++++++++++++++++++ kernel/dma/remap.c | 121 +---------------- 9 files changed, 324 insertions(+), 138 deletions(-) create mode 100644 kernel/dma/pool.c But they apply relatively cleanly to more modern kernels like 5.4. We'd like to backport these all the way to 4.19, however, otherwise guests encounter these bugs. The changes to kernel/dma/remap.c, for example, simply moves code to the new pool.c. But that original code is actually in arch/arm64 in 4.19 and was moved in 5.0: commit 0c3b3171ceccb8830c2bb5adff1b4e9b204c1450 Author: Christoph Hellwig <hch(a)lst.de> Date: Sun Nov 4 20:29:28 2018 +0100 dma-mapping: move the arm64 noncoherent alloc/free support to common code commit f0edfea8ef93ed6cc5f747c46c85c8e53e0798a0 Author: Christoph Hellwig <hch(a)lst.de> Date: Fri Aug 24 10:31:08 2018 +0200 dma-mapping: move the remap helpers to a separate file And there are most certainly more dependencies to get a cleanly applying series to 4.19.123. So the backports could be quite extensive. Peter Gonda <pgonda(a)google.com> is currently handling these and we're looking for advice: should we compile a full list of required backports that would be needed to get a series that would only consist of minor conflicts or is this going to be a non-starter? Thanks!

5 years, 7 months

2
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror