Huang Shijie (1): lib/genalloc.c: change return type to unsigned long for bitmap_set_ll
Saravana Kannan (1): driver core: Update device link status properly for device_bind_driver()
Suravee Suthikulpanit (2): iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE iommu/amd: Restore IRTE.RemapEn bit after programming IRTE
drivers/base/base.h | 1 + drivers/base/core.c | 35 ++++++++++++++++++++++++++++++++++ drivers/base/dd.c | 4 +++- drivers/iommu/Kconfig | 2 +- drivers/iommu/amd_iommu.c | 19 ++++++++++++++---- drivers/iommu/amd_iommu_init.c | 18 +++++++++++++++-- lib/genalloc.c | 3 ++- 7 files changed, 73 insertions(+), 9 deletions(-)
From: Suravee Suthikulpanit suravee.suthikulpanit@amd.com
mainline inclusion from mainline-v5.9-rc4 commit e52d58d54a321d4fe9d0ecdabe4f8774449f0d6e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8MI CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
mainline inclusion from mainline-v5.9-rc4 commit e52d58d54a321d4fe9d0ecdabe4f8774449f0d6e category: bugfix bugzilla: 189075 CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
When using 128-bit interrupt-remapping table entry (IRTE) (a.k.a GA mode), current driver disables interrupt remapping when it updates the IRTE so that the upper and lower 64-bit values can be updated safely.
However, this creates a small window, where the interrupt could arrive and result in IO_PAGE_FAULT (for interrupt) as shown below.
IOMMU Driver Device IRQ ============ =========== irte.RemapEn=0 ... change IRTE IRQ from device ==> IO_PAGE_FAULT !! ... irte.RemapEn=1
This scenario has been observed when changing irq affinity on a system running I/O-intensive workload, in which the destination APIC ID in the IRTE is updated.
Instead, use cmpxchg_double() to update the 128-bit IRTE at once without disabling the interrupt remapping. However, this means several features, which require GA (128-bit IRTE) support will also be affected if cmpxchg16b is not supported (which is unprecedented for AMD processors w/ IOMMU).
Fixes: 880ac60e2538 ("iommu/amd: Introduce interrupt remapping ops structure") Reported-by: Sean Osborne sean.m.osborne@oracle.com Signed-off-by: Suravee Suthikulpanit suravee.suthikulpanit@amd.com Tested-by: Erik Rockstrom erik.rockstrom@oracle.com Reviewed-by: Joao Martins joao.m.martins@oracle.com Link: https://lore.kernel.org/r/20200903093822.52012-3-suravee.suthikulpanit@amd.c... Signed-off-by: Joerg Roedel jroedel@suse.de Signed-off-by: Guo Mengqi guomengqi3@huawei.com --- drivers/iommu/Kconfig | 2 +- drivers/iommu/amd_iommu.c | 17 +++++++++++++---- drivers/iommu/amd_iommu_init.c | 18 ++++++++++++++++-- 3 files changed, 30 insertions(+), 7 deletions(-)
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig index a608ac136a97..53dd814adeb5 100644 --- a/drivers/iommu/Kconfig +++ b/drivers/iommu/Kconfig @@ -161,7 +161,7 @@ config AMD_IOMMU select PCI_PASID select IOMMU_API select IOMMU_IOVA - depends on X86_64 && PCI && ACPI + depends on X86_64 && PCI && ACPI && HAVE_CMPXCHG_DOUBLE ---help--- With this option you can enable support for AMD IOMMU hardware in your system. An IOMMU is a hardware component which provides diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c index a1f417694a48..fbc5b5861d23 100644 --- a/drivers/iommu/amd_iommu.c +++ b/drivers/iommu/amd_iommu.c @@ -3807,6 +3807,7 @@ static int alloc_irq_index(u16 devid, int count, bool align) static int modify_irte_ga(u16 devid, int index, struct irte_ga *irte, struct amd_ir_data *data) { + bool ret; struct irq_remap_table *table; struct amd_iommu *iommu; unsigned long flags; @@ -3824,10 +3825,18 @@ static int modify_irte_ga(u16 devid, int index, struct irte_ga *irte,
entry = (struct irte_ga *)table->table; entry = &entry[index]; - entry->lo.fields_remap.valid = 0; - entry->hi.val = irte->hi.val; - entry->lo.val = irte->lo.val; - entry->lo.fields_remap.valid = 1; + + ret = cmpxchg_double(&entry->lo.val, &entry->hi.val, + entry->lo.val, entry->hi.val, + irte->lo.val, irte->hi.val); + /* + * We use cmpxchg16 to atomically update the 128-bit IRTE, + * and it cannot be updated by the hardware or other processors + * behind us, so the return value of cmpxchg16 should be the + * same as the old value. + */ + WARN_ON(!ret); + if (data) data->ref = entry;
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c index 29bf91e50d41..abd327653d33 100644 --- a/drivers/iommu/amd_iommu_init.c +++ b/drivers/iommu/amd_iommu_init.c @@ -1525,7 +1525,14 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h) iommu->mmio_phys_end = MMIO_REG_END_OFFSET; else iommu->mmio_phys_end = MMIO_CNTR_CONF_OFFSET; - if (((h->efr_attr & (0x1 << IOMMU_FEAT_GASUP_SHIFT)) == 0)) + + /* + * Note: GA (128-bit IRTE) mode requires cmpxchg16b supports. + * GAM also requires GA mode. Therefore, we need to + * check cmpxchg16b support before enabling it. + */ + if (!boot_cpu_has(X86_FEATURE_CX16) || + ((h->efr_attr & (0x1 << IOMMU_FEAT_GASUP_SHIFT)) == 0)) amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY; if (((h->efr_attr & (0x1 << IOMMU_FEAT_XTSUP_SHIFT)) == 0)) amd_iommu_xt_mode = IRQ_REMAP_XAPIC_MODE; @@ -1536,7 +1543,14 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h) iommu->mmio_phys_end = MMIO_REG_END_OFFSET; else iommu->mmio_phys_end = MMIO_CNTR_CONF_OFFSET; - if (((h->efr_reg & (0x1 << IOMMU_EFR_GASUP_SHIFT)) == 0)) + + /* + * Note: GA (128-bit IRTE) mode requires cmpxchg16b supports. + * XT, GAM also requires GA mode. Therefore, we need to + * check cmpxchg16b support before enabling them. + */ + if (!boot_cpu_has(X86_FEATURE_CX16) || + ((h->efr_reg & (0x1 << IOMMU_EFR_GASUP_SHIFT)) == 0)) amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY; if (((h->efr_reg & (0x1 << IOMMU_EFR_XTSUP_SHIFT)) == 0)) amd_iommu_xt_mode = IRQ_REMAP_XAPIC_MODE;
From: Suravee Suthikulpanit suravee.suthikulpanit@amd.com
mainline inclusion from mainline-v5.9-rc4 commit 26e495f341075c09023ba16dee9a7f37a021e745 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8MI CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
mainline inclusion from mainline-v5.9-rc4 commit 26e495f341075c09023ba16dee9a7f37a021e745 category: bugfix bugzilla: 189075 CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
Currently, the RemapEn (valid) bit is accidentally cleared when programming IRTE w/ guestMode=0. It should be restored to the prior state.
Fixes: b9fc6b56f478 ("iommu/amd: Implements irq_set_vcpu_affinity() hook to setup vapic mode for pass-through devices") Signed-off-by: Suravee Suthikulpanit suravee.suthikulpanit@amd.com Reviewed-by: Joao Martins joao.m.martins@oracle.com Link: https://lore.kernel.org/r/20200903093822.52012-2-suravee.suthikulpanit@amd.c... Signed-off-by: Joerg Roedel jroedel@suse.de Signed-off-by: Guo Mengqi guomengqi3@huawei.com --- drivers/iommu/amd_iommu.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c index fbc5b5861d23..9db6a8af9617 100644 --- a/drivers/iommu/amd_iommu.c +++ b/drivers/iommu/amd_iommu.c @@ -4388,10 +4388,12 @@ static int amd_ir_set_vcpu_affinity(struct irq_data *data, void *vcpu_info) } else { /* Un-Setting */ struct irq_cfg *cfg = irqd_cfg(data); + u64 valid = irte->lo.fields_remap.valid;
irte->hi.val = 0; irte->lo.val = 0; irte->hi.fields.vector = cfg->vector; + irte->lo.fields_remap.valid = valid; irte->lo.fields_remap.guest_mode = 0; irte->lo.fields_remap.destination = APICID_TO_IRTE_DEST_LO(cfg->dest_apicid);
From: Huang Shijie sjhuang@iluvatar.ai
mainline inclusion from mainline-v5.12-rc1-dontuse commit 0e24465d3313832e82f8bd9ee2439da1367dd2e5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8MI CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
Just as bitmap_clear_ll(), change return type to unsigned long for bitmap_set_ll to avoid the possible overflow in future.
Link: https://lkml.kernel.org/r/20210105031644.2771-1-sjhuang@iluvatar.ai Signed-off-by: Huang Shijie sjhuang@iluvatar.ai Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Linus Torvalds torvalds@linux-foundation.org Signed-off-by: Guo Mengqi guomengqi3@huawei.com --- lib/genalloc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/lib/genalloc.c b/lib/genalloc.c index 0b8ee173cf3a..2f15b9de12c4 100644 --- a/lib/genalloc.c +++ b/lib/genalloc.c @@ -83,7 +83,8 @@ static int clear_bits_ll(unsigned long *addr, unsigned long mask_to_clear) * users set the same bit, one user will return remain bits, otherwise * return 0. */ -static int bitmap_set_ll(unsigned long *map, unsigned long start, unsigned long nr) +static unsigned long +bitmap_set_ll(unsigned long *map, unsigned long start, unsigned long nr) { unsigned long *p = map + BIT_WORD(start); const unsigned long size = start + nr;
From: Saravana Kannan saravanak@google.com
mainline inclusion from mainline-v5.13-rc1 commit b6f617df4fa936c1ab1831c2b23563f6c1add6c4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8MI CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
Device link status was not getting updated correctly when device_bind_driver() is called on a device. This causes a warning[1]. Fix this by updating device links that can be updated and dropping device links that can't be updated to a sensible state.
[1] - https://lore.kernel.org/lkml/56f7d032-ba5a-a8c7-23de-2969d98c527e@nvidia.com...
Tested-by: Jon Hunter jonathanh@nvidia.com Signed-off-by: Saravana Kannan saravanak@google.com Link: https://lore.kernel.org/r/20210302211133.2244281-3-saravanak@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Guo Mengqi guomengqi3@huawei.com --- drivers/base/base.h | 1 + drivers/base/core.c | 35 +++++++++++++++++++++++++++++++++++ drivers/base/dd.c | 4 +++- 3 files changed, 39 insertions(+), 1 deletion(-)
diff --git a/drivers/base/base.h b/drivers/base/base.h index 2d270b8c731a..dccc76f52ac5 100644 --- a/drivers/base/base.h +++ b/drivers/base/base.h @@ -160,6 +160,7 @@ static inline int devtmpfs_init(void) { return 0; } extern int device_links_read_lock(void); extern void device_links_read_unlock(int idx); extern int device_links_check_suppliers(struct device *dev); +extern void device_links_force_bind(struct device *dev); extern void device_links_driver_bound(struct device *dev); extern void device_links_driver_cleanup(struct device *dev); extern void device_links_no_driver(struct device *dev); diff --git a/drivers/base/core.c b/drivers/base/core.c index 7f27b007b040..9f527937a7f7 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -586,6 +586,41 @@ int device_links_check_suppliers(struct device *dev) return ret; }
+/** + * device_links_force_bind - Prepares device to be force bound + * @dev: Consumer device. + * + * device_bind_driver() force binds a device to a driver without calling any + * driver probe functions. So the consumer really isn't going to wait for any + * supplier before it's bound to the driver. We still want the device link + * states to be sensible when this happens. + * + * In preparation for device_bind_driver(), this function goes through each + * supplier device links and checks if the supplier is bound. If it is, then + * the device link status is set to CONSUMER_PROBE. Otherwise, the device link + * is dropped. Links without the DL_FLAG_MANAGED flag set are ignored. + */ +void device_links_force_bind(struct device *dev) +{ + struct device_link *link, *ln; + + device_links_write_lock(); + + list_for_each_entry_safe(link, ln, &dev->links.suppliers, c_node) { + if (!(link->flags & DL_FLAG_MANAGED)) + continue; + + if (link->status != DL_STATE_AVAILABLE) { + device_link_drop_managed(link); + continue; + } + WRITE_ONCE(link->status, DL_STATE_CONSUMER_PROBE); + } + dev->links.status = DL_DEV_PROBING; + + device_links_write_unlock(); +} + /** * device_links_driver_bound - Update device links after probing its driver. * @dev: Device to update the links for. diff --git a/drivers/base/dd.c b/drivers/base/dd.c index 0377c3c0f2d4..96cedc96a788 100644 --- a/drivers/base/dd.c +++ b/drivers/base/dd.c @@ -424,8 +424,10 @@ int device_bind_driver(struct device *dev) int ret;
ret = driver_sysfs_add(dev); - if (!ret) + if (!ret) { + device_links_force_bind(dev); driver_bound(dev); + } else if (dev->bus) blocking_notifier_call_chain(&dev->bus->p->bus_notifier, BUS_NOTIFY_DRIVER_NOT_BOUND, dev);
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://gitee.com/openeuler/kernel/pulls/1685 邮件列表地址：https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/I...
FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/1685 Mailing list address: https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/I...
-
Guo Mengqi -
patchwork bot