The Intel IOMMU driver opportunistically skips a few top level page
tables from the domain paging directory while programming the IOMMU
context entry. However there is an implicit assumption in the code that
domain's adjusted guest address width (agaw) would always be greater
than IOMMU's agaw.
The IOMMU capabilities in an upcoming platform cause the domain's agaw
to be lower than IOMMU's agaw. The issue is seen when the IOMMU supports
both 4-level and 5-level paging. The domain builds a 4-level page table
based on agaw of 2. However the IOMMU's agaw is set as 3 (5-level). In
this case the code incorrectly tries to skip page page table levels.
This causes the IOMMU driver to avoid programming the context entry. The
fix handles this case and programs the context entry accordingly.
Fixes: de24e55395698 ("iommu/vt-d: Simplify domain_context_mapping_one")
Cc: <stable(a)vger.kernel.org>
Cc: Ashok Raj <ashok.raj(a)intel.com>
Cc: Jacob Pan <jacob.jun.pan(a)linux.intel.com>
Cc: Lu Baolu <baolu.lu(a)linux.intel.com>
Reviewed-by: Lu Baolu <baolu.lu(a)linux.intel.com>
Reported-by: Ramos Falcon, Ernesto R <ernesto.r.ramos.falcon(a)intel.com>
Tested-by: Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com>
Signed-off-by: Sohil Mehta <sohil.mehta(a)intel.com>
---
drivers/iommu/intel-iommu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index f3ccf025108b..fdf79baf1d79 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2044,7 +2044,7 @@ static int domain_context_mapping_one(struct dmar_domain *domain,
* than default. Unnecessary for PT mode.
*/
if (translation != CONTEXT_TT_PASS_THROUGH) {
- for (agaw = domain->agaw; agaw != iommu->agaw; agaw--) {
+ for (agaw = domain->agaw; agaw > iommu->agaw; agaw--) {
ret = -ENOMEM;
pgd = phys_to_virt(dma_pte_addr(pgd));
if (!dma_pte_present(pgd))
@@ -2058,7 +2058,7 @@ static int domain_context_mapping_one(struct dmar_domain *domain,
translation = CONTEXT_TT_MULTI_LEVEL;
context_set_address_root(context, virt_to_phys(pgd));
- context_set_address_width(context, iommu->agaw);
+ context_set_address_width(context, agaw);
} else {
/*
* In pass through mode, AW must be programmed to
--
2.19.0
>>> On 22.11.18 at 07:58, <sashal(a)kernel.org> wrote:
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: 7f2590a110b8 x86/entry/64: Use a per-CPU trampoline stack for
> IDT entries.
>
> The bot has tested the following trees: v4.19.2, v4.18.19, v4.14.81.
>
> v4.19.2: Build OK!
> v4.18.19: Build OK!
> v4.14.81: Failed to apply! Possible dependencies:
> Unable to calculate
>
>
> How should we proceed with this patch?
Before evaluating backporting options, how about we first settle
on what's to go into the master branch?
Jan
This reverts commit 46431d9c28f6859f8e568ac7db92137f1da31100.
This commit fixes a bug in upstream commit a136f59c0a1f ("vb2: Move
buffer cache synchronisation to prepare from queue") which isn't
present in 4.4.
So as a result you get an UNBALANCED message in the kernel log if
this patch is applied:
vb2: counters for queue ffffffc0f3687478, buffer 3: UNBALANCED!
vb2: buf_init: 1 buf_cleanup: 1 buf_prepare: 805 buf_finish: 805
vb2: buf_queue: 806 buf_done: 806
vb2: alloc: 0 put: 0 prepare: 806 finish: 805 mmap: 0
vb2: get_userptr: 0 put_userptr: 0
vb2: attach_dmabuf: 1 detach_dmabuf: 1 map_dmabuf: 805 unmap_dmabuf: 805
vb2: get_dmabuf: 0 num_users: 1609 vaddr: 0 cookie: 805
Reverting this patch solves this regression.
Signed-off-by: Hans Verkuil <hans.verkuil(a)cisco.com>
---
Probably two reasons why this slipped through:
1) The patch was missing a Fixes: tag
2) I was probably CC-ed about this when it was about to be added to 4.9
but didn't realize that that was wrong.
---
drivers/media/v4l2-core/videobuf2-core.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index 1c37d5a..8ce9c63 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -870,12 +870,9 @@ void vb2_buffer_done(struct vb2_buffer *vb, enum vb2_buffer_state state)
dprintk(4, "done processing on buffer %d, state: %d\n",
vb->index, state);
- if (state != VB2_BUF_STATE_QUEUED &&
- state != VB2_BUF_STATE_REQUEUEING) {
- /* sync buffers */
- for (plane = 0; plane < vb->num_planes; ++plane)
- call_void_memop(vb, finish, vb->planes[plane].mem_priv);
- }
+ /* sync buffers */
+ for (plane = 0; plane < vb->num_planes; ++plane)
+ call_void_memop(vb, finish, vb->planes[plane].mem_priv);
spin_lock_irqsave(&q->done_lock, flags);
if (state == VB2_BUF_STATE_QUEUED ||
--
2.10.2
Salaam Aleikum,
The economy of Iraq has been devastated by the recent war, now that the war is winding down the emphasis in Iraq has turned to rebuilding a viable, vibrant economy, in this light the Iraq Reconstruction Management Office (IRMO) have been saddled with a renewed mandate from the Iraqi government to solicit, evaluate and recommend companies/individuals to work as partners in "THE RE-BUILD IRAQ PROJECT ". The launch of ongoing sourcing and bulk supply strategies has opened up new streams of public sector supply opportunities, as your company/individual has been shortlisted for this purpose and to participate " This project entails supplying various items for the Humanitarian Aid & Reconstruction Projects scheduled for all Provinces in the whole of Iraq.Please note given the current exigent circumstances in Iraq, the (IRMO) are currently accepting quotes to the port of Aquaba, Jordan from foreign contractors and Adhoc disbursement centers are now been utilized to expedite payments to contractors through our European payment centers..
Please kindly confirm your willingness to partake in this bulk supplies and contracting program under this new initiative "THE RE-BUILD IRAQ PROJECT ". Note confirmation should be strictly by our email as written below, in order to allow us send detailed procedures and the accompanying Iraq Reconstruction Management Office (IRMO) questionnaire will be sent promptly. Thank you for your co-operation.
Yours Faithfully,
Dr. Rahman Mahmoud
Email: drrahmanmahm(a)gmail.com
Commit-ID: 472de49fdc53365c880ab81ae2b5cfdd83db0b06
Gitweb: https://git.kernel.org/tip/472de49fdc53365c880ab81ae2b5cfdd83db0b06
Author: Jiri Olsa <jolsa(a)kernel.org>
AuthorDate: Wed, 21 Nov 2018 11:16:12 +0100
Committer: Ingo Molnar <mingo(a)kernel.org>
CommitDate: Thu, 22 Nov 2018 09:45:10 +0100
perf/x86/intel: Disallow precise_ip on BTS events
Vince reported a crash in the BTS flush code when touching the callchain
data, which was supposed to be initialized as an 'early' callchain,
but intel_pmu_drain_bts_buffer() does not do that:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
...
Call Trace:
<IRQ>
intel_pmu_drain_bts_buffer+0x151/0x220
? intel_get_event_constraints+0x219/0x360
? perf_assign_events+0xe2/0x2a0
? select_idle_sibling+0x22/0x3a0
? __update_load_avg_se+0x1ec/0x270
? enqueue_task_fair+0x377/0xdd0
? cpumask_next_and+0x19/0x20
? load_balance+0x134/0x950
? check_preempt_curr+0x7a/0x90
? ttwu_do_wakeup+0x19/0x140
x86_pmu_stop+0x3b/0x90
x86_pmu_del+0x57/0x160
event_sched_out.isra.106+0x81/0x170
group_sched_out.part.108+0x51/0xc0
__perf_event_disable+0x7f/0x160
event_function+0x8c/0xd0
remote_function+0x3c/0x50
flush_smp_call_function_queue+0x35/0xe0
smp_call_function_single_interrupt+0x3a/0xd0
call_function_single_interrupt+0xf/0x20
</IRQ>
It was triggered by fuzzer but can be easily reproduced by:
# perf record -e cpu/branch-instructions/pu -g -c 1
Peter suggested not to allow branch tracing for precise events:
> Now arguably, this is really stupid behaviour. Who in his right mind
> wants callchain output on BTS entries. And even if they do, BTS +
> precise_ip is nonsensical.
>
> So in my mind disallowing precise_ip on BTS would be the simplest fix.
Suggested-by: Peter Zijlstra <peterz(a)infradead.org>
Reported-by: Vince Weaver <vincent.weaver(a)maine.edu>
Signed-off-by: Jiri Olsa <jolsa(a)kernel.org>
Acked-by: Peter Zijlstra <a.p.zijlstra(a)chello.nl>
Cc: <stable(a)vger.kernel.org>
Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme(a)kernel.org>
Cc: Arnaldo Carvalho de Melo <acme(a)redhat.com>
Cc: Jiri Olsa <jolsa(a)redhat.com>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: Stephane Eranian <eranian(a)google.com>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Fixes: 6cbc304f2f36 ("perf/x86/intel: Fix unwind errors from PEBS entries (mk-II)")
Link: http://lkml.kernel.org/r/20181121101612.16272-3-jolsa@kernel.org
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
---
arch/x86/events/intel/core.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index a15a73788693..ecc3e34ca955 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3106,6 +3106,10 @@ static int intel_pmu_bts_config(struct perf_event *event)
if (!attr->exclude_kernel)
return -EOPNOTSUPP;
+ /* BTS is not allowed for precise events. */
+ if (attr->precise_ip)
+ return -EOPNOTSUPP;
+
/* disallow bts if conflicting events are present */
if (x86_add_exclusive(x86_lbr_exclusive_lbr))
return -EBUSY;