From: Tony Krowiak <akrowiak(a)linux.ibm.com>
The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or
domain is assigned to the mdev. The purpose of the function is to update
the guest's AP configuration by filtering the matrix of adapters and
domains assigned to the mdev. When an adapter or domain is assigned, only
the APQNs associated with the APID of the new adapter or APQI of the new
domain are inspected. If an APQN does not reference a queue device bound to
the vfio_ap device driver, then it's APID will be filtered from the mdev's
matrix when updating the guest's AP configuration.
Inspecting only the APID of the new adapter or APQI of the new domain will
result in passing AP queues through to a guest that are not bound to the
vfio_ap device driver under certain circumstances. Consider the following:
guest's AP configuration (all also assigned to the mdev's matrix):
14.0004
14.0005
14.0006
16.0004
16.0005
16.0006
unassign domain 4
unbind queue 16.0005
assign domain 4
When domain 4 is re-assigned, since only domain 4 will be inspected, the
APQNs that will be examined will be:
14.0004
16.0004
Since both of those APQNs reference queue devices that are bound to the
vfio_ap device driver, nothing will get filtered from the mdev's matrix
when updating the guest's AP configuration. Consequently, queue 16.0005
will get passed through despite not being bound to the driver. This
violates the linux device model requirement that a guest shall only be
given access to devices bound to the device driver facilitating their
pass-through.
To resolve this problem, every adapter and domain assigned to the mdev will
be inspected when filtering the mdev's matrix.
Signed-off-by: Tony Krowiak <akrowiak(a)linux.ibm.com>
Acked-by: Halil Pasic <pasic(a)linux.ibm.com>
Fixes: 48cae940c31d ("s390/vfio-ap: refresh guest's APCB by filtering AP resources assigned to mdev")
Cc: <stable(a)vger.kernel.org>
---
drivers/s390/crypto/vfio_ap_ops.c | 57 +++++++++----------------------
1 file changed, 17 insertions(+), 40 deletions(-)
diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c
index acb710d3d7bc..1f7a6c106786 100644
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -674,8 +674,7 @@ static bool vfio_ap_mdev_filter_cdoms(struct ap_matrix_mdev *matrix_mdev)
* Return: a boolean value indicating whether the KVM guest's APCB was changed
* by the filtering or not.
*/
-static bool vfio_ap_mdev_filter_matrix(unsigned long *apm, unsigned long *aqm,
- struct ap_matrix_mdev *matrix_mdev)
+static bool vfio_ap_mdev_filter_matrix(struct ap_matrix_mdev *matrix_mdev)
{
unsigned long apid, apqi, apqn;
DECLARE_BITMAP(prev_shadow_apm, AP_DEVICES);
@@ -696,8 +695,8 @@ static bool vfio_ap_mdev_filter_matrix(unsigned long *apm, unsigned long *aqm,
bitmap_and(matrix_mdev->shadow_apcb.aqm, matrix_mdev->matrix.aqm,
(unsigned long *)matrix_dev->info.aqm, AP_DOMAINS);
- for_each_set_bit_inv(apid, apm, AP_DEVICES) {
- for_each_set_bit_inv(apqi, aqm, AP_DOMAINS) {
+ for_each_set_bit_inv(apid, matrix_mdev->matrix.apm, AP_DEVICES) {
+ for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm, AP_DOMAINS) {
/*
* If the APQN is not bound to the vfio_ap device
* driver, then we can't assign it to the guest's
@@ -962,7 +961,6 @@ static ssize_t assign_adapter_store(struct device *dev,
{
int ret;
unsigned long apid;
- DECLARE_BITMAP(apm_delta, AP_DEVICES);
struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev);
mutex_lock(&ap_perms_mutex);
@@ -991,11 +989,8 @@ static ssize_t assign_adapter_store(struct device *dev,
}
vfio_ap_mdev_link_adapter(matrix_mdev, apid);
- memset(apm_delta, 0, sizeof(apm_delta));
- set_bit_inv(apid, apm_delta);
- if (vfio_ap_mdev_filter_matrix(apm_delta,
- matrix_mdev->matrix.aqm, matrix_mdev))
+ if (vfio_ap_mdev_filter_matrix(matrix_mdev))
vfio_ap_mdev_update_guest_apcb(matrix_mdev);
ret = count;
@@ -1171,7 +1166,6 @@ static ssize_t assign_domain_store(struct device *dev,
{
int ret;
unsigned long apqi;
- DECLARE_BITMAP(aqm_delta, AP_DOMAINS);
struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev);
mutex_lock(&ap_perms_mutex);
@@ -1200,11 +1194,8 @@ static ssize_t assign_domain_store(struct device *dev,
}
vfio_ap_mdev_link_domain(matrix_mdev, apqi);
- memset(aqm_delta, 0, sizeof(aqm_delta));
- set_bit_inv(apqi, aqm_delta);
- if (vfio_ap_mdev_filter_matrix(matrix_mdev->matrix.apm, aqm_delta,
- matrix_mdev))
+ if (vfio_ap_mdev_filter_matrix(matrix_mdev))
vfio_ap_mdev_update_guest_apcb(matrix_mdev);
ret = count;
@@ -2109,9 +2100,7 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev)
if (matrix_mdev) {
vfio_ap_mdev_link_queue(matrix_mdev, q);
- if (vfio_ap_mdev_filter_matrix(matrix_mdev->matrix.apm,
- matrix_mdev->matrix.aqm,
- matrix_mdev))
+ if (vfio_ap_mdev_filter_matrix(matrix_mdev))
vfio_ap_mdev_update_guest_apcb(matrix_mdev);
}
dev_set_drvdata(&apdev->device, q);
@@ -2461,34 +2450,22 @@ void vfio_ap_on_cfg_changed(struct ap_config_info *cur_cfg_info,
static void vfio_ap_mdev_hot_plug_cfg(struct ap_matrix_mdev *matrix_mdev)
{
- bool do_hotplug = false;
- int filter_domains = 0;
- int filter_adapters = 0;
- DECLARE_BITMAP(apm, AP_DEVICES);
- DECLARE_BITMAP(aqm, AP_DOMAINS);
+ bool filter_domains, filter_adapters, filter_cdoms, do_hotplug = false;
mutex_lock(&matrix_mdev->kvm->lock);
mutex_lock(&matrix_dev->mdevs_lock);
- filter_adapters = bitmap_and(apm, matrix_mdev->matrix.apm,
- matrix_mdev->apm_add, AP_DEVICES);
- filter_domains = bitmap_and(aqm, matrix_mdev->matrix.aqm,
- matrix_mdev->aqm_add, AP_DOMAINS);
-
- if (filter_adapters && filter_domains)
- do_hotplug |= vfio_ap_mdev_filter_matrix(apm, aqm, matrix_mdev);
- else if (filter_adapters)
- do_hotplug |=
- vfio_ap_mdev_filter_matrix(apm,
- matrix_mdev->shadow_apcb.aqm,
- matrix_mdev);
- else
- do_hotplug |=
- vfio_ap_mdev_filter_matrix(matrix_mdev->shadow_apcb.apm,
- aqm, matrix_mdev);
+ filter_adapters = bitmap_intersects(matrix_mdev->matrix.apm,
+ matrix_mdev->apm_add, AP_DEVICES);
+ filter_domains = bitmap_intersects(matrix_mdev->matrix.aqm,
+ matrix_mdev->aqm_add, AP_DOMAINS);
+ filter_cdoms = bitmap_intersects(matrix_mdev->matrix.adm,
+ matrix_mdev->adm_add, AP_DOMAINS);
+
+ if (filter_adapters || filter_domains)
+ do_hotplug = vfio_ap_mdev_filter_matrix(matrix_mdev);
- if (bitmap_intersects(matrix_mdev->matrix.adm, matrix_mdev->adm_add,
- AP_DOMAINS))
+ if (filter_cdoms)
do_hotplug |= vfio_ap_mdev_filter_cdoms(matrix_mdev);
if (do_hotplug)
--
2.43.0
I'm announcing the release of the 6.6.12 kernel.
All users of the 6.6 kernel series must upgrade.
The updated 6.6.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
fs/nfsd/nfsctl.c | 31 +++++++++++++++++--------------
fs/nfsd/nfsd.h | 7 -------
3 files changed, 18 insertions(+), 22 deletions(-)
Greg Kroah-Hartman (1):
Linux 6.6.12
Jeff Layton (1):
nfsd: drop the nfsd_put helper
I'm announcing the release of the 6.1.73 kernel.
All users of the 6.1 kernel series must upgrade.
The updated 6.1.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.1.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
fs/nfsd/nfsctl.c | 9 +-------
fs/nfsd/nfsd.h | 8 -------
fs/nfsd/nfssvc.c | 52 +++++++++++++++++++++++++++++++------------------
fs/smb/client/cifsfs.c | 2 -
include/net/dst_ops.h | 2 -
net/core/dst.c | 8 +------
net/ipv6/route.c | 13 ++++--------
8 files changed, 46 insertions(+), 50 deletions(-)
Greg Kroah-Hartman (3):
Revert "nfsd: call nfsd_last_thread() before final nfsd_put()"
Revert "nfsd: separate nfsd_last_thread() from nfsd_put()"
Linux 6.1.73
Jon Maxwell (1):
ipv6: remove max_size check inline with ipv4
Steve French (1):
cifs: fix flushing folio regression for 6.1 backport
I'm announcing the release of the 4.19.305 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm/mach-sunxi/mc_smp.c | 4
drivers/firewire/ohci.c | 51 +++++
drivers/mmc/core/block.c | 7
drivers/mmc/core/host.c | 1
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4
drivers/net/ethernet/intel/i40e/i40e_main.c | 11 +
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 +++
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 3
drivers/net/ethernet/qlogic/qla3xxx.c | 198 +++++++++------------
drivers/net/usb/ax88172a.c | 4
drivers/pci/quirks.c | 28 ++
fs/fuse/dir.c | 10 -
include/net/dst_ops.h | 6
include/net/netns/ipv6.h | 4
mm/memory-failure.c | 6
mm/memory.c | 4
net/core/dst.c | 8
net/ipv6/route.c | 25 +-
net/netfilter/nf_tables_api.c | 27 ++
net/nfc/llcp_core.c | 39 +++-
net/sched/em_text.c | 4
net/socket.c | 2
24 files changed, 330 insertions(+), 156 deletions(-)
Adrian Cinal (1):
net: bcmgenet: Fix FCS generation for fragmented skbuffs
Andrii Staikov (1):
i40e: Restore VF MSI-X state during PCI reset
Bartosz Pawlowski (2):
PCI: Extract ATS disabling to a helper function
PCI: Disable ATS for specific Intel IPU E2000 devices
Chen Ni (1):
asix: Add check for usbnet_get_endpoints
Christophe JAILLET (1):
net/qla3xxx: switch from 'pci_' to 'dma_' API
Dinghao Liu (1):
net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues
Eric Dumazet (2):
net/dst: use a smaller percpu_counter batch for dst entries accounting
ipv6: make ip6_rt_gc_expire an atomic_t
Geert Uytterhoeven (1):
mmc: core: Cancel delayed work before releasing host
Greg Kroah-Hartman (1):
Linux 4.19.305
Hangyu Hua (1):
net: sched: em_text: fix possible memory leak in em_text_destroy()
Jiajun Xie (1):
mm: fix unmap_mapping_range high bits shift bug
Jon Maxwell (1):
ipv6: remove max_size check inline with ipv4
Jorge Ramirez-Ortiz (1):
mmc: rpmb: fixes pause retune on all RPMB partitions.
Ke Xiao (1):
i40e: fix use-after-free in i40e_aqc_add_filters()
Marc Dionne (1):
net: Save and restore msg_namelen in sock_sendmsg
Matthew Wilcox (Oracle) (1):
mm/memory-failure: check the mapcount of the precise page
Michael Chan (1):
bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters()
Peter Oskolkov (1):
net: add a route cache full diagnostic message
Phil Sutter (1):
netfilter: nf_tables: Reject tables of unsupported family
Siddh Raman Pant (1):
nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local
Stefan Wahren (1):
ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init
Sudheer Mogilappagari (1):
i40e: Fix filter input checks to prevent config with invalid values
Takashi Sakamoto (1):
firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards
ruanmeisi (1):
fuse: nlookup missing decrement in fuse_direntplus_link
This is the start of the stable review cycle for the 4.19.305 release.
There are 25 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon, 15 Jan 2024 09:41:55 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.305-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.305-rc1
Jon Maxwell <jmaxwell37(a)gmail.com>
ipv6: remove max_size check inline with ipv4
Eric Dumazet <edumazet(a)google.com>
ipv6: make ip6_rt_gc_expire an atomic_t
Eric Dumazet <edumazet(a)google.com>
net/dst: use a smaller percpu_counter batch for dst entries accounting
Peter Oskolkov <posk(a)google.com>
net: add a route cache full diagnostic message
Bartosz Pawlowski <bartosz.pawlowski(a)intel.com>
PCI: Disable ATS for specific Intel IPU E2000 devices
Bartosz Pawlowski <bartosz.pawlowski(a)intel.com>
PCI: Extract ATS disabling to a helper function
Phil Sutter <phil(a)nwl.cc>
netfilter: nf_tables: Reject tables of unsupported family
ruanmeisi <ruan.meisi(a)zte.com.cn>
fuse: nlookup missing decrement in fuse_direntplus_link
Geert Uytterhoeven <geert+renesas(a)glider.be>
mmc: core: Cancel delayed work before releasing host
Jorge Ramirez-Ortiz <jorge(a)foundries.io>
mmc: rpmb: fixes pause retune on all RPMB partitions.
Jiajun Xie <jiajun.xie.sh(a)gmail.com>
mm: fix unmap_mapping_range high bits shift bug
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards
Matthew Wilcox (Oracle) <willy(a)infradead.org>
mm/memory-failure: check the mapcount of the precise page
Michael Chan <michael.chan(a)broadcom.com>
bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters()
Chen Ni <nichen(a)iscas.ac.cn>
asix: Add check for usbnet_get_endpoints
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
net/qla3xxx: switch from 'pci_' to 'dma_' API
Andrii Staikov <andrii.staikov(a)intel.com>
i40e: Restore VF MSI-X state during PCI reset
Ke Xiao <xiaoke(a)sangfor.com.cn>
i40e: fix use-after-free in i40e_aqc_add_filters()
Marc Dionne <marc.dionne(a)auristor.com>
net: Save and restore msg_namelen in sock_sendmsg
Adrian Cinal <adriancinal(a)gmail.com>
net: bcmgenet: Fix FCS generation for fragmented skbuffs
Stefan Wahren <wahrenst(a)gmx.net>
ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init
Hangyu Hua <hbh25y(a)gmail.com>
net: sched: em_text: fix possible memory leak in em_text_destroy()
Sudheer Mogilappagari <sudheer.mogilappagari(a)intel.com>
i40e: Fix filter input checks to prevent config with invalid values
Siddh Raman Pant <code(a)siddh.me>
nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local
-------------
Diffstat:
Makefile | 4 +-
arch/arm/mach-sunxi/mc_smp.c | 4 +-
drivers/firewire/ohci.c | 51 ++++++
drivers/mmc/core/block.c | 7 +-
drivers/mmc/core/host.c | 1 +
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +-
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 11 +-
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 +++-
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 3 +
drivers/net/ethernet/qlogic/qla3xxx.c | 198 +++++++++------------
drivers/net/usb/ax88172a.c | 4 +-
drivers/pci/quirks.c | 28 ++-
fs/fuse/dir.c | 10 +-
include/net/dst_ops.h | 6 +-
include/net/netns/ipv6.h | 4 +-
mm/memory-failure.c | 6 +-
mm/memory.c | 4 +-
net/core/dst.c | 8 +-
net/ipv6/route.c | 25 +--
net/netfilter/nf_tables_api.c | 27 +++
net/nfc/llcp_core.c | 39 +++-
net/sched/em_text.c | 4 +-
net/socket.c | 2 +
24 files changed, 331 insertions(+), 157 deletions(-)