Skip to content

Commit e8214ed

Browse files
torvaldstorvalds
committed
Merge tag 'vfio-v6.17-rc1-v2' of https://github.com/awilliam/linux-vfio
Pull VFIO updates from Alex Williamson: - Fix imbalance where the no-iommu/cdev device path skips too much on open, failing to increment a reference, but still decrements the reference on close. Add bounds checking to prevent such underflows (Jacob Pan) - Fill missing detach_ioas op for pds_vfio_pci, fixing probe failure when used with IOMMUFD (Brett Creeley) - Split SR-IOV VFs to separate dev_set, avoiding unnecessary serialization between VFs that appear on the same bus (Alex Williamson) - Fix a theoretical integer overflow is the mlx5-vfio-pci variant driver (Artem Sadovnikov) - Implement missing VF token checking support via vfio cdev/IOMMUFD interface (Jason Gunthorpe) - Update QAT vfio-pci variant driver to claim latest VF devices (Małgorzata Mielnik) - Add a cond_resched() call to avoid holding the CPU too long during DMA mapping operations (Keith Busch) * tag 'vfio-v6.17-rc1-v2' of https://github.com/awilliam/linux-vfio: vfio/type1: conditional rescheduling while pinning vfio/qat: add support for intel QAT 6xxx virtual functions vfio/qat: Remove myself from VFIO QAT PCI driver maintainers vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD vfio/mlx5: fix possible overflow in tracking max message size vfio/pci: Separate SR-IOV VF dev_set vfio/pds: Fix missing detach_ioas op vfio: Prevent open_count decrement to negative vfio: Fix unbalanced vfio_df_close call in no-iommu mode
2 parents cca7a0a + b1779e4 commit e8214ed

File tree

18 files changed

+99
-22
lines changed

18 files changed

+99
-22
lines changed

‎MAINTAINERS

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26455,7 +26455,6 @@ S: Maintained
2645526455
F: drivers/vfio/platform/
2645626456

2645726457
VFIO QAT PCI DRIVER
26458-
M: Xin Zeng <[email protected]>
2645926458
M: Giovanni Cabiddu <[email protected]>
2646026459
L: [email protected]
2646126460
L: [email protected]

‎drivers/vfio/device_cdev.c

Lines changed: 35 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,22 +60,50 @@ static void vfio_df_get_kvm_safe(struct vfio_device_file *df)
6060
spin_unlock(&df->kvm_ref_lock);
6161
}
6262

63+
static int vfio_df_check_token(struct vfio_device *device,
64+
const struct vfio_device_bind_iommufd *bind)
65+
{
66+
uuid_t uuid;
67+
68+
if (!device->ops->match_token_uuid) {
69+
if (bind->flags & VFIO_DEVICE_BIND_FLAG_TOKEN)
70+
return -EINVAL;
71+
return 0;
72+
}
73+
74+
if (!(bind->flags & VFIO_DEVICE_BIND_FLAG_TOKEN))
75+
return device->ops->match_token_uuid(device, NULL);
76+
77+
if (copy_from_user(&uuid, u64_to_user_ptr(bind->token_uuid_ptr),
78+
sizeof(uuid)))
79+
return -EFAULT;
80+
return device->ops->match_token_uuid(device, &uuid);
81+
}
82+
6383
long vfio_df_ioctl_bind_iommufd(struct vfio_device_file *df,
6484
struct vfio_device_bind_iommufd __user *arg)
6585
{
86+
const u32 VALID_FLAGS = VFIO_DEVICE_BIND_FLAG_TOKEN;
6687
struct vfio_device *device = df->device;
6788
struct vfio_device_bind_iommufd bind;
6889
unsigned long minsz;
90+
u32 user_size;
6991
int ret;
7092

7193
static_assert(__same_type(arg->out_devid, df->devid));
7294

7395
minsz = offsetofend(struct vfio_device_bind_iommufd, out_devid);
7496

75-
if (copy_from_user(&bind, arg, minsz))
76-
return -EFAULT;
97+
ret = get_user(user_size, &arg->argsz);
98+
if (ret)
99+
return ret;
100+
if (user_size < minsz)
101+
return -EINVAL;
102+
ret = copy_struct_from_user(&bind, minsz, arg, user_size);
103+
if (ret)
104+
return ret;
77105

78-
if (bind.argsz < minsz || bind.flags || bind.iommufd < 0)
106+
if (bind.iommufd < 0 || bind.flags & ~VALID_FLAGS)
79107
return -EINVAL;
80108

81109
/* BIND_IOMMUFD only allowed for cdev fds */
@@ -93,6 +121,10 @@ long vfio_df_ioctl_bind_iommufd(struct vfio_device_file *df,
93121
goto out_unlock;
94122
}
95123

124+
ret = vfio_df_check_token(device, &bind);
125+
if (ret)
126+
goto out_unlock;
127+
96128
df->iommufd = iommufd_ctx_from_fd(bind.iommufd);
97129
if (IS_ERR(df->iommufd)) {
98130
ret = PTR_ERR(df->iommufd);

‎drivers/vfio/group.c

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -192,11 +192,10 @@ static int vfio_df_group_open(struct vfio_device_file *df)
192192
* implies they expected translation to exist
193193
*/
194194
if (!capable(CAP_SYS_RAWIO) ||
195-
vfio_iommufd_device_has_compat_ioas(device, df->iommufd))
195+
vfio_iommufd_device_has_compat_ioas(device, df->iommufd)) {
196196
ret = -EPERM;
197-
else
198-
ret = 0;
199-
goto out_put_kvm;
197+
goto out_put_kvm;
198+
}
200199
}
201200

202201
ret = vfio_df_open(df);

‎drivers/vfio/iommufd.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ int vfio_df_iommufd_bind(struct vfio_device_file *df)
2525

2626
lockdep_assert_held(&vdev->dev_set->lock);
2727

28+
/* Returns 0 to permit device opening under noiommu mode */
29+
if (vfio_device_is_noiommu(vdev))
30+
return 0;
31+
2832
return vdev->ops->bind_iommufd(vdev, ictx, &df->devid);
2933
}
3034

‎drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1583,6 +1583,7 @@ static const struct vfio_device_ops hisi_acc_vfio_pci_ops = {
15831583
.mmap = vfio_pci_core_mmap,
15841584
.request = vfio_pci_core_request,
15851585
.match = vfio_pci_core_match,
1586+
.match_token_uuid = vfio_pci_core_match_token_uuid,
15861587
.bind_iommufd = vfio_iommufd_physical_bind,
15871588
.unbind_iommufd = vfio_iommufd_physical_unbind,
15881589
.attach_ioas = vfio_iommufd_physical_attach_ioas,

‎drivers/vfio/pci/mlx5/cmd.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1523,8 +1523,8 @@ int mlx5vf_start_page_tracker(struct vfio_device *vdev,
15231523
log_max_msg_size = MLX5_CAP_ADV_VIRTUALIZATION(mdev, pg_track_log_max_msg_size);
15241524
max_msg_size = (1ULL << log_max_msg_size);
15251525
/* The RQ must hold at least 4 WQEs/messages for successful QP creation */
1526-
if (rq_size < 4 * max_msg_size)
1527-
rq_size = 4 * max_msg_size;
1526+
if (rq_size < 4ULL * max_msg_size)
1527+
rq_size = 4ULL * max_msg_size;
15281528

15291529
memset(tracker, 0, sizeof(*tracker));
15301530
tracker->uar = mlx5_get_uars_page(mdev);

‎drivers/vfio/pci/mlx5/main.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1372,6 +1372,7 @@ static const struct vfio_device_ops mlx5vf_pci_ops = {
13721372
.mmap = vfio_pci_core_mmap,
13731373
.request = vfio_pci_core_request,
13741374
.match = vfio_pci_core_match,
1375+
.match_token_uuid = vfio_pci_core_match_token_uuid,
13751376
.bind_iommufd = vfio_iommufd_physical_bind,
13761377
.unbind_iommufd = vfio_iommufd_physical_unbind,
13771378
.attach_ioas = vfio_iommufd_physical_attach_ioas,

‎drivers/vfio/pci/nvgrace-gpu/main.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -696,6 +696,7 @@ static const struct vfio_device_ops nvgrace_gpu_pci_ops = {
696696
.mmap = nvgrace_gpu_mmap,
697697
.request = vfio_pci_core_request,
698698
.match = vfio_pci_core_match,
699+
.match_token_uuid = vfio_pci_core_match_token_uuid,
699700
.bind_iommufd = vfio_iommufd_physical_bind,
700701
.unbind_iommufd = vfio_iommufd_physical_unbind,
701702
.attach_ioas = vfio_iommufd_physical_attach_ioas,
@@ -715,6 +716,7 @@ static const struct vfio_device_ops nvgrace_gpu_pci_core_ops = {
715716
.mmap = vfio_pci_core_mmap,
716717
.request = vfio_pci_core_request,
717718
.match = vfio_pci_core_match,
719+
.match_token_uuid = vfio_pci_core_match_token_uuid,
718720
.bind_iommufd = vfio_iommufd_physical_bind,
719721
.unbind_iommufd = vfio_iommufd_physical_unbind,
720722
.attach_ioas = vfio_iommufd_physical_attach_ioas,

‎drivers/vfio/pci/pds/vfio_dev.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,9 +201,11 @@ static const struct vfio_device_ops pds_vfio_ops = {
201201
.mmap = vfio_pci_core_mmap,
202202
.request = vfio_pci_core_request,
203203
.match = vfio_pci_core_match,
204+
.match_token_uuid = vfio_pci_core_match_token_uuid,
204205
.bind_iommufd = vfio_iommufd_physical_bind,
205206
.unbind_iommufd = vfio_iommufd_physical_unbind,
206207
.attach_ioas = vfio_iommufd_physical_attach_ioas,
208+
.detach_ioas = vfio_iommufd_physical_detach_ioas,
207209
};
208210

209211
const struct vfio_device_ops *pds_vfio_ops_info(void)

‎drivers/vfio/pci/qat/main.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -614,6 +614,7 @@ static const struct vfio_device_ops qat_vf_pci_ops = {
614614
.mmap = vfio_pci_core_mmap,
615615
.request = vfio_pci_core_request,
616616
.match = vfio_pci_core_match,
617+
.match_token_uuid = vfio_pci_core_match_token_uuid,
617618
.bind_iommufd = vfio_iommufd_physical_bind,
618619
.unbind_iommufd = vfio_iommufd_physical_unbind,
619620
.attach_ioas = vfio_iommufd_physical_attach_ioas,
@@ -675,6 +676,8 @@ static const struct pci_device_id qat_vf_vfio_pci_table[] = {
675676
{ PCI_DRIVER_OVERRIDE_DEVICE_VFIO(PCI_VENDOR_ID_INTEL, 0x4941) },
676677
{ PCI_DRIVER_OVERRIDE_DEVICE_VFIO(PCI_VENDOR_ID_INTEL, 0x4943) },
677678
{ PCI_DRIVER_OVERRIDE_DEVICE_VFIO(PCI_VENDOR_ID_INTEL, 0x4945) },
679+
/* Intel QAT GEN6 6xxx VF device */
680+
{ PCI_DRIVER_OVERRIDE_DEVICE_VFIO(PCI_VENDOR_ID_INTEL, 0x4949) },
678681
{}
679682
};
680683
MODULE_DEVICE_TABLE(pci, qat_vf_vfio_pci_table);
@@ -696,5 +699,5 @@ module_pci_driver(qat_vf_vfio_pci_driver);
696699

697700
MODULE_LICENSE("GPL");
698701
MODULE_AUTHOR("Xin Zeng <[email protected]>");
699-
MODULE_DESCRIPTION("QAT VFIO PCI - VFIO PCI driver with live migration support for Intel(R) QAT GEN4 device family");
702+
MODULE_DESCRIPTION("QAT VFIO PCI - VFIO PCI driver with live migration support for Intel(R) QAT device family");
700703
MODULE_IMPORT_NS("CRYPTO_QAT");

0 commit comments

Comments
 (0)