1. 06 9月, 2019 1 次提交
    • S
      iommu/amd: Flush old domains in kdump kernel · 36b7200f
      Stuart Hayes 提交于
      When devices are attached to the amd_iommu in a kdump kernel, the old device
      table entries (DTEs), which were copied from the crashed kernel, will be
      overwritten with a new domain number.  When the new DTE is written, the IOMMU
      is told to flush the DTE from its internal cache--but it is not told to flush
      the translation cache entries for the old domain number.
      
      Without this patch, AMD systems using the tg3 network driver fail when kdump
      tries to save the vmcore to a network system, showing network timeouts and
      (sometimes) IOMMU errors in the kernel log.
      
      This patch will flush IOMMU translation cache entries for the old domain when
      a DTE gets overwritten with a new domain number.
      Signed-off-by: NStuart Hayes <stuart.w.hayes@gmail.com>
      Fixes: 3ac3e5ee ('iommu/amd: Copy old trans table from old kernel')
      Signed-off-by: NJoerg Roedel <jroedel@suse.de>
      36b7200f
  2. 22 7月, 2019 1 次提交
    • Q
      iommu/amd: fix a crash in iova_magazine_free_pfns · 8cf66504
      Qian Cai 提交于
      The commit b3aa14f0 ("iommu: remove the mapping_error dma_map_ops
      method") incorrectly changed the checking from dma_ops_alloc_iova() in
      map_sg() causes a crash under memory pressure as dma_ops_alloc_iova()
      never return DMA_MAPPING_ERROR on failure but 0, so the error handling
      is all wrong.
      
         kernel BUG at drivers/iommu/iova.c:801!
          Workqueue: kblockd blk_mq_run_work_fn
          RIP: 0010:iova_magazine_free_pfns+0x7d/0xc0
          Call Trace:
           free_cpu_cached_iovas+0xbd/0x150
           alloc_iova_fast+0x8c/0xba
           dma_ops_alloc_iova.isra.6+0x65/0xa0
           map_sg+0x8c/0x2a0
           scsi_dma_map+0xc6/0x160
           pqi_aio_submit_io+0x1f6/0x440 [smartpqi]
           pqi_scsi_queue_command+0x90c/0xdd0 [smartpqi]
           scsi_queue_rq+0x79c/0x1200
           blk_mq_dispatch_rq_list+0x4dc/0xb70
           blk_mq_sched_dispatch_requests+0x249/0x310
           __blk_mq_run_hw_queue+0x128/0x200
           blk_mq_run_work_fn+0x27/0x30
           process_one_work+0x522/0xa10
           worker_thread+0x63/0x5b0
           kthread+0x1d2/0x1f0
           ret_from_fork+0x22/0x40
      
      Fixes: b3aa14f0 ("iommu: remove the mapping_error dma_map_ops method")
      Signed-off-by: NQian Cai <cai@lca.pw>
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      8cf66504
  3. 01 7月, 2019 1 次提交
  4. 05 6月, 2019 1 次提交
  5. 28 5月, 2019 1 次提交
  6. 27 5月, 2019 1 次提交
  7. 07 5月, 2019 1 次提交
  8. 06 5月, 2019 1 次提交
  9. 03 5月, 2019 1 次提交
  10. 30 4月, 2019 1 次提交
  11. 26 4月, 2019 1 次提交
  12. 11 4月, 2019 2 次提交
  13. 30 3月, 2019 1 次提交
  14. 18 3月, 2019 1 次提交
    • S
      iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE · 4e50ce03
      Stanislaw Gruszka 提交于
      Take into account that sg->offset can be bigger than PAGE_SIZE when
      setting segment sg->dma_address. Otherwise sg->dma_address will point
      at diffrent page, what makes DMA not possible with erros like this:
      
      xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa70c0 flags=0x0020]
      xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7040 flags=0x0020]
      xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7080 flags=0x0020]
      xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7100 flags=0x0020]
      xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7000 flags=0x0020]
      
      Additinally with wrong sg->dma_address unmap_sg will free wrong pages,
      what what can cause crashes like this:
      
      Feb 28 19:27:45 kernel: BUG: Bad page state in process cinnamon  pfn:39e8b1
      Feb 28 19:27:45 kernel: Disabling lock debugging due to kernel taint
      Feb 28 19:27:45 kernel: flags: 0x2ffff0000000000()
      Feb 28 19:27:45 kernel: raw: 02ffff0000000000 0000000000000000 ffffffff00000301 0000000000000000
      Feb 28 19:27:45 kernel: raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
      Feb 28 19:27:45 kernel: page dumped because: nonzero _refcount
      Feb 28 19:27:45 kernel: Modules linked in: ccm fuse arc4 nct6775 hwmon_vid amdgpu nls_iso8859_1 nls_cp437 edac_mce_amd vfat fat kvm_amd ccp rng_core kvm mt76x0u mt76x0_common mt76x02_usb irqbypass mt76_usb mt76x02_lib mt76 crct10dif_pclmul crc32_pclmul chash mac80211 amd_iommu_v2 ghash_clmulni_intel gpu_sched i2c_algo_bit ttm wmi_bmof snd_hda_codec_realtek snd_hda_codec_generic drm_kms_helper snd_hda_codec_hdmi snd_hda_intel drm snd_hda_codec aesni_intel snd_hda_core snd_hwdep aes_x86_64 crypto_simd snd_pcm cfg80211 cryptd mousedev snd_timer glue_helper pcspkr r8169 input_leds realtek agpgart libphy rfkill snd syscopyarea sysfillrect sysimgblt fb_sys_fops soundcore sp5100_tco k10temp i2c_piix4 wmi evdev gpio_amdpt pinctrl_amd mac_hid pcc_cpufreq acpi_cpufreq sg ip_tables x_tables ext4(E) crc32c_generic(E) crc16(E) mbcache(E) jbd2(E) fscrypto(E) sd_mod(E) hid_generic(E) usbhid(E) hid(E) dm_mod(E) serio_raw(E) atkbd(E) libps2(E) crc32c_intel(E) ahci(E) libahci(E) libata(E) xhci_pci(E) xhci_hcd(E)
      Feb 28 19:27:45 kernel:  scsi_mod(E) i8042(E) serio(E) bcache(E) crc64(E)
      Feb 28 19:27:45 kernel: CPU: 2 PID: 896 Comm: cinnamon Tainted: G    B   W   E     4.20.12-arch1-1-custom #1
      Feb 28 19:27:45 kernel: Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./B450M Pro4, BIOS P1.20 06/26/2018
      Feb 28 19:27:45 kernel: Call Trace:
      Feb 28 19:27:45 kernel:  dump_stack+0x5c/0x80
      Feb 28 19:27:45 kernel:  bad_page.cold.29+0x7f/0xb2
      Feb 28 19:27:45 kernel:  __free_pages_ok+0x2c0/0x2d0
      Feb 28 19:27:45 kernel:  skb_release_data+0x96/0x180
      Feb 28 19:27:45 kernel:  __kfree_skb+0xe/0x20
      Feb 28 19:27:45 kernel:  tcp_recvmsg+0x894/0xc60
      Feb 28 19:27:45 kernel:  ? reuse_swap_page+0x120/0x340
      Feb 28 19:27:45 kernel:  ? ptep_set_access_flags+0x23/0x30
      Feb 28 19:27:45 kernel:  inet_recvmsg+0x5b/0x100
      Feb 28 19:27:45 kernel:  __sys_recvfrom+0xc3/0x180
      Feb 28 19:27:45 kernel:  ? handle_mm_fault+0x10a/0x250
      Feb 28 19:27:45 kernel:  ? syscall_trace_enter+0x1d3/0x2d0
      Feb 28 19:27:45 kernel:  ? __audit_syscall_exit+0x22a/0x290
      Feb 28 19:27:45 kernel:  __x64_sys_recvfrom+0x24/0x30
      Feb 28 19:27:45 kernel:  do_syscall_64+0x5b/0x170
      Feb 28 19:27:45 kernel:  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      Cc: stable@vger.kernel.org
      Reported-and-tested-by: NJan Viktorin <jan.viktorin@gmail.com>
      Reviewed-by: NAlexander Duyck <alexander.h.duyck@linux.intel.com>
      Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
      Fixes: 80187fd3 ('iommu/amd: Optimize map_sg and unmap_sg')
      Signed-off-by: NJoerg Roedel <jroedel@suse.de>
      4e50ce03
  15. 15 3月, 2019 1 次提交
  16. 11 2月, 2019 1 次提交
  17. 31 1月, 2019 1 次提交
  18. 24 1月, 2019 1 次提交
    • S
      iommu/amd: Fix IOMMU page flush when detach device from a domain · 9825bd94
      Suravee Suthikulpanit 提交于
      When a VM is terminated, the VFIO driver detaches all pass-through
      devices from VFIO domain by clearing domain id and page table root
      pointer from each device table entry (DTE), and then invalidates
      the DTE. Then, the VFIO driver unmap pages and invalidate IOMMU pages.
      
      Currently, the IOMMU driver keeps track of which IOMMU and how many
      devices are attached to the domain. When invalidate IOMMU pages,
      the driver checks if the IOMMU is still attached to the domain before
      issuing the invalidate page command.
      
      However, since VFIO has already detached all devices from the domain,
      the subsequent INVALIDATE_IOMMU_PAGES commands are being skipped as
      there is no IOMMU attached to the domain. This results in data
      corruption and could cause the PCI device to end up in indeterministic
      state.
      
      Fix this by invalidate IOMMU pages when detach a device, and
      before decrementing the per-domain device reference counts.
      
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Suggested-by: NJoerg Roedel <joro@8bytes.org>
      Co-developed-by: NBrijesh Singh <brijesh.singh@amd.com>
      Signed-off-by: NBrijesh Singh <brijesh.singh@amd.com>
      Signed-off-by: NSuravee Suthikulpanit <suravee.suthikulpanit@amd.com>
      Fixes: 6de8ad9b ('x86/amd-iommu: Make iommu_flush_pages aware of multiple IOMMUs')
      Signed-off-by: NJoerg Roedel <jroedel@suse.de>
      9825bd94
  19. 22 1月, 2019 2 次提交
  20. 14 12月, 2018 1 次提交
  21. 07 12月, 2018 1 次提交
    • Y
      iommu/amd: Fix amd_iommu=force_isolation · c12b08eb
      Yu Zhao 提交于
      The parameter is still there but it's ignored. We need to check its
      value before deciding to go into passthrough mode for AMD IOMMU v2
      capable device.
      
      We occasionally use this parameter to force v2 capable device into
      translation mode to debug memory corruption that we suspect is
      caused by DMA writes.
      
      To address the following comment from Joerg Roedel on the first
      version, v2 capability of device is completely ignored.
      > This breaks the iommu_v2 use-case, as it needs a direct mapping for the
      > devices that support it.
      
      And from Documentation/admin-guide/kernel-parameters.txt:
        This option does not override iommu=pt
      
      Fixes: aafd8ba0 ("iommu/amd: Implement add_device and remove_device")
      Signed-off-by: NYu Zhao <yuzhao@google.com>
      Signed-off-by: NJoerg Roedel <jroedel@suse.de>
      c12b08eb
  22. 06 12月, 2018 1 次提交
  23. 28 11月, 2018 3 次提交
  24. 15 11月, 2018 6 次提交
  25. 08 10月, 2018 1 次提交
  26. 05 10月, 2018 1 次提交
    • S
      iommu/amd: Clear memory encryption mask from physical address · b3e9b515
      Singh, Brijesh 提交于
      Boris Ostrovsky reported a memory leak with device passthrough when SME
      is active.
      
      The VFIO driver uses iommu_iova_to_phys() to get the physical address for
      an iova. This physical address is later passed into vfio_unmap_unpin() to
      unpin the memory. The vfio_unmap_unpin() uses pfn_valid() before unpinning
      the memory. The pfn_valid() check was failing because encryption mask was
      part of the physical address returned. This resulted in the memory not
      being unpinned and therefore leaked after the guest terminates.
      
      The memory encryption mask must be cleared from the physical address in
      iommu_iova_to_phys().
      
      Fixes: 2543a786 ("iommu/amd: Allow the AMD IOMMU to work with memory encryption")
      Reported-by: NBoris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Cc: <iommu@lists.linux-foundation.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Radim Krčmář <rkrcmar@redhat.com>
      Cc: kvm@vger.kernel.org
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: <stable@vger.kernel.org> # 4.14+
      Signed-off-by: NBrijesh Singh <brijesh.singh@amd.com>
      Signed-off-by: NJoerg Roedel <jroedel@suse.de>
      b3e9b515
  27. 26 9月, 2018 1 次提交
  28. 18 8月, 2018 1 次提交
  29. 08 8月, 2018 1 次提交
  30. 20 7月, 2018 1 次提交
    • A
      iommu/amd: Remove redundant WARN_ON() · f1a066fc
      Anna-Maria Gleixner 提交于
      The WARN_ON() was introduced in commit 272e4f99 ("iommu/amd: WARN
      when __[attach|detach]_device are called with irqs enabled") to ensure
      that the domain->lock is taken in proper irqs disabled context. This
      is required, because the domain->lock is taken as well in irq
      context.
      
      The proper context check by the WARN_ON() is redundant, because it is
      already covered by LOCKDEP. When working with locks and changing
      context, a run with LOCKDEP is required anyway and would detect the
      wrong lock context.
      
      Furthermore all callers for those functions are within the same file
      and all callers acquire another lock which already disables interrupts.
      Signed-off-by: NAnna-Maria Gleixner <anna-maria@linutronix.de>
      Signed-off-by: NJoerg Roedel <jroedel@suse.de>
      f1a066fc
  31. 06 7月, 2018 1 次提交