1. 28 7月, 2021 4 次提交
  2. 24 7月, 2021 5 次提交
    • A
      riscv: __asm_copy_to-from_user: Fix: Typos in comments · ea196c54
      Akira Tsukamoto 提交于
      Fixing typos and grammar mistakes and using more intuitive label
      name.
      Signed-off-by: NAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: NPalmer Dabbelt <palmerdabbelt@google.com>
      ea196c54
    • A
      riscv: __asm_copy_to-from_user: Remove unnecessary size check · d4b3e010
      Akira Tsukamoto 提交于
      Clean up:
      
      The size of 0 will be evaluated in the next step. Not
      required here.
      Signed-off-by: NAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: NPalmer Dabbelt <palmerdabbelt@google.com>
      d4b3e010
    • A
      riscv: __asm_copy_to-from_user: Fix: fail on RV32 · 22b5f16f
      Akira Tsukamoto 提交于
      Had a bug when converting bytes to bits when the cpu was rv32.
      
      The a3 contains the number of bytes and multiple of 8
      would be the bits. The LGREG is holding 2 for RV32 and 3 for
      RV32, so to achieve multiple of 8 it must always be constant 3.
      The 2 was mistakenly used for rv32.
      Signed-off-by: NAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: NPalmer Dabbelt <palmerdabbelt@google.com>
      22b5f16f
    • A
      riscv: __asm_copy_to-from_user: Fix: overrun copy · 6010d300
      Akira Tsukamoto 提交于
      There were two causes for the overrun memory access.
      
      The threshold size was too small.
      The aligning dst require one SZREG and unrolling word copy requires
      8*SZREG, total have to be at least 9*SZREG.
      
      Inside the unrolling copy, the subtracting -(8*SZREG-1) would make
      iteration happening one extra loop. Proper value is -(8*SZREG).
      Signed-off-by: NAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: NPalmer Dabbelt <palmerdabbelt@google.com>
      6010d300
    • J
      riscv: stacktrace: pin the task's stack in get_wchan · 76f5dfac
      Jisheng Zhang 提交于
      Pin the task's stack before calling walk_stackframe() in get_wchan().
      This can fix the panic as reported by Andreas when CONFIG_VMAP_STACK=y:
      
      [   65.609696] Unable to handle kernel paging request at virtual address ffffffd0003bbde8
      [   65.610460] Oops [#1]
      [   65.610626] Modules linked in: virtio_blk virtio_mmio rtc_goldfish btrfs blake2b_generic libcrc32c xor raid6_pq sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua efivarfs
      [   65.611670] CPU: 2 PID: 1 Comm: systemd Not tainted 5.14.0-rc1-1.g34fe32a-default #1 openSUSE Tumbleweed (unreleased) c62f7109153e5a0897ee58ba52393ad99b070fd2
      [   65.612334] Hardware name: riscv-virtio,qemu (DT)
      [   65.613008] epc : get_wchan+0x5c/0x88
      [   65.613334]  ra : get_wchan+0x42/0x88
      [   65.613625] epc : ffffffff800048a4 ra : ffffffff8000488a sp : ffffffd00021bb90
      [   65.614008]  gp : ffffffff817709f8 tp : ffffffe07fe91b80 t0 : 00000000000001f8
      [   65.614411]  t1 : 0000000000020000 t2 : 0000000000000000 s0 : ffffffd00021bbd0
      [   65.614818]  s1 : ffffffd0003bbdf0 a0 : 0000000000000001 a1 : 0000000000000002
      [   65.615237]  a2 : ffffffff81618008 a3 : 0000000000000000 a4 : 0000000000000000
      [   65.615637]  a5 : ffffffd0003bc000 a6 : 0000000000000002 a7 : ffffffe27d370000
      [   65.616022]  s2 : ffffffd0003bbd90 s3 : ffffffff8071a81e s4 : 0000000000003fff
      [   65.616407]  s5 : ffffffffffffc000 s6 : 0000000000000000 s7 : ffffffff81618008
      [   65.616845]  s8 : 0000000000000001 s9 : 0000000180000040 s10: 0000000000000000
      [   65.617248]  s11: 000000000000016b t3 : 000000ff00000000 t4 : 0c6aec92de5e3fd7
      [   65.617672]  t5 : fff78f60608fcfff t6 : 0000000000000078
      [   65.618088] status: 0000000000000120 badaddr: ffffffd0003bbde8 cause: 000000000000000d
      [   65.618621] [<ffffffff800048a4>] get_wchan+0x5c/0x88
      [   65.619008] [<ffffffff8022da88>] do_task_stat+0x7a2/0xa46
      [   65.619325] [<ffffffff8022e87e>] proc_tgid_stat+0xe/0x16
      [   65.619637] [<ffffffff80227dd6>] proc_single_show+0x46/0x96
      [   65.619979] [<ffffffff801ccb1e>] seq_read_iter+0x190/0x31e
      [   65.620341] [<ffffffff801ccd70>] seq_read+0xc4/0x104
      [   65.620633] [<ffffffff801a6bfe>] vfs_read+0x6a/0x112
      [   65.620922] [<ffffffff801a701c>] ksys_read+0x54/0xbe
      [   65.621206] [<ffffffff801a7094>] sys_read+0xe/0x16
      [   65.621474] [<ffffffff8000303e>] ret_from_syscall+0x0/0x2
      [   65.622169] ---[ end trace f24856ed2b8789c5 ]---
      [   65.622832] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
      Signed-off-by: NJisheng Zhang <jszhang@kernel.org>
      Signed-off-by: NPalmer Dabbelt <palmerdabbelt@google.com>
      76f5dfac
  3. 23 7月, 2021 5 次提交
    • N
      KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state · d9c57d3e
      Nicholas Piggin 提交于
      The H_ENTER_NESTED hypercall is handled by the L0, and it is a request
      by the L1 to switch the context of the vCPU over to that of its L2
      guest, and return with an interrupt indication. The L1 is responsible
      for switching some registers to guest context, and the L0 switches
      others (including all the hypervisor privileged state).
      
      If the L2 MSR has TM active, then the L1 is responsible for
      recheckpointing the L2 TM state. Then the L1 exits to L0 via the
      H_ENTER_NESTED hcall, and the L0 saves the TM state as part of the exit,
      and then it recheckpoints the TM state as part of the nested entry and
      finally HRFIDs into the L2 with TM active MSR. Not efficient, but about
      the simplest approach for something that's horrendously complicated.
      
      Problems arise if the L1 exits to the L0 with a TM state which does not
      match the L2 TM state being requested. For example if the L1 is
      transactional but the L2 MSR is non-transactional, or vice versa. The
      L0's HRFID can take a TM Bad Thing interrupt and crash.
      
      Fix this by disallowing H_ENTER_NESTED in TM[T] state entirely, and then
      ensuring that if the L1 is suspended then the L2 must have TM active,
      and if the L1 is not suspended then the L2 must not have TM active.
      
      Fixes: 360cae31 ("KVM: PPC: Book3S HV: Nested guest entry via hypercall")
      Cc: stable@vger.kernel.org # v4.20+
      Reported-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
      Acked-by: NMichael Neuling <mikey@neuling.org>
      Signed-off-by: NNicholas Piggin <npiggin@gmail.com>
      Signed-off-by: NMichael Ellerman <mpe@ellerman.id.au>
      d9c57d3e
    • N
      KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow · f62f3c20
      Nicholas Piggin 提交于
      The kvmppc_rtas_hcall() sets the host rtas_args.rets pointer based on
      the rtas_args.nargs that was provided by the guest. That guest nargs
      value is not range checked, so the guest can cause the host rets pointer
      to be pointed outside the args array. The individual rtas function
      handlers check the nargs and nrets values to ensure they are correct,
      but if they are not, the handlers store a -3 (0xfffffffd) failure
      indication in rets[0] which corrupts host memory.
      
      Fix this by testing up front whether the guest supplied nargs and nret
      would exceed the array size, and fail the hcall directly without storing
      a failure indication to rets[0].
      
      Also expand on a comment about why we kill the guest and try not to
      return errors directly if we have a valid rets[0] pointer.
      
      Fixes: 8e591cb7 ("KVM: PPC: Book3S: Add infrastructure to implement kernel-side RTAS calls")
      Cc: stable@vger.kernel.org # v3.10+
      Reported-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
      Signed-off-by: NNicholas Piggin <npiggin@gmail.com>
      Signed-off-by: NMichael Ellerman <mpe@ellerman.id.au>
      f62f3c20
    • A
      riscv: Make sure the kernel mapping does not overlap with IS_ERR_VALUE · db6b84a3
      Alexandre Ghiti 提交于
      The check that is done in setup_bootmem currently only works for 32-bit
      kernel since the kernel mapping has been moved outside of the linear
      mapping for 64-bit kernel. So make sure that for 64-bit kernel, the kernel
      mapping does not overlap with the last 4K of the addressable memory.
      Signed-off-by: NAlexandre Ghiti <alex@ghiti.fr>
      Fixes: 2bfc6cd8 ("riscv: Move kernel mapping outside of linear mapping")
      Signed-off-by: NPalmer Dabbelt <palmerdabbelt@google.com>
      db6b84a3
    • A
      riscv: Make sure the linear mapping does not use the kernel mapping · c99127c4
      Alexandre Ghiti 提交于
      For 64-bit kernel, the end of the address space is occupied by the
      kernel mapping and currently, the functions to populate the kernel page
      tables (i.e. create_p*d_mapping) do not override existing mapping so we
      must make sure the linear mapping does not map memory in the kernel mapping
      by clipping the memory above the memory limit.
      Signed-off-by: NAlexandre Ghiti <alex@ghiti.fr>
      Fixes: c9811e37 ("riscv: Add mem kernel parameter support")
      Signed-off-by: NPalmer Dabbelt <palmerdabbelt@google.com>
      c99127c4
    • A
      riscv: Fix memory_limit for 64-bit kernel · c09dc9e1
      Alexandre Ghiti 提交于
      As described in Documentation/riscv/vm-layout.rst, the end of the
      virtual address space for 64-bit kernel is occupied by the modules/BPF/
      kernel mappings so this actually reduces the amount of memory we are able
      to map and then use in the linear mapping. So make sure this limit is
      correctly set.
      Signed-off-by: NAlexandre Ghiti <alex@ghiti.fr>
      Fixes: 2bfc6cd8 ("riscv: Move kernel mapping outside of linear mapping")
      Signed-off-by: NPalmer Dabbelt <palmerdabbelt@google.com>
      c09dc9e1
  4. 22 7月, 2021 2 次提交
  5. 21 7月, 2021 5 次提交
  6. 20 7月, 2021 5 次提交
  7. 19 7月, 2021 1 次提交
  8. 17 7月, 2021 10 次提交
  9. 16 7月, 2021 3 次提交