linux.git/drivers/vfio/platform, branch v6.12.80

Revert "vfio/platform: check the bounds of read/write syscalls"

2025-02-21T13:01:47+00:00

This reverts commit 61ba518195d61c38c6cb86f83135e51f93735442.

It had been committed multiple times to the tree, and isn't needed
again.

Link: https://lore.kernel.org/r/a082db2605514513a0a8568382d5bd2b6f1877a0.camel@cyberus-technology.de
Reported-by: Stefan Nürnberger 
Signed-off-by: Greg Kroah-Hartman

vfio/platform: check the bounds of read/write syscalls

2025-02-17T09:05:38+00:00

commit ce9ff21ea89d191e477a02ad7eabf4f996b80a69 upstream.

count and offset are passed from user space and not checked, only
offset is capped to 40 bits, which can be used to read/write out of
bounds of the device.

Fixes: 6e3f26456009 (“vfio/platform: read and write support for the device fd”)
Cc: stable@vger.kernel.org
Reported-by: Mostafa Saleh 
Reviewed-by: Eric Auger 
Reviewed-by: Mostafa Saleh 
Tested-by: Mostafa Saleh 
Signed-off-by: Alex Williamson 
Signed-off-by: Greg Kroah-Hartman

vfio/platform: check the bounds of read/write syscalls

2025-02-01T17:39:38+00:00

commit ce9ff21ea89d191e477a02ad7eabf4f996b80a69 upstream.

count and offset are passed from user space and not checked, only
offset is capped to 40 bits, which can be used to read/write out of
bounds of the device.

Fixes: 6e3f26456009 (“vfio/platform: read and write support for the device fd”)
Cc: stable@vger.kernel.org
Reported-by: Mostafa Saleh 
Reviewed-by: Eric Auger 
Reviewed-by: Mostafa Saleh 
Tested-by: Mostafa Saleh 
Signed-off-by: Alex Williamson 
Signed-off-by: Greg Kroah-Hartman

ARM: 9370/1: vfio: amba: drop owner assignment

2024-04-18T11:09:21+00:00

Amba bus core already sets owner, so driver does not need to.

Link: https://lore.kernel.org/r/20240326-module-owner-amba-v1-19-4517b091385b@linaro.org

Reviewed-by: Eric Auger 
Acked-by: Suzuki K Poulose 
Signed-off-by: Krzysztof Kozlowski 
Signed-off-by: Russell King (Oracle)

vfio/platform: Create persistent IRQ handlers

2024-03-11T19:08:52+00:00

The vfio-platform SET_IRQS ioctl currently allows loopback triggering of
an interrupt before a signaling eventfd has been configured by the user,
which thereby allows a NULL pointer dereference.

Rather than register the IRQ relative to a valid trigger, register all
IRQs in a disabled state in the device open path.  This allows mask
operations on the IRQ to nest within the overall enable state governed
by a valid eventfd signal.  This decouples @masked, protected by the
@locked spinlock from @trigger, protected via the @igate mutex.

In doing so, it's guaranteed that changes to @trigger cannot race the
IRQ handlers because the IRQ handler is synchronously disabled before
modifying the trigger, and loopback triggering of the IRQ via ioctl is
safe due to serialization with trigger changes via igate.

For compatibility, request_irq() failures are maintained to be local to
the SET_IRQS ioctl rather than a fatal error in the open device path.
This allows, for example, a userspace driver with polling mode support
to continue to work regardless of moving the request_irq() call site.
This necessarily blocks all SET_IRQS access to the failed index.

Cc: Eric Auger 
Cc:  
Fixes: 57f972e2b341 ("vfio/platform: trigger an interrupt via eventfd")
Reviewed-by: Kevin Tian 
Reviewed-by: Eric Auger 
Link: https://lore.kernel.org/r/20240308230557.805580-7-alex.williamson@redhat.com
Signed-off-by: Alex Williamson

vfio/platform: Disable virqfds on cleanup

2024-03-11T19:08:52+00:00

irqfds for mask and unmask that are not specifically disabled by the
user are leaked.  Remove any irqfds during cleanup

Cc: Eric Auger 
Cc:  
Fixes: a7fa7c77cf15 ("vfio/platform: implement IRQ masking/unmasking via an eventfd")
Reviewed-by: Kevin Tian 
Reviewed-by: Eric Auger 
Link: https://lore.kernel.org/r/20240308230557.805580-6-alex.williamson@redhat.com
Signed-off-by: Alex Williamson

vfio/platform: Convert to platform remove callback returning void

2024-03-11T18:09:22+00:00

The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.

To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new(), which already returns void. Eventually after all drivers
are converted, .remove_new() will be renamed to .remove().

Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.

Signed-off-by: Uwe Kleine-König 
Reviewed-by: Jason Gunthorpe 
Reviewed-by: Eric Auger 
Link: https://lore.kernel.org/r/79d3df42fe5b359a05b8061631e72e5ed249b234.1709886922.git.u.kleine-koenig@pengutronix.de
Signed-off-by: Alex Williamson

vfio: amba: Rename pl330_ids[] to vfio_amba_ids[]

2024-03-04T22:10:49+00:00

Obviously drivers/vfio/platform/vfio_amba.c started its life as a
simplified copy of drivers/dma/pl330.c, but not all variable names were
updated.

Signed-off-by: Geert Uytterhoeven 
Reviewed-by: Jason Gunthorpe 
Link: https://lore.kernel.org/r/1d1b873b59b208547439225aee1f24d6f2512a1f.1708945194.git.geert+renesas@glider.be
Signed-off-by: Alex Williamson

eventfd: simplify eventfd_signal()

2023-11-28T13:08:38+00:00

Ever since the eventfd type was introduced back in 2007 in commit
e1ad7468c77d ("signal/timer/event: eventfd core") the eventfd_signal()
function only ever passed 1 as a value for @n. There's no point in
keeping that additional argument.

Link: https://lore.kernel.org/r/20231122-vfs-eventfd-signal-v2-2-bd549b14ce0c@kernel.org
Acked-by: Xu Yilun 
Acked-by: Andrew Donnellan  # ocxl
Acked-by: Eric Farman   # s390
Reviewed-by: Jan Kara 
Reviewed-by: Jens Axboe 
Signed-off-by: Christian Brauner

vfio-iommufd: Add detach_ioas support for physical VFIO devices

2023-07-25T16:19:12+00:00

This prepares for adding DETACH ioctl for physical VFIO devices.

Reviewed-by: Kevin Tian 
Reviewed-by: Jason Gunthorpe 
Tested-by: Terrence Xu 
Tested-by: Nicolin Chen 
Tested-by: Matthew Rosato 
Tested-by: Yanting Jiang 
Tested-by: Shameer Kolothum 
Tested-by: Zhenzhong Duan 
Signed-off-by: Yi Liu 
Link: https://lore.kernel.org/r/20230718135551.6592-14-yi.l.liu@intel.com
Signed-off-by: Alex Williamson