mirror of
https://github.com/torvalds/linux.git
synced 2026-11-06 21:58:01 +01:00
v7.4-rc1
1454 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
26344c0dd3 |
VFIO updates for v7.4-rc1
- Fix missing selftest <libgen.h> include for basename() to support
non-glibc builds. (Hisam Mehboob)
- Add vfio selftest documentation covering the libvfio helper library
and guidance for developers to aid in adding and understanding the
framework. (David Matlack)
- Fix vfio cdev open path to prevent a second open from clobbering
the vf_token or clearing the KVM reference. Add a selftest to
avoid future recurrences. (Alex Williamson)
- Extend vfio selftest mix_and_match timeouts, in particular to
account for systems where generated faults can induce heavy SMM
load, delaying internal timeouts. Also extend timeout for
execution via runner to account for various tests exceeding default
45s timeout. (Alex Williamson)
- Add tracking for non-reserved mappings into a vfio_dma object in
order to optimize the tear-down paths where per-page tests can be
entirely skipped. This resolves a soft lockup for large memory
GPUs. (Samuel Crossley)
- Add vfio selftest driver for mlx5, providing another target for
exercising DMA and interrupts against a physical device.
(Jason Gunthorpe)
- Hardening against read-only region promotion, preserving vm_pgoff
for unmap_mapping_range(), and reject non-shared MMIO mmaps as
necessary through vfio-platform, vfio-fsl-mc, and vfio-cdx. These
prevent future issues, though none are currently reachable.
(Abdifatah Suruur)
- Fix 8-byte ioeventfd support, removing a static error test that was
erroneously left in place when generalizing 8-byte io accesses.
(Li RongQing)
- Fix missed RCU drain on module exit. (Jiale Yao)
- Fix off-by-one boundary check in migration support within the mlx5
vfio-pci variant driver. (Seongjun Hong)
- Remove drvdata usage convention across vfio-pci-core, allowing
variant drivers to freely create their own conventions and enabling
a future Rust-based variant driver. A DRM topic branch is also
merged in support of this effort, modifying the vga arbiter API
to more cleanly remove the drvdata dependency. (Simon Song)
- Fix hisi_acc vfio-pci variant driver to avoid NULL pointer accesses
when bound to unsupported devices and also disabling migration
support when running on 64K host page size due to BAR mapping
constraints. (Longfang Liu)
- Add device IDs for Crescent Island and Nova Lake devices to the Xe
vfio-pci variant driver. (Satyanarayana K V P)
- Fix fallback mode in nvgrace-gpu variant driver to use symmetric
open and close handlers to avoid reported use-after-free issue.
Remove the resulting unnecessary test in the now single-purpose
open function. (Andrea Parri)
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmrZgKwRHGFsZXhAc2hh
emJvdC5vcmcACgkQI5ubbjuwiyJzzQ//YVE+dgmZyop6V4INVheuYOt9jlTwEsbN
CV7BcHG2AQt/0yx9LtKQ6CFKJSJYcPUTQjBq5FMYxXVUYiKCjn2czk7gKJeCXX+6
8AkWqNi2Ds46j7YwRaNZEP4yrDPmZeQw5Z/cqE95zBB2QtujGl3FJ4Jt6hAnT3AM
EIzMT4ZkOWGOaurK9blUY4sH+N8Ft9haJeAeEsBtT1wSD52MvAdXdCKhhfxR0vm9
9R9/DYNVff5ynFOWDIWUqspxT3ITIX2iPJMmsPzlXZXytIjwTcA3NSmH48KvNSCw
iI9+UYPHU9wBoRlrh020ZPl2kxFoOEZLCfonCgEeQuEtZiyaEjmjZ8uU4J/JF6UO
Uu4xUG9DBjNtqbDeEtPlGM/6Scuqn+EDlEGHMVOhjJwllGVilGeVeA93wJo064J2
lXGsvQ6EBP6VDzfvbW/7KApm6JwIjV5h4/+bA0Eq5wFkNxDPoahtjh2IvYflLpIV
2jBIC+OG759QBnJ+KlHI+07m1tQKy5MdYBJg8Lpo4pL/wH14UXTDNnEYPdusrKql
GAuMERJe+3/PrL3xzgptwDBuVwIkWzX8ivdWPWQsIgq0OY/RpENZBgeRL7nXrIpn
lT14Os+FOflGeVyIXJS14cqG+gzTV5/nEP+EDXyOIwKL2Kff5zBFpXfyRiYXtwvJ
oRsxu6XNfT8=
=zgQL
-----END PGP SIGNATURE-----
Merge tag 'vfio-v7.4-rc1' of https://github.com/awilliam/linux-vfio
Pull VFIO updates from Alex Williamson:
- Fix missing selftest <libgen.h> include for basename() to support
non-glibc builds (Hisam Mehboob)
- Add vfio selftest documentation covering the libvfio helper library
and guidance for developers to aid in adding and understanding the
framework (David Matlack)
- Fix vfio cdev open path to prevent a second open from clobbering the
vf_token or clearing the KVM reference. Add a selftest to avoid
future recurrences (Alex Williamson)
- Extend vfio selftest mix_and_match timeouts, in particular to account
for systems where generated faults can induce heavy SMM load,
delaying internal timeouts. Also extend timeout for execution via
runner to account for various tests exceeding default 45s timeout
(Alex Williamson)
- Add tracking for non-reserved mappings into a vfio_dma object in
order to optimize the tear-down paths where per-page tests can be
entirely skipped. This resolves a soft lockup for large memory GPUs
(Samuel Crossley)
- Add vfio selftest driver for mlx5, providing another target for
exercising DMA and interrupts against a physical device (Jason
Gunthorpe)
- Hardening against read-only region promotion, preserving vm_pgoff for
unmap_mapping_range(), and reject non-shared MMIO mmaps as necessary
through vfio-platform, vfio-fsl-mc, and vfio-cdx. These prevent
future issues, though none are currently reachable (Abdifatah Suruur)
- Fix 8-byte ioeventfd support, removing a static error test that was
erroneously left in place when generalizing 8-byte io accesses (Li
RongQing)
- Fix missed RCU drain on module exit (Jiale Yao)
- Fix off-by-one boundary check in migration support within the mlx5
vfio-pci variant driver (Seongjun Hong)
- Remove drvdata usage convention across vfio-pci-core, allowing
variant drivers to freely create their own conventions and enabling a
future Rust-based variant driver. A DRM topic branch is also merged
in support of this effort, modifying the vga arbiter API to more
cleanly remove the drvdata dependency (Simon Song)
- Fix hisi_acc vfio-pci variant driver to avoid NULL pointer accesses
when bound to unsupported devices and also disabling migration
support when running on 64K host page size due to BAR mapping
constraints (Longfang Liu)
- Add device IDs for Crescent Island and Nova Lake devices to the Xe
vfio-pci variant driver (Satyanarayana K V P)
- Fix fallback mode in nvgrace-gpu variant driver to use symmetric open
and close handlers to avoid reported use-after-free issue. Remove the
resulting unnecessary test in the now single-purpose open function
(Andrea Parri)
* tag 'vfio-v7.4-rc1' of https://github.com/awilliam/linux-vfio: (35 commits)
vfio/nvgrace-gpu: Drop the usemem length check in open_device
vfio/nvgrace-gpu: Use a core-only open_device in fallback mode
vfio/xe: Add CRI and NVL device IDs
hisi_acc_vfio_pci: reject live migration on 64KB page with QM_HW_V3 hardware
hisi_acc_vfio_pci: fix NULL dereference in reset_prepare on PF passthrough
vfio/pci: Remove the core dependency on driver data
vfio/mlx5: Fix boundary check in set_report_output()
vfio/pci: Drain eventfd RCU callbacks on module exit
PCI/VGA: pass a data pointer to be used in the decode callback (v2)
vfio/pci: Restore 8-byte ioeventfd support
vfio/cdx: reject non-shared MMIO mmaps
vfio/cdx: keep logical vm_pgoff in MMIO region mmap
vfio/fsl-mc: keep logical vm_pgoff in MMIO region mmap
vfio/platform: keep logical vm_pgoff in MMIO region mmap
vfio/cdx: prevent read-only region mappings from becoming writable
vfio/fsl-mc: prevent read-only region mappings from becoming writable
vfio/platform: prevent read-only region mappings from becoming writable
vfio: selftests: Verify a failed second open preserves the vf_token
vfio: selftests: mlx5 driver - add send_msi support
vfio: selftests: Add mlx5 driver - data path and memcpy ops
...
|
||
|
Andrea Parri
|
076d7e989c |
vfio/nvgrace-gpu: Drop the usemem length check in open_device
nvgrace_gpu_open_device() sets up the fake BAR registers and remap_lock only when usemem.memlength is nonzero. The check exists for fallback mode, which used to share this open path. Fallback mode now has its own open_device, so only devices with ACPI memory properties reach this one. For those devices usemem.memlength is never zero: an empty region from nvgrace_gpu_fetch_memory_property() selects fallback mode, and probe fails when nvgrace_gpu_init_nvdev_struct() rounds usemem down to nothing. Do the setup unconditionally. Assisted-by: LLM Signed-off-by: Andrea Parri <parri.andrea@gmail.com> Reviewed-by: Ankit Agrawal <ankita@nvidia.com> Link: https://lore.kernel.org/r/20261015081937.405320-3-parri.andrea@gmail.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Andrea Parri
|
9c48b994b6 |
vfio/nvgrace-gpu: Use a core-only open_device in fallback mode
When the ACPI memory properties are missing or the C2C link is down, the
device is exposed through nvgrace_gpu_pci_core_ops. That table opens
through nvgrace_gpu_open_device() but closes through
vfio_pci_core_close_device(), so open and close are not symmetric.
nvgrace_gpu_open_device() registers nvdev->usemem for poison handling
unconditionally. In fallback mode usemem.memlength is zero, and
register_pfn_address_space() inserts a node covering [0, ULONG_MAX].
Nothing removes it: a second open fails with -EBUSY, and once the device
is unbound the node outlives the nvdev that contains it. The next open
after a rebind reports:
BUG: KASAN: slab-use-after-free in interval_tree_iter_first+0x209/0x310
Read of size 8 at addr ffff88800894aa30 by task nvgrace_repro/203
Call Trace:
<TASK>
dump_stack_lvl+0x5d/0x80
print_report+0x153/0x4c6
kasan_report+0xe4/0x1a0
interval_tree_iter_first+0x209/0x310
register_pfn_address_space+0x97/0x100
nvgrace_gpu_open_device+0x21c/0x730
vfio_df_open+0x213/0x520
vfio_df_ioctl_bind_iommufd+0x3e8/0x6e0
vfio_device_fops_unl_ioctl+0x782/0x1570
__x64_sys_ioctl+0x13c/0x1c0
do_syscall_64+0x106/0x630
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 188:
...
_vfio_alloc_device+0x3a/0x500
nvgrace_gpu_probe+0xcb/0x660
local_pci_probe+0xcf/0x170
...
Freed by task 188:
...
kfree+0x20d/0x600
device_release+0xcf/0x250
kobject_put+0x152/0x2f0
pci_device_remove+0xb0/0x1c0
device_release_driver_internal+0x38d/0x540
unbind_store+0xde/0x100
...
Give the fallback table its own open_device that only calls
vfio_pci_core_enable() and vfio_pci_core_finish_enable(), the
counterpart of vfio_pci_core_close_device(). Fallback mode then never
touches the nvgrace memory regions, as Alex suggested.
This should be safe because the fallback table uses the vfio-pci core
read, write and mmap handlers, so nothing there uses the state
nvgrace_gpu_open_device() sets up. The one visible difference is that a
fallback open no longer fails when BAR0 cannot be mapped, which matches
vfio-pci.
Fixes:
|
||
|
Satyanarayana K V P
|
60519dd563 |
vfio/xe: Add CRI and NVL device IDs
Crescent Island (CRI), Nova Lake-S (NVL-S) and Nova Lake-P (NVL-P) support SR-IOV in the Xe driver. Add their PCI IDs to the xe-vfio-pci device table, so that the generated vfio_pci module aliases allow userspace to select this variant driver for their VFs. Also reordered the table entries. Signed-off-by: Satyanarayana K V P <satyanarayana.k.v.p@intel.com> Cc: Michał Winiarski <michal.winiarski@intel.com> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: Yishai Hadas <yishaih@nvidia.com> Cc: Shameer Kolothum <skolothumtho@nvidia.com> Cc: Kevin Tian <kevin.tian@intel.com> Cc: Alex Williamson <alex@shazbot.org> Cc: kvm@vger.kernel.org Cc: intel-xe@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://lore.kernel.org/r/20261014131849.157593-2-satyanarayana.k.v.p@intel.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Longfang Liu
|
a80597900b |
hisi_acc_vfio_pci: reject live migration on 64KB page with QM_HW_V3 hardware
On QM_HW_V3 (VF_CTRL mode) hardware with 64KB pages, the functional
region and migration registers share one BAR2 physical page with no
isolation, which leaks migration registers to the guest and causes
guest kernel calltrace under the KVM emulated device scheme.
The previous fix rejected the device in hisi_acc_vf_qm_init() during
open_device, returning -EINVAL and breaking passthrough entirely.
Move the drv_mode check into a helper called from probe() so that a
VF_CTRL device on a 64KB page is bound to the generic ops, keeping
passthrough working while disabling live migration.
Fixes:
|
||
|
Longfang Liu
|
e1d2d60b1f |
hisi_acc_vfio_pci: fix NULL dereference in reset_prepare on PF passthrough
When a PF is bound to the driver via driver_override and passed through to a VM, its pf_qm stays NULL. The PCI error handler reset_prepare() runs during open_device through pci_try_reset_function(), before the mig_ops gate, and dereferences the NULL pf_qm for the timeout log, crashing the kernel. Move the mig_ops check to the entry of reset_prepare() and aer_reset_done() so non-migration devices skip the QM_RESETTING coordination. The dev local resolved &qm->pdev->dev before the gate, so open code it at the dev_err() call where qm is known valid. Also clear set_reset_flag together with QM_RESETTING in aer_reset_done(); the flag was never cleared before, so a later timed-out reset could release a foreign lock. Fixes: |
||
|
Simon Song
|
6a5f427bee |
vfio/pci: Remove the core dependency on driver data
vfio-pci-core currently has runtime functions that interpret pci
driver_data as a pointer to vfio_pci_core_device, and enforce vfio
variant drivers must set vfio_pci_core_device to their pci driver_data.
This constrains variant drivers' private-data layout, including the
typed driver data used by the Rust PCI infrastructure.
Add VFIO_PCI_CORE_DEFINE_CALLBACKS macro to generate wrapper code for
each vfio variant driver, update vfio variant drivers to store their
private structures in driver_data and use generated wrapper to pass the
vfio core device to helpers.
Assisted-by: LLM
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Suggested-by: Alex Williamson <alex.williamson@nvidia.com>
Suggested-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/all/DLFD2ZDSK9YQ.3A4R66G8UJMD8@kernel.org/
Signed-off-by: Simon Song <xinmengs@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/r/20261005184236.1946167-2-xinmengs@nvidia.com
[VGA chunks and commit log reference dropped with rebase to
commit
|
||
|
Alex Williamson
|
f1b563d3e3 |
pci/vgaarb rework for drm/vfio
This reworks the vgaarb API to be a bit more sane. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmq9ssoACgkQDHTzWXnE hr7sRQ//X4ICmP0Y/4Npo4nxrib3eMJwqilrQiFjMIFXjgwjOsbN97ZrN/5Fu0V7 JfKCOfHHnAoXsnBjUbxtf1xMwzrgDOM1+pqPJ/OG3OWeE67VQW0d+OPD88t9F0/i p7THQ3ifN9FunSEZfX0P1VrAIUkXx2tshLPL1Xfxpx8Af6yurrU9t8dyFQ/i+8YJ osrpJ6l5u9FrkksCiKV75PEh7Bl5HX4D0jq9LQDEW2TaOwffI6TmclG7yHq5yemE qhMat9UH2Z3hIY5lHJ1aNJtWwhPF0bHWls9Roz5YTfK7ojGdqNh/sjHeMp5bUCLv PYovBn3FSGSPZK1DPwhv7+oSDz8HXopaKaC+Q4bDcXKSJPpwp3jKFIudfqy0O0Gb zn8lAD3tl7kSfHBCEF0rQXAG+23KnDCjiSgcfHn0t+dnI3OgXl3JffVQx4tibTUU aT5g0zc+cgLfhkKTpHxeE2piF5kGTBAeJNhqtmmYwzm6VM9m/HbD8MPL3FjY9nQG kYgFdiztNbVAl5UcqoVSudNj2otZnyPGXAVMB38XXSHJ8pk6Isaq0flvfcabyoYl QNMadEFzA6zt4+CmS2SIwIJnolFPzoQSuJ60M0v08J4i96SoqlaDXk982/tazlRQ pmxg8p8aHBL2vcbvzkOcw6qcI7xA+WQfgf79yHRI8+4szj/RCBM= =aFZh -----END PGP SIGNATURE----- Merge tag 'topic/pci-vgaarb-rework-2026-10-01' of https://gitlab.freedesktop.org/drm/kernel into v7.4/vfio/next pci/vgaarb rework for drm/vfio This reworks the vgaarb API to be a bit more sane. Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Seongjun Hong
|
37b2ee6747 |
vfio/mlx5: Fix boundary check in set_report_output()
Use > instead of >= on boundary check of recv_buf to avoid the bug which
the full message in the last slot of recv_buf is ignored even though the
received data size does not overflow the recv_buf.
Fixes:
|
||
|
Jiale Yao
|
3b2e9b0501 |
vfio/pci: Drain eventfd RCU callbacks on module exit
vfio_pci_eventfd_replace_locked() defers freeing replaced eventfds to
vfio_pci_eventfd_rcu_free(). A callback can remain queued after
close_device() returns and the device driver module reference is dropped.
Once the dependent driver is removed, vfio-pci-core can be unloaded while
the callback still points into its module text.
Wait for outstanding RCU callbacks before vfio-pci-core exits.
Fixes:
|
||
|
Steffen Eiden
|
5c3ea6d3e8 |
KVM/vfio: Use file-based reference counting for KVM
Replace manual module reference counting with file-based reference counting for KVM integration. Previously, VFIO used symbol_get() to obtain function pointers for kvm_get_kvm_safe() and kvm_put_kvm(), then manually tracked module references through these symbols. This approach required storing the put_kvm function pointer in each device and carefully managing symbol references. Pass struct file pointers instead of struct kvm pointers throughout the VFIO-KVM interface, leveraging the kernel's existing file reference counting via get_file()/get_file_active() and fput(). Convert the x86 page-track API and update s390 vfio to use file_to_kvm_<arch>(). This simplifies the code. Suggested-by: Jason Gunthorpe <jgg@nvidia.com> Co-developed-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Acked-by: Alex Williamson <alex@shazbot.org> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Acked-by: Janosch Frank <frankja@linux.ibm.com> Acked-by: Sean Christopherson <seanjc@google.com> [borntraeger@linux.ibm.com remove _safe from vfio_device_get_kvm_safe] Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> |
||
|
Dave Airlie
|
93d41424ca |
PCI/VGA: pass a data pointer to be used in the decode callback (v2)
This changes the vgaarb client API so that the user can pass a private data pointer into the register that will get used in the decode callback. This allows a bunch of pdev conversions in the drivers, and lets some future vfio cleanups be nicer. I'd like to merge this via the drm next tree but also fine with it going via pci. Signed-off-by: Dave Airlie <airlied@redhat.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Acked-by: Alex Williamson <alex@shazbot.org> Acked-by: Bjorn Helgaas <bhelgaas@google.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Link: https://lore.kernel.org/dri-devel/20260922071807.2533884-1-airlied@gmail.com/ |
||
|
Li RongQing
|
b30b52c2fb |
vfio/pci: Restore 8-byte ioeventfd support
Commit |
||
|
Abdifatah Suruur
|
8b25b35840 |
vfio/cdx: reject non-shared MMIO mmaps
vfio_cdx_mmap() accepts MAP_PRIVATE mappings. A non-shared mapping
with VM_MAYWRITE is a COW mapping, and remap_pfn_range()'s COW special
case in get_remap_pgoff() then overwrites vma->vm_pgoff with the
physical frame number:
if (is_cow) {
if (addr != vm_start || end != vm_end)
return -EINVAL;
*vm_pgoff_p = pfn;
}
The VMA is inserted into the device file's mapping->i_mmap interval
tree keyed by vm_pgoff, which VFIO expects to be the logical file
offset: the core links every device mmap to the device inode's
i_mapping precisely so that unmap_mapping_range() can revoke all
mappings associated with a device (see vfio_device_open_file() and
vfio_device_fops_cdev_open()).
A raw PFN in vm_pgoff lands the interval tree entry in the wrong
coordinate space, so unmap_mapping_range() cannot find the VMA and a
stale MMIO mapping survives any revocation attempt. Without this
check, a MAP_PRIVATE mapping reintroduces that corruption even with
the logical-vm_pgoff fix in place.
Require VM_SHARED as vfio-pci, vfio-fsl-mc and vfio-platform already
do. This is defensive hygiene: vfio-cdx does not call
unmap_mapping_range() today, so no reachable stale-mapping issue
exists.
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Link: https://lore.kernel.org/r/20260929094848.7439-8-suruurism@gmail.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
|
||
|
Abdifatah Suruur
|
614634f262 |
vfio/cdx: keep logical vm_pgoff in MMIO region mmap
vfio_cdx_mmap_mmio() overwrites vma->vm_pgoff with the physical frame number of the MMIO region and passes it to io_remap_pfn_range(). The VMA is inserted into the device file's mapping->i_mmap interval tree keyed by vm_pgoff, which VFIO expects to be the logical file offset: the core links every device mmap to the device inode's i_mapping precisely so that unmap_mapping_range() can revoke all mappings associated with a device (see vfio_device_cdev_open()). With a raw PFN in vm_pgoff the interval tree entry lands in the wrong coordinate space and unmap_mapping_range() cannot find the VMA, leaving stale MMIO mappings behind any revocation attempt. Keep vm_pgoff in the logical VFIO offset space, as vfio-pci does, and pass the physical PFN to io_remap_pfn_range() explicitly. This is defensive hygiene: none of vfio-platform, vfio/fsl-mc and vfio/cdx call unmap_mapping_range() today, so no reachable stale-mapping issue exists. Keeping vm_pgoff logical preserves the VFIO core contract for any future revocation path. Signed-off-by: Abdifatah Suruur <suruurism@gmail.com> Link: https://lore.kernel.org/r/20260929094848.7439-7-suruurism@gmail.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Abdifatah Suruur
|
c9e9ecb94f |
vfio/fsl-mc: keep logical vm_pgoff in MMIO region mmap
vfio_fsl_mc_mmap_mmio() overwrites vma->vm_pgoff with the physical frame number of the MMIO region and passes it to remap_pfn_range(). The VMA is inserted into the device file's mapping->i_mmap interval tree keyed by vm_pgoff, which VFIO expects to be the logical file offset: the core links every device mmap to the device inode's i_mapping precisely so that unmap_mapping_range() can revoke all mappings associated with a device (see vfio_device_cdev_open()). With a raw PFN in vm_pgoff the interval tree entry lands in the wrong coordinate space and unmap_mapping_range() cannot find the VMA, leaving stale MMIO mappings behind any revocation attempt. Keep vm_pgoff in the logical VFIO offset space, as vfio-pci does, and pass the physical PFN to remap_pfn_range() explicitly. This is defensive hygiene: none of vfio-platform, vfio/fsl-mc and vfio/cdx call unmap_mapping_range() today, so no reachable stale-mapping issue exists. Keeping vm_pgoff logical preserves the VFIO core contract for any future revocation path. Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com> Signed-off-by: Abdifatah Suruur <suruurism@gmail.com> Link: https://lore.kernel.org/r/20260929094848.7439-6-suruurism@gmail.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Abdifatah Suruur
|
a9ce237e1a |
vfio/platform: keep logical vm_pgoff in MMIO region mmap
vfio_platform_mmap_mmio() overwrites vma->vm_pgoff with the physical frame number of the MMIO region and passes it to remap_pfn_range(). The VMA is inserted into the device file's mapping->i_mmap interval tree keyed by vm_pgoff, which VFIO expects to be the logical file offset: the core links every device mmap to the device inode's i_mapping precisely so that unmap_mapping_range() can revoke all mappings associated with a device (see vfio_device_cdev_open()). With a raw PFN in vm_pgoff the interval tree entry lands in the wrong coordinate space and unmap_mapping_range() cannot find the VMA, leaving stale MMIO mappings behind any revocation attempt. Keep vm_pgoff in the logical VFIO offset space, as vfio-pci does, and pass the physical PFN to remap_pfn_range() explicitly. This is defensive hygiene: none of vfio-platform, vfio/fsl-mc and vfio/cdx call unmap_mapping_range() today, so no reachable stale-mapping issue exists. Keeping vm_pgoff logical preserves the VFIO core contract for any future revocation path. Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Abdifatah Suruur <suruurism@gmail.com> Link: https://lore.kernel.org/r/20260929094848.7439-5-suruurism@gmail.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Abdifatah Suruur
|
9c5cd385d2 |
vfio/cdx: prevent read-only region mappings from becoming writable
vfio_cdx_mmap() rejects writable mappings of regions without the WRITE flag, but leaves VM_MAYWRITE set. Userspace can map such a region read-only and then upgrade the mapping to writable with mprotect(), writing to MMIO regions the device marks read-only. Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445), drm/panthor (CVE-2024-53071) and commit |
||
|
Abdifatah Suruur
|
25fd8b27ee |
vfio/fsl-mc: prevent read-only region mappings from becoming writable
vfio_fsl_mc_mmap() rejects writable mappings of regions without the WRITE flag, but leaves VM_MAYWRITE set. Userspace can map such a region read-only and then upgrade the mapping to writable with mprotect(). Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445), drm/panthor (CVE-2024-53071) and commit |
||
|
Abdifatah Suruur
|
420bed9131 |
vfio/platform: prevent read-only region mappings from becoming writable
vfio_platform_mmap() rejects writable mappings of regions without the WRITE flag, but leaves VM_MAYWRITE set. Userspace can map such a region read-only and then upgrade the mapping to writable with mprotect(). Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445), drm/panthor (CVE-2024-53071) and commit |
||
|
Samuel Crossley
|
bc78c90728 |
vfio/type1: avoid walking reserved-only mappings while unpinning
Tearing down a large device-passthrough DMA mapping can process tens of millions of reserved pfns in a single VFIO_IOMMU_UNMAP_DMA. A 128 GiB reserved mapping holds about 33.6 million 4KiB pfns, and vfio_unpin_pages_remote() walks every one of them whenever dma->has_rsvd is set, because reserved and non-reserved pfns might be mixed. For a mapping that contains only reserved pfns every put_pfn() is a no-op, but each one still pays for the pfn_valid()/PageReserved() classification. Seen on GPU-passthrough hosts running 6.13 with the v6.18 type1 series backported, where a single VFIO_IOMMU_UNMAP_DMA held a CPU past the soft-lockup watchdog (host identification, register dump and module list trimmed): watchdog: BUG: soft lockup - CPU#261 stuck for 22s! [qemu-system-x86:134503] RIP: 0010:vfio_unpin_pages_remote+0x139/0x2a0 [vfio_iommu_type1] Code: 90 4c 89 e1 48 c1 e9 34 75 74 4c 89 e1 48 c1 e9 22 75 6b 48 8b 0d f7 6f c2 e3 48 85 c9 74 5f 4c 89 e2 48 c1 ea 16 48 8b 0c d1 <48> 85 c9 74 4f 41 8b 55 30 4c 89 e6 48 c1 ee 0f 83 e6 7f c1 e6 05 Call Trace: <IRQ> ? watchdog_timer_fn+0x3d6/0x440 ? running_clock+0x10/0x10 ? hrtimer_interrupt+0x185/0x580 ? __sysvec_apic_timer_interrupt+0x44/0xe0 ? sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ> <TASK> ? asm_sysvec_apic_timer_interrupt+0x16/0x20 ? vfio_unpin_pages_remote+0x139/0x2a0 [vfio_iommu_type1] vfio_sync_unpin+0x96/0xf0 [vfio_iommu_type1] vfio_unmap_unpin+0x324/0x3d0 [vfio_iommu_type1] vfio_remove_dma+0x25/0xa0 [vfio_iommu_type1] vfio_iommu_type1_ioctl+0xcd5/0x1760 [vfio_iommu_type1] ? amd_pmu_v2_enable_all+0xa/0x30 ? perf_pmu_sched_task+0xbf/0xf0 x64_sys_call+0x282/0x1ac0 ? syscall_trace_enter+0x1e5/0x1f0 do_syscall_64+0x68/0x130 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP is the mem_section root test in pfn_valid(), inlined into put_pfn() through is_invalid_reserved_pfn(), so the stall is in the dma->has_rsvd per-page loop. mem_section[] has no root for that pfn, so pfn_valid() returns false and put_pfn() does nothing - for every pfn in the mapping. Track whether the mapping also contains non-reserved pfns and skip the walk entirely for reserved-only mappings. Mixed mappings keep the existing per-pfn walk, and ordinary mappings keep the existing batched unpin path. Tested on an affected host: reserved-only mappings up to 128 GiB take the new path and complete in microseconds. The ordinary-page path was exercised unchanged. Suggested-by: Alex Williamson <alex@shazbot.org> Link: https://lore.kernel.org/all/20260803154707.71cc0d6b@shazbot.org/ Signed-off-by: Samuel Crossley <samuelcrossley@gmail.com> Link: https://lore.kernel.org/r/20260919-vfio-v2-1-68e7ed355972@gmail.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Alex Williamson
|
258ba46543 |
vfio: Reject a second cdev open before mutating shared device state
The cdev single-open check lives in vfio_df_open(), which runs at the end of the bind ioctl, after vfio_df_ioctl_bind_iommufd() has already updated state shared across all opens: vfio_df_check_token() can set the PF vf_token and vfio_df_get_kvm_safe() records the caller's KVM pointer in device->kvm and takes a reference. A second cdev bind of an already-open device runs both, only to be rejected in vfio_df_open(). The error path clears device->kvm and drops the reference, tearing down the current opener's KVM association and potentially resulting in an unbalanced reference on close or premature release, while the vf_token remains clobbered. Move the single-open check into vfio_df_ioctl_bind_iommufd() ahead of both mutations, so a bind that cannot complete leaves the current opener's state untouched. df->group is NULL on this path, so a non-zero open_count is exactly what vfio_df_open() rejected. The test in vfio_df_open() becomes redundant and is removed. Return -EBUSY rather than -EINVAL here. The arguments are not invalid, the device is in use, which could be a transient condition due to a delayed fput if the prior user is terminated. This provides compatibility with the group path, where a group open returns -EBUSY, and users may choose bounded polling to detect such a transient condition. Fixes: |
||
|
Hemanth Selam
|
b1d0f0d97a |
vfio: fix typo "stucture" in comment
Correct "stucture" to "structure", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://lore.kernel.org/r/20260904115109.6170-1-hemanth.selam@gmail.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Linus Torvalds
|
ed3b875bea |
mm.git review status for mm-hotfixes-stable..mm-stable
Everything:
Total patches: 501
Reviews/patch: 1.66
Reviewed rate: 70%
Excluding DAMON:
Total patches: 356
Reviews/patch: 2.26
Reviewed rate: 90%
Excluding DAMON and selftests:
Total patches: 329
Reviews/patch: 2.31
Reviewed rate: 92%
Excluding DAMON, selftests and maple_tree:
Total patches: 328
Reviews/patch: 2.31
Reviewed rate: 92%
Summary of patch series in this merge:
- The 2 patch series "mm: drop "sub" prefix from various places" from
Dev Jain implements some page->folio conversion and a naming cleanup.
- The 2 patch series "mm/kasan: remove redundant initialization for
kasan_flag_write_only" from Igor Putko provides some KASAN cleanup work.
- The 2 patch series "mm/filemap: reduce unnecessary xarray lookups"
from Chi Zhiling provides a small speedup in the pagecaache read code.
- The 4 patch series "mm/percpu: Fix possible NOFS/NOIO reclaim
recursion" from Kaitao Cheng improves a few things in the vmalloc code -
mainly the avoidance of GFP_KERNEL allocations when the caller asked for
GFP_NOFS or GFP_NOIO.
- The 3 patch series "mm/kmemleak: avoid soft lockup when scanning task
stacks" from Breno Leitao avoids a soft lockup watchdog trigger from the
kmemleak scanning code in extreme situations.
- The 6 patch series "mm/page_owner: misc cleanups" from Ye Liu is a
collection of unrelated cleanups to the page_owner code. For some
reason lots of people have been working on the page_owner code this
cycle.
- The 4 patch series "mm: convert to walk_page_range_vma() to eliminate
find_vma()" from Kefeng Wang simplifies and accelerates the page walking
library function.
- The 3 patch series "mm/migrate: preparatory cleanups for batch copy
and offload" from Shivank Garg implements cleanups in the migration
code.
- The 4 patch series "mm/page_owner: add per-fd filter infrastructure
for print_mode and NUMA filtering" from Zhen Ni provides per-fd
filtering to page_owner in order to reduce the sometimes vast amount of
output it can produce.
- The 19 patch series "mm: Refactor bootmem gigantic hugepage
allocation" from Muchun Song is a "set of fixes and preparatory cleanups
around bootmem HugeTLB handling, sparse initialization ordering, and
related vmemmap setup".
- The 4 patch series "mm/zsmalloc: reduce lock contention in zs_free()"
from Wenchao Hao reduces lock contention in zs_free(), which dominates
the unmap path under memory pressure on Android (LMK kills) and on x86
servers running zswap-heavy workloads. Up to 1.83x improvement in
microbenchmarking.
- The 2 patch series "move alloc_tag.c file under mm/" from Suren
Baghdasaryan does that.
- The 6 patch series "samples/damon: handle damon_{start,stop}()
failures" from SJ Park fixes improper handling of damon_start(),
damon_stop(), and damon_call() failures across DAMON sample modules to
prevent potential memory leaks, operation disruptions and use-after-free
bugs.
- The 11 patch series "mm/damon/sysfs: kobject_del() directories that
users can create/remove" from SJ Park resolves an issue where delayed
sysfs directory removal under CONFIG_DEBUG_KOBJECT_RELEASE causes
creation failures due to duplicate directory names by adding missing
kobject_del() calls before creating new directories.
- The 3 patch series "mm: cleanup clear_not_present_full_ptes()" from
David Hildenbrand cleans up the core pte handling code.
- The 3 patch series "selftests/damon: misc fixes for test bugs" from
Kunwu Chan fixes several bugs in the DAMON selftests.
- The 2 patch series "selftests/damon: fix memcg_path staging handling"
from Cheng Nie fixes a bug in _damon_sysfs.py for damos_filter
memcg_path setup, and adds a test case for it in sysfs.py.
- The 2 patch series "selftests/damon: test kdamond refresh_ms" from
Ruslan Valiyev introduces selftest coverage for DAMON's refresh_ms sysfs
feature by updating the test control module and verifying that scheme
stats update automatically without manual intervention.
- The 5 patch series "mm/damon: five misc fixups" from Akinobu Mita
contains miscellaneous DAMON fixups.
- The 2 patch series "mm/damon/core: detect internal variation above
max_nr_regions/2" from Jiayuan Chen fixes DAMON's region splitting
behavior when region counts exceed half the maximum budget by
dynamically scaling down the split fraction as the limit approaches,
preventing large regions from staying un-split, and adds corresponding
KUnit test coverage.
- The 6 patch series "mm: preparatory patches for PMD level swap
entries" from Usama Arif refactors and cleans up PMD softleaf helpers,
call sites, and architecture flags to lay the groundwork for a follow-up
series that introduces PMD page table swap entries.
- The 11 patch series "mm/damon: update, optimize, and clean up doc,
tests, and code" from SJ Park updates DAMON design and ABI
documentation, expands unit and selftest coverage, optimizes
damon_commit_target_regions(), and cleans up recently added sysfs
interface code for better readability.
- The 2 patch series "mm/vmpressure: reduce CPU, memory and code
overhead on cgroup v2" from Usama Arif optimizes vmpressure() by
skipping unnecessary work on cgroup v2 for userspace event notifications
and refactors v1-only eventfd handling into mm/memcontrol-v1.c to reduce
memory overhead and code complexity.
- The 10 patch series "selftests/mm: refactor pkey helpers and fix mmap
error handling" from Hongfu Li refactors pkeys shared tracing and
assertion helpers into a common file, unifies protection key selftests
to use consistent diagnostic logging and assertions, and enforces
standardized MAP_FAILED return checks for mmap() calls across the tests.
- The 18 patch series "mm/damon: optimize out nr_accesses_bp" from SJ
Park replaces the error-prone, continuously updated nr_accesses_bp field
in damon_region with an on-demand moving sum function
(damon_nr_accesses_mvsum()), reducing structure memory overhead and
avoiding state corruption bugs.
- The 6 patch series "Open HugeTLB allocation routine for more generic
use" from Ackerley Tng decouples HugeTLB folio allocation from VMA
dependencies by introducing hugetlb_alloc_folio(), enabling subsystems
like guest_memfd to allocate HugeTLB folios without standard VMA
reservations or pseudo-VMAs.
- The 3 patch series "mm/damon: provide pseudo moving sum probe_hits"
from SJ Park integrates DAMON's probe_hits attribute counter into the
pseudo moving sum infrastructure, enabling real-time, online monitoring
without waiting for full aggregation intervals.
- The 18 patch series "mm: Some cleanups for page allocator APIs" from
Brendan Jackman simplifies and refactors the page allocator entry points
and flags by unifying allocation paths, adding internal alloc_flags
arguments, and eliminating redundant __ prefixed alloc_pages variants.
- The 5 patch series "Fix incorrect access of hugetlb pte entries" from
Dev Jain enforces the consistent use of huge_ptep_get() instead of
ptep_get() for HugeTLB entries and fixes an unaligned address issue in
arm64's huge_ptep_get() implementation.
- The 8 patch series "mm/damon: validate all parameters in the core"
from SJ Park consolidates parameter validation into the DAMON core
specifically within damon_start() and damon_commit_ctx() to centralize
error checking, eliminate caller-side redundant checks and to improve
maintenance efficiency.
- The 3 patch series "tools/mm/page_owner_sort: fix filtering and
cleanup issues" from Yichong Chen renames is_need() to filter_record()
for clearer return semantics, fixes per-record allocation memory leaks
and bounds output copies in search_pattern() to address an existing
buffer issue.
- The 4 patch series "memcg: bail out reclaim when memcg is dying" from
Jiayuan Chen mitigates a system-wide stall which occurs when a cgroup is
removed while one of its memory control files is doing synchronous
reclaim.
- The 5 patch series "mm/memory-failure: add panic option for
unrecoverable pages" from Breno Leitao introduces an opt-in
vm.panic_on_unrecoverable_memory_failure sysctl that immediately panics
the kernel on unrecoverable memory errors in kernel-owned pages to
preserve error context and prevent delayed, silent data corruption.
- The 11 patch series "mm/damon: refactor damon_{start,stop,commit}()
for simple error handling" from SJ Park refactors the DAMON core API
functions to guarantee that all contexts are fully stopped when
damon_start(), damon_stop(), or damon_commit() fail, eliminating the
need for complex and error-prone caller-side cleanup code.
- The 5 patch series "Keep tail page private zero at free and folio
split" from Zi Yan adds checks to ensure tail_page->private is zero when
freeing compound or high-order pages and when promoting tail pages
during large folio splits. By validating these fields at free and split
time, it allows the removal of redundant private field clearing inside
prep_compound_tail().
- The 4 patch series "mm: drop redundant lru_add_drain in anon folio
reuse paths" from Barry Song eliminates redundant lru_add_drain() calls
in wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
contention and system overhead.
By validating folio refcounts against the LRU cache before draining
and removing unnecessary drains in the swap path, it achieves up to a
30.5% reduction in drain calls during heavy swap workloads.
- The 3 patch series "mm: clean up folio LRU and swap declarations" from
Jianyue Wu reorganizes folio LRU and swap code by relocating
page-cluster state to mm/swap_state.c, renaming mm/swap.c to mm/folio.c,
and moving MM-internal reclaim declarations into mm/internal.h.
- The 15 patch series "userfaultfd: working set tracking for VM guest
memory" from Kiryl Shutsemau adds userfaultfd support for tracking the
working set of VM guest memory, so a VMM can identify hot pages and
reclaim cold ones to tiered or remote storage.
- The 10 patch series "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part
2)" from David Hildenbrand removes the remaining pieces of
CONFIG_HAVE_BOOTMEM_INFO_NODE, performing some smaller cleanups around
freeing of reserved vmemmap pages on the way.
- The 7 patch series "mm/damon: update probe hits for runtime parameter
commits" from SJ Park ensures that DAMON's probe_hits attribute counter
is properly updated when monitoring intervals are changed at runtime,
matching the behavior of nr_accesses. To achieve this, it refactors and
renames existing helper functions for shared use, applies the updates to
probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
maintain measurement accuracy.
- The 3 patch series "KSM: performance optimizations for rmap_walk_ksm"
from xu xin resolves a severe KSM reverse-mapping performance bottleneck
where thousands of split VMAs sharing a single anon_vma cause extended
lock contention. By adding an interval-filtering check during the rmap
walk, it reduces worst-case anon_vma lock hold times from over 500ms
down to under 2ms, preventing application freezes and latency spikes
under memory pressure.
- The 3 patch series "mm: split a couple of headers from internal.h"
from Mike Rapoport splits declarations related to mm_init, memblock,
vmalloc and sparse into new headers.
- The 2 patch series "KSM: use linear_page_index in collect_procs_ksm()"
from xu xin applies the interval tree optimization from rmap_walk_ksm()
to collect_procs_ksm() to avoid iterating over non-matching VMAs during
KSM memory error handling. It hoists loop-invariant address
initialization and restricts the anon_vma_interval_tree_foreach walk to
a targeted page offset range, reducing redundant checks and improving
lookup efficiency.
- The 3 patch series "selftests/mm: avoid false failures in hugetlb and
KSM tests" from Sayali Patil fixes issues in the hugetlb and KSM MM
selftest categories that can report failures when the prerequisites for
the tests are not satisfied.
- The 19 patch series "mm/damon: introduce data attributes only
monitoring" from SJ Park introduces attribute-weighted region management
in DAMON, allowing users to prioritize specific data attributes (such as
page sizes or cgroups) over or instead of access monitoring.
By assigning weights to attribute probes, DAMON can completely disable
access tracking and adjust monitoring regions based on weighted
probe-hit counters to optimize monitoring quality for attribute-focused
workloads.
- The 8 patch series "mm/hmm: Add mmap lock-drop support for
userfaultfd-backed mappings" from Stanislav Kinsburskii extends
hmm_range_fault() to support userfaultfd-backed regions by allowing the
mmap lock to be dropped during fault handling via a new
hmm_range_fault_locked() helper.
By accepting a locked pointer and signaling retry status when lock
release occurs, it enables page fault resolution in userfaultfd regions
while preserving backward compatibility for existing callers.
- The 33 patch series "mm: make VMA page offset handling more
consistent" from Lorenzo Stoakes cleans up and standardizes how
vma->vm_pgoff is accessed and manipulated across file-backed and
anonymous mappings in the kernel.
It introduces dedicated helper functions such as vma_start_pgoff(),
vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while renaming
rmap interval tree helpers to better reflect their functionality.
These changes establish a cleaner foundation for future work that will
unify virtual page offset indexing for all anonymous and CoW'd folios.
- The 3 patch series "mm: handle device-private PMDs in walk callbacks"
from Usama Arif addresses kernel panics and state corruption caused by
MM walk callbacks reaching non-present device-private PMD swap entries
created during HMM migrations.
It ensures that functions which acquire pmd_trans_huge_lock() properly
recognize device-private PMDs instead of assuming a present THP or a
standard migration entry.
- The 5 patch series "mm/rmap: Refactor try_to_unmap_one" from Dev Jain
refactors try_to_unmap_one by modularizing Hugetlb, anonymous-lazyfree,
and anonymous-swapbacked logic into dedicated functions, laying the
structural groundwork for batched anonymous large folio unmapping.
- The 4 patch series "Docs/ABI/damon: sysfs ABI document fixes and
additions" from Song Hu fixes typos and fills in missing entries in the
DAMON sysfs ABI document.
- The 10 patch series "dax/kmem: atomic whole-device hotplug via sysfs"
from Gregory Price introduces an atomic sysfs state attribute and
supporting DAX/MM infrastructure to prevent userland races when
offlining and removing entire memory regions.
By adding an unplugged state alongside standard online modes, it
enables whole-device atomic hotplug control while preserving backward
compatibility.
- The 13 patch series "mm: convert more vm_flags_t users to vma_flags_t"
from Lorenzo Stoakes continues transitioning the kernel from the
deprecated vm_flags_t type to vma_flags_t across core memory management
infrastructure.
It replaces legacy type usage in core functions such as do_mmap(),
unmapped area allocation, mm->def_vma_flags, and VMA operations like
mlock, mprotect, and mremap.
- The 2 patch series "Two small patches to clean up mm/mm_slot.h" from
xu xin refactors mm_slot.h by introducing mm_slot_remove() to unify
duplicate slot deletion sequences in khugepaged and KSM. It also adds
code documentation explaining why mm_slot_lookup and mm_slot_insert must
remain as preprocessor macros rather than static inline functions.
- The 10 patch series "mm/damon/core: hide core-private struct fields"
from SJ Park cleans up DAMON core structures by consistently marking
internal-only fields with private: comment tags to prevent improper
direct access from outer layers.
It enforces encapsulation across core structures including
damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
interact through approved access APIs instead of exposing raw struct
members.
- The 6 patch series "mm/damon: unurgent fixes for infinite loop, NULL
de-ref and races" from SJ Park addresses potential infinite loops, NULL
dereferences, and race conditions identified in DAMON.
It fixes an infinite loop triggered by extreme user configurations, a
NULL pointer dereference within unit tests and minor monitoring
accuracy degradation caused by subtle runtime races.
- The 2 patch series "mm/page_alloc: fixes for free_pages_nolock() on
RT/UP" from Brendan Jackman fixes an NMI safety flaw in
__free_frozen_pages() where freeing pages on non-SMP or PREEMPT_RT
kernels can bypass can_spin_trylock() checks via non-PCP or isolated
migration paths.
It also resolves potential kernel crashes and privilege escalation
risks triggered when BPF tracing runs in NMI context alongside memory
hotplug or large allocation frees.
- The 4 patch series "mm/page_alloc: couple of followups for recent
cleanups" from Brendan Jackman cleans up and updates page allocator
nomenclature, documentation, and debug assertions.
It aligns internal FPI_ flags with the public "nolock" naming
convention, removes outdated internal implementation details from
high-level page allocator comments, and eliminates obsolete VM_BUG_ON()
assertions in allocation paths.
- The 3 patch series "mm/mseal: further cleanups" from Lorenzo Stoakes
refactors and simplifies the mseal implementation by clarifying API
boundaries and removing unnecessary code complexity.
It replaces generic do_mseal() usage outside the syscall with a
dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO, eliminates
mm_struct parameters to enforce that sealing applies only to
current->mm, and streamlines overall logic and comments with no
functional changes intended.
- The 4 patch series "mm/vmscan: fix swappiness=max and clean up
per-node proactive reclaim" from Ridong Chen resolves reclaim behavior
bugs and cleans up function parameters across memory reclaim paths.
It fixes swappiness=max in both standard reclaim and MGLRU so
unswappable anonymous memory no longer falls back to evicting page
cache, ensures reclaim_store() returns accurate error codes instead of
collapsing all failures into -EAGAIN, and removes the obsolete gfp_mask
parameter from __node_reclaim().
- The 6 patch series "mm: mincore: misc cleanups" from Kefeng Wang
cleans up and simplifies the mincore code. Most importantly, it removes
the historical special behavior that always reports VM_PFNMAP pages as
non-resident.
- The 2 patch series "mm/huge_memory: drop dead split helper variants"
from Kiryl Shutsemau implements two trivial cleanups in the folio split
API.
- The 7 patch series "mm/damon: fix uninitialized DAMOS field and kunit
exec expectation bugs" from SJ Park resolves minor operational and
testing bugs in DAMON identified by Sashiko. It initializes the
damos->last_applied field to prevent occasional efficiency degradation
and fixes invalid memory accesses in DAMON KUnit tests during test
failure handling.
- The 3 patch series "cleanup for stable_page_flags()" from Jinjiang Tu
cleans up and refactors stable_page_flags() used by /proc/kpageflags
without altering functionality.
It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
bits, converts folio-specific flag checks to standard folio_test_*()
helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.
- The 3 patch series "Batch unmap of uffd-wp file folios" from Dev Jain
extends batched folio unmapping support to file folios within
userfaultfd write-protect (uffd-wp) VMAs by adding batching capabilities
to pte_install_uffd_wp_if_needed().
This removes special-case restrictions on uffd-wp VMAs in
try_to_unmap_one(), significantly simplifying the function's control
flow and complexity.
- The 3 patch series "mm/early_ioremap: clarify and clean up
early_ioremap_reset()" from Sang-Heon Jeon clarifies and cleans up the
architecture-specific usage of __late_set_fixmap() and
__late_clear_fixmap() after early_ioremap_reset().
It adds explicit documentation regarding when early_ioremap_reset()
must be called and removes redundant macro definitions and reset calls
in the RISC-V and ARM64 architectures.
- The 4 patch series "mm: fix reclaim storms in defrag_mode" from
Johannes Weiner addresses severe performance regressions, swap storms,
and spurious OOMs caused by vm.defrag_mode=1 under high memory pressure
in Meta production.
It updates the page allocator slowpath so non-movable allocation
requests actively trigger direct reclaim and direct compaction at
pageblock_order scale, allowing them to claim whole pageblocks rather
than spinning unproductively.
- The 2 patch series "zram: lockmap tweaks" from Sebastian Siewior
optimizes and fixes lockdep tracking for zram devices by consolidating
per-entry lockmaps and isolating lock classes across multiple instances.
It reduces memory overhead by replacing per-entry lockdep_map instances
with a single map per struct zram, and assigns a dynamic lock_class_key
to each instance to prevent false deadlock reports when different zram
devices are backed by distinct filesystems.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaoUJbQAKCRDdBJ7gKXxA
jqrzAP9WoPU0hiK4qS/kSjhtoZxhjpS5eLSUCy/utKuEvZbfGgEAu1zA+LH+X9Tm
THK5ex4iUZxiFbXpWfLMxE/Q9PmQYQ8=
=QTyb
-----END PGP SIGNATURE-----
Merge tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull MM updates from Andrew Morton:
- "mm: drop "sub" prefix from various places" (Dev Jain)
page->folio conversion and a naming cleanup
- "mm/kasan: remove redundant initialization for kasan_flag_write_only"
(Igor Putko)
KASAN cleanup work
- "mm/filemap: reduce unnecessary xarray lookups" (Chi Zhiling)
Small speedup in the pagecaache read code
- "mm/percpu: Fix possible NOFS/NOIO reclaim recursion" (Kaitao Cheng)
Improve the vmalloc code - mainly the avoidance of GFP_KERNEL
allocations when the caller asked for GFP_NOFS or GFP_NOIO
- "mm/kmemleak: avoid soft lockup when scanning task stacks" (Breno
Leitao)
Avoid a soft lockup watchdog trigger from the kmemleak scanning code
in extreme situations
- "mm/page_owner: misc cleanups" (Ye Liu)
Cleanups to the page_owner code. For some reason lots of people have
been working on the page_owner code this cycle.
- "mm: convert to walk_page_range_vma() to eliminate find_vma()"
(Kefeng Wang)
Simplify and accelerate the page walking library function
- "mm/migrate: preparatory cleanups for batch copy and offload"
(Shivank Garg)
Cleanups in the migration code
- "mm/page_owner: add per-fd filter infrastructure for print_mode and
NUMA filtering" (Zhen Ni)
Per-fd filtering to page_owner in order to reduce the sometimes vast
amount of output it can produce
- "mm: Refactor bootmem gigantic hugepage allocation" (Muchun Song)
Fixes and preparatory cleanups around bootmem HugeTLB handling,
sparse initialization ordering, and related vmemmap setup
- "mm/zsmalloc: reduce lock contention in zs_free()" (Wenchao Hao)
Reduce lock contention in zs_free(), which dominates the unmap path
under memory pressure on Android (LMK kills) and on x86 servers
running zswap-heavy workloads.
Up to 1.83x improvement in microbenchmarking.
- "move alloc_tag.c file under mm/" (Suren Baghdasaryan)
- "samples/damon: handle damon_{start,stop}() failures" (SJ Park)
Fix improper handling of damon_start(), damon_stop(), and
damon_call() failures across DAMON sample modules to prevent
potential memory leaks, operation disruptions and use-after-free
bugs
- "mm/damon/sysfs: kobject_del() directories that users can
create/remove" (SJ Park)
Fix delayed sysfs directory removal under DEBUG_KOBJECT_RELEASE
causeing creation failures due to duplicate directory names by adding
missing kobject_del() calls before creating new directories
- "mm: cleanup clear_not_present_full_ptes()" (David Hildenbrand)
Clean up the core pte handling code
- "selftests/damon: misc fixes for test bugs" (Kunwu Chan)
Fix several bugs in the DAMON selftests
- "selftests/damon: fix memcg_path staging handling" (Cheng Nie)
Fix a bug in _damon_sysfs.py for damos_filter memcg_path setup, and
add a test case for it in sysfs.py.
- "selftests/damon: test kdamond refresh_ms" (Ruslan Valiyev)
Selftest coverage for DAMON's refresh_ms sysfs feature by updating
the test control module and verifying that scheme stats update
automatically without manual intervention
- "mm/damon: five misc fixups" (Akinobu Mita)
Miscellaneous DAMON fixups.
- "mm/damon/core: detect internal variation above max_nr_regions/2"
(Jiayuan Chen)
Fix DAMON's region splitting behavior when region counts exceed half
the maximum budget by dynamically scaling down the split fraction as
the limit approaches, preventing large regions from staying un-split,
and add corresponding KUnit test coverage
- "mm: preparatory patches for PMD level swap entries" (Usama Arif)
Refactor and clean up PMD softleaf helpers, call sites, and
architecture flags to lay the groundwork for a follow-up series that
introduces PMD page table swap entries
- "mm/damon: update, optimize, and clean up doc, tests, and code" (SJ
Park)
Update DAMON design and ABI documentation, expands unit and selftest
coverage, optimize damon_commit_target_regions(), and clean up
recently added sysfs interface code for better readability
- "mm/vmpressure: reduce CPU, memory and code overhead on cgroup v2"
(Usama Arif)
Optimize vmpressure() by skipping unnecessary work on cgroup v2 for
userspace event notifications and refactor v1-only eventfd handling
into mm/memcontrol-v1.c to reduce memory overhead and code complexity
- "selftests/mm: refactor pkey helpers and fix mmap error handling"
(Hongfu Li)
Refactor pkeys shared tracing and assertion helpers into a common
file, unify protection key selftests to use consistent diagnostic
logging and assertions, and enforce standardized MAP_FAILED return
checks for mmap() calls across the tests
- "mm/damon: optimize out nr_accesses_bp" (SJ Park)
Replace the error-prone, continuously updated nr_accesses_bp field in
damon_region with an on-demand moving sum function, reducing
structure memory overhead and avoiding state corruption bugs
- "Open HugeTLB allocation routine for more generic use" (Ackerley Tng)
Decouple HugeTLB folio allocation from VMA dependencies by
introducing hugetlb_alloc_folio(), enabling subsystems like
guest_memfd to allocate HugeTLB folios without standard VMA
reservations or pseudo-VMAs
- "mm/damon: provide pseudo moving sum probe_hits" (SJ Park)
Integrate DAMON's probe_hits attribute counter into the pseudo moving
sum infrastructure, enabling real-time, online monitoring without
waiting for full aggregation intervals
- "mm: Some cleanups for page allocator APIs" (Brendan Jackman)
Simplify and refactor the page allocator entry points and flags by
unifying allocation paths, adding internal alloc_flags arguments, and
eliminating redundant __ prefixed alloc_pages variants.
- "Fix incorrect access of hugetlb pte entries" (Dev Jain)
Enforce the consistent use of huge_ptep_get() instead of ptep_get()
for HugeTLB entries and fixes an unaligned address issue in arm64's
huge_ptep_get() implementation
- "mm/damon: validate all parameters in the core" (SJ Park)
Consolidate parameter validation into the DAMON core specifically
within damon_start() and damon_commit_ctx() to centralize error
checking, eliminate caller-side redundant checks and to improve
maintenance efficiency
- "tools/mm/page_owner_sort: fix filtering and cleanup issues" (Yichong
Chen)
Rename is_need() to filter_record() for clearer return semantics, fix
per-record allocation memory leaks and bound output copies in
search_pattern() to address an existing buffer issue
- "memcg: bail out reclaim when memcg is dying" (Jiayuan Chen)
Mitigate a system-wide stall which occurs when a cgroup is removed
while one of its memory control files is doing synchronous reclaim
- "mm/memory-failure: add panic option for unrecoverable pages" (Breno
Leitao)
Introduce an opt-in vm.panic_on_unrecoverable_memory_failure sysctl
that immediately panics the kernel on unrecoverable memory errors in
kernel-owned pages to preserve error context and prevent delayed,
silent data corruption
- "mm/damon: refactor damon_{start,stop,commit}() for simple error
handling" (SJ Park)
Refactor the DAMON core API functions to guarantee that all contexts
are fully stopped when damon_start(), damon_stop(), or damon_commit()
fail, eliminating the need for complex and error-prone caller-side
cleanup code
- "Keep tail page private zero at free and folio split" (Zi Yan)
Add checks to ensure tail_page->private is zero when freeing compound
or high-order pages and when promoting tail pages during large folio
splits. By validating these fields at free and split time, it allows
the removal of redundant private field clearing inside
prep_compound_tail()
- "mm: drop redundant lru_add_drain in anon folio reuse paths" (Barry
Song)
Eliminate redundant lru_add_drain() calls in
wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
contention and system overhead
By validating folio refcounts against the LRU cache before draining
and removing unnecessary drains in the swap path, it achieves up to a
30.5% reduction in drain calls during heavy swap workloads
- "mm: clean up folio LRU and swap declarations" (Jianyue Wu)
Reorganize folio LRU and swap code by relocating page-cluster state
to mm/swap_state.c, renaming mm/swap.c to mm/folio.c, and moving
MM-internal reclaim declarations into mm/internal.h.
- "userfaultfd: working set tracking for VM guest memory" (Kiryl
Shutsemau)
Add userfaultfd support for tracking the working set of VM guest
memory, so a VMM can identify hot pages and reclaim cold ones to
tiered or remote storage
- "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)" (David
Hildenbrand)
Remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE,
performing some smaller cleanups around freeing of reserved vmemmap
pages on the way.
- "mm/damon: update probe hits for runtime parameter commits" (SJ Park)
Ensure that DAMON's probe_hits attribute counter is properly updated
when monitoring intervals are changed at runtime, matching the
behavior of nr_accesses. To achieve this, it refactors and renames
existing helper functions for shared use, applies the updates to
probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
maintain measurement accuracy.
- "KSM: performance optimizations for rmap_walk_ksm" (xu xin)
Resolve a severe KSM reverse-mapping performance bottleneck where
thousands of split VMAs sharing a single anon_vma cause extended lock
contention.
By adding an interval-filtering check during the rmap walk, it
reduces worst-case anon_vma lock hold times from over 500ms down to
under 2ms, preventing application freezes and latency spikes under
memory pressure.
- "mm: split a couple of headers from internal.h" (Mike Rapoport)
Split declarations related to mm_init, memblock, vmalloc and sparse
into new headers
- "KSM: use linear_page_index in collect_procs_ksm()" (xu xin)
Apply the interval tree optimization from rmap_walk_ksm() to
collect_procs_ksm() to avoid iterating over non-matching VMAs during
KSM memory error handling.
It hoists loop-invariant address initialization and restricts the
anon_vma_interval_tree_foreach walk to a targeted page offset range,
reducing redundant checks and improving lookup efficiency.
- "selftests/mm: avoid false failures in hugetlb and KSM tests" (Sayali
Patil)
Fix issues in the hugetlb and KSM MM selftest categories that can
report failures when the prerequisites for the tests are not
satisfied
- "mm/damon: introduce data attributes only monitoring" (SJ Park)
Introduce attribute-weighted region management in DAMON, allowing
users to prioritize specific data attributes (such as page sizes or
cgroups) over or instead of access monitoring.
By assigning weights to attribute probes, DAMON can completely
disable access tracking and adjust monitoring regions based on
weighted probe-hit counters to optimize monitoring quality for
attribute-focused workloads.
- "mm/hmm: Add mmap lock-drop support for userfaultfd-backed mappings"
(Stanislav Kinsburskii)
Extend hmm_range_fault() to support userfaultfd-backed regions by
allowing the mmap lock to be dropped during fault handling via a new
hmm_range_fault_locked() helper.
By accepting a locked pointer and signaling retry status when lock
release occurs, it enables page fault resolution in userfaultfd
regions while preserving backward compatibility for existing callers.
- "mm: make VMA page offset handling more consistent" (Lorenzo Stoakes)
Clean up and standardize how vma->vm_pgoff is accessed and
manipulated across file-backed and anonymous mappings in the kernel
It introduces dedicated helper functions such as vma_start_pgoff(),
vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while
renaming rmap interval tree helpers to better reflect their
functionality.
These changes establish a cleaner foundation for future work that
will unify virtual page offset indexing for all anonymous and CoW'd
folios.
- "mm: handle device-private PMDs in walk callbacks" (Usama Arif)
Address kernel panics and state corruption caused by MM walk
callbacks reaching non-present device-private PMD swap entries
created during HMM migrations
It ensures that functions which acquire pmd_trans_huge_lock()
properly recognize device-private PMDs instead of assuming a present
THP or a standard migration entry.
- "mm/rmap: Refactor try_to_unmap_one" (Dev Jain)
Refactor try_to_unmap_one by modularizing Hugetlb,
anonymous-lazyfree, and anonymous-swapbacked logic into dedicated
functions, laying the structural groundwork for batched anonymous
large folio unmapping.
- "Docs/ABI/damon: sysfs ABI document fixes and additions" (Song Hu)
Fix typos and fills in missing entries in the DAMON sysfs ABI
document
- "dax/kmem: atomic whole-device hotplug via sysfs" (Gregory Price)
Introduce an atomic sysfs state attribute and supporting DAX/MM
infrastructure to prevent userland races when offlining and removing
entire memory regions
By adding an unplugged state alongside standard online modes, it
enables whole-device atomic hotplug control while preserving backward
compatibility.
- "mm: convert more vm_flags_t users to vma_flags_t" (Lorenzo Stoakes)
Continue transitioning the kernel from the deprecated vm_flags_t type
to vma_flags_t across core memory management infrastructure.
It replaces legacy type usage in core functions such as do_mmap(),
unmapped area allocation, mm->def_vma_flags, and VMA operations like
mlock, mprotect, and mremap.
- "Two small patches to clean up mm/mm_slot.h" (xu xin)
Refactor mm_slot.h by introducing mm_slot_remove() to unify duplicate
slot deletion sequences in khugepaged and KSM. It also adds code
documentation explaining why mm_slot_lookup and mm_slot_insert must
remain as preprocessor macros rather than static inline functions.
- "mm/damon/core: hide core-private struct fields" (SJ Park)
Clean up DAMON core structures by consistently marking internal-only
fields with private: comment tags to prevent improper direct access
from outer layers.
It enforces encapsulation across core structures including
damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
interact through approved access APIs instead of exposing raw struct
members.
- "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races"
(SJ Park)
Address potential infinite loops, NULL dereferences, and race
conditions identified in DAMON
It fixes an infinite loop triggered by extreme user configurations, a
NULL pointer dereference within unit tests and minor monitoring
accuracy degradation caused by subtle runtime races.
- "mm/page_alloc: fixes for free_pages_nolock() on RT/UP" (Brendan
Jackman)
Fix an NMI safety flaw in __free_frozen_pages() where freeing pages
on non-SMP or PREEMPT_RT kernels can bypass can_spin_trylock() checks
via non-PCP or isolated migration paths.
It also resolves potential kernel crashes and privilege escalation
risks triggered when BPF tracing runs in NMI context alongside memory
hotplug or large allocation frees.
- "mm/page_alloc: couple of followups for recent cleanups" (Brendan
Jackman)
Clean up and update page allocator nomenclature, documentation, and
debug assertions.
It aligns internal FPI_ flags with the public "nolock" naming
convention, removes outdated internal implementation details from
high-level page allocator comments, and eliminates obsolete
VM_BUG_ON() assertions in allocation paths.
- "mm/mseal: further cleanups" (Lorenzo Stoakes)
Refactor and simplify the mseal implementation by clarifying API
boundaries and removing unnecessary code complexity.
It replaces generic do_mseal() usage outside the syscall with a
dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO,
eliminates mm_struct parameters to enforce that sealing applies only
to current->mm, and streamlines overall logic and comments with no
functional changes intended.
- "mm/vmscan: fix swappiness=max and clean up per-node proactive
reclaim" (Ridong Chen)
Resolve reclaim behavior bugs and clean up function parameters across
memory reclaim paths
It fixes swappiness=max in both standard reclaim and MGLRU so
unswappable anonymous memory no longer falls back to evicting page
cache, ensures reclaim_store() returns accurate error codes instead
of collapsing all failures into -EAGAIN, and removes the obsolete
gfp_mask parameter from __node_reclaim().
- "mm: mincore: misc cleanups" (Kefeng Wang)
Clean up and simplifies the mincore code. Most importantly, it
removes the historical special behavior that always reports VM_PFNMAP
pages as non-resident.
- "mm/huge_memory: drop dead split helper variants" (Kiryl Shutsemau)
Two trivial cleanups in the folio split API
- "mm/damon: fix uninitialized DAMOS field and kunit exec expectation
bugs" (SJ Park)
Resolve minor operational and testing bugs in DAMON identified by
Sashiko. It initializes the damos->last_applied field to prevent
occasional efficiency degradation and fixes invalid memory accesses
in DAMON KUnit tests during test failure handling.
- "cleanup for stable_page_flags()" (Jinjiang Tu)
Clean up and refactor stable_page_flags() used by /proc/kpageflags
without altering functionality.
It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
bits, converts folio-specific flag checks to standard folio_test_*()
helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.
- "Batch unmap of uffd-wp file folios" (Dev Jain)
Extend batched folio unmapping support to file folios within
userfaultfd write-protect (uffd-wp) VMAs by adding batching
capabilities to pte_install_uffd_wp_if_needed().
This removes special-case restrictions on uffd-wp VMAs in
try_to_unmap_one(), significantly simplifying the function's control
flow and complexity.
- "mm/early_ioremap: clarify and clean up early_ioremap_reset()"
(Sang-Heon Jeon)
Clarify and clean up the architecture-specific usage of
__late_set_fixmap() and __late_clear_fixmap() after
early_ioremap_reset()
It adds explicit documentation regarding when early_ioremap_reset()
must be called and removes redundant macro definitions and reset
calls in the RISC-V and ARM64 architectures.
- "mm: fix reclaim storms in defrag_mode" (Johannes Weiner)
Address severe performance regressions, swap storms, and spurious
OOMs caused by vm.defrag_mode=1 under high memory pressure in Meta
production
It updates the page allocator slowpath so non-movable allocation
requests actively trigger direct reclaim and direct compaction at
pageblock_order scale, allowing them to claim whole pageblocks rather
than spinning unproductively.
- "zram: lockmap tweaks" (Sebastian Siewior)
Optimize and fix lockdep tracking for zram devices by consolidating
per-entry lockmaps and isolate lock classes across multiple instances
This reduces memory overhead by replacing per-entry lockdep_map
instances with a single map per struct zram, and assigns a dynamic
lock_class_key to each instance to prevent false deadlock reports
when different zram devices are backed by distinct filesystems.
* tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (501 commits)
selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check
selftests/mm: unpoison pages in memory-failure teardown
mm/shmem: downgrade final i_blocks check in shmem_evict_inode() to pr_warn()
mm/khugepaged: replace mutex_lock/mutex_unlock usage with guard macro
mm/zsmalloc: fix release order of locks in zs_page_migrate()
Documentation: zram: remove sections numbering
ksm: stop iterating VMAs when ksm_test_exit returns true
mm: fold userfaultfd_rwp() to false without CONFIG_ARCH_HAS_PTE_PROTNONE
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
zram: use a custom key for each zram object
zram: move lockmap to be per-zram instead per table
selftests/mm: fix gup_longterm EINVAL error message
mm: page_alloc: fix non-movable reclaim storm in defrag_mode
mm: page_alloc: move capture_control to the page allocator
mm: compaction: support non-movable compaction for pageblock requests
mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
hugetlb: evaluate subpool free state while locked
mm/damon: remove trailing semicolons after function definitions
mm/damon/ops-common: prevent migration fallback to non-target nodes
mm/damon: update outdated comment about DAMOS filter handling
...
|
||
|
Linus Torvalds
|
a625b2a387 |
VFIO updates for v7.3-rc1
- Add nv_falcon vfio selftest driver. The Falcon is a general-purpose
microcontroller embedded within NVIDIA GPUs, presenting a relatively
simple DMA programming interface. This adds another selftest target
for vfio-pci with real DMA transfers. (Rubin Du, Alex Williamson)
- Add allocation assertion helpers to vfio selftests and use them to
avoid variable length arrays and the compiler errors they generate.
(Alex Mastro)
- Fix use-after-free hazard where an init path error in MSI support
leaves a stray pointer that can later be reused or double-freed.
(Xiang Mei)
- Fix previous refactor of PCI BAR mappings to honor non_mappable_bars
flag, which otherwise generates a warning when trying to pci_iomap()
a 256TiB BAR on ISM devices on s390. (Farhan Ali)
- Add igb vfio selftest driver. Like nv_falcon, this provides another
target for DMA testing with vfio selftests, but importantly this
driver supports both physical 82576 NICs and the emulation model in
QEMU. This therefore enables a vfio selftest vector with no physical
hardware requirements. (Josh Hilke, Alex Williamson)
- Mark selftest fixture objects __maybe_unused to accommodate builds
with clang -Wunused-but-set-global. (David Matlack)
- Add error recovery for vfio-pci devices on s390x. This expands
devices which expose the existing error eventfd and introduces a
device feature for reporting firmware defined error state
information to the user, allowing recovery through hypervisor
channels. (Farhan Ali)
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmqE1t4RHGFsZXhAc2hh
emJvdC5vcmcACgkQI5ubbjuwiyJyRg//UQg1EnIu18XdTIMWwFDOIeeJBj+Vm/KK
FzlS4Fsp2jw3qIXTX9KbxU+Bxx8TyHo9h7IhBYSPfaLAjoWLvCllu/HTScU1zumL
+oXiiSLKcqX3q63c1i3U7/QJNgBeRf7CAnwaCXe6Sd57UL2JT+lcURJvEYYj9KRG
yWlsnEnw0kKH4w1rujh3fRcDx31GJf6RmxCK4RqIDyMk7YRfVExD3AOm0GjBN+0N
6YyW0/jF7cy0OgAr1DN5EZocyWJX70roWBSFPa2jO3q9UwDomexQDvH26x5VucDG
6kK1qHHPcW2P5Rel3ggEzKEo3C9bjC1vCqHGT7Vf/5MZMtDekJ82L31jd8gxCodD
q9dnNVXJAScQV38GrIG04FXzjyyB1dnUY6lm2wiZsEhsen2Eot1ZcWAVxHZ8zqdZ
hE6mjA2fCgDC5OUrHj7KhGD1Ya4SZRs0qjuW32GLnv7BoGGaec4x6nLDJKdB4V+y
n26NjoutQdhwj+LjgOZNXb9K3dVgayMvzzDgBV9z6i574R5/A9EjjmkeVUAnfie1
UfW7uod3gCJq9Yzo58GnHLRR7jDZ0miXzq2iZ6SM8FpuHP52Eq0Q7GPs7PHs1coO
xD0ONL6hJav3ZEZEJLtUhCSop7T7CVv3JsSPc6rJo8b5AyhIf7ZZQ8OEOqhiN4uX
ixBRMTzcYkw=
=hR5/
-----END PGP SIGNATURE-----
Merge tag 'vfio-v7.3-rc1' of https://github.com/awilliam/linux-vfio
Pull VFIO updates from Alex Williamson:
- Add nv_falcon vfio selftest driver.
The Falcon is a general-purpose microcontroller embedded within
NVIDIA GPUs, presenting a relatively simple DMA programming
interface.
This adds another selftest target for vfio-pci with real DMA
transfers (Rubin Du, Alex Williamson)
- Add allocation assertion helpers to vfio selftests and use them to
avoid variable length arrays and the compiler errors they generate
(Alex Mastro)
- Fix use-after-free hazard where an init path error in MSI support
leaves a stray pointer that can later be reused or double-freed
(Xiang Mei)
- Fix previous refactor of PCI BAR mappings to honor non_mappable_bars
flag, which otherwise generates a warning when trying to pci_iomap()
a 256TiB BAR on ISM devices on s390 (Farhan Ali)
- Add igb vfio selftest driver.
Like nv_falcon, this provides another target for DMA testing with
vfio selftests, but importantly this driver supports both physical
82576 NICs and the emulation model in QEMU.
This therefore enables a vfio selftest vector with no physical
hardware requirements (Josh Hilke, Alex Williamson)
- Mark selftest fixture objects __maybe_unused to accommodate builds
with clang -Wunused-but-set-global (David Matlack)
- Add error recovery for vfio-pci devices on s390x.
This expands devices which expose the existing error eventfd and
introduces a device feature for reporting firmware defined error
state information to the user, allowing recovery through hypervisor
channels (Farhan Ali)
* tag 'vfio-v7.3-rc1' of https://github.com/awilliam/linux-vfio:
vfio/pci: Remove the pcie check for VFIO_PCI_ERR_IRQ_INDEX
vfio-pci/zdev: Add a device feature for error information
s390/pci: Store PCI error information for passthrough devices
PCI/MSI: Enable memory decoding before restoring MSI-X messages
PCI: Fail FLR when config space is inaccessible
PCI: Avoid saving config space state if inaccessible
PCI: Allow per function PCI slots to fix slot reset on s390
PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
selftests: harness: Mark test fixture objects __maybe_unused
vfio: selftests: Retry on EAGAIN during device reset
vfio: selftests: igb: Add driver for Intel 82576 device
vfio: selftests: Add helpers to re-enable interrupts
vfio/pci: Avoid mapping BARs for devices with non-mappable BARs
vfio/pci: clear vdev->msi_perm after freeing it on init failure
vfio: selftests: Avoid VLAs
vfio: selftests: Add allocation assert helpers
vfio: selftests: Add NVIDIA Falcon driver for DMA testing
vfio: selftests: Allow drivers without send_msi() support
vfio: selftests: Add generic PCI command register helpers
vfio: selftests: Add memcpy chunking to vfio_pci_driver_memcpy()
|
||
|
Farhan Ali
|
4e3c1fc8ab |
vfio/pci: Remove the pcie check for VFIO_PCI_ERR_IRQ_INDEX
The error signaling is configured for the vast majority of devices and it's extremely rare that it fires anyway. Removing the pcie check will allow userspace to be notified on errors for legacy PCI devices. The Internal Shared Memory (ISM) device on s390 is one such device. For PCI devices on IBM s390 error recovery involves platform firmware and notification to operating system is done by architecture specific way. So the ISM device can still be recovered when notified of an error. Reviewed-by: Julian Ruess <julianr@linux.ibm.com> Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com> Reviewed-by: Alex Williamson <alex@shazbot.org> Signed-off-by: Farhan Ali <alifm@linux.ibm.com> Link: https://lore.kernel.org/r/20260630165553.725-4-alifm@linux.ibm.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Farhan Ali
|
fa63a2e3f9 |
vfio-pci/zdev: Add a device feature for error information
For zPCI devices, we have platform specific error information. The platform firmware provides this error information to the operating system in an architecture specific mechanism. To enable recovery from userspace for these devices, we want to expose this error information to userspace. Add a new device feature to expose this information. Userspace needs to be provide a buffer of fixed size. This size is provided to userspace via the VFIO_DEVICE_INFO_CAP_ZPCI_BASE capability. Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com> Signed-off-by: Farhan Ali <alifm@linux.ibm.com> Link: https://lore.kernel.org/r/20260630165553.725-3-alifm@linux.ibm.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Farhan Ali
|
9f240376d0 |
s390/pci: Store PCI error information for passthrough devices
For a passthrough device we need co-operation from user space to recover the device. This would require to bubble up any error information to user space. Let's store this error information for passthrough devices, so it can be retrieved later. We can now have userspace drivers (vfio-pci based) on s390x. The userspace drivers will not have any KVM fd and so no kzdev associated with them. So we need to update the logic for detecting passthrough devices to not depend on struct kvm_zdev. Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com> Signed-off-by: Farhan Ali <alifm@linux.ibm.com> Link: https://lore.kernel.org/r/20260630165553.725-2-alifm@linux.ibm.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Farhan Ali
|
6edd69813b |
vfio/pci: Avoid mapping BARs for devices with non-mappable BARs
vfio_pci_core_map_bars() calls pci_iomap() to set up BAR resources, but not
all devices support having their BARs mapped by the CPU. The
non_mappable_bars flag indicates that a PCI device's BARs cannot be
accessed by the CPU. The ISM device on s390 is one such device. The BAR
size for an ISM device is 256 TiB, and attempting to map the BAR will lead
to warnings:
vmalloc_node_range for size 281474976714752 failed: Address range
restricted to 0x2110bab00000 - 0x21903ab00000
Use pdev->non_mappable_bars to skip pci_iomap() for such devices. This flag
is set by the PCI core at enumeration time and already serves the same
purpose in vfio_pci_probe_mmaps().
Fixes:
|
||
|
Lorenzo Stoakes
|
93d23dff8e |
mm: use linear_page_[index, delta]() consistently
There are a number of places where we open code what linear_page_index() and linear_page_delta() calculate. Replace this code with the appropriate functions for consistency. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-21-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> [DRM] Acked-by: Kai Huang <kai.huang@intel.com> # for sgx Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Pedro Falcato <pfalcato@suse.de> # for mm Reviewed-by: Ackerley Tng <ackerleytng@google.com> [guest_memfd] Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Xiang Mei
|
dc77acfeb9 |
vfio/pci: clear vdev->msi_perm after freeing it on init failure
vfio_msi_cap_len() lazily allocates the per-device MSI permission table:
vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);
if (!vdev->msi_perm)
return -ENOMEM;
ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
if (ret) {
kfree(vdev->msi_perm);
return ret; /* vdev->msi_perm left dangling */
}
When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the
error path frees vdev->msi_perm but leaves the freed pointer stored in
it. vdev->msi_perm is not re-zeroed later because struct
vfio_pci_core_device is per-device and persists across open/close cycles,
and the vfio_config_init() error path returns without calling
vfio_config_free(). So the dangling pointer outlives the failed open.
That leads to two use-after-frees on the same device:
1. Reuse. The next vfio_config_init() sees the stale pointer at
"if (vdev->msi_perm) return len;" and reuses the freed object. MSI
config accesses in vfio_pci_config_rw_single() then dereference and
call the freed perm->readfn / perm->writefn function pointers.
2. Double free. A later vfio_config_free() runs free_perm_bits() and
kfree() on the already-freed object.
Fix it by NULLing vdev->msi_perm after the kfree(), matching the
NULL-after-free discipline already used in free_perm_bits() and
vfio_config_free().
BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)
Read of size 8 at addr ffff88800fcc88d0 by task exploit/143
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)
vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986)
vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599)
vfs_read (fs/read_write.c:572)
__x64_sys_pread64 (fs/read_write.c:764)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...
Followed on device close by a double free of the same object:
Oops: general protection fault, probably for non-canonical address
0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:kfree (mm/slub.c:6711)
Call Trace:
vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861)
vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685)
vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777)
vfio_df_close (drivers/vfio/vfio_main.c:602)
vfio_device_fops_release (drivers/vfio/vfio_main.c:648)
__fput (fs/file_table.c:512)
__x64_sys_close (fs/open.c:1496)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...
Kernel panic - not syncing: Fatal exception
Fixes:
|
||
|
Jacob Pan
|
e8efdf02d3 |
vfio: Enable cdev noiommu mode under iommufd
Now that devices under noiommu mode can bind with IOMMUFD and perform IOAS operations, lift restrictions on cdev from VFIO side. Use cases are documented in Documentation/driver-api/vfio.rst Link: https://patch.msgid.link/r/fdac3395ecc52f87b722b54a055ced66733dc48f.1783360051.git.jacob.pan@linux.microsoft.com Reviewed-by: Kevin Tian <kevin.tian@intel.com> Reviewed-by: Pranjal Shrivastava <praan@google.com> Reviewed-by: Yi Liu <yi.l.liu@intel.com> Reviewed-by: Alex Williamson <alex@shazbot.org> Signed-off-by: Jacob Pan <jacob.pan@linux.microsoft.com> Fixes: 2c6cf6ab1564 ("iommufd: Allow binding to a noiommu device") Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> |
||
|
Alex Williamson
|
586a989d8b |
vfio/pci: Expose latched module parameter policy in debugfs
The nointxmask and disable_idle_d3 module parameters remain writable, but vfio-pci now latches their values into each device at init. Once a device is registered, changing the module parameter only affects future devices, leaving no direct way to confirm the effective policy for an existing device. Add a pci debugfs directory under the VFIO device debugfs root and report the per-device nointxmask and disable_idle_d3 values. These are read-only debugfs views and use the same Y/N bool output convention as the module parameters. Read-only vfio-pci parameters, such as disable_vga, are not exposed here because they cannot drift from the latched device value, therefore the existing module parameter exposure via sysfs is sufficient. Note that while only vfio-pci currently provides these options, the implementation is in vfio-pci-core and therefore properly reflects the device policy in the core, regardless of driver. Assisted-by: OpenAI Codex:gpt-5 Cc: Guixin Liu <kanie@linux.alibaba.com> Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Link: https://lore.kernel.org/r/20260615191241.688297-7-alex.williamson@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Alex Williamson
|
dc7fe87de4 |
vfio: Remove device debugfs before releasing devres
VFIO device debugfs files created with debugfs_create_devm_seqfile()
store a devres allocated debugfs_devm_entry as inode private data.
vfio_unregister_group_dev() currently calls vfio_device_del() before
vfio_device_debugfs_exit(), but device_del() releases devres. This can
leave debugfs entries visible with stale inode private data while
unregister waits for userspace references to drain.
Remove the per-device debugfs tree before vfio_device_del(). The debugfs
view is diagnostic only, so losing it at the start of unregister is
preferable to preserving entries whose backing storage may already have
been released.
Complete the teardown by clearing the per-device debugfs root after
removal. This matches the global debugfs root cleanup and prevents
future users from mistaking a removed dentry for a live debugfs tree
during the remainder of unregister.
Fixes:
|
||
|
Alex Williamson
|
3788cd493e |
vfio/pci: Latch all module parameters per device
The vfio-pci module parameters of disable_idle_d3, nointxmask, and disable_vga latch vfio-pci policy into vfio-pci-core globals each time the vfio-pci module is initialized. The disable_idle_d3 parameter has already migrated to a per-device flag in order to provide consistency for refcounted PM operations for the lifetime of the device registration. Pull the remaining vfio-pci module-parameter policy out of vfio-pci-core into per-device flags set at device initialization. This also restores the mutable aspect of the disable_idle_d3 and nointxmask module parameters for vfio-pci, with the caveat that the parameters are latched into the device at probe. A notable change for variant drivers is that their devices are no longer affected by vfio-pci module parameters and those drivers may need to adopt similar module parameters if any devices have a hidden dependency on vfio-pci setting non-default policy. Assisted-by: Claude:claude-opus-4-8 Acked-by: Chengwen Feng <fengchengwen@huawei.com> Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Link: https://lore.kernel.org/r/20260615191241.688297-6-alex.williamson@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Alex Williamson
|
f2365a63b0 |
vfio/mlx5: Fix racy bitfields and tighten struct layout
Bitfield operations are not atomic, they use a read-modify-write
pattern, therefore we should be careful not to pack bitfields that
can be concurrently updated into the same storage unit.
This split takes a binary approach: flags that are only modified
pre/post open/close remain bitfields, flags modified from user
action, including actions that reach across to another device (ex.
reset) use dedicated storage units.
Note mlx5_vhca_page_tracker.status is relocated to fill the alignment
hole this split exposes.
Bitfield justifications:
migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe
chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe
mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe
Dedicated storage units:
mdev_detach: written in the VF attach/detach event notifier
mlx5fv_vf_event() at runtime
log_active: written in mlx5vf_start_page_tracker()/
mlx5vf_stop_page_tracker() during runtime dirty tracking
deferred_reset: written in mlx5vf_state_mutex_unlock()/
mlx5vf_pci_aer_reset_done() during runtime reset handling
is_err: set by tracker error handling and dirty-log polling at runtime
object_changed: set by tracker event handling and cleared by dirty-log
polling at runtime
Fixes:
|
||
|
Alex Williamson
|
daedde7f02 |
vfio/pci: Release the VGA arbiter client on register_device() failure
The re-order in the Fixes commit below displaced vfio_pci_vga_init() as
the last failure point of what is now vfio_pci_core_register_device()
without introducing an unwind for the VGA arbiter registration.
In current kernels this is mostly benign because vfio_pci_set_decode()
only uses pci_dev state, but the original failure path could leave a
callback with a freed vdev cookie. The stale registration also becomes
unsafe again once the callback follows drvdata to the vfio device.
Add the required VGA unwind callout.
Fixes:
|
||
|
Alex Williamson
|
4575e9aac5 |
vfio/pci: Latch disable_idle_d3 per device
When disable_idle_d3 was introduced in vfio-pci, it directly manipulated the device power state with pci_set_power_state(). There were no refcounts to maintain or balanced operations, we could unconditionally bring the device to D0 and conditionally move it to D3hot. Therefore the module parameter was made writable. Later, in commit |
||
|
Giovanni Cabiddu
|
4ec5e932e6 |
vfio/qat: fix f_pos race in qat_vf_resume_write()
qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but
copies into the migration-state buffer after taking the lock and
re-reading the shared file position.
Two concurrent writers could therefore pass the bounds check with the
old offset, then have the second writer copy after the first advanced
f_pos, writing past the end of the migration-state buffer.
Take migf->lock before doing the boundary checks.
Fixes:
|
||
|
Junrui Luo
|
a26b499b75 |
vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
vfio_mig_get_next_state() walks vfio_from_fsm_table[] one step at a time,
looping to skip optional states the device does not support until
*next_fsm is supported. A blocked transition is encoded as
VFIO_DEVICE_STATE_ERROR, which the trailing return reports as -EINVAL.
The skip loop does not account for the ERROR sentinel.
state_flags_table[ERROR] is ~0U and vfio_from_fsm_table[ERROR][*] is
ERROR, so once *next_fsm becomes ERROR the loop condition stays true and
*next_fsm never changes. The blocked arcs STOP_COPY -> PRE_COPY and
STOP_COPY -> PRE_COPY_P2P map to ERROR yet pass the support check on a
precopy-capable device, causing the loop to spin forever while holding
the driver state mutex. This can result in a soft lockup, and a panic
with softlockup_panic set.
Terminate the skip loop on the ERROR sentinel so a blocked transition
falls through to the existing return and reports -EINVAL.
Fixes:
|
||
|
Ankit Agrawal
|
682ecb14e8 |
vfio/nvgrace-gpu: Add Blackwell-Next GPU readiness check via CXL DVSEC
Add a CXL DVSEC-based readiness check for Blackwell-Next GPUs alongside the existing legacy BAR0 polling path. The CXL Device DVSEC offset is discovered at probe time. Probe, fault and read/write paths then branch on that to use either the legacy BAR0 polling or the CXL DVSEC polling. The CXL path polls Memory_Active, requiring MEM_INFO_VALID within 1s and MEM_ACTIVE within Memory_Active_Timeout (up to 256s) as per CXL spec r4.0 sec 8.1.3.8.2. Given the long worst-case wait, the CXL poll runs outside memory_lock with only a quick readiness check is done under the lock. The poll loops sleep with schedule_timeout_killable() and return -EINTR on a fatal signal. This avoids hung-task panics during the long uninterruptible wait. Extend this to the legacy based wait as well for improvement. In the fault handler the wait runs locklessly before memory_lock. If a reset races in, the in-lock recheck returns -EAGAIN and the wait is retried rather than returning a spurious VM_FAULT_SIGBUS. Add PCI_DVSEC_CXL_MEM_ACTIVE_TIMEOUT to pci_regs.h for the timeout field. Cc: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Cc: Kevin Tian <kevin.tian@intel.com> Suggested-by: Alex Williamson <alex@shazbot.org> Signed-off-by: Ankit Agrawal <ankita@nvidia.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Link: https://lore.kernel.org/r/20260602063015.3915-1-ankita@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Raghavendra Rao Ananta
|
40ef3edf15 |
vfio/pci: Use a private flag to prevent power state change with VFs
The current implementation uses pci_num_vf() while holding the
memory_lock to prevent changing the power state of a PF when
VFs are enabled. This creates a lockdep circular dependency
warning because memory_lock is held during device probing.
[ 286.997167] ======================================================
[ 287.003363] WARNING: possible circular locking dependency detected
[ 287.009562] 7.0.0-dbg-DEV #3 Tainted: G S
[ 287.015074] ------------------------------------------------------
[ 287.021270] vfio_pci_sriov_/18636 is trying to acquire lock:
[ 287.026942] ff45bea2294d4968 (&vdev->memory_lock){+.+.}-{4:4}, at:
vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.036530]
[ 287.036530] but task is already holding lock:
[ 287.042383] ff45bea3a96b8230 (&new_dev_set->lock){+.+.}-{4:4}, at:
vfio_group_fops_unl_ioctl+0x44d/0x7b0
[ 287.051879]
[ 287.051879] which lock already depends on the new lock.
[ 287.051879]
[ 287.060070]
[ 287.060070] the existing dependency chain (in reverse order) is:
[ 287.067568]
[ 287.067568] -> #2 (&new_dev_set->lock){+.+.}-{4:4}:
[ 287.073941] __mutex_lock+0x92/0xb80
[ 287.078058] vfio_assign_device_set+0x66/0x1b0
[ 287.083042] vfio_pci_core_register_device+0xd1/0x2a0
[ 287.088638] vfio_pci_probe+0xd2/0x100
[ 287.092933] local_pci_probe_callback+0x4d/0xa0
[ 287.098001] process_scheduled_works+0x2ca/0x680
[ 287.103158] worker_thread+0x1e8/0x2f0
[ 287.107452] kthread+0x10c/0x140
[ 287.111230] ret_from_fork+0x18e/0x360
[ 287.115519] ret_from_fork_asm+0x1a/0x30
[ 287.119983]
[ 287.119983] -> #1 ((work_completion)(&arg.work)){+.+.}-{0:0}:
[ 287.127219] __flush_work+0x345/0x490
[ 287.131429] pci_device_probe+0x2e3/0x490
[ 287.135979] really_probe+0x1f9/0x4e0
[ 287.140180] __driver_probe_device+0x77/0x100
[ 287.145079] driver_probe_device+0x1e/0x110
[ 287.149803] __device_attach_driver+0xe3/0x170
[ 287.154789] bus_for_each_drv+0x125/0x150
[ 287.159346] __device_attach+0xca/0x1a0
[ 287.163720] device_initial_probe+0x34/0x50
[ 287.168445] pci_bus_add_device+0x6e/0x90
[ 287.172995] pci_iov_add_virtfn+0x3c9/0x3e0
[ 287.177719] sriov_add_vfs+0x2c/0x60
[ 287.181838] sriov_enable+0x306/0x4a0
[ 287.186038] vfio_pci_core_sriov_configure+0x184/0x220
[ 287.191715] sriov_numvfs_store+0xd9/0x1c0
[ 287.196351] kernfs_fop_write_iter+0x13f/0x1d0
[ 287.201338] vfs_write+0x2be/0x3b0
[ 287.205286] ksys_write+0x73/0x100
[ 287.209233] do_syscall_64+0x14d/0x750
[ 287.213529] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 287.219120]
[ 287.219120] -> #0 (&vdev->memory_lock){+.+.}-{4:4}:
[ 287.225491] __lock_acquire+0x14c6/0x2800
[ 287.230048] lock_acquire+0xd3/0x2f0
[ 287.234168] down_write+0x3a/0xc0
[ 287.238019] vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.243436] __rpm_callback+0x8c/0x310
[ 287.247730] rpm_resume+0x529/0x6f0
[ 287.251765] __pm_runtime_resume+0x68/0x90
[ 287.256402] vfio_pci_core_enable+0x44/0x310
[ 287.261216] vfio_pci_open_device+0x1c/0x80
[ 287.265947] vfio_df_open+0x10f/0x150
[ 287.270148] vfio_group_fops_unl_ioctl+0x4a4/0x7b0
[ 287.275476] __se_sys_ioctl+0x71/0xc0
[ 287.279679] do_syscall_64+0x14d/0x750
[ 287.283975] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 287.289559]
[ 287.289559] other info that might help us debug this:
[ 287.289559]
[ 287.297582] Chain exists of:
[ 287.297582] &vdev->memory_lock --> (work_completion)(&arg.work)
--> &new_dev_set->lock
[ 287.297582]
[ 287.310023] Possible unsafe locking scenario:
[ 287.310023]
[ 287.315961] CPU0 CPU1
[ 287.320510] ---- ----
[ 287.325059] lock(&new_dev_set->lock);
[ 287.328917]
lock((work_completion)(&arg.work));
[ 287.336153] lock(&new_dev_set->lock);
[ 287.342523] lock(&vdev->memory_lock);
[ 287.346382]
[ 287.346382] *** DEADLOCK ***
[ 287.346382]
[ 287.352315] 2 locks held by vfio_pci_sriov_/18636:
[ 287.357125] #0: ff45bea208ed3e18 (&group->group_lock){+.+.}-{4:4},
at: vfio_group_fops_unl_ioctl+0x3e3/0x7b0
[ 287.367048] #1: ff45bea3a96b8230 (&new_dev_set->lock){+.+.}-{4:4},
at: vfio_group_fops_unl_ioctl+0x44d/0x7b0
[ 287.376976]
[ 287.376976] stack backtrace:
[ 287.381353] CPU: 191 UID: 0 PID: 18636 Comm: vfio_pci_sriov_
Tainted: G S 7.0.0-dbg-DEV #3 PREEMPTLAZY
[ 287.381355] Tainted: [S]=CPU_OUT_OF_SPEC
[ 287.381356] Call Trace:
[ 287.381357] <TASK>
[ 287.381358] dump_stack_lvl+0x54/0x70
[ 287.381361] print_circular_bug+0x2e1/0x300
[ 287.381363] check_noncircular+0xf9/0x120
[ 287.381364] ? __lock_acquire+0x5b4/0x2800
[ 287.381366] __lock_acquire+0x14c6/0x2800
[ 287.381368] ? pci_mmcfg_read+0x4f/0x220
[ 287.381370] ? pci_mmcfg_write+0x57/0x220
[ 287.381371] ? lock_acquire+0xd3/0x2f0
[ 287.381373] ? pci_mmcfg_write+0x57/0x220
[ 287.381374] ? lock_release+0xef/0x360
[ 287.381376] ? vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.381377] lock_acquire+0xd3/0x2f0
[ 287.381378] ? vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.381379] ? lock_is_held_type+0x76/0x100
[ 287.381382] down_write+0x3a/0xc0
[ 287.381382] ? vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.381383] vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.381384] ? __pfx_pci_pm_runtime_resume+0x10/0x10
[ 287.381385] __rpm_callback+0x8c/0x310
[ 287.381386] ? ktime_get_mono_fast_ns+0x3d/0xb0
[ 287.381389] ? __pfx_pci_pm_runtime_resume+0x10/0x10
[ 287.381390] rpm_resume+0x529/0x6f0
[ 287.381392] ? lock_is_held_type+0x76/0x100
[ 287.381394] __pm_runtime_resume+0x68/0x90
[ 287.381396] vfio_pci_core_enable+0x44/0x310
[ 287.381398] vfio_pci_open_device+0x1c/0x80
[ 287.381399] vfio_df_open+0x10f/0x150
[ 287.381401] vfio_group_fops_unl_ioctl+0x4a4/0x7b0
[ 287.381402] __se_sys_ioctl+0x71/0xc0
[ 287.381404] do_syscall_64+0x14d/0x750
[ 287.381405] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 287.381406] ? trace_irq_disable+0x25/0xd0
[ 287.381409] entry_SYSCALL_64_after_hwframe+0x77/0x7f
Introduce a private flag 'sriov_active' in the vfio_pci_core_device
struct. This allows the driver to track the SR-IOV power state requirement
without relying on pci_num_vf() while holding the memory_lock. The lock is
now only held to set the flag and ensure the device is in D0, after which
pci_enable_sriov() can be called without the lock.
Fixes:
|
||
|
GuoHan Zhao
|
b9285405c5 |
vfio/xe: avoid duplicate reset in xe_vfio_pci_reset_done
xe_vfio_pci_reset_done() sets deferred_reset and, when it manages to
acquire state_mutex itself, hands the cleanup off to
xe_vfio_pci_state_mutex_unlock().
That helper already clears deferred_reset and runs xe_vfio_pci_reset()
before dropping the mutex. Calling xe_vfio_pci_reset() again right
afterwards repeats the reset handling unnecessarily.
Fixes:
|
||
|
Weili Qian
|
e1b3b4d6ff |
hisi_acc_vfio_pci: simplify the command for reading device information
The mailbox operation for the Hisi accelerator device now provides a new read function that supports direct information retrieval by specifying commands, thereby simplifying the related mailbox command handling in the driver. Signed-off-by: Weili Qian <qianweili@huawei.com> Signed-off-by: Longfang Liu <liulongfang@huawei.com> Link: https://lore.kernel.org/r/20260514092026.2018844-1-liulongfang@huawei.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Matt Evans
|
859dc0f625 |
vfio/pci: Replace vfio_pci_core_setup_barmap() with vfio_pci_core_get_iomap()
Since "vfio/pci: Set up barmap in vfio_pci_core_enable()", the resource request and iomap for the BARs was performed early, and vfio_pci_core_setup_barmap() just checks those actions succeeded. Move this logic to a new helper that checks success and returns the iomap address, replacing the various bare vdev->barmap[] lookups. This maintains the error behaviour of the previous on-demand vfio_pci_core_setup_barmap() scheme. Signed-off-by: Matt Evans <mattev@meta.com> Link: https://lore.kernel.org/r/20260511145829.2993601-4-mattev@meta.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Matt Evans
|
702809dabd |
vfio/pci: Check BAR resources before exporting a DMABUF
A DMABUF exports access to BAR resources and, although they are
requested at startup time, we need to ensure they really were reserved
before exporting. Otherwise, it's possible to access unreserved
resources through the export.
Add a check to the DMABUF-creation path.
Fixes:
|
||
|
Matt Evans
|
05f2a68b40 |
vfio/pci: Set up BAR resources and maps in vfio_pci_core_enable()
Previously BAR resource requests and the corresponding pci_iomap()
were performed on-demand and without synchronisation, which was racy.
Rather than add synchronisation, it's simplest to address this by
doing both activities from vfio_pci_core_enable().
The resource allocation and/or pci_iomap() can still fail; their
status is tracked and existing calls to vfio_pci_core_setup_barmap()
will fail in a similar way to before. This keeps the point of failure
as observed by userspace the same, i.e. failures to request/map unused
BARs are benign.
Fixes:
|
||
|
Alex Williamson
|
c64a647c84 |
vfio/pci: fix dma-buf kref underflow after revoke
vfio_pci_dma_buf_move(revoked=true) and vfio_pci_dma_buf_cleanup()
ran the same drain sequence: set priv->revoked, invalidate mappings,
wait for fences, drop the registered kref, wait for completion.
When the VFIO device fd was closed after PCI_COMMAND_MEMORY had been
cleared, both ran in turn -- the second kref_put underflowed and the
subsequent wait_for_completion() blocked on a completion that the
first run had already consumed:
refcount_t: underflow; use-after-free.
WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x59/0x90
Call Trace:
vfio_pci_dma_buf_cleanup+0x163/0x168 [vfio_pci_core]
vfio_pci_core_close_device+0x67/0xe0 [vfio_pci_core]
vfio_df_close+0x4c/0x80 [vfio]
vfio_df_group_close+0x36/0x80 [vfio]
vfio_device_fops_release+0x21/0x40 [vfio]
__fput+0xe6/0x2b0
__x64_sys_close+0x3d/0x80
Collapse the duplication: vfio_pci_dma_buf_cleanup() now delegates
the drain to vfio_pci_dma_buf_move(true), which is idempotent for
already-revoked dma-bufs. cleanup retains only list removal and
the device registration drop; the dma_resv_lock that bracketed
those is dropped along with the in-line drain that required it,
memory_lock continues to protect them.
Re-arm the kref and the completion at the end of move()'s revoke
branch so post-revoke state matches post-creation (kref == 1,
completion ready). This keeps cleanup's call into move() a no-op
when revoke already ran, and replaces the explicit kref_init() that
the un-revoke branch used to perform for the un-revoke -> remap
path.
Fixes:
|
||
|
Alex Williamson
|
30471982cd |
vfio/cdx: Consolidate MSI configured state onto cdx_irqs
struct vfio_cdx_device carries three fields that track whether MSI has been configured: vdev->cdx_irqs (the allocated vector array), vdev-> msi_count (the array length), and vdev->config_msi (a boolean flag). The three are set together when vfio_cdx_msi_enable() succeeds and cleared together by vfio_cdx_msi_disable(). However, the error paths in vfio_cdx_msi_enable() free the cdx_irqs allocation on failure without resetting the pointer, leaving it stale and skewed from the other two fields until the next enable call overwrites it. Clear vdev->cdx_irqs to NULL alongside the kfree() in both error paths so the pointer consistently reflects the configured state. With that invariant restored and access to the MSI state serialized by cdx_irqs_lock, vdev->config_msi is fully redundant with (vdev->cdx_irqs != NULL). Drop the config_msi field and switch all readers to test cdx_irqs directly. Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Acked-by: Nikhil Agarwal <nikhil.agarwal@amd.com> Link: https://lore.kernel.org/r/20260417202800.88287-4-alex.williamson@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org> |
||
|
Alex Williamson
|
670e8864b1 |
vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
vfio_cdx_set_msi_trigger() reads vdev->config_msi and operates on the
vdev->cdx_irqs array based on its value, but provides no serialization
against concurrent VFIO_DEVICE_SET_IRQS ioctls. Two callers can race
such that one observes config_msi as set while another clears it and
frees cdx_irqs via vfio_cdx_msi_disable(), resulting in a use-after-free
of the cdx_irqs array.
Add a cdx_irqs_lock mutex to struct vfio_cdx_device and acquire it in
vfio_cdx_set_msi_trigger(), which is the single chokepoint through
which all updates to config_msi, cdx_irqs, and msi_count flow, covering
both the ioctl path and the close-device cleanup path. This keeps the
test of config_msi atomic with the subsequent enable, disable, or
trigger operations.
Drop the pre-call !cdx_irqs test from vfio_cdx_irqs_cleanup() as part
of this change: the optimization it provided is redundant with the
!config_msi early-return inside vfio_cdx_msi_disable(), and leaving the
test in place would be an unsynchronized read of state the new lock is
meant to protect.
Fixes:
|