linux/drivers
Vitaly Kuznetsov ec2bf249bd Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
[ Upstream commit f0880e2cb7 ]

Passed through PCI device sometimes misbehave on Gen1 VMs when Hyper-V
DRM driver is also loaded. Looking at IOMEM assignment, we can see e.g.

$ cat /proc/iomem
...
f8000000-fffbffff : PCI Bus 0000:00
  f8000000-fbffffff : 0000:00:08.0
    f8000000-f8001fff : bb8c4f33-2ba2-4808-9f7f-02f3b4da22fe
...
fe0000000-fffffffff : PCI Bus 0000:00
  fe0000000-fe07fffff : bb8c4f33-2ba2-4808-9f7f-02f3b4da22fe
    fe0000000-fe07fffff : 2ba2:00:02.0
      fe0000000-fe07fffff : mlx4_core

the interesting part is the 'f8000000' region as it is actually the
VM's framebuffer:

$ lspci -v
...
0000:00:08.0 VGA compatible controller: Microsoft Corporation Hyper-V virtual VGA (prog-if 00 [VGA controller])
	Flags: bus master, fast devsel, latency 0, IRQ 11
	Memory at f8000000 (32-bit, non-prefetchable) [size=64M]
...

 hv_vmbus: registering driver hyperv_drm
 hyperv_drm 5620e0c7-8062-4dce-aeb7-520c7ef76171: [drm] Synthvid Version major 3, minor 5
 hyperv_drm 0000:00:08.0: vgaarb: deactivate vga console
 hyperv_drm 0000:00:08.0: BAR 0: can't reserve [mem 0xf8000000-0xfbffffff]
 hyperv_drm 5620e0c7-8062-4dce-aeb7-520c7ef76171: [drm] Cannot request framebuffer, boot fb still active?

Note: "Cannot request framebuffer" is not a fatal error in
hyperv_setup_gen1() as the code assumes there's some other framebuffer
device there but we actually have some other PCI device (mlx4 in this
case) config space there!

The problem appears to be that vmbus_allocate_mmio() can use dedicated
framebuffer region to serve any MMIO request from any device. The
semantics one might assume of a parameter named "fb_overlap_ok"
aren't implemented because !fb_overlap_ok essentially has no effect.
The existing semantics are really "prefer_fb_overlap". This patch
implements the expected and needed semantics, which is to not allocate
from the frame buffer space when !fb_overlap_ok.

Note, Gen2 VMs are usually unaffected by the issue because
framebuffer region is already taken by EFI fb (in case kernel supports
it) but Gen1 VMs may have this region unclaimed by the time Hyper-V PCI
pass-through driver tries allocating MMIO space if Hyper-V DRM/FB drivers
load after it. Devices can be brought up in any sequence so let's
resolve the issue by always ignoring 'fb_mmio' region for non-FB
requests, even if the region is unclaimed.

Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Link: https://lore.kernel.org/r/20220827130345.1320254-4-vkuznets@redhat.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-09-28 11:10:39 +02:00
..
accessibility tty: the rest, stop using tty_schedule_flip() 2022-07-29 17:19:28 +02:00
acpi ACPI: processor: Remove freq Qos request for all CPUs 2022-08-31 17:15:23 +02:00
amba amba: Make the remove callback return void 2022-04-08 14:40:02 +02:00
android binder: fix UAF of ref->proc caused by race condition 2022-09-08 11:11:38 +02:00
ata ata: libata-eh: Add missing command name 2022-08-25 11:37:50 +02:00
atm atm: idt77252: fix use-after-free bugs caused by tst_timer 2022-08-25 11:38:02 +02:00
auxdisplay
base driver core: Don't probe devices after bus_type.match() probe deferral 2022-09-08 11:11:40 +02:00
bcma
block xen-blkfront: Cache feature_persistent value before advertisement 2022-09-15 11:32:02 +02:00
bluetooth Bluetooth: hci_intel: Add check for platform_driver_register 2022-08-21 15:15:49 +02:00
bus bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() 2022-08-21 15:15:35 +02:00
cdrom
char random: update comment from copy_to_user() -> copy_to_iter() 2022-06-29 08:59:54 +02:00
clk clk: bcm: rpi: Add missing newline 2022-09-08 11:11:38 +02:00
clocksource clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from ixp4xx_timer_setup() 2022-07-07 17:52:23 +02:00
connector
counter
cpufreq cpufreq: pmac32-cpufreq: Fix refcount leak bug 2022-07-21 21:20:14 +02:00
cpuidle
crypto crypto: hisilicon/sec - fix auth key size error 2022-08-21 15:15:50 +02:00
dax dax: make sure inodes are flushed before destroy cache 2022-04-08 14:40:16 +02:00
dca
devfreq PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events 2022-07-07 17:52:18 +02:00
dio
dma dmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_get() 2022-09-28 11:10:29 +02:00
dma-buf udmabuf: Set the DMA mask for the udmabuf device (v2) 2022-09-05 10:28:55 +02:00
edac EDAC/ghes: Set the DIMM label unconditionally 2022-08-03 12:00:50 +02:00
eisa
extcon extcon: Modify extcon device to be created after driver data is set 2022-06-14 18:32:43 +02:00
firewire firewire: core: extend card->lock in fw_core_handle_bus_reset 2022-05-12 12:25:32 +02:00
firmware efi: libstub: check Shim mode using MokSBStateRT 2022-09-28 11:10:27 +02:00
fpga fpga: altera-pr-ip: fix unsigned comparison with less than zero 2022-08-21 15:15:53 +02:00
fsi fsi: Aspeed: Fix a potential double free 2022-04-08 14:40:23 +02:00
gnss
gpio gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully 2022-09-28 11:10:27 +02:00
gpu drm/amdgpu: Fix check for RAS support 2022-09-28 11:10:38 +02:00
greybus greybus: svc: fix an error handling bug in gb_svc_hello() 2022-04-08 14:39:50 +02:00
hid hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message 2022-09-20 12:38:31 +02:00
hsi
hv Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region 2022-09-28 11:10:39 +02:00
hwmon hwmon: (mr75203) enable polling for all VM channels 2022-09-15 11:32:06 +02:00
hwspinlock
hwtracing intel_th: pci: Add Raptor Lake-S CPU support 2022-08-21 15:16:17 +02:00
i2c i2c: imx: Make sure to unregister adapter on remove() 2022-08-25 11:38:08 +02:00
i3c
ide
idle intel_idle: Disable IBRS during long idle 2022-07-25 11:26:43 +02:00
iio iio: adc: mcp3911: use correct formula for AD conversion 2022-09-08 11:11:37 +02:00
infiniband RDMA/mlx5: Set local port to one when accessing counters 2022-09-15 11:32:06 +02:00
input Input: goodix - add compatible string for GT1158 2022-09-20 12:38:33 +02:00
interconnect interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate 2022-09-28 11:10:28 +02:00
iommu iommu/vt-d: Check correct capability for sagaw determination 2022-09-28 11:10:26 +02:00
ipack
irqchip irqchip/tegra: Fix overflow implicit truncation warnings 2022-08-25 11:38:12 +02:00
isdn isdn: hfcpci: check the return value of dma_set_mask() in setup_hw() 2022-03-16 14:15:57 +01:00
leds
lightnvm lightnvm: disable the subsystem 2022-05-09 09:04:56 +02:00
macintosh macintosh/adb: fix oob read in do_adb_query() function 2022-08-11 13:06:47 +02:00
mailbox mailbox: forward the hrtimer if not queued and under a lock 2022-06-09 10:21:18 +02:00
mcb
md md: call __md_stop_writes in md_stop 2022-08-31 17:15:23 +02:00
media media: flexcop-usb: fix endpoint type check 2022-09-28 11:10:26 +02:00
memory memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings 2022-06-29 08:59:54 +02:00
memstick memstick/ms_block: Fix a memory leak 2022-08-21 15:15:58 +02:00
message
mfd mfd: max77620: Fix refcount leak in max77620_initialise_fps 2022-08-21 15:16:09 +02:00
misc misc: fastrpc: fix memory corruption on open 2022-09-08 11:11:37 +02:00
mmc mmc: core: Fix inconsistent sd3_bus_mode at UHS-I SD voltage switch failure 2022-09-28 11:10:22 +02:00
most
mtd mtd: rawnand: arasan: Prevent an unsupported configuration 2022-08-21 15:16:26 +02:00
mux
net net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD 2022-09-28 11:10:37 +02:00
nfc nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout 2022-08-31 17:15:16 +02:00
ntb NTB: ntb_tool: uninitialized heap data in tool_fn_write() 2022-08-25 11:38:01 +02:00
nubus
nvdimm nvdimm: Fix badblocks clear off-by-one error 2022-07-07 17:52:15 +02:00
nvme nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change() 2022-09-20 12:38:32 +02:00
nvmem
of of: fdt: fix off-by-one error in unflatten_dt_nodes() 2022-09-23 14:16:57 +02:00
opp opp: Fix error check in dev_pm_opp_attach_genpd() 2022-08-21 15:16:04 +02:00
oprofile
parisc parisc: ccio-dma: Add missing iounmap in error path in ccio_probe() 2022-09-23 14:16:58 +02:00
parport
pci Revert "PCI/portdrv: Don't disable AER reporting in get_port_device_capability()" 2022-09-05 10:28:55 +02:00
pcmcia pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards 2022-06-14 18:32:30 +02:00
perf perf/arm_pmu_platform: fix tests for platform_get_irq() failure 2022-09-20 12:38:32 +02:00
phy phy: qcom-qmp: fix pipe-clock imbalance on power-on failure 2022-06-14 18:32:32 +02:00
pinctrl pinctrl: sunxi: Fix name for A100 R_PIO 2022-09-23 14:16:57 +02:00
platform platform/x86/intel: hid: add quirk to support Surface Go 3 2022-09-23 14:16:56 +02:00
pnp
power power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe 2022-07-29 17:19:10 +02:00
powercap
pps
ps3
ptp ptp: replace snprintf with sysfs_emit 2022-04-13 21:00:55 +02:00
pwm pwm: lpc18xx-sct: Convert to devm_platform_ioremap_resource() 2022-08-21 15:15:37 +02:00
rapidio
ras
regulator regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe() 2022-09-23 14:16:59 +02:00
remoteproc remoteproc: sysmon: Wait for SSCTL service to come up 2022-08-21 15:16:08 +02:00
reset reset: tegra-bpmp: Restore Handle errors in BPMP response 2022-04-27 13:53:52 +02:00
rpmsg rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge 2022-08-21 15:16:08 +02:00
rtc rtc: mt6397: check return value after calling platform_get_resource() 2022-06-14 18:32:33 +02:00
s390 s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup 2022-09-28 11:10:38 +02:00
sbus
scsi scsi: mpt3sas: Fix return value check of dma_get_required_mask() 2022-09-28 11:10:31 +02:00
sfi
sh
siox
slimbus slimbus: qcom: Fix IRQ check in qcom_slim_probe 2022-05-18 10:23:47 +02:00
soc soc: fsl: select FSL_GUTS driver for DPIO 2022-09-20 12:38:33 +02:00
soundwire soundwire: bus_type: fix remove and shutdown support 2022-08-21 15:15:56 +02:00
spi spi: meson-spicc: add local pow2 clock ops to preserve rate between messages 2022-08-25 11:38:06 +02:00
spmi
ssb
staging staging: rtl8712: fix use after free bugs 2022-09-08 11:11:37 +02:00
target target: remove an incorrect unmap zeroes data deduction 2022-06-09 10:21:01 +02:00
tc
tee tee: fix compiler warning in tee_shm_register() 2022-09-15 11:32:04 +02:00
thermal thermal: sysfs: Fix cooling_device_stats_setup() error code path 2022-08-21 15:15:22 +02:00
thunderbolt thunderbolt: Use the actual buffer in tb_async_error() 2022-09-08 11:11:39 +02:00
tty serial: tegra-tcu: Use uart_xmit_advance(), fixes icount.tx accounting 2022-09-28 11:10:38 +02:00
uio
usb usb: xhci-mtk: fix issue of out-of-bounds array access 2022-09-28 11:10:38 +02:00
vdpa vdpasim: allow to enable a vq repeatedly 2022-06-09 10:21:29 +02:00
vfio vfio/type1: fix vaddr_get_pfns() return in vfio_pin_page_external() 2022-09-28 11:10:38 +02:00
vhost vringh: Fix loop descriptors check in the indirect cases 2022-06-14 18:32:45 +02:00
video video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write 2022-09-23 14:17:00 +02:00
virt vboxguest: Do not use devm for irq 2022-08-25 11:38:14 +02:00
virtio virtio_mmio: Restore guest page size on resume 2022-07-21 21:20:13 +02:00
visorbus
vlynq
vme
w1 w1: w1_therm: fixes w1_seq for ds28ea00 sensors 2022-04-13 21:01:01 +02:00
watchdog watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() 2022-08-21 15:16:10 +02:00
xen xen/grants: prevent integer overflow in gnttab_dma_alloc_pages() 2022-09-08 11:11:38 +02:00
zorro
Kconfig
Makefile