LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Thomas Gleixner <tglx@linutronix.de>,
	Marc Zyngier <maz@kernel.org>,
	Bjorn Helgaas <bhelgaas@google.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: [PATCH 4.9 16/43] PCI/MSI: Mask all unused MSI-X entries
Date: Tue, 24 Aug 2021 13:05:47 -0400	[thread overview]
Message-ID: <20210824170614.710813-17-sashal@kernel.org> (raw)
In-Reply-To: <20210824170614.710813-1-sashal@kernel.org>

From: Thomas Gleixner <tglx@linutronix.de>

commit 7d5ec3d3612396dc6d4b76366d20ab9fc06f399f upstream.

When MSI-X is enabled the ordering of calls is:

  msix_map_region();
  msix_setup_entries();
  pci_msi_setup_msi_irqs();
  msix_program_entries();

This has a few interesting issues:

 1) msix_setup_entries() allocates the MSI descriptors and initializes them
    except for the msi_desc:masked member which is left zero initialized.

 2) pci_msi_setup_msi_irqs() allocates the interrupt descriptors and sets
    up the MSI interrupts which ends up in pci_write_msi_msg() unless the
    interrupt chip provides its own irq_write_msi_msg() function.

 3) msix_program_entries() does not do what the name suggests. It solely
    updates the entries array (if not NULL) and initializes the masked
    member for each MSI descriptor by reading the hardware state and then
    masks the entry.

Obviously this has some issues:

 1) The uninitialized masked member of msi_desc prevents the enforcement
    of masking the entry in pci_write_msi_msg() depending on the cached
    masked bit. Aside of that half initialized data is a NONO in general

 2) msix_program_entries() only ensures that the actually allocated entries
    are masked. This is wrong as experimentation with crash testing and
    crash kernel kexec has shown.

    This limited testing unearthed that when the production kernel had more
    entries in use and unmasked when it crashed and the crash kernel
    allocated a smaller amount of entries, then a full scan of all entries
    found unmasked entries which were in use in the production kernel.

    This is obviously a device or emulation issue as the device reset
    should mask all MSI-X table entries, but obviously that's just part
    of the paper specification.

Cure this by:

 1) Masking all table entries in hardware
 2) Initializing msi_desc::masked in msix_setup_entries()
 3) Removing the mask dance in msix_program_entries()
 4) Renaming msix_program_entries() to msix_update_entries() to
    reflect the purpose of that function.

As the masking of unused entries has never been done the Fixes tag refers
to a commit in:
   git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git

Fixes: f036d4ea5fa7 ("[PATCH] ia32 Message Signalled Interrupt support")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210729222542.403833459@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/msi.c | 39 ++++++++++++++++++++++++++++-----------
 1 file changed, 28 insertions(+), 11 deletions(-)

diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 79b36f1bde0d..a4873c7fea72 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -695,6 +695,7 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base,
 {
 	struct cpumask *curmsk, *masks = NULL;
 	struct msi_desc *entry;
+	void __iomem *addr;
 	int ret, i;
 
 	if (affinity) {
@@ -717,6 +718,7 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base,
 
 		entry->msi_attrib.is_msix	= 1;
 		entry->msi_attrib.is_64		= 1;
+
 		if (entries)
 			entry->msi_attrib.entry_nr = entries[i].entry;
 		else
@@ -724,6 +726,10 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base,
 		entry->msi_attrib.default_irq	= dev->irq;
 		entry->mask_base		= base;
 
+		addr = pci_msix_desc_addr(entry);
+		if (addr)
+			entry->masked = readl(addr + PCI_MSIX_ENTRY_VECTOR_CTRL);
+
 		list_add_tail(&entry->list, dev_to_msi_list(&dev->dev));
 		if (masks)
 			curmsk++;
@@ -734,21 +740,27 @@ out:
 	return ret;
 }
 
-static void msix_program_entries(struct pci_dev *dev,
-				 struct msix_entry *entries)
+static void msix_update_entries(struct pci_dev *dev, struct msix_entry *entries)
 {
 	struct msi_desc *entry;
-	int i = 0;
 
 	for_each_pci_msi_entry(entry, dev) {
-		if (entries)
-			entries[i++].vector = entry->irq;
-		entry->masked = readl(pci_msix_desc_addr(entry) +
-				PCI_MSIX_ENTRY_VECTOR_CTRL);
-		msix_mask_irq(entry, 1);
+		if (entries) {
+			entries->vector = entry->irq;
+			entries++;
+		}
 	}
 }
 
+static void msix_mask_all(void __iomem *base, int tsize)
+{
+	u32 ctrl = PCI_MSIX_ENTRY_CTRL_MASKBIT;
+	int i;
+
+	for (i = 0; i < tsize; i++, base += PCI_MSIX_ENTRY_SIZE)
+		writel(ctrl, base + PCI_MSIX_ENTRY_VECTOR_CTRL);
+}
+
 /**
  * msix_capability_init - configure device's MSI-X capability
  * @dev: pointer to the pci_dev data structure of MSI-X device function
@@ -763,9 +775,9 @@ static void msix_program_entries(struct pci_dev *dev,
 static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
 				int nvec, bool affinity)
 {
-	int ret;
-	u16 control;
 	void __iomem *base;
+	int ret, tsize;
+	u16 control;
 
 	/*
 	 * Some devices require MSI-X to be enabled before the MSI-X
@@ -777,12 +789,17 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
 
 	pci_read_config_word(dev, dev->msix_cap + PCI_MSIX_FLAGS, &control);
 	/* Request & Map MSI-X table region */
+	tsize = msix_table_size(control);
+	base = msix_map_region(dev, tsize);
 	base = msix_map_region(dev, msix_table_size(control));
 	if (!base) {
 		ret = -ENOMEM;
 		goto out_disable;
 	}
 
+	/* Ensure that all table entries are masked. */
+	msix_mask_all(base, tsize);
+
 	ret = msix_setup_entries(dev, base, entries, nvec, affinity);
 	if (ret)
 		goto out_disable;
@@ -796,7 +813,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
 	if (ret)
 		goto out_free;
 
-	msix_program_entries(dev, entries);
+	msix_update_entries(dev, entries);
 
 	ret = populate_msi_sysfs(dev);
 	if (ret)
-- 
2.30.2


  parent reply	other threads:[~2021-08-24 17:36 UTC|newest]

Thread overview: 47+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-24 17:05 [PATCH 4.9 00/43] 4.9.281-rc1 review Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 01/43] iio: adc: Fix incorrect exit of for-loop Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 02/43] ASoC: intel: atom: Fix reference to PCM buffer address Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 03/43] i2c: dev: zero out array used for i2c reads from userspace Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 04/43] ACPI: NFIT: Fix support for virtual SPA ranges Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 05/43] ppp: Fix generating ifname when empty IFLA_IFNAME is specified Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 06/43] net: Fix memory leak in ieee802154_raw_deliver Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 07/43] net: bridge: fix memleak in br_add_if() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 08/43] tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 09/43] xen/events: Fix race in set_evtchn_to_irq Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 10/43] x86/tools: Fix objdump version check again Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 11/43] PCI/MSI: Enable and mask MSI-X early Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 12/43] PCI/MSI: Do not set invalid bits in MSI mask Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 13/43] PCI/MSI: Correct misleading comments Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 14/43] PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 15/43] PCI/MSI: Protect msi_desc::masked for multi-MSI Sasha Levin
2021-08-24 17:05 ` Sasha Levin [this message]
2021-08-24 17:05 ` [PATCH 4.9 17/43] PCI/MSI: Enforce that MSI-X table entry is masked for update Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 18/43] PCI/MSI: Enforce MSI[X] entry updates to be visible Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 19/43] vmlinux.lds.h: Handle clang's module.{c,d}tor sections Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 20/43] mac80211: drop data frames without key on encrypted links Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 21/43] KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 22/43] x86/fpu: Make init_fpstate correct with optimized XSAVE Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 23/43] dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 24/43] ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218 Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 25/43] dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 26/43] scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 27/43] scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 28/43] scsi: core: Avoid printing an error if target_alloc() returns -ENXIO Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 29/43] ARM: dts: nomadik: Fix up interrupt controller node names Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 30/43] Bluetooth: hidp: use correct wait queue when removing ctrl_wait Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 31/43] dccp: add do-while-0 stubs for dccp_pr_debug macros Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 32/43] vhost: Fix the calculation in vhost_overflow() Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 33/43] net: 6pack: fix slab-out-of-bounds in decode_data Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 34/43] net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 35/43] mmc: dw_mmc: call the dw_mci_prep_stop_abort() by default Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 36/43] mmc: dw_mmc: Fix hang on data CRC error Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 37/43] ALSA: hda - fix the 'Capture Switch' value change notifications Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 38/43] ipack: tpci200: fix many double free issues in tpci200_pci_probe Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 39/43] btrfs: prevent rename2 from exchanging a subvol with a directory from different parents Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 40/43] ASoC: intel: atom: Fix breakage for PCM buffer address setup Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 41/43] locks: print a warning when mount fails due to lack of "mand" support Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 42/43] fs: warn about impending deprecation of mandatory locks Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 43/43] Linux 4.9.281-rc1 Sasha Levin
2021-08-25 20:26 ` [PATCH 4.9 00/43] 4.9.281-rc1 review Guenter Roeck
2021-08-25 21:17 ` Daniel Díaz
2021-08-25 22:37 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210824170614.710813-17-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=bhelgaas@google.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=maz@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    --subject='Re: [PATCH 4.9 16/43] PCI/MSI: Mask all unused MSI-X entries' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).