1. 06 Jun, 2015 4 commits
    • Will Deacon's avatar
      iommu/arm-smmu: Fix sign-extension of upstream bus addresses at stage 1 · 4c951487
      Will Deacon authored
      commit 5dc5616e upstream.
      
      Stage 1 translation is controlled by two sets of page tables (TTBR0 and
      TTBR1) which grow up and down from zero respectively in the ARMv8
      translation regime. For the SMMU, we only care about TTBR0 and, in the
      case of a 48-bit virtual space, we expect to map virtual addresses 0x0
      through to 0xffff_ffff_ffff.
      
      Given that some masters may be incapable of emitting virtual addresses
      targetting TTBR1 (e.g. because they sit on a 48-bit bus), the SMMU
      architecture allows bit 47 to be sign-extended, halving the virtual
      range of TTBR0 but allowing TTBR1 to be used. This is controlled by the
      SEP field in TTBCR2.
      
      The SMMU driver incorrectly enables this sign-extension feature, which
      causes problems when userspace addresses are programmed into a master
      device with the SMMU expecting to map the incoming transactions via
      TTBR0; if the top bit of address is set, we will instead get a
      translation fault since TTBR1 walks are disabled in the TTBCR.
      
      This patch fixes the issue by disabling sign-extension of a fixed
      virtual address bit and instead basing the behaviour on the upstream bus
      size: the incoming address is zero extended unless the upstream bus is
      only 49 bits wide, in which case bit 48 is used as the sign bit and is
      replicated to the upper bits.
      Reported-by: default avatarVarun Sethi <varun.sethi@freescale.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4c951487
    • Oded Gabbay's avatar
      iommu/amd: Fix bug in put_pasid_state_wait · 9f453d6e
      Oded Gabbay authored
      commit 1bf1b431 upstream.
      
      This patch fixes a bug in put_pasid_state_wait that appeared in kernel 4.0
      The bug is that pasid_state->count wasn't decremented before entering the
      wait_event. Thus, the condition in wait_event will never be true.
      
      The fix is to decrement (atomically) the pasid_state->count before the
      wait_event.
      Signed-off-by: default avatarOded Gabbay <oded.gabbay@amd.com>
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9f453d6e
    • Eric W. Biederman's avatar
      fs_pin: Allow for the possibility that m_list or s_list go unused. · ef20854f
      Eric W. Biederman authored
      commit 820f9f14 upstream.
      
      This is needed to support lazily umounting locked mounts.  Because the
      entire unmounted subtree needs to stay together until there are no
      users with references to any part of the subtree.
      
      To support this guarantee that the fs_pin m_list and s_list nodes
      are initialized by initializing them in init_fs_pin allowing
      for the possibility that pin_insert_group does not touch them.
      
      Further use hlist_del_init in pin_remove so that there is
      a hlist_unhashed test before the list we attempt to update
      the previous list item.
      Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      ef20854f
    • Eric W. Biederman's avatar
      mnt: Fail collect_mounts when applied to unmounted mounts · 9993cbfd
      Eric W. Biederman authored
      commit cd4a4017 upstream.
      
      The only users of collect_mounts are in audit_tree.c
      
      In audit_trim_trees and audit_add_tree_rule the path passed into
      collect_mounts is generated from kern_path passed an audit_tree
      pathname which is guaranteed to be an absolute path.   In those cases
      collect_mounts is obviously intended to work on mounted paths and
      if a race results in paths that are unmounted when collect_mounts
      it is reasonable to fail early.
      
      The paths passed into audit_tag_tree don't have the absolute path
      check.  But are used to play with fsnotify and otherwise interact with
      the audit_trees, so again operating only on mounted paths appears
      reasonable.
      
      Avoid having to worry about what happens when we try and audit
      unmounted filesystems by restricting collect_mounts to mounts
      that appear in the mount tree.
      Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9993cbfd
  2. 17 May, 2015 36 commits