[PATCH v2] cxl: Fix number of allocated pages in SPA

[PATCH v2] cxl: Fix number of allocated pages in SPA

[Christophe Lombard]

This moves the initialisation of the num_procs to before the SPA
allocation.
The field 'num_procs' of the structure cxl_afu is not updated to the
right value (maximum number of processes that can be supported by
the AFU) when the pages are allocated (i.e. when  cxl_alloc_spa() is called).
The number of allocates pages depends on the max number of processes.

Signed-off-by: Christophe Lombard <clombard@linux.vnet.ibm.com>
---
 drivers/misc/cxl/native.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index b37f2e8..d2e75c8 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -457,6 +457,7 @@ static int activate_afu_directed(struct cxl_afu *afu)
 
 	dev_info(&afu->dev, "Activating AFU directed mode\n");
 
+	afu->num_procs = afu->max_procs_virtualised;
 	if (afu->spa == NULL) {
 		if (cxl_alloc_spa(afu))
 			return -ENOMEM;
@@ -468,7 +469,6 @@ static int activate_afu_directed(struct cxl_afu *afu)
 	cxl_p1n_write(afu, CXL_PSL_ID_An, CXL_PSL_ID_An_F | CXL_PSL_ID_An_L);
 
 	afu->current_mode = CXL_MODE_DIRECTED;
-	afu->num_procs = afu->max_procs_virtualised;
 
 	if ((rc = cxl_chardev_m_afu_add(afu)))
 		return rc;
-- 
1.9.1

Re: [PATCH v2] cxl: Fix number of allocated pages in SPA

[Ian Munsie]

The explanation probably still needs to be expanded more (e.g. this
could cause a crash for an AFU that supports more than about a thousand
processes) - see my other email in reply to v1 for more, but I'm happy
for this to go in as is (but ultimately that's mpe's call).

It should also be CCd to stable, this bug was introduced before the
driver was originally upstreamed, we just never hit it because all our
AFUs are limited to less processes by their interrupt requirements.

Cc: stable <stable@vger.kernel.org>
Acked-by: Ian Munsie <imunsie@au1.ibm.com>

Excerpts from Christophe Lombard's message of 2015-10-07 01:19:49 +1100:
> This moves the initialisation of the num_procs to before the SPA
> allocation.
> The field 'num_procs' of the structure cxl_afu is not updated to the
> right value (maximum number of processes that can be supported by
> the AFU) when the pages are allocated (i.e. when  cxl_alloc_spa() is called).
> The number of allocates pages depends on the max number of processes.
> 
> Signed-off-by: Christophe Lombard <clombard@linux.vnet.ibm.com>
> ---
>  drivers/misc/cxl/native.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
> index b37f2e8..d2e75c8 100644
> --- a/drivers/misc/cxl/native.c
> +++ b/drivers/misc/cxl/native.c
> @@ -457,6 +457,7 @@ static int activate_afu_directed(struct cxl_afu *afu)
>  
>      dev_info(&afu->dev, "Activating AFU directed mode\n");
>  
> +    afu->num_procs = afu->max_procs_virtualised;
>      if (afu->spa == NULL) {
>          if (cxl_alloc_spa(afu))
>              return -ENOMEM;
> @@ -468,7 +469,6 @@ static int activate_afu_directed(struct cxl_afu *afu)
>      cxl_p1n_write(afu, CXL_PSL_ID_An, CXL_PSL_ID_An_F | CXL_PSL_ID_An_L);
>  
>      afu->current_mode = CXL_MODE_DIRECTED;
> -    afu->num_procs = afu->max_procs_virtualised;
>  
>      if ((rc = cxl_chardev_m_afu_add(afu)))
>          return rc;

Re: [PATCH v2] cxl: Fix number of allocated pages in SPA

[Michael Ellerman]

On Wed, 2015-10-07 at 14:51 +1100, Ian Munsie wrote:
> The explanation probably still needs to be expanded more (e.g. this
> could cause a crash for an AFU that supports more than about a thousand
> processes) - see my other email in reply to v1 for more, but I'm happy
> for this to go in as is (but ultimately that's mpe's call).
> 
> It should also be CCd to stable, this bug was introduced before the
> driver was originally upstreamed, we just never hit it because all our
> AFUs are limited to less processes by their interrupt requirements.
> 
> Cc: stable <stable@vger.kernel.org>

So the driver went into 3.18, so this should be:

Cc: stable <stable@vger.kernel.org> # 3.18+

One of you please resend with a coherent change log with all the details
included.

cheers

[PATCH] cxl: Fix number of allocated pages in SPA

[Ian Munsie]

From: Christophe Lombard <clombard@linux.vnet.ibm.com>

The scheduled process area is currently allocated before assigning the
correct maximum processes to the AFU, which will mean we only ever
allocate a fixed number of pages for the scheduled process area. This
will limit us to 958 processes with 2 x 64K pages. If we try to use more
processes than that we'd probably overrun the buffer and corrupt memory
or crash.

AFUs that require three or more interrupts per process will not be
affected as they are already limited to less processes than that, but we
could hit it on an AFU that requires 0, 1 or 2 interrupts per process,
or when using 4K pages.

This patch moves the initialisation of the num_procs to before the SPA
allocation so that enough pages will be allocated for the number of
processes that the AFU supports.

Signed-off-by: Christophe Lombard <clombard@linux.vnet.ibm.com>
Signed-off-by: Ian Munsie <imunsie@au1.ibm.com>
Cc: stable <stable@vger.kernel.org> # 3.18+
---

Changes since v2:
 - Expanded commit message
Changes since v1:
 - Expanded commit message

 drivers/misc/cxl/native.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index b37f2e8..d2e75c8 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -457,6 +457,7 @@ static int activate_afu_directed(struct cxl_afu *afu)
 
 	dev_info(&afu->dev, "Activating AFU directed mode\n");
 
+	afu->num_procs = afu->max_procs_virtualised;
 	if (afu->spa == NULL) {
 		if (cxl_alloc_spa(afu))
 			return -ENOMEM;
@@ -468,7 +469,6 @@ static int activate_afu_directed(struct cxl_afu *afu)
 	cxl_p1n_write(afu, CXL_PSL_ID_An, CXL_PSL_ID_An_F | CXL_PSL_ID_An_L);
 
 	afu->current_mode = CXL_MODE_DIRECTED;
-	afu->num_procs = afu->max_procs_virtualised;
 
 	if ((rc = cxl_chardev_m_afu_add(afu)))
 		return rc;
-- 
2.1.4

Re: cxl: Fix number of allocated pages in SPA

[Michael Ellerman]

On Wed, 2015-07-10 at 05:07:40 UTC, Ian Munsie wrote:
> From: Christophe Lombard <clombard@linux.vnet.ibm.com>
> 
> The scheduled process area is currently allocated before assigning the
> correct maximum processes to the AFU, which will mean we only ever
> allocate a fixed number of pages for the scheduled process area. This
> will limit us to 958 processes with 2 x 64K pages. If we try to use more
> processes than that we'd probably overrun the buffer and corrupt memory
> or crash.
> 
> AFUs that require three or more interrupts per process will not be
> affected as they are already limited to less processes than that, but we
> could hit it on an AFU that requires 0, 1 or 2 interrupts per process,
> or when using 4K pages.
> 
> This patch moves the initialisation of the num_procs to before the SPA
> allocation so that enough pages will be allocated for the number of
> processes that the AFU supports.
> 
> Signed-off-by: Christophe Lombard <clombard@linux.vnet.ibm.com>
> Signed-off-by: Ian Munsie <imunsie@au1.ibm.com>
> Cc: stable <stable@vger.kernel.org> # 3.18+

Applied to powerpc fixes, thanks.

https://git.kernel.org/powerpc/c/4108efb02daa09cbb5db048a

cheers

[PATCH] cxl: Fix number of allocated pages in SPA

[Christophe Lombard]

This moves the initialisation of the num_procs to before the SPA
allocation.

Signed-off-by: Christophe Lombard <clombard@linux.vnet.ibm.com>
---
 drivers/misc/cxl/native.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index b37f2e8..d2e75c8 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -457,6 +457,7 @@ static int activate_afu_directed(struct cxl_afu *afu)
 
 	dev_info(&afu->dev, "Activating AFU directed mode\n");
 
+	afu->num_procs = afu->max_procs_virtualised;
 	if (afu->spa == NULL) {
 		if (cxl_alloc_spa(afu))
 			return -ENOMEM;
@@ -468,7 +469,6 @@ static int activate_afu_directed(struct cxl_afu *afu)
 	cxl_p1n_write(afu, CXL_PSL_ID_An, CXL_PSL_ID_An_F | CXL_PSL_ID_An_L);
 
 	afu->current_mode = CXL_MODE_DIRECTED;
-	afu->num_procs = afu->max_procs_virtualised;
 
 	if ((rc = cxl_chardev_m_afu_add(afu)))
 		return rc;
-- 
1.9.1

Re: [PATCH] cxl: Fix number of allocated pages in SPA

[Ian Munsie]

Acked-by: Ian Munsie <imunsie@au1.ibm.com>

Excerpts from Christophe Lombard's message of 2015-10-03 00:01:25 +1000:
> This moves the initialisation of the num_procs to before the SPA
> allocation.
> 
> Signed-off-by: Christophe Lombard <clombard@linux.vnet.ibm.com>
> ---
>  drivers/misc/cxl/native.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
> index b37f2e8..d2e75c8 100644
> --- a/drivers/misc/cxl/native.c
> +++ b/drivers/misc/cxl/native.c
> @@ -457,6 +457,7 @@ static int activate_afu_directed(struct cxl_afu *afu)
>  
>      dev_info(&afu->dev, "Activating AFU directed mode\n");
>  
> +    afu->num_procs = afu->max_procs_virtualised;
>      if (afu->spa == NULL) {
>          if (cxl_alloc_spa(afu))
>              return -ENOMEM;
> @@ -468,7 +469,6 @@ static int activate_afu_directed(struct cxl_afu *afu)
>      cxl_p1n_write(afu, CXL_PSL_ID_An, CXL_PSL_ID_An_F | CXL_PSL_ID_An_L);
>  
>      afu->current_mode = CXL_MODE_DIRECTED;
> -    afu->num_procs = afu->max_procs_virtualised;
>  
>      if ((rc = cxl_chardev_m_afu_add(afu)))
>          return rc;

Re: [PATCH] cxl: Fix number of allocated pages in SPA

[Michael Ellerman]

On Fri, 2015-10-02 at 16:01 +0200, Christophe Lombard wrote:
> This moves the initialisation of the num_procs to before the SPA
> allocation.

Why? What does it fix? I can't tell from the diff or the change log.

cheers

Re: [PATCH] cxl: Fix number of allocated pages in SPA

[christophe lombard]

The field 'num_procs' of the structure cxl_afu is not updated to the
right value (maximum number of processes that can be supported by
the AFU) when the pages are allocated (i.e. when  cxl_alloc_spa() is called).
The number of allocates pages depends on the max number of processes.

Thanks


On 06/10/2015 08:19, Michael Ellerman wrote:
> On Fri, 2015-10-02 at 16:01 +0200, Christophe Lombard wrote:
>> This moves the initialisation of the num_procs to before the SPA
>> allocation.
> Why? What does it fix? I can't tell from the diff or the change log.
>
> cheers
>
>
> _______________________________________________
> Linuxppc-dev mailing list
> Linuxppc-dev@lists.ozlabs.org
> https://lists.ozlabs.org/listinfo/linuxppc-dev

Re: [PATCH] cxl: Fix number of allocated pages in SPA

[Ian Munsie]

Excerpts from Michael Ellerman's message of 2015-10-06 17:19:02 +1100:
> On Fri, 2015-10-02 at 16:01 +0200, Christophe Lombard wrote:
> > This moves the initialisation of the num_procs to before the SPA
> > allocation.
> 
> Why? What does it fix? I can't tell from the diff or the change log.

This will mean we only ever allocate a fixed number of pages for the
scheduled process area (which in itself looks like it has a minor bug as
it will start trying at two pages instead of one), which will limit us
to 958 processes with 2 x 64K pages. If we actually try to use more
processes than that we'd probably overrun the buffer and corrupt memory
or crash.

The only reason we haven't hit this out in the field so far is any AFUs
the requires at least three interrupts per process is already limited to
less processes than that anyway (e.g. min of 4 interrupts limits it to
509 processes, and all the AFUs I'm aware of require at least that many
interrupts), but we could hit it on an AFU that requires 0, 1 or 2
interrupts per process, or when using 4K pages.

This fix should go to stable.

@Christophe, can you resend with this info in the commit message?

Cheers,
-Ian