search for: __copy_to_user

...gt; + kvm_steal_time_set_preempted(vcpu); > kvm_x86_ops->vcpu_put(vcpu); > kvm_put_guest_fpu(vcpu); > vcpu->arch.last_host_tsc = rdtsc(); You can't call kvm_steal_time_set_preempted in atomic context (neither in sched_out notifier nor in vcpu_put() after preempt_disable)). __copy_to_user in kvm_write_guest_offset_cached schedules and locks up the host. kvm->srcu (or kvm->slots_lock) is also not taken and kvm_write_guest_offset_cached needs to call kvm_memslots which requires it. This I think is why postcopy live migration locks up with current upstream, and it doesn't s...

...gt; + kvm_steal_time_set_preempted(vcpu); > kvm_x86_ops->vcpu_put(vcpu); > kvm_put_guest_fpu(vcpu); > vcpu->arch.last_host_tsc = rdtsc(); You can't call kvm_steal_time_set_preempted in atomic context (neither in sched_out notifier nor in vcpu_put() after preempt_disable)). __copy_to_user in kvm_write_guest_offset_cached schedules and locks up the host. kvm->srcu (or kvm->slots_lock) is also not taken and kvm_write_guest_offset_cached needs to call kvm_memslots which requires it. This I think is why postcopy live migration locks up with current upstream, and it doesn't s...

...s/vhost/vhost.c @@ -744,7 +744,7 @@ static int vhost_copy_to_user(struct vhost_virtqueue *vq, void __user *to, struct iov_iter t; void __user *uaddr = vhost_vq_meta_fetch(vq, (u64)(uintptr_t)to, size, - VHOST_ADDR_DESC); + VHOST_ADDR_USED); if (uaddr) return __copy_to_user(uaddr, from, size); -- 2.5.5

...s/vhost/vhost.c @@ -744,7 +744,7 @@ static int vhost_copy_to_user(struct vhost_virtqueue *vq, void __user *to, struct iov_iter t; void __user *uaddr = vhost_vq_meta_fetch(vq, (u64)(uintptr_t)to, size, - VHOST_ADDR_DESC); + VHOST_ADDR_USED); if (uaddr) return __copy_to_user(uaddr, from, size); -- 2.5.5

On Thu, Nov 1, 2018 at 4:00 PM Kees Cook <keescook at chromium.org> wrote: > > + memset(&rsp, 0, sizeof(rsp)); > + rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED; > + resp = vq->iov[out].iov_base; > + ret = __copy_to_user(resp, &rsp, sizeof(rsp)); > > Is it actually safe to trust that iov_base has passed an earlier > access_ok() check here? Why not just use copy_to_user() instead? Good point. We really should have removed those double-underscore things ages ago. Also, apart from the address, what abo...

On Thu, Nov 1, 2018 at 4:00 PM Kees Cook <keescook at chromium.org> wrote: > > + memset(&rsp, 0, sizeof(rsp)); > + rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED; > + resp = vq->iov[out].iov_base; > + ret = __copy_to_user(resp, &rsp, sizeof(rsp)); > > Is it actually safe to trust that iov_base has passed an earlier > access_ok() check here? Why not just use copy_to_user() instead? Good point. We really should have removed those double-underscore things ages ago. Also, apart from the address, what abo...

...ted(vcpu); >> kvm_x86_ops->vcpu_put(vcpu); >> kvm_put_guest_fpu(vcpu); >> vcpu->arch.last_host_tsc = rdtsc(); > > You can't call kvm_steal_time_set_preempted in atomic context (neither > in sched_out notifier nor in vcpu_put() after > preempt_disable)). __copy_to_user in kvm_write_guest_offset_cached > schedules and locks up the host. > yes, you are right! :) we have known the problems. I am going to introduce something like kvm_write_guest_XXX_atomic and use them instead of kvm_write_guest_offset_cached. within pagefault_disable()/enable(), we can not cal...

The following changes since commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d: Linux 4.19 (2018-10-22 07:37:37 +0100) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git tags/for_linus for you to fetch changes up to 79f800b2e76923cd8ce0aa659cb5c019d9643bc9: MAINTAINERS: remove reference to bogus vsock file (2018-10-24 21:16:14 -0400)

The following changes since commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d: Linux 4.19 (2018-10-22 07:37:37 +0100) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git tags/for_linus for you to fetch changes up to 79f800b2e76923cd8ce0aa659cb5c019d9643bc9: MAINTAINERS: remove reference to bogus vsock file (2018-10-24 21:16:14 -0400)

...inux/kernel/git/mst/vhost.git vhost-net-next Jason Wang (1): vhost: fix typos in comment Julia Lawall (1): drivers/vhost/vhost.c: delete double assignment Michael S. Tsirkin (9): vhost: put mm after thread stop vhost-net: batch use/unuse mm vhost: copy_to_user -> __copy_to_user vhost: get/put_user -> __get/__put_user vhost: remove unused include vhost: correctly set bits of dirty pages vhost: better variable name in logging vhost test module tools/virtio: virtio_test tool drivers/vhost/net.c | 9 +- drivers/vhos...

...inux/kernel/git/mst/vhost.git vhost-net-next Jason Wang (1): vhost: fix typos in comment Julia Lawall (1): drivers/vhost/vhost.c: delete double assignment Michael S. Tsirkin (9): vhost: put mm after thread stop vhost-net: batch use/unuse mm vhost: copy_to_user -> __copy_to_user vhost: get/put_user -> __get/__put_user vhost: remove unused include vhost: correctly set bits of dirty pages vhost: better variable name in logging vhost test module tools/virtio: virtio_test tool drivers/vhost/net.c | 9 +- drivers/vhos...

...1: >> arch/m68k/include/asm/uaccess_mm.h:373:2: warning: passing argument 1 of '__constant_copy_to_user' makes pointer from integer without a cast __constant_copy_to_user(to, from, n) : \ ^ >> arch/m68k/include/asm/uaccess_mm.h:380:35: note: in expansion of macro '__copy_to_user' #define copy_to_user(to, from, n) __copy_to_user(to, from, n) ^ drivers/gpu/drm/vc4/vc4_gem.c:123:6: note: in expansion of macro 'copy_to_user' if (copy_to_user(u64_to_user_ptr(get_state->bo), ^ arch/m68k/include/asm/uacc...

...ue; return; } - if (head == vq->num) { + if (!ret) { if (vhost_enable_notify(&vs->dev, vq)) goto again; vs->vs_events_missed = true; @@ -488,7 +503,7 @@ vhost_scsi_do_evt_work(struct vhost_scsi *vs, struct vhost_scsi_evt *evt) eventp = vq->iov[out].iov_base; ret = __copy_to_user(eventp, event, sizeof(*event)); if (!ret) - vhost_add_used_and_signal(&vs->dev, vq, head, 0); + vhost_scsi_signal_noinput(&vs->dev, vq, &buf); else vq_err(vq, "Faulted on vhost_scsi_send_event\n"); } @@ -549,7 +564,7 @@ static void vhost_scsi_complete_cmd_work(...

...ue; return; } - if (head == vq->num) { + if (!ret) { if (vhost_enable_notify(&vs->dev, vq)) goto again; vs->vs_events_missed = true; @@ -488,7 +503,7 @@ vhost_scsi_do_evt_work(struct vhost_scsi *vs, struct vhost_scsi_evt *evt) eventp = vq->iov[out].iov_base; ret = __copy_to_user(eventp, event, sizeof(*event)); if (!ret) - vhost_add_used_and_signal(&vs->dev, vq, head, 0); + vhost_scsi_signal_noinput(&vs->dev, vq, &buf); else vq_err(vq, "Faulted on vhost_scsi_send_event\n"); } @@ -549,7 +564,7 @@ static void vhost_scsi_complete_cmd_work(...

...vhost-blk userspace bits for kvm tool can be found here: git at github.com:asias/linux-kvm.git blk.vhost-blk 2) QEMU The latest vhost-blk userspace prototype for QEMU can be found here: git at github.com:asias/qemu.git blk.vhost-blk Changes in v4: - Mark req->status as userspace pointer - Use __copy_to_user() instead of copy_to_user() in vhost_blk_set_status() - Add if (need_resched()) schedule() in blk thread - Kill vhost_blk_stop_vq() and move it into vhost_blk_stop() - Use vq_err() instead of pr_warn() - Fail un Unsupported request - Add flush in vhost_blk_set_features() Changes in v3: - Sending R...

...vhost-blk userspace bits for kvm tool can be found here: git at github.com:asias/linux-kvm.git blk.vhost-blk 2) QEMU The latest vhost-blk userspace prototype for QEMU can be found here: git at github.com:asias/qemu.git blk.vhost-blk Changes in v4: - Mark req->status as userspace pointer - Use __copy_to_user() instead of copy_to_user() in vhost_blk_set_status() - Add if (need_resched()) schedule() in blk thread - Kill vhost_blk_stop_vq() and move it into vhost_blk_stop() - Use vq_err() instead of pr_warn() - Fail un Unsupported request - Add flush in vhost_blk_set_features() Changes in v3: - Sending R...

This series tries to unify and simplify vhost codes especially for zerocopy. With this series, 5% - 10% improvement for per cpu throughput were seen during netperf guest sending test. Plase review. Changes from V2: - Typo fixes and code style fix - Add performance gain in the commit log of patch 2/6 - Retest the update the result in patch 6/6 Changes from V1: - Fix the zerocopy enabling check

This series tries to unify and simplify vhost codes especially for zerocopy. With this series, 5% - 10% improvement for per cpu throughput were seen during netperf guest sending test. Plase review. Changes from V2: - Typo fixes and code style fix - Add performance gain in the commit log of patch 2/6 - Retest the update the result in patch 6/6 Changes from V1: - Fix the zerocopy enabling check

...@@ void shadow_invlpg(struct exec_domain *e * XXX KAF: Why is this set-to-zero required? * Why, on failure, must we bin all our shadow state? */ - if (__put_user(0L, (unsigned long *) - &shadow_linear_pg_table[va >> PAGE_SHIFT])) { + if (__copy_to_user(&shadow_linear_pg_table[va >> PAGE_SHIFT], + &zero, sizeof(zero))) { vmx_shadow_clear_state(ed->domain); return; } - if (__get_user(gpte, (unsigned long *) - &linear_pg_table[va >> PAGE_SHIFT])) { + if (__copy_from_...

Use the newly added u64_to_user_pointer a bit more frequently. Signed-off-by: Joe Perches <joe at perches.com> --- drivers/gpu/drm/armada/armada_gem.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 7 ++++--- drivers/gpu/drm/tegra/drm.c | 15 ++++++++------- drivers/gpu/drm/vc4/vc4_bo.c | 4 ++-- drivers/gpu/drm/vc4/vc4_gem.c | 10 +++++-----