Commit Graph

948892 Commits

Author SHA1 Message Date
Jacob Keller
f45a645fa6 ice: report netlist version in .info_get
The flash memory for the ice hardware contains a block of information
used for link management called the Netlist module.

As this essentially represents another section of firmware, add its
version information to the output of the driver's .info_get handler.

This includes both a version and the first few bytes of a hash of the
module contents.

  fw.netlist -> the version information extracted from the netlist module
  fw.netlist.build-> first 4 bytes of the hash of the contents, similar
                     to fw.mgmt.build

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2020-05-21 22:10:03 -07:00
Dave Airlie
918b73dcfc Merge branch 'linux-5.8' of git://github.com/skeggsb/linux into drm-next
- HD audio fixes on recent systems
- vGPU detection (fail probe if we're on one, for now)
- Interlaced mode fixes (mostly avoidance on Turing, which doesn't support it)
- SVM improvements/fixes
- NVIDIA format modifier support
- Misc other fixes.

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Ben Skeggs <skeggsb@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/ <CACAvsv6DcRFMDVEftdL7LxNtxuSQQ=qnfqdHXO0K=BmJ8Q2-+g@mail.gmail.com
2020-05-22 13:17:12 +10:00
Dave Airlie
5f0ed4f8f6 Merge tag 'mediatek-drm-next-5.8' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-next
Mediatek DRM Next for Linux 5.8

This include dpi pin mode swap, config mipi_tx current and impedance,
and some fixup.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200521014612.17175-1-chunkuang.hu@kernel.org
2020-05-22 12:20:18 +10:00
Swathi Dhanavanthri
2992b543b8 drm/i915/ehl: Extend w/a 14010685332 to JSP/MCC
This is a permanent w/a for JSL/EHL.This is to be applied to the
PCH types on JSL/EHL ie JSP/MCC
Bspec: 52888

v2: Fixed the wrong usage of logical OR(ville)
v3: Removed extra braces, changed the check(jose)

Signed-off-by: Swathi Dhanavanthri <swathi.dhanavanthri@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200521064448.29522-1-swathi.dhanavanthri@intel.com
2020-05-21 19:05:11 -07:00
Dinghao Liu
dc455f4c88 drm/nouveau/dispnv50: fix runtime pm imbalance on error
pm_runtime_get_sync() increments the runtime PM usage counter even
the call returns an error code. Thus a pairing decrement is needed
on the error handling path to keep the counter balanced.

Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:53 +10:00
Dinghao Liu
d3faddc7dc drm/nouveau: fix runtime pm imbalance on error
pm_runtime_get_sync() increments the runtime PM usage counter even
the call returns an error code. Thus a pairing decrement is needed
on the error handling path to keep the counter balanced.

Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:52 +10:00
Dinghao Liu
d7372dfb3f drm/nouveau: fix runtime pm imbalance on error
pm_runtime_get_sync() increments the runtime PM usage counter even
the call returns an error code. Thus a pairing decrement is needed
on the error handling path to keep the counter balanced.

Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:52 +10:00
Dinghao Liu
00583fbe80 drm/nouveau/debugfs: fix runtime pm imbalance on error
pm_runtime_get_sync() increments the runtime PM usage counter even
the call returns an error code. Thus a pairing decrement is needed
on the error handling path to keep the counter balanced.

Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:52 +10:00
Ralph Campbell
9d4296a7d4 drm/nouveau/nouveau/hmm: fix migrate zero page to GPU
When calling OpenCL clEnqueueSVMMigrateMem() on a region of memory that
is backed by pte_none() or zero pages, migrate_vma_setup() will fill the
source PFN array with an entry indicating the source page is zero.
Use this to optimize migration to device private memory by allocating
GPU memory and zero filling it instead of failing to migrate the page.

Signed-off-by: Ralph Campbell <rcampbell@nvidia.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:52 +10:00
Ralph Campbell
1d7f940c3a drm/nouveau/nouveau/hmm: fix nouveau_dmem_chunk allocations
In nouveau_dmem_init(), a number of struct nouveau_dmem_chunk are allocated
and put on the dmem->chunk_empty list. Then in nouveau_dmem_pages_alloc(),
a nouveau_dmem_chunk is removed from the list and GPU memory is allocated.
However, the nouveau_dmem_chunk is never removed from the chunk_empty
list nor placed on the chunk_free or chunk_full lists. This results
in only one chunk ever being actually used (2MB) and quickly leads to
migration to device private memory failures.

Fix this by having just one list of free device private pages and if no
pages are free, allocate a chunk of device private pages and GPU memory.

Signed-off-by: Ralph Campbell <rcampbell@nvidia.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:52 +10:00
Lyude Paul
d6a9efece7 drm/nouveau/kms/nv50-: Share DP SST mode_valid() handling with MST
Currently, the nv50_mstc_mode_valid() function is happy to take any and
all modes, even the ones we can't actually support sometimes like
interlaced modes.

Luckily, the only difference between the mode validation that needs to
be performed for MST vs. SST is that eventually we'll need to check the
minimum PBN against the MSTB's full PBN capabilities (remember-we don't
care about the current bw state here). Otherwise, all of the other code
can be shared.

So, we move all of the common mode validation in
nouveau_connector_mode_valid() into a separate helper,
nv50_dp_mode_valid(), and use that from both nv50_mstc_mode_valid() and
nouveau_connector_mode_valid(). Note that we allow for returning the
calculated clock that nv50_dp_mode_valid() came up with, since we'll
eventually want to use that for PBN calculation in
nv50_mstc_mode_valid().

Signed-off-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:52 +10:00
Lyude Paul
bbdf6a5891 drm/nouveau/kms/nv50-: Move 8BPC limit for MST into nv50_mstc_get_modes()
This just limits the BPC for MST connectors to a maximum of 8 from
nv50_mstc_get_modes(), instead of doing so during
nv50_msto_atomic_check(). This doesn't introduce any functional changes
yet (other then userspace now lying about the max bpc, but we can't
support that yet anyway so meh). But, we'll need this in a moment so
that we can share mode validation between SST and MST which will fix
some real world issues.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:52 +10:00
Lyude Paul
af620cf083 drm/nouveau/kms/gv100-: Add support for interlaced modes
We advertise being able to set interlaced modes, so let's actually make
sure to do that. Otherwise, we'll end up hanging the display engine due
to trying to set a mode with timings adjusted for interlacing without
telling the hardware it's actually an interlaced mode.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:52 +10:00
Lyude Paul
4a2cb4181b drm/nouveau/kms/nv50-: Probe SOR and PIOR caps for DP interlacing support
Right now, we make the mistake of allowing interlacing on all
connectors. Nvidia hardware does not always support interlacing with DP
though, so we need to make sure that we don't allow interlaced modes to
be set in such situations as otherwise we'll end up accidentally hanging
the display HW.

This fixes some hangs with Turing, which would be caused by attempting
to set an interlaced mode on hardware that doesn't support it. This
patch likely fixes other hardware hanging in the same way as well.

Note that we say we probe PIOR caps, but they don't actually have any
interlacing caps. So, the get_caps() function for PIORs just sets
interlacing support to true.

Changes since v1:
* Actually probe caps correctly this time, both on EVO and NVDisplay.
Changes since v2:
* Fix probing for < GF119
* Use vfunc table, in prep for adding more caps in the future.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:51 +10:00
Lyude Paul
fa1232ea84 drm/nouveau/kms/nv50-: Initialize core channel in nouveau_display_create()
We'll need the core channel initialized and ready by the time that we
start creating modesetting objects, so that we can call the
NV507D_GET_CAPABILITIES method to make the hardware expose it's
modesetting capabilities for later probing.

So, when loading the driver prepare the core channel from within
nouveau_display_create(). Everywhere else, we initialize the core
channel during resume.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:51 +10:00
Ben Skeggs
0435d7c692 drm/nouveau/disp/hda/gv100-: NV_PDISP_SF_AUDIO_CNTRL0 register moved
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:51 +10:00
Ben Skeggs
7ec60c0440 drm/nouveau/disp/hda/gf119-: select HDA device entry based on bound head
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:51 +10:00
Ben Skeggs
d4115d17cd drm/nouveau/disp/hda/gf119-: add HAL for programming device entry in SF
Register has moved on GV100.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:51 +10:00
Ben Skeggs
1404e56a49 drm/nouveau/disp/hda/gt215-: pass head to nvkm_ior.hda.eld()
We're going to use the bound head to select HDA device entry.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:51 +10:00
Ben Skeggs
18d8cf9309 drm/nouveau/disp/nv50-: increase timeout on pio channel free() polling
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:51 +10:00
Takashi Iwai
61a41097e4 drm/nouveau/kms: Fix regression by audio component transition
Since the commit 742db30c4e ("drm/nouveau: Add HD-audio component
notifier support"), the nouveau driver notifies and pokes the HD-audio
HPD and ELD via audio component, but this seems broken.  The culprit
is the naive assumption that crtc->index corresponds to the HDA pin.
Actually this rather corresponds to the MST dev_id (alias "pipe" in
the audio component framework) while the actual port number is given
from the output ior id number.

This patch corrects the assignment of port and dev_id arguments in the
audio component ops to recover from the HDMI/DP audio regression.

Fixes: 742db30c4e ("drm/nouveau: Add HD-audio component notifier support")
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207223
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:50 +10:00
Ben Skeggs
0f85bbb6ae drm/nouveau/device: use regular PRI accessors in chipset detection
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:50 +10:00
Karol Herbst
2924779bca drm/nouveau/device: detect vGPUs
Using ENODEV as this prevents probe failed errors in dmesg.

v2: move check further down

Signed-off-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:50 +10:00
Karol Herbst
51c05340e4 drm/nouveau/device: detect if changing endianness failed
v2: relax the checks a little

Signed-off-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:50 +10:00
Karol Herbst
24d5ff40a7 drm/nouveau/device: rework mmio mapping code to get rid of second map
Fixes warnings on GPUs with smaller a smaller mmio region like vGPUs.

Signed-off-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:50 +10:00
Zheng Bin
94db9a3b0f drm/nouveau/mmu: Remove unneeded semicolon
Fixes coccicheck warning:

drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.h:307:2-3: Unneeded semicolon
drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c:583:2-3: Unneeded semicolon

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zheng Bin <zhengbin13@huawei.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:50 +10:00
Kai-Heng Feng
ccfc2d5cdb drm/nouveau: Use generic helper to check _PR3 presence
Replace nouveau_pr3_present() in favor of a more generic one,
pci_pr3_present().

Also the presence of upstream bridge _PR3 doesn't need to go hand in
hand with device's _DSM, so check _PR3 before _DSM.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:50 +10:00
Zou Wei
75a708918a drm/nouveau/acr: Use kmemdup instead of kmalloc and memcpy
Fixes coccicheck warning:

drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c:103:23-30: WARNING opportunity for kmemdup
drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c:113:22-29: WARNING opportunity for kmemdup

Fixes: 22dcda45a3 ("drm/nouveau/acr: implement new subdev to replace "secure boot"")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:49 +10:00
Colin Ian King
cf0f64ff4f drm/nouveau/core/memory: remove redundant assignments to variable ret
The variable ret is being initialized with a value that is never
read and it is being updated later with a new value. The initialization
is redundant and can be removed.

Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:49 +10:00
Ralph Campbell
e3d8b08904 drm/nouveau/svm: map pages after migration
When memory is migrated to the GPU, it is likely to be accessed by GPU
code soon afterwards. Instead of waiting for a GPU fault, map the
migrated memory into the GPU page tables with the same access permissions
as the source CPU page table entries. This preserves copy on write
semantics.

Signed-off-by: Ralph Campbell <rcampbell@nvidia.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Jason Gunthorpe <jgg@mellanox.com>
Cc: "Jérôme Glisse" <jglisse@redhat.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:49 +10:00
Ben Skeggs
9c1c08a68d drm/nouveau/disp/gv100-: expose capabilities class
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:49 +10:00
Ben Skeggs
b950c8c5d0 drm/nouveau/bios: move ACPI _ROM handling
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:49 +10:00
Ben Skeggs
2dd4d163cd drm/nouveau: remove open-coded version of remove_conflicting_pci_framebuffers()
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:49 +10:00
Ben Skeggs
fb172f5fe8 drm/nouveau/gr/gk20a: move MODULE_FIRMWARE firmware definitions
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:49 +10:00
Ben Skeggs
d2bcfce7f8 drm/nouveau/ibus: use nvkm_subdev_new_()
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:48 +10:00
Ben Skeggs
f02ca8425a drm/nouveau/core: add nvkm_subdev_new_() for bare subdevs
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:13:48 +10:00
James Jones
fa4f4c213f drm/nouveau/kms: Support NVIDIA format modifiers
Allow setting the block layout of a nouveau FB
object using DRM format modifiers.  When
specified, the format modifier block layout and
kind overrides the GEM buffer's implicit layout
and kind.  The specified format modifier is
validated against the list of modifiers supported
by the target display hardware.

v2: Used Tesla family instead of NV50 chipset compare
v4: Do not cache kind, tile_mode in nouveau_framebuffer
v5: Resolved against nouveau_framebuffer cleanup

Signed-off-by: James Jones <jajones@nvidia.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:11:16 +10:00
James Jones
4f5746c863 drm/nouveau/kms: Check framebuffer size against bo
Make sure framebuffer dimensions and tiling
parameters will not result in accesses beyond the
end of the GEM buffer they are bound to.

v3: Return EINVAL when creating FB against BO with
    unsupported tiling
v5: Resolved against nouveau_framebuffer cleanup

Signed-off-by: James Jones <jajones@nvidia.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:11:15 +10:00
James Jones
c586f30bf7 drm/nouveau/kms: Add format mod prop to base/ovly/nvdisp
Advertise support for the full list of format
modifiers supported by each class of NVIDIA
desktop GPU display hardware.  Stash the array
of modifiers in the nouveau_display struct for
use when validating userspace framebuffer
creation requests, which will be supportd in
a subsequent change.

Signed-off-by: James Jones <jajones@nvidia.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:11:15 +10:00
Ben Skeggs
fd44028ff1 drm/nouveau/acr: ensure falcon providing acr functions is bootstrapped first
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:11:15 +10:00
Thomas Zimmermann
559c9eb6a6 drm/nouveau/kms: Remove struct nouveau_framebuffer
After its cleanup, struct nouveau_framebuffer is only a wrapper around
struct drm_framebuffer. Use the latter directly.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:11:15 +10:00
Thomas Zimmermann
1834058792 drm/nouveau/kms: Remove field nvbo from struct nouveau_framebuffer
The buffer object stored in nvbo is also available GEM object in obj[0]
of struct drm_framebuffer. Therefore remove nvbo in favor obj[0] and
replace all references accordingly. This may require an additional cast.

With this change we can already replace nouveau_user_framebuffer_destroy()
and nouveau_user_framebuffer_create_handle() with generic GEM helpers.
Calls to nouveau_framebuffer_new() receive a GEM object.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:11:14 +10:00
Thomas Zimmermann
84c862b572 drm/nouveau/kms: Move struct nouveau_framebuffer.vma to struct nouveau_fbdev
The vma field of struct nouveau_framebuffer is a special field for the
the accelerated fbdev console. Hence there's at most one single instance
for the active console. Moving it into struct nouveau_fbdev makes struct
nouveau_framebuffer slightly smaller and brings it closer to struct
drm_framebuffer.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:11:14 +10:00
Thomas Zimmermann
e27ad35e69 drm/nouveau/kms: Remove unused fields from struct nouveau_framebuffer
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:11:14 +10:00
Ben Skeggs
bbd540c072 drm/nouveau: fix out-of-tree module build
The $(srctree) addition a while back busted building the out-of-tree
version of the module, and I've been hacking it up ever since.

This allows us to work around the issue.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 11:11:14 +10:00
James Jones
82c8c4ddca drm: Generalized NV Block Linear DRM format mod
Builds upon the existing NVIDIA 16Bx2 block linear
format modifiers by adding more "fields" to the
existing parameterized
DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK format modifier
macro that allow fully defining a unique-across-
all-NVIDIA-hardware bit layout using a minimal
set of fields and values.  The new modifier macro
DRM_FORMAT_MOD_NVIDIA_BLOCK_LINEAR_2D is
effectively backwards compatible with the existing
macro, introducing a superset of the previously
definable format modifiers.

Backwards compatibility has two quirks.  First,
the zero value for the "kind" field, which is
implied by the DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK
macro, must be special cased in drivers and
assumed to map to the pre-Turing generic kind of
0xfe, since a kind of "zero" is reserved for
linear buffer layouts on all GPUs.

Second, it is assumed backwards compatibility
is only needed when running on Tegra GPUs, and
specifically Tegra GPUs prior to Xavier.  This
is based on two assertions:

-Tegra GPUs prior to Xavier used a slightly
 different raw bit layout than desktop GPUs,
 making it impossible to directly share block
 linear buffers between the two.

-Support for the existing block linear modifiers
 was incomplete, making them useful only for
 exporting buffers created by nouveau and
 importing them to Tegra DRM as framebuffers for
 scan out.  There was no support for adding
 framebuffers using format modifiers in nouveau,
 nor importing dma-buf/PRIME GEM objects into
 nouveau userspace drivers with modifiers in Mesa.

Hence it is assumed the prior modifiers were not
intended for use on desktop GPUs, and as a
corollary, were not intended to support sharing
block linear buffers across two different NVIDIA
GPUs.

v2:
  - Added canonicalize helper function

v3:
  - Added additional bit to compression field to
    support Tesla (NV5x,G8x,G9x,GT1xx,GT2xx) class
    chips.

Signed-off-by: James Jones <jajones@nvidia.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-05-22 10:53:33 +10:00
Jakub Sitnicki
5cf65922bb flow_dissector: Drop BPF flow dissector prog ref on netns cleanup
When attaching a flow dissector program to a network namespace with
bpf(BPF_PROG_ATTACH, ...) we grab a reference to bpf_prog.

If netns gets destroyed while a flow dissector is still attached, and there
are no other references to the prog, we leak the reference and the program
remains loaded.

Leak can be reproduced by running flow dissector tests from selftests/bpf:

  # bpftool prog list
  # ./test_flow_dissector.sh
  ...
  selftests: test_flow_dissector [PASS]
  # bpftool prog list
  4: flow_dissector  name _dissect  tag e314084d332a5338  gpl
          loaded_at 2020-05-20T18:50:53+0200  uid 0
          xlated 552B  jited 355B  memlock 4096B  map_ids 3,4
          btf_id 4
  #

Fix it by detaching the flow dissector program when netns is going away.

Fixes: d58e468b11 ("flow_dissector: implements flow dissector BPF hook")
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/bpf/20200521083435.560256-1-jakub@cloudflare.com
2020-05-21 17:52:45 -07:00
Alexei Starovoitov
29ae90d221 Merge branch 'improve-branch_taken'
John Fastabend says:

====================
This series adds logic to the verifier to handle the case where a
pointer is known to be non-null but then the verifier encountesr a
instruction, such as 'if ptr == 0 goto X' or 'if ptr != 0 goto X',
where the pointer is compared against 0. Because the verifier tracks
if a pointer may be null in many cases we can improve the branch
tracking by following the case known to be true.

The first patch adds the verifier logic and patches 2-4 add the
test cases.

v1->v2: fix verifier logic to return -1 indicating both paths must
still be walked if value is not zero. Move mark_precision skip for
this case into caller of mark_precision to ensure mark_precision can
still catch other misuses. And add PTR_TYPE_BTF_ID to our list of
supported types. Finally add one more test to catch the value not
equal zero case. Thanks to Andrii for original review.

Also fixed up commit messages hopefully its better now.
====================

Acked-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2020-05-21 17:47:33 -07:00
John Fastabend
d844a71bff bpf: Selftests, add printk to test_sk_lookup_kern to encode null ptr check
Adding a printk to test_sk_lookup_kern created the reported failure
where a pointer type is checked twice for NULL. Lets add it to the
progs test test_sk_lookup_kern.c so we test the case from C all the
way into the verifier.

We already have printk's in selftests so seems OK to add another one.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Link: https://lore.kernel.org/bpf/159009170603.6313.1715279795045285176.stgit@john-Precision-5820-Tower
2020-05-21 17:44:25 -07:00
John Fastabend
f9b16ec0ee bpf: Selftests, verifier case for non null pointer map value branch
When we have pointer type that is known to be non-null we only follow
the non-null branch. This adds tests to cover the map_value pointer
returned from a map lookup. To force an error if both branches are
followed we do an ALU op on R10.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Link: https://lore.kernel.org/bpf/159009168650.6313.7434084136067263554.stgit@john-Precision-5820-Tower
2020-05-21 17:44:25 -07:00