<feed xmlns='http://www.w3.org/2005/Atom'>
<title>kernel/linux.git/drivers/hv/channel.c, branch v6.4</title>
<subtitle>Linux kernel stable tree (mirror)</subtitle>
<id>https://git.radix-linux.su/kernel/linux.git/atom?h=v6.4</id>
<link rel='self' href='https://git.radix-linux.su/kernel/linux.git/atom?h=v6.4'/>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/'/>
<updated>2022-04-25T15:51:13+00:00</updated>
<entry>
<title>Drivers: hv: vmbus: Introduce {lock,unlock}_requestor()</title>
<updated>2022-04-25T15:51:13+00:00</updated>
<author>
<name>Andrea Parri (Microsoft)</name>
<email>parri.andrea@gmail.com</email>
</author>
<published>2022-04-19T12:23:24+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=b91eaf7267cf7aec0a4e087decf7770dfb694d78'/>
<id>urn:sha1:b91eaf7267cf7aec0a4e087decf7770dfb694d78</id>
<content type='text'>
To abtract the lock and unlock operations on the requestor spin lock.
The helpers will come in handy in hv_pci.

No functional change.

Suggested-by: Michael Kelley &lt;mikelley@microsoft.com&gt;
Signed-off-by: Andrea Parri (Microsoft) &lt;parri.andrea@gmail.com&gt;
Reviewed-by: Michael Kelley &lt;mikelley@microsoft.com&gt;
Link: https://lore.kernel.org/r/20220419122325.10078-6-parri.andrea@gmail.com
Signed-off-by: Wei Liu &lt;wei.liu@kernel.org&gt;
</content>
</entry>
<entry>
<title>Drivers: hv: vmbus: Introduce vmbus_request_addr_match()</title>
<updated>2022-04-25T15:51:12+00:00</updated>
<author>
<name>Andrea Parri (Microsoft)</name>
<email>parri.andrea@gmail.com</email>
</author>
<published>2022-04-19T12:23:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=0aadb6a7bb811554cf39318b5d18e8ec50dd9f02'/>
<id>urn:sha1:0aadb6a7bb811554cf39318b5d18e8ec50dd9f02</id>
<content type='text'>
The function can be used to retrieve and clear/remove a transation ID
from a channel requestor, provided the memory address corresponding to
the ID equals a specified address.  The function, and its 'lockless'
variant __vmbus_request_addr_match(), will be used by hv_pci.

Refactor vmbus_request_addr() to reuse the 'newly' introduced code.

No functional change.

Suggested-by: Michael Kelley &lt;mikelley@microsoft.com&gt;
Signed-off-by: Andrea Parri (Microsoft) &lt;parri.andrea@gmail.com&gt;
Reviewed-by: Michael Kelley &lt;mikelley@microsoft.com&gt;
Link: https://lore.kernel.org/r/20220419122325.10078-5-parri.andrea@gmail.com
Signed-off-by: Wei Liu &lt;wei.liu@kernel.org&gt;
</content>
</entry>
<entry>
<title>Drivers: hv: vmbus: Introduce vmbus_sendpacket_getid()</title>
<updated>2022-04-25T15:51:12+00:00</updated>
<author>
<name>Andrea Parri (Microsoft)</name>
<email>parri.andrea@gmail.com</email>
</author>
<published>2022-04-19T12:23:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=b03afa57c65e1e045e02df49777e953742745f4c'/>
<id>urn:sha1:b03afa57c65e1e045e02df49777e953742745f4c</id>
<content type='text'>
The function can be used to send a VMbus packet and retrieve the
corresponding transaction ID.  It will be used by hv_pci.

No functional change.

Suggested-by: Michael Kelley &lt;mikelley@microsoft.com&gt;
Signed-off-by: Andrea Parri (Microsoft) &lt;parri.andrea@gmail.com&gt;
Reviewed-by: Michael Kelley &lt;mikelley@microsoft.com&gt;
Link: https://lore.kernel.org/r/20220419122325.10078-4-parri.andrea@gmail.com
Signed-off-by: Wei Liu &lt;wei.liu@kernel.org&gt;
</content>
</entry>
<entry>
<title>Drivers: hv: vmbus: Fix handling of messages with transaction ID of zero</title>
<updated>2022-04-25T15:51:12+00:00</updated>
<author>
<name>Andrea Parri (Microsoft)</name>
<email>parri.andrea@gmail.com</email>
</author>
<published>2022-04-19T12:23:20+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=82cd4bacff88a11e36f143e2cb950174b09c86c3'/>
<id>urn:sha1:82cd4bacff88a11e36f143e2cb950174b09c86c3</id>
<content type='text'>
vmbus_request_addr() returns 0 (zero) if the transaction ID passed
to as argument is 0.  This is unfortunate for two reasons: first,
netvsc_send_completion() does not check for a NULL cmd_rqst (before
dereferencing the corresponding NVSP message); second, 0 is a *valid*
value of cmd_rqst in netvsc_send_tx_complete(), cf. the call of
vmbus_sendpacket() in netvsc_send_pkt().

vmbus_request_addr() has included the code in question since its
introduction with commit e8b7db38449ac ("Drivers: hv: vmbus: Add
vmbus_requestor data structure for VMBus hardening"); such code was
motivated by the early use of vmbus_requestor by hv_storvsc.  Since
hv_storvsc moved to a tag-based mechanism to generate and retrieve
transaction IDs with commit bf5fd8cae3c8f ("scsi: storvsc: Use
blk_mq_unique_tag() to generate requestIDs"), vmbus_request_addr()
can be modified to return VMBUS_RQST_ERROR if the ID is 0.  This
change solves the issues in hv_netvsc (and makes the handling of
messages with transaction ID of 0 consistent with the semantics
"the ID is not contained in the requestor/invalid ID").

vmbus_next_request_id(), vmbus_request_addr() should still reserve
the ID of 0 for Hyper-V, because Hyper-V will "ignore" (not respond
to) VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED packets/requests with
transaction ID of 0 from the guest.

Fixes: bf5fd8cae3c8f ("scsi: storvsc: Use blk_mq_unique_tag() to generate requestIDs")
Signed-off-by: Andrea Parri (Microsoft) &lt;parri.andrea@gmail.com&gt;
Reviewed-by: Michael Kelley &lt;mikelley@microsoft.com&gt;
Link: https://lore.kernel.org/r/20220419122325.10078-2-parri.andrea@gmail.com
Signed-off-by: Wei Liu &lt;wei.liu@kernel.org&gt;
</content>
</entry>
<entry>
<title>Drivers: hv: vmbus: Initialize VMbus ring buffer for Isolation VM</title>
<updated>2021-10-28T11:26:36+00:00</updated>
<author>
<name>Tianyu Lan</name>
<email>Tianyu.Lan@microsoft.com</email>
</author>
<published>2021-10-25T12:21:14+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=9a8797722e4239242d0cb4cc4baa805df6ac979e'/>
<id>urn:sha1:9a8797722e4239242d0cb4cc4baa805df6ac979e</id>
<content type='text'>
VMbus ring buffer are shared with host and it's need to
be accessed via extra address space of Isolation VM with
AMD SNP support. This patch is to map the ring buffer
address in extra address space via vmap_pfn(). Hyperv set
memory host visibility hvcall smears data in the ring buffer
and so reset the ring buffer memory to zero after mapping.

Reviewed-by: Michael Kelley &lt;mikelley@microsoft.com&gt;
Signed-off-by: Tianyu Lan &lt;Tianyu.Lan@microsoft.com&gt;
Link: https://lore.kernel.org/r/20211025122116.264793-10-ltykernel@gmail.com
Signed-off-by: Wei Liu &lt;wei.liu@kernel.org&gt;
</content>
</entry>
<entry>
<title>Drivers: hv: vmbus: Mark vmbus ring buffer visible to host in Isolation VM</title>
<updated>2021-10-28T11:22:23+00:00</updated>
<author>
<name>Tianyu Lan</name>
<email>Tianyu.Lan@microsoft.com</email>
</author>
<published>2021-10-25T12:21:09+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=d4dccf353db80e209f262e3973c834e6e48ba9a9'/>
<id>urn:sha1:d4dccf353db80e209f262e3973c834e6e48ba9a9</id>
<content type='text'>
Mark vmbus ring buffer visible with set_memory_decrypted() when
establish gpadl handle.

Reviewed-by: Michael Kelley &lt;mikelley@microsoft.com&gt;
Signed-off-by: Tianyu Lan &lt;Tianyu.Lan@microsoft.com&gt;
Link: https://lore.kernel.org/r/20211025122116.264793-5-ltykernel@gmail.com
Signed-off-by: Wei Liu &lt;wei.liu@kernel.org&gt;
</content>
</entry>
<entry>
<title>scsi: storvsc: Use blk_mq_unique_tag() to generate requestIDs</title>
<updated>2021-05-14T17:39:32+00:00</updated>
<author>
<name>Andrea Parri (Microsoft)</name>
<email>parri.andrea@gmail.com</email>
</author>
<published>2021-05-10T21:08:41+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=bf5fd8cae3c8f0d1e6f71a076e0ce2bd17645d0b'/>
<id>urn:sha1:bf5fd8cae3c8f0d1e6f71a076e0ce2bd17645d0b</id>
<content type='text'>
Use blk_mq_unique_tag() to generate requestIDs for StorVSC, avoiding
all issues with allocating enough entries in the VMbus requestor.

Suggested-by: Michael Kelley &lt;mikelley@microsoft.com&gt;
Signed-off-by: Andrea Parri (Microsoft) &lt;parri.andrea@gmail.com&gt;
Reviewed-by: Michael Kelley &lt;mikelley@microsoft.com&gt;
Acked-by: Martin K. Petersen &lt;martin.petersen@oracle.com&gt;
Link: https://lore.kernel.org/r/20210510210841.370472-1-parri.andrea@gmail.com
Signed-off-by: Wei Liu &lt;wei.liu@kernel.org&gt;
</content>
</entry>
<entry>
<title>Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer</title>
<updated>2021-05-14T17:37:46+00:00</updated>
<author>
<name>Andres Beltran</name>
<email>lkmlabelt@gmail.com</email>
</author>
<published>2021-04-08T16:14:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=adae1e931acd8b430d31141a283ea06d4b705417'/>
<id>urn:sha1:adae1e931acd8b430d31141a283ea06d4b705417</id>
<content type='text'>
Pointers to ring-buffer packets sent by Hyper-V are used within the
guest VM. Hyper-V can send packets with erroneous values or modify
packet fields after they are processed by the guest. To defend
against these scenarios, return a copy of the incoming VMBus packet
after validating its length and offset fields in hv_pkt_iter_first().
In this way, the packet can no longer be modified by the host.

Signed-off-by: Andres Beltran &lt;lkmlabelt@gmail.com&gt;
Co-developed-by: Andrea Parri (Microsoft) &lt;parri.andrea@gmail.com&gt;
Signed-off-by: Andrea Parri (Microsoft) &lt;parri.andrea@gmail.com&gt;
Reviewed-by: Michael Kelley &lt;mikelley@microsoft.com&gt;
Link: https://lore.kernel.org/r/20210408161439.341988-1-parri.andrea@gmail.com
Signed-off-by: Wei Liu &lt;wei.liu@kernel.org&gt;
</content>
</entry>
<entry>
<title>Drivers: hv: vmbus: Drivers: hv: vmbus: Introduce CHANNELMSG_MODIFYCHANNEL_RESPONSE</title>
<updated>2021-04-18T13:03:11+00:00</updated>
<author>
<name>Andrea Parri (Microsoft)</name>
<email>parri.andrea@gmail.com</email>
</author>
<published>2021-04-16T14:34:48+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=870ced0548c895eb0bf8d982400344e5a9b2df00'/>
<id>urn:sha1:870ced0548c895eb0bf8d982400344e5a9b2df00</id>
<content type='text'>
Introduce the CHANNELMSG_MODIFYCHANNEL_RESPONSE message type, and code
to receive and process such a message.

Signed-off-by: Andrea Parri (Microsoft) &lt;parri.andrea@gmail.com&gt;
Reviewed-by: Michael Kelley &lt;mikelley@microsoft.com&gt;
Link: https://lore.kernel.org/r/20210416143449.16185-3-parri.andrea@gmail.com
Signed-off-by: Wei Liu &lt;wei.liu@kernel.org&gt;
</content>
</entry>
<entry>
<title>Drivers: hv: vmbus: Use after free in __vmbus_open()</title>
<updated>2021-04-16T10:36:33+00:00</updated>
<author>
<name>Dan Carpenter</name>
<email>dan.carpenter@oracle.com</email>
</author>
<published>2021-04-13T10:50:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=3e9bf43f7f7a46f21ec071cb47be92d0874c48da'/>
<id>urn:sha1:3e9bf43f7f7a46f21ec071cb47be92d0874c48da</id>
<content type='text'>
The "open_info" variable is added to the &amp;vmbus_connection.chn_msg_list,
but the error handling frees "open_info" without removing it from the
list.  This will result in a use after free.  First remove it from the
list, and then free it.

Fixes: 6f3d791f3006 ("Drivers: hv: vmbus: Fix rescind handling issues")
Signed-off-by: Dan Carpenter &lt;dan.carpenter@oracle.com&gt;
Reviewed-by: Andrea Parri &lt;parri.andrea@gmail.com&gt;
Link: https://lore.kernel.org/r/YHV3XLCot6xBS44r@mwanda
Signed-off-by: Wei Liu &lt;wei.liu@kernel.org&gt;
</content>
</entry>
</feed>
