[PATCH 00/17] [PATCH 00/17] dmaengine: idxd: fixes found by an in-kernel polling client

[Daniel Byrne]

These are fixes for bugs in the idxd driver that an in-kernel polling
client exposed while sharing DSA work queues between many io_uring rings
(that client is to be posted separately as "io_uring: DMA-engine copy offload
for buffered file I/O"). They apply to v7.3 on their own and do not
depend on that series. Each patch says which released kernels it
affects; the ones that fit stable are tagged.

In short:
 - the event-log fault path dereferences a NULL workqueue on a kernel WQ
   (stable, 6.4+), plus a hardening of the user WQ's workqueue teardown;
 - a memcpy longer than the work queue's transfer limit is accepted at
   prep and fails silently in hardware (stable, 5.10+);
 - a channel is listed before it is complete, and a failed registration
   leaves a freed channel on the list (stable, 5.13+);
 - the device driver is unbound after its work queues were freed;
 - terminate_all releases the work queue's interrupt handle for good
   (stable, 7.0+);
 - device commands wait forever, and the interrupt-handle release writes
   over a running command; the device disable misreads the fail-fast
   status as "already disabled"; the device is disabled after its
   queues' software state is gone; a reset loses the command interrupt
   it re-creates;
 - terminate_all frees descriptor slots the device still holds, and
   drains and resets report a timeout as a completed drain;
 - a descriptor whose submission failed is freed twice (stable, 5.14+);
 - an iaa_crypto descriptor is completed as a dmaengine transaction on
   abort and flush (stable, 6.8+);
 - software- and system-reset halts never flush the work queues, a halt
   flush strips the callbacks of live clients, and the interrupt-handle
   revoke runs without the queue lock.

Tested on a Granite Rapids system with four DSA devices: crc32c-verified
DMA I/O from the io_uring client under WQ unbind, live unbind and rebind,
driver unbind, PCI FLR and PCI driver unbind and rebind, on a v7.2-based
tree, clean under KASAN, DMA_API_DEBUG and lockdep; the v7.3 rebase is
conflict-free and build-tested per patch.

Daniel Byrne (17):
  dmaengine: idxd: don't queue EVL fault work for kernel WQs
  dmaengine: idxd: detach the user fault workqueue under the event log
    lock
  dmaengine: idxd: refuse a memcpy longer than the WQ max transfer size
  dmaengine: idxd: list a new channel only once it is complete
  dmaengine: idxd: unbind the device driver before its work queues go
    away
  dmaengine: idxd: keep the interrupt handle across terminate_all
  dmaengine: idxd: bound device command waits and fail fast after a
    timeout
  dmaengine: idxd: compare the device disable status code whole
  dmaengine: idxd: quarantine terminate_all's descriptor slots until the
    device has drained
  dmaengine: idxd: return -ETIMEDOUT from drains and resets and leak
    what the device may still write
  dmaengine: idxd: disable the device before its work queues are
    unregistered
  dmaengine: idxd: hold device commands off while the reset re-creates
    its interrupts
  dmaengine: idxd: fix the double free of a descriptor whose submission
    failed
  dmaengine: idxd: complete an iaa_crypto descriptor through its own
    driver on abort and flush
  dmaengine: idxd: flush the work queues on every halt type
  dmaengine: idxd: keep client callbacks on a halt flush and cancel
    resubmissions after a terminate
  dmaengine: idxd: run the interrupt-handle revoke under the queue lock

 drivers/dma/dmaengine.c   |  41 +++
 drivers/dma/idxd/cdev.c   |  62 +++-
 drivers/dma/idxd/device.c | 588 ++++++++++++++++++++++++++++++++++----
 drivers/dma/idxd/dma.c    |  60 +++-
 drivers/dma/idxd/idxd.h   |  53 +++-
 drivers/dma/idxd/init.c   |  64 ++++-
 drivers/dma/idxd/irq.c    | 258 +++++++++++++----
 drivers/dma/idxd/submit.c | 158 ++++++++--
 include/linux/dmaengine.h |   2 +
 9 files changed, 1109 insertions(+), 177 deletions(-)


base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
-- 
2.43.0