From 24d7ca9c05db22fe8890e759396b5a9c634cf41a Mon Sep 17 00:00:00 2001 From: Josh Lay Date: Mon, 25 Feb 2019 21:48:16 -0600 Subject: [PATCH] initial commit --- README.md | 52 +++++++++ TODO.md | 4 + ansible.cfg | 3 + payload/acso-4.17.patch | 190 +++++++++++++++++++++++++++++++ payload/acso-4.18.patch | 190 +++++++++++++++++++++++++++++++ payload/add-acs-overrides.patch | 196 ++++++++++++++++++++++++++++++++ playbook.yml | 62 ++++++++++ 7 files changed, 697 insertions(+) create mode 100644 README.md create mode 100644 TODO.md create mode 100644 ansible.cfg create mode 100644 payload/acso-4.17.patch create mode 100644 payload/acso-4.18.patch create mode 100644 payload/add-acs-overrides.patch create mode 100644 playbook.yml diff --git a/README.md b/README.md new file mode 100644 index 0000000..a3c36e9 --- /dev/null +++ b/README.md @@ -0,0 +1,52 @@ +### build_kernel +This playbook is used to automatically build a kernel with an ACS overrides patch applied. Useful to isolate PCI-e devices to their own IOMMU group for VFIO passthrough. + +See this page for kernel configuration details: https://copr.fedorainfracloud.org/coprs/jlay/kernel-acspatch/ + +### Example usage +``` +jlay@workstation:~/git/ansible/build_kernel$ ansible-playbook -i hosts playbook.yml + +PLAY [buildservers] ****************************************************************************************************************************************** + +TASK [Gathering Facts] ****************************************************************************************************************************************** +ok: [delta.jlay.io] + +TASK [Ensure libselinux-python is installed] ****************************************************************************************************************************************** +ok: [delta.jlay.io] + +TASK [Ensure fedpkg is installed] ****************************************************************************************************************************************** +ok: [delta.jlay.io] + +TASK [Find old mock chroots] ****************************************************************************************************************************************** +ok: [delta.jlay.io] + +TASK [Clean old mock chroots] ****************************************************************************************************************************************** + +TASK [Clean old build dir] ****************************************************************************************************************************************** +changed: [delta.jlay.io] + +TASK [Clone f29 kernel to /tmp/f29_kernel] ****************************************************************************************************************************************** +changed: [delta.jlay.io] + +TASK [Copy patch to build dir] ****************************************************************************************************************************************** +changed: [delta.jlay.io] + +TASK [Apply patch and build kernel (logs in /tmp/f29_kernel/results_kernel/*)] ****************************************************************************************************************************************** +changed: [delta.jlay.io] => (item=./scripts/newpatch.sh acso-4.18.patch) +changed: [delta.jlay.io] => (item=/usr/bin/sed -i -e 's/%define buildid .*$/%define buildid .acspatch/' kernel.spec) +changed: [delta.jlay.io] => (item=/usr/bin/make release) +changed: [delta.jlay.io] => (item=fedpkg mockbuild) + +TASK [Find RPMs in /tmp/f29_kernel/results_kernel/*/*/*.rpm] ****************************************************************************************************************************************** +ok: [delta.jlay.io] + +TASK [Copy RPMs to /tmp/ (local)] ****************************************************************************************************************************************** +ok: [delta.jlay.io] => (item={'uid': 0, 'woth': False, 'mtime': 1545900251.552329, 'inode': 1086935, 'isgid': False, 'size': 104419185, 'roth': True, 'isuid': False, 'isreg': True, 'pw_name': 'root', 'gid': 135, 'ischr': False, 'wusr': True, 'xoth': False, 'rusr': True, 'nlink': 1, 'issock': False, 'rgrp': True, 'gr_name': 'mock', 'path': '/tmp/f29_kernel/results_kernel/4.19.12/302.acspatch.fc29/kernel-4.19.12-302.acspatch.fc29.src.rpm', 'xusr': False, 'atime': 1545932715.7957838, 'isdir': False, 'ctime': 1545926304.4206192, 'isblk': False, 'xgrp': False, 'dev': 41, 'wgrp': False, 'isfifo': False, 'mode': '0644', 'islnk': False}) +[...] + +PLAY RECAP ****************************************************************************************************************************************** +delta.jlay.io : ok=8 changed=4 unreachable=0 failed=0 + +jlay@workstation:~/git/ansible/build_kernel$ +``` diff --git a/TODO.md b/TODO.md new file mode 100644 index 0000000..2a1fb69 --- /dev/null +++ b/TODO.md @@ -0,0 +1,4 @@ +### TODO +Use clang to build the upstream kernel manually instead of fedpkg/git +* Build times would be much faster (~10-15 minutes vs an hour) +* Newer versions diff --git a/ansible.cfg b/ansible.cfg new file mode 100644 index 0000000..3da56a8 --- /dev/null +++ b/ansible.cfg @@ -0,0 +1,3 @@ +[defaults] +command_warnings = False +retry_files_enabled = False diff --git a/payload/acso-4.17.patch b/payload/acso-4.17.patch new file mode 100644 index 0000000..78174ac --- /dev/null +++ b/payload/acso-4.17.patch @@ -0,0 +1,190 @@ +From 8afeb76790377fe42c4c91c9cb7d311078e9a7ae Mon Sep 17 00:00:00 2001 +From: Mark Weiman +Date: Fri, 20 Apr 2018 13:17:23 -0400 +Subject: [PATCH] pci: Enable overrides for missing ACS capabilities (4.17) + +This an updated version of Alex Williamson's patch from: +https://lkml.org/lkml/2013/5/30/513 + +Original commit message follows: +--- +PCIe ACS (Access Control Services) is the PCIe 2.0+ feature that +allows us to control whether transactions are allowed to be redirected +in various subnodes of a PCIe topology. For instance, if two +endpoints are below a root port or downsteam switch port, the +downstream port may optionally redirect transactions between the +devices, bypassing upstream devices. The same can happen internally +on multifunction devices. The transaction may never be visible to the +upstream devices. + +One upstream device that we particularly care about is the IOMMU. If +a redirection occurs in the topology below the IOMMU, then the IOMMU +cannot provide isolation between devices. This is why the PCIe spec +encourages topologies to include ACS support. Without it, we have to +assume peer-to-peer DMA within a hierarchy can bypass IOMMU isolation. + +Unfortunately, far too many topologies do not support ACS to make this +a steadfast requirement. Even the latest chipsets from Intel are only +sporadically supporting ACS. We have trouble getting interconnect +vendors to include the PCIe spec required PCIe capability, let alone +suggested features. + +Therefore, we need to add some flexibility. The pcie_acs_override= +boot option lets users opt-in specific devices or sets of devices to +assume ACS support. The "downstream" option assumes full ACS support +on root ports and downstream switch ports. The "multifunction" +option assumes the subset of ACS features available on multifunction +endpoints and upstream switch ports are supported. The "id:nnnn:nnnn" +option enables ACS support on devices matching the provided vendor +and device IDs, allowing more strategic ACS overrides. These options +may be combined in any order. A maximum of 16 id specific overrides +are available. It's suggested to use the most limited set of options +necessary to avoid completely disabling ACS across the topology. +Note to hardware vendors, we have facilities to permanently quirk +specific devices which enforce isolation but not provide an ACS +capability. Please contact me to have your devices added and save +your customers the hassle of this boot option. + +Signed-off-by: Mark Weiman +--- +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 11fc28ecdb6d..2ca7b2227135 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -3019,6 +3019,15 @@ + nomsi [MSI] If the PCI_MSI kernel config parameter is + enabled, this kernel boot option can be used to + disable the use of MSI interrupts system-wide. ++ pcie_acs_override = ++ [PCIE] Override missing PCIe ACS support for: ++ downstream ++ All downstream ports - full ACS capabilities ++ multfunction ++ All multifunction devices - multifunction ACS subset ++ id:nnnn:nnnn ++ Specfic device - full ACS capabilities ++ Specified as vid:did (vendor/device ID) in hex + noioapicquirk [APIC] Disable all boot interrupt quirks. + Safety option to keep boot IRQs enabled. This + should never be necessary. +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 2990ad1e7c99..1527dce42d72 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3340,6 +3340,106 @@ DECLARE_PCI_FIXUP_SUSPEND_LATE(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C, + quirk_apple_poweroff_thunderbolt); + ++static bool acs_on_downstream; ++static bool acs_on_multifunction; ++ ++#define NUM_ACS_IDS 16 ++struct acs_on_id { ++ unsigned short vendor; ++ unsigned short device; ++}; ++static struct acs_on_id acs_on_ids[NUM_ACS_IDS]; ++static u8 max_acs_id; ++ ++static __init int pcie_acs_override_setup(char *p) ++{ ++ if (!p) ++ return -EINVAL; ++ ++ while (*p) { ++ if (!strncmp(p, "downstream", 10)) ++ acs_on_downstream = true; ++ if (!strncmp(p, "multifunction", 13)) ++ acs_on_multifunction = true; ++ if (!strncmp(p, "id:", 3)) { ++ char opt[5]; ++ int ret; ++ long val; ++ ++ if (max_acs_id >= NUM_ACS_IDS - 1) { ++ pr_warn("Out of PCIe ACS override slots (%d)\n", ++ NUM_ACS_IDS); ++ goto next; ++ } ++ ++ p += 3; ++ snprintf(opt, 5, "%s", p); ++ ret = kstrtol(opt, 16, &val); ++ if (ret) { ++ pr_warn("PCIe ACS ID parse error %d\n", ret); ++ goto next; ++ } ++ acs_on_ids[max_acs_id].vendor = val; ++ ++ p += strcspn(p, ":"); ++ if (*p != ':') { ++ pr_warn("PCIe ACS invalid ID\n"); ++ goto next; ++ } ++ ++ p++; ++ snprintf(opt, 5, "%s", p); ++ ret = kstrtol(opt, 16, &val); ++ if (ret) { ++ pr_warn("PCIe ACS ID parse error %d\n", ret); ++ goto next; ++ } ++ acs_on_ids[max_acs_id].device = val; ++ max_acs_id++; ++ } ++next: ++ p += strcspn(p, ","); ++ if (*p == ',') ++ p++; ++ } ++ ++ if (acs_on_downstream || acs_on_multifunction || max_acs_id) ++ pr_warn("Warning: PCIe ACS overrides enabled; This may allow non-IOMMU protected peer-to-peer DMA\n"); ++ ++ return 0; ++} ++early_param("pcie_acs_override", pcie_acs_override_setup); ++ ++static int pcie_acs_overrides(struct pci_dev *dev, u16 acs_flags) ++{ ++ int i; ++ ++ /* Never override ACS for legacy devices or devices with ACS caps */ ++ if (!pci_is_pcie(dev) || ++ pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS)) ++ return -ENOTTY; ++ ++ for (i = 0; i < max_acs_id; i++) ++ if (acs_on_ids[i].vendor == dev->vendor && ++ acs_on_ids[i].device == dev->device) ++ return 1; ++ ++ switch (pci_pcie_type(dev)) { ++ case PCI_EXP_TYPE_DOWNSTREAM: ++ case PCI_EXP_TYPE_ROOT_PORT: ++ if (acs_on_downstream) ++ return 1; ++ break; ++ case PCI_EXP_TYPE_ENDPOINT: ++ case PCI_EXP_TYPE_UPSTREAM: ++ case PCI_EXP_TYPE_LEG_END: ++ case PCI_EXP_TYPE_RC_END: ++ if (acs_on_multifunction && dev->multifunction) ++ return 1; ++ } ++ ++ return -ENOTTY; ++} + /* + * Apple: Wait for the thunderbolt controller to reestablish pci tunnels. + * +@@ -4381,6 +4481,7 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_AMPERE, 0xE00A, pci_quirk_xgene_acs }, + { PCI_VENDOR_ID_AMPERE, 0xE00B, pci_quirk_xgene_acs }, + { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs }, ++ { PCI_ANY_ID, PCI_ANY_ID, pcie_acs_overrides }, + { 0 } + }; + + + diff --git a/payload/acso-4.18.patch b/payload/acso-4.18.patch new file mode 100644 index 0000000..5061d92 --- /dev/null +++ b/payload/acso-4.18.patch @@ -0,0 +1,190 @@ +From: Josh Lay +Date: Fri, 12 Oct 2018 11:17:23 -0600 +Subject: [PATCH] pci: Enable overrides for missing ACS capabilities (4.18) + +This an updated version of Alex Williamson's patch from: +https://lkml.org/lkml/2013/5/30/513 + +To build on Fedora 28 kernels 4.18.x + +Original commit message follows: +--- +PCIe ACS (Access Control Services) is the PCIe 2.0+ feature that +allows us to control whether transactions are allowed to be redirected +in various subnodes of a PCIe topology. For instance, if two +endpoints are below a root port or downsteam switch port, the +downstream port may optionally redirect transactions between the +devices, bypassing upstream devices. The same can happen internally +on multifunction devices. The transaction may never be visible to the +upstream devices. + +One upstream device that we particularly care about is the IOMMU. If +a redirection occurs in the topology below the IOMMU, then the IOMMU +cannot provide isolation between devices. This is why the PCIe spec +encourages topologies to include ACS support. Without it, we have to +assume peer-to-peer DMA within a hierarchy can bypass IOMMU isolation. + +Unfortunately, far too many topologies do not support ACS to make this +a steadfast requirement. Even the latest chipsets from Intel are only +sporadically supporting ACS. We have trouble getting interconnect +vendors to include the PCIe spec required PCIe capability, let alone +suggested features. + +Therefore, we need to add some flexibility. The pcie_acs_override= +boot option lets users opt-in specific devices or sets of devices to +assume ACS support. The "downstream" option assumes full ACS support +on root ports and downstream switch ports. The "multifunction" +option assumes the subset of ACS features available on multifunction +endpoints and upstream switch ports are supported. The "id:nnnn:nnnn" +option enables ACS support on devices matching the provided vendor +and device IDs, allowing more strategic ACS overrides. These options +may be combined in any order. A maximum of 16 id specific overrides +are available. It's suggested to use the most limited set of options +necessary to avoid completely disabling ACS across the topology. +Note to hardware vendors, we have facilities to permanently quirk +specific devices which enforce isolation but not provide an ACS +capability. Please contact me to have your devices added and save +your customers the hassle of this boot option. + +Signed-off-by: Mark Weiman +--- +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index efc7aa7a0670..b5258db83441 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -3028,6 +3028,15 @@ + nomsi [MSI] If the PCI_MSI kernel config parameter is + enabled, this kernel boot option can be used to + disable the use of MSI interrupts system-wide. ++ pcie_acs_override = ++ [PCIE] Override missing PCIe ACS support for: ++ downstream ++ All downstream ports - full ACS capabilities ++ multfunction ++ All multifunction devices - multifunction ACS subset ++ id:nnnn:nnnn ++ Specfic device - full ACS capabilities ++ Specified as vid:did (vendor/device ID) in hex + noioapicquirk [APIC] Disable all boot interrupt quirks. + Safety option to keep boot IRQs enabled. This + should never be necessary. +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index f439de848658..6431f60a56f4 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3353,6 +3353,106 @@ static void quirk_no_bus_reset(struct pci_dev *dev) + dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET; + } + ++static bool acs_on_downstream; ++static bool acs_on_multifunction; ++ ++#define NUM_ACS_IDS 16 ++struct acs_on_id { ++ unsigned short vendor; ++ unsigned short device; ++}; ++static struct acs_on_id acs_on_ids[NUM_ACS_IDS]; ++static u8 max_acs_id; ++ ++static __init int pcie_acs_override_setup(char *p) ++{ ++ if (!p) ++ return -EINVAL; ++ ++ while (*p) { ++ if (!strncmp(p, "downstream", 10)) ++ acs_on_downstream = true; ++ if (!strncmp(p, "multifunction", 13)) ++ acs_on_multifunction = true; ++ if (!strncmp(p, "id:", 3)) { ++ char opt[5]; ++ int ret; ++ long val; ++ ++ if (max_acs_id >= NUM_ACS_IDS - 1) { ++ pr_warn("Out of PCIe ACS override slots (%d)\n", ++ NUM_ACS_IDS); ++ goto next; ++ } ++ ++ p += 3; ++ snprintf(opt, 5, "%s", p); ++ ret = kstrtol(opt, 16, &val); ++ if (ret) { ++ pr_warn("PCIe ACS ID parse error %d\n", ret); ++ goto next; ++ } ++ acs_on_ids[max_acs_id].vendor = val; ++ ++ p += strcspn(p, ":"); ++ if (*p != ':') { ++ pr_warn("PCIe ACS invalid ID\n"); ++ goto next; ++ } ++ ++ p++; ++ snprintf(opt, 5, "%s", p); ++ ret = kstrtol(opt, 16, &val); ++ if (ret) { ++ pr_warn("PCIe ACS ID parse error %d\n", ret); ++ goto next; ++ } ++ acs_on_ids[max_acs_id].device = val; ++ max_acs_id++; ++ } ++next: ++ p += strcspn(p, ","); ++ if (*p == ',') ++ p++; ++ } ++ ++ if (acs_on_downstream || acs_on_multifunction || max_acs_id) ++ pr_warn("Warning: PCIe ACS overrides enabled; This may allow non-IOMMU protected peer-to-peer DMA\n"); ++ ++ return 0; ++} ++early_param("pcie_acs_override", pcie_acs_override_setup); ++ ++static int pcie_acs_overrides(struct pci_dev *dev, u16 acs_flags) ++{ ++ int i; ++ ++ /* Never override ACS for legacy devices or devices with ACS caps */ ++ if (!pci_is_pcie(dev) || ++ pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS)) ++ return -ENOTTY; ++ ++ for (i = 0; i < max_acs_id; i++) ++ if (acs_on_ids[i].vendor == dev->vendor && ++ acs_on_ids[i].device == dev->device) ++ return 1; ++ ++ switch (pci_pcie_type(dev)) { ++ case PCI_EXP_TYPE_DOWNSTREAM: ++ case PCI_EXP_TYPE_ROOT_PORT: ++ if (acs_on_downstream) ++ return 1; ++ break; ++ case PCI_EXP_TYPE_ENDPOINT: ++ case PCI_EXP_TYPE_UPSTREAM: ++ case PCI_EXP_TYPE_LEG_END: ++ case PCI_EXP_TYPE_RC_END: ++ if (acs_on_multifunction && dev->multifunction) ++ return 1; ++ } ++ ++ return -ENOTTY; ++} + /* + * Some Atheros AR9xxx and QCA988x chips do not behave after a bus reset. + * The device will throw a Link Down error on AER-capable systems and +@@ -4395,6 +4495,7 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_AMPERE, 0xE00A, pci_quirk_xgene_acs }, + { PCI_VENDOR_ID_AMPERE, 0xE00B, pci_quirk_xgene_acs }, + { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs }, ++ { PCI_ANY_ID, PCI_ANY_ID, pcie_acs_overrides }, + { 0 } + }; + + diff --git a/payload/add-acs-overrides.patch b/payload/add-acs-overrides.patch new file mode 100644 index 0000000..1b646e0 --- /dev/null +++ b/payload/add-acs-overrides.patch @@ -0,0 +1,196 @@ +From 8afeb76790377fe42c4c91c9cb7d311078e9a7ae Mon Sep 17 00:00:00 2001 +From: Mark Weiman +Date: Fri, 20 Apr 2018 13:17:23 -0400 +Subject: [PATCH] pci: Enable overrides for missing ACS capabilities (4.16) + +This an updated version of Alex Williamson's patch from: +https://lkml.org/lkml/2013/5/30/513 + +Original commit message follows: +--- +PCIe ACS (Access Control Services) is the PCIe 2.0+ feature that +allows us to control whether transactions are allowed to be redirected +in various subnodes of a PCIe topology. For instance, if two +endpoints are below a root port or downsteam switch port, the +downstream port may optionally redirect transactions between the +devices, bypassing upstream devices. The same can happen internally +on multifunction devices. The transaction may never be visible to the +upstream devices. + +One upstream device that we particularly care about is the IOMMU. If +a redirection occurs in the topology below the IOMMU, then the IOMMU +cannot provide isolation between devices. This is why the PCIe spec +encourages topologies to include ACS support. Without it, we have to +assume peer-to-peer DMA within a hierarchy can bypass IOMMU isolation. + +Unfortunately, far too many topologies do not support ACS to make this +a steadfast requirement. Even the latest chipsets from Intel are only +sporadically supporting ACS. We have trouble getting interconnect +vendors to include the PCIe spec required PCIe capability, let alone +suggested features. + +Therefore, we need to add some flexibility. The pcie_acs_override= +boot option lets users opt-in specific devices or sets of devices to +assume ACS support. The "downstream" option assumes full ACS support +on root ports and downstream switch ports. The "multifunction" +option assumes the subset of ACS features available on multifunction +endpoints and upstream switch ports are supported. The "id:nnnn:nnnn" +option enables ACS support on devices matching the provided vendor +and device IDs, allowing more strategic ACS overrides. These options +may be combined in any order. A maximum of 16 id specific overrides +are available. It's suggested to use the most limited set of options +necessary to avoid completely disabling ACS across the topology. +Note to hardware vendors, we have facilities to permanently quirk +specific devices which enforce isolation but not provide an ACS +capability. Please contact me to have your devices added and save +your customers the hassle of this boot option. + +Signed-off-by: Mark Weiman +--- + .../admin-guide/kernel-parameters.txt | 9 ++ + drivers/pci/quirks.c | 101 ++++++++++++++++++ + 2 files changed, 110 insertions(+) + +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 1d1d53f85ddd..fa7110ca99e2 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -2983,6 +2983,15 @@ + nomsi [MSI] If the PCI_MSI kernel config parameter is + enabled, this kernel boot option can be used to + disable the use of MSI interrupts system-wide. ++ pci_acs_override = ++ [PCIE] Override missing PCIe ACS support for: ++ downstream ++ All downstream ports - full ACS capabilities ++ multifunction ++ Add multifunction devices - multifunction ACS subset ++ id:nnnn:nnnn ++ Specific device - full ACS capabilities ++ Specified as vid:did (vendor/device ID) in hex + noioapicquirk [APIC] Disable all boot interrupt quirks. + Safety option to keep boot IRQs enabled. This + should never be necessary. +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 46d47bd6ca1f..90aaf6ae8544 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3687,6 +3687,106 @@ static int __init pci_apply_final_quirks(void) + + fs_initcall_sync(pci_apply_final_quirks); + ++static bool acs_on_downstream; ++static bool acs_on_multifunction; ++ ++#define NUM_ACS_IDS 16 ++struct acs_on_id { ++ unsigned short vendor; ++ unsigned short device; ++}; ++static struct acs_on_id acs_on_ids[NUM_ACS_IDS]; ++static u8 max_acs_id; ++ ++static __init int pcie_acs_override_setup(char *p) ++{ ++ if (!p) ++ return -EINVAL; ++ ++ while (*p) { ++ if (!strncmp(p, "downstream", 10)) ++ acs_on_downstream = true; ++ if (!strncmp(p, "multifunction", 13)) ++ acs_on_multifunction = true; ++ if (!strncmp(p, "id:", 3)) { ++ char opt[5]; ++ int ret; ++ long val; ++ ++ if (max_acs_id >= NUM_ACS_IDS - 1) { ++ pr_warn("Out of PCIe ACS override slots (%d)\n", ++ NUM_ACS_IDS); ++ goto next; ++ } ++ ++ p += 3; ++ snprintf(opt, 5, "%s", p); ++ ret = kstrtol(opt, 16, &val); ++ if (ret) { ++ pr_warn("PCIe ACS ID parse error %d\n", ret); ++ goto next; ++ } ++ acs_on_ids[max_acs_id].vendor = val; ++ p += strcspn(p, ":"); ++ if (*p != ':') { ++ pr_warn("PCIe ACS invalid ID\n"); ++ goto next; ++ } ++ ++ p++; ++ snprintf(opt, 5, "%s", p); ++ ret = kstrtol(opt, 16, &val); ++ if (ret) { ++ pr_warn("PCIe ACS ID parse error %d\n", ret); ++ goto next; ++ } ++ acs_on_ids[max_acs_id].device = val; ++ max_acs_id++; ++ } ++next: ++ p += strcspn(p, ","); ++ if (*p == ',') ++ p++; ++ } ++ ++ if (acs_on_downstream || acs_on_multifunction || max_acs_id) ++ pr_warn("Warning: PCIe ACS overrides enabled; This may allow non-IOMMU protected peer-to-peer DMA\n"); ++ ++ return 0; ++} ++early_param("pcie_acs_override", pcie_acs_override_setup); ++ ++static int pcie_acs_overrides(struct pci_dev *dev, u16 acs_flags) ++{ ++ int i; ++ ++ /* Never override ACS for legacy devices or devices with ACS caps */ ++ if (!pci_is_pcie(dev) || ++ pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS)) ++ return -ENOTTY; ++ ++ for (i = 0; i < max_acs_id; i++) ++ if (acs_on_ids[i].vendor == dev->vendor && ++ acs_on_ids[i].device == dev->device) ++ return 1; ++ ++switch (pci_pcie_type(dev)) { ++ case PCI_EXP_TYPE_DOWNSTREAM: ++ case PCI_EXP_TYPE_ROOT_PORT: ++ if (acs_on_downstream) ++ return 1; ++ break; ++ case PCI_EXP_TYPE_ENDPOINT: ++ case PCI_EXP_TYPE_UPSTREAM: ++ case PCI_EXP_TYPE_LEG_END: ++ case PCI_EXP_TYPE_RC_END: ++ if (acs_on_multifunction && dev->multifunction) ++ return 1; ++ } ++ ++ return -ENOTTY; ++} ++ + /* + * Following are device-specific reset methods which can be used to + * reset a single function if other methods (e.g. FLR, PM D0->D3) are +@@ -4523,6 +4623,7 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs }, + /* APM X-Gene */ + { PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs }, ++ { PCI_ANY_ID, PCI_ANY_ID, pcie_acs_overrides }, + { 0 } + }; + +-- +2.17.0 + + diff --git a/playbook.yml b/playbook.yml new file mode 100644 index 0000000..b2918d1 --- /dev/null +++ b/playbook.yml @@ -0,0 +1,62 @@ +--- +- hosts: buildservers + vars: + fedora_version: f29 + patch_file: acso-4.18.patch # This patch file works with 4.19.12 Fedora srpms currently. + run_epoch: "{{ ansible_date_time.epoch }}" + build_dir: /tmp/{{ fedora_version }}_kernel + tasks: + - name: Ensure libselinux-python is installed + dnf: + name: libselinux-python + state: present + become: true + - name: Ensure fedpkg is installed + dnf: + name: fedpkg + state: present + become: true + - name: Find old mock chroots + find: + paths: /var/lib/mock/ + patterns: "*" + file_type: directory + recurse: yes + register: chroots_to_delete + - name: Clean old mock chroots + file: + path: "{{ item.path }}" + state: absent + with_items: "{{ chroots_to_delete.files }}" + become: true + - name: Clean old build dir + file: + path: "{{ build_dir }}" + state: absent + become: true + - name: Clone {{ fedora_version }} kernel to {{ build_dir }} + shell: fedpkg clone -a -b {{ fedora_version }} kernel {{ build_dir }} + - name: Copy patch to build dir + copy: + src: payload/{{ patch_file }} + dest: "{{ build_dir }}" + - name: Apply patch and build kernel (logs in {{ build_dir }}/results_kernel/*) + command: "{{ item }} chdir={{ build_dir }}" + with_items: + - ./scripts/newpatch.sh {{ patch_file }} + - /usr/bin/sed -i -e 's/%define buildid .*$/%define buildid .acspatch/' kernel.spec + - /usr/bin/make release + - fedpkg mockbuild + become: true + - name: Find RPMs in {{ build_dir }}/results_kernel/*/*/*.rpm + find: + paths: "{{ build_dir }}/results_kernel/" + recurse: yes + patterns: '*.rpm' + register: rpms + - name: Copy RPMs to /tmp/ (local) + fetch: + src: "{{ item.path }}" + dest: /tmp/ + flat: yes + with_items: "{{ rpms.files }}"