[PATCH v9 0/6] s390/vfio-ap: Fix pre-existing bugs in vfio_ap device driver

[Anthony Krowiak <akrowiak@linux.ibm.com>]

This series fixes several pre-existing bugs in the vfio_ap device driver
code reported by AI.

Change log v8 => v9:
~~~~~~~~~~~~~~~~~~~
* Patch 1/6: Fix leaks of pinned NIB and registered GISC
  ~ In umap_iova(), do not free AQIC resources after the ZAPQ;
    If the reset succeeded, they will have been freed in
    apq_reset_check().
  ~ Fixed NIB and ISC kept after a failed reset are later released
    against a different vfio device or KVM
* Patch 3/6: Fix unbounded loop in apq_reset_check()
  ~ Removed elapsed = 0 in -EAGAIN case in apq_reset_check
  ~ Rearranged code to make ZAPQ re-issue condition reachable for 
    the case the previous ZAPQ returned AP_RESPONSE_RESET_IN_PROGRESS
    or AP_RESPONSE_STATE_CHANGE_IN_PROGRESS 
* Patch 5/6: fix queue state leakage to guest and host
  ~ Fixed vfio_ap_on_qstate_transition(): use-after-free of q against a
    concurrent unbind
  ~ Changed patch commit message to include comments about the 
    excessive amount of time for hundreds of simultaneous probes
* Patch 6/6: replace guest-reachable WARNs with ratelimited warnings
  ~ New guest-triggerable log messages in handle_pqap()
  ~ vfio_ap_le_guid_to_be_uuid(): no longer called in handle_pqap()
    because the UUID is derived from the mdev 

Anthony Krowiak (6):
  s390/vfio-ap: Fix leaks of pinned NIB and registered GISC
  s390/vfio-ap: Fix failure to release IRQ notification eventfd contexts
  s390/vfio-ap: Fix unbounded loop in apq_reset_check()
  s390/vfio-ap: Use AP_DOMAINS for adm_add bitmap size in
    vfio_ap_mdev_cfg_add()
  s390/vfio-ap: fix queue state leakage to guest and host
  s390/vfio-ap: replace guest-reachable WARNs with ratelimited warnings

 drivers/s390/crypto/ap_bus.c          |  51 ++
 drivers/s390/crypto/ap_bus.h          |  33 +
 drivers/s390/crypto/vfio_ap_drv.c     |   1 +
 drivers/s390/crypto/vfio_ap_ops.c     | 912 ++++++++++++++++++++------
 drivers/s390/crypto/vfio_ap_private.h |  51 +-
 5 files changed, 846 insertions(+), 202 deletions(-)

-- 
2.53.0