December 2024 - Linux-stable-mirror

[PATCH] iommu/vt-d: Fix kernel NULL pointer dereference in cache_tag_flush_range_np()

by Zhenzhong Duan

When setup mapping on an paging domain before the domain is attached to any device, a NULL pointer dereference triggers as below: BUG: kernel NULL pointer dereference, address: 0000000000000200 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page RIP: 0010:cache_tag_flush_range_np+0x114/0x1f0 ... Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x80/0x150 ? do_user_addr_fault+0x5f/0x670 ? pfn_to_dma_pte+0xca/0x280 ? exc_page_fault+0x78/0x170 ? asm_exc_page_fault+0x22/0x30 ? cache_tag_flush_range_np+0x114/0x1f0 intel_iommu_iotlb_sync_map+0x16/0x20 iommu_map+0x59/0xd0 batch_to_domain+0x154/0x1e0 iopt_area_fill_domains+0x106/0x300 iopt_map_pages+0x1bc/0x290 iopt_map_user_pages+0xe8/0x1e0 ? xas_load+0x9/0xb0 iommufd_ioas_map+0xc9/0x1c0 iommufd_fops_ioctl+0xff/0x1b0 __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e qi_batch structure is allocated when domain is attached to a device for the first time, when a mapping is setup before that, qi_batch is referenced to do batched flush and trigger above issue. Fix it by checking qi_batch pointer and bypass batched flushing if no device is attached. Cc: stable(a)vger.kernel.org Fixes: 705c1cdf1e73 ("iommu/vt-d: Introduce batched cache invalidation") Signed-off-by: Zhenzhong Duan <zhenzhong.duan(a)intel.com> --- drivers/iommu/intel/cache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/intel/cache.c b/drivers/iommu/intel/cache.c index e5b89f728ad3..bb9dae9a7fba 100644 --- a/drivers/iommu/intel/cache.c +++ b/drivers/iommu/intel/cache.c @@ -264,7 +264,7 @@ static unsigned long calculate_psi_aligned_address(unsigned long start, static void qi_batch_flush_descs(struct intel_iommu *iommu, struct qi_batch *batch) { - if (!iommu || !batch->index) + if (!iommu || !batch || !batch->index) return; qi_submit_sync(iommu, batch->descs, batch->index, 0); -- 2.34.1

6 months, 2 weeks

4
6
0 0

ocfs2 broken for me in 6.6.y since 6.6.55

by Thomas Voegtle

Hi, ocfs2 on a drbd device, writing something to it, then unmount ends up in: [ 1135.766639] OCFS2: ERROR (device drbd0): ocfs2_block_group_clear_bits: Group descriptor # 4128768 has bit count 32256 but claims 33222 are freed. num_bits 996 [ 1135.766645] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 1135.766647] (umount,10751,3):_ocfs2_free_suballoc_bits:2490 ERROR: status = -30 [ 1135.766650] (umount,10751,3):_ocfs2_free_clusters:2573 ERROR: status = -30 [ 1135.766652] (umount,10751,3):ocfs2_sync_local_to_main:1027 ERROR: status = -30 [ 1135.766654] (umount,10751,3):ocfs2_sync_local_to_main:1032 ERROR: status = -30 [ 1135.766656] (umount,10751,3):ocfs2_shutdown_local_alloc:449 ERROR: status = -30 [ 1135.965908] ocfs2: Unmounting device (147,0) on (node 2) This is since 6.6.55, reverting this patch helps: commit e7a801014726a691d4aa6e3839b3f0940ea41591 Author: Heming Zhao <heming.zhao(a)suse.com> Date: Fri Jul 19 19:43:10 2024 +0800 ocfs2: fix the la space leak when unmounting an ocfs2 volume commit dfe6c5692fb525e5e90cefe306ee0dffae13d35f upstream. Linux 6.1.119 is also broken, but 6.12.4 is fine. I guess there is something missing? Thomas

6 months, 2 weeks

4
7
0 0

[PATCH] drm/fbdev-dma: Add shadow buffering for deferred I/O

by Thomas Zimmermann

DMA areas are not necessarily backed by struct page, so we cannot rely on it for deferred I/O. Allocate a shadow buffer for drivers that require deferred I/O and use it as framebuffer memory. Fixes driver errors about being "Unable to handle kernel NULL pointer dereference at virtual address" or "Unable to handle kernel paging request at virtual address". The patch splits drm_fbdev_dma_driver_fbdev_probe() in an initial allocation, which creates the DMA-backed buffer object, and a tail that sets up the fbdev data structures. There is a tail function for direct memory mappings and a tail function for deferred I/O with the shadow buffer. It is no longer possible to use deferred I/O without shadow buffer. It can be re-added if there exists a reliably test for usable struct page in the allocated DMA-backed buffer object. Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Reported-by: Nuno Gonçalves <nunojpg(a)gmail.com> CLoses: https://lore.kernel.org/dri-devel/CAEXMXLR55DziAMbv_+2hmLeH-jP96pmit6nhs6si… Tested-by: Nuno Gonçalves <nunojpg(a)gmail.com> Fixes: 5ab91447aa13 ("drm/tiny/ili9225: Use fbdev-dma") Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: <stable(a)vger.kernel.org> # v6.11+ --- drivers/gpu/drm/drm_fbdev_dma.c | 217 +++++++++++++++++++++++--------- 1 file changed, 155 insertions(+), 62 deletions(-) diff --git a/drivers/gpu/drm/drm_fbdev_dma.c b/drivers/gpu/drm/drm_fbdev_dma.c index b14b581c059d..02a516e77192 100644 --- a/drivers/gpu/drm/drm_fbdev_dma.c +++ b/drivers/gpu/drm/drm_fbdev_dma.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: MIT #include <linux/fb.h> +#include <linux/vmalloc.h> #include <drm/drm_drv.h> #include <drm/drm_fbdev_dma.h> @@ -70,37 +71,102 @@ static const struct fb_ops drm_fbdev_dma_fb_ops = { .fb_destroy = drm_fbdev_dma_fb_destroy, }; -FB_GEN_DEFAULT_DEFERRED_DMAMEM_OPS(drm_fbdev_dma, +FB_GEN_DEFAULT_DEFERRED_DMAMEM_OPS(drm_fbdev_dma_shadowed, drm_fb_helper_damage_range, drm_fb_helper_damage_area); -static int drm_fbdev_dma_deferred_fb_mmap(struct fb_info *info, struct vm_area_struct *vma) +static void drm_fbdev_dma_shadowed_fb_destroy(struct fb_info *info) { struct drm_fb_helper *fb_helper = info->par; - struct drm_framebuffer *fb = fb_helper->fb; - struct drm_gem_dma_object *dma = drm_fb_dma_get_gem_obj(fb, 0); + void *shadow = info->screen_buffer; + + if (!fb_helper->dev) + return; - if (!dma->map_noncoherent) - vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot); + if (info->fbdefio) + fb_deferred_io_cleanup(info); + drm_fb_helper_fini(fb_helper); + vfree(shadow); - return fb_deferred_io_mmap(info, vma); + drm_client_buffer_vunmap(fb_helper->buffer); + drm_client_framebuffer_delete(fb_helper->buffer); + drm_client_release(&fb_helper->client); + drm_fb_helper_unprepare(fb_helper); + kfree(fb_helper); } -static const struct fb_ops drm_fbdev_dma_deferred_fb_ops = { +static const struct fb_ops drm_fbdev_dma_shadowed_fb_ops = { .owner = THIS_MODULE, .fb_open = drm_fbdev_dma_fb_open, .fb_release = drm_fbdev_dma_fb_release, - __FB_DEFAULT_DEFERRED_OPS_RDWR(drm_fbdev_dma), + FB_DEFAULT_DEFERRED_OPS(drm_fbdev_dma_shadowed), DRM_FB_HELPER_DEFAULT_OPS, - __FB_DEFAULT_DEFERRED_OPS_DRAW(drm_fbdev_dma), - .fb_mmap = drm_fbdev_dma_deferred_fb_mmap, - .fb_destroy = drm_fbdev_dma_fb_destroy, + .fb_destroy = drm_fbdev_dma_shadowed_fb_destroy, }; /* * struct drm_fb_helper */ +static void drm_fbdev_dma_damage_blit_real(struct drm_fb_helper *fb_helper, + struct drm_clip_rect *clip, + struct iosys_map *dst) +{ + struct drm_framebuffer *fb = fb_helper->fb; + size_t offset = clip->y1 * fb->pitches[0]; + size_t len = clip->x2 - clip->x1; + unsigned int y; + void *src; + + switch (drm_format_info_bpp(fb->format, 0)) { + case 1: + offset += clip->x1 / 8; + len = DIV_ROUND_UP(len + clip->x1 % 8, 8); + break; + case 2: + offset += clip->x1 / 4; + len = DIV_ROUND_UP(len + clip->x1 % 4, 4); + break; + case 4: + offset += clip->x1 / 2; + len = DIV_ROUND_UP(len + clip->x1 % 2, 2); + break; + default: + offset += clip->x1 * fb->format->cpp[0]; + len *= fb->format->cpp[0]; + break; + } + + src = fb_helper->info->screen_buffer + offset; + iosys_map_incr(dst, offset); /* go to first pixel within clip rect */ + + for (y = clip->y1; y < clip->y2; y++) { + iosys_map_memcpy_to(dst, 0, src, len); + iosys_map_incr(dst, fb->pitches[0]); + src += fb->pitches[0]; + } +} + +static int drm_fbdev_dma_damage_blit(struct drm_fb_helper *fb_helper, + struct drm_clip_rect *clip) +{ + struct drm_client_buffer *buffer = fb_helper->buffer; + struct iosys_map dst; + + /* + * For fbdev emulation, we only have to protect against fbdev modeset + * operations. Nothing else will involve the client buffer's BO. So it + * is sufficient to acquire struct drm_fb_helper.lock here. + */ + mutex_lock(&fb_helper->lock); + + dst = buffer->map; + drm_fbdev_dma_damage_blit_real(fb_helper, clip, &dst); + + mutex_unlock(&fb_helper->lock); + + return 0; +} static int drm_fbdev_dma_helper_fb_dirty(struct drm_fb_helper *helper, struct drm_clip_rect *clip) { @@ -112,6 +178,10 @@ static int drm_fbdev_dma_helper_fb_dirty(struct drm_fb_helper *helper, return 0; if (helper->fb->funcs->dirty) { + ret = drm_fbdev_dma_damage_blit(helper, clip); + if (drm_WARN_ONCE(dev, ret, "Damage blitter failed: ret=%d\n", ret)) + return ret; + ret = helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, clip, 1); if (drm_WARN_ONCE(dev, ret, "Dirty helper failed: ret=%d\n", ret)) return ret; @@ -128,14 +198,80 @@ static const struct drm_fb_helper_funcs drm_fbdev_dma_helper_funcs = { * struct drm_fb_helper */ +static int drm_fbdev_dma_driver_fbdev_probe_tail(struct drm_fb_helper *fb_helper, + struct drm_fb_helper_surface_size *sizes) +{ + struct drm_device *dev = fb_helper->dev; + struct drm_client_buffer *buffer = fb_helper->buffer; + struct drm_gem_dma_object *dma_obj = to_drm_gem_dma_obj(buffer->gem); + struct drm_framebuffer *fb = fb_helper->fb; + struct fb_info *info = fb_helper->info; + struct iosys_map map = buffer->map; + + info->fbops = &drm_fbdev_dma_fb_ops; + + /* screen */ + info->flags |= FBINFO_VIRTFB; /* system memory */ + if (dma_obj->map_noncoherent) + info->flags |= FBINFO_READS_FAST; /* signal caching */ + info->screen_size = sizes->surface_height * fb->pitches[0]; + info->screen_buffer = map.vaddr; + if (!(info->flags & FBINFO_HIDE_SMEM_START)) { + if (!drm_WARN_ON(dev, is_vmalloc_addr(info->screen_buffer))) + info->fix.smem_start = page_to_phys(virt_to_page(info->screen_buffer)); + } + info->fix.smem_len = info->screen_size; + + return 0; +} + +static int drm_fbdev_dma_driver_fbdev_probe_tail_shadowed(struct drm_fb_helper *fb_helper, + struct drm_fb_helper_surface_size *sizes) +{ + struct drm_client_buffer *buffer = fb_helper->buffer; + struct fb_info *info = fb_helper->info; + size_t screen_size = buffer->gem->size; + void *screen_buffer; + int ret; + + /* + * Deferred I/O requires struct page for framebuffer memory, + * which is not guaranteed for all DMA ranges. We thus create + * a shadow buffer in system memory. + */ + screen_buffer = vzalloc(screen_size); + if (!screen_buffer) + return -ENOMEM; + + info->fbops = &drm_fbdev_dma_shadowed_fb_ops; + + /* screen */ + info->flags |= FBINFO_VIRTFB; /* system memory */ + info->flags |= FBINFO_READS_FAST; /* signal caching */ + info->screen_buffer = screen_buffer; + info->fix.smem_len = screen_size; + + fb_helper->fbdefio.delay = HZ / 20; + fb_helper->fbdefio.deferred_io = drm_fb_helper_deferred_io; + + info->fbdefio = &fb_helper->fbdefio; + ret = fb_deferred_io_init(info); + if (ret) + goto err_vfree; + + return 0; + +err_vfree: + vfree(screen_buffer); + return ret; +} + int drm_fbdev_dma_driver_fbdev_probe(struct drm_fb_helper *fb_helper, struct drm_fb_helper_surface_size *sizes) { struct drm_client_dev *client = &fb_helper->client; struct drm_device *dev = fb_helper->dev; - bool use_deferred_io = false; struct drm_client_buffer *buffer; - struct drm_gem_dma_object *dma_obj; struct drm_framebuffer *fb; struct fb_info *info; u32 format; @@ -152,19 +288,9 @@ int drm_fbdev_dma_driver_fbdev_probe(struct drm_fb_helper *fb_helper, sizes->surface_height, format); if (IS_ERR(buffer)) return PTR_ERR(buffer); - dma_obj = to_drm_gem_dma_obj(buffer->gem); fb = buffer->fb; - /* - * Deferred I/O requires struct page for framebuffer memory, - * which is not guaranteed for all DMA ranges. We thus only - * install deferred I/O if we have a framebuffer that requires - * it. - */ - if (fb->funcs->dirty) - use_deferred_io = true; - ret = drm_client_buffer_vmap(buffer, &map); if (ret) { goto err_drm_client_buffer_delete; @@ -185,45 +311,12 @@ int drm_fbdev_dma_driver_fbdev_probe(struct drm_fb_helper *fb_helper, drm_fb_helper_fill_info(info, fb_helper, sizes); - if (use_deferred_io) - info->fbops = &drm_fbdev_dma_deferred_fb_ops; + if (fb->funcs->dirty) + ret = drm_fbdev_dma_driver_fbdev_probe_tail_shadowed(fb_helper, sizes); else - info->fbops = &drm_fbdev_dma_fb_ops; - - /* screen */ - info->flags |= FBINFO_VIRTFB; /* system memory */ - if (dma_obj->map_noncoherent) - info->flags |= FBINFO_READS_FAST; /* signal caching */ - info->screen_size = sizes->surface_height * fb->pitches[0]; - info->screen_buffer = map.vaddr; - if (!(info->flags & FBINFO_HIDE_SMEM_START)) { - if (!drm_WARN_ON(dev, is_vmalloc_addr(info->screen_buffer))) - info->fix.smem_start = page_to_phys(virt_to_page(info->screen_buffer)); - } - info->fix.smem_len = info->screen_size; - - /* - * Only set up deferred I/O if the screen buffer supports - * it. If this disagrees with the previous test for ->dirty, - * mmap on the /dev/fb file might not work correctly. - */ - if (!is_vmalloc_addr(info->screen_buffer) && info->fix.smem_start) { - unsigned long pfn = info->fix.smem_start >> PAGE_SHIFT; - - if (drm_WARN_ON(dev, !pfn_to_page(pfn))) - use_deferred_io = false; - } - - /* deferred I/O */ - if (use_deferred_io) { - fb_helper->fbdefio.delay = HZ / 20; - fb_helper->fbdefio.deferred_io = drm_fb_helper_deferred_io; - - info->fbdefio = &fb_helper->fbdefio; - ret = fb_deferred_io_init(info); - if (ret) - goto err_drm_fb_helper_release_info; - } + ret = drm_fbdev_dma_driver_fbdev_probe_tail(fb_helper, sizes); + if (ret) + goto err_drm_fb_helper_release_info; return 0; -- 2.47.1

6 months, 2 weeks

3
2
0 0

Re: Patch "HID: bpf: Fix NKRO on Mistel MD770" has been added to the 6.6-stable tree

by Benjamin Tissoires

On Tue, Dec 10, 2024 at 10:00 PM Sasha Levin <sashal(a)kernel.org> wrote: > > This is a note to let you know that I've just added the patch titled > > HID: bpf: Fix NKRO on Mistel MD770 > > to the 6.6-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > hid-bpf-fix-nkro-on-mistel-md770.patch > and it can be found in the queue-6.6 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. Please drop this patch (and in all previous releases). Again, it makes no sense to backport any files in drivers/hid/bpf/progs on kernels before 6.11, and even then, it makes very little value as they are also tracked in a different userspace project (udev-hid-bpf). Cheers, Benjamin > > > > > commit ad2a792488fb4d41b30190360837022bfca634cf > Author: Benjamin Tissoires <bentiss(a)kernel.org> > Date: Thu Oct 17 18:34:58 2024 +0200 > > HID: bpf: Fix NKRO on Mistel MD770 > > [ Upstream commit 9bc089307e8dff7797233308372b4a90ce8f79be ] > > Mistel MD770 keyboard (using Holtek Semiconductor, Inc. controller) has > a quirk in report descriptor in one of its interfaces (more detail in > the source file). Fix up the descriptor to allow NKRO to work again. > > Tested by loading the BPF program and confirming that 8 simultaneous > keypresses work. > > Link: https://bugzilla.kernel.org/show_bug.cgi?id=218495 > Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/122 > Signed-off-by: Tatsuyuki Ishi <ishitatsuyuki(a)gmail.com> > Acked-by: Jiri Kosina <jkosina(a)suse.com> > Link: https://patch.msgid.link/20241017-import_bpf_6-13-v2-1-6a7acb89a97f@kernel.… > Signed-off-by: Benjamin Tissoires <bentiss(a)kernel.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/hid/bpf/progs/Mistel__MD770.bpf.c b/drivers/hid/bpf/progs/Mistel__MD770.bpf.c > new file mode 100644 > index 0000000000000..fb8b5a6968b12 > --- /dev/null > +++ b/drivers/hid/bpf/progs/Mistel__MD770.bpf.c > @@ -0,0 +1,154 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* Copyright (c) 2024 Tatsuyuki Ishi > + */ > + > +#include "vmlinux.h" > +#include "hid_bpf.h" > +#include "hid_bpf_helpers.h" > +#include <bpf/bpf_tracing.h> > + > +#define VID_HOLTEK 0x04D9 > +#define PID_MD770 0x0339 > +#define RDESC_SIZE 203 > + > +HID_BPF_CONFIG( > + HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, VID_HOLTEK, PID_MD770) > +); > + > +/* > + * The Mistel MD770 keyboard reports the first 6 simultaneous key presses > + * through the first interface, and anything beyond that through a second > + * interface. Unfortunately, the second interface's report descriptor has an > + * error, causing events to be malformed and ignored. This HID-BPF driver > + * fixes the descriptor to allow NKRO to work again. > + * > + * For reference, this is the original report descriptor: > + * > + * 0x05, 0x01, // Usage Page (Generic Desktop) 0 > + * 0x09, 0x80, // Usage (System Control) 2 > + * 0xa1, 0x01, // Collection (Application) 4 > + * 0x85, 0x01, // Report ID (1) 6 > + * 0x19, 0x81, // Usage Minimum (129) 8 > + * 0x29, 0x83, // Usage Maximum (131) 10 > + * 0x15, 0x00, // Logical Minimum (0) 12 > + * 0x25, 0x01, // Logical Maximum (1) 14 > + * 0x95, 0x03, // Report Count (3) 16 > + * 0x75, 0x01, // Report Size (1) 18 > + * 0x81, 0x02, // Input (Data,Var,Abs) 20 > + * 0x95, 0x01, // Report Count (1) 22 > + * 0x75, 0x05, // Report Size (5) 24 > + * 0x81, 0x01, // Input (Cnst,Arr,Abs) 26 > + * 0xc0, // End Collection 28 > + * 0x05, 0x0c, // Usage Page (Consumer Devices) 29 > + * 0x09, 0x01, // Usage (Consumer Control) 31 > + * 0xa1, 0x01, // Collection (Application) 33 > + * 0x85, 0x02, // Report ID (2) 35 > + * 0x15, 0x00, // Logical Minimum (0) 37 > + * 0x25, 0x01, // Logical Maximum (1) 39 > + * 0x95, 0x12, // Report Count (18) 41 > + * 0x75, 0x01, // Report Size (1) 43 > + * 0x0a, 0x83, 0x01, // Usage (AL Consumer Control Config) 45 > + * 0x0a, 0x8a, 0x01, // Usage (AL Email Reader) 48 > + * 0x0a, 0x92, 0x01, // Usage (AL Calculator) 51 > + * 0x0a, 0x94, 0x01, // Usage (AL Local Machine Browser) 54 > + * 0x09, 0xcd, // Usage (Play/Pause) 57 > + * 0x09, 0xb7, // Usage (Stop) 59 > + * 0x09, 0xb6, // Usage (Scan Previous Track) 61 > + * 0x09, 0xb5, // Usage (Scan Next Track) 63 > + * 0x09, 0xe2, // Usage (Mute) 65 > + * 0x09, 0xea, // Usage (Volume Down) 67 > + * 0x09, 0xe9, // Usage (Volume Up) 69 > + * 0x0a, 0x21, 0x02, // Usage (AC Search) 71 > + * 0x0a, 0x23, 0x02, // Usage (AC Home) 74 > + * 0x0a, 0x24, 0x02, // Usage (AC Back) 77 > + * 0x0a, 0x25, 0x02, // Usage (AC Forward) 80 > + * 0x0a, 0x26, 0x02, // Usage (AC Stop) 83 > + * 0x0a, 0x27, 0x02, // Usage (AC Refresh) 86 > + * 0x0a, 0x2a, 0x02, // Usage (AC Bookmarks) 89 > + * 0x81, 0x02, // Input (Data,Var,Abs) 92 > + * 0x95, 0x01, // Report Count (1) 94 > + * 0x75, 0x0e, // Report Size (14) 96 > + * 0x81, 0x01, // Input (Cnst,Arr,Abs) 98 > + * 0xc0, // End Collection 100 > + * 0x05, 0x01, // Usage Page (Generic Desktop) 101 > + * 0x09, 0x02, // Usage (Mouse) 103 > + * 0xa1, 0x01, // Collection (Application) 105 > + * 0x09, 0x01, // Usage (Pointer) 107 > + * 0xa1, 0x00, // Collection (Physical) 109 > + * 0x85, 0x03, // Report ID (3) 111 > + * 0x05, 0x09, // Usage Page (Button) 113 > + * 0x19, 0x01, // Usage Minimum (1) 115 > + * 0x29, 0x08, // Usage Maximum (8) 117 > + * 0x15, 0x00, // Logical Minimum (0) 119 > + * 0x25, 0x01, // Logical Maximum (1) 121 > + * 0x75, 0x01, // Report Size (1) 123 > + * 0x95, 0x08, // Report Count (8) 125 > + * 0x81, 0x02, // Input (Data,Var,Abs) 127 > + * 0x05, 0x01, // Usage Page (Generic Desktop) 129 > + * 0x09, 0x30, // Usage (X) 131 > + * 0x09, 0x31, // Usage (Y) 133 > + * 0x16, 0x01, 0x80, // Logical Minimum (-32767) 135 > + * 0x26, 0xff, 0x7f, // Logical Maximum (32767) 138 > + * 0x75, 0x10, // Report Size (16) 141 > + * 0x95, 0x02, // Report Count (2) 143 > + * 0x81, 0x06, // Input (Data,Var,Rel) 145 > + * 0x09, 0x38, // Usage (Wheel) 147 > + * 0x15, 0x81, // Logical Minimum (-127) 149 > + * 0x25, 0x7f, // Logical Maximum (127) 151 > + * 0x75, 0x08, // Report Size (8) 153 > + * 0x95, 0x01, // Report Count (1) 155 > + * 0x81, 0x06, // Input (Data,Var,Rel) 157 > + * 0x05, 0x0c, // Usage Page (Consumer Devices) 159 > + * 0x0a, 0x38, 0x02, // Usage (AC Pan) 161 > + * 0x95, 0x01, // Report Count (1) 164 > + * 0x81, 0x06, // Input (Data,Var,Rel) 166 > + * 0xc0, // End Collection 168 > + * 0xc0, // End Collection 169 > + * 0x05, 0x01, // Usage Page (Generic Desktop) 170 > + * 0x09, 0x06, // Usage (Keyboard) 172 > + * 0xa1, 0x01, // Collection (Application) 174 > + * 0x85, 0x04, // Report ID (4) 176 > + * 0x05, 0x07, // Usage Page (Keyboard) 178 > + * 0x95, 0x01, // Report Count (1) 180 > + * 0x75, 0x08, // Report Size (8) 182 > + * 0x81, 0x03, // Input (Cnst,Var,Abs) 184 > + * 0x95, 0xe8, // Report Count (232) 186 > + * 0x75, 0x01, // Report Size (1) 188 > + * 0x15, 0x00, // Logical Minimum (0) 190 > + * 0x25, 0x01, // Logical Maximum (1) 192 > + * 0x05, 0x07, // Usage Page (Keyboard) 194 > + * 0x19, 0x00, // Usage Minimum (0) 196 > + * 0x29, 0xe7, // Usage Maximum (231) 198 > + * 0x81, 0x00, // Input (Data,Arr,Abs) 200 <- change to 0x81, 0x02 (Data,Var,Abs) > + * 0xc0, // End Collection 202 > + */ > + > +SEC(HID_BPF_RDESC_FIXUP) > +int BPF_PROG(hid_rdesc_fixup_mistel_md770, struct hid_bpf_ctx *hctx) > +{ > + __u8 *data = hid_bpf_get_data(hctx, 0, HID_MAX_DESCRIPTOR_SIZE); > + > + if (!data) > + return 0; /* EPERM check */ > + > + if (data[201] == 0x00) > + data[201] = 0x02; > + > + return 0; > +} > + > +HID_BPF_OPS(mistel_md770) = { > + .hid_rdesc_fixup = (void *)hid_rdesc_fixup_mistel_md770, > +}; > + > +SEC("syscall") > +int probe(struct hid_bpf_probe_args *ctx) > +{ > + ctx->retval = ctx->rdesc_size != RDESC_SIZE; > + if (ctx->retval) > + ctx->retval = -EINVAL; > + > + return 0; > +} > + > +char _license[] SEC("license") = "GPL"; >

6 months, 2 weeks

2
1
0 0

Re: Patch "rtla/utils: Add idle state disabling via libcpupower" has been added to the 6.12-stable tree

by Tomas Glozar

út 10. 12. 2024 v 21:44 odesílatel Sasha Levin <sashal(a)kernel.org> napsal: > > This is a note to let you know that I've just added the patch titled > > rtla/utils: Add idle state disabling via libcpupower > > to the 6.12-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > rtla-utils-add-idle-state-disabling-via-libcpupower.patch > and it can be found in the queue-6.12 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. This is a part of a patchset implementing a new feature, rtla idle state disabling, see [1]. It seems it was included in this stable queue and also the one for 6.6 by mistake. Also, the patch by itself does not do anything, because it depends on preceding commits from the patchset to enable HAVE_LIBCPUPOWER_SUPPORT and on following commits to actually implement the functionality in the rtla command line interface. Perhaps AUTOSEL picked it due to some merge conflicts with other patches? I don't know of any though. [1] - https://lore.kernel.org/linux-trace-kernel/20241017140914.3200454-1-tglozar… > > > > commit 354bcd3b3efd600f4d23cee6898a6968659bb3a9 > Author: Tomas Glozar <tglozar(a)redhat.com> > Date: Thu Oct 17 16:09:11 2024 +0200 > > rtla/utils: Add idle state disabling via libcpupower > > [ Upstream commit 083d29d3784319e9e9fab3ac02683a7b26ae3480 ] > > Add functions to utils.c to disable idle states through functions of > libcpupower. This will serve as the basis for disabling idle states > per cpu when running timerlat. > > Link: https://lore.kernel.org/20241017140914.3200454-4-tglozar@redhat.com > Signed-off-by: Tomas Glozar <tglozar(a)redhat.com> > Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/tools/tracing/rtla/src/utils.c b/tools/tracing/rtla/src/utils.c > index 0735fcb827ed7..230f9fc7502dd 100644 > --- a/tools/tracing/rtla/src/utils.c > +++ b/tools/tracing/rtla/src/utils.c > @@ -4,6 +4,9 @@ > */ > > #define _GNU_SOURCE > +#ifdef HAVE_LIBCPUPOWER_SUPPORT > +#include <cpuidle.h> > +#endif /* HAVE_LIBCPUPOWER_SUPPORT */ > #include <dirent.h> > #include <stdarg.h> > #include <stdlib.h> > @@ -519,6 +522,153 @@ int set_cpu_dma_latency(int32_t latency) > return fd; > } > > +#ifdef HAVE_LIBCPUPOWER_SUPPORT > +static unsigned int **saved_cpu_idle_disable_state; > +static size_t saved_cpu_idle_disable_state_alloc_ctr; > + > +/* > + * save_cpu_idle_state_disable - save disable for all idle states of a cpu > + * > + * Saves the current disable of all idle states of a cpu, to be subsequently > + * restored via restore_cpu_idle_disable_state. > + * > + * Return: idle state count on success, negative on error > + */ > +int save_cpu_idle_disable_state(unsigned int cpu) > +{ > + unsigned int nr_states; > + unsigned int state; > + int disabled; > + int nr_cpus; > + > + nr_states = cpuidle_state_count(cpu); > + > + if (nr_states == 0) > + return 0; > + > + if (saved_cpu_idle_disable_state == NULL) { > + nr_cpus = sysconf(_SC_NPROCESSORS_CONF); > + saved_cpu_idle_disable_state = calloc(nr_cpus, sizeof(unsigned int *)); > + if (!saved_cpu_idle_disable_state) > + return -1; > + } > + > + saved_cpu_idle_disable_state[cpu] = calloc(nr_states, sizeof(unsigned int)); > + if (!saved_cpu_idle_disable_state[cpu]) > + return -1; > + saved_cpu_idle_disable_state_alloc_ctr++; > + > + for (state = 0; state < nr_states; state++) { > + disabled = cpuidle_is_state_disabled(cpu, state); > + if (disabled < 0) > + return disabled; > + saved_cpu_idle_disable_state[cpu][state] = disabled; > + } > + > + return nr_states; > +} > + > +/* > + * restore_cpu_idle_disable_state - restore disable for all idle states of a cpu > + * > + * Restores the current disable state of all idle states of a cpu that was > + * previously saved by save_cpu_idle_disable_state. > + * > + * Return: idle state count on success, negative on error > + */ > +int restore_cpu_idle_disable_state(unsigned int cpu) > +{ > + unsigned int nr_states; > + unsigned int state; > + int disabled; > + int result; > + > + nr_states = cpuidle_state_count(cpu); > + > + if (nr_states == 0) > + return 0; > + > + if (!saved_cpu_idle_disable_state) > + return -1; > + > + for (state = 0; state < nr_states; state++) { > + if (!saved_cpu_idle_disable_state[cpu]) > + return -1; > + disabled = saved_cpu_idle_disable_state[cpu][state]; > + result = cpuidle_state_disable(cpu, state, disabled); > + if (result < 0) > + return result; > + } > + > + free(saved_cpu_idle_disable_state[cpu]); > + saved_cpu_idle_disable_state[cpu] = NULL; > + saved_cpu_idle_disable_state_alloc_ctr--; > + if (saved_cpu_idle_disable_state_alloc_ctr == 0) { > + free(saved_cpu_idle_disable_state); > + saved_cpu_idle_disable_state = NULL; > + } > + > + return nr_states; > +} > + > +/* > + * free_cpu_idle_disable_states - free saved idle state disable for all cpus > + * > + * Frees the memory used for storing cpu idle state disable for all cpus > + * and states. > + * > + * Normally, the memory is freed automatically in > + * restore_cpu_idle_disable_state; this is mostly for cleaning up after an > + * error. > + */ > +void free_cpu_idle_disable_states(void) > +{ > + int cpu; > + int nr_cpus; > + > + if (!saved_cpu_idle_disable_state) > + return; > + > + nr_cpus = sysconf(_SC_NPROCESSORS_CONF); > + > + for (cpu = 0; cpu < nr_cpus; cpu++) { > + free(saved_cpu_idle_disable_state[cpu]); > + saved_cpu_idle_disable_state[cpu] = NULL; > + } > + > + free(saved_cpu_idle_disable_state); > + saved_cpu_idle_disable_state = NULL; > +} > + > +/* > + * set_deepest_cpu_idle_state - limit idle state of cpu > + * > + * Disables all idle states deeper than the one given in > + * deepest_state (assuming states with higher number are deeper). > + * > + * This is used to reduce the exit from idle latency. Unlike > + * set_cpu_dma_latency, it can disable idle states per cpu. > + * > + * Return: idle state count on success, negative on error > + */ > +int set_deepest_cpu_idle_state(unsigned int cpu, unsigned int deepest_state) > +{ > + unsigned int nr_states; > + unsigned int state; > + int result; > + > + nr_states = cpuidle_state_count(cpu); > + > + for (state = deepest_state + 1; state < nr_states; state++) { > + result = cpuidle_state_disable(cpu, state, 1); > + if (result < 0) > + return result; > + } > + > + return nr_states; > +} > +#endif /* HAVE_LIBCPUPOWER_SUPPORT */ > + > #define _STR(x) #x > #define STR(x) _STR(x) > > diff --git a/tools/tracing/rtla/src/utils.h b/tools/tracing/rtla/src/utils.h > index 99c9cf81bcd02..101d4799a0090 100644 > --- a/tools/tracing/rtla/src/utils.h > +++ b/tools/tracing/rtla/src/utils.h > @@ -66,6 +66,19 @@ int set_comm_sched_attr(const char *comm_prefix, struct sched_attr *attr); > int set_comm_cgroup(const char *comm_prefix, const char *cgroup); > int set_pid_cgroup(pid_t pid, const char *cgroup); > int set_cpu_dma_latency(int32_t latency); > +#ifdef HAVE_LIBCPUPOWER_SUPPORT > +int save_cpu_idle_disable_state(unsigned int cpu); > +int restore_cpu_idle_disable_state(unsigned int cpu); > +void free_cpu_idle_disable_states(void); > +int set_deepest_cpu_idle_state(unsigned int cpu, unsigned int state); > +static inline int have_libcpupower_support(void) { return 1; } > +#else > +static inline int save_cpu_idle_disable_state(unsigned int cpu) { return -1; } > +static inline int restore_cpu_idle_disable_state(unsigned int cpu) { return -1; } > +static inline void free_cpu_idle_disable_states(void) { } > +static inline int set_deepest_cpu_idle_state(unsigned int cpu, unsigned int state) { return -1; } > +static inline int have_libcpupower_support(void) { return 0; } > +#endif /* HAVE_LIBCPUPOWER_SUPPORT */ > int auto_house_keeping(cpu_set_t *monitored_cpus); > > #define ns_to_usf(x) (((double)x/1000)) > Tomas

6 months, 2 weeks

2
1
0 0

[PATCHv2] drm: zynqmp_dp: Fix integer overflow in zynqmp_dp_rate_get()

by Karol Przybylski

This patch fixes a potential integer overflow in the zynqmp_dp_rate_get() The issue comes up when the expression drm_dp_bw_code_to_link_rate(dp->test.bw_code) * 10000 is evaluated using 32-bit Now the constant is a compatible 64-bit type. Resolves coverity issues: CID 1636340 and CID 1635811 Signed-off-by: Karol Przybylski <karprzy7(a)gmail.com> Fixes: 28edaacb821c6 ("drm: zynqmp_dp: Add debugfs interface for compliance testing") --- drivers/gpu/drm/xlnx/zynqmp_dp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c index 25c5dc61e..56a261a40 100644 --- a/drivers/gpu/drm/xlnx/zynqmp_dp.c +++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c @@ -2190,7 +2190,7 @@ static int zynqmp_dp_rate_get(void *data, u64 *val) struct zynqmp_dp *dp = data; mutex_lock(&dp->lock); - *val = drm_dp_bw_code_to_link_rate(dp->test.bw_code) * 10000; + *val = drm_dp_bw_code_to_link_rate(dp->test.bw_code) * 10000ULL; mutex_unlock(&dp->lock); return 0; } -- 2.34.1

6 months, 2 weeks

2
1
0 0

[REGRESSION] ThinkPad L15 Gen 4 touchpad no longer works

by Ulrich Müller

After upgrading from 6.6.52 to 6.6.58, tapping on the touchpad stopped working. The problem is still present in 6.6.59. I see the following in dmesg output; the first line was not there previously: [ 2.129282] hid-multitouch 0018:27C6:01E0.0001: The byte is not expected for fixing the report descriptor. It's possible that the touchpad firmware is not suitable for applying the fix. got: 9 [ 2.137479] input: GXTP5140:00 27C6:01E0 as /devices/platform/AMDI0010:00/i2c-0/i2c-GXTP5140:00/0018:27C6:01E0.0001/input/input10 [ 2.137680] input: GXTP5140:00 27C6:01E0 as /devices/platform/AMDI0010:00/i2c-0/i2c-GXTP5140:00/0018:27C6:01E0.0001/input/input11 [ 2.137921] hid-multitouch 0018:27C6:01E0.0001: input,hidraw0: I2C HID v1.00 Mouse [GXTP5140:00 27C6:01E0] on i2c-GXTP5140:00 Hardware is a Lenovo ThinkPad L15 Gen 4. The problem goes away when reverting this commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… See also Gentoo bug report: https://bugs.gentoo.org/942797

6 months, 2 weeks

6
13
0 0

Stable inclusion

by Jens Axboe

Hi, Can you add the below to 6.1-stable? Thanks! commit 3181e22fb79910c7071e84a43af93ac89e8a7106 Author: Pavel Begunkov <asml.silence(a)gmail.com> Date: Mon Jan 9 14:46:10 2023 +0000 io_uring: wake up optimisations Commit 3181e22fb79910c7071e84a43af93ac89e8a7106 upstream. Flush completions is done either from the submit syscall or by the task_work, both are in the context of the submitter task, and when it goes for a single threaded rings like implied by ->task_complete, there won't be any waiters on ->cq_wait but the master task. That means that there can be no tasks sleeping on cq_wait while we run __io_submit_flush_completions() and so waking up can be skipped. Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/60ad9768ec74435a0ddaa6eec0ffa7729474f69f.16732742… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 4f0ae938b146..0b1361663267 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -582,6 +582,16 @@ static inline void __io_cq_unlock_post(struct io_ring_ctx *ctx) io_cqring_ev_posted(ctx); } +static inline void __io_cq_unlock_post_flush(struct io_ring_ctx *ctx) + __releases(ctx->completion_lock) +{ + io_commit_cqring(ctx); + spin_unlock(&ctx->completion_lock); + io_commit_cqring_flush(ctx); + if (!(ctx->flags & IORING_SETUP_DEFER_TASKRUN)) + __io_cqring_wake(ctx); +} + void io_cq_unlock_post(struct io_ring_ctx *ctx) { __io_cq_unlock_post(ctx); @@ -1339,7 +1349,7 @@ static void __io_submit_flush_completions(struct io_ring_ctx *ctx) if (!(req->flags & REQ_F_CQE_SKIP)) __io_fill_cqe_req(ctx, req); } - __io_cq_unlock_post(ctx); + __io_cq_unlock_post_flush(ctx); io_free_batch_list(ctx, state->compl_reqs.first); INIT_WQ_LIST(&state->compl_reqs); -- Jens Axboe

6 months, 2 weeks

2
1
0 0

[PATCH v3 3/6] arm64/kvm: Configure HYP TCR.PS/DS based on host stage1

by Ard Biesheuvel

From: Ard Biesheuvel <ardb(a)kernel.org> When the host stage1 is configured for LPA2, the value currently being programmed into TCR_EL2.T0SZ may be invalid unless LPA2 is configured at HYP as well. This means kvm_lpa2_is_enabled() is not the right condition to test when setting TCR_EL2.DS, as it will return false if LPA2 is only available for stage 1 but not for stage 2. Similary, programming TCR_EL2.PS based on a limited IPA range due to lack of stage2 LPA2 support could potentially result in problems. So use lpa2_is_enabled() instead, and set the PS field according to the host's IPS, which is capped at 48 bits if LPA2 support is absent or disabled. Whether or not we can make meaningful use of such a configuration is a different question. Cc: <stable(a)vger.kernel.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> --- arch/arm64/kvm/arm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index a102c3aebdbc..7b2735ad32e9 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -1990,8 +1990,7 @@ static int kvm_init_vector_slots(void) static void __init cpu_prepare_hyp_mode(int cpu, u32 hyp_va_bits) { struct kvm_nvhe_init_params *params = per_cpu_ptr_nvhe_sym(kvm_init_params, cpu); - u64 mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); - unsigned long tcr; + unsigned long tcr, ips; /* * Calculate the raw per-cpu offset without a translation from the @@ -2005,6 +2004,7 @@ static void __init cpu_prepare_hyp_mode(int cpu, u32 hyp_va_bits) params->mair_el2 = read_sysreg(mair_el1); tcr = read_sysreg(tcr_el1); + ips = FIELD_GET(TCR_IPS_MASK, tcr); if (cpus_have_final_cap(ARM64_KVM_HVHE)) { tcr |= TCR_EPD1_MASK; } else { @@ -2014,8 +2014,8 @@ static void __init cpu_prepare_hyp_mode(int cpu, u32 hyp_va_bits) tcr &= ~TCR_T0SZ_MASK; tcr |= TCR_T0SZ(hyp_va_bits); tcr &= ~TCR_EL2_PS_MASK; - tcr |= FIELD_PREP(TCR_EL2_PS_MASK, kvm_get_parange(mmfr0)); - if (kvm_lpa2_is_enabled()) + tcr |= FIELD_PREP(TCR_EL2_PS_MASK, ips); + if (lpa2_is_enabled()) tcr |= TCR_EL2_DS; params->tcr_el2 = tcr; -- 2.47.1.613.gc27f4b7a9f-goog

6 months, 2 weeks

1
0
0 0

[PATCH v3 2/6] arm64/mm: Override PARange for !LPA2 and use it consistently

by Ard Biesheuvel

From: Ard Biesheuvel <ardb(a)kernel.org> When FEAT_LPA{,2} are not implemented, the ID_AA64MMFR0_EL1.PARange and TCR.IPS values corresponding with 52-bit physical addressing are reserved. Setting the TCR.IPS field to 0b110 (52-bit physical addressing) has side effects, such as how the TTBRn_ELx.BADDR fields are interpreted, and so it is important that disabling FEAT_LPA2 (by overriding the ID_AA64MMFR0.TGran fields) also presents a PARange field consistent with that. So limit the field to 48 bits unless LPA2 is enabled, and update existing references to use the override consistently. Fixes: 352b0395b505 ("arm64: Enable 52-bit virtual addressing for 4k and 16k granule configs") Cc: <stable(a)vger.kernel.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> --- arch/arm64/include/asm/assembler.h | 5 +++++ arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/pi/idreg-override.c | 9 +++++++++ arch/arm64/kernel/pi/map_kernel.c | 6 ++++++ arch/arm64/mm/init.c | 7 ++++++- 5 files changed, 27 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h index 3d8d534a7a77..ad63457a05c5 100644 --- a/arch/arm64/include/asm/assembler.h +++ b/arch/arm64/include/asm/assembler.h @@ -343,6 +343,11 @@ alternative_cb_end // Narrow PARange to fit the PS field in TCR_ELx ubfx \tmp0, \tmp0, #ID_AA64MMFR0_EL1_PARANGE_SHIFT, #3 mov \tmp1, #ID_AA64MMFR0_EL1_PARANGE_MAX +#ifdef CONFIG_ARM64_LPA2 +alternative_if_not ARM64_HAS_VA52 + mov \tmp1, #ID_AA64MMFR0_EL1_PARANGE_48 +alternative_else_nop_endif +#endif cmp \tmp0, \tmp1 csel \tmp0, \tmp1, \tmp0, hi bfi \tcr, \tmp0, \pos, #3 diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 6ce71f444ed8..f8cb8a6ab98a 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -3478,7 +3478,7 @@ static void verify_hyp_capabilities(void) return; safe_mmfr1 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR1_EL1); - mmfr0 = read_cpuid(ID_AA64MMFR0_EL1); + mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); mmfr1 = read_cpuid(ID_AA64MMFR1_EL1); /* Verify VMID bits */ diff --git a/arch/arm64/kernel/pi/idreg-override.c b/arch/arm64/kernel/pi/idreg-override.c index 22159251eb3a..c6b185b885f7 100644 --- a/arch/arm64/kernel/pi/idreg-override.c +++ b/arch/arm64/kernel/pi/idreg-override.c @@ -83,6 +83,15 @@ static bool __init mmfr2_varange_filter(u64 val) id_aa64mmfr0_override.val |= (ID_AA64MMFR0_EL1_TGRAN_LPA2 - 1) << ID_AA64MMFR0_EL1_TGRAN_SHIFT; id_aa64mmfr0_override.mask |= 0xfU << ID_AA64MMFR0_EL1_TGRAN_SHIFT; + + /* + * Override PARange to 48 bits - the override will just be + * ignored if the actual PARange is smaller, but this is + * unlikely to be the case for LPA2 capable silicon. + */ + id_aa64mmfr0_override.val |= + ID_AA64MMFR0_EL1_PARANGE_48 << ID_AA64MMFR0_EL1_PARANGE_SHIFT; + id_aa64mmfr0_override.mask |= 0xfU << ID_AA64MMFR0_EL1_PARANGE_SHIFT; } #endif return true; diff --git a/arch/arm64/kernel/pi/map_kernel.c b/arch/arm64/kernel/pi/map_kernel.c index f374a3e5a5fe..e57b043f324b 100644 --- a/arch/arm64/kernel/pi/map_kernel.c +++ b/arch/arm64/kernel/pi/map_kernel.c @@ -136,6 +136,12 @@ static void noinline __section(".idmap.text") set_ttbr0_for_lpa2(u64 ttbr) { u64 sctlr = read_sysreg(sctlr_el1); u64 tcr = read_sysreg(tcr_el1) | TCR_DS; + u64 mmfr0 = read_sysreg(id_aa64mmfr0_el1); + u64 parange = cpuid_feature_extract_unsigned_field(mmfr0, + ID_AA64MMFR0_EL1_PARANGE_SHIFT); + + tcr &= ~TCR_IPS_MASK; + tcr |= parange << TCR_IPS_SHIFT; asm(" msr sctlr_el1, %0 ;" " isb ;" diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c index d21f67d67cf5..2b2289d55eaa 100644 --- a/arch/arm64/mm/init.c +++ b/arch/arm64/mm/init.c @@ -280,7 +280,12 @@ void __init arm64_memblock_init(void) if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) { extern u16 memstart_offset_seed; - u64 mmfr0 = read_cpuid(ID_AA64MMFR0_EL1); + + /* + * Use the sanitised version of id_aa64mmfr0_el1 so that linear + * map randomization can be enabled by shrinking the IPA space. + */ + u64 mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); int parange = cpuid_feature_extract_unsigned_field( mmfr0, ID_AA64MMFR0_EL1_PARANGE_SHIFT); s64 range = linear_region_size - -- 2.47.1.613.gc27f4b7a9f-goog

6 months, 2 weeks

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2024