The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 5d187c0454ef4c5e046a81af36882d4d515922ec Mon Sep 17 00:00:00 2001
From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
Date: Thu, 6 Aug 2020 19:46:23 -0700
Subject: [PATCH] usb: dwc3: gadget: Don't setup more than requested
The SG list may be set up with entry size more than the requested
length. Check the usb_request->length and make sure that we don't setup
the TRBs to send/receive more than requested. This case may occur when
the SG entry is allocated up to a certain minimum size, but the request
length is less than that. It can also occur when the request is reused
for a different request length.
Cc: <stable(a)vger.kernel.org> # v4.18+
Fixes: a31e63b608ff ("usb: dwc3: gadget: Correct handling of scattergather lists")
Signed-off-by: Thinh Nguyen <thinhn(a)synopsys.com>
Signed-off-by: Felipe Balbi <balbi(a)kernel.org>
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index e44bfc3b5096..f9231253cbed 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1054,27 +1054,25 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
* dwc3_prepare_one_trb - setup one TRB from one request
* @dep: endpoint for which this request is prepared
* @req: dwc3_request pointer
+ * @trb_length: buffer size of the TRB
* @chain: should this TRB be chained to the next?
* @node: only for isochronous endpoints. First TRB needs different type.
*/
static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
- struct dwc3_request *req, unsigned chain, unsigned node)
+ struct dwc3_request *req, unsigned int trb_length,
+ unsigned chain, unsigned node)
{
struct dwc3_trb *trb;
- unsigned int length;
dma_addr_t dma;
unsigned stream_id = req->request.stream_id;
unsigned short_not_ok = req->request.short_not_ok;
unsigned no_interrupt = req->request.no_interrupt;
unsigned is_last = req->request.is_last;
- if (req->request.num_sgs > 0) {
- length = sg_dma_len(req->start_sg);
+ if (req->request.num_sgs > 0)
dma = sg_dma_address(req->start_sg);
- } else {
- length = req->request.length;
+ else
dma = req->request.dma;
- }
trb = &dep->trb_pool[dep->trb_enqueue];
@@ -1086,7 +1084,7 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
req->num_trbs++;
- __dwc3_prepare_one_trb(dep, trb, dma, length, chain, node,
+ __dwc3_prepare_one_trb(dep, trb, dma, trb_length, chain, node,
stream_id, short_not_ok, no_interrupt, is_last);
}
@@ -1096,16 +1094,27 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
struct scatterlist *sg = req->start_sg;
struct scatterlist *s;
int i;
-
+ unsigned int length = req->request.length;
unsigned int remaining = req->request.num_mapped_sgs
- req->num_queued_sgs;
+ /*
+ * If we resume preparing the request, then get the remaining length of
+ * the request and resume where we left off.
+ */
+ for_each_sg(req->request.sg, s, req->num_queued_sgs, i)
+ length -= sg_dma_len(s);
+
for_each_sg(sg, s, remaining, i) {
- unsigned int length = req->request.length;
unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
unsigned int rem = length % maxp;
+ unsigned int trb_length;
unsigned chain = true;
+ trb_length = min_t(unsigned int, length, sg_dma_len(s));
+
+ length -= trb_length;
+
/*
* IOMMU driver is coalescing the list of sgs which shares a
* page boundary into one and giving it to USB driver. With
@@ -1113,7 +1122,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
* sgs passed. So mark the chain bit to false if it isthe last
* mapped sg.
*/
- if (i == remaining - 1)
+ if ((i == remaining - 1) || !length)
chain = false;
if (rem && usb_endpoint_dir_out(dep->endpoint.desc) && !chain) {
@@ -1123,7 +1132,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
req->needs_extra_trb = true;
/* prepare normal TRB */
- dwc3_prepare_one_trb(dep, req, true, i);
+ dwc3_prepare_one_trb(dep, req, trb_length, true, i);
/* Now prepare one extra TRB to align transfer size */
trb = &dep->trb_pool[dep->trb_enqueue];
@@ -1135,7 +1144,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
req->request.no_interrupt,
req->request.is_last);
} else {
- dwc3_prepare_one_trb(dep, req, chain, i);
+ dwc3_prepare_one_trb(dep, req, trb_length, chain, i);
}
/*
@@ -1150,6 +1159,16 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
req->num_queued_sgs++;
+ /*
+ * The number of pending SG entries may not correspond to the
+ * number of mapped SG entries. If all the data are queued, then
+ * don't include unused SG entries.
+ */
+ if (length == 0) {
+ req->num_pending_sgs -= req->request.num_mapped_sgs - req->num_queued_sgs;
+ break;
+ }
+
if (!dwc3_calc_trbs_left(dep))
break;
}
@@ -1169,7 +1188,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
req->needs_extra_trb = true;
/* prepare normal TRB */
- dwc3_prepare_one_trb(dep, req, true, 0);
+ dwc3_prepare_one_trb(dep, req, length, true, 0);
/* Now prepare one extra TRB to align transfer size */
trb = &dep->trb_pool[dep->trb_enqueue];
@@ -1187,7 +1206,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
req->needs_extra_trb = true;
/* prepare normal TRB */
- dwc3_prepare_one_trb(dep, req, true, 0);
+ dwc3_prepare_one_trb(dep, req, length, true, 0);
/* Now prepare one extra TRB to handle ZLP */
trb = &dep->trb_pool[dep->trb_enqueue];
@@ -1198,7 +1217,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
req->request.no_interrupt,
req->request.is_last);
} else {
- dwc3_prepare_one_trb(dep, req, false, 0);
+ dwc3_prepare_one_trb(dep, req, length, false, 0);
}
}
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e5f10d6385cda083037915c12b130887c8831d2b Mon Sep 17 00:00:00 2001
From: Mika Kuoppala <mika.kuoppala(a)linux.intel.com>
Date: Mon, 17 Aug 2020 22:59:26 +0300
Subject: [PATCH] drm/i915: Fix cmd parser desc matching with masks
Our variety of defined gpu commands have the actual
command id field and possibly length and flags applied.
We did start to apply the mask during initialization of
the cmd descriptors but forgot to also apply it on comparisons.
Fix comparisons in order to properly deny access with
associated commands.
v2: fix lri with correct mask (Chris)
References: 926abff21a8f ("drm/i915/cmdparser: Ignore Length operands during command matching")
Reported-by: Nicolai Stange <nstange(a)suse.de>
Cc: stable(a)vger.kernel.org # v5.4+
Cc: Miroslav Benes <mbenes(a)suse.cz>
Cc: Takashi Iwai <tiwai(a)suse.de>
Cc: Tyler Hicks <tyhicks(a)canonical.com>
Cc: Jon Bloomfield <jon.bloomfield(a)intel.com>
Cc: Chris Wilson <chris.p.wilson(a)intel.com>
Signed-off-by: Mika Kuoppala <mika.kuoppala(a)linux.intel.com>
Reviewed-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20200817195926.12671-1-mika.k…
(cherry picked from commit 3b4efa148da36f158cce3f662e831af2834b8e0f)
Signed-off-by: Jani Nikula <jani.nikula(a)intel.com>
diff --git a/drivers/gpu/drm/i915/i915_cmd_parser.c b/drivers/gpu/drm/i915/i915_cmd_parser.c
index 372354d33f55..5ac4a999f05a 100644
--- a/drivers/gpu/drm/i915/i915_cmd_parser.c
+++ b/drivers/gpu/drm/i915/i915_cmd_parser.c
@@ -1204,6 +1204,12 @@ static u32 *copy_batch(struct drm_i915_gem_object *dst_obj,
return dst;
}
+static inline bool cmd_desc_is(const struct drm_i915_cmd_descriptor * const desc,
+ const u32 cmd)
+{
+ return desc->cmd.value == (cmd & desc->cmd.mask);
+}
+
static bool check_cmd(const struct intel_engine_cs *engine,
const struct drm_i915_cmd_descriptor *desc,
const u32 *cmd, u32 length)
@@ -1242,19 +1248,19 @@ static bool check_cmd(const struct intel_engine_cs *engine,
* allowed mask/value pair given in the whitelist entry.
*/
if (reg->mask) {
- if (desc->cmd.value == MI_LOAD_REGISTER_MEM) {
+ if (cmd_desc_is(desc, MI_LOAD_REGISTER_MEM)) {
DRM_DEBUG("CMD: Rejected LRM to masked register 0x%08X\n",
reg_addr);
return false;
}
- if (desc->cmd.value == MI_LOAD_REGISTER_REG) {
+ if (cmd_desc_is(desc, MI_LOAD_REGISTER_REG)) {
DRM_DEBUG("CMD: Rejected LRR to masked register 0x%08X\n",
reg_addr);
return false;
}
- if (desc->cmd.value == MI_LOAD_REGISTER_IMM(1) &&
+ if (cmd_desc_is(desc, MI_LOAD_REGISTER_IMM(1)) &&
(offset + 2 > length ||
(cmd[offset + 1] & reg->mask) != reg->value)) {
DRM_DEBUG("CMD: Rejected LRI to masked register 0x%08X\n",
@@ -1478,7 +1484,7 @@ int intel_engine_cmd_parser(struct intel_engine_cs *engine,
break;
}
- if (desc->cmd.value == MI_BATCH_BUFFER_START) {
+ if (cmd_desc_is(desc, MI_BATCH_BUFFER_START)) {
ret = check_bbstart(cmd, offset, length, batch_length,
batch_addr, shadow_addr,
jump_whitelist);
This is a note to let you know that I've just added the patch titled
iio: adc: mcp3422: fix locking scope
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 3f1093d83d7164e4705e4232ccf76da54adfda85 Mon Sep 17 00:00:00 2001
From: Angelo Compagnucci <angelo.compagnucci(a)gmail.com>
Date: Wed, 19 Aug 2020 09:55:25 +0200
Subject: iio: adc: mcp3422: fix locking scope
Locking should be held for the entire reading sequence involving setting
the channel, waiting for the channel switch and reading from the
channel.
If not, reading from a channel can result mixing with the reading from
another channel.
Fixes: 07914c84ba30 ("iio: adc: Add driver for Microchip MCP3422/3/4 high resolution ADC")
Signed-off-by: Angelo Compagnucci <angelo.compagnucci(a)gmail.com>
Link: https://lore.kernel.org/r/20200819075525.1395248-1-angelo.compagnucci@gmail…
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
---
drivers/iio/adc/mcp3422.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
index 5f1706d1c3c0..219adac2384b 100644
--- a/drivers/iio/adc/mcp3422.c
+++ b/drivers/iio/adc/mcp3422.c
@@ -96,16 +96,12 @@ static int mcp3422_update_config(struct mcp3422 *adc, u8 newconfig)
{
int ret;
- mutex_lock(&adc->lock);
-
ret = i2c_master_send(adc->i2c, &newconfig, 1);
if (ret > 0) {
adc->config = newconfig;
ret = 0;
}
- mutex_unlock(&adc->lock);
-
return ret;
}
@@ -138,6 +134,8 @@ static int mcp3422_read_channel(struct mcp3422 *adc,
u8 config;
u8 req_channel = channel->channel;
+ mutex_lock(&adc->lock);
+
if (req_channel != MCP3422_CHANNEL(adc->config)) {
config = adc->config;
config &= ~MCP3422_CHANNEL_MASK;
@@ -150,7 +148,11 @@ static int mcp3422_read_channel(struct mcp3422 *adc,
msleep(mcp3422_read_times[MCP3422_SAMPLE_RATE(adc->config)]);
}
- return mcp3422_read(adc, value, &config);
+ ret = mcp3422_read(adc, value, &config);
+
+ mutex_unlock(&adc->lock);
+
+ return ret;
}
static int mcp3422_read_raw(struct iio_dev *iio,
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio:adc:max1118 Fix alignment of timestamp and data leak issues
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From db8f06d97ec284dc018e2e4890d2e5035fde8630 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Wed, 22 Jul 2020 16:51:03 +0100
Subject: iio:adc:max1118 Fix alignment of timestamp and data leak issues
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc so no data can leak apart
from previous readings.
The explicit alignment of ts is necessary to ensure correct padding
on architectures where s64 is only 4 bytes aligned such as x86_32.
Fixes: a9e9c7153e96 ("iio: adc: add max1117/max1118/max1119 ADC driver")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Cc: Akinobu Mita <akinobu.mita(a)gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Cc: <Stable(a)vger.kernel.org>
---
drivers/iio/adc/max1118.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/adc/max1118.c b/drivers/iio/adc/max1118.c
index 01b20e420ac4..6efb0b43d938 100644
--- a/drivers/iio/adc/max1118.c
+++ b/drivers/iio/adc/max1118.c
@@ -36,6 +36,11 @@ struct max1118 {
struct spi_device *spi;
struct mutex lock;
struct regulator *reg;
+ /* Ensure natural alignment of buffer elements */
+ struct {
+ u8 channels[2];
+ s64 ts __aligned(8);
+ } scan;
u8 data ____cacheline_aligned;
};
@@ -166,7 +171,6 @@ static irqreturn_t max1118_trigger_handler(int irq, void *p)
struct iio_poll_func *pf = p;
struct iio_dev *indio_dev = pf->indio_dev;
struct max1118 *adc = iio_priv(indio_dev);
- u8 data[16] = { }; /* 2x 8-bit ADC data + padding + 8 bytes timestamp */
int scan_index;
int i = 0;
@@ -184,10 +188,10 @@ static irqreturn_t max1118_trigger_handler(int irq, void *p)
goto out;
}
- data[i] = ret;
+ adc->scan.channels[i] = ret;
i++;
}
- iio_push_to_buffers_with_timestamp(indio_dev, data,
+ iio_push_to_buffers_with_timestamp(indio_dev, &adc->scan,
iio_get_time_ns(indio_dev));
out:
mutex_unlock(&adc->lock);
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio:adc:ina2xx Fix timestamp alignment issue.
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From f8cd222feb82ecd82dcf610fcc15186f55f9c2b5 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Wed, 22 Jul 2020 16:51:02 +0100
Subject: iio:adc:ina2xx Fix timestamp alignment issue.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses a 32 byte array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv() data with alignment
explicitly requested. This data is allocated with kzalloc so no
data can leak apart from previous readings. The explicit alignment
isn't technically needed here, but it reduced fragility and avoids
cut and paste into drivers where it will be needed.
If we want this in older stables will need manual backport due to
driver reworks.
Fixes: c43a102e67db ("iio: ina2xx: add support for TI INA2xx Power Monitors")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Cc: Stefan Brüns <stefan.bruens(a)rwth-aachen.de>
Cc: Marc Titinger <mtitinger(a)baylibre.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Cc: <Stable(a)vger.kernel.org>
---
drivers/iio/adc/ina2xx-adc.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/iio/adc/ina2xx-adc.c b/drivers/iio/adc/ina2xx-adc.c
index 5ed63e874292..b573ec60a8b8 100644
--- a/drivers/iio/adc/ina2xx-adc.c
+++ b/drivers/iio/adc/ina2xx-adc.c
@@ -146,6 +146,11 @@ struct ina2xx_chip_info {
int range_vbus; /* Bus voltage maximum in V */
int pga_gain_vshunt; /* Shunt voltage PGA gain */
bool allow_async_readout;
+ /* data buffer needs space for channel data and timestamp */
+ struct {
+ u16 chan[4];
+ u64 ts __aligned(8);
+ } scan;
};
static const struct ina2xx_config ina2xx_config[] = {
@@ -738,8 +743,6 @@ static int ina2xx_conversion_ready(struct iio_dev *indio_dev)
static int ina2xx_work_buffer(struct iio_dev *indio_dev)
{
struct ina2xx_chip_info *chip = iio_priv(indio_dev);
- /* data buffer needs space for channel data and timestap */
- unsigned short data[4 + sizeof(s64)/sizeof(short)];
int bit, ret, i = 0;
s64 time;
@@ -758,10 +761,10 @@ static int ina2xx_work_buffer(struct iio_dev *indio_dev)
if (ret < 0)
return ret;
- data[i++] = val;
+ chip->scan.chan[i++] = val;
}
- iio_push_to_buffers_with_timestamp(indio_dev, data, time);
+ iio_push_to_buffers_with_timestamp(indio_dev, &chip->scan, time);
return 0;
};
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio:adc:ti-adc084s021 Fix alignment and data leak issues.
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From a661b571e3682705cb402a5cd1e970586a3ec00f Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Wed, 22 Jul 2020 16:50:57 +0100
Subject: iio:adc:ti-adc084s021 Fix alignment and data leak issues.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv().
This data is allocated with kzalloc so no data can leak apart from
previous readings.
The force alignment of ts is not strictly necessary in this case
but reduces the fragility of the code.
Fixes: 3691e5a69449 ("iio: adc: add driver for the ti-adc084s021 chip")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Cc: Mårten Lindahl <martenli(a)axis.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Cc: <Stable(a)vger.kernel.org>
---
drivers/iio/adc/ti-adc084s021.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/adc/ti-adc084s021.c b/drivers/iio/adc/ti-adc084s021.c
index 9017e1e24273..dfba34834a57 100644
--- a/drivers/iio/adc/ti-adc084s021.c
+++ b/drivers/iio/adc/ti-adc084s021.c
@@ -26,6 +26,11 @@ struct adc084s021 {
struct spi_transfer spi_trans;
struct regulator *reg;
struct mutex lock;
+ /* Buffer used to align data */
+ struct {
+ __be16 channels[4];
+ s64 ts __aligned(8);
+ } scan;
/*
* DMA (thus cache coherency maintenance) requires the
* transfer buffers to live in their own cache line.
@@ -141,14 +146,13 @@ static irqreturn_t adc084s021_buffer_trigger_handler(int irq, void *pollfunc)
struct iio_poll_func *pf = pollfunc;
struct iio_dev *indio_dev = pf->indio_dev;
struct adc084s021 *adc = iio_priv(indio_dev);
- __be16 data[8] = {0}; /* 4 * 16-bit words of data + 8 bytes timestamp */
mutex_lock(&adc->lock);
- if (adc084s021_adc_conversion(adc, &data) < 0)
+ if (adc084s021_adc_conversion(adc, adc->scan.channels) < 0)
dev_err(&adc->spi->dev, "Failed to read data\n");
- iio_push_to_buffers_with_timestamp(indio_dev, data,
+ iio_push_to_buffers_with_timestamp(indio_dev, &adc->scan,
iio_get_time_ns(indio_dev));
mutex_unlock(&adc->lock);
iio_trigger_notify_done(indio_dev->trig);
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio:adc:ti-adc081c Fix alignment and data leak issues
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 54f82df2ba86e2a8e9cbf4036d192366e3905c89 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Wed, 22 Jul 2020 16:50:56 +0100
Subject: iio:adc:ti-adc081c Fix alignment and data leak issues
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv().
This data is allocated with kzalloc so no data can leak apart
from previous readings.
The eplicit alignment of ts is necessary to ensure correct padding
on x86_32 where s64 is only aligned to 4 bytes.
Fixes: 08e05d1fce5c ("ti-adc081c: Initial triggered buffer support")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Cc: <Stable(a)vger.kernel.org>
---
drivers/iio/adc/ti-adc081c.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/adc/ti-adc081c.c b/drivers/iio/adc/ti-adc081c.c
index 9426f70a8005..cf63983a54d9 100644
--- a/drivers/iio/adc/ti-adc081c.c
+++ b/drivers/iio/adc/ti-adc081c.c
@@ -33,6 +33,12 @@ struct adc081c {
/* 8, 10 or 12 */
int bits;
+
+ /* Ensure natural alignment of buffer elements */
+ struct {
+ u16 channel;
+ s64 ts __aligned(8);
+ } scan;
};
#define REG_CONV_RES 0x00
@@ -128,14 +134,13 @@ static irqreturn_t adc081c_trigger_handler(int irq, void *p)
struct iio_poll_func *pf = p;
struct iio_dev *indio_dev = pf->indio_dev;
struct adc081c *data = iio_priv(indio_dev);
- u16 buf[8]; /* 2 bytes data + 6 bytes padding + 8 bytes timestamp */
int ret;
ret = i2c_smbus_read_word_swapped(data->i2c, REG_CONV_RES);
if (ret < 0)
goto out;
- buf[0] = ret;
- iio_push_to_buffers_with_timestamp(indio_dev, buf,
+ data->scan.channel = ret;
+ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
iio_get_time_ns(indio_dev));
out:
iio_trigger_notify_done(indio_dev->trig);
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio:magnetometer:ak8975 Fix alignment and data leak issues.
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 02ad21cefbac4d89ac443866f25b90449527737b Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Wed, 22 Jul 2020 16:50:49 +0100
Subject: iio:magnetometer:ak8975 Fix alignment and data leak issues.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc so no data can leak apart from
previous readings.
The explicit alignment of ts is not necessary in this case as by
coincidence the padding will end up the same, however I consider
it to make the code less fragile and have included it.
Fixes: bc11ca4a0b84 ("iio:magnetometer:ak8975: triggered buffer support")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Cc: Gregor Boirie <gregor.boirie(a)parrot.com>
Cc: Linus Walleij <linus.walleij(a)linaro.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Cc: <Stable(a)vger.kernel.org>
---
drivers/iio/magnetometer/ak8975.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
index 03d71f796177..623766ff800b 100644
--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -366,6 +366,12 @@ struct ak8975_data {
struct iio_mount_matrix orientation;
struct regulator *vdd;
struct regulator *vid;
+
+ /* Ensure natural alignment of timestamp */
+ struct {
+ s16 channels[3];
+ s64 ts __aligned(8);
+ } scan;
};
/* Enable attached power regulator if any. */
@@ -793,7 +799,6 @@ static void ak8975_fill_buffer(struct iio_dev *indio_dev)
const struct i2c_client *client = data->client;
const struct ak_def *def = data->def;
int ret;
- s16 buff[8]; /* 3 x 16 bits axis values + 1 aligned 64 bits timestamp */
__le16 fval[3];
mutex_lock(&data->lock);
@@ -816,12 +821,13 @@ static void ak8975_fill_buffer(struct iio_dev *indio_dev)
mutex_unlock(&data->lock);
/* Clamp to valid range. */
- buff[0] = clamp_t(s16, le16_to_cpu(fval[0]), -def->range, def->range);
- buff[1] = clamp_t(s16, le16_to_cpu(fval[1]), -def->range, def->range);
- buff[2] = clamp_t(s16, le16_to_cpu(fval[2]), -def->range, def->range);
+ data->scan.channels[0] = clamp_t(s16, le16_to_cpu(fval[0]), -def->range, def->range);
+ data->scan.channels[1] = clamp_t(s16, le16_to_cpu(fval[1]), -def->range, def->range);
+ data->scan.channels[2] = clamp_t(s16, le16_to_cpu(fval[2]), -def->range, def->range);
- iio_push_to_buffers_with_timestamp(indio_dev, buff,
+ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
iio_get_time_ns(indio_dev));
+
return;
unlock:
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio:light:ltr501 Fix timestamp alignment issue.
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 2684d5003490df5398aeafe2592ba9d4a4653998 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Wed, 22 Jul 2020 16:50:48 +0100
Subject: iio:light:ltr501 Fix timestamp alignment issue.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
Here we use a structure on the stack. The driver already did an
explicit memset so no data leak was possible.
Forced alignment of ts is not strictly necessary but probably makes
the code slightly less fragile.
Note there has been some rework in this driver of the years, so no
way this will apply cleanly all the way back.
Fixes: 2690be905123 ("iio: Add Lite-On ltr501 ambient light / proximity sensor driver")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Cc: <Stable(a)vger.kernel.org>
---
drivers/iio/light/ltr501.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
index 4bac0646398d..b4323d2db0b1 100644
--- a/drivers/iio/light/ltr501.c
+++ b/drivers/iio/light/ltr501.c
@@ -1243,13 +1243,16 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p)
struct iio_poll_func *pf = p;
struct iio_dev *indio_dev = pf->indio_dev;
struct ltr501_data *data = iio_priv(indio_dev);
- u16 buf[8];
+ struct {
+ u16 channels[3];
+ s64 ts __aligned(8);
+ } scan;
__le16 als_buf[2];
u8 mask = 0;
int j = 0;
int ret, psdata;
- memset(buf, 0, sizeof(buf));
+ memset(&scan, 0, sizeof(scan));
/* figure out which data needs to be ready */
if (test_bit(0, indio_dev->active_scan_mask) ||
@@ -1268,9 +1271,9 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p)
if (ret < 0)
return ret;
if (test_bit(0, indio_dev->active_scan_mask))
- buf[j++] = le16_to_cpu(als_buf[1]);
+ scan.channels[j++] = le16_to_cpu(als_buf[1]);
if (test_bit(1, indio_dev->active_scan_mask))
- buf[j++] = le16_to_cpu(als_buf[0]);
+ scan.channels[j++] = le16_to_cpu(als_buf[0]);
}
if (mask & LTR501_STATUS_PS_RDY) {
@@ -1278,10 +1281,10 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p)
&psdata, 2);
if (ret < 0)
goto done;
- buf[j++] = psdata & LTR501_PS_DATA_MASK;
+ scan.channels[j++] = psdata & LTR501_PS_DATA_MASK;
}
- iio_push_to_buffers_with_timestamp(indio_dev, buf,
+ iio_push_to_buffers_with_timestamp(indio_dev, &scan,
iio_get_time_ns(indio_dev));
done:
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio:light:max44000 Fix timestamp alignment and prevent data leak.
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 523628852a5f5f34a15252b2634d0498d3cfb347 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Wed, 22 Jul 2020 16:50:45 +0100
Subject: iio:light:max44000 Fix timestamp alignment and prevent data leak.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses a 16 byte array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv().
This data is allocated with kzalloc so no data can leak appart
from previous readings.
It is necessary to force the alignment of ts to avoid the padding
on x86_32 being different from 64 bit platorms (it alows for
4 bytes aligned 8 byte types.
Fixes: 06ad7ea10e2b ("max44000: Initial triggered buffer support")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Cc: <Stable(a)vger.kernel.org>
---
drivers/iio/light/max44000.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/iio/light/max44000.c b/drivers/iio/light/max44000.c
index aa8ed1e3e89a..b8e721bced5b 100644
--- a/drivers/iio/light/max44000.c
+++ b/drivers/iio/light/max44000.c
@@ -75,6 +75,11 @@
struct max44000_data {
struct mutex lock;
struct regmap *regmap;
+ /* Ensure naturally aligned timestamp */
+ struct {
+ u16 channels[2];
+ s64 ts __aligned(8);
+ } scan;
};
/* Default scale is set to the minimum of 0.03125 or 1 / (1 << 5) lux */
@@ -488,7 +493,6 @@ static irqreturn_t max44000_trigger_handler(int irq, void *p)
struct iio_poll_func *pf = p;
struct iio_dev *indio_dev = pf->indio_dev;
struct max44000_data *data = iio_priv(indio_dev);
- u16 buf[8]; /* 2x u16 + padding + 8 bytes timestamp */
int index = 0;
unsigned int regval;
int ret;
@@ -498,17 +502,17 @@ static irqreturn_t max44000_trigger_handler(int irq, void *p)
ret = max44000_read_alsval(data);
if (ret < 0)
goto out_unlock;
- buf[index++] = ret;
+ data->scan.channels[index++] = ret;
}
if (test_bit(MAX44000_SCAN_INDEX_PRX, indio_dev->active_scan_mask)) {
ret = regmap_read(data->regmap, MAX44000_REG_PRX_DATA, ®val);
if (ret < 0)
goto out_unlock;
- buf[index] = regval;
+ data->scan.channels[index] = regval;
}
mutex_unlock(&data->lock);
- iio_push_to_buffers_with_timestamp(indio_dev, buf,
+ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
iio_get_time_ns(indio_dev));
iio_trigger_notify_done(indio_dev->trig);
return IRQ_HANDLED;
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio:chemical:ccs811: Fix timestamp alignment and prevent data leak.
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From eb1a148ef41d8ae8d9201efc3f1b145976290331 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Wed, 22 Jul 2020 16:50:43 +0100
Subject: iio:chemical:ccs811: Fix timestamp alignment and prevent data leak.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv() data with alignment
explicitly requested. This data is allocated with kzalloc so no
data can leak appart from previous readings.
The explicit alignment of ts is necessary to ensure consistent
padding for x86_32 in which the ts would otherwise be 4 byte aligned.
Fixes: 283d26917ad6 ("iio: chemical: ccs811: Add triggered buffer support")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Cc: Narcisa Ana Maria Vasile <narcisaanamaria12(a)gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Cc: <Stable(a)vger.kernel.org>
---
drivers/iio/chemical/ccs811.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/iio/chemical/ccs811.c b/drivers/iio/chemical/ccs811.c
index 2b007e7568b2..60dd87e96f5f 100644
--- a/drivers/iio/chemical/ccs811.c
+++ b/drivers/iio/chemical/ccs811.c
@@ -78,6 +78,11 @@ struct ccs811_data {
struct iio_trigger *drdy_trig;
struct gpio_desc *wakeup_gpio;
bool drdy_trig_on;
+ /* Ensures correct alignment of timestamp if present */
+ struct {
+ s16 channels[2];
+ s64 ts __aligned(8);
+ } scan;
};
static const struct iio_chan_spec ccs811_channels[] = {
@@ -327,17 +332,17 @@ static irqreturn_t ccs811_trigger_handler(int irq, void *p)
struct iio_dev *indio_dev = pf->indio_dev;
struct ccs811_data *data = iio_priv(indio_dev);
struct i2c_client *client = data->client;
- s16 buf[8]; /* s16 eCO2 + s16 TVOC + padding + 8 byte timestamp */
int ret;
- ret = i2c_smbus_read_i2c_block_data(client, CCS811_ALG_RESULT_DATA, 4,
- (u8 *)&buf);
+ ret = i2c_smbus_read_i2c_block_data(client, CCS811_ALG_RESULT_DATA,
+ sizeof(data->scan.channels),
+ (u8 *)data->scan.channels);
if (ret != 4) {
dev_err(&client->dev, "cannot read sensor data\n");
goto err;
}
- iio_push_to_buffers_with_timestamp(indio_dev, buf,
+ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
iio_get_time_ns(indio_dev));
err:
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio:proximity:mb1232: Fix timestamp alignment and prevent data leak.
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From f60e8bb84282b8e633956cfe74b4f0d64ca73cec Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Wed, 22 Jul 2020 16:50:42 +0100
Subject: iio:proximity:mb1232: Fix timestamp alignment and prevent data leak.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses a 16 byte s16 array on the stack As Lars also noted
this anti pattern can involve a leak of data to userspace and that
indeed can happen here. We close both issues by moving to
a suitable structure in the iio_priv() data with alignment
ensured by use of an explicit c structure. This data is allocated
with kzalloc so no data can leak appart from previous readings.
In this case the forced alignment of the ts is necessary to ensure
correct padding on x86_32 where the s64 would only be 4 byte aligned.
Fixes: 16b05261537e ("mb1232.c: add distance iio sensor with i2c")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Cc: Andreas Klinger <ak(a)it-klinger.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Cc: <Stable(a)vger.kernel.org>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
---
drivers/iio/proximity/mb1232.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/iio/proximity/mb1232.c b/drivers/iio/proximity/mb1232.c
index 654564c45248..ad4b1fb2607a 100644
--- a/drivers/iio/proximity/mb1232.c
+++ b/drivers/iio/proximity/mb1232.c
@@ -40,6 +40,11 @@ struct mb1232_data {
*/
struct completion ranging;
int irqnr;
+ /* Ensure correct alignment of data to push to IIO buffer */
+ struct {
+ s16 distance;
+ s64 ts __aligned(8);
+ } scan;
};
static irqreturn_t mb1232_handle_irq(int irq, void *dev_id)
@@ -113,17 +118,13 @@ static irqreturn_t mb1232_trigger_handler(int irq, void *p)
struct iio_poll_func *pf = p;
struct iio_dev *indio_dev = pf->indio_dev;
struct mb1232_data *data = iio_priv(indio_dev);
- /*
- * triggered buffer
- * 16-bit channel + 48-bit padding + 64-bit timestamp
- */
- s16 buffer[8] = { 0 };
- buffer[0] = mb1232_read_distance(data);
- if (buffer[0] < 0)
+ data->scan.distance = mb1232_read_distance(data);
+ if (data->scan.distance < 0)
goto err;
- iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp);
+ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ pf->timestamp);
err:
iio_trigger_notify_done(indio_dev->trig);
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio:accel:mma7455: Fix timestamp alignment and prevent data leak.
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 7e5ac1f2206eda414f90c698fe1820dee873394d Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Wed, 22 Jul 2020 16:50:40 +0100
Subject: iio:accel:mma7455: Fix timestamp alignment and prevent data leak.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses a 16 byte u8 array on the stack As Lars also noted
this anti pattern can involve a leak of data to userspace and that
indeed can happen here. We close both issues by moving to
a suitable structure in the iio_priv() data with alignment
ensured by use of an explicit c structure. This data is allocated
with kzalloc so no data can leak appart from previous readings.
The force alignment of ts is not strictly necessary in this particularly
case but does make the code less fragile.
Fixes: a84ef0d181d9 ("iio: accel: add Freescale MMA7455L/MMA7456L 3-axis accelerometer driver")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Cc: <Stable(a)vger.kernel.org>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
---
drivers/iio/accel/mma7455_core.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/iio/accel/mma7455_core.c b/drivers/iio/accel/mma7455_core.c
index 7e99bcb3398d..922bd38ff6ea 100644
--- a/drivers/iio/accel/mma7455_core.c
+++ b/drivers/iio/accel/mma7455_core.c
@@ -52,6 +52,14 @@
struct mma7455_data {
struct regmap *regmap;
+ /*
+ * Used to reorganize data. Will ensure correct alignment of
+ * the timestamp if present
+ */
+ struct {
+ __le16 channels[3];
+ s64 ts __aligned(8);
+ } scan;
};
static int mma7455_drdy(struct mma7455_data *mma7455)
@@ -82,19 +90,19 @@ static irqreturn_t mma7455_trigger_handler(int irq, void *p)
struct iio_poll_func *pf = p;
struct iio_dev *indio_dev = pf->indio_dev;
struct mma7455_data *mma7455 = iio_priv(indio_dev);
- u8 buf[16]; /* 3 x 16-bit channels + padding + ts */
int ret;
ret = mma7455_drdy(mma7455);
if (ret)
goto done;
- ret = regmap_bulk_read(mma7455->regmap, MMA7455_REG_XOUTL, buf,
- sizeof(__le16) * 3);
+ ret = regmap_bulk_read(mma7455->regmap, MMA7455_REG_XOUTL,
+ mma7455->scan.channels,
+ sizeof(mma7455->scan.channels));
if (ret)
goto done;
- iio_push_to_buffers_with_timestamp(indio_dev, buf,
+ iio_push_to_buffers_with_timestamp(indio_dev, &mma7455->scan,
iio_get_time_ns(indio_dev));
done:
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio:accel:bmc150-accel: Fix timestamp alignment and prevent data
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From a6f86f724394de3629da63fe5e1b7a4ab3396efe Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Wed, 22 Jul 2020 16:50:39 +0100
Subject: iio:accel:bmc150-accel: Fix timestamp alignment and prevent data
leak.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses a 16 byte array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by moving
to a suitable structure in the iio_priv() data with alignment
ensured by use of an explicit c structure. This data is allocated
with kzalloc so no data can leak appart from previous readings.
Fixes tag is beyond some major refactoring so likely manual backporting
would be needed to get that far back.
Whilst the force alignment of the ts is not strictly necessary, it
does make the code less fragile.
Fixes: 3bbec9773389 ("iio: bmc150_accel: add support for hardware fifo")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Cc: <Stable(a)vger.kernel.org>
---
drivers/iio/accel/bmc150-accel-core.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
index 24864d9dfab5..48435865fdaf 100644
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -189,6 +189,14 @@ struct bmc150_accel_data {
struct mutex mutex;
u8 fifo_mode, watermark;
s16 buffer[8];
+ /*
+ * Ensure there is sufficient space and correct alignment for
+ * the timestamp if enabled
+ */
+ struct {
+ __le16 channels[3];
+ s64 ts __aligned(8);
+ } scan;
u8 bw_bits;
u32 slope_dur;
u32 slope_thres;
@@ -922,15 +930,16 @@ static int __bmc150_accel_fifo_flush(struct iio_dev *indio_dev,
* now.
*/
for (i = 0; i < count; i++) {
- u16 sample[8];
int j, bit;
j = 0;
for_each_set_bit(bit, indio_dev->active_scan_mask,
indio_dev->masklength)
- memcpy(&sample[j++], &buffer[i * 3 + bit], 2);
+ memcpy(&data->scan.channels[j++], &buffer[i * 3 + bit],
+ sizeof(data->scan.channels[0]));
- iio_push_to_buffers_with_timestamp(indio_dev, sample, tstamp);
+ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ tstamp);
tstamp += sample_period;
}
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio:accel:mma8452: Fix timestamp alignment and prevent data leak.
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 89226a296d816727405d3fea684ef69e7d388bd8 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Wed, 22 Jul 2020 16:50:38 +0100
Subject: iio:accel:mma8452: Fix timestamp alignment and prevent data leak.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses a 16 byte u8 array on the stack. As Lars also noted
this anti pattern can involve a leak of data to userspace and that
indeed can happen here. We close both issues by moving to
a suitable structure in the iio_priv() data with alignment
ensured by use of an explicit c structure. This data is allocated
with kzalloc so no data can leak appart from previous readings.
The additional forcing of the 8 byte alignment of the timestamp
is not strictly necessary but makes the code less fragile by
making this explicit.
Fixes: c7eeea93ac60 ("iio: Add Freescale MMA8452Q 3-axis accelerometer driver")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Cc: Peter Meerwald <pmeerw(a)pmeerw.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Cc: <Stable(a)vger.kernel.org>
---
drivers/iio/accel/mma8452.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
index ba27f8673131..1cf2b5db26ca 100644
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -110,6 +110,12 @@ struct mma8452_data {
int sleep_val;
struct regulator *vdd_reg;
struct regulator *vddio_reg;
+
+ /* Ensure correct alignment of time stamp when present */
+ struct {
+ __be16 channels[3];
+ s64 ts __aligned(8);
+ } buffer;
};
/**
@@ -1091,14 +1097,13 @@ static irqreturn_t mma8452_trigger_handler(int irq, void *p)
struct iio_poll_func *pf = p;
struct iio_dev *indio_dev = pf->indio_dev;
struct mma8452_data *data = iio_priv(indio_dev);
- u8 buffer[16]; /* 3 16-bit channels + padding + ts */
int ret;
- ret = mma8452_read(data, (__be16 *)buffer);
+ ret = mma8452_read(data, data->buffer.channels);
if (ret < 0)
goto done;
- iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+ iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer,
iio_get_time_ns(indio_dev));
done:
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio: accel: kxsd9: Fix alignment of local buffer.
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 95ad67577de4ea08eb8e441394e698aa4addcc0b Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Wed, 22 Jul 2020 16:50:37 +0100
Subject: iio: accel: kxsd9: Fix alignment of local buffer.
iio_push_to_buffers_with_timestamp assumes 8 byte alignment which
is not guaranteed by an array of smaller elements.
Note that whilst in this particular case the alignment forcing
of the ts element is not strictly necessary it acts as good
documentation. Doing this where not necessary should cut
down on the number of cut and paste introduced errors elsewhere.
Fixes: 0427a106a98a ("iio: accel: kxsd9: Add triggered buffer handling")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Cc: <Stable(a)vger.kernel.org>
---
drivers/iio/accel/kxsd9.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index 66b2e4cf24cf..0e18b92e2099 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -209,14 +209,20 @@ static irqreturn_t kxsd9_trigger_handler(int irq, void *p)
const struct iio_poll_func *pf = p;
struct iio_dev *indio_dev = pf->indio_dev;
struct kxsd9_state *st = iio_priv(indio_dev);
+ /*
+ * Ensure correct positioning and alignment of timestamp.
+ * No need to zero initialize as all elements written.
+ */
+ struct {
+ __be16 chan[4];
+ s64 ts __aligned(8);
+ } hw_values;
int ret;
- /* 4 * 16bit values AND timestamp */
- __be16 hw_values[8];
ret = regmap_bulk_read(st->map,
KXSD9_REG_X,
- &hw_values,
- 8);
+ hw_values.chan,
+ sizeof(hw_values.chan));
if (ret) {
dev_err(st->dev,
"error reading data\n");
@@ -224,7 +230,7 @@ static irqreturn_t kxsd9_trigger_handler(int irq, void *p)
}
iio_push_to_buffers_with_timestamp(indio_dev,
- hw_values,
+ &hw_values,
iio_get_time_ns(indio_dev));
iio_trigger_notify_done(indio_dev->trig);
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio: adc: ti-ads1015: fix conversion when CONFIG_PM is not set
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From e71e6dbe96ac80ac2aebe71a6a942e7bd60e7596 Mon Sep 17 00:00:00 2001
From: Maxim Kochetkov <fido_max(a)inbox.ru>
Date: Mon, 3 Aug 2020 08:04:05 +0300
Subject: iio: adc: ti-ads1015: fix conversion when CONFIG_PM is not set
To stop conversion ads1015_set_power_state() function call unimplemented
function __pm_runtime_suspend() from pm_runtime_put_autosuspend()
if CONFIG_PM is not set.
In case of CONFIG_PM is not set: __pm_runtime_suspend() returns -ENOSYS,
so ads1015_read_raw() failed because ads1015_set_power_state() returns an
error.
If CONFIG_PM is disabled, there is no need to start/stop conversion.
Fix it by adding return 0 function variant if CONFIG_PM is not set.
Signed-off-by: Maxim Kochetkov <fido_max(a)inbox.ru>
Fixes: ecc24e72f437 ("iio: adc: Add TI ADS1015 ADC driver support")
Tested-by: Maxim Kiselev <bigunclemax(a)gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
---
drivers/iio/adc/ti-ads1015.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
index f42ab112986e..9fef39bcf997 100644
--- a/drivers/iio/adc/ti-ads1015.c
+++ b/drivers/iio/adc/ti-ads1015.c
@@ -316,6 +316,7 @@ static const struct iio_chan_spec ads1115_channels[] = {
IIO_CHAN_SOFT_TIMESTAMP(ADS1015_TIMESTAMP),
};
+#ifdef CONFIG_PM
static int ads1015_set_power_state(struct ads1015_data *data, bool on)
{
int ret;
@@ -333,6 +334,15 @@ static int ads1015_set_power_state(struct ads1015_data *data, bool on)
return ret < 0 ? ret : 0;
}
+#else /* !CONFIG_PM */
+
+static int ads1015_set_power_state(struct ads1015_data *data, bool on)
+{
+ return 0;
+}
+
+#endif /* !CONFIG_PM */
+
static
int ads1015_get_adc_result(struct ads1015_data *data, int chan, int *val)
{
--
2.28.0
This is a note to let you know that I've just added the patch titled
iio: cros_ec: Set Gyroscope default frequency to 25Hz
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 336306790b2bbf7ce837625fa3b24ba724d05838 Mon Sep 17 00:00:00 2001
From: Gwendal Grignou <gwendal(a)chromium.org>
Date: Tue, 28 Jul 2020 13:48:25 -0700
Subject: iio: cros_ec: Set Gyroscope default frequency to 25Hz
BMI160 Minimium gyroscope frequency in normal mode is 25Hz.
When older EC firmware do not report their sensors frequencies,
use 25Hz as the minimum for gyroscope to be sure it works on BMI160.
Fixes: ae7b02ad2f32d ("iio: common: cros_ec_sensors: Expose cros_ec_sensors frequency range via iio sysfs")
Signed-off-by: Gwendal Grignou <gwendal(a)chromium.org>
Reviewed-by: Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
---
drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
index ea480c1d4349..1bc6efa47316 100644
--- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
+++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
@@ -72,10 +72,13 @@ static void get_default_min_max_freq(enum motionsensor_type type,
switch (type) {
case MOTIONSENSE_TYPE_ACCEL:
- case MOTIONSENSE_TYPE_GYRO:
*min_freq = 12500;
*max_freq = 100000;
break;
+ case MOTIONSENSE_TYPE_GYRO:
+ *min_freq = 25000;
+ *max_freq = 100000;
+ break;
case MOTIONSENSE_TYPE_MAG:
*min_freq = 5000;
*max_freq = 25000;
--
2.28.0
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 71a7f8cb1ca4ca7214a700b1243626759b6c11d4 Mon Sep 17 00:00:00 2001
From: James Morse <james.morse(a)arm.com>
Date: Fri, 21 Aug 2020 15:07:07 +0100
Subject: [PATCH] KVM: arm64: Set HCR_EL2.PTW to prevent AT taking synchronous
exception
AT instructions do a translation table walk and return the result, or
the fault in PAR_EL1. KVM uses these to find the IPA when the value is
not provided by the CPU in HPFAR_EL1.
If a translation table walk causes an external abort it is taken as an
exception, even if it was due to an AT instruction. (DDI0487F.a's D5.2.11
"Synchronous faults generated by address translation instructions")
While we previously made KVM resilient to exceptions taken due to AT
instructions, the device access causes mismatched attributes, and may
occur speculatively. Prevent this, by forbidding a walk through memory
described as device at stage2. Now such AT instructions will report a
stage2 fault.
Such a fault will cause KVM to restart the guest. If the AT instructions
always walk the page tables, but guest execution uses the translation cached
in the TLB, the guest can't make forward progress until the TLB entry is
evicted. This isn't a problem, as since commit 5dcd0fdbb492 ("KVM: arm64:
Defer guest entry when an asynchronous exception is pending"), KVM will
return to the host to process IRQs allowing the rest of the system to keep
running.
Cc: stable(a)vger.kernel.org # <v5.3: 5dcd0fdbb492 ("KVM: arm64: Defer guest entry when an asynchronous exception is pending")
Signed-off-by: James Morse <james.morse(a)arm.com>
Reviewed-by: Marc Zyngier <maz(a)kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com>
diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
index 51c1d9918999..1da8e3dc4455 100644
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -71,11 +71,12 @@
* IMO: Override CPSR.I and enable signaling with VI
* FMO: Override CPSR.F and enable signaling with VF
* SWIO: Turn set/way invalidates into set/way clean+invalidate
+ * PTW: Take a stage2 fault if a stage1 walk steps in device memory
*/
#define HCR_GUEST_FLAGS (HCR_TSC | HCR_TSW | HCR_TWE | HCR_TWI | HCR_VM | \
HCR_BSU_IS | HCR_FB | HCR_TAC | \
HCR_AMO | HCR_SWIO | HCR_TIDCP | HCR_RW | HCR_TLOR | \
- HCR_FMO | HCR_IMO)
+ HCR_FMO | HCR_IMO | HCR_PTW )
#define HCR_VIRT_EXCP_MASK (HCR_VSE | HCR_VI | HCR_VF)
#define HCR_HOST_NVHE_FLAGS (HCR_RW | HCR_API | HCR_APK)
#define HCR_HOST_VHE_FLAGS (HCR_RW | HCR_TGE | HCR_E2H)
The patch below does not apply to the 5.8-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 88a84ccccb3966bcc3f309cdb76092a9892c0260 Mon Sep 17 00:00:00 2001
From: James Morse <james.morse(a)arm.com>
Date: Fri, 21 Aug 2020 15:07:06 +0100
Subject: [PATCH] KVM: arm64: Survive synchronous exceptions caused by AT
instructions
KVM doesn't expect any synchronous exceptions when executing, any such
exception leads to a panic(). AT instructions access the guest page
tables, and can cause a synchronous external abort to be taken.
The arm-arm is unclear on what should happen if the guest has configured
the hardware update of the access-flag, and a memory type in TCR_EL1 that
does not support atomic operations. B2.2.6 "Possible implementation
restrictions on using atomic instructions" from DDI0487F.a lists
synchronous external abort as a possible behaviour of atomic instructions
that target memory that isn't writeback cacheable, but the page table
walker may behave differently.
Make KVM robust to synchronous exceptions caused by AT instructions.
Add a get_user() style helper for AT instructions that returns -EFAULT
if an exception was generated.
While KVM's version of the exception table mixes synchronous and
asynchronous exceptions, only one of these can occur at each location.
Re-enter the guest when the AT instructions take an exception on the
assumption the guest will take the same exception. This isn't guaranteed
to make forward progress, as the AT instructions may always walk the page
tables, but guest execution may use the translation cached in the TLB.
This isn't a problem, as since commit 5dcd0fdbb492 ("KVM: arm64: Defer guest
entry when an asynchronous exception is pending"), KVM will return to the
host to process IRQs allowing the rest of the system to keep running.
Cc: stable(a)vger.kernel.org # <v5.3: 5dcd0fdbb492 ("KVM: arm64: Defer guest entry when an asynchronous exception is pending")
Signed-off-by: James Morse <james.morse(a)arm.com>
Reviewed-by: Marc Zyngier <maz(a)kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com>
diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h
index 63350f0e3453..6f98fbd0ac81 100644
--- a/arch/arm64/include/asm/kvm_asm.h
+++ b/arch/arm64/include/asm/kvm_asm.h
@@ -169,6 +169,34 @@ extern char __smccc_workaround_1_smc[__SMCCC_WORKAROUND_1_SMC_SZ];
*__hyp_this_cpu_ptr(sym); \
})
+#define __KVM_EXTABLE(from, to) \
+ " .pushsection __kvm_ex_table, \"a\"\n" \
+ " .align 3\n" \
+ " .long (" #from " - .), (" #to " - .)\n" \
+ " .popsection\n"
+
+
+#define __kvm_at(at_op, addr) \
+( { \
+ int __kvm_at_err = 0; \
+ u64 spsr, elr; \
+ asm volatile( \
+ " mrs %1, spsr_el2\n" \
+ " mrs %2, elr_el2\n" \
+ "1: at "at_op", %3\n" \
+ " isb\n" \
+ " b 9f\n" \
+ "2: msr spsr_el2, %1\n" \
+ " msr elr_el2, %2\n" \
+ " mov %w0, %4\n" \
+ "9:\n" \
+ __KVM_EXTABLE(1b, 2b) \
+ : "+r" (__kvm_at_err), "=&r" (spsr), "=&r" (elr) \
+ : "r" (addr), "i" (-EFAULT)); \
+ __kvm_at_err; \
+} )
+
+
#else /* __ASSEMBLY__ */
.macro hyp_adr_this_cpu reg, sym, tmp
diff --git a/arch/arm64/kvm/hyp/hyp-entry.S b/arch/arm64/kvm/hyp/hyp-entry.S
index e47547e276d8..46b4dab933d0 100644
--- a/arch/arm64/kvm/hyp/hyp-entry.S
+++ b/arch/arm64/kvm/hyp/hyp-entry.S
@@ -167,13 +167,19 @@ el1_error:
b __guest_exit
el2_sync:
- /* Check for illegal exception return, otherwise panic */
+ /* Check for illegal exception return */
mrs x0, spsr_el2
+ tbnz x0, #20, 1f
- /* if this was something else, then panic! */
- tst x0, #PSR_IL_BIT
- b.eq __hyp_panic
+ save_caller_saved_regs_vect
+ stp x29, x30, [sp, #-16]!
+ bl kvm_unexpected_el2_exception
+ ldp x29, x30, [sp], #16
+ restore_caller_saved_regs_vect
+
+ eret
+1:
/* Let's attempt a recovery from the illegal exception return */
get_vcpu_ptr x1, x0
mov x0, #ARM_EXCEPTION_IL
diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h
index 6d8d4ed4287c..5b6b8fa00f0a 100644
--- a/arch/arm64/kvm/hyp/include/hyp/switch.h
+++ b/arch/arm64/kvm/hyp/include/hyp/switch.h
@@ -146,10 +146,10 @@ static inline bool __translate_far_to_hpfar(u64 far, u64 *hpfar)
* saved the guest context yet, and we may return early...
*/
par = read_sysreg(par_el1);
- asm volatile("at s1e1r, %0" : : "r" (far));
- isb();
-
- tmp = read_sysreg(par_el1);
+ if (!__kvm_at("s1e1r", far))
+ tmp = read_sysreg(par_el1);
+ else
+ tmp = SYS_PAR_EL1_F; /* back to the guest */
write_sysreg(par, par_el1);
if (unlikely(tmp & SYS_PAR_EL1_F))
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 88a84ccccb3966bcc3f309cdb76092a9892c0260 Mon Sep 17 00:00:00 2001
From: James Morse <james.morse(a)arm.com>
Date: Fri, 21 Aug 2020 15:07:06 +0100
Subject: [PATCH] KVM: arm64: Survive synchronous exceptions caused by AT
instructions
KVM doesn't expect any synchronous exceptions when executing, any such
exception leads to a panic(). AT instructions access the guest page
tables, and can cause a synchronous external abort to be taken.
The arm-arm is unclear on what should happen if the guest has configured
the hardware update of the access-flag, and a memory type in TCR_EL1 that
does not support atomic operations. B2.2.6 "Possible implementation
restrictions on using atomic instructions" from DDI0487F.a lists
synchronous external abort as a possible behaviour of atomic instructions
that target memory that isn't writeback cacheable, but the page table
walker may behave differently.
Make KVM robust to synchronous exceptions caused by AT instructions.
Add a get_user() style helper for AT instructions that returns -EFAULT
if an exception was generated.
While KVM's version of the exception table mixes synchronous and
asynchronous exceptions, only one of these can occur at each location.
Re-enter the guest when the AT instructions take an exception on the
assumption the guest will take the same exception. This isn't guaranteed
to make forward progress, as the AT instructions may always walk the page
tables, but guest execution may use the translation cached in the TLB.
This isn't a problem, as since commit 5dcd0fdbb492 ("KVM: arm64: Defer guest
entry when an asynchronous exception is pending"), KVM will return to the
host to process IRQs allowing the rest of the system to keep running.
Cc: stable(a)vger.kernel.org # <v5.3: 5dcd0fdbb492 ("KVM: arm64: Defer guest entry when an asynchronous exception is pending")
Signed-off-by: James Morse <james.morse(a)arm.com>
Reviewed-by: Marc Zyngier <maz(a)kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com>
diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h
index 63350f0e3453..6f98fbd0ac81 100644
--- a/arch/arm64/include/asm/kvm_asm.h
+++ b/arch/arm64/include/asm/kvm_asm.h
@@ -169,6 +169,34 @@ extern char __smccc_workaround_1_smc[__SMCCC_WORKAROUND_1_SMC_SZ];
*__hyp_this_cpu_ptr(sym); \
})
+#define __KVM_EXTABLE(from, to) \
+ " .pushsection __kvm_ex_table, \"a\"\n" \
+ " .align 3\n" \
+ " .long (" #from " - .), (" #to " - .)\n" \
+ " .popsection\n"
+
+
+#define __kvm_at(at_op, addr) \
+( { \
+ int __kvm_at_err = 0; \
+ u64 spsr, elr; \
+ asm volatile( \
+ " mrs %1, spsr_el2\n" \
+ " mrs %2, elr_el2\n" \
+ "1: at "at_op", %3\n" \
+ " isb\n" \
+ " b 9f\n" \
+ "2: msr spsr_el2, %1\n" \
+ " msr elr_el2, %2\n" \
+ " mov %w0, %4\n" \
+ "9:\n" \
+ __KVM_EXTABLE(1b, 2b) \
+ : "+r" (__kvm_at_err), "=&r" (spsr), "=&r" (elr) \
+ : "r" (addr), "i" (-EFAULT)); \
+ __kvm_at_err; \
+} )
+
+
#else /* __ASSEMBLY__ */
.macro hyp_adr_this_cpu reg, sym, tmp
diff --git a/arch/arm64/kvm/hyp/hyp-entry.S b/arch/arm64/kvm/hyp/hyp-entry.S
index e47547e276d8..46b4dab933d0 100644
--- a/arch/arm64/kvm/hyp/hyp-entry.S
+++ b/arch/arm64/kvm/hyp/hyp-entry.S
@@ -167,13 +167,19 @@ el1_error:
b __guest_exit
el2_sync:
- /* Check for illegal exception return, otherwise panic */
+ /* Check for illegal exception return */
mrs x0, spsr_el2
+ tbnz x0, #20, 1f
- /* if this was something else, then panic! */
- tst x0, #PSR_IL_BIT
- b.eq __hyp_panic
+ save_caller_saved_regs_vect
+ stp x29, x30, [sp, #-16]!
+ bl kvm_unexpected_el2_exception
+ ldp x29, x30, [sp], #16
+ restore_caller_saved_regs_vect
+
+ eret
+1:
/* Let's attempt a recovery from the illegal exception return */
get_vcpu_ptr x1, x0
mov x0, #ARM_EXCEPTION_IL
diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h
index 6d8d4ed4287c..5b6b8fa00f0a 100644
--- a/arch/arm64/kvm/hyp/include/hyp/switch.h
+++ b/arch/arm64/kvm/hyp/include/hyp/switch.h
@@ -146,10 +146,10 @@ static inline bool __translate_far_to_hpfar(u64 far, u64 *hpfar)
* saved the guest context yet, and we may return early...
*/
par = read_sysreg(par_el1);
- asm volatile("at s1e1r, %0" : : "r" (far));
- isb();
-
- tmp = read_sysreg(par_el1);
+ if (!__kvm_at("s1e1r", far))
+ tmp = read_sysreg(par_el1);
+ else
+ tmp = SYS_PAR_EL1_F; /* back to the guest */
write_sysreg(par, par_el1);
if (unlikely(tmp & SYS_PAR_EL1_F))
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 282dd7d7718444679b046b769d872b188818ca35 Mon Sep 17 00:00:00 2001
From: Marcos Paulo de Souza <mpdesouza(a)suse.com>
Date: Mon, 3 Aug 2020 16:55:01 -0300
Subject: [PATCH] btrfs: reset compression level for lzo on remount
Currently a user can set mount "-o compress" which will set the
compression algorithm to zlib, and use the default compress level for
zlib (3):
relatime,compress=zlib:3,space_cache
If the user remounts the fs using "-o compress=lzo", then the old
compress_level is used:
relatime,compress=lzo:3,space_cache
But lzo does not expose any tunable compression level. The same happens
if we set any compress argument with different level, also with zstd.
Fix this by resetting the compress_level when compress=lzo is
specified. With the fix applied, lzo is shown without compress level:
relatime,compress=lzo,space_cache
CC: stable(a)vger.kernel.org # 4.4+
Signed-off-by: Marcos Paulo de Souza <mpdesouza(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index e529ddb35b87..25967ecaaf0a 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -625,6 +625,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options,
} else if (strncmp(args[0].from, "lzo", 3) == 0) {
compress_type = "lzo";
info->compress_type = BTRFS_COMPRESS_LZO;
+ info->compress_level = 0;
btrfs_set_opt(info->mount_opt, COMPRESS);
btrfs_clear_opt(info->mount_opt, NODATACOW);
btrfs_clear_opt(info->mount_opt, NODATASUM);
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 282dd7d7718444679b046b769d872b188818ca35 Mon Sep 17 00:00:00 2001
From: Marcos Paulo de Souza <mpdesouza(a)suse.com>
Date: Mon, 3 Aug 2020 16:55:01 -0300
Subject: [PATCH] btrfs: reset compression level for lzo on remount
Currently a user can set mount "-o compress" which will set the
compression algorithm to zlib, and use the default compress level for
zlib (3):
relatime,compress=zlib:3,space_cache
If the user remounts the fs using "-o compress=lzo", then the old
compress_level is used:
relatime,compress=lzo:3,space_cache
But lzo does not expose any tunable compression level. The same happens
if we set any compress argument with different level, also with zstd.
Fix this by resetting the compress_level when compress=lzo is
specified. With the fix applied, lzo is shown without compress level:
relatime,compress=lzo,space_cache
CC: stable(a)vger.kernel.org # 4.4+
Signed-off-by: Marcos Paulo de Souza <mpdesouza(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index e529ddb35b87..25967ecaaf0a 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -625,6 +625,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options,
} else if (strncmp(args[0].from, "lzo", 3) == 0) {
compress_type = "lzo";
info->compress_type = BTRFS_COMPRESS_LZO;
+ info->compress_level = 0;
btrfs_set_opt(info->mount_opt, COMPRESS);
btrfs_clear_opt(info->mount_opt, NODATACOW);
btrfs_clear_opt(info->mount_opt, NODATASUM);
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 282dd7d7718444679b046b769d872b188818ca35 Mon Sep 17 00:00:00 2001
From: Marcos Paulo de Souza <mpdesouza(a)suse.com>
Date: Mon, 3 Aug 2020 16:55:01 -0300
Subject: [PATCH] btrfs: reset compression level for lzo on remount
Currently a user can set mount "-o compress" which will set the
compression algorithm to zlib, and use the default compress level for
zlib (3):
relatime,compress=zlib:3,space_cache
If the user remounts the fs using "-o compress=lzo", then the old
compress_level is used:
relatime,compress=lzo:3,space_cache
But lzo does not expose any tunable compression level. The same happens
if we set any compress argument with different level, also with zstd.
Fix this by resetting the compress_level when compress=lzo is
specified. With the fix applied, lzo is shown without compress level:
relatime,compress=lzo,space_cache
CC: stable(a)vger.kernel.org # 4.4+
Signed-off-by: Marcos Paulo de Souza <mpdesouza(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index e529ddb35b87..25967ecaaf0a 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -625,6 +625,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options,
} else if (strncmp(args[0].from, "lzo", 3) == 0) {
compress_type = "lzo";
info->compress_type = BTRFS_COMPRESS_LZO;
+ info->compress_level = 0;
btrfs_set_opt(info->mount_opt, COMPRESS);
btrfs_clear_opt(info->mount_opt, NODATACOW);
btrfs_clear_opt(info->mount_opt, NODATASUM);
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From fb2fecbad50964b9f27a3b182e74e437b40753ef Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef(a)toxicpanda.com>
Date: Mon, 10 Aug 2020 17:31:16 -0400
Subject: [PATCH] btrfs: check the right error variable in
btrfs_del_dir_entries_in_log
With my new locking code dbench is so much faster that I tripped over a
transaction abort from ENOSPC. This turned out to be because
btrfs_del_dir_entries_in_log was checking for ret == -ENOSPC, but this
function sets err on error, and returns err. So instead of properly
marking the inode as needing a full commit, we were returning -ENOSPC
and aborting in __btrfs_unlink_inode. Fix this by checking the proper
variable so that we return the correct thing in the case of ENOSPC.
The ENOENT needs to be checked, because btrfs_lookup_dir_item_index()
can return -ENOENT if the dir item isn't in the tree log (which would
happen if we hadn't fsync'ed this guy). We actually handle that case in
__btrfs_unlink_inode, so it's an expected error to get back.
Fixes: 4a500fd178c8 ("Btrfs: Metadata ENOSPC handling for tree log")
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: Josef Bacik <josef(a)toxicpanda.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
[ add note and comment about ENOENT ]
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 696dd861cc3c..39da9db35278 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3449,11 +3449,13 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
btrfs_free_path(path);
out_unlock:
mutex_unlock(&dir->log_mutex);
- if (ret == -ENOSPC) {
+ if (err == -ENOSPC) {
btrfs_set_log_full_commit(trans);
- ret = 0;
- } else if (ret < 0)
- btrfs_abort_transaction(trans, ret);
+ err = 0;
+ } else if (err < 0 && err != -ENOENT) {
+ /* ENOENT can be returned if the entry hasn't been fsynced yet */
+ btrfs_abort_transaction(trans, err);
+ }
btrfs_end_log_trans(root);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From fb2fecbad50964b9f27a3b182e74e437b40753ef Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef(a)toxicpanda.com>
Date: Mon, 10 Aug 2020 17:31:16 -0400
Subject: [PATCH] btrfs: check the right error variable in
btrfs_del_dir_entries_in_log
With my new locking code dbench is so much faster that I tripped over a
transaction abort from ENOSPC. This turned out to be because
btrfs_del_dir_entries_in_log was checking for ret == -ENOSPC, but this
function sets err on error, and returns err. So instead of properly
marking the inode as needing a full commit, we were returning -ENOSPC
and aborting in __btrfs_unlink_inode. Fix this by checking the proper
variable so that we return the correct thing in the case of ENOSPC.
The ENOENT needs to be checked, because btrfs_lookup_dir_item_index()
can return -ENOENT if the dir item isn't in the tree log (which would
happen if we hadn't fsync'ed this guy). We actually handle that case in
__btrfs_unlink_inode, so it's an expected error to get back.
Fixes: 4a500fd178c8 ("Btrfs: Metadata ENOSPC handling for tree log")
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: Josef Bacik <josef(a)toxicpanda.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
[ add note and comment about ENOENT ]
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 696dd861cc3c..39da9db35278 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3449,11 +3449,13 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
btrfs_free_path(path);
out_unlock:
mutex_unlock(&dir->log_mutex);
- if (ret == -ENOSPC) {
+ if (err == -ENOSPC) {
btrfs_set_log_full_commit(trans);
- ret = 0;
- } else if (ret < 0)
- btrfs_abort_transaction(trans, ret);
+ err = 0;
+ } else if (err < 0 && err != -ENOENT) {
+ /* ENOENT can be returned if the entry hasn't been fsynced yet */
+ btrfs_abort_transaction(trans, err);
+ }
btrfs_end_log_trans(root);
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From fb2fecbad50964b9f27a3b182e74e437b40753ef Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef(a)toxicpanda.com>
Date: Mon, 10 Aug 2020 17:31:16 -0400
Subject: [PATCH] btrfs: check the right error variable in
btrfs_del_dir_entries_in_log
With my new locking code dbench is so much faster that I tripped over a
transaction abort from ENOSPC. This turned out to be because
btrfs_del_dir_entries_in_log was checking for ret == -ENOSPC, but this
function sets err on error, and returns err. So instead of properly
marking the inode as needing a full commit, we were returning -ENOSPC
and aborting in __btrfs_unlink_inode. Fix this by checking the proper
variable so that we return the correct thing in the case of ENOSPC.
The ENOENT needs to be checked, because btrfs_lookup_dir_item_index()
can return -ENOENT if the dir item isn't in the tree log (which would
happen if we hadn't fsync'ed this guy). We actually handle that case in
__btrfs_unlink_inode, so it's an expected error to get back.
Fixes: 4a500fd178c8 ("Btrfs: Metadata ENOSPC handling for tree log")
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: Josef Bacik <josef(a)toxicpanda.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
[ add note and comment about ENOENT ]
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 696dd861cc3c..39da9db35278 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3449,11 +3449,13 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
btrfs_free_path(path);
out_unlock:
mutex_unlock(&dir->log_mutex);
- if (ret == -ENOSPC) {
+ if (err == -ENOSPC) {
btrfs_set_log_full_commit(trans);
- ret = 0;
- } else if (ret < 0)
- btrfs_abort_transaction(trans, ret);
+ err = 0;
+ } else if (err < 0 && err != -ENOENT) {
+ /* ENOENT can be returned if the entry hasn't been fsynced yet */
+ btrfs_abort_transaction(trans, err);
+ }
btrfs_end_log_trans(root);
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From fb2fecbad50964b9f27a3b182e74e437b40753ef Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef(a)toxicpanda.com>
Date: Mon, 10 Aug 2020 17:31:16 -0400
Subject: [PATCH] btrfs: check the right error variable in
btrfs_del_dir_entries_in_log
With my new locking code dbench is so much faster that I tripped over a
transaction abort from ENOSPC. This turned out to be because
btrfs_del_dir_entries_in_log was checking for ret == -ENOSPC, but this
function sets err on error, and returns err. So instead of properly
marking the inode as needing a full commit, we were returning -ENOSPC
and aborting in __btrfs_unlink_inode. Fix this by checking the proper
variable so that we return the correct thing in the case of ENOSPC.
The ENOENT needs to be checked, because btrfs_lookup_dir_item_index()
can return -ENOENT if the dir item isn't in the tree log (which would
happen if we hadn't fsync'ed this guy). We actually handle that case in
__btrfs_unlink_inode, so it's an expected error to get back.
Fixes: 4a500fd178c8 ("Btrfs: Metadata ENOSPC handling for tree log")
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: Josef Bacik <josef(a)toxicpanda.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
[ add note and comment about ENOENT ]
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 696dd861cc3c..39da9db35278 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3449,11 +3449,13 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
btrfs_free_path(path);
out_unlock:
mutex_unlock(&dir->log_mutex);
- if (ret == -ENOSPC) {
+ if (err == -ENOSPC) {
btrfs_set_log_full_commit(trans);
- ret = 0;
- } else if (ret < 0)
- btrfs_abort_transaction(trans, ret);
+ err = 0;
+ } else if (err < 0 && err != -ENOENT) {
+ /* ENOENT can be returned if the entry hasn't been fsynced yet */
+ btrfs_abort_transaction(trans, err);
+ }
btrfs_end_log_trans(root);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d7d8535f377e9ba87edbf7fbbd634ac942f3f54f Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei(a)redhat.com>
Date: Mon, 17 Aug 2020 18:01:15 +0800
Subject: [PATCH] blk-mq: order adding requests to hctx->dispatch and checking
SCHED_RESTART
SCHED_RESTART code path is relied to re-run queue for dispatch requests
in hctx->dispatch. Meantime the SCHED_RSTART flag is checked when adding
requests to hctx->dispatch.
memory barriers have to be used for ordering the following two pair of OPs:
1) adding requests to hctx->dispatch and checking SCHED_RESTART in
blk_mq_dispatch_rq_list()
2) clearing SCHED_RESTART and checking if there is request in hctx->dispatch
in blk_mq_sched_restart().
Without the added memory barrier, either:
1) blk_mq_sched_restart() may miss requests added to hctx->dispatch meantime
blk_mq_dispatch_rq_list() observes SCHED_RESTART, and not run queue in
dispatch side
or
2) blk_mq_dispatch_rq_list still sees SCHED_RESTART, and not run queue
in dispatch side, meantime checking if there is request in
hctx->dispatch from blk_mq_sched_restart() is missed.
IO hang in ltp/fs_fill test is reported by kernel test robot:
https://lkml.org/lkml/2020/7/26/77
Turns out it is caused by the above out-of-order OPs. And the IO hang
can't be observed any more after applying this patch.
Fixes: bd166ef183c2 ("blk-mq-sched: add framework for MQ capable IO schedulers")
Reported-by: kernel test robot <rong.a.chen(a)intel.com>
Signed-off-by: Ming Lei <ming.lei(a)redhat.com>
Reviewed-by: Christoph Hellwig <hch(a)lst.de>
Cc: Bart Van Assche <bvanassche(a)acm.org>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: David Jeffery <djeffery(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index a19cdf159b75..d2790e5b06d1 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -78,6 +78,15 @@ void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx)
return;
clear_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
+ /*
+ * Order clearing SCHED_RESTART and list_empty_careful(&hctx->dispatch)
+ * in blk_mq_run_hw_queue(). Its pair is the barrier in
+ * blk_mq_dispatch_rq_list(). So dispatch code won't see SCHED_RESTART,
+ * meantime new request added to hctx->dispatch is missed to check in
+ * blk_mq_run_hw_queue().
+ */
+ smp_mb();
+
blk_mq_run_hw_queue(hctx, true);
}
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 35f8d0692442..a80f4986e594 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1437,6 +1437,15 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list,
list_splice_tail_init(list, &hctx->dispatch);
spin_unlock(&hctx->lock);
+ /*
+ * Order adding requests to hctx->dispatch and checking
+ * SCHED_RESTART flag. The pair of this smp_mb() is the one
+ * in blk_mq_sched_restart(). Avoid restart code path to
+ * miss the new added requests to hctx->dispatch, meantime
+ * SCHED_RESTART is observed here.
+ */
+ smp_mb();
+
/*
* If SCHED_RESTART was set by the caller of this function and
* it is no longer set that means that it was cleared by another
The patch titled
Subject: shmem: shmem_writepage() split unlikely i915 THP
has been added to the -mm tree. Its filename is
shmem-shmem_writepage-split-unlikely-i915-thp.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/shmem-shmem_writepage-split-unlike…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/shmem-shmem_writepage-split-unlike…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Hugh Dickins <hughd(a)google.com>
Subject: shmem: shmem_writepage() split unlikely i915 THP
drivers/gpu/drm/i915/gem/i915_gem_shmem.c contains a shmem_writeback()
which calls shmem_writepage() from a shrinker: that usually works well
enough; but if /sys/kernel/mm/transparent_hugepage/shmem_enabled has been
set to "force" (documented as "Force the huge option on for all - very
useful for testing"), shmem_writepage() is surprised to be called with a
huge page, and crashes on the VM_BUG_ON_PAGE(PageCompound) (I did not find
out where the crash happens when CONFIG_DEBUG_VM is off).
LRU page reclaim always splits the shmem huge page first: I'd prefer not
to demand that of i915, so check and split compound in shmem_writepage().
Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008301401390.5954@eggly.anvils
Fixes: 2d6692e642e7 ("drm/i915: Start writeback from the shrinker")
Signed-off-by: Hugh Dickins <hughd(a)google.com>
Cc: Alex Shi <alex.shi(a)linux.alibaba.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Qian Cai <cai(a)lca.pw>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: <stable(a)vger.kernel.org> [5.3+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/shmem.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/mm/shmem.c~shmem-shmem_writepage-split-unlikely-i915-thp
+++ a/mm/shmem.c
@@ -1362,7 +1362,15 @@ static int shmem_writepage(struct page *
swp_entry_t swap;
pgoff_t index;
- VM_BUG_ON_PAGE(PageCompound(page), page);
+ /*
+ * If /sys/kernel/mm/transparent_hugepage/shmem_enabled is "force",
+ * then drivers/gpu/drm/i915/gem/i915_gem_shmem.c gets huge pages,
+ * and its shmem_writeback() needs them to be split when swapping.
+ */
+ if (PageTransCompound(page))
+ if (split_huge_page(page) < 0)
+ goto redirty;
+
BUG_ON(!PageLocked(page));
mapping = page->mapping;
index = page->index;
_
Patches currently in -mm which might be from hughd(a)google.com are
ksm-reinstate-memcg-charge-on-copied-pages.patch
mm-migration-of-hugetlbfs-page-skip-memcg.patch
shmem-shmem_writepage-split-unlikely-i915-thp.patch
mm-fix-check_move_unevictable_pages-on-thp.patch
mlock-fix-unevictable_pgs-event-counts-on-thp.patch
The patch titled
Subject: ksm: reinstate memcg charge on copied pages
has been added to the -mm tree. Its filename is
ksm-reinstate-memcg-charge-on-copied-pages.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/ksm-reinstate-memcg-charge-on-copi…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/ksm-reinstate-memcg-charge-on-copi…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Hugh Dickins <hughd(a)google.com>
Subject: ksm: reinstate memcg charge on copied pages
Patch series "mm: fixes to past from future testing".
Here's a set of independent fixes against 5.9-rc2: prompted by
testing Alex Shi's "warning on !memcg" and lru_lock series, but
I think fit for 5.9 - though maybe only the first for stable.
This patch (of 5):
In 5.8 some instances of memcg charging in do_swap_page() and unuse_pte()
were removed, on the understanding that swap cache is now already charged
at those points; but a case was missed, when ksm_might_need_to_copy() has
decided it must allocate a substitute page: such pages were never charged.
Fix it inside ksm_might_need_to_copy().
This was discovered by Alex Shi's prospective commit "mm/memcg: warning on
!memcg after readahead page charged".
But there is a another surprise: this also fixes some rarer uncharged
PageAnon cases, when KSM is configured in, but has never been activated.
ksm_might_need_to_copy()'s anon_vma->root and linear_page_index() check
sometimes catches a case which would need to have been copied if KSM were
turned on. Or that's my optimistic interpretation (of my own old code),
but it leaves some doubt as to whether everything is working as intended
there - might it hint at rare anon ptes which rmap cannot find? A
question not easily answered: put in the fix for missed memcg charges.
Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008301343270.5954@eggly.anvils
Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008301358020.5954@eggly.anvils
Fixes: 4c6355b25e8b ("mm: memcontrol: charge swapin pages on instantiation")
Signed-off-by: Hugh Dickins <hughd(a)google.com>
Cc: Alex Shi <alex.shi(a)linux.alibaba.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc; Matthew Wilcox <willy(a)infradead.org>
Cc: Qian Cai <cai(a)lca.pw>
Cc: <stable(a)vger.kernel.org> [5.8]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/ksm.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/mm/ksm.c~ksm-reinstate-memcg-charge-on-copied-pages
+++ a/mm/ksm.c
@@ -2586,6 +2586,10 @@ struct page *ksm_might_need_to_copy(stru
return page; /* let do_swap_page report the error */
new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, address);
+ if (new_page && mem_cgroup_charge(new_page, vma->vm_mm, GFP_KERNEL)) {
+ put_page(new_page);
+ new_page = NULL;
+ }
if (new_page) {
copy_user_highpage(new_page, page, address, vma);
_
Patches currently in -mm which might be from hughd(a)google.com are
ksm-reinstate-memcg-charge-on-copied-pages.patch
mm-migration-of-hugetlbfs-page-skip-memcg.patch
shmem-shmem_writepage-split-unlikely-i915-thp.patch
mm-fix-check_move_unevictable_pages-on-thp.patch
mlock-fix-unevictable_pgs-event-counts-on-thp.patch
Hello,
This commit is in v5.8 but it is affecting users in earlier kernels. I'd
like to propose this commit for merging to all earlier stable kernels.
$ git log --oneline -1 ea8912b788f8144e7d32ee61e5ccba45424bef83
ea8912b788f8 media: gpio-ir-tx: improve precision of transmitted signal due to scheduling
Thanks,
Sean
From: Tobias Schramm <t.schramm(a)manjaro.org>
[ Upstream commit ae1ba50f1e706dfd7ce402ac52c1f1f10becad68 ]
Previously the stm32h7 interrupt thread cleared all non-masked interrupts.
If an interrupt was to occur during the handling of another interrupt its
flag would be unset, resulting in a lost interrupt.
This patches fixes the issue by clearing only the currently set interrupt
flags.
Signed-off-by: Tobias Schramm <t.schramm(a)manjaro.org>
Link: https://lore.kernel.org/r/20200804195136.1485392-1-t.schramm@manjaro.org
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/spi/spi-stm32.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
index 4c643dfc7fbbc..4a21feae0103d 100644
--- a/drivers/spi/spi-stm32.c
+++ b/drivers/spi/spi-stm32.c
@@ -966,7 +966,7 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)
if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0)))
stm32h7_spi_read_rxfifo(spi, false);
- writel_relaxed(mask, spi->base + STM32H7_SPI_IFCR);
+ writel_relaxed(sr & mask, spi->base + STM32H7_SPI_IFCR);
spin_unlock_irqrestore(&spi->lock, flags);
--
2.25.1
The patch titled
Subject: fat: avoid oops when bdi->io_pages==0
has been added to the -mm tree. Its filename is
fat-avoid-oops-when-bdi-io_pages==0.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/fat-avoid-oops-when-bdi-io_pages%3…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/fat-avoid-oops-when-bdi-io_pages%3…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp>
Subject: fat: avoid oops when bdi->io_pages==0
On one system, there was bdi->io_pages==0. This seems to be the bug of a
driver somewhere, which perhaps failed to initialize io_pages. We should
fix it though - it is better to avoid the divide-by-zero Oops.
So add a check for this.
Link: http://lkml.kernel.org/r/87ft85osn6.fsf@mail.parknet.co.jp
Signed-off-by: OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Jens Axboe <axboe(a)kernel.dk>
Cc: <stable(a)vger.kernel.org> [5.8+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/fat/fatent.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/fat/fatent.c~fat-avoid-oops-when-bdi-io_pages==0
+++ a/fs/fat/fatent.c
@@ -660,7 +660,7 @@ static void fat_ra_init(struct super_blo
if (fatent->entry >= ent_limit)
return;
- if (ra_pages > sb->s_bdi->io_pages)
+ if (sb->s_bdi->io_pages && ra_pages > sb->s_bdi->io_pages)
ra_pages = rounddown(ra_pages, sb->s_bdi->io_pages);
reada_blocks = ra_pages << (PAGE_SHIFT - sb->s_blocksize_bits + 1);
_
Patches currently in -mm which might be from hirofumi(a)mail.parknet.co.jp are
fat-avoid-oops-when-bdi-io_pages==0.patch
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: 784a0830377d0761834e385975bc46861fea9fa0
Gitweb: https://git.kernel.org/tip/784a0830377d0761834e385975bc46861fea9fa0
Author: Thomas Gleixner <tglx(a)linutronix.de>
AuthorDate: Sun, 30 Aug 2020 19:07:53 +02:00
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Sun, 30 Aug 2020 19:17:28 +02:00
genirq/matrix: Deal with the sillyness of for_each_cpu() on UP
Most of the CPU mask operations behave the same way, but for_each_cpu() and
it's variants ignore the cpumask argument and claim that CPU0 is always in
the mask. This is historical, inconsistent and annoying behaviour.
The matrix allocator uses for_each_cpu() and can be called on UP with an
empty cpumask. The calling code does not expect that this succeeds but
until commit e027fffff799 ("x86/irq: Unbreak interrupt affinity setting")
this went unnoticed. That commit added a WARN_ON() to catch cases which
move an interrupt from one vector to another on the same CPU. The warning
triggers on UP.
Add a check for the cpumask being empty to prevent this.
Fixes: 2f75d9e1c905 ("genirq: Implement bitmap matrix allocator")
Reported-by: kernel test robot <rong.a.chen(a)intel.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: stable(a)vger.kernel.org
---
kernel/irq/matrix.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c
index 30cc217..651a4ad 100644
--- a/kernel/irq/matrix.c
+++ b/kernel/irq/matrix.c
@@ -380,6 +380,13 @@ int irq_matrix_alloc(struct irq_matrix *m, const struct cpumask *msk,
unsigned int cpu, bit;
struct cpumap *cm;
+ /*
+ * Not required in theory, but matrix_find_best_cpu() uses
+ * for_each_cpu() which ignores the cpumask on UP .
+ */
+ if (cpumask_empty(msk))
+ return -EINVAL;
+
cpu = matrix_find_best_cpu(m, msk);
if (cpu == UINT_MAX)
return -ENOSPC;
Hi
[This is an automated email]
This commit has been processed because it contains a -stable tag.
The stable tag indicates that it's relevant for the following trees: all
The bot has tested the following trees: v5.8.5, v5.4.61, v4.19.142, v4.14.195, v4.9.234, v4.4.234.
v5.8.5: Build OK!
v5.4.61: Failed to apply! Possible dependencies:
898310032b96 ("fat: improve the readahead for FAT entries")
a090a5a7d73f ("fat: fix fat_ra_init() for data clusters == 0")
v4.19.142: Failed to apply! Possible dependencies:
898310032b96 ("fat: improve the readahead for FAT entries")
a090a5a7d73f ("fat: fix fat_ra_init() for data clusters == 0")
v4.14.195: Failed to apply! Possible dependencies:
898310032b96 ("fat: improve the readahead for FAT entries")
a090a5a7d73f ("fat: fix fat_ra_init() for data clusters == 0")
f663b5b38fff ("fat: add FITRIM ioctl for FAT file system")
v4.9.234: Failed to apply! Possible dependencies:
898310032b96 ("fat: improve the readahead for FAT entries")
a090a5a7d73f ("fat: fix fat_ra_init() for data clusters == 0")
f663b5b38fff ("fat: add FITRIM ioctl for FAT file system")
v4.4.234: Failed to apply! Possible dependencies:
898310032b96 ("fat: improve the readahead for FAT entries")
8992de4cec12 ("fat: constify fatent_operations structures")
a090a5a7d73f ("fat: fix fat_ra_init() for data clusters == 0")
f663b5b38fff ("fat: add FITRIM ioctl for FAT file system")
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
--
Thanks
Sasha
Good Day,
I work as a clerk in a Bank here in Cotonou Benin Rep, I have a very
confidential Business Proposition for you. There is a said amount of
money floating in the bank unclaimed, (Fourth One Million Eight
Hundred Thousand Dollars) belonging to the bank Foreign customer who
die with his family in the Ethiopian Airline crash of March 11, 2019.
I seek your good collaboration to move the fund for our benefit. we
have agreed that 15% be yours once you help claim. Do get back to with
1) Your Full Name:(2) Residential Address:(3) Phone, Mobile (4) Scan
Copy of Your ID. to apply for claims of the funds.
Moreover, if this business proposition offends your moral ethics, do
accept my sincere delete.
Thanks & Regards
Mr, Mabou Emmanuel
On 32b, highmem uses a finite set of indirect PTE (i.e. vmap) to provide
virtual mappings of the high pages. As these are finite, map_new_virtual()
must wait for some other kmap() to finish when it runs out. If we map a
large number of objects, there is no method for it to tell us to release
the mappings, and we deadlock.
However, if we make an explicit vmap of the page, that uses a larger
vmalloc arena, and also has the ability to tell us to release unwanted
mappings. Most importantly, it will fail and propagate an error instead
of waiting forever.
Fixes: fb8621d3bee8 ("drm/i915: Avoid allocating a vmap arena for a single page") #x86-32
References: e87666b52f00 ("drm/i915/shrinker: Hook up vmap allocation failure notifier")
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Harald Arnesen <harald(a)skogtun.org>
Cc: <stable(a)vger.kernel.org> # v4.7+
---
drivers/gpu/drm/i915/gem/i915_gem_pages.c | 26 +++++++++++++++++++++--
1 file changed, 24 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_pages.c b/drivers/gpu/drm/i915/gem/i915_gem_pages.c
index 7050519c87a4..51b63e05dbe4 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_pages.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_pages.c
@@ -255,8 +255,30 @@ static void *i915_gem_object_map(struct drm_i915_gem_object *obj,
return NULL;
/* A single page can always be kmapped */
- if (n_pte == 1 && type == I915_MAP_WB)
- return kmap(sg_page(sgt->sgl));
+ if (n_pte == 1 && type == I915_MAP_WB) {
+ struct page *page = sg_page(sgt->sgl);
+
+ /*
+ * On 32b, highmem uses a finite set of indirect PTE (i.e.
+ * vmap) to provide virtual mappings of the high pages.
+ * As these are finite, map_new_virtual() must wait for some
+ * other kmap() to finish when it runs out. If we map a large
+ * number of objects, there is no method for it to tell us
+ * to release the mappings, and we deadlock.
+ *
+ * However, if we make an explicit vmap of the page, that
+ * uses a larger vmalloc arena, and also has the ability
+ * to tell us to release unwanted mappings. Most importantly,
+ * it will fail and propagate an error instead of waiting
+ * forever.
+ *
+ * So if the page is beyond the 32b boundary, make an explicit
+ * vmap. On 64b, this check will be optimised away as we can
+ * directly kmap any page on the system.
+ */
+ if (!PageHighMem(page))
+ return kmap(page);
+ }
mem = stack;
if (n_pte > ARRAY_SIZE(stack)) {
--
2.20.1
With the current implementation the following race can happen:
* blk_pre_runtime_suspend() calls blk_freeze_queue_start() and
blk_mq_unfreeze_queue().
* blk_queue_enter() calls blk_queue_pm_only() and that function returns
true.
* blk_queue_enter() calls blk_pm_request_resume() and that function does
not call pm_request_resume() because the queue runtime status is
RPM_ACTIVE.
* blk_pre_runtime_suspend() changes the queue status into RPM_SUSPENDING.
Fix this race by changing the queue runtime status into RPM_SUSPENDING
before switching q_usage_counter to atomic mode.
Cc: Alan Stern <stern(a)rowland.harvard.edu>
Cc: Stanley Chu <stanley.chu(a)mediatek.com>
Cc: Ming Lei <ming.lei(a)redhat.com>
Cc: stable <stable(a)vger.kernel.org>
Fixes: 986d413b7c15 ("blk-mq: Enable support for runtime power management")
Signed-off-by: Can Guo <cang(a)codeaurora.org>
Signed-off-by: Bart Van Assche <bvanassche(a)acm.org>
---
block/blk-pm.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/block/blk-pm.c b/block/blk-pm.c
index b85234d758f7..17bd020268d4 100644
--- a/block/blk-pm.c
+++ b/block/blk-pm.c
@@ -67,6 +67,10 @@ int blk_pre_runtime_suspend(struct request_queue *q)
WARN_ON_ONCE(q->rpm_status != RPM_ACTIVE);
+ spin_lock_irq(&q->queue_lock);
+ q->rpm_status = RPM_SUSPENDING;
+ spin_unlock_irq(&q->queue_lock);
+
/*
* Increase the pm_only counter before checking whether any
* non-PM blk_queue_enter() calls are in progress to avoid that any
@@ -89,15 +93,14 @@ int blk_pre_runtime_suspend(struct request_queue *q)
/* Switch q_usage_counter back to per-cpu mode. */
blk_mq_unfreeze_queue(q);
- spin_lock_irq(&q->queue_lock);
- if (ret < 0)
+ if (ret < 0) {
+ spin_lock_irq(&q->queue_lock);
+ q->rpm_status = RPM_ACTIVE;
pm_runtime_mark_last_busy(q->dev);
- else
- q->rpm_status = RPM_SUSPENDING;
- spin_unlock_irq(&q->queue_lock);
+ spin_unlock_irq(&q->queue_lock);
- if (ret)
blk_clear_pm_only(q);
+ }
return ret;
}
The indicated patch introduced a barrier in the sysfs_delete attribute
for the controller that rejects the request if the controller isn't
created. "Created" is defined as at least 1 call to nvme_start_ctrl().
This is problematic in error-injection testing. If an error occurs on
the initial attempt to create an association and the controller enters
reconnect(s) attempts, the admin cannot delete the controller until
either there is a successful association created or ctrl_loss_tmo
times out.
Where this issue is particularly hurtful is when the "admin" is the
nvme-cli, it is performing a connection to a discovery controller, and
it is initiated via auto-connect scripts. With the FC transport, if the
first connection attempt fails, the controller enters a normal reconnect
state but returns control to the cli thread that created the controller.
In this scenario, the cli attempts to read the discovery log via ioctl,
which fails, causing the cli to see it as an empty log and then proceeds
to delete the discovery controller. The delete is rejected and the
controller is left live. If the discovery controller reconnect then
succeeds, there is no action to delete it, and it sits live doing nothing.
Cc: <stable(a)vger.kernel.org> # v5.7+
Fixes: ce1518139e69 ("nvme: Fix controller creation races with teardown flow")
Signed-off-by: James Smart <james.smart(a)broadcom.com>
CC: Israel Rukshin <israelr(a)mellanox.com>
CC: Max Gurtovoy <maxg(a)mellanox.com>
CC: Christoph Hellwig <hch(a)lst.de>
CC: Keith Busch <kbusch(a)kernel.org>
CC: Sagi Grimberg <sagi(a)grimberg.me>
---
drivers/nvme/host/core.c | 5 -----
drivers/nvme/host/nvme.h | 1 -
2 files changed, 6 deletions(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 05aa568a60af..86abce864aa9 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3481,10 +3481,6 @@ static ssize_t nvme_sysfs_delete(struct device *dev,
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
- /* Can't delete non-created controllers */
- if (!ctrl->created)
- return -EBUSY;
-
if (device_remove_file_self(dev, attr))
nvme_delete_ctrl_sync(ctrl);
return count;
@@ -4355,7 +4351,6 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
nvme_queue_scan(ctrl);
nvme_start_queues(ctrl);
}
- ctrl->created = true;
}
EXPORT_SYMBOL_GPL(nvme_start_ctrl);
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index c5c1bac797aa..45cf360fefbc 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -300,7 +300,6 @@ struct nvme_ctrl {
struct nvme_command ka_cmd;
struct work_struct fw_act_work;
unsigned long events;
- bool created;
#ifdef CONFIG_NVME_MULTIPATH
/* asymmetric namespace access: */
--
2.26.2
Some systems are reporting the following log message during driver
unload or system shutdown:
ics_rtas_set_affinity: No online cpus in the mask
A prior commit introduced the writing of an empty affinity mask in calls
to irq_set_affinity_hint() when disabling interrupts or when there are
no remaining online cpus to service an eq interrupt. At least some ppc64
systems are checking whether affinity masks are empty or not.
Fix: Do not call irq_set_affinity_hint() with an empty cpu mask.
Fixes: dcaa21367938 ("scsi: lpfc: Change default IRQ model on AMD architectures")
Cc: <stable(a)vger.kernel.org> # v5.5+
Signed-off-by: Dick Kennedy <dick.kennedy(a)broadcom.com>
Signed-off-by: James Smart <james.smart(a)broadcom.com>
---
drivers/scsi/lpfc/lpfc_init.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 05ace6916b66..89c3ba0a0df9 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -11376,7 +11376,6 @@ lpfc_irq_clear_aff(struct lpfc_hba_eq_hdl *eqhdl)
{
cpumask_clear(&eqhdl->aff_mask);
irq_clear_status_flags(eqhdl->irq, IRQ_NO_BALANCING);
- irq_set_affinity_hint(eqhdl->irq, &eqhdl->aff_mask);
}
/**
--
2.26.2
Some systems are reporting the following log message during driver
unload or system shutdown:
ics_rtas_set_affinity: No online cpus in the mask
A prior commit introduced the writing of an empty affinity mask in calls
to irq_set_affinity_hint() when disabling interrupts or when there are
no remaining online cpus to service an eq interrupt. At least some ppc64
systems are checking whether affinity masks are empty or not.
Fix: Do not call irq_set_affinity_hint() with an empty cpu mask.
Fixes: dcaa21367938 ("scsi: lpfc: Change default IRQ model on AMD architectures")
Cc: <stable(a)vger.kernel.org> # v5.5+
Signed-off-by: Dick Kennedy <dick.kennedy(a)broadcom.com>
Signed-off-by: James Smart <james.smart(a)broadcom.com>
---
drivers/scsi/lpfc/lpfc_init.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 05ace6916b66..89c3ba0a0df9 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -11376,7 +11376,6 @@ lpfc_irq_clear_aff(struct lpfc_hba_eq_hdl *eqhdl)
{
cpumask_clear(&eqhdl->aff_mask);
irq_clear_status_flags(eqhdl->irq, IRQ_NO_BALANCING);
- irq_set_affinity_hint(eqhdl->irq, &eqhdl->aff_mask);
}
/**
--
2.26.2
Hi Greg/Sasha
The following 2 patches are backports of
46609ce22703: ("sched/uclamp: Protect uclamp fast path code with static key")
e65855a52b47: ("sched/uclamp: Fix a deadlock when enabling uclamp static key")
into 5.4.y stable tree. The conflict was trivial and due to:
1. uclamp_rq_util_with() was renamed from util_util_with()
2. 2 local variables were converted to unsigned long from unsigned int.
I did do compile test on aarch64 and x86_64 and both looked fine. Beside I ran
a quick and short mmtest to verify the functionality and got the following
results which is inline with what's expected.
5.4.y 5.4.y-static-keys
Hmean send-64 188.46 ( 0.00%) 189.95 * 0.79%*
Hmean send-128 375.65 ( 0.00%) 379.75 * 1.09%*
7.32% -0.33% [kernel.kallsyms] [k] try_to_wake_up
0.58% -0.55% [kernel.kallsyms] [k] deactivate_task
0.50% -0.45% [kernel.kallsyms] [k] activate_task
That said, it's Friday afternoon and I am off next week. If I did something
stupid and didn't find me, please accept my apologies in advance and will fix
it as soon as I am back online.
Thanks
--
Qais Yousef
Qais Yousef (2):
sched/uclamp: Protect uclamp fast path code with static key
sched/uclamp: Fix a deadlock when enabling uclamp static key
kernel/sched/core.c | 81 +++++++++++++++++++++++++++++++-
kernel/sched/cpufreq_schedutil.c | 2 +-
kernel/sched/sched.h | 47 +++++++++++++++++-
3 files changed, 126 insertions(+), 4 deletions(-)
--
2.17.1
Hi,
Please can commit a1769bb68a850508a492e3674ab1e5e479b11254 be back
merged to the 4.4, 4.9, 4.14, 4.19 and 5.4 LTS kernels to resolve a
PCIe hang with Wave 2-generation 802.11ac QCA chips?
commit a1769bb68a850508a492e3674ab1e5e479b11254
author Zhi Chen <zhichen(a)codeaurora.org>
date 2020-01-14 12:35:21 +0800
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
The issue resolved is that a value of 0 has a different meaning and
instruction depending on the specific chip. Wave 1 and Wave 2 QCA
802.11ac chips use this differently.
This meant that the original commit introduced a regression for the
Wave 2-generation 802.11ac QCA chips when seeking to resolve a
firmware crash issue affecting some Wave 1-generation 802.11ac QCA
chips.
This subsequently has only been partially reverted via this commit,
specifically for the 10_4 target only via TARGET_10_4_DMA_BURST_SIZE 1
The original commit that caused this regression from back in 2015 is
76d164f582150fd0259ec0fcbc485470bcd8033e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
With thanks,
Nick
commit 535e4fc623fab2e09a0653fc3a3e17f382ad0251 upstream.
The original upstream commit applies only to 5.7 and 5.8
stable trees. This is backport to 4.4, 4.9, 4.14, 4.19
and 5.4 trees.
The node distance is hardcoded to 0, which causes a trouble
for some user-level applications. In particular, "libnuma"
expects the distance of a node to itself as LOCAL_DISTANCE.
This update removes the offending node distance override.
Cc: Heiko Carstens <hca(a)linux.ibm.com>
Fixes: 3a368f742da1 ("s390/numa: add core infrastructure")
Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com>
---
arch/s390/numa/numa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/numa/numa.c b/arch/s390/numa/numa.c
index d2910fa..8f95db6 100644
--- a/arch/s390/numa/numa.c
+++ b/arch/s390/numa/numa.c
@@ -51,7 +51,7 @@ void numa_update_cpu_topology(void)
int __node_distance(int a, int b)
{
- return mode->distance ? mode->distance(a, b) : 0;
+ return mode->distance ? mode->distance(a, b) : LOCAL_DISTANCE;
}
EXPORT_SYMBOL(__node_distance);
--
1.8.3.1
Hi,
Can you cherry-pick this one:
commit e697deed834de15d2322d0619d51893022c90ea2
Author: Jiufei Xue <jiufei.xue(a)linux.alibaba.com>
Date: Wed Jun 10 13:41:59 2020 +0800
io_uring: check file O_NONBLOCK state for accept
into 5.7-stable? Thanks!
--
Jens Axboe
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: rc: do not access device via sysfs after rc_unregister_device()
Author: Sean Young <sean(a)mess.org>
Date: Sat Aug 8 13:38:02 2020 +0200
Device drivers do not expect to have change_protocol or wakeup
re-programming to be accesed after rc_unregister_device(). This can
cause the device driver to access deallocated resources.
Cc: <stable(a)vger.kernel.org> # 4.16+
Signed-off-by: Sean Young <sean(a)mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
drivers/media/rc/rc-main.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
---
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index e1cda80a4b25..dee8a9f3d80a 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1292,6 +1292,10 @@ static ssize_t store_protocols(struct device *device,
}
mutex_lock(&dev->lock);
+ if (!dev->registered) {
+ mutex_unlock(&dev->lock);
+ return -ENODEV;
+ }
old_protocols = *current_protocols;
new_protocols = old_protocols;
@@ -1430,6 +1434,10 @@ static ssize_t store_filter(struct device *device,
return -EINVAL;
mutex_lock(&dev->lock);
+ if (!dev->registered) {
+ mutex_unlock(&dev->lock);
+ return -ENODEV;
+ }
new_filter = *filter;
if (fattr->mask)
@@ -1544,6 +1552,10 @@ static ssize_t store_wakeup_protocols(struct device *device,
int i;
mutex_lock(&dev->lock);
+ if (!dev->registered) {
+ mutex_unlock(&dev->lock);
+ return -ENODEV;
+ }
allowed = dev->allowed_wakeup_protocols;
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: rc: do not access device via sysfs after rc_unregister_device()
Author: Sean Young <sean(a)mess.org>
Date: Sat Aug 8 13:38:02 2020 +0200
Device drivers do not expect to have change_protocol or wakeup
re-programming to be accesed after rc_unregister_device(). This can
cause the device driver to access deallocated resources.
Cc: <stable(a)vger.kernel.org> # 4.16+
Signed-off-by: Sean Young <sean(a)mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
drivers/media/rc/rc-main.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
---
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index e1cda80a4b25..dee8a9f3d80a 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1292,6 +1292,10 @@ static ssize_t store_protocols(struct device *device,
}
mutex_lock(&dev->lock);
+ if (!dev->registered) {
+ mutex_unlock(&dev->lock);
+ return -ENODEV;
+ }
old_protocols = *current_protocols;
new_protocols = old_protocols;
@@ -1430,6 +1434,10 @@ static ssize_t store_filter(struct device *device,
return -EINVAL;
mutex_lock(&dev->lock);
+ if (!dev->registered) {
+ mutex_unlock(&dev->lock);
+ return -ENODEV;
+ }
new_filter = *filter;
if (fattr->mask)
@@ -1544,6 +1552,10 @@ static ssize_t store_wakeup_protocols(struct device *device,
int i;
mutex_lock(&dev->lock);
+ if (!dev->registered) {
+ mutex_unlock(&dev->lock);
+ return -ENODEV;
+ }
allowed = dev->allowed_wakeup_protocols;
This is a note to let you know that I've just added the patch titled
kobject: Restore old behaviour of kobject_del(NULL)
to my driver-core git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git
in the driver-core-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 40b8b826a6998639dd1c26f0e127f18371e1058d Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Date: Mon, 3 Aug 2020 11:27:06 +0300
Subject: kobject: Restore old behaviour of kobject_del(NULL)
The commit 079ad2fb4bf9 ("kobject: Avoid premature parent object freeing in
kobject_cleanup()") inadvertently dropped a possibility to call kobject_del()
with NULL pointer. Restore the old behaviour.
Fixes: 079ad2fb4bf9 ("kobject: Avoid premature parent object freeing in kobject_cleanup()")
Cc: stable <stable(a)vger.kernel.org>
Reported-by: Qu Wenruo <quwenruo.btrfs(a)gmx.com>
Cc: Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Reviewed-by: Qu Wenruo <wqu(a)suse.com>
Link: https://lore.kernel.org/r/20200803082706.65347-1-andriy.shevchenko@linux.in…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
lib/kobject.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/lib/kobject.c b/lib/kobject.c
index 3afb939f2a1c..9dce68c378e6 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -637,8 +637,12 @@ static void __kobject_del(struct kobject *kobj)
*/
void kobject_del(struct kobject *kobj)
{
- struct kobject *parent = kobj->parent;
+ struct kobject *parent;
+
+ if (!kobj)
+ return;
+ parent = kobj->parent;
__kobject_del(kobj);
kobject_put(parent);
}
--
2.28.0
Tegra210/Tegra186/Tegra194 has incorrectly enabled
SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK from the beginning of their support.
Tegra210 and later SDMMC hardware default uses sdmmc_legacy_tm (TMCLK)
all the time for hardware data timeout instead of SDCLK and this TMCLK
need to be kept enabled by Tegra sdmmc driver.
This series includes patches to fix this for Tegra210/Tegra186/Tegra194.
These patches need to be manually backported to 4.19.
Will send patches for 4.19 backport separately.
Delta between patch versions:
[v7]: v7 has below change
- v6 has implementation for retrieving tmclk irrespective of
clocks order. But based in internal discussion with Thierry
this is not required as typically order specified in DT
bindings is the order validator want to see in DT.
[v6]: v5 is sent out mistakenly with incorrect patches.
v6 includes proper patches addressing v4 feedback
- updated dt-binding doc to be more clear
- updated Tegra sdhci driver to retrieve sdhci and tmclk clocks
based on no. of clocks in sdhci device node as old device trees
do not use sdhci clock name and this allows proper clock retrival
irrespective of sdhci and tmclk clocks order in device tree.
- Added separate quirk for identifying SoC's supporting separate
timeout clock to be more clear.
[v5]: Include below changes based on v4 feedback
- updated dt-binding doc to be more clear
- updated Tegra sdhci driver to retrieve sdhci and tmclk clocks
based on no. of clocks in sdhci device node as old device trees
do not use sdhci clock name and this allows proper clock retrival
irrespective of sdhci and tmclk clocks order in device tree.
- Added separate quirk for identifying SoC's supporting separate
timeout clock to be more clear.
[v4]: Include additional dt-binding patch
[v3]: Same as v2 with fixes tag
[v2]: Includes minor fix
- Patch-0006: parentheses around operand of '!'
Sowjanya Komatineni (7):
sdhci: tegra: Remove SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK for Tegra210
sdhci: tegra: Remove SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK for Tegra186
dt-bindings: mmc: tegra: Add tmclk for Tegra210 and later
arm64: tegra: Add missing timeout clock to Tegra210 SDMMC
arm64: tegra: Add missing timeout clock to Tegra186 SDMMC nodes
arm64: tegra: Add missing timeout clock to Tegra194 SDMMC nodes
sdhci: tegra: Add missing TMCLK for data timeout
.../bindings/mmc/nvidia,tegra20-sdhci.txt | 32 +++++++++++--
arch/arm64/boot/dts/nvidia/tegra186.dtsi | 20 ++++----
arch/arm64/boot/dts/nvidia/tegra194.dtsi | 15 +++---
arch/arm64/boot/dts/nvidia/tegra210.dtsi | 20 ++++----
drivers/mmc/host/sdhci-tegra.c | 55 ++++++++++++++++++++--
5 files changed, 113 insertions(+), 29 deletions(-)
--
2.7.4
Hi,
I'm adding stable(a)vger.kernel.org
On 2020-06-20 05:26, Martin K. Petersen wrote:
> On Thu, 18 Jun 2020 15:16:30 +0200, Bodo Stroesser wrote:
>
>> This small series of patches consists of:
>> [PATCH 1/2 v2] scsi: target: tcmu: Optimize use of flush_dcache_page
>> [PATCH 2/2 v2] scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range
>>
>> Together with commit
>> 8c4e0f212398 scsi: target: tcmu: Fix size in calls to tcmu_flush_dcache_range
>> these patches fix crashes in tcmu on ARM.
>>
>> [...]
>
> Applied to 5.9/scsi-queue, thanks!
>
> [1/2] scsi: target: tcmu: Optimize use of flush_dcache_page
> https://git.kernel.org/mkp/scsi/c/3c58f737231e
> [2/2] scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM
> https://git.kernel.org/mkp/scsi/c/3145550a7f8b
>
Patch 2/2 of this series already made it into 5.8, (5.7,) 5.4 and 4.19,
but patch 1/2 was not added yet. The crash will be fixed with with both
patches only. So please consider adding patch 1/2 also. The full commit
is 3c58f737231e2c8cbf543a09d84d8c8e80e05e43
Thank you
Bodo
This is a note to let you know that I've just added the patch titled
usb: storage: Add unusual_uas entry for Sony PSZ drives
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 20934c0de13b49a072fb1e0ca79fe0fe0e40eae5 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern(a)rowland.harvard.edu>
Date: Wed, 26 Aug 2020 10:32:29 -0400
Subject: usb: storage: Add unusual_uas entry for Sony PSZ drives
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The PSZ-HA* family of USB disk drives from Sony can't handle the
REPORT OPCODES command when using the UAS protocol. This patch adds
an appropriate quirks entry.
Reported-and-tested-by: Till Dörges <doerges(a)pre-sense.de>
Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu>
CC: <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20200826143229.GB400430@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/storage/unusual_uas.h | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index 971f8a4354c8..711ab240058c 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -28,6 +28,13 @@
* and don't forget to CC: the USB development list <linux-usb(a)vger.kernel.org>
*/
+/* Reported-by: Till Dörges <doerges(a)pre-sense.de> */
+UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x9999,
+ "Sony",
+ "PSZ-HA*",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_REPORT_OPCODES),
+
/* Reported-by: Julian Groß <julian.g(a)posteo.de> */
UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999,
"LaCie",
--
2.28.0
From: Dirk Behme <dirk.behme(a)de.bosch.com>
The i2c-rcar driver utilizes the Generic Reset Controller kernel
feature, so select the RESET_CONTROLLER option when the I2C_RCAR
option is selected.
Fixes: 2b16fd63059ab9 ("i2c: rcar: handle RXDMA HW behaviour on Gen3")
Cc: Wolfram Sang <wsa+renesas(a)sang-engineering.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Dirk Behme <dirk.behme(a)de.bosch.com>
Signed-off-by: Andy Lowe <andy_lowe(a)mentor.com>
[erosca: Add "if ARCH_RCAR_GEN3" on Wolfram's request]
Signed-off-by: Eugeniu Rosca <erosca(a)de.adit-jv.com>
---
v2:
- Append "if ARCH_RCAR_GEN3" to "select", as requested by Wolfram
in https://lore.kernel.org/linux-i2c/20200824120734.GA2500@ninjato/
v1:
- https://lore.kernel.org/linux-i2c/20200824062623.9346-1-erosca@de.adit-jv.c…
---
drivers/i2c/busses/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 293e7a0760e7..7ccbfbcb02e9 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -1181,6 +1181,7 @@ config I2C_RCAR
tristate "Renesas R-Car I2C Controller"
depends on ARCH_RENESAS || COMPILE_TEST
select I2C_SLAVE
+ select RESET_CONTROLLER if ARCH_RCAR_GEN3
help
If you say yes to this option, support will be included for the
R-Car I2C controller.
--
2.28.0
The GSC registers report temperature in decidegrees celcius so we
need to scale it to represent the hwmon sysfs API of millidegrees.
Cc: stable(a)vger.kernel.org
Signed-off-by: Tim Harvey <tharvey(a)gateworks.com>
---
drivers/hwmon/gsc-hwmon.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hwmon/gsc-hwmon.c b/drivers/hwmon/gsc-hwmon.c
index 3dfe2ca..c6d4567 100644
--- a/drivers/hwmon/gsc-hwmon.c
+++ b/drivers/hwmon/gsc-hwmon.c
@@ -172,6 +172,7 @@ gsc_hwmon_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
case mode_temperature:
if (tmp > 0x8000)
tmp -= 0xffff;
+ tmp *= 100; /* convert to millidegrees celsius */
break;
case mode_voltage_raw:
tmp = clamp_val(tmp, 0, BIT(GSC_HWMON_RESOLUTION));
--
2.7.4
From: Randy Dunlap <rdunlap(a)infradead.org>
Fix build error when CONFIG_ACPI is not set/enabled by adding
the header file <asm/acpi.h> which contains a stub for the function
in the build error.
../arch/x86/pci/intel_mid_pci.c: In function ‘intel_mid_pci_init’:
../arch/x86/pci/intel_mid_pci.c:303:2: error: implicit declaration of function ‘acpi_noirq_set’; did you mean ‘acpi_irq_get’? [-Werror=implicit-function-declaration]
acpi_noirq_set();
Fixes: a912a7584ec3 ("x86/platform/intel-mid: Move PCI initialization to arch_init()")
Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org>
Cc: stable(a)vger.kernel.org # v4.16+
Cc: Jacob Pan <jacob.jun.pan(a)linux.intel.com>
Cc: Len Brown <lenb(a)kernel.org>
To: Bjorn Helgaas <bhelgaas(a)google.com>
Cc: Jesse Barnes <jsbarnes(a)google.com>
Cc: Arjan van de Ven <arjan(a)linux.intel.com>
Cc: linux-pci(a)vger.kernel.org
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Reviewed-by: Jesse Barnes <jsbarnes(a)google.com>
Acked-by: Thomas Gleixner <tglx(a)linutronix.de>
---
Found in linux-next, but applies to/exists in mainline also.
v2:
- add Reviewed-by: and Acked-by: tags
- drop alternatives
arch/x86/pci/intel_mid_pci.c | 1 +
1 file changed, 1 insertion(+)
--- linux-next-20200813.orig/arch/x86/pci/intel_mid_pci.c
+++ linux-next-20200813/arch/x86/pci/intel_mid_pci.c
@@ -33,6 +33,7 @@
#include <asm/hw_irq.h>
#include <asm/io_apic.h>
#include <asm/intel-mid.h>
+#include <asm/acpi.h>
#define PCIE_CAP_OFFSET 0x100
Tegra210/Tegra186/Tegra194 has incorrectly enabled
SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK from the beginning of their support.
Tegra210 and later SDMMC hardware default uses sdmmc_legacy_tm (TMCLK)
all the time for hardware data timeout instead of SDCLK and this TMCLK
need to be kept enabled by Tegra sdmmc driver.
This series includes patches to fix this for Tegra210/Tegra186/Tegra194.
These patches need to be manually backported for 4.9, 4.14 and 4.19.
Will send patches to backport separately once these patches are ack'd.
Delta between patch versions:
[v6]: v5 is sent out mistakenly with incorrect patches.
v6 includes proper patches addressing v4 feedback
- updated dt-binding doc to be more clear
- updated Tegra sdhci driver to retrieve sdhci and tmclk clocks
based on no. of clocks in sdhci device node as old device trees
do not use sdhci clock name and this allows proper clock retrival
irrespective of sdhci and tmclk clocks order in device tree.
- Added separate quirk for identifying SoC's supporting separate
timeout clock to be more clear.
[v5]: Include below changes based on v4 feedback
- updated dt-binding doc to be more clear
- updated Tegra sdhci driver to retrieve sdhci and tmclk clocks
based on no. of clocks in sdhci device node as old device trees
do not use sdhci clock name and this allows proper clock retrival
irrespective of sdhci and tmclk clocks order in device tree.
- Added separate quirk for identifying SoC's supporting separate
timeout clock to be more clear.
[v4]: Include additional dt-binding patch
[v3]: Same as v2 with fixes tag
[v2]: Includes minor fix
- Patch-0006: parentheses around operand of '!'
Sowjanya Komatineni (7):
sdhci: tegra: Remove SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK for Tegra210
sdhci: tegra: Remove SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK for Tegra186
dt-bindings: mmc: tegra: Add tmclk for Tegra210 and later
arm64: tegra: Add missing timeout clock to Tegra210 SDMMC
arm64: tegra: Add missing timeout clock to Tegra186 SDMMC nodes
arm64: tegra: Add missing timeout clock to Tegra194 SDMMC nodes
sdhci: tegra: Add missing TMCLK for data timeout
.../bindings/mmc/nvidia,tegra20-sdhci.txt | 32 +++++++-
arch/arm64/boot/dts/nvidia/tegra186.dtsi | 20 +++--
arch/arm64/boot/dts/nvidia/tegra194.dtsi | 15 ++--
arch/arm64/boot/dts/nvidia/tegra210.dtsi | 20 +++--
drivers/mmc/host/sdhci-tegra.c | 92 +++++++++++++++++++---
5 files changed, 144 insertions(+), 35 deletions(-)
--
2.7.4
commit 90a9b102eddf6a3f987d15f4454e26a2532c1c98 upstream.
As per PAPR we have to look for both EPOW sensor value and event
modifier to identify the type of event and take appropriate action.
In LoPAPR v1.1 section 10.2.2 includes table 136 "EPOW Action Codes":
SYSTEM_SHUTDOWN 3
The system must be shut down. An EPOW-aware OS logs the EPOW error
log information, then schedules the system to be shut down to begin
after an OS defined delay internal (default is 10 minutes.)
Then in section 10.3.2.2.8 there is table 146 "Platform Event Log
Format, Version 6, EPOW Section", which includes the "EPOW Event
Modifier":
For EPOW sensor value = 3
0x01 = Normal system shutdown with no additional delay
0x02 = Loss of utility power, system is running on UPS/Battery
0x03 = Loss of system critical functions, system should be shutdown
0x04 = Ambient temperature too high
All other values = reserved
We have a user space tool (rtas_errd) on LPAR to monitor for
EPOW_SHUTDOWN_ON_UPS. Once it gets an event it initiates shutdown
after predefined time. It also starts monitoring for any new EPOW
events. If it receives "Power restored" event before predefined time
it will cancel the shutdown. Otherwise after predefined time it will
shutdown the system.
Commit 79872e35469b ("powerpc/pseries: All events of
EPOW_SYSTEM_SHUTDOWN must initiate shutdown") changed our handling of
the "on UPS/Battery" case, to immediately shutdown the system. This
breaks existing setups that rely on the userspace tool to delay
shutdown and let the system run on the UPS.
Fixes: 79872e35469b ("powerpc/pseries: All events of EPOW_SYSTEM_SHUTDOWN must initiate shutdown")
Cc: stable(a)vger.kernel.org # v4.0+
Signed-off-by: Vasant Hegde <hegdevasant(a)linux.vnet.ibm.com>
[mpe: Massage change log and add PAPR references]
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
Link: https://lore.kernel.org/r/20200820061844.306460-1-hegdevasant@linux.vnet.ib…
Signed-off-by: Vasant Hegde <hegdevasant(a)linux.vnet.ibm.com>
---
Hi,
Please apply this patch to linux-stable-v4.4 branch. Its already applied to
other required stable branches.
-Vasant
arch/powerpc/platforms/pseries/ras.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index 9e817c1b7808..1fa8e492ce27 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -90,7 +90,6 @@ static void handle_system_shutdown(char event_modifier)
pr_emerg("Loss of power reported by firmware, system is "
"running on UPS/battery");
pr_emerg("Check RTAS error log for details");
- orderly_poweroff(true);
break;
case EPOW_SHUTDOWN_LOSS_OF_CRITICAL_FUNCTIONS:
--
2.26.2
Hi,
+stable
On Wed, 22 Jul 2020, Mark Brown wrote:
> Applied to
>
> https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next
[...]
>
> [1/1] ASoC: intel/skl/hda - fix probe regression on systems without i915
> commit: ffc6d45d96f07a32700cb6b7be2d3459e63c255a
please apply this to stable kernels as well. Without the patch, audio is
broken with 5.8.x on many laptops (with Intel audio and non-Intel
graphics). One more recent bug filed:
https://github.com/thesofproject/sof/issues/3345
This does _not_ affect 5.7.x and older, plus already fixed in 5.9-rc.
Br, Kai
Commit 633260fa143 ("x86/irq: Convey vector as argument and not in ptregs")
changed the handover logic of the vector identifier from ~vector in orig_ax
to purely register based. Unfortunately, this field has another consumer
in the APIC code which the commit did not touch. The net result was that
IRQ balancing did not work and instead resulted in interrupt storms, slowing
down the system.
This patch restores the original semantics that orig_ax contains the vector.
When we receive an interrupt now, the actual vector number stays stored in
the orig_ax field which then gets consumed by the APIC code.
To ensure that nobody else trips over this in the future, the patch also adds
comments at strategic places to warn anyone who would refactor the code that
there is another consumer of the field.
With this patch in place, IRQ balancing works as expected and performance
levels are restored to previous levels.
Reported-by: Alex bykov <alex.bykov(a)scylladb.com>
Reported-by: Avi Kivity <avi(a)scylladb.com>
Fixes: 633260fa143 ("x86/irq: Convey vector as argument and not in ptregs")
Cc: stable(a)vger.kernel.org
Signed-off-by: Alexander Graf <graf(a)amazon.com>
---
arch/x86/entry/entry_32.S | 2 +-
arch/x86/entry/entry_64.S | 17 +++++++++++------
arch/x86/kernel/apic/vector.c | 2 +-
3 files changed, 13 insertions(+), 8 deletions(-)
diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index df8c017..22e829c 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -727,7 +727,7 @@ SYM_CODE_START_LOCAL(asm_\cfunc)
ENCODE_FRAME_POINTER
movl %esp, %eax
movl PT_ORIG_EAX(%esp), %edx /* get the vector from stack */
- movl $-1, PT_ORIG_EAX(%esp) /* no syscall to restart */
+ /* keep vector on stack for APIC's irq_complete_move() */
call \cfunc
jmp handle_exception_return
SYM_CODE_END(asm_\cfunc)
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 70dea93..d78fb1c 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -319,7 +319,7 @@ SYM_CODE_END(ret_from_fork)
* @cfunc: C function to be called
* @has_error_code: Hardware pushed error code on stack
*/
-.macro idtentry_body cfunc has_error_code:req
+.macro idtentry_body cfunc has_error_code:req preserve_error_code:req
call error_entry
UNWIND_HINT_REGS
@@ -328,7 +328,9 @@ SYM_CODE_END(ret_from_fork)
.if \has_error_code == 1
movq ORIG_RAX(%rsp), %rsi /* get error code into 2nd argument*/
- movq $-1, ORIG_RAX(%rsp) /* no syscall to restart */
+ .if \preserve_error_code == 0
+ movq $-1, ORIG_RAX(%rsp) /* no syscall to restart */
+ .endif
.endif
call \cfunc
@@ -346,7 +348,7 @@ SYM_CODE_END(ret_from_fork)
* The macro emits code to set up the kernel context for straight forward
* and simple IDT entries. No IST stack, no paranoid entry checks.
*/
-.macro idtentry vector asmsym cfunc has_error_code:req
+.macro idtentry vector asmsym cfunc has_error_code:req preserve_error_code=0
SYM_CODE_START(\asmsym)
UNWIND_HINT_IRET_REGS offset=\has_error_code*8
ASM_CLAC
@@ -369,7 +371,7 @@ SYM_CODE_START(\asmsym)
.Lfrom_usermode_no_gap_\@:
.endif
- idtentry_body \cfunc \has_error_code
+ idtentry_body \cfunc \has_error_code \preserve_error_code
_ASM_NOKPROBE(\asmsym)
SYM_CODE_END(\asmsym)
@@ -382,11 +384,14 @@ SYM_CODE_END(\asmsym)
* position of idtentry exceptions, and jump to one of the two idtentry points
* (common/spurious).
*
+ * The original vector number on the stack has to stay untouched, so that the
+ * APIC irq_complete_move() code can access it later on IRQ ack.
+ *
* common_interrupt is a hotpath, align it to a cache line
*/
.macro idtentry_irq vector cfunc
.p2align CONFIG_X86_L1_CACHE_SHIFT
- idtentry \vector asm_\cfunc \cfunc has_error_code=1
+ idtentry \vector asm_\cfunc \cfunc has_error_code=1 preserve_error_code=1
.endm
/*
@@ -440,7 +445,7 @@ SYM_CODE_START(\asmsym)
/* Switch to the regular task stack and use the noist entry point */
.Lfrom_usermode_switch_stack_\@:
- idtentry_body noist_\cfunc, has_error_code=0
+ idtentry_body noist_\cfunc, has_error_code=0, preserve_error_code=0
_ASM_NOKPROBE(\asmsym)
SYM_CODE_END(\asmsym)
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index dae32d9..e81b835 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -924,7 +924,7 @@ static void __irq_complete_move(struct irq_cfg *cfg, unsigned vector)
void irq_complete_move(struct irq_cfg *cfg)
{
- __irq_complete_move(cfg, ~get_irq_regs()->orig_ax);
+ __irq_complete_move(cfg, (u8)get_irq_regs()->orig_ax);
}
/*
--
1.8.3.1
Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879
-------------------
Note, ok, this is really going to be the final 5.7.y kernel release. I
mean it this time....
-------------------
This is the start of the stable review cycle for the 5.7.19 release.
There are 15 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 28 Aug 2020 11:48:35 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.7.19-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.7.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.7.19-rc1
Max Filippov <jcmvbkbc(a)gmail.com>
binfmt_flat: revert "binfmt_flat: don't offset the data start"
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/64s: Don't init FSCR_DSCR in __init_FSCR()
Maxim Mikityanskiy <maximmi(a)mellanox.com>
ethtool: Don't omit the netlink reply if no features were changed
Maxim Mikityanskiy <maximmi(a)mellanox.com>
ethtool: Account for hw_features in netlink interface
Maxim Mikityanskiy <maximmi(a)mellanox.com>
ethtool: Fix preserving of wanted feature bits in netlink interface
Shay Agroskin <shayagr(a)amazon.com>
net: ena: Make missed_tx stat incremental
Cong Wang <xiyou.wangcong(a)gmail.com>
tipc: fix uninit skb->data in tipc_nl_compat_dumpit()
Xin Long <lucien.xin(a)gmail.com>
tipc: call rcu_read_lock() in tipc_aead_encrypt_done()
Peilin Ye <yepeilin.cs(a)gmail.com>
net/smc: Prevent kernel-infoleak in __smc_diag_dump()
David Laight <David.Laight(a)ACULAB.COM>
net: sctp: Fix negotiation of the number of data streams.
Alaa Hleihel <alaa(a)mellanox.com>
net/sched: act_ct: Fix skb double-free in tcf_ct_handle_fragments() error flow
Necip Fazil Yildiran <necip(a)google.com>
net: qrtr: fix usage of idr in port assignment to socket
Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com>
net: nexthop: don't allow empty NHA_GROUP
Miaohe Lin <linmiaohe(a)huawei.com>
net: Fix potential wrong skb->protocol in skb_vlan_untag()
Mark Tomlinson <mark.tomlinson(a)alliedtelesis.co.nz>
gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY
-------------
Diffstat:
Makefile | 4 ++--
arch/powerpc/kernel/cpu_setup_power.S | 2 +-
drivers/net/ethernet/amazon/ena/ena_netdev.c | 5 ++++-
fs/binfmt_flat.c | 20 ++++++++++++--------
net/core/skbuff.c | 4 ++--
net/ethtool/features.c | 19 ++++++++++---------
net/ipv4/nexthop.c | 5 ++++-
net/ipv6/ip6_tunnel.c | 10 +++++++++-
net/qrtr/qrtr.c | 20 +++++++++++---------
net/sched/act_ct.c | 2 +-
net/sctp/stream.c | 6 ++++--
net/smc/smc_diag.c | 16 +++++++++-------
net/tipc/crypto.c | 2 ++
net/tipc/netlink_compat.c | 12 +++++++++++-
14 files changed, 82 insertions(+), 45 deletions(-)
This is the start of the stable review cycle for the 5.8.5 release.
There are 16 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 28 Aug 2020 11:49:02 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.8.5-rc1.…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.8.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.8.5-rc1
Max Filippov <jcmvbkbc(a)gmail.com>
binfmt_flat: revert "binfmt_flat: don't offset the data start"
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: fix missing ->mm on exit
Johannes Berg <johannes.berg(a)intel.com>
netlink: fix state reallocation in policy export
Maxim Mikityanskiy <maximmi(a)mellanox.com>
ethtool: Don't omit the netlink reply if no features were changed
Maxim Mikityanskiy <maximmi(a)mellanox.com>
ethtool: Account for hw_features in netlink interface
Maxim Mikityanskiy <maximmi(a)mellanox.com>
ethtool: Fix preserving of wanted feature bits in netlink interface
Shay Agroskin <shayagr(a)amazon.com>
net: ena: Make missed_tx stat incremental
Cong Wang <xiyou.wangcong(a)gmail.com>
tipc: fix uninit skb->data in tipc_nl_compat_dumpit()
Xin Long <lucien.xin(a)gmail.com>
tipc: call rcu_read_lock() in tipc_aead_encrypt_done()
Peilin Ye <yepeilin.cs(a)gmail.com>
net/smc: Prevent kernel-infoleak in __smc_diag_dump()
David Laight <David.Laight(a)ACULAB.COM>
net: sctp: Fix negotiation of the number of data streams.
Alaa Hleihel <alaa(a)mellanox.com>
net/sched: act_ct: Fix skb double-free in tcf_ct_handle_fragments() error flow
Necip Fazil Yildiran <necip(a)google.com>
net: qrtr: fix usage of idr in port assignment to socket
Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com>
net: nexthop: don't allow empty NHA_GROUP
Miaohe Lin <linmiaohe(a)huawei.com>
net: Fix potential wrong skb->protocol in skb_vlan_untag()
Mark Tomlinson <mark.tomlinson(a)alliedtelesis.co.nz>
gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY
-------------
Diffstat:
Makefile | 4 ++--
drivers/net/ethernet/amazon/ena/ena_netdev.c | 5 ++++-
fs/binfmt_flat.c | 20 ++++++++++++--------
fs/io_uring.c | 3 ++-
net/core/skbuff.c | 4 ++--
net/ethtool/features.c | 19 ++++++++++---------
net/ipv4/nexthop.c | 5 ++++-
net/ipv6/ip6_tunnel.c | 10 +++++++++-
net/netlink/policy.c | 3 +++
net/qrtr/qrtr.c | 20 +++++++++++---------
net/sched/act_ct.c | 2 +-
net/sctp/stream.c | 6 ++++--
net/smc/smc_diag.c | 16 +++++++++-------
net/tipc/crypto.c | 2 ++
net/tipc/netlink_compat.c | 12 +++++++++++-
15 files changed, 86 insertions(+), 45 deletions(-)
On Thu, 27 Aug 2020 at 06:56, Caleb Jorden <caljorden(a)hotmail.com> wrote:
>
> I can tell you all assumed this, but just by way as a quick update on the original issue:
>
> I have confirmed that Herbert's patch (crypto: af_alg - Work around empty control messages without MSG_MORE) does indeed fix the original iwd 1.8 + WPA Enterprise issue.
>
> Thank you!
>
> Caleb Jorden
>
Thanks for confirming.
> ________________________________________
> From: Herbert Xu <herbert(a)gondor.apana.org.au>
> Sent: Thursday, August 27, 2020 3:49 AM
> To: Ard Biesheuvel
> Cc: Denis Kenzior; Andrew Zaborowski; Paul Menzel; Caleb Jorden; Sasha Levin; iwd(a)lists.01.org; # 3.4.x; Greg KH; LKML; David S. Miller; Linux Crypto Mailing List
> Subject: Re: Issue with iwd + Linux 5.8.3 + WPA Enterprise
>
> On Wed, Aug 26, 2020 at 05:42:27PM +0200, Ard Biesheuvel wrote:
> >
> > I still get a failure in aes_siv_encrypt(), which does not occur with
> > the kernel side fix applied.
>
> Where is this test from? I can't find it in the ell git tree.
>
> Thanks,
> --
> Email: Herbert Xu <herbert(a)gondor.apana.org.au>
> Home Page: http://gondor.apana.org.au/~herbert/
> PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Dear Caleb,
Thank you for the report. Linux has a no regression policy, so the
correct forum to report this to is the Linux kernel folks. I am adding
the crypto and stable folks to the receiver list.
Am 26.08.20 um 07:51 schrieb caljorden(a)hotmail.com:
> I wanted to note an issue that I have hit with iwd when I upgraded to
> the Linux 5.8.3 stable kernel. My office network uses WPA Enterprise
> with EAP-PEAPv0 + MSCHAPv2. When using this office network,
> upgrading to Linux 5.8.3 caused my system to refuse to associate
> successfully to the network. I get the following in my dmesg logs:
>
> [ 40.846535] wlan0: authenticate with <redacted>:60
> [ 40.850570] wlan0: send auth to <redacted>:60 (try 1/3)
> [ 40.854627] wlan0: authenticated
> [ 40.855992] wlan0: associate with <redacted>:60 (try 1/3)
> [ 40.860450] wlan0: RX AssocResp from <redacted>:60 (capab=0x411 status=0 aid=11)
> [ 40.861620] wlan0: associated
> [ 41.886503] wlan0: deauthenticating from <redacted>:60 by local choice (Reason: 23=IEEE8021X_FAILED)
> [ 42.360127] wlan0: authenticate with <redacted>:22
> [ 42.364584] wlan0: send auth to <redacted>:22 (try 1/3)
> [ 42.370821] wlan0: authenticated
> [ 42.372658] wlan0: associate with <redacted>:22 (try 1/3)
> [ 42.377426] wlan0: RX AssocResp from <redacted>:22 (capab=0x411 status=0 aid=15)
> [ 42.378607] wlan0: associated
> [ 43.402009] wlan0: deauthenticating from <redacted>:22 by local choice (Reason: 23=IEEE8021X_FAILED)
> [ 43.875921] wlan0: authenticate with <redacted>:60
> [ 43.879988] wlan0: send auth to <redacted>:60 (try 1/3)
> [ 43.886244] wlan0: authenticated
> [ 43.889273] wlan0: associate with <redacted>:60 (try 1/3)
> [ 43.894586] wlan0: RX AssocResp from <redacted>:60 (capab=0x411 status=0 aid=11)
> [ 43.896077] wlan0: associated
> [ 44.918504] wlan0: deauthenticating from <redacted>:60 by local choice (Reason: 23=IEEE8021X_FAILED)
>
> This continues as long as I let iwd run.
>
> I downgraded back to Linux 5.8.2, and verified that everything works
> as expected. I also tried using Linux 5.8.3 on a different system at
> my home, which uses WPA2-PSK. It worked fine (though it uses an
> Atheros wireless card instead of an Intel card - but I assume that is
> irrelevant).
>
> I decided to try to figure out what caused the issue in the changes
> for Linux 5.8.3. I assumed that it was something that changed in the
> crypto interface, which limited my bisection to a very few commits.
> Sure enough, I found that if I revert commit
> e91d82703ad0bc68942a7d91c1c3d993e3ad87f0 (crypto: algif_aead - Only
> wake up when ctx->more is zero), the problem goes away and I am able
> to associate to my WPA Enterprise network successfully, and use it.
> I found that in order to revert this commit, I also first had to
> revert 465c03e999102bddac9b1e132266c232c5456440 (crypto: af_alg - Fix
> regression on empty requests), because the two commits have coupled
> changes.
>
> I normally would have assumed that this should be sent to the kernel
> list, but I thought I would first mention it here because of what I
> found in some email threads on the Linux-Crypto list about the crypto
> interfaces to the kernel being sub-optimal and needing to be fixed.
> The changes in these commits look like they are just trying to fix
> what could be broken interfaces, so I thought that it would make
> sense to see what the iwd team thinks about the situation first.
>
> The wireless card I was using during this testing is an Intel
> Wireless 3165 (rev 81). If there is any additional information I
> could help provide, please let me know.
It’d be great, if you verified, if the problem occurs with Linus’ master
branch too.
Kind regards,
Paul
----------
Note, this is the LAST 5.7.y kernel to be released. This release series
is now end-of-life, please move to 5.8.y at this point in time.
------------
I'm announcing the release of the 5.7.19 kernel.
All users of the 5.7 kernel series must upgrade.
The updated 5.7.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.7.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
arch/powerpc/kernel/cpu_setup_power.S | 2 +-
drivers/net/ethernet/amazon/ena/ena_netdev.c | 5 ++++-
fs/binfmt_flat.c | 20 ++++++++++++--------
net/core/skbuff.c | 4 ++--
net/ethtool/features.c | 19 ++++++++++---------
net/ipv4/nexthop.c | 5 ++++-
net/ipv6/ip6_tunnel.c | 10 +++++++++-
net/qrtr/qrtr.c | 20 +++++++++++---------
net/sched/act_ct.c | 2 +-
net/sctp/stream.c | 6 ++++--
net/smc/smc_diag.c | 16 +++++++++-------
net/tipc/crypto.c | 2 ++
net/tipc/netlink_compat.c | 12 +++++++++++-
14 files changed, 81 insertions(+), 44 deletions(-)
Alaa Hleihel (1):
net/sched: act_ct: Fix skb double-free in tcf_ct_handle_fragments() error flow
Cong Wang (1):
tipc: fix uninit skb->data in tipc_nl_compat_dumpit()
David Laight (1):
net: sctp: Fix negotiation of the number of data streams.
Greg Kroah-Hartman (1):
Linux 5.7.19
Mark Tomlinson (1):
gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY
Max Filippov (1):
binfmt_flat: revert "binfmt_flat: don't offset the data start"
Maxim Mikityanskiy (3):
ethtool: Fix preserving of wanted feature bits in netlink interface
ethtool: Account for hw_features in netlink interface
ethtool: Don't omit the netlink reply if no features were changed
Miaohe Lin (1):
net: Fix potential wrong skb->protocol in skb_vlan_untag()
Michael Ellerman (1):
powerpc/64s: Don't init FSCR_DSCR in __init_FSCR()
Necip Fazil Yildiran (1):
net: qrtr: fix usage of idr in port assignment to socket
Nikolay Aleksandrov (1):
net: nexthop: don't allow empty NHA_GROUP
Peilin Ye (1):
net/smc: Prevent kernel-infoleak in __smc_diag_dump()
Shay Agroskin (1):
net: ena: Make missed_tx stat incremental
Xin Long (1):
tipc: call rcu_read_lock() in tipc_aead_encrypt_done()
I'm announcing the release of the 5.8.5 kernel.
All users of the 5.8 kernel series must upgrade.
The updated 5.8.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.8.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
drivers/net/ethernet/amazon/ena/ena_netdev.c | 5 ++++-
fs/binfmt_flat.c | 20 ++++++++++++--------
fs/io_uring.c | 3 ++-
net/core/skbuff.c | 4 ++--
net/ethtool/features.c | 19 ++++++++++---------
net/ipv4/nexthop.c | 5 ++++-
net/ipv6/ip6_tunnel.c | 10 +++++++++-
net/netlink/policy.c | 3 +++
net/qrtr/qrtr.c | 20 +++++++++++---------
net/sched/act_ct.c | 2 +-
net/sctp/stream.c | 6 ++++--
net/smc/smc_diag.c | 16 +++++++++-------
net/tipc/crypto.c | 2 ++
net/tipc/netlink_compat.c | 12 +++++++++++-
15 files changed, 85 insertions(+), 44 deletions(-)
Alaa Hleihel (1):
net/sched: act_ct: Fix skb double-free in tcf_ct_handle_fragments() error flow
Cong Wang (1):
tipc: fix uninit skb->data in tipc_nl_compat_dumpit()
David Laight (1):
net: sctp: Fix negotiation of the number of data streams.
Greg Kroah-Hartman (1):
Linux 5.8.5
Johannes Berg (1):
netlink: fix state reallocation in policy export
Mark Tomlinson (1):
gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY
Max Filippov (1):
binfmt_flat: revert "binfmt_flat: don't offset the data start"
Maxim Mikityanskiy (3):
ethtool: Fix preserving of wanted feature bits in netlink interface
ethtool: Account for hw_features in netlink interface
ethtool: Don't omit the netlink reply if no features were changed
Miaohe Lin (1):
net: Fix potential wrong skb->protocol in skb_vlan_untag()
Necip Fazil Yildiran (1):
net: qrtr: fix usage of idr in port assignment to socket
Nikolay Aleksandrov (1):
net: nexthop: don't allow empty NHA_GROUP
Pavel Begunkov (1):
io_uring: fix missing ->mm on exit
Peilin Ye (1):
net/smc: Prevent kernel-infoleak in __smc_diag_dump()
Shay Agroskin (1):
net: ena: Make missed_tx stat incremental
Xin Long (1):
tipc: call rcu_read_lock() in tipc_aead_encrypt_done()
There is a race when taking a CPU offline. Current code looks like this:
native_cpu_disable()
{
...
apic_soft_disable();
/*
* Any existing set bits for pending interrupt to
* this CPU are preserved and will be sent via IPI
* to another CPU by fixup_irqs().
*/
cpu_disable_common();
{
....
/*
* Race window happens here. Once local APIC has been
* disabled any new interrupts from the device to
* the old CPU are lost
*/
fixup_irqs(); // Too late to capture anything in IRR.
...
}
}
The fix is to disable the APIC *after* cpu_disable_common().
Testing was done with a USB NIC that provided a source of frequent
interrupts. A script migrated interrupts to a specific CPU and
then took that CPU offline.
Fixes: 60dcaad5736f ("x86/hotplug: Silence APIC and NMI when CPU is dead")
Link: https://lore.kernel.org/lkml/875zdarr4h.fsf@nanos.tec.linutronix.de/
Reported-by: Evan Green <evgreen(a)chromium.org>
Tested-by: Mathias Nyman <mathias.nyman(a)linux.intel.com>
Tested-by: Evan Green <evgreen(a)chromium.org>
Reviewed-by: Evan Green <evgreen(a)chromium.org>
Signed-off-by: Ashok Raj <ashok.raj(a)intel.com>
---
v3:
Fix commit message and comments per Thomas.
https://lore.kernel.org/lkml/87mu2iw86q.fsf@nanos.tec.linutronix.de/
v2:
- Typos and fixes suggested by Randy Dunlap
To: linux-kernel(a)vger.kernel.org
To: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Sukumar Ghorai <sukumar.ghorai(a)intel.com>
Cc: Srikanth Nandamuri <srikanth.nandamuri(a)intel.com>
Cc: Evan Green <evgreen(a)chromium.org>
Cc: Mathias Nyman <mathias.nyman(a)linux.intel.com>
Cc: Bjorn Helgaas <bhelgaas(a)google.com>
Cc: x86(a)kernel.org
Cc: stable(a)vger.kernel.org
---
arch/x86/kernel/smpboot.c | 26 ++++++++++++++++++++------
1 file changed, 20 insertions(+), 6 deletions(-)
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 27aa04a95702..f5ef689dd62a 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1594,14 +1594,28 @@ int native_cpu_disable(void)
if (ret)
return ret;
- /*
- * Disable the local APIC. Otherwise IPI broadcasts will reach
- * it. It still responds normally to INIT, NMI, SMI, and SIPI
- * messages.
- */
- apic_soft_disable();
cpu_disable_common();
+ /*
+ * Disable the local APIC. Otherwise IPI broadcasts will reach
+ * it. It still responds normally to INIT, NMI, SMI, and SIPI
+ * messages.
+ *
+ * Disabling the APIC must happen after cpu_disable_common()
+ * which invokes fixup_irqs().
+ *
+ * Disabling the APIC preserves already set bits in IRR, but
+ * an interrupt arriving after disabling the local APIC does not
+ * set the corresponding IRR bit.
+ *
+ * fixup_irqs() scans IRR for set bits so it can raise a not
+ * yet handled interrupt on the new destination CPU via an IPI
+ * but obviously it can't do so for IRR bits which are not set.
+ * IOW, interrupts arriving after disabling the local APIC will
+ * be lost.
+ */
+ apic_soft_disable();
+
return 0;
}
--
2.7.4
This is a note to let you know that I've just added the patch titled
USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 9aa37788e7ebb3f489fb4b71ce07adadd444264a Mon Sep 17 00:00:00 2001
From: Cyril Roelandt <tipecaml(a)gmail.com>
Date: Tue, 25 Aug 2020 23:22:31 +0200
Subject: USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge
This device does not support UAS properly and a similar entry already
exists in drivers/usb/storage/unusual_uas.h. Without this patch,
storage_probe() defers the handling of this device to UAS, which cannot
handle it either.
Tested-by: Brice Goglin <brice.goglin(a)gmail.com>
Fixes: bc3bdb12bbb3 ("usb-storage: Disable UAS on JMicron SATA enclosure")
Acked-by: Alan Stern <stern(a)rowland.harvard.edu>
CC: <stable(a)vger.kernel.org>
Signed-off-by: Cyril Roelandt <tipecaml(a)gmail.com>
Link: https://lore.kernel.org/r/20200825212231.46309-1-tipecaml@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 220ae2c356ee..5732e9691f08 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2328,7 +2328,7 @@ UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x0114,
"JMicron",
"USB to ATA/ATAPI Bridge",
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
- US_FL_BROKEN_FUA ),
+ US_FL_BROKEN_FUA | US_FL_IGNORE_UAS ),
/* Reported by Andrey Rahmatullin <wrar(a)altlinux.org> */
UNUSUAL_DEV( 0x4102, 0x1020, 0x0100, 0x0100,
--
2.28.0
This is a note to let you know that I've just added the patch titled
usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe()
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 1d4169834628d18b2392a2da92b7fbf5e8e2ce89 Mon Sep 17 00:00:00 2001
From: Tang Bin <tangbin(a)cmss.chinamobile.com>
Date: Wed, 26 Aug 2020 22:49:31 +0800
Subject: usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe()
If the function platform_get_irq() failed, the negative value
returned will not be detected here. So fix error handling in
exynos_ohci_probe(). And when get irq failed, the function
platform_get_irq() logs an error message, so remove redundant
message here.
Fixes: 62194244cf87 ("USB: Add Samsung Exynos OHCI diver")
Signed-off-by: Zhang Shengju <zhangshengju(a)cmss.chinamobile.com>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Tang Bin <tangbin(a)cmss.chinamobile.com>
Reviewed-by: Krzysztof Kozlowski <krzk(a)kernel.org>
Link: https://lore.kernel.org/r/20200826144931.1828-1-tangbin@cmss.chinamobile.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/host/ohci-exynos.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/host/ohci-exynos.c b/drivers/usb/host/ohci-exynos.c
index bd40e597f256..5f5e8a64c8e2 100644
--- a/drivers/usb/host/ohci-exynos.c
+++ b/drivers/usb/host/ohci-exynos.c
@@ -171,9 +171,8 @@ static int exynos_ohci_probe(struct platform_device *pdev)
hcd->rsrc_len = resource_size(res);
irq = platform_get_irq(pdev, 0);
- if (!irq) {
- dev_err(&pdev->dev, "Failed to get IRQ\n");
- err = -ENODEV;
+ if (irq < 0) {
+ err = irq;
goto fail_io;
}
--
2.28.0
This is a note to let you know that I've just added the patch titled
USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 068834a2773b6a12805105cfadbb3d4229fc6e0a Mon Sep 17 00:00:00 2001
From: Alan Stern <stern(a)rowland.harvard.edu>
Date: Wed, 26 Aug 2020 15:46:24 -0400
Subject: USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D
The Sound Devices MixPre-D audio card suffers from the same defect
as the Sound Devices USBPre2: an endpoint shared between a normal
audio interface and a vendor-specific interface, in violation of the
USB spec. Since the USB core now treats duplicated endpoints as bugs
and ignores them, the audio endpoint isn't available and the card
can't be used for audio capture.
Along the same lines as commit bdd1b147b802 ("USB: quirks: blacklist
duplicate ep on Sound Devices USBPre2"), this patch adds a quirks
entry saying to ignore ep5in for interface 1, leaving it available for
use with standard audio interface 2.
Reported-and-tested-by: Jean-Christophe Barnoud <jcbarnoud(a)gmail.com>
Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu>
CC: <stable(a)vger.kernel.org>
Fixes: 3e4f8e21c4f2 ("USB: core: fix check for duplicate endpoints")
Link: https://lore.kernel.org/r/20200826194624.GA412633@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/core/quirks.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index d1f38956b210..f232914de5fd 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -370,6 +370,10 @@ static const struct usb_device_id usb_quirk_list[] = {
{ USB_DEVICE(0x0926, 0x0202), .driver_info =
USB_QUIRK_ENDPOINT_IGNORE },
+ /* Sound Devices MixPre-D */
+ { USB_DEVICE(0x0926, 0x0208), .driver_info =
+ USB_QUIRK_ENDPOINT_IGNORE },
+
/* Keytouch QWERTY Panel keyboard */
{ USB_DEVICE(0x0926, 0x3333), .driver_info =
USB_QUIRK_CONFIG_INTF_STRINGS },
@@ -511,6 +515,7 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = {
*/
static const struct usb_device_id usb_endpoint_ignore[] = {
{ USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0202, 1), .driver_info = 0x85 },
+ { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0208, 1), .driver_info = 0x85 },
{ }
};
--
2.28.0
From: Rajendra Nayak <rnayak(a)codeaurora.org>
dev_pm_opp_set_rate() can now be called with freq = 0 in order
to either drop performance or bandwidth votes or to disable
regulators on platforms which support them.
In such cases, a subsequent call to dev_pm_opp_set_rate() with
the same frequency ends up returning early because 'old_freq == freq'
Instead make it fall through and put back the dropped performance
and bandwidth votes and/or enable back the regulators.
Cc: v5.3+ <stable(a)vger.kernel.org> # v5.3+
Fixes: cd7ea582 ("opp: Make dev_pm_opp_set_rate() handle freq = 0 to drop performance votes")
Reported-by: Sajida Bhanu <sbhanu(a)codeaurora.org>
Reviewed-by: Sibi Sankar <sibis(a)codeaurora.org>
Reported-by: Matthias Kaehlcke <mka(a)chromium.org>
Tested-by: Matthias Kaehlcke <mka(a)chromium.org>
Signed-off-by: Rajendra Nayak <rnayak(a)codeaurora.org>
[ Viresh: Don't skip clk_set_rate() and massaged changelog ]
Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org>
---
Hi Rajendra,
I wasn't able to test this stuff, please give it a try. I have
simplified your patch and cleaned up a bunch of stuff as well.
drivers/opp/core.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index bdb028c7793d..9668ea04cc80 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -934,10 +934,13 @@ int dev_pm_opp_set_rate(struct device *dev, unsigned long target_freq)
/* Return early if nothing to do */
if (old_freq == freq) {
- dev_dbg(dev, "%s: old/new frequencies (%lu Hz) are same, nothing to do\n",
- __func__, freq);
- ret = 0;
- goto put_opp_table;
+ if (!opp_table->required_opp_tables && !opp_table->regulators &&
+ !opp_table->paths) {
+ dev_dbg(dev, "%s: old/new frequencies (%lu Hz) are same, nothing to do\n",
+ __func__, freq);
+ ret = 0;
+ goto put_opp_table;
+ }
}
/*
--
2.14.1
Tegra210/Tegra186/Tegra194 has incorrectly enabled
SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK from the beginning of their support.
Tegra210 and later SDMMC hardware default uses sdmmc_legacy_tm (TMCLK)
all the time for hardware data timeout instead of SDCLK and this TMCLK
need to be kept enabled by Tegra sdmmc driver.
This series includes patches to fix this for Tegra210/Tegra186/Tegra194.
These patches need to be manually backported for 4.9, 4.14 and 4.19.
Will send patches to backport separately once these patches are ack'd.
Delta between patch versions:
[v5]: Include below changes based on v4 feedback
- updated dt-binding doc to be more clear
- updated Tegra sdhci driver to retrieve sdhci and tmclk clocks
based on no. of clocks in sdhci device node as old device trees
do not use sdhci clock name and this allows proper clock retrival
irrespective of sdhci and tmclk clocks order in device tree.
- Added separate quirk for identifying SoC's supporting separate
timeout clock to be more clear.
[v4]: Include additional dt-binding patch
[v3]: Same as v2 with fixes tag
[v2]: Includes minor fix
- Patch-0006: parentheses around operand of '!'
Sowjanya Komatineni (7):
sdhci: tegra: Remove SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK for Tegra210
sdhci: tegra: Remove SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK for Tegra186
dt-bindings: mmc: tegra: Add tmclk for Tegra210 and later
arm64: tegra: Add missing timeout clock to Tegra210 SDMMC
arm64: tegra: Add missing timeout clock to Tegra186 SDMMC nodes
arm64: tegra: Add missing timeout clock to Tegra194 SDMMC nodes
sdhci: tegra: Add missing TMCLK for data timeout
.../bindings/mmc/nvidia,tegra20-sdhci.txt | 32 +++++++-
arch/arm64/boot/dts/nvidia/tegra186.dtsi | 20 +++--
arch/arm64/boot/dts/nvidia/tegra194.dtsi | 15 ++--
arch/arm64/boot/dts/nvidia/tegra210.dtsi | 20 +++--
drivers/mmc/host/sdhci-tegra.c | 91 +++++++++++++++++++---
5 files changed, 143 insertions(+), 35 deletions(-)
--
2.7.4
On Wed, 19 Aug 2020, gregkh(a)linuxfoundation.org wrote:
>
> This is a note to let you know that I've just added the patch titled
>
> khugepaged: khugepaged_test_exit() check mmget_still_valid()
>
> to the 5.8-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
>
> The filename of the patch is:
> khugepaged-khugepaged_test_exit-check-mmget_still_valid.patch
> and it can be found in the queue-5.8 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable(a)vger.kernel.org> know about it.
Please hold this one back for the moment: we shall want it, but syzbot
detected one place where it can lead to a VM_BUG_ON_MM(). The fix to
that is currently in Andrew's tree, but not yet in Linus's - when it
gets there, I'll send you its git commit id in reply to this mail.
This patch failed to apply to earlier releases: I'll send the fixup for
those at that time. (Fixups for another patch to follow later today.)
Thanks,
Hugh
>
>
> From bbe98f9cadff58cdd6a4acaeba0efa8565dabe65 Mon Sep 17 00:00:00 2001
> From: Hugh Dickins <hughd(a)google.com>
> Date: Thu, 6 Aug 2020 23:26:25 -0700
> Subject: khugepaged: khugepaged_test_exit() check mmget_still_valid()
>
> From: Hugh Dickins <hughd(a)google.com>
>
> commit bbe98f9cadff58cdd6a4acaeba0efa8565dabe65 upstream.
>
> Move collapse_huge_page()'s mmget_still_valid() check into
> khugepaged_test_exit() itself. collapse_huge_page() is used for anon THP
> only, and earned its mmget_still_valid() check because it inserts a huge
> pmd entry in place of the page table's pmd entry; whereas
> collapse_file()'s retract_page_tables() or collapse_pte_mapped_thp()
> merely clears the page table's pmd entry. But core dumping without mmap
> lock must have been as open to mistaking a racily cleared pmd entry for a
> page table at physical page 0, as exit_mmap() was. And we certainly have
> no interest in mapping as a THP once dumping core.
>
> Fixes: 59ea6d06cfa9 ("coredump: fix race condition between collapse_huge_page() and core dumping")
> Signed-off-by: Hugh Dickins <hughd(a)google.com>
> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
> Cc: Andrea Arcangeli <aarcange(a)redhat.com>
> Cc: Song Liu <songliubraving(a)fb.com>
> Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
> Cc: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
> Cc: <stable(a)vger.kernel.org> [4.8+]
> Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008021217020.27773@eggly.anvils
> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
>
> ---
> mm/khugepaged.c | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
>
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -431,7 +431,7 @@ static void insert_to_mm_slots_hash(stru
>
> static inline int khugepaged_test_exit(struct mm_struct *mm)
> {
> - return atomic_read(&mm->mm_users) == 0;
> + return atomic_read(&mm->mm_users) == 0 || !mmget_still_valid(mm);
> }
>
> static bool hugepage_vma_check(struct vm_area_struct *vma,
> @@ -1100,9 +1100,6 @@ static void collapse_huge_page(struct mm
> * handled by the anon_vma lock + PG_lock.
> */
> mmap_write_lock(mm);
> - result = SCAN_ANY_PROCESS;
> - if (!mmget_still_valid(mm))
> - goto out;
> result = hugepage_vma_revalidate(mm, address, &vma);
> if (result)
> goto out;
>
>
> Patches currently in stable-queue which might be from hughd(a)google.com are
>
> queue-5.8/khugepaged-collapse_pte_mapped_thp-flush-the-right-range.patch
> queue-5.8/hugetlbfs-remove-call-to-huge_pte_alloc-without-i_mmap_rwsem.patch
> queue-5.8/khugepaged-khugepaged_test_exit-check-mmget_still_valid.patch
> queue-5.8/khugepaged-retract_page_tables-remember-to-test-exit.patch
> queue-5.8/khugepaged-collapse_pte_mapped_thp-protect-the-pmd-lock.patch
>
LLVM implemented a recent "libcall optimization" that lowers calls to
`sprintf(dest, "%s", str)` where the return value is used to
`stpcpy(dest, str) - dest`. This generally avoids the machinery involved
in parsing format strings. `stpcpy` is just like `strcpy` except it
returns the pointer to the new tail of `dest`. This optimization was
introduced into clang-12.
Implement this so that we don't observe linkage failures due to missing
symbol definitions for `stpcpy`.
Similar to last year's fire drill with:
commit 5f074f3e192f ("lib/string.c: implement a basic bcmp")
The kernel is somewhere between a "freestanding" environment (no full libc)
and "hosted" environment (many symbols from libc exist with the same
type, function signature, and semantics).
As H. Peter Anvin notes, there's not really a great way to inform the
compiler that you're targeting a freestanding environment but would like
to opt-in to some libcall optimizations (see pr/47280 below), rather than
opt-out.
Arvind notes, -fno-builtin-* behaves slightly differently between GCC
and Clang, and Clang is missing many __builtin_* definitions, which I
consider a bug in Clang and am working on fixing.
Masahiro summarizes the subtle distinction between compilers justly:
To prevent transformation from foo() into bar(), there are two ways in
Clang to do that; -fno-builtin-foo, and -fno-builtin-bar. There is
only one in GCC; -fno-buitin-foo.
(Any difference in that behavior in Clang is likely a bug from a missing
__builtin_* definition.)
Masahiro also notes:
We want to disable optimization from foo() to bar(),
but we may still benefit from the optimization from
foo() into something else. If GCC implements the same transform, we
would run into a problem because it is not -fno-builtin-bar, but
-fno-builtin-foo that disables that optimization.
In this regard, -fno-builtin-foo would be more future-proof than
-fno-built-bar, but -fno-builtin-foo is still potentially overkill. We
may want to prevent calls from foo() being optimized into calls to
bar(), but we still may want other optimization on calls to foo().
It seems that compilers today don't quite provide the fine grain control
over which libcall optimizations pseudo-freestanding environments would
prefer.
Finally, Kees notes that this interface is unsafe, so we should not
encourage its use. As such, I've removed the declaration from any
header, but it still needs to be exported to avoid linkage errors in
modules.
Cc: stable(a)vger.kernel.org
Link: https://bugs.llvm.org/show_bug.cgi?id=47162
Link: https://bugs.llvm.org/show_bug.cgi?id=47280
Link: https://github.com/ClangBuiltLinux/linux/issues/1126
Link: https://man7.org/linux/man-pages/man3/stpcpy.3.html
Link: https://pubs.opengroup.org/onlinepubs/9699919799/functions/stpcpy.html
Link: https://reviews.llvm.org/D85963
Suggested-by: Andy Lavr <andy.lavr(a)gmail.com>
Suggested-by: Arvind Sankar <nivedita(a)alum.mit.edu>
Suggested-by: Joe Perches <joe(a)perches.com>
Suggested-by: Masahiro Yamada <masahiroy(a)kernel.org>
Suggested-by: Rasmus Villemoes <linux(a)rasmusvillemoes.dk>
Reported-by: Sami Tolvanen <samitolvanen(a)google.com>
Signed-off-by: Nick Desaulniers <ndesaulniers(a)google.com>
---
Changes V3:
* Drop Sami's Tested by tag; newer patch.
* Add EXPORT_SYMBOL as per Andy.
* Rewrite commit message, rewrote part of what Masahiro said to be
generic in terms of foo() and bar().
* Prefer %NUL-terminated to NULL terminated. NUL is the ASCII character
'\0', as per Arvind and Rasmus.
Changes V2:
* Added Sami's Tested by; though the patch changed implementation, the
missing symbol at link time was the problem Sami was observing.
* Fix __restrict -> __restrict__ typo as per Joe.
* Drop note about restrict from commit message as per Arvind.
* Fix NULL -> NUL as per Arvind; NUL is ASCII '\0'. TIL
* Fix off by one error as per Arvind; I had another off by one error in
my test program that was masking this.
lib/string.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/lib/string.c b/lib/string.c
index 6012c385fb31..6bd0cf0fb009 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -272,6 +272,30 @@ ssize_t strscpy_pad(char *dest, const char *src, size_t count)
}
EXPORT_SYMBOL(strscpy_pad);
+/**
+ * stpcpy - copy a string from src to dest returning a pointer to the new end
+ * of dest, including src's %NUL-terminator. May overrun dest.
+ * @dest: pointer to end of string being copied into. Must be large enough
+ * to receive copy.
+ * @src: pointer to the beginning of string being copied from. Must not overlap
+ * dest.
+ *
+ * stpcpy differs from strcpy in a key way: the return value is the new
+ * %NUL-terminated character. (for strcpy, the return value is a pointer to
+ * src. This interface is considered unsafe as it doesn't perform bounds
+ * checking of the inputs. As such it's not recommended for usage. Instead,
+ * its definition is provided in case the compiler lowers other libcalls to
+ * stpcpy.
+ */
+char *stpcpy(char *__restrict__ dest, const char *__restrict__ src);
+char *stpcpy(char *__restrict__ dest, const char *__restrict__ src)
+{
+ while ((*dest++ = *src++) != '\0')
+ /* nothing */;
+ return --dest;
+}
+EXPORT_SYMBOL(stpcpy);
+
#ifndef __HAVE_ARCH_STRCAT
/**
* strcat - Append one %NUL-terminated string to another
--
2.28.0.297.g1956fa8f8d-goog
Tegra210/Tegra186/Tegra194 has incorrectly enabled
SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK from the beginning of their support.
Tegra210 and later SDMMC hardware default uses sdmmc_legacy_tm (TMCLK)
all the time for hardware data timeout instead of SDCLK and this TMCLK
need to be kept enabled by Tegra sdmmc driver.
This series includes patches to fix this for Tegra210/Tegra186/Tegra194.
These patches need to be manually backported for 4.9, 4.14 and 4.19.
Will send patches to backport separately once these patches are ack'd.
Delta between patch versions:
[v3]: Same as v2 with fixes tag
[v2]: Includes minor fix
- Patch-0006: parentheses around operand of '!'
Sowjanya Komatineni (6):
sdhci: tegra: Remove SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK for Tegra210
sdhci: tegra: Remove SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK for Tegra186
arm64: tegra: Add missing timeout clock to Tegra210 SDMMC
arm64: tegra: Add missing timeout clock to Tegra186 SDMMC nodes
arm64: tegra: Add missing timeout clock to Tegra194 SDMMC nodes
sdhci: tegra: Add missing TMCLK for data timeout
arch/arm64/boot/dts/nvidia/tegra186.dtsi | 20 +++++++++------
arch/arm64/boot/dts/nvidia/tegra194.dtsi | 15 ++++++-----
arch/arm64/boot/dts/nvidia/tegra210.dtsi | 20 +++++++++------
drivers/mmc/host/sdhci-tegra.c | 43 ++++++++++++++++++++++++++++++--
4 files changed, 74 insertions(+), 24 deletions(-)
--
2.7.4
Hi
[This is an automated email]
This commit has been processed because it contains a "Fixes:" tag
fixing commit: 9f58fdde95c9 ("x86/db: Split out dr6/7 handling").
The bot has tested the following trees: v5.8.2.
v5.8.2: Failed to apply! Possible dependencies:
0b085e68f407 ("x86/entry: Consolidate 32/64 bit syscall entry")
27d6b4d14f5c ("x86/entry: Use generic syscall entry function")
517e499227be ("x86/entry: Cleanup idtentry_entry/exit_user")
8d5ea35c5e91 ("x86/entry: Consolidate check_user_regs()")
a377ac1cd9d7 ("x86/entry: Move user return notifier out of loop")
b037b09b9058 ("x86/entry: Rename idtentry_enter/exit_cond_rcu() to idtentry_enter/exit()")
ba1f2b2eaa2a ("x86/entry: Fix NMI vs IRQ state tracking")
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
--
Thanks
Sasha
Before this commit i2c_hid_parse() consists of the following steps:
1. Send power on cmd
2. usleep_range(1000, 5000)
3. Send reset cmd
4. Wait for reset to complete (device interrupt, or msleep(100))
5. Send power on cmd
6. Try to read HID descriptor
Notice how there is an usleep_range(1000, 5000) after the first power-on
command, but not after the second power-on command.
Testing has shown that at least on the BMAX Y13 laptop's i2c-hid touchpad,
not having a delay after the second power-on command causes the HID
descriptor to read as all zeros.
In case we hit this on other devices too, the descriptor being all zeros
can be recognized by the following message being logged many, many times:
hid-generic 0018:0911:5288.0002: unknown main item tag 0x0
Having 2 cases where we need a delay after sending the power-on command,
seems to indicate that we should always sleep after the power-on command.
So this commit fixes the all zeros HID descriptor issue by moving the
existing usleep_range(1000, 5000) to the i2c_hid_set_power() function.
Cc: stable(a)vger.kernel.org
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208247
Reported-and-tested-by: Andrea Borgia <andrea(a)borgia.bo.it>
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
---
drivers/hid/i2c-hid/i2c-hid-core.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 294c84e136d7..e5d7aaf39b5e 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -420,6 +420,17 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
dev_err(&client->dev, "failed to change power setting.\n");
set_pwr_exit:
+
+ /*
+ * The HID over I2C specification states that if a DEVICE needs time
+ * after the PWR_ON request, it should utilise CLOCK stretching.
+ * However, it has been observered that the Windows driver provides a
+ * 1ms sleep between the PWR_ON and RESET requests and that some devices
+ * rely on having a short delay after PWR_ON commands.
+ */
+ if (power_state == I2C_HID_PWR_ON)
+ usleep_range(1000, 5000);
+
return ret;
}
@@ -441,15 +452,6 @@ static int i2c_hid_hwreset(struct i2c_client *client)
if (ret)
goto out_unlock;
- /*
- * The HID over I2C specification states that if a DEVICE needs time
- * after the PWR_ON request, it should utilise CLOCK stretching.
- * However, it has been observered that the Windows driver provides a
- * 1ms sleep between the PWR_ON and RESET requests and that some devices
- * rely on this.
- */
- usleep_range(1000, 5000);
-
i2c_hid_dbg(ihid, "resetting...\n");
ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0);
--
2.26.2
Lockdep reports an AB BA lock inversion between ucsi_init() and
ucsi_handle_connector_change():
AB order:
1. ucsi_init takes ucsi->ppm_lock (it runs with that locked for the
duration of the function)
2. usci_init eventually end up calling ucsi_register_displayport,
which takes ucsi_connector->lock
BA order:
1. ucsi_handle_connector_change work is started, takes ucsi_connector->lock
2. ucsi_handle_connector_change calls ucsi_send_command which takes
ucsi->ppm_lock
The ppm_lock really only needs to be hold during 2 functions:
ucsi_reset_ppm() and ucsi_run_command().
This commit fixes the AB BA lock inversion by making ucsi_init drop the
ucsi->ppm_lock before it starts registering ports; and replacing any
ucsi_run_command() calls after this point with ucsi_send_command()
(which is a wrapper around run_command taking the lock while handling
the command).
Some of the replacing of ucsi_run_command with ucsi_send_command
in the helpers used during port registration also fixes a number of
code paths after registration which call ucsi_run_command() without
holding the ppm_lock:
1. ucsi_altmode_update_active() call in ucsi/displayport.c
2. ucsi_register_altmodes() call from ucsi_handle_connector_change()
(through ucsi_partner_change())
Cc: stable(a)vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
---
drivers/usb/typec/ucsi/ucsi.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index d0c63afaf345..d9d93f83b2a6 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -205,7 +205,7 @@ void ucsi_altmode_update_active(struct ucsi_connector *con)
int i;
command = UCSI_GET_CURRENT_CAM | UCSI_CONNECTOR_NUMBER(con->num);
- ret = ucsi_run_command(con->ucsi, command, &cur, sizeof(cur));
+ ret = ucsi_send_command(con->ucsi, command, &cur, sizeof(cur));
if (ret < 0) {
if (con->ucsi->version > 0x0100) {
dev_err(con->ucsi->dev,
@@ -354,7 +354,7 @@ ucsi_register_altmodes_nvidia(struct ucsi_connector *con, u8 recipient)
command |= UCSI_GET_ALTMODE_RECIPIENT(recipient);
command |= UCSI_GET_ALTMODE_CONNECTOR_NUMBER(con->num);
command |= UCSI_GET_ALTMODE_OFFSET(i);
- len = ucsi_run_command(con->ucsi, command, &alt, sizeof(alt));
+ len = ucsi_send_command(con->ucsi, command, &alt, sizeof(alt));
/*
* We are collecting all altmodes first and then registering.
* Some type-C device will return zero length data beyond last
@@ -431,7 +431,7 @@ static int ucsi_register_altmodes(struct ucsi_connector *con, u8 recipient)
command |= UCSI_GET_ALTMODE_RECIPIENT(recipient);
command |= UCSI_GET_ALTMODE_CONNECTOR_NUMBER(con->num);
command |= UCSI_GET_ALTMODE_OFFSET(i);
- len = ucsi_run_command(con->ucsi, command, alt, sizeof(alt));
+ len = ucsi_send_command(con->ucsi, command, alt, sizeof(alt));
if (len <= 0)
return len;
@@ -904,7 +904,7 @@ static int ucsi_register_port(struct ucsi *ucsi, int index)
/* Get connector capability */
command = UCSI_GET_CONNECTOR_CAPABILITY;
command |= UCSI_CONNECTOR_NUMBER(con->num);
- ret = ucsi_run_command(ucsi, command, &con->cap, sizeof(con->cap));
+ ret = ucsi_send_command(ucsi, command, &con->cap, sizeof(con->cap));
if (ret < 0)
return ret;
@@ -953,8 +953,7 @@ static int ucsi_register_port(struct ucsi *ucsi, int index)
/* Get the status */
command = UCSI_GET_CONNECTOR_STATUS | UCSI_CONNECTOR_NUMBER(con->num);
- ret = ucsi_run_command(ucsi, command, &con->status,
- sizeof(con->status));
+ ret = ucsi_send_command(ucsi, command, &con->status, sizeof(con->status));
if (ret < 0) {
dev_err(ucsi->dev, "con%d: failed to get status\n", con->num);
return 0;
@@ -1044,6 +1043,8 @@ int ucsi_init(struct ucsi *ucsi)
goto err_reset;
}
+ mutex_unlock(&ucsi->ppm_lock);
+
/* Register all connectors */
for (i = 0; i < ucsi->cap.num_connectors; i++) {
ret = ucsi_register_port(ucsi, i);
@@ -1054,12 +1055,10 @@ int ucsi_init(struct ucsi *ucsi)
/* Enable all notifications */
ucsi->ntfy = UCSI_ENABLE_NTFY_ALL;
command = UCSI_SET_NOTIFICATION_ENABLE | ucsi->ntfy;
- ret = ucsi_run_command(ucsi, command, NULL, 0);
+ ret = ucsi_send_command(ucsi, command, NULL, 0);
if (ret < 0)
goto err_unregister;
- mutex_unlock(&ucsi->ppm_lock);
-
return 0;
err_unregister:
@@ -1071,6 +1070,7 @@ int ucsi_init(struct ucsi *ucsi)
con->port = NULL;
}
+ mutex_lock(&ucsi->ppm_lock);
err_reset:
ucsi_reset_ppm(ucsi);
err:
--
2.26.2
Before this commit i2c_hid_parse() consists of the following steps:
1. Send power on cmd
2. usleep_range(1000, 5000)
3. Send reset cmd
4. Wait for reset to complete (device interrupt, or msleep(100))
5. Send power on cmd
6. Try to read HID descriptor
Notice how there is an usleep_range(1000, 5000) after the first power-on
command, but not after the second power-on command.
Testing has shown that at least on the BMAX Y13 laptop's i2c-hid touchpad,
not having a delay after the second power-on command causes the HID
descriptor to read as all zeros.
In case we hit this on other devices too, the descriptor being all zeros
can be recognized by the following message being logged many, many times:
hid-generic 0018:0911:5288.0002: unknown main item tag 0x0
At the same time as the BMAX Y13's touchpad issue was debugged,
Kai-Heng was working on debugging some issues with Goodix i2c-hid
touchpads. It turns out that these need a delay after a PWR_ON command
too, otherwise they stop working after a suspend/resume cycle.
According to Goodix a delay of minimal 60ms is needed.
Having multiple cases where we need a delay after sending the power-on
command, seems to indicate that we should always sleep after the power-on
command.
This commit fixes the mentioned issues by moving the existing 1ms sleep to
the i2c_hid_set_power() function and changing it to a 60ms sleep.
Cc: stable(a)vger.kernel.org
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208247
Reported-by: Kai-Heng Feng <kai.heng.feng(a)canonical.com>
Reported-and-tested-by: Andrea Borgia <andrea(a)borgia.bo.it>
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
---
Changes in v3:
- Fix Subject to say 60ms instead of 1ms
Changes in v2:
- Add Kai-Heng's case, with Goodix touchpads needing a delay after PWR_ON too,
to the commit message
- Add a Reported-by tag for Kai-Heng
- Increase the delay to 60ms
---
drivers/hid/i2c-hid/i2c-hid-core.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 294c84e136d7..dbd04492825d 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -420,6 +420,19 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
dev_err(&client->dev, "failed to change power setting.\n");
set_pwr_exit:
+
+ /*
+ * The HID over I2C specification states that if a DEVICE needs time
+ * after the PWR_ON request, it should utilise CLOCK stretching.
+ * However, it has been observered that the Windows driver provides a
+ * 1ms sleep between the PWR_ON and RESET requests.
+ * According to Goodix Windows even waits 60 ms after (other?)
+ * PWR_ON requests. Testing has confirmed that several devices
+ * will not work properly without a delay after a PWR_ON request.
+ */
+ if (!ret && power_state == I2C_HID_PWR_ON)
+ msleep(60);
+
return ret;
}
@@ -441,15 +454,6 @@ static int i2c_hid_hwreset(struct i2c_client *client)
if (ret)
goto out_unlock;
- /*
- * The HID over I2C specification states that if a DEVICE needs time
- * after the PWR_ON request, it should utilise CLOCK stretching.
- * However, it has been observered that the Windows driver provides a
- * 1ms sleep between the PWR_ON and RESET requests and that some devices
- * rely on this.
- */
- usleep_range(1000, 5000);
-
i2c_hid_dbg(ihid, "resetting...\n");
ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0);
--
2.28.0
There are a few issues in DWC3 driver when preparing for TRB.
The driver needs to account the following:
* MPS alignment for ZLP OUT direction
* Extra TRBs when checking for available TRBs
* SG entries size > request length
Along with these fixes, there are some cleanup/refactoring patches in this
series.
Changes in v2:
- Update remaining length when resume request
- Remove unused variables
- Add a missing "return 0" for dwc3_prepare_trbs()
- Update doc indicating dwc3_prepare_trbs() can return other -errno
Thinh Nguyen (7):
usb: dwc3: gadget: Don't setup more than requested
usb: dwc3: gadget: Fix handling ZLP
usb: dwc3: gadget: Handle ZLP for sg requests
usb: dwc3: gadget: Refactor preparing TRBs
usb: dwc3: gadget: Account for extra TRB
usb: dwc3: gadget: Rename misleading function names
usb: dwc3: ep0: Skip ZLP setup for OUT
drivers/usb/dwc3/ep0.c | 2 +-
drivers/usb/dwc3/gadget.c | 247 +++++++++++++++++++++++---------------
2 files changed, 148 insertions(+), 101 deletions(-)
base-commit: e3ee0e740c3887d2293e8d54a8707218d70d86ca
--
2.28.0
Hi
[This is an automated email]
This commit has been processed because it contains a -stable tag.
The stable tag indicates that it's relevant for the following trees: all
The bot has tested the following trees: v5.8.2, v5.7.16, v5.4.59, v4.19.140, v4.14.193, v4.9.232, v4.4.232.
v5.8.2: Build OK!
v5.7.16: Build OK!
v5.4.59: Failed to apply! Possible dependencies:
781ca2de89ba ("iommu: Add gfp parameter to iommu_ops::map")
v4.19.140: Failed to apply! Possible dependencies:
06d60728ff5c ("iommu/dma: move the arm64 wrappers to common code")
44f6876a00e8 ("iommu/arm-smmu: Support non-strict mode")
46053c736854 ("dma-mapping: clear dev->dma_ops in arch_teardown_dma_ops")
781ca2de89ba ("iommu: Add gfp parameter to iommu_ops::map")
886643b76632 ("arm64: use the generic swiotlb_dma_ops")
92aec09cc879 ("iommu/dma: Move __iommu_dma_map")
96a299d24cfb ("iommu/arm-smmu: Add pm_runtime/sleep ops")
c4dae366925f ("swiotlb: refactor swiotlb_map_page")
d4a44f0750bb ("iommu/arm-smmu: Invoke pm_runtime across the driver")
dff8d6c1ed58 ("swiotlb: remove the overflow buffer")
fafadcd16595 ("swiotlb: don't dip into swiotlb pool for coherent allocations")
v4.14.193: Failed to apply! Possible dependencies:
06d60728ff5c ("iommu/dma: move the arm64 wrappers to common code")
10dac04c79b1 ("mips: fix an off-by-one in dma_capable")
32b124492bdf ("iommu/io-pgtable-arm: Convert to IOMMU API TLB sync")
32ce3862af3c ("powerpc/lib: Implement PMEM API")
44f6876a00e8 ("iommu/arm-smmu: Support non-strict mode")
781ca2de89ba ("iommu: Add gfp parameter to iommu_ops::map")
92aec09cc879 ("iommu/dma: Move __iommu_dma_map")
96a299d24cfb ("iommu/arm-smmu: Add pm_runtime/sleep ops")
d4a44f0750bb ("iommu/arm-smmu: Invoke pm_runtime across the driver")
ea8c64ace866 ("dma-mapping: move swiotlb arch helpers to a new header")
v4.9.232: Failed to apply! Possible dependencies:
125458ab3aef ("iommu/arm-smmu: Fix 16-bit ASID configuration")
280b683ceace ("iommu/arm-smmu: Simplify ASID/VMID handling")
32b124492bdf ("iommu/io-pgtable-arm: Convert to IOMMU API TLB sync")
3677a649a751 ("iommu/arm-smmu: Fix for ThunderX erratum #27704")
44f6876a00e8 ("iommu/arm-smmu: Support non-strict mode")
452107c79035 ("iommu/arm-smmu: Tidy up context bank indexing")
523d7423e21b ("iommu/arm-smmu: Remove io-pgtable spinlock")
58188afeb727 ("iommu/arm-smmu-v3: Remove io-pgtable spinlock")
61bc671179f1 ("iommu/arm-smmu: Install bypass S2CRs for IOMMU_DOMAIN_IDENTITY domains")
781ca2de89ba ("iommu: Add gfp parameter to iommu_ops::map")
bdf95923086f ("iommu/arm-smmu: Return IOVA in iova_to_phys when SMMU is bypassed")
d4a44f0750bb ("iommu/arm-smmu: Invoke pm_runtime across the driver")
v4.4.232: Failed to apply! Possible dependencies:
267b62a96951 ("clk: tegra: pll: Update PLLM handling")
287980e49ffc ("remove lots of IS_ERR_VALUE abuses")
407254da291c ("clk: tegra: pll: Add logic for out-of-table rates for T210")
56fd27b31f1a ("clk: tegra: pll: Change misc_reg count from 3 to 6")
58188afeb727 ("iommu/arm-smmu-v3: Remove io-pgtable spinlock")
6583a6309e83 ("clk: tegra: pll: Add tegra_pll_wait_for_lock to clk header")
6929715cf6b9 ("clk: tegra: pll: Add support for PLLMB for Tegra210")
6b301a059eb2 ("clk: tegra: Add support for Tegra210 clocks")
781ca2de89ba ("iommu: Add gfp parameter to iommu_ops::map")
7db864c9deb2 ("clk: tegra: pll: Simplify clk_enable_path")
8cfb0cdf07e2 ("ACPI / debugger: Add IO interface to access debugger functionalities")
8f78515425da ("iommu/arm-smmu: Implement of_xlate() for SMMUv3")
9adb95949a34 ("iommu/arm-smmu: Support DMA-API domains")
bc7f2ce0a7b5 ("iommu/arm-smmu: Don't fail device attach if already attached to a domain")
bdf95923086f ("iommu/arm-smmu: Return IOVA in iova_to_phys when SMMU is bypassed")
d907f4b4a178 ("clk: tegra: pll: Add logic for handling SDM data")
f8d31489629c ("ACPICA: Debugger: Convert some mechanisms to OSPM specific")
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
--
Thanks
Sasha
As per PAPR specification whenever system is running on UPS we have to
wait for predefined time (default 10mins) before initiating shutdown.
We have user space tool (rtas_errd) to monitor for EPOW events and
initiate shutdown after predefined time. Hence do not initiate shutdown
whenever we get EPOW_SHUTDOWN_ON_UPS event.
Fixes: 79872e35 (powerpc/pseries: All events of EPOW_SYSTEM_SHUTDOWN must initiate shutdown)
Cc: stable(a)vger.kernel.org # v4.0+
Cc: Michael Ellerman <mpe(a)ellerman.id.au>
Signed-off-by: Vasant Hegde <hegdevasant(a)linux.vnet.ibm.com>
---
arch/powerpc/platforms/pseries/ras.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index f3736fcd98fc..13c86a292c6d 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -184,7 +184,6 @@ static void handle_system_shutdown(char event_modifier)
case EPOW_SHUTDOWN_ON_UPS:
pr_emerg("Loss of system power detected. System is running on"
" UPS/battery. Check RTAS error log for details\n");
- orderly_poweroff(true);
break;
case EPOW_SHUTDOWN_LOSS_OF_CRITICAL_FUNCTIONS:
--
2.26.2
Hi
[This is an automated email]
This commit has been processed because it contains a "Fixes:" tag
fixing commit: b189817cf789 ("crypto: caam/qi - add ablkcipher and authenc algorithms").
The bot has tested the following trees: v5.8.2, v5.7.16, v5.4.59, v4.19.140, v4.14.193.
v5.8.2: Failed to apply! Possible dependencies:
1108da08e2c1 ("crypto: caam/qi - add fallback for XTS with more than 8B IV")
a85211f36f3d ("crypto: qat - fallback for xts with 192 bit keys")
b185a68710e0 ("crypto: qat - validate xts key")
b8aa7dc5c753 ("crypto: drivers - set the flag CRYPTO_ALG_ALLOCATES_MEMORY")
v5.7.16: Failed to apply! Possible dependencies:
1108da08e2c1 ("crypto: caam/qi - add fallback for XTS with more than 8B IV")
a85211f36f3d ("crypto: qat - fallback for xts with 192 bit keys")
b185a68710e0 ("crypto: qat - validate xts key")
b8aa7dc5c753 ("crypto: drivers - set the flag CRYPTO_ALG_ALLOCATES_MEMORY")
v5.4.59: Failed to apply! Possible dependencies:
1108da08e2c1 ("crypto: caam/qi - add fallback for XTS with more than 8B IV")
64db5e7439fb ("crypto: sparc/aes - convert to skcipher API")
66d7fb94e4ff ("crypto: blake2s - generic C library implementation and selftest")
674f368a952c ("crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN")
746b2e024c67 ("crypto: lib - tidy up lib/crypto Kconfig and Makefile")
7988fb2c03c8 ("crypto: s390/aes - convert to skcipher API")
7f725f41f627 ("crypto: powerpc - convert SPE AES algorithms to skcipher API")
7f9b0880925f ("crypto: blake2s - implement generic shash driver")
91d689337fe8 ("crypto: blake2b - add blake2b generic implementation")
b4d0c0aad57a ("crypto: arm - use Kconfig based compiler checks for crypto opcodes")
b95bba5d0114 ("crypto: skcipher - rename the crypto_blkcipher module and kconfig option")
d00c06398154 ("crypto: s390/paes - convert to skcipher API")
da6a66853a38 ("crypto: caam - silence .setkey in case of bad key length")
ed0356eda153 ("crypto: blake2s - x86_64 SIMD implementation")
v4.19.140: Failed to apply! Possible dependencies:
0a5dff9882e5 ("crypto: arm/ghash - provide a synchronous version")
1108da08e2c1 ("crypto: caam/qi - add fallback for XTS with more than 8B IV")
1ca1b917940c ("crypto: chacha20-generic - refactor to allow varying number of rounds")
5ca7badb1f62 ("crypto: caam/jr - ablkcipher -> skcipher conversion")
674f368a952c ("crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN")
8a5a79d5556b ("crypto: x86/chacha20 - Add a 4-block AVX2 variant")
99680c5e9182 ("crypto: arm - convert to use crypto_simd_usable()")
9b17608f15b9 ("crypto: x86/chacha20 - Use larger block functions more aggressively")
9dbe3072c6b1 ("crypto: caam/qi - ablkcipher -> skcipher conversion")
a5dd97f86211 ("crypto: x86/chacha20 - Add a 2-block AVX2 variant")
aec48adce85d ("crypto: caam/qi - remove ablkcipher IV generation")
c3b734dd325d ("crypto: x86/chacha20 - Support partial lengths in 8-block AVX2 variant")
cf5448b5c3d8 ("crypto: caam/jr - remove ablkcipher IV generation")
da6a66853a38 ("crypto: caam - silence .setkey in case of bad key length")
db8e15a24957 ("crypto: x86/chacha20 - Support partial lengths in 4-block SSSE3 variant")
e4e72063d3c0 ("crypto: x86/chacha20 - Support partial lengths in 1-block SSSE3 variant")
v4.14.193: Failed to apply! Possible dependencies:
1108da08e2c1 ("crypto: caam/qi - add fallback for XTS with more than 8B IV")
5ca7badb1f62 ("crypto: caam/jr - ablkcipher -> skcipher conversion")
662f70ede597 ("crypto: caam - remove needless ablkcipher key copy")
7e0880b9fbbe ("crypto: caam - add Derived Key Protocol (DKP) support")
9dbe3072c6b1 ("crypto: caam/qi - ablkcipher -> skcipher conversion")
cf5448b5c3d8 ("crypto: caam/jr - remove ablkcipher IV generation")
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
--
Thanks
Sasha
From: Stylon Wang <stylon.wang(a)amd.com>
[Why]
Resuming from suspend, CEA blocks from EDID are not parsed and no video
modes can support YUV420. When this happens, output bpc cannot go over
8-bit with 4K modes on HDMI.
[How]
In amdgpu_dm_update_connector_after_detect(), drm_add_edid_modes() is
called after drm_connector_update_edid_property() to fully parse EDID
and update display info.
Cc: stable(a)vger.kernel.org
Signed-off-by: Stylon Wang <stylon.wang(a)amd.com>
Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas(a)amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo(a)amd.com>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 53bf8f60d30c..bfb06c168fba 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -2202,6 +2202,7 @@ void amdgpu_dm_update_connector_after_detect(
drm_connector_update_edid_property(connector,
aconnector->edid);
+ drm_add_edid_modes(connector, aconnector->edid);
if (aconnector->dc_link->aux_mode)
drm_dp_cec_set_edid(&aconnector->dm_dp_aux.aux,
--
2.17.1
From: Sean Paul <seanpaul(a)chromium.org>
On HDCP disable, clear the repeater bit. This ensures if we connect a
non-repeater sink after a repeater, the bit is in the state we expect.
Fixes: ee5e5e7a5e0f (drm/i915: Add HDCP framework + base implementation)
Cc: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Ramalingam C <ramalingam.c(a)intel.com>
Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: Sean Paul <seanpaul(a)chromium.org>
Cc: Jani Nikula <jani.nikula(a)linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com>
Cc: intel-gfx(a)lists.freedesktop.org
Cc: <stable(a)vger.kernel.org> # v4.17+
Reviewed-by: Ramalingam C <ramalingam.c(a)intel.com>
Signed-off-by: Sean Paul <seanpaul(a)chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20191212190230.188505-3-sean@… #v2
Link: https://patchwork.freedesktop.org/patch/msgid/20200117193103.156821-3-sean@… #v3
Link: https://patchwork.freedesktop.org/patch/msgid/20200218220242.107265-3-sean@… #v4
Link: https://patchwork.freedesktop.org/patch/msgid/20200305201236.152307-3-sean@… #v5
Link: https://patchwork.freedesktop.org/patch/msgid/20200429195502.39919-3-sean@p… #v6
Link: https://patchwork.freedesktop.org/patch/msgid/20200623155907.22961-3-sean@p… #v7
Changes in v2:
-Added to the set
Changes in v3:
-None
I had previously agreed that clearing the rep_ctl bits on enable would
also be a good idea. However when I committed that idea to code, it
didn't look right. So let's rely on enables and disables being paired
and everything outside of that will be considered a bug
Changes in v4:
-s/I915_(READ|WRITE)/intel_de_(read|write)/
Changes in v5:
-None
Changes in v6:
-None
Changes in v7:
-None
Changes in v8:
-None
---
drivers/gpu/drm/i915/display/intel_hdcp.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/i915/display/intel_hdcp.c b/drivers/gpu/drm/i915/display/intel_hdcp.c
index 6189b7583277..1a0d49af2a08 100644
--- a/drivers/gpu/drm/i915/display/intel_hdcp.c
+++ b/drivers/gpu/drm/i915/display/intel_hdcp.c
@@ -795,6 +795,7 @@ static int _intel_hdcp_disable(struct intel_connector *connector)
struct intel_hdcp *hdcp = &connector->hdcp;
enum port port = dig_port->base.port;
enum transcoder cpu_transcoder = hdcp->cpu_transcoder;
+ u32 repeater_ctl;
int ret;
drm_dbg_kms(&dev_priv->drm, "[%s:%d] HDCP is being disabled...\n",
@@ -810,6 +811,11 @@ static int _intel_hdcp_disable(struct intel_connector *connector)
return -ETIMEDOUT;
}
+ repeater_ctl = intel_hdcp_get_repeater_ctl(dev_priv, cpu_transcoder,
+ port);
+ intel_de_write(dev_priv, HDCP_REP_CTL,
+ intel_de_read(dev_priv, HDCP_REP_CTL) & ~repeater_ctl);
+
ret = hdcp->shim->toggle_signalling(dig_port, false);
if (ret) {
drm_err(&dev_priv->drm, "Failed to disable HDCP signalling\n");
--
Sean Paul, Software Engineer, Google / Chromium OS
Commit 2f217d58a8a0 ("perf/x86/amd/uncore: Set the thread mask for
F17h L3 PMCs") inadvertently changed the uncore driver's behaviour
wrt perf tool invocations with or without a CPU list, specified with
-C / --cpu=.
Change the behaviour of the driver to assume the former all-cpu (-a)
case, which is the more commonly desired default. This fixes
'-a -A' invocations without explicit cpu lists (-C) to not count
L3 events only on behalf of the first thread of the first core
in the L3 domain.
BEFORE:
Activity performed by the first thread of the last core (CPU#43) in
CPU#40's L3 domain is not reported by CPU#40:
sudo perf stat -a -A -e l3_request_g1.caching_l3_cache_accesses taskset -c 43 perf bench mem memcpy -s 32mb -l 100 -f default
...
CPU36 21,835 l3_request_g1.caching_l3_cache_accesses
CPU40 87,066 l3_request_g1.caching_l3_cache_accesses
CPU44 17,360 l3_request_g1.caching_l3_cache_accesses
...
AFTER:
The L3 domain activity is now reported by CPU#40:
sudo perf stat -a -A -e l3_request_g1.caching_l3_cache_accesses taskset -c 43 perf bench mem memcpy -s 32mb -l 100 -f default
...
CPU36 354,891 l3_request_g1.caching_l3_cache_accesses
CPU40 1,780,870 l3_request_g1.caching_l3_cache_accesses
CPU44 315,062 l3_request_g1.caching_l3_cache_accesses
...
Reported-by: Stephane Eranian <eranian(a)google.com>
Signed-off-by: Kim Phillips <kim.phillips(a)amd.com>
Fixes: 2f217d58a8a0 ("perf/x86/amd/uncore: Set the thread mask for F17h L3 PMCs")
Cc: Stephane Eranian <eranian(a)google.com>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Ingo Molnar <mingo(a)kernel.org>
Cc: Ingo Molnar <mingo(a)redhat.com>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Borislav Petkov <bp(a)alien8.de>
Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme(a)kernel.org>
Cc: "H. Peter Anvin" <hpa(a)zytor.com>
Cc: Jiri Olsa <jolsa(a)redhat.com>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Michael Petlan <mpetlan(a)redhat.com>
Cc: Namhyung Kim <namhyung(a)kernel.org>
Cc: LKML <linux-kernel(a)vger.kernel.org>
Cc: x86 <x86(a)kernel.org>
Cc: stable(a)vger.kernel.org
---
Original submission:
https://lore.kernel.org/lkml/20200323233159.19601-1-kim.phillips@amd.com/
arch/x86/events/amd/uncore.c | 28 ++++++++--------------------
1 file changed, 8 insertions(+), 20 deletions(-)
diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
index 76400c052b0e..e7e61c8b56bd 100644
--- a/arch/x86/events/amd/uncore.c
+++ b/arch/x86/events/amd/uncore.c
@@ -181,28 +181,16 @@ static void amd_uncore_del(struct perf_event *event, int flags)
}
/*
- * Convert logical CPU number to L3 PMC Config ThreadMask format
+ * Return a full thread and slice mask until per-CPU is
+ * properly supported.
*/
-static u64 l3_thread_slice_mask(int cpu)
+static u64 l3_thread_slice_mask(void)
{
- u64 thread_mask, core = topology_core_id(cpu);
- unsigned int shift, thread = 0;
+ if (boot_cpu_data.x86 <= 0x18)
+ return AMD64_L3_SLICE_MASK | AMD64_L3_THREAD_MASK;
- if (topology_smt_supported() && !topology_is_primary_thread(cpu))
- thread = 1;
-
- if (boot_cpu_data.x86 <= 0x18) {
- shift = AMD64_L3_THREAD_SHIFT + 2 * (core % 4) + thread;
- thread_mask = BIT_ULL(shift);
-
- return AMD64_L3_SLICE_MASK | thread_mask;
- }
-
- core = (core << AMD64_L3_COREID_SHIFT) & AMD64_L3_COREID_MASK;
- shift = AMD64_L3_THREAD_SHIFT + thread;
- thread_mask = BIT_ULL(shift);
-
- return AMD64_L3_EN_ALL_SLICES | core | thread_mask;
+ return AMD64_L3_EN_ALL_SLICES | AMD64_L3_EN_ALL_CORES |
+ AMD64_L3_F19H_THREAD_MASK;
}
static int amd_uncore_event_init(struct perf_event *event)
@@ -232,7 +220,7 @@ static int amd_uncore_event_init(struct perf_event *event)
* For other events, the two fields do not affect the count.
*/
if (l3_mask && is_llc_event(event))
- hwc->config |= l3_thread_slice_mask(event->cpu);
+ hwc->config |= l3_thread_slice_mask();
uncore = event_to_amd_uncore(event);
if (!uncore)
--
2.27.0
Not entirely sure why this never came up when I originally tested this
(maybe some BIOSes already have this setup?) but the ->caps_init vfunc
appears to cause the display engine to throw an exception on driver
init, at least on my ThinkPad P72:
nouveau 0000:01:00.0: disp: chid 0 mthd 008c data 00000000 0000508c 0000102b
This is magic nvidia speak for "You need to have the DMA notifier offset
programmed before you can call NV507D_GET_CAPABILITIES." So, let's fix
this by doing that.
Signed-off-by: Lyude Paul <lyude(a)redhat.com>
Fixes: 4a2cb4181b07 ("drm/nouveau/kms/nv50-: Probe SOR and PIOR caps for DP interlacing support")
Cc: <stable(a)vger.kernel.org> # v5.8+
---
drivers/gpu/drm/nouveau/dispnv50/core507d.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/nouveau/dispnv50/core507d.c b/drivers/gpu/drm/nouveau/dispnv50/core507d.c
index ad1f09a143aa4..c984080ce99f2 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/core507d.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/core507d.c
@@ -80,11 +80,19 @@ core507d_caps_init(struct nouveau_drm *drm, struct nv50_disp *disp)
struct nvif_push *push = disp->core->chan.push;
int ret;
- if ((ret = PUSH_WAIT(push, 2)))
+ if ((ret = PUSH_WAIT(push, 4)))
return ret;
+ PUSH_MTHD(push, NV507D, SET_NOTIFIER_CONTROL,
+ NVDEF(NV507D, SET_NOTIFIER_CONTROL, MODE, WRITE) |
+ NVVAL(NV507D, SET_NOTIFIER_CONTROL, OFFSET, NV50_DISP_CORE_NTFY >> 2) |
+ NVDEF(NV507D, SET_NOTIFIER_CONTROL, NOTIFY, ENABLE));
PUSH_MTHD(push, NV507D, GET_CAPABILITIES, 0x00000000);
- return PUSH_KICK(push);
+ ret = PUSH_KICK(push);
+ if (ret)
+ return ret;
+
+ return 0;
}
int
--
2.26.2
ext4_search_dir() and ext4_generic_delete_entry() can be called both for
standard director blocks and for inline directories stored inside inode
or inline xattr space. For the second case we didn't call
ext4_check_dir_entry() with proper constraints that could result in
accepting corrupted directory entry as well as false positive filesystem
errors like:
EXT4-fs error (device dm-0): ext4_search_dir:1395: inode #28320400:
block 113246792: comm dockerd: bad entry in directory: directory entry too
close to block end - offset=0, inode=28320403, rec_len=32, name_len=8,
size=4096
Fix the arguments passed to ext4_check_dir_entry().
Fixes: 109ba779d6cc ("ext4: check for directory entries too close to block end")
CC: stable(a)vger.kernel.org
Signed-off-by: Jan Kara <jack(a)suse.cz>
---
fs/ext4/namei.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 56738b538ddf..98b91f2314eb 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1396,8 +1396,8 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size,
ext4_match(dir, fname, de)) {
/* found a match - just to be sure, do
* a full check */
- if (ext4_check_dir_entry(dir, NULL, de, bh, bh->b_data,
- bh->b_size, offset))
+ if (ext4_check_dir_entry(dir, NULL, de, bh, search_buf,
+ buf_size, offset))
return -1;
*res_dir = de;
return 1;
@@ -2472,7 +2472,7 @@ int ext4_generic_delete_entry(handle_t *handle,
de = (struct ext4_dir_entry_2 *)entry_buf;
while (i < buf_size - csum_size) {
if (ext4_check_dir_entry(dir, NULL, de, bh,
- bh->b_data, bh->b_size, i))
+ entry_buf, buf_size, i))
return -EFSCORRUPTED;
if (de == de_del) {
if (pde)
--
2.16.4
SCHED_RESTART code path is relied to re-run queue for dispatch requests
in hctx->dispatch. Meantime the SCHED_RSTART flag is checked when adding
requests to hctx->dispatch.
memory barriers have to be used for ordering the following two pair of OPs:
1) adding requests to hctx->dispatch and checking SCHED_RESTART in
blk_mq_dispatch_rq_list()
2) clearing SCHED_RESTART and checking if there is request in hctx->dispatch
in blk_mq_sched_restart().
Without the added memory barrier, either:
1) blk_mq_sched_restart() may miss requests added to hctx->dispatch meantime
blk_mq_dispatch_rq_list() observes SCHED_RESTART, and not run queue in
dispatch side
or
2) blk_mq_dispatch_rq_list still sees SCHED_RESTART, and not run queue
in dispatch side, meantime checking if there is request in
hctx->dispatch from blk_mq_sched_restart() is missed.
IO hang in ltp/fs_fill test is reported by kernel test robot:
https://lkml.org/lkml/2020/7/26/77
Turns out it is caused by the above out-of-order OPs. And the IO hang
can't be observed any more after applying this patch.
Cc: Bart Van Assche <bvanassche(a)acm.org>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: David Jeffery <djeffery(a)redhat.com>
Reported-by: kernel test robot <rong.a.chen(a)intel.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Ming Lei <ming.lei(a)redhat.com>
---
block/blk-mq-sched.c | 9 +++++++++
block/blk-mq.c | 9 +++++++++
2 files changed, 18 insertions(+)
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index a19cdf159b75..d2790e5b06d1 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -78,6 +78,15 @@ void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx)
return;
clear_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
+ /*
+ * Order clearing SCHED_RESTART and list_empty_careful(&hctx->dispatch)
+ * in blk_mq_run_hw_queue(). Its pair is the barrier in
+ * blk_mq_dispatch_rq_list(). So dispatch code won't see SCHED_RESTART,
+ * meantime new request added to hctx->dispatch is missed to check in
+ * blk_mq_run_hw_queue().
+ */
+ smp_mb();
+
blk_mq_run_hw_queue(hctx, true);
}
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 0015a1892153..6c1c3ad175a9 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1437,6 +1437,15 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list,
list_splice_tail_init(list, &hctx->dispatch);
spin_unlock(&hctx->lock);
+ /*
+ * Order adding requests to hctx->dispatch and checking
+ * SCHED_RESTART flag. The pair of this smp_mb() is the one
+ * in blk_mq_sched_restart(). Avoid restart code path to
+ * miss the new added requests to hctx->dispatch, meantime
+ * SCHED_RESTART is observed here.
+ */
+ smp_mb();
+
/*
* If SCHED_RESTART was set by the caller of this function and
* it is no longer set that means that it was cleared by another
--
2.25.2
Before this commit i2c_hid_parse() consists of the following steps:
1. Send power on cmd
2. usleep_range(1000, 5000)
3. Send reset cmd
4. Wait for reset to complete (device interrupt, or msleep(100))
5. Send power on cmd
6. Try to read HID descriptor
Notice how there is an usleep_range(1000, 5000) after the first power-on
command, but not after the second power-on command.
Testing has shown that at least on the BMAX Y13 laptop's i2c-hid touchpad,
not having a delay after the second power-on command causes the HID
descriptor to read as all zeros.
In case we hit this on other devices too, the descriptor being all zeros
can be recognized by the following message being logged many, many times:
hid-generic 0018:0911:5288.0002: unknown main item tag 0x0
At the same time as the BMAX Y13's touchpad issue was debugged,
Kai-Heng was working on debugging some issues with Goodix i2c-hid
touchpads. It turns out that these need a delay after a PWR_ON command
too, otherwise they stop working after a suspend/resume cycle.
According to Goodix a delay of minimal 60ms is needed.
Having multiple cases where we need a delay after sending the power-on
command, seems to indicate that we should always sleep after the power-on
command.
This commit fixes the mentioned issues by moving the existing 1ms sleep to
the i2c_hid_set_power() function and changing it to a 60ms sleep.
Cc: stable(a)vger.kernel.org
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208247
Reported-by: Kai-Heng Feng <kai.heng.feng(a)canonical.com>
Reported-and-tested-by: Andrea Borgia <andrea(a)borgia.bo.it>
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
---
Changes in v2:
- Add Kai-Heng's case, with Goodix touchpads needing a delay after PWR_ON too,
to the commit message
- Add a Reported-by tag for Kai-Heng
- Increase the delay to 60ms
---
drivers/hid/i2c-hid/i2c-hid-core.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 294c84e136d7..dbd04492825d 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -420,6 +420,19 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
dev_err(&client->dev, "failed to change power setting.\n");
set_pwr_exit:
+
+ /*
+ * The HID over I2C specification states that if a DEVICE needs time
+ * after the PWR_ON request, it should utilise CLOCK stretching.
+ * However, it has been observered that the Windows driver provides a
+ * 1ms sleep between the PWR_ON and RESET requests.
+ * According to Goodix Windows even waits 60 ms after (other?)
+ * PWR_ON requests. Testing has confirmed that several devices
+ * will not work properly without a delay after a PWR_ON request.
+ */
+ if (!ret && power_state == I2C_HID_PWR_ON)
+ msleep(60);
+
return ret;
}
@@ -441,15 +454,6 @@ static int i2c_hid_hwreset(struct i2c_client *client)
if (ret)
goto out_unlock;
- /*
- * The HID over I2C specification states that if a DEVICE needs time
- * after the PWR_ON request, it should utilise CLOCK stretching.
- * However, it has been observered that the Windows driver provides a
- * 1ms sleep between the PWR_ON and RESET requests and that some devices
- * rely on this.
- */
- usleep_range(1000, 5000);
-
i2c_hid_dbg(ihid, "resetting...\n");
ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0);
--
2.28.0
From: Sean Paul <seanpaul(a)chromium.org>
This patch fixes a few bugs:
1- We weren't taking into account sha_leftovers when adding multiple
ksvs to sha_text. As such, we were or'ing the end of ksv[j - 1] with
the beginning of ksv[j]
2- In the sha_leftovers == 2 and sha_leftovers == 3 case, bstatus was
being placed on the wrong half of sha_text, overlapping the leftover
ksv value
3- In the sha_leftovers == 2 case, we need to manually terminate the
byte stream with 0x80 since the hardware doesn't have enough room to
add it after writing M0
The upside is that all of the HDCP supported HDMI repeaters I could
find on Amazon just strip HDCP anyways, so it turns out to be _really_
hard to hit any of these cases without an MST hub, which is not (yet)
supported. Oh, and the sha_leftovers == 1 case works perfectly!
Fixes: ee5e5e7a5e0f (drm/i915: Add HDCP framework + base implementation)
Cc: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Ramalingam C <ramalingam.c(a)intel.com>
Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: Sean Paul <seanpaul(a)chromium.org>
Cc: Jani Nikula <jani.nikula(a)linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com>
Cc: intel-gfx(a)lists.freedesktop.org
Cc: <stable(a)vger.kernel.org> # v4.17+
Reviewed-by: Ramalingam C <ramalingam.c(a)intel.com>
Signed-off-by: Sean Paul <seanpaul(a)chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20191203173638.94919-2-sean@p… #v1
Link: https://patchwork.freedesktop.org/patch/msgid/20191212190230.188505-2-sean@… #v2
Link: https://patchwork.freedesktop.org/patch/msgid/20200117193103.156821-2-sean@… #v3
Link: https://patchwork.freedesktop.org/patch/msgid/20200218220242.107265-2-sean@… #v4
Link: https://patchwork.freedesktop.org/patch/msgid/20200305201236.152307-2-sean@… #v5
Link: https://patchwork.freedesktop.org/patch/msgid/20200429195502.39919-2-sean@p… #v6
Link: https://patchwork.freedesktop.org/patch/msgid/20200623155907.22961-2-sean@p… #v7
Changes in v2:
-None
Changes in v3:
-None
Changes in v4:
-Rebased on intel_de_write changes
Changes in v5:
-None
Changes in v6:
-None
Changes in v7:
-None
Changes in v8:
-None
---
drivers/gpu/drm/i915/display/intel_hdcp.c | 26 +++++++++++++++++------
include/drm/drm_hdcp.h | 3 +++
2 files changed, 23 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_hdcp.c b/drivers/gpu/drm/i915/display/intel_hdcp.c
index 89a4d294822d..6189b7583277 100644
--- a/drivers/gpu/drm/i915/display/intel_hdcp.c
+++ b/drivers/gpu/drm/i915/display/intel_hdcp.c
@@ -336,8 +336,10 @@ int intel_hdcp_validate_v_prime(struct intel_connector *connector,
/* Fill up the empty slots in sha_text and write it out */
sha_empty = sizeof(sha_text) - sha_leftovers;
- for (j = 0; j < sha_empty; j++)
- sha_text |= ksv[j] << ((sizeof(sha_text) - j - 1) * 8);
+ for (j = 0; j < sha_empty; j++) {
+ u8 off = ((sizeof(sha_text) - j - 1 - sha_leftovers) * 8);
+ sha_text |= ksv[j] << off;
+ }
ret = intel_write_sha_text(dev_priv, sha_text);
if (ret < 0)
@@ -435,7 +437,7 @@ int intel_hdcp_validate_v_prime(struct intel_connector *connector,
/* Write 32 bits of text */
intel_de_write(dev_priv, HDCP_REP_CTL,
rep_ctl | HDCP_SHA1_TEXT_32);
- sha_text |= bstatus[0] << 24 | bstatus[1] << 16;
+ sha_text |= bstatus[0] << 8 | bstatus[1];
ret = intel_write_sha_text(dev_priv, sha_text);
if (ret < 0)
return ret;
@@ -450,17 +452,29 @@ int intel_hdcp_validate_v_prime(struct intel_connector *connector,
return ret;
sha_idx += sizeof(sha_text);
}
+
+ /*
+ * Terminate the SHA-1 stream by hand. For the other leftover
+ * cases this is appended by the hardware.
+ */
+ intel_de_write(dev_priv, HDCP_REP_CTL,
+ rep_ctl | HDCP_SHA1_TEXT_32);
+ sha_text = DRM_HDCP_SHA1_TERMINATOR << 24;
+ ret = intel_write_sha_text(dev_priv, sha_text);
+ if (ret < 0)
+ return ret;
+ sha_idx += sizeof(sha_text);
} else if (sha_leftovers == 3) {
- /* Write 32 bits of text */
+ /* Write 32 bits of text (filled from LSB) */
intel_de_write(dev_priv, HDCP_REP_CTL,
rep_ctl | HDCP_SHA1_TEXT_32);
- sha_text |= bstatus[0] << 24;
+ sha_text |= bstatus[0];
ret = intel_write_sha_text(dev_priv, sha_text);
if (ret < 0)
return ret;
sha_idx += sizeof(sha_text);
- /* Write 8 bits of text, 24 bits of M0 */
+ /* Write 8 bits of text (filled from LSB), 24 bits of M0 */
intel_de_write(dev_priv, HDCP_REP_CTL,
rep_ctl | HDCP_SHA1_TEXT_8);
ret = intel_write_sha_text(dev_priv, bstatus[1]);
diff --git a/include/drm/drm_hdcp.h b/include/drm/drm_hdcp.h
index c6bab4986a65..fe58dbb46962 100644
--- a/include/drm/drm_hdcp.h
+++ b/include/drm/drm_hdcp.h
@@ -29,6 +29,9 @@
/* Slave address for the HDCP registers in the receiver */
#define DRM_HDCP_DDC_ADDR 0x3A
+/* Value to use at the end of the SHA-1 bytestream used for repeaters */
+#define DRM_HDCP_SHA1_TERMINATOR 0x80
+
/* HDCP register offsets for HDMI/DVI devices */
#define DRM_HDCP_DDC_BKSV 0x00
#define DRM_HDCP_DDC_RI_PRIME 0x08
--
Sean Paul, Software Engineer, Google / Chromium OS
This series fixes a couple of driver issues handling ClearFeature(halt)
request:
1) A function driver often uses set_halt() to reject a class driver protocol
command. After set_halt(), the endpoint will be stalled. It can queue new
requests while the endpoint is stalled. However, dwc3 currently drops those
requests after CLEAR_STALL. The driver should only drop started requests. Keep
the pending requests in the pending list to resume and process them after the
host issues ClearFeature(Halt) to the endpoint.
2) DWC3 should issue CLEAR_STALL command _after_ END_TRANSFER command completes.
Thinh Nguyen (3):
usb: dwc3: gadget: Resume pending requests after CLEAR_STALL
usb: dwc3: gadget: END_TRANSFER before CLEAR_STALL command
usb: dwc3: gadget: Refactor ep command completion
drivers/usb/dwc3/core.h | 1 +
drivers/usb/dwc3/ep0.c | 16 +++++++++
drivers/usb/dwc3/gadget.c | 85 +++++++++++++++++++++++++++++++----------------
drivers/usb/dwc3/gadget.h | 1 +
4 files changed, 75 insertions(+), 28 deletions(-)
base-commit: e3ee0e740c3887d2293e8d54a8707218d70d86ca
--
2.11.0
The ast HW cursor requires the primary plane and CRTC to display at
a valid mode and format. This is not the case while switching
display modes, which can lead to the screen turing permanently dark.
As a workaround, the ast driver now disables active planes while the
mode or format switch takes place. It also synchronizes with the vertical
refresh to give CRTC and planes some time to catch up on each other.
The active planes planes (primary or cursor) will be re-enabled by
each plane's atomic_update() function.
v2:
* move the logic into the commit-tail function
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
Fixes: 4961eb60f145 ("drm/ast: Enable atomic modesetting")
Cc: Thomas Zimmermann <tzimmermann(a)suse.de>
Cc: Gerd Hoffmann <kraxel(a)redhat.com>
Cc: Dave Airlie <airlied(a)redhat.com>
Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: Sam Ravnborg <sam(a)ravnborg.org>
Cc: Emil Velikov <emil.l.velikov(a)gmail.com>
Cc: "Y.C. Chen" <yc_chen(a)aspeedtech.com>
Cc: <stable(a)vger.kernel.org> # v5.6+
---
drivers/gpu/drm/ast/ast_drv.h | 2 +
drivers/gpu/drm/ast/ast_mode.c | 68 ++++++++++++++++++++++++++++++++--
2 files changed, 66 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h
index c1af6b725933..467049ca8430 100644
--- a/drivers/gpu/drm/ast/ast_drv.h
+++ b/drivers/gpu/drm/ast/ast_drv.h
@@ -177,6 +177,8 @@ struct ast_private *ast_device_create(struct drm_driver *drv,
#define AST_IO_MM_OFFSET (0x380)
+#define AST_IO_VGAIR1_VREFRESH BIT(3)
+
#define __ast_read(x) \
static inline u##x ast_read##x(struct ast_private *ast, u32 reg) { \
u##x val = 0;\
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index ae5cb0a333f7..a379d51f3543 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -514,6 +514,17 @@ static void ast_set_start_address_crt1(struct ast_private *ast,
}
+static void ast_wait_for_vretrace(struct ast_private *ast)
+{
+ unsigned long timeout = jiffies + HZ;
+ u8 vgair1;
+
+ do {
+ vgair1 = ast_io_read8(ast, AST_IO_INPUT_STATUS1_READ);
+ } while (!(vgair1 & AST_IO_VGAIR1_VREFRESH) &&
+ time_before(jiffies, timeout));
+}
+
/*
* Primary plane
*/
@@ -1043,23 +1054,72 @@ static int ast_connector_init(struct drm_device *dev)
* Mode config
*/
+static bool
+ast_crtc_needs_planes_disabled(struct drm_crtc_state *old_crtc_state,
+ struct drm_crtc_state *new_crtc_state)
+{
+ struct ast_crtc_state *old_ast_crtc_state, *new_ast_crtc_state;
+
+ if (drm_atomic_crtc_needs_modeset(new_crtc_state))
+ return true;
+
+ old_ast_crtc_state = to_ast_crtc_state(old_crtc_state);
+ new_ast_crtc_state = to_ast_crtc_state(new_crtc_state);
+
+ if (old_ast_crtc_state->format != new_ast_crtc_state->format)
+ return true;
+
+ return false;
+}
+
static void
ast_mode_config_helper_commit_tail(struct drm_atomic_state *old_state)
{
struct drm_device *dev = old_state->dev;
+ struct ast_private *ast = to_ast_private(dev);
+ struct drm_crtc_state *old_crtc_state, *new_crtc_state;
+ struct drm_crtc *crtc;
+ int i;
+ bool wait_for_vretrace = false;
drm_atomic_helper_commit_modeset_disables(dev, old_state);
- drm_atomic_helper_commit_planes(dev, old_state, 0);
+ /*
+ * HW cursors require the underlying primary plane and CRTC to
+ * display a valid mode and image. This is not the case during
+ * full modeset operations. So we temporarily disable any active
+ * plane, including the HW cursor. Each plane's atomic_update()
+ * helper will re-enable it if necessary.
+ *
+ * We only do this during *full* modesets. It does not affect
+ * simple pageflips on the planes.
+ */
+ for_each_oldnew_crtc_in_state(old_state, crtc,
+ old_crtc_state,
+ new_crtc_state, i) {
+ if (!ast_crtc_needs_planes_disabled(old_crtc_state,
+ new_crtc_state))
+ continue;
+ drm_atomic_helper_disable_planes_on_crtc(old_crtc_state,
+ false);
+ wait_for_vretrace = true;
+ }
+
+ /*
+ * Ensure that no scanout takes place before reprogramming mode
+ * and format registers.
+ */
+ if (wait_for_vretrace)
+ ast_wait_for_vretrace(ast);
+
+ drm_atomic_helper_commit_planes(dev, old_state,
+ DRM_PLANE_COMMIT_ACTIVE_ONLY);
drm_atomic_helper_commit_modeset_enables(dev, old_state);
drm_atomic_helper_fake_vblank(old_state);
-
drm_atomic_helper_commit_hw_done(old_state);
-
drm_atomic_helper_wait_for_vblanks(dev, old_state);
-
drm_atomic_helper_cleanup_planes(dev, old_state);
}
--
2.28.0
Not entirely sure why this never came up when I originally tested this
(maybe some BIOSes already have this setup?) but the ->caps_init vfunc
appears to cause the display engine to throw an exception on driver
init, at least on my ThinkPad P72:
nouveau 0000:01:00.0: disp: chid 0 mthd 008c data 00000000 0000508c 0000102b
This is magic nvidia speak for "You need to have the DMA notifier offset
programmed before you can call NV507D_GET_CAPABILITIES." So, let's fix
this by doing that, and also perform an update afterwards to prevent
racing with the GPU when reading capabilities.
Changes since v1:
* Don't just program the DMA notifier offset, make sure to actually
perform an update
Signed-off-by: Lyude Paul <lyude(a)redhat.com>
Fixes: 4a2cb4181b07 ("drm/nouveau/kms/nv50-: Probe SOR and PIOR caps for DP interlacing support")
Cc: <stable(a)vger.kernel.org> # v5.8+
---
drivers/gpu/drm/nouveau/dispnv50/core507d.c | 22 +++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/nouveau/dispnv50/core507d.c b/drivers/gpu/drm/nouveau/dispnv50/core507d.c
index ad1f09a143aa4..fc4bf9ca59f85 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/core507d.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/core507d.c
@@ -77,14 +77,32 @@ core507d_ntfy_init(struct nouveau_bo *bo, u32 offset)
int
core507d_caps_init(struct nouveau_drm *drm, struct nv50_disp *disp)
{
+ struct nv50_core *core = disp->core;
struct nvif_push *push = disp->core->chan.push;
+ u32 interlock[NV50_DISP_INTERLOCK__SIZE] = {0};
int ret;
- if ((ret = PUSH_WAIT(push, 2)))
+ core->func->ntfy_init(disp->sync, NV50_DISP_CORE_NTFY);
+
+ if ((ret = PUSH_WAIT(push, 4)))
return ret;
+ PUSH_MTHD(push, NV507D, SET_NOTIFIER_CONTROL,
+ NVDEF(NV507D, SET_NOTIFIER_CONTROL, MODE, WRITE) |
+ NVVAL(NV507D, SET_NOTIFIER_CONTROL, OFFSET, NV50_DISP_CORE_NTFY >> 2) |
+ NVDEF(NV507D, SET_NOTIFIER_CONTROL, NOTIFY, ENABLE));
PUSH_MTHD(push, NV507D, GET_CAPABILITIES, 0x00000000);
- return PUSH_KICK(push);
+
+ ret = PUSH_KICK(push);
+ if (ret)
+ return ret;
+
+ core->func->update(core, interlock, false);
+ if (core->func->ntfy_wait_done(disp->sync, NV50_DISP_CORE_NTFY,
+ core->chan.base.device))
+ NV_ERROR(drm, "core notifier timeout\n");
+
+ return 0;
}
int
--
2.26.2
Fix 2 unlocked ucsi_run_command calls:
1. ucsi_handle_connector_change() contains one ucsi_send_command() call,
which takes the ppm_lock for it; and one ucsi_run_command() call which
relies on the caller have taking the ppm_lock.
ucsi_handle_connector_change() does not take the lock, so the
second (ucsi_run_command) calls should also be ucsi_send_command().
2. ucsi_get_pdos() gets called from ucsi_handle_connector_change() which
does not hold the ppm_lock, so it also must use ucsi_send_command().
This commit also adds a WARN_ON(!mutex_is_locked(&ucsi->ppm_lock)); to
ucsi_run_command() to avoid similar problems getting re-introduced in
the future.
Cc: stable(a)vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
---
drivers/usb/typec/ucsi/ucsi.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index d9d93f83b2a6..2f586d6c54f4 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -152,6 +152,8 @@ static int ucsi_run_command(struct ucsi *ucsi, u64 command,
u8 length;
int ret;
+ WARN_ON(!mutex_is_locked(&ucsi->ppm_lock));
+
ret = ucsi_exec_command(ucsi, command);
if (ret < 0)
return ret;
@@ -502,7 +504,7 @@ static void ucsi_get_pdos(struct ucsi_connector *con, int is_partner)
command |= UCSI_GET_PDOS_PARTNER_PDO(is_partner);
command |= UCSI_GET_PDOS_NUM_PDOS(UCSI_MAX_PDOS - 1);
command |= UCSI_GET_PDOS_SRC_PDOS;
- ret = ucsi_run_command(ucsi, command, con->src_pdos,
+ ret = ucsi_send_command(ucsi, command, con->src_pdos,
sizeof(con->src_pdos));
if (ret < 0) {
dev_err(ucsi->dev, "UCSI_GET_PDOS failed (%d)\n", ret);
@@ -681,7 +683,7 @@ static void ucsi_handle_connector_change(struct work_struct *work)
*/
command = UCSI_GET_CAM_SUPPORTED;
command |= UCSI_CONNECTOR_NUMBER(con->num);
- ucsi_run_command(con->ucsi, command, NULL, 0);
+ ucsi_send_command(con->ucsi, command, NULL, 0);
}
if (con->status.change & UCSI_CONSTAT_PARTNER_CHANGE)
--
2.26.2
We only allow persistent requests to remain on the GPU past the closure
of their containing context (and process) so long as they are continuously
checked for hangs or allow other requests to preempt them, as we need to
ensure forward progress of the system. If we allow persistent contexts
to remain on the system after the the hangcheck mechanism is disabled,
the system may grind to a halt. On disabling the mechanism, we sent a
pulse along the engine to remove all executing contexts from the engine
which would check for hung contexts -- but we did not prevent those
contexts from being resubmitted if they survived the final hangcheck.
Fixes: 9a40bddd47ca ("drm/i915/gt: Expose heartbeat interval via sysfs")
Testcase: igt/gem_ctx_persistence/heartbeat-stop
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: <stable(a)vger.kernel.org> # v5.7+
---
drivers/gpu/drm/i915/gt/intel_engine.h | 9 +++++++++
drivers/gpu/drm/i915/i915_request.c | 5 +++++
2 files changed, 14 insertions(+)
diff --git a/drivers/gpu/drm/i915/gt/intel_engine.h b/drivers/gpu/drm/i915/gt/intel_engine.h
index 08e2c000dcc3..a90cb91c8246 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine.h
+++ b/drivers/gpu/drm/i915/gt/intel_engine.h
@@ -337,4 +337,13 @@ intel_engine_has_preempt_reset(const struct intel_engine_cs *engine)
return intel_engine_has_preemption(engine);
}
+static inline bool
+intel_engine_has_heartbeat(const struct intel_engine_cs *engine)
+{
+ if (!IS_ACTIVE(CONFIG_DRM_I915_HEARTBEAT_INTERVAL))
+ return false;
+
+ return engine->props.heartbeat_interval_ms;
+}
+
#endif /* _INTEL_RINGBUFFER_H_ */
diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c
index 0208e917d14a..92efca606f91 100644
--- a/drivers/gpu/drm/i915/i915_request.c
+++ b/drivers/gpu/drm/i915/i915_request.c
@@ -542,8 +542,13 @@ bool __i915_request_submit(struct i915_request *request)
if (i915_request_completed(request))
goto xfer;
+ if (unlikely(intel_context_is_closed(request->context) &&
+ !intel_engine_has_heartbeat(engine)))
+ intel_context_set_banned(request->context);
+
if (unlikely(intel_context_is_banned(request->context)))
i915_request_set_error_once(request, -EIO);
+
if (unlikely(fatal_error(request->fence.error)))
__i915_request_skip(request);
--
2.20.1
It recently became apparent that some of the low-level input and hid
helpers lack some form of input validation when associating an event
code with their internal capability bitmap, leading to potential
memory corruption.
These two patches address two occurrences of that issue, by masking
out the top bits of the event code (all capability bitmaps are
conveniently sized as power of twos), and spitting out a warning for
further debugging.
Marc Zyngier (2):
Input; Sanitize event code before modifying bitmaps
HID: core; Sanitize event code and type before mapping input
drivers/input/input.c | 16 +++++++++++++++-
include/linux/hid.h | 19 +++++++++++++++----
2 files changed, 30 insertions(+), 5 deletions(-)
--
2.27.0
After commit 912c0a7f2b5daa3cbb2bc10f303981e493de73bd ("powerpc/64s: Save FSCR
to init_task.thread.fscr after feature init"), which has been applied to the
referred branches, when userspace sets the user DSCR MSR, it won't be inherited
or restored during context switch, because the facility unavailable interrupt
won't trigger.
Applying 0828137e8f16721842468e33df0460044a0c588b ("powerpc/64s: Don't init
FSCR_DSCR in __init_FSCR()") will fix it.
Cascardo.
This is the start of the stable review cycle for the 4.19.142 release.
There are 71 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 26 Aug 2020 08:23:34 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.142-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.142-rc1
Stephen Boyd <sboyd(a)kernel.org>
clk: Evict unregistered clks from parent caches
Juergen Gross <jgross(a)suse.com>
xen: don't reschedule in preemption off sections
Peter Xu <peterx(a)redhat.com>
mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
Al Viro <viro(a)zeniv.linux.org.uk>
do_epoll_ctl(): clean the failure exits up a bit
Marc Zyngier <maz(a)kernel.org>
epoll: Keep a reference on files added to the check list
Li Heng <liheng40(a)huawei.com>
efi: add missed destroy_workqueue when efisubsys_init fails
Vasant Hegde <hegdevasant(a)linux.vnet.ibm.com>
powerpc/pseries: Do not initiate shutdown when system is running on UPS
Tom Rix <trix(a)redhat.com>
net: dsa: b53: check for timeout
Haiyang Zhang <haiyangz(a)microsoft.com>
hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit()
Wang Hai <wanghai38(a)huawei.com>
net: gemini: Fix missing free_netdev() in error path of gemini_ethernet_port_probe()
Shay Agroskin <shayagr(a)amazon.com>
net: ena: Prevent reset after device destruction
Jiri Wiesner <jwiesner(a)suse.com>
bonding: fix active-backup failover for current ARP slave
David Howells <dhowells(a)redhat.com>
afs: Fix NULL deref in afs_dynroot_depopulate()
Selvin Xavier <selvin.xavier(a)broadcom.com>
RDMA/bnxt_re: Do not add user qps to flushlist
Randy Dunlap <rdunlap(a)infradead.org>
Fix build error when CONFIG_ACPI is not set/enabled:
Juergen Gross <jgross(a)suse.com>
efi: avoid error message when booting under Xen
Masahiro Yamada <masahiroy(a)kernel.org>
kconfig: qconf: fix signal connection to invalid slots
Masahiro Yamada <masahiroy(a)kernel.org>
kconfig: qconf: do not limit the pop-up menu to the first row
Jim Mattson <jmattson(a)google.com>
kvm: x86: Toggling CR4.PKE does not load PDPTEs in PAE mode
Jim Mattson <jmattson(a)google.com>
kvm: x86: Toggling CR4.SMAP does not load PDPTEs in PAE mode
Alex Williamson <alex.williamson(a)redhat.com>
vfio/type1: Add proper error unwind for vfio_iommu_replay()
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
ASoC: intel: Fix memleak in sst_media_open
Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
ASoC: msm8916-wcd-analog: fix register Interrupt offset
Heiko Carstens <hca(a)linux.ibm.com>
s390/ptrace: fix storage key handling
Heiko Carstens <hca(a)linux.ibm.com>
s390/runtime_instrumentation: fix storage key handling
Cong Wang <xiyou.wangcong(a)gmail.com>
bonding: fix a potential double-unregister
Jarod Wilson <jarod(a)redhat.com>
bonding: show saner speed for broadcast mode
Fugang Duan <fugang.duan(a)nxp.com>
net: fec: correct the error path for regulator disable in probe
Grzegorz Szczurek <grzegorzx.szczurek(a)intel.com>
i40e: Fix crash during removing i40e driver
Przemyslaw Patynowski <przemyslawx.patynowski(a)intel.com>
i40e: Set RX_ONLY mode for unicast promiscuous on VLAN
Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
ASoC: q6routing: add dummy register read/write function
Jan Kara <jack(a)suse.cz>
ext4: don't allow overlapping system zones
Eric Sandeen <sandeen(a)redhat.com>
ext4: fix potential negative array index in do_split()
Helge Deller <deller(a)gmx.de>
fs/signalfd.c: fix inconsistent return codes for signalfd4
Luc Van Oostenryck <luc.vanoostenryck(a)gmail.com>
alpha: fix annotation of io{read,write}{16,32}be()
Eiichi Tsukata <devel(a)etsukata.com>
xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init
Gaurav Singh <gaurav1086(a)gmail.com>
tools/testing/selftests/cgroup/cgroup_util.c: cg_read_strcmp: fix null pointer dereference
Mao Wenan <wenan.mao(a)linux.alibaba.com>
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
Javed Hasan <jhasan(a)marvell.com>
scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases
Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com>
cpufreq: intel_pstate: Fix cpuinfo_max_freq when MSR_TURBO_RATIO_LIMIT is 0
Xiubo Li <xiubli(a)redhat.com>
ceph: fix use-after-free for fsc->mdsc
Zhe Li <lizhe67(a)huawei.com>
jffs2: fix UAF problem
Darrick J. Wong <darrick.wong(a)oracle.com>
xfs: fix inode quota reservation checks
Chuck Lever <chuck.lever(a)oracle.com>
svcrdma: Fix another Receive buffer leak
Greg Ungerer <gerg(a)linux-m68k.org>
m68knommu: fix overwriting of bits in ColdFire V3 cache control
Xiongfeng Wang <wangxiongfeng2(a)huawei.com>
Input: psmouse - add a newline when printing 'proto' by sysfs
Evgeny Novikov <novikov(a)ispras.ru>
media: vpss: clean up resources in init
Huacai Chen <chenhc(a)lemote.com>
rtc: goldfish: Enable interrupt in set_alarm() when necessary
Chuhong Yuan <hslester96(a)gmail.com>
media: budget-core: Improve exception handling in budget_register()
Bodo Stroesser <bstroesser(a)ts.fujitsu.com>
scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM
Stanley Chu <stanley.chu(a)mediatek.com>
scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices
Lukas Wunner <lukas(a)wunner.de>
spi: Prevent adding devices below an unregistering controller
Liang Chen <cl(a)rock-chips.com>
kthread: Do not preempt current task if it is going to call schedule()
Krunoslav Kovac <Krunoslav.Kovac(a)amd.com>
drm/amd/display: fix pow() crashing when given base 0
Yang Shi <shy828301(a)gmail.com>
mm/memory.c: skip spurious TLB flush for retried page fault
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: Fix use-after-free in request timeout handlers
zhangyi (F) <yi.zhang(a)huawei.com>
jbd2: add the missing unlock_buffer() in the error path of jbd2_write_superblock()
Jan Kara <jack(a)suse.cz>
ext4: fix checking of directory entry validity for inline directories
Charan Teja Reddy <charante(a)codeaurora.org>
mm, page_alloc: fix core hung in free_pcppages_bulk()
Doug Berger <opendmb(a)gmail.com>
mm: include CMA pages in lowmem_reserve at boot
Wei Yongjun <weiyongjun1(a)huawei.com>
kernel/relay.c: fix memleak on destroy relay channel
Jann Horn <jannh(a)google.com>
romfs: fix uninitialized memory leak in romfs_dev_read()
Josef Bacik <josef(a)toxicpanda.com>
btrfs: sysfs: use NOFS for device creation
Qu Wenruo <wqu(a)suse.com>
btrfs: inode: fix NULL pointer dereference if inode doesn't need compression
Nikolay Borisov <nborisov(a)suse.com>
btrfs: Move free_pages_out label in inline extent handling branch in compress_file_range
Josef Bacik <josef(a)toxicpanda.com>
btrfs: don't show full path of bind mounts in subvol=
Marcos Paulo de Souza <mpdesouza(a)suse.com>
btrfs: export helpers for subvolume name/id resolution
Hugh Dickins <hughd(a)google.com>
khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter()
Hugh Dickins <hughd(a)google.com>
khugepaged: khugepaged_test_exit() check mmget_still_valid()
Masami Hiramatsu <mhiramat(a)kernel.org>
perf probe: Fix memory leakage when the probe point is not found
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset()
-------------
Diffstat:
Makefile | 4 +-
arch/alpha/include/asm/io.h | 8 +--
arch/m68k/include/asm/m53xxacr.h | 6 +-
arch/powerpc/platforms/pseries/ras.c | 1 -
arch/s390/kernel/ptrace.c | 7 ++-
arch/s390/kernel/runtime_instr.c | 2 +-
arch/x86/kvm/x86.c | 2 +-
arch/x86/pci/xen.c | 1 +
drivers/clk/clk.c | 52 +++++++++++++----
drivers/cpufreq/intel_pstate.c | 1 +
drivers/firmware/efi/efi.c | 2 +
drivers/gpu/drm/amd/display/include/fixed31_32.h | 3 +
drivers/gpu/drm/vgem/vgem_drv.c | 27 ---------
drivers/infiniband/hw/bnxt_re/main.c | 3 +-
drivers/input/mouse/psmouse-base.c | 2 +-
drivers/media/pci/ttpci/budget-core.c | 11 +++-
drivers/media/platform/davinci/vpss.c | 20 +++++--
drivers/net/bonding/bond_main.c | 42 ++++++++++++--
drivers/net/dsa/b53/b53_common.c | 2 +
drivers/net/ethernet/amazon/ena/ena_netdev.c | 19 +++---
drivers/net/ethernet/cortina/gemini.c | 4 +-
drivers/net/ethernet/freescale/fec_main.c | 4 +-
drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h | 2 +-
drivers/net/ethernet/intel/i40e/i40e_common.c | 35 ++++++++---
drivers/net/ethernet/intel/i40e/i40e_main.c | 3 +
drivers/net/hyperv/netvsc_drv.c | 2 +-
drivers/rtc/rtc-goldfish.c | 1 +
drivers/s390/scsi/zfcp_fsf.c | 4 +-
drivers/scsi/libfc/fc_disc.c | 12 +++-
drivers/scsi/ufs/ufs_quirks.h | 1 +
drivers/scsi/ufs/ufshcd.c | 2 +
drivers/spi/Kconfig | 3 +
drivers/spi/spi.c | 21 ++++++-
drivers/target/target_core_user.c | 2 +-
drivers/vfio/vfio_iommu_type1.c | 71 +++++++++++++++++++++--
drivers/video/fbdev/efifb.c | 2 +-
drivers/virtio/virtio_ring.c | 3 +
drivers/xen/preempt.c | 2 +-
fs/afs/dynroot.c | 20 ++++---
fs/btrfs/ctree.h | 2 +
fs/btrfs/export.c | 8 +--
fs/btrfs/export.h | 5 ++
fs/btrfs/inode.c | 23 +++++---
fs/btrfs/super.c | 18 ++++--
fs/btrfs/sysfs.c | 4 ++
fs/ceph/mds_client.c | 3 +-
fs/eventpoll.c | 19 +++---
fs/ext4/block_validity.c | 36 +++++-------
fs/ext4/namei.c | 22 +++++--
fs/jbd2/journal.c | 4 +-
fs/jffs2/dir.c | 6 +-
fs/romfs/storage.c | 4 +-
fs/signalfd.c | 10 ++--
fs/xfs/xfs_sysfs.h | 6 +-
fs/xfs/xfs_trans_dquot.c | 2 +-
kernel/kthread.c | 17 +++++-
kernel/relay.c | 1 +
mm/hugetlb.c | 24 ++++----
mm/khugepaged.c | 7 +--
mm/memory.c | 3 +
mm/page_alloc.c | 7 ++-
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 2 +
scripts/kconfig/qconf.cc | 70 +++++++++++-----------
sound/soc/codecs/msm8916-wcd-analog.c | 4 +-
sound/soc/intel/atom/sst-mfld-platform-pcm.c | 5 +-
sound/soc/qcom/qdsp6/q6routing.c | 16 +++++
tools/perf/util/probe-finder.c | 2 +-
tools/testing/selftests/cgroup/cgroup_util.c | 2 +-
68 files changed, 496 insertions(+), 245 deletions(-)
I'm announcing the release of the 4.9.234 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/alpha/include/asm/io.h | 8 -
arch/arm/kvm/mmu.c | 6 -
arch/m68k/include/asm/m53xxacr.h | 6 -
arch/powerpc/mm/fault.c | 7 +
arch/powerpc/platforms/pseries/ras.c | 1
arch/x86/include/asm/archrandom.h | 8 -
arch/x86/include/asm/bitops.h | 29 +++---
arch/x86/include/asm/percpu.h | 2
drivers/gpu/drm/imx/imx-ldb.c | 7 -
drivers/input/mouse/psmouse-base.c | 2
drivers/media/pci/ttpci/budget-core.c | 11 +-
drivers/media/platform/davinci/vpss.c | 20 +++-
drivers/net/dsa/b53/b53_common.c | 2
drivers/net/ethernet/freescale/fec_main.c | 4
drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h | 2
drivers/net/ethernet/intel/i40e/i40e_common.c | 35 ++++++-
drivers/scsi/libfc/fc_disc.c | 12 ++
drivers/scsi/ufs/ufs_quirks.h | 1
drivers/scsi/ufs/ufshcd.c | 2
drivers/virtio/virtio_ring.c | 3
drivers/xen/preempt.c | 2
fs/btrfs/ctree.h | 2
fs/btrfs/export.c | 8 -
fs/btrfs/export.h | 5 +
fs/btrfs/super.c | 18 ++--
fs/eventpoll.c | 19 ++--
fs/ext4/namei.c | 99 ++++++++--------------
fs/jffs2/dir.c | 6 +
fs/romfs/storage.c | 4
fs/xfs/xfs_sysfs.h | 6 -
fs/xfs/xfs_trans_dquot.c | 2
kernel/relay.c | 1
kernel/trace/trace_hwlat.c | 37 ++++----
mm/hugetlb.c | 24 ++---
mm/khugepaged.c | 7 -
mm/page_alloc.c | 7 +
sound/soc/intel/atom/sst-mfld-platform-pcm.c | 5 -
tools/perf/util/probe-finder.c | 2
39 files changed, 237 insertions(+), 187 deletions(-)
Al Viro (1):
do_epoll_ctl(): clean the failure exits up a bit
Charan Teja Reddy (1):
mm, page_alloc: fix core hung in free_pcppages_bulk()
Chuhong Yuan (1):
media: budget-core: Improve exception handling in budget_register()
Darrick J. Wong (1):
xfs: fix inode quota reservation checks
Dinghao Liu (1):
ASoC: intel: Fix memleak in sst_media_open
Doug Berger (1):
mm: include CMA pages in lowmem_reserve at boot
Eiichi Tsukata (1):
xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init
Eric Biggers (1):
ext4: clean up ext4_match() and callers
Eric Sandeen (1):
ext4: fix potential negative array index in do_split()
Evgeny Novikov (1):
media: vpss: clean up resources in init
Fugang Duan (1):
net: fec: correct the error path for regulator disable in probe
Greg Kroah-Hartman (1):
Linux 4.9.234
Greg Ungerer (1):
m68knommu: fix overwriting of bits in ColdFire V3 cache control
Hugh Dickins (2):
khugepaged: khugepaged_test_exit() check mmget_still_valid()
khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter()
Jan Beulich (1):
x86/asm: Add instruction suffixes to bitops
Jan Kara (1):
ext4: fix checking of directory entry validity for inline directories
Jann Horn (1):
romfs: fix uninitialized memory leak in romfs_dev_read()
Javed Hasan (1):
scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases
Josef Bacik (1):
btrfs: don't show full path of bind mounts in subvol=
Juergen Gross (1):
xen: don't reschedule in preemption off sections
Kevin Hao (1):
tracing/hwlat: Honor the tracing_cpumask
Liu Ying (1):
drm/imx: imx-ldb: Disable both channels for split mode in enc->disable()
Luc Van Oostenryck (1):
alpha: fix annotation of io{read,write}{16,32}be()
Mao Wenan (1):
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
Marc Zyngier (1):
epoll: Keep a reference on files added to the check list
Marcos Paulo de Souza (1):
btrfs: export helpers for subvolume name/id resolution
Masami Hiramatsu (1):
perf probe: Fix memory leakage when the probe point is not found
Michael Ellerman (1):
powerpc: Allow 4224 bytes of stack expansion for the signal frame
Peter Xu (1):
mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
Przemyslaw Patynowski (1):
i40e: Set RX_ONLY mode for unicast promiscuous on VLAN
Stanley Chu (1):
scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices
Steven Rostedt (VMware) (1):
tracing: Clean up the hwlat binding code
Tom Rix (1):
net: dsa: b53: check for timeout
Uros Bizjak (1):
x86/asm: Remove unnecessary \n\t in front of CC_SET() from asm templates
Vasant Hegde (1):
powerpc/pseries: Do not initiate shutdown when system is running on UPS
Wei Yongjun (1):
kernel/relay.c: fix memleak on destroy relay channel
Will Deacon (1):
KVM: arm/arm64: Don't reschedule in unmap_stage2_range()
Xiongfeng Wang (1):
Input: psmouse - add a newline when printing 'proto' by sysfs
Zhe Li (1):
jffs2: fix UAF problem
I'm announcing the release of the 4.4.234 kernel.
All users of the 4.4 kernel series must upgrade.
The updated 4.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/alpha/include/asm/io.h | 8 +-
arch/arm/kvm/mmu.c | 8 --
arch/m68k/include/asm/m53xxacr.h | 6 -
arch/powerpc/mm/fault.c | 7 +
drivers/gpu/drm/imx/imx-ldb.c | 7 +
drivers/input/mouse/psmouse-base.c | 2
drivers/media/pci/ttpci/budget-core.c | 11 ++-
drivers/media/platform/davinci/vpss.c | 20 ++++-
drivers/scsi/libfc/fc_disc.c | 12 ++-
drivers/video/fbdev/omap2/dss/dss.c | 2
drivers/virtio/virtio_ring.c | 3
drivers/watchdog/f71808e_wdt.c | 6 -
drivers/xen/preempt.c | 2
fs/btrfs/ctree.h | 2
fs/btrfs/export.c | 8 +-
fs/btrfs/export.h | 5 +
fs/btrfs/super.c | 18 +++-
fs/eventpoll.c | 19 +++--
fs/ext4/namei.c | 99 ++++++++++-----------------
fs/jffs2/dir.c | 6 +
fs/romfs/storage.c | 4 -
fs/xfs/xfs_sysfs.h | 6 +
fs/xfs/xfs_trans_dquot.c | 2
include/linux/mm.h | 4 +
include/net/sock.h | 4 +
mm/huge_memory.c | 4 -
mm/hugetlb.c | 25 +++---
mm/page_alloc.c | 7 +
net/compat.c | 1
net/core/sock.c | 21 +++++
sound/soc/intel/atom/sst-mfld-platform-pcm.c | 5 -
tools/perf/util/probe-finder.c | 2
33 files changed, 196 insertions(+), 142 deletions(-)
Adam Ford (1):
omapfb: dss: Fix max fclk divider for omap36xx
Ahmad Fatoum (2):
watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options
watchdog: f71808e_wdt: remove use of wrong watchdog_info option
Al Viro (1):
do_epoll_ctl(): clean the failure exits up a bit
Andrea Arcangeli (1):
coredump: fix race condition between collapse_huge_page() and core dumping
Charan Teja Reddy (1):
mm, page_alloc: fix core hung in free_pcppages_bulk()
Chuhong Yuan (1):
media: budget-core: Improve exception handling in budget_register()
Darrick J. Wong (1):
xfs: fix inode quota reservation checks
Dinghao Liu (1):
ASoC: intel: Fix memleak in sst_media_open
Doug Berger (1):
mm: include CMA pages in lowmem_reserve at boot
Eiichi Tsukata (1):
xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init
Eric Biggers (1):
ext4: clean up ext4_match() and callers
Eric Sandeen (1):
ext4: fix potential negative array index in do_split()
Evgeny Novikov (1):
media: vpss: clean up resources in init
Greg Kroah-Hartman (1):
Linux 4.4.234
Greg Ungerer (1):
m68knommu: fix overwriting of bits in ColdFire V3 cache control
Hugh Dickins (2):
khugepaged: khugepaged_test_exit() check mmget_still_valid()
khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter()
Jan Kara (1):
ext4: fix checking of directory entry validity for inline directories
Jann Horn (1):
romfs: fix uninitialized memory leak in romfs_dev_read()
Javed Hasan (1):
scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases
Josef Bacik (1):
btrfs: don't show full path of bind mounts in subvol=
Juergen Gross (1):
xen: don't reschedule in preemption off sections
Kees Cook (1):
net/compat: Add missing sock updates for SCM_RIGHTS
Liu Ying (1):
drm/imx: imx-ldb: Disable both channels for split mode in enc->disable()
Luc Van Oostenryck (1):
alpha: fix annotation of io{read,write}{16,32}be()
Mao Wenan (1):
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
Marc Zyngier (1):
epoll: Keep a reference on files added to the check list
Marcos Paulo de Souza (1):
btrfs: export helpers for subvolume name/id resolution
Masami Hiramatsu (1):
perf probe: Fix memory leakage when the probe point is not found
Michael Ellerman (1):
powerpc: Allow 4224 bytes of stack expansion for the signal frame
Peter Xu (1):
mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
Will Deacon (1):
KVM: arm/arm64: Don't reschedule in unmap_stage2_range()
Xiongfeng Wang (1):
Input: psmouse - add a newline when printing 'proto' by sysfs
Zhe Li (1):
jffs2: fix UAF problem
This is the start of the stable review cycle for the 4.4.234 release.
There are 33 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 26 Aug 2020 08:23:34 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.234-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.234-rc1
Adam Ford <aford173(a)gmail.com>
omapfb: dss: Fix max fclk divider for omap36xx
Juergen Gross <jgross(a)suse.com>
xen: don't reschedule in preemption off sections
Peter Xu <peterx(a)redhat.com>
mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
Al Viro <viro(a)zeniv.linux.org.uk>
do_epoll_ctl(): clean the failure exits up a bit
Marc Zyngier <maz(a)kernel.org>
epoll: Keep a reference on files added to the check list
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc: Allow 4224 bytes of stack expansion for the signal frame
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
ASoC: intel: Fix memleak in sst_media_open
Eric Sandeen <sandeen(a)redhat.com>
ext4: fix potential negative array index in do_split()
Luc Van Oostenryck <luc.vanoostenryck(a)gmail.com>
alpha: fix annotation of io{read,write}{16,32}be()
Eiichi Tsukata <devel(a)etsukata.com>
xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init
Mao Wenan <wenan.mao(a)linux.alibaba.com>
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
Javed Hasan <jhasan(a)marvell.com>
scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases
Zhe Li <lizhe67(a)huawei.com>
jffs2: fix UAF problem
Darrick J. Wong <darrick.wong(a)oracle.com>
xfs: fix inode quota reservation checks
Greg Ungerer <gerg(a)linux-m68k.org>
m68knommu: fix overwriting of bits in ColdFire V3 cache control
Xiongfeng Wang <wangxiongfeng2(a)huawei.com>
Input: psmouse - add a newline when printing 'proto' by sysfs
Evgeny Novikov <novikov(a)ispras.ru>
media: vpss: clean up resources in init
Chuhong Yuan <hslester96(a)gmail.com>
media: budget-core: Improve exception handling in budget_register()
Jan Kara <jack(a)suse.cz>
ext4: fix checking of directory entry validity for inline directories
Eric Biggers <ebiggers(a)google.com>
ext4: clean up ext4_match() and callers
Charan Teja Reddy <charante(a)codeaurora.org>
mm, page_alloc: fix core hung in free_pcppages_bulk()
Doug Berger <opendmb(a)gmail.com>
mm: include CMA pages in lowmem_reserve at boot
Jann Horn <jannh(a)google.com>
romfs: fix uninitialized memory leak in romfs_dev_read()
Josef Bacik <josef(a)toxicpanda.com>
btrfs: don't show full path of bind mounts in subvol=
Marcos Paulo de Souza <mpdesouza(a)suse.com>
btrfs: export helpers for subvolume name/id resolution
Hugh Dickins <hughd(a)google.com>
khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter()
Hugh Dickins <hughd(a)google.com>
khugepaged: khugepaged_test_exit() check mmget_still_valid()
Andrea Arcangeli <aarcange(a)redhat.com>
coredump: fix race condition between collapse_huge_page() and core dumping
Ahmad Fatoum <a.fatoum(a)pengutronix.de>
watchdog: f71808e_wdt: remove use of wrong watchdog_info option
Ahmad Fatoum <a.fatoum(a)pengutronix.de>
watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options
Kees Cook <keescook(a)chromium.org>
net/compat: Add missing sock updates for SCM_RIGHTS
Masami Hiramatsu <mhiramat(a)kernel.org>
perf probe: Fix memory leakage when the probe point is not found
Liu Ying <victor.liu(a)nxp.com>
drm/imx: imx-ldb: Disable both channels for split mode in enc->disable()
-------------
Diffstat:
Makefile | 4 +-
arch/alpha/include/asm/io.h | 8 +--
arch/m68k/include/asm/m53xxacr.h | 6 +-
arch/powerpc/mm/fault.c | 7 +-
drivers/gpu/drm/imx/imx-ldb.c | 7 +-
drivers/input/mouse/psmouse-base.c | 2 +-
drivers/media/pci/ttpci/budget-core.c | 11 +++-
drivers/media/platform/davinci/vpss.c | 20 ++++--
drivers/scsi/libfc/fc_disc.c | 12 +++-
drivers/video/fbdev/omap2/dss/dss.c | 2 +-
drivers/virtio/virtio_ring.c | 3 +
drivers/watchdog/f71808e_wdt.c | 6 +-
drivers/xen/preempt.c | 2 +-
fs/btrfs/ctree.h | 2 +
fs/btrfs/export.c | 8 +--
fs/btrfs/export.h | 5 ++
fs/btrfs/super.c | 18 +++--
fs/eventpoll.c | 19 +++---
fs/ext4/namei.c | 99 +++++++++++-----------------
fs/jffs2/dir.c | 6 +-
fs/romfs/storage.c | 4 +-
fs/xfs/xfs_sysfs.h | 6 +-
fs/xfs/xfs_trans_dquot.c | 2 +-
include/linux/mm.h | 4 ++
include/net/sock.h | 4 ++
mm/huge_memory.c | 4 +-
mm/hugetlb.c | 25 ++++---
mm/page_alloc.c | 7 +-
net/compat.c | 1 +
net/core/sock.c | 21 ++++++
sound/soc/intel/atom/sst-mfld-platform-pcm.c | 5 +-
tools/perf/util/probe-finder.c | 2 +-
32 files changed, 197 insertions(+), 135 deletions(-)
When offlining CPUs, fixup_irqs() migrates all interrupts away from the
outgoing CPU to an online CPU. It's always possible the device sent an
interrupt to the previous CPU destination. Pending interrupt bit in IRR in
LAPIC identifies such interrupts. apic_soft_disable() will not capture any
new interrupts in IRR. This causes interrupts from device to be lost during
CPU offline. The issue was found when explicitly setting MSI affinity to a
CPU and immediately offlining it. It was simple to recreate with a USB
ethernet device and doing I/O to it while the CPU is offlined. Lost
interrupts happen even when Interrupt Remapping is enabled.
Current code does apic_soft_disable() before migrating interrupts.
native_cpu_disable()
{
...
apic_soft_disable();
cpu_disable_common();
--> fixup_irqs(); // Too late to capture anything in IRR.
}
Just flipping the above call sequence seems to hit the IRR checks
and the lost interrupt is fixed for both legacy MSI and when
interrupt remapping is enabled.
Fixes: 60dcaad5736f ("x86/hotplug: Silence APIC and NMI when CPU is dead")
Link: https://lore.kernel.org/lkml/875zdarr4h.fsf@nanos.tec.linutronix.de/
Reported-by: Evan Green <evgreen(a)chromium.org>
Tested-by: Mathias Nyman <mathias.nyman(a)linux.intel.com>
Tested-by: Evan Green <evgreen(a)chromium.org>
Reviewed-by: Evan Green <evgreen(a)chromium.org>
Signed-off-by: Ashok Raj <ashok.raj(a)intel.com>
---
v2:
- Typos and fixes suggested by Randy Dunlap
To: linux-kernel(a)vger.kernel.org
To: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Sukumar Ghorai <sukumar.ghorai(a)intel.com>
Cc: Srikanth Nandamuri <srikanth.nandamuri(a)intel.com>
Cc: Evan Green <evgreen(a)chromium.org>
Cc: Mathias Nyman <mathias.nyman(a)linux.intel.com>
Cc: Bjorn Helgaas <bhelgaas(a)google.com>
Cc: stable(a)vger.kernel.org
---
arch/x86/kernel/smpboot.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 27aa04a95702..3016c3b627ce 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1594,13 +1594,20 @@ int native_cpu_disable(void)
if (ret)
return ret;
+ cpu_disable_common();
/*
* Disable the local APIC. Otherwise IPI broadcasts will reach
* it. It still responds normally to INIT, NMI, SMI, and SIPI
- * messages.
+ * messages. It's important to do apic_soft_disable() after
+ * fixup_irqs(), because fixup_irqs() called from cpu_disable_common()
+ * depends on IRR being set. After apic_soft_disable() CPU preserves
+ * currently set IRR/ISR but new interrupts will not set IRR.
+ * This causes interrupts sent to outgoing CPU before completion
+ * of IRQ migration to be lost. Check SDM Vol 3 "10.4.7.2 Local
+ * APIC State after It Has been Software Disabled" section for more
+ * details.
*/
apic_soft_disable();
- cpu_disable_common();
return 0;
}
--
2.7.4
The patch titled
Subject: mm/rmap: fixup copying of soft dirty and uffd ptes
has been added to the -mm tree. Its filename is
mm-rmap-fixup-copying-of-soft-dirty-and-uffd-ptes.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-rmap-fixup-copying-of-soft-dir…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-rmap-fixup-copying-of-soft-dir…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Alistair Popple <alistair(a)popple.id.au>
Subject: mm/rmap: fixup copying of soft dirty and uffd ptes
During memory migration a pte is temporarily replaced with a migration
swap pte. Some pte bits from the existing mapping such as the soft-dirty
and uffd write-protect bits are preserved by copying these to the
temporary migration swap pte.
However these bits are not stored at the same location for swap and
non-swap ptes. Therefore testing these bits requires using the
appropriate helper function for the given pte type.
Unfortunately several code locations were found where the wrong helper
function is being used to test soft_dirty and uffd_wp bits which leads to
them getting incorrectly set or cleared during page-migration.
Fix these by using the correct tests based on pte type.
Link: https://lkml.kernel.org/r/20200825064232.10023-2-alistair@popple.id.au
Fixes: a5430dda8a3a ("mm/migrate: support un-addressable ZONE_DEVICE page in migration")
Fixes: 8c3328f1f36a ("mm/migrate: migrate_vma() unmap page from vma while collecting pages")
Fixes: f45ec5ff16a7 ("userfaultfd: wp: support swap and page migration")
Signed-off-by: Alistair Popple <alistair(a)popple.id.au>
Reviewed-by: Peter Xu <peterx(a)redhat.com>
Cc: Jérôme Glisse <jglisse(a)redhat.com>
Cc: John Hubbard <jhubbard(a)nvidia.com>
Cc: Ralph Campbell <rcampbell(a)nvidia.com>
Cc: Alistair Popple <alistair(a)popple.id.au>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/migrate.c | 15 +++++++++++----
mm/rmap.c | 9 +++++++--
2 files changed, 18 insertions(+), 6 deletions(-)
--- a/mm/migrate.c~mm-rmap-fixup-copying-of-soft-dirty-and-uffd-ptes
+++ a/mm/migrate.c
@@ -2427,10 +2427,17 @@ again:
entry = make_migration_entry(page, mpfn &
MIGRATE_PFN_WRITE);
swp_pte = swp_entry_to_pte(entry);
- if (pte_soft_dirty(pte))
- swp_pte = pte_swp_mksoft_dirty(swp_pte);
- if (pte_uffd_wp(pte))
- swp_pte = pte_swp_mkuffd_wp(swp_pte);
+ if (pte_present(pte)) {
+ if (pte_soft_dirty(pte))
+ swp_pte = pte_swp_mksoft_dirty(swp_pte);
+ if (pte_uffd_wp(pte))
+ swp_pte = pte_swp_mkuffd_wp(swp_pte);
+ } else {
+ if (pte_swp_soft_dirty(pte))
+ swp_pte = pte_swp_mksoft_dirty(swp_pte);
+ if (pte_swp_uffd_wp(pte))
+ swp_pte = pte_swp_mkuffd_wp(swp_pte);
+ }
set_pte_at(mm, addr, ptep, swp_pte);
/*
--- a/mm/rmap.c~mm-rmap-fixup-copying-of-soft-dirty-and-uffd-ptes
+++ a/mm/rmap.c
@@ -1511,9 +1511,14 @@ static bool try_to_unmap_one(struct page
*/
entry = make_migration_entry(page, 0);
swp_pte = swp_entry_to_pte(entry);
- if (pte_soft_dirty(pteval))
+
+ /*
+ * pteval maps a zone device page and is therefore
+ * a swap pte.
+ */
+ if (pte_swp_soft_dirty(pteval))
swp_pte = pte_swp_mksoft_dirty(swp_pte);
- if (pte_uffd_wp(pteval))
+ if (pte_swp_uffd_wp(pteval))
swp_pte = pte_swp_mkuffd_wp(swp_pte);
set_pte_at(mm, pvmw.address, pvmw.pte, swp_pte);
/*
_
Patches currently in -mm which might be from alistair(a)popple.id.au are
mm-migrate-fixup-setting-uffd_wp-flag.patch
mm-rmap-fixup-copying-of-soft-dirty-and-uffd-ptes.patch
The patch titled
Subject: lib/string.c: implement stpcpy
has been added to the -mm tree. Its filename is
lib-stringc-implement-stpcpy.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/lib-stringc-implement-stpcpy.patch
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/lib-stringc-implement-stpcpy.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Nick Desaulniers <ndesaulniers(a)google.com>
Subject: lib/string.c: implement stpcpy
LLVM implemented a recent "libcall optimization" that lowers calls to
`sprintf(dest, "%s", str)` where the return value is used to `stpcpy(dest,
str) - dest`. This generally avoids the machinery involved in parsing
format strings. `stpcpy` is just like `strcpy` except it returns the
pointer to the new tail of `dest`. This optimization was introduced into
clang-12.
Implement this so that we don't observe linkage failures due to missing
symbol definitions for `stpcpy`.
Similar to last year's fire drill with: commit 5f074f3e192f
("lib/string.c: implement a basic bcmp")
The kernel is somewhere between a "freestanding" environment (no full
libc) and "hosted" environment (many symbols from libc exist with the same
type, function signature, and semantics).
As H. Peter Anvin notes, there's not really a great way to inform the
compiler that you're targeting a freestanding environment but would like
to opt-in to some libcall optimizations (see pr/47280 below), rather than
opt-out.
Arvind notes, -fno-builtin-* behaves slightly differently between GCC and
Clang, and Clang is missing many __builtin_* definitions, which I consider
a bug in Clang and am working on fixing.
Masahiro summarizes the subtle distinction between compilers justly:
To prevent transformation from foo() into bar(), there are two ways in
Clang to do that; -fno-builtin-foo, and -fno-builtin-bar. There is
only one in GCC; -fno-buitin-foo.
(Any difference in that behavior in Clang is likely a bug from a missing
__builtin_* definition.)
Masahiro also notes:
We want to disable optimization from foo() to bar(),
but we may still benefit from the optimization from
foo() into something else. If GCC implements the same transform, we
would run into a problem because it is not -fno-builtin-bar, but
-fno-builtin-foo that disables that optimization.
In this regard, -fno-builtin-foo would be more future-proof than
-fno-built-bar, but -fno-builtin-foo is still potentially overkill. We
may want to prevent calls from foo() being optimized into calls to
bar(), but we still may want other optimization on calls to foo().
It seems that compilers today don't quite provide the fine grain control
over which libcall optimizations pseudo-freestanding environments would
prefer.
Finally, Kees notes that this interface is unsafe, so we should not
encourage its use. As such, I've removed the declaration from any header,
but it still needs to be exported to avoid linkage errors in modules.
Link: https://lkml.kernel.org/r/20200825140001.2941001-1-ndesaulniers@google.com
Link: https://bugs.llvm.org/show_bug.cgi?id=47162
Link: https://bugs.llvm.org/show_bug.cgi?id=47280
Link: https://github.com/ClangBuiltLinux/linux/issues/1126
Link: https://man7.org/linux/man-pages/man3/stpcpy.3.html
Link: https://pubs.opengroup.org/onlinepubs/9699919799/functions/stpcpy.html
Link: https://reviews.llvm.org/D85963
Signed-off-by: Nick Desaulniers <ndesaulniers(a)google.com>
Reported-by: Sami Tolvanen <samitolvanen(a)google.com>
Tested-by: Nathan Chancellor <natechancellor(a)gmail.com>
Suggested-by: Andy Lavr <andy.lavr(a)gmail.com>
Suggested-by: Arvind Sankar <nivedita(a)alum.mit.edu>
Suggested-by: Joe Perches <joe(a)perches.com>
Suggested-by: Masahiro Yamada <masahiroy(a)kernel.org>
Suggested-by: Rasmus Villemoes <linux(a)rasmusvillemoes.dk>
Cc: <stable(a)vger.kernel.org>
Cc: Kees Cook <keescook(a)chromium.org>
Cc: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Cc: Alexandru Ardelean <alexandru.ardelean(a)analog.com>
Cc: Yury Norov <yury.norov(a)gmail.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
lib/string.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
--- a/lib/string.c~lib-stringc-implement-stpcpy
+++ a/lib/string.c
@@ -272,6 +272,30 @@ ssize_t strscpy_pad(char *dest, const ch
}
EXPORT_SYMBOL(strscpy_pad);
+/**
+ * stpcpy - copy a string from src to dest returning a pointer to the new end
+ * of dest, including src's %NUL-terminator. May overrun dest.
+ * @dest: pointer to end of string being copied into. Must be large enough
+ * to receive copy.
+ * @src: pointer to the beginning of string being copied from. Must not overlap
+ * dest.
+ *
+ * stpcpy differs from strcpy in a key way: the return value is the new
+ * %NUL-terminated character. (for strcpy, the return value is a pointer to
+ * src. This interface is considered unsafe as it doesn't perform bounds
+ * checking of the inputs. As such it's not recommended for usage. Instead,
+ * its definition is provided in case the compiler lowers other libcalls to
+ * stpcpy.
+ */
+char *stpcpy(char *__restrict__ dest, const char *__restrict__ src);
+char *stpcpy(char *__restrict__ dest, const char *__restrict__ src)
+{
+ while ((*dest++ = *src++) != '\0')
+ /* nothing */;
+ return --dest;
+}
+EXPORT_SYMBOL(stpcpy);
+
#ifndef __HAVE_ARCH_STRCAT
/**
* strcat - Append one %NUL-terminated string to another
_
Patches currently in -mm which might be from ndesaulniers(a)google.com are
maintainers-add-llvm-maintainers.patch
lib-stringc-implement-stpcpy.patch
The following commit has been merged into the irq/urgent branch of tip:
Commit-ID: e579076ac0a3bebb440fab101aef3c42c9f4c709
Gitweb: https://git.kernel.org/tip/e579076ac0a3bebb440fab101aef3c42c9f4c709
Author: qiuguorui1 <qiuguorui1(a)huawei.com>
AuthorDate: Thu, 20 Aug 2020 11:16:29 +08:00
Committer: Marc Zyngier <maz(a)kernel.org>
CommitterDate: Tue, 25 Aug 2020 10:57:05 +01:00
irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake
In the current code, when the eoi callback of the exti clears the pending
bit of the current interrupt, it will first read the values of fpr and
rpr, then logically OR the corresponding bit of the interrupt number,
and finally write back to fpr and rpr.
We found through experiments that if two exti interrupts,
we call them int1/int2, arrive almost at the same time. in our scenario,
the time difference is 30 microseconds, assuming int1 is triggered first.
there will be an extreme scenario: both int's pending bit are set to 1,
the irq handle of int1 is executed first, and eoi handle is then executed,
at this moment, all pending bits are cleared, but the int 2 has not
finally been reported to the cpu yet, which eventually lost int2.
According to stm32's TRM description about rpr and fpr: Writing a 1 to this
bit will trigger a rising edge event on event x, Writing 0 has no
effect.
Therefore, when clearing the pending bit, we only need to clear the
pending bit of the irq.
Fixes: 927abfc4461e7 ("irqchip/stm32: Add stm32mp1 support with hierarchy domain")
Signed-off-by: qiuguorui1 <qiuguorui1(a)huawei.com>
Signed-off-by: Marc Zyngier <maz(a)kernel.org>
Cc: stable(a)vger.kernel.org # v4.18+
Link: https://lore.kernel.org/r/20200820031629.15582-1-qiuguorui1@huawei.com
---
drivers/irqchip/irq-stm32-exti.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
index 03a36be..0c2c61d 100644
--- a/drivers/irqchip/irq-stm32-exti.c
+++ b/drivers/irqchip/irq-stm32-exti.c
@@ -416,6 +416,16 @@ static void stm32_irq_ack(struct irq_data *d)
irq_gc_unlock(gc);
}
+/* directly set the target bit without reading first. */
+static inline void stm32_exti_write_bit(struct irq_data *d, u32 reg)
+{
+ struct stm32_exti_chip_data *chip_data = irq_data_get_irq_chip_data(d);
+ void __iomem *base = chip_data->host_data->base;
+ u32 val = BIT(d->hwirq % IRQS_PER_BANK);
+
+ writel_relaxed(val, base + reg);
+}
+
static inline u32 stm32_exti_set_bit(struct irq_data *d, u32 reg)
{
struct stm32_exti_chip_data *chip_data = irq_data_get_irq_chip_data(d);
@@ -449,9 +459,9 @@ static void stm32_exti_h_eoi(struct irq_data *d)
raw_spin_lock(&chip_data->rlock);
- stm32_exti_set_bit(d, stm32_bank->rpr_ofst);
+ stm32_exti_write_bit(d, stm32_bank->rpr_ofst);
if (stm32_bank->fpr_ofst != UNDEF_REG)
- stm32_exti_set_bit(d, stm32_bank->fpr_ofst);
+ stm32_exti_write_bit(d, stm32_bank->fpr_ofst);
raw_spin_unlock(&chip_data->rlock);
This is the start of the stable review cycle for the 4.19.142 release.
There are 73 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 26 Aug 2020 16:47:07 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.142-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.142-rc2
Will Deacon <will(a)kernel.org>
KVM: arm64: Only reschedule if MMU_NOTIFIER_RANGE_BLOCKABLE is not set
Will Deacon <will(a)kernel.org>
KVM: Pass MMU notifier range flags to kvm_unmap_hva_range()
Stephen Boyd <sboyd(a)kernel.org>
clk: Evict unregistered clks from parent caches
Juergen Gross <jgross(a)suse.com>
xen: don't reschedule in preemption off sections
Peter Xu <peterx(a)redhat.com>
mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
Al Viro <viro(a)zeniv.linux.org.uk>
do_epoll_ctl(): clean the failure exits up a bit
Marc Zyngier <maz(a)kernel.org>
epoll: Keep a reference on files added to the check list
Li Heng <liheng40(a)huawei.com>
efi: add missed destroy_workqueue when efisubsys_init fails
Vasant Hegde <hegdevasant(a)linux.vnet.ibm.com>
powerpc/pseries: Do not initiate shutdown when system is running on UPS
Tom Rix <trix(a)redhat.com>
net: dsa: b53: check for timeout
Haiyang Zhang <haiyangz(a)microsoft.com>
hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit()
Wang Hai <wanghai38(a)huawei.com>
net: gemini: Fix missing free_netdev() in error path of gemini_ethernet_port_probe()
Shay Agroskin <shayagr(a)amazon.com>
net: ena: Prevent reset after device destruction
Jiri Wiesner <jwiesner(a)suse.com>
bonding: fix active-backup failover for current ARP slave
David Howells <dhowells(a)redhat.com>
afs: Fix NULL deref in afs_dynroot_depopulate()
Selvin Xavier <selvin.xavier(a)broadcom.com>
RDMA/bnxt_re: Do not add user qps to flushlist
Randy Dunlap <rdunlap(a)infradead.org>
Fix build error when CONFIG_ACPI is not set/enabled:
Juergen Gross <jgross(a)suse.com>
efi: avoid error message when booting under Xen
Masahiro Yamada <masahiroy(a)kernel.org>
kconfig: qconf: fix signal connection to invalid slots
Masahiro Yamada <masahiroy(a)kernel.org>
kconfig: qconf: do not limit the pop-up menu to the first row
Jim Mattson <jmattson(a)google.com>
kvm: x86: Toggling CR4.PKE does not load PDPTEs in PAE mode
Jim Mattson <jmattson(a)google.com>
kvm: x86: Toggling CR4.SMAP does not load PDPTEs in PAE mode
Alex Williamson <alex.williamson(a)redhat.com>
vfio/type1: Add proper error unwind for vfio_iommu_replay()
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
ASoC: intel: Fix memleak in sst_media_open
Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
ASoC: msm8916-wcd-analog: fix register Interrupt offset
Heiko Carstens <hca(a)linux.ibm.com>
s390/ptrace: fix storage key handling
Heiko Carstens <hca(a)linux.ibm.com>
s390/runtime_instrumentation: fix storage key handling
Cong Wang <xiyou.wangcong(a)gmail.com>
bonding: fix a potential double-unregister
Jarod Wilson <jarod(a)redhat.com>
bonding: show saner speed for broadcast mode
Fugang Duan <fugang.duan(a)nxp.com>
net: fec: correct the error path for regulator disable in probe
Grzegorz Szczurek <grzegorzx.szczurek(a)intel.com>
i40e: Fix crash during removing i40e driver
Przemyslaw Patynowski <przemyslawx.patynowski(a)intel.com>
i40e: Set RX_ONLY mode for unicast promiscuous on VLAN
Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
ASoC: q6routing: add dummy register read/write function
Jan Kara <jack(a)suse.cz>
ext4: don't allow overlapping system zones
Eric Sandeen <sandeen(a)redhat.com>
ext4: fix potential negative array index in do_split()
Helge Deller <deller(a)gmx.de>
fs/signalfd.c: fix inconsistent return codes for signalfd4
Luc Van Oostenryck <luc.vanoostenryck(a)gmail.com>
alpha: fix annotation of io{read,write}{16,32}be()
Eiichi Tsukata <devel(a)etsukata.com>
xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init
Gaurav Singh <gaurav1086(a)gmail.com>
tools/testing/selftests/cgroup/cgroup_util.c: cg_read_strcmp: fix null pointer dereference
Mao Wenan <wenan.mao(a)linux.alibaba.com>
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
Javed Hasan <jhasan(a)marvell.com>
scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases
Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com>
cpufreq: intel_pstate: Fix cpuinfo_max_freq when MSR_TURBO_RATIO_LIMIT is 0
Xiubo Li <xiubli(a)redhat.com>
ceph: fix use-after-free for fsc->mdsc
Zhe Li <lizhe67(a)huawei.com>
jffs2: fix UAF problem
Darrick J. Wong <darrick.wong(a)oracle.com>
xfs: fix inode quota reservation checks
Chuck Lever <chuck.lever(a)oracle.com>
svcrdma: Fix another Receive buffer leak
Greg Ungerer <gerg(a)linux-m68k.org>
m68knommu: fix overwriting of bits in ColdFire V3 cache control
Xiongfeng Wang <wangxiongfeng2(a)huawei.com>
Input: psmouse - add a newline when printing 'proto' by sysfs
Evgeny Novikov <novikov(a)ispras.ru>
media: vpss: clean up resources in init
Huacai Chen <chenhc(a)lemote.com>
rtc: goldfish: Enable interrupt in set_alarm() when necessary
Chuhong Yuan <hslester96(a)gmail.com>
media: budget-core: Improve exception handling in budget_register()
Bodo Stroesser <bstroesser(a)ts.fujitsu.com>
scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM
Stanley Chu <stanley.chu(a)mediatek.com>
scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices
Lukas Wunner <lukas(a)wunner.de>
spi: Prevent adding devices below an unregistering controller
Liang Chen <cl(a)rock-chips.com>
kthread: Do not preempt current task if it is going to call schedule()
Krunoslav Kovac <Krunoslav.Kovac(a)amd.com>
drm/amd/display: fix pow() crashing when given base 0
Yang Shi <shy828301(a)gmail.com>
mm/memory.c: skip spurious TLB flush for retried page fault
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: Fix use-after-free in request timeout handlers
zhangyi (F) <yi.zhang(a)huawei.com>
jbd2: add the missing unlock_buffer() in the error path of jbd2_write_superblock()
Jan Kara <jack(a)suse.cz>
ext4: fix checking of directory entry validity for inline directories
Charan Teja Reddy <charante(a)codeaurora.org>
mm, page_alloc: fix core hung in free_pcppages_bulk()
Doug Berger <opendmb(a)gmail.com>
mm: include CMA pages in lowmem_reserve at boot
Wei Yongjun <weiyongjun1(a)huawei.com>
kernel/relay.c: fix memleak on destroy relay channel
Jann Horn <jannh(a)google.com>
romfs: fix uninitialized memory leak in romfs_dev_read()
Josef Bacik <josef(a)toxicpanda.com>
btrfs: sysfs: use NOFS for device creation
Qu Wenruo <wqu(a)suse.com>
btrfs: inode: fix NULL pointer dereference if inode doesn't need compression
Nikolay Borisov <nborisov(a)suse.com>
btrfs: Move free_pages_out label in inline extent handling branch in compress_file_range
Josef Bacik <josef(a)toxicpanda.com>
btrfs: don't show full path of bind mounts in subvol=
Marcos Paulo de Souza <mpdesouza(a)suse.com>
btrfs: export helpers for subvolume name/id resolution
Hugh Dickins <hughd(a)google.com>
khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter()
Hugh Dickins <hughd(a)google.com>
khugepaged: khugepaged_test_exit() check mmget_still_valid()
Masami Hiramatsu <mhiramat(a)kernel.org>
perf probe: Fix memory leakage when the probe point is not found
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset()
-------------
Diffstat:
Makefile | 4 +-
arch/alpha/include/asm/io.h | 8 +--
arch/arm/include/asm/kvm_host.h | 2 +-
arch/arm64/include/asm/kvm_host.h | 2 +-
arch/m68k/include/asm/m53xxacr.h | 6 +-
arch/mips/include/asm/kvm_host.h | 2 +-
arch/mips/kvm/mmu.c | 3 +-
arch/powerpc/include/asm/kvm_host.h | 3 +-
arch/powerpc/kvm/book3s.c | 3 +-
arch/powerpc/kvm/e500_mmu_host.c | 3 +-
arch/powerpc/platforms/pseries/ras.c | 1 -
arch/s390/kernel/ptrace.c | 7 ++-
arch/s390/kernel/runtime_instr.c | 2 +-
arch/x86/include/asm/kvm_host.h | 3 +-
arch/x86/kvm/mmu.c | 3 +-
arch/x86/kvm/x86.c | 2 +-
arch/x86/pci/xen.c | 1 +
drivers/clk/clk.c | 52 +++++++++++++----
drivers/cpufreq/intel_pstate.c | 1 +
drivers/firmware/efi/efi.c | 2 +
drivers/gpu/drm/amd/display/include/fixed31_32.h | 3 +
drivers/gpu/drm/vgem/vgem_drv.c | 27 ---------
drivers/infiniband/hw/bnxt_re/main.c | 3 +-
drivers/input/mouse/psmouse-base.c | 2 +-
drivers/media/pci/ttpci/budget-core.c | 11 +++-
drivers/media/platform/davinci/vpss.c | 20 +++++--
drivers/net/bonding/bond_main.c | 42 ++++++++++++--
drivers/net/dsa/b53/b53_common.c | 2 +
drivers/net/ethernet/amazon/ena/ena_netdev.c | 19 +++---
drivers/net/ethernet/cortina/gemini.c | 4 +-
drivers/net/ethernet/freescale/fec_main.c | 4 +-
drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h | 2 +-
drivers/net/ethernet/intel/i40e/i40e_common.c | 35 ++++++++---
drivers/net/ethernet/intel/i40e/i40e_main.c | 3 +
drivers/net/hyperv/netvsc_drv.c | 2 +-
drivers/rtc/rtc-goldfish.c | 1 +
drivers/s390/scsi/zfcp_fsf.c | 4 +-
drivers/scsi/libfc/fc_disc.c | 12 +++-
drivers/scsi/ufs/ufs_quirks.h | 1 +
drivers/scsi/ufs/ufshcd.c | 2 +
drivers/spi/Kconfig | 3 +
drivers/spi/spi.c | 21 ++++++-
drivers/target/target_core_user.c | 2 +-
drivers/vfio/vfio_iommu_type1.c | 71 +++++++++++++++++++++--
drivers/video/fbdev/efifb.c | 2 +-
drivers/virtio/virtio_ring.c | 3 +
drivers/xen/preempt.c | 2 +-
fs/afs/dynroot.c | 20 ++++---
fs/btrfs/ctree.h | 2 +
fs/btrfs/export.c | 8 +--
fs/btrfs/export.h | 5 ++
fs/btrfs/inode.c | 23 +++++---
fs/btrfs/super.c | 18 ++++--
fs/btrfs/sysfs.c | 4 ++
fs/ceph/mds_client.c | 3 +-
fs/eventpoll.c | 19 +++---
fs/ext4/block_validity.c | 36 +++++-------
fs/ext4/namei.c | 22 +++++--
fs/jbd2/journal.c | 4 +-
fs/jffs2/dir.c | 6 +-
fs/romfs/storage.c | 4 +-
fs/signalfd.c | 10 ++--
fs/xfs/xfs_sysfs.h | 6 +-
fs/xfs/xfs_trans_dquot.c | 2 +-
kernel/kthread.c | 17 +++++-
kernel/relay.c | 1 +
mm/hugetlb.c | 24 ++++----
mm/khugepaged.c | 7 +--
mm/memory.c | 3 +
mm/page_alloc.c | 7 ++-
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 2 +
scripts/kconfig/qconf.cc | 70 +++++++++++-----------
sound/soc/codecs/msm8916-wcd-analog.c | 4 +-
sound/soc/intel/atom/sst-mfld-platform-pcm.c | 5 +-
sound/soc/qcom/qdsp6/q6routing.c | 16 +++++
tools/perf/util/probe-finder.c | 2 +-
tools/testing/selftests/cgroup/cgroup_util.c | 2 +-
virt/kvm/arm/mmu.c | 18 ++++--
virt/kvm/kvm_main.c | 2 +-
79 files changed, 525 insertions(+), 260 deletions(-)
This is the start of the stable review cycle for the 4.14.195 release.
There are 51 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 26 Aug 2020 16:47:07 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.195-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.195-rc2
Will Deacon <will(a)kernel.org>
KVM: arm/arm64: Don't reschedule in unmap_stage2_range()
Stephen Boyd <sboyd(a)kernel.org>
clk: Evict unregistered clks from parent caches
Juergen Gross <jgross(a)suse.com>
xen: don't reschedule in preemption off sections
Peter Xu <peterx(a)redhat.com>
mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
Al Viro <viro(a)zeniv.linux.org.uk>
do_epoll_ctl(): clean the failure exits up a bit
Marc Zyngier <maz(a)kernel.org>
epoll: Keep a reference on files added to the check list
Vasant Hegde <hegdevasant(a)linux.vnet.ibm.com>
powerpc/pseries: Do not initiate shutdown when system is running on UPS
Tom Rix <trix(a)redhat.com>
net: dsa: b53: check for timeout
Haiyang Zhang <haiyangz(a)microsoft.com>
hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit()
Jiri Wiesner <jwiesner(a)suse.com>
bonding: fix active-backup failover for current ARP slave
Alex Williamson <alex.williamson(a)redhat.com>
vfio/type1: Add proper error unwind for vfio_iommu_replay()
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
ASoC: intel: Fix memleak in sst_media_open
Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
ASoC: msm8916-wcd-analog: fix register Interrupt offset
Cong Wang <xiyou.wangcong(a)gmail.com>
bonding: fix a potential double-unregister
Jarod Wilson <jarod(a)redhat.com>
bonding: show saner speed for broadcast mode
Fugang Duan <fugang.duan(a)nxp.com>
net: fec: correct the error path for regulator disable in probe
Grzegorz Szczurek <grzegorzx.szczurek(a)intel.com>
i40e: Fix crash during removing i40e driver
Przemyslaw Patynowski <przemyslawx.patynowski(a)intel.com>
i40e: Set RX_ONLY mode for unicast promiscuous on VLAN
Eric Sandeen <sandeen(a)redhat.com>
ext4: fix potential negative array index in do_split()
Luc Van Oostenryck <luc.vanoostenryck(a)gmail.com>
alpha: fix annotation of io{read,write}{16,32}be()
Eiichi Tsukata <devel(a)etsukata.com>
xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init
Mao Wenan <wenan.mao(a)linux.alibaba.com>
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
Javed Hasan <jhasan(a)marvell.com>
scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases
Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com>
cpufreq: intel_pstate: Fix cpuinfo_max_freq when MSR_TURBO_RATIO_LIMIT is 0
Zhe Li <lizhe67(a)huawei.com>
jffs2: fix UAF problem
Darrick J. Wong <darrick.wong(a)oracle.com>
xfs: fix inode quota reservation checks
Greg Ungerer <gerg(a)linux-m68k.org>
m68knommu: fix overwriting of bits in ColdFire V3 cache control
Xiongfeng Wang <wangxiongfeng2(a)huawei.com>
Input: psmouse - add a newline when printing 'proto' by sysfs
Evgeny Novikov <novikov(a)ispras.ru>
media: vpss: clean up resources in init
Huacai Chen <chenhc(a)lemote.com>
rtc: goldfish: Enable interrupt in set_alarm() when necessary
Chuhong Yuan <hslester96(a)gmail.com>
media: budget-core: Improve exception handling in budget_register()
Stanley Chu <stanley.chu(a)mediatek.com>
scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices
Lukas Wunner <lukas(a)wunner.de>
spi: Prevent adding devices below an unregistering controller
Yang Shi <shy828301(a)gmail.com>
mm/memory.c: skip spurious TLB flush for retried page fault
zhangyi (F) <yi.zhang(a)huawei.com>
jbd2: add the missing unlock_buffer() in the error path of jbd2_write_superblock()
Jan Kara <jack(a)suse.cz>
ext4: fix checking of directory entry validity for inline directories
Charan Teja Reddy <charante(a)codeaurora.org>
mm, page_alloc: fix core hung in free_pcppages_bulk()
Doug Berger <opendmb(a)gmail.com>
mm: include CMA pages in lowmem_reserve at boot
Wei Yongjun <weiyongjun1(a)huawei.com>
kernel/relay.c: fix memleak on destroy relay channel
Jann Horn <jannh(a)google.com>
romfs: fix uninitialized memory leak in romfs_dev_read()
Josef Bacik <josef(a)toxicpanda.com>
btrfs: sysfs: use NOFS for device creation
Qu Wenruo <wqu(a)suse.com>
btrfs: inode: fix NULL pointer dereference if inode doesn't need compression
Nikolay Borisov <nborisov(a)suse.com>
btrfs: Move free_pages_out label in inline extent handling branch in compress_file_range
Josef Bacik <josef(a)toxicpanda.com>
btrfs: don't show full path of bind mounts in subvol=
Marcos Paulo de Souza <mpdesouza(a)suse.com>
btrfs: export helpers for subvolume name/id resolution
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc: Allow 4224 bytes of stack expansion for the signal frame
Christophe Leroy <christophe.leroy(a)c-s.fr>
powerpc/mm: Only read faulting instruction when necessary in do_page_fault()
Hugh Dickins <hughd(a)google.com>
khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter()
Hugh Dickins <hughd(a)google.com>
khugepaged: khugepaged_test_exit() check mmget_still_valid()
Masami Hiramatsu <mhiramat(a)kernel.org>
perf probe: Fix memory leakage when the probe point is not found
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset()
-------------
Diffstat:
Makefile | 4 +-
arch/alpha/include/asm/io.h | 8 +--
arch/m68k/include/asm/m53xxacr.h | 6 +-
arch/powerpc/mm/fault.c | 55 ++++++++++++------
arch/powerpc/platforms/pseries/ras.c | 1 -
drivers/clk/clk.c | 52 +++++++++++++----
drivers/cpufreq/intel_pstate.c | 1 +
drivers/gpu/drm/vgem/vgem_drv.c | 27 ---------
drivers/input/mouse/psmouse-base.c | 2 +-
drivers/media/pci/ttpci/budget-core.c | 11 +++-
drivers/media/platform/davinci/vpss.c | 20 +++++--
drivers/net/bonding/bond_main.c | 42 ++++++++++++--
drivers/net/dsa/b53/b53_common.c | 2 +
drivers/net/ethernet/freescale/fec_main.c | 4 +-
drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h | 2 +-
drivers/net/ethernet/intel/i40e/i40e_common.c | 35 ++++++++---
drivers/net/ethernet/intel/i40e/i40e_main.c | 3 +
drivers/net/hyperv/netvsc_drv.c | 2 +-
drivers/rtc/rtc-goldfish.c | 1 +
drivers/scsi/libfc/fc_disc.c | 12 +++-
drivers/scsi/ufs/ufs_quirks.h | 1 +
drivers/scsi/ufs/ufshcd.c | 2 +
drivers/spi/Kconfig | 3 +
drivers/spi/spi.c | 21 ++++++-
drivers/vfio/vfio_iommu_type1.c | 71 +++++++++++++++++++++--
drivers/virtio/virtio_ring.c | 3 +
drivers/xen/preempt.c | 2 +-
fs/btrfs/ctree.h | 2 +
fs/btrfs/export.c | 8 +--
fs/btrfs/export.h | 5 ++
fs/btrfs/inode.c | 23 +++++---
fs/btrfs/super.c | 18 ++++--
fs/btrfs/sysfs.c | 4 ++
fs/eventpoll.c | 19 +++---
fs/ext4/namei.c | 22 +++++--
fs/jbd2/journal.c | 4 +-
fs/jffs2/dir.c | 6 +-
fs/romfs/storage.c | 4 +-
fs/xfs/xfs_sysfs.h | 6 +-
fs/xfs/xfs_trans_dquot.c | 2 +-
kernel/relay.c | 1 +
mm/hugetlb.c | 24 ++++----
mm/khugepaged.c | 7 +--
mm/memory.c | 3 +
mm/page_alloc.c | 7 ++-
sound/soc/codecs/msm8916-wcd-analog.c | 4 +-
sound/soc/intel/atom/sst-mfld-platform-pcm.c | 5 +-
tools/perf/util/probe-finder.c | 2 +-
virt/kvm/arm/mmu.c | 6 --
49 files changed, 403 insertions(+), 172 deletions(-)
This is the start of the stable review cycle for the 4.9.234 release.
There are 39 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 26 Aug 2020 16:47:07 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.234-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.234-rc2
Will Deacon <will(a)kernel.org>
KVM: arm/arm64: Don't reschedule in unmap_stage2_range()
Juergen Gross <jgross(a)suse.com>
xen: don't reschedule in preemption off sections
Peter Xu <peterx(a)redhat.com>
mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
Al Viro <viro(a)zeniv.linux.org.uk>
do_epoll_ctl(): clean the failure exits up a bit
Marc Zyngier <maz(a)kernel.org>
epoll: Keep a reference on files added to the check list
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc: Allow 4224 bytes of stack expansion for the signal frame
Vasant Hegde <hegdevasant(a)linux.vnet.ibm.com>
powerpc/pseries: Do not initiate shutdown when system is running on UPS
Tom Rix <trix(a)redhat.com>
net: dsa: b53: check for timeout
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
ASoC: intel: Fix memleak in sst_media_open
Fugang Duan <fugang.duan(a)nxp.com>
net: fec: correct the error path for regulator disable in probe
Przemyslaw Patynowski <przemyslawx.patynowski(a)intel.com>
i40e: Set RX_ONLY mode for unicast promiscuous on VLAN
Eric Sandeen <sandeen(a)redhat.com>
ext4: fix potential negative array index in do_split()
Luc Van Oostenryck <luc.vanoostenryck(a)gmail.com>
alpha: fix annotation of io{read,write}{16,32}be()
Eiichi Tsukata <devel(a)etsukata.com>
xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init
Mao Wenan <wenan.mao(a)linux.alibaba.com>
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
Javed Hasan <jhasan(a)marvell.com>
scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases
Zhe Li <lizhe67(a)huawei.com>
jffs2: fix UAF problem
Darrick J. Wong <darrick.wong(a)oracle.com>
xfs: fix inode quota reservation checks
Greg Ungerer <gerg(a)linux-m68k.org>
m68knommu: fix overwriting of bits in ColdFire V3 cache control
Xiongfeng Wang <wangxiongfeng2(a)huawei.com>
Input: psmouse - add a newline when printing 'proto' by sysfs
Evgeny Novikov <novikov(a)ispras.ru>
media: vpss: clean up resources in init
Chuhong Yuan <hslester96(a)gmail.com>
media: budget-core: Improve exception handling in budget_register()
Stanley Chu <stanley.chu(a)mediatek.com>
scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices
Jan Kara <jack(a)suse.cz>
ext4: fix checking of directory entry validity for inline directories
Eric Biggers <ebiggers(a)google.com>
ext4: clean up ext4_match() and callers
Charan Teja Reddy <charante(a)codeaurora.org>
mm, page_alloc: fix core hung in free_pcppages_bulk()
Doug Berger <opendmb(a)gmail.com>
mm: include CMA pages in lowmem_reserve at boot
Wei Yongjun <weiyongjun1(a)huawei.com>
kernel/relay.c: fix memleak on destroy relay channel
Jann Horn <jannh(a)google.com>
romfs: fix uninitialized memory leak in romfs_dev_read()
Josef Bacik <josef(a)toxicpanda.com>
btrfs: don't show full path of bind mounts in subvol=
Marcos Paulo de Souza <mpdesouza(a)suse.com>
btrfs: export helpers for subvolume name/id resolution
Hugh Dickins <hughd(a)google.com>
khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter()
Hugh Dickins <hughd(a)google.com>
khugepaged: khugepaged_test_exit() check mmget_still_valid()
Kevin Hao <haokexin(a)gmail.com>
tracing/hwlat: Honor the tracing_cpumask
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Clean up the hwlat binding code
Masami Hiramatsu <mhiramat(a)kernel.org>
perf probe: Fix memory leakage when the probe point is not found
Liu Ying <victor.liu(a)nxp.com>
drm/imx: imx-ldb: Disable both channels for split mode in enc->disable()
Jan Beulich <JBeulich(a)suse.com>
x86/asm: Add instruction suffixes to bitops
Uros Bizjak <ubizjak(a)gmail.com>
x86/asm: Remove unnecessary \n\t in front of CC_SET() from asm templates
-------------
Diffstat:
Makefile | 4 +-
arch/alpha/include/asm/io.h | 8 +-
arch/arm/kvm/mmu.c | 6 --
arch/m68k/include/asm/m53xxacr.h | 6 +-
arch/powerpc/mm/fault.c | 7 +-
arch/powerpc/platforms/pseries/ras.c | 1 -
arch/x86/include/asm/archrandom.h | 8 +-
arch/x86/include/asm/bitops.h | 29 ++++---
arch/x86/include/asm/percpu.h | 2 +-
drivers/gpu/drm/imx/imx-ldb.c | 7 +-
drivers/input/mouse/psmouse-base.c | 2 +-
drivers/media/pci/ttpci/budget-core.c | 11 ++-
drivers/media/platform/davinci/vpss.c | 20 ++++-
drivers/net/dsa/b53/b53_common.c | 2 +
drivers/net/ethernet/freescale/fec_main.c | 4 +-
drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h | 2 +-
drivers/net/ethernet/intel/i40e/i40e_common.c | 35 ++++++--
drivers/scsi/libfc/fc_disc.c | 12 ++-
drivers/scsi/ufs/ufs_quirks.h | 1 +
drivers/scsi/ufs/ufshcd.c | 2 +
drivers/virtio/virtio_ring.c | 3 +
drivers/xen/preempt.c | 2 +-
fs/btrfs/ctree.h | 2 +
fs/btrfs/export.c | 8 +-
fs/btrfs/export.h | 5 ++
fs/btrfs/super.c | 18 +++--
fs/eventpoll.c | 19 +++--
fs/ext4/namei.c | 99 +++++++++--------------
fs/jffs2/dir.c | 6 +-
fs/romfs/storage.c | 4 +-
fs/xfs/xfs_sysfs.h | 6 +-
fs/xfs/xfs_trans_dquot.c | 2 +-
kernel/relay.c | 1 +
kernel/trace/trace_hwlat.c | 37 ++++-----
mm/hugetlb.c | 24 +++---
mm/khugepaged.c | 7 +-
mm/page_alloc.c | 7 +-
sound/soc/intel/atom/sst-mfld-platform-pcm.c | 5 +-
tools/perf/util/probe-finder.c | 2 +-
39 files changed, 238 insertions(+), 188 deletions(-)
This is the start of the stable review cycle for the 4.4.234 release.
There are 34 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 26 Aug 2020 16:47:07 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.234-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.234-rc2
Will Deacon <will(a)kernel.org>
KVM: arm/arm64: Don't reschedule in unmap_stage2_range()
Adam Ford <aford173(a)gmail.com>
omapfb: dss: Fix max fclk divider for omap36xx
Juergen Gross <jgross(a)suse.com>
xen: don't reschedule in preemption off sections
Peter Xu <peterx(a)redhat.com>
mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
Al Viro <viro(a)zeniv.linux.org.uk>
do_epoll_ctl(): clean the failure exits up a bit
Marc Zyngier <maz(a)kernel.org>
epoll: Keep a reference on files added to the check list
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc: Allow 4224 bytes of stack expansion for the signal frame
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
ASoC: intel: Fix memleak in sst_media_open
Eric Sandeen <sandeen(a)redhat.com>
ext4: fix potential negative array index in do_split()
Luc Van Oostenryck <luc.vanoostenryck(a)gmail.com>
alpha: fix annotation of io{read,write}{16,32}be()
Eiichi Tsukata <devel(a)etsukata.com>
xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init
Mao Wenan <wenan.mao(a)linux.alibaba.com>
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
Javed Hasan <jhasan(a)marvell.com>
scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases
Zhe Li <lizhe67(a)huawei.com>
jffs2: fix UAF problem
Darrick J. Wong <darrick.wong(a)oracle.com>
xfs: fix inode quota reservation checks
Greg Ungerer <gerg(a)linux-m68k.org>
m68knommu: fix overwriting of bits in ColdFire V3 cache control
Xiongfeng Wang <wangxiongfeng2(a)huawei.com>
Input: psmouse - add a newline when printing 'proto' by sysfs
Evgeny Novikov <novikov(a)ispras.ru>
media: vpss: clean up resources in init
Chuhong Yuan <hslester96(a)gmail.com>
media: budget-core: Improve exception handling in budget_register()
Jan Kara <jack(a)suse.cz>
ext4: fix checking of directory entry validity for inline directories
Eric Biggers <ebiggers(a)google.com>
ext4: clean up ext4_match() and callers
Charan Teja Reddy <charante(a)codeaurora.org>
mm, page_alloc: fix core hung in free_pcppages_bulk()
Doug Berger <opendmb(a)gmail.com>
mm: include CMA pages in lowmem_reserve at boot
Jann Horn <jannh(a)google.com>
romfs: fix uninitialized memory leak in romfs_dev_read()
Josef Bacik <josef(a)toxicpanda.com>
btrfs: don't show full path of bind mounts in subvol=
Marcos Paulo de Souza <mpdesouza(a)suse.com>
btrfs: export helpers for subvolume name/id resolution
Hugh Dickins <hughd(a)google.com>
khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter()
Hugh Dickins <hughd(a)google.com>
khugepaged: khugepaged_test_exit() check mmget_still_valid()
Andrea Arcangeli <aarcange(a)redhat.com>
coredump: fix race condition between collapse_huge_page() and core dumping
Ahmad Fatoum <a.fatoum(a)pengutronix.de>
watchdog: f71808e_wdt: remove use of wrong watchdog_info option
Ahmad Fatoum <a.fatoum(a)pengutronix.de>
watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options
Kees Cook <keescook(a)chromium.org>
net/compat: Add missing sock updates for SCM_RIGHTS
Masami Hiramatsu <mhiramat(a)kernel.org>
perf probe: Fix memory leakage when the probe point is not found
Liu Ying <victor.liu(a)nxp.com>
drm/imx: imx-ldb: Disable both channels for split mode in enc->disable()
-------------
Diffstat:
Makefile | 4 +-
arch/alpha/include/asm/io.h | 8 +--
arch/arm/kvm/mmu.c | 8 ---
arch/m68k/include/asm/m53xxacr.h | 6 +-
arch/powerpc/mm/fault.c | 7 +-
drivers/gpu/drm/imx/imx-ldb.c | 7 +-
drivers/input/mouse/psmouse-base.c | 2 +-
drivers/media/pci/ttpci/budget-core.c | 11 +++-
drivers/media/platform/davinci/vpss.c | 20 ++++--
drivers/scsi/libfc/fc_disc.c | 12 +++-
drivers/video/fbdev/omap2/dss/dss.c | 2 +-
drivers/virtio/virtio_ring.c | 3 +
drivers/watchdog/f71808e_wdt.c | 6 +-
drivers/xen/preempt.c | 2 +-
fs/btrfs/ctree.h | 2 +
fs/btrfs/export.c | 8 +--
fs/btrfs/export.h | 5 ++
fs/btrfs/super.c | 18 +++--
fs/eventpoll.c | 19 +++---
fs/ext4/namei.c | 99 +++++++++++-----------------
fs/jffs2/dir.c | 6 +-
fs/romfs/storage.c | 4 +-
fs/xfs/xfs_sysfs.h | 6 +-
fs/xfs/xfs_trans_dquot.c | 2 +-
include/linux/mm.h | 4 ++
include/net/sock.h | 4 ++
mm/huge_memory.c | 4 +-
mm/hugetlb.c | 25 ++++---
mm/page_alloc.c | 7 +-
net/compat.c | 1 +
net/core/sock.c | 21 ++++++
sound/soc/intel/atom/sst-mfld-platform-pcm.c | 5 +-
tools/perf/util/probe-finder.c | 2 +-
33 files changed, 197 insertions(+), 143 deletions(-)
Currently __set_oom_adj loops through all processes in the system to
keep oom_score_adj and oom_score_adj_min in sync between processes
sharing their mm. This is done for any task with more that one mm_users,
which includes processes with multiple threads (sharing mm and signals).
However for such processes the loop is unnecessary because their signal
structure is shared as well.
Android updates oom_score_adj whenever a tasks changes its role
(background/foreground/...) or binds to/unbinds from a service, making
it more/less important. Such operation can happen frequently.
We noticed that updates to oom_score_adj became more expensive and after
further investigation found out that the patch mentioned in "Fixes"
introduced a regression. Using Pixel 4 with a typical Android workload,
write time to oom_score_adj increased from ~3.57us to ~362us. Moreover
this regression linearly depends on the number of multi-threaded
processes running on the system.
Mark the mm with a new MMF_PROC_SHARED flag bit when task is created with
(CLONE_VM && !CLONE_THREAD && !CLONE_VFORK). Change __set_oom_adj to use
MMF_PROC_SHARED instead of mm_users to decide whether oom_score_adj
update should be synchronized between multiple processes. To prevent
races between clone() and __set_oom_adj(), when oom_score_adj of the
process being cloned might be modified from userspace, we use
oom_adj_mutex. Its scope is changed to global and it is renamed into
oom_adj_lock for naming consistency with oom_lock. The combination of
(CLONE_VM && !CLONE_THREAD) is rarely used except for the case of vfork().
To prevent performance regressions of vfork(), we skip taking oom_adj_lock
and setting MMF_PROC_SHARED when CLONE_VFORK is specified. Clearing the
MMF_PROC_SHARED flag (when the last process sharing the mm exits) is left
out of this patch to keep it simple and because it is believed that this
threading model is rare. Should there ever be a need for optimizing that
case as well, it can be done by hooking into the exit path, likely
following the mm_update_next_owner pattern.
With the combination of (CLONE_VM && !CLONE_THREAD && !CLONE_VFORK) being
quite rare, the regression is gone after the change is applied.
Fixes: 44a70adec910 ("mm, oom_adj: make sure processes sharing mm have same view of oom_score_adj")
Reported-by: Tim Murray <timmurray(a)google.com>
Debugged-by: Minchan Kim <minchan(a)kernel.org>
Suggested-by: Michal Hocko <mhocko(a)kernel.org>
Signed-off-by: Suren Baghdasaryan <surenb(a)google.com>
---
v2:
- Implemented proposal from Michal Hocko in:
https://lore.kernel.org/linux-fsdevel/20200820124109.GI5033@dhcp22.suse.cz/
- Updated description to reflect the change
v1:
- https://lore.kernel.org/linux-mm/20200820002053.1424000-1-surenb@google.com/
fs/proc/base.c | 7 +++----
include/linux/oom.h | 1 +
include/linux/sched/coredump.h | 1 +
kernel/fork.c | 21 +++++++++++++++++++++
mm/oom_kill.c | 2 ++
5 files changed, 28 insertions(+), 4 deletions(-)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 617db4e0faa0..cff1a58a236c 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1055,7 +1055,6 @@ static ssize_t oom_adj_read(struct file *file, char __user *buf, size_t count,
static int __set_oom_adj(struct file *file, int oom_adj, bool legacy)
{
- static DEFINE_MUTEX(oom_adj_mutex);
struct mm_struct *mm = NULL;
struct task_struct *task;
int err = 0;
@@ -1064,7 +1063,7 @@ static int __set_oom_adj(struct file *file, int oom_adj, bool legacy)
if (!task)
return -ESRCH;
- mutex_lock(&oom_adj_mutex);
+ mutex_lock(&oom_adj_lock);
if (legacy) {
if (oom_adj < task->signal->oom_score_adj &&
!capable(CAP_SYS_RESOURCE)) {
@@ -1095,7 +1094,7 @@ static int __set_oom_adj(struct file *file, int oom_adj, bool legacy)
struct task_struct *p = find_lock_task_mm(task);
if (p) {
- if (atomic_read(&p->mm->mm_users) > 1) {
+ if (test_bit(MMF_PROC_SHARED, &p->mm->flags)) {
mm = p->mm;
mmgrab(mm);
}
@@ -1132,7 +1131,7 @@ static int __set_oom_adj(struct file *file, int oom_adj, bool legacy)
mmdrop(mm);
}
err_unlock:
- mutex_unlock(&oom_adj_mutex);
+ mutex_unlock(&oom_adj_lock);
put_task_struct(task);
return err;
}
diff --git a/include/linux/oom.h b/include/linux/oom.h
index f022f581ac29..861f22bd4706 100644
--- a/include/linux/oom.h
+++ b/include/linux/oom.h
@@ -55,6 +55,7 @@ struct oom_control {
};
extern struct mutex oom_lock;
+extern struct mutex oom_adj_lock;
static inline void set_current_oom_origin(void)
{
diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h
index ecdc6542070f..070629b722df 100644
--- a/include/linux/sched/coredump.h
+++ b/include/linux/sched/coredump.h
@@ -72,6 +72,7 @@ static inline int get_dumpable(struct mm_struct *mm)
#define MMF_DISABLE_THP 24 /* disable THP for all VMAs */
#define MMF_OOM_VICTIM 25 /* mm is the oom victim */
#define MMF_OOM_REAP_QUEUED 26 /* mm was queued for oom_reaper */
+#define MMF_PROC_SHARED 27 /* mm is shared while sighand is not */
#define MMF_DISABLE_THP_MASK (1 << MMF_DISABLE_THP)
#define MMF_INIT_MASK (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK |\
diff --git a/kernel/fork.c b/kernel/fork.c
index 4d32190861bd..6fce8ffa9b8b 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1809,6 +1809,25 @@ static __always_inline void delayed_free_task(struct task_struct *tsk)
free_task(tsk);
}
+static void copy_oom_score_adj(u64 clone_flags, struct task_struct *tsk)
+{
+ /* Skip if kernel thread */
+ if (!tsk->mm)
+ return;
+
+ /* Skip if spawning a thread or using vfork */
+ if ((clone_flags & (CLONE_VM | CLONE_THREAD | CLONE_VFORK)) != CLONE_VM)
+ return;
+
+ /* We need to synchronize with __set_oom_adj */
+ mutex_lock(&oom_adj_lock);
+ set_bit(MMF_PROC_SHARED, &tsk->mm->flags);
+ /* Update the values in case they were changed after copy_signal */
+ tsk->signal->oom_score_adj = current->signal->oom_score_adj;
+ tsk->signal->oom_score_adj_min = current->signal->oom_score_adj_min;
+ mutex_unlock(&oom_adj_lock);
+}
+
/*
* This creates a new process as a copy of the old one,
* but does not actually start it yet.
@@ -2281,6 +2300,8 @@ static __latent_entropy struct task_struct *copy_process(
trace_task_newtask(p, clone_flags);
uprobe_copy_process(p, clone_flags);
+ copy_oom_score_adj(clone_flags, p);
+
return p;
bad_fork_cancel_cgroup:
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index e90f25d6385d..c22f07c986cb 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -64,6 +64,8 @@ int sysctl_oom_dump_tasks = 1;
* and mark_oom_victim
*/
DEFINE_MUTEX(oom_lock);
+/* Serializes oom_score_adj and oom_score_adj_min updates */
+DEFINE_MUTEX(oom_adj_lock);
static inline bool is_memcg_oom(struct oom_control *oc)
{
--
2.28.0.297.g1956fa8f8d-goog
Commit f45ec5ff16a75 ("userfaultfd: wp: support swap and page
migration") introduced support for tracking the uffd wp bit during page
migration. However the non-swap PTE variant was used to set the flag for
zone device private pages which are a type of swap page.
This leads to corruption of the swap offset if the original PTE has the
uffd_wp flag set.
Fixes: f45ec5ff16a75 ("userfaultfd: wp: support swap and page migration")
Signed-off-by: Alistair Popple <alistair(a)popple.id.au>
Reviewed-by: Peter Xu <peterx(a)redhat.com>
Cc: stable(a)vger.kernel.org
---
mm/migrate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/migrate.c b/mm/migrate.c
index 34a842a8eb6a..ddb64253fe3e 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -251,7 +251,7 @@ static bool remove_migration_pte(struct page *page, struct vm_area_struct *vma,
entry = make_device_private_entry(new, pte_write(pte));
pte = swp_entry_to_pte(entry);
if (pte_swp_uffd_wp(*pvmw.pte))
- pte = pte_mkuffd_wp(pte);
+ pte = pte_swp_mkuffd_wp(pte);
}
}
--
2.20.1
If block_write_full_page() is called for a page that is beyond current
inode size, it will truncate page buffers for the page and return 0.
This logic has been added in 2.5.62 in commit 81eb69062588 ("fix ext3
BUG due to race with truncate") in history.git tree to fix a problem
with ext3 in data=ordered mode. This particular problem doesn't exist
anymore because ext3 is long gone and ext4 handles ordered data
differently. Also normally buffers are invalidated by truncate code and
there's no need to specially handle this in ->writepage() code.
This invalidation of page buffers in block_write_full_page() is causing
issues to filesystems (e.g. ext4 or ocfs2) when block device is shrunk
under filesystem's hands and metadata buffers get discarded while being
tracked by the journalling layer. Although it is obviously "not
supported" it can cause kernel crashes like:
[ 7986.689400] BUG: unable to handle kernel NULL pointer dereference at
+0000000000000008
[ 7986.697197] PGD 0 P4D 0
[ 7986.699724] Oops: 0002 [#1] SMP PTI
[ 7986.703200] CPU: 4 PID: 203778 Comm: jbd2/dm-3-8 Kdump: loaded Tainted: G
+O --------- - - 4.18.0-147.5.0.5.h126.eulerosv2r9.x86_64 #1
[ 7986.716438] Hardware name: Huawei RH2288H V3/BC11HGSA0, BIOS 1.57 08/11/2015
[ 7986.723462] RIP: 0010:jbd2_journal_grab_journal_head+0x1b/0x40 [jbd2]
...
[ 7986.810150] Call Trace:
[ 7986.812595] __jbd2_journal_insert_checkpoint+0x23/0x70 [jbd2]
[ 7986.818408] jbd2_journal_commit_transaction+0x155f/0x1b60 [jbd2]
[ 7986.836467] kjournald2+0xbd/0x270 [jbd2]
which is not great. The crash happens because bh->b_private is suddently
NULL although BH_JBD flag is still set (this is because
block_invalidatepage() cleared BH_Mapped flag and subsequent bh lookup
found buffer without BH_Mapped set, called init_page_buffers() which has
rewritten bh->b_private). So just remove the invalidation in
block_write_full_page().
Note that the buffer cache invalidation when block device changes size
is already careful to avoid similar problems by using
invalidate_mapping_pages() which skips busy buffers so it was only this
odd block_write_full_page() behavior that could tear down bdev buffers
under filesystem's hands.
Reported-by: Ye Bin <yebin10(a)huawei.com>
CC: stable(a)vger.kernel.org
Signed-off-by: Jan Kara <jack(a)suse.cz>
---
fs/buffer.c | 16 ----------------
1 file changed, 16 deletions(-)
diff --git a/fs/buffer.c b/fs/buffer.c
index 061dd202979d..163c2c0b9aa3 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2771,16 +2771,6 @@ int nobh_writepage(struct page *page, get_block_t *get_block,
/* Is the page fully outside i_size? (truncate in progress) */
offset = i_size & (PAGE_SIZE-1);
if (page->index >= end_index+1 || !offset) {
- /*
- * The page may have dirty, unmapped buffers. For example,
- * they may have been added in ext3_writepage(). Make them
- * freeable here, so the page does not leak.
- */
-#if 0
- /* Not really sure about this - do we need this ? */
- if (page->mapping->a_ops->invalidatepage)
- page->mapping->a_ops->invalidatepage(page, offset);
-#endif
unlock_page(page);
return 0; /* don't care */
}
@@ -2975,12 +2965,6 @@ int block_write_full_page(struct page *page, get_block_t *get_block,
/* Is the page fully outside i_size? (truncate in progress) */
offset = i_size & (PAGE_SIZE-1);
if (page->index >= end_index+1 || !offset) {
- /*
- * The page may have dirty, unmapped buffers. For example,
- * they may have been added in ext3_writepage(). Make them
- * freeable here, so the page does not leak.
- */
- do_invalidatepage(page, 0, PAGE_SIZE);
unlock_page(page);
return 0; /* don't care */
}
--
2.16.4
Tegra210/Tegra186/Tegra194 has incorrectly enabled
SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK from the beginning of their support.
Tegra210 and later SDMMC hardware default uses sdmmc_legacy_tm (TMCLK)
all the time for hardware data timeout instead of SDCLK and this TMCLK
need to be kept enabled by Tegra sdmmc driver.
This series includes patches to fix this for Tegra210/Tegra186/Tegra194.
These patches need to be manually backported for 4.9, 4.14 and 4.19.
Will send patches to backport separately once these patches are ack'd.
Delta between patch versions:
[v4]: Include additional dt-binding patch
[v3]: Same as v2 with fixes tag
[v2]: Includes minor fix
- Patch-0006: parentheses around operand of '!'
Sowjanya Komatineni (7):
sdhci: tegra: Remove SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK for Tegra210
sdhci: tegra: Remove SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK for Tegra186
dt-bindings: mmc: tegra: Add tmclk for Tegra210 and later
arm64: tegra: Add missing timeout clock to Tegra210 SDMMC
arm64: tegra: Add missing timeout clock to Tegra186 SDMMC nodes
arm64: tegra: Add missing timeout clock to Tegra194 SDMMC nodes
sdhci: tegra: Add missing TMCLK for data timeout
.../bindings/mmc/nvidia,tegra20-sdhci.txt | 23 +++++++++++-
arch/arm64/boot/dts/nvidia/tegra186.dtsi | 20 ++++++----
arch/arm64/boot/dts/nvidia/tegra194.dtsi | 15 +++++---
arch/arm64/boot/dts/nvidia/tegra210.dtsi | 20 ++++++----
drivers/mmc/host/sdhci-tegra.c | 43 +++++++++++++++++++++-
5 files changed, 96 insertions(+), 25 deletions(-)
--
2.7.4
Commit f45ec5ff16a75 ("userfaultfd: wp: support swap and page
migration") introduced support for tracking the uffd wp bit during page
migration. However the non-swap PTE variant was used to set the flag for
zone device private pages which are a type of swap page.
This leads to corruption of the swap offset if the original PTE has the
uffd_wp flag set.
Fixes: f45ec5ff16a75 ("userfaultfd: wp: support swap and page migration")
Signed-off-by: Alistair Popple <alistair(a)popple.id.au>
Cc: stable(a)vger.kernel.org
---
mm/migrate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/migrate.c b/mm/migrate.c
index 34a842a8eb6a..ddb64253fe3e 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -251,7 +251,7 @@ static bool remove_migration_pte(struct page *page, struct vm_area_struct *vma,
entry = make_device_private_entry(new, pte_write(pte));
pte = swp_entry_to_pte(entry);
if (pte_swp_uffd_wp(*pvmw.pte))
- pte = pte_mkuffd_wp(pte);
+ pte = pte_swp_mkuffd_wp(pte);
}
}
--
2.20.1
From: Rajendra Nayak <rnayak(a)codeaurora.org>
commit a4501bac0e553bed117b7e1b166d49731caf7260 upstream.
dev_pm_opp_set_rate() can now be called with freq = 0 in order
to either drop performance or bandwidth votes or to disable
regulators on platforms which support them.
In such cases, a subsequent call to dev_pm_opp_set_rate() with
the same frequency ends up returning early because 'old_freq == freq'
Instead make it fall through and put back the dropped performance
and bandwidth votes and/or enable back the regulators.
Cc: v5.3+ <stable(a)vger.kernel.org> # v5.3+
Fixes: cd7ea582866f ("opp: Make dev_pm_opp_set_rate() handle freq = 0 to drop performance votes")
Reported-by: Sajida Bhanu <sbhanu(a)codeaurora.org>
Reviewed-by: Sibi Sankar <sibis(a)codeaurora.org>
Reported-by: Matthias Kaehlcke <mka(a)chromium.org>
Tested-by: Matthias Kaehlcke <mka(a)chromium.org>
Reviewed-by: Stephen Boyd <sboyd(a)kernel.org>
Signed-off-by: Rajendra Nayak <rnayak(a)codeaurora.org>
[ Viresh: Don't skip clk_set_rate() and massaged changelog ]
Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org>
[ Viresh: Updated the patch to apply to v5.4 ]
Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org>
---
drivers/opp/core.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index 9ff0538ee83a..518442be638d 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -843,10 +843,12 @@ int dev_pm_opp_set_rate(struct device *dev, unsigned long target_freq)
/* Return early if nothing to do */
if (old_freq == freq) {
- dev_dbg(dev, "%s: old/new frequencies (%lu Hz) are same, nothing to do\n",
- __func__, freq);
- ret = 0;
- goto put_opp_table;
+ if (!opp_table->required_opp_tables) {
+ dev_dbg(dev, "%s: old/new frequencies (%lu Hz) are same, nothing to do\n",
+ __func__, freq);
+ ret = 0;
+ goto put_opp_table;
+ }
}
temp_freq = old_freq;
--
2.25.0.rc1.19.g042ed3e048af
From: Stephen Boyd <swboyd(a)chromium.org>
commit 8979ef70850eb469e1094279259d1ef393ffe85f upstream.
We get the opp_table pointer at the top of the function and so we should
put the pointer at the end of the function like all other exit paths
from this function do.
Cc: v5.7+ <stable(a)vger.kernel.org> # v5.7+
Fixes: aca48b61f963 ("opp: Manage empty OPP tables with clk handle")
Reviewed-by: Rajendra Nayak <rnayak(a)codeaurora.org>
Signed-off-by: Stephen Boyd <swboyd(a)chromium.org>
[ Viresh: Split the patch into two ]
Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org>
[ Viresh: Update the code for v5.7-stable ]
Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org>
---
drivers/opp/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index bb7060d52eec..c94e725e6522 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -820,7 +820,7 @@ int dev_pm_opp_set_rate(struct device *dev, unsigned long target_freq)
if (opp_table->required_opp_tables) {
ret = _set_required_opps(dev, opp_table, NULL);
} else if (!_get_opp_count(opp_table)) {
- return 0;
+ ret = 0;
} else {
dev_err(dev, "target frequency can't be 0\n");
ret = -EINVAL;
--
2.25.0.rc1.19.g042ed3e048af
Changes in v3:
- included missing preliminary patch to define the SB barrier instruction, see
patch change log for details on how it was back ported into v4.9
Changes in v2:
- added missing hunk in hyp/entry.S per Will's feedback
Will Deacon (2):
arm64: Add support for SB barrier and patch in over DSB; ISB sequences
arm64: entry: Place an SB sequence following an ERET instruction
arch/arm64/include/asm/assembler.h | 13 +++++++++++++
arch/arm64/include/asm/barrier.h | 4 ++++
arch/arm64/include/asm/cpucaps.h | 3 ++-
arch/arm64/include/asm/sysreg.h | 13 +++++++++++++
arch/arm64/include/asm/uaccess.h | 3 +--
arch/arm64/include/uapi/asm/hwcap.h | 1 +
arch/arm64/kernel/cpufeature.c | 22 +++++++++++++++++++++-
arch/arm64/kernel/cpuinfo.c | 1 +
arch/arm64/kernel/entry.S | 2 ++
arch/arm64/kvm/hyp/entry.S | 2 ++
arch/arm64/kvm/hyp/hyp-entry.S | 4 ++++
11 files changed, 64 insertions(+), 4 deletions(-)
--
2.7.4
From: Tobias Schramm <t.schramm(a)manjaro.org>
[ Upstream commit ae1ba50f1e706dfd7ce402ac52c1f1f10becad68 ]
Previously the stm32h7 interrupt thread cleared all non-masked interrupts.
If an interrupt was to occur during the handling of another interrupt its
flag would be unset, resulting in a lost interrupt.
This patches fixes the issue by clearing only the currently set interrupt
flags.
Signed-off-by: Tobias Schramm <t.schramm(a)manjaro.org>
Link: https://lore.kernel.org/r/20200804195136.1485392-1-t.schramm@manjaro.org
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/spi/spi-stm32.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
index b222ce8d083ef..db4c1584327c1 100644
--- a/drivers/spi/spi-stm32.c
+++ b/drivers/spi/spi-stm32.c
@@ -961,7 +961,7 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)
if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0)))
stm32h7_spi_read_rxfifo(spi, false);
- writel_relaxed(mask, spi->base + STM32H7_SPI_IFCR);
+ writel_relaxed(sr & mask, spi->base + STM32H7_SPI_IFCR);
spin_unlock_irqrestore(&spi->lock, flags);
--
2.25.1
From: Tobias Schramm <t.schramm(a)manjaro.org>
[ Upstream commit ae1ba50f1e706dfd7ce402ac52c1f1f10becad68 ]
Previously the stm32h7 interrupt thread cleared all non-masked interrupts.
If an interrupt was to occur during the handling of another interrupt its
flag would be unset, resulting in a lost interrupt.
This patches fixes the issue by clearing only the currently set interrupt
flags.
Signed-off-by: Tobias Schramm <t.schramm(a)manjaro.org>
Link: https://lore.kernel.org/r/20200804195136.1485392-1-t.schramm@manjaro.org
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/spi/spi-stm32.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
index 44ac6eb3298d4..ef3be03574e80 100644
--- a/drivers/spi/spi-stm32.c
+++ b/drivers/spi/spi-stm32.c
@@ -964,7 +964,7 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)
if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0)))
stm32h7_spi_read_rxfifo(spi, false);
- writel_relaxed(mask, spi->base + STM32H7_SPI_IFCR);
+ writel_relaxed(sr & mask, spi->base + STM32H7_SPI_IFCR);
spin_unlock_irqrestore(&spi->lock, flags);
--
2.25.1
The patch titled
Subject: mm: slub: fix conversion of freelist_corrupted()
has been added to the -mm tree. Its filename is
mm-slub-fix-conversion-of-freelist_corrupted.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-slub-fix-conversion-of-freelis…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-slub-fix-conversion-of-freelis…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Eugeniu Rosca <erosca(a)de.adit-jv.com>
Subject: mm: slub: fix conversion of freelist_corrupted()
Commit 52f23478081ae0 ("mm/slub.c: fix corrupted freechain in
deactivate_slab()") suffered an update when picked up from LKML [1].
Specifically, relocating 'freelist = NULL' into 'freelist_corrupted()'
created a no-op statement. Fix it by sticking to the behavior intended in
the original patch [1]. In addition, make freelist_corrupted() immune to
passing NULL instead of &freelist.
The issue has been spotted via static analysis and code review.
[1] https://lore.kernel.org/linux-mm/20200331031450.12182-1-dongli.zhang@oracle…
Link: https://lkml.kernel.org/r/20200824130643.10291-1-erosca@de.adit-jv.com
Fixes: 52f23478081ae0 ("mm/slub.c: fix corrupted freechain in deactivate_slab()")
Signed-off-by: Eugeniu Rosca <erosca(a)de.adit-jv.com>
Cc: Dongli Zhang <dongli.zhang(a)oracle.com>
Cc: Joe Jin <joe.jin(a)oracle.com>
Cc: Christoph Lameter <cl(a)linux.com>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/slub.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/mm/slub.c~mm-slub-fix-conversion-of-freelist_corrupted
+++ a/mm/slub.c
@@ -672,12 +672,12 @@ static void slab_fix(struct kmem_cache *
}
static bool freelist_corrupted(struct kmem_cache *s, struct page *page,
- void *freelist, void *nextfree)
+ void **freelist, void *nextfree)
{
if ((s->flags & SLAB_CONSISTENCY_CHECKS) &&
- !check_valid_pointer(s, page, nextfree)) {
- object_err(s, page, freelist, "Freechain corrupt");
- freelist = NULL;
+ !check_valid_pointer(s, page, nextfree) && freelist) {
+ object_err(s, page, *freelist, "Freechain corrupt");
+ *freelist = NULL;
slab_fix(s, "Isolate corrupted freechain");
return true;
}
@@ -1494,7 +1494,7 @@ static inline void dec_slabs_node(struct
int objects) {}
static bool freelist_corrupted(struct kmem_cache *s, struct page *page,
- void *freelist, void *nextfree)
+ void **freelist, void *nextfree)
{
return false;
}
@@ -2184,7 +2184,7 @@ static void deactivate_slab(struct kmem_
* 'freelist' is already corrupted. So isolate all objects
* starting at 'freelist'.
*/
- if (freelist_corrupted(s, page, freelist, nextfree))
+ if (freelist_corrupted(s, page, &freelist, nextfree))
break;
do {
_
Patches currently in -mm which might be from erosca(a)de.adit-jv.com are
mm-slub-fix-conversion-of-freelist_corrupted.patch
The patch titled
Subject: mm: slub: fix conversion of freelist_corrupted()
has been removed from the -mm tree. Its filename was
mm-slub-fix-conversion-of-freelist_corrupted.patch
This patch was dropped because an updated version will be merged
------------------------------------------------------
From: Eugeniu Rosca <erosca(a)de.adit-jv.com>
Subject: mm: slub: fix conversion of freelist_corrupted()
Commit 52f23478081ae0 ("mm/slub.c: fix corrupted freechain in
deactivate_slab()") suffered an update when picked up from LKML [1].
Specifically, relocating 'freelist = NULL' into 'freelist_corrupted()'
created a no-op statement. Fix it by sticking to the behavior intended in
the original patch [1]. Prefer the lowest-line-count solution.
The issue popped up as a result of static analysis and code review.
Therefore, I lack any specific runtime behavior example being fixed.
[1] https://lore.kernel.org/linux-mm/20200331031450.12182-1-dongli.zhang@oracle…
Link: http://lkml.kernel.org/r/20200811124656.10308-1-erosca@de.adit-jv.com
Fixes: 52f23478081ae0 ("mm/slub.c: fix corrupted freechain in deactivate_slab()")
Signed-off-by: Eugeniu Rosca <erosca(a)de.adit-jv.com>
Cc: Dongli Zhang <dongli.zhang(a)oracle.com>
Cc: Joe Jin <joe.jin(a)oracle.com>
Cc: Christoph Lameter <cl(a)linux.com>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/slub.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/mm/slub.c~mm-slub-fix-conversion-of-freelist_corrupted
+++ a/mm/slub.c
@@ -677,7 +677,6 @@ static bool freelist_corrupted(struct km
if ((s->flags & SLAB_CONSISTENCY_CHECKS) &&
!check_valid_pointer(s, page, nextfree)) {
object_err(s, page, freelist, "Freechain corrupt");
- freelist = NULL;
slab_fix(s, "Isolate corrupted freechain");
return true;
}
@@ -2184,8 +2183,10 @@ static void deactivate_slab(struct kmem_
* 'freelist' is already corrupted. So isolate all objects
* starting at 'freelist'.
*/
- if (freelist_corrupted(s, page, freelist, nextfree))
+ if (freelist_corrupted(s, page, freelist, nextfree)) {
+ freelist = NULL;
break;
+ }
do {
prior = page->freelist;
_
Patches currently in -mm which might be from erosca(a)de.adit-jv.com are
When cat /proc/pid/stat, do_task_stat will call into cputime_adjust,
which call stack is like this:
[17179954.674326]BookE Watchdog detected hard LOCKUP on cpu 0
[17179954.674331]dCPU: 0 PID: 1262 Comm: TICK Tainted: P W O 4.4.176 #1
[17179954.674339]dtask: dc9d7040 task.stack: d3cb4000
[17179954.674344]NIP: c001b1a8 LR: c006a7ac CTR: 00000000
[17179954.674349]REGS: e6fe1f10 TRAP: 3202 Tainted: P W O (4.4.176)
[17179954.674355]MSR: 00021002 <CE,ME> CR: 28002224 XER: 00000000
[17179954.674364]
GPR00: 00000016 d3cb5cb0 dc9d7040 d3cb5cc0 00000000 0000025d ffe15b24 ffffffff
GPR08: de86aead 00000000 000003ff ffffffff 28002222 0084d1c0 00000000 ffffffff
GPR16: b5929ca0 b4bb7a48 c0863c08 0000048d 00000062 00000062 00000000 0000000f
GPR24: 00000000 d3cb5d08 d3cb5d60 d3cb5d64 00029002 d3e9c214 fffff30e d3e9c20c
[17179954.674410]NIP [c001b1a8] __div64_32+0x60/0xa0
[17179954.674422]LR [c006a7ac] cputime_adjust+0x124/0x138
[17179954.674434]Call Trace:
[17179961.832693]Call Trace:
[17179961.832695][d3cb5cb0] [c006a6dc] cputime_adjust+0x54/0x138 (unreliable)
[17179961.832705][d3cb5cf0] [c006a818] task_cputime_adjusted+0x58/0x80
[17179961.832713][d3cb5d20] [c01dab44] do_task_stat+0x298/0x870
[17179961.832720][d3cb5de0] [c01d4948] proc_single_show+0x60/0xa4
[17179961.832728][d3cb5e10] [c01963d8] seq_read+0x2d8/0x52c
[17179961.832736][d3cb5e80] [c01702fc] __vfs_read+0x40/0x114
[17179961.832744][d3cb5ef0] [c0170b1c] vfs_read+0x9c/0x10c
[17179961.832751][d3cb5f10] [c0171440] SyS_read+0x68/0xc4
[17179961.832759][d3cb5f40] [c0010a40] ret_from_syscall+0x0/0x3c
do_task_stat->task_cputime_adjusted->cputime_adjust->scale_stime->div_u64
->div_u64_rem->do_div->__div64_32
In some corner case, stime + utime = 0 if overflow. Even in v5.8.2 kernel
the cputime has changed from unsigned long to u64 data type. About 200
days, the lowwer 32 bit will be 0x00000000. Because divisor for __div64_32
is unsigned long data type,which is 32 bit for powepc 32, the bug still
exists.
So it is also a bug in the cputime_adjust which does not check if
stime + utime = 0
time = scale_stime((__force u64)stime, (__force u64)rtime,
(__force u64)(stime + utime));
The commit 3dc167ba5729 ("sched/cputime: Improve cputime_adjust()") in
mainline kernel may has fixed this case. But it is also better to check
if divisor is 0 in __div64_32 for other situation.
Signed-off-by: Guohua Zhong <zhongguohua1(a)huawei.com>
Fixes:14cf11af6cf6 "( powerpc: Merge enough to start building in arch/powerpc.)"
Fixes:94b212c29f68 "( powerpc: Move ppc64 boot wrapper code over to arch/powerpc)"
Cc: stable(a)vger.kernel.org # v2.6.15+
---
arch/powerpc/boot/div64.S | 4 ++++
arch/powerpc/lib/div64.S | 4 ++++
2 files changed, 8 insertions(+)
diff --git a/arch/powerpc/boot/div64.S b/arch/powerpc/boot/div64.S
index 4354928ed62e..39a25b9712d1 100644
--- a/arch/powerpc/boot/div64.S
+++ b/arch/powerpc/boot/div64.S
@@ -13,6 +13,9 @@
.globl __div64_32
__div64_32:
+ li r9,0
+ cmplw r4,r9 # check if divisor r4 is zero
+ beq 5f # jump to label 5 if r4(divisor) is zero
lwz r5,0(r3) # get the dividend into r5/r6
lwz r6,4(r3)
cmplw r5,r4
@@ -52,6 +55,7 @@ __div64_32:
4: stw r7,0(r3) # return the quotient in *r3
stw r8,4(r3)
mr r3,r6 # return the remainder in r3
+5: # return if divisor r4 is zero
blr
/*
diff --git a/arch/powerpc/lib/div64.S b/arch/powerpc/lib/div64.S
index 3d5426e7dcc4..1cc9bcabf678 100644
--- a/arch/powerpc/lib/div64.S
+++ b/arch/powerpc/lib/div64.S
@@ -13,6 +13,9 @@
#include <asm/processor.h>
_GLOBAL(__div64_32)
+ li r9,0
+ cmplw r4,r9 # check if divisor r4 is zero
+ beq 5f # jump to label 5 if r4(divisor) is zero
lwz r5,0(r3) # get the dividend into r5/r6
lwz r6,4(r3)
cmplw r5,r4
@@ -52,4 +55,5 @@ _GLOBAL(__div64_32)
4: stw r7,0(r3) # return the quotient in *r3
stw r8,4(r3)
mr r3,r6 # return the remainder in r3
+5: # return if divisor r4 is zero
blr
--
2.12.3
Adding stable(a)vger.kernel.org. Please see the original message regarding this
OOB memory access security fix. The patch is intended for the LTS branches
4.19.y, 4.14.y, 4.9.y and 4.4.y.
Thanks,
Will
From: Lukas Czerner <lczerner(a)redhat.com>
[ Upstream commit 24dc9864914eb5813173cfa53313fcd02e4aea7d ]
Callers of __jbd2_journal_unfile_buffer() and
__jbd2_journal_refile_buffer() assume that the b_transaction is set. In
fact if it's not, we can end up with journal_head refcounting errors
leading to crash much later that might be very hard to track down. Add
asserts to make sure that is the case.
We also make sure that b_next_transaction is NULL in
__jbd2_journal_unfile_buffer() since the callers expect that as well and
we should not get into that stage in this state anyway, leading to
problems later on if we do.
Tested with fstests.
Signed-off-by: Lukas Czerner <lczerner(a)redhat.com>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Link: https://lore.kernel.org/r/20200617092549.6712-1-lczerner@redhat.com
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
fs/jbd2/transaction.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 3233e5ac9774f..622610934c9ad 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1906,6 +1906,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh)
*/
static void __jbd2_journal_unfile_buffer(struct journal_head *jh)
{
+ J_ASSERT_JH(jh, jh->b_transaction != NULL);
+ J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
+
__jbd2_journal_temp_unlink_buffer(jh);
jh->b_transaction = NULL;
jbd2_journal_put_journal_head(jh);
@@ -2453,6 +2456,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
was_dirty = test_clear_buffer_jbddirty(bh);
__jbd2_journal_temp_unlink_buffer(jh);
+
+ /*
+ * b_transaction must be set, otherwise the new b_transaction won't
+ * be holding jh reference
+ */
+ J_ASSERT_JH(jh, jh->b_transaction != NULL);
+
/*
* We set b_transaction here because b_next_transaction will inherit
* our jh reference and thus __jbd2_journal_file_buffer() must not
--
2.25.1
From: Lukas Czerner <lczerner(a)redhat.com>
[ Upstream commit 24dc9864914eb5813173cfa53313fcd02e4aea7d ]
Callers of __jbd2_journal_unfile_buffer() and
__jbd2_journal_refile_buffer() assume that the b_transaction is set. In
fact if it's not, we can end up with journal_head refcounting errors
leading to crash much later that might be very hard to track down. Add
asserts to make sure that is the case.
We also make sure that b_next_transaction is NULL in
__jbd2_journal_unfile_buffer() since the callers expect that as well and
we should not get into that stage in this state anyway, leading to
problems later on if we do.
Tested with fstests.
Signed-off-by: Lukas Czerner <lczerner(a)redhat.com>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Link: https://lore.kernel.org/r/20200617092549.6712-1-lczerner@redhat.com
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
fs/jbd2/transaction.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 8de458d64134a..1478512ecab3e 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1896,6 +1896,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh)
*/
static void __jbd2_journal_unfile_buffer(struct journal_head *jh)
{
+ J_ASSERT_JH(jh, jh->b_transaction != NULL);
+ J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
+
__jbd2_journal_temp_unlink_buffer(jh);
jh->b_transaction = NULL;
jbd2_journal_put_journal_head(jh);
@@ -2443,6 +2446,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
was_dirty = test_clear_buffer_jbddirty(bh);
__jbd2_journal_temp_unlink_buffer(jh);
+
+ /*
+ * b_transaction must be set, otherwise the new b_transaction won't
+ * be holding jh reference
+ */
+ J_ASSERT_JH(jh, jh->b_transaction != NULL);
+
/*
* We set b_transaction here because b_next_transaction will inherit
* our jh reference and thus __jbd2_journal_file_buffer() must not
--
2.25.1
From: Lukas Czerner <lczerner(a)redhat.com>
[ Upstream commit 24dc9864914eb5813173cfa53313fcd02e4aea7d ]
Callers of __jbd2_journal_unfile_buffer() and
__jbd2_journal_refile_buffer() assume that the b_transaction is set. In
fact if it's not, we can end up with journal_head refcounting errors
leading to crash much later that might be very hard to track down. Add
asserts to make sure that is the case.
We also make sure that b_next_transaction is NULL in
__jbd2_journal_unfile_buffer() since the callers expect that as well and
we should not get into that stage in this state anyway, leading to
problems later on if we do.
Tested with fstests.
Signed-off-by: Lukas Czerner <lczerner(a)redhat.com>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Link: https://lore.kernel.org/r/20200617092549.6712-1-lczerner@redhat.com
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
fs/jbd2/transaction.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index a355ca418e788..b4bde0ae10948 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1914,6 +1914,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh)
*/
static void __jbd2_journal_unfile_buffer(struct journal_head *jh)
{
+ J_ASSERT_JH(jh, jh->b_transaction != NULL);
+ J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
+
__jbd2_journal_temp_unlink_buffer(jh);
jh->b_transaction = NULL;
jbd2_journal_put_journal_head(jh);
@@ -2461,6 +2464,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
was_dirty = test_clear_buffer_jbddirty(bh);
__jbd2_journal_temp_unlink_buffer(jh);
+
+ /*
+ * b_transaction must be set, otherwise the new b_transaction won't
+ * be holding jh reference
+ */
+ J_ASSERT_JH(jh, jh->b_transaction != NULL);
+
/*
* We set b_transaction here because b_next_transaction will inherit
* our jh reference and thus __jbd2_journal_file_buffer() must not
--
2.25.1
From: Lukas Czerner <lczerner(a)redhat.com>
[ Upstream commit 24dc9864914eb5813173cfa53313fcd02e4aea7d ]
Callers of __jbd2_journal_unfile_buffer() and
__jbd2_journal_refile_buffer() assume that the b_transaction is set. In
fact if it's not, we can end up with journal_head refcounting errors
leading to crash much later that might be very hard to track down. Add
asserts to make sure that is the case.
We also make sure that b_next_transaction is NULL in
__jbd2_journal_unfile_buffer() since the callers expect that as well and
we should not get into that stage in this state anyway, leading to
problems later on if we do.
Tested with fstests.
Signed-off-by: Lukas Czerner <lczerner(a)redhat.com>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Link: https://lore.kernel.org/r/20200617092549.6712-1-lczerner@redhat.com
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
fs/jbd2/transaction.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 43693b6797105..5a0de78a5d71a 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1915,6 +1915,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh)
*/
static void __jbd2_journal_unfile_buffer(struct journal_head *jh)
{
+ J_ASSERT_JH(jh, jh->b_transaction != NULL);
+ J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
+
__jbd2_journal_temp_unlink_buffer(jh);
jh->b_transaction = NULL;
jbd2_journal_put_journal_head(jh);
@@ -2462,6 +2465,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
was_dirty = test_clear_buffer_jbddirty(bh);
__jbd2_journal_temp_unlink_buffer(jh);
+
+ /*
+ * b_transaction must be set, otherwise the new b_transaction won't
+ * be holding jh reference
+ */
+ J_ASSERT_JH(jh, jh->b_transaction != NULL);
+
/*
* We set b_transaction here because b_next_transaction will inherit
* our jh reference and thus __jbd2_journal_file_buffer() must not
--
2.25.1
This reverts commit 1adb2ff1f6b170cdbc3925a359c8f39d2215dc20.
This breaks display wake up in stable kernels (5.7.x and 5.8.x).
Note that there is no upstream equivalent to this
revert. This patch was targeted for stable by Sasha's stable
patch process. Presumably there are some other changes necessary
for this patch to work properly on stable kernels.
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1266
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
Cc: stable(a)vger.kernel.org # 5.7.x, 5.8.x
Cc: Sasha Levin <sashal(a)kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_link.c | 4 +---
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 16 ++++++----------
.../amd/display/dc/dce110/dce110_hw_sequencer.c | 11 +----------
3 files changed, 8 insertions(+), 23 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 841cc051b7d0..48ab51533d5d 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -3298,11 +3298,9 @@ void core_link_disable_stream(struct pipe_ctx *pipe_ctx)
write_i2c_redriver_setting(pipe_ctx, false);
}
}
-
- disable_link(pipe_ctx->stream->link, pipe_ctx->stream->signal);
-
dc->hwss.disable_stream(pipe_ctx);
+ disable_link(pipe_ctx->stream->link, pipe_ctx->stream->signal);
if (pipe_ctx->stream->timing.flags.DSC) {
if (dc_is_dp_signal(pipe_ctx->stream->signal))
dp_set_dsc_enable(pipe_ctx, false);
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index 6124af571bff..91cd884d6f25 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -1102,10 +1102,6 @@ static inline enum link_training_result perform_link_training_int(
dpcd_pattern.v1_4.TRAINING_PATTERN_SET = DPCD_TRAINING_PATTERN_VIDEOIDLE;
dpcd_set_training_pattern(link, dpcd_pattern);
- /* delay 5ms after notifying sink of idle pattern before switching output */
- if (link->connector_signal != SIGNAL_TYPE_EDP)
- msleep(5);
-
/* 4. mainlink output idle pattern*/
dp_set_hw_test_pattern(link, DP_TEST_PATTERN_VIDEO_MODE, NULL, 0);
@@ -1555,12 +1551,6 @@ bool perform_link_training_with_retries(
struct dc_link *link = stream->link;
enum dp_panel_mode panel_mode = dp_get_panel_mode(link);
- /* We need to do this before the link training to ensure the idle pattern in SST
- * mode will be sent right after the link training
- */
- link->link_enc->funcs->connect_dig_be_to_fe(link->link_enc,
- pipe_ctx->stream_res.stream_enc->id, true);
-
for (j = 0; j < attempts; ++j) {
dp_enable_link_phy(
@@ -1577,6 +1567,12 @@ bool perform_link_training_with_retries(
dp_set_panel_mode(link, panel_mode);
+ /* We need to do this before the link training to ensure the idle pattern in SST
+ * mode will be sent right after the link training
+ */
+ link->link_enc->funcs->connect_dig_be_to_fe(link->link_enc,
+ pipe_ctx->stream_res.stream_enc->id, true);
+
if (link->aux_access_disabled) {
dc_link_dp_perform_link_training_skip_aux(link, link_setting);
return true;
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index 2af1d74d16ad..b77e9dc16086 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -1069,17 +1069,8 @@ void dce110_blank_stream(struct pipe_ctx *pipe_ctx)
link->dc->hwss.set_abm_immediate_disable(pipe_ctx);
}
- if (dc_is_dp_signal(pipe_ctx->stream->signal)) {
+ if (dc_is_dp_signal(pipe_ctx->stream->signal))
pipe_ctx->stream_res.stream_enc->funcs->dp_blank(pipe_ctx->stream_res.stream_enc);
-
- /*
- * After output is idle pattern some sinks need time to recognize the stream
- * has changed or they enter protection state and hang.
- */
- if (!dc_is_embedded_signal(pipe_ctx->stream->signal))
- msleep(60);
- }
-
}
--
2.25.4
Upstream commits fdfe7cbd5880 ("KVM: Pass MMU notifier range flags to
kvm_unmap_hva_range()") and b5331379bc62 ("KVM: arm64: Only reschedule
if MMU_NOTIFIER_RANGE_BLOCKABLE is not set") fix a "sleeping from invalid
context" BUG caused by unmap_stage2_range() attempting to reschedule when
called on the OOM path.
Unfortunately, these patches rely on the MMU notifier callback being
passed knowledge about whether or not blocking is permitted, which was
introduced in 4.19. Rather than backport this considerable amount of
infrastructure just for KVM on arm, instead just remove the conditional
reschedule.
Cc: <stable(a)vger.kernel.org> # v4.4 only
Cc: Marc Zyngier <maz(a)kernel.org>
Cc: Suzuki K Poulose <suzuki.poulose(a)arm.com>
Cc: James Morse <james.morse(a)arm.com>
Signed-off-by: Will Deacon <will(a)kernel.org>
---
arch/arm/kvm/mmu.c | 8 --------
1 file changed, 8 deletions(-)
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index e0267532bd4e..edd392fdc14b 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -300,14 +300,6 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
next = kvm_pgd_addr_end(addr, end);
if (!pgd_none(*pgd))
unmap_puds(kvm, pgd, addr, next);
- /*
- * If we are dealing with a large range in
- * stage2 table, release the kvm->mmu_lock
- * to prevent starvation and lockup detector
- * warnings.
- */
- if (kvm && (next != end))
- cond_resched_lock(&kvm->mmu_lock);
} while (pgd++, addr = next, addr != end);
}
--
2.28.0.297.g1956fa8f8d-goog