Hi Christoph,
A kernel bug report was opened against Ubuntu [0]. After a kernel
bisect, it was found that reverting the following commit resolved this bug:
909657615d9b ("scsi: libsas: allow async aborts")
The regression was introduced as of v4.12-rc1, and it still exists in
4.14 mainline.
I was hoping to get your feedback, since you are the patch author. Do
you think gathering any additional data will help diagnose this issue,
or would it be best to submit a revert request?
Thanks,
Joe
[0] http://pad.lv/1726519
On Tue, Dec 05, 2017 at 08:23:27AM +0100, Christian Hesse wrote:
> Greg KH <gregkh(a)linuxfoundation.org> on Mon, 2017/12/04 19:37:
> > On Mon, Dec 04, 2017 at 04:47:00PM +0100, Christian Hesse wrote:
> > > Amit Pundir <amit.pundir(a)linaro.org> on Mon, 2017/11/27 18:23:
> > > > Hi Greg,
> > > >
> > > > Found few e100e upstream fixes from Benjamin Poirier in lede
> > > > source tree, https://git.lede-project.org/?p=source.git, and
> > > > these fixes seem reasonable enough for 4.14.y too.
> > > >
> > > > Also submitting an e1000e buffer overrun fix by Sasha Neftin.
> > > >
> > > > Cherry-picked and build tested for linux v4.14.2 for ARCH=arm/arm64.
> > > >
> > > > Regards,
> > > > Amit Pundir
> > > >
> > > >
> > > > Benjamin Poirier (4):
> > > > e1000e: Fix error path in link detection
> > > > e1000e: Fix return value test
> > > > e1000e: Separate signaling for link check/link up
> > > > e1000e: Avoid receiver overrun interrupt bursts
> > > >
> > > > Sasha Neftin (1):
> > > > e1000e: fix buffer overrun while the I219 is processing DMA
> > > > transactions
> > >
> > > Hello everybody,
> > >
> > > looks like one of these breaks connectivity on my Thinkpad X250.
> > > Just downgraded to linux 4.14.2 to verify.
> >
> > Can you try the -rc release I just did? It has a fix for this series in
> > it.
>
> It connects with the notebook's built in ethernet port (did not check with
> 4.14.3) but still fails to see a link when placed in docking station.
Do you have the same issues with 4.15-rc2?
thanks,
greg k-h
Hi,
On Tue, Nov 28, 2017 at 11:47 PM, Maxime Ripard
<maxime.ripard(a)free-electrons.com> wrote:
> On Mon, Nov 27, 2017 at 08:05:34PM +0100, Stefan Brüns wrote:
>> Include the OF-based modalias in the uevent sent when registering devices
>> on the sunxi RSB bus, so that user space has a chance to autoload the
>> kernel module for the device.
>>
>> Fixes a regression caused by commit 3f241bfa60bd ("arm64: allwinner: a64:
>> pine64: Use dcdc1 regulator for mmc0"). When the axp20x-rsb module for
>> the AXP803 PMIC is built as a module, it is not loaded and the system
>> ends up with an disfunctional MMC controller.
>>
Tags should be:
Fixes: d787dcdb9c8f ("bus: sunxi-rsb: Add driver for Allwinner Reduced
Serial Bus")
Cc: stable <stable(a)vger.kernel.org> # 4.4.x 7a3b7cd332db of: device:
Export of_device_{get_modalias, uvent_modalias} to modules
>> Cc: stable <stable(a)vger.kernel.org>
>> Signed-off-by: Stefan Brüns <stefan.bruens(a)rwth-aachen.de>
>
> Acked-by: Maxime Ripard <maxime.ripard(a)free-electrons.com>
Acked-by: Chen-Yu Tsai <wens(a)csie.org>
Maxime, could you merge this as a fix to get it in fast?
ChenYu
This is the start of the stable review cycle for the 4.9.67 release.
There are 38 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Dec 6 15:59:56 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.67-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.67-rc1
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915: Prevent zero length "index" write
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915: Don't try indexed reads to alternate slave addresses
NeilBrown <neilb(a)suse.com>
NFS: revalidate "." etc correctly on "open".
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "x86/entry/64: Add missing irqflags tracing to native_load_gs_index()"
Rex Zhu <Rex.Zhu(a)amd.com>
drm/amd/pp: fix typecast error in powerplay.
Christian König <christian.koenig(a)amd.com>
drm/ttm: once more fix ttm_buffer_object_transfer
Peter Griffin <peter.griffin(a)linaro.org>
drm/hisilicon: Ensure LDI regs are properly configured.
Jonathan Liu <net147(a)gmail.com>
drm/panel: simple: Add missing panel_simple_unprepare() calls
Roman Kapl <rka(a)sysgo.com>
drm/radeon: fix atombios on big endian
Dan Carpenter <dan.carpenter(a)oracle.com>
drm/amdgpu: Potential uninitialized variable in amdgpu_vm_update_directories()
Dan Carpenter <dan.carpenter(a)oracle.com>
drm/amdgpu: potential uninitialized variable in amdgpu_vce_ring_parse_cs()
Alex Deucher <alexander.deucher(a)amd.com>
Revert "drm/radeon: dont switch vt on suspend"
Jeff Lien <jeff.lien(a)wdc.com>
nvme-pci: add quirk for delay before CHK RDY for WDC SN200
Peter Rosin <peda(a)axentia.se>
hwmon: (jc42) optionally try to disable the SMBUS timeout
Huacai Chen <chenhc(a)lemote.com>
bcache: Fix building error on MIPS
Hans de Goede <hdegoede(a)redhat.com>
i2c: i801: Fix Failed to allocate irq -2147483648 error
Heiner Kallweit <hkallweit1(a)gmail.com>
eeprom: at24: check at24_read/write arguments
Bartosz Golaszewski <brgl(a)bgdev.pl>
eeprom: at24: correctly set the size for at24mac402
Heiner Kallweit <hkallweit1(a)gmail.com>
eeprom: at24: fix reading from 24MAC402/24MAC602
Bastian Stender <bst(a)pengutronix.de>
mmc: core: prepend 0x to OCR entry in sysfs
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: core: Do not leave the block driver in a suspended state
Dr. David Alan Gilbert <dgilbert(a)redhat.com>
KVM: lapic: Fixup LDR on load in x2apic
Dr. David Alan Gilbert <dgilbert(a)redhat.com>
KVM: lapic: Split out x2apic ldr calculation
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86: inject exceptions produced by x86_decode_insn
Liran Alon <liran.alon(a)oracle.com>
KVM: x86: Exit to user-mode on #UD intercept when emulator requires
Liran Alon <liran.alon(a)oracle.com>
KVM: x86: pvclock: Handle first-time write to pvclock-page contains random junk
Adam Ford <aford173(a)gmail.com>
ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate
Adam Ford <aford173(a)gmail.com>
mfd: twl4030-power: Fix pmic for boards that need vmmc1 on reboot
Naofumi Honda <honda(a)math.sci.hokudai.ac.jp>
nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat
Trond Myklebust <trond.myklebust(a)primarydata.com>
nfsd: Fix another OPEN stateid race
Trond Myklebust <trond.myklebust(a)primarydata.com>
nfsd: Fix stateid races between OPEN and CLOSE
Josef Bacik <jbacik(a)fb.com>
btrfs: clear space cache inode generation always
chenjie <chenjie6(a)huawei.com>
mm/madvise.c: fix madvise() infinite loop under special circumstances
Dan Williams <dan.j.williams(a)intel.com>
mm, hugetlbfs: introduce ->split() to vm_operations_struct
Mike Kravetz <mike.kravetz(a)oracle.com>
mm/cma: fix alloc_contig_range ret code/potential leak
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()
Adam Ford <aford173(a)gmail.com>
ARM: dts: omap3: logicpd-torpedo-37xx-devkit: Fix MMC1 cd-gpio
Adam Ford <aford173(a)gmail.com>
ARM: dts: LogicPD Torpedo: Fix camera pin mux
-------------
Diffstat:
Documentation/devicetree/bindings/hwmon/jc42.txt | 4 +
Makefile | 4 +-
arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts | 8 +-
arch/arm/mach-omap2/pdata-quirks.c | 2 +-
arch/x86/entry/entry_64.S | 10 +--
arch/x86/kvm/lapic.c | 12 ++-
arch/x86/kvm/svm.c | 2 +
arch/x86/kvm/vmx.c | 2 +
arch/x86/kvm/x86.c | 5 ++
drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 38 ++++-----
drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +-
.../amd/powerplay/hwmgr/process_pptables_v1_0.c | 4 +-
drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c | 3 +
drivers/gpu/drm/i915/intel_i2c.c | 4 +-
drivers/gpu/drm/panel/panel-simple.c | 2 +
drivers/gpu/drm/radeon/atombios_dp.c | 38 ++++-----
drivers/gpu/drm/radeon/radeon_fb.c | 1 -
drivers/gpu/drm/ttm/ttm_bo_util.c | 1 +
drivers/hwmon/jc42.c | 21 +++++
drivers/i2c/busses/i2c-i801.c | 3 +
drivers/md/bcache/alloc.c | 2 +-
drivers/md/bcache/extents.c | 2 +-
drivers/md/bcache/journal.c | 2 +-
drivers/mfd/twl4030-power.c | 1 +
drivers/misc/eeprom/at24.c | 19 ++++-
drivers/mmc/core/bus.c | 3 +
drivers/mmc/core/mmc.c | 2 +-
drivers/mmc/core/sd.c | 2 +-
drivers/nvme/host/nvme.h | 2 +-
drivers/nvme/host/pci.c | 2 +
fs/btrfs/extent-tree.c | 14 +--
fs/nfs/dir.c | 3 +-
fs/nfsd/nfs4state.c | 99 ++++++++++++++++------
include/linux/mm.h | 1 +
include/uapi/linux/bcache.h | 2 +-
mm/huge_memory.c | 19 ++---
mm/hugetlb.c | 8 ++
mm/madvise.c | 4 +-
mm/mmap.c | 8 +-
mm/page_alloc.c | 9 +-
41 files changed, 250 insertions(+), 122 deletions(-)
This is the start of the stable review cycle for the 3.18.86 release.
There are 12 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Dec 6 15:59:06 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.86-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 3.18.86-rc1
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915: Prevent zero length "index" write
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915: Don't try indexed reads to alternate slave addresses
NeilBrown <neilb(a)suse.com>
NFS: revalidate "." etc correctly on "open".
Jonathan Liu <net147(a)gmail.com>
drm/panel: simple: Add missing panel_simple_unprepare() calls
Heiner Kallweit <hkallweit1(a)gmail.com>
eeprom: at24: check at24_read/write arguments
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86: inject exceptions produced by x86_decode_insn
Liran Alon <liran.alon(a)oracle.com>
KVM: x86: Exit to user-mode on #UD intercept when emulator requires
Josef Bacik <jbacik(a)fb.com>
btrfs: clear space cache inode generation always
chenjie <chenjie6(a)huawei.com>
mm/madvise.c: fix madvise() infinite loop under special circumstances
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()
Herbert Xu <herbert(a)gondor.apana.org.au>
ipsec: Fix aborted xfrm policy dump crash
Tom Herbert <tom(a)herbertland.com>
netlink: add a start callback for starting a netlink dump
-------------
Diffstat:
Makefile | 4 ++--
arch/x86/kvm/svm.c | 2 ++
arch/x86/kvm/vmx.c | 2 ++
arch/x86/kvm/x86.c | 2 ++
drivers/gpu/drm/i915/intel_i2c.c | 4 +++-
drivers/gpu/drm/panel/panel-simple.c | 2 ++
drivers/misc/eeprom/at24.c | 6 ++++++
fs/btrfs/extent-tree.c | 14 +++++++-------
fs/nfs/dir.c | 3 ++-
include/linux/netlink.h | 2 ++
include/net/genetlink.h | 2 ++
mm/huge_memory.c | 14 ++++----------
mm/madvise.c | 3 +--
net/netlink/af_netlink.c | 4 ++++
net/netlink/genetlink.c | 16 ++++++++++++++++
net/xfrm/xfrm_user.c | 25 +++++++++++++++----------
16 files changed, 72 insertions(+), 33 deletions(-)
We cannot proceed booting if the machine doesn't support the paging mode
kernel was compiled for.
Getting error the usual way -- via validate_cpu() -- is not going to
work. We need to enable appropriate paging mode before that, otherwise
kernel would triple-fault during KASLR setup.
This code will go away once we get support for boot-time switching
between paging modes.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Cc: <stable(a)vger.kernel.org> [4.14+]
---
arch/x86/boot/compressed/misc.c | 16 ++++++++++++++++
arch/x86/boot/compressed/pgtable_64.c | 2 +-
2 files changed, 17 insertions(+), 1 deletion(-)
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index b50c42455e25..f7f8d9f76e15 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -169,6 +169,16 @@ void __puthex(unsigned long value)
}
}
+static int l5_supported(void)
+{
+ /* Check if leaf 7 is supported. */
+ if (native_cpuid_eax(0) < 7)
+ return 0;
+
+ /* Check if la57 is supported. */
+ return native_cpuid_ecx(7) & (1 << (X86_FEATURE_LA57 & 31));
+}
+
#if CONFIG_X86_NEED_RELOCS
static void handle_relocations(void *output, unsigned long output_len,
unsigned long virt_addr)
@@ -362,6 +372,12 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap,
console_init();
debug_putstr("early console in extract_kernel\n");
+ if (IS_ENABLED(CONFIG_X86_5LEVEL) && !l5_supported()) {
+ error("This linux kernel as configured requires 5-level paging\n"
+ "This CPU does not support the required 'cr4.la57' feature\n"
+ "Unable to boot - please use a kernel appropriate for your CPU\n");
+ }
+
free_mem_ptr = heap; /* Heap */
free_mem_end_ptr = heap + BOOT_HEAP_SIZE;
diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c
index eed3a2c3b577..7bcf03b376da 100644
--- a/arch/x86/boot/compressed/pgtable_64.c
+++ b/arch/x86/boot/compressed/pgtable_64.c
@@ -2,7 +2,7 @@
int l5_paging_required(void)
{
- /* Check i leaf 7 is supported. */
+ /* Check if leaf 7 is supported. */
if (native_cpuid_eax(0) < 7)
return 0;
--
2.15.0
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d8a1a000555ecd1b824ac1ed6df8fe364dfbbbb0 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust(a)primarydata.com>
Date: Fri, 3 Nov 2017 08:00:11 -0400
Subject: [PATCH] nfsd: Fix another OPEN stateid race
If nfsd4_process_open2() is initialising a new stateid, and yet the
call to nfs4_get_vfs_file() fails for some reason, then we must
declare the stateid closed, and unhash it before dropping the mutex.
Right now, we unhash the stateid after dropping the mutex, and without
changing the stateid type, meaning that another OPEN could theoretically
look it up and attempt to use it.
Reported-by: Andrew W Elble <aweits(a)rit.edu>
Signed-off-by: Trond Myklebust <trond.myklebust(a)primarydata.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields(a)redhat.com>
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index ee8fde2dfa92..457f0e7ece74 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4502,6 +4502,7 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
struct nfs4_ol_stateid *stp = NULL;
struct nfs4_delegation *dp = NULL;
__be32 status;
+ bool new_stp = false;
/*
* Lookup file; if found, lookup stateid and check open request,
@@ -4521,11 +4522,19 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
goto out;
}
+ if (!stp) {
+ stp = init_open_stateid(fp, open);
+ if (!open->op_stp)
+ new_stp = true;
+ }
+
/*
* OPEN the file, or upgrade an existing OPEN.
* If truncate fails, the OPEN fails.
+ *
+ * stp is already locked.
*/
- if (stp) {
+ if (!new_stp) {
/* Stateid was found, this is an OPEN upgrade */
status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
if (status) {
@@ -4533,22 +4542,11 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
goto out;
}
} else {
- /* stp is returned locked. */
- stp = init_open_stateid(fp, open);
- /* See if we lost the race to some other thread */
- if (stp->st_access_bmap != 0) {
- status = nfs4_upgrade_open(rqstp, fp, current_fh,
- stp, open);
- if (status) {
- mutex_unlock(&stp->st_mutex);
- goto out;
- }
- goto upgrade_out;
- }
status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open);
if (status) {
- mutex_unlock(&stp->st_mutex);
+ stp->st_stid.sc_type = NFS4_CLOSED_STID;
release_open_stateid(stp);
+ mutex_unlock(&stp->st_mutex);
goto out;
}
@@ -4557,7 +4555,7 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
if (stp->st_clnt_odstate == open->op_odstate)
open->op_odstate = NULL;
}
-upgrade_out:
+
nfs4_inc_and_copy_stateid(&open->op_stateid, &stp->st_stid);
mutex_unlock(&stp->st_mutex);
On Mon, Dec 04, 2017 at 04:47:00PM +0100, Christian Hesse wrote:
> Amit Pundir <amit.pundir(a)linaro.org> on Mon, 2017/11/27 18:23:
> > Hi Greg,
> >
> > Found few e100e upstream fixes from Benjamin Poirier in lede
> > source tree, https://git.lede-project.org/?p=source.git, and
> > these fixes seem reasonable enough for 4.14.y too.
> >
> > Also submitting an e1000e buffer overrun fix by Sasha Neftin.
> >
> > Cherry-picked and build tested for linux v4.14.2 for ARCH=arm/arm64.
> >
> > Regards,
> > Amit Pundir
> >
> >
> > Benjamin Poirier (4):
> > e1000e: Fix error path in link detection
> > e1000e: Fix return value test
> > e1000e: Separate signaling for link check/link up
> > e1000e: Avoid receiver overrun interrupt bursts
> >
> > Sasha Neftin (1):
> > e1000e: fix buffer overrun while the I219 is processing DMA
> > transactions
>
> Hello everybody,
>
> looks like one of these breaks connectivity on my Thinkpad X250.
> Just downgraded to linux 4.14.2 to verify.
Can you try the -rc release I just did? It has a fix for this series in
it.
thanks,
greg k-h
Changes since v2 [1]:
* Add a comment for the vma_is_fsdax() check in get_vaddr_frames() (Jan)
* Collect Jan's Reviewed-by.
* Rebased on v4.15-rc1
[1]: https://lists.01.org/pipermail/linux-nvdimm/2017-November/013295.html
The summary text below is unchanged from v2.
---
Andrew,
Here is a new get_user_pages api for cases where a driver intends to
keep an elevated page count indefinitely. This is distinct from usages
like iov_iter_get_pages where the elevated page counts are transient.
The iov_iter_get_pages cases immediately turn around and submit the
pages to a device driver which will put_page when the i/o operation
completes (under kernel control).
In the longterm case userspace is responsible for dropping the page
reference at some undefined point in the future. This is untenable for
filesystem-dax case where the filesystem is in control of the lifetime
of the block / page and needs reasonable limits on how long it can wait
for pages in a mapping to become idle.
Fixing filesystems to actually wait for dax pages to be idle before
blocks from a truncate/hole-punch operation are repurposed is saved for
a later patch series.
Also, allowing longterm registration of dax mappings is a future patch
series that introduces a "map with lease" semantic where the kernel can
revoke a lease and force userspace to drop its page references.
I have also tagged these for -stable to purposely break cases that might
assume that longterm memory registrations for filesystem-dax mappings
were supported by the kernel. The behavior regression this policy change
implies is one of the reasons we maintain the "dax enabled. Warning:
EXPERIMENTAL, use at your own risk" notification when mounting a
filesystem in dax mode.
It is worth noting the device-dax interface does not suffer the same
constraints since it does not support file space management operations
like hole-punch.
---
Dan Williams (4):
mm: introduce get_user_pages_longterm
mm: fail get_vaddr_frames() for filesystem-dax mappings
[media] v4l2: disable filesystem-dax mapping support
IB/core: disable memory registration of fileystem-dax vmas
drivers/infiniband/core/umem.c | 2 -
drivers/media/v4l2-core/videobuf-dma-sg.c | 5 +-
include/linux/fs.h | 14 ++++++
include/linux/mm.h | 13 ++++++
mm/frame_vector.c | 12 +++++
mm/gup.c | 64 +++++++++++++++++++++++++++++
6 files changed, 107 insertions(+), 3 deletions(-)
From: Christoffer Dall <christoffer.dall(a)linaro.org>
We are incorrectly rearranging 32-bit words inside a 64-bit typed value
for big endian systems, which would result in never marking a virtual
interrupt as inactive on big endian systems (assuming 32 or fewer LRs on
the hardware). Fix this by not doing any word order manipulation for
the typed values.
Cc: <stable(a)vger.kernel.org>
Acked-by: Christoffer Dall <christoffer.dall(a)linaro.org>
Signed-off-by: Christoffer Dall <christoffer.dall(a)linaro.org>
---
virt/kvm/arm/hyp/vgic-v2-sr.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/virt/kvm/arm/hyp/vgic-v2-sr.c b/virt/kvm/arm/hyp/vgic-v2-sr.c
index a3f18d362366..d7fd46fe9efb 100644
--- a/virt/kvm/arm/hyp/vgic-v2-sr.c
+++ b/virt/kvm/arm/hyp/vgic-v2-sr.c
@@ -34,11 +34,7 @@ static void __hyp_text save_elrsr(struct kvm_vcpu *vcpu, void __iomem *base)
else
elrsr1 = 0;
-#ifdef CONFIG_CPU_BIG_ENDIAN
- cpu_if->vgic_elrsr = ((u64)elrsr0 << 32) | elrsr1;
-#else
cpu_if->vgic_elrsr = ((u64)elrsr1 << 32) | elrsr0;
-#endif
}
static void __hyp_text save_lrs(struct kvm_vcpu *vcpu, void __iomem *base)
--
2.14.2
From: Marc Zyngier <marc.zyngier(a)arm.com>
VTTBR_BADDR_MASK is used to sanity check the size and alignment of the
VTTBR address. It seems to currently be off by one, thereby only
allowing up to 39-bit addresses (instead of 40-bit) and also
insufficiently checking the alignment. This patch fixes it.
This patch is the 32bit pendent of Kristina's arm64 fix, and
she deserves the actual kudos for pinpointing that one.
Fixes: f7ed45be3ba52 ("KVM: ARM: World-switch implementation")
Cc: <stable(a)vger.kernel.org> # 3.9
Reported-by: Kristina Martsenko <kristina.martsenko(a)arm.com>
Reviewed-by: Christoffer Dall <christoffer.dall(a)linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall(a)linaro.org>
---
arch/arm/include/asm/kvm_arm.h | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm/include/asm/kvm_arm.h b/arch/arm/include/asm/kvm_arm.h
index c8781450905b..3ab8b3781bfe 100644
--- a/arch/arm/include/asm/kvm_arm.h
+++ b/arch/arm/include/asm/kvm_arm.h
@@ -161,8 +161,7 @@
#else
#define VTTBR_X (5 - KVM_T0SZ)
#endif
-#define VTTBR_BADDR_SHIFT (VTTBR_X - 1)
-#define VTTBR_BADDR_MASK (((_AC(1, ULL) << (40 - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT)
+#define VTTBR_BADDR_MASK (((_AC(1, ULL) << (40 - VTTBR_X)) - 1) << VTTBR_X)
#define VTTBR_VMID_SHIFT _AC(48, ULL)
#define VTTBR_VMID_MASK(size) (_AT(u64, (1 << size) - 1) << VTTBR_VMID_SHIFT)
--
2.14.2
From: Kristina Martsenko <kristina.martsenko(a)arm.com>
VTTBR_BADDR_MASK is used to sanity check the size and alignment of the
VTTBR address. It seems to currently be off by one, thereby only
allowing up to 47-bit addresses (instead of 48-bit) and also
insufficiently checking the alignment. This patch fixes it.
As an example, with 4k pages, before this patch we have:
PHYS_MASK_SHIFT = 48
VTTBR_X = 37 - 24 = 13
VTTBR_BADDR_SHIFT = 13 - 1 = 12
VTTBR_BADDR_MASK = ((1 << 35) - 1) << 12 = 0x00007ffffffff000
Which is wrong, because the mask doesn't allow bit 47 of the VTTBR
address to be set, and only requires the address to be 12-bit (4k)
aligned, while it actually needs to be 13-bit (8k) aligned because we
concatenate two 4k tables.
With this patch, the mask becomes 0x0000ffffffffe000, which is what we
want.
Fixes: 0369f6a34b9f ("arm64: KVM: EL2 register definitions")
Cc: <stable(a)vger.kernel.org> # 3.11.x
Reviewed-by: Suzuki K Poulose <suzuki.poulose(a)arm.com>
Reviewed-by: Christoffer Dall <christoffer.dall(a)linaro.org>
Signed-off-by: Kristina Martsenko <kristina.martsenko(a)arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall(a)linaro.org>
---
arch/arm64/include/asm/kvm_arm.h | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
index 7f069ff37f06..715d395ef45b 100644
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -170,8 +170,7 @@
#define VTCR_EL2_FLAGS (VTCR_EL2_COMMON_BITS | VTCR_EL2_TGRAN_FLAGS)
#define VTTBR_X (VTTBR_X_TGRAN_MAGIC - VTCR_EL2_T0SZ_IPA)
-#define VTTBR_BADDR_SHIFT (VTTBR_X - 1)
-#define VTTBR_BADDR_MASK (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT)
+#define VTTBR_BADDR_MASK (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_X)
#define VTTBR_VMID_SHIFT (UL(48))
#define VTTBR_VMID_MASK(size) (_AT(u64, (1 << size) - 1) << VTTBR_VMID_SHIFT)
--
2.14.2
From: Marc Zyngier <marc.zyngier(a)arm.com>
The current pending table parsing code assumes that we keep the
previous read of the pending bits, but keep that variable in
the current block, making sure it is discarded on each loop.
We end-up using whatever is on the stack. Who knows, it might
just be the right thing...
Fixes: 33d3bc9556a7d ("KVM: arm64: vgic-its: Read initial LPI pending table")
Cc: <stable(a)vger.kernel.org> # 4.8
Reported-by: AKASHI Takahiro <takahiro.akashi(a)linaro.org>
Reviewed-by: Christoffer Dall <christoffer.dall(a)linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall(a)linaro.org>
---
virt/kvm/arm/vgic/vgic-its.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
index 1f761a9991e7..cb2d0a2dbe5a 100644
--- a/virt/kvm/arm/vgic/vgic-its.c
+++ b/virt/kvm/arm/vgic/vgic-its.c
@@ -421,6 +421,7 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu)
u32 *intids;
int nr_irqs, i;
unsigned long flags;
+ u8 pendmask;
nr_irqs = vgic_copy_lpi_list(vcpu, &intids);
if (nr_irqs < 0)
@@ -428,7 +429,6 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu)
for (i = 0; i < nr_irqs; i++) {
int byte_offset, bit_nr;
- u8 pendmask;
byte_offset = intids[i] / BITS_PER_BYTE;
bit_nr = intids[i] % BITS_PER_BYTE;
--
2.14.2
From: Marc Zyngier <marc.zyngier(a)arm.com>
The current pending table parsing code assumes that we keep the
previous read of the pending bits, but keep that variable in
the current block, making sure it is discarded on each loop.
We end-up using whatever is on the stack. Who knows, it might
just be the right thing...
Fixes: 280771252c1ba ("KVM: arm64: vgic-v3: KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES")
Cc: <stable(a)vger.kernel.org> # 4.12
Reported-by: AKASHI Takahiro <takahiro.akashi(a)linaro.org>
Reviewed-by: Christoffer Dall <christoffer.dall(a)linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall(a)linaro.org>
---
virt/kvm/arm/vgic/vgic-v3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 2f05f732d3fd..f47e8481fa45 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -327,13 +327,13 @@ int vgic_v3_save_pending_tables(struct kvm *kvm)
int last_byte_offset = -1;
struct vgic_irq *irq;
int ret;
+ u8 val;
list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) {
int byte_offset, bit_nr;
struct kvm_vcpu *vcpu;
gpa_t pendbase, ptr;
bool stored;
- u8 val;
vcpu = irq->target_vcpu;
if (!vcpu)
--
2.14.2
From: Marc Zyngier <marc.zyngier(a)arm.com>
Using the size of the structure we're allocating is a good idea
and avoids any surprise... In this case, we're happilly confusing
kvm_kernel_irq_routing_entry and kvm_irq_routing_entry...
Fixes: 95b110ab9a09 ("KVM: arm/arm64: Enable irqchip routing")
Cc: <stable(a)vger.kernel.org> # 4.8
Reported-by: AKASHI Takahiro <takahiro.akashi(a)linaro.org>
Reviewed-by: Christoffer Dall <christoffer.dall(a)linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall(a)linaro.org>
---
virt/kvm/arm/vgic/vgic-irqfd.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/virt/kvm/arm/vgic/vgic-irqfd.c b/virt/kvm/arm/vgic/vgic-irqfd.c
index b7baf581611a..99e026d2dade 100644
--- a/virt/kvm/arm/vgic/vgic-irqfd.c
+++ b/virt/kvm/arm/vgic/vgic-irqfd.c
@@ -112,8 +112,7 @@ int kvm_vgic_setup_default_irq_routing(struct kvm *kvm)
u32 nr = dist->nr_spis;
int i, ret;
- entries = kcalloc(nr, sizeof(struct kvm_kernel_irq_routing_entry),
- GFP_KERNEL);
+ entries = kcalloc(nr, sizeof(*entries), GFP_KERNEL);
if (!entries)
return -ENOMEM;
--
2.14.2
This is a note to let you know that I've just added the patch titled
drm/i915: Prevent zero length "index" write
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
drm-i915-prevent-zero-length-index-write.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 56350fb8978bbf4aafe08f21234e161dd128b417 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala(a)linux.intel.com>
Date: Thu, 23 Nov 2017 21:41:57 +0200
Subject: drm/i915: Prevent zero length "index" write
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
commit 56350fb8978bbf4aafe08f21234e161dd128b417 upstream.
The hardware always writes one or two bytes in the index portion of
an indexed transfer. Make sure the message we send as the index
doesn't have a zero length.
Cc: Daniel Kurtz <djkurtz(a)chromium.org>
Cc: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: Sean Paul <seanpaul(a)chromium.org>
Fixes: 56f9eac05489 ("drm/i915/intel_i2c: use INDEX cycles for i2c read transactions")
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20171123194157.25367-3-ville.…
Reviewed-by: Chris Wilson <chris(a)chris-wilson.co.uk>
(cherry picked from commit bb9e0d4bca50f429152e74a459160b41f3d60fb2)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_i2c.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -431,7 +431,8 @@ gmbus_is_index_read(struct i2c_msg *msgs
{
return (i + 1 < num &&
msgs[i].addr == msgs[i + 1].addr &&
- !(msgs[i].flags & I2C_M_RD) && msgs[i].len <= 2 &&
+ !(msgs[i].flags & I2C_M_RD) &&
+ (msgs[i].len == 1 || msgs[i].len == 2) &&
(msgs[i + 1].flags & I2C_M_RD));
}
Patches currently in stable-queue which might be from ville.syrjala(a)linux.intel.com are
queue-4.9/drm-i915-prevent-zero-length-index-write.patch
queue-4.9/drm-i915-don-t-try-indexed-reads-to-alternate-slave-addresses.patch
This is a note to let you know that I've just added the patch titled
drm/i915: Don't try indexed reads to alternate slave addresses
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
drm-i915-don-t-try-indexed-reads-to-alternate-slave-addresses.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From ae5c631e605a452a5a0e73205a92810c01ed954b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala(a)linux.intel.com>
Date: Thu, 23 Nov 2017 21:41:56 +0200
Subject: drm/i915: Don't try indexed reads to alternate slave addresses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
commit ae5c631e605a452a5a0e73205a92810c01ed954b upstream.
We can only specify the one slave address to indexed reads/writes.
Make sure the messages we check are destined to the same slave
address before deciding to do an indexed transfer.
Cc: Daniel Kurtz <djkurtz(a)chromium.org>
Cc: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: Sean Paul <seanpaul(a)chromium.org>
Fixes: 56f9eac05489 ("drm/i915/intel_i2c: use INDEX cycles for i2c read transactions")
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20171123194157.25367-2-ville.…
Reviewed-by: Chris Wilson <chris(a)chris-wilson.co.uk>
(cherry picked from commit c4deb62d7821672265b87952bcd1c808f3bf3e8f)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_i2c.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -430,6 +430,7 @@ static bool
gmbus_is_index_read(struct i2c_msg *msgs, int i, int num)
{
return (i + 1 < num &&
+ msgs[i].addr == msgs[i + 1].addr &&
!(msgs[i].flags & I2C_M_RD) && msgs[i].len <= 2 &&
(msgs[i + 1].flags & I2C_M_RD));
}
Patches currently in stable-queue which might be from ville.syrjala(a)linux.intel.com are
queue-4.9/drm-i915-prevent-zero-length-index-write.patch
queue-4.9/drm-i915-don-t-try-indexed-reads-to-alternate-slave-addresses.patch
This is a note to let you know that I've just added the patch titled
nfsd: Make init_open_stateid() a bit more whole
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
nfsd-make-init_open_stateid-a-bit-more-whole.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 8c7245abda877d4689b3371db8ae2a4400d7d9ce Mon Sep 17 00:00:00 2001
From: Oleg Drokin <green(a)linuxhacker.ru>
Date: Tue, 14 Jun 2016 23:28:06 -0400
Subject: nfsd: Make init_open_stateid() a bit more whole
From: Oleg Drokin <green(a)linuxhacker.ru>
commit 8c7245abda877d4689b3371db8ae2a4400d7d9ce upstream.
Move the state selection logic inside from the caller,
always making it return correct stp to use.
Signed-off-by: J . Bruce Fields <bfields(a)fieldses.org>
Signed-off-by: Oleg Drokin <green(a)linuxhacker.ru>
Signed-off-by: J. Bruce Fields <bfields(a)redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 27 ++++++++++++---------------
1 file changed, 12 insertions(+), 15 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3420,13 +3420,14 @@ alloc_init_open_stateowner(unsigned int
}
static struct nfs4_ol_stateid *
-init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp,
- struct nfsd4_open *open)
+init_open_stateid(struct nfs4_file *fp, struct nfsd4_open *open)
{
struct nfs4_openowner *oo = open->op_openowner;
struct nfs4_ol_stateid *retstp = NULL;
+ struct nfs4_ol_stateid *stp;
+ stp = open->op_stp;
/* We are moving these outside of the spinlocks to avoid the warnings */
mutex_init(&stp->st_mutex);
mutex_lock(&stp->st_mutex);
@@ -3437,6 +3438,8 @@ init_open_stateid(struct nfs4_ol_stateid
retstp = nfsd4_find_existing_open(fp, open);
if (retstp)
goto out_unlock;
+
+ open->op_stp = NULL;
atomic_inc(&stp->st_stid.sc_count);
stp->st_stid.sc_type = NFS4_OPEN_STID;
INIT_LIST_HEAD(&stp->st_locks);
@@ -3454,10 +3457,11 @@ out_unlock:
spin_unlock(&oo->oo_owner.so_client->cl_lock);
if (retstp) {
mutex_lock(&retstp->st_mutex);
- /* Not that we need to, just for neatness */
+ /* To keep mutex tracking happy */
mutex_unlock(&stp->st_mutex);
+ stp = retstp;
}
- return retstp;
+ return stp;
}
/*
@@ -4260,7 +4264,6 @@ nfsd4_process_open2(struct svc_rqst *rqs
struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
struct nfs4_file *fp = NULL;
struct nfs4_ol_stateid *stp = NULL;
- struct nfs4_ol_stateid *swapstp = NULL;
struct nfs4_delegation *dp = NULL;
__be32 status;
@@ -4297,16 +4300,10 @@ nfsd4_process_open2(struct svc_rqst *rqs
goto out;
}
} else {
- stp = open->op_stp;
- open->op_stp = NULL;
- /*
- * init_open_stateid() either returns a locked stateid
- * it found, or initializes and locks the new one we passed in
- */
- swapstp = init_open_stateid(stp, fp, open);
- if (swapstp) {
- nfs4_put_stid(&stp->st_stid);
- stp = swapstp;
+ /* stp is returned locked. */
+ stp = init_open_stateid(fp, open);
+ /* See if we lost the race to some other thread */
+ if (stp->st_access_bmap != 0) {
status = nfs4_upgrade_open(rqstp, fp, current_fh,
stp, open);
if (status) {
Patches currently in stable-queue which might be from green(a)linuxhacker.ru are
queue-4.4/nfsd-make-init_open_stateid-a-bit-more-whole.patch