Hi all,
We found the following issue with Linux v6.12-rc7 on KunPeng920
platform. A very low frequency problem of pc value mismatch occurs when
using perf hardware breakpoints to trigger a signal handler and
comparing pc from u_context with its desired value.
Attached please find the reproducer for this issue. It applies perf
events to set a hardware breakpoint to an address while binding a signal
to the perf event fd. When stepping into the breakpoint address, the
signal handler compares pc value copied from signal ucontext with the
real breakpoint address and see if there is a mismatch.
While looking into the flow of execution:
// normal flow of exe:
a.out-19844 [038] d... 8763.348609:
hw_breakpoint_control: perf user addr: 400c6c, bp addr: 400c6c, ops: 0
// breakpoint exception:
a.out-19844 [038] d... 8763.348611: do_debug_exception:
ec: 0, pc: 400c6c, pstate: 20001000
a.out-19844 [038] d... 8763.348611: breakpoint_handler:
perf bp read: 400c6c
// send signal:
a.out-19844 [038] d.h. 8763.348613: send_sigio_to_task
<-send_sigio
a.out-19844 [038] d.h. 8763.348614: <stack trace>
=> send_sigio_to_task
=> send_sigio
=> kill_fasync_rcu
=> kill_fasync
=> perf_event_wakeup
=> perf_pending_event
=> irq_work_single
=> irq_work_run_list
=> irq_work_run
=> do_handle_IPI
=> ipi_handler
=> handle_percpu_devid_fasteoi_ipi
=> __handle_domain_irq
=> gic_handle_irq
=> el0_irq_naked
a.out-19844 [038] d.h. 8763.348614: send_sigio_to_task:
step in with signum 38
a.out-19844 [038] d.h. 8763.348615: send_sigio_to_task:
will do_send_sig_info 38
// kernel signal handling:
a.out-19844 [038] .... 8763.348616: do_notify_resume:
thread_flags 2097665, _TIF_SIGPENDING 1, _TIF_NOTIFY_SIGNAL40
a.out-19844 [038] .... 8763.348617: setup_sigframe:
restore sig: 400c6c
// single step exception:
a.out-19844 [038] d... 8763.348619: do_debug_exception:
ec: 1, pc: 400988, pstate: 20001000
a.out-19844 [038] d... 8763.348621:
hw_breakpoint_control: perf user addr: 400c6c, bp addr: 400c6c, ops: 1
// abnormal flow of exe:
a.out-19844 [084] d... 8763.782103:
hw_breakpoint_control: perf user addr: 400c6c, bp addr: 400c6c, ops: 0
// breakpoint exception:
a.out-19844 [084] d... 8763.782104: do_debug_exception:
ec: 0, pc: 400c6c, pstate: 20001000
// single step exception:
a.out-19844 [084] d... 8763.782105: breakpoint_handler:
perf bp read: 400c6c
a.out-19844 [084] d... 8763.782107: do_debug_exception:
ec: 1, pc: 400c70, pstate: 20001000
// send signal:
a.out-19844 [084] d.h. 8763.782108: send_sigio_to_task
<-send_sigio
a.out-19844 [084] d.h. 8763.782109: <stack trace>
=> send_sigio_to_task
=> send_sigio
=> kill_fasync_rcu
=> kill_fasync
=> perf_event_wakeup
=> perf_pending_event
=> irq_work_single
=> irq_work_run_list
=> irq_work_run
=> do_handle_IPI
=> ipi_handler
=> handle_percpu_devid_fasteoi_ipi
=> __handle_domain_irq
=> gic_handle_irq
=> el0_irq_naked
a.out-19844 [084] d.h. 8763.782110: send_sigio_to_task:
step in with signum 38
a.out-19844 [084] d.h. 8763.782110: send_sigio_to_task:
will do_send_sig_info 38
// kernel signal handling:
a.out-19844 [084] .... 8763.782111: do_notify_resume:
thread_flags 513, _TIF_SIGPENDING 1, _TIF_NOTIFY_SIGNAL40
a.out-19844 [084] .... 8763.782113: setup_sigframe:
restore sig: 400c70
a.out-19844 [084] d... 8763.782115:
hw_breakpoint_control: perf user addr: 400c6c, bp addr: 400c6c, ops: 1
Kernel sends this signal to task through pushing a perf_pending_event
(which sends the signal) in irq_work_queue then triggering an IPI to let
kernel handle this pended task.
seems that when mismatch occurs, the IPI does not preempt the breakpoint
exception it should preempt, causing no pending signals to be handled.
In this way, there is no pending signals in do_notify_resume and kernel
will not set up signal frame with correct pc value.
Thanks,
Chen
If KASAN is enabled, and one runs in a clean repository e.g.:
make LLVM=1 prepare
make LLVM=1 prepare
Then the Rust code gets rebuilt, which should not happen.
The reason is some of the LLVM KASAN `rustc` flags are added in the
second run:
-Cllvm-args=-asan-instrumentation-with-call-threshold=10000
-Cllvm-args=-asan-stack=0
-Cllvm-args=-asan-globals=1
-Cllvm-args=-asan-kernel-mem-intrinsic-prefix=1
Further runs do not rebuild Rust because the flags do not change anymore.
Rebuilding like that in the second run is bad, even if this just happens
with KASAN enabled, but missing flags in the first one is even worse.
The root issue is that we pass, for some architectures and for the moment,
a generated `target.json` file. That file is not ready by the time `rustc`
gets called for the flag test, and thus the flag test fails just because
the file is not available, e.g.:
$ ... --target=./scripts/target.json ... -Cllvm-args=...
error: target file "./scripts/target.json" does not exist
There are a few approaches we could take here to solve this. For instance,
we could ensure that every time that the config is rebuilt, we regenerate
the file and recompute the flags. Or we could use the LLVM version to
check for these flags, instead of testing the flag (which may have other
advantages, such as allowing us to detect renames on the LLVM side).
However, it may be easier than that: `rustc` is aware of the `-Cllvm-args`
regardless of the `--target` (e.g. I checked that the list printed
is the same, plus that I can check for these flags even if I pass
a completely unrelated target), and thus we can just eliminate the
dependency completely.
Thus filter out the target.
This does mean that `rustc-option` cannot be used to test a flag that
requires the right target, but we don't have other users yet, it is a
minimal change and we want to get rid of custom targets in the future.
We could only filter in the case `target.json` is used, to make it work
in more cases, but then it would be harder to notice that it may not
work in a couple architectures.
Cc: Matthew Maurer <mmaurer(a)google.com>
Cc: Sami Tolvanen <samitolvanen(a)google.com>
Cc: stable(a)vger.kernel.org
Fixes: e3117404b411 ("kbuild: rust: Enable KASAN support")
Signed-off-by: Miguel Ojeda <ojeda(a)kernel.org>
---
By the way, I noticed that we are not getting `asan-instrument-allocas` enabled
in neither C nor Rust -- upstream LLVM renamed it in commit 8176ee9b5dda ("[asan]
Rename asan-instrument-allocas -> asan-instrument-dynamic-allocas")). But it
happened a very long time ago (9 years ago), and the addition in the kernel
is fairly old too, in 342061ee4ef3 ("kasan: support alloca() poisoning").
I assume it should either be renamed or removed? Happy to send a patch if so.
scripts/Makefile.compiler | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/Makefile.compiler b/scripts/Makefile.compiler
index 8956587b8547..7ed7f92a7daa 100644
--- a/scripts/Makefile.compiler
+++ b/scripts/Makefile.compiler
@@ -80,7 +80,7 @@ ld-option = $(call try-run, $(LD) $(KBUILD_LDFLAGS) $(1) -v,$(1),$(2),$(3))
# TODO: remove RUSTC_BOOTSTRAP=1 when we raise the minimum GNU Make version to 4.4
__rustc-option = $(call try-run,\
echo '#![allow(missing_docs)]#![feature(no_core)]#![no_core]' | RUSTC_BOOTSTRAP=1\
- $(1) --sysroot=/dev/null $(filter-out --sysroot=/dev/null,$(2)) $(3)\
+ $(1) --sysroot=/dev/null $(filter-out --sysroot=/dev/null --target=%,$(2)) $(3)\
--crate-type=rlib --out-dir=$(TMPOUT) --emit=obj=- - >/dev/null,$(3),$(4))
# rustc-option
base-commit: 0af2f6be1b4281385b618cb86ad946eded089ac8
--
2.49.0
Typically HDMI to MIPI CSI-2 bridges have a pin to signal image data is
being received. On the host side this is wired to a GPIO for polling or
interrupts. This includes the Lontium HDMI to MIPI CSI-2 bridges
lt6911uxe and lt6911uxc.
The GPIO "hpd" is used already by other HDMI to CSI-2 bridges, use it
here as well.
Signed-off-by: Dongcheng Yan <dongcheng.yan(a)intel.com>
---
drivers/platform/x86/intel/int3472/common.h | 1 +
drivers/platform/x86/intel/int3472/discrete.c | 6 ++++++
2 files changed, 7 insertions(+)
diff --git a/drivers/platform/x86/intel/int3472/common.h b/drivers/platform/x86/intel/int3472/common.h
index 145dec66df64..db4cd3720e24 100644
--- a/drivers/platform/x86/intel/int3472/common.h
+++ b/drivers/platform/x86/intel/int3472/common.h
@@ -22,6 +22,7 @@
#define INT3472_GPIO_TYPE_POWER_ENABLE 0x0b
#define INT3472_GPIO_TYPE_CLK_ENABLE 0x0c
#define INT3472_GPIO_TYPE_PRIVACY_LED 0x0d
+#define INT3472_GPIO_TYPE_HOTPLUG_DETECT 0x13
#define INT3472_PDEV_MAX_NAME_LEN 23
#define INT3472_MAX_SENSOR_GPIOS 3
diff --git a/drivers/platform/x86/intel/int3472/discrete.c b/drivers/platform/x86/intel/int3472/discrete.c
index 30ff8f3ea1f5..28d41b1b3809 100644
--- a/drivers/platform/x86/intel/int3472/discrete.c
+++ b/drivers/platform/x86/intel/int3472/discrete.c
@@ -186,6 +186,10 @@ static void int3472_get_con_id_and_polarity(struct acpi_device *adev, u8 *type,
*con_id = "privacy-led";
*gpio_flags = GPIO_ACTIVE_HIGH;
break;
+ case INT3472_GPIO_TYPE_HOTPLUG_DETECT:
+ *con_id = "hpd";
+ *gpio_flags = GPIO_LOOKUP_FLAGS_DEFAULT;
+ break;
case INT3472_GPIO_TYPE_POWER_ENABLE:
*con_id = "power-enable";
*gpio_flags = GPIO_ACTIVE_HIGH;
@@ -212,6 +216,7 @@ static void int3472_get_con_id_and_polarity(struct acpi_device *adev, u8 *type,
* 0x0b Power enable
* 0x0c Clock enable
* 0x0d Privacy LED
+ * 0x13 Hotplug detect
*
* There are some known platform specific quirks where that does not quite
* hold up; for example where a pin with type 0x01 (Power down) is mapped to
@@ -281,6 +286,7 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
switch (type) {
case INT3472_GPIO_TYPE_RESET:
case INT3472_GPIO_TYPE_POWERDOWN:
+ case INT3472_GPIO_TYPE_HOTPLUG_DETECT:
ret = skl_int3472_map_gpio_to_sensor(int3472, agpio, con_id, gpio_flags);
if (ret)
err_msg = "Failed to map GPIO pin to sensor\n";
base-commit: 01c6df60d5d4ae00cd5c1648818744838bba7763
--
2.34.1