* [PATCH 4.15 001/146] RDMA/ucma: Limit possible option size
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
@ 2018-03-13 15:22 ` Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 002/146] RDMA/ucma: Check that user doesnt overflow QP state Greg Kroah-Hartman
` (148 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+a38b0e9f694c379ca7ce,
Leon Romanovsky, Doug Ledford
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@mellanox.com>
commit 6a21dfc0d0db7b7e0acedce67ca533a6eb19283c upstream.
Users of ucma are supposed to provide size of option level,
in most paths it is supposed to be equal to u8 or u16, but
it is not the case for the IB path record, where it can be
multiple of struct ib_path_rec_data.
This patch takes simplest possible approach and prevents providing
values more than possible to allocate.
Reported-by: syzbot+a38b0e9f694c379ca7ce@syzkaller.appspotmail.com
Fixes: 7ce86409adcd ("RDMA/ucma: Allow user space to set service type")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/ucma.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1293,6 +1293,9 @@ static ssize_t ucma_set_option(struct uc
if (IS_ERR(ctx))
return PTR_ERR(ctx);
+ if (unlikely(cmd.optval > KMALLOC_MAX_SIZE))
+ return -EINVAL;
+
optval = memdup_user((void __user *) (unsigned long) cmd.optval,
cmd.optlen);
if (IS_ERR(optval)) {
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 002/146] RDMA/ucma: Check that user doesnt overflow QP state
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 001/146] RDMA/ucma: Limit possible option size Greg Kroah-Hartman
@ 2018-03-13 15:22 ` Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 003/146] RDMA/mlx5: Fix integer overflow while resizing CQ Greg Kroah-Hartman
` (147 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+0df1ab766f8924b1edba,
Leon Romanovsky, Doug Ledford
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@mellanox.com>
commit a5880b84430316e3e1c1f5d23aa32ec6000cc717 upstream.
The QP state is limited and declared in enum ib_qp_state,
but ucma user was able to supply any possible (u32) value.
Reported-by: syzbot+0df1ab766f8924b1edba@syzkaller.appspotmail.com
Fixes: 75216638572f ("RDMA/cma: Export rdma cm interface to userspace")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/ucma.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1148,6 +1148,9 @@ static ssize_t ucma_init_qp_attr(struct
if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
return -EFAULT;
+ if (cmd.qp_state > IB_QPS_ERR)
+ return -EINVAL;
+
ctx = ucma_get_ctx(file, cmd.id);
if (IS_ERR(ctx))
return PTR_ERR(ctx);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 003/146] RDMA/mlx5: Fix integer overflow while resizing CQ
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 001/146] RDMA/ucma: Limit possible option size Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 002/146] RDMA/ucma: Check that user doesnt overflow QP state Greg Kroah-Hartman
@ 2018-03-13 15:22 ` Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 004/146] bpf: cpumap: use GFP_KERNEL instead of GFP_ATOMIC in __cpu_map_entry_alloc() Greg Kroah-Hartman
` (146 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzkaller, Noa Osherovich,
Yishai Hadas, Leon Romanovsky, Doug Ledford
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@mellanox.com>
commit 28e9091e3119933c38933cb8fc48d5618eb784c8 upstream.
The user can provide very large cqe_size which will cause to integer
overflow as it can be seen in the following UBSAN warning:
=======================================================================
UBSAN: Undefined behaviour in drivers/infiniband/hw/mlx5/cq.c:1192:53
signed integer overflow:
64870 * 65536 cannot be represented in type 'int'
CPU: 0 PID: 267 Comm: syzkaller605279 Not tainted 4.15.0+ #90 Hardware
name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
Call Trace:
dump_stack+0xde/0x164
? dma_virt_map_sg+0x22c/0x22c
ubsan_epilogue+0xe/0x81
handle_overflow+0x1f3/0x251
? __ubsan_handle_negate_overflow+0x19b/0x19b
? lock_acquire+0x440/0x440
mlx5_ib_resize_cq+0x17e7/0x1e40
? cyc2ns_read_end+0x10/0x10
? native_read_msr_safe+0x6c/0x9b
? cyc2ns_read_end+0x10/0x10
? mlx5_ib_modify_cq+0x220/0x220
? sched_clock_cpu+0x18/0x200
? lookup_get_idr_uobject+0x200/0x200
? rdma_lookup_get_uobject+0x145/0x2f0
ib_uverbs_resize_cq+0x207/0x3e0
? ib_uverbs_ex_create_cq+0x250/0x250
ib_uverbs_write+0x7f9/0xef0
? cyc2ns_read_end+0x10/0x10
? print_irqtrace_events+0x280/0x280
? ib_uverbs_ex_create_cq+0x250/0x250
? uverbs_devnode+0x110/0x110
? sched_clock_cpu+0x18/0x200
? do_raw_spin_trylock+0x100/0x100
? __lru_cache_add+0x16e/0x290
__vfs_write+0x10d/0x700
? uverbs_devnode+0x110/0x110
? kernel_read+0x170/0x170
? sched_clock_cpu+0x18/0x200
? security_file_permission+0x93/0x260
vfs_write+0x1b0/0x550
SyS_write+0xc7/0x1a0
? SyS_read+0x1a0/0x1a0
? trace_hardirqs_on_thunk+0x1a/0x1c
entry_SYSCALL_64_fastpath+0x1e/0x8b
RIP: 0033:0x433549
RSP: 002b:00007ffe63bd1ea8 EFLAGS: 00000217
=======================================================================
Cc: syzkaller <syzkaller@googlegroups.com>
Cc: <stable@vger.kernel.org> # 3.13
Fixes: bde51583f49b ("IB/mlx5: Add support for resize CQ")
Reported-by: Noa Osherovich <noaos@mellanox.com>
Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx5/cq.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -1177,7 +1177,12 @@ static int resize_user(struct mlx5_ib_de
if (ucmd.reserved0 || ucmd.reserved1)
return -EINVAL;
- umem = ib_umem_get(context, ucmd.buf_addr, entries * ucmd.cqe_size,
+ /* check multiplication overflow */
+ if (ucmd.cqe_size && SIZE_MAX / ucmd.cqe_size <= entries - 1)
+ return -EINVAL;
+
+ umem = ib_umem_get(context, ucmd.buf_addr,
+ (size_t)ucmd.cqe_size * entries,
IB_ACCESS_LOCAL_WRITE, 1);
if (IS_ERR(umem)) {
err = PTR_ERR(umem);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 004/146] bpf: cpumap: use GFP_KERNEL instead of GFP_ATOMIC in __cpu_map_entry_alloc()
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2018-03-13 15:22 ` [PATCH 4.15 003/146] RDMA/mlx5: Fix integer overflow while resizing CQ Greg Kroah-Hartman
@ 2018-03-13 15:22 ` Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 005/146] IB/uverbs: Improve lockdep_check Greg Kroah-Hartman
` (145 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+1a240cdb1f4cc88819df,
Michal Hocko, Daniel Borkmann, Matthew Wilcox,
Jesper Dangaard Brouer, akpm, dhowells, hannes, Jason Wang
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <jasowang@redhat.com>
commit 7fc17e909edfb9bf421ee04e981d3d474175c7c7 upstream.
There're several implications after commit 0bf7800f1799 ("ptr_ring:
try vmalloc() when kmalloc() fails") with the using of vmalloc() since
can't allow GFP_ATOMIC but mandate GFP_KERNEL. This will lead a WARN
since cpumap try to call with GFP_ATOMIC. Fortunately, entry
allocation of cpumap can only be done through syscall path which means
GFP_ATOMIC is not necessary, so fixing this by replacing GFP_ATOMIC
with GFP_KERNEL.
Reported-by: syzbot+1a240cdb1f4cc88819df@syzkaller.appspotmail.com
Fixes: 0bf7800f1799 ("ptr_ring: try vmalloc() when kmalloc() fails")
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Jesper Dangaard Brouer <brouer@redhat.com>
Cc: akpm@linux-foundation.org
Cc: dhowells@redhat.com
Cc: hannes@cmpxchg.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/cpumap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/bpf/cpumap.c
+++ b/kernel/bpf/cpumap.c
@@ -339,7 +339,7 @@ static int cpu_map_kthread_run(void *dat
struct bpf_cpu_map_entry *__cpu_map_entry_alloc(u32 qsize, u32 cpu, int map_id)
{
- gfp_t gfp = GFP_ATOMIC|__GFP_NOWARN;
+ gfp_t gfp = GFP_KERNEL | __GFP_NOWARN;
struct bpf_cpu_map_entry *rcpu;
int numa, err;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 005/146] IB/uverbs: Improve lockdep_check
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2018-03-13 15:22 ` [PATCH 4.15 004/146] bpf: cpumap: use GFP_KERNEL instead of GFP_ATOMIC in __cpu_map_entry_alloc() Greg Kroah-Hartman
@ 2018-03-13 15:22 ` Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 006/146] mac80211_hwsim: dont use WQ_MEM_RECLAIM Greg Kroah-Hartman
` (144 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Jason Gunthorpe
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@mellanox.com>
commit 104f268d439b3c21c83708e52946a4d8d37f3d0f upstream.
This is really being used as an assert that the expected usecnt
is being held and implicitly that the usecnt is valid. Rename it to
assert_uverbs_usecnt and tighten the checks to only accept valid
values of usecnt (eg 0 and < -1 are invalid).
The tigher checkes make the assertion cover more cases and is more
likely to find bugs via syzkaller/etc.
Fixes: 3832125624b7 ("IB/core: Add support for idr types")
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/rdma_core.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/infiniband/core/rdma_core.c
+++ b/drivers/infiniband/core/rdma_core.c
@@ -407,13 +407,13 @@ static int __must_check remove_commit_fd
return ret;
}
-static void lockdep_check(struct ib_uobject *uobj, bool exclusive)
+static void assert_uverbs_usecnt(struct ib_uobject *uobj, bool exclusive)
{
#ifdef CONFIG_LOCKDEP
if (exclusive)
- WARN_ON(atomic_read(&uobj->usecnt) > 0);
+ WARN_ON(atomic_read(&uobj->usecnt) != -1);
else
- WARN_ON(atomic_read(&uobj->usecnt) == -1);
+ WARN_ON(atomic_read(&uobj->usecnt) <= 0);
#endif
}
@@ -452,7 +452,7 @@ int __must_check rdma_remove_commit_uobj
WARN(true, "ib_uverbs: Cleanup is running while removing an uobject\n");
return 0;
}
- lockdep_check(uobj, true);
+ assert_uverbs_usecnt(uobj, true);
ret = _rdma_remove_commit_uobject(uobj, RDMA_REMOVE_DESTROY);
up_read(&ucontext->cleanup_rwsem);
@@ -482,7 +482,7 @@ int rdma_explicit_destroy(struct ib_uobj
WARN(true, "ib_uverbs: Cleanup is running while removing an uobject\n");
return 0;
}
- lockdep_check(uobject, true);
+ assert_uverbs_usecnt(uobject, true);
ret = uobject->type->type_class->remove_commit(uobject,
RDMA_REMOVE_DESTROY);
if (ret)
@@ -569,7 +569,7 @@ static void lookup_put_fd_uobject(struct
void rdma_lookup_put_uobject(struct ib_uobject *uobj, bool exclusive)
{
- lockdep_check(uobj, exclusive);
+ assert_uverbs_usecnt(uobj, exclusive);
uobj->type->type_class->lookup_put(uobj, exclusive);
/*
* In order to unlock an object, either decrease its usecnt for
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 006/146] mac80211_hwsim: dont use WQ_MEM_RECLAIM
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2018-03-13 15:22 ` [PATCH 4.15 005/146] IB/uverbs: Improve lockdep_check Greg Kroah-Hartman
@ 2018-03-13 15:22 ` Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 007/146] net/smc: fix NULL pointer dereference on sock_create_kern() error path Greg Kroah-Hartman
` (143 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+41cdaf4232c50e658934, Johannes Berg
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit ce162bfbc0b601841886965baba14877127c7c7c upstream.
We're obviously not part of a memory reclaim path, so don't set the flag.
This also causes a warning in check_flush_dependency() since we end up
in a code path that flushes a non-reclaim workqueue, and we shouldn't do
that if we were really part of reclaim.
Reported-by: syzbot+41cdaf4232c50e658934@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mac80211_hwsim.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -3455,7 +3455,7 @@ static int __init init_mac80211_hwsim(vo
spin_lock_init(&hwsim_radio_lock);
- hwsim_wq = alloc_workqueue("hwsim_wq",WQ_MEM_RECLAIM,0);
+ hwsim_wq = alloc_workqueue("hwsim_wq", 0, 0);
if (!hwsim_wq)
return -ENOMEM;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 007/146] net/smc: fix NULL pointer dereference on sock_create_kern() error path
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2018-03-13 15:22 ` [PATCH 4.15 006/146] mac80211_hwsim: dont use WQ_MEM_RECLAIM Greg Kroah-Hartman
@ 2018-03-13 15:22 ` Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 008/146] regulator: stm32-vrefbuf: fix check on ready flag Greg Kroah-Hartman
` (142 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Davide Caratti, Ursula Braun,
David S. Miller
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Caratti <dcaratti@redhat.com>
commit a5dcb73b96a9d21431048bdaac02d9e96f386da3 upstream.
when sock_create_kern(..., a) returns an error, 'a' might not be a valid
pointer, so it shouldn't be dereferenced to read a->sk->sk_sndbuf and
and a->sk->sk_rcvbuf; not doing that caused the following crash:
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 4254 Comm: syzkaller919713 Not tainted 4.16.0-rc1+ #18
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:smc_create+0x14e/0x300 net/smc/af_smc.c:1410
RSP: 0018:ffff8801b06afbc8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8801b63457c0 RCX: ffffffff85a3e746
RDX: 0000000000000004 RSI: 00000000ffffffff RDI: 0000000000000020
RBP: ffff8801b06afbf0 R08: 00000000000007c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8801b6345c08 R14: 00000000ffffffe9 R15: ffffffff8695ced0
FS: 0000000001afb880(0000) GS:ffff8801db200000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000040 CR3: 00000001b0721004 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__sock_create+0x4d4/0x850 net/socket.c:1285
sock_create net/socket.c:1325 [inline]
SYSC_socketpair net/socket.c:1409 [inline]
SyS_socketpair+0x1c0/0x6f0 net/socket.c:1366
do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x26/0x9b
RIP: 0033:0x4404b9
RSP: 002b:00007fff44ab6908 EFLAGS: 00000246 ORIG_RAX: 0000000000000035
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004404b9
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000002b
RBP: 00007fff44ab6910 R08: 0000000000000002 R09: 00007fff44003031
R10: 0000000020000040 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000
Code: 48 c1 ea 03 80 3c 02 00 0f 85 b3 01 00 00 4c 8b a3 48 04 00 00 48
b8
00 00 00 00 00 fc ff df 49 8d 7c 24 20 48 89 fa 48 c1 ea 03 <80> 3c 02
00
0f 85 82 01 00 00 4d 8b 7c 24 20 48 b8 00 00 00 00
RIP: smc_create+0x14e/0x300 net/smc/af_smc.c:1410 RSP: ffff8801b06afbc8
Fixes: cd6851f30386 smc: remote memory buffers (RMBs)
Reported-and-tested-by: syzbot+aa0227369be2dcc26ebe@syzkaller.appspotmail.com
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/smc/af_smc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1369,8 +1369,10 @@ static int smc_create(struct net *net, s
smc->use_fallback = false; /* assume rdma capability first */
rc = sock_create_kern(net, PF_INET, SOCK_STREAM,
IPPROTO_TCP, &smc->clcsock);
- if (rc)
+ if (rc) {
sk_common_release(sk);
+ goto out;
+ }
smc->sk.sk_sndbuf = max(smc->clcsock->sk->sk_sndbuf, SMC_BUF_MIN_SIZE);
smc->sk.sk_rcvbuf = max(smc->clcsock->sk->sk_rcvbuf, SMC_BUF_MIN_SIZE);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 008/146] regulator: stm32-vrefbuf: fix check on ready flag
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2018-03-13 15:22 ` [PATCH 4.15 007/146] net/smc: fix NULL pointer dereference on sock_create_kern() error path Greg Kroah-Hartman
@ 2018-03-13 15:22 ` Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 009/146] drm/i915: Check for fused or unused pipes Greg Kroah-Hartman
` (141 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fabrice Gasnier, Mark Brown
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrice Gasnier <fabrice.gasnier@st.com>
commit f63248fac563125fd5a2f0bc780ce7a299872cab upstream.
stm32_vrefbuf_enable() wrongly checks VRR bit: 0 stands for not ready,
1 for ready. It currently checks the opposite.
This makes enable routine to exit immediately without waiting for ready
flag.
Fixes: 0cdbf481e927 ("regulator: Add support for stm32-vrefbuf")
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/stm32-vrefbuf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/regulator/stm32-vrefbuf.c
+++ b/drivers/regulator/stm32-vrefbuf.c
@@ -51,7 +51,7 @@ static int stm32_vrefbuf_enable(struct r
* arbitrary timeout.
*/
ret = readl_poll_timeout(priv->base + STM32_VREFBUF_CSR, val,
- !(val & STM32_VRR), 650, 10000);
+ val & STM32_VRR, 650, 10000);
if (ret) {
dev_err(&rdev->dev, "stm32 vrefbuf timed out!\n");
val = readl_relaxed(priv->base + STM32_VREFBUF_CSR);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 009/146] drm/i915: Check for fused or unused pipes
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2018-03-13 15:22 ` [PATCH 4.15 008/146] regulator: stm32-vrefbuf: fix check on ready flag Greg Kroah-Hartman
@ 2018-03-13 15:22 ` Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 010/146] drm/i915/audio: fix check for av_enc_map overflow Greg Kroah-Hartman
` (140 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
Jaswinder Singh Rajput, Jani Nikula, Mika Kahola, Rodrigo Vivi
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Kahola <mika.kahola@intel.com>
commit 9965db26ac0548648309f506dc155a92daa2158f upstream.
We may have fused or unused pipes in our system. Let's check that the pipe
in question is within limits of accessible pipes. In case, that we are not
able to access the pipe, we return early with a warning.
v2: Rephrasing of the commit message (Jani)
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103206
Reported-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jaswinder Singh Rajput <jaswinder@perfectintelligent.com>
Suggested-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Mika Kahola <mika.kahola@intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1513584243-12607-1-git-send-email-mika.kahola@intel.com
(cherry picked from commit 0b7029b7e43fda1304c181a3ade0b429b9edcd9d)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: <stable@vger.kernel.org> # v4.10+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_audio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -754,7 +754,7 @@ static struct intel_encoder *get_saved_e
{
struct intel_encoder *encoder;
- if (WARN_ON(pipe >= INTEL_INFO(dev_priv)->num_pipes))
+ if (WARN_ON(pipe >= ARRAY_SIZE(dev_priv->av_enc_map)))
return NULL;
/* MST */
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 010/146] drm/i915/audio: fix check for av_enc_map overflow
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2018-03-13 15:22 ` [PATCH 4.15 009/146] drm/i915: Check for fused or unused pipes Greg Kroah-Hartman
@ 2018-03-13 15:22 ` Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 011/146] drm/i915: Fix rsvd2 mask when out-fence is returned Greg Kroah-Hartman
` (139 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mika Kahola, Rodrigo Vivi,
Jani Nikula, Joonas Lahtinen, intel-gfx, Dhinakaran Pandiyan,
Jani Nikula
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
commit 72a6d72c2cd03bba7b70117b63dea83d2de88057 upstream.
Turns out -1 >= ARRAY_SIZE() is always true. Move the bounds check where
we know pipe >= 0 and next to the array indexing where it makes most
sense.
Fixes: 9965db26ac05 ("drm/i915: Check for fused or unused pipes")
Fixes: 0b7029b7e43f ("drm/i915: Check for fused or unused pipes")
Cc: <stable@vger.kernel.org> # v4.10+
Cc: Mika Kahola <mika.kahola@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: intel-gfx@lists.freedesktop.org
Reviewed-by: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
Reviewed-by: Mika Kahola <mika.kahola@intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180214173840.25360-1-jani.nikula@intel.com
(cherry picked from commit cdb3db8542d854bd678d60cd28861b042e191672)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_audio.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -754,11 +754,11 @@ static struct intel_encoder *get_saved_e
{
struct intel_encoder *encoder;
- if (WARN_ON(pipe >= ARRAY_SIZE(dev_priv->av_enc_map)))
- return NULL;
-
/* MST */
if (pipe >= 0) {
+ if (WARN_ON(pipe >= ARRAY_SIZE(dev_priv->av_enc_map)))
+ return NULL;
+
encoder = dev_priv->av_enc_map[pipe];
/*
* when bootup, audio driver may not know it is
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 011/146] drm/i915: Fix rsvd2 mask when out-fence is returned
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2018-03-13 15:22 ` [PATCH 4.15 010/146] drm/i915/audio: fix check for av_enc_map overflow Greg Kroah-Hartman
@ 2018-03-13 15:22 ` Greg Kroah-Hartman
2018-03-13 15:22 ` [PATCH 4.15 012/146] drm/i915: Clear the in-use marker on execbuf failure Greg Kroah-Hartman
` (138 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Daniele Ceraolo Spurio,
Rodrigo Vivi
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
commit b1b13780ab06ef8c770dd9cbe31dac549a11630e upstream.
GENMASK_ULL wants the high bit of the mask first. The current value
cancels the in-fence when an out-fence is returned.
Fixes: fec0445caa273 ("drm/i915: Support explicit fencing for execbuf")
Testcase: igt/gem_exec_fence/keep-in-fence*
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20180214191827.8465-1-daniele.ceraolospurio@intel.com
Cc: <stable@vger.kernel.org> # v4.12+
(cherry picked from commit b6a88e4a804cf5a71159906e16df2c1fc7196f92)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_gem_execbuffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -2419,7 +2419,7 @@ err_request:
if (out_fence) {
if (err == 0) {
fd_install(out_fence_fd, out_fence->file);
- args->rsvd2 &= GENMASK_ULL(0, 31); /* keep in-fence */
+ args->rsvd2 &= GENMASK_ULL(31, 0); /* keep in-fence */
args->rsvd2 |= (u64)out_fence_fd << 32;
out_fence_fd = -1;
} else {
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 012/146] drm/i915: Clear the in-use marker on execbuf failure
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2018-03-13 15:22 ` [PATCH 4.15 011/146] drm/i915: Fix rsvd2 mask when out-fence is returned Greg Kroah-Hartman
@ 2018-03-13 15:22 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 013/146] drm/i915: Disable DC states around GMBUS on GLK Greg Kroah-Hartman
` (137 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Tvrtko Ursulin,
Joonas Lahtinen, Rodrigo Vivi
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit e659d14ed48096f87a678e7ebbdf286a817b4d0e upstream.
If we fail to unbind the vma (due to a signal on an active buffer that
needs to be moved for the next execbuf), then we need to clear the
persistent tracking state we setup for this execbuf.
Fixes: c7c6e46f913b ("drm/i915: Convert execbuf to use struct-of-array packing for critical fields")
Testcase: igt/gem_fenced_exec_thrash/no-spare-fences-busy*
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: <stable@vger.kernel.org> # v4.14+
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180219140144.24004-1-chris@chris-wilson.co.uk
(cherry picked from commit ed2f3532321083cf40e4da4e36234880e0136136)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_gem_execbuffer.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -505,6 +505,8 @@ eb_add_vma(struct i915_execbuffer *eb, u
list_add_tail(&vma->exec_link, &eb->unbound);
if (drm_mm_node_allocated(&vma->node))
err = i915_vma_unbind(vma);
+ if (unlikely(err))
+ vma->exec_flags = NULL;
}
return err;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 013/146] drm/i915: Disable DC states around GMBUS on GLK
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2018-03-13 15:22 ` [PATCH 4.15 012/146] drm/i915: Clear the in-use marker on execbuf failure Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 014/146] drm/i915: Update watermark state correctly in sanitize_watermarks Greg Kroah-Hartman
` (136 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ville Syrjälä, Dhinakaran Pandiyan
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <ville.syrjala@linux.intel.com>
commit 156961ae7bdf6feb72778e8da83d321b273343fd upstream.
Prevent the DMC from destroying GMBUS transfers on GLK. GMBUS
lives in PG1 so DC off is all we need.
Cc: stable@vger.kernel.org
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20171208213739.16388-1-ville.syrjala@linux.intel.com
Reviewed-by: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_runtime_pm.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -1844,6 +1844,7 @@ void intel_display_power_put(struct drm_
CNL_DISPLAY_POWERWELL_2_POWER_DOMAINS | \
BIT_ULL(POWER_DOMAIN_MODESET) | \
BIT_ULL(POWER_DOMAIN_AUX_A) | \
+ BIT_ULL(POWER_DOMAIN_GMBUS) | \
BIT_ULL(POWER_DOMAIN_INIT))
static const struct i915_power_well_ops i9xx_always_on_power_well_ops = {
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 014/146] drm/i915: Update watermark state correctly in sanitize_watermarks
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 013/146] drm/i915: Disable DC states around GMBUS on GLK Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 015/146] drm/i915: Try EDID bitbanging on HDMI after failed read Greg Kroah-Hartman
` (135 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maarten Lankhorst, Ville Syrjälä
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
commit 556fe36d09da5f82879e92bafa0371b4b79f7d6f upstream.
We no longer use intel_crtc->wm.active for watermarks any more,
which was incorrect. But this uncovered a bug in sanitize_watermarks(),
which meant that we wrote the correct watermarks, but the next
update would still use the wrong hw watermarks for calculating.
This caused all further updates to fail with -EINVAL and the
log would reveal an error like the one below:
[ 10.043902] [drm:ilk_validate_wm_level.part.8 [i915]] Sprite WM0 too large 56 (max 0)
[ 10.043960] [drm:ilk_validate_pipe_wm [i915]] LP0 watermark invalid
[ 10.044030] [drm:intel_crtc_atomic_check [i915]] No valid intermediate pipe watermarks are possible
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Fixes: b6b178a77210 ("drm/i915: Calculate ironlake intermediate watermarks correctly, v2.")
Cc: stable@vger.kernel.org #v4.8+
Link: https://patchwork.freedesktop.org/patch/msgid/20171110113503.16253-1-maarten.lankhorst@linux.intel.com
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_display.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -14463,6 +14463,8 @@ retry:
cs->wm.need_postvbl_update = true;
dev_priv->display.optimize_watermarks(intel_state, cs);
+
+ to_intel_crtc_state(crtc->state)->wm = cs->wm;
}
put_state:
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 015/146] drm/i915: Try EDID bitbanging on HDMI after failed read
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 014/146] drm/i915: Update watermark state correctly in sanitize_watermarks Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 016/146] drm/i915/perf: fix perf stream opening lock Greg Kroah-Hartman
` (134 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Brüns, Daniel Vetter,
Rodrigo Vivi
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Brüns <stefan.bruens@rwth-aachen.de>
commit 90024a5951029685acc5396258f1b0de9b23cf4a upstream.
The ACK/NACK implementation as found in e.g. the G965 has the falling
clock edge and the release of the data line after the ACK for the received
byte happen at the same time.
This is conformant with the I2C specification, which allows a zero hold
time, see footnote [3]: "A device must internally provide a hold time of
at least 300 ns for the SDA signal (with respect to the V IH(min) of the
SCL signal) to bridge the undefined region of the falling edge of SCL."
Some HDMI-to-VGA converters apparently fail to adhere to this requirement
and latch SDA at the falling clock edge, so instead of an ACK
sometimes a NACK is read and the slave (i.e. the EDID ROM) ends the
transfer.
The bitbanging releases the data line for the ACK only 1/4 bit time after
the falling clock edge, so a slave will see the correct value no matter
if it samples at the rising or the falling clock edge or in the center.
Fallback to bitbanging is already done for the CRT connector.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92685
Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/a39f080b-81a5-4c93-b3f7-7cb0a58daca3@rwthex-w2-a.rwth-ad.de
(cherry picked from commit cfb926e148e99acc02351d72e8b85e32b5f786ef)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_hdmi.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -1573,12 +1573,20 @@ intel_hdmi_set_edid(struct drm_connector
struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector);
struct edid *edid;
bool connected = false;
+ struct i2c_adapter *i2c;
intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS);
- edid = drm_get_edid(connector,
- intel_gmbus_get_adapter(dev_priv,
- intel_hdmi->ddc_bus));
+ i2c = intel_gmbus_get_adapter(dev_priv, intel_hdmi->ddc_bus);
+
+ edid = drm_get_edid(connector, i2c);
+
+ if (!edid && !intel_gmbus_is_forced_bit(i2c)) {
+ DRM_DEBUG_KMS("HDMI GMBUS EDID read failed, retry using GPIO bit-banging\n");
+ intel_gmbus_force_bit(i2c, true);
+ edid = drm_get_edid(connector, i2c);
+ intel_gmbus_force_bit(i2c, false);
+ }
intel_hdmi_dp_dual_mode_detect(connector, edid != NULL);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 016/146] drm/i915/perf: fix perf stream opening lock
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 015/146] drm/i915: Try EDID bitbanging on HDMI after failed read Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 017/146] scsi: core: Avoid that ATA error handling can trigger a kernel hang or oops Greg Kroah-Hartman
` (133 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lionel Landwerlin, Matthew Auld,
Chris Wilson, Jani Nikula, Joonas Lahtinen, Rodrigo Vivi,
intel-gfx
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
commit f616f2830c1ed79245cfeca900f7e8a3b3c08c06 upstream.
We're seeing on CI that some contexts don't have the programmed OA
period timer that directs the OA unit on how often to write reports.
The issue is that we're not holding the drm lock from when we edit the
context images down to when we set the exclusive_stream variable. This
leaves a window for the deferred context allocation to call
i915_oa_init_reg_state() that will not program the expected OA timer
value, because we haven't set the exclusive_stream yet.
v2: Drop need_lock from gen8_configure_all_contexts() (Matt)
Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Fixes: 701f8231a2f ("drm/i915/perf: prune OA configs")
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102254
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103715
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103755
Link: https://patchwork.freedesktop.org/patch/msgid/20180301110613.1737-1-lionel.g.landwerlin@intel.com
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: intel-gfx@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v4.14+
(cherry picked from commit 41d3fdcd15d5ecf29cc73e8b79c2327ebb54b960)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_perf.c | 38 ++++++++++++--------------------------
1 file changed, 12 insertions(+), 26 deletions(-)
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -1301,9 +1301,8 @@ static void i915_oa_stream_destroy(struc
*/
mutex_lock(&dev_priv->drm.struct_mutex);
dev_priv->perf.oa.exclusive_stream = NULL;
- mutex_unlock(&dev_priv->drm.struct_mutex);
-
dev_priv->perf.oa.ops.disable_metric_set(dev_priv);
+ mutex_unlock(&dev_priv->drm.struct_mutex);
free_oa_buffer(dev_priv);
@@ -1755,22 +1754,13 @@ static int gen8_switch_to_updated_kernel
* Note: it's only the RCS/Render context that has any OA state.
*/
static int gen8_configure_all_contexts(struct drm_i915_private *dev_priv,
- const struct i915_oa_config *oa_config,
- bool interruptible)
+ const struct i915_oa_config *oa_config)
{
struct i915_gem_context *ctx;
int ret;
unsigned int wait_flags = I915_WAIT_LOCKED;
- if (interruptible) {
- ret = i915_mutex_lock_interruptible(&dev_priv->drm);
- if (ret)
- return ret;
-
- wait_flags |= I915_WAIT_INTERRUPTIBLE;
- } else {
- mutex_lock(&dev_priv->drm.struct_mutex);
- }
+ lockdep_assert_held(&dev_priv->drm.struct_mutex);
/* Switch away from any user context. */
ret = gen8_switch_to_updated_kernel_context(dev_priv, oa_config);
@@ -1818,8 +1808,6 @@ static int gen8_configure_all_contexts(s
}
out:
- mutex_unlock(&dev_priv->drm.struct_mutex);
-
return ret;
}
@@ -1862,7 +1850,7 @@ static int gen8_enable_metric_set(struct
* to make sure all slices/subslices are ON before writing to NOA
* registers.
*/
- ret = gen8_configure_all_contexts(dev_priv, oa_config, true);
+ ret = gen8_configure_all_contexts(dev_priv, oa_config);
if (ret)
return ret;
@@ -1877,7 +1865,7 @@ static int gen8_enable_metric_set(struct
static void gen8_disable_metric_set(struct drm_i915_private *dev_priv)
{
/* Reset all contexts' slices/subslices configurations. */
- gen8_configure_all_contexts(dev_priv, NULL, false);
+ gen8_configure_all_contexts(dev_priv, NULL);
I915_WRITE(GDT_CHICKEN_BITS, (I915_READ(GDT_CHICKEN_BITS) &
~GT_NOA_ENABLE));
@@ -2127,6 +2115,10 @@ static int i915_oa_stream_init(struct i9
if (ret)
goto err_oa_buf_alloc;
+ ret = i915_mutex_lock_interruptible(&dev_priv->drm);
+ if (ret)
+ goto err_lock;
+
ret = dev_priv->perf.oa.ops.enable_metric_set(dev_priv,
stream->oa_config);
if (ret)
@@ -2134,23 +2126,17 @@ static int i915_oa_stream_init(struct i9
stream->ops = &i915_oa_stream_ops;
- /* Lock device for exclusive_stream access late because
- * enable_metric_set() might lock as well on gen8+.
- */
- ret = i915_mutex_lock_interruptible(&dev_priv->drm);
- if (ret)
- goto err_lock;
-
dev_priv->perf.oa.exclusive_stream = stream;
mutex_unlock(&dev_priv->drm.struct_mutex);
return 0;
-err_lock:
+err_enable:
dev_priv->perf.oa.ops.disable_metric_set(dev_priv);
+ mutex_unlock(&dev_priv->drm.struct_mutex);
-err_enable:
+err_lock:
free_oa_buffer(dev_priv);
err_oa_buf_alloc:
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 017/146] scsi: core: Avoid that ATA error handling can trigger a kernel hang or oops
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 016/146] drm/i915/perf: fix perf stream opening lock Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 018/146] scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS Greg Kroah-Hartman
` (132 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Natanael Copa, Damien Le Moal,
Bart Van Assche, Alexandre Oliva, Pavel Tikhomirov,
Hannes Reinecke, Johannes Thumshirn, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@wdc.com>
commit 3be8828fc507cdafe7040a3dcf361a2bcd8e305b upstream.
Avoid that the recently introduced call_rcu() call in the SCSI core
triggers a double call_rcu() call.
Reported-by: Natanael Copa <ncopa@alpinelinux.org>
Reported-by: Damien Le Moal <damien.lemoal@wdc.com>
References: https://bugzilla.kernel.org/show_bug.cgi?id=198861
Fixes: 3bd6f43f5cb3 ("scsi: core: Ensure that the SCSI error handler gets woken up")
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Tested-by: Damien Le Moal <damien.lemoal@wdc.com>
Cc: Natanael Copa <ncopa@alpinelinux.org>
Cc: Damien Le Moal <damien.lemoal@wdc.com>
Cc: Alexandre Oliva <oliva@gnu.org>
Cc: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Johannes Thumshirn <jthumshirn@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/hosts.c | 3 ---
drivers/scsi/scsi_error.c | 5 +++--
drivers/scsi/scsi_lib.c | 2 ++
include/scsi/scsi_cmnd.h | 3 +++
include/scsi/scsi_host.h | 2 --
5 files changed, 8 insertions(+), 7 deletions(-)
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -328,8 +328,6 @@ static void scsi_host_dev_release(struct
if (shost->work_q)
destroy_workqueue(shost->work_q);
- destroy_rcu_head(&shost->rcu);
-
if (shost->shost_state == SHOST_CREATED) {
/*
* Free the shost_dev device name here if scsi_host_alloc()
@@ -404,7 +402,6 @@ struct Scsi_Host *scsi_host_alloc(struct
INIT_LIST_HEAD(&shost->starved_list);
init_waitqueue_head(&shost->host_wait);
mutex_init(&shost->scan_mutex);
- init_rcu_head(&shost->rcu);
index = ida_simple_get(&host_index_ida, 0, 0, GFP_KERNEL);
if (index < 0)
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -222,7 +222,8 @@ static void scsi_eh_reset(struct scsi_cm
static void scsi_eh_inc_host_failed(struct rcu_head *head)
{
- struct Scsi_Host *shost = container_of(head, typeof(*shost), rcu);
+ struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu);
+ struct Scsi_Host *shost = scmd->device->host;
unsigned long flags;
spin_lock_irqsave(shost->host_lock, flags);
@@ -258,7 +259,7 @@ void scsi_eh_scmd_add(struct scsi_cmnd *
* Ensure that all tasks observe the host state change before the
* host_failed change.
*/
- call_rcu(&shost->rcu, scsi_eh_inc_host_failed);
+ call_rcu(&scmd->rcu, scsi_eh_inc_host_failed);
}
/**
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -670,6 +670,7 @@ static bool scsi_end_request(struct requ
if (!blk_rq_is_scsi(req)) {
WARN_ON_ONCE(!(cmd->flags & SCMD_INITIALIZED));
cmd->flags &= ~SCMD_INITIALIZED;
+ destroy_rcu_head(&cmd->rcu);
}
if (req->mq_ctx) {
@@ -1150,6 +1151,7 @@ void scsi_initialize_rq(struct request *
struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(rq);
scsi_req_init(&cmd->req);
+ init_rcu_head(&cmd->rcu);
cmd->jiffies_at_alloc = jiffies;
cmd->retries = 0;
}
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -69,6 +69,9 @@ struct scsi_cmnd {
struct list_head list; /* scsi_cmnd participates in queue lists */
struct list_head eh_entry; /* entry for the host eh_cmd_q */
struct delayed_work abort_work;
+
+ struct rcu_head rcu;
+
int eh_eflags; /* Used by error handlr */
/*
--- a/include/scsi/scsi_host.h
+++ b/include/scsi/scsi_host.h
@@ -571,8 +571,6 @@ struct Scsi_Host {
struct blk_mq_tag_set tag_set;
};
- struct rcu_head rcu;
-
atomic_t host_busy; /* commands actually active on low-level */
atomic_t host_blocked;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 018/146] scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 017/146] scsi: core: Avoid that ATA error handling can trigger a kernel hang or oops Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 019/146] drm/i915: Always call to intel_display_set_init_power() in resume_early Greg Kroah-Hartman
` (131 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Johannes Thumshirn,
Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: himanshu.madhani@cavium.com <himanshu.madhani@cavium.com>
commit 1514839b366417934e2f1328edb50ed1e8a719f5 upstream.
This patch fixes NULL pointer crash due to active timer running for abort
IOCB.
>From crash dump analysis it was discoverd that get_next_timer_interrupt()
encountered a corrupted entry on the timer list.
#9 [ffff95e1f6f0fd40] page_fault at ffffffff914fe8f8
[exception RIP: get_next_timer_interrupt+440]
RIP: ffffffff90ea3088 RSP: ffff95e1f6f0fdf0 RFLAGS: 00010013
RAX: ffff95e1f6451028 RBX: 000218e2389e5f40 RCX: 00000001232ad600
RDX: 0000000000000001 RSI: ffff95e1f6f0fdf0 RDI: 0000000001232ad6
RBP: ffff95e1f6f0fe40 R8: ffff95e1f6451188 R9: 0000000000000001
R10: 0000000000000016 R11: 0000000000000016 R12: 00000001232ad5f6
R13: ffff95e1f6450000 R14: ffff95e1f6f0fdf8 R15: ffff95e1f6f0fe10
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
Looking at the assembly of get_next_timer_interrupt(), address came
from %r8 (ffff95e1f6451188) which is pointing to list_head with single
entry at ffff95e5ff621178.
0xffffffff90ea307a <get_next_timer_interrupt+426>: mov (%r8),%rdx
0xffffffff90ea307d <get_next_timer_interrupt+429>: cmp %r8,%rdx
0xffffffff90ea3080 <get_next_timer_interrupt+432>: je 0xffffffff90ea30a7 <get_next_timer_interrupt+471>
0xffffffff90ea3082 <get_next_timer_interrupt+434>: nopw 0x0(%rax,%rax,1)
0xffffffff90ea3088 <get_next_timer_interrupt+440>: testb $0x1,0x18(%rdx)
crash> rd ffff95e1f6451188 10
ffff95e1f6451188: ffff95e5ff621178 ffff95e5ff621178 x.b.....x.b.....
ffff95e1f6451198: ffff95e1f6451198 ffff95e1f6451198 ..E.......E.....
ffff95e1f64511a8: ffff95e1f64511a8 ffff95e1f64511a8 ..E.......E.....
ffff95e1f64511b8: ffff95e77cf509a0 ffff95e77cf509a0 ...|.......|....
ffff95e1f64511c8: ffff95e1f64511c8 ffff95e1f64511c8 ..E.......E.....
crash> rd ffff95e5ff621178 10
ffff95e5ff621178: 0000000000000001 ffff95e15936aa00 ..........6Y....
ffff95e5ff621188: 0000000000000000 00000000ffffffff ................
ffff95e5ff621198: 00000000000000a0 0000000000000010 ................
ffff95e5ff6211a8: ffff95e5ff621198 000000000000000c ..b.............
ffff95e5ff6211b8: 00000f5800000000 ffff95e751f8d720 ....X... ..Q....
ffff95e5ff621178 belongs to freed mempool object at ffff95e5ff621080.
CACHE NAME OBJSIZE ALLOCATED TOTAL SLABS SSIZE
ffff95dc7fd74d00 mnt_cache 384 19785 24948 594 16k
SLAB MEMORY NODE TOTAL ALLOCATED FREE
ffffdc5dabfd8800 ffff95e5ff620000 1 42 29 13
FREE / [ALLOCATED]
ffff95e5ff621080 (cpu 6 cache)
Examining the contents of that memory reveals a pointer to a constant string
in the driver, "abort\0", which is set by qla24xx_async_abort_cmd().
crash> rd ffffffffc059277c 20
ffffffffc059277c: 6e490074726f6261 0074707572726574 abort.Interrupt.
ffffffffc059278c: 00676e696c6c6f50 6920726576697244 Polling.Driver i
ffffffffc059279c: 646f6d207325206e 6974736554000a65 n %s mode..Testi
ffffffffc05927ac: 636976656420676e 786c252074612065 ng device at %lx
ffffffffc05927bc: 6b63656843000a2e 646f727020676e69 ...Checking prod
ffffffffc05927cc: 6f20444920746375 0a2e706968632066 uct ID of chip..
ffffffffc05927dc: 5120646e756f4600 204130303232414c .Found QLA2200A
ffffffffc05927ec: 43000a2e70696843 20676e696b636568 Chip...Checking
ffffffffc05927fc: 65786f626c69616d 6c636e69000a2e73 mailboxes...incl
ffffffffc059280c: 756e696c2f656475 616d2d616d642f78 ude/linux/dma-ma
crash> struct -ox srb_iocb
struct srb_iocb {
union {
struct {...} logio;
struct {...} els_logo;
struct {...} tmf;
struct {...} fxiocb;
struct {...} abt;
struct ct_arg ctarg;
struct {...} mbx;
struct {...} nack;
[0x0 ] } u;
[0xb8] struct timer_list timer;
[0x108] void (*timeout)(void *);
}
SIZE: 0x110
crash> ! bc
ibase=16
obase=10
B8+40
F8
The object is a srb_t, and at offset 0xf8 within that structure
(i.e. ffff95e5ff621080 + f8 -> ffff95e5ff621178) is a struct timer_list.
Cc: <stable@vger.kernel.org> #4.4+
Fixes: 4440e46d5db7 ("[SCSI] qla2xxx: Add IOCB Abort command asynchronous handling.")
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_init.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1347,6 +1347,7 @@ qla24xx_abort_sp_done(void *ptr, int res
srb_t *sp = ptr;
struct srb_iocb *abt = &sp->u.iocb_cmd;
+ del_timer(&sp->u.iocb_cmd.timer);
complete(&abt->u.abt.comp);
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 019/146] drm/i915: Always call to intel_display_set_init_power() in resume_early.
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 018/146] scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 020/146] workqueue: Allow retrieval of current tasks work struct Greg Kroah-Hartman
` (130 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maarten Lankhorst,
Nivedita Swaminathan, Imre Deak, Patrik Jakobsson, Jani Nikula,
Joonas Lahtinen, Rodrigo Vivi
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
commit d13a8479f3584613b6aacbb793eae64578b8f69a upstream.
intel_power_domains_init_hw() calls set_init_power, but when using
runtime power management this call is skipped. This prevents hw readout
from taking place.
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=104172
Link: https://patchwork.freedesktop.org/patch/msgid/20180116155324.75120-1-maarten.lankhorst@linux.intel.com
Fixes: bc87229f323e ("drm/i915/skl: enable PC9/10 power states during suspend-to-idle")
Cc: Nivedita Swaminathan <nivedita.swaminathan@intel.com>
Cc: Imre Deak <imre.deak@intel.com>
Cc: Patrik Jakobsson <patrik.jakobsson@linux.intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: <stable@vger.kernel.org> # v4.5+
Reviewed-by: Imre Deak <imre.deak@intel.com>
(cherry picked from commit ac25dfed15d470d7f23dd817e965b54aa3f94a1e)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_drv.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1827,6 +1827,8 @@ static int i915_drm_resume_early(struct
if (IS_GEN9_LP(dev_priv) ||
!(dev_priv->suspended_to_idle && dev_priv->csr.dmc_payload))
intel_power_domains_init_hw(dev_priv, true);
+ else
+ intel_display_set_init_power(dev_priv, true);
i915_gem_sanitize(dev_priv);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 020/146] workqueue: Allow retrieval of current tasks work struct
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 019/146] drm/i915: Always call to intel_display_set_init_power() in resume_early Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 021/146] drm: Allow determining if current task is output poll worker Greg Kroah-Hartman
` (129 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lai Jiangshan, Dave Airlie,
Ben Skeggs, Alex Deucher, Tejun Heo, Lyude Paul, Lukas Wunner
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 27d4ee03078aba88c5e07dcc4917e8d01d046f38 upstream.
Introduce a helper to retrieve the current task's work struct if it is
a workqueue worker.
This allows us to fix a long-standing deadlock in several DRM drivers
wherein the ->runtime_suspend callback waits for a specific worker to
finish and that worker in turn calls a function which waits for runtime
suspend to finish. That function is invoked from multiple call sites
and waiting for runtime suspend to finish is the correct thing to do
except if it's executing in the context of the worker.
Cc: Lai Jiangshan <jiangshanlai@gmail.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Link: https://patchwork.freedesktop.org/patch/msgid/2d8f603074131eb87e588d2b803a71765bd3a2fd.1518338788.git.lukas@wunner.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/workqueue.h | 1 +
kernel/workqueue.c | 16 ++++++++++++++++
2 files changed, 17 insertions(+)
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
@@ -465,6 +465,7 @@ extern bool cancel_delayed_work_sync(str
extern void workqueue_set_max_active(struct workqueue_struct *wq,
int max_active);
+extern struct work_struct *current_work(void);
extern bool current_is_workqueue_rescuer(void);
extern bool workqueue_congested(int cpu, struct workqueue_struct *wq);
extern unsigned int work_busy(struct work_struct *work);
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -4169,6 +4169,22 @@ void workqueue_set_max_active(struct wor
EXPORT_SYMBOL_GPL(workqueue_set_max_active);
/**
+ * current_work - retrieve %current task's work struct
+ *
+ * Determine if %current task is a workqueue worker and what it's working on.
+ * Useful to find out the context that the %current task is running in.
+ *
+ * Return: work struct if %current task is a workqueue worker, %NULL otherwise.
+ */
+struct work_struct *current_work(void)
+{
+ struct worker *worker = current_wq_worker();
+
+ return worker ? worker->current_work : NULL;
+}
+EXPORT_SYMBOL(current_work);
+
+/**
* current_is_workqueue_rescuer - is %current workqueue rescuer?
*
* Determine whether %current is a workqueue rescuer. Can be used from
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 021/146] drm: Allow determining if current task is output poll worker
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 020/146] workqueue: Allow retrieval of current tasks work struct Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 022/146] drm/nouveau: Fix deadlock on runtime suspend Greg Kroah-Hartman
` (128 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Airlie, Ben Skeggs,
Alex Deucher, Lyude Paul, Lukas Wunner
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 25c058ccaf2ebbc3e250ec1e199e161f91fe27d4 upstream.
Introduce a helper to determine if the current task is an output poll
worker.
This allows us to fix a long-standing deadlock in several DRM drivers
wherein the ->runtime_suspend callback waits for the output poll worker
to finish and the worker in turn calls a ->detect callback which waits
for runtime suspend to finish. The ->detect callback is invoked from
multiple call sites and waiting for runtime suspend to finish is the
correct thing to do except if it's executing in the context of the
worker.
v2: Expand kerneldoc to specifically mention deadlock between
output poll worker and autosuspend worker as use case. (Lyude)
Cc: Dave Airlie <airlied@redhat.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Link: https://patchwork.freedesktop.org/patch/msgid/3549ce32e7f1467102e70d3e9cbf70c46bfe108e.1518593424.git.lukas@wunner.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_probe_helper.c | 20 ++++++++++++++++++++
include/drm/drm_crtc_helper.h | 1 +
2 files changed, 21 insertions(+)
--- a/drivers/gpu/drm/drm_probe_helper.c
+++ b/drivers/gpu/drm/drm_probe_helper.c
@@ -655,6 +655,26 @@ out:
}
/**
+ * drm_kms_helper_is_poll_worker - is %current task an output poll worker?
+ *
+ * Determine if %current task is an output poll worker. This can be used
+ * to select distinct code paths for output polling versus other contexts.
+ *
+ * One use case is to avoid a deadlock between the output poll worker and
+ * the autosuspend worker wherein the latter waits for polling to finish
+ * upon calling drm_kms_helper_poll_disable(), while the former waits for
+ * runtime suspend to finish upon calling pm_runtime_get_sync() in a
+ * connector ->detect hook.
+ */
+bool drm_kms_helper_is_poll_worker(void)
+{
+ struct work_struct *work = current_work();
+
+ return work && work->func == output_poll_execute;
+}
+EXPORT_SYMBOL(drm_kms_helper_is_poll_worker);
+
+/**
* drm_kms_helper_poll_disable - disable output polling
* @dev: drm_device
*
--- a/include/drm/drm_crtc_helper.h
+++ b/include/drm/drm_crtc_helper.h
@@ -77,5 +77,6 @@ void drm_kms_helper_hotplug_event(struct
void drm_kms_helper_poll_disable(struct drm_device *dev);
void drm_kms_helper_poll_enable(struct drm_device *dev);
+bool drm_kms_helper_is_poll_worker(void);
#endif
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 022/146] drm/nouveau: Fix deadlock on runtime suspend
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 021/146] drm: Allow determining if current task is output poll worker Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 023/146] drm/radeon: " Greg Kroah-Hartman
` (127 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ben Skeggs, Dave Airlie, Lyude Paul,
Lukas Wunner
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit d61a5c1063515e855bedb1b81e20e50b0ac3541e upstream.
nouveau's ->runtime_suspend hook calls drm_kms_helper_poll_disable(),
which waits for the output poll worker to finish if it's running.
The output poll worker meanwhile calls pm_runtime_get_sync() in
nouveau_connector_detect() which waits for the ongoing suspend to finish,
causing a deadlock.
Fix by not acquiring a runtime PM ref if nouveau_connector_detect() is
called in the output poll worker's context. This is safe because
the poll worker is only enabled while runtime active and we know that
->runtime_suspend waits for it to finish.
Other contexts calling nouveau_connector_detect() do require a runtime
PM ref, these comprise:
status_store() drm sysfs interface
->fill_modes drm callback
drm_fb_helper_probe_connector_modes()
drm_mode_getconnector()
nouveau_connector_hotplug()
nouveau_display_hpd_work()
nv17_tv_set_property()
Stack trace for posterity:
INFO: task kworker/0:1:58 blocked for more than 120 seconds.
Workqueue: events output_poll_execute [drm_kms_helper]
Call Trace:
schedule+0x28/0x80
rpm_resume+0x107/0x6e0
__pm_runtime_resume+0x47/0x70
nouveau_connector_detect+0x7e/0x4a0 [nouveau]
nouveau_connector_detect_lvds+0x132/0x180 [nouveau]
drm_helper_probe_detect_ctx+0x85/0xd0 [drm_kms_helper]
output_poll_execute+0x11e/0x1c0 [drm_kms_helper]
process_one_work+0x184/0x380
worker_thread+0x2e/0x390
INFO: task kworker/0:2:252 blocked for more than 120 seconds.
Workqueue: pm pm_runtime_work
Call Trace:
schedule+0x28/0x80
schedule_timeout+0x1e3/0x370
wait_for_completion+0x123/0x190
flush_work+0x142/0x1c0
nouveau_pmops_runtime_suspend+0x7e/0xd0 [nouveau]
pci_pm_runtime_suspend+0x5c/0x180
vga_switcheroo_runtime_suspend+0x1e/0xa0
__rpm_callback+0xc1/0x200
rpm_callback+0x1f/0x70
rpm_suspend+0x13c/0x640
pm_runtime_work+0x6e/0x90
process_one_work+0x184/0x380
worker_thread+0x2e/0x390
Bugzilla: https://bugs.archlinux.org/task/53497
Bugzilla: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870523
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70388#c33
Fixes: 5addcf0a5f0f ("nouveau: add runtime PM support (v0.9)")
Cc: stable@vger.kernel.org # v3.12+: 27d4ee03078a: workqueue: Allow retrieval of current task's work struct
Cc: stable@vger.kernel.org # v3.12+: 25c058ccaf2e: drm: Allow determining if current task is output poll worker
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: Dave Airlie <airlied@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Link: https://patchwork.freedesktop.org/patch/msgid/b7d2cbb609a80f59ccabfdf479b9d5907c603ea1.1518338789.git.lukas@wunner.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_connector.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -570,9 +570,15 @@ nouveau_connector_detect(struct drm_conn
nv_connector->edid = NULL;
}
- ret = pm_runtime_get_sync(connector->dev->dev);
- if (ret < 0 && ret != -EACCES)
- return conn_status;
+ /* Outputs are only polled while runtime active, so acquiring a
+ * runtime PM ref here is unnecessary (and would deadlock upon
+ * runtime suspend because it waits for polling to finish).
+ */
+ if (!drm_kms_helper_is_poll_worker()) {
+ ret = pm_runtime_get_sync(connector->dev->dev);
+ if (ret < 0 && ret != -EACCES)
+ return conn_status;
+ }
nv_encoder = nouveau_connector_ddc_detect(connector);
if (nv_encoder && (i2c = nv_encoder->i2c) != NULL) {
@@ -647,8 +653,10 @@ detect_analog:
out:
- pm_runtime_mark_last_busy(connector->dev->dev);
- pm_runtime_put_autosuspend(connector->dev->dev);
+ if (!drm_kms_helper_is_poll_worker()) {
+ pm_runtime_mark_last_busy(connector->dev->dev);
+ pm_runtime_put_autosuspend(connector->dev->dev);
+ }
return conn_status;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 023/146] drm/radeon: Fix deadlock on runtime suspend
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 022/146] drm/nouveau: Fix deadlock on runtime suspend Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 024/146] drm/amdgpu: " Greg Kroah-Hartman
` (126 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ismo Toijala, Alex Deucher,
Dave Airlie, Lyude Paul, Lukas Wunner
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 15734feff2bdac24aa3266c437cffa42851990e3 upstream.
radeon's ->runtime_suspend hook calls drm_kms_helper_poll_disable(),
which waits for the output poll worker to finish if it's running.
The output poll worker meanwhile calls pm_runtime_get_sync() in
radeon's ->detect hooks, which waits for the ongoing suspend to finish,
causing a deadlock.
Fix by not acquiring a runtime PM ref if the ->detect hooks are called
in the output poll worker's context. This is safe because the poll
worker is only enabled while runtime active and we know that
->runtime_suspend waits for it to finish.
Stack trace for posterity:
INFO: task kworker/0:3:31847 blocked for more than 120 seconds
Workqueue: events output_poll_execute [drm_kms_helper]
Call Trace:
schedule+0x3c/0x90
rpm_resume+0x1e2/0x690
__pm_runtime_resume+0x3f/0x60
radeon_lvds_detect+0x39/0xf0 [radeon]
output_poll_execute+0xda/0x1e0 [drm_kms_helper]
process_one_work+0x14b/0x440
worker_thread+0x48/0x4a0
INFO: task kworker/2:0:10493 blocked for more than 120 seconds.
Workqueue: pm pm_runtime_work
Call Trace:
schedule+0x3c/0x90
schedule_timeout+0x1b3/0x240
wait_for_common+0xc2/0x180
wait_for_completion+0x1d/0x20
flush_work+0xfc/0x1a0
__cancel_work_timer+0xa5/0x1d0
cancel_delayed_work_sync+0x13/0x20
drm_kms_helper_poll_disable+0x1f/0x30 [drm_kms_helper]
radeon_pmops_runtime_suspend+0x3d/0xa0 [radeon]
pci_pm_runtime_suspend+0x61/0x1a0
vga_switcheroo_runtime_suspend+0x21/0x70
__rpm_callback+0x32/0x70
rpm_callback+0x24/0x80
rpm_suspend+0x12b/0x640
pm_runtime_work+0x6f/0xb0
process_one_work+0x14b/0x440
worker_thread+0x48/0x4a0
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94147
Fixes: 10ebc0bc0934 ("drm/radeon: add runtime PM support (v2)")
Cc: stable@vger.kernel.org # v3.13+: 27d4ee03078a: workqueue: Allow retrieval of current task's work struct
Cc: stable@vger.kernel.org # v3.13+: 25c058ccaf2e: drm: Allow determining if current task is output poll worker
Cc: Ismo Toijala <ismo.toijala@gmail.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Dave Airlie <airlied@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Link: https://patchwork.freedesktop.org/patch/msgid/64ea02c44f91dda19bc563902b97bbc699040392.1518338789.git.lukas@wunner.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_connectors.c | 74 +++++++++++++++++++----------
1 file changed, 49 insertions(+), 25 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -900,9 +900,11 @@ radeon_lvds_detect(struct drm_connector
enum drm_connector_status ret = connector_status_disconnected;
int r;
- r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
- return connector_status_disconnected;
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+ if (r < 0)
+ return connector_status_disconnected;
+ }
if (encoder) {
struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
@@ -925,8 +927,12 @@ radeon_lvds_detect(struct drm_connector
/* check acpi lid status ??? */
radeon_connector_update_scratch_regs(connector, ret);
- pm_runtime_mark_last_busy(connector->dev->dev);
- pm_runtime_put_autosuspend(connector->dev->dev);
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ pm_runtime_mark_last_busy(connector->dev->dev);
+ pm_runtime_put_autosuspend(connector->dev->dev);
+ }
+
return ret;
}
@@ -1040,9 +1046,11 @@ radeon_vga_detect(struct drm_connector *
enum drm_connector_status ret = connector_status_disconnected;
int r;
- r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
- return connector_status_disconnected;
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+ if (r < 0)
+ return connector_status_disconnected;
+ }
encoder = radeon_best_single_encoder(connector);
if (!encoder)
@@ -1109,8 +1117,10 @@ radeon_vga_detect(struct drm_connector *
radeon_connector_update_scratch_regs(connector, ret);
out:
- pm_runtime_mark_last_busy(connector->dev->dev);
- pm_runtime_put_autosuspend(connector->dev->dev);
+ if (!drm_kms_helper_is_poll_worker()) {
+ pm_runtime_mark_last_busy(connector->dev->dev);
+ pm_runtime_put_autosuspend(connector->dev->dev);
+ }
return ret;
}
@@ -1174,9 +1184,11 @@ radeon_tv_detect(struct drm_connector *c
if (!radeon_connector->dac_load_detect)
return ret;
- r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
- return connector_status_disconnected;
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+ if (r < 0)
+ return connector_status_disconnected;
+ }
encoder = radeon_best_single_encoder(connector);
if (!encoder)
@@ -1188,8 +1200,12 @@ radeon_tv_detect(struct drm_connector *c
if (ret == connector_status_connected)
ret = radeon_connector_analog_encoder_conflict_solve(connector, encoder, ret, false);
radeon_connector_update_scratch_regs(connector, ret);
- pm_runtime_mark_last_busy(connector->dev->dev);
- pm_runtime_put_autosuspend(connector->dev->dev);
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ pm_runtime_mark_last_busy(connector->dev->dev);
+ pm_runtime_put_autosuspend(connector->dev->dev);
+ }
+
return ret;
}
@@ -1252,9 +1268,11 @@ radeon_dvi_detect(struct drm_connector *
enum drm_connector_status ret = connector_status_disconnected;
bool dret = false, broken_edid = false;
- r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
- return connector_status_disconnected;
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+ if (r < 0)
+ return connector_status_disconnected;
+ }
if (radeon_connector->detected_hpd_without_ddc) {
force = true;
@@ -1437,8 +1455,10 @@ out:
}
exit:
- pm_runtime_mark_last_busy(connector->dev->dev);
- pm_runtime_put_autosuspend(connector->dev->dev);
+ if (!drm_kms_helper_is_poll_worker()) {
+ pm_runtime_mark_last_busy(connector->dev->dev);
+ pm_runtime_put_autosuspend(connector->dev->dev);
+ }
return ret;
}
@@ -1689,9 +1709,11 @@ radeon_dp_detect(struct drm_connector *c
if (radeon_dig_connector->is_mst)
return connector_status_disconnected;
- r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
- return connector_status_disconnected;
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+ if (r < 0)
+ return connector_status_disconnected;
+ }
if (!force && radeon_check_hpd_status_unchanged(connector)) {
ret = connector->status;
@@ -1778,8 +1800,10 @@ radeon_dp_detect(struct drm_connector *c
}
out:
- pm_runtime_mark_last_busy(connector->dev->dev);
- pm_runtime_put_autosuspend(connector->dev->dev);
+ if (!drm_kms_helper_is_poll_worker()) {
+ pm_runtime_mark_last_busy(connector->dev->dev);
+ pm_runtime_put_autosuspend(connector->dev->dev);
+ }
return ret;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 024/146] drm/amdgpu: Fix deadlock on runtime suspend
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 023/146] drm/radeon: " Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 025/146] drm/nouveau: prefer XBGR2101010 for addfb ioctl Greg Kroah-Hartman
` (125 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Deucher, Mike Lothian,
Lyude Paul, Lukas Wunner
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit aa0aad57909eb321746325951d66af88a83bc956 upstream.
amdgpu's ->runtime_suspend hook calls drm_kms_helper_poll_disable(),
which waits for the output poll worker to finish if it's running.
The output poll worker meanwhile calls pm_runtime_get_sync() in
amdgpu's ->detect hooks, which waits for the ongoing suspend to finish,
causing a deadlock.
Fix by not acquiring a runtime PM ref if the ->detect hooks are called
in the output poll worker's context. This is safe because the poll
worker is only enabled while runtime active and we know that
->runtime_suspend waits for it to finish.
Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
Cc: stable@vger.kernel.org # v4.2+: 27d4ee03078a: workqueue: Allow retrieval of current task's work struct
Cc: stable@vger.kernel.org # v4.2+: 25c058ccaf2e: drm: Allow determining if current task is output poll worker
Cc: Alex Deucher <alexander.deucher@amd.com>
Tested-by: Mike Lothian <mike@fireburn.co.uk>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Link: https://patchwork.freedesktop.org/patch/msgid/4c9bf72aacae1eef062bd134cd112e0770a7f121.1518338789.git.lukas@wunner.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 58 ++++++++++++++++---------
1 file changed, 38 insertions(+), 20 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -737,9 +737,11 @@ amdgpu_connector_lvds_detect(struct drm_
enum drm_connector_status ret = connector_status_disconnected;
int r;
- r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
- return connector_status_disconnected;
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+ if (r < 0)
+ return connector_status_disconnected;
+ }
if (encoder) {
struct amdgpu_encoder *amdgpu_encoder = to_amdgpu_encoder(encoder);
@@ -758,8 +760,12 @@ amdgpu_connector_lvds_detect(struct drm_
/* check acpi lid status ??? */
amdgpu_connector_update_scratch_regs(connector, ret);
- pm_runtime_mark_last_busy(connector->dev->dev);
- pm_runtime_put_autosuspend(connector->dev->dev);
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ pm_runtime_mark_last_busy(connector->dev->dev);
+ pm_runtime_put_autosuspend(connector->dev->dev);
+ }
+
return ret;
}
@@ -869,9 +875,11 @@ amdgpu_connector_vga_detect(struct drm_c
enum drm_connector_status ret = connector_status_disconnected;
int r;
- r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
- return connector_status_disconnected;
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+ if (r < 0)
+ return connector_status_disconnected;
+ }
encoder = amdgpu_connector_best_single_encoder(connector);
if (!encoder)
@@ -925,8 +933,10 @@ amdgpu_connector_vga_detect(struct drm_c
amdgpu_connector_update_scratch_regs(connector, ret);
out:
- pm_runtime_mark_last_busy(connector->dev->dev);
- pm_runtime_put_autosuspend(connector->dev->dev);
+ if (!drm_kms_helper_is_poll_worker()) {
+ pm_runtime_mark_last_busy(connector->dev->dev);
+ pm_runtime_put_autosuspend(connector->dev->dev);
+ }
return ret;
}
@@ -989,9 +999,11 @@ amdgpu_connector_dvi_detect(struct drm_c
enum drm_connector_status ret = connector_status_disconnected;
bool dret = false, broken_edid = false;
- r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
- return connector_status_disconnected;
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+ if (r < 0)
+ return connector_status_disconnected;
+ }
if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
ret = connector->status;
@@ -1116,8 +1128,10 @@ out:
amdgpu_connector_update_scratch_regs(connector, ret);
exit:
- pm_runtime_mark_last_busy(connector->dev->dev);
- pm_runtime_put_autosuspend(connector->dev->dev);
+ if (!drm_kms_helper_is_poll_worker()) {
+ pm_runtime_mark_last_busy(connector->dev->dev);
+ pm_runtime_put_autosuspend(connector->dev->dev);
+ }
return ret;
}
@@ -1360,9 +1374,11 @@ amdgpu_connector_dp_detect(struct drm_co
struct drm_encoder *encoder = amdgpu_connector_best_single_encoder(connector);
int r;
- r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
- return connector_status_disconnected;
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+ if (r < 0)
+ return connector_status_disconnected;
+ }
if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
ret = connector->status;
@@ -1430,8 +1446,10 @@ amdgpu_connector_dp_detect(struct drm_co
amdgpu_connector_update_scratch_regs(connector, ret);
out:
- pm_runtime_mark_last_busy(connector->dev->dev);
- pm_runtime_put_autosuspend(connector->dev->dev);
+ if (!drm_kms_helper_is_poll_worker()) {
+ pm_runtime_mark_last_busy(connector->dev->dev);
+ pm_runtime_put_autosuspend(connector->dev->dev);
+ }
return ret;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 025/146] drm/nouveau: prefer XBGR2101010 for addfb ioctl
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 024/146] drm/amdgpu: " Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 026/146] drm/amd/powerplay/smu7: allow mclk switching with no displays Greg Kroah-Hartman
` (124 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ilia Mirkin, Ben Skeggs, Daniel Vetter
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilia Mirkin <imirkin@alum.mit.edu>
commit c20bb155c2c5acb775f68be5d84fe679687c3c1e upstream.
Nouveau only exposes support for XBGR2101010. Prior to the atomic
conversion, drm would pass in the wrong format in the framebuffer, but
it was always ignored -- both userspace (xf86-video-nouveau) and the
kernel driver agreed on the layout, so the fact that the format was
wrong didn't matter.
With the atomic conversion, nouveau all of a sudden started caring about
the exact format, and so the previously-working code in
xf86-video-nouveau no longer functioned since the (internally-assigned)
format from the addfb ioctl was wrong.
This change adds infrastructure to allow a drm driver to specify that it
prefers the XBGR format variant for the addfb ioctl, and makes nouveau's
nv50 display driver set it. (Prior gens had no support for 30bpp at all.)
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Cc: stable@vger.kernel.org # v4.10+
Acked-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20180203191123.31507-1-imirkin@alum.mit.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_framebuffer.c | 4 ++++
drivers/gpu/drm/nouveau/nv50_display.c | 1 +
include/drm/drm_drv.h | 1 +
3 files changed, 6 insertions(+)
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -118,6 +118,10 @@ int drm_mode_addfb(struct drm_device *de
r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
r.handles[0] = or->handle;
+ if (r.pixel_format == DRM_FORMAT_XRGB2101010 &&
+ dev->driver->driver_features & DRIVER_PREFER_XBGR_30BPP)
+ r.pixel_format = DRM_FORMAT_XBGR2101010;
+
ret = drm_mode_addfb2(dev, &r, file_priv);
if (ret)
return ret;
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -4426,6 +4426,7 @@ nv50_display_create(struct drm_device *d
nouveau_display(dev)->fini = nv50_display_fini;
disp->disp = &nouveau_display(dev)->disp;
dev->mode_config.funcs = &nv50_disp_func;
+ dev->driver->driver_features |= DRIVER_PREFER_XBGR_30BPP;
if (nouveau_atomic)
dev->driver->driver_features |= DRIVER_ATOMIC;
--- a/include/drm/drm_drv.h
+++ b/include/drm/drm_drv.h
@@ -55,6 +55,7 @@ struct drm_mode_create_dumb;
#define DRIVER_ATOMIC 0x10000
#define DRIVER_KMS_LEGACY_CONTEXT 0x20000
#define DRIVER_SYNCOBJ 0x40000
+#define DRIVER_PREFER_XBGR_30BPP 0x80000
/**
* struct drm_driver - DRM driver structure
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 026/146] drm/amd/powerplay/smu7: allow mclk switching with no displays
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 025/146] drm/nouveau: prefer XBGR2101010 for addfb ioctl Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 027/146] drm/amd/powerplay/vega10: " Greg Kroah-Hartman
` (123 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Huang, Alex Deucher
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 51954e17914aaadf18d97b21c2a2cee16fa29513 upstream.
If there are no displays attached, there is no reason to disable
mclk switching.
Fixes mclks getting set to high when there are no displays attached.
Reviewed-by: Eric Huang <JinhuiEric.Huang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -2791,10 +2791,13 @@ static int smu7_apply_state_adjust_rules
PHM_PlatformCaps_DisableMclkSwitchingForFrameLock);
- disable_mclk_switching = ((1 < info.display_count) ||
- disable_mclk_switching_for_frame_lock ||
- smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) ||
- (mode_info.refresh_rate > 120));
+ if (info.display_count == 0)
+ disable_mclk_switching = false;
+ else
+ disable_mclk_switching = ((1 < info.display_count) ||
+ disable_mclk_switching_for_frame_lock ||
+ smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) ||
+ (mode_info.refresh_rate > 120));
sclk = smu7_ps->performance_levels[0].engine_clock;
mclk = smu7_ps->performance_levels[0].memory_clock;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 027/146] drm/amd/powerplay/vega10: allow mclk switching with no displays
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 026/146] drm/amd/powerplay/smu7: allow mclk switching with no displays Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 028/146] Revert "drm/radeon/pm: autoswitch power state when in balanced mode" Greg Kroah-Hartman
` (122 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Huang, Alex Deucher
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 5825acf5c958a6820b04e9811caeb2f5e572bcd8 upstream.
If there are no displays attached, there is no reason to disable
mclk switching.
Fixes mclks getting set to high when there are no displays attached.
Reviewed-by: Eric Huang <JinhuiEric.Huang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -3208,10 +3208,13 @@ static int vega10_apply_state_adjust_rul
disable_mclk_switching_for_vr = PP_CAP(PHM_PlatformCaps_DisableMclkSwitchForVR);
force_mclk_high = PP_CAP(PHM_PlatformCaps_ForceMclkHigh);
- disable_mclk_switching = (info.display_count > 1) ||
- disable_mclk_switching_for_frame_lock ||
- disable_mclk_switching_for_vr ||
- force_mclk_high;
+ if (info.display_count == 0)
+ disable_mclk_switching = false;
+ else
+ disable_mclk_switching = (info.display_count > 1) ||
+ disable_mclk_switching_for_frame_lock ||
+ disable_mclk_switching_for_vr ||
+ force_mclk_high;
sclk = vega10_ps->performance_levels[0].gfx_clock;
mclk = vega10_ps->performance_levels[0].mem_clock;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 028/146] Revert "drm/radeon/pm: autoswitch power state when in balanced mode"
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 027/146] drm/amd/powerplay/vega10: " Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 029/146] drm/amd/display: check for ipp before calling cursor operations Greg Kroah-Hartman
` (121 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 53bf277b487eb5ae6695db01bede0fe406792119 upstream.
This reverts commit 1c331f75aa6ccbf64ebcc5a019183e617c9d818a.
Breaks resume on some systems.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100759
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_pm.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -47,7 +47,6 @@ static bool radeon_pm_in_vbl(struct rade
static bool radeon_pm_debug_check_in_vbl(struct radeon_device *rdev, bool finish);
static void radeon_pm_update_profile(struct radeon_device *rdev);
static void radeon_pm_set_clocks(struct radeon_device *rdev);
-static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev);
int radeon_pm_get_type_index(struct radeon_device *rdev,
enum radeon_pm_state_type ps_type,
@@ -80,8 +79,6 @@ void radeon_pm_acpi_event_handler(struct
radeon_dpm_enable_bapm(rdev, rdev->pm.dpm.ac_power);
}
mutex_unlock(&rdev->pm.mutex);
- /* allow new DPM state to be picked */
- radeon_pm_compute_clocks_dpm(rdev);
} else if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
if (rdev->pm.profile == PM_PROFILE_AUTO) {
mutex_lock(&rdev->pm.mutex);
@@ -885,8 +882,7 @@ static struct radeon_ps *radeon_dpm_pick
dpm_state = POWER_STATE_TYPE_INTERNAL_3DPERF;
/* balanced states don't exist at the moment */
if (dpm_state == POWER_STATE_TYPE_BALANCED)
- dpm_state = rdev->pm.dpm.ac_power ?
- POWER_STATE_TYPE_PERFORMANCE : POWER_STATE_TYPE_BATTERY;
+ dpm_state = POWER_STATE_TYPE_PERFORMANCE;
restart_search:
/* Pick the best power state based on current conditions */
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 029/146] drm/amd/display: check for ipp before calling cursor operations
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 028/146] Revert "drm/radeon/pm: autoswitch power state when in balanced mode" Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 030/146] drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE Greg Kroah-Hartman
` (120 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shirish S, Harry Wentland, Alex Deucher
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shirish S <shirish.s@amd.com>
commit d6b6669762898dfc99e9273b8d8603bc47014aa9 upstream.
Currently all cursor related functions are made to all
pipes that are attached to a particular stream.
This is not applicable to pipes that do not have cursor plane
initialised like underlay.
Hence this patch allows cursor related operations on a pipe
only if ipp in available on that particular pipe.
The check is added to set_cursor_position & set_cursor_attribute.
Signed-off-by: Shirish S <shirish.s@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -200,7 +200,8 @@ bool dc_stream_set_cursor_attributes(
for (i = 0; i < MAX_PIPES; i++) {
struct pipe_ctx *pipe_ctx = &res_ctx->pipe_ctx[i];
- if (pipe_ctx->stream != stream || (!pipe_ctx->plane_res.xfm && !pipe_ctx->plane_res.dpp))
+ if (pipe_ctx->stream != stream || (!pipe_ctx->plane_res.xfm &&
+ !pipe_ctx->plane_res.dpp) || !pipe_ctx->plane_res.ipp)
continue;
if (pipe_ctx->top_pipe && pipe_ctx->plane_state != pipe_ctx->top_pipe->plane_state)
continue;
@@ -276,7 +277,8 @@ bool dc_stream_set_cursor_position(
if (pipe_ctx->stream != stream ||
(!pipe_ctx->plane_res.mi && !pipe_ctx->plane_res.hubp) ||
!pipe_ctx->plane_state ||
- (!pipe_ctx->plane_res.xfm && !pipe_ctx->plane_res.dpp))
+ (!pipe_ctx->plane_res.xfm && !pipe_ctx->plane_res.dpp) ||
+ !pipe_ctx->plane_res.ipp)
continue;
if (pipe_ctx->plane_state->address.type
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 030/146] drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 029/146] drm/amd/display: check for ipp before calling cursor operations Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 031/146] drm/amd/powerplay: fix power over limit on Fiji Greg Kroah-Hartman
` (119 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Crocker, Alex Deucher
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Crocker <bcrocker@redhat.com>
commit 2c83029cda55a5e7665c7c6326909427d6a01350 upstream.
In radeon_device_init, set the need_dma32 flag for Cedar chips
(e.g. FirePro 2270). This fixes, or at least works around, a bug
on PowerPC exposed by last year's commits
8e3f1b1d8255105f31556aacf8aeb6071b00d469 (Russell Currey)
and
253fd51e2f533552ae35a0c661705da6c4842c1b (Alistair Popple)
which enabled the 64-bit DMA iommu bypass.
This caused the device to freeze, in some cases unrecoverably, and is
the subject of several bug reports internal to Red Hat.
Signed-off-by: Ben Crocker <bcrocker@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_device.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1397,6 +1397,10 @@ int radeon_device_init(struct radeon_dev
if ((rdev->flags & RADEON_IS_PCI) &&
(rdev->family <= CHIP_RS740))
rdev->need_dma32 = true;
+#ifdef CONFIG_PPC64
+ if (rdev->family == CHIP_CEDAR)
+ rdev->need_dma32 = true;
+#endif
dma_bits = rdev->need_dma32 ? 32 : 40;
r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits));
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 031/146] drm/amd/powerplay: fix power over limit on Fiji
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 030/146] drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 032/146] drm/amd/display: Default HDMI6G support to true. Log VBIOS table error Greg Kroah-Hartman
` (118 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Huang, Felix Kuehling, Alex Deucher
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Huang <JinHuiEric.Huang@amd.com>
commit a0aaa03062be252aacad60a776f3374dd53e3f98 upstream.
power containment disabled only on Fiji and compute
power profile. It violates PCIe spec and may cause power
supply failed. Enabling it will fix the issue, even the
fix will drop performance of some compute tests.
Signed-off-by: Eric Huang <JinHuiEric.Huang@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 7 -------
1 file changed, 7 deletions(-)
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -4572,13 +4572,6 @@ static int smu7_set_power_profile_state(
int tmp_result, result = 0;
uint32_t sclk_mask = 0, mclk_mask = 0;
- if (hwmgr->chip_id == CHIP_FIJI) {
- if (request->type == AMD_PP_GFX_PROFILE)
- smu7_enable_power_containment(hwmgr);
- else if (request->type == AMD_PP_COMPUTE_PROFILE)
- smu7_disable_power_containment(hwmgr);
- }
-
if (hwmgr->dpm_level != AMD_DPM_FORCED_LEVEL_AUTO)
return -EINVAL;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 032/146] drm/amd/display: Default HDMI6G support to true. Log VBIOS table error.
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 031/146] drm/amd/powerplay: fix power over limit on Fiji Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 033/146] drm/amdgpu: used cached pcie gen info for SI (v2) Greg Kroah-Hartman
` (117 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Harry Wentland, Roman Li, Tony Cheng,
Alex Deucher
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Wentland <harry.wentland@amd.com>
commit caf0a9030d75509f3cacefe466d6d69d26e3dee6 upstream.
There have been many reports of Ellesmere and Baffin systems not being
able to drive HDMI 4k60 due to the fact that we check the HDMI_6GB_EN
bit from VBIOS table. Windows seems to not have this issue.
On some systems we fail to the encoder cap info from VBIOS. In that case
we should default to enabling HDMI6G support.
This was tested by dwagner on
https://bugs.freedesktop.org/show_bug.cgi?id=102820
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Roman Li <Roman.Li@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
@@ -683,6 +683,7 @@ void dce110_link_encoder_construct(
{
struct bp_encoder_cap_info bp_cap_info = {0};
const struct dc_vbios_funcs *bp_funcs = init_data->ctx->dc_bios->funcs;
+ enum bp_result result = BP_RESULT_OK;
enc110->base.funcs = &dce110_lnk_enc_funcs;
enc110->base.ctx = init_data->ctx;
@@ -757,15 +758,24 @@ void dce110_link_encoder_construct(
enc110->base.preferred_engine = ENGINE_ID_UNKNOWN;
}
+ /* default to one to mirror Windows behavior */
+ enc110->base.features.flags.bits.HDMI_6GB_EN = 1;
+
+ result = bp_funcs->get_encoder_cap_info(enc110->base.ctx->dc_bios,
+ enc110->base.id, &bp_cap_info);
+
/* Override features with DCE-specific values */
- if (BP_RESULT_OK == bp_funcs->get_encoder_cap_info(
- enc110->base.ctx->dc_bios, enc110->base.id,
- &bp_cap_info)) {
+ if (BP_RESULT_OK == result) {
enc110->base.features.flags.bits.IS_HBR2_CAPABLE =
bp_cap_info.DP_HBR2_EN;
enc110->base.features.flags.bits.IS_HBR3_CAPABLE =
bp_cap_info.DP_HBR3_EN;
enc110->base.features.flags.bits.HDMI_6GB_EN = bp_cap_info.HDMI_6GB_EN;
+ } else {
+ dm_logger_write(enc110->base.ctx->logger, LOG_WARNING,
+ "%s: Failed to get encoder_cap_info from VBIOS with error code %d!\n",
+ __func__,
+ result);
}
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 033/146] drm/amdgpu: used cached pcie gen info for SI (v2)
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 032/146] drm/amd/display: Default HDMI6G support to true. Log VBIOS table error Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 034/146] drm/amdgpu: Notify sbios device ready before send request Greg Kroah-Hartman
` (116 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian König, Rex Zhu, Alex Deucher
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 05656e5e4917a08296300dc0530aed1539202c25 upstream.
Rather than querying it every time we need it.
Also fixes a crash in VM pass through if there is no
root bridge because the cached value fetch already checks
this properly.
v2: fix includes
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=105244
Acked-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Rex Zhu<rezhu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/si.c | 22 +++++++--------
drivers/gpu/drm/amd/amdgpu/si_dpm.c | 50 +++++++++---------------------------
2 files changed, 23 insertions(+), 49 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/si.c
+++ b/drivers/gpu/drm/amd/amdgpu/si.c
@@ -31,6 +31,7 @@
#include "amdgpu_uvd.h"
#include "amdgpu_vce.h"
#include "atom.h"
+#include "amd_pcie.h"
#include "amdgpu_powerplay.h"
#include "sid.h"
#include "si_ih.h"
@@ -1461,8 +1462,8 @@ static void si_pcie_gen3_enable(struct a
{
struct pci_dev *root = adev->pdev->bus->self;
int bridge_pos, gpu_pos;
- u32 speed_cntl, mask, current_data_rate;
- int ret, i;
+ u32 speed_cntl, current_data_rate;
+ int i;
u16 tmp16;
if (pci_is_root_bus(adev->pdev->bus))
@@ -1474,23 +1475,20 @@ static void si_pcie_gen3_enable(struct a
if (adev->flags & AMD_IS_APU)
return;
- ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
- if (ret != 0)
- return;
-
- if (!(mask & (DRM_PCIE_SPEED_50 | DRM_PCIE_SPEED_80)))
+ if (!(adev->pm.pcie_gen_mask & (CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2 |
+ CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)))
return;
speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL);
current_data_rate = (speed_cntl & LC_CURRENT_DATA_RATE_MASK) >>
LC_CURRENT_DATA_RATE_SHIFT;
- if (mask & DRM_PCIE_SPEED_80) {
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) {
if (current_data_rate == 2) {
DRM_INFO("PCIE gen 3 link speeds already enabled\n");
return;
}
DRM_INFO("enabling PCIE gen 3 link speeds, disable with amdgpu.pcie_gen2=0\n");
- } else if (mask & DRM_PCIE_SPEED_50) {
+ } else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) {
if (current_data_rate == 1) {
DRM_INFO("PCIE gen 2 link speeds already enabled\n");
return;
@@ -1506,7 +1504,7 @@ static void si_pcie_gen3_enable(struct a
if (!gpu_pos)
return;
- if (mask & DRM_PCIE_SPEED_80) {
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) {
if (current_data_rate != 2) {
u16 bridge_cfg, gpu_cfg;
u16 bridge_cfg2, gpu_cfg2;
@@ -1589,9 +1587,9 @@ static void si_pcie_gen3_enable(struct a
pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
tmp16 &= ~0xf;
- if (mask & DRM_PCIE_SPEED_80)
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
tmp16 |= 3;
- else if (mask & DRM_PCIE_SPEED_50)
+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2)
tmp16 |= 2;
else
tmp16 |= 1;
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -26,6 +26,7 @@
#include "amdgpu_pm.h"
#include "amdgpu_dpm.h"
#include "amdgpu_atombios.h"
+#include "amd_pcie.h"
#include "sid.h"
#include "r600_dpm.h"
#include "si_dpm.h"
@@ -3331,29 +3332,6 @@ static void btc_apply_voltage_delta_rule
}
}
-static enum amdgpu_pcie_gen r600_get_pcie_gen_support(struct amdgpu_device *adev,
- u32 sys_mask,
- enum amdgpu_pcie_gen asic_gen,
- enum amdgpu_pcie_gen default_gen)
-{
- switch (asic_gen) {
- case AMDGPU_PCIE_GEN1:
- return AMDGPU_PCIE_GEN1;
- case AMDGPU_PCIE_GEN2:
- return AMDGPU_PCIE_GEN2;
- case AMDGPU_PCIE_GEN3:
- return AMDGPU_PCIE_GEN3;
- default:
- if ((sys_mask & DRM_PCIE_SPEED_80) && (default_gen == AMDGPU_PCIE_GEN3))
- return AMDGPU_PCIE_GEN3;
- else if ((sys_mask & DRM_PCIE_SPEED_50) && (default_gen == AMDGPU_PCIE_GEN2))
- return AMDGPU_PCIE_GEN2;
- else
- return AMDGPU_PCIE_GEN1;
- }
- return AMDGPU_PCIE_GEN1;
-}
-
static void r600_calculate_u_and_p(u32 i, u32 r_c, u32 p_b,
u32 *p, u32 *u)
{
@@ -5028,10 +5006,11 @@ static int si_populate_smc_acpi_state(st
table->ACPIState.levels[0].vddc.index,
&table->ACPIState.levels[0].std_vddc);
}
- table->ACPIState.levels[0].gen2PCIE = (u8)r600_get_pcie_gen_support(adev,
- si_pi->sys_pcie_mask,
- si_pi->boot_pcie_gen,
- AMDGPU_PCIE_GEN1);
+ table->ACPIState.levels[0].gen2PCIE =
+ (u8)amdgpu_get_pcie_gen_support(adev,
+ si_pi->sys_pcie_mask,
+ si_pi->boot_pcie_gen,
+ AMDGPU_PCIE_GEN1);
if (si_pi->vddc_phase_shed_control)
si_populate_phase_shedding_value(adev,
@@ -7172,10 +7151,10 @@ static void si_parse_pplib_clock_info(st
pl->vddc = le16_to_cpu(clock_info->si.usVDDC);
pl->vddci = le16_to_cpu(clock_info->si.usVDDCI);
pl->flags = le32_to_cpu(clock_info->si.ulFlags);
- pl->pcie_gen = r600_get_pcie_gen_support(adev,
- si_pi->sys_pcie_mask,
- si_pi->boot_pcie_gen,
- clock_info->si.ucPCIEGen);
+ pl->pcie_gen = amdgpu_get_pcie_gen_support(adev,
+ si_pi->sys_pcie_mask,
+ si_pi->boot_pcie_gen,
+ clock_info->si.ucPCIEGen);
/* patch up vddc if necessary */
ret = si_get_leakage_voltage_from_leakage_index(adev, pl->vddc,
@@ -7330,7 +7309,6 @@ static int si_dpm_init(struct amdgpu_dev
struct si_power_info *si_pi;
struct atom_clock_dividers dividers;
int ret;
- u32 mask;
si_pi = kzalloc(sizeof(struct si_power_info), GFP_KERNEL);
if (si_pi == NULL)
@@ -7340,11 +7318,9 @@ static int si_dpm_init(struct amdgpu_dev
eg_pi = &ni_pi->eg;
pi = &eg_pi->rv7xx;
- ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
- if (ret)
- si_pi->sys_pcie_mask = 0;
- else
- si_pi->sys_pcie_mask = mask;
+ si_pi->sys_pcie_mask =
+ (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_MASK) >>
+ CAIL_PCIE_LINK_SPEED_SUPPORT_SHIFT;
si_pi->force_pcie_gen = AMDGPU_PCIE_GEN_INVALID;
si_pi->boot_pcie_gen = si_get_current_pcie_speed(adev);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 034/146] drm/amdgpu: Notify sbios device ready before send request
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 033/146] drm/amdgpu: used cached pcie gen info for SI (v2) Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 035/146] drm/radeon: fix KV harvesting Greg Kroah-Hartman
` (115 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher, Rex Zhu
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Zhu <Rex.Zhu@amd.com>
commit 1bced75f4ab04bec55aecb57d99435dc6d0ae5a0 upstream.
it is required if a platform supports PCIe root complex
core voltage reduction. After receiving this notification,
SBIOS can apply default PCIe root complex power policy.
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -540,6 +540,9 @@ int amdgpu_acpi_pcie_performance_request
size_t size;
u32 retry = 3;
+ if (amdgpu_acpi_pcie_notify_device_ready(adev))
+ return -EINVAL;
+
/* Get the device handle */
handle = ACPI_HANDLE(&adev->pdev->dev);
if (!handle)
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 035/146] drm/radeon: fix KV harvesting
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 034/146] drm/amdgpu: Notify sbios device ready before send request Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 036/146] drm/amdgpu: " Greg Kroah-Hartman
` (114 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian König, Alex Deucher
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 0b58d90f89545e021d188c289fa142e5ff9e708b upstream.
Always set the graphics values to the max for the
asic type. E.g., some 1 RB chips are actually 1 RB chips,
others are actually harvested 2 RB chips.
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=99353
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/cik.c | 31 ++-----------------------------
1 file changed, 2 insertions(+), 29 deletions(-)
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3228,35 +3228,8 @@ static void cik_gpu_init(struct radeon_d
case CHIP_KAVERI:
rdev->config.cik.max_shader_engines = 1;
rdev->config.cik.max_tile_pipes = 4;
- if ((rdev->pdev->device == 0x1304) ||
- (rdev->pdev->device == 0x1305) ||
- (rdev->pdev->device == 0x130C) ||
- (rdev->pdev->device == 0x130F) ||
- (rdev->pdev->device == 0x1310) ||
- (rdev->pdev->device == 0x1311) ||
- (rdev->pdev->device == 0x131C)) {
- rdev->config.cik.max_cu_per_sh = 8;
- rdev->config.cik.max_backends_per_se = 2;
- } else if ((rdev->pdev->device == 0x1309) ||
- (rdev->pdev->device == 0x130A) ||
- (rdev->pdev->device == 0x130D) ||
- (rdev->pdev->device == 0x1313) ||
- (rdev->pdev->device == 0x131D)) {
- rdev->config.cik.max_cu_per_sh = 6;
- rdev->config.cik.max_backends_per_se = 2;
- } else if ((rdev->pdev->device == 0x1306) ||
- (rdev->pdev->device == 0x1307) ||
- (rdev->pdev->device == 0x130B) ||
- (rdev->pdev->device == 0x130E) ||
- (rdev->pdev->device == 0x1315) ||
- (rdev->pdev->device == 0x1318) ||
- (rdev->pdev->device == 0x131B)) {
- rdev->config.cik.max_cu_per_sh = 4;
- rdev->config.cik.max_backends_per_se = 1;
- } else {
- rdev->config.cik.max_cu_per_sh = 3;
- rdev->config.cik.max_backends_per_se = 1;
- }
+ rdev->config.cik.max_cu_per_sh = 8;
+ rdev->config.cik.max_backends_per_se = 2;
rdev->config.cik.max_sh_per_se = 1;
rdev->config.cik.max_texture_channel_caches = 4;
rdev->config.cik.max_gprs = 256;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 036/146] drm/amdgpu: fix KV harvesting
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 035/146] drm/radeon: fix KV harvesting Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 037/146] drm/amdgpu:Correct max uvd handles Greg Kroah-Hartman
` (113 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian König, Alex Deucher
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 545b0bcde7fbd3ee408fa842ea0731451dc4bd0a upstream.
Always set the graphics values to the max for the
asic type. E.g., some 1 RB chips are actually 1 RB chips,
others are actually harvested 2 RB chips.
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=99353
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 30 ++----------------------------
1 file changed, 2 insertions(+), 28 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -4403,34 +4403,8 @@ static void gfx_v7_0_gpu_early_init(stru
case CHIP_KAVERI:
adev->gfx.config.max_shader_engines = 1;
adev->gfx.config.max_tile_pipes = 4;
- if ((adev->pdev->device == 0x1304) ||
- (adev->pdev->device == 0x1305) ||
- (adev->pdev->device == 0x130C) ||
- (adev->pdev->device == 0x130F) ||
- (adev->pdev->device == 0x1310) ||
- (adev->pdev->device == 0x1311) ||
- (adev->pdev->device == 0x131C)) {
- adev->gfx.config.max_cu_per_sh = 8;
- adev->gfx.config.max_backends_per_se = 2;
- } else if ((adev->pdev->device == 0x1309) ||
- (adev->pdev->device == 0x130A) ||
- (adev->pdev->device == 0x130D) ||
- (adev->pdev->device == 0x1313) ||
- (adev->pdev->device == 0x131D)) {
- adev->gfx.config.max_cu_per_sh = 6;
- adev->gfx.config.max_backends_per_se = 2;
- } else if ((adev->pdev->device == 0x1306) ||
- (adev->pdev->device == 0x1307) ||
- (adev->pdev->device == 0x130B) ||
- (adev->pdev->device == 0x130E) ||
- (adev->pdev->device == 0x1315) ||
- (adev->pdev->device == 0x131B)) {
- adev->gfx.config.max_cu_per_sh = 4;
- adev->gfx.config.max_backends_per_se = 1;
- } else {
- adev->gfx.config.max_cu_per_sh = 3;
- adev->gfx.config.max_backends_per_se = 1;
- }
+ adev->gfx.config.max_cu_per_sh = 8;
+ adev->gfx.config.max_backends_per_se = 2;
adev->gfx.config.max_sh_per_se = 1;
adev->gfx.config.max_texture_channel_caches = 4;
adev->gfx.config.max_gprs = 256;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 037/146] drm/amdgpu:Correct max uvd handles
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 036/146] drm/amdgpu: " Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 038/146] drm/amdgpu:Always save uvd vcpu_bo in VM Mode Greg Kroah-Hartman
` (112 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Zhu, Leo Liu,
Christian König, Alex Deucher
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Zhu <James.Zhu@amd.com>
commit 0e5ee33d2a54e4c55fe92857f23e1cbb0440d6de upstream.
Max uvd handles should use adev->uvd.max_handles instead of
AMDGPU_MAX_UVD_HANDLES here.
Signed-off-by: James Zhu <James.Zhu@amd.com>
Reviewed-by: Leo Liu <leo.liu@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -301,7 +301,7 @@ int amdgpu_uvd_suspend(struct amdgpu_dev
if (atomic_read(&adev->uvd.handles[i]))
break;
- if (i == AMDGPU_MAX_UVD_HANDLES)
+ if (i == adev->uvd.max_handles)
return 0;
cancel_delayed_work_sync(&adev->uvd.idle_work);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 038/146] drm/amdgpu:Always save uvd vcpu_bo in VM Mode
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 037/146] drm/amdgpu:Correct max uvd handles Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 039/146] ovl: redirect_dir=nofollow should not follow redirect for opaque lower Greg Kroah-Hartman
` (111 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Zhu, Leo Liu,
Christian König, Alex Deucher
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Zhu <James.Zhu@amd.com>
commit f8bee6135e167f5b35b7789c74c2956dad14d0d5 upstream.
When UVD is in VM mode, there is not uvd handle exchanged,
uvd.handles are always 0. So vcpu_bo always need save,
Otherwise amdgpu driver will fail during suspend/resume.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105021
Signed-off-by: James Zhu <James.Zhu@amd.com>
Reviewed-by: Leo Liu <leo.liu@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -297,12 +297,15 @@ int amdgpu_uvd_suspend(struct amdgpu_dev
if (adev->uvd.vcpu_bo == NULL)
return 0;
- for (i = 0; i < adev->uvd.max_handles; ++i)
- if (atomic_read(&adev->uvd.handles[i]))
- break;
+ /* only valid for physical mode */
+ if (adev->asic_type < CHIP_POLARIS10) {
+ for (i = 0; i < adev->uvd.max_handles; ++i)
+ if (atomic_read(&adev->uvd.handles[i]))
+ break;
- if (i == adev->uvd.max_handles)
- return 0;
+ if (i == adev->uvd.max_handles)
+ return 0;
+ }
cancel_delayed_work_sync(&adev->uvd.idle_work);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 039/146] ovl: redirect_dir=nofollow should not follow redirect for opaque lower
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 038/146] drm/amdgpu:Always save uvd vcpu_bo in VM Mode Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 040/146] MIPS: BMIPS: Do not mask IPIs during suspend Greg Kroah-Hartman
` (110 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vivek Goyal, Miklos Szeredi
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vivek Goyal <vgoyal@redhat.com>
commit d1fe96c0e4de78ba0cd336ea3df3b850d06b9b9a upstream.
redirect_dir=nofollow should not follow a redirect. But in a specific
configuration it can still follow it. For example try this.
$ mkdir -p lower0 lower1/foo upper work merged
$ touch lower1/foo/lower-file.txt
$ setfattr -n "trusted.overlay.opaque" -v "y" lower1/foo
$ mount -t overlay -o lowerdir=lower1:lower0,workdir=work,upperdir=upper,redirect_dir=on none merged
$ cd merged
$ mv foo foo-renamed
$ umount merged
# mount again. This time with redirect_dir=nofollow
$ mount -t overlay -o lowerdir=lower1:lower0,workdir=work,upperdir=upper,redirect_dir=nofollow none merged
$ ls merged/foo-renamed/
# This lists lower-file.txt, while it should not have.
Basically, we are doing redirect check after we check for d.stop. And
if this is not last lower, and we find an opaque lower, d.stop will be
set.
ovl_lookup_single()
if (!d->last && ovl_is_opaquedir(this)) {
d->stop = d->opaque = true;
goto out;
}
To fix this, first check redirect is allowed. And after that check if
d.stop has been set or not.
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Fixes: 438c84c2f0c7 ("ovl: don't follow redirects if redirect_dir=off")
Cc: <stable@vger.kernel.org> #v4.15
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/namei.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -678,9 +678,6 @@ struct dentry *ovl_lookup(struct inode *
stack[ctr].layer = lower.layer;
ctr++;
- if (d.stop)
- break;
-
/*
* Following redirects can have security consequences: it's like
* a symlink into the lower layer without the permission checks.
@@ -697,6 +694,9 @@ struct dentry *ovl_lookup(struct inode *
goto out_put;
}
+ if (d.stop)
+ break;
+
if (d.redirect && d.redirect[0] == '/' && poe != roe) {
poe = roe;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 040/146] MIPS: BMIPS: Do not mask IPIs during suspend
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 039/146] ovl: redirect_dir=nofollow should not follow redirect for opaque lower Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 041/146] MIPS: ath25: Check for kzalloc allocation failure Greg Kroah-Hartman
` (109 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Justin Chen, Florian Fainelli,
linux-mips, James Hogan
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <justinpopo6@gmail.com>
commit 06a3f0c9f2725f5d7c63c4203839373c9bd00c28 upstream.
Commit a3e6c1eff548 ("MIPS: IRQ: Fix disable_irq on CPU IRQs") fixes an
issue where disable_irq did not actually disable the irq. The bug caused
our IPIs to not be disabled, which actually is the correct behavior.
With the addition of commit a3e6c1eff548 ("MIPS: IRQ: Fix disable_irq on
CPU IRQs"), the IPIs were getting disabled going into suspend, thus
schedule_ipi() was not being called. This caused deadlocks where
schedulable task were not being scheduled and other cpus were waiting
for them to do something.
Add the IRQF_NO_SUSPEND flag so an irq_disable will not be called on the
IPIs during suspend.
Signed-off-by: Justin Chen <justinpopo6@gmail.com>
Fixes: a3e6c1eff548 ("MIPS: IRQ: Fix disabled_irq on CPU IRQs")
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: linux-mips@linux-mips.org
Cc: stable@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/17385/
[jhogan@kernel.org: checkpatch: wrap long lines and fix commit refs]
Signed-off-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/smp-bmips.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -168,11 +168,11 @@ static void bmips_prepare_cpus(unsigned
return;
}
- if (request_irq(IPI0_IRQ, bmips_ipi_interrupt, IRQF_PERCPU,
- "smp_ipi0", NULL))
+ if (request_irq(IPI0_IRQ, bmips_ipi_interrupt,
+ IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi0", NULL))
panic("Can't request IPI0 interrupt");
- if (request_irq(IPI1_IRQ, bmips_ipi_interrupt, IRQF_PERCPU,
- "smp_ipi1", NULL))
+ if (request_irq(IPI1_IRQ, bmips_ipi_interrupt,
+ IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi1", NULL))
panic("Can't request IPI1 interrupt");
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 041/146] MIPS: ath25: Check for kzalloc allocation failure
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 040/146] MIPS: BMIPS: Do not mask IPIs during suspend Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 042/146] MIPS: OCTEON: irq: Check for null return on kzalloc allocation Greg Kroah-Hartman
` (108 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Ralf Baechle,
linux-mips, James Hogan
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.king@canonical.com>
commit 1b22b4b28fd5fbc51855219e3238b3ab81da8466 upstream.
Currently there is no null check on a failed allocation of board_data,
and hence a null pointer dereference will occurr. Fix this by checking
for the out of memory null pointer.
Fixes: a7473717483e ("MIPS: ath25: add board configuration detection")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: <stable@vger.kernel.org> # 3.19+
Patchwork: https://patchwork.linux-mips.org/patch/18657/
Signed-off-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/ath25/board.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/mips/ath25/board.c
+++ b/arch/mips/ath25/board.c
@@ -135,6 +135,8 @@ int __init ath25_find_config(phys_addr_t
}
board_data = kzalloc(BOARD_CONFIG_BUFSZ, GFP_KERNEL);
+ if (!board_data)
+ goto error;
ath25_board.config = (struct ath25_boarddata *)board_data;
memcpy_fromio(board_data, bcfg, 0x100);
if (broken_boarddata) {
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 042/146] MIPS: OCTEON: irq: Check for null return on kzalloc allocation
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 041/146] MIPS: ath25: Check for kzalloc allocation failure Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 043/146] PCI: dwc: Fix enumeration end when reaching root subordinate Greg Kroah-Hartman
` (107 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, David Daney,
Ralf Baechle, Steven J. Hill, linux-mips, James Hogan
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.king@canonical.com>
commit 902f4d067a50ccf645a58dd5fb1d113b6e0f9b5b upstream.
The allocation of host_data is not null checked, leading to a null
pointer dereference if the allocation fails. Fix this by adding a null
check and return with -ENOMEM.
Fixes: 64b139f97c01 ("MIPS: OCTEON: irq: add CIB and other fixes")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: David Daney <david.daney@cavium.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: "Steven J. Hill" <Steven.Hill@cavium.com>
Cc: linux-mips@linux-mips.org
Cc: <stable@vger.kernel.org> # 4.0+
Patchwork: https://patchwork.linux-mips.org/patch/18658/
Signed-off-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/cavium-octeon/octeon-irq.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/mips/cavium-octeon/octeon-irq.c
+++ b/arch/mips/cavium-octeon/octeon-irq.c
@@ -2277,6 +2277,8 @@ static int __init octeon_irq_init_cib(st
}
host_data = kzalloc(sizeof(*host_data), GFP_KERNEL);
+ if (!host_data)
+ return -ENOMEM;
raw_spin_lock_init(&host_data->lock);
addr = of_get_address(ciu_node, 0, NULL, NULL);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 043/146] PCI: dwc: Fix enumeration end when reaching root subordinate
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 042/146] MIPS: OCTEON: irq: Check for null return on kzalloc allocation Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 044/146] Input: matrix_keypad - fix race when disabling interrupts Greg Kroah-Hartman
` (106 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Niklas Cassel, Fabio Estevam,
Sebastian Reichel, Koen Vandeputte, Lorenzo Pieralisi,
Bjorn Helgaas, Mika Westerberg, Lucas Stach, Binghui Wang,
Jesper Nilsson, Jianguo Sun, Jingoo Han, Kishon Vijay Abraham I,
Minghuan Lian, Mingkai Hu, Murali Karicheri, Pratyush Anand,
Richard Zhu, Roy Zang, Shawn Guo, Stanimir Varbanov,
Thomas Petazzoni, Xiaowei Song, Zhou Wang
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koen Vandeputte <koen.vandeputte@ncentric.com>
commit fc110ebdd014dd1368c98e7685b47789c31fab42 upstream.
The subordinate value indicates the highest bus number which can be
reached downstream though a certain device.
Commit a20c7f36bd3d ("PCI: Do not allocate more buses than available in
parent") ensures that downstream devices cannot assign busnumbers higher
than the upstream device subordinate number, which was indeed illogical.
By default, dw_pcie_setup_rc() inits the Root Complex subordinate to a
value of 0x01.
Due to this combined with above commit, enumeration stops digging deeper
downstream as soon as bus num 0x01 has been assigned, which is always the
case for a bridge device.
This results in all devices behind a bridge bus remaining undetected, as
these would be connected to bus 0x02 or higher.
Fix this by initializing the RC to a subordinate value of 0xff, which is
not altering hardware behaviour in any way, but informs probing function
pci_scan_bridge() later on which reads this value back from register.
The following nasty errors during boot are also fixed by this:
pci_bus 0000:02: busn_res: can not insert [bus 02-ff] under [bus 01] (conflicts with (null) [bus 01])
...
pci_bus 0000:03: [bus 03] partially hidden behind bridge 0000:01 [bus 01]
...
pci_bus 0000:04: [bus 04] partially hidden behind bridge 0000:01 [bus 01]
...
pci_bus 0000:05: [bus 05] partially hidden behind bridge 0000:01 [bus 01]
pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 05
pci_bus 0000:02: busn_res: can not insert [bus 02-05] under [bus 01] (conflicts with (null) [bus 01])
pci_bus 0000:02: [bus 02-05] partially hidden behind bridge 0000:01 [bus 01]
Fixes: a20c7f36bd3d ("PCI: Do not allocate more buses than available in
parent")
Tested-by: Niklas Cassel <niklas.cassel@axis.com>
Tested-by: Fabio Estevam <fabio.estevam@nxp.com>
Tested-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Acked-by: Lucas Stach <l.stach@pengutronix.de>
Cc: stable@vger.kernel.org # v4.15+
Cc: Binghui Wang <wangbinghui@hisilicon.com>
Cc: Jesper Nilsson <jesper.nilsson@axis.com>
Cc: Jianguo Sun <sunjianguo1@huawei.com>
Cc: Jingoo Han <jingoohan1@gmail.com>
Cc: Kishon Vijay Abraham I <kishon@ti.com>
Cc: Lucas Stach <l.stach@pengutronix.de>
Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
Cc: Minghuan Lian <minghuan.Lian@freescale.com>
Cc: Mingkai Hu <mingkai.hu@freescale.com>
Cc: Murali Karicheri <m-karicheri2@ti.com>
Cc: Pratyush Anand <pratyush.anand@gmail.com>
Cc: Richard Zhu <hongxing.zhu@nxp.com>
Cc: Roy Zang <tie-fei.zang@freescale.com>
Cc: Shawn Guo <shawn.guo@linaro.org>
Cc: Stanimir Varbanov <svarbanov@mm-sol.com>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Xiaowei Song <songxiaowei@hisilicon.com>
Cc: Zhou Wang <wangzhou1@hisilicon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/dwc/pcie-designware-host.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/dwc/pcie-designware-host.c
+++ b/drivers/pci/dwc/pcie-designware-host.c
@@ -607,7 +607,7 @@ void dw_pcie_setup_rc(struct pcie_port *
/* setup bus numbers */
val = dw_pcie_readl_dbi(pci, PCI_PRIMARY_BUS);
val &= 0xff000000;
- val |= 0x00010100;
+ val |= 0x00ff0100;
dw_pcie_writel_dbi(pci, PCI_PRIMARY_BUS, val);
/* setup command register */
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 044/146] Input: matrix_keypad - fix race when disabling interrupts
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 043/146] PCI: dwc: Fix enumeration end when reaching root subordinate Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 045/146] Revert "Input: synaptics - Lenovo Thinkpad T460p devices should use RMI" Greg Kroah-Hartman
` (105 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhang Bo, Dmitry Torokhov
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Bo <zbsdta@126.com>
commit ea4f7bd2aca9f68470e9aac0fc9432fd180b1fe7 upstream.
If matrix_keypad_stop() is executing and the keypad interrupt is triggered,
disable_row_irqs() may be called by both matrix_keypad_interrupt() and
matrix_keypad_stop() at the same time, causing interrupts to be disabled
twice and the keypad being "stuck" after resuming.
Take lock when setting keypad->stopped to ensure that ISR will not race
with matrix_keypad_stop() disabling interrupts.
Signed-off-by: Zhang Bo <zbsdta@126.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/keyboard/matrix_keypad.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/input/keyboard/matrix_keypad.c
+++ b/drivers/input/keyboard/matrix_keypad.c
@@ -218,8 +218,10 @@ static void matrix_keypad_stop(struct in
{
struct matrix_keypad *keypad = input_get_drvdata(dev);
+ spin_lock_irq(&keypad->lock);
keypad->stopped = true;
- mb();
+ spin_unlock_irq(&keypad->lock);
+
flush_work(&keypad->work.work);
/*
* matrix_keypad_scan() will leave IRQs enabled;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 045/146] Revert "Input: synaptics - Lenovo Thinkpad T460p devices should use RMI"
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 044/146] Input: matrix_keypad - fix race when disabling interrupts Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 046/146] bug: use %pB in BUG and stack protector failure Greg Kroah-Hartman
` (104 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Richard Schütz, Arkadiusz Hiler,
Martin Peres, Dmitry Torokhov
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arkadiusz Hiler <arkadiusz.hiler@intel.com>
commit 5444a992b4a73aa5246a432c482b20b89bce93a5 upstream.
This reverts commit 48282969826b3d3c76e908182f69724d86d995fe which
caused the following issues:
1. On T460p with BIOS version 2.22 touchpad and trackpoint stop working
after suspend-resume cycle. Due to strange state of the device another
suspend is impossible.
The following dmesg errors can be observed:
thinkpad_acpi: EC reports that Thermal Table has changed
rmi4_smbus 7-002c: failed to get SMBus version number!
rmi4_physical rmi4-00: rmi_driver_reset_handler: Failed to read current IRQ mask.
rmi4_f01 rmi4-00.fn01: Failed to restore normal operation: -16.
rmi4_f01 rmi4-00.fn01: Resume failed with code -16.
rmi4_physical rmi4-00: Failed to suspend functions: -16
rmi4_smbus 7-002c: Failed to resume device: -16
PM: resume devices took 0.640 seconds
rmi4_f03 rmi4-00.fn03: rmi_f03_pt_write: Failed to write to F03 TX register (-16).
rmi4_physical rmi4-00: rmi_driver_clear_irq_bits: Failed to change enabled interrupts!
rmi4_physical rmi4-00: rmi_driver_set_irq_bits: Failed to change enabled interrupts!
psmouse: probe of serio3 failed with error -1
2. On another T460p with BIOS version 2.15 two finger scrolling gesture
on the touchpad stops working after suspend-resume cycle (about 75%
reproducibility, when it still works, the scrolling gesture becomes
laggy). Nothing suspicious appears in the dmesg.
Analysis form Richard Schütz:
"RMI is unreliable on the ThinkPad T460p because the device is affected
by the firmware behavior addressed in a7ae81952cda ("i2c: i801: Allow
ACPI SystemIO OpRegion to conflict with PCI BAR")."
The affected devices often show:
i801_smbus 0000:00:1f.4: BIOS is accessing SMBus registers
i801_smbus 0000:00:1f.4: Driver SMBus register access inhibited
Reported-by: Richard Schütz <rschuetz@uni-koblenz.de>
Signed-off-by: Arkadiusz Hiler <arkadiusz.hiler@intel.com>
Tested-by: Martin Peres <martin.peres@linux.intel.com>
Tested-by: Arkadiusz Hiler <arkadiusz.hiler@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/synaptics.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -173,7 +173,6 @@ static const char * const smbus_pnp_ids[
"LEN0046", /* X250 */
"LEN004a", /* W541 */
"LEN200f", /* T450s */
- "LEN2018", /* T460p */
NULL
};
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 046/146] bug: use %pB in BUG and stack protector failure
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 045/146] Revert "Input: synaptics - Lenovo Thinkpad T460p devices should use RMI" Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 047/146] lib/bug.c: exclude non-BUG/WARN exceptions from report_bug() Greg Kroah-Hartman
` (103 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kees Cook, Andrew Morton,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Borislav Petkov,
Linus Torvalds, Richard Weinberger
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit 0862ca422b79cb5aa70823ee0f07f6b468f86070 upstream.
The BUG and stack protector reports were still using a raw %p. This
changes it to %pB for more meaningful output.
Link: http://lkml.kernel.org/r/20180301225704.GA34198@beast
Fixes: ad67b74d2469 ("printk: hash addresses printed with %p")
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Richard Weinberger <richard.weinberger@gmail.com>,
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/panic.c | 2 +-
lib/bug.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -640,7 +640,7 @@ device_initcall(register_warn_debugfs);
*/
__visible void __stack_chk_fail(void)
{
- panic("stack-protector: Kernel stack is corrupted in: %p\n",
+ panic("stack-protector: Kernel stack is corrupted in: %pB\n",
__builtin_return_address(0));
}
EXPORT_SYMBOL(__stack_chk_fail);
--- a/lib/bug.c
+++ b/lib/bug.c
@@ -191,7 +191,7 @@ enum bug_trap_type report_bug(unsigned l
if (file)
pr_crit("kernel BUG at %s:%u!\n", file, line);
else
- pr_crit("Kernel BUG at %p [verbose debug info unavailable]\n",
+ pr_crit("Kernel BUG at %pB [verbose debug info unavailable]\n",
(void *)bugaddr);
return BUG_TRAP_TYPE_BUG;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 047/146] lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 046/146] bug: use %pB in BUG and stack protector failure Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 048/146] mm/memblock.c: hardcode the end_pfn being -1 Greg Kroah-Hartman
` (102 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kees Cook, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Borislav Petkov,
Richard Weinberger, Andrew Morton, Linus Torvalds
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit 1b4cfe3c0a30dde968fb43c577a8d7e262a145ee upstream.
Commit b8347c219649 ("x86/debug: Handle warnings before the notifier
chain, to fix KGDB crash") changed the ordering of fixups, and did not
take into account the case of x86 processing non-WARN() and non-BUG()
exceptions. This would lead to output of a false BUG line with no other
information.
In the case of a refcount exception, it would be immediately followed by
the refcount WARN(), producing very strange double-"cut here":
lkdtm: attempting bad refcount_inc() overflow
------------[ cut here ]------------
Kernel BUG at 0000000065f29de5 [verbose debug info unavailable]
------------[ cut here ]------------
refcount_t overflow at lkdtm_REFCOUNT_INC_OVERFLOW+0x6b/0x90 in cat[3065], uid/euid: 0/0
WARNING: CPU: 0 PID: 3065 at kernel/panic.c:657 refcount_error_report+0x9a/0xa4
...
In the prior ordering, exceptions were searched first:
do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
...
if (fixup_exception(regs, trapnr))
return 0;
- if (fixup_bug(regs, trapnr))
- return 0;
-
As a result, fixup_bugs()'s is_valid_bugaddr() didn't take into account
needing to search the exception list first, since that had already
happened.
So, instead of searching the exception list twice (once in
is_valid_bugaddr() and then again in fixup_exception()), just add a
simple sanity check to report_bug() that will immediately bail out if a
BUG() (or WARN()) entry is not found.
Link: http://lkml.kernel.org/r/20180301225934.GA34350@beast
Fixes: b8347c219649 ("x86/debug: Handle warnings before the notifier chain, to fix KGDB crash")
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Richard Weinberger <richard.weinberger@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/bug.c | 2 ++
1 file changed, 2 insertions(+)
--- a/lib/bug.c
+++ b/lib/bug.c
@@ -150,6 +150,8 @@ enum bug_trap_type report_bug(unsigned l
return BUG_TRAP_TYPE_NONE;
bug = find_bug(bugaddr);
+ if (!bug)
+ return BUG_TRAP_TYPE_NONE;
file = NULL;
line = 0;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 048/146] mm/memblock.c: hardcode the end_pfn being -1
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 047/146] lib/bug.c: exclude non-BUG/WARN exceptions from report_bug() Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 049/146] mm/page_alloc: fix memmap_init_zone pageblock alignment Greg Kroah-Hartman
` (101 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Vacek, Michal Hocko,
Vlastimil Babka, Mel Gorman, Pavel Tatashin, Paul Burton,
Andrew Morton, Linus Torvalds
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vacek <neelx@redhat.com>
commit 379b03b7fa05f7db521b7732a52692448a3c34fe upstream.
This is just a cleanup. It aids handling the special end case in the
next commit.
[akpm@linux-foundation.org: make it work against current -linus, not against -mm]
[akpm@linux-foundation.org: make it work against current -linus, not against -mm some more]
Link: http://lkml.kernel.org/r/1ca478d4269125a99bcfb1ca04d7b88ac1aee924.1520011944.git.neelx@redhat.com
Signed-off-by: Daniel Vacek <neelx@redhat.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Pavel Tatashin <pasha.tatashin@oracle.com>
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memblock.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -1107,7 +1107,7 @@ unsigned long __init_memblock memblock_n
struct memblock_type *type = &memblock.memory;
unsigned int right = type->cnt;
unsigned int mid, left = 0;
- phys_addr_t addr = PFN_PHYS(pfn + 1);
+ phys_addr_t addr = PFN_PHYS(++pfn);
do {
mid = (right + left) / 2;
@@ -1118,15 +1118,15 @@ unsigned long __init_memblock memblock_n
type->regions[mid].size))
left = mid + 1;
else {
- /* addr is within the region, so pfn + 1 is valid */
- return min(pfn + 1, max_pfn);
+ /* addr is within the region, so pfn is valid */
+ return pfn;
}
} while (left < right);
if (right == type->cnt)
- return max_pfn;
+ return -1UL;
else
- return min(PHYS_PFN(type->regions[right].base), max_pfn);
+ return PHYS_PFN(type->regions[right].base);
}
/**
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 049/146] mm/page_alloc: fix memmap_init_zone pageblock alignment
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 048/146] mm/memblock.c: hardcode the end_pfn being -1 Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 19:34 ` Dan Rue
2018-03-13 15:23 ` [PATCH 4.15 050/146] Documentation/sphinx: Fix Directive import error Greg Kroah-Hartman
` (100 subsequent siblings)
149 siblings, 1 reply; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Vacek, Mel Gorman,
Michal Hocko, Paul Burton, Pavel Tatashin, Vlastimil Babka,
Andrew Morton, Linus Torvalds
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vacek <neelx@redhat.com>
commit 864b75f9d6b0100bb24fdd9a20d156e7cda9b5ae upstream.
Commit b92df1de5d28 ("mm: page_alloc: skip over regions of invalid pfns
where possible") introduced a bug where move_freepages() triggers a
VM_BUG_ON() on uninitialized page structure due to pageblock alignment.
To fix this, simply align the skipped pfns in memmap_init_zone() the
same way as in move_freepages_block().
Seen in one of the RHEL reports:
crash> log | grep -e BUG -e RIP -e Call.Trace -e move_freepages_block -e rmqueue -e freelist -A1
kernel BUG at mm/page_alloc.c:1389!
invalid opcode: 0000 [#1] SMP
--
RIP: 0010:[<ffffffff8118833e>] [<ffffffff8118833e>] move_freepages+0x15e/0x160
RSP: 0018:ffff88054d727688 EFLAGS: 00010087
--
Call Trace:
[<ffffffff811883b3>] move_freepages_block+0x73/0x80
[<ffffffff81189e63>] __rmqueue+0x263/0x460
[<ffffffff8118c781>] get_page_from_freelist+0x7e1/0x9e0
[<ffffffff8118caf6>] __alloc_pages_nodemask+0x176/0x420
--
RIP [<ffffffff8118833e>] move_freepages+0x15e/0x160
RSP <ffff88054d727688>
crash> page_init_bug -v | grep RAM
<struct resource 0xffff88067fffd2f8> 1000 - 9bfff System RAM (620.00 KiB)
<struct resource 0xffff88067fffd3a0> 100000 - 430bffff System RAM ( 1.05 GiB = 1071.75 MiB = 1097472.00 KiB)
<struct resource 0xffff88067fffd410> 4b0c8000 - 4bf9cfff System RAM ( 14.83 MiB = 15188.00 KiB)
<struct resource 0xffff88067fffd480> 4bfac000 - 646b1fff System RAM (391.02 MiB = 400408.00 KiB)
<struct resource 0xffff88067fffd560> 7b788000 - 7b7fffff System RAM (480.00 KiB)
<struct resource 0xffff88067fffd640> 100000000 - 67fffffff System RAM ( 22.00 GiB)
crash> page_init_bug | head -6
<struct resource 0xffff88067fffd560> 7b788000 - 7b7fffff System RAM (480.00 KiB)
<struct page 0xffffea0001ede200> 1fffff00000000 0 <struct pglist_data 0xffff88047ffd9000> 1 <struct zone 0xffff88047ffd9800> DMA32 4096 1048575
<struct page 0xffffea0001ede200> 505736 505344 <struct page 0xffffea0001ed8000> 505855 <struct page 0xffffea0001edffc0>
<struct page 0xffffea0001ed8000> 0 0 <struct pglist_data 0xffff88047ffd9000> 0 <struct zone 0xffff88047ffd9000> DMA 1 4095
<struct page 0xffffea0001edffc0> 1fffff00000400 0 <struct pglist_data 0xffff88047ffd9000> 1 <struct zone 0xffff88047ffd9800> DMA32 4096 1048575
BUG, zones differ!
Note that this range follows two not populated sections
68000000-77ffffff in this zone. 7b788000-7b7fffff is the first one
after a gap. This makes memmap_init_zone() skip all the pfns up to the
beginning of this range. But this range is not pageblock (2M) aligned.
In fact no range has to be.
crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b787000 7b788000
PAGE PHYSICAL MAPPING INDEX CNT FLAGS
ffffea0001e00000 78000000 0 0 0 0
ffffea0001ed7fc0 7b5ff000 0 0 0 0
ffffea0001ed8000 7b600000 0 0 0 0 <<<<
ffffea0001ede1c0 7b787000 0 0 0 0
ffffea0001ede200 7b788000 0 0 1 1fffff00000000
Top part of page flags should contain nodeid and zonenr, which is not
the case for page ffffea0001ed8000 here (<<<<).
crash> log | grep -o fffea0001ed[^\ ]* | sort -u
fffea0001ed8000
fffea0001eded20
fffea0001edffc0
crash> bt -r | grep -o fffea0001ed[^\ ]* | sort -u
fffea0001ed8000
fffea0001eded00
fffea0001eded20
fffea0001edffc0
Initialization of the whole beginning of the section is skipped up to
the start of the range due to the commit b92df1de5d28. Now any code
calling move_freepages_block() (like reusing the page from a freelist as
in this example) with a page from the beginning of the range will get
the page rounded down to start_page ffffea0001ed8000 and passed to
move_freepages() which crashes on assertion getting wrong zonenr.
> VM_BUG_ON(page_zone(start_page) != page_zone(end_page));
Note, page_zone() derives the zone from page flags here.
>From similar machine before commit b92df1de5d28:
crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b7fe000 7b7ff000
PAGE PHYSICAL MAPPING INDEX CNT FLAGS
fffff73941e00000 78000000 0 0 1 1fffff00000000
fffff73941ed7fc0 7b5ff000 0 0 1 1fffff00000000
fffff73941ed8000 7b600000 0 0 1 1fffff00000000
fffff73941edff80 7b7fe000 0 0 1 1fffff00000000
fffff73941edffc0 7b7ff000 ffff8e67e04d3ae0 ad84 1 1fffff00020068 uptodate,lru,active,mappedtodisk
All the pages since the beginning of the section are initialized.
move_freepages()' not gonna blow up.
The same machine with this fix applied:
crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b7fe000 7b7ff000
PAGE PHYSICAL MAPPING INDEX CNT FLAGS
ffffea0001e00000 78000000 0 0 0 0
ffffea0001e00000 7b5ff000 0 0 0 0
ffffea0001ed8000 7b600000 0 0 1 1fffff00000000
ffffea0001edff80 7b7fe000 0 0 1 1fffff00000000
ffffea0001edffc0 7b7ff000 ffff88017fb13720 8 2 1fffff00020068 uptodate,lru,active,mappedtodisk
At least the bare minimum of pages is initialized preventing the crash
as well.
Customers started to report this as soon as 7.4 (where b92df1de5d28 was
merged in RHEL) was released. I remember reports from
September/October-ish times. It's not easily reproduced and happens on
a handful of machines only. I guess that's why. But that does not make
it less serious, I think.
Though there actually is a report here:
https://bugzilla.kernel.org/show_bug.cgi?id=196443
And there are reports for Fedora from July:
https://bugzilla.redhat.com/show_bug.cgi?id=1473242
and CentOS:
https://bugs.centos.org/view.php?id=13964
and we internally track several dozens reports for RHEL bug
https://bugzilla.redhat.com/show_bug.cgi?id=1525121
Link: http://lkml.kernel.org/r/0485727b2e82da7efbce5f6ba42524b429d0391a.1520011945.git.neelx@redhat.com
Fixes: b92df1de5d28 ("mm: page_alloc: skip over regions of invalid pfns where possible")
Signed-off-by: Daniel Vacek <neelx@redhat.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: Pavel Tatashin <pasha.tatashin@oracle.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_alloc.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5353,9 +5353,14 @@ void __meminit memmap_init_zone(unsigned
/*
* Skip to the pfn preceding the next valid one (or
* end_pfn), such that we hit a valid pfn (or end_pfn)
- * on our next iteration of the loop.
+ * on our next iteration of the loop. Note that it needs
+ * to be pageblock aligned even when the region itself
+ * is not. move_freepages_block() can shift ahead of
+ * the valid region but still depends on correct page
+ * metadata.
*/
- pfn = memblock_next_valid_pfn(pfn, end_pfn) - 1;
+ pfn = (memblock_next_valid_pfn(pfn, end_pfn) &
+ ~(pageblock_nr_pages-1)) - 1;
#endif
continue;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* Re: [PATCH 4.15 049/146] mm/page_alloc: fix memmap_init_zone pageblock alignment
2018-03-13 15:23 ` [PATCH 4.15 049/146] mm/page_alloc: fix memmap_init_zone pageblock alignment Greg Kroah-Hartman
@ 2018-03-13 19:34 ` Dan Rue
2018-03-13 21:47 ` Daniel Vacek
2018-03-14 10:54 ` Greg Kroah-Hartman
0 siblings, 2 replies; 160+ messages in thread
From: Dan Rue @ 2018-03-13 19:34 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Daniel Vacek, Mel Gorman, Michal Hocko,
Paul Burton, Pavel Tatashin, Vlastimil Babka, Andrew Morton,
Linus Torvalds
On Tue, Mar 13, 2018 at 04:23:36PM +0100, Greg Kroah-Hartman wrote:
> 4.15-stable review patch. If anyone has any objections, please let me know.
On 4.14 and 4.15, this patch breaks booting on dragonboard 410c and
hikey 620 (both arm64). The fix has been proposed and tested but is not
yet in mainline per https://lkml.org/lkml/2018/3/12/710
Dan
>
> ------------------
>
> From: Daniel Vacek <neelx@redhat.com>
>
> commit 864b75f9d6b0100bb24fdd9a20d156e7cda9b5ae upstream.
>
> Commit b92df1de5d28 ("mm: page_alloc: skip over regions of invalid pfns
> where possible") introduced a bug where move_freepages() triggers a
> VM_BUG_ON() on uninitialized page structure due to pageblock alignment.
> To fix this, simply align the skipped pfns in memmap_init_zone() the
> same way as in move_freepages_block().
>
> Seen in one of the RHEL reports:
>
> crash> log | grep -e BUG -e RIP -e Call.Trace -e move_freepages_block -e rmqueue -e freelist -A1
> kernel BUG at mm/page_alloc.c:1389!
> invalid opcode: 0000 [#1] SMP
> --
> RIP: 0010:[<ffffffff8118833e>] [<ffffffff8118833e>] move_freepages+0x15e/0x160
> RSP: 0018:ffff88054d727688 EFLAGS: 00010087
> --
> Call Trace:
> [<ffffffff811883b3>] move_freepages_block+0x73/0x80
> [<ffffffff81189e63>] __rmqueue+0x263/0x460
> [<ffffffff8118c781>] get_page_from_freelist+0x7e1/0x9e0
> [<ffffffff8118caf6>] __alloc_pages_nodemask+0x176/0x420
> --
> RIP [<ffffffff8118833e>] move_freepages+0x15e/0x160
> RSP <ffff88054d727688>
>
> crash> page_init_bug -v | grep RAM
> <struct resource 0xffff88067fffd2f8> 1000 - 9bfff System RAM (620.00 KiB)
> <struct resource 0xffff88067fffd3a0> 100000 - 430bffff System RAM ( 1.05 GiB = 1071.75 MiB = 1097472.00 KiB)
> <struct resource 0xffff88067fffd410> 4b0c8000 - 4bf9cfff System RAM ( 14.83 MiB = 15188.00 KiB)
> <struct resource 0xffff88067fffd480> 4bfac000 - 646b1fff System RAM (391.02 MiB = 400408.00 KiB)
> <struct resource 0xffff88067fffd560> 7b788000 - 7b7fffff System RAM (480.00 KiB)
> <struct resource 0xffff88067fffd640> 100000000 - 67fffffff System RAM ( 22.00 GiB)
>
> crash> page_init_bug | head -6
> <struct resource 0xffff88067fffd560> 7b788000 - 7b7fffff System RAM (480.00 KiB)
> <struct page 0xffffea0001ede200> 1fffff00000000 0 <struct pglist_data 0xffff88047ffd9000> 1 <struct zone 0xffff88047ffd9800> DMA32 4096 1048575
> <struct page 0xffffea0001ede200> 505736 505344 <struct page 0xffffea0001ed8000> 505855 <struct page 0xffffea0001edffc0>
> <struct page 0xffffea0001ed8000> 0 0 <struct pglist_data 0xffff88047ffd9000> 0 <struct zone 0xffff88047ffd9000> DMA 1 4095
> <struct page 0xffffea0001edffc0> 1fffff00000400 0 <struct pglist_data 0xffff88047ffd9000> 1 <struct zone 0xffff88047ffd9800> DMA32 4096 1048575
> BUG, zones differ!
>
> Note that this range follows two not populated sections
> 68000000-77ffffff in this zone. 7b788000-7b7fffff is the first one
> after a gap. This makes memmap_init_zone() skip all the pfns up to the
> beginning of this range. But this range is not pageblock (2M) aligned.
> In fact no range has to be.
>
> crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b787000 7b788000
> PAGE PHYSICAL MAPPING INDEX CNT FLAGS
> ffffea0001e00000 78000000 0 0 0 0
> ffffea0001ed7fc0 7b5ff000 0 0 0 0
> ffffea0001ed8000 7b600000 0 0 0 0 <<<<
> ffffea0001ede1c0 7b787000 0 0 0 0
> ffffea0001ede200 7b788000 0 0 1 1fffff00000000
>
> Top part of page flags should contain nodeid and zonenr, which is not
> the case for page ffffea0001ed8000 here (<<<<).
>
> crash> log | grep -o fffea0001ed[^\ ]* | sort -u
> fffea0001ed8000
> fffea0001eded20
> fffea0001edffc0
>
> crash> bt -r | grep -o fffea0001ed[^\ ]* | sort -u
> fffea0001ed8000
> fffea0001eded00
> fffea0001eded20
> fffea0001edffc0
>
> Initialization of the whole beginning of the section is skipped up to
> the start of the range due to the commit b92df1de5d28. Now any code
> calling move_freepages_block() (like reusing the page from a freelist as
> in this example) with a page from the beginning of the range will get
> the page rounded down to start_page ffffea0001ed8000 and passed to
> move_freepages() which crashes on assertion getting wrong zonenr.
>
> > VM_BUG_ON(page_zone(start_page) != page_zone(end_page));
>
> Note, page_zone() derives the zone from page flags here.
>
> >From similar machine before commit b92df1de5d28:
>
> crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b7fe000 7b7ff000
> PAGE PHYSICAL MAPPING INDEX CNT FLAGS
> fffff73941e00000 78000000 0 0 1 1fffff00000000
> fffff73941ed7fc0 7b5ff000 0 0 1 1fffff00000000
> fffff73941ed8000 7b600000 0 0 1 1fffff00000000
> fffff73941edff80 7b7fe000 0 0 1 1fffff00000000
> fffff73941edffc0 7b7ff000 ffff8e67e04d3ae0 ad84 1 1fffff00020068 uptodate,lru,active,mappedtodisk
>
> All the pages since the beginning of the section are initialized.
> move_freepages()' not gonna blow up.
>
> The same machine with this fix applied:
>
> crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b7fe000 7b7ff000
> PAGE PHYSICAL MAPPING INDEX CNT FLAGS
> ffffea0001e00000 78000000 0 0 0 0
> ffffea0001e00000 7b5ff000 0 0 0 0
> ffffea0001ed8000 7b600000 0 0 1 1fffff00000000
> ffffea0001edff80 7b7fe000 0 0 1 1fffff00000000
> ffffea0001edffc0 7b7ff000 ffff88017fb13720 8 2 1fffff00020068 uptodate,lru,active,mappedtodisk
>
> At least the bare minimum of pages is initialized preventing the crash
> as well.
>
> Customers started to report this as soon as 7.4 (where b92df1de5d28 was
> merged in RHEL) was released. I remember reports from
> September/October-ish times. It's not easily reproduced and happens on
> a handful of machines only. I guess that's why. But that does not make
> it less serious, I think.
>
> Though there actually is a report here:
> https://bugzilla.kernel.org/show_bug.cgi?id=196443
>
> And there are reports for Fedora from July:
> https://bugzilla.redhat.com/show_bug.cgi?id=1473242
> and CentOS:
> https://bugs.centos.org/view.php?id=13964
> and we internally track several dozens reports for RHEL bug
> https://bugzilla.redhat.com/show_bug.cgi?id=1525121
>
> Link: http://lkml.kernel.org/r/0485727b2e82da7efbce5f6ba42524b429d0391a.1520011945.git.neelx@redhat.com
> Fixes: b92df1de5d28 ("mm: page_alloc: skip over regions of invalid pfns where possible")
> Signed-off-by: Daniel Vacek <neelx@redhat.com>
> Cc: Mel Gorman <mgorman@techsingularity.net>
> Cc: Michal Hocko <mhocko@suse.com>
> Cc: Paul Burton <paul.burton@imgtec.com>
> Cc: Pavel Tatashin <pasha.tatashin@oracle.com>
> Cc: Vlastimil Babka <vbabka@suse.cz>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> mm/page_alloc.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -5353,9 +5353,14 @@ void __meminit memmap_init_zone(unsigned
> /*
> * Skip to the pfn preceding the next valid one (or
> * end_pfn), such that we hit a valid pfn (or end_pfn)
> - * on our next iteration of the loop.
> + * on our next iteration of the loop. Note that it needs
> + * to be pageblock aligned even when the region itself
> + * is not. move_freepages_block() can shift ahead of
> + * the valid region but still depends on correct page
> + * metadata.
> */
> - pfn = memblock_next_valid_pfn(pfn, end_pfn) - 1;
> + pfn = (memblock_next_valid_pfn(pfn, end_pfn) &
> + ~(pageblock_nr_pages-1)) - 1;
> #endif
> continue;
> }
>
>
^ permalink raw reply [flat|nested] 160+ messages in thread* Re: [PATCH 4.15 049/146] mm/page_alloc: fix memmap_init_zone pageblock alignment
2018-03-13 19:34 ` Dan Rue
@ 2018-03-13 21:47 ` Daniel Vacek
2018-03-14 10:54 ` Greg Kroah-Hartman
1 sibling, 0 replies; 160+ messages in thread
From: Daniel Vacek @ 2018-03-13 21:47 UTC (permalink / raw)
To: Greg Kroah-Hartman, open list, stable, Daniel Vacek, Mel Gorman,
Michal Hocko, Paul Burton, Pavel Tatashin, Vlastimil Babka,
Andrew Morton, Linus Torvalds
On Tue, Mar 13, 2018 at 8:34 PM, Dan Rue <dan.rue@linaro.org> wrote:
> On Tue, Mar 13, 2018 at 04:23:36PM +0100, Greg Kroah-Hartman wrote:
>> 4.15-stable review patch. If anyone has any objections, please let me know.
>
> On 4.14 and 4.15, this patch breaks booting on dragonboard 410c and
> hikey 620 (both arm64). The fix has been proposed and tested but is not
> yet in mainline per https://lkml.org/lkml/2018/3/12/710
I'll send a formal fix today.
> Dan
>
>>
>> ------------------
>>
>> From: Daniel Vacek <neelx@redhat.com>
>>
>> commit 864b75f9d6b0100bb24fdd9a20d156e7cda9b5ae upstream.
>>
>> Commit b92df1de5d28 ("mm: page_alloc: skip over regions of invalid pfns
>> where possible") introduced a bug where move_freepages() triggers a
>> VM_BUG_ON() on uninitialized page structure due to pageblock alignment.
>> To fix this, simply align the skipped pfns in memmap_init_zone() the
>> same way as in move_freepages_block().
>>
>> Seen in one of the RHEL reports:
>>
>> crash> log | grep -e BUG -e RIP -e Call.Trace -e move_freepages_block -e rmqueue -e freelist -A1
>> kernel BUG at mm/page_alloc.c:1389!
>> invalid opcode: 0000 [#1] SMP
>> --
>> RIP: 0010:[<ffffffff8118833e>] [<ffffffff8118833e>] move_freepages+0x15e/0x160
>> RSP: 0018:ffff88054d727688 EFLAGS: 00010087
>> --
>> Call Trace:
>> [<ffffffff811883b3>] move_freepages_block+0x73/0x80
>> [<ffffffff81189e63>] __rmqueue+0x263/0x460
>> [<ffffffff8118c781>] get_page_from_freelist+0x7e1/0x9e0
>> [<ffffffff8118caf6>] __alloc_pages_nodemask+0x176/0x420
>> --
>> RIP [<ffffffff8118833e>] move_freepages+0x15e/0x160
>> RSP <ffff88054d727688>
>>
>> crash> page_init_bug -v | grep RAM
>> <struct resource 0xffff88067fffd2f8> 1000 - 9bfff System RAM (620.00 KiB)
>> <struct resource 0xffff88067fffd3a0> 100000 - 430bffff System RAM ( 1.05 GiB = 1071.75 MiB = 1097472.00 KiB)
>> <struct resource 0xffff88067fffd410> 4b0c8000 - 4bf9cfff System RAM ( 14.83 MiB = 15188.00 KiB)
>> <struct resource 0xffff88067fffd480> 4bfac000 - 646b1fff System RAM (391.02 MiB = 400408.00 KiB)
>> <struct resource 0xffff88067fffd560> 7b788000 - 7b7fffff System RAM (480.00 KiB)
>> <struct resource 0xffff88067fffd640> 100000000 - 67fffffff System RAM ( 22.00 GiB)
>>
>> crash> page_init_bug | head -6
>> <struct resource 0xffff88067fffd560> 7b788000 - 7b7fffff System RAM (480.00 KiB)
>> <struct page 0xffffea0001ede200> 1fffff00000000 0 <struct pglist_data 0xffff88047ffd9000> 1 <struct zone 0xffff88047ffd9800> DMA32 4096 1048575
>> <struct page 0xffffea0001ede200> 505736 505344 <struct page 0xffffea0001ed8000> 505855 <struct page 0xffffea0001edffc0>
>> <struct page 0xffffea0001ed8000> 0 0 <struct pglist_data 0xffff88047ffd9000> 0 <struct zone 0xffff88047ffd9000> DMA 1 4095
>> <struct page 0xffffea0001edffc0> 1fffff00000400 0 <struct pglist_data 0xffff88047ffd9000> 1 <struct zone 0xffff88047ffd9800> DMA32 4096 1048575
>> BUG, zones differ!
>>
>> Note that this range follows two not populated sections
>> 68000000-77ffffff in this zone. 7b788000-7b7fffff is the first one
>> after a gap. This makes memmap_init_zone() skip all the pfns up to the
>> beginning of this range. But this range is not pageblock (2M) aligned.
>> In fact no range has to be.
>>
>> crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b787000 7b788000
>> PAGE PHYSICAL MAPPING INDEX CNT FLAGS
>> ffffea0001e00000 78000000 0 0 0 0
>> ffffea0001ed7fc0 7b5ff000 0 0 0 0
>> ffffea0001ed8000 7b600000 0 0 0 0 <<<<
>> ffffea0001ede1c0 7b787000 0 0 0 0
>> ffffea0001ede200 7b788000 0 0 1 1fffff00000000
>>
>> Top part of page flags should contain nodeid and zonenr, which is not
>> the case for page ffffea0001ed8000 here (<<<<).
>>
>> crash> log | grep -o fffea0001ed[^\ ]* | sort -u
>> fffea0001ed8000
>> fffea0001eded20
>> fffea0001edffc0
>>
>> crash> bt -r | grep -o fffea0001ed[^\ ]* | sort -u
>> fffea0001ed8000
>> fffea0001eded00
>> fffea0001eded20
>> fffea0001edffc0
>>
>> Initialization of the whole beginning of the section is skipped up to
>> the start of the range due to the commit b92df1de5d28. Now any code
>> calling move_freepages_block() (like reusing the page from a freelist as
>> in this example) with a page from the beginning of the range will get
>> the page rounded down to start_page ffffea0001ed8000 and passed to
>> move_freepages() which crashes on assertion getting wrong zonenr.
>>
>> > VM_BUG_ON(page_zone(start_page) != page_zone(end_page));
>>
>> Note, page_zone() derives the zone from page flags here.
>>
>> >From similar machine before commit b92df1de5d28:
>>
>> crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b7fe000 7b7ff000
>> PAGE PHYSICAL MAPPING INDEX CNT FLAGS
>> fffff73941e00000 78000000 0 0 1 1fffff00000000
>> fffff73941ed7fc0 7b5ff000 0 0 1 1fffff00000000
>> fffff73941ed8000 7b600000 0 0 1 1fffff00000000
>> fffff73941edff80 7b7fe000 0 0 1 1fffff00000000
>> fffff73941edffc0 7b7ff000 ffff8e67e04d3ae0 ad84 1 1fffff00020068 uptodate,lru,active,mappedtodisk
>>
>> All the pages since the beginning of the section are initialized.
>> move_freepages()' not gonna blow up.
>>
>> The same machine with this fix applied:
>>
>> crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b7fe000 7b7ff000
>> PAGE PHYSICAL MAPPING INDEX CNT FLAGS
>> ffffea0001e00000 78000000 0 0 0 0
>> ffffea0001e00000 7b5ff000 0 0 0 0
>> ffffea0001ed8000 7b600000 0 0 1 1fffff00000000
>> ffffea0001edff80 7b7fe000 0 0 1 1fffff00000000
>> ffffea0001edffc0 7b7ff000 ffff88017fb13720 8 2 1fffff00020068 uptodate,lru,active,mappedtodisk
>>
>> At least the bare minimum of pages is initialized preventing the crash
>> as well.
>>
>> Customers started to report this as soon as 7.4 (where b92df1de5d28 was
>> merged in RHEL) was released. I remember reports from
>> September/October-ish times. It's not easily reproduced and happens on
>> a handful of machines only. I guess that's why. But that does not make
>> it less serious, I think.
>>
>> Though there actually is a report here:
>> https://bugzilla.kernel.org/show_bug.cgi?id=196443
>>
>> And there are reports for Fedora from July:
>> https://bugzilla.redhat.com/show_bug.cgi?id=1473242
>> and CentOS:
>> https://bugs.centos.org/view.php?id=13964
>> and we internally track several dozens reports for RHEL bug
>> https://bugzilla.redhat.com/show_bug.cgi?id=1525121
>>
>> Link: http://lkml.kernel.org/r/0485727b2e82da7efbce5f6ba42524b429d0391a.1520011945.git.neelx@redhat.com
>> Fixes: b92df1de5d28 ("mm: page_alloc: skip over regions of invalid pfns where possible")
>> Signed-off-by: Daniel Vacek <neelx@redhat.com>
>> Cc: Mel Gorman <mgorman@techsingularity.net>
>> Cc: Michal Hocko <mhocko@suse.com>
>> Cc: Paul Burton <paul.burton@imgtec.com>
>> Cc: Pavel Tatashin <pasha.tatashin@oracle.com>
>> Cc: Vlastimil Babka <vbabka@suse.cz>
>> Cc: <stable@vger.kernel.org>
>> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
>> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>>
>> ---
>> mm/page_alloc.c | 9 +++++++--
>> 1 file changed, 7 insertions(+), 2 deletions(-)
>>
>> --- a/mm/page_alloc.c
>> +++ b/mm/page_alloc.c
>> @@ -5353,9 +5353,14 @@ void __meminit memmap_init_zone(unsigned
>> /*
>> * Skip to the pfn preceding the next valid one (or
>> * end_pfn), such that we hit a valid pfn (or end_pfn)
>> - * on our next iteration of the loop.
>> + * on our next iteration of the loop. Note that it needs
>> + * to be pageblock aligned even when the region itself
>> + * is not. move_freepages_block() can shift ahead of
>> + * the valid region but still depends on correct page
>> + * metadata.
>> */
>> - pfn = memblock_next_valid_pfn(pfn, end_pfn) - 1;
>> + pfn = (memblock_next_valid_pfn(pfn, end_pfn) &
>> + ~(pageblock_nr_pages-1)) - 1;
>> #endif
>> continue;
>> }
>>
>>
^ permalink raw reply [flat|nested] 160+ messages in thread* Re: [PATCH 4.15 049/146] mm/page_alloc: fix memmap_init_zone pageblock alignment
2018-03-13 19:34 ` Dan Rue
2018-03-13 21:47 ` Daniel Vacek
@ 2018-03-14 10:54 ` Greg Kroah-Hartman
1 sibling, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-14 10:54 UTC (permalink / raw)
To: linux-kernel, stable, Daniel Vacek, Mel Gorman, Michal Hocko,
Paul Burton, Pavel Tatashin, Vlastimil Babka, Andrew Morton,
Linus Torvalds
On Tue, Mar 13, 2018 at 02:34:57PM -0500, Dan Rue wrote:
> On Tue, Mar 13, 2018 at 04:23:36PM +0100, Greg Kroah-Hartman wrote:
> > 4.15-stable review patch. If anyone has any objections, please let me know.
>
> On 4.14 and 4.15, this patch breaks booting on dragonboard 410c and
> hikey 620 (both arm64). The fix has been proposed and tested but is not
> yet in mainline per https://lkml.org/lkml/2018/3/12/710
Thanks for letting me know, now dropped.
I'll go respin a -rc2 with this change.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 160+ messages in thread
* [PATCH 4.15 050/146] Documentation/sphinx: Fix Directive import error
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 049/146] mm/page_alloc: fix memmap_init_zone pageblock alignment Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 051/146] loop: Fix lost writes caused by missing flag Greg Kroah-Hartman
` (99 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jani Nikula, Matthew Wilcox, Jonathan Corbet
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox <mawilcox@microsoft.com>
commit ff690eeed804f112242f9a0614eafdf559f9276a upstream.
Sphinx 1.7 removed sphinx.util.compat.Directive so people
who have upgraded cannot build the documentation. Switch to
docutils.parsers.rst.Directive which has been available since
docutils 0.5 released in 2009.
Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1083694
Co-developed-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Jani Nikula <jani.nikula@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/sphinx/kerneldoc.py | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/Documentation/sphinx/kerneldoc.py
+++ b/Documentation/sphinx/kerneldoc.py
@@ -36,8 +36,7 @@ import glob
from docutils import nodes, statemachine
from docutils.statemachine import ViewList
-from docutils.parsers.rst import directives
-from sphinx.util.compat import Directive
+from docutils.parsers.rst import directives, Directive
from sphinx.ext.autodoc import AutodocReporter
__version__ = '1.0'
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 051/146] loop: Fix lost writes caused by missing flag
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 050/146] Documentation/sphinx: Fix Directive import error Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 052/146] virtio_ring: fix num_free handling in error case Greg Kroah-Hartman
` (98 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Al Viro, Christoph Hellwig, Ming Lei,
Ross Zwisler, Jens Axboe
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ross Zwisler <ross.zwisler@linux.intel.com>
commit 1d037577c323e5090ce281e96bc313ab2eee5be2 upstream.
The following commit:
commit aa4d86163e4e ("block: loop: switch to VFS ITER_BVEC")
replaced __do_lo_send_write(), which used ITER_KVEC iterators, with
lo_write_bvec() which uses ITER_BVEC iterators. In this change, though,
the WRITE flag was lost:
- iov_iter_kvec(&from, ITER_KVEC | WRITE, &kvec, 1, len);
+ iov_iter_bvec(&i, ITER_BVEC, bvec, 1, bvec->bv_len);
This flag is necessary for the DAX case because we make decisions based on
whether or not the iterator is a READ or a WRITE in dax_iomap_actor() and
in dax_iomap_rw().
We end up going through this path in configurations where we combine a PMEM
device with 4k sectors, a loopback device and DAX. The consequence of this
missed flag is that what we intend as a write actually turns into a read in
the DAX code, so no data is ever written.
The very simplest test case is to create a loopback device and try and
write a small string to it, then hexdump a few bytes of the device to see
if the write took. Without this patch you read back all zeros, with this
you read back the string you wrote.
For XFS this causes us to fail or panic during the following xfstests:
xfs/074 xfs/078 xfs/216 xfs/217 xfs/250
For ext4 we have a similar issue where writes never happen, but we don't
currently have any xfstests that use loopback and show this issue.
Fix this by restoring the WRITE flag argument to iov_iter_bvec(). This
causes the xfstests to all pass.
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: stable@vger.kernel.org
Fixes: commit aa4d86163e4e ("block: loop: switch to VFS ITER_BVEC")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/loop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -266,7 +266,7 @@ static int lo_write_bvec(struct file *fi
struct iov_iter i;
ssize_t bw;
- iov_iter_bvec(&i, ITER_BVEC, bvec, 1, bvec->bv_len);
+ iov_iter_bvec(&i, ITER_BVEC | WRITE, bvec, 1, bvec->bv_len);
file_start_write(file);
bw = vfs_iter_write(file, &i, ppos, 0);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 052/146] virtio_ring: fix num_free handling in error case
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 051/146] loop: Fix lost writes caused by missing flag Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 053/146] KVM: s390: fix memory overwrites when not using SCA entries Greg Kroah-Hartman
` (97 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Lutomirski, Michael S. Tsirkin,
Tiwei Bie
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiwei Bie <tiwei.bie@intel.com>
commit e82df670235138575b37ff0ec24412a471efd97f upstream.
The vq->vq.num_free hasn't been changed when error happens,
so it shouldn't be changed when handling the error.
Fixes: 780bc7903a32 ("virtio_ring: Support DMA APIs")
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Tiwei Bie <tiwei.bie@intel.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/virtio/virtio_ring.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -428,8 +428,6 @@ unmap_release:
i = virtio16_to_cpu(_vq->vdev, vq->vring.desc[i].next);
}
- vq->vq.num_free += total_sg;
-
if (indirect)
kfree(desc);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 053/146] KVM: s390: fix memory overwrites when not using SCA entries
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 052/146] virtio_ring: fix num_free handling in error case Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 054/146] arm64: mm: fix thinko in non-global page table attribute check Greg Kroah-Hartman
` (96 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Borntraeger,
David Hildenbrand, Cornelia Huck
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <david@redhat.com>
commit f07afa0462b76a5b9c4f3a43d5ac24fdb86a90c2 upstream.
Even if we don't have extended SCA support, we can have more than 64 CPUs
if we don't enable any HW features that might use the SCA entries.
Now, this works just fine, but we missed a return, which is why we
would actually store the SCA entries. If we have more than 64 CPUs, this
means writing outside of the basic SCA - bad.
Let's fix this. This allows > 64 CPUs when running nested (under vSIE)
without random crashes.
Fixes: a6940674c384 ("KVM: s390: allow 255 VCPUs when sca entries aren't used")
Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20180306132758.21034-1-david@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/kvm-s390.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -2118,6 +2118,7 @@ static void sca_add_vcpu(struct kvm_vcpu
/* we still need the basic sca for the ipte control */
vcpu->arch.sie_block->scaoh = (__u32)(((__u64)sca) >> 32);
vcpu->arch.sie_block->scaol = (__u32)(__u64)sca;
+ return;
}
read_lock(&vcpu->kvm->arch.sca_lock);
if (vcpu->kvm->arch.use_esca) {
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 054/146] arm64: mm: fix thinko in non-global page table attribute check
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 053/146] KVM: s390: fix memory overwrites when not using SCA entries Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 055/146] IB/core: Fix missing RDMA cgroups release in case of failure to register device Greg Kroah-Hartman
` (95 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Rutland, Marc Zyngier,
Will Deacon, Ard Biesheuvel, Catalin Marinas
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
commit 753e8abc36b2c966caea075db0c845563c8a19bf upstream.
The routine pgattr_change_is_safe() was extended in commit 4e6020565596
("arm64: mm: Permit transitioning from Global to Non-Global without BBM")
to permit changing the nG attribute from not set to set, but did so in a
way that inadvertently disallows such changes if other permitted attribute
changes take place at the same time. So update the code to take this into
account.
Fixes: 4e6020565596 ("arm64: mm: Permit transitioning from Global to ...")
Cc: <stable@vger.kernel.org> # 4.14.x-
Acked-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/mm/mmu.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -107,7 +107,7 @@ static bool pgattr_change_is_safe(u64 ol
* The following mapping attributes may be updated in live
* kernel mappings without the need for break-before-make.
*/
- static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE;
+ static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE | PTE_NG;
/* creating or taking down mappings is always safe */
if (old == 0 || new == 0)
@@ -117,9 +117,9 @@ static bool pgattr_change_is_safe(u64 ol
if ((old | new) & PTE_CONT)
return false;
- /* Transitioning from Global to Non-Global is safe */
- if (((old ^ new) == PTE_NG) && (new & PTE_NG))
- return true;
+ /* Transitioning from Non-Global to Global is unsafe */
+ if (old & ~new & PTE_NG)
+ return false;
return ((old ^ new) & ~mask) == 0;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 055/146] IB/core: Fix missing RDMA cgroups release in case of failure to register device
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 054/146] arm64: mm: fix thinko in non-global page table attribute check Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 056/146] Revert "nvme: create slaves and holders entries for hidden controllers" Greg Kroah-Hartman
` (94 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Jurgens, Parav Pandit,
Leon Romanovsky, Jason Gunthorpe
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parav Pandit <parav@mellanox.com>
commit 2fb4f4eadd180a50112618dd9c5fef7fc50d4f08 upstream.
During IB device registration process, if query_device() fails or if
ib_core fails to registers sysfs entries, rdma cgroup cleanup is
skipped.
Cc: <stable@vger.kernel.org> # v4.2+
Fixes: 4be3a4fa51f4 ("IB/core: Fix kernel crash during fail to initialize device")
Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
Signed-off-by: Parav Pandit <parav@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/device.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -534,14 +534,14 @@ int ib_register_device(struct ib_device
ret = device->query_device(device, &device->attrs, &uhw);
if (ret) {
pr_warn("Couldn't query the device attributes\n");
- goto cache_cleanup;
+ goto cg_cleanup;
}
ret = ib_device_register_sysfs(device, port_callback);
if (ret) {
pr_warn("Couldn't register device %s with driver model\n",
device->name);
- goto cache_cleanup;
+ goto cg_cleanup;
}
device->reg_state = IB_DEV_REGISTERED;
@@ -557,6 +557,8 @@ int ib_register_device(struct ib_device
mutex_unlock(&device_mutex);
return 0;
+cg_cleanup:
+ ib_device_unregister_rdmacg(device);
cache_cleanup:
ib_cache_cleanup_one(device);
ib_cache_release_one(device);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 056/146] Revert "nvme: create slaves and holders entries for hidden controllers"
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 055/146] IB/core: Fix missing RDMA cgroups release in case of failure to register device Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 057/146] kbuild: Handle builtin dtb file names containing hyphens Greg Kroah-Hartman
` (93 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christoph Hellwig,
Potnuri Bharat Teja, Keith Busch
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
commit 8a30ecc6e0ecbb9ae95daf499b2680b885ed0349 upstream.
This reverts commit e9a48034d7d1318ece7d4a235838a86c94db9d68.
The slaves and holders link for the hidden gendisks confuse lsblk so that
it errors out on, or doesn't report the nvme multipath devices. Given
that we don't need holder relationships for something that can't even be
directly accessed we should just stop creating those links.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reported-by: Potnuri Bharat Teja <bharat@chelsio.com>
Cc: stable@vger.kernel.org
Signed-off-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/core.c | 2 --
drivers/nvme/host/multipath.c | 30 ------------------------------
drivers/nvme/host/nvme.h | 8 --------
3 files changed, 40 deletions(-)
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -2950,7 +2950,6 @@ static void nvme_alloc_ns(struct nvme_ct
if (new)
nvme_mpath_add_disk(ns->head);
- nvme_mpath_add_disk_links(ns);
return;
out_unlink_ns:
mutex_lock(&ctrl->subsys->lock);
@@ -2970,7 +2969,6 @@ static void nvme_ns_remove(struct nvme_n
return;
if (ns->disk && ns->disk->flags & GENHD_FL_UP) {
- nvme_mpath_remove_disk_links(ns);
sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
&nvme_ns_id_attr_group);
if (ns->ndev)
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -245,25 +245,6 @@ void nvme_mpath_add_disk(struct nvme_ns_
head->disk->disk_name);
}
-void nvme_mpath_add_disk_links(struct nvme_ns *ns)
-{
- struct kobject *slave_disk_kobj, *holder_disk_kobj;
-
- if (!ns->head->disk)
- return;
-
- slave_disk_kobj = &disk_to_dev(ns->disk)->kobj;
- if (sysfs_create_link(ns->head->disk->slave_dir, slave_disk_kobj,
- kobject_name(slave_disk_kobj)))
- return;
-
- holder_disk_kobj = &disk_to_dev(ns->head->disk)->kobj;
- if (sysfs_create_link(ns->disk->part0.holder_dir, holder_disk_kobj,
- kobject_name(holder_disk_kobj)))
- sysfs_remove_link(ns->head->disk->slave_dir,
- kobject_name(slave_disk_kobj));
-}
-
void nvme_mpath_remove_disk(struct nvme_ns_head *head)
{
if (!head->disk)
@@ -278,14 +259,3 @@ void nvme_mpath_remove_disk(struct nvme_
blk_cleanup_queue(head->disk->queue);
put_disk(head->disk);
}
-
-void nvme_mpath_remove_disk_links(struct nvme_ns *ns)
-{
- if (!ns->head->disk)
- return;
-
- sysfs_remove_link(ns->disk->part0.holder_dir,
- kobject_name(&disk_to_dev(ns->head->disk)->kobj));
- sysfs_remove_link(ns->head->disk->slave_dir,
- kobject_name(&disk_to_dev(ns->disk)->kobj));
-}
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -405,9 +405,7 @@ bool nvme_req_needs_failover(struct requ
void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl);
int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl,struct nvme_ns_head *head);
void nvme_mpath_add_disk(struct nvme_ns_head *head);
-void nvme_mpath_add_disk_links(struct nvme_ns *ns);
void nvme_mpath_remove_disk(struct nvme_ns_head *head);
-void nvme_mpath_remove_disk_links(struct nvme_ns *ns);
static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns)
{
@@ -448,12 +446,6 @@ static inline void nvme_mpath_add_disk(s
static inline void nvme_mpath_remove_disk(struct nvme_ns_head *head)
{
}
-static inline void nvme_mpath_add_disk_links(struct nvme_ns *ns)
-{
-}
-static inline void nvme_mpath_remove_disk_links(struct nvme_ns *ns)
-{
-}
static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns)
{
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 057/146] kbuild: Handle builtin dtb file names containing hyphens
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 056/146] Revert "nvme: create slaves and holders entries for hidden controllers" Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 058/146] dm bufio: avoid false-positive Wmaybe-uninitialized warning Greg Kroah-Hartman
` (92 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Hogan, Frank Rowand,
Rob Herring, Michal Marek, Ralf Baechle, Florian Fainelli,
Kevin Cernekee, Masahiro Yamada
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <jhogan@kernel.org>
commit 55fe6da9efba102866e2fb5b40b04b6a4b26c19e upstream.
cmd_dt_S_dtb constructs the assembly source to incorporate a devicetree
FDT (that is, the .dtb file) as binary data in the kernel image. This
assembly source contains labels before and after the binary data. The
label names incorporate the file name of the corresponding .dtb file.
Hyphens are not legal characters in labels, so .dtb files built into the
kernel with hyphens in the file name result in errors like the
following:
bcm3368-netgear-cvg834g.dtb.S: Assembler messages:
bcm3368-netgear-cvg834g.dtb.S:5: Error: : no such section
bcm3368-netgear-cvg834g.dtb.S:5: Error: junk at end of line, first unrecognized character is `-'
bcm3368-netgear-cvg834g.dtb.S:6: Error: unrecognized opcode `__dtb_bcm3368-netgear-cvg834g_begin:'
bcm3368-netgear-cvg834g.dtb.S:8: Error: unrecognized opcode `__dtb_bcm3368-netgear-cvg834g_end:'
bcm3368-netgear-cvg834g.dtb.S:9: Error: : no such section
bcm3368-netgear-cvg834g.dtb.S:9: Error: junk at end of line, first unrecognized character is `-'
Fix this by updating cmd_dt_S_dtb to transform all hyphens from the file
name to underscores when constructing the labels.
As of v4.16-rc2, 1139 .dts files across ARM64, ARM, MIPS and PowerPC
contain hyphens in their names, but the issue only currently manifests
on Broadcom MIPS platforms, as that is the only place where such files
are built into the kernel. For example when CONFIG_DT_NETGEAR_CVG834G=y,
or on BMIPS kernels when the dtbs target is used (in the latter case it
admittedly shouldn't really build all the dtb.o files, but thats a
separate issue).
Fixes: 695835511f96 ("MIPS: BMIPS: rename bcm96358nb4ser to bcm6358-neufbox4-sercom")
Signed-off-by: James Hogan <jhogan@kernel.org>
Reviewed-by: Frank Rowand <frowand.list@gmail.com>
Cc: Rob Herring <robh+dt@kernel.org>
Cc: Michal Marek <michal.lkml@markovi.net>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: Kevin Cernekee <cernekee@gmail.com>
Cc: <stable@vger.kernel.org> # 4.9+
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
scripts/Makefile.lib | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -287,11 +287,11 @@ cmd_dt_S_dtb= \
echo '\#include <asm-generic/vmlinux.lds.h>'; \
echo '.section .dtb.init.rodata,"a"'; \
echo '.balign STRUCT_ALIGNMENT'; \
- echo '.global __dtb_$(*F)_begin'; \
- echo '__dtb_$(*F)_begin:'; \
+ echo '.global __dtb_$(subst -,_,$(*F))_begin'; \
+ echo '__dtb_$(subst -,_,$(*F))_begin:'; \
echo '.incbin "$<" '; \
- echo '__dtb_$(*F)_end:'; \
- echo '.global __dtb_$(*F)_end'; \
+ echo '__dtb_$(subst -,_,$(*F))_end:'; \
+ echo '.global __dtb_$(subst -,_,$(*F))_end'; \
echo '.balign STRUCT_ALIGNMENT'; \
) > $@
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 058/146] dm bufio: avoid false-positive Wmaybe-uninitialized warning
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 057/146] kbuild: Handle builtin dtb file names containing hyphens Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 059/146] IB/mlx5: Fix incorrect size of klms in the memory region Greg Kroah-Hartman
` (91 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Mike Snitzer
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 590347e4000356f55eb10b03ced2686bd74dab40 upstream.
gcc-6.3 and earlier show a new warning after a seemingly unrelated
change to the arm64 PAGE_KERNEL definition:
In file included from drivers/md/dm-bufio.c:14:0:
drivers/md/dm-bufio.c: In function 'alloc_buffer':
include/linux/sched/mm.h:182:56: warning: 'noio_flag' may be used uninitialized in this function [-Wmaybe-uninitialized]
current->flags = (current->flags & ~PF_MEMALLOC_NOIO) | flags;
^
The same warning happened earlier on linux-3.18 for MIPS and I did a
workaround for that, but now it's come back.
gcc-7 and newer are apparently smart enough to figure this out, and
other architectures don't show it, so the best I could come up with is
to rework the caller slightly in a way that makes it obvious enough to
all arm64 compilers what is happening here.
Fixes: 41acec624087 ("arm64: kpti: Make use of nG dependent on arm64_kernel_unmapped_at_el0()")
Link: https://patchwork.kernel.org/patch/9692829/
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
[snitzer: moved declarations inside conditional, altered vmalloc return]
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-bufio.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -386,9 +386,6 @@ static void __cache_size_refresh(void)
static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask,
enum data_mode *data_mode)
{
- unsigned noio_flag;
- void *ptr;
-
if (c->block_size <= DM_BUFIO_BLOCK_SIZE_SLAB_LIMIT) {
*data_mode = DATA_MODE_SLAB;
return kmem_cache_alloc(DM_BUFIO_CACHE(c), gfp_mask);
@@ -412,16 +409,15 @@ static void *alloc_buffer_data(struct dm
* all allocations done by this process (including pagetables) are done
* as if GFP_NOIO was specified.
*/
+ if (gfp_mask & __GFP_NORETRY) {
+ unsigned noio_flag = memalloc_noio_save();
+ void *ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
- if (gfp_mask & __GFP_NORETRY)
- noio_flag = memalloc_noio_save();
-
- ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
-
- if (gfp_mask & __GFP_NORETRY)
memalloc_noio_restore(noio_flag);
+ return ptr;
+ }
- return ptr;
+ return __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
}
/*
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 059/146] IB/mlx5: Fix incorrect size of klms in the memory region
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 058/146] dm bufio: avoid false-positive Wmaybe-uninitialized warning Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 060/146] bcache: fix crashes in duplicate cache device register Greg Kroah-Hartman
` (90 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergey Gorenko, Laurence Oberman,
Leon Romanovsky, Jason Gunthorpe
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Gorenko <sergeygo@mellanox.com>
commit da343b6d90e11132f1e917d865d88ee35d6e6d00 upstream.
The value of mr->ndescs greater than mr->max_descs is set in the
function mlx5_ib_sg_to_klms() if sg_nents is greater than
mr->max_descs. This is an invalid value and it causes the
following error when registering mr:
mlx5_0:dump_cqe:276:(pid 193): dump error cqe
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000030: 00 00 00 00 0f 00 78 06 25 00 00 8b 08 1e 8f d3
Cc: <stable@vger.kernel.org> # 4.5
Fixes: b005d3164713 ("mlx5: Add arbitrary sg list support")
Signed-off-by: Sergey Gorenko <sergeygo@mellanox.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx5/mr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1813,7 +1813,6 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr
mr->ibmr.iova = sg_dma_address(sg) + sg_offset;
mr->ibmr.length = 0;
- mr->ndescs = sg_nents;
for_each_sg(sgl, sg, sg_nents, i) {
if (unlikely(i >= mr->max_descs))
@@ -1825,6 +1824,7 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr
sg_offset = 0;
}
+ mr->ndescs = i;
if (sg_offset_p)
*sg_offset_p = sg_offset;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 060/146] bcache: fix crashes in duplicate cache device register
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 059/146] IB/mlx5: Fix incorrect size of klms in the memory region Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 061/146] bcache: dont attach backing with duplicate UUID Greg Kroah-Hartman
` (89 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tang Junhui, Marc MERLIN,
Michael Lyle, Jens Axboe
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tang Junhui <tang.junhui@zte.com.cn>
commit cc40daf91bdddbba72a4a8cd0860640e06668309 upstream.
Kernel crashed when register a duplicate cache device, the call trace is
bellow:
[ 417.643790] CPU: 1 PID: 16886 Comm: bcache-register Tainted: G
W OE 4.15.5-amd64-preempt-sysrq-20171018 #2
[ 417.643861] Hardware name: LENOVO 20ERCTO1WW/20ERCTO1WW, BIOS
N1DET41W (1.15 ) 12/31/2015
[ 417.643870] RIP: 0010:bdevname+0x13/0x1e
[ 417.643876] RSP: 0018:ffffa3aa9138fd38 EFLAGS: 00010282
[ 417.643884] RAX: 0000000000000000 RBX: ffff8c8f2f2f8000 RCX: ffffd6701f8
c7edf
[ 417.643890] RDX: ffffa3aa9138fd88 RSI: ffffa3aa9138fd88 RDI: 00000000000
00000
[ 417.643895] RBP: ffffa3aa9138fde0 R08: ffffa3aa9138fae8 R09: 00000000000
1850e
[ 417.643901] R10: ffff8c8eed34b271 R11: ffff8c8eed34b250 R12: 00000000000
00000
[ 417.643906] R13: ffffd6701f78f940 R14: ffff8c8f38f80000 R15: ffff8c8ea7d
90000
[ 417.643913] FS: 00007fde7e66f500(0000) GS:ffff8c8f61440000(0000) knlGS:
0000000000000000
[ 417.643919] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 417.643925] CR2: 0000000000000314 CR3: 00000007e6fa0001 CR4: 00000000003
606e0
[ 417.643931] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000
00000
[ 417.643938] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000
00400
[ 417.643946] Call Trace:
[ 417.643978] register_bcache+0x1117/0x1270 [bcache]
[ 417.643994] ? slab_pre_alloc_hook+0x15/0x3c
[ 417.644001] ? slab_post_alloc_hook.isra.44+0xa/0x1a
[ 417.644013] ? kernfs_fop_write+0xf6/0x138
[ 417.644020] kernfs_fop_write+0xf6/0x138
[ 417.644031] __vfs_write+0x31/0xcc
[ 417.644043] ? current_kernel_time64+0x10/0x36
[ 417.644115] ? __audit_syscall_entry+0xbf/0xe3
[ 417.644124] vfs_write+0xa5/0xe2
[ 417.644133] SyS_write+0x5c/0x9f
[ 417.644144] do_syscall_64+0x72/0x81
[ 417.644161] entry_SYSCALL_64_after_hwframe+0x3d/0xa2
[ 417.644169] RIP: 0033:0x7fde7e1c1974
[ 417.644175] RSP: 002b:00007fff13009a38 EFLAGS: 00000246 ORIG_RAX: 0000000
000000001
[ 417.644183] RAX: ffffffffffffffda RBX: 0000000001658280 RCX: 00007fde7e1c
1974
[ 417.644188] RDX: 000000000000000a RSI: 0000000001658280 RDI: 000000000000
0001
[ 417.644193] RBP: 000000000000000a R08: 0000000000000003 R09: 000000000000
0077
[ 417.644198] R10: 000000000000089e R11: 0000000000000246 R12: 000000000000
0001
[ 417.644203] R13: 000000000000000a R14: 7fffffffffffffff R15: 000000000000
0000
[ 417.644213] Code: c7 c2 83 6f ee 98 be 20 00 00 00 48 89 df e8 6c 27 3b 0
0 48 89 d8 5b c3 0f 1f 44 00 00 48 8b 47 70 48 89 f2 48 8b bf 80 00 00 00 <8
b> b0 14 03 00 00 e9 73 ff ff ff 0f 1f 44 00 00 48 8b 47 40 39
[ 417.644302] RIP: bdevname+0x13/0x1e RSP: ffffa3aa9138fd38
[ 417.644306] CR2: 0000000000000314
When registering duplicate cache device in register_cache(), after failure
on calling register_cache_set(), bch_cache_release() will be called, then
bdev will be freed, so bdevname(bdev, name) caused kernel crash.
Since bch_cache_release() will free bdev, so in this patch we make sure
bdev being freed if register_cache() fail, and do not free bdev again in
register_bcache() when register_cache() fail.
Signed-off-by: Tang Junhui <tang.junhui@zte.com.cn>
Reported-by: Marc MERLIN <marc@merlins.org>
Tested-by: Michael Lyle <mlyle@lyle.org>
Reviewed-by: Michael Lyle <mlyle@lyle.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/bcache/super.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1191,7 +1191,7 @@ static void register_bdev(struct cache_s
return;
err:
- pr_notice("error opening %s: %s", bdevname(bdev, name), err);
+ pr_notice("error %s: %s", bdevname(bdev, name), err);
bcache_device_stop(&dc->disk);
}
@@ -1859,6 +1859,8 @@ static int register_cache(struct cache_s
const char *err = NULL; /* must be set for any error case */
int ret = 0;
+ bdevname(bdev, name);
+
memcpy(&ca->sb, sb, sizeof(struct cache_sb));
ca->bdev = bdev;
ca->bdev->bd_holder = ca;
@@ -1867,11 +1869,12 @@ static int register_cache(struct cache_s
ca->sb_bio.bi_io_vec[0].bv_page = sb_page;
get_page(sb_page);
- if (blk_queue_discard(bdev_get_queue(ca->bdev)))
+ if (blk_queue_discard(bdev_get_queue(bdev)))
ca->discard = CACHE_DISCARD(&ca->sb);
ret = cache_alloc(ca);
if (ret != 0) {
+ blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
if (ret == -ENOMEM)
err = "cache_alloc(): -ENOMEM";
else
@@ -1894,14 +1897,14 @@ static int register_cache(struct cache_s
goto out;
}
- pr_info("registered cache device %s", bdevname(bdev, name));
+ pr_info("registered cache device %s", name);
out:
kobject_put(&ca->kobj);
err:
if (err)
- pr_notice("error opening %s: %s", bdevname(bdev, name), err);
+ pr_notice("error %s: %s", name, err);
return ret;
}
@@ -1990,6 +1993,7 @@ static ssize_t register_bcache(struct ko
if (err)
goto err_close;
+ err = "failed to register device";
if (SB_IS_BDEV(sb)) {
struct cached_dev *dc = kzalloc(sizeof(*dc), GFP_KERNEL);
if (!dc)
@@ -2004,7 +2008,7 @@ static ssize_t register_bcache(struct ko
goto err_close;
if (register_cache(sb, sb_page, bdev, ca) != 0)
- goto err_close;
+ goto err;
}
out:
if (sb_page)
@@ -2017,7 +2021,7 @@ out:
err_close:
blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
err:
- pr_info("error opening %s: %s", path, err);
+ pr_info("error %s: %s", path, err);
ret = -EINVAL;
goto out;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 061/146] bcache: dont attach backing with duplicate UUID
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 060/146] bcache: fix crashes in duplicate cache device register Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 062/146] x86/MCE: Save microcode revision in machine check records Greg Kroah-Hartman
` (88 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Lyle, Tang Junhui, Jens Axboe
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Lyle <mlyle@lyle.org>
commit 86755b7a96faed57f910f9e6b8061e019ac1ec08 upstream.
This can happen e.g. during disk cloning.
This is an incomplete fix: it does not catch duplicate UUIDs earlier
when things are still unattached. It does not unregister the device.
Further changes to cope better with this are planned but conflict with
Coly's ongoing improvements to handling device errors. In the meantime,
one can manually stop the device after this has happened.
Attempts to attach a duplicate device result in:
[ 136.372404] loop: module loaded
[ 136.424461] bcache: register_bdev() registered backing device loop0
[ 136.424464] bcache: bch_cached_dev_attach() Tried to attach loop0 but duplicate UUID already attached
My test procedure is:
dd if=/dev/sdb1 of=imgfile bs=1024 count=262144
losetup -f imgfile
Signed-off-by: Michael Lyle <mlyle@lyle.org>
Reviewed-by: Tang Junhui <tang.junhui@zte.com.cn>
Cc: <stable@vger.kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/bcache/super.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -951,6 +951,7 @@ int bch_cached_dev_attach(struct cached_
uint32_t rtime = cpu_to_le32(get_seconds());
struct uuid_entry *u;
char buf[BDEVNAME_SIZE];
+ struct cached_dev *exist_dc, *t;
bdevname(dc->bdev, buf);
@@ -974,6 +975,16 @@ int bch_cached_dev_attach(struct cached_
return -EINVAL;
}
+ /* Check whether already attached */
+ list_for_each_entry_safe(exist_dc, t, &c->cached_devs, list) {
+ if (!memcmp(dc->sb.uuid, exist_dc->sb.uuid, 16)) {
+ pr_err("Tried to attach %s but duplicate UUID already attached",
+ buf);
+
+ return -EINVAL;
+ }
+ }
+
u = uuid_find(c, dc->sb.uuid);
if (u &&
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 062/146] x86/MCE: Save microcode revision in machine check records
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 061/146] bcache: dont attach backing with duplicate UUID Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 063/146] x86/MCE: Serialize sysfs changes Greg Kroah-Hartman
` (87 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tony Luck, Borislav Petkov,
Thomas Gleixner, Yazen Ghannam, linux-edac
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <tony.luck@intel.com>
commit fa94d0c6e0f3431523f5701084d799c77c7d4a4f upstream.
Updating microcode used to be relatively rare. Now that it has become
more common we should save the microcode version in a machine check
record to make sure that those people looking at the error have this
important information bundled with the rest of the logged information.
[ Borislav: Simplify a bit. ]
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Yazen Ghannam <yazen.ghannam@amd.com>
Cc: linux-edac <linux-edac@vger.kernel.org>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/20180301233449.24311-1-tony.luck@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/uapi/asm/mce.h | 1 +
arch/x86/kernel/cpu/mcheck/mce.c | 4 +++-
2 files changed, 4 insertions(+), 1 deletion(-)
--- a/arch/x86/include/uapi/asm/mce.h
+++ b/arch/x86/include/uapi/asm/mce.h
@@ -30,6 +30,7 @@ struct mce {
__u64 synd; /* MCA_SYND MSR: only valid on SMCA systems */
__u64 ipid; /* MCA_IPID MSR: only valid on SMCA systems */
__u64 ppin; /* Protected Processor Inventory Number */
+ __u32 microcode;/* Microcode revision */
};
#define MCE_GET_RECORD_LEN _IOR('M', 1, int)
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -131,6 +131,8 @@ void mce_setup(struct mce *m)
if (this_cpu_has(X86_FEATURE_INTEL_PPIN))
rdmsrl(MSR_PPIN, m->ppin);
+
+ m->microcode = boot_cpu_data.microcode;
}
DEFINE_PER_CPU(struct mce, injectm);
@@ -263,7 +265,7 @@ static void __print_mce(struct mce *m)
*/
pr_emerg(HW_ERR "PROCESSOR %u:%x TIME %llu SOCKET %u APIC %x microcode %x\n",
m->cpuvendor, m->cpuid, m->time, m->socketid, m->apicid,
- cpu_data(m->extcpu).microcode);
+ m->microcode);
}
static void print_mce(struct mce *m)
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 063/146] x86/MCE: Serialize sysfs changes
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 062/146] x86/MCE: Save microcode revision in machine check records Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 064/146] perf tools: Fix trigger class trigger_on() Greg Kroah-Hartman
` (86 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Seunghun Han, Borislav Petkov,
Thomas Gleixner, Tony Luck, linux-edac
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seunghun Han <kkamagui@gmail.com>
commit b3b7c4795ccab5be71f080774c45bbbcc75c2aaf upstream.
The check_interval file in
/sys/devices/system/machinecheck/machinecheck<cpu number>
directory is a global timer value for MCE polling. If it is changed by one
CPU, mce_restart() broadcasts the event to other CPUs to delete and restart
the MCE polling timer and __mcheck_cpu_init_timer() reinitializes the
mce_timer variable.
If more than one CPU writes a specific value to the check_interval file
concurrently, mce_timer is not protected from such concurrent accesses and
all kinds of explosions happen. Since only root can write to those sysfs
variables, the issue is not a big deal security-wise.
However, concurrent writes to these configuration variables is void of
reason so the proper thing to do is to serialize the access with a mutex.
Boris:
- Make store_int_with_restart() use device_store_ulong() to filter out
negative intervals
- Limit min interval to 1 second
- Correct locking
- Massage commit message
Signed-off-by: Seunghun Han <kkamagui@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Tony Luck <tony.luck@intel.com>
Cc: linux-edac <linux-edac@vger.kernel.org>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/20180302202706.9434-1-kkamagui@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/mcheck/mce.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -57,6 +57,9 @@
static DEFINE_MUTEX(mce_log_mutex);
+/* sysfs synchronization */
+static DEFINE_MUTEX(mce_sysfs_mutex);
+
#define CREATE_TRACE_POINTS
#include <trace/events/mce.h>
@@ -2080,6 +2083,7 @@ static ssize_t set_ignore_ce(struct devi
if (kstrtou64(buf, 0, &new) < 0)
return -EINVAL;
+ mutex_lock(&mce_sysfs_mutex);
if (mca_cfg.ignore_ce ^ !!new) {
if (new) {
/* disable ce features */
@@ -2092,6 +2096,8 @@ static ssize_t set_ignore_ce(struct devi
on_each_cpu(mce_enable_ce, (void *)1, 1);
}
}
+ mutex_unlock(&mce_sysfs_mutex);
+
return size;
}
@@ -2104,6 +2110,7 @@ static ssize_t set_cmci_disabled(struct
if (kstrtou64(buf, 0, &new) < 0)
return -EINVAL;
+ mutex_lock(&mce_sysfs_mutex);
if (mca_cfg.cmci_disabled ^ !!new) {
if (new) {
/* disable cmci */
@@ -2115,6 +2122,8 @@ static ssize_t set_cmci_disabled(struct
on_each_cpu(mce_enable_ce, NULL, 1);
}
}
+ mutex_unlock(&mce_sysfs_mutex);
+
return size;
}
@@ -2122,8 +2131,19 @@ static ssize_t store_int_with_restart(st
struct device_attribute *attr,
const char *buf, size_t size)
{
- ssize_t ret = device_store_int(s, attr, buf, size);
+ unsigned long old_check_interval = check_interval;
+ ssize_t ret = device_store_ulong(s, attr, buf, size);
+
+ if (check_interval == old_check_interval)
+ return ret;
+
+ if (check_interval < 1)
+ check_interval = 1;
+
+ mutex_lock(&mce_sysfs_mutex);
mce_restart();
+ mutex_unlock(&mce_sysfs_mutex);
+
return ret;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 064/146] perf tools: Fix trigger class trigger_on()
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 063/146] x86/MCE: Serialize sysfs changes Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 065/146] x86/spectre_v2: Dont check microcode versions when running under hypervisors Greg Kroah-Hartman
` (85 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Jiri Olsa, Wang Nan,
Arnaldo Carvalho de Melo
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
commit de19e5c3c51fdb1ff20d0f61d099db902ff7494b upstream.
trigger_on() means that the trigger is available but not ready, however
trigger_on() was making it ready. That can segfault if the signal comes
before trigger_ready(). e.g. (USR2 signal delivery not shown)
$ perf record -e intel_pt//u -S sleep 1
perf: Segmentation fault
Obtained 16 stack frames.
/home/ahunter/bin/perf(sighandler_dump_stack+0x40) [0x4ec550]
/lib/x86_64-linux-gnu/libc.so.6(+0x36caf) [0x7fa76411acaf]
/home/ahunter/bin/perf(perf_evsel__disable+0x26) [0x4b9dd6]
/home/ahunter/bin/perf() [0x43a45b]
/lib/x86_64-linux-gnu/libc.so.6(+0x36caf) [0x7fa76411acaf]
/lib/x86_64-linux-gnu/libc.so.6(__xstat64+0x15) [0x7fa7641d2cc5]
/home/ahunter/bin/perf() [0x4ec6c9]
/home/ahunter/bin/perf() [0x4ec73b]
/home/ahunter/bin/perf() [0x4ec73b]
/home/ahunter/bin/perf() [0x4ec73b]
/home/ahunter/bin/perf() [0x4eca15]
/home/ahunter/bin/perf(machine__create_kernel_maps+0x257) [0x4f0b77]
/home/ahunter/bin/perf(perf_session__new+0xc0) [0x4f86f0]
/home/ahunter/bin/perf(cmd_record+0x722) [0x43c132]
/home/ahunter/bin/perf() [0x4a11ae]
/home/ahunter/bin/perf(main+0x5d4) [0x427fb4]
Note, for testing purposes, this is hard to hit unless you add some sleep()
in builtin-record.c before record__open().
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Cc: stable@vger.kernel.org
Fixes: 3dcc4436fa6f ("perf tools: Introduce trigger class")
Link: http://lkml.kernel.org/r/1519807144-30694-1-git-send-email-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/util/trigger.h | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/tools/perf/util/trigger.h
+++ b/tools/perf/util/trigger.h
@@ -12,7 +12,7 @@
* States and transits:
*
*
- * OFF--(on)--> READY --(hit)--> HIT
+ * OFF--> ON --> READY --(hit)--> HIT
* ^ |
* | (ready)
* | |
@@ -27,8 +27,9 @@ struct trigger {
volatile enum {
TRIGGER_ERROR = -2,
TRIGGER_OFF = -1,
- TRIGGER_READY = 0,
- TRIGGER_HIT = 1,
+ TRIGGER_ON = 0,
+ TRIGGER_READY = 1,
+ TRIGGER_HIT = 2,
} state;
const char *name;
};
@@ -50,7 +51,7 @@ static inline bool trigger_is_error(stru
static inline void trigger_on(struct trigger *t)
{
TRIGGER_WARN_ONCE(t, TRIGGER_OFF);
- t->state = TRIGGER_READY;
+ t->state = TRIGGER_ON;
}
static inline void trigger_ready(struct trigger *t)
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 065/146] x86/spectre_v2: Dont check microcode versions when running under hypervisors
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 064/146] perf tools: Fix trigger class trigger_on() Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 066/146] ALSA: hda/realtek - Add support headset mode for DELL WYSE Greg Kroah-Hartman
` (84 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk,
Thomas Gleixner, Paolo Bonzini, Wanpeng Li, kvm,
Krčmář,
Borislav Petkov, H. Peter Anvin
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 36268223c1e9981d6cfc33aff8520b3bde4b8114 upstream.
As:
1) It's known that hypervisors lie about the environment anyhow (host
mismatch)
2) Even if the hypervisor (Xen, KVM, VMWare, etc) provided a valid
"correct" value, it all gets to be very murky when migration happens
(do you provide the "new" microcode of the machine?).
And in reality the cloud vendors are the ones that should make sure that
the microcode that is running is correct and we should just sing lalalala
and trust them.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: Wanpeng Li <kernellwp@gmail.com>
Cc: kvm <kvm@vger.kernel.org>
Cc: Krčmář <rkrcmar@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
CC: "H. Peter Anvin" <hpa@zytor.com>
CC: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20180226213019.GE9497@char.us.oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/intel.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -144,6 +144,13 @@ static bool bad_spectre_microcode(struct
{
int i;
+ /*
+ * We know that the hypervisor lie to us on the microcode version so
+ * we may as well hope that it is running the correct version.
+ */
+ if (cpu_has(c, X86_FEATURE_HYPERVISOR))
+ return false;
+
for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) {
if (c->x86_model == spectre_bad_microcodes[i].model &&
c->x86_stepping == spectre_bad_microcodes[i].stepping)
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 066/146] ALSA: hda/realtek - Add support headset mode for DELL WYSE
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 065/146] x86/spectre_v2: Dont check microcode versions when running under hypervisors Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 067/146] ALSA: hda/realtek - Add headset mode support for Dell laptop Greg Kroah-Hartman
` (83 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <kailang@realtek.com>
commit 5f36413526677b11d3226ebf064f471894ea2e5d upstream.
Enable headset mode support for WYSE platform.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5358,6 +5358,7 @@ enum {
ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE,
ALC233_FIXUP_LENOVO_MULTI_CODECS,
ALC294_FIXUP_LENOVO_MIC_LOCATION,
+ ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE,
ALC700_FIXUP_INTEL_REFERENCE,
ALC274_FIXUP_DELL_BIND_DACS,
ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
@@ -6161,6 +6162,18 @@ static const struct hda_fixup alc269_fix
{ }
},
},
+ [ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x16, 0x0101102f }, /* Rear Headset HP */
+ { 0x19, 0x02a1913c }, /* use as Front headset mic, without its own jack detect */
+ { 0x1a, 0x01a19030 }, /* Rear Headset MIC */
+ { 0x1b, 0x02011020 },
+ { }
+ },
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+ },
[ALC700_FIXUP_INTEL_REFERENCE] = {
.type = HDA_FIXUP_VERBS,
.v.verbs = (const struct hda_verb[]) {
@@ -6246,6 +6259,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 067/146] ALSA: hda/realtek - Add headset mode support for Dell laptop
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 066/146] ALSA: hda/realtek - Add support headset mode for DELL WYSE Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 068/146] ALSA: hda/realtek: Limit mic boost on T480 Greg Kroah-Hartman
` (82 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <kailang@realtek.com>
commit ae104a21e52b1f9aab342cf6924405177b720069 upstream.
This platform was only one phone Jack.
Add dummy lineout verb to fix automute mode disable.
This just the workaround.
[ More background information:
since the platform has only a headphone jack without speaker, the
driver doesn't create the auto-mute control. Meanwhile we do update
the headset mode via the automute hook in the driver, thus with this
setup, the headset won't be updated any longer.
By adding a dummy line-out pin here, the auto-mute is added by the
driver, and the headset update is triggered properly.
Note that this is different from the other
ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, which has the real line-out pin,
while this quirk adds a dummy line-out pin. -- tiwai ]
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5363,6 +5363,7 @@ enum {
ALC274_FIXUP_DELL_BIND_DACS,
ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
ALC298_FIXUP_TPT470_DOCK,
+ ALC255_FIXUP_DUMMY_LINEOUT_VERB,
};
static const struct hda_fixup alc269_fixups[] = {
@@ -6210,6 +6211,15 @@ static const struct hda_fixup alc269_fix
.chained = true,
.chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE
},
+ [ALC255_FIXUP_DUMMY_LINEOUT_VERB] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x14, 0x0201101f },
+ { }
+ },
+ .chained = true,
+ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+ },
};
static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6263,6 +6273,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 068/146] ALSA: hda/realtek: Limit mic boost on T480
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 067/146] ALSA: hda/realtek - Add headset mode support for Dell laptop Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 069/146] ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520 Greg Kroah-Hartman
` (81 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Benjamin Berg, Takashi Iwai
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <bberg@redhat.com>
commit 85981dfd6b0a0fd9ed87ca4a525981b67c21f098 upstream.
The internal mic boost on the T480 is too high. Fix this by applying the
ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain.
Signed-off-by: Benjamin Berg <bberg@redhat.com>
Tested-by: Benjamin Berg <bberg@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6414,6 +6414,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x17aa, 0x224b, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 069/146] ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 068/146] ALSA: hda/realtek: Limit mic boost on T480 Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 070/146] ALSA: hda/realtek - Make dock sound work on ThinkPad L570 Greg Kroah-Hartman
` (80 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit e312a869cd726c698a75caca0d9e5c22fd3f1534 upstream.
The dock line-out pin (NID 0x17 of ALC3254 codec) on Dell Precision
7520 may route to three different DACs, 0x02, 0x03 and 0x06. The
first two DACS have the volume amp controls while the last one
doesn't. And unfortunately, the auto-parser assigns this pin to DAC3,
resulting in the non-working volume control for the line out.
Fix it by disabling the routing to DAC3 on the corresponding pin.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199029
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5152,6 +5152,16 @@ static void alc298_fixup_speaker_volume(
}
}
+/* disable DAC3 (0x06) selection on NID 0x17 as it has no volume amp control */
+static void alc295_fixup_disable_dac3(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+{
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ hda_nid_t conn[2] = { 0x02, 0x03 };
+ snd_hda_override_conn_list(codec, 0x17, 2, conn);
+ }
+}
+
/* Hook to update amp GPIO4 for automute */
static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
struct hda_jack_callback *jack)
@@ -5344,6 +5354,7 @@ enum {
ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
ALC255_FIXUP_DELL_SPK_NOISE,
ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC295_FIXUP_DISABLE_DAC3,
ALC280_FIXUP_HP_HEADSET_MIC,
ALC221_FIXUP_HP_FRONT_MIC,
ALC292_FIXUP_TPT460,
@@ -6078,6 +6089,10 @@ static const struct hda_fixup alc269_fix
.chained = true,
.chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE,
},
+ [ALC295_FIXUP_DISABLE_DAC3] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc295_fixup_disable_dac3,
+ },
[ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
.type = HDA_FIXUP_PINS,
.v.pins = (const struct hda_pintbl[]) {
@@ -6268,6 +6283,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 070/146] ALSA: hda/realtek - Make dock sound work on ThinkPad L570
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 069/146] ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520 Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 071/146] ALSA: seq: Dont allow resizing pool in use Greg Kroah-Hartman
` (79 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dennis Wassenberg, Takashi Iwai
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Wassenberg <dennis.wassenberg@secunet.com>
commit e4c07b3b66b7d6a24c2fe3b1ddeff5cd9b378b3a upstream.
One version of Lenovo Thinkpad T570 did not use ALC298
(like other Kaby Lake devices). Instead it uses ALC292.
In order to make the Lenovo dock working with that codec
the dock quirk for ALC292 will be used.
Signed-off-by: Dennis Wassenberg <dennis.wassenberg@secunet.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6427,6 +6427,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x17aa, 0x2245, "Thinkpad T470", ALC298_FIXUP_TPT470_DOCK),
SND_PCI_QUIRK(0x17aa, 0x2246, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
SND_PCI_QUIRK(0x17aa, 0x2247, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2249, "Thinkpad", ALC292_FIXUP_TPT460),
SND_PCI_QUIRK(0x17aa, 0x224b, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 071/146] ALSA: seq: Dont allow resizing pool in use
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 070/146] ALSA: hda/realtek - Make dock sound work on ThinkPad L570 Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:23 ` [PATCH 4.15 072/146] ALSA: seq: More protection for concurrent write and ioctl races Greg Kroah-Hartman
` (78 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, 范龙飞,
Nicolai Stange, Takashi Iwai
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit d85739367c6d56e475c281945c68fdb05ca74b4c upstream.
This is a fix for a (sort of) fallout in the recent commit
d15d662e89fc ("ALSA: seq: Fix racy pool initializations") for
CVE-2018-1000004.
As the pool resize deletes the existing cells, it may lead to a race
when another thread is writing concurrently, eventually resulting a
UAF.
A simple workaround is not to allow the pool resizing when the pool is
in use. It's an invalid behavior in anyway.
Fixes: d15d662e89fc ("ALSA: seq: Fix racy pool initializations")
Reported-by: 范龙飞 <long7573@126.com>
Reported-by: Nicolai Stange <nstange@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/seq/seq_clientmgr.c | 3 +++
1 file changed, 3 insertions(+)
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1838,6 +1838,9 @@ static int snd_seq_ioctl_set_client_pool
(! snd_seq_write_pool_allocated(client) ||
info->output_pool != client->pool->size)) {
if (snd_seq_write_pool_allocated(client)) {
+ /* is the pool in use? */
+ if (atomic_read(&client->pool->counter))
+ return -EBUSY;
/* remove all existing cells */
snd_seq_pool_mark_closing(client->pool);
snd_seq_queue_client_leave_cells(client->number);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 072/146] ALSA: seq: More protection for concurrent write and ioctl races
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 071/146] ALSA: seq: Dont allow resizing pool in use Greg Kroah-Hartman
@ 2018-03-13 15:23 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 073/146] ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines Greg Kroah-Hartman
` (77 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, 范龙飞,
Nicolai Stange, Takashi Iwai
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 7bd80091567789f1c0cb70eb4737aac8bcd2b6b9 upstream.
This patch is an attempt for further hardening against races between
the concurrent write and ioctls. The previous fix d15d662e89fc
("ALSA: seq: Fix racy pool initializations") covered the race of the
pool initialization at writer and the pool resize ioctl by the
client->ioctl_mutex (CVE-2018-1000004). However, basically this mutex
should be applied more widely to the whole write operation for
avoiding the unexpected pool operations by another thread.
The only change outside snd_seq_write() is the additional mutex
argument to helper functions, so that we can unlock / relock the given
mutex temporarily during schedule() call for blocking write.
Fixes: d15d662e89fc ("ALSA: seq: Fix racy pool initializations")
Reported-by: 范龙飞 <long7573@126.com>
Reported-by: Nicolai Stange <nstange@suse.de>
Reviewed-and-tested-by: Nicolai Stange <nstange@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/seq/seq_clientmgr.c | 18 +++++++++++-------
sound/core/seq/seq_fifo.c | 2 +-
sound/core/seq/seq_memory.c | 14 ++++++++++----
sound/core/seq/seq_memory.h | 3 ++-
4 files changed, 24 insertions(+), 13 deletions(-)
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -910,7 +910,8 @@ int snd_seq_dispatch_event(struct snd_se
static int snd_seq_client_enqueue_event(struct snd_seq_client *client,
struct snd_seq_event *event,
struct file *file, int blocking,
- int atomic, int hop)
+ int atomic, int hop,
+ struct mutex *mutexp)
{
struct snd_seq_event_cell *cell;
int err;
@@ -948,7 +949,8 @@ static int snd_seq_client_enqueue_event(
return -ENXIO; /* queue is not allocated */
/* allocate an event cell */
- err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic, file);
+ err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic,
+ file, mutexp);
if (err < 0)
return err;
@@ -1017,12 +1019,11 @@ static ssize_t snd_seq_write(struct file
return -ENXIO;
/* allocate the pool now if the pool is not allocated yet */
+ mutex_lock(&client->ioctl_mutex);
if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
- mutex_lock(&client->ioctl_mutex);
err = snd_seq_pool_init(client->pool);
- mutex_unlock(&client->ioctl_mutex);
if (err < 0)
- return -ENOMEM;
+ goto out;
}
/* only process whole events */
@@ -1073,7 +1074,7 @@ static ssize_t snd_seq_write(struct file
/* ok, enqueue it */
err = snd_seq_client_enqueue_event(client, &event, file,
!(file->f_flags & O_NONBLOCK),
- 0, 0);
+ 0, 0, &client->ioctl_mutex);
if (err < 0)
break;
@@ -1084,6 +1085,8 @@ static ssize_t snd_seq_write(struct file
written += len;
}
+ out:
+ mutex_unlock(&client->ioctl_mutex);
return written ? written : err;
}
@@ -2263,7 +2266,8 @@ static int kernel_client_enqueue(int cli
if (! cptr->accept_output)
result = -EPERM;
else /* send it */
- result = snd_seq_client_enqueue_event(cptr, ev, file, blocking, atomic, hop);
+ result = snd_seq_client_enqueue_event(cptr, ev, file, blocking,
+ atomic, hop, NULL);
snd_seq_client_unlock(cptr);
return result;
--- a/sound/core/seq/seq_fifo.c
+++ b/sound/core/seq/seq_fifo.c
@@ -125,7 +125,7 @@ int snd_seq_fifo_event_in(struct snd_seq
return -EINVAL;
snd_use_lock_use(&f->use_lock);
- err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL); /* always non-blocking */
+ err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL, NULL); /* always non-blocking */
if (err < 0) {
if ((err == -ENOMEM) || (err == -EAGAIN))
atomic_inc(&f->overflow);
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -220,7 +220,8 @@ void snd_seq_cell_free(struct snd_seq_ev
*/
static int snd_seq_cell_alloc(struct snd_seq_pool *pool,
struct snd_seq_event_cell **cellp,
- int nonblock, struct file *file)
+ int nonblock, struct file *file,
+ struct mutex *mutexp)
{
struct snd_seq_event_cell *cell;
unsigned long flags;
@@ -244,7 +245,11 @@ static int snd_seq_cell_alloc(struct snd
set_current_state(TASK_INTERRUPTIBLE);
add_wait_queue(&pool->output_sleep, &wait);
spin_unlock_irq(&pool->lock);
+ if (mutexp)
+ mutex_unlock(mutexp);
schedule();
+ if (mutexp)
+ mutex_lock(mutexp);
spin_lock_irq(&pool->lock);
remove_wait_queue(&pool->output_sleep, &wait);
/* interrupted? */
@@ -287,7 +292,7 @@ __error:
*/
int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
struct snd_seq_event_cell **cellp, int nonblock,
- struct file *file)
+ struct file *file, struct mutex *mutexp)
{
int ncells, err;
unsigned int extlen;
@@ -304,7 +309,7 @@ int snd_seq_event_dup(struct snd_seq_poo
if (ncells >= pool->total_elements)
return -ENOMEM;
- err = snd_seq_cell_alloc(pool, &cell, nonblock, file);
+ err = snd_seq_cell_alloc(pool, &cell, nonblock, file, mutexp);
if (err < 0)
return err;
@@ -330,7 +335,8 @@ int snd_seq_event_dup(struct snd_seq_poo
int size = sizeof(struct snd_seq_event);
if (len < size)
size = len;
- err = snd_seq_cell_alloc(pool, &tmp, nonblock, file);
+ err = snd_seq_cell_alloc(pool, &tmp, nonblock, file,
+ mutexp);
if (err < 0)
goto __error;
if (cell->event.data.ext.ptr == NULL)
--- a/sound/core/seq/seq_memory.h
+++ b/sound/core/seq/seq_memory.h
@@ -66,7 +66,8 @@ struct snd_seq_pool {
void snd_seq_cell_free(struct snd_seq_event_cell *cell);
int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
- struct snd_seq_event_cell **cellp, int nonblock, struct file *file);
+ struct snd_seq_event_cell **cellp, int nonblock,
+ struct file *file, struct mutex *mutexp);
/* return number of unused (free) cells */
static inline int snd_seq_unused_cells(struct snd_seq_pool *pool)
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 073/146] ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2018-03-13 15:23 ` [PATCH 4.15 072/146] ALSA: seq: More protection for concurrent write and ioctl races Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 074/146] ALSA: hda: add dock and led support for HP EliteBook 820 G3 Greg Kroah-Hartman
` (76 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kailang Yang, Hui Wang, Takashi Iwai
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <hui.wang@canonical.com>
commit d5078193e56bb24f4593f00102a3b5e07bb84ee0 upstream.
With the alc289, the Pin 0x1b is Headphone-Mic, so we should assign
ALC269_FIXUP_DELL4_MIC_NO_PRESENCE rather than
ALC225_FIXUP_DELL1_MIC_NO_PRESENCE to it. And this change is suggested
by Kailang of Realtek and is verified on the machine.
Fixes: 3f2f7c553d07 ("ALSA: hda - Fix headset mic detection problem for two Dell machines")
Cc: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6793,7 +6793,7 @@ static const struct snd_hda_pin_quirk al
{0x12, 0x90a60120},
{0x14, 0x90170110},
{0x21, 0x0321101f}),
- SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
{0x12, 0xb7a60130},
{0x14, 0x90170110},
{0x21, 0x04211020}),
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 074/146] ALSA: hda: add dock and led support for HP EliteBook 820 G3
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 073/146] ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 075/146] ALSA: hda: add dock and led support for HP ProBook 640 G2 Greg Kroah-Hartman
` (75 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dennis Wassenberg, Takashi Iwai
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Wassenberg <dennis.wassenberg@secunet.com>
commit aea808172018ca01abf53db808323aed23281835 upstream.
This patch adds missing initialisation for HP 2013 UltraSlim Dock
Line-In/Out PINs and activates keyboard mute/micmute leds
for HP EliteBook 820 G3
Signed-off-by: Dennis Wassenberg <dennis.wassenberg@secunet.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_conexant.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -957,6 +957,7 @@ static const struct snd_pci_quirk cxt506
SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 075/146] ALSA: hda: add dock and led support for HP ProBook 640 G2
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 074/146] ALSA: hda: add dock and led support for HP EliteBook 820 G3 Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 076/146] scsi: qla2xxx: Fix NULL pointer crash due to probe failure Greg Kroah-Hartman
` (74 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dennis Wassenberg, Takashi Iwai
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Wassenberg <dennis.wassenberg@secunet.com>
commit 099fd6ca0ad25bc19c5ade2ea4b25b8fadaa11b3 upstream.
This patch adds missing initialisation for HP 2013 UltraSlim Dock
Line-In/Out PINs and activates keyboard mute/micmute leds
for HP ProBook 640 G2
Signed-off-by: Dennis Wassenberg <dennis.wassenberg@secunet.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_conexant.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -958,6 +958,7 @@ static const struct snd_pci_quirk cxt506
SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 076/146] scsi: qla2xxx: Fix NULL pointer crash due to probe failure
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 075/146] ALSA: hda: add dock and led support for HP ProBook 640 G2 Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 077/146] scsi: qla2xxx: Fix recursion while sending terminate exchange Greg Kroah-Hartman
` (73 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: himanshu.madhani@cavium.com <himanshu.madhani@cavium.com>
commit d64d6c5671db5e693a0caaee79f2571b098749c9 upstream.
This patch fixes regression added by commit d74595278f4ab
("scsi: qla2xxx: Add multiple queue pair functionality.").
When driver is not able to get reqeusted IRQs from the system, driver will
attempt tp clean up memory before failing hardware probe. During this cleanup,
driver assigns NULL value to the pointer which has not been allocated by
driver yet. This results in a NULL pointer access.
Log file will show following message and stack trace
qla2xxx [0000:a3:00.1]-00c7:21: MSI-X: Failed to enable support, giving up -- 32/-1.
qla2xxx [0000:a3:00.1]-0037:21: Falling back-to MSI mode --1.
qla2xxx [0000:a3:00.1]-003a:21: Failed to reserve interrupt 821 already in use.
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffffc010c4b6>] qla2x00_probe_one+0x18b6/0x2730 [qla2xxx]
PGD 0
Oops: 0002 [#1] SMP
Fixes: d74595278f4ab ("scsi: qla2xxx: Add multiple queue pair functionality.").
Cc: <stable@vger.kernel.org> # 4.10
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_os.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3011,9 +3011,6 @@ qla2x00_probe_one(struct pci_dev *pdev,
base_vha = qla2x00_create_host(sht, ha);
if (!base_vha) {
ret = -ENOMEM;
- qla2x00_mem_free(ha);
- qla2x00_free_req_que(ha, req);
- qla2x00_free_rsp_que(ha, rsp);
goto probe_hw_failed;
}
@@ -3074,7 +3071,7 @@ qla2x00_probe_one(struct pci_dev *pdev,
/* Set up the irqs */
ret = qla2x00_request_irqs(ha, rsp);
if (ret)
- goto probe_init_failed;
+ goto probe_hw_failed;
/* Alloc arrays of request and response ring ptrs */
if (!qla2x00_alloc_queues(ha, req, rsp)) {
@@ -3390,6 +3387,9 @@ probe_failed:
scsi_host_put(base_vha->host);
probe_hw_failed:
+ qla2x00_mem_free(ha);
+ qla2x00_free_req_que(ha, req);
+ qla2x00_free_rsp_que(ha, rsp);
qla2x00_clear_drv_active(ha);
iospace_config_failed:
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 077/146] scsi: qla2xxx: Fix recursion while sending terminate exchange
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 076/146] scsi: qla2xxx: Fix NULL pointer crash due to probe failure Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 078/146] dt-bindings: Document mti,mips-cpc binding Greg Kroah-Hartman
` (72 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: himanshu.madhani@cavium.com <himanshu.madhani@cavium.com>
commit 3efc31f76dd7fc8a71cd86683909f637e9b7cadb upstream.
During error test case where switch port status is toggled from enable to
disable, following stack trace is seen which indicates recursion trying to
send terminate exchange. This regression was introduced by commit
82de802ad46e ("scsi: qla2xxx: Preparation for Target MQ.")
BUG: stack guard page was hit at ffffb96488383ff8 (stack is ffffb96488384000..ffffb96488387fff)
BUG: stack guard page was hit at ffffb964886c3ff8 (stack is ffffb964886c4000..ffffb964886c7fff)
kernel stack overflow (double-fault): 0000 [#1] SMP
qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
Fixes: 82de802ad46e ("scsi: qla2xxx: Preparation for Target MQ.")
Cc: <stable@vger.kernel.org> #4.10
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_target.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -3708,7 +3708,7 @@ static int qlt_term_ctio_exchange(struct
term = 1;
if (term)
- qlt_term_ctio_exchange(qpair, ctio, cmd, status);
+ qlt_send_term_exchange(qpair, cmd, &cmd->atio, 1, 0);
return term;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 078/146] dt-bindings: Document mti,mips-cpc binding
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 077/146] scsi: qla2xxx: Fix recursion while sending terminate exchange Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 079/146] MIPS: CPC: Map registers using DT in mips_cpc_default_phys_base() Greg Kroah-Hartman
` (71 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Burton, Aleksandar Markovic,
Rob Herring, linux-mips, devicetree, James Hogan
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Burton <paul.burton@mips.com>
commit aece34cd576c7625181b0488a8129c1e165355f7 upstream.
Document a binding for the MIPS Cluster Power Controller (CPC) that
allows the device tree to specify where the CPC registers are located.
Signed-off-by: Paul Burton <paul.burton@mips.com>
Signed-off-by: Aleksandar Markovic <aleksandar.markovic@mips.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Cc: linux-mips@linux-mips.org
Cc: devicetree@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/18512/
Signed-off-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/power/mti,mips-cpc.txt | 8 ++++++++
MAINTAINERS | 1 +
2 files changed, 9 insertions(+)
--- /dev/null
+++ b/Documentation/devicetree/bindings/power/mti,mips-cpc.txt
@@ -0,0 +1,8 @@
+Binding for MIPS Cluster Power Controller (CPC).
+
+This binding allows a system to specify where the CPC registers are
+located.
+
+Required properties:
+compatible : Should be "mti,mips-cpc".
+regs: Should describe the address & size of the CPC register region.
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -9107,6 +9107,7 @@ MIPS GENERIC PLATFORM
M: Paul Burton <paul.burton@mips.com>
L: linux-mips@linux-mips.org
S: Supported
+F: Documentation/devicetree/bindings/power/mti,mips-cpc.txt
F: arch/mips/generic/
F: arch/mips/tools/generic-board-config.sh
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 079/146] MIPS: CPC: Map registers using DT in mips_cpc_default_phys_base()
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 078/146] dt-bindings: Document mti,mips-cpc binding Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 080/146] nospec: Kill array_index_nospec_mask_check() Greg Kroah-Hartman
` (70 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Burton, Miodrag Dinic,
Aleksandar Markovic, linux-mips, Ralf Baechle, James Hogan
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Burton <paul.burton@mips.com>
commit 791412dafbbfd860e78983d45cf71db603a82f67 upstream.
Reading mips_cpc_base value from the DT allows each platform to
define it according to its needs. This is especially convenient
for MIPS_GENERIC kernel where this kind of information should be
determined in runtime.
Use mti,mips-cpc compatible string with just a reg property to
specify the register location for your platform.
Signed-off-by: Paul Burton <paul.burton@mips.com>
Signed-off-by: Miodrag Dinic <miodrag.dinic@mips.com>
Signed-off-by: Aleksandar Markovic <aleksandar.markovic@mips.com>
Cc: linux-mips@linux-mips.org
Cc: Ralf Baechle <ralf@linux-mips.org>
Patchwork: https://patchwork.linux-mips.org/patch/18513/
Signed-off-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/mips-cpc.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/arch/mips/kernel/mips-cpc.c
+++ b/arch/mips/kernel/mips-cpc.c
@@ -10,6 +10,8 @@
#include <linux/errno.h>
#include <linux/percpu.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
#include <linux/spinlock.h>
#include <asm/mips-cps.h>
@@ -22,6 +24,17 @@ static DEFINE_PER_CPU_ALIGNED(unsigned l
phys_addr_t __weak mips_cpc_default_phys_base(void)
{
+ struct device_node *cpc_node;
+ struct resource res;
+ int err;
+
+ cpc_node = of_find_compatible_node(of_root, NULL, "mti,mips-cpc");
+ if (cpc_node) {
+ err = of_address_to_resource(cpc_node, 0, &res);
+ if (!err)
+ return res.start;
+ }
+
return 0;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 080/146] nospec: Kill array_index_nospec_mask_check()
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 079/146] MIPS: CPC: Map registers using DT in mips_cpc_default_phys_base() Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 081/146] nospec: Include <asm/barrier.h> dependency Greg Kroah-Hartman
` (69 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Linus Torvalds, Dan Williams,
Andy Lutomirski, Arjan van de Ven, Borislav Petkov, Dave Hansen,
David Woodhouse, Josh Poimboeuf, Peter Zijlstra, Thomas Gleixner,
Will Deacon, linux-arch, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <dan.j.williams@intel.com>
commit 1d91c1d2c80cb70e2e553845e278b87a960c04da upstream.
There are multiple problems with the dynamic sanity checking in
array_index_nospec_mask_check():
* It causes unnecessary overhead in the 32-bit case since integer sized
@index values will no longer cause the check to be compiled away like
in the 64-bit case.
* In the 32-bit case it may trigger with user controllable input when
the expectation is that should only trigger during development of new
kernel enabling.
* The macro reuses the input parameter in multiple locations which is
broken if someone passes an expression like 'index++' to
array_index_nospec().
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will.deacon@arm.com>
Cc: linux-arch@vger.kernel.org
Link: http://lkml.kernel.org/r/151881604278.17395.6605847763178076520.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/nospec.h | 22 +---------------------
1 file changed, 1 insertion(+), 21 deletions(-)
--- a/include/linux/nospec.h
+++ b/include/linux/nospec.h
@@ -30,26 +30,6 @@ static inline unsigned long array_index_
#endif
/*
- * Warn developers about inappropriate array_index_nospec() usage.
- *
- * Even if the CPU speculates past the WARN_ONCE branch, the
- * sign bit of @index is taken into account when generating the
- * mask.
- *
- * This warning is compiled out when the compiler can infer that
- * @index and @size are less than LONG_MAX.
- */
-#define array_index_mask_nospec_check(index, size) \
-({ \
- if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX, \
- "array_index_nospec() limited to range of [0, LONG_MAX]\n")) \
- _mask = 0; \
- else \
- _mask = array_index_mask_nospec(index, size); \
- _mask; \
-})
-
-/*
* array_index_nospec - sanitize an array index after a bounds check
*
* For a code sequence like:
@@ -67,7 +47,7 @@ static inline unsigned long array_index_
({ \
typeof(index) _i = (index); \
typeof(size) _s = (size); \
- unsigned long _mask = array_index_mask_nospec_check(_i, _s); \
+ unsigned long _mask = array_index_mask_nospec(_i, _s); \
\
BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \
BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 081/146] nospec: Include <asm/barrier.h> dependency
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 080/146] nospec: Kill array_index_nospec_mask_check() Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 082/146] x86/entry: Reduce the code footprint of the idtentry macro Greg Kroah-Hartman
` (68 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Borntraeger, Dan Williams,
Andy Lutomirski, Arjan van de Ven, Borislav Petkov, Dave Hansen,
David Woodhouse, Josh Poimboeuf, Linus Torvalds, Peter Zijlstra,
Thomas Gleixner, Will Deacon, linux-arch, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <dan.j.williams@intel.com>
commit eb6174f6d1be16b19cfa43dac296bfed003ce1a6 upstream.
The nospec.h header expects the per-architecture header file
<asm/barrier.h> to optionally define array_index_mask_nospec(). Include
that dependency to prevent inadvertent fallback to the default
array_index_mask_nospec() implementation.
The default implementation may not provide a full mitigation
on architectures that perform data value speculation.
Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will.deacon@arm.com>
Cc: linux-arch@vger.kernel.org
Link: http://lkml.kernel.org/r/151881605404.17395.1341935530792574707.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/nospec.h | 1 +
1 file changed, 1 insertion(+)
--- a/include/linux/nospec.h
+++ b/include/linux/nospec.h
@@ -5,6 +5,7 @@
#ifndef _LINUX_NOSPEC_H
#define _LINUX_NOSPEC_H
+#include <asm/barrier.h>
/**
* array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 082/146] x86/entry: Reduce the code footprint of the idtentry macro
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 081/146] nospec: Include <asm/barrier.h> dependency Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 083/146] x86/entry/64: Use xorl for faster register clearing Greg Kroah-Hartman
` (67 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dominik Brodowski, Andy Lutomirski,
Arjan van de Ven, Borislav Petkov, Dan Williams, Dave Hansen,
David Woodhouse, Josh Poimboeuf, Linus Torvalds, Peter Zijlstra,
Thomas Gleixner, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominik Brodowski <linux@dominikbrodowski.net>
commit 9e809d15d6b692fa061d74be7aaab1c79f6784b8 upstream.
Play a little trick in the generic PUSH_AND_CLEAR_REGS macro
to insert the GP registers "above" the original return address.
This allows us to (re-)insert the macro in error_entry() and
paranoid_entry() and to remove it from the idtentry macro. This
reduces the static footprint significantly:
text data bss dec hex filename
24307 0 0 24307 5ef3 entry_64.o-orig
20987 0 0 20987 51fb entry_64.o
Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20180214175924.23065-2-linux@dominikbrodowski.net
[ Small tweaks to comments. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/entry/calling.h | 11 ++++++++++-
arch/x86/entry/entry_64.S | 18 ++++++++----------
2 files changed, 18 insertions(+), 11 deletions(-)
--- a/arch/x86/entry/calling.h
+++ b/arch/x86/entry/calling.h
@@ -97,7 +97,7 @@ For 32-bit we have the following convent
#define SIZEOF_PTREGS 21*8
-.macro PUSH_AND_CLEAR_REGS rdx=%rdx rax=%rax
+.macro PUSH_AND_CLEAR_REGS rdx=%rdx rax=%rax save_ret=0
/*
* Push registers and sanitize registers of values that a
* speculation attack might otherwise want to exploit. The
@@ -105,8 +105,14 @@ For 32-bit we have the following convent
* could be put to use in a speculative execution gadget.
* Interleave XOR with PUSH for better uop scheduling:
*/
+ .if \save_ret
+ pushq %rsi /* pt_regs->si */
+ movq 8(%rsp), %rsi /* temporarily store the return address in %rsi */
+ movq %rdi, 8(%rsp) /* pt_regs->di (overwriting original return address) */
+ .else
pushq %rdi /* pt_regs->di */
pushq %rsi /* pt_regs->si */
+ .endif
pushq \rdx /* pt_regs->dx */
pushq %rcx /* pt_regs->cx */
pushq \rax /* pt_regs->ax */
@@ -131,6 +137,9 @@ For 32-bit we have the following convent
pushq %r15 /* pt_regs->r15 */
xorq %r15, %r15 /* nospec r15*/
UNWIND_HINT_REGS
+ .if \save_ret
+ pushq %rsi /* return address on top of stack */
+ .endif
.endm
.macro POP_REGS pop_rdi=1 skip_r11rcx=0
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -871,12 +871,8 @@ ENTRY(\sym)
pushq $-1 /* ORIG_RAX: no syscall to restart */
.endif
- /* Save all registers in pt_regs */
- PUSH_AND_CLEAR_REGS
- ENCODE_FRAME_POINTER
-
.if \paranoid < 2
- testb $3, CS(%rsp) /* If coming from userspace, switch stacks */
+ testb $3, CS-ORIG_RAX(%rsp) /* If coming from userspace, switch stacks */
jnz .Lfrom_usermode_switch_stack_\@
.endif
@@ -1123,13 +1119,15 @@ idtentry machine_check do_mce has_err
#endif
/*
- * Switch gs if needed.
+ * Save all registers in pt_regs, and switch gs if needed.
* Use slow, but surefire "are we in kernel?" check.
* Return: ebx=0: need swapgs on exit, ebx=1: otherwise
*/
ENTRY(paranoid_entry)
UNWIND_HINT_FUNC
cld
+ PUSH_AND_CLEAR_REGS save_ret=1
+ ENCODE_FRAME_POINTER 8
movl $1, %ebx
movl $MSR_GS_BASE, %ecx
rdmsr
@@ -1174,12 +1172,14 @@ ENTRY(paranoid_exit)
END(paranoid_exit)
/*
- * Switch gs if needed.
+ * Save all registers in pt_regs, and switch GS if needed.
* Return: EBX=0: came from user mode; EBX=1: otherwise
*/
ENTRY(error_entry)
- UNWIND_HINT_REGS offset=8
+ UNWIND_HINT_FUNC
cld
+ PUSH_AND_CLEAR_REGS save_ret=1
+ ENCODE_FRAME_POINTER 8
testb $3, CS+8(%rsp)
jz .Lerror_kernelspace
@@ -1570,8 +1570,6 @@ end_repeat_nmi:
* frame to point back to repeat_nmi.
*/
pushq $-1 /* ORIG_RAX: no syscall to restart */
- PUSH_AND_CLEAR_REGS
- ENCODE_FRAME_POINTER
/*
* Use paranoid_entry to handle SWAPGS, but no need to use paranoid_exit
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 083/146] x86/entry/64: Use xorl for faster register clearing
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 082/146] x86/entry: Reduce the code footprint of the idtentry macro Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 084/146] x86/mm: Remove stale comment about KMEMCHECK Greg Kroah-Hartman
` (66 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Denys Vlasenko, Dominik Brodowski,
Andy Lutomirski, Arjan van de Ven, Borislav Petkov, Dan Williams,
Dave Hansen, David Woodhouse, Josh Poimboeuf, Linus Torvalds,
Peter Zijlstra, Thomas Gleixner, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominik Brodowski <linux@dominikbrodowski.net>
commit ced5d0bf603fa0baee8ea889e1d70971fd210894 upstream.
On some x86 CPU microarchitectures using 'xorq' to clear general-purpose
registers is slower than 'xorl'. As 'xorl' is sufficient to clear all
64 bits of these registers due to zero-extension [*], switch the x86
64-bit entry code to use 'xorl'.
No change in functionality and no change in code size.
[*] According to Intel 64 and IA-32 Architecture Software Developer's
Manual, section 3.4.1.1, the result of 32-bit operands are "zero-
extended to a 64-bit result in the destination general-purpose
register." The AMD64 Architecture Programmer’s Manual Volume 3,
Appendix B.1, describes the same behaviour.
Suggested-by: Denys Vlasenko <dvlasenk@redhat.com>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20180214175924.23065-3-linux@dominikbrodowski.net
[ Improved on the changelog a bit. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/entry/calling.h | 16 +++++------
arch/x86/entry/entry_64_compat.S | 54 +++++++++++++++++++--------------------
2 files changed, 35 insertions(+), 35 deletions(-)
--- a/arch/x86/entry/calling.h
+++ b/arch/x86/entry/calling.h
@@ -117,25 +117,25 @@ For 32-bit we have the following convent
pushq %rcx /* pt_regs->cx */
pushq \rax /* pt_regs->ax */
pushq %r8 /* pt_regs->r8 */
- xorq %r8, %r8 /* nospec r8 */
+ xorl %r8d, %r8d /* nospec r8 */
pushq %r9 /* pt_regs->r9 */
- xorq %r9, %r9 /* nospec r9 */
+ xorl %r9d, %r9d /* nospec r9 */
pushq %r10 /* pt_regs->r10 */
- xorq %r10, %r10 /* nospec r10 */
+ xorl %r10d, %r10d /* nospec r10 */
pushq %r11 /* pt_regs->r11 */
- xorq %r11, %r11 /* nospec r11*/
+ xorl %r11d, %r11d /* nospec r11*/
pushq %rbx /* pt_regs->rbx */
xorl %ebx, %ebx /* nospec rbx*/
pushq %rbp /* pt_regs->rbp */
xorl %ebp, %ebp /* nospec rbp*/
pushq %r12 /* pt_regs->r12 */
- xorq %r12, %r12 /* nospec r12*/
+ xorl %r12d, %r12d /* nospec r12*/
pushq %r13 /* pt_regs->r13 */
- xorq %r13, %r13 /* nospec r13*/
+ xorl %r13d, %r13d /* nospec r13*/
pushq %r14 /* pt_regs->r14 */
- xorq %r14, %r14 /* nospec r14*/
+ xorl %r14d, %r14d /* nospec r14*/
pushq %r15 /* pt_regs->r15 */
- xorq %r15, %r15 /* nospec r15*/
+ xorl %r15d, %r15d /* nospec r15*/
UNWIND_HINT_REGS
.if \save_ret
pushq %rsi /* return address on top of stack */
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -85,25 +85,25 @@ ENTRY(entry_SYSENTER_compat)
pushq %rcx /* pt_regs->cx */
pushq $-ENOSYS /* pt_regs->ax */
pushq $0 /* pt_regs->r8 = 0 */
- xorq %r8, %r8 /* nospec r8 */
+ xorl %r8d, %r8d /* nospec r8 */
pushq $0 /* pt_regs->r9 = 0 */
- xorq %r9, %r9 /* nospec r9 */
+ xorl %r9d, %r9d /* nospec r9 */
pushq $0 /* pt_regs->r10 = 0 */
- xorq %r10, %r10 /* nospec r10 */
+ xorl %r10d, %r10d /* nospec r10 */
pushq $0 /* pt_regs->r11 = 0 */
- xorq %r11, %r11 /* nospec r11 */
+ xorl %r11d, %r11d /* nospec r11 */
pushq %rbx /* pt_regs->rbx */
xorl %ebx, %ebx /* nospec rbx */
pushq %rbp /* pt_regs->rbp (will be overwritten) */
xorl %ebp, %ebp /* nospec rbp */
pushq $0 /* pt_regs->r12 = 0 */
- xorq %r12, %r12 /* nospec r12 */
+ xorl %r12d, %r12d /* nospec r12 */
pushq $0 /* pt_regs->r13 = 0 */
- xorq %r13, %r13 /* nospec r13 */
+ xorl %r13d, %r13d /* nospec r13 */
pushq $0 /* pt_regs->r14 = 0 */
- xorq %r14, %r14 /* nospec r14 */
+ xorl %r14d, %r14d /* nospec r14 */
pushq $0 /* pt_regs->r15 = 0 */
- xorq %r15, %r15 /* nospec r15 */
+ xorl %r15d, %r15d /* nospec r15 */
cld
/*
@@ -224,25 +224,25 @@ GLOBAL(entry_SYSCALL_compat_after_hwfram
pushq %rbp /* pt_regs->cx (stashed in bp) */
pushq $-ENOSYS /* pt_regs->ax */
pushq $0 /* pt_regs->r8 = 0 */
- xorq %r8, %r8 /* nospec r8 */
+ xorl %r8d, %r8d /* nospec r8 */
pushq $0 /* pt_regs->r9 = 0 */
- xorq %r9, %r9 /* nospec r9 */
+ xorl %r9d, %r9d /* nospec r9 */
pushq $0 /* pt_regs->r10 = 0 */
- xorq %r10, %r10 /* nospec r10 */
+ xorl %r10d, %r10d /* nospec r10 */
pushq $0 /* pt_regs->r11 = 0 */
- xorq %r11, %r11 /* nospec r11 */
+ xorl %r11d, %r11d /* nospec r11 */
pushq %rbx /* pt_regs->rbx */
xorl %ebx, %ebx /* nospec rbx */
pushq %rbp /* pt_regs->rbp (will be overwritten) */
xorl %ebp, %ebp /* nospec rbp */
pushq $0 /* pt_regs->r12 = 0 */
- xorq %r12, %r12 /* nospec r12 */
+ xorl %r12d, %r12d /* nospec r12 */
pushq $0 /* pt_regs->r13 = 0 */
- xorq %r13, %r13 /* nospec r13 */
+ xorl %r13d, %r13d /* nospec r13 */
pushq $0 /* pt_regs->r14 = 0 */
- xorq %r14, %r14 /* nospec r14 */
+ xorl %r14d, %r14d /* nospec r14 */
pushq $0 /* pt_regs->r15 = 0 */
- xorq %r15, %r15 /* nospec r15 */
+ xorl %r15d, %r15d /* nospec r15 */
/*
* User mode is traced as though IRQs are on, and SYSENTER
@@ -298,9 +298,9 @@ sysret32_from_system_call:
*/
SWITCH_TO_USER_CR3_NOSTACK scratch_reg=%r8 scratch_reg2=%r9
- xorq %r8, %r8
- xorq %r9, %r9
- xorq %r10, %r10
+ xorl %r8d, %r8d
+ xorl %r9d, %r9d
+ xorl %r10d, %r10d
swapgs
sysretl
END(entry_SYSCALL_compat)
@@ -358,25 +358,25 @@ ENTRY(entry_INT80_compat)
pushq %rcx /* pt_regs->cx */
pushq $-ENOSYS /* pt_regs->ax */
pushq $0 /* pt_regs->r8 = 0 */
- xorq %r8, %r8 /* nospec r8 */
+ xorl %r8d, %r8d /* nospec r8 */
pushq $0 /* pt_regs->r9 = 0 */
- xorq %r9, %r9 /* nospec r9 */
+ xorl %r9d, %r9d /* nospec r9 */
pushq $0 /* pt_regs->r10 = 0 */
- xorq %r10, %r10 /* nospec r10 */
+ xorl %r10d, %r10d /* nospec r10 */
pushq $0 /* pt_regs->r11 = 0 */
- xorq %r11, %r11 /* nospec r11 */
+ xorl %r11d, %r11d /* nospec r11 */
pushq %rbx /* pt_regs->rbx */
xorl %ebx, %ebx /* nospec rbx */
pushq %rbp /* pt_regs->rbp */
xorl %ebp, %ebp /* nospec rbp */
pushq %r12 /* pt_regs->r12 */
- xorq %r12, %r12 /* nospec r12 */
+ xorl %r12d, %r12d /* nospec r12 */
pushq %r13 /* pt_regs->r13 */
- xorq %r13, %r13 /* nospec r13 */
+ xorl %r13d, %r13d /* nospec r13 */
pushq %r14 /* pt_regs->r14 */
- xorq %r14, %r14 /* nospec r14 */
+ xorl %r14d, %r14d /* nospec r14 */
pushq %r15 /* pt_regs->r15 */
- xorq %r15, %r15 /* nospec r15 */
+ xorl %r15d, %r15d /* nospec r15 */
cld
/*
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 084/146] x86/mm: Remove stale comment about KMEMCHECK
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 083/146] x86/entry/64: Use xorl for faster register clearing Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 085/146] x86/asm: Improve how GEN_*_SUFFIXED_RMWcc() specify clobbers Greg Kroah-Hartman
` (65 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jann Horn, Thomas Gleixner,
Andy Lutomirski, Borislav Petkov, Brian Gerst, Denys Vlasenko,
H. Peter Anvin, Josh Poimboeuf, Linus Torvalds, Peter Zijlstra,
Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jannh@google.com>
commit 3b3a9268bba62b35a29bafe0931715b1725fdf26 upstream.
This comment referred to a conditional call to kmemcheck_hide() that was
here until commit 4950276672fc ("kmemcheck: remove annotations").
Now that kmemcheck has been removed, it doesn't make sense anymore.
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/20180219175039.253089-1-jannh@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/mm/fault.c | 4 ----
1 file changed, 4 deletions(-)
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1248,10 +1248,6 @@ __do_page_fault(struct pt_regs *regs, un
tsk = current;
mm = tsk->mm;
- /*
- * Detect and handle instructions that would cause a page fault for
- * both a tracked kernel page and a userspace page.
- */
prefetchw(&mm->mmap_sem);
if (unlikely(kmmio_fault(regs, address)))
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 085/146] x86/asm: Improve how GEN_*_SUFFIXED_RMWcc() specify clobbers
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 084/146] x86/mm: Remove stale comment about KMEMCHECK Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 086/146] x86/IO-APIC: Avoid warning in 32-bit builds Greg Kroah-Hartman
` (64 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Beulich, Thomas Gleixner,
Andy Lutomirski, Borislav Petkov, Brian Gerst, Denys Vlasenko,
H. Peter Anvin, Josh Poimboeuf, Kees Cook, Linus Torvalds,
Peter Zijlstra, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <JBeulich@suse.com>
commit 700b7c5409c3e9da279fbea78cf28a78fbc176cd upstream.
Commit:
df3405245a ("x86/asm: Add suffix macro for GEN_*_RMWcc()")
... introduced "suffix" RMWcc operations, adding bogus clobber specifiers:
For one, on x86 there's no point explicitly clobbering "cc".
In fact, with GCC properly fixed, this results in an overlap being detected by
the compiler between outputs and clobbers.
Furthermore it seems bad practice to me to have clobber specification
and use of the clobbered register(s) disconnected - it should rather be
at the invocation place of that GEN_{UN,BIN}ARY_SUFFIXED_RMWcc() macros
that the clobber is specified which this particular invocation needs.
Drop the "cc" clobber altogether and move the "cx" one to refcount.h.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/5A8AF1F802000078001A91E1@prv-mh.provo.novell.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/refcount.h | 4 ++--
arch/x86/include/asm/rmwcc.h | 16 ++++++++--------
2 files changed, 10 insertions(+), 10 deletions(-)
--- a/arch/x86/include/asm/refcount.h
+++ b/arch/x86/include/asm/refcount.h
@@ -67,13 +67,13 @@ static __always_inline __must_check
bool refcount_sub_and_test(unsigned int i, refcount_t *r)
{
GEN_BINARY_SUFFIXED_RMWcc(LOCK_PREFIX "subl", REFCOUNT_CHECK_LT_ZERO,
- r->refs.counter, "er", i, "%0", e);
+ r->refs.counter, "er", i, "%0", e, "cx");
}
static __always_inline __must_check bool refcount_dec_and_test(refcount_t *r)
{
GEN_UNARY_SUFFIXED_RMWcc(LOCK_PREFIX "decl", REFCOUNT_CHECK_LT_ZERO,
- r->refs.counter, "%0", e);
+ r->refs.counter, "%0", e, "cx");
}
static __always_inline __must_check
--- a/arch/x86/include/asm/rmwcc.h
+++ b/arch/x86/include/asm/rmwcc.h
@@ -2,8 +2,7 @@
#ifndef _ASM_X86_RMWcc
#define _ASM_X86_RMWcc
-#define __CLOBBERS_MEM "memory"
-#define __CLOBBERS_MEM_CC_CX "memory", "cc", "cx"
+#define __CLOBBERS_MEM(clb...) "memory", ## clb
#if !defined(__GCC_ASM_FLAG_OUTPUTS__) && defined(CC_HAVE_ASM_GOTO)
@@ -40,18 +39,19 @@ do { \
#endif /* defined(__GCC_ASM_FLAG_OUTPUTS__) || !defined(CC_HAVE_ASM_GOTO) */
#define GEN_UNARY_RMWcc(op, var, arg0, cc) \
- __GEN_RMWcc(op " " arg0, var, cc, __CLOBBERS_MEM)
+ __GEN_RMWcc(op " " arg0, var, cc, __CLOBBERS_MEM())
-#define GEN_UNARY_SUFFIXED_RMWcc(op, suffix, var, arg0, cc) \
+#define GEN_UNARY_SUFFIXED_RMWcc(op, suffix, var, arg0, cc, clobbers...)\
__GEN_RMWcc(op " " arg0 "\n\t" suffix, var, cc, \
- __CLOBBERS_MEM_CC_CX)
+ __CLOBBERS_MEM(clobbers))
#define GEN_BINARY_RMWcc(op, var, vcon, val, arg0, cc) \
__GEN_RMWcc(op __BINARY_RMWcc_ARG arg0, var, cc, \
- __CLOBBERS_MEM, vcon (val))
+ __CLOBBERS_MEM(), vcon (val))
-#define GEN_BINARY_SUFFIXED_RMWcc(op, suffix, var, vcon, val, arg0, cc) \
+#define GEN_BINARY_SUFFIXED_RMWcc(op, suffix, var, vcon, val, arg0, cc, \
+ clobbers...) \
__GEN_RMWcc(op __BINARY_RMWcc_ARG arg0 "\n\t" suffix, var, cc, \
- __CLOBBERS_MEM_CC_CX, vcon (val))
+ __CLOBBERS_MEM(clobbers), vcon (val))
#endif /* _ASM_X86_RMWcc */
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 086/146] x86/IO-APIC: Avoid warning in 32-bit builds
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 085/146] x86/asm: Improve how GEN_*_SUFFIXED_RMWcc() specify clobbers Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 087/146] x86/LDT: Avoid warning in 32-bit builds with older gcc Greg Kroah-Hartman
` (63 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Beulich, Thomas Gleixner,
Andy Lutomirski, Borislav Petkov, Brian Gerst, Denys Vlasenko,
H. Peter Anvin, Josh Poimboeuf, Linus Torvalds, Peter Zijlstra,
Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <JBeulich@suse.com>
commit 6262b6e78ce5ba62be47774ca80f5b0a6f0eb428 upstream.
Constants wider than 32 bits should be tagged with ULL.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/5A8AF23F02000078001A91E5@prv-mh.provo.novell.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/apic/io_apic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1603,7 +1603,7 @@ static void __init delay_with_tsc(void)
do {
rep_nop();
now = rdtsc();
- } while ((now - start) < 40000000000UL / HZ &&
+ } while ((now - start) < 40000000000ULL / HZ &&
time_before_eq(jiffies, end));
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 087/146] x86/LDT: Avoid warning in 32-bit builds with older gcc
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 086/146] x86/IO-APIC: Avoid warning in 32-bit builds Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 088/146] x86-64/realmode: Add instruction suffix Greg Kroah-Hartman
` (62 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Beulich, Thomas Gleixner,
Andy Lutomirski, Borislav Petkov, Brian Gerst, Denys Vlasenko,
H. Peter Anvin, Josh Poimboeuf, Linus Torvalds, Peter Zijlstra,
Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <JBeulich@suse.com>
commit f2f18b16c779978ece4a04f304a92ff9ac8fbce5 upstream.
BUG() doesn't always imply "no return", and hence should be followed by
a return statement even if that's obviously (to a human) unreachable.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/5A8AF2AA02000078001A91E9@prv-mh.provo.novell.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/mmu_context.h | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -74,6 +74,7 @@ static inline void *ldt_slot_va(int slot
return (void *)(LDT_BASE_ADDR + LDT_SLOT_STRIDE * slot);
#else
BUG();
+ return (void *)fix_to_virt(FIX_HOLE);
#endif
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 088/146] x86-64/realmode: Add instruction suffix
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 087/146] x86/LDT: Avoid warning in 32-bit builds with older gcc Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 089/146] Revert "x86/retpoline: Simplify vmexit_fill_RSB()" Greg Kroah-Hartman
` (61 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Beulich, Thomas Gleixner,
Andy Lutomirski, Borislav Petkov, Brian Gerst, Denys Vlasenko,
H. Peter Anvin, Josh Poimboeuf, Linus Torvalds, Peter Zijlstra,
Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <JBeulich@suse.com>
commit 8554004a0231dedf44d4d62147fb3d6a6db489aa upstream.
Omitting suffixes from instructions in AT&T mode is bad practice when
operand size cannot be determined by the assembler from register
operands, and is likely going to be warned about by upstream GAS in the
future (mine does already). Add the single missing suffix here.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/5A8AF5F602000078001A9230@prv-mh.provo.novell.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/realmode/rm/trampoline_64.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/realmode/rm/trampoline_64.S
+++ b/arch/x86/realmode/rm/trampoline_64.S
@@ -102,7 +102,7 @@ ENTRY(startup_32)
* don't we'll eventually crash trying to execute encrypted
* instructions.
*/
- bt $TH_FLAGS_SME_ACTIVE_BIT, pa_tr_flags
+ btl $TH_FLAGS_SME_ACTIVE_BIT, pa_tr_flags
jnc .Ldone
movl $MSR_K8_SYSCFG, %ecx
rdmsr
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 089/146] Revert "x86/retpoline: Simplify vmexit_fill_RSB()"
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 088/146] x86-64/realmode: Add instruction suffix Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 090/146] x86/speculation: Use IBRS if available before calling into firmware Greg Kroah-Hartman
` (60 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Woodhouse, Thomas Gleixner,
Linus Torvalds, Peter Zijlstra, arjan.van.de.ven, bp,
dave.hansen, jmattson, karahmed, kvm, pbonzini, rkrcmar,
Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <dwmw@amazon.co.uk>
commit d1c99108af3c5992640aa2afa7d2e88c3775c06e upstream.
This reverts commit 1dde7415e99933bb7293d6b2843752cbdb43ec11. By putting
the RSB filling out of line and calling it, we waste one RSB slot for
returning from the function itself, which means one fewer actual function
call we can make if we're doing the Skylake abomination of call-depth
counting.
It also changed the number of RSB stuffings we do on vmexit from 32,
which was correct, to 16. Let's just stop with the bikeshedding; it
didn't actually *fix* anything anyway.
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: arjan.van.de.ven@intel.com
Cc: bp@alien8.de
Cc: dave.hansen@intel.com
Cc: jmattson@google.com
Cc: karahmed@amazon.de
Cc: kvm@vger.kernel.org
Cc: pbonzini@redhat.com
Cc: rkrcmar@redhat.com
Link: http://lkml.kernel.org/r/1519037457-7643-4-git-send-email-dwmw@amazon.co.uk
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/entry/entry_32.S | 3 -
arch/x86/entry/entry_64.S | 3 -
arch/x86/include/asm/asm-prototypes.h | 3 -
arch/x86/include/asm/nospec-branch.h | 70 ++++++++++++++++++++++++++++++----
arch/x86/lib/Makefile | 1
arch/x86/lib/retpoline.S | 56 ---------------------------
6 files changed, 65 insertions(+), 71 deletions(-)
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -252,8 +252,7 @@ ENTRY(__switch_to_asm)
* exist, overwrite the RSB with entries which capture
* speculative execution to prevent attack.
*/
- /* Clobbers %ebx */
- FILL_RETURN_BUFFER RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW
+ FILL_RETURN_BUFFER %ebx, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW
#endif
/* restore callee-saved registers */
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -364,8 +364,7 @@ ENTRY(__switch_to_asm)
* exist, overwrite the RSB with entries which capture
* speculative execution to prevent attack.
*/
- /* Clobbers %rbx */
- FILL_RETURN_BUFFER RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW
+ FILL_RETURN_BUFFER %r12, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW
#endif
/* restore callee-saved registers */
--- a/arch/x86/include/asm/asm-prototypes.h
+++ b/arch/x86/include/asm/asm-prototypes.h
@@ -38,7 +38,4 @@ INDIRECT_THUNK(dx)
INDIRECT_THUNK(si)
INDIRECT_THUNK(di)
INDIRECT_THUNK(bp)
-asmlinkage void __fill_rsb(void);
-asmlinkage void __clear_rsb(void);
-
#endif /* CONFIG_RETPOLINE */
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -8,6 +8,50 @@
#include <asm/cpufeatures.h>
#include <asm/msr-index.h>
+/*
+ * Fill the CPU return stack buffer.
+ *
+ * Each entry in the RSB, if used for a speculative 'ret', contains an
+ * infinite 'pause; lfence; jmp' loop to capture speculative execution.
+ *
+ * This is required in various cases for retpoline and IBRS-based
+ * mitigations for the Spectre variant 2 vulnerability. Sometimes to
+ * eliminate potentially bogus entries from the RSB, and sometimes
+ * purely to ensure that it doesn't get empty, which on some CPUs would
+ * allow predictions from other (unwanted!) sources to be used.
+ *
+ * We define a CPP macro such that it can be used from both .S files and
+ * inline assembly. It's possible to do a .macro and then include that
+ * from C via asm(".include <asm/nospec-branch.h>") but let's not go there.
+ */
+
+#define RSB_CLEAR_LOOPS 32 /* To forcibly overwrite all entries */
+#define RSB_FILL_LOOPS 16 /* To avoid underflow */
+
+/*
+ * Google experimented with loop-unrolling and this turned out to be
+ * the optimal version — two calls, each with their own speculation
+ * trap should their return address end up getting used, in a loop.
+ */
+#define __FILL_RETURN_BUFFER(reg, nr, sp) \
+ mov $(nr/2), reg; \
+771: \
+ call 772f; \
+773: /* speculation trap */ \
+ pause; \
+ lfence; \
+ jmp 773b; \
+772: \
+ call 774f; \
+775: /* speculation trap */ \
+ pause; \
+ lfence; \
+ jmp 775b; \
+774: \
+ dec reg; \
+ jnz 771b; \
+ add $(BITS_PER_LONG/8) * nr, sp;
+
#ifdef __ASSEMBLY__
/*
@@ -78,10 +122,17 @@
#endif
.endm
-/* This clobbers the BX register */
-.macro FILL_RETURN_BUFFER nr:req ftr:req
+ /*
+ * A simpler FILL_RETURN_BUFFER macro. Don't make people use the CPP
+ * monstrosity above, manually.
+ */
+.macro FILL_RETURN_BUFFER reg:req nr:req ftr:req
#ifdef CONFIG_RETPOLINE
- ALTERNATIVE "", "call __clear_rsb", \ftr
+ ANNOTATE_NOSPEC_ALTERNATIVE
+ ALTERNATIVE "jmp .Lskip_rsb_\@", \
+ __stringify(__FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP)) \
+ \ftr
+.Lskip_rsb_\@:
#endif
.endm
@@ -156,10 +207,15 @@ extern char __indirect_thunk_end[];
static inline void vmexit_fill_RSB(void)
{
#ifdef CONFIG_RETPOLINE
- alternative_input("",
- "call __fill_rsb",
- X86_FEATURE_RETPOLINE,
- ASM_NO_INPUT_CLOBBER(_ASM_BX, "memory"));
+ unsigned long loops;
+
+ asm volatile (ANNOTATE_NOSPEC_ALTERNATIVE
+ ALTERNATIVE("jmp 910f",
+ __stringify(__FILL_RETURN_BUFFER(%0, RSB_CLEAR_LOOPS, %1)),
+ X86_FEATURE_RETPOLINE)
+ "910:"
+ : "=r" (loops), ASM_CALL_CONSTRAINT
+ : : "memory" );
#endif
}
--- a/arch/x86/lib/Makefile
+++ b/arch/x86/lib/Makefile
@@ -27,7 +27,6 @@ lib-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) +=
lib-$(CONFIG_INSTRUCTION_DECODER) += insn.o inat.o insn-eval.o
lib-$(CONFIG_RANDOMIZE_BASE) += kaslr.o
lib-$(CONFIG_RETPOLINE) += retpoline.o
-OBJECT_FILES_NON_STANDARD_retpoline.o :=y
obj-y += msr.o msr-reg.o msr-reg-export.o hweight.o
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -7,7 +7,6 @@
#include <asm/alternative-asm.h>
#include <asm/export.h>
#include <asm/nospec-branch.h>
-#include <asm/bitsperlong.h>
.macro THUNK reg
.section .text.__x86.indirect_thunk
@@ -47,58 +46,3 @@ GENERATE_THUNK(r13)
GENERATE_THUNK(r14)
GENERATE_THUNK(r15)
#endif
-
-/*
- * Fill the CPU return stack buffer.
- *
- * Each entry in the RSB, if used for a speculative 'ret', contains an
- * infinite 'pause; lfence; jmp' loop to capture speculative execution.
- *
- * This is required in various cases for retpoline and IBRS-based
- * mitigations for the Spectre variant 2 vulnerability. Sometimes to
- * eliminate potentially bogus entries from the RSB, and sometimes
- * purely to ensure that it doesn't get empty, which on some CPUs would
- * allow predictions from other (unwanted!) sources to be used.
- *
- * Google experimented with loop-unrolling and this turned out to be
- * the optimal version - two calls, each with their own speculation
- * trap should their return address end up getting used, in a loop.
- */
-.macro STUFF_RSB nr:req sp:req
- mov $(\nr / 2), %_ASM_BX
- .align 16
-771:
- call 772f
-773: /* speculation trap */
- pause
- lfence
- jmp 773b
- .align 16
-772:
- call 774f
-775: /* speculation trap */
- pause
- lfence
- jmp 775b
- .align 16
-774:
- dec %_ASM_BX
- jnz 771b
- add $((BITS_PER_LONG/8) * \nr), \sp
-.endm
-
-#define RSB_FILL_LOOPS 16 /* To avoid underflow */
-
-ENTRY(__fill_rsb)
- STUFF_RSB RSB_FILL_LOOPS, %_ASM_SP
- ret
-END(__fill_rsb)
-EXPORT_SYMBOL_GPL(__fill_rsb)
-
-#define RSB_CLEAR_LOOPS 32 /* To forcibly overwrite all entries */
-
-ENTRY(__clear_rsb)
- STUFF_RSB RSB_CLEAR_LOOPS, %_ASM_SP
- ret
-END(__clear_rsb)
-EXPORT_SYMBOL_GPL(__clear_rsb)
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 090/146] x86/speculation: Use IBRS if available before calling into firmware
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 089/146] Revert "x86/retpoline: Simplify vmexit_fill_RSB()" Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 091/146] x86/retpoline: Support retpoline builds with Clang Greg Kroah-Hartman
` (59 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Woodhouse, Thomas Gleixner,
Linus Torvalds, Peter Zijlstra, arjan.van.de.ven, bp,
dave.hansen, jmattson, karahmed, kvm, pbonzini, rkrcmar,
Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <dwmw@amazon.co.uk>
commit dd84441a797150dcc49298ec95c459a8891d8bb1 upstream.
Retpoline means the kernel is safe because it has no indirect branches.
But firmware isn't, so use IBRS for firmware calls if it's available.
Block preemption while IBRS is set, although in practice the call sites
already had to be doing that.
Ignore hpwdt.c for now. It's taking spinlocks and calling into firmware
code, from an NMI handler. I don't want to touch that with a bargepole.
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: arjan.van.de.ven@intel.com
Cc: bp@alien8.de
Cc: dave.hansen@intel.com
Cc: jmattson@google.com
Cc: karahmed@amazon.de
Cc: kvm@vger.kernel.org
Cc: pbonzini@redhat.com
Cc: rkrcmar@redhat.com
Link: http://lkml.kernel.org/r/1519037457-7643-2-git-send-email-dwmw@amazon.co.uk
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/apm.h | 6 +++++
arch/x86/include/asm/cpufeatures.h | 1
arch/x86/include/asm/efi.h | 17 +++++++++++++--
arch/x86/include/asm/nospec-branch.h | 39 ++++++++++++++++++++++++++---------
arch/x86/kernel/cpu/bugs.c | 12 +++++++++-
5 files changed, 63 insertions(+), 12 deletions(-)
--- a/arch/x86/include/asm/apm.h
+++ b/arch/x86/include/asm/apm.h
@@ -7,6 +7,8 @@
#ifndef _ASM_X86_MACH_DEFAULT_APM_H
#define _ASM_X86_MACH_DEFAULT_APM_H
+#include <asm/nospec-branch.h>
+
#ifdef APM_ZERO_SEGS
# define APM_DO_ZERO_SEGS \
"pushl %%ds\n\t" \
@@ -32,6 +34,7 @@ static inline void apm_bios_call_asm(u32
* N.B. We do NOT need a cld after the BIOS call
* because we always save and restore the flags.
*/
+ firmware_restrict_branch_speculation_start();
__asm__ __volatile__(APM_DO_ZERO_SEGS
"pushl %%edi\n\t"
"pushl %%ebp\n\t"
@@ -44,6 +47,7 @@ static inline void apm_bios_call_asm(u32
"=S" (*esi)
: "a" (func), "b" (ebx_in), "c" (ecx_in)
: "memory", "cc");
+ firmware_restrict_branch_speculation_end();
}
static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in,
@@ -56,6 +60,7 @@ static inline bool apm_bios_call_simple_
* N.B. We do NOT need a cld after the BIOS call
* because we always save and restore the flags.
*/
+ firmware_restrict_branch_speculation_start();
__asm__ __volatile__(APM_DO_ZERO_SEGS
"pushl %%edi\n\t"
"pushl %%ebp\n\t"
@@ -68,6 +73,7 @@ static inline bool apm_bios_call_simple_
"=S" (si)
: "a" (func), "b" (ebx_in), "c" (ecx_in)
: "memory", "cc");
+ firmware_restrict_branch_speculation_end();
return error;
}
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -211,6 +211,7 @@
#define X86_FEATURE_RSB_CTXSW ( 7*32+19) /* "" Fill RSB on context switches */
#define X86_FEATURE_USE_IBPB ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */
+#define X86_FEATURE_USE_IBRS_FW ( 7*32+22) /* "" Use IBRS during runtime firmware calls */
/* Virtualization flags: Linux defined, word 8 */
#define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -6,6 +6,7 @@
#include <asm/pgtable.h>
#include <asm/processor-flags.h>
#include <asm/tlb.h>
+#include <asm/nospec-branch.h>
/*
* We map the EFI regions needed for runtime services non-contiguously,
@@ -36,8 +37,18 @@
extern asmlinkage unsigned long efi_call_phys(void *, ...);
-#define arch_efi_call_virt_setup() kernel_fpu_begin()
-#define arch_efi_call_virt_teardown() kernel_fpu_end()
+#define arch_efi_call_virt_setup() \
+({ \
+ kernel_fpu_begin(); \
+ firmware_restrict_branch_speculation_start(); \
+})
+
+#define arch_efi_call_virt_teardown() \
+({ \
+ firmware_restrict_branch_speculation_end(); \
+ kernel_fpu_end(); \
+})
+
/*
* Wrap all the virtual calls in a way that forces the parameters on the stack.
@@ -73,6 +84,7 @@ struct efi_scratch {
efi_sync_low_kernel_mappings(); \
preempt_disable(); \
__kernel_fpu_begin(); \
+ firmware_restrict_branch_speculation_start(); \
\
if (efi_scratch.use_pgd) { \
efi_scratch.prev_cr3 = __read_cr3(); \
@@ -91,6 +103,7 @@ struct efi_scratch {
__flush_tlb_all(); \
} \
\
+ firmware_restrict_branch_speculation_end(); \
__kernel_fpu_end(); \
preempt_enable(); \
})
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -219,17 +219,38 @@ static inline void vmexit_fill_RSB(void)
#endif
}
+#define alternative_msr_write(_msr, _val, _feature) \
+ asm volatile(ALTERNATIVE("", \
+ "movl %[msr], %%ecx\n\t" \
+ "movl %[val], %%eax\n\t" \
+ "movl $0, %%edx\n\t" \
+ "wrmsr", \
+ _feature) \
+ : : [msr] "i" (_msr), [val] "i" (_val) \
+ : "eax", "ecx", "edx", "memory")
+
static inline void indirect_branch_prediction_barrier(void)
{
- asm volatile(ALTERNATIVE("",
- "movl %[msr], %%ecx\n\t"
- "movl %[val], %%eax\n\t"
- "movl $0, %%edx\n\t"
- "wrmsr",
- X86_FEATURE_USE_IBPB)
- : : [msr] "i" (MSR_IA32_PRED_CMD),
- [val] "i" (PRED_CMD_IBPB)
- : "eax", "ecx", "edx", "memory");
+ alternative_msr_write(MSR_IA32_PRED_CMD, PRED_CMD_IBPB,
+ X86_FEATURE_USE_IBPB);
+}
+
+/*
+ * With retpoline, we must use IBRS to restrict branch prediction
+ * before calling into firmware.
+ */
+static inline void firmware_restrict_branch_speculation_start(void)
+{
+ preempt_disable();
+ alternative_msr_write(MSR_IA32_SPEC_CTRL, SPEC_CTRL_IBRS,
+ X86_FEATURE_USE_IBRS_FW);
+}
+
+static inline void firmware_restrict_branch_speculation_end(void)
+{
+ alternative_msr_write(MSR_IA32_SPEC_CTRL, 0,
+ X86_FEATURE_USE_IBRS_FW);
+ preempt_enable();
}
#endif /* __ASSEMBLY__ */
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -300,6 +300,15 @@ retpoline_auto:
setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
}
+
+ /*
+ * Retpoline means the kernel is safe because it has no indirect
+ * branches. But firmware isn't, so use IBRS to protect that.
+ */
+ if (boot_cpu_has(X86_FEATURE_IBRS)) {
+ setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
+ pr_info("Enabling Restricted Speculation for firmware calls\n");
+ }
}
#undef pr_fmt
@@ -326,8 +335,9 @@ ssize_t cpu_show_spectre_v2(struct devic
if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
return sprintf(buf, "Not affected\n");
- return sprintf(buf, "%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+ return sprintf(buf, "%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
+ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
spectre_v2_module_string());
}
#endif
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 091/146] x86/retpoline: Support retpoline builds with Clang
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 090/146] x86/speculation: Use IBRS if available before calling into firmware Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 092/146] x86/speculation, objtool: Annotate indirect calls/jumps for objtool Greg Kroah-Hartman
` (58 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Woodhouse, Thomas Gleixner,
Linus Torvalds, Peter Zijlstra, arjan.van.de.ven, bp,
dave.hansen, jmattson, karahmed, kvm, pbonzini, rkrcmar,
Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <dwmw@amazon.co.uk>
commit 87358710c1fb4f1bf96bbe2349975ff9953fc9b2 upstream.
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: arjan.van.de.ven@intel.com
Cc: bp@alien8.de
Cc: dave.hansen@intel.com
Cc: jmattson@google.com
Cc: karahmed@amazon.de
Cc: kvm@vger.kernel.org
Cc: pbonzini@redhat.com
Cc: rkrcmar@redhat.com
Link: http://lkml.kernel.org/r/1519037457-7643-5-git-send-email-dwmw@amazon.co.uk
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/Makefile | 5 ++++-
include/linux/compiler-clang.h | 5 +++++
include/linux/compiler-gcc.h | 4 ++++
include/linux/init.h | 8 ++++----
4 files changed, 17 insertions(+), 5 deletions(-)
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -232,7 +232,10 @@ KBUILD_CFLAGS += -fno-asynchronous-unwin
# Avoid indirect branches in kernel to deal with Spectre
ifdef CONFIG_RETPOLINE
- RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register)
+ RETPOLINE_CFLAGS_GCC := -mindirect-branch=thunk-extern -mindirect-branch-register
+ RETPOLINE_CFLAGS_CLANG := -mretpoline-external-thunk
+
+ RETPOLINE_CFLAGS += $(call cc-option,$(RETPOLINE_CFLAGS_GCC),$(call cc-option,$(RETPOLINE_CFLAGS_CLANG)))
ifneq ($(RETPOLINE_CFLAGS),)
KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
endif
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -19,3 +19,8 @@
#define randomized_struct_fields_start struct {
#define randomized_struct_fields_end };
+
+/* Clang doesn't have a way to turn it off per-function, yet. */
+#ifdef __noretpoline
+#undef __noretpoline
+#endif
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -93,6 +93,10 @@
#define __weak __attribute__((weak))
#define __alias(symbol) __attribute__((alias(#symbol)))
+#ifdef RETPOLINE
+#define __noretpoline __attribute__((indirect_branch("keep")))
+#endif
+
/*
* it doesn't make sense on ARM (currently the only user of __naked)
* to trace naked functions because then mcount is called without
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -6,10 +6,10 @@
#include <linux/types.h>
/* Built-in __init functions needn't be compiled with retpoline */
-#if defined(RETPOLINE) && !defined(MODULE)
-#define __noretpoline __attribute__((indirect_branch("keep")))
+#if defined(__noretpoline) && !defined(MODULE)
+#define __noinitretpoline __noretpoline
#else
-#define __noretpoline
+#define __noinitretpoline
#endif
/* These macros are used to mark some functions or
@@ -47,7 +47,7 @@
/* These are for everybody (although not all archs will actually
discard it in modules) */
-#define __init __section(.init.text) __cold __latent_entropy __noretpoline
+#define __init __section(.init.text) __cold __latent_entropy __noinitretpoline
#define __initdata __section(.init.data)
#define __initconst __section(.init.rodata)
#define __exitdata __section(.exit.data)
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 092/146] x86/speculation, objtool: Annotate indirect calls/jumps for objtool
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 091/146] x86/retpoline: Support retpoline builds with Clang Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 093/146] x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP Greg Kroah-Hartman
` (57 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra (Intel),
David Woodhouse, Thomas Gleixner, Josh Poimboeuf,
Andy Lutomirski, Arjan van de Ven, Borislav Petkov, Dan Williams,
Dave Hansen, David Woodhouse, Linus Torvalds, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 9e0e3c5130e949c389caabc8033e9799b129e429 upstream.
Annotate the indirect calls/jumps in the CALL_NOSPEC/JUMP_NOSPEC
alternatives.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: David Woodhouse <dwmw@amazon.co.uk>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/nospec-branch.h | 27 +++++++++++++++++++++++----
1 file changed, 23 insertions(+), 4 deletions(-)
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -68,6 +68,18 @@
.endm
/*
+ * This should be used immediately before an indirect jump/call. It tells
+ * objtool the subsequent indirect jump/call is vouched safe for retpoline
+ * builds.
+ */
+.macro ANNOTATE_RETPOLINE_SAFE
+ .Lannotate_\@:
+ .pushsection .discard.retpoline_safe
+ _ASM_PTR .Lannotate_\@
+ .popsection
+.endm
+
+/*
* These are the bare retpoline primitives for indirect jmp and call.
* Do not use these directly; they only exist to make the ALTERNATIVE
* invocation below less ugly.
@@ -103,9 +115,9 @@
.macro JMP_NOSPEC reg:req
#ifdef CONFIG_RETPOLINE
ANNOTATE_NOSPEC_ALTERNATIVE
- ALTERNATIVE_2 __stringify(jmp *\reg), \
+ ALTERNATIVE_2 __stringify(ANNOTATE_RETPOLINE_SAFE; jmp *\reg), \
__stringify(RETPOLINE_JMP \reg), X86_FEATURE_RETPOLINE, \
- __stringify(lfence; jmp *\reg), X86_FEATURE_RETPOLINE_AMD
+ __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; jmp *\reg), X86_FEATURE_RETPOLINE_AMD
#else
jmp *\reg
#endif
@@ -114,9 +126,9 @@
.macro CALL_NOSPEC reg:req
#ifdef CONFIG_RETPOLINE
ANNOTATE_NOSPEC_ALTERNATIVE
- ALTERNATIVE_2 __stringify(call *\reg), \
+ ALTERNATIVE_2 __stringify(ANNOTATE_RETPOLINE_SAFE; call *\reg), \
__stringify(RETPOLINE_CALL \reg), X86_FEATURE_RETPOLINE,\
- __stringify(lfence; call *\reg), X86_FEATURE_RETPOLINE_AMD
+ __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; call *\reg), X86_FEATURE_RETPOLINE_AMD
#else
call *\reg
#endif
@@ -144,6 +156,12 @@
".long 999b - .\n\t" \
".popsection\n\t"
+#define ANNOTATE_RETPOLINE_SAFE \
+ "999:\n\t" \
+ ".pushsection .discard.retpoline_safe\n\t" \
+ _ASM_PTR " 999b\n\t" \
+ ".popsection\n\t"
+
#if defined(CONFIG_X86_64) && defined(RETPOLINE)
/*
@@ -153,6 +171,7 @@
# define CALL_NOSPEC \
ANNOTATE_NOSPEC_ALTERNATIVE \
ALTERNATIVE( \
+ ANNOTATE_RETPOLINE_SAFE \
"call *%[thunk_target]\n", \
"call __x86_indirect_thunk_%V[thunk_target]\n", \
X86_FEATURE_RETPOLINE)
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 093/146] x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 092/146] x86/speculation, objtool: Annotate indirect calls/jumps for objtool Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 094/146] x86/paravirt, objtool: Annotate indirect calls Greg Kroah-Hartman
` (56 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Woodhouse, Thomas Gleixner,
Linus Torvalds, Peter Zijlstra, arjan.van.de.ven, bp,
dave.hansen, jmattson, karahmed, kvm, pbonzini, rkrcmar,
Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ingo Molnar <mingo@kernel.org>
commit d72f4e29e6d84b7ec02ae93088aa459ac70e733b upstream.
firmware_restrict_branch_speculation_*() recently started using
preempt_enable()/disable(), but those are relatively high level
primitives and cause build failures on some 32-bit builds.
Since we want to keep <asm/nospec-branch.h> low level, convert
them to macros to avoid header hell...
Cc: David Woodhouse <dwmw@amazon.co.uk>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: arjan.van.de.ven@intel.com
Cc: bp@alien8.de
Cc: dave.hansen@intel.com
Cc: jmattson@google.com
Cc: karahmed@amazon.de
Cc: kvm@vger.kernel.org
Cc: pbonzini@redhat.com
Cc: rkrcmar@redhat.com
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/nospec-branch.h | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -257,20 +257,22 @@ static inline void indirect_branch_predi
/*
* With retpoline, we must use IBRS to restrict branch prediction
* before calling into firmware.
+ *
+ * (Implemented as CPP macros due to header hell.)
*/
-static inline void firmware_restrict_branch_speculation_start(void)
-{
- preempt_disable();
- alternative_msr_write(MSR_IA32_SPEC_CTRL, SPEC_CTRL_IBRS,
- X86_FEATURE_USE_IBRS_FW);
-}
+#define firmware_restrict_branch_speculation_start() \
+do { \
+ preempt_disable(); \
+ alternative_msr_write(MSR_IA32_SPEC_CTRL, SPEC_CTRL_IBRS, \
+ X86_FEATURE_USE_IBRS_FW); \
+} while (0)
-static inline void firmware_restrict_branch_speculation_end(void)
-{
- alternative_msr_write(MSR_IA32_SPEC_CTRL, 0,
- X86_FEATURE_USE_IBRS_FW);
- preempt_enable();
-}
+#define firmware_restrict_branch_speculation_end() \
+do { \
+ alternative_msr_write(MSR_IA32_SPEC_CTRL, 0, \
+ X86_FEATURE_USE_IBRS_FW); \
+ preempt_enable(); \
+} while (0)
#endif /* __ASSEMBLY__ */
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 094/146] x86/paravirt, objtool: Annotate indirect calls
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 093/146] x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 095/146] x86/boot, objtool: Annotate indirect jump in secondary_startup_64() Greg Kroah-Hartman
` (55 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra (Intel),
David Woodhouse, Thomas Gleixner, Josh Poimboeuf,
Andy Lutomirski, Arjan van de Ven, Borislav Petkov, Dan Williams,
Dave Hansen, David Woodhouse, Linus Torvalds, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 3010a0663fd949d122eca0561b06b0a9453f7866 upstream.
Paravirt emits indirect calls which get flagged by objtool retpoline
checks, annotate it away because all these indirect calls will be
patched out before we start userspace.
This patching happens through alternative_instructions() ->
apply_paravirt() -> pv_init_ops.patch() which will eventually end up
in paravirt_patch_default(). This function _will_ write direct
alternatives.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: David Woodhouse <dwmw@amazon.co.uk>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/paravirt.h | 17 +++++++++++++----
arch/x86/include/asm/paravirt_types.h | 5 ++++-
2 files changed, 17 insertions(+), 5 deletions(-)
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -7,6 +7,7 @@
#ifdef CONFIG_PARAVIRT
#include <asm/pgtable_types.h>
#include <asm/asm.h>
+#include <asm/nospec-branch.h>
#include <asm/paravirt_types.h>
@@ -879,23 +880,27 @@ extern void default_banner(void);
#define INTERRUPT_RETURN \
PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_iret), CLBR_NONE, \
- jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_iret))
+ ANNOTATE_RETPOLINE_SAFE; \
+ jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_iret);)
#define DISABLE_INTERRUPTS(clobbers) \
PARA_SITE(PARA_PATCH(pv_irq_ops, PV_IRQ_irq_disable), clobbers, \
PV_SAVE_REGS(clobbers | CLBR_CALLEE_SAVE); \
+ ANNOTATE_RETPOLINE_SAFE; \
call PARA_INDIRECT(pv_irq_ops+PV_IRQ_irq_disable); \
PV_RESTORE_REGS(clobbers | CLBR_CALLEE_SAVE);)
#define ENABLE_INTERRUPTS(clobbers) \
PARA_SITE(PARA_PATCH(pv_irq_ops, PV_IRQ_irq_enable), clobbers, \
PV_SAVE_REGS(clobbers | CLBR_CALLEE_SAVE); \
+ ANNOTATE_RETPOLINE_SAFE; \
call PARA_INDIRECT(pv_irq_ops+PV_IRQ_irq_enable); \
PV_RESTORE_REGS(clobbers | CLBR_CALLEE_SAVE);)
#ifdef CONFIG_X86_32
#define GET_CR0_INTO_EAX \
push %ecx; push %edx; \
+ ANNOTATE_RETPOLINE_SAFE; \
call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
pop %edx; pop %ecx
#else /* !CONFIG_X86_32 */
@@ -917,21 +922,25 @@ extern void default_banner(void);
*/
#define SWAPGS \
PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_swapgs), CLBR_NONE, \
- call PARA_INDIRECT(pv_cpu_ops+PV_CPU_swapgs) \
+ ANNOTATE_RETPOLINE_SAFE; \
+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_swapgs); \
)
#define GET_CR2_INTO_RAX \
- call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr2)
+ ANNOTATE_RETPOLINE_SAFE; \
+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr2);
#define USERGS_SYSRET64 \
PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_usergs_sysret64), \
CLBR_NONE, \
- jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_usergs_sysret64))
+ ANNOTATE_RETPOLINE_SAFE; \
+ jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_usergs_sysret64);)
#ifdef CONFIG_DEBUG_ENTRY
#define SAVE_FLAGS(clobbers) \
PARA_SITE(PARA_PATCH(pv_irq_ops, PV_IRQ_save_fl), clobbers, \
PV_SAVE_REGS(clobbers | CLBR_CALLEE_SAVE); \
+ ANNOTATE_RETPOLINE_SAFE; \
call PARA_INDIRECT(pv_irq_ops+PV_IRQ_save_fl); \
PV_RESTORE_REGS(clobbers | CLBR_CALLEE_SAVE);)
#endif
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -43,6 +43,7 @@
#include <asm/desc_defs.h>
#include <asm/kmap_types.h>
#include <asm/pgtable_types.h>
+#include <asm/nospec-branch.h>
struct page;
struct thread_struct;
@@ -392,7 +393,9 @@ int paravirt_disable_iospace(void);
* offset into the paravirt_patch_template structure, and can therefore be
* freely converted back into a structure offset.
*/
-#define PARAVIRT_CALL "call *%c[paravirt_opptr];"
+#define PARAVIRT_CALL \
+ ANNOTATE_RETPOLINE_SAFE \
+ "call *%c[paravirt_opptr];"
/*
* These macros are intended to wrap calls through one of the paravirt
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 095/146] x86/boot, objtool: Annotate indirect jump in secondary_startup_64()
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 094/146] x86/paravirt, objtool: Annotate indirect calls Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 096/146] x86/mm/sme, objtool: Annotate indirect call in sme_encrypt_execute() Greg Kroah-Hartman
` (54 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra (Intel),
David Woodhouse, Thomas Gleixner, Josh Poimboeuf,
Andy Lutomirski, Arjan van de Ven, Borislav Petkov, Dan Williams,
Dave Hansen, David Woodhouse, Linus Torvalds, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit bd89004f6305cbf7352238f61da093207ee518d6 upstream.
The objtool retpoline validation found this indirect jump. Seeing how
it's on CPU bringup before we run userspace it should be safe, annotate
it.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: David Woodhouse <dwmw@amazon.co.uk>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/head_64.S | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -23,6 +23,7 @@
#include <asm/nops.h>
#include "../entry/calling.h"
#include <asm/export.h>
+#include <asm/nospec-branch.h>
#ifdef CONFIG_PARAVIRT
#include <asm/asm-offsets.h>
@@ -134,6 +135,7 @@ ENTRY(secondary_startup_64)
/* Ensure I am executing from virtual addresses */
movq $1f, %rax
+ ANNOTATE_RETPOLINE_SAFE
jmp *%rax
1:
UNWIND_HINT_EMPTY
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 096/146] x86/mm/sme, objtool: Annotate indirect call in sme_encrypt_execute()
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 095/146] x86/boot, objtool: Annotate indirect jump in secondary_startup_64() Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 097/146] objtool: Use existing global variables for options Greg Kroah-Hartman
` (53 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra (Intel),
Thomas Gleixner, Josh Poimboeuf, Andy Lutomirski,
Arjan van de Ven, Borislav Petkov, Borislav Petkov, Dan Williams,
Dave Hansen, David Woodhouse, Linus Torvalds, Tom Lendacky,
Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 531bb52a869a9c6e08c8d17ba955fcbfc18037ad upstream.
This is boot code and thus Spectre-safe: we run this _way_ before userspace
comes along to have a chance to poison our branch predictor.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/mm/mem_encrypt_boot.S | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/x86/mm/mem_encrypt_boot.S
+++ b/arch/x86/mm/mem_encrypt_boot.S
@@ -15,6 +15,7 @@
#include <asm/page.h>
#include <asm/processor-flags.h>
#include <asm/msr-index.h>
+#include <asm/nospec-branch.h>
.text
.code64
@@ -59,6 +60,7 @@ ENTRY(sme_encrypt_execute)
movq %rax, %r8 /* Workarea encryption routine */
addq $PAGE_SIZE, %r8 /* Workarea intermediate copy buffer */
+ ANNOTATE_RETPOLINE_SAFE
call *%rax /* Call the encryption routine */
pop %r12
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 097/146] objtool: Use existing global variables for options
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 096/146] x86/mm/sme, objtool: Annotate indirect call in sme_encrypt_execute() Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 098/146] objtool: Add retpoline validation Greg Kroah-Hartman
` (52 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra (Intel),
Thomas Gleixner, Josh Poimboeuf, Andy Lutomirski,
Arjan van de Ven, Borislav Petkov, Dan Williams, Dave Hansen,
David Woodhouse, Linus Torvalds, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 43a4525f80534530077683f6472d8971646b0ace upstream.
Use the existing global variables instead of passing them around and
creating duplicate global variables.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/objtool/builtin-check.c | 2 +-
tools/objtool/builtin-orc.c | 6 +-----
tools/objtool/builtin.h | 5 +++++
tools/objtool/check.c | 5 ++---
tools/objtool/check.h | 2 +-
5 files changed, 10 insertions(+), 10 deletions(-)
--- a/tools/objtool/builtin-check.c
+++ b/tools/objtool/builtin-check.c
@@ -53,5 +53,5 @@ int cmd_check(int argc, const char **arg
objname = argv[0];
- return check(objname, no_fp, no_unreachable, false);
+ return check(objname, false);
}
--- a/tools/objtool/builtin-orc.c
+++ b/tools/objtool/builtin-orc.c
@@ -25,7 +25,6 @@
*/
#include <string.h>
-#include <subcmd/parse-options.h>
#include "builtin.h"
#include "check.h"
@@ -36,9 +35,6 @@ static const char *orc_usage[] = {
NULL,
};
-extern const struct option check_options[];
-extern bool no_fp, no_unreachable;
-
int cmd_orc(int argc, const char **argv)
{
const char *objname;
@@ -54,7 +50,7 @@ int cmd_orc(int argc, const char **argv)
objname = argv[0];
- return check(objname, no_fp, no_unreachable, true);
+ return check(objname, true);
}
if (!strcmp(argv[0], "dump")) {
--- a/tools/objtool/builtin.h
+++ b/tools/objtool/builtin.h
@@ -17,6 +17,11 @@
#ifndef _BUILTIN_H
#define _BUILTIN_H
+#include <subcmd/parse-options.h>
+
+extern const struct option check_options[];
+extern bool no_fp, no_unreachable;
+
extern int cmd_check(int argc, const char **argv);
extern int cmd_orc(int argc, const char **argv);
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -18,6 +18,7 @@
#include <string.h>
#include <stdlib.h>
+#include "builtin.h"
#include "check.h"
#include "elf.h"
#include "special.h"
@@ -33,7 +34,6 @@ struct alternative {
};
const char *objname;
-static bool no_fp;
struct cfi_state initial_func_cfi;
struct instruction *find_insn(struct objtool_file *file,
@@ -2021,13 +2021,12 @@ static void cleanup(struct objtool_file
elf_close(file->elf);
}
-int check(const char *_objname, bool _no_fp, bool no_unreachable, bool orc)
+int check(const char *_objname, bool orc)
{
struct objtool_file file;
int ret, warnings = 0;
objname = _objname;
- no_fp = _no_fp;
file.elf = elf_open(objname, orc ? O_RDWR : O_RDONLY);
if (!file.elf)
--- a/tools/objtool/check.h
+++ b/tools/objtool/check.h
@@ -63,7 +63,7 @@ struct objtool_file {
bool ignore_unreachables, c_file, hints;
};
-int check(const char *objname, bool no_fp, bool no_unreachable, bool orc);
+int check(const char *objname, bool orc);
struct instruction *find_insn(struct objtool_file *file,
struct section *sec, unsigned long offset);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 098/146] objtool: Add retpoline validation
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (96 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 097/146] objtool: Use existing global variables for options Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 099/146] objtool: Add module specific retpoline rules Greg Kroah-Hartman
` (51 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Woodhouse,
Peter Zijlstra (Intel),
David Woodhouse, Thomas Gleixner, Josh Poimboeuf,
Andy Lutomirski, Arjan van de Ven, Borislav Petkov, Dan Williams,
Dave Hansen, Linus Torvalds, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit b5bc2231b8ad4387c9641f235ca0ad8cd300b6df upstream.
David requested a objtool validation pass for CONFIG_RETPOLINE=y enabled
builds, where it validates no unannotated indirect jumps or calls are
left.
Add an additional .discard.retpoline_safe section to allow annotating
the few indirect sites that are required and safe.
Requested-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: David Woodhouse <dwmw@amazon.co.uk>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
scripts/Makefile.build | 4 +
tools/objtool/builtin-check.c | 3 -
tools/objtool/builtin.h | 2
tools/objtool/check.c | 86 +++++++++++++++++++++++++++++++++++++++++-
tools/objtool/check.h | 1
5 files changed, 93 insertions(+), 3 deletions(-)
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -264,6 +264,10 @@ objtool_args += --no-unreachable
else
objtool_args += $(call cc-ifversion, -lt, 0405, --no-unreachable)
endif
+ifdef CONFIG_RETPOLINE
+ objtool_args += --retpoline
+endif
+
ifdef CONFIG_MODVERSIONS
objtool_o = $(@D)/.tmp_$(@F)
--- a/tools/objtool/builtin-check.c
+++ b/tools/objtool/builtin-check.c
@@ -29,7 +29,7 @@
#include "builtin.h"
#include "check.h"
-bool no_fp, no_unreachable;
+bool no_fp, no_unreachable, retpoline;
static const char * const check_usage[] = {
"objtool check [<options>] file.o",
@@ -39,6 +39,7 @@ static const char * const check_usage[]
const struct option check_options[] = {
OPT_BOOLEAN('f', "no-fp", &no_fp, "Skip frame pointer validation"),
OPT_BOOLEAN('u', "no-unreachable", &no_unreachable, "Skip 'unreachable instruction' warnings"),
+ OPT_BOOLEAN('r', "retpoline", &retpoline, "Validate retpoline assumptions"),
OPT_END(),
};
--- a/tools/objtool/builtin.h
+++ b/tools/objtool/builtin.h
@@ -20,7 +20,7 @@
#include <subcmd/parse-options.h>
extern const struct option check_options[];
-extern bool no_fp, no_unreachable;
+extern bool no_fp, no_unreachable, retpoline;
extern int cmd_check(int argc, const char **argv);
extern int cmd_orc(int argc, const char **argv);
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -496,6 +496,7 @@ static int add_jump_destinations(struct
* disguise, so convert them accordingly.
*/
insn->type = INSN_JUMP_DYNAMIC;
+ insn->retpoline_safe = true;
continue;
} else {
/* sibling call */
@@ -547,7 +548,8 @@ static int add_call_destinations(struct
if (!insn->call_dest && !insn->ignore) {
WARN_FUNC("unsupported intra-function call",
insn->sec, insn->offset);
- WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.");
+ if (retpoline)
+ WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.");
return -1;
}
@@ -1107,6 +1109,54 @@ static int read_unwind_hints(struct objt
return 0;
}
+static int read_retpoline_hints(struct objtool_file *file)
+{
+ struct section *sec, *relasec;
+ struct instruction *insn;
+ struct rela *rela;
+ int i;
+
+ sec = find_section_by_name(file->elf, ".discard.retpoline_safe");
+ if (!sec)
+ return 0;
+
+ relasec = sec->rela;
+ if (!relasec) {
+ WARN("missing .rela.discard.retpoline_safe section");
+ return -1;
+ }
+
+ if (sec->len % sizeof(unsigned long)) {
+ WARN("retpoline_safe size mismatch: %d %ld", sec->len, sizeof(unsigned long));
+ return -1;
+ }
+
+ for (i = 0; i < sec->len / sizeof(unsigned long); i++) {
+ rela = find_rela_by_dest(sec, i * sizeof(unsigned long));
+ if (!rela) {
+ WARN("can't find rela for retpoline_safe[%d]", i);
+ return -1;
+ }
+
+ insn = find_insn(file, rela->sym->sec, rela->addend);
+ if (!insn) {
+ WARN("can't find insn for retpoline_safe[%d]", i);
+ return -1;
+ }
+
+ if (insn->type != INSN_JUMP_DYNAMIC &&
+ insn->type != INSN_CALL_DYNAMIC) {
+ WARN_FUNC("retpoline_safe hint not a indirect jump/call",
+ insn->sec, insn->offset);
+ return -1;
+ }
+
+ insn->retpoline_safe = true;
+ }
+
+ return 0;
+}
+
static int decode_sections(struct objtool_file *file)
{
int ret;
@@ -1145,6 +1195,10 @@ static int decode_sections(struct objtoo
if (ret)
return ret;
+ ret = read_retpoline_hints(file);
+ if (ret)
+ return ret;
+
return 0;
}
@@ -1890,6 +1944,29 @@ static int validate_unwind_hints(struct
return warnings;
}
+static int validate_retpoline(struct objtool_file *file)
+{
+ struct instruction *insn;
+ int warnings = 0;
+
+ for_each_insn(file, insn) {
+ if (insn->type != INSN_JUMP_DYNAMIC &&
+ insn->type != INSN_CALL_DYNAMIC)
+ continue;
+
+ if (insn->retpoline_safe)
+ continue;
+
+ WARN_FUNC("indirect %s found in RETPOLINE build",
+ insn->sec, insn->offset,
+ insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");
+
+ warnings++;
+ }
+
+ return warnings;
+}
+
static bool is_kasan_insn(struct instruction *insn)
{
return (insn->type == INSN_CALL &&
@@ -2050,6 +2127,13 @@ int check(const char *_objname, bool orc
if (list_empty(&file.insn_list))
goto out;
+ if (retpoline) {
+ ret = validate_retpoline(&file);
+ if (ret < 0)
+ return ret;
+ warnings += ret;
+ }
+
ret = validate_functions(&file);
if (ret < 0)
goto out;
--- a/tools/objtool/check.h
+++ b/tools/objtool/check.h
@@ -45,6 +45,7 @@ struct instruction {
unsigned char type;
unsigned long immediate;
bool alt_group, visited, dead_end, ignore, hint, save, restore, ignore_alts;
+ bool retpoline_safe;
struct symbol *call_dest;
struct instruction *jump_dest;
struct instruction *first_jump_src;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 099/146] objtool: Add module specific retpoline rules
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (97 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 098/146] objtool: Add retpoline validation Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 100/146] objtool, retpolines: Integrate objtool with retpoline support more closely Greg Kroah-Hartman
` (50 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Woodhouse,
Peter Zijlstra (Intel),
Thomas Gleixner, Josh Poimboeuf, Andy Lutomirski,
Arjan van de Ven, Borislav Petkov, Dan Williams, Dave Hansen,
Linus Torvalds, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit ca41b97ed9124fd62323a162de5852f6e28f94b8 upstream.
David allowed retpolines in .init.text, except for modules, which will
trip up objtool retpoline validation, fix that.
Requested-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
scripts/Makefile.build | 2 ++
tools/objtool/builtin-check.c | 3 ++-
tools/objtool/builtin.h | 2 +-
tools/objtool/check.c | 9 +++++++++
4 files changed, 14 insertions(+), 2 deletions(-)
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -256,6 +256,8 @@ __objtool_obj := $(objtree)/tools/objtoo
objtool_args = $(if $(CONFIG_UNWINDER_ORC),orc generate,check)
+objtool_args += $(if $(part-of-module), --module,)
+
ifndef CONFIG_FRAME_POINTER
objtool_args += --no-fp
endif
--- a/tools/objtool/builtin-check.c
+++ b/tools/objtool/builtin-check.c
@@ -29,7 +29,7 @@
#include "builtin.h"
#include "check.h"
-bool no_fp, no_unreachable, retpoline;
+bool no_fp, no_unreachable, retpoline, module;
static const char * const check_usage[] = {
"objtool check [<options>] file.o",
@@ -40,6 +40,7 @@ const struct option check_options[] = {
OPT_BOOLEAN('f', "no-fp", &no_fp, "Skip frame pointer validation"),
OPT_BOOLEAN('u', "no-unreachable", &no_unreachable, "Skip 'unreachable instruction' warnings"),
OPT_BOOLEAN('r', "retpoline", &retpoline, "Validate retpoline assumptions"),
+ OPT_BOOLEAN('m', "module", &module, "Indicates the object will be part of a kernel module"),
OPT_END(),
};
--- a/tools/objtool/builtin.h
+++ b/tools/objtool/builtin.h
@@ -20,7 +20,7 @@
#include <subcmd/parse-options.h>
extern const struct option check_options[];
-extern bool no_fp, no_unreachable, retpoline;
+extern bool no_fp, no_unreachable, retpoline, module;
extern int cmd_check(int argc, const char **argv);
extern int cmd_orc(int argc, const char **argv);
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -1957,6 +1957,15 @@ static int validate_retpoline(struct obj
if (insn->retpoline_safe)
continue;
+ /*
+ * .init.text code is ran before userspace and thus doesn't
+ * strictly need retpolines, except for modules which are
+ * loaded late, they very much do need retpoline in their
+ * .init.text
+ */
+ if (!strcmp(insn->sec->name, ".init.text") && !module)
+ continue;
+
WARN_FUNC("indirect %s found in RETPOLINE build",
insn->sec, insn->offset,
insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 100/146] objtool, retpolines: Integrate objtool with retpoline support more closely
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (98 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 099/146] objtool: Add module specific retpoline rules Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 101/146] objtool: Fix another switch table detection issue Greg Kroah-Hartman
` (49 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra (Intel),
Thomas Gleixner, Andy Lutomirski, Arjan van de Ven,
Borislav Petkov, Dan Williams, Dave Hansen, David Woodhouse,
Josh Poimboeuf, Linus Torvalds, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit d5028ba8ee5a18c9d0bb926d883c28b370f89009 upstream.
Disable retpoline validation in objtool if your compiler sucks, and otherwise
select the validation stuff for CONFIG_RETPOLINE=y (most builds would already
have it set due to ORC).
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Makefile | 5 +++++
arch/x86/Kconfig | 1 +
arch/x86/Makefile | 10 +++-------
scripts/Makefile.build | 2 ++
4 files changed, 11 insertions(+), 7 deletions(-)
--- a/Makefile
+++ b/Makefile
@@ -487,6 +487,11 @@ KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG
KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC)
endif
+RETPOLINE_CFLAGS_GCC := -mindirect-branch=thunk-extern -mindirect-branch-register
+RETPOLINE_CFLAGS_CLANG := -mretpoline-external-thunk
+RETPOLINE_CFLAGS := $(call cc-option,$(RETPOLINE_CFLAGS_GCC),$(call cc-option,$(RETPOLINE_CFLAGS_CLANG)))
+export RETPOLINE_CFLAGS
+
ifeq ($(config-targets),1)
# ===========================================================================
# *config targets only - make sure prerequisites are updated, and descend
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -432,6 +432,7 @@ config GOLDFISH
config RETPOLINE
bool "Avoid speculative indirect branches in kernel"
default y
+ select STACK_VALIDATION if HAVE_STACK_VALIDATION
help
Compile kernel with the retpoline compiler options to guard against
kernel-to-user data leaks by avoiding speculative indirect
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -232,13 +232,9 @@ KBUILD_CFLAGS += -fno-asynchronous-unwin
# Avoid indirect branches in kernel to deal with Spectre
ifdef CONFIG_RETPOLINE
- RETPOLINE_CFLAGS_GCC := -mindirect-branch=thunk-extern -mindirect-branch-register
- RETPOLINE_CFLAGS_CLANG := -mretpoline-external-thunk
-
- RETPOLINE_CFLAGS += $(call cc-option,$(RETPOLINE_CFLAGS_GCC),$(call cc-option,$(RETPOLINE_CFLAGS_CLANG)))
- ifneq ($(RETPOLINE_CFLAGS),)
- KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
- endif
+ifneq ($(RETPOLINE_CFLAGS),)
+ KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
+endif
endif
archscripts: scripts_basic
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -267,8 +267,10 @@ else
objtool_args += $(call cc-ifversion, -lt, 0405, --no-unreachable)
endif
ifdef CONFIG_RETPOLINE
+ifneq ($(RETPOLINE_CFLAGS),)
objtool_args += --retpoline
endif
+endif
ifdef CONFIG_MODVERSIONS
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 101/146] objtool: Fix another switch table detection issue
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (99 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 100/146] objtool, retpolines: Integrate objtool with retpoline support more closely Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 102/146] objtool: Fix 32-bit build Greg Kroah-Hartman
` (48 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Josh Poimboeuf,
Thomas Gleixner, Peter Zijlstra
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <jpoimboe@redhat.com>
commit 1402fd8ed7e5bda1b3e7613b70780b0db392d1e6 upstream.
Continue the switch table detection whack-a-mole. Add a check to
distinguish KASAN data reads from switch data reads. The switch jump
tables in .rodata have relocations associated with them.
This fixes the following warning:
crypto/asymmetric_keys/x509_cert_parser.o: warning: objtool: x509_note_pkey_algo()+0xa4: sibling call from callable instruction with modified stack frame
Reported-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Arnd Bergmann <arnd@arndb.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lkml.kernel.org/r/d7c8853022ad47d158cb81e953a40469fc08a95e.1519784382.git.jpoimboe@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/objtool/check.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -924,7 +924,11 @@ static struct rela *find_switch_table(st
if (find_symbol_containing(file->rodata, text_rela->addend))
continue;
- return find_rela_by_dest(file->rodata, text_rela->addend);
+ rodata_rela = find_rela_by_dest(file->rodata, text_rela->addend);
+ if (!rodata_rela)
+ continue;
+
+ return rodata_rela;
}
return NULL;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 102/146] objtool: Fix 32-bit build
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (100 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 101/146] objtool: Fix another switch table detection issue Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 103/146] x86/kprobes: Fix kernel crash when probing .entry_trampoline code Greg Kroah-Hartman
` (47 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Joachim, Josh Poimboeuf,
Linus Torvalds, Peter Zijlstra, Thomas Gleixner, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <jpoimboe@redhat.com>
commit 63474dc4ac7ed3848a4786b9592dd061901f606d upstream.
Fix the objtool build when cross-compiling a 64-bit kernel on a 32-bit
host. This also simplifies read_retpoline_hints() a bit and makes its
implementation similar to most of the other annotation reading
functions.
Reported-by: Sven Joachim <svenjoac@gmx.de>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: b5bc2231b8ad ("objtool: Add retpoline validation")
Link: http://lkml.kernel.org/r/2ca46c636c23aa9c9d57d53c75de4ee3ddf7a7df.1520380691.git.jpoimboe@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/objtool/check.c | 27 +++++++--------------------
1 file changed, 7 insertions(+), 20 deletions(-)
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -1115,42 +1115,29 @@ static int read_unwind_hints(struct objt
static int read_retpoline_hints(struct objtool_file *file)
{
- struct section *sec, *relasec;
+ struct section *sec;
struct instruction *insn;
struct rela *rela;
- int i;
- sec = find_section_by_name(file->elf, ".discard.retpoline_safe");
+ sec = find_section_by_name(file->elf, ".rela.discard.retpoline_safe");
if (!sec)
return 0;
- relasec = sec->rela;
- if (!relasec) {
- WARN("missing .rela.discard.retpoline_safe section");
- return -1;
- }
-
- if (sec->len % sizeof(unsigned long)) {
- WARN("retpoline_safe size mismatch: %d %ld", sec->len, sizeof(unsigned long));
- return -1;
- }
-
- for (i = 0; i < sec->len / sizeof(unsigned long); i++) {
- rela = find_rela_by_dest(sec, i * sizeof(unsigned long));
- if (!rela) {
- WARN("can't find rela for retpoline_safe[%d]", i);
+ list_for_each_entry(rela, &sec->rela_list, list) {
+ if (rela->sym->type != STT_SECTION) {
+ WARN("unexpected relocation symbol type in %s", sec->name);
return -1;
}
insn = find_insn(file, rela->sym->sec, rela->addend);
if (!insn) {
- WARN("can't find insn for retpoline_safe[%d]", i);
+ WARN("bad .discard.retpoline_safe entry");
return -1;
}
if (insn->type != INSN_JUMP_DYNAMIC &&
insn->type != INSN_CALL_DYNAMIC) {
- WARN_FUNC("retpoline_safe hint not a indirect jump/call",
+ WARN_FUNC("retpoline_safe hint not an indirect jump/call",
insn->sec, insn->offset);
return -1;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 103/146] x86/kprobes: Fix kernel crash when probing .entry_trampoline code
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (101 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 102/146] objtool: Fix 32-bit build Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 104/146] watchdog: hpwdt: SMBIOS check Greg Kroah-Hartman
` (46 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Francis Deslauriers, Thomas Gleixner,
Andy Lutomirski, Borislav Petkov, Brian Gerst, Denys Vlasenko,
H. Peter Anvin, Josh Poimboeuf, Linus Torvalds, Peter Zijlstra,
mathieu.desnoyers, mhiramat, Ingo Molnar
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francis Deslauriers <francis.deslauriers@efficios.com>
commit c07a8f8b08ba683ea24f3ac9159f37ae94daf47f upstream.
Disable the kprobe probing of the entry trampoline:
.entry_trampoline is a code area that is used to ensure page table
isolation between userspace and kernelspace.
At the beginning of the execution of the trampoline, we load the
kernel's CR3 register. This has the effect of enabling the translation
of the kernel virtual addresses to physical addresses. Before this
happens most kernel addresses can not be translated because the running
process' CR3 is still used.
If a kprobe is placed on the trampoline code before that change of the
CR3 register happens the kernel crashes because int3 handling pages are
not accessible.
To fix this, add the .entry_trampoline section to the kprobe blacklist
to prohibit the probing of code before all the kernel pages are
accessible.
Signed-off-by: Francis Deslauriers <francis.deslauriers@efficios.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: mathieu.desnoyers@efficios.com
Cc: mhiramat@kernel.org
Link: http://lkml.kernel.org/r/1520565492-4637-2-git-send-email-francis.deslauriers@efficios.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/sections.h | 1 +
arch/x86/kernel/kprobes/core.c | 10 +++++++++-
arch/x86/kernel/vmlinux.lds.S | 2 ++
3 files changed, 12 insertions(+), 1 deletion(-)
--- a/arch/x86/include/asm/sections.h
+++ b/arch/x86/include/asm/sections.h
@@ -10,6 +10,7 @@ extern struct exception_table_entry __st
#if defined(CONFIG_X86_64)
extern char __end_rodata_hpage_align[];
+extern char __entry_trampoline_start[], __entry_trampoline_end[];
#endif
#endif /* _ASM_X86_SECTIONS_H */
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -1168,10 +1168,18 @@ NOKPROBE_SYMBOL(longjmp_break_handler);
bool arch_within_kprobe_blacklist(unsigned long addr)
{
+ bool is_in_entry_trampoline_section = false;
+
+#ifdef CONFIG_X86_64
+ is_in_entry_trampoline_section =
+ (addr >= (unsigned long)__entry_trampoline_start &&
+ addr < (unsigned long)__entry_trampoline_end);
+#endif
return (addr >= (unsigned long)__kprobes_text_start &&
addr < (unsigned long)__kprobes_text_end) ||
(addr >= (unsigned long)__entry_text_start &&
- addr < (unsigned long)__entry_text_end);
+ addr < (unsigned long)__entry_text_end) ||
+ is_in_entry_trampoline_section;
}
int __init arch_init_kprobes(void)
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -118,9 +118,11 @@ SECTIONS
#ifdef CONFIG_X86_64
. = ALIGN(PAGE_SIZE);
+ VMLINUX_SYMBOL(__entry_trampoline_start) = .;
_entry_trampoline = .;
*(.entry_trampoline)
. = ALIGN(PAGE_SIZE);
+ VMLINUX_SYMBOL(__entry_trampoline_end) = .;
ASSERT(. - _entry_trampoline == PAGE_SIZE, "entry trampoline is too big");
#endif
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 104/146] watchdog: hpwdt: SMBIOS check
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (102 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 103/146] x86/kprobes: Fix kernel crash when probing .entry_trampoline code Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 105/146] watchdog: hpwdt: Check source of NMI Greg Kroah-Hartman
` (45 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jerry Hoemann, Guenter Roeck,
Wim Van Sebroeck
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Hoemann <jerry.hoemann@hpe.com>
commit c42cbe41727a138905a28f8e0b00c147be77ee93 upstream.
This corrects:
commit cce78da76601 ("watchdog: hpwdt: Add check for UEFI bits")
The test on HPE SMBIOS extension type 219 record "Misc Features"
bits for UEFI support is incorrect. The definition of the Misc Features
bits in the HPE SMBIOS OEM Extensions specification (and related
firmware) was changed to use a different pair of bits to
represent UEFI supported. Howerver, a corresponding change
to Linux was missed.
Current code/platform work because the iCRU test is working.
But purpose of cce78da766 is to ensure correct functionality
on future systems where iCRU isn't supported.
Signed-off-by: Jerry Hoemann <jerry.hoemann@hpe.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/watchdog/hpwdt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -700,7 +700,7 @@ static void dmi_find_icru(const struct d
smbios_proliant_ptr = (struct smbios_proliant_info *) dm;
if (smbios_proliant_ptr->misc_features & 0x01)
is_icru = 1;
- if (smbios_proliant_ptr->misc_features & 0x408)
+ if (smbios_proliant_ptr->misc_features & 0x1400)
is_uefi = 1;
}
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 105/146] watchdog: hpwdt: Check source of NMI
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (103 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 104/146] watchdog: hpwdt: SMBIOS check Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 106/146] watchdog: hpwdt: fix unused variable warning Greg Kroah-Hartman
` (44 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jerry Hoemann, Guenter Roeck,
Wim Van Sebroeck
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Hoemann <jerry.hoemann@hpe.com>
commit 838534e50e2e5c1e644e30ab6cb28da88eb31368 upstream.
Do not claim the NMI (i.e. return NMI_DONE) if the source of
the NMI isn't the iLO watchdog or debug.
Signed-off-by: Jerry Hoemann <jerry.hoemann@hpe.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/watchdog/hpwdt.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -52,6 +52,7 @@ static char expect_release;
static unsigned long hpwdt_is_open;
static void __iomem *pci_mem_addr; /* the PCI-memory address */
+static unsigned long __iomem *hpwdt_nmistat;
static unsigned long __iomem *hpwdt_timer_reg;
static unsigned long __iomem *hpwdt_timer_con;
@@ -474,6 +475,11 @@ static int hpwdt_time_left(void)
return TICKS_TO_SECS(ioread16(hpwdt_timer_reg));
}
+static int hpwdt_my_nmi(void)
+{
+ return ioread8(hpwdt_nmistat) & 0x6;
+}
+
#ifdef CONFIG_HPWDT_NMI_DECODING
/*
* NMI Handler
@@ -486,6 +492,9 @@ static int hpwdt_pretimeout(unsigned int
if (!hpwdt_nmi_decoding)
return NMI_DONE;
+ if ((ulReason == NMI_UNKNOWN) && !hpwdt_my_nmi())
+ return NMI_DONE;
+
spin_lock_irqsave(&rom_lock, rom_pl);
if (!die_nmi_called && !is_icru && !is_uefi)
asminline_call(&cmn_regs, cru_rom_addr);
@@ -842,6 +851,7 @@ static int hpwdt_init_one(struct pci_dev
retval = -ENOMEM;
goto error_pci_iomap;
}
+ hpwdt_nmistat = pci_mem_addr + 0x6e;
hpwdt_timer_reg = pci_mem_addr + 0x70;
hpwdt_timer_con = pci_mem_addr + 0x72;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 106/146] watchdog: hpwdt: fix unused variable warning
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (104 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 105/146] watchdog: hpwdt: Check source of NMI Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 107/146] watchdog: hpwdt: Remove legacy NMI sourcing Greg Kroah-Hartman
` (43 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Jerry Hoemann,
Guenter Roeck, Wim Van Sebroeck
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit aeebc6ba88ba3758ad95467ff6191fabf2074c13 upstream.
The new hpwdt_my_nmi() function is used conditionally, which produces
a harmless warning in some configurations:
drivers/watchdog/hpwdt.c:478:12: error: 'hpwdt_my_nmi' defined but not used [-Werror=unused-function]
This moves it inside of the #ifdef that protects its caller, to silence
the warning.
Fixes: 621174a92851 ("watchdog: hpwdt: Check source of NMI")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Jerry Hoemann <jerry.hoemann@hpe.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/watchdog/hpwdt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -475,12 +475,12 @@ static int hpwdt_time_left(void)
return TICKS_TO_SECS(ioread16(hpwdt_timer_reg));
}
+#ifdef CONFIG_HPWDT_NMI_DECODING
static int hpwdt_my_nmi(void)
{
return ioread8(hpwdt_nmistat) & 0x6;
}
-#ifdef CONFIG_HPWDT_NMI_DECODING
/*
* NMI Handler
*/
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 107/146] watchdog: hpwdt: Remove legacy NMI sourcing.
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (105 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 106/146] watchdog: hpwdt: fix unused variable warning Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 108/146] netfilter: add back stackpointer size checks Greg Kroah-Hartman
` (42 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jerry Hoemann, Ingo Molnar,
Guenter Roeck, Wim Van Sebroeck
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Hoemann <jerry.hoemann@hpe.com>
commit 2b3d89b402b085b08498e896c65267a145bed486 upstream.
Gen8 and prior Proliant systems supported the "CRU" interface
to firmware. This interfaces allows linux to "call back" into firmware
to source the cause of an NMI. This feature isn't fully utilized
as the actual source of the NMI isn't printed, the driver only
indicates that the source couldn't be determined when the call
fails.
With the advent of Gen9, iCRU replaces the CRU. The call back
feature is no longer available in firmware. To be compatible and
not attempt to call back into firmware on system not supporting CRU,
the SMBIOS table is consulted to determine if it is safe to
make the call back or not.
This results in about half of the driver code being devoted
to either making CRU calls or determing if it is safe to make
CRU calls. As noted, the driver isn't really using the results of
the CRU calls.
Furthermore, as a consequence of the Spectre security issue, the
BIOS/EFI calls are being wrapped into Spectre-disabling section.
Removing the call back in hpwdt_pretimeout assists in this effort.
As the CRU sourcing of the NMI isn't required for handling the
NMI and there are security concerns with making the call back, remove
the legacy (pre Gen9) NMI sourcing and the DMI code to determine if
the system had the CRU interface.
Signed-off-by: Jerry Hoemann <jerry.hoemann@hpe.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/watchdog/hpwdt.c | 501 -----------------------------------------------
1 file changed, 9 insertions(+), 492 deletions(-)
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -28,16 +28,7 @@
#include <linux/types.h>
#include <linux/uaccess.h>
#include <linux/watchdog.h>
-#ifdef CONFIG_HPWDT_NMI_DECODING
-#include <linux/dmi.h>
-#include <linux/spinlock.h>
-#include <linux/nmi.h>
-#include <linux/kdebug.h>
-#include <linux/notifier.h>
-#include <asm/set_memory.h>
-#endif /* CONFIG_HPWDT_NMI_DECODING */
#include <asm/nmi.h>
-#include <asm/frame.h>
#define HPWDT_VERSION "1.4.0"
#define SECS_TO_TICKS(secs) ((secs) * 1000 / 128)
@@ -48,6 +39,9 @@
static unsigned int soft_margin = DEFAULT_MARGIN; /* in seconds */
static unsigned int reload; /* the computed soft_margin */
static bool nowayout = WATCHDOG_NOWAYOUT;
+#ifdef CONFIG_HPWDT_NMI_DECODING
+static unsigned int allow_kdump = 1;
+#endif
static char expect_release;
static unsigned long hpwdt_is_open;
@@ -63,373 +57,6 @@ static const struct pci_device_id hpwdt_
};
MODULE_DEVICE_TABLE(pci, hpwdt_devices);
-#ifdef CONFIG_HPWDT_NMI_DECODING
-#define PCI_BIOS32_SD_VALUE 0x5F32335F /* "_32_" */
-#define CRU_BIOS_SIGNATURE_VALUE 0x55524324
-#define PCI_BIOS32_PARAGRAPH_LEN 16
-#define PCI_ROM_BASE1 0x000F0000
-#define ROM_SIZE 0x10000
-
-struct bios32_service_dir {
- u32 signature;
- u32 entry_point;
- u8 revision;
- u8 length;
- u8 checksum;
- u8 reserved[5];
-};
-
-/* type 212 */
-struct smbios_cru64_info {
- u8 type;
- u8 byte_length;
- u16 handle;
- u32 signature;
- u64 physical_address;
- u32 double_length;
- u32 double_offset;
-};
-#define SMBIOS_CRU64_INFORMATION 212
-
-/* type 219 */
-struct smbios_proliant_info {
- u8 type;
- u8 byte_length;
- u16 handle;
- u32 power_features;
- u32 omega_features;
- u32 reserved;
- u32 misc_features;
-};
-#define SMBIOS_ICRU_INFORMATION 219
-
-
-struct cmn_registers {
- union {
- struct {
- u8 ral;
- u8 rah;
- u16 rea2;
- };
- u32 reax;
- } u1;
- union {
- struct {
- u8 rbl;
- u8 rbh;
- u8 reb2l;
- u8 reb2h;
- };
- u32 rebx;
- } u2;
- union {
- struct {
- u8 rcl;
- u8 rch;
- u16 rec2;
- };
- u32 recx;
- } u3;
- union {
- struct {
- u8 rdl;
- u8 rdh;
- u16 red2;
- };
- u32 redx;
- } u4;
-
- u32 resi;
- u32 redi;
- u16 rds;
- u16 res;
- u32 reflags;
-} __attribute__((packed));
-
-static unsigned int hpwdt_nmi_decoding;
-static unsigned int allow_kdump = 1;
-static unsigned int is_icru;
-static unsigned int is_uefi;
-static DEFINE_SPINLOCK(rom_lock);
-static void *cru_rom_addr;
-static struct cmn_registers cmn_regs;
-
-extern asmlinkage void asminline_call(struct cmn_registers *pi86Regs,
- unsigned long *pRomEntry);
-
-#ifdef CONFIG_X86_32
-/* --32 Bit Bios------------------------------------------------------------ */
-
-#define HPWDT_ARCH 32
-
-asm(".text \n\t"
- ".align 4 \n\t"
- ".globl asminline_call \n"
- "asminline_call: \n\t"
- "pushl %ebp \n\t"
- "movl %esp, %ebp \n\t"
- "pusha \n\t"
- "pushf \n\t"
- "push %es \n\t"
- "push %ds \n\t"
- "pop %es \n\t"
- "movl 8(%ebp),%eax \n\t"
- "movl 4(%eax),%ebx \n\t"
- "movl 8(%eax),%ecx \n\t"
- "movl 12(%eax),%edx \n\t"
- "movl 16(%eax),%esi \n\t"
- "movl 20(%eax),%edi \n\t"
- "movl (%eax),%eax \n\t"
- "push %cs \n\t"
- "call *12(%ebp) \n\t"
- "pushf \n\t"
- "pushl %eax \n\t"
- "movl 8(%ebp),%eax \n\t"
- "movl %ebx,4(%eax) \n\t"
- "movl %ecx,8(%eax) \n\t"
- "movl %edx,12(%eax) \n\t"
- "movl %esi,16(%eax) \n\t"
- "movl %edi,20(%eax) \n\t"
- "movw %ds,24(%eax) \n\t"
- "movw %es,26(%eax) \n\t"
- "popl %ebx \n\t"
- "movl %ebx,(%eax) \n\t"
- "popl %ebx \n\t"
- "movl %ebx,28(%eax) \n\t"
- "pop %es \n\t"
- "popf \n\t"
- "popa \n\t"
- "leave \n\t"
- "ret \n\t"
- ".previous");
-
-
-/*
- * cru_detect
- *
- * Routine Description:
- * This function uses the 32-bit BIOS Service Directory record to
- * search for a $CRU record.
- *
- * Return Value:
- * 0 : SUCCESS
- * <0 : FAILURE
- */
-static int cru_detect(unsigned long map_entry,
- unsigned long map_offset)
-{
- void *bios32_map;
- unsigned long *bios32_entrypoint;
- unsigned long cru_physical_address;
- unsigned long cru_length;
- unsigned long physical_bios_base = 0;
- unsigned long physical_bios_offset = 0;
- int retval = -ENODEV;
-
- bios32_map = ioremap(map_entry, (2 * PAGE_SIZE));
-
- if (bios32_map == NULL)
- return -ENODEV;
-
- bios32_entrypoint = bios32_map + map_offset;
-
- cmn_regs.u1.reax = CRU_BIOS_SIGNATURE_VALUE;
-
- set_memory_x((unsigned long)bios32_map, 2);
- asminline_call(&cmn_regs, bios32_entrypoint);
-
- if (cmn_regs.u1.ral != 0) {
- pr_warn("Call succeeded but with an error: 0x%x\n",
- cmn_regs.u1.ral);
- } else {
- physical_bios_base = cmn_regs.u2.rebx;
- physical_bios_offset = cmn_regs.u4.redx;
- cru_length = cmn_regs.u3.recx;
- cru_physical_address =
- physical_bios_base + physical_bios_offset;
-
- /* If the values look OK, then map it in. */
- if ((physical_bios_base + physical_bios_offset)) {
- cru_rom_addr =
- ioremap(cru_physical_address, cru_length);
- if (cru_rom_addr) {
- set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK,
- (cru_length + PAGE_SIZE - 1) >> PAGE_SHIFT);
- retval = 0;
- }
- }
-
- pr_debug("CRU Base Address: 0x%lx\n", physical_bios_base);
- pr_debug("CRU Offset Address: 0x%lx\n", physical_bios_offset);
- pr_debug("CRU Length: 0x%lx\n", cru_length);
- pr_debug("CRU Mapped Address: %p\n", &cru_rom_addr);
- }
- iounmap(bios32_map);
- return retval;
-}
-
-/*
- * bios_checksum
- */
-static int bios_checksum(const char __iomem *ptr, int len)
-{
- char sum = 0;
- int i;
-
- /*
- * calculate checksum of size bytes. This should add up
- * to zero if we have a valid header.
- */
- for (i = 0; i < len; i++)
- sum += ptr[i];
-
- return ((sum == 0) && (len > 0));
-}
-
-/*
- * bios32_present
- *
- * Routine Description:
- * This function finds the 32-bit BIOS Service Directory
- *
- * Return Value:
- * 0 : SUCCESS
- * <0 : FAILURE
- */
-static int bios32_present(const char __iomem *p)
-{
- struct bios32_service_dir *bios_32_ptr;
- int length;
- unsigned long map_entry, map_offset;
-
- bios_32_ptr = (struct bios32_service_dir *) p;
-
- /*
- * Search for signature by checking equal to the swizzled value
- * instead of calling another routine to perform a strcmp.
- */
- if (bios_32_ptr->signature == PCI_BIOS32_SD_VALUE) {
- length = bios_32_ptr->length * PCI_BIOS32_PARAGRAPH_LEN;
- if (bios_checksum(p, length)) {
- /*
- * According to the spec, we're looking for the
- * first 4KB-aligned address below the entrypoint
- * listed in the header. The Service Directory code
- * is guaranteed to occupy no more than 2 4KB pages.
- */
- map_entry = bios_32_ptr->entry_point & ~(PAGE_SIZE - 1);
- map_offset = bios_32_ptr->entry_point - map_entry;
-
- return cru_detect(map_entry, map_offset);
- }
- }
- return -ENODEV;
-}
-
-static int detect_cru_service(void)
-{
- char __iomem *p, *q;
- int rc = -1;
-
- /*
- * Search from 0x0f0000 through 0x0fffff, inclusive.
- */
- p = ioremap(PCI_ROM_BASE1, ROM_SIZE);
- if (p == NULL)
- return -ENOMEM;
-
- for (q = p; q < p + ROM_SIZE; q += 16) {
- rc = bios32_present(q);
- if (!rc)
- break;
- }
- iounmap(p);
- return rc;
-}
-/* ------------------------------------------------------------------------- */
-#endif /* CONFIG_X86_32 */
-#ifdef CONFIG_X86_64
-/* --64 Bit Bios------------------------------------------------------------ */
-
-#define HPWDT_ARCH 64
-
-asm(".text \n\t"
- ".align 4 \n\t"
- ".globl asminline_call \n\t"
- ".type asminline_call, @function \n\t"
- "asminline_call: \n\t"
- FRAME_BEGIN
- "pushq %rax \n\t"
- "pushq %rbx \n\t"
- "pushq %rdx \n\t"
- "pushq %r12 \n\t"
- "pushq %r9 \n\t"
- "movq %rsi, %r12 \n\t"
- "movq %rdi, %r9 \n\t"
- "movl 4(%r9),%ebx \n\t"
- "movl 8(%r9),%ecx \n\t"
- "movl 12(%r9),%edx \n\t"
- "movl 16(%r9),%esi \n\t"
- "movl 20(%r9),%edi \n\t"
- "movl (%r9),%eax \n\t"
- "call *%r12 \n\t"
- "pushfq \n\t"
- "popq %r12 \n\t"
- "movl %eax, (%r9) \n\t"
- "movl %ebx, 4(%r9) \n\t"
- "movl %ecx, 8(%r9) \n\t"
- "movl %edx, 12(%r9) \n\t"
- "movl %esi, 16(%r9) \n\t"
- "movl %edi, 20(%r9) \n\t"
- "movq %r12, %rax \n\t"
- "movl %eax, 28(%r9) \n\t"
- "popq %r9 \n\t"
- "popq %r12 \n\t"
- "popq %rdx \n\t"
- "popq %rbx \n\t"
- "popq %rax \n\t"
- FRAME_END
- "ret \n\t"
- ".previous");
-
-/*
- * dmi_find_cru
- *
- * Routine Description:
- * This function checks whether or not a SMBIOS/DMI record is
- * the 64bit CRU info or not
- */
-static void dmi_find_cru(const struct dmi_header *dm, void *dummy)
-{
- struct smbios_cru64_info *smbios_cru64_ptr;
- unsigned long cru_physical_address;
-
- if (dm->type == SMBIOS_CRU64_INFORMATION) {
- smbios_cru64_ptr = (struct smbios_cru64_info *) dm;
- if (smbios_cru64_ptr->signature == CRU_BIOS_SIGNATURE_VALUE) {
- cru_physical_address =
- smbios_cru64_ptr->physical_address +
- smbios_cru64_ptr->double_offset;
- cru_rom_addr = ioremap(cru_physical_address,
- smbios_cru64_ptr->double_length);
- set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK,
- smbios_cru64_ptr->double_length >> PAGE_SHIFT);
- }
- }
-}
-
-static int detect_cru_service(void)
-{
- cru_rom_addr = NULL;
-
- dmi_walk(dmi_find_cru, NULL);
-
- /* if cru_rom_addr has been set then we found a CRU service */
- return ((cru_rom_addr != NULL) ? 0 : -ENODEV);
-}
-/* ------------------------------------------------------------------------- */
-#endif /* CONFIG_X86_64 */
-#endif /* CONFIG_HPWDT_NMI_DECODING */
/*
* Watchdog operations
@@ -486,30 +113,12 @@ static int hpwdt_my_nmi(void)
*/
static int hpwdt_pretimeout(unsigned int ulReason, struct pt_regs *regs)
{
- unsigned long rom_pl;
- static int die_nmi_called;
-
- if (!hpwdt_nmi_decoding)
- return NMI_DONE;
-
if ((ulReason == NMI_UNKNOWN) && !hpwdt_my_nmi())
return NMI_DONE;
- spin_lock_irqsave(&rom_lock, rom_pl);
- if (!die_nmi_called && !is_icru && !is_uefi)
- asminline_call(&cmn_regs, cru_rom_addr);
- die_nmi_called = 1;
- spin_unlock_irqrestore(&rom_lock, rom_pl);
-
if (allow_kdump)
hpwdt_stop();
- if (!is_icru && !is_uefi) {
- if (cmn_regs.u1.ral == 0) {
- nmi_panic(regs, "An NMI occurred, but unable to determine source.\n");
- return NMI_HANDLED;
- }
- }
nmi_panic(regs, "An NMI occurred. Depending on your system the reason "
"for the NMI is logged in any one of the following "
"resources:\n"
@@ -675,84 +284,11 @@ static struct miscdevice hpwdt_miscdev =
* Init & Exit
*/
-#ifdef CONFIG_HPWDT_NMI_DECODING
-#ifdef CONFIG_X86_LOCAL_APIC
-static void hpwdt_check_nmi_decoding(struct pci_dev *dev)
-{
- /*
- * If nmi_watchdog is turned off then we can turn on
- * our nmi decoding capability.
- */
- hpwdt_nmi_decoding = 1;
-}
-#else
-static void hpwdt_check_nmi_decoding(struct pci_dev *dev)
-{
- dev_warn(&dev->dev, "NMI decoding is disabled. "
- "Your kernel does not support a NMI Watchdog.\n");
-}
-#endif /* CONFIG_X86_LOCAL_APIC */
-
-/*
- * dmi_find_icru
- *
- * Routine Description:
- * This function checks whether or not we are on an iCRU-based server.
- * This check is independent of architecture and needs to be made for
- * any ProLiant system.
- */
-static void dmi_find_icru(const struct dmi_header *dm, void *dummy)
-{
- struct smbios_proliant_info *smbios_proliant_ptr;
-
- if (dm->type == SMBIOS_ICRU_INFORMATION) {
- smbios_proliant_ptr = (struct smbios_proliant_info *) dm;
- if (smbios_proliant_ptr->misc_features & 0x01)
- is_icru = 1;
- if (smbios_proliant_ptr->misc_features & 0x1400)
- is_uefi = 1;
- }
-}
static int hpwdt_init_nmi_decoding(struct pci_dev *dev)
{
+#ifdef CONFIG_HPWDT_NMI_DECODING
int retval;
-
- /*
- * On typical CRU-based systems we need to map that service in
- * the BIOS. For 32 bit Operating Systems we need to go through
- * the 32 Bit BIOS Service Directory. For 64 bit Operating
- * Systems we get that service through SMBIOS.
- *
- * On systems that support the new iCRU service all we need to
- * do is call dmi_walk to get the supported flag value and skip
- * the old cru detect code.
- */
- dmi_walk(dmi_find_icru, NULL);
- if (!is_icru && !is_uefi) {
-
- /*
- * We need to map the ROM to get the CRU service.
- * For 32 bit Operating Systems we need to go through the 32 Bit
- * BIOS Service Directory
- * For 64 bit Operating Systems we get that service through SMBIOS.
- */
- retval = detect_cru_service();
- if (retval < 0) {
- dev_warn(&dev->dev,
- "Unable to detect the %d Bit CRU Service.\n",
- HPWDT_ARCH);
- return retval;
- }
-
- /*
- * We know this is the only CRU call we need to make so lets keep as
- * few instructions as possible once the NMI comes in.
- */
- cmn_regs.u1.rah = 0x0D;
- cmn_regs.u1.ral = 0x02;
- }
-
/*
* Only one function can register for NMI_UNKNOWN
*/
@@ -780,45 +316,26 @@ error:
dev_warn(&dev->dev,
"Unable to register a die notifier (err=%d).\n",
retval);
- if (cru_rom_addr)
- iounmap(cru_rom_addr);
return retval;
+#endif /* CONFIG_HPWDT_NMI_DECODING */
+ return 0;
}
static void hpwdt_exit_nmi_decoding(void)
{
+#ifdef CONFIG_HPWDT_NMI_DECODING
unregister_nmi_handler(NMI_UNKNOWN, "hpwdt");
unregister_nmi_handler(NMI_SERR, "hpwdt");
unregister_nmi_handler(NMI_IO_CHECK, "hpwdt");
- if (cru_rom_addr)
- iounmap(cru_rom_addr);
-}
-#else /* !CONFIG_HPWDT_NMI_DECODING */
-static void hpwdt_check_nmi_decoding(struct pci_dev *dev)
-{
-}
-
-static int hpwdt_init_nmi_decoding(struct pci_dev *dev)
-{
- return 0;
+#endif
}
-static void hpwdt_exit_nmi_decoding(void)
-{
-}
-#endif /* CONFIG_HPWDT_NMI_DECODING */
-
static int hpwdt_init_one(struct pci_dev *dev,
const struct pci_device_id *ent)
{
int retval;
/*
- * Check if we can do NMI decoding or not
- */
- hpwdt_check_nmi_decoding(dev);
-
- /*
* First let's find out if we are on an iLO2+ server. We will
* not run on a legacy ASM box.
* So we only support the G5 ProLiant servers and higher.
@@ -922,6 +439,6 @@ MODULE_PARM_DESC(nowayout, "Watchdog can
#ifdef CONFIG_HPWDT_NMI_DECODING
module_param(allow_kdump, int, 0);
MODULE_PARM_DESC(allow_kdump, "Start a kernel dump after NMI occurs");
-#endif /* !CONFIG_HPWDT_NMI_DECODING */
+#endif /* CONFIG_HPWDT_NMI_DECODING */
module_pci_driver(hpwdt_driver);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 108/146] netfilter: add back stackpointer size checks
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (106 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 107/146] watchdog: hpwdt: Remove legacy NMI sourcing Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 109/146] netfilter: ipt_CLUSTERIP: fix a race condition of proc file creation Greg Kroah-Hartman
` (41 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+e783f671527912cd9403,
Florian Westphal, Pablo Neira Ayuso
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 57ebd808a97d7c5b1e1afb937c2db22beba3c1f8 upstream.
The rationale for removing the check is only correct for rulesets
generated by ip(6)tables.
In iptables, a jump can only occur to a user-defined chain, i.e.
because we size the stack based on number of user-defined chains we
cannot exceed stack size.
However, the underlying binary format has no such restriction,
and the validation step only ensures that the jump target is a
valid rule start point.
IOW, its possible to build a rule blob that has no user-defined
chains but does contain a jump.
If this happens, no jump stack gets allocated and crash occurs
because no jumpstack was allocated.
Fixes: 7814b6ec6d0d6 ("netfilter: xtables: don't save/restore jumpstack offset")
Reported-by: syzbot+e783f671527912cd9403@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/netfilter/arp_tables.c | 4 ++++
net/ipv4/netfilter/ip_tables.c | 7 ++++++-
net/ipv6/netfilter/ip6_tables.c | 4 ++++
3 files changed, 14 insertions(+), 1 deletion(-)
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -257,6 +257,10 @@ unsigned int arpt_do_table(struct sk_buf
}
if (table_base + v
!= arpt_next_entry(e)) {
+ if (unlikely(stackidx >= private->stacksize)) {
+ verdict = NF_DROP;
+ break;
+ }
jumpstack[stackidx++] = e;
}
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -335,8 +335,13 @@ ipt_do_table(struct sk_buff *skb,
continue;
}
if (table_base + v != ipt_next_entry(e) &&
- !(e->ip.flags & IPT_F_GOTO))
+ !(e->ip.flags & IPT_F_GOTO)) {
+ if (unlikely(stackidx >= private->stacksize)) {
+ verdict = NF_DROP;
+ break;
+ }
jumpstack[stackidx++] = e;
+ }
e = get_entry(table_base, v);
continue;
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -357,6 +357,10 @@ ip6t_do_table(struct sk_buff *skb,
}
if (table_base + v != ip6t_next_entry(e) &&
!(e->ipv6.flags & IP6T_F_GOTO)) {
+ if (unlikely(stackidx >= private->stacksize)) {
+ verdict = NF_DROP;
+ break;
+ }
jumpstack[stackidx++] = e;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 109/146] netfilter: ipt_CLUSTERIP: fix a race condition of proc file creation
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (107 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 108/146] netfilter: add back stackpointer size checks Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 110/146] netfilter: xt_hashlimit: fix lock imbalance Greg Kroah-Hartman
` (40 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+03218bcdba6aa76441a3,
Paolo Abeni, Xin Long, Pablo Neira Ayuso, Cong Wang
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <xiyou.wangcong@gmail.com>
commit b3e456fce9f51d6276e576d00271e2813c1b8b67 upstream.
There is a race condition between clusterip_config_entry_put()
and clusterip_config_init(), after we release the spinlock in
clusterip_config_entry_put(), a new proc file with a same IP could
be created immediately since it is already removed from the configs
list, therefore it triggers this warning:
------------[ cut here ]------------
proc_dir_entry 'ipt_CLUSTERIP/172.20.0.170' already registered
WARNING: CPU: 1 PID: 4152 at fs/proc/generic.c:330 proc_register+0x2a4/0x370 fs/proc/generic.c:329
Kernel panic - not syncing: panic_on_warn set ...
As a quick fix, just move the proc_remove() inside the spinlock.
Reported-by: <syzbot+03218bcdba6aa76441a3@syzkaller.appspotmail.com>
Fixes: 6c5d5cfbe3c5 ("netfilter: ipt_CLUSTERIP: check duplicate config when initializing")
Tested-by: Paolo Abeni <pabeni@redhat.com>
Cc: Xin Long <lucien.xin@gmail.com>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -107,12 +107,6 @@ clusterip_config_entry_put(struct net *n
local_bh_disable();
if (refcount_dec_and_lock(&c->entries, &cn->lock)) {
- list_del_rcu(&c->list);
- spin_unlock(&cn->lock);
- local_bh_enable();
-
- unregister_netdevice_notifier(&c->notifier);
-
/* In case anyone still accesses the file, the open/close
* functions are also incrementing the refcount on their own,
* so it's safe to remove the entry even if it's in use. */
@@ -120,6 +114,12 @@ clusterip_config_entry_put(struct net *n
if (cn->procdir)
proc_remove(c->pde);
#endif
+ list_del_rcu(&c->list);
+ spin_unlock(&cn->lock);
+ local_bh_enable();
+
+ unregister_netdevice_notifier(&c->notifier);
+
return;
}
local_bh_enable();
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 110/146] netfilter: xt_hashlimit: fix lock imbalance
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (108 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 109/146] netfilter: ipt_CLUSTERIP: fix a race condition of proc file creation Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 111/146] netfilter: x_tables: fix missing timer initialization in xt_LED Greg Kroah-Hartman
` (39 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, syzkaller, Pablo Neira Ayuso
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit de526f401284e1638d4c97cb5a4c292ac3f37655 upstream.
syszkaller found that rcu was not held in hashlimit_mt_common()
We only need to enable BH at this point.
Fixes: bea74641e378 ("netfilter: xt_hashlimit: add rate match mode")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/xt_hashlimit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -774,7 +774,7 @@ hashlimit_mt_common(const struct sk_buff
if (!dh->rateinfo.prev_window &&
(dh->rateinfo.current_rate <= dh->rateinfo.burst)) {
spin_unlock(&dh->lock);
- rcu_read_unlock_bh();
+ local_bh_enable();
return !(cfg->mode & XT_HASHLIMIT_INVERT);
} else {
goto overlimit;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 111/146] netfilter: x_tables: fix missing timer initialization in xt_LED
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (109 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 110/146] netfilter: xt_hashlimit: fix lock imbalance Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 112/146] netfilter: nat: cope with negative port range Greg Kroah-Hartman
` (38 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+10c98dc5725c6c8fc7fb,
Paolo Abeni, Pablo Neira Ayuso
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
commit 10414014bc085aac9f787a5890b33b5605fbcfc4 upstream.
syzbot reported that xt_LED may try to use the ledinternal->timer
without previously initializing it:
------------[ cut here ]------------
kernel BUG at kernel/time/timer.c:958!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 1826 Comm: kworker/1:2 Not tainted 4.15.0+ #306
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:__mod_timer kernel/time/timer.c:958 [inline]
RIP: 0010:mod_timer+0x7d6/0x13c0 kernel/time/timer.c:1102
RSP: 0018:ffff8801d24fe9f8 EFLAGS: 00010293
RAX: ffff8801d25246c0 RBX: ffff8801aec6cb50 RCX: ffffffff816052c6
RDX: 0000000000000000 RSI: 00000000fffbd14b RDI: ffff8801aec6cb68
RBP: ffff8801d24fec98 R08: 0000000000000000 R09: 1ffff1003a49fd6c
R10: ffff8801d24feb28 R11: 0000000000000005 R12: dffffc0000000000
R13: ffff8801d24fec70 R14: 00000000fffbd14b R15: ffff8801af608f90
FS: 0000000000000000(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000206d6fd0 CR3: 0000000006a22001 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
led_tg+0x1db/0x2e0 net/netfilter/xt_LED.c:75
ip6t_do_table+0xc2a/0x1a30 net/ipv6/netfilter/ip6_tables.c:365
ip6table_raw_hook+0x65/0x80 net/ipv6/netfilter/ip6table_raw.c:42
nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]
nf_hook_slow+0xba/0x1a0 net/netfilter/core.c:483
nf_hook.constprop.27+0x3f6/0x830 include/linux/netfilter.h:243
NF_HOOK include/linux/netfilter.h:286 [inline]
ndisc_send_skb+0xa51/0x1370 net/ipv6/ndisc.c:491
ndisc_send_ns+0x38a/0x870 net/ipv6/ndisc.c:633
addrconf_dad_work+0xb9e/0x1320 net/ipv6/addrconf.c:4008
process_one_work+0xbbf/0x1af0 kernel/workqueue.c:2113
worker_thread+0x223/0x1990 kernel/workqueue.c:2247
kthread+0x33c/0x400 kernel/kthread.c:238
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:429
Code: 85 2a 0b 00 00 4d 8b 3c 24 4d 85 ff 75 9f 4c 8b bd 60 fd ff ff e8 bb
57 10 00 65 ff 0d 94 9a a1 7e e9 d9 fc ff ff e8 aa 57 10 00 <0f> 0b e8 a3
57 10 00 e9 14 fb ff ff e8 99 57 10 00 4c 89 bd 70
RIP: __mod_timer kernel/time/timer.c:958 [inline] RSP: ffff8801d24fe9f8
RIP: mod_timer+0x7d6/0x13c0 kernel/time/timer.c:1102 RSP: ffff8801d24fe9f8
---[ end trace f661ab06f5dd8b3d ]---
The ledinternal struct can be shared between several different
xt_LED targets, but the related timer is currently initialized only
if the first target requires it. Fix it by unconditionally
initializing the timer struct.
v1 -> v2: call del_timer_sync() unconditionally, too.
Fixes: 268cb38e1802 ("netfilter: x_tables: add LED trigger target")
Reported-by: syzbot+10c98dc5725c6c8fc7fb@syzkaller.appspotmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/xt_LED.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/net/netfilter/xt_LED.c
+++ b/net/netfilter/xt_LED.c
@@ -142,9 +142,10 @@ static int led_tg_check(const struct xt_
goto exit_alloc;
}
- /* See if we need to set up a timer */
- if (ledinfo->delay > 0)
- timer_setup(&ledinternal->timer, led_timeout_callback, 0);
+ /* Since the letinternal timer can be shared between multiple targets,
+ * always set it up, even if the current target does not need it
+ */
+ timer_setup(&ledinternal->timer, led_timeout_callback, 0);
list_add_tail(&ledinternal->list, &xt_led_triggers);
@@ -181,8 +182,7 @@ static void led_tg_destroy(const struct
list_del(&ledinternal->list);
- if (ledinfo->delay > 0)
- del_timer_sync(&ledinternal->timer);
+ del_timer_sync(&ledinternal->timer);
led_trigger_unregister(&ledinternal->netfilter_led_trigger);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 112/146] netfilter: nat: cope with negative port range
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (110 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 111/146] netfilter: x_tables: fix missing timer initialization in xt_LED Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 113/146] netfilter: IDLETIMER: be syzkaller friendly Greg Kroah-Hartman
` (37 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+8012e198bd037f4871e5,
Paolo Abeni, Pablo Neira Ayuso
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
commit db57ccf0f2f4624b4c4758379f8165277504fbd7 upstream.
syzbot reported a division by 0 bug in the netfilter nat code:
divide error: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 4168 Comm: syzkaller034710 Not tainted 4.16.0-rc1+ #309
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:nf_nat_l4proto_unique_tuple+0x291/0x530
net/netfilter/nf_nat_proto_common.c:88
RSP: 0018:ffff8801b2466778 EFLAGS: 00010246
RAX: 000000000000f153 RBX: ffff8801b2466dd8 RCX: ffff8801b2466c7c
RDX: 0000000000000000 RSI: ffff8801b2466c58 RDI: ffff8801db5293ac
RBP: ffff8801b24667d8 R08: ffff8801b8ba6dc0 R09: ffffffff88af5900
R10: ffff8801b24666f0 R11: 0000000000000000 R12: 000000002990f153
R13: 0000000000000001 R14: 0000000000000000 R15: ffff8801b2466c7c
FS: 00000000017e3880(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000208fdfe4 CR3: 00000001b5340002 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
dccp_unique_tuple+0x40/0x50 net/netfilter/nf_nat_proto_dccp.c:30
get_unique_tuple+0xc28/0x1c10 net/netfilter/nf_nat_core.c:362
nf_nat_setup_info+0x1c2/0xe00 net/netfilter/nf_nat_core.c:406
nf_nat_redirect_ipv6+0x306/0x730 net/netfilter/nf_nat_redirect.c:124
redirect_tg6+0x7f/0xb0 net/netfilter/xt_REDIRECT.c:34
ip6t_do_table+0xc2a/0x1a30 net/ipv6/netfilter/ip6_tables.c:365
ip6table_nat_do_chain+0x65/0x80 net/ipv6/netfilter/ip6table_nat.c:41
nf_nat_ipv6_fn+0x594/0xa80 net/ipv6/netfilter/nf_nat_l3proto_ipv6.c:302
nf_nat_ipv6_local_fn+0x33/0x5d0
net/ipv6/netfilter/nf_nat_l3proto_ipv6.c:407
ip6table_nat_local_fn+0x2c/0x40 net/ipv6/netfilter/ip6table_nat.c:69
nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]
nf_hook_slow+0xba/0x1a0 net/netfilter/core.c:483
nf_hook include/linux/netfilter.h:243 [inline]
NF_HOOK include/linux/netfilter.h:286 [inline]
ip6_xmit+0x10ec/0x2260 net/ipv6/ip6_output.c:277
inet6_csk_xmit+0x2fc/0x580 net/ipv6/inet6_connection_sock.c:139
dccp_transmit_skb+0x9ac/0x10f0 net/dccp/output.c:142
dccp_connect+0x369/0x670 net/dccp/output.c:564
dccp_v6_connect+0xe17/0x1bf0 net/dccp/ipv6.c:946
__inet_stream_connect+0x2d4/0xf00 net/ipv4/af_inet.c:620
inet_stream_connect+0x58/0xa0 net/ipv4/af_inet.c:684
SYSC_connect+0x213/0x4a0 net/socket.c:1639
SyS_connect+0x24/0x30 net/socket.c:1620
do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x26/0x9b
RIP: 0033:0x441c69
RSP: 002b:00007ffe50cc0be8 EFLAGS: 00000217 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000441c69
RDX: 000000000000001c RSI: 00000000208fdfe4 RDI: 0000000000000003
RBP: 00000000006cc018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000538 R11: 0000000000000217 R12: 0000000000403590
R13: 0000000000403620 R14: 0000000000000000 R15: 0000000000000000
Code: 48 89 f0 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 46 02 00 00 48 8b
45 c8 44 0f b7 20 e8 88 97 04 fd 31 d2 41 0f b7 c4 4c 89 f9 <41> f7 f6 48
c1 e9 03 48 b8 00 00 00 00 00 fc ff df 0f b6 0c 01
RIP: nf_nat_l4proto_unique_tuple+0x291/0x530
net/netfilter/nf_nat_proto_common.c:88 RSP: ffff8801b2466778
The problem is that currently we don't have any check on the
configured port range. A port range == -1 triggers the bug, while
other negative values may require a very long time to complete the
following loop.
This commit addresses the issue swapping the two ends on negative
ranges. The check is performed in nf_nat_l4proto_unique_tuple() since
the nft nat loads the port values from nft registers at runtime.
v1 -> v2: use the correct 'Fixes' tag
v2 -> v3: update commit message, drop unneeded READ_ONCE()
Fixes: 5b1158e909ec ("[NETFILTER]: Add NAT support for nf_conntrack")
Reported-by: syzbot+8012e198bd037f4871e5@syzkaller.appspotmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_nat_proto_common.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/net/netfilter/nf_nat_proto_common.c
+++ b/net/netfilter/nf_nat_proto_common.c
@@ -41,7 +41,7 @@ void nf_nat_l4proto_unique_tuple(const s
const struct nf_conn *ct,
u16 *rover)
{
- unsigned int range_size, min, i;
+ unsigned int range_size, min, max, i;
__be16 *portptr;
u_int16_t off;
@@ -71,7 +71,10 @@ void nf_nat_l4proto_unique_tuple(const s
}
} else {
min = ntohs(range->min_proto.all);
- range_size = ntohs(range->max_proto.all) - min + 1;
+ max = ntohs(range->max_proto.all);
+ if (unlikely(max < min))
+ swap(max, min);
+ range_size = max - min + 1;
}
if (range->flags & NF_NAT_RANGE_PROTO_RANDOM) {
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 113/146] netfilter: IDLETIMER: be syzkaller friendly
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (111 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 112/146] netfilter: nat: cope with negative port range Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 114/146] netfilter: ebtables: CONFIG_COMPAT: dont trust userland offsets Greg Kroah-Hartman
` (36 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, syzkaller, Pablo Neira Ayuso
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit cfc2c740533368b96e2be5e0a4e8c3cace7d9814 upstream.
We had one report from syzkaller [1]
First issue is that INIT_WORK() should be done before mod_timer()
or we risk timer being fired too soon, even with a 1 second timer.
Second issue is that we need to reject too big info->timeout
to avoid overflows in msecs_to_jiffies(info->timeout * 1000), or
risk looping, if result after overflow is 0.
[1]
WARNING: CPU: 1 PID: 5129 at kernel/workqueue.c:1444 __queue_work+0xdf4/0x1230 kernel/workqueue.c:1444
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 5129 Comm: syzkaller159866 Not tainted 4.16.0-rc1+ #230
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:53
panic+0x1e4/0x41c kernel/panic.c:183
__warn+0x1dc/0x200 kernel/panic.c:547
report_bug+0x211/0x2d0 lib/bug.c:184
fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
fixup_bug arch/x86/kernel/traps.c:247 [inline]
do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:988
RIP: 0010:__queue_work+0xdf4/0x1230 kernel/workqueue.c:1444
RSP: 0018:ffff8801db507538 EFLAGS: 00010006
RAX: ffff8801aeb46080 RBX: ffff8801db530200 RCX: ffffffff81481404
RDX: 0000000000000100 RSI: ffffffff86b42640 RDI: 0000000000000082
RBP: ffff8801db507758 R08: 1ffff1003b6a0de5 R09: 000000000000000c
R10: ffff8801db5073f0 R11: 0000000000000020 R12: 1ffff1003b6a0eb6
R13: ffff8801b1067ae0 R14: 00000000000001f8 R15: dffffc0000000000
queue_work_on+0x16a/0x1c0 kernel/workqueue.c:1488
queue_work include/linux/workqueue.h:488 [inline]
schedule_work include/linux/workqueue.h:546 [inline]
idletimer_tg_expired+0x44/0x60 net/netfilter/xt_IDLETIMER.c:116
call_timer_fn+0x228/0x820 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7ee/0xb70 kernel/time/timer.c:1666
run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
__do_softirq+0x2d7/0xb85 kernel/softirq.c:285
invoke_softirq kernel/softirq.c:365 [inline]
irq_exit+0x1cc/0x200 kernel/softirq.c:405
exiting_irq arch/x86/include/asm/apic.h:541 [inline]
smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052
apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:829
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:777 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x5e/0xba kernel/locking/spinlock.c:184
RSP: 0018:ffff8801c20173c8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff12
RAX: dffffc0000000000 RBX: 0000000000000282 RCX: 0000000000000006
RDX: 1ffffffff0d592cd RSI: 1ffff10035d68d23 RDI: 0000000000000282
RBP: ffff8801c20173d8 R08: 1ffff10038402e47 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8820e5c8
R13: ffff8801b1067ad8 R14: ffff8801aea7c268 R15: ffff8801aea7c278
__debug_object_init+0x235/0x1040 lib/debugobjects.c:378
debug_object_init+0x17/0x20 lib/debugobjects.c:391
__init_work+0x2b/0x60 kernel/workqueue.c:506
idletimer_tg_create net/netfilter/xt_IDLETIMER.c:152 [inline]
idletimer_tg_checkentry+0x691/0xb00 net/netfilter/xt_IDLETIMER.c:213
xt_check_target+0x22c/0x7d0 net/netfilter/x_tables.c:850
check_target net/ipv6/netfilter/ip6_tables.c:533 [inline]
find_check_entry.isra.7+0x935/0xcf0 net/ipv6/netfilter/ip6_tables.c:575
translate_table+0xf52/0x1690 net/ipv6/netfilter/ip6_tables.c:744
do_replace net/ipv6/netfilter/ip6_tables.c:1160 [inline]
do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1686
nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]
nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115
ipv6_setsockopt+0x10b/0x130 net/ipv6/ipv6_sockglue.c:927
udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1422
sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2976
SYSC_setsockopt net/socket.c:1850 [inline]
SyS_setsockopt+0x189/0x360 net/socket.c:1829
do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287
Fixes: 0902b469bd25 ("netfilter: xtables: idletimer target implementation")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/xt_IDLETIMER.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -146,11 +146,11 @@ static int idletimer_tg_create(struct id
timer_setup(&info->timer->timer, idletimer_tg_expired, 0);
info->timer->refcnt = 1;
+ INIT_WORK(&info->timer->work, idletimer_tg_work);
+
mod_timer(&info->timer->timer,
msecs_to_jiffies(info->timeout * 1000) + jiffies);
- INIT_WORK(&info->timer->work, idletimer_tg_work);
-
return 0;
out_free_attr:
@@ -191,7 +191,10 @@ static int idletimer_tg_checkentry(const
pr_debug("timeout value is zero\n");
return -EINVAL;
}
-
+ if (info->timeout >= INT_MAX / 1000) {
+ pr_debug("timeout value is too big\n");
+ return -EINVAL;
+ }
if (info->label[0] == '\0' ||
strnlen(info->label,
MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) {
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 114/146] netfilter: ebtables: CONFIG_COMPAT: dont trust userland offsets
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (112 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 113/146] netfilter: IDLETIMER: be syzkaller friendly Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 115/146] netfilter: bridge: ebt_among: add missing match size checks Greg Kroah-Hartman
` (35 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+845a53d13171abf8bf29,
Florian Westphal, Pablo Neira Ayuso
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit b71812168571fa55e44cdd0254471331b9c4c4c6 upstream.
We need to make sure the offsets are not out of range of the
total size.
Also check that they are in ascending order.
The WARN_ON triggered by syzkaller (it sets panic_on_warn) is
changed to also bail out, no point in continuing parsing.
Briefly tested with simple ruleset of
-A INPUT --limit 1/s' --log
plus jump to custom chains using 32bit ebtables binary.
Reported-by: <syzbot+845a53d13171abf8bf29@syzkaller.appspotmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/netfilter/ebtables.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2053,7 +2053,9 @@ static int ebt_size_mwt(struct compat_eb
if (match_kern)
match_kern->match_size = ret;
- WARN_ON(type == EBT_COMPAT_TARGET && size_left);
+ if (WARN_ON(type == EBT_COMPAT_TARGET && size_left))
+ return -EINVAL;
+
match32 = (struct compat_ebt_entry_mwt *) buf;
}
@@ -2109,6 +2111,15 @@ static int size_entry_mwt(struct ebt_ent
*
* offsets are relative to beginning of struct ebt_entry (i.e., 0).
*/
+ for (i = 0; i < 4 ; ++i) {
+ if (offsets[i] >= *total)
+ return -EINVAL;
+ if (i == 0)
+ continue;
+ if (offsets[i-1] > offsets[i])
+ return -EINVAL;
+ }
+
for (i = 0, j = 1 ; j < 4 ; j++, i++) {
struct compat_ebt_entry_mwt *match32;
unsigned int size;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 115/146] netfilter: bridge: ebt_among: add missing match size checks
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (113 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 114/146] netfilter: ebtables: CONFIG_COMPAT: dont trust userland offsets Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 116/146] netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt Greg Kroah-Hartman
` (34 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+fe0b19af568972814355,
Florian Westphal, Pablo Neira Ayuso
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit c4585a2823edf4d1326da44d1524ecbfda26bb37 upstream.
ebt_among is special, it has a dynamic match size and is exempt
from the central size checks.
Therefore it must check that the size of the match structure
provided from userspace is sane by making sure em->match_size
is at least the minimum size of the expected structure.
The module has such a check, but its only done after accessing
a structure that might be out of bounds.
tested with: ebtables -A INPUT ... \
--among-dst fe:fe:fe:fe:fe:fe
--among-dst fe:fe:fe:fe:fe:fe --among-src fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fb,fe:fe:fe:fe:fc:fd,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe
--among-src fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fa,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe,fe:fe:fe:fe:fe:fe
Reported-by: <syzbot+fe0b19af568972814355@syzkaller.appspotmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/netfilter/ebt_among.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -172,18 +172,35 @@ ebt_among_mt(const struct sk_buff *skb,
return true;
}
+static bool poolsize_invalid(const struct ebt_mac_wormhash *w)
+{
+ return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple));
+}
+
static int ebt_among_mt_check(const struct xt_mtchk_param *par)
{
const struct ebt_among_info *info = par->matchinfo;
const struct ebt_entry_match *em =
container_of(par->matchinfo, const struct ebt_entry_match, data);
- int expected_length = sizeof(struct ebt_among_info);
+ unsigned int expected_length = sizeof(struct ebt_among_info);
const struct ebt_mac_wormhash *wh_dst, *wh_src;
int err;
+ if (expected_length > em->match_size)
+ return -EINVAL;
+
wh_dst = ebt_among_wh_dst(info);
- wh_src = ebt_among_wh_src(info);
+ if (poolsize_invalid(wh_dst))
+ return -EINVAL;
+
expected_length += ebt_mac_wormhash_size(wh_dst);
+ if (expected_length > em->match_size)
+ return -EINVAL;
+
+ wh_src = ebt_among_wh_src(info);
+ if (poolsize_invalid(wh_src))
+ return -EINVAL;
+
expected_length += ebt_mac_wormhash_size(wh_src);
if (em->match_size != EBT_ALIGN(expected_length)) {
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 116/146] netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (114 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 115/146] netfilter: bridge: ebt_among: add missing match size checks Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 117/146] netfilter: use skb_to_full_sk in ip6_route_me_harder Greg Kroah-Hartman
` (33 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Westphal, Pablo Neira Ayuso
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit b078556aecd791b0e5cb3a59f4c3a14273b52121 upstream.
l4proto->manip_pkt() can cause reallocation of skb head so pointer
to the ipv6 header must be reloaded.
Reported-and-tested-by: <syzbot+10005f4292fc9cc89de7@syzkaller.appspotmail.com>
Fixes: 58a317f1061c89 ("netfilter: ipv6: add IPv6 NAT support")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
@@ -99,6 +99,10 @@ static bool nf_nat_ipv6_manip_pkt(struct
!l4proto->manip_pkt(skb, &nf_nat_l3proto_ipv6, iphdroff, hdroff,
target, maniptype))
return false;
+
+ /* must reload, offset might have changed */
+ ipv6h = (void *)skb->data + iphdroff;
+
manip_addr:
if (maniptype == NF_NAT_MANIP_SRC)
ipv6h->saddr = target->src.u3.in6;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 117/146] netfilter: use skb_to_full_sk in ip6_route_me_harder
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (115 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 116/146] netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 118/146] tpm_tis: Move ilb_base_addr to tpm_tis_data Greg Kroah-Hartman
` (32 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, syzbot, Pablo Neira Ayuso
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 7d98386d55a5afaa65de77e1e9197edeb8a42079 upstream.
For some reason, Florian forgot to apply to ip6_route_me_harder
the fix that went in commit 29e09229d9f2 ("netfilter: use
skb_to_full_sk in ip_route_me_harder")
Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead of listener")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/netfilter.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -21,18 +21,19 @@
int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
{
const struct ipv6hdr *iph = ipv6_hdr(skb);
+ struct sock *sk = sk_to_full_sk(skb->sk);
unsigned int hh_len;
struct dst_entry *dst;
struct flowi6 fl6 = {
- .flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
+ .flowi6_oif = sk ? sk->sk_bound_dev_if : 0,
.flowi6_mark = skb->mark,
- .flowi6_uid = sock_net_uid(net, skb->sk),
+ .flowi6_uid = sock_net_uid(net, sk),
.daddr = iph->daddr,
.saddr = iph->saddr,
};
int err;
- dst = ip6_route_output(net, skb->sk, &fl6);
+ dst = ip6_route_output(net, sk, &fl6);
err = dst->error;
if (err) {
IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
@@ -50,7 +51,7 @@ int ip6_route_me_harder(struct net *net,
if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
xfrm_decode_session(skb, flowi6_to_flowi(&fl6), AF_INET6) == 0) {
skb_dst_set(skb, NULL);
- dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), skb->sk, 0);
+ dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
if (IS_ERR(dst))
return PTR_ERR(dst);
skb_dst_set(skb, dst);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 118/146] tpm_tis: Move ilb_base_addr to tpm_tis_data
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (116 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 117/146] netfilter: use skb_to_full_sk in ip6_route_me_harder Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-14 0:42 ` Shaikh, Azhar
2018-03-13 15:24 ` [PATCH 4.15 119/146] tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd() Greg Kroah-Hartman
` (31 subsequent siblings)
149 siblings, 1 reply; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Azhar Shaikh, Jarkko Sakkinen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Azhar Shaikh <azhar.shaikh@intel.com>
commit c382babccba2c82fe57f9e647f290fb7bf4d130d upstream.
Move static variable ilb_base_addr to tpm_tis_data.
Cc: stable@vger.kernel.org
Signed-off-by: Azhar Shaikh <azhar.shaikh@intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm_tis.c | 75 ++++++++++++++--------------------------
drivers/char/tpm/tpm_tis_core.c | 16 ++++++++
drivers/char/tpm/tpm_tis_core.h | 13 ++++++
3 files changed, 56 insertions(+), 48 deletions(-)
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -134,33 +134,24 @@ static int check_acpi_tpm2(struct device
#endif
#ifdef CONFIG_X86
-#define INTEL_LEGACY_BLK_BASE_ADDR 0xFED08000
-#define ILB_REMAP_SIZE 0x100
-#define LPC_CNTRL_REG_OFFSET 0x84
-#define LPC_CLKRUN_EN (1 << 2)
-
-static void __iomem *ilb_base_addr;
-
-static inline bool is_bsw(void)
-{
- return ((boot_cpu_data.x86_model == INTEL_FAM6_ATOM_AIRMONT) ? 1 : 0);
-}
+#define LPC_CNTRL_OFFSET 0x84
+#define LPC_CLKRUN_EN (1 << 2)
/**
* tpm_platform_begin_xfer() - clear LPC CLKRUN_EN i.e. clocks will be running
*/
-static void tpm_platform_begin_xfer(void)
+static void tpm_platform_begin_xfer(struct tpm_tis_data *data)
{
u32 clkrun_val;
if (!is_bsw())
return;
- clkrun_val = ioread32(ilb_base_addr + LPC_CNTRL_REG_OFFSET);
+ clkrun_val = ioread32(data->ilb_base_addr + LPC_CNTRL_OFFSET);
/* Disable LPC CLKRUN# */
clkrun_val &= ~LPC_CLKRUN_EN;
- iowrite32(clkrun_val, ilb_base_addr + LPC_CNTRL_REG_OFFSET);
+ iowrite32(clkrun_val, data->ilb_base_addr + LPC_CNTRL_OFFSET);
/*
* Write any random value on port 0x80 which is on LPC, to make
@@ -173,18 +164,18 @@ static void tpm_platform_begin_xfer(void
/**
* tpm_platform_end_xfer() - set LPC CLKRUN_EN i.e. clocks can be turned off
*/
-static void tpm_platform_end_xfer(void)
+static void tpm_platform_end_xfer(struct tpm_tis_data *data)
{
u32 clkrun_val;
if (!is_bsw())
return;
- clkrun_val = ioread32(ilb_base_addr + LPC_CNTRL_REG_OFFSET);
+ clkrun_val = ioread32(data->ilb_base_addr + LPC_CNTRL_OFFSET);
/* Enable LPC CLKRUN# */
clkrun_val |= LPC_CLKRUN_EN;
- iowrite32(clkrun_val, ilb_base_addr + LPC_CNTRL_REG_OFFSET);
+ iowrite32(clkrun_val, data->ilb_base_addr + LPC_CNTRL_OFFSET);
/*
* Write any random value on port 0x80 which is on LPC, to make
@@ -194,16 +185,11 @@ static void tpm_platform_end_xfer(void)
}
#else
-static inline bool is_bsw(void)
-{
- return false;
-}
-
-static void tpm_platform_begin_xfer(void)
+static void tpm_platform_begin_xfer(struct tpm_tis_data *data)
{
}
-static void tpm_platform_end_xfer(void)
+static void tpm_platform_end_xfer(struct tpm_tis_data *data)
{
}
#endif
@@ -213,12 +199,12 @@ static int tpm_tcg_read_bytes(struct tpm
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- tpm_platform_begin_xfer();
+ tpm_platform_begin_xfer(data);
while (len--)
*result++ = ioread8(phy->iobase + addr);
- tpm_platform_end_xfer();
+ tpm_platform_end_xfer(data);
return 0;
}
@@ -228,12 +214,12 @@ static int tpm_tcg_write_bytes(struct tp
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- tpm_platform_begin_xfer();
+ tpm_platform_begin_xfer(data);
while (len--)
iowrite8(*value++, phy->iobase + addr);
- tpm_platform_end_xfer();
+ tpm_platform_end_xfer(data);
return 0;
}
@@ -242,11 +228,11 @@ static int tpm_tcg_read16(struct tpm_tis
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- tpm_platform_begin_xfer();
+ tpm_platform_begin_xfer(data);
*result = ioread16(phy->iobase + addr);
- tpm_platform_end_xfer();
+ tpm_platform_end_xfer(data);
return 0;
}
@@ -255,11 +241,11 @@ static int tpm_tcg_read32(struct tpm_tis
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- tpm_platform_begin_xfer();
+ tpm_platform_begin_xfer(data);
*result = ioread32(phy->iobase + addr);
- tpm_platform_end_xfer();
+ tpm_platform_end_xfer(data);
return 0;
}
@@ -268,11 +254,11 @@ static int tpm_tcg_write32(struct tpm_ti
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- tpm_platform_begin_xfer();
+ tpm_platform_begin_xfer(data);
iowrite32(value, phy->iobase + addr);
- tpm_platform_end_xfer();
+ tpm_platform_end_xfer(data);
return 0;
}
@@ -351,9 +337,13 @@ MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl);
static void tpm_tis_pnp_remove(struct pnp_dev *dev)
{
struct tpm_chip *chip = pnp_get_drvdata(dev);
+ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
tpm_chip_unregister(chip);
tpm_tis_remove(chip);
+ if (is_bsw())
+ iounmap(priv->ilb_base_addr);
+
}
static struct pnp_driver tis_pnp_driver = {
@@ -400,10 +390,14 @@ static int tpm_tis_plat_probe(struct pla
static int tpm_tis_plat_remove(struct platform_device *pdev)
{
struct tpm_chip *chip = dev_get_drvdata(&pdev->dev);
+ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
tpm_chip_unregister(chip);
tpm_tis_remove(chip);
+ if (is_bsw())
+ iounmap(priv->ilb_base_addr);
+
return 0;
}
@@ -461,11 +455,6 @@ static int __init init_tis(void)
if (rc)
goto err_force;
-#ifdef CONFIG_X86
- if (is_bsw())
- ilb_base_addr = ioremap(INTEL_LEGACY_BLK_BASE_ADDR,
- ILB_REMAP_SIZE);
-#endif
rc = platform_driver_register(&tis_drv);
if (rc)
goto err_platform;
@@ -484,10 +473,6 @@ err_pnp:
err_platform:
if (force_pdev)
platform_device_unregister(force_pdev);
-#ifdef CONFIG_X86
- if (is_bsw())
- iounmap(ilb_base_addr);
-#endif
err_force:
return rc;
}
@@ -497,10 +482,6 @@ static void __exit cleanup_tis(void)
pnp_unregister_driver(&tis_pnp_driver);
platform_driver_unregister(&tis_drv);
-#ifdef CONFIG_X86
- if (is_bsw())
- iounmap(ilb_base_addr);
-#endif
if (force_pdev)
platform_device_unregister(force_pdev);
}
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -701,6 +701,13 @@ int tpm_tis_core_init(struct device *dev
priv->phy_ops = phy_ops;
dev_set_drvdata(&chip->dev, priv);
+ if (is_bsw()) {
+ priv->ilb_base_addr = ioremap(INTEL_LEGACY_BLK_BASE_ADDR,
+ ILB_REMAP_SIZE);
+ if (!priv->ilb_base_addr)
+ return -ENOMEM;
+ }
+
if (wait_startup(chip, 0) != 0) {
rc = -ENODEV;
goto out_err;
@@ -791,9 +798,16 @@ int tpm_tis_core_init(struct device *dev
}
}
- return tpm_chip_register(chip);
+ rc = tpm_chip_register(chip);
+ if (rc && is_bsw())
+ iounmap(priv->ilb_base_addr);
+
+ return rc;
out_err:
tpm_tis_remove(chip);
+ if (is_bsw())
+ iounmap(priv->ilb_base_addr);
+
return rc;
}
EXPORT_SYMBOL_GPL(tpm_tis_core_init);
--- a/drivers/char/tpm/tpm_tis_core.h
+++ b/drivers/char/tpm/tpm_tis_core.h
@@ -79,6 +79,9 @@ enum tis_defaults {
#define TPM_DID_VID(l) (0x0F00 | ((l) << 12))
#define TPM_RID(l) (0x0F04 | ((l) << 12))
+#define INTEL_LEGACY_BLK_BASE_ADDR 0xFED08000
+#define ILB_REMAP_SIZE 0x100
+
enum tpm_tis_flags {
TPM_TIS_ITPM_WORKAROUND = BIT(0),
};
@@ -89,6 +92,7 @@ struct tpm_tis_data {
int irq;
bool irq_tested;
unsigned int flags;
+ void __iomem *ilb_base_addr;
wait_queue_head_t int_queue;
wait_queue_head_t read_queue;
const struct tpm_tis_phy_ops *phy_ops;
@@ -144,6 +148,15 @@ static inline int tpm_tis_write32(struct
return data->phy_ops->write32(data, addr, value);
}
+static inline bool is_bsw(void)
+{
+#ifdef CONFIG_X86
+ return ((boot_cpu_data.x86_model == INTEL_FAM6_ATOM_AIRMONT) ? 1 : 0);
+#else
+ return false;
+#endif
+}
+
void tpm_tis_remove(struct tpm_chip *chip);
int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
const struct tpm_tis_phy_ops *phy_ops,
^ permalink raw reply [flat|nested] 160+ messages in thread* RE: [PATCH 4.15 118/146] tpm_tis: Move ilb_base_addr to tpm_tis_data
2018-03-13 15:24 ` [PATCH 4.15 118/146] tpm_tis: Move ilb_base_addr to tpm_tis_data Greg Kroah-Hartman
@ 2018-03-14 0:42 ` Shaikh, Azhar
0 siblings, 0 replies; 160+ messages in thread
From: Shaikh, Azhar @ 2018-03-14 0:42 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel; +Cc: stable, Jarkko Sakkinen
No objections from my side.
Please merge.
Regards,
Azhar Shaikh
>-----Original Message-----
>From: Greg Kroah-Hartman [mailto:gregkh@linuxfoundation.org]
>Sent: Tuesday, March 13, 2018 8:25 AM
>To: linux-kernel@vger.kernel.org
>Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>;
>stable@vger.kernel.org; Shaikh, Azhar <azhar.shaikh@intel.com>; Jarkko
>Sakkinen <jarkko.sakkinen@linux.intel.com>
>Subject: [PATCH 4.15 118/146] tpm_tis: Move ilb_base_addr to tpm_tis_data
>
>4.15-stable review patch. If anyone has any objections, please let me know.
>
>------------------
>
>From: Azhar Shaikh <azhar.shaikh@intel.com>
>
>commit c382babccba2c82fe57f9e647f290fb7bf4d130d upstream.
>
>Move static variable ilb_base_addr to tpm_tis_data.
>
>Cc: stable@vger.kernel.org
>Signed-off-by: Azhar Shaikh <azhar.shaikh@intel.com>
>Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
>Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
>Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
>Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
>---
> drivers/char/tpm/tpm_tis.c | 75 ++++++++++++++--------------------------
> drivers/char/tpm/tpm_tis_core.c | 16 ++++++++
> drivers/char/tpm/tpm_tis_core.h | 13 ++++++
> 3 files changed, 56 insertions(+), 48 deletions(-)
>
>--- a/drivers/char/tpm/tpm_tis.c
>+++ b/drivers/char/tpm/tpm_tis.c
>@@ -134,33 +134,24 @@ static int check_acpi_tpm2(struct device #endif
>
> #ifdef CONFIG_X86
>-#define INTEL_LEGACY_BLK_BASE_ADDR 0xFED08000
>-#define ILB_REMAP_SIZE 0x100
>-#define LPC_CNTRL_REG_OFFSET 0x84
>-#define LPC_CLKRUN_EN (1 << 2)
>-
>-static void __iomem *ilb_base_addr;
>-
>-static inline bool is_bsw(void)
>-{
>- return ((boot_cpu_data.x86_model ==
>INTEL_FAM6_ATOM_AIRMONT) ? 1 : 0);
>-}
>+#define LPC_CNTRL_OFFSET 0x84
>+#define LPC_CLKRUN_EN (1 << 2)
>
> /**
> * tpm_platform_begin_xfer() - clear LPC CLKRUN_EN i.e. clocks will be
>running
> */
>-static void tpm_platform_begin_xfer(void)
>+static void tpm_platform_begin_xfer(struct tpm_tis_data *data)
> {
> u32 clkrun_val;
>
> if (!is_bsw())
> return;
>
>- clkrun_val = ioread32(ilb_base_addr + LPC_CNTRL_REG_OFFSET);
>+ clkrun_val = ioread32(data->ilb_base_addr + LPC_CNTRL_OFFSET);
>
> /* Disable LPC CLKRUN# */
> clkrun_val &= ~LPC_CLKRUN_EN;
>- iowrite32(clkrun_val, ilb_base_addr + LPC_CNTRL_REG_OFFSET);
>+ iowrite32(clkrun_val, data->ilb_base_addr + LPC_CNTRL_OFFSET);
>
> /*
> * Write any random value on port 0x80 which is on LPC, to make @@ -
>173,18 +164,18 @@ static void tpm_platform_begin_xfer(void
> /**
> * tpm_platform_end_xfer() - set LPC CLKRUN_EN i.e. clocks can be turned
>off
> */
>-static void tpm_platform_end_xfer(void)
>+static void tpm_platform_end_xfer(struct tpm_tis_data *data)
> {
> u32 clkrun_val;
>
> if (!is_bsw())
> return;
>
>- clkrun_val = ioread32(ilb_base_addr + LPC_CNTRL_REG_OFFSET);
>+ clkrun_val = ioread32(data->ilb_base_addr + LPC_CNTRL_OFFSET);
>
> /* Enable LPC CLKRUN# */
> clkrun_val |= LPC_CLKRUN_EN;
>- iowrite32(clkrun_val, ilb_base_addr + LPC_CNTRL_REG_OFFSET);
>+ iowrite32(clkrun_val, data->ilb_base_addr + LPC_CNTRL_OFFSET);
>
> /*
> * Write any random value on port 0x80 which is on LPC, to make @@ -
>194,16 +185,11 @@ static void tpm_platform_end_xfer(void)
>
> }
> #else
>-static inline bool is_bsw(void)
>-{
>- return false;
>-}
>-
>-static void tpm_platform_begin_xfer(void)
>+static void tpm_platform_begin_xfer(struct tpm_tis_data *data)
> {
> }
>
>-static void tpm_platform_end_xfer(void)
>+static void tpm_platform_end_xfer(struct tpm_tis_data *data)
> {
> }
> #endif
>@@ -213,12 +199,12 @@ static int tpm_tcg_read_bytes(struct tpm {
> struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
>
>- tpm_platform_begin_xfer();
>+ tpm_platform_begin_xfer(data);
>
> while (len--)
> *result++ = ioread8(phy->iobase + addr);
>
>- tpm_platform_end_xfer();
>+ tpm_platform_end_xfer(data);
>
> return 0;
> }
>@@ -228,12 +214,12 @@ static int tpm_tcg_write_bytes(struct tp {
> struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
>
>- tpm_platform_begin_xfer();
>+ tpm_platform_begin_xfer(data);
>
> while (len--)
> iowrite8(*value++, phy->iobase + addr);
>
>- tpm_platform_end_xfer();
>+ tpm_platform_end_xfer(data);
>
> return 0;
> }
>@@ -242,11 +228,11 @@ static int tpm_tcg_read16(struct tpm_tis {
> struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
>
>- tpm_platform_begin_xfer();
>+ tpm_platform_begin_xfer(data);
>
> *result = ioread16(phy->iobase + addr);
>
>- tpm_platform_end_xfer();
>+ tpm_platform_end_xfer(data);
>
> return 0;
> }
>@@ -255,11 +241,11 @@ static int tpm_tcg_read32(struct tpm_tis {
> struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
>
>- tpm_platform_begin_xfer();
>+ tpm_platform_begin_xfer(data);
>
> *result = ioread32(phy->iobase + addr);
>
>- tpm_platform_end_xfer();
>+ tpm_platform_end_xfer(data);
>
> return 0;
> }
>@@ -268,11 +254,11 @@ static int tpm_tcg_write32(struct tpm_ti {
> struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
>
>- tpm_platform_begin_xfer();
>+ tpm_platform_begin_xfer(data);
>
> iowrite32(value, phy->iobase + addr);
>
>- tpm_platform_end_xfer();
>+ tpm_platform_end_xfer(data);
>
> return 0;
> }
>@@ -351,9 +337,13 @@ MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl); static
>void tpm_tis_pnp_remove(struct pnp_dev *dev) {
> struct tpm_chip *chip = pnp_get_drvdata(dev);
>+ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
>
> tpm_chip_unregister(chip);
> tpm_tis_remove(chip);
>+ if (is_bsw())
>+ iounmap(priv->ilb_base_addr);
>+
> }
>
> static struct pnp_driver tis_pnp_driver = { @@ -400,10 +390,14 @@ static int
>tpm_tis_plat_probe(struct pla static int tpm_tis_plat_remove(struct
>platform_device *pdev) {
> struct tpm_chip *chip = dev_get_drvdata(&pdev->dev);
>+ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
>
> tpm_chip_unregister(chip);
> tpm_tis_remove(chip);
>
>+ if (is_bsw())
>+ iounmap(priv->ilb_base_addr);
>+
> return 0;
> }
>
>@@ -461,11 +455,6 @@ static int __init init_tis(void)
> if (rc)
> goto err_force;
>
>-#ifdef CONFIG_X86
>- if (is_bsw())
>- ilb_base_addr = ioremap(INTEL_LEGACY_BLK_BASE_ADDR,
>- ILB_REMAP_SIZE);
>-#endif
> rc = platform_driver_register(&tis_drv);
> if (rc)
> goto err_platform;
>@@ -484,10 +473,6 @@ err_pnp:
> err_platform:
> if (force_pdev)
> platform_device_unregister(force_pdev);
>-#ifdef CONFIG_X86
>- if (is_bsw())
>- iounmap(ilb_base_addr);
>-#endif
> err_force:
> return rc;
> }
>@@ -497,10 +482,6 @@ static void __exit cleanup_tis(void)
> pnp_unregister_driver(&tis_pnp_driver);
> platform_driver_unregister(&tis_drv);
>
>-#ifdef CONFIG_X86
>- if (is_bsw())
>- iounmap(ilb_base_addr);
>-#endif
> if (force_pdev)
> platform_device_unregister(force_pdev);
> }
>--- a/drivers/char/tpm/tpm_tis_core.c
>+++ b/drivers/char/tpm/tpm_tis_core.c
>@@ -701,6 +701,13 @@ int tpm_tis_core_init(struct device *dev
> priv->phy_ops = phy_ops;
> dev_set_drvdata(&chip->dev, priv);
>
>+ if (is_bsw()) {
>+ priv->ilb_base_addr =
>ioremap(INTEL_LEGACY_BLK_BASE_ADDR,
>+ ILB_REMAP_SIZE);
>+ if (!priv->ilb_base_addr)
>+ return -ENOMEM;
>+ }
>+
> if (wait_startup(chip, 0) != 0) {
> rc = -ENODEV;
> goto out_err;
>@@ -791,9 +798,16 @@ int tpm_tis_core_init(struct device *dev
> }
> }
>
>- return tpm_chip_register(chip);
>+ rc = tpm_chip_register(chip);
>+ if (rc && is_bsw())
>+ iounmap(priv->ilb_base_addr);
>+
>+ return rc;
> out_err:
> tpm_tis_remove(chip);
>+ if (is_bsw())
>+ iounmap(priv->ilb_base_addr);
>+
> return rc;
> }
> EXPORT_SYMBOL_GPL(tpm_tis_core_init);
>--- a/drivers/char/tpm/tpm_tis_core.h
>+++ b/drivers/char/tpm/tpm_tis_core.h
>@@ -79,6 +79,9 @@ enum tis_defaults {
> #define TPM_DID_VID(l) (0x0F00 | ((l) << 12))
> #define TPM_RID(l) (0x0F04 | ((l) << 12))
>
>+#define INTEL_LEGACY_BLK_BASE_ADDR 0xFED08000
>+#define ILB_REMAP_SIZE 0x100
>+
> enum tpm_tis_flags {
> TPM_TIS_ITPM_WORKAROUND = BIT(0),
> };
>@@ -89,6 +92,7 @@ struct tpm_tis_data {
> int irq;
> bool irq_tested;
> unsigned int flags;
>+ void __iomem *ilb_base_addr;
> wait_queue_head_t int_queue;
> wait_queue_head_t read_queue;
> const struct tpm_tis_phy_ops *phy_ops; @@ -144,6 +148,15 @@
>static inline int tpm_tis_write32(struct
> return data->phy_ops->write32(data, addr, value); }
>
>+static inline bool is_bsw(void)
>+{
>+#ifdef CONFIG_X86
>+ return ((boot_cpu_data.x86_model ==
>INTEL_FAM6_ATOM_AIRMONT) ? 1 : 0);
>+#else
>+ return false;
>+#endif
>+}
>+
> void tpm_tis_remove(struct tpm_chip *chip); int tpm_tis_core_init(struct
>device *dev, struct tpm_tis_data *priv, int irq,
> const struct tpm_tis_phy_ops *phy_ops,
>
^ permalink raw reply [flat|nested] 160+ messages in thread
* [PATCH 4.15 119/146] tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd()
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (117 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 118/146] tpm_tis: Move ilb_base_addr to tpm_tis_data Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-14 0:42 ` Shaikh, Azhar
2018-03-13 15:24 ` [PATCH 4.15 120/146] tpm: delete the TPM_TIS_CLK_ENABLE flag Greg Kroah-Hartman
` (30 subsequent siblings)
149 siblings, 1 reply; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Azhar Shaikh, Jarkko Sakkinen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Azhar Shaikh <azhar.shaikh@intel.com>
commit b3e958ce4c585bf666de249dc794971ebc62d2d3 upstream.
Commit 5e572cab92f0bb5 ("tpm: Enable CLKRUN protocol for Braswell
systems") disabled CLKRUN protocol during TPM transactions and re-enabled
once the transaction is completed. But there were still some corner cases
observed where, reading of TPM header failed for savestate command
while going to suspend, which resulted in suspend failure.
To fix this issue keep the CLKRUN protocol disabled for the entire
duration of a single TPM command and not disabling and re-enabling
again for every TPM transaction. For the other TPM accesses outside
TPM command flow, add a higher level of disabling and re-enabling
the CLKRUN protocol, instead of doing for every TPM transaction.
Fixes: 5e572cab92f0bb5 ("tpm: Enable CLKRUN protocol for Braswell systems")
Signed-off-by: Azhar Shaikh <azhar.shaikh@intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm-interface.c | 6 ++
drivers/char/tpm/tpm_tis.c | 92 +++------------------------------
drivers/char/tpm/tpm_tis_core.c | 108 +++++++++++++++++++++++++++++++++++----
drivers/char/tpm/tpm_tis_core.h | 4 +
include/linux/tpm.h | 1
5 files changed, 119 insertions(+), 92 deletions(-)
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -413,6 +413,9 @@ ssize_t tpm_transmit(struct tpm_chip *ch
if (chip->dev.parent)
pm_runtime_get_sync(chip->dev.parent);
+ if (chip->ops->clk_enable != NULL)
+ chip->ops->clk_enable(chip, true);
+
/* Store the decision as chip->locality will be changed. */
need_locality = chip->locality == -1;
@@ -489,6 +492,9 @@ out:
chip->locality = -1;
}
out_no_locality:
+ if (chip->ops->clk_enable != NULL)
+ chip->ops->clk_enable(chip, false);
+
if (chip->dev.parent)
pm_runtime_put_sync(chip->dev.parent);
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -133,79 +133,17 @@ static int check_acpi_tpm2(struct device
}
#endif
-#ifdef CONFIG_X86
-#define LPC_CNTRL_OFFSET 0x84
-#define LPC_CLKRUN_EN (1 << 2)
-
-/**
- * tpm_platform_begin_xfer() - clear LPC CLKRUN_EN i.e. clocks will be running
- */
-static void tpm_platform_begin_xfer(struct tpm_tis_data *data)
-{
- u32 clkrun_val;
-
- if (!is_bsw())
- return;
-
- clkrun_val = ioread32(data->ilb_base_addr + LPC_CNTRL_OFFSET);
-
- /* Disable LPC CLKRUN# */
- clkrun_val &= ~LPC_CLKRUN_EN;
- iowrite32(clkrun_val, data->ilb_base_addr + LPC_CNTRL_OFFSET);
-
- /*
- * Write any random value on port 0x80 which is on LPC, to make
- * sure LPC clock is running before sending any TPM command.
- */
- outb(0xCC, 0x80);
-
-}
-
-/**
- * tpm_platform_end_xfer() - set LPC CLKRUN_EN i.e. clocks can be turned off
- */
-static void tpm_platform_end_xfer(struct tpm_tis_data *data)
-{
- u32 clkrun_val;
-
- if (!is_bsw())
- return;
-
- clkrun_val = ioread32(data->ilb_base_addr + LPC_CNTRL_OFFSET);
-
- /* Enable LPC CLKRUN# */
- clkrun_val |= LPC_CLKRUN_EN;
- iowrite32(clkrun_val, data->ilb_base_addr + LPC_CNTRL_OFFSET);
-
- /*
- * Write any random value on port 0x80 which is on LPC, to make
- * sure LPC clock is running before sending any TPM command.
- */
- outb(0xCC, 0x80);
-
-}
-#else
-static void tpm_platform_begin_xfer(struct tpm_tis_data *data)
-{
-}
-
-static void tpm_platform_end_xfer(struct tpm_tis_data *data)
-{
-}
-#endif
-
static int tpm_tcg_read_bytes(struct tpm_tis_data *data, u32 addr, u16 len,
u8 *result)
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- tpm_platform_begin_xfer(data);
+ if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
+ WARN(1, "CLKRUN not enabled!\n");
while (len--)
*result++ = ioread8(phy->iobase + addr);
- tpm_platform_end_xfer(data);
-
return 0;
}
@@ -214,13 +152,12 @@ static int tpm_tcg_write_bytes(struct tp
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- tpm_platform_begin_xfer(data);
+ if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
+ WARN(1, "CLKRUN not enabled!\n");
while (len--)
iowrite8(*value++, phy->iobase + addr);
- tpm_platform_end_xfer(data);
-
return 0;
}
@@ -228,12 +165,11 @@ static int tpm_tcg_read16(struct tpm_tis
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- tpm_platform_begin_xfer(data);
+ if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
+ WARN(1, "CLKRUN not enabled!\n");
*result = ioread16(phy->iobase + addr);
- tpm_platform_end_xfer(data);
-
return 0;
}
@@ -241,12 +177,11 @@ static int tpm_tcg_read32(struct tpm_tis
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- tpm_platform_begin_xfer(data);
+ if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
+ WARN(1, "CLKRUN not enabled!\n");
*result = ioread32(phy->iobase + addr);
- tpm_platform_end_xfer(data);
-
return 0;
}
@@ -254,12 +189,11 @@ static int tpm_tcg_write32(struct tpm_ti
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- tpm_platform_begin_xfer(data);
+ if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
+ WARN(1, "CLKRUN not enabled!\n");
iowrite32(value, phy->iobase + addr);
- tpm_platform_end_xfer(data);
-
return 0;
}
@@ -341,9 +275,6 @@ static void tpm_tis_pnp_remove(struct pn
tpm_chip_unregister(chip);
tpm_tis_remove(chip);
- if (is_bsw())
- iounmap(priv->ilb_base_addr);
-
}
static struct pnp_driver tis_pnp_driver = {
@@ -395,9 +326,6 @@ static int tpm_tis_plat_remove(struct pl
tpm_chip_unregister(chip);
tpm_tis_remove(chip);
- if (is_bsw())
- iounmap(priv->ilb_base_addr);
-
return 0;
}
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -31,6 +31,8 @@
#include "tpm.h"
#include "tpm_tis_core.h"
+static void tpm_tis_clkrun_enable(struct tpm_chip *chip, bool value);
+
/* Before we attempt to access the TPM we must see that the valid bit is set.
* The specification says that this bit is 0 at reset and remains 0 until the
* 'TPM has gone through its self test and initialization and has established
@@ -422,19 +424,28 @@ static bool tpm_tis_update_timeouts(stru
int i, rc;
u32 did_vid;
+ if (chip->ops->clk_enable != NULL)
+ chip->ops->clk_enable(chip, true);
+
rc = tpm_tis_read32(priv, TPM_DID_VID(0), &did_vid);
if (rc < 0)
- return rc;
+ goto out;
for (i = 0; i != ARRAY_SIZE(vendor_timeout_overrides); i++) {
if (vendor_timeout_overrides[i].did_vid != did_vid)
continue;
memcpy(timeout_cap, vendor_timeout_overrides[i].timeout_us,
sizeof(vendor_timeout_overrides[i].timeout_us));
- return true;
+ rc = true;
}
- return false;
+ rc = false;
+
+out:
+ if (chip->ops->clk_enable != NULL)
+ chip->ops->clk_enable(chip, false);
+
+ return rc;
}
/*
@@ -654,14 +665,74 @@ void tpm_tis_remove(struct tpm_chip *chi
u32 interrupt;
int rc;
+ tpm_tis_clkrun_enable(chip, true);
+
rc = tpm_tis_read32(priv, reg, &interrupt);
if (rc < 0)
interrupt = 0;
tpm_tis_write32(priv, reg, ~TPM_GLOBAL_INT_ENABLE & interrupt);
+
+ tpm_tis_clkrun_enable(chip, false);
+
+ if (priv->ilb_base_addr)
+ iounmap(priv->ilb_base_addr);
}
EXPORT_SYMBOL_GPL(tpm_tis_remove);
+/**
+ * tpm_tis_clkrun_enable() - Keep clkrun protocol disabled for entire duration
+ * of a single TPM command
+ * @chip: TPM chip to use
+ * @value: 1 - Disable CLKRUN protocol, so that clocks are free running
+ * 0 - Enable CLKRUN protocol
+ * Call this function directly in tpm_tis_remove() in error or driver removal
+ * path, since the chip->ops is set to NULL in tpm_chip_unregister().
+ */
+static void tpm_tis_clkrun_enable(struct tpm_chip *chip, bool value)
+{
+ struct tpm_tis_data *data = dev_get_drvdata(&chip->dev);
+ u32 clkrun_val;
+
+ if (!IS_ENABLED(CONFIG_X86) || !is_bsw())
+ return;
+
+ if (value) {
+ data->flags |= TPM_TIS_CLK_ENABLE;
+ data->clkrun_enabled++;
+ if (data->clkrun_enabled > 1)
+ return;
+ clkrun_val = ioread32(data->ilb_base_addr + LPC_CNTRL_OFFSET);
+
+ /* Disable LPC CLKRUN# */
+ clkrun_val &= ~LPC_CLKRUN_EN;
+ iowrite32(clkrun_val, data->ilb_base_addr + LPC_CNTRL_OFFSET);
+
+ /*
+ * Write any random value on port 0x80 which is on LPC, to make
+ * sure LPC clock is running before sending any TPM command.
+ */
+ outb(0xCC, 0x80);
+ } else {
+ data->clkrun_enabled--;
+ if (data->clkrun_enabled)
+ return;
+
+ clkrun_val = ioread32(data->ilb_base_addr + LPC_CNTRL_OFFSET);
+
+ /* Enable LPC CLKRUN# */
+ clkrun_val |= LPC_CLKRUN_EN;
+ iowrite32(clkrun_val, data->ilb_base_addr + LPC_CNTRL_OFFSET);
+
+ /*
+ * Write any random value on port 0x80 which is on LPC, to make
+ * sure LPC clock is running before sending any TPM command.
+ */
+ outb(0xCC, 0x80);
+ data->flags &= ~TPM_TIS_CLK_ENABLE;
+ }
+}
+
static const struct tpm_class_ops tpm_tis = {
.flags = TPM_OPS_AUTO_STARTUP,
.status = tpm_tis_status,
@@ -674,6 +745,7 @@ static const struct tpm_class_ops tpm_ti
.req_canceled = tpm_tis_req_canceled,
.request_locality = request_locality,
.relinquish_locality = release_locality,
+ .clk_enable = tpm_tis_clkrun_enable,
};
int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
@@ -708,6 +780,9 @@ int tpm_tis_core_init(struct device *dev
return -ENOMEM;
}
+ if (chip->ops->clk_enable != NULL)
+ chip->ops->clk_enable(chip, true);
+
if (wait_startup(chip, 0) != 0) {
rc = -ENODEV;
goto out_err;
@@ -799,14 +874,18 @@ int tpm_tis_core_init(struct device *dev
}
rc = tpm_chip_register(chip);
- if (rc && is_bsw())
- iounmap(priv->ilb_base_addr);
+ if (rc)
+ goto out_err;
- return rc;
+ if (chip->ops->clk_enable != NULL)
+ chip->ops->clk_enable(chip, false);
+
+ return 0;
out_err:
+ if ((chip->ops != NULL) && (chip->ops->clk_enable != NULL))
+ chip->ops->clk_enable(chip, false);
+
tpm_tis_remove(chip);
- if (is_bsw())
- iounmap(priv->ilb_base_addr);
return rc;
}
@@ -819,22 +898,31 @@ static void tpm_tis_reenable_interrupts(
u32 intmask;
int rc;
+ if (chip->ops->clk_enable != NULL)
+ chip->ops->clk_enable(chip, true);
+
/* reenable interrupts that device may have lost or
* BIOS/firmware may have disabled
*/
rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), priv->irq);
if (rc < 0)
- return;
+ goto out;
rc = tpm_tis_read32(priv, TPM_INT_ENABLE(priv->locality), &intmask);
if (rc < 0)
- return;
+ goto out;
intmask |= TPM_INTF_CMD_READY_INT
| TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_DATA_AVAIL_INT
| TPM_INTF_STS_VALID_INT | TPM_GLOBAL_INT_ENABLE;
tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask);
+
+out:
+ if (chip->ops->clk_enable != NULL)
+ chip->ops->clk_enable(chip, false);
+
+ return;
}
int tpm_tis_resume(struct device *dev)
--- a/drivers/char/tpm/tpm_tis_core.h
+++ b/drivers/char/tpm/tpm_tis_core.h
@@ -79,11 +79,14 @@ enum tis_defaults {
#define TPM_DID_VID(l) (0x0F00 | ((l) << 12))
#define TPM_RID(l) (0x0F04 | ((l) << 12))
+#define LPC_CNTRL_OFFSET 0x84
+#define LPC_CLKRUN_EN (1 << 2)
#define INTEL_LEGACY_BLK_BASE_ADDR 0xFED08000
#define ILB_REMAP_SIZE 0x100
enum tpm_tis_flags {
TPM_TIS_ITPM_WORKAROUND = BIT(0),
+ TPM_TIS_CLK_ENABLE = BIT(1),
};
struct tpm_tis_data {
@@ -93,6 +96,7 @@ struct tpm_tis_data {
bool irq_tested;
unsigned int flags;
void __iomem *ilb_base_addr;
+ u16 clkrun_enabled;
wait_queue_head_t int_queue;
wait_queue_head_t read_queue;
const struct tpm_tis_phy_ops *phy_ops;
--- a/include/linux/tpm.h
+++ b/include/linux/tpm.h
@@ -50,6 +50,7 @@ struct tpm_class_ops {
unsigned long *timeout_cap);
int (*request_locality)(struct tpm_chip *chip, int loc);
void (*relinquish_locality)(struct tpm_chip *chip, int loc);
+ void (*clk_enable)(struct tpm_chip *chip, bool value);
};
#if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE)
^ permalink raw reply [flat|nested] 160+ messages in thread* RE: [PATCH 4.15 119/146] tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd()
2018-03-13 15:24 ` [PATCH 4.15 119/146] tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd() Greg Kroah-Hartman
@ 2018-03-14 0:42 ` Shaikh, Azhar
0 siblings, 0 replies; 160+ messages in thread
From: Shaikh, Azhar @ 2018-03-14 0:42 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel; +Cc: stable, Jarkko Sakkinen
No objections from my side.
Please merge.
Regards,
Azhar Shaikh
>-----Original Message-----
>From: Greg Kroah-Hartman [mailto:gregkh@linuxfoundation.org]
>Sent: Tuesday, March 13, 2018 8:25 AM
>To: linux-kernel@vger.kernel.org
>Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>;
>stable@vger.kernel.org; Shaikh, Azhar <azhar.shaikh@intel.com>; Jarkko
>Sakkinen <jarkko.sakkinen@linux.intel.com>
>Subject: [PATCH 4.15 119/146] tpm: Keep CLKRUN enabled throughout the
>duration of transmit_cmd()
>
>4.15-stable review patch. If anyone has any objections, please let me know.
>
>------------------
>
>From: Azhar Shaikh <azhar.shaikh@intel.com>
>
>commit b3e958ce4c585bf666de249dc794971ebc62d2d3 upstream.
>
>Commit 5e572cab92f0bb5 ("tpm: Enable CLKRUN protocol for Braswell
>systems") disabled CLKRUN protocol during TPM transactions and re-enabled
>once the transaction is completed. But there were still some corner cases
>observed where, reading of TPM header failed for savestate command while
>going to suspend, which resulted in suspend failure.
>To fix this issue keep the CLKRUN protocol disabled for the entire duration of
>a single TPM command and not disabling and re-enabling again for every TPM
>transaction. For the other TPM accesses outside TPM command flow, add a
>higher level of disabling and re-enabling the CLKRUN protocol, instead of
>doing for every TPM transaction.
>
>Fixes: 5e572cab92f0bb5 ("tpm: Enable CLKRUN protocol for Braswell
>systems")
>Signed-off-by: Azhar Shaikh <azhar.shaikh@intel.com>
>Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
>Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
>Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
>Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
>---
> drivers/char/tpm/tpm-interface.c | 6 ++
> drivers/char/tpm/tpm_tis.c | 92 +++------------------------------
> drivers/char/tpm/tpm_tis_core.c | 108
>+++++++++++++++++++++++++++++++++++----
> drivers/char/tpm/tpm_tis_core.h | 4 +
> include/linux/tpm.h | 1
> 5 files changed, 119 insertions(+), 92 deletions(-)
>
>--- a/drivers/char/tpm/tpm-interface.c
>+++ b/drivers/char/tpm/tpm-interface.c
>@@ -413,6 +413,9 @@ ssize_t tpm_transmit(struct tpm_chip *ch
> if (chip->dev.parent)
> pm_runtime_get_sync(chip->dev.parent);
>
>+ if (chip->ops->clk_enable != NULL)
>+ chip->ops->clk_enable(chip, true);
>+
> /* Store the decision as chip->locality will be changed. */
> need_locality = chip->locality == -1;
>
>@@ -489,6 +492,9 @@ out:
> chip->locality = -1;
> }
> out_no_locality:
>+ if (chip->ops->clk_enable != NULL)
>+ chip->ops->clk_enable(chip, false);
>+
> if (chip->dev.parent)
> pm_runtime_put_sync(chip->dev.parent);
>
>--- a/drivers/char/tpm/tpm_tis.c
>+++ b/drivers/char/tpm/tpm_tis.c
>@@ -133,79 +133,17 @@ static int check_acpi_tpm2(struct device } #endif
>
>-#ifdef CONFIG_X86
>-#define LPC_CNTRL_OFFSET 0x84
>-#define LPC_CLKRUN_EN (1 << 2)
>-
>-/**
>- * tpm_platform_begin_xfer() - clear LPC CLKRUN_EN i.e. clocks will be
>running
>- */
>-static void tpm_platform_begin_xfer(struct tpm_tis_data *data) -{
>- u32 clkrun_val;
>-
>- if (!is_bsw())
>- return;
>-
>- clkrun_val = ioread32(data->ilb_base_addr + LPC_CNTRL_OFFSET);
>-
>- /* Disable LPC CLKRUN# */
>- clkrun_val &= ~LPC_CLKRUN_EN;
>- iowrite32(clkrun_val, data->ilb_base_addr + LPC_CNTRL_OFFSET);
>-
>- /*
>- * Write any random value on port 0x80 which is on LPC, to make
>- * sure LPC clock is running before sending any TPM command.
>- */
>- outb(0xCC, 0x80);
>-
>-}
>-
>-/**
>- * tpm_platform_end_xfer() - set LPC CLKRUN_EN i.e. clocks can be turned
>off
>- */
>-static void tpm_platform_end_xfer(struct tpm_tis_data *data) -{
>- u32 clkrun_val;
>-
>- if (!is_bsw())
>- return;
>-
>- clkrun_val = ioread32(data->ilb_base_addr + LPC_CNTRL_OFFSET);
>-
>- /* Enable LPC CLKRUN# */
>- clkrun_val |= LPC_CLKRUN_EN;
>- iowrite32(clkrun_val, data->ilb_base_addr + LPC_CNTRL_OFFSET);
>-
>- /*
>- * Write any random value on port 0x80 which is on LPC, to make
>- * sure LPC clock is running before sending any TPM command.
>- */
>- outb(0xCC, 0x80);
>-
>-}
>-#else
>-static void tpm_platform_begin_xfer(struct tpm_tis_data *data) -{ -}
>-
>-static void tpm_platform_end_xfer(struct tpm_tis_data *data) -{ -} -#endif
>-
> static int tpm_tcg_read_bytes(struct tpm_tis_data *data, u32 addr, u16 len,
> u8 *result)
> {
> struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
>
>- tpm_platform_begin_xfer(data);
>+ if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
>+ WARN(1, "CLKRUN not enabled!\n");
>
> while (len--)
> *result++ = ioread8(phy->iobase + addr);
>
>- tpm_platform_end_xfer(data);
>-
> return 0;
> }
>
>@@ -214,13 +152,12 @@ static int tpm_tcg_write_bytes(struct tp {
> struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
>
>- tpm_platform_begin_xfer(data);
>+ if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
>+ WARN(1, "CLKRUN not enabled!\n");
>
> while (len--)
> iowrite8(*value++, phy->iobase + addr);
>
>- tpm_platform_end_xfer(data);
>-
> return 0;
> }
>
>@@ -228,12 +165,11 @@ static int tpm_tcg_read16(struct tpm_tis {
> struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
>
>- tpm_platform_begin_xfer(data);
>+ if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
>+ WARN(1, "CLKRUN not enabled!\n");
>
> *result = ioread16(phy->iobase + addr);
>
>- tpm_platform_end_xfer(data);
>-
> return 0;
> }
>
>@@ -241,12 +177,11 @@ static int tpm_tcg_read32(struct tpm_tis {
> struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
>
>- tpm_platform_begin_xfer(data);
>+ if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
>+ WARN(1, "CLKRUN not enabled!\n");
>
> *result = ioread32(phy->iobase + addr);
>
>- tpm_platform_end_xfer(data);
>-
> return 0;
> }
>
>@@ -254,12 +189,11 @@ static int tpm_tcg_write32(struct tpm_ti {
> struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
>
>- tpm_platform_begin_xfer(data);
>+ if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
>+ WARN(1, "CLKRUN not enabled!\n");
>
> iowrite32(value, phy->iobase + addr);
>
>- tpm_platform_end_xfer(data);
>-
> return 0;
> }
>
>@@ -341,9 +275,6 @@ static void tpm_tis_pnp_remove(struct pn
>
> tpm_chip_unregister(chip);
> tpm_tis_remove(chip);
>- if (is_bsw())
>- iounmap(priv->ilb_base_addr);
>-
> }
>
> static struct pnp_driver tis_pnp_driver = { @@ -395,9 +326,6 @@ static int
>tpm_tis_plat_remove(struct pl
> tpm_chip_unregister(chip);
> tpm_tis_remove(chip);
>
>- if (is_bsw())
>- iounmap(priv->ilb_base_addr);
>-
> return 0;
> }
>
>--- a/drivers/char/tpm/tpm_tis_core.c
>+++ b/drivers/char/tpm/tpm_tis_core.c
>@@ -31,6 +31,8 @@
> #include "tpm.h"
> #include "tpm_tis_core.h"
>
>+static void tpm_tis_clkrun_enable(struct tpm_chip *chip, bool value);
>+
> /* Before we attempt to access the TPM we must see that the valid bit is set.
> * The specification says that this bit is 0 at reset and remains 0 until the
> * 'TPM has gone through its self test and initialization and has established
>@@ -422,19 +424,28 @@ static bool tpm_tis_update_timeouts(stru
> int i, rc;
> u32 did_vid;
>
>+ if (chip->ops->clk_enable != NULL)
>+ chip->ops->clk_enable(chip, true);
>+
> rc = tpm_tis_read32(priv, TPM_DID_VID(0), &did_vid);
> if (rc < 0)
>- return rc;
>+ goto out;
>
> for (i = 0; i != ARRAY_SIZE(vendor_timeout_overrides); i++) {
> if (vendor_timeout_overrides[i].did_vid != did_vid)
> continue;
> memcpy(timeout_cap,
>vendor_timeout_overrides[i].timeout_us,
> sizeof(vendor_timeout_overrides[i].timeout_us));
>- return true;
>+ rc = true;
> }
>
>- return false;
>+ rc = false;
>+
>+out:
>+ if (chip->ops->clk_enable != NULL)
>+ chip->ops->clk_enable(chip, false);
>+
>+ return rc;
> }
>
> /*
>@@ -654,14 +665,74 @@ void tpm_tis_remove(struct tpm_chip *chi
> u32 interrupt;
> int rc;
>
>+ tpm_tis_clkrun_enable(chip, true);
>+
> rc = tpm_tis_read32(priv, reg, &interrupt);
> if (rc < 0)
> interrupt = 0;
>
> tpm_tis_write32(priv, reg, ~TPM_GLOBAL_INT_ENABLE & interrupt);
>+
>+ tpm_tis_clkrun_enable(chip, false);
>+
>+ if (priv->ilb_base_addr)
>+ iounmap(priv->ilb_base_addr);
> }
> EXPORT_SYMBOL_GPL(tpm_tis_remove);
>
>+/**
>+ * tpm_tis_clkrun_enable() - Keep clkrun protocol disabled for entire
>duration
>+ * of a single TPM command
>+ * @chip: TPM chip to use
>+ * @value: 1 - Disable CLKRUN protocol, so that clocks are free running
>+ * 0 - Enable CLKRUN protocol
>+ * Call this function directly in tpm_tis_remove() in error or driver
>+removal
>+ * path, since the chip->ops is set to NULL in tpm_chip_unregister().
>+ */
>+static void tpm_tis_clkrun_enable(struct tpm_chip *chip, bool value) {
>+ struct tpm_tis_data *data = dev_get_drvdata(&chip->dev);
>+ u32 clkrun_val;
>+
>+ if (!IS_ENABLED(CONFIG_X86) || !is_bsw())
>+ return;
>+
>+ if (value) {
>+ data->flags |= TPM_TIS_CLK_ENABLE;
>+ data->clkrun_enabled++;
>+ if (data->clkrun_enabled > 1)
>+ return;
>+ clkrun_val = ioread32(data->ilb_base_addr +
>LPC_CNTRL_OFFSET);
>+
>+ /* Disable LPC CLKRUN# */
>+ clkrun_val &= ~LPC_CLKRUN_EN;
>+ iowrite32(clkrun_val, data->ilb_base_addr +
>LPC_CNTRL_OFFSET);
>+
>+ /*
>+ * Write any random value on port 0x80 which is on LPC, to
>make
>+ * sure LPC clock is running before sending any TPM
>command.
>+ */
>+ outb(0xCC, 0x80);
>+ } else {
>+ data->clkrun_enabled--;
>+ if (data->clkrun_enabled)
>+ return;
>+
>+ clkrun_val = ioread32(data->ilb_base_addr +
>LPC_CNTRL_OFFSET);
>+
>+ /* Enable LPC CLKRUN# */
>+ clkrun_val |= LPC_CLKRUN_EN;
>+ iowrite32(clkrun_val, data->ilb_base_addr +
>LPC_CNTRL_OFFSET);
>+
>+ /*
>+ * Write any random value on port 0x80 which is on LPC, to
>make
>+ * sure LPC clock is running before sending any TPM
>command.
>+ */
>+ outb(0xCC, 0x80);
>+ data->flags &= ~TPM_TIS_CLK_ENABLE;
>+ }
>+}
>+
> static const struct tpm_class_ops tpm_tis = {
> .flags = TPM_OPS_AUTO_STARTUP,
> .status = tpm_tis_status,
>@@ -674,6 +745,7 @@ static const struct tpm_class_ops tpm_ti
> .req_canceled = tpm_tis_req_canceled,
> .request_locality = request_locality,
> .relinquish_locality = release_locality,
>+ .clk_enable = tpm_tis_clkrun_enable,
> };
>
> int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
>@@ -708,6 +780,9 @@ int tpm_tis_core_init(struct device *dev
> return -ENOMEM;
> }
>
>+ if (chip->ops->clk_enable != NULL)
>+ chip->ops->clk_enable(chip, true);
>+
> if (wait_startup(chip, 0) != 0) {
> rc = -ENODEV;
> goto out_err;
>@@ -799,14 +874,18 @@ int tpm_tis_core_init(struct device *dev
> }
>
> rc = tpm_chip_register(chip);
>- if (rc && is_bsw())
>- iounmap(priv->ilb_base_addr);
>+ if (rc)
>+ goto out_err;
>
>- return rc;
>+ if (chip->ops->clk_enable != NULL)
>+ chip->ops->clk_enable(chip, false);
>+
>+ return 0;
> out_err:
>+ if ((chip->ops != NULL) && (chip->ops->clk_enable != NULL))
>+ chip->ops->clk_enable(chip, false);
>+
> tpm_tis_remove(chip);
>- if (is_bsw())
>- iounmap(priv->ilb_base_addr);
>
> return rc;
> }
>@@ -819,22 +898,31 @@ static void tpm_tis_reenable_interrupts(
> u32 intmask;
> int rc;
>
>+ if (chip->ops->clk_enable != NULL)
>+ chip->ops->clk_enable(chip, true);
>+
> /* reenable interrupts that device may have lost or
> * BIOS/firmware may have disabled
> */
> rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), priv->irq);
> if (rc < 0)
>- return;
>+ goto out;
>
> rc = tpm_tis_read32(priv, TPM_INT_ENABLE(priv->locality),
>&intmask);
> if (rc < 0)
>- return;
>+ goto out;
>
> intmask |= TPM_INTF_CMD_READY_INT
> | TPM_INTF_LOCALITY_CHANGE_INT |
>TPM_INTF_DATA_AVAIL_INT
> | TPM_INTF_STS_VALID_INT | TPM_GLOBAL_INT_ENABLE;
>
> tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask);
>+
>+out:
>+ if (chip->ops->clk_enable != NULL)
>+ chip->ops->clk_enable(chip, false);
>+
>+ return;
> }
>
> int tpm_tis_resume(struct device *dev)
>--- a/drivers/char/tpm/tpm_tis_core.h
>+++ b/drivers/char/tpm/tpm_tis_core.h
>@@ -79,11 +79,14 @@ enum tis_defaults {
> #define TPM_DID_VID(l) (0x0F00 | ((l) << 12))
> #define TPM_RID(l) (0x0F04 | ((l) << 12))
>
>+#define LPC_CNTRL_OFFSET 0x84
>+#define LPC_CLKRUN_EN (1 << 2)
> #define INTEL_LEGACY_BLK_BASE_ADDR 0xFED08000
> #define ILB_REMAP_SIZE 0x100
>
> enum tpm_tis_flags {
> TPM_TIS_ITPM_WORKAROUND = BIT(0),
>+ TPM_TIS_CLK_ENABLE = BIT(1),
> };
>
> struct tpm_tis_data {
>@@ -93,6 +96,7 @@ struct tpm_tis_data {
> bool irq_tested;
> unsigned int flags;
> void __iomem *ilb_base_addr;
>+ u16 clkrun_enabled;
> wait_queue_head_t int_queue;
> wait_queue_head_t read_queue;
> const struct tpm_tis_phy_ops *phy_ops;
>--- a/include/linux/tpm.h
>+++ b/include/linux/tpm.h
>@@ -50,6 +50,7 @@ struct tpm_class_ops {
> unsigned long *timeout_cap);
> int (*request_locality)(struct tpm_chip *chip, int loc);
> void (*relinquish_locality)(struct tpm_chip *chip, int loc);
>+ void (*clk_enable)(struct tpm_chip *chip, bool value);
> };
>
> #if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE)
>
^ permalink raw reply [flat|nested] 160+ messages in thread
* [PATCH 4.15 120/146] tpm: delete the TPM_TIS_CLK_ENABLE flag
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (118 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 119/146] tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd() Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 121/146] tpm: remove unused variables Greg Kroah-Hartman
` (29 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jarkko Sakkinen, Javier Martinez Canillas
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Martinez Canillas <javierm@redhat.com>
commit 764325add6c2ad1641199edde7b2995495fc2d7c upstream.
This flag is only used to warn if CLKRUN_EN wasn't disabled on Braswell
systems, but the only way this can happen is if the code is not correct.
So it's an unnecessary check that just makes the code harder to read.
Suggested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm_tis.c | 15 ---------------
drivers/char/tpm/tpm_tis_core.c | 2 --
drivers/char/tpm/tpm_tis_core.h | 1 -
3 files changed, 18 deletions(-)
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -138,9 +138,6 @@ static int tpm_tcg_read_bytes(struct tpm
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
while (len--)
*result++ = ioread8(phy->iobase + addr);
@@ -152,9 +149,6 @@ static int tpm_tcg_write_bytes(struct tp
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
while (len--)
iowrite8(*value++, phy->iobase + addr);
@@ -165,9 +159,6 @@ static int tpm_tcg_read16(struct tpm_tis
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
*result = ioread16(phy->iobase + addr);
return 0;
@@ -177,9 +168,6 @@ static int tpm_tcg_read32(struct tpm_tis
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
*result = ioread32(phy->iobase + addr);
return 0;
@@ -189,9 +177,6 @@ static int tpm_tcg_write32(struct tpm_ti
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
iowrite32(value, phy->iobase + addr);
return 0;
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -698,7 +698,6 @@ static void tpm_tis_clkrun_enable(struct
return;
if (value) {
- data->flags |= TPM_TIS_CLK_ENABLE;
data->clkrun_enabled++;
if (data->clkrun_enabled > 1)
return;
@@ -729,7 +728,6 @@ static void tpm_tis_clkrun_enable(struct
* sure LPC clock is running before sending any TPM command.
*/
outb(0xCC, 0x80);
- data->flags &= ~TPM_TIS_CLK_ENABLE;
}
}
--- a/drivers/char/tpm/tpm_tis_core.h
+++ b/drivers/char/tpm/tpm_tis_core.h
@@ -86,7 +86,6 @@ enum tis_defaults {
enum tpm_tis_flags {
TPM_TIS_ITPM_WORKAROUND = BIT(0),
- TPM_TIS_CLK_ENABLE = BIT(1),
};
struct tpm_tis_data {
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 121/146] tpm: remove unused variables
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (119 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 120/146] tpm: delete the TPM_TIS_CLK_ENABLE flag Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 122/146] tpm: only attempt to disable the LPC CLKRUN if is already enabled Greg Kroah-Hartman
` (28 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Jarkko Sakkinen, James Morris
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 68021bf4734d15c9a9ed1c1072b9ebcfda3e39cc upstream.
The CLKRUN fix caused a few harmless compile-time warnings:
drivers/char/tpm/tpm_tis.c: In function 'tpm_tis_pnp_remove':
drivers/char/tpm/tpm_tis.c:274:23: error: unused variable 'priv' [-Werror=unused-variable]
drivers/char/tpm/tpm_tis.c: In function 'tpm_tis_plat_remove':
drivers/char/tpm/tpm_tis.c:324:23: error: unused variable 'priv' [-Werror=unused-variable]
This removes the variables that have now become unused.
Fixes: 6d0866cbc2d3 ("tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd()")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Reviewed-by: James Morris <jmorris@namei.org>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm_tis.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -256,7 +256,6 @@ MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl);
static void tpm_tis_pnp_remove(struct pnp_dev *dev)
{
struct tpm_chip *chip = pnp_get_drvdata(dev);
- struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
tpm_chip_unregister(chip);
tpm_tis_remove(chip);
@@ -306,7 +305,6 @@ static int tpm_tis_plat_probe(struct pla
static int tpm_tis_plat_remove(struct platform_device *pdev)
{
struct tpm_chip *chip = dev_get_drvdata(&pdev->dev);
- struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
tpm_chip_unregister(chip);
tpm_tis_remove(chip);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 122/146] tpm: only attempt to disable the LPC CLKRUN if is already enabled
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (120 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 121/146] tpm: remove unused variables Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 123/146] x86/xen: Calculate __max_logical_packages on PV domains Greg Kroah-Hartman
` (27 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Javier Martinez Canillas,
James Ettle, Jeffery Miller, Jarkko Sakkinen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Martinez Canillas <javierm@redhat.com>
commit 6c9f0ce0dffe64da2204f38b0fd90f3ae2a8903c upstream.
Commit 5e572cab92f0 ("tpm: Enable CLKRUN protocol for Braswell systems")
added logic in the TPM TIS driver to disable the Low Pin Count CLKRUN
signal during TPM transactions.
Unfortunately this breaks other devices that are attached to the LPC bus
like for example PS/2 mouse and keyboards.
One flaw with the logic is that it assumes that the CLKRUN is always
enabled, and so it unconditionally enables it after a TPM transaction.
But it could be that the CLKRUN# signal was already disabled in the LPC
bus and so after the driver probes, CLKRUN_EN will remain enabled which
may break other devices that are attached to the LPC bus but don't have
support for the CLKRUN protocol.
Fixes: 5e572cab92f0 ("tpm: Enable CLKRUN protocol for Braswell systems")
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Tested-by: James Ettle <james@ettle.org.uk>
Tested-by: Jeffery Miller <jmiller@neverware.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm_tis_core.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -694,7 +694,8 @@ static void tpm_tis_clkrun_enable(struct
struct tpm_tis_data *data = dev_get_drvdata(&chip->dev);
u32 clkrun_val;
- if (!IS_ENABLED(CONFIG_X86) || !is_bsw())
+ if (!IS_ENABLED(CONFIG_X86) || !is_bsw() ||
+ !data->ilb_base_addr)
return;
if (value) {
@@ -751,6 +752,7 @@ int tpm_tis_core_init(struct device *dev
acpi_handle acpi_dev_handle)
{
u32 vendor, intfcaps, intmask;
+ u32 clkrun_val;
u8 rid;
int rc, probe;
struct tpm_chip *chip;
@@ -776,6 +778,13 @@ int tpm_tis_core_init(struct device *dev
ILB_REMAP_SIZE);
if (!priv->ilb_base_addr)
return -ENOMEM;
+
+ clkrun_val = ioread32(priv->ilb_base_addr + LPC_CNTRL_OFFSET);
+ /* Check if CLKRUN# is already not enabled in the LPC bus */
+ if (!(clkrun_val & LPC_CLKRUN_EN)) {
+ iounmap(priv->ilb_base_addr);
+ priv->ilb_base_addr = NULL;
+ }
}
if (chip->ops->clk_enable != NULL)
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 123/146] x86/xen: Calculate __max_logical_packages on PV domains
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (121 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 122/146] tpm: only attempt to disable the LPC CLKRUN if is already enabled Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 124/146] scsi: qla2xxx: Fix system crash for Notify ack timeout handling Greg Kroah-Hartman
` (26 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Prarit Bhargava, Thomas Gleixner,
Ingo Molnar, H. Peter Anvin, x86, Boris Ostrovsky, Juergen Gross,
Dou Liyang, Kate Stewart, Andy Lutomirski, Andi Kleen,
Vitaly Kuznetsov, xen-devel
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prarit Bhargava <prarit@redhat.com>
commit 63e708f826bb21470155d37b103a75d8a9e25b18 upstream.
The kernel panics on PV domains because native_smp_cpus_done() is
only called for HVM domains.
Calculate __max_logical_packages for PV domains.
Fixes: b4c0a7326f5d ("x86/smpboot: Fix __max_logical_packages estimate")
Signed-off-by: Prarit Bhargava <prarit@redhat.com>
Tested-and-reported-by: Simon Gaiser <simon@invisiblethingslab.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: x86@kernel.org
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Dou Liyang <douly.fnst@cn.fujitsu.com>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Kate Stewart <kstewart@linuxfoundation.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: xen-devel@lists.xenproject.org
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/smp.h | 1 +
arch/x86/kernel/smpboot.c | 10 ++++++++--
arch/x86/xen/smp.c | 2 ++
3 files changed, 11 insertions(+), 2 deletions(-)
--- a/arch/x86/include/asm/smp.h
+++ b/arch/x86/include/asm/smp.h
@@ -129,6 +129,7 @@ static inline void arch_send_call_functi
void cpu_disable_common(void);
void native_smp_prepare_boot_cpu(void);
void native_smp_prepare_cpus(unsigned int max_cpus);
+void calculate_max_logical_packages(void);
void native_smp_cpus_done(unsigned int max_cpus);
void common_cpu_up(unsigned int cpunum, struct task_struct *tidle);
int native_cpu_up(unsigned int cpunum, struct task_struct *tidle);
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1282,11 +1282,10 @@ void __init native_smp_prepare_boot_cpu(
cpu_set_state_online(me);
}
-void __init native_smp_cpus_done(unsigned int max_cpus)
+void __init calculate_max_logical_packages(void)
{
int ncpus;
- pr_debug("Boot done\n");
/*
* Today neither Intel nor AMD support heterogenous systems so
* extrapolate the boot cpu's data to all packages.
@@ -1294,6 +1293,13 @@ void __init native_smp_cpus_done(unsigne
ncpus = cpu_data(0).booted_cores * topology_max_smt_threads();
__max_logical_packages = DIV_ROUND_UP(nr_cpu_ids, ncpus);
pr_info("Max logical packages: %u\n", __max_logical_packages);
+}
+
+void __init native_smp_cpus_done(unsigned int max_cpus)
+{
+ pr_debug("Boot done\n");
+
+ calculate_max_logical_packages();
if (x86_has_numa_in_package)
set_sched_topology(x86_numa_in_package_topology);
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -122,6 +122,8 @@ void __init xen_smp_cpus_done(unsigned i
if (xen_hvm_domain())
native_smp_cpus_done(max_cpus);
+ else
+ calculate_max_logical_packages();
if (xen_have_vcpu_info_placement)
return;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 124/146] scsi: qla2xxx: Fix system crash for Notify ack timeout handling
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (122 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 123/146] x86/xen: Calculate __max_logical_packages on PV domains Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 125/146] scsi: qla2xxx: Fix gpnid error processing Greg Kroah-Hartman
` (25 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit 2e01d0ba868ec1d4d55ddcba519339e072b0bf4d upstream.
Fix NULL pointer crash due to missing timeout handling callback for
Notify Ack IOCB.
Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_target.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -665,7 +665,7 @@ int qla24xx_async_notify_ack(scsi_qla_ho
qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha)+2);
sp->u.iocb_cmd.u.nack.ntfy = ntfy;
-
+ sp->u.iocb_cmd.timeout = qla2x00_async_iocb_timeout;
sp->done = qla2x00_async_nack_sp_done;
rval = qla2x00_start_sp(sp);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 125/146] scsi: qla2xxx: Fix gpnid error processing
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (123 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 124/146] scsi: qla2xxx: Fix system crash for Notify ack timeout handling Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 126/146] scsi: qla2xxx: Move session delete to driver work queue Greg Kroah-Hartman
` (24 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit 22e786ea47f8795c561e1a01b6a66bb2cae2fc20 upstream.
Stop GPNID command from advancing if command has failed.
Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_gs.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -3211,6 +3211,11 @@ static void qla2x00_async_gpnid_sp_done(
sp->name, res, ct_req->req.port_id.port_id,
ct_rsp->rsp.gpn_id.port_name);
+ if (res) {
+ sp->free(sp);
+ return;
+ }
+
memset(&ea, 0, sizeof(ea));
memcpy(ea.port_name, ct_rsp->rsp.gpn_id.port_name, WWN_SIZE);
ea.sp = sp;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 126/146] scsi: qla2xxx: Move session delete to driver work queue
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (124 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 125/146] scsi: qla2xxx: Fix gpnid error processing Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 127/146] scsi: qla2xxx: Skip IRQ affinity for Target QPairs Greg Kroah-Hartman
` (23 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit a01c77d2cbc45ba527e884e5c30363a1200a4130 upstream.
Move session delete from system work queue to driver's work queue for in
time processing.
Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_os.c | 3 ++-
drivers/scsi/qla2xxx/qla_target.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3190,10 +3190,11 @@ qla2x00_probe_one(struct pci_dev *pdev,
host->can_queue, base_vha->req,
base_vha->mgmt_svr_loop_id, host->sg_tablesize);
+ ha->wq = alloc_workqueue("qla2xxx_wq", WQ_MEM_RECLAIM, 0);
+
if (ha->mqenable) {
bool mq = false;
bool startit = false;
- ha->wq = alloc_workqueue("qla2xxx_wq", WQ_MEM_RECLAIM, 0);
if (QLA_TGT_MODE_ENABLED()) {
mq = true;
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -1205,7 +1205,8 @@ void qlt_schedule_sess_for_deletion(stru
ql_dbg(ql_dbg_tgt, sess->vha, 0xe001,
"Scheduling sess %p for deletion\n", sess);
- schedule_work(&sess->del_work);
+ INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn);
+ queue_work(sess->vha->hw->wq, &sess->del_work);
}
void qlt_schedule_sess_for_deletion_lock(struct fc_port *sess)
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 127/146] scsi: qla2xxx: Skip IRQ affinity for Target QPairs
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (125 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 126/146] scsi: qla2xxx: Move session delete to driver work queue Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 128/146] scsi: qla2xxx: Fix re-login for Nport Handle in use Greg Kroah-Hartman
` (22 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit d68b850e1bfb9afb24b888a946165a186a710195 upstream.
Fix co-existence between Block MQ and Target Mode. Block MQ and
initiator mode requires midlayer queue mapping to check for IRQ to be
affinitized. For target mode, it's not the case.
Fixes: 09620eeb62c41 ("scsi: qla2xxx: Add debug knob for user control workload")
Cc: <stable@vger.kernel.org> # 4.12+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_os.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -6609,9 +6609,14 @@ qla83xx_disable_laser(scsi_qla_host_t *v
static int qla2xxx_map_queues(struct Scsi_Host *shost)
{
+ int rc;
scsi_qla_host_t *vha = (scsi_qla_host_t *)shost->hostdata;
- return blk_mq_pci_map_queues(&shost->tag_set, vha->hw->pdev);
+ if (USER_CTRL_IRQ(vha->hw))
+ rc = blk_mq_map_queues(&shost->tag_set);
+ else
+ rc = blk_mq_pci_map_queues(&shost->tag_set, vha->hw->pdev);
+ return rc;
}
static const struct pci_error_handlers qla2xxx_err_handler = {
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 128/146] scsi: qla2xxx: Fix re-login for Nport Handle in use
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (126 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 127/146] scsi: qla2xxx: Skip IRQ affinity for Target QPairs Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 129/146] scsi: qla2xxx: Retry switch command on time out Greg Kroah-Hartman
` (21 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit a084fd68e1d26174c4cc1a13fbb0112f468ff7f4 upstream.
When NPort Handle is in use, driver needs to mark the handle as used and
pick another. Instead, the code clears the handle and re-pick the same
handle.
Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_gs.c | 16 ++++++++++----
drivers/scsi/qla2xxx/qla_init.c | 44 ++++++++++++++++++++++++++++++++++++----
drivers/scsi/qla2xxx/qla_isr.c | 5 ----
3 files changed, 51 insertions(+), 14 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -2833,7 +2833,7 @@ void qla24xx_handle_gidpn_event(scsi_qla
}
} else { /* fcport->d_id.b24 != ea->id.b24 */
fcport->d_id.b24 = ea->id.b24;
- if (fcport->deleted == QLA_SESS_DELETED) {
+ if (fcport->deleted != QLA_SESS_DELETED) {
ql_dbg(ql_dbg_disc, vha, 0x2021,
"%s %d %8phC post del sess\n",
__func__, __LINE__, fcport->port_name);
@@ -3206,10 +3206,16 @@ static void qla2x00_async_gpnid_sp_done(
struct event_arg ea;
struct qla_work_evt *e;
- ql_dbg(ql_dbg_disc, vha, 0x2066,
- "Async done-%s res %x ID %3phC. %8phC\n",
- sp->name, res, ct_req->req.port_id.port_id,
- ct_rsp->rsp.gpn_id.port_name);
+ if (res)
+ ql_dbg(ql_dbg_disc, vha, 0x2066,
+ "Async done-%s fail res %x ID %3phC. %8phC\n",
+ sp->name, res, ct_req->req.port_id.port_id,
+ ct_rsp->rsp.gpn_id.port_name);
+ else
+ ql_dbg(ql_dbg_disc, vha, 0x2066,
+ "Async done-%s good ID %3phC. %8phC\n",
+ sp->name, ct_req->req.port_id.port_id,
+ ct_rsp->rsp.gpn_id.port_name);
if (res) {
sp->free(sp);
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1453,6 +1453,8 @@ static void
qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea)
{
port_id_t cid; /* conflict Nport id */
+ u16 lid;
+ struct fc_port *conflict_fcport;
switch (ea->data[0]) {
case MBS_COMMAND_COMPLETE:
@@ -1468,8 +1470,12 @@ qla24xx_handle_plogi_done_event(struct s
qla24xx_post_prli_work(vha, ea->fcport);
} else {
ql_dbg(ql_dbg_disc, vha, 0x20ea,
- "%s %d %8phC post gpdb\n",
- __func__, __LINE__, ea->fcport->port_name);
+ "%s %d %8phC LoopID 0x%x in use with %06x. post gnl\n",
+ __func__, __LINE__, ea->fcport->port_name,
+ ea->fcport->loop_id, ea->fcport->d_id.b24);
+
+ set_bit(ea->fcport->loop_id, vha->hw->loop_id_map);
+ ea->fcport->loop_id = FC_NO_LOOP_ID;
ea->fcport->chip_reset = vha->hw->base_qpair->chip_reset;
ea->fcport->logout_on_delete = 1;
ea->fcport->send_els_logo = 0;
@@ -1514,8 +1520,38 @@ qla24xx_handle_plogi_done_event(struct s
ea->fcport->d_id.b.domain, ea->fcport->d_id.b.area,
ea->fcport->d_id.b.al_pa);
- qla2x00_clear_loop_id(ea->fcport);
- qla24xx_post_gidpn_work(vha, ea->fcport);
+ lid = ea->iop[1] & 0xffff;
+ qlt_find_sess_invalidate_other(vha,
+ wwn_to_u64(ea->fcport->port_name),
+ ea->fcport->d_id, lid, &conflict_fcport);
+
+ if (conflict_fcport) {
+ /*
+ * Another fcport share the same loop_id/nport id.
+ * Conflict fcport needs to finish cleanup before this
+ * fcport can proceed to login.
+ */
+ conflict_fcport->conflict = ea->fcport;
+ ea->fcport->login_pause = 1;
+
+ ql_dbg(ql_dbg_disc, vha, 0x20ed,
+ "%s %d %8phC NPortId %06x inuse with loopid 0x%x. post gidpn\n",
+ __func__, __LINE__, ea->fcport->port_name,
+ ea->fcport->d_id.b24, lid);
+ qla2x00_clear_loop_id(ea->fcport);
+ qla24xx_post_gidpn_work(vha, ea->fcport);
+ } else {
+ ql_dbg(ql_dbg_disc, vha, 0x20ed,
+ "%s %d %8phC NPortId %06x inuse with loopid 0x%x. sched delete\n",
+ __func__, __LINE__, ea->fcport->port_name,
+ ea->fcport->d_id.b24, lid);
+
+ qla2x00_clear_loop_id(ea->fcport);
+ set_bit(lid, vha->hw->loop_id_map);
+ ea->fcport->loop_id = lid;
+ ea->fcport->keep_nport_handle = 0;
+ qlt_schedule_sess_for_deletion(ea->fcport, false);
+ }
break;
}
return;
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -2369,7 +2369,6 @@ qla2x00_status_entry(scsi_qla_host_t *vh
int res = 0;
uint16_t state_flags = 0;
uint16_t retry_delay = 0;
- uint8_t no_logout = 0;
sts = (sts_entry_t *) pkt;
sts24 = (struct sts_entry_24xx *) pkt;
@@ -2640,7 +2639,6 @@ check_scsi_status:
break;
case CS_PORT_LOGGED_OUT:
- no_logout = 1;
case CS_PORT_CONFIG_CHG:
case CS_PORT_BUSY:
case CS_INCOMPLETE:
@@ -2671,9 +2669,6 @@ check_scsi_status:
port_state_str[atomic_read(&fcport->state)],
comp_status);
- if (no_logout)
- fcport->logout_on_delete = 0;
-
qla2x00_mark_device_lost(fcport->vha, fcport, 1, 1);
qlt_schedule_sess_for_deletion_lock(fcport);
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 129/146] scsi: qla2xxx: Retry switch command on time out
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (127 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 128/146] scsi: qla2xxx: Fix re-login for Nport Handle in use Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 130/146] scsi: qla2xxx: Serialize GPNID for multiple RSCN Greg Kroah-Hartman
` (20 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit 25ad76b703d9ad536f3411b15b1070aeb059ab55 upstream.
Retry GID_PN & GPN_ID switch commands for time out case.
Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_gs.c | 34 ++++++++++++++++++++++++++--------
1 file changed, 26 insertions(+), 8 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -175,6 +175,9 @@ qla2x00_chk_ms_status(scsi_qla_host_t *v
set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
}
break;
+ case CS_TIMEOUT:
+ rval = QLA_FUNCTION_TIMEOUT;
+ /* drop through */
default:
ql_dbg(ql_dbg_disc, vha, 0x2033,
"%s failed, completion status (%x) on port_id: "
@@ -2889,9 +2892,22 @@ static void qla2x00_async_gidpn_sp_done(
ea.rc = res;
ea.event = FCME_GIDPN_DONE;
- ql_dbg(ql_dbg_disc, vha, 0x204f,
- "Async done-%s res %x, WWPN %8phC ID %3phC \n",
- sp->name, res, fcport->port_name, id);
+ if (res == QLA_FUNCTION_TIMEOUT) {
+ ql_dbg(ql_dbg_disc, sp->vha, 0xffff,
+ "Async done-%s WWPN %8phC timed out.\n",
+ sp->name, fcport->port_name);
+ qla24xx_post_gidpn_work(sp->vha, fcport);
+ sp->free(sp);
+ return;
+ } else if (res) {
+ ql_dbg(ql_dbg_disc, sp->vha, 0xffff,
+ "Async done-%s fail res %x, WWPN %8phC\n",
+ sp->name, res, fcport->port_name);
+ } else {
+ ql_dbg(ql_dbg_disc, vha, 0x204f,
+ "Async done-%s good WWPN %8phC ID %3phC\n",
+ sp->name, fcport->port_name, id);
+ }
qla2x00_fcport_event_handler(vha, &ea);
@@ -3217,11 +3233,6 @@ static void qla2x00_async_gpnid_sp_done(
sp->name, ct_req->req.port_id.port_id,
ct_rsp->rsp.gpn_id.port_name);
- if (res) {
- sp->free(sp);
- return;
- }
-
memset(&ea, 0, sizeof(ea));
memcpy(ea.port_name, ct_rsp->rsp.gpn_id.port_name, WWN_SIZE);
ea.sp = sp;
@@ -3231,6 +3242,13 @@ static void qla2x00_async_gpnid_sp_done(
ea.rc = res;
ea.event = FCME_GPNID_DONE;
+ if (res) {
+ if (res == QLA_FUNCTION_TIMEOUT)
+ qla24xx_post_gpnid_work(sp->vha, &ea.id);
+ sp->free(sp);
+ return;
+ }
+
qla2x00_fcport_event_handler(vha, &ea);
e = qla2x00_alloc_work(vha, QLA_EVT_GPNID_DONE);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 130/146] scsi: qla2xxx: Serialize GPNID for multiple RSCN
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (128 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 129/146] scsi: qla2xxx: Retry switch command on time out Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 131/146] scsi: qla2xxx: Fix login state machine stuck at GPDB Greg Kroah-Hartman
` (19 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit 2d73ac6102d943c4be4945735a338005359c6abc upstream.
GPNID is triggered by RSCN. For multiple RSCNs of the same affected
NPORT ID, serialize the GPNID to prevent confusion.
Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_def.h | 48 ++++++++++++++++++++++-------------------
drivers/scsi/qla2xxx/qla_gs.c | 35 +++++++++++++++++++++++++----
drivers/scsi/qla2xxx/qla_isr.c | 2 -
drivers/scsi/qla2xxx/qla_os.c | 1
4 files changed, 58 insertions(+), 28 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -315,6 +315,29 @@ struct srb_cmd {
/* To identify if a srb is of T10-CRC type. @sp => srb_t pointer */
#define IS_PROT_IO(sp) (sp->flags & SRB_CRC_CTX_DSD_VALID)
+/*
+ * 24 bit port ID type definition.
+ */
+typedef union {
+ uint32_t b24 : 24;
+
+ struct {
+#ifdef __BIG_ENDIAN
+ uint8_t domain;
+ uint8_t area;
+ uint8_t al_pa;
+#elif defined(__LITTLE_ENDIAN)
+ uint8_t al_pa;
+ uint8_t area;
+ uint8_t domain;
+#else
+#error "__BIG_ENDIAN or __LITTLE_ENDIAN must be defined!"
+#endif
+ uint8_t rsvd_1;
+ } b;
+} port_id_t;
+#define INVALID_PORT_ID 0xFFFFFF
+
struct els_logo_payload {
uint8_t opcode;
uint8_t rsvd[3];
@@ -338,6 +361,7 @@ struct ct_arg {
u32 rsp_size;
void *req;
void *rsp;
+ port_id_t id;
};
/*
@@ -499,6 +523,7 @@ typedef struct srb {
const char *name;
int iocbs;
struct qla_qpair *qpair;
+ struct list_head elem;
u32 gen1; /* scratch */
u32 gen2; /* scratch */
union {
@@ -2164,28 +2189,6 @@ struct imm_ntfy_from_isp {
#define REQUEST_ENTRY_SIZE (sizeof(request_t))
-/*
- * 24 bit port ID type definition.
- */
-typedef union {
- uint32_t b24 : 24;
-
- struct {
-#ifdef __BIG_ENDIAN
- uint8_t domain;
- uint8_t area;
- uint8_t al_pa;
-#elif defined(__LITTLE_ENDIAN)
- uint8_t al_pa;
- uint8_t area;
- uint8_t domain;
-#else
-#error "__BIG_ENDIAN or __LITTLE_ENDIAN must be defined!"
-#endif
- uint8_t rsvd_1;
- } b;
-} port_id_t;
-#define INVALID_PORT_ID 0xFFFFFF
/*
* Switch info gathering structure.
@@ -4252,6 +4255,7 @@ typedef struct scsi_qla_host {
uint8_t n2n_node_name[WWN_SIZE];
uint8_t n2n_port_name[WWN_SIZE];
uint16_t n2n_id;
+ struct list_head gpnid_list;
} scsi_qla_host_t;
struct qla27xx_image_status {
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -3221,16 +3221,17 @@ static void qla2x00_async_gpnid_sp_done(
(struct ct_sns_rsp *)sp->u.iocb_cmd.u.ctarg.rsp;
struct event_arg ea;
struct qla_work_evt *e;
+ unsigned long flags;
if (res)
ql_dbg(ql_dbg_disc, vha, 0x2066,
- "Async done-%s fail res %x ID %3phC. %8phC\n",
- sp->name, res, ct_req->req.port_id.port_id,
+ "Async done-%s fail res %x rscn gen %d ID %3phC. %8phC\n",
+ sp->name, res, sp->gen1, ct_req->req.port_id.port_id,
ct_rsp->rsp.gpn_id.port_name);
else
ql_dbg(ql_dbg_disc, vha, 0x2066,
- "Async done-%s good ID %3phC. %8phC\n",
- sp->name, ct_req->req.port_id.port_id,
+ "Async done-%s good rscn gen %d ID %3phC. %8phC\n",
+ sp->name, sp->gen1, ct_req->req.port_id.port_id,
ct_rsp->rsp.gpn_id.port_name);
memset(&ea, 0, sizeof(ea));
@@ -3242,11 +3243,20 @@ static void qla2x00_async_gpnid_sp_done(
ea.rc = res;
ea.event = FCME_GPNID_DONE;
+ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+ list_del(&sp->elem);
+ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+
if (res) {
if (res == QLA_FUNCTION_TIMEOUT)
qla24xx_post_gpnid_work(sp->vha, &ea.id);
sp->free(sp);
return;
+ } else if (sp->gen1) {
+ /* There was anoter RSNC for this Nport ID */
+ qla24xx_post_gpnid_work(sp->vha, &ea.id);
+ sp->free(sp);
+ return;
}
qla2x00_fcport_event_handler(vha, &ea);
@@ -3282,8 +3292,9 @@ int qla24xx_async_gpnid(scsi_qla_host_t
{
int rval = QLA_FUNCTION_FAILED;
struct ct_sns_req *ct_req;
- srb_t *sp;
+ srb_t *sp, *tsp;
struct ct_sns_pkt *ct_sns;
+ unsigned long flags;
if (!vha->flags.online)
goto done;
@@ -3294,8 +3305,22 @@ int qla24xx_async_gpnid(scsi_qla_host_t
sp->type = SRB_CT_PTHRU_CMD;
sp->name = "gpnid";
+ sp->u.iocb_cmd.u.ctarg.id = *id;
+ sp->gen1 = 0;
qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);
+ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+ list_for_each_entry(tsp, &vha->gpnid_list, elem) {
+ if (tsp->u.iocb_cmd.u.ctarg.id.b24 == id->b24) {
+ tsp->gen1++;
+ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+ sp->free(sp);
+ goto done;
+ }
+ }
+ list_add_tail(&sp->elem, &vha->gpnid_list);
+ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+
sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
GFP_KERNEL);
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1574,7 +1574,7 @@ qla24xx_els_ct_entry(scsi_qla_host_t *vh
/* borrowing sts_entry_24xx.comp_status.
same location as ct_entry_24xx.comp_status
*/
- res = qla2x00_chk_ms_status(vha, (ms_iocb_entry_t *)pkt,
+ res = qla2x00_chk_ms_status(sp->vha, (ms_iocb_entry_t *)pkt,
(struct ct_sns_rsp *)sp->u.iocb_cmd.u.ctarg.rsp,
sp->name);
sp->done(sp, res);
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -4515,6 +4515,7 @@ struct scsi_qla_host *qla2x00_create_hos
INIT_LIST_HEAD(&vha->qp_list);
INIT_LIST_HEAD(&vha->gnl.fcports);
INIT_LIST_HEAD(&vha->nvme_rport_list);
+ INIT_LIST_HEAD(&vha->gpnid_list);
spin_lock_init(&vha->work_lock);
spin_lock_init(&vha->cmd_list_lock);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 131/146] scsi: qla2xxx: Fix login state machine stuck at GPDB
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (129 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 130/146] scsi: qla2xxx: Serialize GPNID for multiple RSCN Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 132/146] scsi: qla2xxx: Fix NPIV host cleanup in target mode Greg Kroah-Hartman
` (18 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit 414d9ff3f8039f85d23f619dcbbd1ba2628a1a67 upstream.
This patch returns discovery state machine back to Login Complete.
Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_init.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -863,6 +863,7 @@ void qla24xx_handle_gpdb_event(scsi_qla_
int rval = ea->rc;
fc_port_t *fcport = ea->fcport;
unsigned long flags;
+ u16 opt = ea->sp->u.iocb_cmd.u.mbx.out_mb[10];
fcport->flags &= ~FCF_ASYNC_SENT;
@@ -893,7 +894,8 @@ void qla24xx_handle_gpdb_event(scsi_qla_
}
spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
- ea->fcport->login_gen++;
+ if (opt != PDO_FORCE_ADISC)
+ ea->fcport->login_gen++;
ea->fcport->deleted = 0;
ea->fcport->logout_on_delete = 1;
@@ -917,6 +919,13 @@ void qla24xx_handle_gpdb_event(scsi_qla_
qla24xx_post_gpsc_work(vha, fcport);
}
+ } else if (ea->fcport->login_succ) {
+ /*
+ * We have an existing session. A late RSCN delivery
+ * must have triggered the session to be re-validate.
+ * session is still valid.
+ */
+ fcport->disc_state = DSC_LOGIN_COMPLETE;
}
spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
} /* gpdb event */
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 132/146] scsi: qla2xxx: Fix NPIV host cleanup in target mode
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (130 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 131/146] scsi: qla2xxx: Fix login state machine stuck at GPDB Greg Kroah-Hartman
@ 2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 133/146] scsi: qla2xxx: Relogin to target port on a cable swap Greg Kroah-Hartman
` (17 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sawan Chandak, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sawan Chandak <sawan.chandak@cavium.com>
commit 3be63b1e1838e35ce93e83f19573e949f4b389b4 upstream.
Add check to make sure we are cleaning up global target host list only
for NPIV hosts
Fixes: bdbe24de281e2 ("scsi: qla2xxx: Cleanup NPIV host in target mode during config teardown")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Sawan Chandak <sawan.chandak@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_target.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -1561,8 +1561,11 @@ static void qlt_release(struct qla_tgt *
btree_destroy64(&tgt->lun_qpair_map);
- if (ha->tgt.tgt_ops && ha->tgt.tgt_ops->remove_target)
- ha->tgt.tgt_ops->remove_target(vha);
+ if (vha->vp_idx)
+ if (ha->tgt.tgt_ops &&
+ ha->tgt.tgt_ops->remove_target &&
+ vha->vha_tgt.target_lport_ptr)
+ ha->tgt.tgt_ops->remove_target(vha);
vha->vha_tgt.qla_tgt = NULL;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 133/146] scsi: qla2xxx: Relogin to target port on a cable swap
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (131 preceding siblings ...)
2018-03-13 15:24 ` [PATCH 4.15 132/146] scsi: qla2xxx: Fix NPIV host cleanup in target mode Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 134/146] scsi: qla2xxx: Fix Relogin being triggered too fast Greg Kroah-Hartman
` (16 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit 5ef696aa9f3ccf999552d924c4e21a348f2bbea9 upstream.
If user swaps one target port for another target port for same switch
port, the new target port is not being recognized by the driver. Current
code assumes that old Target port has recovered from link down. The fix
will ask switch what is the WWPN of a specific NportID (GPNID) rather
than assuming it's the same Target port which has came back.
Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_gs.c | 170 +++++++++++++++++++++++++++++---------
drivers/scsi/qla2xxx/qla_init.c | 6 -
drivers/scsi/qla2xxx/qla_os.c | 35 +++++++
drivers/scsi/qla2xxx/qla_target.c | 35 ++++++-
4 files changed, 197 insertions(+), 49 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -3171,43 +3171,136 @@ void qla24xx_async_gpnid_done(scsi_qla_h
void qla24xx_handle_gpnid_event(scsi_qla_host_t *vha, struct event_arg *ea)
{
- fc_port_t *fcport;
- unsigned long flags;
+ fc_port_t *fcport, *conflict, *t;
- spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
- fcport = qla2x00_find_fcport_by_wwpn(vha, ea->port_name, 1);
- spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
-
- if (fcport) {
- /* cable moved. just plugged in */
- fcport->rscn_gen++;
- fcport->d_id = ea->id;
- fcport->scan_state = QLA_FCPORT_FOUND;
- fcport->flags |= FCF_FABRIC_DEVICE;
-
- switch (fcport->disc_state) {
- case DSC_DELETED:
- ql_dbg(ql_dbg_disc, vha, 0x210d,
- "%s %d %8phC login\n", __func__, __LINE__,
- fcport->port_name);
- qla24xx_fcport_handle_login(vha, fcport);
- break;
- case DSC_DELETE_PEND:
- break;
- default:
- ql_dbg(ql_dbg_disc, vha, 0x2064,
- "%s %d %8phC post del sess\n",
- __func__, __LINE__, fcport->port_name);
- qlt_schedule_sess_for_deletion_lock(fcport);
- break;
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "%s %d port_id: %06x\n",
+ __func__, __LINE__, ea->id.b24);
+
+ if (ea->rc) {
+ /* cable is disconnected */
+ list_for_each_entry_safe(fcport, t, &vha->vp_fcports, list) {
+ if (fcport->d_id.b24 == ea->id.b24) {
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "%s %d %8phC DS %d\n",
+ __func__, __LINE__,
+ fcport->port_name,
+ fcport->disc_state);
+ fcport->scan_state = QLA_FCPORT_SCAN;
+ switch (fcport->disc_state) {
+ case DSC_DELETED:
+ case DSC_DELETE_PEND:
+ break;
+ default:
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "%s %d %8phC post del sess\n",
+ __func__, __LINE__,
+ fcport->port_name);
+ qlt_schedule_sess_for_deletion_lock
+ (fcport);
+ break;
+ }
+ }
}
} else {
- /* create new fcport */
- ql_dbg(ql_dbg_disc, vha, 0x2065,
- "%s %d %8phC post new sess\n",
- __func__, __LINE__, ea->port_name);
-
- qla24xx_post_newsess_work(vha, &ea->id, ea->port_name, NULL);
+ /* cable is connected */
+ fcport = qla2x00_find_fcport_by_wwpn(vha, ea->port_name, 1);
+ if (fcport) {
+ list_for_each_entry_safe(conflict, t, &vha->vp_fcports,
+ list) {
+ if ((conflict->d_id.b24 == ea->id.b24) &&
+ (fcport != conflict)) {
+ /* 2 fcports with conflict Nport ID or
+ * an existing fcport is having nport ID
+ * conflict with new fcport.
+ */
+
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "%s %d %8phC DS %d\n",
+ __func__, __LINE__,
+ conflict->port_name,
+ conflict->disc_state);
+ conflict->scan_state = QLA_FCPORT_SCAN;
+ switch (conflict->disc_state) {
+ case DSC_DELETED:
+ case DSC_DELETE_PEND:
+ break;
+ default:
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "%s %d %8phC post del sess\n",
+ __func__, __LINE__,
+ conflict->port_name);
+ qlt_schedule_sess_for_deletion_lock
+ (conflict);
+ break;
+ }
+ }
+ }
+
+ fcport->rscn_gen++;
+ fcport->scan_state = QLA_FCPORT_FOUND;
+ fcport->flags |= FCF_FABRIC_DEVICE;
+ switch (fcport->disc_state) {
+ case DSC_LOGIN_COMPLETE:
+ /* recheck session is still intact. */
+ ql_dbg(ql_dbg_disc, vha, 0x210d,
+ "%s %d %8phC revalidate session with ADISC\n",
+ __func__, __LINE__, fcport->port_name);
+ qla24xx_post_gpdb_work(vha, fcport,
+ PDO_FORCE_ADISC);
+ break;
+ case DSC_DELETED:
+ ql_dbg(ql_dbg_disc, vha, 0x210d,
+ "%s %d %8phC login\n", __func__, __LINE__,
+ fcport->port_name);
+ fcport->d_id = ea->id;
+ qla24xx_fcport_handle_login(vha, fcport);
+ break;
+ case DSC_DELETE_PEND:
+ fcport->d_id = ea->id;
+ break;
+ default:
+ fcport->d_id = ea->id;
+ break;
+ }
+ } else {
+ list_for_each_entry_safe(conflict, t, &vha->vp_fcports,
+ list) {
+ if (conflict->d_id.b24 == ea->id.b24) {
+ /* 2 fcports with conflict Nport ID or
+ * an existing fcport is having nport ID
+ * conflict with new fcport.
+ */
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "%s %d %8phC DS %d\n",
+ __func__, __LINE__,
+ conflict->port_name,
+ conflict->disc_state);
+
+ conflict->scan_state = QLA_FCPORT_SCAN;
+ switch (conflict->disc_state) {
+ case DSC_DELETED:
+ case DSC_DELETE_PEND:
+ break;
+ default:
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "%s %d %8phC post del sess\n",
+ __func__, __LINE__,
+ conflict->port_name);
+ qlt_schedule_sess_for_deletion_lock
+ (conflict);
+ break;
+ }
+ }
+ }
+
+ /* create new fcport */
+ ql_dbg(ql_dbg_disc, vha, 0x2065,
+ "%s %d %8phC post new sess\n",
+ __func__, __LINE__, ea->port_name);
+ qla24xx_post_newsess_work(vha, &ea->id,
+ ea->port_name, NULL);
+ }
}
}
@@ -3248,12 +3341,13 @@ static void qla2x00_async_gpnid_sp_done(
spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
if (res) {
- if (res == QLA_FUNCTION_TIMEOUT)
+ if (res == QLA_FUNCTION_TIMEOUT) {
qla24xx_post_gpnid_work(sp->vha, &ea.id);
- sp->free(sp);
- return;
+ sp->free(sp);
+ return;
+ }
} else if (sp->gen1) {
- /* There was anoter RSNC for this Nport ID */
+ /* There was another RSCN for this Nport ID */
qla24xx_post_gpnid_work(sp->vha, &ea.id);
sp->free(sp);
return;
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -925,6 +925,9 @@ void qla24xx_handle_gpdb_event(scsi_qla_
* must have triggered the session to be re-validate.
* session is still valid.
*/
+ ql_dbg(ql_dbg_disc, vha, 0x20d6,
+ "%s %d %8phC session revalidate success\n",
+ __func__, __LINE__, fcport->port_name);
fcport->disc_state = DSC_LOGIN_COMPLETE;
}
spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
@@ -1049,9 +1052,8 @@ void qla24xx_handle_rscn_event(fc_port_t
switch (fcport->disc_state) {
case DSC_DELETED:
case DSC_LOGIN_COMPLETE:
- qla24xx_post_gidpn_work(fcport->vha, fcport);
+ qla24xx_post_gpnid_work(fcport->vha, &ea->id);
break;
-
default:
break;
}
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -4760,10 +4760,39 @@ void qla24xx_create_new_sess(struct scsi
spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
if (fcport) {
- if (pla)
+ if (pla) {
qlt_plogi_ack_unref(vha, pla);
- else
- qla24xx_async_gffid(vha, fcport);
+ } else {
+ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+ tfcp = qla2x00_find_fcport_by_nportid(vha,
+ &e->u.new_sess.id, 1);
+ if (tfcp && (tfcp != fcport)) {
+ /*
+ * We have a conflict fcport with same NportID.
+ */
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "%s %8phC found conflict b4 add. DS %d LS %d\n",
+ __func__, tfcp->port_name, tfcp->disc_state,
+ tfcp->fw_login_state);
+
+ switch (tfcp->disc_state) {
+ case DSC_DELETED:
+ break;
+ case DSC_DELETE_PEND:
+ fcport->login_pause = 1;
+ tfcp->conflict = fcport;
+ break;
+ default:
+ fcport->login_pause = 1;
+ tfcp->conflict = fcport;
+ qlt_schedule_sess_for_deletion_lock
+ (tfcp);
+ break;
+ }
+ }
+ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+ qla24xx_async_gnl(vha, fcport);
+ }
}
if (free_fcport) {
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -890,6 +890,17 @@ qlt_plogi_ack_link(struct scsi_qla_host
iocb->u.isp24.port_id[1], iocb->u.isp24.port_id[0],
pla->ref_count, pla, link);
+ if (link == QLT_PLOGI_LINK_CONFLICT) {
+ switch (sess->disc_state) {
+ case DSC_DELETED:
+ case DSC_DELETE_PEND:
+ pla->ref_count--;
+ return;
+ default:
+ break;
+ }
+ }
+
if (sess->plogi_link[link])
qlt_plogi_ack_unref(vha, sess->plogi_link[link]);
@@ -4737,6 +4748,10 @@ static int qlt_24xx_handle_els(struct sc
sess->d_id = port_id;
sess->login_gen++;
+ ql_dbg(ql_dbg_disc, vha, 0x20f9,
+ "%s %d %8phC DS %d\n",
+ __func__, __LINE__, sess->port_name, sess->disc_state);
+
switch (sess->disc_state) {
case DSC_DELETED:
qlt_plogi_ack_unref(vha, pla);
@@ -4786,12 +4801,20 @@ static int qlt_24xx_handle_els(struct sc
}
if (conflict_sess) {
- ql_dbg(ql_dbg_tgt_mgt, vha, 0xf09b,
- "PRLI with conflicting sess %p port %8phC\n",
- conflict_sess, conflict_sess->port_name);
- qlt_send_term_imm_notif(vha, iocb, 1);
- res = 0;
- break;
+ switch (conflict_sess->disc_state) {
+ case DSC_DELETED:
+ case DSC_DELETE_PEND:
+ break;
+ default:
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf09b,
+ "PRLI with conflicting sess %p port %8phC\n",
+ conflict_sess, conflict_sess->port_name);
+ conflict_sess->fw_login_state =
+ DSC_LS_PORT_UNAVAIL;
+ qlt_send_term_imm_notif(vha, iocb, 1);
+ res = 0;
+ break;
+ }
}
if (sess != NULL) {
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 134/146] scsi: qla2xxx: Fix Relogin being triggered too fast
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (132 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 133/146] scsi: qla2xxx: Relogin to target port on a cable swap Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 135/146] scsi: qla2xxx: Fix PRLI state check Greg Kroah-Hartman
` (15 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit 4005a995668b8fd58f4cf1460dd4cf63efa18363 upstream.
Current driver design schedules relogin process via DPC thread every 1
second. In a large fabric, this DPC thread tries to schedule too many
jobs and might get overloaded. As a result of this processing of DPC
thread, it can schedule relogin earlier than 1 second.
Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_def.h | 1 +
drivers/scsi/qla2xxx/qla_mid.c | 22 ++++++++++++++--------
drivers/scsi/qla2xxx/qla_os.c | 22 ++++++++++++++--------
3 files changed, 29 insertions(+), 16 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -4110,6 +4110,7 @@ typedef struct scsi_qla_host {
#define LOOP_READY 5
#define LOOP_DEAD 6
+ unsigned long relogin_jif;
unsigned long dpc_flags;
#define RESET_MARKER_NEEDED 0 /* Send marker to ISP. */
#define RESET_ACTIVE 1
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -343,15 +343,21 @@ qla2x00_do_dpc_vp(scsi_qla_host_t *vha)
"FCPort update end.\n");
}
- if ((test_and_clear_bit(RELOGIN_NEEDED, &vha->dpc_flags)) &&
- !test_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags) &&
- atomic_read(&vha->loop_state) != LOOP_DOWN) {
+ if (test_bit(RELOGIN_NEEDED, &vha->dpc_flags) &&
+ !test_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags) &&
+ atomic_read(&vha->loop_state) != LOOP_DOWN) {
- ql_dbg(ql_dbg_dpc, vha, 0x4018,
- "Relogin needed scheduled.\n");
- qla2x00_relogin(vha);
- ql_dbg(ql_dbg_dpc, vha, 0x4019,
- "Relogin needed end.\n");
+ if (!vha->relogin_jif ||
+ time_after_eq(jiffies, vha->relogin_jif)) {
+ vha->relogin_jif = jiffies + HZ;
+ clear_bit(RELOGIN_NEEDED, &vha->dpc_flags);
+
+ ql_dbg(ql_dbg_dpc, vha, 0x4018,
+ "Relogin needed scheduled.\n");
+ qla2x00_relogin(vha);
+ ql_dbg(ql_dbg_dpc, vha, 0x4019,
+ "Relogin needed end.\n");
+ }
}
if (test_and_clear_bit(RESET_MARKER_NEEDED, &vha->dpc_flags) &&
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -4905,7 +4905,7 @@ void qla2x00_relogin(struct scsi_qla_hos
*/
if (atomic_read(&fcport->state) != FCS_ONLINE &&
fcport->login_retry && !(fcport->flags & FCF_ASYNC_SENT)) {
- fcport->login_retry--;
+
if (fcport->flags & FCF_FABRIC_DEVICE) {
ql_dbg(ql_dbg_disc, fcport->vha, 0x2108,
"%s %8phC DS %d LS %d\n", __func__,
@@ -4916,6 +4916,7 @@ void qla2x00_relogin(struct scsi_qla_hos
ea.fcport = fcport;
qla2x00_fcport_event_handler(vha, &ea);
} else {
+ fcport->login_retry--;
status = qla2x00_local_device_login(vha,
fcport);
if (status == QLA_SUCCESS) {
@@ -5898,16 +5899,21 @@ qla2x00_do_dpc(void *data)
}
/* Retry each device up to login retry count */
- if ((test_and_clear_bit(RELOGIN_NEEDED,
- &base_vha->dpc_flags)) &&
+ if (test_bit(RELOGIN_NEEDED, &base_vha->dpc_flags) &&
!test_bit(LOOP_RESYNC_NEEDED, &base_vha->dpc_flags) &&
atomic_read(&base_vha->loop_state) != LOOP_DOWN) {
- ql_dbg(ql_dbg_dpc, base_vha, 0x400d,
- "Relogin scheduled.\n");
- qla2x00_relogin(base_vha);
- ql_dbg(ql_dbg_dpc, base_vha, 0x400e,
- "Relogin end.\n");
+ if (!base_vha->relogin_jif ||
+ time_after_eq(jiffies, base_vha->relogin_jif)) {
+ base_vha->relogin_jif = jiffies + HZ;
+ clear_bit(RELOGIN_NEEDED, &base_vha->dpc_flags);
+
+ ql_dbg(ql_dbg_dpc, base_vha, 0x400d,
+ "Relogin scheduled.\n");
+ qla2x00_relogin(base_vha);
+ ql_dbg(ql_dbg_dpc, base_vha, 0x400e,
+ "Relogin end.\n");
+ }
}
loop_resync_check:
if (test_and_clear_bit(LOOP_RESYNC_NEEDED,
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 135/146] scsi: qla2xxx: Fix PRLI state check
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (133 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 134/146] scsi: qla2xxx: Fix Relogin being triggered too fast Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 136/146] scsi: qla2xxx: Fix abort command deadlock due to spinlock Greg Kroah-Hartman
` (14 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit 23c645595dab7b414f23639d0a428a07515807df upstream.
Get Port Database MBX cmd is to validate current Login state upon PRLI
completion. Current code looks at the last login state for re-validation
which was incorrect. This patch removed incorrect state check.
Fixes: 15f30a5752287 ("qla2xxx: Use IOCB interface to submit non-critical MBX.")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_mbx.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -6160,8 +6160,7 @@ int __qla24xx_parse_gpdb(struct scsi_qla
}
/* Check for logged in state. */
- if (current_login_state != PDS_PRLI_COMPLETE &&
- last_login_state != PDS_PRLI_COMPLETE) {
+ if (current_login_state != PDS_PRLI_COMPLETE) {
ql_dbg(ql_dbg_mbx, vha, 0x119a,
"Unable to verify login-state (%x/%x) for loop_id %x.\n",
current_login_state, last_login_state, fcport->loop_id);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 136/146] scsi: qla2xxx: Fix abort command deadlock due to spinlock
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (134 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 135/146] scsi: qla2xxx: Fix PRLI state check Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 137/146] scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport Greg Kroah-Hartman
` (13 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit b0dcce746b32ac573343ad39cb3dc485030de95e upstream.
Original code acquires hardware_lock to add Abort IOCB onto driver
request queue for processing. However, abort_command() will also acquire
hardware lock to look up sp pointer before issuing abort IOCB command
resulting into a deadlock. This patch safely removes the possible
deadlock scenario by removing extra spinlock.
Fixes: 6eb54715b54bb ("qla2xxx: Added interface to send explicit LOGO.")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_iocb.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -2394,7 +2394,6 @@ qla2x00_els_dcmd_iocb_timeout(void *data
struct scsi_qla_host *vha = sp->vha;
struct qla_hw_data *ha = vha->hw;
struct srb_iocb *lio = &sp->u.iocb_cmd;
- unsigned long flags = 0;
ql_dbg(ql_dbg_io, vha, 0x3069,
"%s Timeout, hdl=%x, portid=%02x%02x%02x\n",
@@ -2402,7 +2401,6 @@ qla2x00_els_dcmd_iocb_timeout(void *data
fcport->d_id.b.al_pa);
/* Abort the exchange */
- spin_lock_irqsave(&ha->hardware_lock, flags);
if (ha->isp_ops->abort_command(sp)) {
ql_dbg(ql_dbg_io, vha, 0x3070,
"mbx abort_command failed.\n");
@@ -2410,7 +2408,6 @@ qla2x00_els_dcmd_iocb_timeout(void *data
ql_dbg(ql_dbg_io, vha, 0x3071,
"mbx abort_command success.\n");
}
- spin_unlock_irqrestore(&ha->hardware_lock, flags);
complete(&lio->u.els_logo.comp);
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 137/146] scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (135 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 136/146] scsi: qla2xxx: Fix abort command deadlock due to spinlock Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 138/146] scsi: qla2xxx: Fix scan state field for fcport Greg Kroah-Hartman
` (12 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit 063b36d6b0ad74c748d536f5cb47bac2f850a0fa upstream.
Current code manually allocate an fcport structure that is not properly
initialize. Replace kzalloc with qla2x00_alloc_fcport, so that all
fields are initialized. Also set set scan flag to port found
Cc: <stable@vger.kernel.org>
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_target.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -5782,7 +5782,7 @@ static fc_port_t *qlt_get_port_database(
unsigned long flags;
u8 newfcport = 0;
- fcport = kzalloc(sizeof(*fcport), GFP_KERNEL);
+ fcport = qla2x00_alloc_fcport(vha, GFP_KERNEL);
if (!fcport) {
ql_dbg(ql_dbg_tgt_mgt, vha, 0xf06f,
"qla_target(%d): Allocation of tmp FC port failed",
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 138/146] scsi: qla2xxx: Fix scan state field for fcport
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (136 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 137/146] scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 139/146] scsi: qla2xxx: Clear loop id after delete Greg Kroah-Hartman
` (11 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit 76f9a2dd4c60183879a1898bcd56a1dbab19a85d upstream.
Add correct value of scan_state field indicating state of the FC port
Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_target.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -5811,6 +5811,7 @@ static fc_port_t *qlt_get_port_database(
tfcp->port_type = fcport->port_type;
tfcp->supported_classes = fcport->supported_classes;
tfcp->flags |= fcport->flags;
+ tfcp->scan_state = QLA_FCPORT_FOUND;
del = fcport;
fcport = tfcp;
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 139/146] scsi: qla2xxx: Clear loop id after delete
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (137 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 138/146] scsi: qla2xxx: Fix scan state field for fcport Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 140/146] scsi: qla2xxx: Defer processing of GS IOCB calls Greg Kroah-Hartman
` (10 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit ba743f9148e951abe1c94f89c174ec8e44fb145b upstream.
Clear loop id after delete to prevent session invalidation of stale
session.
Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_target.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -985,7 +985,7 @@ static void qlt_free_session_done(struct
qlt_send_first_logo(vha, &logo);
}
- if (sess->logout_on_delete) {
+ if (sess->logout_on_delete && sess->loop_id != FC_NO_LOOP_ID) {
int rc;
rc = qla2x00_post_async_logout_work(vha, sess, NULL);
@@ -1044,8 +1044,7 @@ static void qlt_free_session_done(struct
sess->login_succ = 0;
}
- if (sess->chip_reset != ha->base_qpair->chip_reset)
- qla2x00_clear_loop_id(sess);
+ qla2x00_clear_loop_id(sess);
if (sess->conflict) {
sess->conflict->login_pause = 0;
@@ -4599,9 +4598,9 @@ qlt_find_sess_invalidate_other(scsi_qla_
"Invalidating sess %p loop_id %d wwn %llx.\n",
other_sess, other_sess->loop_id, other_wwn);
-
other_sess->keep_nport_handle = 1;
- *conflict_sess = other_sess;
+ if (other_sess->disc_state != DSC_DELETED)
+ *conflict_sess = other_sess;
qlt_schedule_sess_for_deletion(other_sess,
true);
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 140/146] scsi: qla2xxx: Defer processing of GS IOCB calls
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (138 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 139/146] scsi: qla2xxx: Clear loop id after delete Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 141/146] scsi: qla2xxx: Remove aborting ELS IOCB call issued as part of timeout Greg Kroah-Hartman
` (9 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Giridhar Malavali, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giridhar Malavali <giridhar.malavali@cavium.com>
commit 5d3300a9b8b122b4743aed5a178bf12c87e2b8c9 upstream.
This patch defers processing of GS IOCB calls from interrupt context to
avoid hardware spinlock recursion.
Following stack trace is seen
? mod_timer+0x193/0x330
? ql_dbg+0xa7/0xf0 [qla2xxx]
_raw_spin_lock_irqsave+0x31/0x40
qla2x00_start_sp+0x3b/0x250 [qla2xxx]
qla24xx_async_gnl+0x1d3/0x240 [qla2xxx]
qla24xx_fcport_handle_login+0x285/0x290 [qla2xxx]
? vprintk_func+0x20/0x50
Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Giridhar Malavali <giridhar.malavali@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_init.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -975,7 +975,7 @@ int qla24xx_fcport_handle_login(struct s
ql_dbg(ql_dbg_disc, vha, 0x20bd,
"%s %d %8phC post gnl\n",
__func__, __LINE__, fcport->port_name);
- qla24xx_async_gnl(vha, fcport);
+ qla24xx_post_gnl_work(vha, fcport);
} else {
ql_dbg(ql_dbg_disc, vha, 0x20bf,
"%s %d %8phC post login\n",
@@ -1143,7 +1143,7 @@ void qla24xx_handle_relogin_event(scsi_q
ql_dbg(ql_dbg_disc, vha, 0x20e9, "%s %d %8phC post gidpn\n",
__func__, __LINE__, fcport->port_name);
- qla24xx_async_gidpn(vha, fcport);
+ qla24xx_post_gidpn_work(vha, fcport);
return;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 141/146] scsi: qla2xxx: Remove aborting ELS IOCB call issued as part of timeout.
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (139 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 140/146] scsi: qla2xxx: Defer processing of GS IOCB calls Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 142/146] scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref Greg Kroah-Hartman
` (8 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Giridhar Malavali, Himanshu Madhani,
Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giridhar Malavali <giridhar.malavali@cavium.com>
commit bf07ef86e882013522876f7c834c8eea085f35b4 upstream.
This fix the spinlock recursion issue seen while unloading the driver.
14 [ffff9f2e21e03db8] native_queued_spin_lock_slowpath at ffffffffad0d8802
15 [ffff9f2e21e03dc0] do_raw_spin_lock at ffffffffad0d99e4
16 [ffff9f2e21e03dd8] _raw_spin_lock_irqsave at ffffffffad652471
17 [ffff9f2e21e03e00] qla2x00_els_dcmd_iocb_timeout at ffffffffc070cd63
18 [ffff9f2e21e03e40] qla2x00_sp_timeout at ffffffffc06f06d3 [qla2xxx]
19 [ffff9f2e21e03e68] call_timer_fn at ffffffffad0f97d8
20 [ffff9f2e21e03ed8] run_timer_softirq at ffffffffad0faf47
21 [ffff9f2e21e03f68] __softirqentry_text_start at ffffffffad655f32
Fixes: 6eb54715b54bb ("qla2xxx: Added interface to send explicit LOGO.")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Giridhar Malavali <giridhar.malavali@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_iocb.c | 10 ----------
1 file changed, 10 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -2392,7 +2392,6 @@ qla2x00_els_dcmd_iocb_timeout(void *data
srb_t *sp = data;
fc_port_t *fcport = sp->fcport;
struct scsi_qla_host *vha = sp->vha;
- struct qla_hw_data *ha = vha->hw;
struct srb_iocb *lio = &sp->u.iocb_cmd;
ql_dbg(ql_dbg_io, vha, 0x3069,
@@ -2400,15 +2399,6 @@ qla2x00_els_dcmd_iocb_timeout(void *data
sp->name, sp->handle, fcport->d_id.b.domain, fcport->d_id.b.area,
fcport->d_id.b.al_pa);
- /* Abort the exchange */
- if (ha->isp_ops->abort_command(sp)) {
- ql_dbg(ql_dbg_io, vha, 0x3070,
- "mbx abort_command failed.\n");
- } else {
- ql_dbg(ql_dbg_io, vha, 0x3071,
- "mbx abort_command success.\n");
- }
-
complete(&lio->u.els_logo.comp);
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 142/146] scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (140 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 141/146] scsi: qla2xxx: Remove aborting ELS IOCB call issued as part of timeout Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 143/146] scsi: qla2xxx: Fix memory leak in dual/target mode Greg Kroah-Hartman
` (7 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Giridhar Malavali,
Himanshu Madhani, Hannes Reinecke, Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit 19759033e0d0beed70421ab9258f5ede79e070ae upstream.
Fix system crash due to NULL pointer access.
qlt_plogi_ack_t and fc_port structures were not properly bound before
calling qlt_plogi_ack_unref().
RIP: 0010:qlt_plogi_ack_unref+0xa1/0x150 [qla2xxx]
Call Trace:
qla24xx_create_new_sess+0xb1/0x320 [qla2xxx]
qla2x00_do_work+0x123/0x260 [qla2xxx]
qla2x00_iocb_work_fn+0x30/0x40 [qla2xxx]
process_one_work+0x1f3/0x530
worker_thread+0x4e/0x480
kthread+0x10c/0x140
Fixes: 726b85487067d ("qla2xxx: Add framework for async fabric discovery")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_os.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -4750,11 +4750,11 @@ void qla24xx_create_new_sess(struct scsi
} else {
list_add_tail(&fcport->list, &vha->vp_fcports);
- if (pla) {
- qlt_plogi_ack_link(vha, pla, fcport,
- QLT_PLOGI_LINK_SAME_WWN);
- pla->ref_count--;
- }
+ }
+ if (pla) {
+ qlt_plogi_ack_link(vha, pla, fcport,
+ QLT_PLOGI_LINK_SAME_WWN);
+ pla->ref_count--;
}
}
spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 143/146] scsi: qla2xxx: Fix memory leak in dual/target mode
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (141 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 142/146] scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 144/146] NFS: Fix an incorrect type in struct nfs_direct_req Greg Kroah-Hartman
` (6 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Hannes Reinecke,
Martin K. Petersen
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: himanshu.madhani@cavium.com <himanshu.madhani@cavium.com>
commit 7867b98dceb7741065c9c1b645136facad5c2e93 upstream.
When driver is loaded in Target/Dual mode, it creates QPair to support
MQ and allocates resources for each QPair. This Qpair initialization is
delayed until the FW personality is changed to Dual/Target mode by
issuing chip reset. At the time of chip reset firmware is re-initilized
in correct personality all the QPairs are initialized by sending
MBC_INITIALIZE_MULTIQ (001Fh).
This patch fixes memory leak by adding check to issue
MBC_INITIALIZE_MULTIQ command only while deleting rsp/req queue when the
flag is set for initiator mode, and clean up QPair resources correctly
during the driver unload. This MBX does not need to be issued for
Target/Dual mode because chip reset will reset ISP.
Fixes: d65237c7f0860 ("scsi: qla2xxx: Fix mailbox failure while deleting Queue pairs")
Cc: <stable@vger.kernel.org> # 4.10+
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_init.c | 4 +---
drivers/scsi/qla2xxx/qla_mid.c | 18 ++++++++++--------
2 files changed, 11 insertions(+), 11 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -8221,9 +8221,6 @@ int qla2xxx_delete_qpair(struct scsi_qla
int ret = QLA_FUNCTION_FAILED;
struct qla_hw_data *ha = qpair->hw;
- if (!vha->flags.qpairs_req_created && !vha->flags.qpairs_rsp_created)
- goto fail;
-
qpair->delete_in_progress = 1;
while (atomic_read(&qpair->ref_count))
msleep(500);
@@ -8231,6 +8228,7 @@ int qla2xxx_delete_qpair(struct scsi_qla
ret = qla25xx_delete_req_que(vha, qpair->req);
if (ret != QLA_SUCCESS)
goto fail;
+
ret = qla25xx_delete_rsp_que(vha, qpair->rsp);
if (ret != QLA_SUCCESS)
goto fail;
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -575,14 +575,15 @@ qla25xx_free_rsp_que(struct scsi_qla_hos
int
qla25xx_delete_req_que(struct scsi_qla_host *vha, struct req_que *req)
{
- int ret = -1;
+ int ret = QLA_SUCCESS;
- if (req) {
+ if (req && vha->flags.qpairs_req_created) {
req->options |= BIT_0;
ret = qla25xx_init_req_que(vha, req);
+ if (ret != QLA_SUCCESS)
+ return QLA_FUNCTION_FAILED;
}
- if (ret == QLA_SUCCESS)
- qla25xx_free_req_que(vha, req);
+ qla25xx_free_req_que(vha, req);
return ret;
}
@@ -590,14 +591,15 @@ qla25xx_delete_req_que(struct scsi_qla_h
int
qla25xx_delete_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp)
{
- int ret = -1;
+ int ret = QLA_SUCCESS;
- if (rsp) {
+ if (rsp && vha->flags.qpairs_rsp_created) {
rsp->options |= BIT_0;
ret = qla25xx_init_rsp_que(vha, rsp);
+ if (ret != QLA_SUCCESS)
+ return QLA_FUNCTION_FAILED;
}
- if (ret == QLA_SUCCESS)
- qla25xx_free_rsp_que(vha, rsp);
+ qla25xx_free_rsp_que(vha, rsp);
return ret;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 144/146] NFS: Fix an incorrect type in struct nfs_direct_req
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (142 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 143/146] scsi: qla2xxx: Fix memory leak in dual/target mode Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 145/146] pNFS: Prevent the layout header refcount going to zero in pnfs_roc() Greg Kroah-Hartman
` (5 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
commit d9ee65539d3eabd9ade46cca1780e3309ad0f907 upstream.
The start offset needs to be of type loff_t.
Fixed: 5fadeb47dcc5c ("nfs: count DIO good bytes correctly with mirroring")
Cc: stable@vger.kernel.org # v4.0+
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/direct.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -86,10 +86,10 @@ struct nfs_direct_req {
struct nfs_direct_mirror mirrors[NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX];
int mirror_count;
+ loff_t io_start; /* Start offset for I/O */
ssize_t count, /* bytes actually processed */
max_count, /* max expected count */
bytes_left, /* bytes left to be sent */
- io_start, /* start of IO */
error; /* any reported error */
struct completion completion; /* wait for i/o completion */
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 145/146] pNFS: Prevent the layout header refcount going to zero in pnfs_roc()
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (143 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 144/146] NFS: Fix an incorrect type in struct nfs_direct_req Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 15:25 ` [PATCH 4.15 146/146] NFS: Fix unstable write completion Greg Kroah-Hartman
` (4 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tigran Mkrtchyan, Trond Myklebust
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
commit 9c6376ebddad585da4238532dd6d90ae23ffee67 upstream.
Ensure that we hold a reference to the layout header when processing
the pNFS return-on-close so that the refcount value does not inadvertently
go to zero.
Reported-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Cc: stable@vger.kernel.org # v4.10+
Tested-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/pnfs.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -292,8 +292,11 @@ pnfs_detach_layout_hdr(struct pnfs_layou
void
pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo)
{
- struct inode *inode = lo->plh_inode;
+ struct inode *inode;
+ if (!lo)
+ return;
+ inode = lo->plh_inode;
pnfs_layoutreturn_before_put_layout_hdr(lo);
if (refcount_dec_and_lock(&lo->plh_refcount, &inode->i_lock)) {
@@ -1241,10 +1244,12 @@ retry:
spin_lock(&ino->i_lock);
lo = nfsi->layout;
if (!lo || !pnfs_layout_is_valid(lo) ||
- test_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags))
+ test_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags)) {
+ lo = NULL;
goto out_noroc;
+ }
+ pnfs_get_layout_hdr(lo);
if (test_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) {
- pnfs_get_layout_hdr(lo);
spin_unlock(&ino->i_lock);
wait_on_bit(&lo->plh_flags, NFS_LAYOUT_RETURN,
TASK_UNINTERRUPTIBLE);
@@ -1312,10 +1317,12 @@ out_noroc:
struct pnfs_layoutdriver_type *ld = NFS_SERVER(ino)->pnfs_curr_ld;
if (ld->prepare_layoutreturn)
ld->prepare_layoutreturn(args);
+ pnfs_put_layout_hdr(lo);
return true;
}
if (layoutreturn)
pnfs_send_layoutreturn(lo, &stateid, iomode, true);
+ pnfs_put_layout_hdr(lo);
return false;
}
^ permalink raw reply [flat|nested] 160+ messages in thread* [PATCH 4.15 146/146] NFS: Fix unstable write completion
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (144 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 145/146] pNFS: Prevent the layout header refcount going to zero in pnfs_roc() Greg Kroah-Hartman
@ 2018-03-13 15:25 ` Greg Kroah-Hartman
2018-03-13 20:19 ` [PATCH 4.15 000/146] 4.15.10-stable review kernelci.org bot
` (3 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-13 15:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Scott Mayhew, Trond Myklebust
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
commit c4f24df942a181699c5bab01b8e5e82b925f77f3 upstream.
We do want to respect the FLUSH_SYNC argument to nfs_commit_inode() to
ensure that all outstanding COMMIT requests to the inode in question are
complete. Currently we may exit early from both nfs_commit_inode() and
nfs_write_inode() even if there are COMMIT requests in flight, or unstable
writes on the commit list.
In order to get the right semantics w.r.t. sync_inode(), we don't need
to have nfs_commit_inode() reset the inode dirty flags when called from
nfs_wb_page() and/or nfs_wb_all(). We just need to ensure that
nfs_write_inode() leaves them in the right state if there are outstanding
commits, or stable pages.
Reported-by: Scott Mayhew <smayhew@redhat.com>
Fixes: dc4fd9ab01ab ("nfs: don't wait on commit in nfs_commit_inode()...")
Cc: stable@vger.kernel.org # v4.14+
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/write.c | 83 +++++++++++++++++++++++++++++----------------------------
1 file changed, 43 insertions(+), 40 deletions(-)
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1878,40 +1878,43 @@ int nfs_generic_commit_list(struct inode
return status;
}
-int nfs_commit_inode(struct inode *inode, int how)
+static int __nfs_commit_inode(struct inode *inode, int how,
+ struct writeback_control *wbc)
{
LIST_HEAD(head);
struct nfs_commit_info cinfo;
int may_wait = how & FLUSH_SYNC;
- int error = 0;
- int res;
+ int ret, nscan;
nfs_init_cinfo_from_inode(&cinfo, inode);
nfs_commit_begin(cinfo.mds);
- res = nfs_scan_commit(inode, &head, &cinfo);
- if (res)
- error = nfs_generic_commit_list(inode, &head, how, &cinfo);
+ for (;;) {
+ ret = nscan = nfs_scan_commit(inode, &head, &cinfo);
+ if (ret <= 0)
+ break;
+ ret = nfs_generic_commit_list(inode, &head, how, &cinfo);
+ if (ret < 0)
+ break;
+ ret = 0;
+ if (wbc && wbc->sync_mode == WB_SYNC_NONE) {
+ if (nscan < wbc->nr_to_write)
+ wbc->nr_to_write -= nscan;
+ else
+ wbc->nr_to_write = 0;
+ }
+ if (nscan < INT_MAX)
+ break;
+ cond_resched();
+ }
nfs_commit_end(cinfo.mds);
- if (res == 0)
- return res;
- if (error < 0)
- goto out_error;
- if (!may_wait)
- goto out_mark_dirty;
- error = wait_on_commit(cinfo.mds);
- if (error < 0)
- return error;
- return res;
-out_error:
- res = error;
- /* Note: If we exit without ensuring that the commit is complete,
- * we must mark the inode as dirty. Otherwise, future calls to
- * sync_inode() with the WB_SYNC_ALL flag set will fail to ensure
- * that the data is on the disk.
- */
-out_mark_dirty:
- __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
- return res;
+ if (ret || !may_wait)
+ return ret;
+ return wait_on_commit(cinfo.mds);
+}
+
+int nfs_commit_inode(struct inode *inode, int how)
+{
+ return __nfs_commit_inode(inode, how, NULL);
}
EXPORT_SYMBOL_GPL(nfs_commit_inode);
@@ -1921,11 +1924,11 @@ int nfs_write_inode(struct inode *inode,
int flags = FLUSH_SYNC;
int ret = 0;
- /* no commits means nothing needs to be done */
- if (!atomic_long_read(&nfsi->commit_info.ncommit))
- return ret;
-
if (wbc->sync_mode == WB_SYNC_NONE) {
+ /* no commits means nothing needs to be done */
+ if (!atomic_long_read(&nfsi->commit_info.ncommit))
+ goto check_requests_outstanding;
+
/* Don't commit yet if this is a non-blocking flush and there
* are a lot of outstanding writes for this mapping.
*/
@@ -1936,16 +1939,16 @@ int nfs_write_inode(struct inode *inode,
flags = 0;
}
- ret = nfs_commit_inode(inode, flags);
- if (ret >= 0) {
- if (wbc->sync_mode == WB_SYNC_NONE) {
- if (ret < wbc->nr_to_write)
- wbc->nr_to_write -= ret;
- else
- wbc->nr_to_write = 0;
- }
- return 0;
- }
+ ret = __nfs_commit_inode(inode, flags, wbc);
+ if (!ret) {
+ if (flags & FLUSH_SYNC)
+ return 0;
+ } else if (atomic_long_read(&nfsi->commit_info.ncommit))
+ goto out_mark_dirty;
+
+check_requests_outstanding:
+ if (!atomic_read(&nfsi->commit_info.rpcs_out))
+ return ret;
out_mark_dirty:
__mark_inode_dirty(inode, I_DIRTY_DATASYNC);
return ret;
^ permalink raw reply [flat|nested] 160+ messages in thread* Re: [PATCH 4.15 000/146] 4.15.10-stable review
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (145 preceding siblings ...)
2018-03-13 15:25 ` [PATCH 4.15 146/146] NFS: Fix unstable write completion Greg Kroah-Hartman
@ 2018-03-13 20:19 ` kernelci.org bot
2018-03-13 22:28 ` Guenter Roeck
` (2 subsequent siblings)
149 siblings, 0 replies; 160+ messages in thread
From: kernelci.org bot @ 2018-03-13 20:19 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuahkh, patches,
ben.hutchings, lkft-triage, stable
stable-rc/linux-4.15.y boot: 144 boots: 8 failed, 112 passed with 21 offline, 2 untried/unknown, 1 conflict (v4.15.9-147-g478762923754)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.15.y/kernel/v4.15.9-147-g478762923754/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.15.y/kernel/v4.15.9-147-g478762923754/
Tree: stable-rc
Branch: linux-4.15.y
Git Describe: v4.15.9-147-g478762923754
Git Commit: 47876292375471e74934c42b819483362073feb2
Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 77 unique boards, 22 SoC families, 17 builds out of 185
Boot Regressions Detected:
arm:
exynos_defconfig:
exynos5800-peach-pi:
lab-baylibre-seattle: failing since 1 day (last pass: v4.15.8-12-g212dd4bb587d - first fail: v4.15.9)
multi_v7_defconfig:
meson8b-odroidc1:
lab-baylibre-seattle: new failure (last pass: v4.15.8)
sun8i-a33-sinlinx-sina33:
lab-free-electrons: new failure (last pass: v4.15.9)
mvebu_v7_defconfig:
armada-375-db:
lab-free-electrons: new failure (last pass: v4.15.9)
arm64:
defconfig:
apq8016-sbc:
lab-mhart: new failure (last pass: v4.15.9)
meson-gxbb-p200:
lab-baylibre-seattle: failing since 1 day (last pass: v4.15.8 - first fail: v4.15.9)
meson-gxl-s905d-p230:
lab-baylibre-seattle: new failure (last pass: v4.15.9)
meson-gxl-s905x-khadas-vim:
lab-baylibre: new failure (last pass: v4.15.9)
meson-gxl-s905x-p212:
lab-baylibre-seattle: new failure (last pass: v4.15.9)
Boot Failures Detected:
arm:
mvebu_v7_defconfig
armada-375-db: 1 failed lab
multi_v7_defconfig
meson8b-odroidc1: 1 failed lab
sun8i-a33-sinlinx-sina33: 1 failed lab
arm64:
defconfig
apq8016-sbc: 1 failed lab
meson-gxbb-p200: 1 failed lab
meson-gxl-s905d-p230: 1 failed lab
meson-gxl-s905x-khadas-vim: 1 failed lab
meson-gxl-s905x-p212: 1 failed lab
Offline Platforms:
arm:
tegra_defconfig:
tegra124-jetson-tk1: 1 offline lab
multi_v7_defconfig:
alpine-db: 1 offline lab
am335x-boneblack: 1 offline lab
at91-sama5d4_xplained: 1 offline lab
exynos5410-odroidxu: 1 offline lab
socfpga_cyclone5_de0_sockit: 1 offline lab
sun5i-r8-chip: 1 offline lab
tegra124-jetson-tk1: 1 offline lab
vf610-colibri-eval-v3: 1 offline lab
sunxi_defconfig:
sun5i-r8-chip: 1 offline lab
imx_v6_v7_defconfig:
vf610-colibri-eval-v3: 1 offline lab
sama5_defconfig:
at91-sama5d4_xplained: 1 offline lab
exynos_defconfig:
exynos5410-odroidxu: 1 offline lab
bcm2835_defconfig:
bcm2835-rpi-b: 1 offline lab
omap2plus_defconfig:
am335x-boneblack: 1 offline lab
arm64:
defconfig:
apq8016-sbc: 1 offline lab
juno-r2: 1 offline lab
meson-gxbb-odroidc2: 1 offline lab
meson-gxl-s905x-khadas-vim: 1 offline lab
meson-gxl-s905x-nexbox-a95x: 1 offline lab
mt7622-rfb1: 1 offline lab
Conflicting Boot Failure Detected: (These likely are not failures as other labs are reporting PASS. Needs review.)
arm:
exynos_defconfig:
exynos5800-peach-pi:
lab-collabora: PASS
lab-baylibre-seattle: FAIL
---
For more info write to <info@kernelci.org>
^ permalink raw reply [flat|nested] 160+ messages in thread* Re: [PATCH 4.15 000/146] 4.15.10-stable review
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (146 preceding siblings ...)
2018-03-13 20:19 ` [PATCH 4.15 000/146] 4.15.10-stable review kernelci.org bot
@ 2018-03-13 22:28 ` Guenter Roeck
2018-03-14 7:50 ` Greg Kroah-Hartman
2018-03-14 10:20 ` Naresh Kamboju
2018-03-14 10:56 ` Greg Kroah-Hartman
149 siblings, 1 reply; 160+ messages in thread
From: Guenter Roeck @ 2018-03-13 22:28 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, shuahkh, patches, ben.hutchings,
lkft-triage, stable
On Tue, Mar 13, 2018 at 04:22:47PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.15.10 release.
> There are 146 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Mar 15 15:22:37 UTC 2018.
> Anything received after that time might be too late.
>
Build results:
total: 147 pass: 147 fail: 0
Qemu test results:
total: 141 pass: 141 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
^ permalink raw reply [flat|nested] 160+ messages in thread* Re: [PATCH 4.15 000/146] 4.15.10-stable review
2018-03-13 22:28 ` Guenter Roeck
@ 2018-03-14 7:50 ` Greg Kroah-Hartman
0 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-14 7:50 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, shuahkh, patches, ben.hutchings,
lkft-triage, stable
On Tue, Mar 13, 2018 at 03:28:00PM -0700, Guenter Roeck wrote:
> On Tue, Mar 13, 2018 at 04:22:47PM +0100, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.15.10 release.
> > There are 146 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu Mar 15 15:22:37 UTC 2018.
> > Anything received after that time might be too late.
> >
>
> Build results:
> total: 147 pass: 147 fail: 0
> Qemu test results:
> total: 141 pass: 141 fail: 0
>
> Details are available at http://kerneltests.org/builders.
Great, thanks for testing both of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 160+ messages in thread
* Re: [PATCH 4.15 000/146] 4.15.10-stable review
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (147 preceding siblings ...)
2018-03-13 22:28 ` Guenter Roeck
@ 2018-03-14 10:20 ` Naresh Kamboju
2018-03-14 10:51 ` Greg Kroah-Hartman
2018-03-14 10:56 ` Greg Kroah-Hartman
149 siblings, 1 reply; 160+ messages in thread
From: Naresh Kamboju @ 2018-03-14 10:20 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
Shuah Khan, patches, Ben Hutchings, lkft-triage, linux- stable,
Daniel Vacek
On 13 March 2018 at 20:52, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 4.15.10 release.
> There are 146 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Mar 15 15:22:37 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.15.10-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 4.15.10-rc1
>
> Trond Myklebust <trond.myklebust@primarydata.com>
> NFS: Fix unstable write completion
>
> Trond Myklebust <trond.myklebust@primarydata.com>
> pNFS: Prevent the layout header refcount going to zero in pnfs_roc()
>
> Trond Myklebust <trond.myklebust@primarydata.com>
> NFS: Fix an incorrect type in struct nfs_direct_req
>
> himanshu.madhani@cavium.com <himanshu.madhani@cavium.com>
> scsi: qla2xxx: Fix memory leak in dual/target mode
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref
>
> Giridhar Malavali <giridhar.malavali@cavium.com>
> scsi: qla2xxx: Remove aborting ELS IOCB call issued as part of timeout.
>
> Giridhar Malavali <giridhar.malavali@cavium.com>
> scsi: qla2xxx: Defer processing of GS IOCB calls
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Clear loop id after delete
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Fix scan state field for fcport
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Fix abort command deadlock due to spinlock
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Fix PRLI state check
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Fix Relogin being triggered too fast
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Relogin to target port on a cable swap
>
> Sawan Chandak <sawan.chandak@cavium.com>
> scsi: qla2xxx: Fix NPIV host cleanup in target mode
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Fix login state machine stuck at GPDB
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Serialize GPNID for multiple RSCN
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Retry switch command on time out
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Fix re-login for Nport Handle in use
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Skip IRQ affinity for Target QPairs
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Move session delete to driver work queue
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Fix gpnid error processing
>
> Quinn Tran <quinn.tran@cavium.com>
> scsi: qla2xxx: Fix system crash for Notify ack timeout handling
>
> Prarit Bhargava <prarit@redhat.com>
> x86/xen: Calculate __max_logical_packages on PV domains
>
> Javier Martinez Canillas <javierm@redhat.com>
> tpm: only attempt to disable the LPC CLKRUN if is already enabled
>
> Arnd Bergmann <arnd@arndb.de>
> tpm: remove unused variables
>
> Javier Martinez Canillas <javierm@redhat.com>
> tpm: delete the TPM_TIS_CLK_ENABLE flag
>
> Azhar Shaikh <azhar.shaikh@intel.com>
> tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd()
>
> Azhar Shaikh <azhar.shaikh@intel.com>
> tpm_tis: Move ilb_base_addr to tpm_tis_data
>
> Eric Dumazet <edumazet@google.com>
> netfilter: use skb_to_full_sk in ip6_route_me_harder
>
> Florian Westphal <fw@strlen.de>
> netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt
>
> Florian Westphal <fw@strlen.de>
> netfilter: bridge: ebt_among: add missing match size checks
>
> Florian Westphal <fw@strlen.de>
> netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets
>
> Eric Dumazet <edumazet@google.com>
> netfilter: IDLETIMER: be syzkaller friendly
>
> Paolo Abeni <pabeni@redhat.com>
> netfilter: nat: cope with negative port range
>
> Paolo Abeni <pabeni@redhat.com>
> netfilter: x_tables: fix missing timer initialization in xt_LED
>
> Eric Dumazet <edumazet@google.com>
> netfilter: xt_hashlimit: fix lock imbalance
>
> Cong Wang <xiyou.wangcong@gmail.com>
> netfilter: ipt_CLUSTERIP: fix a race condition of proc file creation
>
> Florian Westphal <fw@strlen.de>
> netfilter: add back stackpointer size checks
>
> Jerry Hoemann <jerry.hoemann@hpe.com>
> watchdog: hpwdt: Remove legacy NMI sourcing.
>
> Arnd Bergmann <arnd@arndb.de>
> watchdog: hpwdt: fix unused variable warning
>
> Jerry Hoemann <jerry.hoemann@hpe.com>
> watchdog: hpwdt: Check source of NMI
>
> Jerry Hoemann <jerry.hoemann@hpe.com>
> watchdog: hpwdt: SMBIOS check
>
> Francis Deslauriers <francis.deslauriers@efficios.com>
> x86/kprobes: Fix kernel crash when probing .entry_trampoline code
>
> Josh Poimboeuf <jpoimboe@redhat.com>
> objtool: Fix 32-bit build
>
> Josh Poimboeuf <jpoimboe@redhat.com>
> objtool: Fix another switch table detection issue
>
> Peter Zijlstra <peterz@infradead.org>
> objtool, retpolines: Integrate objtool with retpoline support more closely
>
> Peter Zijlstra <peterz@infradead.org>
> objtool: Add module specific retpoline rules
>
> Peter Zijlstra <peterz@infradead.org>
> objtool: Add retpoline validation
>
> Peter Zijlstra <peterz@infradead.org>
> objtool: Use existing global variables for options
>
> Peter Zijlstra <peterz@infradead.org>
> x86/mm/sme, objtool: Annotate indirect call in sme_encrypt_execute()
>
> Peter Zijlstra <peterz@infradead.org>
> x86/boot, objtool: Annotate indirect jump in secondary_startup_64()
>
> Peter Zijlstra <peterz@infradead.org>
> x86/paravirt, objtool: Annotate indirect calls
>
> Ingo Molnar <mingo@kernel.org>
> x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP
>
> Peter Zijlstra <peterz@infradead.org>
> x86/speculation, objtool: Annotate indirect calls/jumps for objtool
>
> David Woodhouse <dwmw@amazon.co.uk>
> x86/retpoline: Support retpoline builds with Clang
>
> David Woodhouse <dwmw@amazon.co.uk>
> x86/speculation: Use IBRS if available before calling into firmware
>
> David Woodhouse <dwmw@amazon.co.uk>
> Revert "x86/retpoline: Simplify vmexit_fill_RSB()"
>
> Jan Beulich <JBeulich@suse.com>
> x86-64/realmode: Add instruction suffix
>
> Jan Beulich <JBeulich@suse.com>
> x86/LDT: Avoid warning in 32-bit builds with older gcc
>
> Jan Beulich <JBeulich@suse.com>
> x86/IO-APIC: Avoid warning in 32-bit builds
>
> Jan Beulich <JBeulich@suse.com>
> x86/asm: Improve how GEN_*_SUFFIXED_RMWcc() specify clobbers
>
> Jann Horn <jannh@google.com>
> x86/mm: Remove stale comment about KMEMCHECK
>
> Dominik Brodowski <linux@dominikbrodowski.net>
> x86/entry/64: Use 'xorl' for faster register clearing
>
> Dominik Brodowski <linux@dominikbrodowski.net>
> x86/entry: Reduce the code footprint of the 'idtentry' macro
>
> Dan Williams <dan.j.williams@intel.com>
> nospec: Include <asm/barrier.h> dependency
>
> Dan Williams <dan.j.williams@intel.com>
> nospec: Kill array_index_nospec_mask_check()
>
> Paul Burton <paul.burton@mips.com>
> MIPS: CPC: Map registers using DT in mips_cpc_default_phys_base()
>
> Paul Burton <paul.burton@mips.com>
> dt-bindings: Document mti,mips-cpc binding
>
> himanshu.madhani@cavium.com <himanshu.madhani@cavium.com>
> scsi: qla2xxx: Fix recursion while sending terminate exchange
>
> himanshu.madhani@cavium.com <himanshu.madhani@cavium.com>
> scsi: qla2xxx: Fix NULL pointer crash due to probe failure
>
> Dennis Wassenberg <dennis.wassenberg@secunet.com>
> ALSA: hda: add dock and led support for HP ProBook 640 G2
>
> Dennis Wassenberg <dennis.wassenberg@secunet.com>
> ALSA: hda: add dock and led support for HP EliteBook 820 G3
>
> Hui Wang <hui.wang@canonical.com>
> ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: seq: More protection for concurrent write and ioctl races
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: seq: Don't allow resizing pool in use
>
> Dennis Wassenberg <dennis.wassenberg@secunet.com>
> ALSA: hda/realtek - Make dock sound work on ThinkPad L570
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520
>
> Benjamin Berg <bberg@redhat.com>
> ALSA: hda/realtek: Limit mic boost on T480
>
> Kailang Yang <kailang@realtek.com>
> ALSA: hda/realtek - Add headset mode support for Dell laptop
>
> Kailang Yang <kailang@realtek.com>
> ALSA: hda/realtek - Add support headset mode for DELL WYSE
>
> Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> x86/spectre_v2: Don't check microcode versions when running under hypervisors
>
> Adrian Hunter <adrian.hunter@intel.com>
> perf tools: Fix trigger class trigger_on()
>
> Seunghun Han <kkamagui@gmail.com>
> x86/MCE: Serialize sysfs changes
>
> Tony Luck <tony.luck@intel.com>
> x86/MCE: Save microcode revision in machine check records
>
> Michael Lyle <mlyle@lyle.org>
> bcache: don't attach backing with duplicate UUID
>
> Tang Junhui <tang.junhui@zte.com.cn>
> bcache: fix crashes in duplicate cache device register
>
> Sergey Gorenko <sergeygo@mellanox.com>
> IB/mlx5: Fix incorrect size of klms in the memory region
>
> Arnd Bergmann <arnd@arndb.de>
> dm bufio: avoid false-positive Wmaybe-uninitialized warning
>
> James Hogan <jhogan@kernel.org>
> kbuild: Handle builtin dtb file names containing hyphens
>
> Christoph Hellwig <hch@lst.de>
> Revert "nvme: create 'slaves' and 'holders' entries for hidden controllers"
>
> Parav Pandit <parav@mellanox.com>
> IB/core: Fix missing RDMA cgroups release in case of failure to register device
>
> Ard Biesheuvel <ard.biesheuvel@linaro.org>
> arm64: mm: fix thinko in non-global page table attribute check
>
> David Hildenbrand <david@redhat.com>
> KVM: s390: fix memory overwrites when not using SCA entries
>
> Tiwei Bie <tiwei.bie@intel.com>
> virtio_ring: fix num_free handling in error case
>
> Ross Zwisler <ross.zwisler@linux.intel.com>
> loop: Fix lost writes caused by missing flag
>
> Matthew Wilcox <mawilcox@microsoft.com>
> Documentation/sphinx: Fix Directive import error
>
> Daniel Vacek <neelx@redhat.com>
> mm/page_alloc: fix memmap_init_zone pageblock alignment
On 4.14 and 4.15, this patch breaks booting on dragonboard 410c and
hikey 620 (both arm64). The fix has been proposed and tested but is not
yet in mainline per https://lkml.org/lkml/2018/3/12/710
A new fix proposed by Daniel is under review,
mm/page_alloc: fix boot hang in memmap_init_zone
https://lkml.org/lkml/2018/3/13/1422
^ permalink raw reply [flat|nested] 160+ messages in thread* Re: [PATCH 4.15 000/146] 4.15.10-stable review
2018-03-14 10:20 ` Naresh Kamboju
@ 2018-03-14 10:51 ` Greg Kroah-Hartman
0 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-14 10:51 UTC (permalink / raw)
To: Naresh Kamboju
Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
Shuah Khan, patches, Ben Hutchings, lkft-triage, linux- stable,
Daniel Vacek
On Wed, Mar 14, 2018 at 03:50:56PM +0530, Naresh Kamboju wrote:
> On 13 March 2018 at 20:52, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> > Daniel Vacek <neelx@redhat.com>
> > mm/page_alloc: fix memmap_init_zone pageblock alignment
>
>
> On 4.14 and 4.15, this patch breaks booting on dragonboard 410c and
> hikey 620 (both arm64). The fix has been proposed and tested but is not
> yet in mainline per https://lkml.org/lkml/2018/3/12/710
>
> A new fix proposed by Daniel is under review,
> mm/page_alloc: fix boot hang in memmap_init_zone
> https://lkml.org/lkml/2018/3/13/1422
Yeah, I think I'm going to drop this patch now, and add it for the next
round.
And please learn to trim your email context...
thanks,
greg k-h
^ permalink raw reply [flat|nested] 160+ messages in thread
* Re: [PATCH 4.15 000/146] 4.15.10-stable review
2018-03-13 15:22 [PATCH 4.15 000/146] 4.15.10-stable review Greg Kroah-Hartman
` (148 preceding siblings ...)
2018-03-14 10:20 ` Naresh Kamboju
@ 2018-03-14 10:56 ` Greg Kroah-Hartman
2018-03-14 18:53 ` Naresh Kamboju
149 siblings, 1 reply; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-14 10:56 UTC (permalink / raw)
To: linux-kernel
Cc: torvalds, akpm, linux, shuahkh, patches, ben.hutchings,
lkft-triage, stable
On Tue, Mar 13, 2018 at 04:22:47PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.15.10 release.
> There are 146 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Mar 15 15:22:37 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.15.10-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.15.y
> and the diffstat can be found below.
-rc2 is out to resolve a boot problem on some ARM boards:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.15.10-rc2.gz
^ permalink raw reply [flat|nested] 160+ messages in thread* Re: [PATCH 4.15 000/146] 4.15.10-stable review
2018-03-14 10:56 ` Greg Kroah-Hartman
@ 2018-03-14 18:53 ` Naresh Kamboju
2018-03-15 10:19 ` Greg Kroah-Hartman
0 siblings, 1 reply; 160+ messages in thread
From: Naresh Kamboju @ 2018-03-14 18:53 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: open list, Ben Hutchings, Shuah Khan, lkft-triage, patches,
linux- stable, Andrew Morton, Linus Torvalds, Guenter Roeck
On 14 March 2018 at 16:26, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> On Tue, Mar 13, 2018 at 04:22:47PM +0100, Greg Kroah-Hartman wrote:
>> This is the start of the stable review cycle for the 4.15.10 release.
>> There are 146 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
>>
>> Responses should be made by Thu Mar 15 15:22:37 UTC 2018.
>> Anything received after that time might be too late.
>>
>> The whole patch series can be found in one patch at:
>> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.15.10-rc1.gz
>> or in the git tree and branch at:
>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.15.y
>> and the diffstat can be found below.
>
> -rc2 is out to resolve a boot problem on some ARM boards:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.15.10-rc2.gz
Results from Linaro’s test farm.
No regressions on arm64, arm, qemu_x86_64 and x86_64.
Summary
------------------------------------------------------------------------
kernel: 4.15.10-rc2
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.15.y
git commit: 2ad27e8a3cad093b4d4f5f7471ac80bdfb6bb372
git describe: v4.15.9-146-g2ad27e8a3cad
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.15-oe/build/v4.15.9-146-g2ad27e8a3cad
No regressions (compared to build v4.15.9-147-g478762923754)
Boards, architectures and test suites:
-------------------------------------
dragonboard-410c - arm64
* boot - pass: 22, fail: 2
* kselftest - pass: 45, skip: 20,
* libhugetlbfs - pass: 90, skip: 1,
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64, skip: 17,
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 61, skip: 2,
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 21, skip: 1,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 14,
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1002, skip: 148,
* ltp-timers-tests - pass: 12, skip: 1,
hi6220-hikey - arm64
* boot - pass: 20,
* kselftest - pass: 48, skip: 17,
* libhugetlbfs - pass: 90, skip: 1,
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64, skip: 17,
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 61, skip: 2,
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 21, skip: 1,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 10, skip: 4,
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 999, skip: 151,
* ltp-timers-tests - pass: 12, skip: 1,
juno-r2 - arm64
* boot - pass: 20,
* kselftest - pass: 48, skip: 17,
* libhugetlbfs - pass: 90, skip: 1,
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64, skip: 17,
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 61, skip: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 22,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 10, skip: 4,
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1001, skip: 149,
* ltp-timers-tests - pass: 12, skip: 1,
qemu_x86_64
* boot - pass: 20,
* kselftest - pass: 61, skip: 21,
* libhugetlbfs - pass: 90, skip: 1,
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64, skip: 17,
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 57, skip: 6,
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 22,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 13, skip: 1,
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1002, skip: 148,
* ltp-timers-tests - pass: 12, skip: 1,
x15 - arm
* boot - pass: 20,
* kselftest - pass: 41, skip: 21,
* libhugetlbfs - pass: 87, skip: 1,
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 63, skip: 18,
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 61, skip: 2,
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 20, skip: 2,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 13, skip: 1,
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1053, skip: 97,
* ltp-timers-tests - pass: 12, skip: 1,
x86_64
* boot - pass: 20,
* kselftest - pass: 61, skip: 19,
* libhugetlbfs - pass: 90, skip: 1,
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64, skip: 17,
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 62, skip: 1,
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 22,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 9, skip: 5,
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1031, skip: 119,
* ltp-timers-tests - pass: 12, skip: 1,
--
Linaro QA (beta)
https://qa-reports.linaro.org
>
> _______________________________________________
> Lkft-triage mailing list
> Lkft-triage@lists.linaro.org
> https://lists.linaro.org/mailman/listinfo/lkft-triage
^ permalink raw reply [flat|nested] 160+ messages in thread
* Re: [PATCH 4.15 000/146] 4.15.10-stable review
2018-03-14 18:53 ` Naresh Kamboju
@ 2018-03-15 10:19 ` Greg Kroah-Hartman
0 siblings, 0 replies; 160+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-15 10:19 UTC (permalink / raw)
To: Naresh Kamboju
Cc: open list, Ben Hutchings, Shuah Khan, lkft-triage, patches,
linux- stable, Andrew Morton, Linus Torvalds, Guenter Roeck
On Thu, Mar 15, 2018 at 12:23:36AM +0530, Naresh Kamboju wrote:
> On 14 March 2018 at 16:26, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> > On Tue, Mar 13, 2018 at 04:22:47PM +0100, Greg Kroah-Hartman wrote:
> >> This is the start of the stable review cycle for the 4.15.10 release.
> >> There are 146 patches in this series, all will be posted as a response
> >> to this one. If anyone has any issues with these being applied, please
> >> let me know.
> >>
> >> Responses should be made by Thu Mar 15 15:22:37 UTC 2018.
> >> Anything received after that time might be too late.
> >>
> >> The whole patch series can be found in one patch at:
> >> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.15.10-rc1.gz
> >> or in the git tree and branch at:
> >> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.15.y
> >> and the diffstat can be found below.
> >
> > -rc2 is out to resolve a boot problem on some ARM boards:
> > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.15.10-rc2.gz
>
> Results from Linaro’s test farm.
> No regressions on arm64, arm, qemu_x86_64 and x86_64.
Great, thanks for testing both of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 160+ messages in thread