August 2019 - Linux-stable-mirror

by CKI Project

Hello, We ran automated tests on a patchset that was proposed for merging into this kernel tree. The patches were applied to: Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Commit: f7d5b3dc4792 - Linux 5.2.10 The results of these automated tests are provided below. Overall result: FAILED (see details below) Merge: OK Compile: OK Tests: FAILED All kernel binaries, config files, and logs are available for download here: https://artifacts.cki-project.org/pipelines/125539 One or more kernel tests failed: ppc64le: ❌ xfstests: xfs We hope that these logs can help you find the problem quickly. For the full detail on our testing procedures, please scroll to the bottom of this message. Please reply to this email if you have any questions about the tests that we ran or if you have any suggestions on how to make future tests more effective. ,-. ,-. ( C ) ( K ) Continuous `-',-.`-' Kernel ( I ) Integration `-' ______________________________________________________________________________ Merge testing ------------- We cloned this repository and checked out the following commit: Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Commit: f7d5b3dc4792 - Linux 5.2.10 We grabbed the ab8cf3ce2f85 commit of the stable queue repository. We then merged the patchset with `git am`: asoc-simple_card_utils.h-care-null-dai-at-asoc_simpl.patch asoc-simple-card-fix-an-use-after-free-in-simple_dai.patch asoc-simple-card-fix-an-use-after-free-in-simple_for.patch asoc-audio-graph-card-fix-use-after-free-in-graph_da.patch asoc-audio-graph-card-fix-an-use-after-free-in-graph.patch asoc-audio-graph-card-add-missing-const-at-graph_get.patch regulator-axp20x-fix-dcdca-and-dcdcd-for-axp806.patch regulator-axp20x-fix-dcdc5-and-dcdc6-for-axp803.patch asoc-samsung-odroid-fix-an-use-after-free-issue-for-.patch asoc-samsung-odroid-fix-a-double-free-issue-for-cpu_.patch asoc-intel-bytcht_es8316-add-quirk-for-irbis-nb41-ne.patch hid-logitech-hidpp-add-usb-pid-for-a-few-more-suppor.patch hid-add-044f-b320-thrustmaster-inc.-2-in-1-dt.patch mips-kernel-only-use-i8253-clocksource-with-periodic.patch mips-fix-cacheinfo.patch libbpf-sanitize-var-to-conservative-1-byte-int.patch netfilter-ebtables-fix-a-memory-leak-bug-in-compat.patch asoc-dapm-fix-handling-of-custom_stop_condition-on-d.patch asoc-sof-use-__u32-instead-of-uint32_t-in-uapi-heade.patch spi-pxa2xx-balance-runtime-pm-enable-disable-on-erro.patch bpf-sockmap-sock_map_delete-needs-to-use-xchg.patch bpf-sockmap-synchronize_rcu-before-free-ing-map.patch bpf-sockmap-only-create-entry-if-ulp-is-not-already-.patch selftests-bpf-fix-sendmsg6_prog-on-s390.patch asoc-dapm-fix-a-memory-leak-bug.patch bonding-force-slave-speed-check-after-link-state-rec.patch net-mvpp2-don-t-check-for-3-consecutive-idle-frames-.patch selftests-forwarding-gre_multipath-enable-ipv4-forwa.patch selftests-forwarding-gre_multipath-fix-flower-filter.patch selftests-bpf-add-another-gso_segs-access.patch libbpf-fix-using-uninitialized-ioctl-results.patch can-dev-call-netif_carrier_off-in-register_candev.patch can-mcp251x-add-error-check-when-wq-alloc-failed.patch can-gw-fix-error-path-of-cgw_module_init.patch asoc-fail-card-instantiation-if-dai-format-setup-fai.patch staging-fbtft-fix-gpio-handling.patch libbpf-silence-gcc8-warning-about-string-truncation.patch st21nfca_connectivity_event_received-null-check-the-.patch st_nci_hci_connectivity_event_received-null-check-th.patch nl-mac-80211-fix-interface-combinations-on-crypto-co.patch asoc-ti-davinci-mcasp-fix-clk-pdir-handling-for-i2s-.patch asoc-rockchip-fix-mono-capture.patch asoc-ti-davinci-mcasp-correct-slot_width-posed-const.patch net-usb-qmi_wwan-add-the-broadmobi-bm818-card.patch qed-rdma-fix-the-hw_ver-returned-in-device-attribute.patch isdn-misdn-hfcsusb-fix-possible-null-pointer-derefer.patch habanalabs-fix-f-w-download-in-be-architecture.patch mac80211_hwsim-fix-possible-null-pointer-dereference.patch net-stmmac-manage-errors-returned-by-of_get_mac_addr.patch netfilter-ipset-actually-allow-destination-mac-addre.patch netfilter-ipset-copy-the-right-mac-address-in-bitmap.patch netfilter-ipset-fix-rename-concurrency-with-listing.patch rxrpc-fix-potential-deadlock.patch rxrpc-fix-the-lack-of-notification-when-sendmsg-fail.patch nvmem-use-the-same-permissions-for-eeprom-as-for-nvm.patch iwlwifi-mvm-avoid-races-in-rate-init-and-rate-perfor.patch iwlwifi-dbg_ini-move-iwl_dbg_tlv_load_bin-out-of-deb.patch iwlwifi-dbg_ini-move-iwl_dbg_tlv_free-outside-of-deb.patch iwlwifi-fix-locking-in-delayed-gtk-setting.patch iwlwifi-mvm-send-lq-command-always-async.patch enetc-fix-build-error-without-phylib.patch isdn-hfcsusb-fix-misdn-driver-crash-caused-by-transf.patch net-phy-phy_led_triggers-fix-a-possible-null-pointer.patch perf-bench-numa-fix-cpu0-binding.patch spi-pxa2xx-add-support-for-intel-tiger-lake.patch can-sja1000-force-the-string-buffer-null-terminated.patch can-peak_usb-force-the-string-buffer-null-terminated.patch asoc-amd-acp3x-use-dma_ops-of-parent-device-for-acp3.patch net-ethernet-qlogic-qed-force-the-string-buffer-null.patch enetc-select-phylib-while-config_fsl_enetc_vf-is-set.patch nfsv4-fix-a-credential-refcount-leak-in-nfs41_check_.patch nfsv4-when-recovering-state-fails-with-eagain-retry-.patch nfsv4.1-fix-open-stateid-recovery.patch nfsv4.1-only-reap-expired-delegations.patch nfsv4-fix-a-potential-sleep-while-atomic-in-nfs4_do_.patch nfs-fix-regression-whereby-fscache-errors-are-appear.patch hid-quirks-set-the-increment_usage_on_duplicate-quir.patch hid-input-fix-a4tech-horizontal-wheel-custom-usage.patch drm-rockchip-suspend-dp-late.patch smb3-fix-potential-memory-leak-when-processing-compo.patch smb3-kernel-oops-mounting-a-encryptdata-share-with-c.patch sched-deadline-fix-double-accounting-of-rq-running-b.patch sched-psi-reduce-psimon-fifo-priority.patch sched-psi-do-not-require-setsched-permission-from-th.patch s390-protvirt-avoid-memory-sharing-for-diag-308-set-.patch s390-mm-fix-dump_pagetables-top-level-page-table-wal.patch s390-put-_stext-and-_etext-into-.text-section.patch ata-rb532_cf-fix-unused-variable-warning-in-rb532_pa.patch net-cxgb3_main-fix-a-resource-leak-in-a-error-path-i.patch net-stmmac-fix-issues-when-number-of-queues-4.patch net-stmmac-tc-do-not-return-a-fragment-entry.patch drm-amdgpu-pin-the-csb-buffer-on-hw-init-for-gfx-v8.patch net-hisilicon-make-hip04_tx_reclaim-non-reentrant.patch net-hisilicon-fix-hip04-xmit-never-return-tx_busy.patch net-hisilicon-fix-dma_map_single-failed-on-arm64.patch nfsv4-ensure-state-recovery-handles-etimedout-correc.patch libata-have-ata_scsi_rw_xlat-fail-invalid-passthroug.patch libata-add-sg-safety-checks-in-sff-pio-transfers.patch x86-lib-cpu-address-missing-prototypes-warning.patch drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch block-aoe-fix-kernel-crash-due-to-atomic-sleep-when-.patch block-bfq-handle-null-return-value-by-bfq_init_rq.patch perf-ftrace-fix-failure-to-set-cpumask-when-only-one.patch perf-cpumap-fix-writing-to-illegal-memory-in-handlin.patch perf-pmu-events-fix-missing-cpu_clk_unhalted.core-ev.patch dt-bindings-riscv-fix-the-schema-compatible-string-f.patch kvm-arm64-don-t-write-junk-to-sysregs-on-reset.patch kvm-arm-don-t-write-junk-to-cp15-registers-on-reset.patch selftests-kvm-adding-config-fragments.patch iwlwifi-mvm-disable-tx-amsdu-on-older-nics.patch hid-wacom-correct-misreported-ekr-ring-values.patch hid-wacom-correct-distance-scale-for-2nd-gen-intuos-devices.patch revert-kvm-x86-mmu-zap-only-the-relevant-pages-when-removing-a-memslot.patch revert-dm-bufio-fix-deadlock-with-loop-device.patch clk-socfpga-stratix10-fix-rate-caclulationg-for-cnt_clks.patch ceph-clear-page-dirty-before-invalidate-page.patch ceph-don-t-try-fill-file_lock-on-unsuccessful-getfilelock-reply.patch libceph-fix-pg-split-vs-osd-re-connect-race.patch drm-amdgpu-gfx9-update-pg_flags-after-determining-if-gfx-off-is-possible.patch drm-nouveau-don-t-retry-infinitely-when-receiving-no-data-on-i2c-over-aux.patch scsi-ufs-fix-null-pointer-dereference-in-ufshcd_config_vreg_hpm.patch gpiolib-never-report-open-drain-source-lines-as-input-to-user-space.patch drivers-hv-vmbus-fix-virt_to_hvpfn-for-x86_pae.patch userfaultfd_release-always-remove-uffd-flags-and-clear-vm_userfaultfd_ctx.patch x86-retpoline-don-t-clobber-rflags-during-call_nospec-on-i386.patch x86-apic-handle-missing-global-clockevent-gracefully.patch x86-cpu-amd-clear-rdrand-cpuid-bit-on-amd-family-15h-16h.patch x86-boot-save-fields-explicitly-zero-out-everything-else.patch x86-boot-fix-boot-regression-caused-by-bootparam-sanitizing.patch ib-hfi1-unsafe-psn-checking-for-tid-rdma-read-resp-packet.patch ib-hfi1-add-additional-checks-when-handling-tid-rdma-read-resp-packet.patch ib-hfi1-add-additional-checks-when-handling-tid-rdma-write-data-packet.patch ib-hfi1-drop-stale-tid-rdma-packets-that-cause-tiderr.patch psi-get-poll_work-to-run-when-calling-poll-syscall-next-time.patch dm-kcopyd-always-complete-failed-jobs.patch dm-dust-use-dust-block-size-for-badblocklist-index.patch dm-btree-fix-order-of-block-initialization-in-btree_split_beneath.patch dm-integrity-fix-a-crash-due-to-bug_on-in-__journal_read_write.patch dm-raid-add-missing-cleanup-in-raid_ctr.patch dm-space-map-metadata-fix-missing-store-of-apply_bops-return-value.patch dm-table-fix-invalid-memory-accesses-with-too-high-sector-number.patch dm-zoned-improve-error-handling-in-reclaim.patch dm-zoned-improve-error-handling-in-i-o-map-code.patch dm-zoned-properly-handle-backing-device-failure.patch genirq-properly-pair-kobject_del-with-kobject_add.patch mm-z3fold.c-fix-race-between-migration-and-destruction.patch mm-page_alloc-move_freepages-should-not-examine-struct-page-of-reserved-memory.patch mm-memcontrol-flush-percpu-vmstats-before-releasing-memcg.patch mm-memcontrol-flush-percpu-vmevents-before-releasing-memcg.patch mm-page_owner-handle-thp-splits-correctly.patch Compile testing --------------- We compiled the kernel for 3 architectures: aarch64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg ppc64le: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg x86_64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg Hardware testing ---------------- We booted each kernel and ran the following tests: aarch64: Host 1: ✅ Boot test [0] ✅ xfstests: xfs [1] ✅ selinux-policy: serge-testsuite [2] ✅ lvm thinp sanity [3] ✅ storage: software RAID testing [4] 🚧 ✅ Storage blktests [5] Host 2: ✅ Boot test [0] ✅ Podman system integration test (as root) [6] ✅ Podman system integration test (as user) [6] ✅ LTP lite [7] ✅ Loopdev Sanity [8] ✅ jvm test suite [9] ✅ AMTU (Abstract Machine Test Utility) [10] ✅ LTP: openposix test suite [11] ✅ Ethernet drivers sanity [12] ✅ Networking socket: fuzz [13] ✅ audit: audit testsuite test [14] ✅ httpd: mod_ssl smoke sanity [15] ✅ iotop: sanity [16] ✅ tuned: tune-processes-through-perf [17] ✅ Usex - version 1.9-29 [18] ✅ storage: SCSI VPD [19] ✅ stress: stress-ng [20] ppc64le: Host 1: ✅ Boot test [0] ✅ Podman system integration test (as root) [6] ✅ Podman system integration test (as user) [6] ✅ LTP lite [7] ✅ Loopdev Sanity [8] ✅ jvm test suite [9] ✅ AMTU (Abstract Machine Test Utility) [10] ✅ LTP: openposix test suite [11] ✅ Ethernet drivers sanity [12] ✅ Networking socket: fuzz [13] ✅ audit: audit testsuite test [14] ✅ httpd: mod_ssl smoke sanity [15] ✅ iotop: sanity [16] ✅ tuned: tune-processes-through-perf [17] ✅ Usex - version 1.9-29 [18] Host 2: ⚡ Internal infrastructure issues prevented one or more tests (marked with ⚡⚡⚡) from running on this architecture. This is not the fault of the kernel that was tested. ✅ Boot test [0] ❌ xfstests: xfs [1] ⚡⚡⚡ selinux-policy: serge-testsuite [2] ⚡⚡⚡ lvm thinp sanity [3] ⚡⚡⚡ storage: software RAID testing [4] 🚧 ⚡⚡⚡ Storage blktests [5] x86_64: Host 1: ✅ Boot test [0] ✅ xfstests: xfs [1] ✅ selinux-policy: serge-testsuite [2] ✅ lvm thinp sanity [3] ✅ storage: software RAID testing [4] 🚧 ✅ Storage blktests [5] Host 2: ✅ Boot test [0] ✅ Podman system integration test (as root) [6] ✅ Podman system integration test (as user) [6] ✅ LTP lite [7] ✅ Loopdev Sanity [8] ✅ jvm test suite [9] ✅ AMTU (Abstract Machine Test Utility) [10] ✅ LTP: openposix test suite [11] ✅ Ethernet drivers sanity [12] ✅ Networking socket: fuzz [13] ✅ audit: audit testsuite test [14] ✅ httpd: mod_ssl smoke sanity [15] ✅ iotop: sanity [16] ✅ tuned: tune-processes-through-perf [17] ✅ pciutils: sanity smoke test [21] ✅ Usex - version 1.9-29 [18] ✅ storage: SCSI VPD [19] ✅ stress: stress-ng [20] Test source: 💚 Pull requests are welcome for new tests or improvements to existing tests! [0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution… [1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems… [2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se… [3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/lvm/… [4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/swra… [5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk [6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p… [7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution… [8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/… [9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm [10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu [11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution… [12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/… [13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/… [14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud… [15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt… [16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot… [17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun… [18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us… [19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/scsi… [20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres… [21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san… Waived tests ------------ If the test run included waived tests, they are marked with 🚧. Such tests are executed but their results are not taken into account. Tests are waived when their results are not reliable enough, e.g. when they're just introduced or are being fixed.

5 years, 4 months

2
1
0 0

[PATCH] x86/mm: Do not split_large_page() for set_kernel_text_rw()

by Song Liu

As 4k pages check was removed from cpa [1], set_kernel_text_rw() leads to split_large_page() for all kernel text pages. This means a single kprobe will put all kernel text in 4k pages: root@ ~# grep ffff81000000- /sys/kernel/debug/page_tables/kernel 0xffffffff81000000-0xffffffff82400000 20M ro PSE x pmd root@ ~# echo ONE_KPROBE >> /sys/kernel/debug/tracing/kprobe_events root@ ~# echo 1 > /sys/kernel/debug/tracing/events/kprobes/enable root@ ~# grep ffff81000000- /sys/kernel/debug/page_tables/kernel 0xffffffff81000000-0xffffffff82400000 20M ro x pte To fix this issue, introduce CPA_FLIP_TEXT_RW to bypass "Text RO" check in static_protections(). Two helper functions set_text_rw() and set_text_ro() are added to flip _PAGE_RW bit for kernel text. [1] commit 585948f4f695 ("x86/mm/cpa: Avoid the 4k pages check completely") Fixes: 585948f4f695 ("x86/mm/cpa: Avoid the 4k pages check completely") Cc: stable(a)vger.kernel.org # v4.20+ Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Dave Hansen <dave.hansen(a)intel.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Signed-off-by: Song Liu <songliubraving(a)fb.com> --- arch/x86/mm/init_64.c | 4 ++-- arch/x86/mm/mm_internal.h | 4 ++++ arch/x86/mm/pageattr.c | 34 +++++++++++++++++++++++++--------- 3 files changed, 31 insertions(+), 11 deletions(-) diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c index a6b5c653727b..5745fdcc429e 100644 --- a/arch/x86/mm/init_64.c +++ b/arch/x86/mm/init_64.c @@ -1276,7 +1276,7 @@ void set_kernel_text_rw(void) * mapping will always be RO. Refer to the comment in * static_protections() in pageattr.c */ - set_memory_rw(start, (end - start) >> PAGE_SHIFT); + set_text_rw(start, (end - start) >> PAGE_SHIFT); } void set_kernel_text_ro(void) @@ -1293,7 +1293,7 @@ void set_kernel_text_ro(void) /* * Set the kernel identity mapping for text RO. */ - set_memory_ro(start, (end - start) >> PAGE_SHIFT); + set_text_ro(start, (end - start) >> PAGE_SHIFT); } void mark_rodata_ro(void) diff --git a/arch/x86/mm/mm_internal.h b/arch/x86/mm/mm_internal.h index eeae142062ed..65b84b471770 100644 --- a/arch/x86/mm/mm_internal.h +++ b/arch/x86/mm/mm_internal.h @@ -24,4 +24,8 @@ void update_cache_mode_entry(unsigned entry, enum page_cache_mode cache); extern unsigned long tlb_single_page_flush_ceiling; +int set_text_rw(unsigned long addr, int numpages); + +int set_text_ro(unsigned long addr, int numpages); + #endif /* __X86_MM_INTERNAL_H */ diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c index 6a9a77a403c9..44a885df776d 100644 --- a/arch/x86/mm/pageattr.c +++ b/arch/x86/mm/pageattr.c @@ -66,6 +66,7 @@ static DEFINE_SPINLOCK(cpa_lock); #define CPA_ARRAY 2 #define CPA_PAGES_ARRAY 4 #define CPA_NO_CHECK_ALIAS 8 /* Do not search for aliases */ +#define CPA_FLIP_TEXT_RW 0x10 /* allow flip _PAGE_RW for kernel text */ #ifdef CONFIG_PROC_FS static unsigned long direct_pages_count[PG_LEVEL_NUM]; @@ -516,7 +517,7 @@ static inline void check_conflict(int warnlvl, pgprot_t prot, pgprotval_t val, */ static inline pgprot_t static_protections(pgprot_t prot, unsigned long start, unsigned long pfn, unsigned long npg, - int warnlvl) + int warnlvl, unsigned int cpa_flags) { pgprotval_t forbidden, res; unsigned long end; @@ -535,9 +536,11 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long start, check_conflict(warnlvl, prot, res, start, end, pfn, "Text NX"); forbidden = res; - res = protect_kernel_text_ro(start, end); - check_conflict(warnlvl, prot, res, start, end, pfn, "Text RO"); - forbidden |= res; + if (!(cpa_flags & CPA_FLIP_TEXT_RW)) { + res = protect_kernel_text_ro(start, end); + check_conflict(warnlvl, prot, res, start, end, pfn, "Text RO"); + forbidden |= res; + } /* Check the PFN directly */ res = protect_pci_bios(pfn, pfn + npg - 1); @@ -819,7 +822,7 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address, * extra conditional required here. */ chk_prot = static_protections(old_prot, lpaddr, old_pfn, numpages, - CPA_CONFLICT); + CPA_CONFLICT, cpa->flags); if (WARN_ON_ONCE(pgprot_val(chk_prot) != pgprot_val(old_prot))) { /* @@ -855,7 +858,7 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address, * protection requirement in the large page. */ new_prot = static_protections(req_prot, lpaddr, old_pfn, numpages, - CPA_DETECT); + CPA_DETECT, cpa->flags); /* * If there is a conflict, split the large page. @@ -906,7 +909,7 @@ static void split_set_pte(struct cpa_data *cpa, pte_t *pte, unsigned long pfn, if (!cpa->force_static_prot) goto set; - prot = static_protections(ref_prot, address, pfn, npg, CPA_PROTECT); + prot = static_protections(ref_prot, address, pfn, npg, CPA_PROTECT, 0); if (pgprot_val(prot) == pgprot_val(ref_prot)) goto set; @@ -1504,7 +1507,7 @@ static int __change_page_attr(struct cpa_data *cpa, int primary) cpa_inc_4k_install(); new_prot = static_protections(new_prot, address, pfn, 1, - CPA_PROTECT); + CPA_PROTECT, 0); new_prot = pgprot_clear_protnone_bits(new_prot); @@ -1707,7 +1710,7 @@ static int change_page_attr_set_clr(unsigned long *addr, int numpages, cpa.curpage = 0; cpa.force_split = force_split; - if (in_flag & (CPA_ARRAY | CPA_PAGES_ARRAY)) + if (in_flag & (CPA_ARRAY | CPA_PAGES_ARRAY | CPA_FLIP_TEXT_RW)) cpa.flags |= in_flag; /* No alias checking for _NX bit modifications */ @@ -1983,11 +1986,24 @@ int set_memory_ro(unsigned long addr, int numpages) return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_RW), 0); } +int set_text_ro(unsigned long addr, int numpages) +{ + return change_page_attr_set_clr(&addr, numpages, __pgprot(0), + __pgprot(_PAGE_RW), 0, CPA_FLIP_TEXT_RW, + NULL); +} + int set_memory_rw(unsigned long addr, int numpages) { return change_page_attr_set(&addr, numpages, __pgprot(_PAGE_RW), 0); } +int set_text_rw(unsigned long addr, int numpages) +{ + return change_page_attr_set_clr(&addr, numpages, __pgprot(_PAGE_RW), + __pgprot(0), 0, CPA_FLIP_TEXT_RW, NULL); +} + int set_memory_np(unsigned long addr, int numpages) { return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_PRESENT), 0); -- 2.17.1

5 years, 4 months

4
11
0 0

[PATCH 0/6] xfs: stable fixes for v4.19.y - circa v4.19.60

by Luis Chamberlain

Sasha, you merged my last set of XFS fixes. I asked for one patch to not be merged yet as one issue was not yet properly fixed. After some further review I have identified commits which do fix the kernel crash reported on kz#204223 [0] with generic/388, this patch set applies on top of the last one I sent you. These commits do quite a bit of code refactoring, and the actual fix lies hidden in the last commit by Darrick. Due to the amount of changes trying to extract the fix is riskier than just carring the code refactoring. If we're OK with the code refactor for stable, its my recommendation we keep the changes to match more with upstream and benefit from other fixes. The code refactoring was merged on v4.20 and Darrick's fix is the only fix upstream since the code was merged. If others disagree with this approach please speak up. I've run a full set of fstests against the following sections 12 times and have found no regressions against the baseline: xfs xfs_logdev xfs_nocrc_512 xfs_nocrc xfs_realtimedev xfs_reflink_1024 xfs_reflink_dev Review from others is appreciated. [0] https://bugzilla.kernel.org/show_bug.cgi?id=204223 Allison Henderson (4): xfs: Move fs/xfs/xfs_attr.h to fs/xfs/libxfs/xfs_attr.h xfs: Add helper function xfs_attr_try_sf_addname xfs: Add attibute set and helper functions xfs: Add attibute remove and helper functions Brian Foster (1): xfs: don't trip over uninitialized buffer on extent read of corrupted inode Darrick J. Wong (1): xfs: always rejoin held resources during defer roll fs/xfs/libxfs/xfs_attr.c | 231 ++++++++++++++++++--------------- fs/xfs/{ => libxfs}/xfs_attr.h | 2 + fs/xfs/libxfs/xfs_bmap.c | 54 +++++--- fs/xfs/libxfs/xfs_bmap.h | 1 + fs/xfs/libxfs/xfs_defer.c | 14 +- fs/xfs/xfs_dquot.c | 17 +-- 6 files changed, 183 insertions(+), 136 deletions(-) rename fs/xfs/{ => libxfs}/xfs_attr.h (98%) -- 2.18.0

5 years, 4 months

2
9
0 0

[tip: x86/urgent] x86/apic: Do not initialize LDR and DFR for bigsmp

by tip-bot2 for Bandan Das

The following commit has been merged into the x86/urgent branch of tip: Commit-ID: bae3a8d3308ee69a7dbdf145911b18dfda8ade0d Gitweb: https://git.kernel.org/tip/bae3a8d3308ee69a7dbdf145911b18dfda8ade0d Author: Bandan Das <bsd(a)redhat.com> AuthorDate: Mon, 26 Aug 2019 06:15:12 -04:00 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Mon, 26 Aug 2019 20:00:56 +02:00 x86/apic: Do not initialize LDR and DFR for bigsmp Legacy apic init uses bigsmp for smp systems with 8 and more CPUs. The bigsmp APIC implementation uses physical destination mode, but it nevertheless initializes LDR and DFR. The LDR even ends up incorrectly with multiple bit being set. This does not cause a functional problem because LDR and DFR are ignored when physical destination mode is active, but it triggered a problem on a 32-bit KVM guest which jumps into a kdump kernel. The multiple bits set unearthed a bug in the KVM APIC implementation. The code which creates the logical destination map for VCPUs ignores the disabled state of the APIC and ends up overwriting an existing valid entry and as a result, APIC calibration hangs in the guest during kdump initialization. Remove the bogus LDR/DFR initialization. This is not intended to work around the KVM APIC bug. The LDR/DFR ininitalization is wrong on its own. The issue goes back into the pre git history. The fixes tag is the commit in the bitkeeper import which introduced bigsmp support in 2003. git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git Fixes: db7b9e9f26b8 ("[PATCH] Clustered APIC setup for >8 CPU systems") Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Bandan Das <bsd(a)redhat.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lkml.kernel.org/r/20190826101513.5080-2-bsd@redhat.com --- arch/x86/kernel/apic/bigsmp_32.c | 24 ++---------------------- 1 file changed, 2 insertions(+), 22 deletions(-) diff --git a/arch/x86/kernel/apic/bigsmp_32.c b/arch/x86/kernel/apic/bigsmp_32.c index afee386..caedd8d 100644 --- a/arch/x86/kernel/apic/bigsmp_32.c +++ b/arch/x86/kernel/apic/bigsmp_32.c @@ -38,32 +38,12 @@ static int bigsmp_early_logical_apicid(int cpu) return early_per_cpu(x86_cpu_to_apicid, cpu); } -static inline unsigned long calculate_ldr(int cpu) -{ - unsigned long val, id; - - val = apic_read(APIC_LDR) & ~APIC_LDR_MASK; - id = per_cpu(x86_bios_cpu_apicid, cpu); - val |= SET_APIC_LOGICAL_ID(id); - - return val; -} - /* - * Set up the logical destination ID. - * - * Intel recommends to set DFR, LDR and TPR before enabling - * an APIC. See e.g. "AP-388 82489DX User's Manual" (Intel - * document number 292116). So here it goes... + * bigsmp enables physical destination mode + * and doesn't use LDR and DFR */ static void bigsmp_init_apic_ldr(void) { - unsigned long val; - int cpu = smp_processor_id(); - - apic_write(APIC_DFR, APIC_DFR_FLAT); - val = calculate_ldr(cpu); - apic_write(APIC_LDR, val); } static void bigsmp_setup_apic_routing(void)

5 years, 4 months

1
0
0 0

[tip: x86/urgent] x86/apic: Include the LDR when clearing out APIC registers

by tip-bot2 for Bandan Das

The following commit has been merged into the x86/urgent branch of tip: Commit-ID: 558682b5291937a70748d36fd9ba757fb25b99ae Gitweb: https://git.kernel.org/tip/558682b5291937a70748d36fd9ba757fb25b99ae Author: Bandan Das <bsd(a)redhat.com> AuthorDate: Mon, 26 Aug 2019 06:15:13 -04:00 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Mon, 26 Aug 2019 20:00:57 +02:00 x86/apic: Include the LDR when clearing out APIC registers Although APIC initialization will typically clear out the LDR before setting it, the APIC cleanup code should reset the LDR. This was discovered with a 32-bit KVM guest jumping into a kdump kernel. The stale bits in the LDR triggered a bug in the KVM APIC implementation which caused the destination mapping for VCPUs to be corrupted. Note that this isn't intended to paper over the KVM APIC bug. The kernel has to clear the LDR when resetting the APIC registers except when X2APIC is enabled. This lacks a Fixes tag because missing to clear LDR goes way back into pre git history. [ tglx: Made x2apic_enabled a function call as required ] Signed-off-by: Bandan Das <bsd(a)redhat.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lkml.kernel.org/r/20190826101513.5080-3-bsd@redhat.com --- arch/x86/kernel/apic/apic.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c index aa5495d..dba2828 100644 --- a/arch/x86/kernel/apic/apic.c +++ b/arch/x86/kernel/apic/apic.c @@ -1179,6 +1179,10 @@ void clear_local_APIC(void) apic_write(APIC_LVT0, v | APIC_LVT_MASKED); v = apic_read(APIC_LVT1); apic_write(APIC_LVT1, v | APIC_LVT_MASKED); + if (!x2apic_enabled()) { + v = apic_read(APIC_LDR) & ~APIC_LDR_MASK; + apic_write(APIC_LDR, v); + } if (maxlvt >= 4) { v = apic_read(APIC_LVTPC); apic_write(APIC_LVTPC, v | APIC_LVT_MASKED);

5 years, 4 months

1
0
0 0

[PATCH] mm/migrate: initialize pud_entry in migrate_vma()

by Ralph Campbell

When CONFIG_MIGRATE_VMA_HELPER is enabled, migrate_vma() calls migrate_vma_collect() which initializes a struct mm_walk but didn't initialize mm_walk.pud_entry. (Found by code inspection) Use a C structure initialization to make sure it is set to NULL. Fixes: 8763cb45ab967 ("mm/migrate: new memory migration helper for use with device memory") Cc: stable(a)vger.kernel.org Signed-off-by: Ralph Campbell <rcampbell(a)nvidia.com> Cc: "Jérôme Glisse" <jglisse(a)redhat.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> --- mm/migrate.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/mm/migrate.c b/mm/migrate.c index 515718392b24..a42858d8e00b 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -2340,16 +2340,13 @@ static int migrate_vma_collect_pmd(pmd_t *pmdp, static void migrate_vma_collect(struct migrate_vma *migrate) { struct mmu_notifier_range range; - struct mm_walk mm_walk; - - mm_walk.pmd_entry = migrate_vma_collect_pmd; - mm_walk.pte_entry = NULL; - mm_walk.pte_hole = migrate_vma_collect_hole; - mm_walk.hugetlb_entry = NULL; - mm_walk.test_walk = NULL; - mm_walk.vma = migrate->vma; - mm_walk.mm = migrate->vma->vm_mm; - mm_walk.private = migrate; + struct mm_walk mm_walk = { + .pmd_entry = migrate_vma_collect_pmd, + .pte_hole = migrate_vma_collect_hole, + .vma = migrate->vma, + .mm = migrate->vma->vm_mm, + .private = migrate, + }; mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, NULL, mm_walk.mm, migrate->start, -- 2.20.1

5 years, 4 months

3
3
0 0

[PATCH 4.4.y] cgroup: Disable IRQs while holding css_set_lock

by Zubin Mithra

From: Daniel Bristot de Oliveira <bristot(a)redhat.com> commit 82d6489d0fed2ec8a8c48c19e8d8a04ac8e5bb26 upstream. While testing the deadline scheduler + cgroup setup I hit this warning. [ 132.612935] ------------[ cut here ]------------ [ 132.612951] WARNING: CPU: 5 PID: 0 at kernel/softirq.c:150 __local_bh_enable_ip+0x6b/0x80 [ 132.612952] Modules linked in: (a ton of modules...) [ 132.612981] CPU: 5 PID: 0 Comm: swapper/5 Not tainted 4.7.0-rc2 #2 [ 132.612981] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.2-20150714_191134- 04/01/2014 [ 132.612982] 0000000000000086 45c8bb5effdd088b ffff88013fd43da0 ffffffff813d229e [ 132.612984] 0000000000000000 0000000000000000 ffff88013fd43de0 ffffffff810a652b [ 132.612985] 00000096811387b5 0000000000000200 ffff8800bab29d80 ffff880034c54c00 [ 132.612986] Call Trace: [ 132.612987] <IRQ> [<ffffffff813d229e>] dump_stack+0x63/0x85 [ 132.612994] [<ffffffff810a652b>] __warn+0xcb/0xf0 [ 132.612997] [<ffffffff810e76a0>] ? push_dl_task.part.32+0x170/0x170 [ 132.612999] [<ffffffff810a665d>] warn_slowpath_null+0x1d/0x20 [ 132.613000] [<ffffffff810aba5b>] __local_bh_enable_ip+0x6b/0x80 [ 132.613008] [<ffffffff817d6c8a>] _raw_write_unlock_bh+0x1a/0x20 [ 132.613010] [<ffffffff817d6c9e>] _raw_spin_unlock_bh+0xe/0x10 [ 132.613015] [<ffffffff811388ac>] put_css_set+0x5c/0x60 [ 132.613016] [<ffffffff8113dc7f>] cgroup_free+0x7f/0xa0 [ 132.613017] [<ffffffff810a3912>] __put_task_struct+0x42/0x140 [ 132.613018] [<ffffffff810e776a>] dl_task_timer+0xca/0x250 [ 132.613027] [<ffffffff810e76a0>] ? push_dl_task.part.32+0x170/0x170 [ 132.613030] [<ffffffff8111371e>] __hrtimer_run_queues+0xee/0x270 [ 132.613031] [<ffffffff81113ec8>] hrtimer_interrupt+0xa8/0x190 [ 132.613034] [<ffffffff81051a58>] local_apic_timer_interrupt+0x38/0x60 [ 132.613035] [<ffffffff817d9b0d>] smp_apic_timer_interrupt+0x3d/0x50 [ 132.613037] [<ffffffff817d7c5c>] apic_timer_interrupt+0x8c/0xa0 [ 132.613038] <EOI> [<ffffffff81063466>] ? native_safe_halt+0x6/0x10 [ 132.613043] [<ffffffff81037a4e>] default_idle+0x1e/0xd0 [ 132.613044] [<ffffffff810381cf>] arch_cpu_idle+0xf/0x20 [ 132.613046] [<ffffffff810e8fda>] default_idle_call+0x2a/0x40 [ 132.613047] [<ffffffff810e92d7>] cpu_startup_entry+0x2e7/0x340 [ 132.613048] [<ffffffff81050235>] start_secondary+0x155/0x190 [ 132.613049] ---[ end trace f91934d162ce9977 ]--- The warn is the spin_(lock|unlock)_bh(&css_set_lock) in the interrupt context. Converting the spin_lock_bh to spin_lock_irq(save) to avoid this problem - and other problems of sharing a spinlock with an interrupt. Cc: Tejun Heo <tj(a)kernel.org> Cc: Li Zefan <lizefan(a)huawei.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Juri Lelli <juri.lelli(a)arm.com> Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: cgroups(a)vger.kernel.org Cc: stable(a)vger.kernel.org # 4.5+ Cc: linux-kernel(a)vger.kernel.org Reviewed-by: Rik van Riel <riel(a)redhat.com> Reviewed-by: "Luis Claudio R. Goncalves" <lgoncalv(a)redhat.com> Signed-off-by: Daniel Bristot de Oliveira <bristot(a)redhat.com> Acked-by: Zefan Li <lizefan(a)huawei.com> Signed-off-by: Tejun Heo <tj(a)kernel.org> Signed-off-by: Zubin Mithra <zsm(a)chromium.org> --- Note: * Syzkaller triggered a warning in __local_bh_enable_ip with the following stacktrace when fuzzing a 4.4 kernel. Call Trace: [<ffffffff81cb25b1>] __dump_stack lib/dump_stack.c:15 [inline] [<ffffffff81cb25b1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [<ffffffff813e220d>] panic+0x1a2/0x364 kernel/panic.c:116 [<ffffffff813e2435>] __warn.cold+0x20/0x45 kernel/panic.c:470 [<ffffffff813e2498>] warn_slowpath_null+0x3e/0x44 kernel/panic.c:514 [<ffffffff81117276>] __local_bh_enable_ip+0x96/0xd0 kernel/softirq.c:150 [<ffffffff82a3a7c6>] __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:178 [inline] [<ffffffff82a3a7c6>] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:207 [<ffffffff812bb9bb>] spin_unlock_bh include/linux/spinlock.h:352 [inline] [<ffffffff812bb9bb>] put_css_set kernel/cgroup.c:808 [inline] [<ffffffff812bb9bb>] put_css_set+0x8b/0xb0 kernel/cgroup.c:796 [<ffffffff812ca55c>] cgroup_free+0xfc/0x1e0 kernel/cgroup.c:5812 [<ffffffff8110025d>] __put_task_struct+0xbd/0x3c0 kernel/fork.c:258 [<ffffffff8126605a>] put_task_struct include/linux/sched.h:2158 [inline] [<ffffffff8126605a>] posix_cpu_timer_del+0x1ba/0x2a0 kernel/time/posix-cpu-timers.c:418 [<ffffffff812647f1>] timer_delete_hook kernel/time/posix-timers.c:953 [inline] [<ffffffff812647f1>] itimer_delete kernel/time/posix-timers.c:996 [inline] [<ffffffff812647f1>] exit_itimers+0x121/0x280 kernel/time/posix-timers.c:1021 [<ffffffff81112df4>] do_exit+0xcf4/0x2960 kernel/exit.c:738 [<ffffffff81114be6>] do_group_exit+0x116/0x330 kernel/exit.c:893 [<ffffffff8113709b>] get_signal+0x33b/0x1a50 kernel/signal.c:2380 [<ffffffff8100b2b2>] do_signal+0x92/0x17c0 arch/x86/kernel/signal.c:737 [<ffffffff810028b0>] exit_to_usermode_loop+0xc0/0x150 arch/x86/entry/common.c:242 [<ffffffff81005300>] prepare_exit_to_usermode arch/x86/entry/common.c:276 [inline] [<ffffffff81005300>] syscall_return_slowpath+0x1c0/0x1f0 arch/x86/entry/common.c:345 [<ffffffff82a3b3f9>] int_ret_from_sys_call+0x25/0xa3 * This patch resolves conflicts related to the following changes that are not present in linux-4.4.y. 4f41fc59620f ("cgroup, kernfs: make mountinfo show properly scoped path for cgroup namespaces") ed82571b1a14 ("cgroup: mount cgroupns-root when inside non-init cgroupns") a79a908fd2b0 ("cgroup: introduce cgroup namespaces") 16af43964545 ("cgroup: implement cgroup_get_from_path() and expose cgroup_put()") * This commit is present in linux-4.9.y. * Tests run: Chrome OS tryjobs, Syzkaller reproducer kernel/cgroup.c | 123 +++++++++++++++++++++++++----------------------- 1 file changed, 64 insertions(+), 59 deletions(-) diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 5299618d6308..f1842b23686b 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -784,6 +784,8 @@ static void put_css_set_locked(struct css_set *cset) static void put_css_set(struct css_set *cset) { + unsigned long flags; + /* * Ensure that the refcount doesn't hit zero while any readers * can see it. Similar to atomic_dec_and_lock(), but for an @@ -792,9 +794,9 @@ static void put_css_set(struct css_set *cset) if (atomic_add_unless(&cset->refcount, -1, 1)) return; - spin_lock_bh(&css_set_lock); + spin_lock_irqsave(&css_set_lock, flags); put_css_set_locked(cset); - spin_unlock_bh(&css_set_lock); + spin_unlock_irqrestore(&css_set_lock, flags); } /* @@ -1017,11 +1019,11 @@ static struct css_set *find_css_set(struct css_set *old_cset, /* First see if we already have a cgroup group that matches * the desired set */ - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); cset = find_existing_css_set(old_cset, cgrp, template); if (cset) get_css_set(cset); - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); if (cset) return cset; @@ -1049,7 +1051,7 @@ static struct css_set *find_css_set(struct css_set *old_cset, * find_existing_css_set() */ memcpy(cset->subsys, template, sizeof(cset->subsys)); - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); /* Add reference counts and links from the new css_set. */ list_for_each_entry(link, &old_cset->cgrp_links, cgrp_link) { struct cgroup *c = link->cgrp; @@ -1075,7 +1077,7 @@ static struct css_set *find_css_set(struct css_set *old_cset, css_get(css); } - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); return cset; } @@ -1139,7 +1141,7 @@ static void cgroup_destroy_root(struct cgroup_root *root) * Release all the links from cset_links to this hierarchy's * root cgroup */ - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); list_for_each_entry_safe(link, tmp_link, &cgrp->cset_links, cset_link) { list_del(&link->cset_link); @@ -1147,7 +1149,7 @@ static void cgroup_destroy_root(struct cgroup_root *root) kfree(link); } - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); if (!list_empty(&root->root_list)) { list_del(&root->root_list); @@ -1551,11 +1553,11 @@ static int rebind_subsystems(struct cgroup_root *dst_root, ss->root = dst_root; css->cgroup = dcgrp; - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); hash_for_each(css_set_table, i, cset, hlist) list_move_tail(&cset->e_cset_node[ss->id], &dcgrp->e_csets[ss->id]); - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); src_root->subsys_mask &= ~(1 << ssid); scgrp->subtree_control &= ~(1 << ssid); @@ -1832,7 +1834,7 @@ static void cgroup_enable_task_cg_lists(void) { struct task_struct *p, *g; - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); if (use_task_css_set_links) goto out_unlock; @@ -1857,8 +1859,12 @@ static void cgroup_enable_task_cg_lists(void) * entry won't be deleted though the process has exited. * Do it while holding siglock so that we don't end up * racing against cgroup_exit(). + * + * Interrupts were already disabled while acquiring + * the css_set_lock, so we do not need to disable it + * again when acquiring the sighand->siglock here. */ - spin_lock_irq(&p->sighand->siglock); + spin_lock(&p->sighand->siglock); if (!(p->flags & PF_EXITING)) { struct css_set *cset = task_css_set(p); @@ -1867,11 +1873,11 @@ static void cgroup_enable_task_cg_lists(void) list_add_tail(&p->cg_list, &cset->tasks); get_css_set(cset); } - spin_unlock_irq(&p->sighand->siglock); + spin_unlock(&p->sighand->siglock); } while_each_thread(g, p); read_unlock(&tasklist_lock); out_unlock: - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); } static void init_cgroup_housekeeping(struct cgroup *cgrp) @@ -1976,13 +1982,13 @@ static int cgroup_setup_root(struct cgroup_root *root, unsigned long ss_mask) * Link the root cgroup in this hierarchy into all the css_set * objects. */ - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); hash_for_each(css_set_table, i, cset, hlist) { link_css_set(&tmp_links, cset, root_cgrp); if (css_set_populated(cset)) cgroup_update_populated(root_cgrp, true); } - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); BUG_ON(!list_empty(&root_cgrp->self.children)); BUG_ON(atomic_read(&root->nr_cgrps) != 1); @@ -2149,7 +2155,6 @@ out_free: if (ret) return ERR_PTR(ret); - dentry = kernfs_mount(fs_type, flags, root->kf_root, CGROUP_SUPER_MAGIC, &new_sb); if (IS_ERR(dentry) || !new_sb) @@ -2215,7 +2220,7 @@ char *task_cgroup_path(struct task_struct *task, char *buf, size_t buflen) char *path = NULL; mutex_lock(&cgroup_mutex); - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); root = idr_get_next(&cgroup_hierarchy_idr, &hierarchy_id); @@ -2228,7 +2233,7 @@ char *task_cgroup_path(struct task_struct *task, char *buf, size_t buflen) path = buf; } - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); mutex_unlock(&cgroup_mutex); return path; } @@ -2403,7 +2408,7 @@ static int cgroup_taskset_migrate(struct cgroup_taskset *tset, * the new cgroup. There are no failure cases after here, so this * is the commit point. */ - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); list_for_each_entry(cset, &tset->src_csets, mg_node) { list_for_each_entry_safe(task, tmp_task, &cset->mg_tasks, cg_list) { struct css_set *from_cset = task_css_set(task); @@ -2414,7 +2419,7 @@ static int cgroup_taskset_migrate(struct cgroup_taskset *tset, put_css_set_locked(from_cset); } } - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); /* * Migration is committed, all target tasks are now on dst_csets. @@ -2443,13 +2448,13 @@ out_cancel_attach: } } out_release_tset: - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); list_splice_init(&tset->dst_csets, &tset->src_csets); list_for_each_entry_safe(cset, tmp_cset, &tset->src_csets, mg_node) { list_splice_tail_init(&cset->mg_tasks, &cset->tasks); list_del_init(&cset->mg_node); } - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); return ret; } @@ -2466,14 +2471,14 @@ static void cgroup_migrate_finish(struct list_head *preloaded_csets) lockdep_assert_held(&cgroup_mutex); - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); list_for_each_entry_safe(cset, tmp_cset, preloaded_csets, mg_preload_node) { cset->mg_src_cgrp = NULL; cset->mg_dst_cset = NULL; list_del_init(&cset->mg_preload_node); put_css_set_locked(cset); } - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); } /** @@ -2623,7 +2628,7 @@ static int cgroup_migrate(struct task_struct *leader, bool threadgroup, * already PF_EXITING could be freed from underneath us unless we * take an rcu_read_lock. */ - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); rcu_read_lock(); task = leader; do { @@ -2632,7 +2637,7 @@ static int cgroup_migrate(struct task_struct *leader, bool threadgroup, break; } while_each_thread(leader, task); rcu_read_unlock(); - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); return cgroup_taskset_migrate(&tset, cgrp); } @@ -2653,7 +2658,7 @@ static int cgroup_attach_task(struct cgroup *dst_cgrp, int ret; /* look up all src csets */ - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); rcu_read_lock(); task = leader; do { @@ -2663,7 +2668,7 @@ static int cgroup_attach_task(struct cgroup *dst_cgrp, break; } while_each_thread(leader, task); rcu_read_unlock(); - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); /* prepare dst csets and commit */ ret = cgroup_migrate_prepare_dst(dst_cgrp, &preloaded_csets); @@ -2696,9 +2701,9 @@ static int cgroup_procs_write_permission(struct task_struct *task, struct cgroup *cgrp; struct inode *inode; - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); cgrp = task_cgroup_from_root(task, &cgrp_dfl_root); - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); while (!cgroup_is_descendant(dst_cgrp, cgrp)) cgrp = cgroup_parent(cgrp); @@ -2800,9 +2805,9 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) if (root == &cgrp_dfl_root) continue; - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); from_cgrp = task_cgroup_from_root(from, root); - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); retval = cgroup_attach_task(from_cgrp, tsk, false); if (retval) @@ -2927,7 +2932,7 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp) percpu_down_write(&cgroup_threadgroup_rwsem); /* look up all csses currently attached to @cgrp's subtree */ - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); css_for_each_descendant_pre(css, cgroup_css(cgrp, NULL)) { struct cgrp_cset_link *link; @@ -2939,14 +2944,14 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp) cgroup_migrate_add_src(link->cset, cgrp, &preloaded_csets); } - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); /* NULL dst indicates self on default hierarchy */ ret = cgroup_migrate_prepare_dst(NULL, &preloaded_csets); if (ret) goto out_finish; - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); list_for_each_entry(src_cset, &preloaded_csets, mg_preload_node) { struct task_struct *task, *ntask; @@ -2958,7 +2963,7 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp) list_for_each_entry_safe(task, ntask, &src_cset->tasks, cg_list) cgroup_taskset_add(task, &tset); } - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); ret = cgroup_taskset_migrate(&tset, cgrp); out_finish: @@ -3641,10 +3646,10 @@ static int cgroup_task_count(const struct cgroup *cgrp) int count = 0; struct cgrp_cset_link *link; - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); list_for_each_entry(link, &cgrp->cset_links, cset_link) count += atomic_read(&link->cset->refcount); - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); return count; } @@ -3982,7 +3987,7 @@ void css_task_iter_start(struct cgroup_subsys_state *css, memset(it, 0, sizeof(*it)); - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); it->ss = css->ss; @@ -3995,7 +4000,7 @@ void css_task_iter_start(struct cgroup_subsys_state *css, css_task_iter_advance_css_set(it); - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); } /** @@ -4013,7 +4018,7 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it) it->cur_task = NULL; } - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); if (it->task_pos) { it->cur_task = list_entry(it->task_pos, struct task_struct, @@ -4022,7 +4027,7 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it) css_task_iter_advance(it); } - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); return it->cur_task; } @@ -4036,10 +4041,10 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it) void css_task_iter_end(struct css_task_iter *it) { if (it->cur_cset) { - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); list_del(&it->iters_node); put_css_set_locked(it->cur_cset); - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); } if (it->cur_task) @@ -4068,10 +4073,10 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from) mutex_lock(&cgroup_mutex); /* all tasks in @from are being moved, all csets are source */ - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); list_for_each_entry(link, &from->cset_links, cset_link) cgroup_migrate_add_src(link->cset, to, &preloaded_csets); - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); ret = cgroup_migrate_prepare_dst(to, &preloaded_csets); if (ret) @@ -5180,10 +5185,10 @@ static int cgroup_destroy_locked(struct cgroup *cgrp) */ cgrp->self.flags &= ~CSS_ONLINE; - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); list_for_each_entry(link, &cgrp->cset_links, cset_link) link->cset->dead = true; - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); /* initiate massacre of all css's */ for_each_css(css, ssid, cgrp) @@ -5436,7 +5441,7 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns, goto out; mutex_lock(&cgroup_mutex); - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); for_each_root(root) { struct cgroup_subsys *ss; @@ -5488,7 +5493,7 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns, retval = 0; out_unlock: - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); mutex_unlock(&cgroup_mutex); kfree(buf); out: @@ -5649,13 +5654,13 @@ void cgroup_post_fork(struct task_struct *child, if (use_task_css_set_links) { struct css_set *cset; - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); cset = task_css_set(current); if (list_empty(&child->cg_list)) { get_css_set(cset); css_set_move_task(child, NULL, cset, false); } - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); } /* @@ -5699,9 +5704,9 @@ void cgroup_exit(struct task_struct *tsk) cset = task_css_set(tsk); if (!list_empty(&tsk->cg_list)) { - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); css_set_move_task(tsk, cset, NULL, false); - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); } else { get_css_set(cset); } @@ -5914,7 +5919,7 @@ static int current_css_set_cg_links_read(struct seq_file *seq, void *v) if (!name_buf) return -ENOMEM; - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); rcu_read_lock(); cset = rcu_dereference(current->cgroups); list_for_each_entry(link, &cset->cgrp_links, cgrp_link) { @@ -5925,7 +5930,7 @@ static int current_css_set_cg_links_read(struct seq_file *seq, void *v) c->root->hierarchy_id, name_buf); } rcu_read_unlock(); - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); kfree(name_buf); return 0; } @@ -5936,7 +5941,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v) struct cgroup_subsys_state *css = seq_css(seq); struct cgrp_cset_link *link; - spin_lock_bh(&css_set_lock); + spin_lock_irq(&css_set_lock); list_for_each_entry(link, &css->cgroup->cset_links, cset_link) { struct css_set *cset = link->cset; struct task_struct *task; @@ -5959,7 +5964,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v) overflow: seq_puts(seq, " ...\n"); } - spin_unlock_bh(&css_set_lock); + spin_unlock_irq(&css_set_lock); return 0; } -- 2.23.0.187.g17f5b7556c-goog

5 years, 4 months

2
2
0 0

[PATCH] IB/hfi1: Drop stale TID RDMA packets

by Mike Marciniszyn

From: Kaike Wan <kaike.wan(a)intel.com> Upstream commit d58c1834bf0d218a0bc00f8fb44874551b21da84. In a congested fabric with adaptive routing enabled, traces show that the sender could receive stale TID RDMA NAK packets that contain newer KDETH PSNs and older Verbs PSNs. If not dropped, these packets could cause the incorrect rewinding of the software flows and the incorrect completion of TID RDMA WRITE requests, and eventually leading to memory corruption and kernel crash. The current code drops stale TID RDMA ACK/NAK packets solely based on KDETH PSNs, which may lead to erroneous processing. This patch fixes the issue by also checking the Verbs PSN. Addition checks are added before rewinding the TID RDMA WRITE DATA packets. [ported to 5.2 from upstream accounting for fspsn replacing flpsn.] Fixes: 9e93e967f7b4 ("IB/hfi1: Add a function to receive TID RDMA ACK packet") Cc: <stable(a)vger.kernel.org> Reviewed-by: Mike Marciniszyn <mike.marciniszyn(a)intel.com> Signed-off-by: Kaike Wan <kaike.wan(a)intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)intel.com> Signed-off-by: Doug Ledford <dledford(a)redhat.com> --- 0 files changed diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c b/drivers/infiniband/hw/hfi1/tid_rdma.c index fe7e709..8fcad80 100644 --- a/drivers/infiniband/hw/hfi1/tid_rdma.c +++ b/drivers/infiniband/hw/hfi1/tid_rdma.c @@ -4511,7 +4511,7 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi1_packet *packet) struct rvt_swqe *wqe; struct tid_rdma_request *req; struct tid_rdma_flow *flow; - u32 aeth, psn, req_psn, ack_psn, fspsn, resync_psn, ack_kpsn; + u32 aeth, psn, req_psn, ack_psn, flpsn, resync_psn, ack_kpsn; unsigned long flags; u16 fidx; @@ -4540,6 +4540,9 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi1_packet *packet) ack_kpsn--; } + if (unlikely(qp->s_acked == qp->s_tail)) + goto ack_op_err; + wqe = rvt_get_swqe_ptr(qp, qp->s_acked); if (wqe->wr.opcode != IB_WR_TID_RDMA_WRITE) @@ -4552,7 +4555,8 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi1_packet *packet) trace_hfi1_tid_flow_rcv_tid_ack(qp, req->acked_tail, flow); /* Drop stale ACK/NAK */ - if (cmp_psn(psn, full_flow_psn(flow, flow->flow_state.spsn)) < 0) + if (cmp_psn(psn, full_flow_psn(flow, flow->flow_state.spsn)) < 0 || + cmp_psn(req_psn, flow->flow_state.resp_ib_psn) < 0) goto ack_op_err; while (cmp_psn(ack_kpsn, @@ -4714,8 +4718,12 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi1_packet *packet) switch ((aeth >> IB_AETH_CREDIT_SHIFT) & IB_AETH_CREDIT_MASK) { case 0: /* PSN sequence error */ + if (!req->flows) + break; flow = &req->flows[req->acked_tail]; - fspsn = full_flow_psn(flow, flow->flow_state.spsn); + flpsn = full_flow_psn(flow, flow->flow_state.lpsn); + if (cmp_psn(psn, flpsn) > 0) + break; trace_hfi1_tid_flow_rcv_tid_ack(qp, req->acked_tail, flow); req->r_ack_psn = mask_psn(be32_to_cpu(ohdr->bth[2]));

5 years, 4 months

2
1
0 0

[PATCH 01/10] drm/i915/dp: Fix dsc bpp calculations.

by Maarten Lankhorst

There was a integer wraparound when mode_clock became too high, and we didn't correct for the FEC overhead factor when dividing, also the calculations would break at HBR3. As a result our calculated bpp was way too high, and the link width bpp limitation never came into effect. Print out the resulting bpp calcululations as a sanity check, just in case we ever have to debug it later on again. Signed-off-by: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Fixes: d9218c8f6cf4 ("drm/i915/dp: Add helpers for Compressed BPP and Slice Count for DSC") Cc: <stable(a)vger.kernel.org> # v5.0+ Cc: Manasi Navare <manasi.d.navare(a)intel.com> --- drivers/gpu/drm/i915/display/intel_dp.c | 16 +++++++++------- drivers/gpu/drm/i915/display/intel_dp.h | 4 ++-- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c index 921ad0a2f7ba..614a25911f07 100644 --- a/drivers/gpu/drm/i915/display/intel_dp.c +++ b/drivers/gpu/drm/i915/display/intel_dp.c @@ -4323,10 +4323,10 @@ intel_dp_get_sink_irq_esi(struct intel_dp *intel_dp, u8 *sink_irq_vector) DP_DPRX_ESI_LEN; } -u16 intel_dp_dsc_get_output_bpp(int link_clock, u8 lane_count, - int mode_clock, int mode_hdisplay) +u16 intel_dp_dsc_get_output_bpp(u32 link_clock, u8 lane_count, + u32 mode_clock, u32 mode_hdisplay) { - u16 bits_per_pixel, max_bpp_small_joiner_ram; + u32 bits_per_pixel, max_bpp_small_joiner_ram; int i; /* @@ -4335,13 +4335,14 @@ u16 intel_dp_dsc_get_output_bpp(int link_clock, u8 lane_count, * FECOverhead = 2.4%, for SST -> TimeSlotsPerMTP is 1, * for MST -> TimeSlotsPerMTP has to be calculated */ - bits_per_pixel = (link_clock * lane_count * 8 * - DP_DSC_FEC_OVERHEAD_FACTOR) / - mode_clock; + bits_per_pixel = div_u64((u64)link_clock * lane_count * 8 * + DP_DSC_FEC_OVERHEAD_FACTOR, 1000ULL * mode_clock); + DRM_DEBUG_KMS("Max link bpp: %u\n", bits_per_pixel); /* Small Joiner Check: output bpp <= joiner RAM (bits) / Horiz. width */ max_bpp_small_joiner_ram = DP_DSC_MAX_SMALL_JOINER_RAM_BUFFER / mode_hdisplay; + DRM_DEBUG_KMS("Max small joiner bpp: %u\n", max_bpp_small_joiner_ram); /* * Greatest allowed DSC BPP = MIN (output BPP from avaialble Link BW @@ -4351,7 +4352,8 @@ u16 intel_dp_dsc_get_output_bpp(int link_clock, u8 lane_count, /* Error out if the max bpp is less than smallest allowed valid bpp */ if (bits_per_pixel < valid_dsc_bpp[0]) { - DRM_DEBUG_KMS("Unsupported BPP %d\n", bits_per_pixel); + DRM_DEBUG_KMS("Unsupported BPP %u, min %u\n", + bits_per_pixel, valid_dsc_bpp[0]); return 0; } diff --git a/drivers/gpu/drm/i915/display/intel_dp.h b/drivers/gpu/drm/i915/display/intel_dp.h index 657bbb1f5ed0..007d1981a33b 100644 --- a/drivers/gpu/drm/i915/display/intel_dp.h +++ b/drivers/gpu/drm/i915/display/intel_dp.h @@ -102,8 +102,8 @@ bool intel_dp_source_supports_hbr2(struct intel_dp *intel_dp); bool intel_dp_source_supports_hbr3(struct intel_dp *intel_dp); bool intel_dp_get_link_status(struct intel_dp *intel_dp, u8 *link_status); -u16 intel_dp_dsc_get_output_bpp(int link_clock, u8 lane_count, - int mode_clock, int mode_hdisplay); +u16 intel_dp_dsc_get_output_bpp(u32 link_clock, u8 lane_count, + u32 mode_clock, u32 mode_hdisplay); u8 intel_dp_dsc_get_slice_count(struct intel_dp *intel_dp, int mode_clock, int mode_hdisplay); -- 2.20.1

5 years, 4 months

3
4
0 0

[PATCH 5.1] iwlwifi: mvm: disable TX-AMSDU on older NICs

by Luca Coelho

From: Johannes Berg <johannes.berg(a)intel.com> commit cfb21b11b891b08b79be07be57c40a85bb926668 upstream. On older NICs, we occasionally see issues with A-MSDU support, where the commands in the FIFO get confused and then we see an assert EDC because the next command in the FIFO isn't TX. We've tried to isolate this issue and understand where it comes from, but haven't found any errors in building the A-MSDU in software. At least for now, disable A-MSDU support on older hardware so that users can use it again without fearing the assert. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=203315. Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Luca Coelho <luciano.coelho(a)intel.com> --- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c index 5caadaef707d..a74079b3e4bb 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c @@ -473,7 +473,19 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm) ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW); ieee80211_hw_set(hw, BUFF_MMPDU_TXQ); ieee80211_hw_set(hw, STA_MMPDU_TXQ); - ieee80211_hw_set(hw, TX_AMSDU); + /* + * On older devices, enabling TX A-MSDU occasionally leads to + * something getting messed up, the command read from the FIFO + * gets out of sync and isn't a TX command, so that we have an + * assert EDC. + * + * It's not clear where the bug is, but since we didn't used to + * support A-MSDU until moving the mac80211 iTXQs, just leave it + * for older devices. We also don't see this issue on any newer + * devices. + */ + if (mvm->cfg->device_family >= IWL_DEVICE_FAMILY_9000) + ieee80211_hw_set(hw, TX_AMSDU); ieee80211_hw_set(hw, TX_FRAG_LIST); if (iwl_mvm_has_tlc_offload(mvm)) { -- 2.23.0.rc1

5 years, 4 months

2
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror August 2019