December 2022 - Linux-stable-mirror

[PATCH v2 09/13] arm64: dts: qcom: sm8350: Fix the base addresses of LLCC banks

by Manivannan Sadhasivam

The LLCC block has several banks each with a different base address and holes in between. So it is not a correct approach to cover these banks with a single offset/size. Instead, the individual bank's base address needs to be specified in devicetree with the exact size. Also, let's get rid of reg-names property as it is not needed anymore. The driver is expected to parse the reg field based on index to get the addresses of each LLCC banks. Cc: <stable(a)vger.kernel.org> # 5.17 Fixes: 9ac8999e8d6c ("arm64: dts: qcom: sm8350: Add LLCC node") Reported-by: Parikshit Pareek <quic_ppareek(a)quicinc.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- arch/arm64/boot/dts/qcom/sm8350.dtsi | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi index 245dce24ec59..7f76778e1bc8 100644 --- a/arch/arm64/boot/dts/qcom/sm8350.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi @@ -2513,8 +2513,9 @@ gem_noc: interconnect@9100000 { system-cache-controller@9200000 { compatible = "qcom,sm8350-llcc"; - reg = <0 0x09200000 0 0x1d0000>, <0 0x09600000 0 0x50000>; - reg-names = "llcc_base", "llcc_broadcast_base"; + reg = <0 0x09200000 0 0x58000>, <0 0x09280000 0 0x58000>, + <0 0x09300000 0 0x58000>, <0 0x09380000 0 0x58000>, + <0 0x09600000 0 0x58000>; }; usb_1: usb@a6f8800 { -- 2.25.1

2 years

2
1
0 0

[PATCH v2 08/13] arm64: dts: qcom: sm8250: Fix the base addresses of LLCC banks

by Manivannan Sadhasivam

The LLCC block has several banks each with a different base address and holes in between. So it is not a correct approach to cover these banks with a single offset/size. Instead, the individual bank's base address needs to be specified in devicetree with the exact size. Also, let's get rid of reg-names property as it is not needed anymore. The driver is expected to parse the reg field based on index to get the addresses of each LLCC banks. Cc: <stable(a)vger.kernel.org> # 5.12 Fixes: 0085a33a25cc ("arm64: dts: qcom: sm8250: Add support for LLCC block") Reported-by: Parikshit Pareek <quic_ppareek(a)quicinc.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- arch/arm64/boot/dts/qcom/sm8250.dtsi | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi index dab5579946f3..439ca5f6000e 100644 --- a/arch/arm64/boot/dts/qcom/sm8250.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi @@ -3545,8 +3545,9 @@ usb_1_dwc3: usb@a600000 { system-cache-controller@9200000 { compatible = "qcom,sm8250-llcc"; - reg = <0 0x09200000 0 0x1d0000>, <0 0x09600000 0 0x50000>; - reg-names = "llcc_base", "llcc_broadcast_base"; + reg = <0 0x09200000 0 0x50000>, <0 0x09280000 0 0x50000>, + <0 0x09300000 0 0x50000>, <0 0x09380000 0 0x50000>, + <0 0x09600000 0 0x50000>; }; usb_2: usb@a8f8800 { -- 2.25.1

2 years

2
1
0 0

[PATCH v2 07/13] arm64: dts: qcom: sm8150: Fix the base addresses of LLCC banks

by Manivannan Sadhasivam

The LLCC block has several banks each with a different base address and holes in between. So it is not a correct approach to cover these banks with a single offset/size. Instead, the individual bank's base address needs to be specified in devicetree with the exact size. Also, let's get rid of reg-names property as it is not needed anymore. The driver is expected to parse the reg field based on index to get the addresses of each LLCC banks. Cc: <stable(a)vger.kernel.org> # 5.11 Fixes: bb1f7cf68a2d ("arm64: dts: qcom: sm8150: Add LLC support for sm8150") Reported-by: Parikshit Pareek <quic_ppareek(a)quicinc.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- arch/arm64/boot/dts/qcom/sm8150.dtsi | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi index a0c57fb798d3..958655bf5b1a 100644 --- a/arch/arm64/boot/dts/qcom/sm8150.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi @@ -1762,8 +1762,9 @@ mmss_noc: interconnect@1740000 { system-cache-controller@9200000 { compatible = "qcom,sm8150-llcc"; - reg = <0 0x09200000 0 0x200000>, <0 0x09600000 0 0x50000>; - reg-names = "llcc_base", "llcc_broadcast_base"; + reg = <0 0x09200000 0 0x50000>, <0 0x09280000 0 0x50000>, + <0 0x09300000 0 0x50000>, <0 0x09380000 0 0x50000>, + <0 0x09600000 0 0x50000>; interrupts = <GIC_SPI 582 IRQ_TYPE_LEVEL_HIGH>; }; -- 2.25.1

2 years

2
1
0 0

[PATCH v2 06/13] arm64: dts: qcom: sc8280xp: Fix the base addresses of LLCC banks

by Manivannan Sadhasivam

The LLCC block has several banks each with a different base address and holes in between. So it is not a correct approach to cover these banks with a single offset/size. Instead, the individual bank's base address needs to be specified in devicetree with the exact size. Also, let's get rid of reg-names property as it is not needed anymore. The driver is expected to parse the reg field based on index to get the addresses of each LLCC banks. Cc: <stable(a)vger.kernel.org> # 6.0 Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") Reported-by: Parikshit Pareek <quic_ppareek(a)quicinc.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi index 109c9d2b684d..f8731cbccce9 100644 --- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi @@ -1856,8 +1856,11 @@ opp-6 { system-cache-controller@9200000 { compatible = "qcom,sc8280xp-llcc"; - reg = <0 0x09200000 0 0x58000>, <0 0x09600000 0 0x58000>; - reg-names = "llcc_base", "llcc_broadcast_base"; + reg = <0 0x09200000 0 0x58000>, <0 0x09280000 0 0x58000>, + <0 0x09300000 0 0x58000>, <0 0x09380000 0 0x58000>, + <0 0x09400000 0 0x58000>, <0 0x09480000 0 0x58000>, + <0 0x09500000 0 0x58000>, <0 0x09580000 0 0x58000>, + <0 0x09600000 0 0x58000>; interrupts = <GIC_SPI 582 IRQ_TYPE_LEVEL_HIGH>; }; -- 2.25.1

2 years

2
1
0 0

Project Funding.

by Andrew Schneider

Good day, Attn: Ceo/Owner. We are currently funding existing and pre-existing projects at an affordable rate. Business Loans and Expansion Capital is also welcome upon review of your project(s) brief/literature. If interested, never hesitate to contact us for further correspondence. Regards. Andrew Schneider Senior Portfolio Director Aivon Funding Group Limited.

2 years

1
0
0 0

[PATCH 2/2 v3] ceph: add ceph_lock_info support for file_lock

by xiubli＠redhat.com

From: Xiubo Li <xiubli(a)redhat.com> When ceph releasing the file_lock it will try to get the inode pointer from the fl->fl_file, which the memory could already be released by another thread in filp_close(). Because in VFS layer the fl->fl_file doesn't increase the file's reference counter. Will switch to use ceph dedicate lock info to track the inode. And in ceph_fl_release_lock() we should skip all the operations if the fl->fl_u.ceph_fl.fl_inode is not set, which should come from the request file_lock. And we will set fl->fl_u.ceph_fl.fl_inode when inserting it to the inode lock list, which is when copying the lock. Cc: stable(a)vger.kernel.org Cc: Jeff Layton <jlayton(a)kernel.org> URL: https://tracker.ceph.com/issues/57986 Signed-off-by: Xiubo Li <xiubli(a)redhat.com> --- fs/ceph/locks.c | 20 ++++++++++++++++++-- include/linux/ceph/ceph_fs_fl.h | 17 +++++++++++++++++ include/linux/fs.h | 2 ++ 3 files changed, 37 insertions(+), 2 deletions(-) create mode 100644 include/linux/ceph/ceph_fs_fl.h diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c index b191426bf880..621f38f10a88 100644 --- a/fs/ceph/locks.c +++ b/fs/ceph/locks.c @@ -34,18 +34,34 @@ static void ceph_fl_copy_lock(struct file_lock *dst, struct file_lock *src) { struct inode *inode = file_inode(dst->fl_file); atomic_inc(&ceph_inode(inode)->i_filelock_ref); + dst->fl_u.ceph_fl.fl_inode = igrab(inode); } +/* + * Do not use the 'fl->fl_file' in release function, which + * is possibly already released by another thread. + */ static void ceph_fl_release_lock(struct file_lock *fl) { - struct inode *inode = file_inode(fl->fl_file); - struct ceph_inode_info *ci = ceph_inode(inode); + struct inode *inode = fl->fl_u.ceph_fl.fl_inode; + struct ceph_inode_info *ci; + + /* + * If inode is NULL it should be a request file_lock, + * nothing we can do. + */ + if (!inode) + return; + + ci = ceph_inode(inode); if (atomic_dec_and_test(&ci->i_filelock_ref)) { /* clear error when all locks are released */ spin_lock(&ci->i_ceph_lock); ci->i_ceph_flags &= ~CEPH_I_ERROR_FILELOCK; spin_unlock(&ci->i_ceph_lock); } + fl->fl_u.ceph_fl.fl_inode = NULL; + iput(inode); } static const struct file_lock_operations ceph_fl_lock_ops = { diff --git a/include/linux/ceph/ceph_fs_fl.h b/include/linux/ceph/ceph_fs_fl.h new file mode 100644 index 000000000000..ad1cf96329f9 --- /dev/null +++ b/include/linux/ceph/ceph_fs_fl.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * ceph_fs_fl.h - Ceph lock info + * + * LGPL2 + */ + +#ifndef CEPH_FS_FL_H +#define CEPH_FS_FL_H + +#include <linux/fs.h> + +struct ceph_lock_info { + struct inode *fl_inode; +}; + +#endif diff --git a/include/linux/fs.h b/include/linux/fs.h index d6cb42b7e91c..2b03d5e375d7 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1066,6 +1066,7 @@ bool opens_in_grace(struct net *); /* that will die - we need it for nfs_lock_info */ #include <linux/nfs_fs_i.h> +#include <linux/ceph/ceph_fs_fl.h> /* * struct file_lock represents a generic "file lock". It's used to represent @@ -1119,6 +1120,7 @@ struct file_lock { int state; /* state of grant or error if -ve */ unsigned int debug_id; } afs; + struct ceph_lock_info ceph_fl; } fl_u; } __randomize_layout; -- 2.31.1

2 years

4
3
0 0

[char-misc 1/2] mei: bus: fix unlink on bus in error path

by Tomas Winkler

From: Alexander Usyskin <alexander.usyskin(a)intel.com> Unconditional call to mei_cl_unlink in mei_cl_bus_dev_release leads to call of the mei_cl_unlink without corresponding mei_cl_link. This leads to miscalculation of open_handle_count (decrease without increase). Call unlink in mei_cldev_enable fail path and remove blanket unlink from mei_cl_bus_dev_release. Fixes: 34f1166afd67 ("mei: bus: need to unlink client before freeing") Cc: <stable(a)vger.kernel.org> Signed-off-by: Alexander Usyskin <alexander.usyskin(a)intel.com> Reviewed-by: Tomas Winkler <tomas.winkler(a)intel.com> Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com> --- drivers/misc/mei/bus.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c index fdb5f7331695..3d24bdb02f0f 100644 --- a/drivers/misc/mei/bus.c +++ b/drivers/misc/mei/bus.c @@ -685,13 +685,15 @@ void *mei_cldev_dma_map(struct mei_cl_device *cldev, u8 buffer_id, size_t size) if (cl->state == MEI_FILE_UNINITIALIZED) { ret = mei_cl_link(cl); if (ret) - goto out; + goto notlinked; /* update pointers */ cl->cldev = cldev; } ret = mei_cl_dma_alloc_and_map(cl, NULL, buffer_id, size); -out: + if (ret) + mei_cl_unlink(cl); +notlinked: mutex_unlock(&bus->device_lock); if (ret) return ERR_PTR(ret); @@ -741,7 +743,7 @@ int mei_cldev_enable(struct mei_cl_device *cldev) if (cl->state == MEI_FILE_UNINITIALIZED) { ret = mei_cl_link(cl); if (ret) - goto out; + goto notlinked; /* update pointers */ cl->cldev = cldev; } @@ -768,6 +770,9 @@ int mei_cldev_enable(struct mei_cl_device *cldev) } out: + if (ret) + mei_cl_unlink(cl); +notlinked: mutex_unlock(&bus->device_lock); return ret; @@ -1135,7 +1140,6 @@ static void mei_cl_bus_dev_release(struct device *dev) mei_cl_flush_queues(cldev->cl, NULL); mei_me_cl_put(cldev->me_cl); mei_dev_bus_put(cldev->bus); - mei_cl_unlink(cldev->cl); kfree(cldev->cl); kfree(cldev); } -- 2.38.1

2 years

1
1
0 0

[PATCH net 0/4] mptcp: Fix IPv6 reqsk ops and some netlink error codes

by Mat Martineau

Patch 1 adds some missing error status values for MPTCP path management netlink commands with invalid attributes. Patches 2-4 make IPv6 subflows use the correct request_sock_ops structure and IPv6-specific destructor. The first patch in this group is a prerequisite change that simplifies the last two patches. Matthieu Baerts (3): mptcp: remove MPTCP 'ifdef' in TCP SYN cookies mptcp: dedicated request sock for subflow in v6 mptcp: use proper req destructor for IPv6 Wei Yongjun (1): mptcp: netlink: fix some error return code include/net/mptcp.h | 12 ++++++-- net/ipv4/syncookies.c | 7 ++--- net/mptcp/pm_userspace.c | 4 +++ net/mptcp/subflow.c | 61 +++++++++++++++++++++++++++++++++------- 4 files changed, 68 insertions(+), 16 deletions(-) base-commit: 01de1123322e4fe1bbd0fcdf0982511b55519c03 -- 2.38.1

2 years

2
5
0 0

[PATCH] media: uvcvideo: Fix race condition with usb_kill_urb

by Ricardo Ribalda

usb_kill_urb warranties that all the handlers are finished when it returns, but does not protect against threads that might be handling asynchronously the urb. For UVC, the function uvc_ctrl_status_event_async() takes care of control changes. If the code is executed in the following order: CPU 0 CPU 1 ===== ===== uvc_status_complete() uvc_status_stop() uvc_ctrl_status_event_work() uvc_status_start() -> FAIL Then uvc_status_start will keep failing and this error will be shown: <4>[ 5.540139] URB 0000000000000000 submitted while active drivers/usb/core/urb.c:378 usb_submit_urb+0x4c3/0x528 Let's improve the current situation, by not re-submiting the urb if there are no users on the system. Also add a flag that is clear during stop, that will capture this situation: CPU 0 CPU 1 ===== ===== uvc_status_complete() uvc_status_stop() uvc_status_start() uvc_ctrl_status_event_work() -> FAIL Hopefully, with the usb layer protection it should be enough to cover all the cases. Cc: stable(a)vger.kernel.org Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives") Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> --- To: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> To: Mauro Carvalho Chehab <mchehab(a)kernel.org> Cc: linux-media(a)vger.kernel.org Cc: linux-kernel(a)vger.kernel.org --- drivers/media/usb/uvc/uvc_ctrl.c | 9 +++++++++ drivers/media/usb/uvc/uvc_status.c | 1 + drivers/media/usb/uvc/uvcvideo.h | 2 ++ 3 files changed, 12 insertions(+) diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index c95a2229f4fa..0634a4baa2e9 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -1442,12 +1442,20 @@ static void uvc_ctrl_status_event_work(struct work_struct *work) uvc_ctrl_status_event(w->chain, w->ctrl, w->data); + mutex_lock(&dev->lock); + if (!dev->users || !dev->resubmit_urb) { + mutex_unlock(&dev->lock); + return; + } + /* Resubmit the URB. */ w->urb->interval = dev->int_ep->desc.bInterval; ret = usb_submit_urb(w->urb, GFP_KERNEL); if (ret < 0) dev_err(&dev->udev->dev, "Failed to resubmit status URB (%d).\n", ret); + dev->resubmit_urb = false; + mutex_unlock(&dev->lock); } bool uvc_ctrl_status_event_async(struct urb *urb, struct uvc_video_chain *chain, @@ -1466,6 +1474,7 @@ bool uvc_ctrl_status_event_async(struct urb *urb, struct uvc_video_chain *chain, w->chain = chain; w->ctrl = ctrl; + dev->resubmit_urb = true; schedule_work(&w->work); return true; diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c index 7518ffce22ed..3cc6e1dfaf01 100644 --- a/drivers/media/usb/uvc/uvc_status.c +++ b/drivers/media/usb/uvc/uvc_status.c @@ -310,4 +310,5 @@ int uvc_status_start(struct uvc_device *dev, gfp_t flags) void uvc_status_stop(struct uvc_device *dev) { usb_kill_urb(dev->int_urb); + dev->resubmit_urb = false; } diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h index df93db259312..9e6a52008ce5 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -539,6 +539,8 @@ struct uvc_device { struct mutex lock; /* Protects users */ unsigned int users; + bool resubmit_urb; + atomic_t nmappings; /* Video control interface */ --- base-commit: 0ec5a38bf8499f403f81cb81a0e3a60887d1993c change-id: 20221212-uvc-race-09276ea68bf8 Best regards, -- Ricardo Ribalda <ribalda(a)chromium.org>

2 years

1
0
0 0

[tip: locking/urgent] rtmutex: Add acquire semantics for rtmutex lock acquisition slow path

by tip-bot2 for Mel Gorman

The following commit has been merged into the locking/urgent branch of tip: Commit-ID: 1c0908d8e441631f5b8ba433523cf39339ee2ba0 Gitweb: https://git.kernel.org/tip/1c0908d8e441631f5b8ba433523cf39339ee2ba0 Author: Mel Gorman <mgorman(a)techsingularity.net> AuthorDate: Fri, 02 Dec 2022 10:02:23 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Mon, 12 Dec 2022 19:55:56 +01:00 rtmutex: Add acquire semantics for rtmutex lock acquisition slow path Jan Kara reported the following bug triggering on 6.0.5-rt14 running dbench on XFS on arm64. kernel BUG at fs/inode.c:625! Internal error: Oops - BUG: 0 [#1] PREEMPT_RT SMP CPU: 11 PID: 6611 Comm: dbench Tainted: G E 6.0.0-rt14-rt+ #1 pc : clear_inode+0xa0/0xc0 lr : clear_inode+0x38/0xc0 Call trace: clear_inode+0xa0/0xc0 evict+0x160/0x180 iput+0x154/0x240 do_unlinkat+0x184/0x300 __arm64_sys_unlinkat+0x48/0xc0 el0_svc_common.constprop.4+0xe4/0x2c0 do_el0_svc+0xac/0x100 el0_svc+0x78/0x200 el0t_64_sync_handler+0x9c/0xc0 el0t_64_sync+0x19c/0x1a0 It also affects 6.1-rc7-rt5 and affects a preempt-rt fork of 5.14 so this is likely a bug that existed forever and only became visible when ARM support was added to preempt-rt. The same problem does not occur on x86-64 and he also reported that converting sb->s_inode_wblist_lock to raw_spinlock_t makes the problem disappear indicating that the RT spinlock variant is the problem. Which in turn means that RT mutexes on ARM64 and any other weakly ordered architecture are affected by this independent of RT. Will Deacon observed: "I'd be more inclined to be suspicious of the slowpath tbh, as we need to make sure that we have acquire semantics on all paths where the lock can be taken. Looking at the rtmutex code, this really isn't obvious to me -- for example, try_to_take_rt_mutex() appears to be able to return via the 'takeit' label without acquire semantics and it looks like we might be relying on the caller's subsequent _unlock_ of the wait_lock for ordering, but that will give us release semantics which aren't correct." Sebastian Andrzej Siewior prototyped a fix that does work based on that comment but it was a little bit overkill and added some fences that should not be necessary. The lock owner is updated with an IRQ-safe raw spinlock held, but the spin_unlock does not provide acquire semantics which are needed when acquiring a mutex. Adds the necessary acquire semantics for lock owner updates in the slow path acquisition and the waiter bit logic. It successfully completed 10 iterations of the dbench workload while the vanilla kernel fails on the first iteration. [ bigeasy(a)linutronix.de: Initial prototype fix ] Fixes: 700318d1d7b38 ("locking/rtmutex: Use acquire/release semantics") Fixes: 23f78d4a03c5 ("[PATCH] pi-futex: rt mutex core") Reported-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Mel Gorman <mgorman(a)techsingularity.net> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20221202100223.6mevpbl7i6x5udfd@techsingularity.n… --- kernel/locking/rtmutex.c | 55 +++++++++++++++++++++++++++++------ kernel/locking/rtmutex_api.c | 6 ++-- 2 files changed, 49 insertions(+), 12 deletions(-) diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c index 7779ee8..010cf4e 100644 --- a/kernel/locking/rtmutex.c +++ b/kernel/locking/rtmutex.c @@ -89,15 +89,31 @@ static inline int __ww_mutex_check_kill(struct rt_mutex *lock, * set this bit before looking at the lock. */ -static __always_inline void -rt_mutex_set_owner(struct rt_mutex_base *lock, struct task_struct *owner) +static __always_inline struct task_struct * +rt_mutex_owner_encode(struct rt_mutex_base *lock, struct task_struct *owner) { unsigned long val = (unsigned long)owner; if (rt_mutex_has_waiters(lock)) val |= RT_MUTEX_HAS_WAITERS; - WRITE_ONCE(lock->owner, (struct task_struct *)val); + return (struct task_struct *)val; +} + +static __always_inline void +rt_mutex_set_owner(struct rt_mutex_base *lock, struct task_struct *owner) +{ + /* + * lock->wait_lock is held but explicit acquire semantics are needed + * for a new lock owner so WRITE_ONCE is insufficient. + */ + xchg_acquire(&lock->owner, rt_mutex_owner_encode(lock, owner)); +} + +static __always_inline void rt_mutex_clear_owner(struct rt_mutex_base *lock) +{ + /* lock->wait_lock is held so the unlock provides release semantics. */ + WRITE_ONCE(lock->owner, rt_mutex_owner_encode(lock, NULL)); } static __always_inline void clear_rt_mutex_waiters(struct rt_mutex_base *lock) @@ -106,7 +122,8 @@ static __always_inline void clear_rt_mutex_waiters(struct rt_mutex_base *lock) ((unsigned long)lock->owner & ~RT_MUTEX_HAS_WAITERS); } -static __always_inline void fixup_rt_mutex_waiters(struct rt_mutex_base *lock) +static __always_inline void +fixup_rt_mutex_waiters(struct rt_mutex_base *lock, bool acquire_lock) { unsigned long owner, *p = (unsigned long *) &lock->owner; @@ -172,8 +189,21 @@ static __always_inline void fixup_rt_mutex_waiters(struct rt_mutex_base *lock) * still set. */ owner = READ_ONCE(*p); - if (owner & RT_MUTEX_HAS_WAITERS) - WRITE_ONCE(*p, owner & ~RT_MUTEX_HAS_WAITERS); + if (owner & RT_MUTEX_HAS_WAITERS) { + /* + * See rt_mutex_set_owner() and rt_mutex_clear_owner() on + * why xchg_acquire() is used for updating owner for + * locking and WRITE_ONCE() for unlocking. + * + * WRITE_ONCE() would work for the acquire case too, but + * in case that the lock acquisition failed it might + * force other lockers into the slow path unnecessarily. + */ + if (acquire_lock) + xchg_acquire(p, owner & ~RT_MUTEX_HAS_WAITERS); + else + WRITE_ONCE(*p, owner & ~RT_MUTEX_HAS_WAITERS); + } } /* @@ -208,6 +238,13 @@ static __always_inline void mark_rt_mutex_waiters(struct rt_mutex_base *lock) owner = *p; } while (cmpxchg_relaxed(p, owner, owner | RT_MUTEX_HAS_WAITERS) != owner); + + /* + * The cmpxchg loop above is relaxed to avoid back-to-back ACQUIRE + * operations in the event of contention. Ensure the successful + * cmpxchg is visible. + */ + smp_mb__after_atomic(); } /* @@ -1243,7 +1280,7 @@ static int __sched __rt_mutex_slowtrylock(struct rt_mutex_base *lock) * try_to_take_rt_mutex() sets the lock waiters bit * unconditionally. Clean this up. */ - fixup_rt_mutex_waiters(lock); + fixup_rt_mutex_waiters(lock, true); return ret; } @@ -1604,7 +1641,7 @@ static int __sched __rt_mutex_slowlock(struct rt_mutex_base *lock, * try_to_take_rt_mutex() sets the waiter bit * unconditionally. We might have to fix that up. */ - fixup_rt_mutex_waiters(lock); + fixup_rt_mutex_waiters(lock, true); trace_contention_end(lock, ret); @@ -1719,7 +1756,7 @@ static void __sched rtlock_slowlock_locked(struct rt_mutex_base *lock) * try_to_take_rt_mutex() sets the waiter bit unconditionally. * We might have to fix that up: */ - fixup_rt_mutex_waiters(lock); + fixup_rt_mutex_waiters(lock, true); debug_rt_mutex_free_waiter(&waiter); trace_contention_end(lock, 0); diff --git a/kernel/locking/rtmutex_api.c b/kernel/locking/rtmutex_api.c index 9002209..cb9fdff 100644 --- a/kernel/locking/rtmutex_api.c +++ b/kernel/locking/rtmutex_api.c @@ -267,7 +267,7 @@ void __sched rt_mutex_init_proxy_locked(struct rt_mutex_base *lock, void __sched rt_mutex_proxy_unlock(struct rt_mutex_base *lock) { debug_rt_mutex_proxy_unlock(lock); - rt_mutex_set_owner(lock, NULL); + rt_mutex_clear_owner(lock); } /** @@ -382,7 +382,7 @@ int __sched rt_mutex_wait_proxy_lock(struct rt_mutex_base *lock, * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might * have to fix that up. */ - fixup_rt_mutex_waiters(lock); + fixup_rt_mutex_waiters(lock, true); raw_spin_unlock_irq(&lock->wait_lock); return ret; @@ -438,7 +438,7 @@ bool __sched rt_mutex_cleanup_proxy_lock(struct rt_mutex_base *lock, * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might * have to fix that up. */ - fixup_rt_mutex_waiters(lock); + fixup_rt_mutex_waiters(lock, false); raw_spin_unlock_irq(&lock->wait_lock);

2 years

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2022