From: Paolo Bonzini <pbonzini(a)redhat.com>
commit 6cd88243c7e03845a450795e134b488fc2afb736 upstream.
If a vCPU is outside guest mode and is scheduled out, it might be in the
process of making a memory access. A problem occurs if another vCPU uses
the PV TLB flush feature during the period when the vCPU is scheduled
out, and a virtual address has already been translated but has not yet
been accessed, because this is equivalent to using a stale TLB entry.
To avoid this, only report a vCPU as preempted if sure that the guest
is at an instruction boundary. A rescheduling request will be delivered
to the host physical CPU as an external interrupt, so for simplicity
consider any vmexit *not* instruction boundary except for external
interrupts.
It would in principle be okay to report the vCPU as preempted also
if it is sleeping in kvm_vcpu_block(): a TLB flush IPI will incur the
vmentry/vmexit overhead unnecessarily, and optimistic spinning is
also unlikely to succeed. However, leave it for later because right
now kvm_vcpu_check_block() is doing memory accesses. Even
though the TLB flush issue only applies to virtual memory address,
it's very much preferrable to be conservative.
Reported-by: Jann Horn <jannh(a)google.com>
Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com>
[OP: use VCPU_STAT() for debugfs entries]
Signed-off-by: Ovidiu Panait <ovidiu.panait(a)windriver.com>
---
5.10 backport of CVE-2022-39189 fix:
https://bugs.chromium.org/p/project-zero/issues/detail?id=2309
arch/x86/include/asm/kvm_host.h | 3 +++
arch/x86/kvm/svm/svm.c | 2 ++
arch/x86/kvm/vmx/vmx.c | 1 +
arch/x86/kvm/x86.c | 22 ++++++++++++++++++++++
4 files changed, 28 insertions(+)
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 660012ab7bfa..af4b4d3c6ff6 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -553,6 +553,7 @@ struct kvm_vcpu_arch {
u64 ia32_misc_enable_msr;
u64 smbase;
u64 smi_count;
+ bool at_instruction_boundary;
bool tpr_access_reporting;
bool xsaves_enabled;
u64 ia32_xss;
@@ -1061,6 +1062,8 @@ struct kvm_vcpu_stat {
u64 req_event;
u64 halt_poll_success_ns;
u64 halt_poll_fail_ns;
+ u64 preemption_reported;
+ u64 preemption_other;
};
struct x86_instruction_info;
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 5775983fec56..7b2b61309d8a 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -3983,6 +3983,8 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu,
static void svm_handle_exit_irqoff(struct kvm_vcpu *vcpu)
{
+ if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_INTR)
+ vcpu->arch.at_instruction_boundary = true;
}
static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu)
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 2c5d8b9f9873..16943e923902 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6510,6 +6510,7 @@ static void handle_external_interrupt_irqoff(struct kvm_vcpu *vcpu)
return;
handle_interrupt_nmi_irqoff(vcpu, gate_offset(desc));
+ vcpu->arch.at_instruction_boundary = true;
}
static void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 0ccc8d1b972c..c1351335d22f 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -231,6 +231,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
VCPU_STAT("l1d_flush", l1d_flush),
VCPU_STAT("halt_poll_success_ns", halt_poll_success_ns),
VCPU_STAT("halt_poll_fail_ns", halt_poll_fail_ns),
+ VCPU_STAT("preemption_reported", preemption_reported),
+ VCPU_STAT("preemption_other", preemption_other),
VM_STAT("mmu_shadow_zapped", mmu_shadow_zapped),
VM_STAT("mmu_pte_write", mmu_pte_write),
VM_STAT("mmu_pde_zapped", mmu_pde_zapped),
@@ -4052,6 +4054,19 @@ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu)
struct kvm_host_map map;
struct kvm_steal_time *st;
+ /*
+ * The vCPU can be marked preempted if and only if the VM-Exit was on
+ * an instruction boundary and will not trigger guest emulation of any
+ * kind (see vcpu_run). Vendor specific code controls (conservatively)
+ * when this is true, for example allowing the vCPU to be marked
+ * preempted if and only if the VM-Exit was due to a host interrupt.
+ */
+ if (!vcpu->arch.at_instruction_boundary) {
+ vcpu->stat.preemption_other++;
+ return;
+ }
+
+ vcpu->stat.preemption_reported++;
if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
return;
@@ -9357,6 +9372,13 @@ static int vcpu_run(struct kvm_vcpu *vcpu)
vcpu->arch.l1tf_flush_l1d = true;
for (;;) {
+ /*
+ * If another guest vCPU requests a PV TLB flush in the middle
+ * of instruction emulation, the rest of the emulation could
+ * use a stale page translation. Assume that any code after
+ * this point can start executing an instruction.
+ */
+ vcpu->arch.at_instruction_boundary = false;
if (kvm_vcpu_running(vcpu)) {
r = vcpu_enter_guest(vcpu);
} else {
--
2.39.1
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 08da182175db4c7f80850354849d95f2670e8cd9
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023051354-sculptor-harddisk-19a9@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
08da182175db ("drm/amd/display: fix flickering caused by S/G mode")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 08da182175db4c7f80850354849d95f2670e8cd9 Mon Sep 17 00:00:00 2001
From: Hamza Mahfooz <hamza.mahfooz(a)amd.com>
Date: Fri, 14 Apr 2023 14:26:27 -0400
Subject: [PATCH] drm/amd/display: fix flickering caused by S/G mode
Currently, on a handful of ASICs. We allow the framebuffer for a given
plane to exist in either VRAM or GTT. However, if the plane's new
framebuffer is in a different memory domain than it's previous
framebuffer, flipping between them can cause the screen to flicker. So,
to fix this, don't perform an immediate flip in the aforementioned case.
Cc: stable(a)vger.kernel.org
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2354
Reviewed-by: Roman Li <Roman.Li(a)amd.com>
Fixes: 81d0bcf99009 ("drm/amdgpu: make display pinning more flexible (v2)")
Signed-off-by: Hamza Mahfooz <hamza.mahfooz(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index b619d7cdb525..8d17fd5a817e 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -7901,6 +7901,13 @@ static void amdgpu_dm_commit_cursors(struct drm_atomic_state *state)
amdgpu_dm_plane_handle_cursor_update(plane, old_plane_state);
}
+static inline uint32_t get_mem_type(struct drm_framebuffer *fb)
+{
+ struct amdgpu_bo *abo = gem_to_amdgpu_bo(fb->obj[0]);
+
+ return abo->tbo.resource ? abo->tbo.resource->mem_type : 0;
+}
+
static void amdgpu_dm_commit_planes(struct drm_atomic_state *state,
struct dc_state *dc_state,
struct drm_device *dev,
@@ -8043,11 +8050,13 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state,
/*
* Only allow immediate flips for fast updates that don't
- * change FB pitch, DCC state, rotation or mirroing.
+ * change memory domain, FB pitch, DCC state, rotation or
+ * mirroring.
*/
bundle->flip_addrs[planes_count].flip_immediate =
crtc->state->async_flip &&
- acrtc_state->update_type == UPDATE_TYPE_FAST;
+ acrtc_state->update_type == UPDATE_TYPE_FAST &&
+ get_mem_type(old_plane_state->fb) == get_mem_type(fb);
timestamp_ns = ktime_get_ns();
bundle->flip_addrs[planes_count].flip_timestamp_in_us = div_u64(timestamp_ns, 1000);
Hi Stable maintainers,
This patch, ID 17d793f3ed53, inserts timestamps to Wacom bluetooth
device events. The upstream patch applies to kernels 6.1 and later as
is.
The attached patch applies to kernel 5.4 to 5.15 stable versions. Let
me know if you have other questions.
Thank you,
Ping
Hi Stable maintainers,
This patch, ID 08a46b4190d3, fixes an issue for a few older devices.
It can be backported as is to all the current Long Term Supported
kernels.
Thank you,
Ping
Hi,
Since AMD introduced Navi3x dGPUs, setting them up is more difficult
than it need to be, as you need the GPU firmware binaries present in the
filesystem before the kernel drivers can be loaded. If you don't, you'll
just "hang" at a black screen. This is awkward because you must do
modprobe.blacklist=amdgpu and then load the file.
A large commit series went into 6.3 that improve this experience, but
not all of it is stable materiel.
As the dGPUs are supported on 6.1.y and 6.2.y, we can improve the
experience specifically for these new produces by back-porting a small
subset of commits that correspond to firmware files that are uniquely
loaded by the new products. With these commits amdgpu driver will return
an error code and you can continue to use framebuffer provided by UEFI
GOP driver until you have GPU firmware binaries loaded onto your system.
Commits needed for 6.2.y
cc42e76e7de5 "drm/amd: Load MES microcode during early_init"
2210af50ae7f "drm/amd: Add a new helper for loading/validating microcode"
11e0b0067ec0 "drm/amd: Use `amdgpu_ucode_*` helpers for MES"
Commits needed for 6.1.y
6040517e4a29 "drm/amdgpu: remove deprecated MES version vars"
cc42e76e7de5 "drm/amd: Load MES microcode during early_init"
2210af50ae7f "drm/amd: Add a new helper for loading/validating microcode"
11e0b0067ec0 "drm/amd: Use `amdgpu_ucode_*` helpers for MES"
Regards,
Richard
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y
git checkout FETCH_HEAD
git cherry-pick -x 58d9b9a14b47c2a3da6effcbb01607ad7edc0275
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023051326-earthen-footer-09c4@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^..
Possible dependencies:
58d9b9a14b47 ("drm/amd/pm: parse pp_handle under appropriate conditions")
ebfc253335af ("drm/amd/pm: do not expose the smu_context structure used internally in power")
d698a2c4859d ("drm/amd/pm: move pp_force_state_enabled member to amdgpu_pm structure")
13f5dbd6e3d9 ("drm/amd/pm: do not expose power implementation details to display")
79c65f3fcbb1 ("drm/amd/pm: do not expose power implementation details to amdgpu_pm.c")
bc143d8b8387 ("drm/amd/pm: do not expose implementation details to other blocks out of power")
4da8b63944a4 ("drm/amdgpu: Send Message to SMU on aldebaran passthrough for sbr handling")
f296a0bcc961 ("drm/amd/pm: skip setting gfx cgpg in the s0ix suspend-resume")
7e31a8585b79 ("drm/amdgpu: move smu_debug_mask to a more proper place")
6ff7fddbd120 ("drm/amdgpu: add support for SMU debug option")
1f5fc7a50955 ("drm/amd/pm: Add debugfs info for STB")
79aae67ef8bb ("drm/amd/pm: Add STB accessors interface")
fdcb279d5b79 ("drm/amdgpu: query umc error info from ecc_table v2")
edd794208555 ("drm/amd/pm: add message smu to get ecc_table v2")
3ebd8bf02380 ("drm/amdgpu: support new mode-1 reset interface (v2)")
6c08e0ef87b8 ("drm/amd/pm: avoid duplicate powergate/ungate setting")
56c5977eae87 ("drm/amdkfd: replace/remove remaining kgd_dev references")
c531a58bb61b ("drm/amdkfd: replace kgd_dev in static gfx v10_3 funcs")
4056b0337746 ("drm/amdkfd: replace kgd_dev in static gfx v10 funcs")
9a17c9b79b4d ("drm/amdkfd: replace kgd_dev in static gfx v9 funcs")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 58d9b9a14b47c2a3da6effcbb01607ad7edc0275 Mon Sep 17 00:00:00 2001
From: Guchun Chen <guchun.chen(a)amd.com>
Date: Fri, 5 May 2023 13:20:11 +0800
Subject: [PATCH] drm/amd/pm: parse pp_handle under appropriate conditions
amdgpu_dpm_is_overdrive_supported is a common API across all
asics, so we should cast pp_handle into correct structure
under different power frameworks.
v2: using return directly to simplify code
v3: SI asic does not carry od_enabled member in pp_handle, and update Fixes tag
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2541
Fixes: eb4900aa4c49 ("drm/amdgpu: Fix kernel NULL pointer dereference in dpm functions")
Suggested-by: Mario Limonciello <mario.limonciello(a)amd.com>
Signed-off-by: Guchun Chen <guchun.chen(a)amd.com>
Reviewed-by: Mario Limonciello <mario.limonciello(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
Cc: stable(a)vger.kernel.org
diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
index 300e156b924f..86246f69dbe1 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
@@ -1460,15 +1460,21 @@ int amdgpu_dpm_get_smu_prv_buf_details(struct amdgpu_device *adev,
int amdgpu_dpm_is_overdrive_supported(struct amdgpu_device *adev)
{
- struct pp_hwmgr *hwmgr = adev->powerplay.pp_handle;
- struct smu_context *smu = adev->powerplay.pp_handle;
+ if (is_support_sw_smu(adev)) {
+ struct smu_context *smu = adev->powerplay.pp_handle;
+
+ return (smu->od_enabled || smu->is_apu);
+ } else {
+ struct pp_hwmgr *hwmgr;
- if ((is_support_sw_smu(adev) && smu->od_enabled) ||
- (is_support_sw_smu(adev) && smu->is_apu) ||
- (!is_support_sw_smu(adev) && hwmgr->od_enabled))
- return true;
+ /* SI asic does not carry od_enabled */
+ if (adev->family == AMDGPU_FAMILY_SI)
+ return false;
- return false;
+ hwmgr = (struct pp_hwmgr *)adev->powerplay.pp_handle;
+
+ return hwmgr->od_enabled;
+ }
}
int amdgpu_dpm_set_pp_table(struct amdgpu_device *adev,
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x 58d9b9a14b47c2a3da6effcbb01607ad7edc0275
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023051323-outburst-chaplain-729e@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
58d9b9a14b47 ("drm/amd/pm: parse pp_handle under appropriate conditions")
ebfc253335af ("drm/amd/pm: do not expose the smu_context structure used internally in power")
d698a2c4859d ("drm/amd/pm: move pp_force_state_enabled member to amdgpu_pm structure")
13f5dbd6e3d9 ("drm/amd/pm: do not expose power implementation details to display")
79c65f3fcbb1 ("drm/amd/pm: do not expose power implementation details to amdgpu_pm.c")
bc143d8b8387 ("drm/amd/pm: do not expose implementation details to other blocks out of power")
4da8b63944a4 ("drm/amdgpu: Send Message to SMU on aldebaran passthrough for sbr handling")
f296a0bcc961 ("drm/amd/pm: skip setting gfx cgpg in the s0ix suspend-resume")
7e31a8585b79 ("drm/amdgpu: move smu_debug_mask to a more proper place")
6ff7fddbd120 ("drm/amdgpu: add support for SMU debug option")
1f5fc7a50955 ("drm/amd/pm: Add debugfs info for STB")
79aae67ef8bb ("drm/amd/pm: Add STB accessors interface")
fdcb279d5b79 ("drm/amdgpu: query umc error info from ecc_table v2")
edd794208555 ("drm/amd/pm: add message smu to get ecc_table v2")
3ebd8bf02380 ("drm/amdgpu: support new mode-1 reset interface (v2)")
6c08e0ef87b8 ("drm/amd/pm: avoid duplicate powergate/ungate setting")
56c5977eae87 ("drm/amdkfd: replace/remove remaining kgd_dev references")
c531a58bb61b ("drm/amdkfd: replace kgd_dev in static gfx v10_3 funcs")
4056b0337746 ("drm/amdkfd: replace kgd_dev in static gfx v10 funcs")
9a17c9b79b4d ("drm/amdkfd: replace kgd_dev in static gfx v9 funcs")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 58d9b9a14b47c2a3da6effcbb01607ad7edc0275 Mon Sep 17 00:00:00 2001
From: Guchun Chen <guchun.chen(a)amd.com>
Date: Fri, 5 May 2023 13:20:11 +0800
Subject: [PATCH] drm/amd/pm: parse pp_handle under appropriate conditions
amdgpu_dpm_is_overdrive_supported is a common API across all
asics, so we should cast pp_handle into correct structure
under different power frameworks.
v2: using return directly to simplify code
v3: SI asic does not carry od_enabled member in pp_handle, and update Fixes tag
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2541
Fixes: eb4900aa4c49 ("drm/amdgpu: Fix kernel NULL pointer dereference in dpm functions")
Suggested-by: Mario Limonciello <mario.limonciello(a)amd.com>
Signed-off-by: Guchun Chen <guchun.chen(a)amd.com>
Reviewed-by: Mario Limonciello <mario.limonciello(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
Cc: stable(a)vger.kernel.org
diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
index 300e156b924f..86246f69dbe1 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
@@ -1460,15 +1460,21 @@ int amdgpu_dpm_get_smu_prv_buf_details(struct amdgpu_device *adev,
int amdgpu_dpm_is_overdrive_supported(struct amdgpu_device *adev)
{
- struct pp_hwmgr *hwmgr = adev->powerplay.pp_handle;
- struct smu_context *smu = adev->powerplay.pp_handle;
+ if (is_support_sw_smu(adev)) {
+ struct smu_context *smu = adev->powerplay.pp_handle;
+
+ return (smu->od_enabled || smu->is_apu);
+ } else {
+ struct pp_hwmgr *hwmgr;
- if ((is_support_sw_smu(adev) && smu->od_enabled) ||
- (is_support_sw_smu(adev) && smu->is_apu) ||
- (!is_support_sw_smu(adev) && hwmgr->od_enabled))
- return true;
+ /* SI asic does not carry od_enabled */
+ if (adev->family == AMDGPU_FAMILY_SI)
+ return false;
- return false;
+ hwmgr = (struct pp_hwmgr *)adev->powerplay.pp_handle;
+
+ return hwmgr->od_enabled;
+ }
}
int amdgpu_dpm_set_pp_table(struct amdgpu_device *adev,