December 2024 - Linux-stable-mirror

Re: Patch "iommu/arm-smmu: Defer probe of clients after smmu device bound" has been added to the 6.6-stable tree

by Robin Murphy

On 2024-12-09 11:27 am, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > iommu/arm-smmu: Defer probe of clients after smmu device bound > > to the 6.6-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > iommu-arm-smmu-defer-probe-of-clients-after-smmu-dev.patch > and it can be found in the queue-6.6 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. FWIW the correct resolution for cherry-picking this directly is the logically-straightforward one, as below (git is mostly just confused by the context) Cheers, Robin. ----->8----- diff --cc drivers/iommu/arm/arm-smmu/arm-smmu.c index d6d1a2a55cc0,14618772a3d6..000000000000 --- a/drivers/iommu/arm/arm-smmu/arm-smmu.c +++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c @@@ -1357,10 -1435,19 +1357,21 @@@ static struct iommu_device *arm_smmu_pr fwspec = dev_iommu_fwspec_get(dev); if (ret) goto out_free; - } else { + } else if (fwspec && fwspec->ops == &arm_smmu_ops) { smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode); + + /* + * Defer probe if the relevant SMMU instance hasn't finished + * probing yet. This is a fragile hack and we'd ideally + * avoid this race in the core code. Until that's ironed + * out, however, this is the most pragmatic option on the + * table. + */ + if (!smmu) + return ERR_PTR(dev_err_probe(dev, -EPROBE_DEFER, + "smmu dev has not bound yet\n")); + } else { + return ERR_PTR(-ENODEV); } ret = -EINVAL; > > > > commit 62dc845a353efab2254480df8ae7d06175627313 > Author: Pratyush Brahma <quic_pbrahma(a)quicinc.com> > Date: Fri Oct 4 14:34:28 2024 +0530 > > iommu/arm-smmu: Defer probe of clients after smmu device bound > > [ Upstream commit 229e6ee43d2a160a1592b83aad620d6027084aad ] > > Null pointer dereference occurs due to a race between smmu > driver probe and client driver probe, when of_dma_configure() > for client is called after the iommu_device_register() for smmu driver > probe has executed but before the driver_bound() for smmu driver > has been called. > > Following is how the race occurs: > > T1:Smmu device probe T2: Client device probe > > really_probe() > arm_smmu_device_probe() > iommu_device_register() > really_probe() > platform_dma_configure() > of_dma_configure() > of_dma_configure_id() > of_iommu_configure() > iommu_probe_device() > iommu_init_device() > arm_smmu_probe_device() > arm_smmu_get_by_fwnode() > driver_find_device_by_fwnode() > driver_find_device() > next_device() > klist_next() > /* null ptr > assigned to smmu */ > /* null ptr dereference > while smmu->streamid_mask */ > driver_bound() > klist_add_tail() > > When this null smmu pointer is dereferenced later in > arm_smmu_probe_device, the device crashes. > > Fix this by deferring the probe of the client device > until the smmu device has bound to the arm smmu driver. > > Fixes: 021bb8420d44 ("iommu/arm-smmu: Wire up generic configuration support") > Cc: stable(a)vger.kernel.org > Co-developed-by: Prakash Gupta <quic_guptap(a)quicinc.com> > Signed-off-by: Prakash Gupta <quic_guptap(a)quicinc.com> > Signed-off-by: Pratyush Brahma <quic_pbrahma(a)quicinc.com> > Link: https://lore.kernel.org/r/20241004090428.2035-1-quic_pbrahma@quicinc.com > [will: Add comment] > Signed-off-by: Will Deacon <will(a)kernel.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu.c b/drivers/iommu/arm/arm-smmu/arm-smmu.c > index 8203a06014d71..b40ffa1ec2db6 100644 > --- a/drivers/iommu/arm/arm-smmu/arm-smmu.c > +++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c > @@ -1354,6 +1354,17 @@ static struct iommu_device *arm_smmu_probe_device(struct device *dev) > goto out_free; > } else { > smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode); > + > + /* > + * Defer probe if the relevant SMMU instance hasn't finished > + * probing yet. This is a fragile hack and we'd ideally > + * avoid this race in the core code. Until that's ironed > + * out, however, this is the most pragmatic option on the > + * table. > + */ > + if (!smmu) > + return ERR_PTR(dev_err_probe(dev, -EPROBE_DEFER, > + "smmu dev has not bound yet\n")); > } > > ret = -EINVAL;

4 months, 2 weeks

2
2
0 0

Re: Patch "iommu: Clean up open-coded ownership checks" has been added to the 6.6-stable tree

by Robin Murphy

On 2024-12-09 11:27 am, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > iommu: Clean up open-coded ownership checks > > to the 6.6-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > iommu-clean-up-open-coded-ownership-checks.patch > and it can be found in the queue-6.6 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. Unless you're also going to backport the rest of the larger redesign which makes this commit message true, I don't think this is appropriate. Thanks, Robin. > commit 302639dd441533017096f8ebccb02440090fb09d > Author: Robin Murphy <robin.murphy(a)arm.com> > Date: Tue Nov 21 18:04:03 2023 +0000 > > iommu: Clean up open-coded ownership checks > > [ Upstream commit e7080665c977ea1aafb8547a9c7bd08b199311d6 ] > > Some drivers already implement their own defence against the possibility > of being given someone else's device. Since this is now taken care of by > the core code (and via a slightly different path from the original > fwspec-based idea), let's clean them up. > > Acked-by: Will Deacon <will(a)kernel.org> > Reviewed-by: Jason Gunthorpe <jgg(a)nvidia.com> > Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> > Signed-off-by: Robin Murphy <robin.murphy(a)arm.com> > Link: https://lore.kernel.org/r/58a9879ce3f03562bb061e6714fe6efb554c3907.17005895… > Signed-off-by: Joerg Roedel <jroedel(a)suse.de> > Stable-dep-of: 229e6ee43d2a ("iommu/arm-smmu: Defer probe of clients after smmu device bound") > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c > index 68b81f9c2f4b1..c24584754d252 100644 > --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c > +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c > @@ -2658,9 +2658,6 @@ static struct iommu_device *arm_smmu_probe_device(struct device *dev) > struct arm_smmu_master *master; > struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev); > > - if (!fwspec || fwspec->ops != &arm_smmu_ops) > - return ERR_PTR(-ENODEV); > - > if (WARN_ON_ONCE(dev_iommu_priv_get(dev))) > return ERR_PTR(-EBUSY); > > diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu.c b/drivers/iommu/arm/arm-smmu/arm-smmu.c > index d6d1a2a55cc06..8203a06014d71 100644 > --- a/drivers/iommu/arm/arm-smmu/arm-smmu.c > +++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c > @@ -1116,11 +1116,6 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev) > struct arm_smmu_device *smmu; > int ret; > > - if (!fwspec || fwspec->ops != &arm_smmu_ops) { > - dev_err(dev, "cannot attach to SMMU, is it on the same bus?\n"); > - return -ENXIO; > - } > - > /* > * FIXME: The arch/arm DMA API code tries to attach devices to its own > * domains between of_xlate() and probe_device() - we have no way to cope > @@ -1357,10 +1352,8 @@ static struct iommu_device *arm_smmu_probe_device(struct device *dev) > fwspec = dev_iommu_fwspec_get(dev); > if (ret) > goto out_free; > - } else if (fwspec && fwspec->ops == &arm_smmu_ops) { > - smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode); > } else { > - return ERR_PTR(-ENODEV); > + smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode); > } > > ret = -EINVAL; > diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c > index bc45d18f350cb..3b8c4b33842d1 100644 > --- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c > +++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c > @@ -79,16 +79,6 @@ static struct qcom_iommu_domain *to_qcom_iommu_domain(struct iommu_domain *dom) > > static const struct iommu_ops qcom_iommu_ops; > > -static struct qcom_iommu_dev * to_iommu(struct device *dev) > -{ > - struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev); > - > - if (!fwspec || fwspec->ops != &qcom_iommu_ops) > - return NULL; > - > - return dev_iommu_priv_get(dev); > -} > - > static struct qcom_iommu_ctx * to_ctx(struct qcom_iommu_domain *d, unsigned asid) > { > struct qcom_iommu_dev *qcom_iommu = d->iommu; > @@ -374,7 +364,7 @@ static void qcom_iommu_domain_free(struct iommu_domain *domain) > > static int qcom_iommu_attach_dev(struct iommu_domain *domain, struct device *dev) > { > - struct qcom_iommu_dev *qcom_iommu = to_iommu(dev); > + struct qcom_iommu_dev *qcom_iommu = dev_iommu_priv_get(dev); > struct qcom_iommu_domain *qcom_domain = to_qcom_iommu_domain(domain); > int ret; > > @@ -406,7 +396,7 @@ static int qcom_iommu_identity_attach(struct iommu_domain *identity_domain, > struct iommu_domain *domain = iommu_get_domain_for_dev(dev); > struct qcom_iommu_domain *qcom_domain; > struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev); > - struct qcom_iommu_dev *qcom_iommu = to_iommu(dev); > + struct qcom_iommu_dev *qcom_iommu = dev_iommu_priv_get(dev); > unsigned int i; > > if (domain == identity_domain || !domain) > @@ -537,7 +527,7 @@ static bool qcom_iommu_capable(struct device *dev, enum iommu_cap cap) > > static struct iommu_device *qcom_iommu_probe_device(struct device *dev) > { > - struct qcom_iommu_dev *qcom_iommu = to_iommu(dev); > + struct qcom_iommu_dev *qcom_iommu = dev_iommu_priv_get(dev); > struct device_link *link; > > if (!qcom_iommu) > diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c > index de698463e94ad..23c7eec46fff6 100644 > --- a/drivers/iommu/mtk_iommu.c > +++ b/drivers/iommu/mtk_iommu.c > @@ -843,16 +843,11 @@ static phys_addr_t mtk_iommu_iova_to_phys(struct iommu_domain *domain, > static struct iommu_device *mtk_iommu_probe_device(struct device *dev) > { > struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev); > - struct mtk_iommu_data *data; > + struct mtk_iommu_data *data = dev_iommu_priv_get(dev); > struct device_link *link; > struct device *larbdev; > unsigned int larbid, larbidx, i; > > - if (!fwspec || fwspec->ops != &mtk_iommu_ops) > - return ERR_PTR(-ENODEV); /* Not a iommu client device */ > - > - data = dev_iommu_priv_get(dev); > - > if (!MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) > return &data->iommu; > > diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c > index f1754efcfe74e..027b2ff7f33ef 100644 > --- a/drivers/iommu/mtk_iommu_v1.c > +++ b/drivers/iommu/mtk_iommu_v1.c > @@ -478,9 +478,6 @@ static struct iommu_device *mtk_iommu_v1_probe_device(struct device *dev) > idx++; > } > > - if (!fwspec || fwspec->ops != &mtk_iommu_v1_ops) > - return ERR_PTR(-ENODEV); /* Not a iommu client device */ > - > data = dev_iommu_priv_get(dev); > > /* Link the consumer device with the smi-larb device(supplier) */ > diff --git a/drivers/iommu/sprd-iommu.c b/drivers/iommu/sprd-iommu.c > index c8e79a2d8b4c6..b5570ef887023 100644 > --- a/drivers/iommu/sprd-iommu.c > +++ b/drivers/iommu/sprd-iommu.c > @@ -388,13 +388,7 @@ static phys_addr_t sprd_iommu_iova_to_phys(struct iommu_domain *domain, > > static struct iommu_device *sprd_iommu_probe_device(struct device *dev) > { > - struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev); > - struct sprd_iommu_device *sdev; > - > - if (!fwspec || fwspec->ops != &sprd_iommu_ops) > - return ERR_PTR(-ENODEV); > - > - sdev = dev_iommu_priv_get(dev); > + struct sprd_iommu_device *sdev = dev_iommu_priv_get(dev); > > return &sdev->iommu; > } > diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c > index 17dcd826f5c20..bb2e795a80d0f 100644 > --- a/drivers/iommu/virtio-iommu.c > +++ b/drivers/iommu/virtio-iommu.c > @@ -969,9 +969,6 @@ static struct iommu_device *viommu_probe_device(struct device *dev) > struct viommu_dev *viommu = NULL; > struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev); > > - if (!fwspec || fwspec->ops != &viommu_ops) > - return ERR_PTR(-ENODEV); > - > viommu = viommu_get_by_fwnode(fwspec->iommu_fwnode); > if (!viommu) > return ERR_PTR(-ENODEV);

4 months, 2 weeks

2
2
0 0

[PATCH] HID: wacom: Initialize brightness of LED trigger

by Gerecke, Jason

From: Jason Gerecke <jason.gerecke(a)wacom.com> If an LED has a default_trigger set prior to being registered with the subsystem, that trigger will be executed with a brightness value defined by `trigger->brightness`. Our driver was not setting this value, which was causing problems. It would cause the selected LED to be turned off, as well as corrupt the hlv/llv values assigned to other LEDs (since calling `wacom_led_brightness_set` will overite these values). This patch sets the value of `trigger->brightness` to an appropriate value. We use `wacom_leds_brightness_get` to transform the llv/hlv values into a brightness that is understood by the rest of the LED subsystem. Fixes: 822c91e72eac ("leds: trigger: Store brightness set by led_trigger_event()") Cc: stable(a)vger.kernel.org # v6.10+ Signed-off-by: Jason Gerecke <jason.gerecke(a)wacom.com> --- drivers/hid/wacom_sys.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c index 2bc45b24075c3..e60ca39ac7adc 100644 --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -1370,17 +1370,6 @@ static int wacom_led_register_one(struct device *dev, struct wacom *wacom, if (!name) return -ENOMEM; - if (!read_only) { - led->trigger.name = name; - error = devm_led_trigger_register(dev, &led->trigger); - if (error) { - hid_err(wacom->hdev, - "failed to register LED trigger %s: %d\n", - led->cdev.name, error); - return error; - } - } - led->group = group; led->id = id; led->wacom = wacom; @@ -1397,6 +1386,19 @@ static int wacom_led_register_one(struct device *dev, struct wacom *wacom, led->cdev.brightness_set = wacom_led_readonly_brightness_set; } + if (!read_only) { + led->trigger.name = name; + if (id == wacom->led.groups[group].select) + led->trigger.brightness = wacom_leds_brightness_get(led); + error = devm_led_trigger_register(dev, &led->trigger); + if (error) { + hid_err(wacom->hdev, + "failed to register LED trigger %s: %d\n", + led->cdev.name, error); + return error; + } + } + error = devm_led_classdev_register(dev, &led->cdev); if (error) { hid_err(wacom->hdev, -- 2.47.1

4 months, 2 weeks

2
1
0 0

[PATCH] spi: spi-mem: check the dummy buswidth only for rx mode

by haibo.chen＠nxp.com

From: Haibo Chen <haibo.chen(a)nxp.com> Dummy usually used for rx, so combine the dummy buswidth check only for rx mode. Find issue after commit 98d1fb94ce75 ("mtd: spi-nor: core: replace dummy buswidth from addr to data") on imx8mn-ddr4-evk board. On this board, rx=4, tx=1, without the upper commit, chose SNOR_CMD_READ_1_1_4, after this commit, chose SNOR_CMD_READ(1_1_1). This is because when dummy buswidth = 4, spi_check_buswidth_req(mem, op->dummy.buswidth, true) do not return the expected result. Combine the cmd.buswidth and addr.buswidth check to tx is reasonable, but for dummy buswidth, need to check the rx mode. Fixes: c36ff266dc82 ("spi: Extend the core to ease integration of SPI memory controllers") Cc: stable(a)vger.kernel.org Signed-off-by: Haibo Chen <haibo.chen(a)nxp.com> --- drivers/spi/spi-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c index abc6792e738c..bc9f09a9e5a0 100644 --- a/drivers/spi/spi-mem.c +++ b/drivers/spi/spi-mem.c @@ -150,7 +150,7 @@ static bool spi_mem_check_buswidth(struct spi_mem *mem, return false; if (op->dummy.nbytes && - spi_check_buswidth_req(mem, op->dummy.buswidth, true)) + spi_check_buswidth_req(mem, op->dummy.buswidth, false)) return false; if (op->data.dir != SPI_MEM_NO_DATA && -- 2.34.1

4 months, 2 weeks

1
0
0 0

[PATCH] btrfs: output the reason for open_ctree() failure

by Qu Wenruo

There is a recent ML report that mounting a large fs backed by hardware RAID56 controller (with one device missing) took too much time, and systemd seems to kill the mount attempt. In that case, the only error message is: BTRFS error (device sdj): open_ctree failed There is no reason on why the failure happened, making it very hard to understand the reason. At least output the error number (in the particular case it should be -EINTR) to provide some clue. Link: https://lore.kernel.org/linux-btrfs/9b9c4d2810abcca2f9f76e32220ed9a90febb23… Reported-by: Christoph Anton Mitterer <calestyo(a)scientia.org> Cc: stable(a)vger.kernel.org Signed-off-by: Qu Wenruo <wqu(a)suse.com> --- fs/btrfs/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c index 7dfe5005129a..f6eaaf20229d 100644 --- a/fs/btrfs/super.c +++ b/fs/btrfs/super.c @@ -971,7 +971,7 @@ static int btrfs_fill_super(struct super_block *sb, err = open_ctree(sb, fs_devices); if (err) { - btrfs_err(fs_info, "open_ctree failed"); + btrfs_err(fs_info, "open_ctree failed: %d", err); return err; } -- 2.47.1

4 months, 2 weeks

2
1
0 0

[PATCH 0/8] of/irq: fix bugs

by Zijun Hu

This patch series is to fix bugs in drivers/of/irq.c Signed-off-by: Zijun Hu <quic_zijuhu(a)quicinc.com> --- Zijun Hu (8): of/irq: Fix wrong value of variable @len in of_irq_parse_imap_parent() of/irq: Correct element count for array @dummy_imask in API of_irq_parse_raw() of/irq: Fix device node refcount leakage in API of_irq_parse_raw() of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() of/irq: Fix device node refcount leakage in API of_irq_parse_one() of/irq: Fix device node refcount leakages in of_irq_count() of/irq: Fix device node refcount leakages in of_irq_init() of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() drivers/of/irq.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) --- base-commit: 16ef9c9de0c48b836c5996c6e9792cb4f658c8f1 change-id: 20241208-of_irq_fix-659514bc9aa3 Best regards, -- Zijun Hu <quic_zijuhu(a)quicinc.com>

4 months, 2 weeks

2
12
0 0

[PATCH] drm/panic: remove spurious empty line to clean warning

by Miguel Ojeda

Clippy in the upcoming Rust 1.83.0 spots a spurious empty line since the `clippy::empty_line_after_doc_comments` warning is now enabled by default given it is part of the `suspicious` group [1]: error: empty line after doc comment --> drivers/gpu/drm/drm_panic_qr.rs:931:1 | 931 | / /// They must remain valid for the duration of the function call. 932 | | | |_ 933 | #[no_mangle] 934 | / pub unsafe extern "C" fn drm_panic_qr_generate( 935 | | url: *const i8, 936 | | data: *mut u8, 937 | | data_len: usize, ... | 940 | | tmp_size: usize, 941 | | ) -> u8 { | |_______- the comment documents this function | = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#empty_line_after_… = note: `-D clippy::empty-line-after-doc-comments` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(clippy::empty_line_after_doc_comments)]` = help: if the empty line is unintentional remove it Thus remove the empty line. Cc: stable(a)vger.kernel.org Fixes: cb5164ac43d0 ("drm/panic: Add a QR code panic screen") Link: https://github.com/rust-lang/rust-clippy/pull/13091 [1] Signed-off-by: Miguel Ojeda <ojeda(a)kernel.org> --- I added the Fixes and stable tags since it would be nice to keep the 6.12 LTS Clippy-clean (since that one is the first that supports several Rust compilers). drivers/gpu/drm/drm_panic_qr.rs | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/gpu/drm/drm_panic_qr.rs b/drivers/gpu/drm/drm_panic_qr.rs index 09500cddc009..ef2d490965ba 100644 --- a/drivers/gpu/drm/drm_panic_qr.rs +++ b/drivers/gpu/drm/drm_panic_qr.rs @@ -929,7 +929,6 @@ fn draw_all(&mut self, data: impl Iterator<Item = u8>) { /// * `tmp` must be valid for reading and writing for `tmp_size` bytes. /// /// They must remain valid for the duration of the function call. - #[no_mangle] pub unsafe extern "C" fn drm_panic_qr_generate( url: *const i8, base-commit: b7ed2b6f4e8d7f64649795e76ee9db67300de8eb -- 2.47.0

4 months, 2 weeks

4
6
0 0

FAILED: patch "[PATCH] x86/kexec: Restore GDT on return from ::preserve_context" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 07fa619f2a40c221ea27747a3323cabc59ab25eb # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024121049-attire-ramble-432b@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 07fa619f2a40c221ea27747a3323cabc59ab25eb Mon Sep 17 00:00:00 2001 From: David Woodhouse <dwmw(a)amazon.co.uk> Date: Thu, 5 Dec 2024 15:05:07 +0000 Subject: [PATCH] x86/kexec: Restore GDT on return from ::preserve_context kexec The restore_processor_state() function explicitly states that "the asm code that gets us here will have restored a usable GDT". That wasn't true in the case of returning from a ::preserve_context kexec. Make it so. Without this, the kernel was depending on the called function to reload a GDT which is appropriate for the kernel before returning. Test program: #include <unistd.h> #include <errno.h> #include <stdio.h> #include <stdlib.h> #include <linux/kexec.h> #include <linux/reboot.h> #include <sys/reboot.h> #include <sys/syscall.h> int main (void) { struct kexec_segment segment = {}; unsigned char purgatory[] = { 0x66, 0xba, 0xf8, 0x03, // mov $0x3f8, %dx 0xb0, 0x42, // mov $0x42, %al 0xee, // outb %al, (%dx) 0xc3, // ret }; int ret; segment.buf = &purgatory; segment.bufsz = sizeof(purgatory); segment.mem = (void *)0x400000; segment.memsz = 0x1000; ret = syscall(__NR_kexec_load, 0x400000, 1, &segment, KEXEC_PRESERVE_CONTEXT); if (ret) { perror("kexec_load"); exit(1); } ret = syscall(__NR_reboot, LINUX_REBOOT_MAGIC1, LINUX_REBOOT_MAGIC2, LINUX_REBOOT_CMD_KEXEC); if (ret) { perror("kexec reboot"); exit(1); } printf("Success\n"); return 0; } Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20241205153343.3275139-2-dwmw2@infradead.org diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S index e9e88c342f75..1236f25fc8d1 100644 --- a/arch/x86/kernel/relocate_kernel_64.S +++ b/arch/x86/kernel/relocate_kernel_64.S @@ -242,6 +242,13 @@ SYM_CODE_START_LOCAL_NOALIGN(virtual_mapped) movq CR0(%r8), %r8 movq %rax, %cr3 movq %r8, %cr0 + +#ifdef CONFIG_KEXEC_JUMP + /* Saved in save_processor_state. */ + movq $saved_context, %rax + lgdt saved_context_gdt_desc(%rax) +#endif + movq %rbp, %rax popf

4 months, 2 weeks

1
0
0 0

FAILED: patch "[PATCH] x86/kexec: Restore GDT on return from ::preserve_context" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 07fa619f2a40c221ea27747a3323cabc59ab25eb # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024121048-dreamlike-devourer-7135@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 07fa619f2a40c221ea27747a3323cabc59ab25eb Mon Sep 17 00:00:00 2001 From: David Woodhouse <dwmw(a)amazon.co.uk> Date: Thu, 5 Dec 2024 15:05:07 +0000 Subject: [PATCH] x86/kexec: Restore GDT on return from ::preserve_context kexec The restore_processor_state() function explicitly states that "the asm code that gets us here will have restored a usable GDT". That wasn't true in the case of returning from a ::preserve_context kexec. Make it so. Without this, the kernel was depending on the called function to reload a GDT which is appropriate for the kernel before returning. Test program: #include <unistd.h> #include <errno.h> #include <stdio.h> #include <stdlib.h> #include <linux/kexec.h> #include <linux/reboot.h> #include <sys/reboot.h> #include <sys/syscall.h> int main (void) { struct kexec_segment segment = {}; unsigned char purgatory[] = { 0x66, 0xba, 0xf8, 0x03, // mov $0x3f8, %dx 0xb0, 0x42, // mov $0x42, %al 0xee, // outb %al, (%dx) 0xc3, // ret }; int ret; segment.buf = &purgatory; segment.bufsz = sizeof(purgatory); segment.mem = (void *)0x400000; segment.memsz = 0x1000; ret = syscall(__NR_kexec_load, 0x400000, 1, &segment, KEXEC_PRESERVE_CONTEXT); if (ret) { perror("kexec_load"); exit(1); } ret = syscall(__NR_reboot, LINUX_REBOOT_MAGIC1, LINUX_REBOOT_MAGIC2, LINUX_REBOOT_CMD_KEXEC); if (ret) { perror("kexec reboot"); exit(1); } printf("Success\n"); return 0; } Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20241205153343.3275139-2-dwmw2@infradead.org diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S index e9e88c342f75..1236f25fc8d1 100644 --- a/arch/x86/kernel/relocate_kernel_64.S +++ b/arch/x86/kernel/relocate_kernel_64.S @@ -242,6 +242,13 @@ SYM_CODE_START_LOCAL_NOALIGN(virtual_mapped) movq CR0(%r8), %r8 movq %rax, %cr3 movq %r8, %cr0 + +#ifdef CONFIG_KEXEC_JUMP + /* Saved in save_processor_state. */ + movq $saved_context, %rax + lgdt saved_context_gdt_desc(%rax) +#endif + movq %rbp, %rax popf

4 months, 2 weeks

1
0
0 0

FAILED: patch "[PATCH] x86/kexec: Restore GDT on return from ::preserve_context" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 07fa619f2a40c221ea27747a3323cabc59ab25eb # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024121047-pushing-trouble-cc13@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 07fa619f2a40c221ea27747a3323cabc59ab25eb Mon Sep 17 00:00:00 2001 From: David Woodhouse <dwmw(a)amazon.co.uk> Date: Thu, 5 Dec 2024 15:05:07 +0000 Subject: [PATCH] x86/kexec: Restore GDT on return from ::preserve_context kexec The restore_processor_state() function explicitly states that "the asm code that gets us here will have restored a usable GDT". That wasn't true in the case of returning from a ::preserve_context kexec. Make it so. Without this, the kernel was depending on the called function to reload a GDT which is appropriate for the kernel before returning. Test program: #include <unistd.h> #include <errno.h> #include <stdio.h> #include <stdlib.h> #include <linux/kexec.h> #include <linux/reboot.h> #include <sys/reboot.h> #include <sys/syscall.h> int main (void) { struct kexec_segment segment = {}; unsigned char purgatory[] = { 0x66, 0xba, 0xf8, 0x03, // mov $0x3f8, %dx 0xb0, 0x42, // mov $0x42, %al 0xee, // outb %al, (%dx) 0xc3, // ret }; int ret; segment.buf = &purgatory; segment.bufsz = sizeof(purgatory); segment.mem = (void *)0x400000; segment.memsz = 0x1000; ret = syscall(__NR_kexec_load, 0x400000, 1, &segment, KEXEC_PRESERVE_CONTEXT); if (ret) { perror("kexec_load"); exit(1); } ret = syscall(__NR_reboot, LINUX_REBOOT_MAGIC1, LINUX_REBOOT_MAGIC2, LINUX_REBOOT_CMD_KEXEC); if (ret) { perror("kexec reboot"); exit(1); } printf("Success\n"); return 0; } Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20241205153343.3275139-2-dwmw2@infradead.org diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S index e9e88c342f75..1236f25fc8d1 100644 --- a/arch/x86/kernel/relocate_kernel_64.S +++ b/arch/x86/kernel/relocate_kernel_64.S @@ -242,6 +242,13 @@ SYM_CODE_START_LOCAL_NOALIGN(virtual_mapped) movq CR0(%r8), %r8 movq %rax, %cr3 movq %r8, %cr0 + +#ifdef CONFIG_KEXEC_JUMP + /* Saved in save_processor_state. */ + movq $saved_context, %rax + lgdt saved_context_gdt_desc(%rax) +#endif + movq %rbp, %rax popf

4 months, 2 weeks

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2024