Hi folks,
Please backport commit f634ca650f72 "kbuild: Add $(KBUILD_HOSTLDFLAGS)
to 'has_libelf' test" to stable series 5.10.y, 5.4.y & 4.19.y.
This backport is needed to fix builds with CONFIG_UNWINDER_ORC=y where
HOSTLDFLAGS is given on the make command line containing library paths
needed to link against libelf. The issue was found when trying to build
stable kernel branches for x86-64 using Yocto Project after commit
7fd06a57a1d9 "kernel: Rework kernel make flag to variable mappings" was
added to openembedded-core back in October.
The backport to 5.10.y is trivial. The backports to 5.4.y & 4.19.y need
a minor tweak so I'll send patches for those following this email.
The build failure is also seen in 4.14.y but I can't see a trivial way
to address this as KBUILD_HOSTLDFLAGS does not exist in 4.14.y and
backporting the commit which introduces KBUILD_HOSTLDFLAGS would change
several other kbuild areas. I'm happy to workaround this locally by
disabling CONFIG_UNWINDER_ORC for 4.14.y builds but it may be worth
considering alternative fixes for this branch.
Let me know if there are any questions.
--
Paul Barker
Principal Software Engineer
SanCloud Ltd
e: paul.barker(a)sancloud.com
w: https://sancloud.co.uk/
Could we please have this in linux-4.14.y as it fixes a CVE.
https://lore.kernel.org/all/20180516234411.18122-1-daniel@iogearbox.net/
050fad7c4534c ("bpf: fix truncated jump targets on heavy expansions")
Kind regards,
Lee
--
Lee Jones [李琼斯]
Linaro Services Principle Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog
DEAR FRIEND
You have been compensated with the sum of 5.4 million dollars in this
united nation the payment will be Issue into ATM visa card and send to
you from the bank,we need your address, passport and your WhatsApp
Number.
Thanks
Mrs.Bill Chantal
Coca Cola Award,
Your email account have emerged as one of the lucky winner for
$3.5,000.000.00USD which you're to contact below person to enable him
process the transfer to you through ATM card transfer.
For more Inquiries Contact;
Name: DR. Richardson Smith
Email: info.coca(a)mail.com
From: Palmer Dabbelt <palmer(a)rivosinc.com>
For non-relocatable kernels we need to be able to link the kernel at
approximately PAGE_OFFSET, thus requiring medany (as medlow requires the
code to be linked within 2GiB of 0). The inverse doesn't apply, though:
since medany code can be linked anywhere it's fine to link it close to
0, so we can support the smaller memory config.
Fixes: de5f4b8f634b ("RISC-V: Define MAXPHYSMEM_1GB only for RV32")
Cc: stable(a)vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer(a)rivosinc.com>
---
I found this when going through the savedefconfig diffs for the K210
defconfigs. I'm not entirely sure they're doing the right thing here
(they should probably be setting CMODEL_LOW to take advantage of the
better code generation), but I don't have any way to test those
platforms so I don't want to change too much.
---
arch/riscv/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index 821252b65f89..61f64512dcde 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -280,7 +280,7 @@ choice
depends on 32BIT
bool "1GiB"
config MAXPHYSMEM_2GB
- depends on 64BIT && CMODEL_MEDLOW
+ depends on 64BIT
bool "2GiB"
config MAXPHYSMEM_128GB
depends on 64BIT && CMODEL_MEDANY
--
2.32.0
dear,
I am Jenneh Kandeh from FreeTown Sierra Leone, Time of opposed to the
government of President Tejan Kebbah the ex-leader since 21st November
2005 But am current residing in Benin because war of my country, my
mother killed on 04/01/2002 for Sierra Leone civilian war and I am
only child for my family sad that my father die on 25/11/2018. During
the war my father made a lot of money through the sales of Diamonds to
the tune of $10,200,000.
This money is currently and secretly kept in ECOWAS company in Benin,
due to political turmoil which exists in Africa, I cannot invest the
money alone, hence am soliciting your help to help me take these funds
into your custody for invest.
I want to add here that if agreed 35% that's $3,570,000 of the total
worth of the fund will be yours minus your total expenses incurred
during the clearing of the fund in P/Novo Benin.
l wait to hear from you
Hello Ard,
In patch 'efi/libstub: arm64: Double check image alignment at entry'
(c32ac11da3f83bb42b986702a9b92f0a14ed4182) you added the following check:
if (!IS_ALIGNED((u64)_text, EFI_KIMG_ALIGN))
efi_err("FIRMWARE BUG: kernel image not aligned on %ldk boundary\n", +
EFI_KIMG_ALIGN >> 10);
Unfortunatelly the kernel is aligned at SEGMENT_SIZE and this is the size
populated in the PE headers:
arch/arm64/kernel/efi-header.S: .long SEGMENT_ALIGN
// SectionAlignment
EFI_KIMG_ALIGN is defined as: (SEGMENT_ALIGN > THREAD_ALIGN ? SEGMENT_ALIGN
: THREAD_ALIGN)
So it depends on THREAD_ALIGN. On newer builds these message started to
appear even though the loader (Grub) is taking into account the PE header
(which is stating 64K).
Did you want to also modify the alignment in the headers/linkers or may be
check against SEGMENT_ALIGN?
Thank you,
Mihai
Hi Greg and Sasha,
Please consider applying the following commits to allow arm64 and x86_64
allmodconfig to compile with CONFIG_WERROR enabled with clang-11 through
clang-14 (the currently supported releases upstream).
502408a61f4b ("staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn()") [5.15, 5.10, 5.4, 4.19, 4.14, 4.9]
2e70570656ad ("drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk()") [5.16, 5.15, 5.10, 5.4, 4.19, 4.14, 4.9, 4.4]
144779edf598 ("staging: greybus: fix stack size warning with UBSAN") [5.16, 5.15, 5.10, 5.4]
I primarily care about 5.16 and 5.15, as those are the releases that
have CONFIG_WERROR, but I included all the versions that those patches
should apply cleanly to, as they do fix warnings in the build that
people might see, although I don't think they are worth backporting
further manually until someone complains. 502408a61f4b is already in
5.16.
If there are any issues or objections, please let me know!
Cheers,
Nathan
Hello friend.
You might find it so difficult to remember me, though it is indeed a
very long time, I am much delighted to contact you again after a long
period of time, I remember you despite circumstances that made things
not worked out as we projected then. I want to inform you that the
transaction we're doing together then finally worked out and I decided
to contact you and to let you know because of your tremendous effort
to make things work out then.
Meanwhile I must inform you that I'm presently in Caribbean Island for
numerous business negotiation with some partners. with my sincere
heart i have decided to compensate you with USD$900,000 for your
dedication then on our transaction, you tried so much that period and
I appreciated your effort. I wrote a cheque/check on your name, as
soon as you receive it, you let me know.
Contact my secretary now on his email: mchristophdaniel(a)gmail.com
Name: Mr. Christoph Daniel
You are to forward to him your Name........ Address.......,Phone
number......for shipment/dispatch of the cheque/Check to you
Regards,
Mr. Marcus Galois
Hello friend.
You might find it so difficult to remember me, though it is indeed a
very long time, I am much delighted to contact you again after a long
period of time, I remember you despite circumstances that made things
not worked out as we projected then. I want to inform you that the
transaction we're doing together then finally worked out and I decided
to contact you and to let you know because of your tremendous effort
to make things work out then.
Meanwhile I must inform you that I'm presently in Caribbean Island for
numerous business negotiation with some partners. with my sincere
heart i have decided to compensate you with USD$900,000 for your
dedication then on our transaction, you tried so much that period and
I appreciated your effort. I wrote a cheque/check on your name, as
soon as you receive it, you let me know.
Contact my secretary now on his email: mchristophdaniel(a)gmail.com
Name: Mr. Christoph Daniel
You are to forward to him your Name........ Address.......,Phone
number......for shipment/dispatch of the cheque/Check to you
Regards,
Mr. Marcus Galois
The patch titled
Subject: btrfs: avoid live-lock in search_ioctl() on hardware with sub-page faults
has been removed from the -mm tree. Its filename was
btrfs-avoid-live-lock-in-search_ioctl-on-hardware-with-sub-page-faults.patch
This patch was dropped because an updated version will be merged
------------------------------------------------------
From: Catalin Marinas <catalin.marinas(a)arm.com>
Subject: btrfs: avoid live-lock in search_ioctl() on hardware with sub-page faults
Commit a48b73eca4ce ("btrfs: fix potential deadlock in the search ioctl")
addressed a lockdep warning by pre-faulting the user pages and attempting
the copy_to_user_nofault() in an infinite loop. On architectures like
arm64 with MTE, an access may fault within a page at a location different
from what fault_in_writeable() probed. Since the sk_offset is rewound to
the previous struct btrfs_ioctl_search_header boundary, there is no
guaranteed forward progress and search_ioctl() may live-lock.
Use fault_in_exact_writeable() instead which probes the entire user
buffer for faults at sub-page granularity.
Link: https://lkml.kernel.org/r/20211124192024.2408218-4-catalin.marinas@arm.com
Fixes: a48b73eca4ce ("btrfs: fix potential deadlock in the search ioctl")
Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com>
Reported-by: Al Viro <viro(a)zeniv.linux.org.uk>
Acked-by: David Sterba <dsterba(a)suse.com>
Cc: Josef Bacik <josef(a)toxicpanda.com>
Cc: Andreas Gruenbacher <agruenba(a)redhat.com>
Cc: Will Deacon <will(a)kernel.org>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/btrfs/ioctl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/btrfs/ioctl.c~btrfs-avoid-live-lock-in-search_ioctl-on-hardware-with-sub-page-faults
+++ a/fs/btrfs/ioctl.c
@@ -2225,7 +2225,8 @@ static noinline int search_ioctl(struct
while (1) {
ret = -EFAULT;
- if (fault_in_writeable(ubuf + sk_offset, *buf_size - sk_offset))
+ if (fault_in_exact_writeable(ubuf + sk_offset,
+ *buf_size - sk_offset))
break;
ret = btrfs_search_forward(root, &key, path, sk->min_transid);
_
Patches currently in -mm which might be from catalin.marinas(a)arm.com are
The patch titled
Subject: arm64: add support for sub-page faults user probing
has been removed from the -mm tree. Its filename was
arm64-add-support-for-sub-page-faults-user-probing.patch
This patch was dropped because an updated version will be merged
------------------------------------------------------
From: Catalin Marinas <catalin.marinas(a)arm.com>
Subject: arm64: add support for sub-page faults user probing
With MTE, even if the pte allows an access, a mismatched tag somewhere
within a page can still cause a fault. Select ARCH_HAS_SUBPAGE_FAULTS if
MTE is enabled and implement probe_user_writeable().
Link: https://lkml.kernel.org/r/20211124192024.2408218-3-catalin.marinas@arm.com
Fixes: a48b73eca4ce ("btrfs: fix potential deadlock in the search ioctl")
Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: Al Viro <viro(a)zeniv.linux.org.uk>
Cc: Andreas Gruenbacher <agruenba(a)redhat.com>
Cc: David Sterba <dsterba(a)suse.com>
Cc: Josef Bacik <josef(a)toxicpanda.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Will Deacon <will(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
arch/arm64/Kconfig | 1
arch/arm64/include/asm/uaccess.h | 33 +++++++++++++++++++++++++++++
2 files changed, 34 insertions(+)
--- a/arch/arm64/include/asm/uaccess.h~arm64-add-support-for-sub-page-faults-user-probing
+++ a/arch/arm64/include/asm/uaccess.h
@@ -479,4 +479,37 @@ static inline int __copy_from_user_flush
}
#endif
+#ifdef CONFIG_ARCH_HAS_SUBPAGE_FAULTS
+static inline size_t __mte_probe_user_range(const char __user *uaddr,
+ size_t size)
+{
+ const char __user *end = uaddr + size;
+ int err = 0;
+ char val;
+
+ uaddr = PTR_ALIGN_DOWN(uaddr, MTE_GRANULE_SIZE);
+ while (uaddr < end) {
+ /*
+ * A read is sufficient for MTE, the caller should have probed
+ * for the pte write permission.
+ */
+ __raw_get_user(val, uaddr, err);
+ if (err)
+ return end - uaddr;
+ uaddr += MTE_GRANULE_SIZE;
+ }
+ (void)val;
+
+ return 0;
+}
+
+static inline size_t probe_user_writable(const void __user *uaddr,
+ size_t size)
+{
+ if (!system_supports_mte())
+ return 0;
+ return __mte_probe_user_range(uaddr, size);
+}
+#endif /* CONFIG_ARCH_HAS_SUBPAGE_FAULTS */
+
#endif /* __ASM_UACCESS_H */
--- a/arch/arm64/Kconfig~arm64-add-support-for-sub-page-faults-user-probing
+++ a/arch/arm64/Kconfig
@@ -1777,6 +1777,7 @@ config ARM64_MTE
depends on AS_HAS_LSE_ATOMICS
# Required for tag checking in the uaccess routines
depends on ARM64_PAN
+ select ARCH_HAS_SUBPAGE_FAULTS
select ARCH_USES_HIGH_VMA_FLAGS
help
Memory Tagging (part of the ARMv8.5 Extensions) provides
_
Patches currently in -mm which might be from catalin.marinas(a)arm.com are
btrfs-avoid-live-lock-in-search_ioctl-on-hardware-with-sub-page-faults.patch
The patch titled
Subject: mm: introduce fault_in_exact_writeable() to probe for sub-page faults
has been removed from the -mm tree. Its filename was
mm-introduce-fault_in_exact_writeable-to-probe-for-sub-page-faults.patch
This patch was dropped because an updated version will be merged
------------------------------------------------------
From: Catalin Marinas <catalin.marinas(a)arm.com>
Subject: mm: introduce fault_in_exact_writeable() to probe for sub-page faults
Patch series "Avoid live-lock in fault-in+uaccess loops with sub-page faults".
There are a few places in the filesystem layer where a uaccess is
performed in a loop with page faults disabled, together with a
fault_in_*() call to pre-fault the pages. On architectures like arm64
with MTE (memory tagging extensions) or SPARC ADI, even if the
fault_in_*() succeeded, the uaccess can still fault indefinitely.
In general this is not an issue since such code restarts the fault_in_*()
from where the uaccess failed, therefore guaranteeing forward progress.
The btrfs search_ioctl(), however, rewinds the fault_in_*() position and
it can live-lock. This was reported by Al here:
https://lore.kernel.org/r/YSqOUb7yZ7kBoKRY@zeniv-ca.linux.org.uk
There's also an analysis by Al of other fault-in places:
https://lore.kernel.org/r/YSldx9uhMYhT/G8X@zeniv-ca.linux.org.uk
and another sub-thread on the same topic:
https://lore.kernel.org/r/YXBFqD9WVuU8awIv@arm.com
So far only btrfs search_ioctl() seems to be affected and that's what this
series addresses. The existing loops like generic_perform_write() already
guarantee forward progress.
Andreas raised a concern about O_DIRECT accesses since on fault the user
address is rewound to a block size boundary. I tried ext4, btrfs and gfs2
and I could not get any of them to live-lock. Depending on the alignment
of the user buffer (page or not), I found two behaviours:
- the copy to or from the user buffer succeeds entirely if it goes
through the kernel mapping (GUP, kmap'ed page; user MTE tags are not
checked) or
- the copy partially succeeds after a few attempts at uaccess on the
faulting same address (the highest number of attempts in my tests was
11 with btrfs).
Given the high cost of such sub-page probing (which is done prior to the
uaccess) my proposal is to only change the btrfs search_ioctl() (as per
the last patch). We can extend the API and call places in the future if
needed but I hope filesystems already deal with this in other ways.
This patch (of 3):
On hardware with features like arm64 MTE or SPARC ADI, an access fault can
be triggered at sub-page granularity. Depending on how the fault_in_*()
functions are used, the caller can get into a live-lock by continuously
retrying the fault-in on an address different from the one where the
uaccess failed.
In the majority of cases progress is ensured by the following conditions:
1. copy_{to,from}_user() guarantees at least one byte access if the user
address is not faulting;
2. The fault_in_*() is attempted on the next address that could not be
accessed by copy_*_user().
In the places where the above conditions are not met or the
fault-in/uaccess loop does not have a mechanism to bail out, the
fault_in_exact_writeable() ensures that the arch code will probe the range
in question at a sub-page fault granularity (e.g. 16 bytes for arm64
MTE). For large ranges, this is significantly more expensive than the
non-exact versions which probe a single byte in each page or use GUP.
The architecture code has to select ARCH_HAS_SUBPAGE_FAULTS and implement
probe_user_writeable().
Link: https://lkml.kernel.org/r/20211124192024.2408218-1-catalin.marinas@arm.com
Link: https://lkml.kernel.org/r/20211124192024.2408218-2-catalin.marinas@arm.com
Fixes: a48b73eca4ce ("btrfs: fix potential deadlock in the search ioctl")
Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Al Viro <viro(a)zeniv.linux.org.uk>
Cc: Andreas Gruenbacher <agruenba(a)redhat.com>
Cc: David Sterba <dsterba(a)suse.com>
Cc: Josef Bacik <josef(a)toxicpanda.com>
Cc: Will Deacon <will(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
arch/Kconfig | 7 +++++++
include/linux/pagemap.h | 1 +
include/linux/uaccess.h | 21 +++++++++++++++++++++
mm/gup.c | 19 +++++++++++++++++++
4 files changed, 48 insertions(+)
--- a/arch/Kconfig~mm-introduce-fault_in_exact_writeable-to-probe-for-sub-page-faults
+++ a/arch/Kconfig
@@ -27,6 +27,13 @@ config HAVE_IMA_KEXEC
config SET_FS
bool
+config ARCH_HAS_SUBPAGE_FAULTS
+ bool
+ help
+ Select if the architecture can check permissions at sub-page
+ granularity (e.g. arm64 MTE). The probe_user_*() functions
+ must be implemented.
+
config HOTPLUG_SMT
bool
--- a/include/linux/pagemap.h~mm-introduce-fault_in_exact_writeable-to-probe-for-sub-page-faults
+++ a/include/linux/pagemap.h
@@ -925,6 +925,7 @@ void folio_add_wait_queue(struct folio *
* Fault in userspace address range.
*/
size_t fault_in_writeable(char __user *uaddr, size_t size);
+size_t fault_in_exact_writeable(char __user *uaddr, size_t size);
size_t fault_in_safe_writeable(const char __user *uaddr, size_t size);
size_t fault_in_readable(const char __user *uaddr, size_t size);
--- a/include/linux/uaccess.h~mm-introduce-fault_in_exact_writeable-to-probe-for-sub-page-faults
+++ a/include/linux/uaccess.h
@@ -271,6 +271,27 @@ static inline bool pagefault_disabled(vo
*/
#define faulthandler_disabled() (pagefault_disabled() || in_atomic())
+#ifndef CONFIG_ARCH_HAS_SUBPAGE_FAULTS
+/**
+ * probe_user_writable: probe for sub-page faults in the user range
+ * @uaddr: start of address range
+ * @size: size of address range
+ *
+ * Returns the number of bytes not accessible (like copy_to_user() and
+ * copy_from_user()).
+ *
+ * Architectures that can generate sub-page faults (e.g. arm64 MTE) should
+ * implement this function. It is expected that the caller checked for the
+ * write permission of each page in the range either by put_user() or GUP.
+ * The architecture port can implement a more efficient get_user() probing of
+ * the range if sub-page faults are triggered by either a load or store.
+ */
+static inline size_t probe_user_writable(void __user *uaddr, size_t size)
+{
+ return 0;
+}
+#endif
+
#ifndef ARCH_HAS_NOCACHE_UACCESS
static inline __must_check unsigned long
--- a/mm/gup.c~mm-introduce-fault_in_exact_writeable-to-probe-for-sub-page-faults
+++ a/mm/gup.c
@@ -1699,6 +1699,25 @@ out:
}
EXPORT_SYMBOL(fault_in_writeable);
+/**
+ * fault_in_exact_writeable - fault in userspace address range for writing,
+ * potentially checking for sub-page faults
+ * @uaddr: start of address range
+ * @size: size of address range
+ *
+ * Returns the number of bytes not faulted in (like copy_to_user() and
+ * copy_from_user()).
+ */
+size_t fault_in_exact_writeable(char __user *uaddr, size_t size)
+{
+ size_t accessible = size - fault_in_writeable(uaddr, size);
+
+ if (accessible)
+ accessible -= probe_user_writable(uaddr, accessible);
+ return size - accessible;
+}
+EXPORT_SYMBOL(fault_in_exact_writeable);
+
/*
* fault_in_safe_writeable - fault in an address range for writing
* @uaddr: start of address range
_
Patches currently in -mm which might be from catalin.marinas(a)arm.com are
arm64-add-support-for-sub-page-faults-user-probing.patch
btrfs-avoid-live-lock-in-search_ioctl-on-hardware-with-sub-page-faults.patch
The patch titled
Subject: mm: use compare-exchange operation to set KASAN page tag
has been added to the -mm tree. Its filename is
mm-use-compare-exchange-operation-to-set-kasan-page-tag.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-use-compare-exchange-operation…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-use-compare-exchange-operation…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Peter Collingbourne <pcc(a)google.com>
Subject: mm: use compare-exchange operation to set KASAN page tag
It has been reported that the tag setting operation on newly-allocated
pages can cause the page flags to be corrupted when performed concurrently
with other flag updates as a result of the use of non-atomic operations.
Fix the problem by using a compare-exchange loop to update the tag.
Link: https://lkml.kernel.org/r/20220113031434.464992-1-pcc@google.com
Link: https://linux-review.googlesource.com/id/I456b24a2b9067d93968d43b4bb3351c0c…
Signed-off-by: Peter Collingbourne <pcc(a)google.com>
Fixes: 2813b9c02962 ("kasan, mm, arm64: tag non slab memory allocated via pagealloc")
Cc: Andrey Ryabinin <ryabinin.a.a(a)gmail.com>
Cc: Alexander Potapenko <glider(a)google.com>
Cc: Andrey Konovalov <andreyknvl(a)gmail.com>
Cc: Dmitry Vyukov <dvyukov(a)google.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/mm.h | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
--- a/include/linux/mm.h~mm-use-compare-exchange-operation-to-set-kasan-page-tag
+++ a/include/linux/mm.h
@@ -1524,11 +1524,17 @@ static inline u8 page_kasan_tag(const st
static inline void page_kasan_tag_set(struct page *page, u8 tag)
{
- if (kasan_enabled()) {
- tag ^= 0xff;
- page->flags &= ~(KASAN_TAG_MASK << KASAN_TAG_PGSHIFT);
- page->flags |= (tag & KASAN_TAG_MASK) << KASAN_TAG_PGSHIFT;
- }
+ unsigned long old_flags, flags;
+
+ if (!kasan_enabled())
+ return;
+
+ tag ^= 0xff;
+ do {
+ old_flags = flags = page->flags;
+ flags &= ~(KASAN_TAG_MASK << KASAN_TAG_PGSHIFT);
+ flags |= (tag & KASAN_TAG_MASK) << KASAN_TAG_PGSHIFT;
+ } while (unlikely(cmpxchg(&page->flags, old_flags, flags) != old_flags));
}
static inline void page_kasan_tag_reset(struct page *page)
_
Patches currently in -mm which might be from pcc(a)google.com are
mm-use-compare-exchange-operation-to-set-kasan-page-tag.patch
When the TDP MMU is write-protection GFNs for page table protection (as
opposed to for dirty logging, or due to the HVA not being writable), it
checks if the SPTE is already write-protected and if so skips modifying
the SPTE and the TLB flush.
This behavior is incorrect because the SPTE may be write-protected for
dirty logging. This implies that the SPTE could be locklessly be made
writable on the next write access, and that vCPUs could still be running
with writable SPTEs cached in their TLB.
Fix this by unconditionally setting the SPTE and only skipping the TLB
flush if the SPTE was already marked !MMU-writable or !Host-writable,
which guarantees the SPTE cannot be locklessly be made writable and no
vCPUs are running the writable SPTEs cached in their TLBs.
Technically it would be safe to skip setting the SPTE as well since:
(a) If MMU-writable is set then Host-writable must be cleared
and the only way to set Host-writable is to fault the SPTE
back in entirely (at which point any unsynced shadow pages
reachable by the new SPTE will be synced and MMU-writable can
be safetly be set again).
and
(b) MMU-writable is never consulted on its own.
And in fact this is what the shadow MMU does when write-protecting guest
page tables. However setting the SPTE unconditionally is much easier to
reason about and does not require a huge comment explaining why it is safe.
Fixes: 46044f72c382 ("kvm: x86/mmu: Support write protection for nesting in tdp MMU")
Cc: stable(a)vger.kernel.org
Signed-off-by: David Matlack <dmatlack(a)google.com>
---
arch/x86/kvm/mmu/tdp_mmu.c | 27 ++++++++++++++++++++-------
1 file changed, 20 insertions(+), 7 deletions(-)
diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c
index 7b1bc816b7c3..462c6de9f944 100644
--- a/arch/x86/kvm/mmu/tdp_mmu.c
+++ b/arch/x86/kvm/mmu/tdp_mmu.c
@@ -1423,14 +1423,16 @@ void kvm_tdp_mmu_zap_collapsible_sptes(struct kvm *kvm,
/*
* Removes write access on the last level SPTE mapping this GFN and unsets the
* MMU-writable bit to ensure future writes continue to be intercepted.
- * Returns true if an SPTE was set and a TLB flush is needed.
+ *
+ * Returns true if a TLB flush is needed to ensure no CPU has a writable
+ * version of the SPTE in its TLB.
*/
static bool write_protect_gfn(struct kvm *kvm, struct kvm_mmu_page *root,
gfn_t gfn, int min_level)
{
struct tdp_iter iter;
u64 new_spte;
- bool spte_set = false;
+ bool flush = false;
BUG_ON(min_level > KVM_MAX_HUGEPAGE_LEVEL);
@@ -1442,19 +1444,30 @@ static bool write_protect_gfn(struct kvm *kvm, struct kvm_mmu_page *root,
!is_last_spte(iter.old_spte, iter.level))
continue;
- if (!is_writable_pte(iter.old_spte))
- break;
-
new_spte = iter.old_spte &
~(PT_WRITABLE_MASK | shadow_mmu_writable_mask);
tdp_mmu_set_spte(kvm, &iter, new_spte);
- spte_set = true;
+
+ /*
+ * The TLB flush can be skipped if the old SPTE cannot be
+ * locklessly be made writable, which implies it is already
+ * write-protected due to being !MMU-writable or !Host-writable.
+ * This guarantees no CPU currently has a writable version of
+ * this SPTE in its TLB.
+ *
+ * Otherwise the old SPTE was either not write-protected or was
+ * write-protected but for dirty logging (which does not flush
+ * TLBs before dropping the MMU lock), so a TLB flush is
+ * required.
+ */
+ if (spte_can_locklessly_be_made_writable(iter.old_spte))
+ flush = true;
}
rcu_read_unlock();
- return spte_set;
+ return flush;
}
/*
base-commit: fea31d1690945e6dd6c3e89ec5591490857bc3d4
--
2.34.1.703.g22d0c6ccf7-goog
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From f7e67b8e803185d0aabe7f29d25a35c8be724a78 Mon Sep 17 00:00:00 2001
From: Dominik Brodowski <linux(a)dominikbrodowski.net>
Date: Wed, 29 Dec 2021 22:10:03 +0100
Subject: [PATCH] random: fix crash on multiple early calls to
add_bootloader_randomness()
Currently, if CONFIG_RANDOM_TRUST_BOOTLOADER is enabled, multiple calls
to add_bootloader_randomness() are broken and can cause a NULL pointer
dereference, as noted by Ivan T. Ivanov. This is not only a hypothetical
problem, as qemu on arm64 may provide bootloader entropy via EFI and via
devicetree.
On the first call to add_hwgenerator_randomness(), crng_fast_load() is
executed, and if the seed is long enough, crng_init will be set to 1.
On subsequent calls to add_bootloader_randomness() and then to
add_hwgenerator_randomness(), crng_fast_load() will be skipped. Instead,
wait_event_interruptible() and then credit_entropy_bits() will be called.
If the entropy count for that second seed is large enough, that proceeds
to crng_reseed().
However, both wait_event_interruptible() and crng_reseed() depends
(at least in numa_crng_init()) on workqueues. Therefore, test whether
system_wq is already initialized, which is a sufficient indicator that
workqueue_init_early() has progressed far enough.
If we wind up hitting the !system_wq case, we later want to do what
would have been done there when wqs are up, so set a flag, and do that
work later from the rand_initialize() call.
Reported-by: Ivan T. Ivanov <iivanov(a)suse.de>
Fixes: 18b915ac6b0a ("efi/random: Treat EFI_RNG_PROTOCOL output as bootloader randomness")
Cc: stable(a)vger.kernel.org
Signed-off-by: Dominik Brodowski <linux(a)dominikbrodowski.net>
[Jason: added crng_need_done state and related logic.]
Signed-off-by: Jason A. Donenfeld <Jason(a)zx2c4.com>
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 82db125aaed7..144e8841bff4 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -468,6 +468,7 @@ static struct crng_state primary_crng = {
* its value (from 0->1->2).
*/
static int crng_init = 0;
+static bool crng_need_final_init = false;
#define crng_ready() (likely(crng_init > 1))
static int crng_init_cnt = 0;
static unsigned long crng_global_init_time = 0;
@@ -835,6 +836,36 @@ static void __init crng_initialize_primary(struct crng_state *crng)
crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1;
}
+static void crng_finalize_init(struct crng_state *crng)
+{
+ if (crng != &primary_crng || crng_init >= 2)
+ return;
+ if (!system_wq) {
+ /* We can't call numa_crng_init until we have workqueues,
+ * so mark this for processing later. */
+ crng_need_final_init = true;
+ return;
+ }
+
+ invalidate_batched_entropy();
+ numa_crng_init();
+ crng_init = 2;
+ process_random_ready_list();
+ wake_up_interruptible(&crng_init_wait);
+ kill_fasync(&fasync, SIGIO, POLL_IN);
+ pr_notice("crng init done\n");
+ if (unseeded_warning.missed) {
+ pr_notice("%d get_random_xx warning(s) missed due to ratelimiting\n",
+ unseeded_warning.missed);
+ unseeded_warning.missed = 0;
+ }
+ if (urandom_warning.missed) {
+ pr_notice("%d urandom warning(s) missed due to ratelimiting\n",
+ urandom_warning.missed);
+ urandom_warning.missed = 0;
+ }
+}
+
#ifdef CONFIG_NUMA
static void do_numa_crng_init(struct work_struct *work)
{
@@ -989,25 +1020,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
memzero_explicit(&buf, sizeof(buf));
WRITE_ONCE(crng->init_time, jiffies);
spin_unlock_irqrestore(&crng->lock, flags);
- if (crng == &primary_crng && crng_init < 2) {
- invalidate_batched_entropy();
- numa_crng_init();
- crng_init = 2;
- process_random_ready_list();
- wake_up_interruptible(&crng_init_wait);
- kill_fasync(&fasync, SIGIO, POLL_IN);
- pr_notice("crng init done\n");
- if (unseeded_warning.missed) {
- pr_notice("%d get_random_xx warning(s) missed due to ratelimiting\n",
- unseeded_warning.missed);
- unseeded_warning.missed = 0;
- }
- if (urandom_warning.missed) {
- pr_notice("%d urandom warning(s) missed due to ratelimiting\n",
- urandom_warning.missed);
- urandom_warning.missed = 0;
- }
- }
+ crng_finalize_init(crng);
}
static void _extract_crng(struct crng_state *crng,
@@ -1780,6 +1793,8 @@ static void __init init_std_data(struct entropy_store *r)
int __init rand_initialize(void)
{
init_std_data(&input_pool);
+ if (crng_need_final_init)
+ crng_finalize_init(&primary_crng);
crng_initialize_primary(&primary_crng);
crng_global_init_time = jiffies;
if (ratelimit_disable) {
@@ -2288,7 +2303,8 @@ void add_hwgenerator_randomness(const char *buffer, size_t count,
* We'll be woken up again once below random_write_wakeup_thresh,
* or when the calling thread is about to terminate.
*/
- wait_event_interruptible(random_write_wait, kthread_should_stop() ||
+ wait_event_interruptible(random_write_wait,
+ !system_wq || kthread_should_stop() ||
ENTROPY_BITS(&input_pool) <= random_write_wakeup_bits);
mix_pool_bytes(poolp, buffer, count);
credit_entropy_bits(poolp, entropy);
Check out this report and any autotriaged failures in our web dashboard:
https://datawarehouse.cki-project.org/kcidb/checkouts/28993
Hello,
We ran automated tests on a recent commit from this kernel tree:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: a06ea6650903 - mmc: sdhci-pci: Add PCI ID for Intel ADL
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
Targeted tests: NO
All kernel binaries, config files, and logs are available for download here:
https://arr-cki-prod-datawarehouse-public.s3.amazonaws.com/index.html?prefi…
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Compile testing
---------------
We compiled the kernel for 4 architectures:
aarch64:
make options: make -j24 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: make -j24 INSTALL_MOD_STRIP=1 targz-pkg
s390x:
make options: make -j24 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: make -j24 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test
✅ Reboot test
🚧 ✅ Storage blktests - nvmeof-mp
Host 2:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test
⚡⚡⚡ Reboot test
🚧 ⚡⚡⚡ Storage blktests - srp
Host 3:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
✅ Reboot test
✅ xfstests - ext4
⚡⚡⚡ xfstests - xfs
⚡⚡⚡ IPMI driver test
⚡⚡⚡ IPMItool loop stress test
⚡⚡⚡ selinux-policy: serge-testsuite
⚡⚡⚡ Storage blktests - blk
⚡⚡⚡ Storage block - filesystem fio test
⚡⚡⚡ Storage block - queue scheduler test
⚡⚡⚡ storage: software RAID testing
⚡⚡⚡ Storage: swraid mdadm raid_module test
⚡⚡⚡ stress: stress-ng - interrupt
⚡⚡⚡ stress: stress-ng - cpu
⚡⚡⚡ stress: stress-ng - cpu-cache
⚡⚡⚡ stress: stress-ng - memory
🚧 ⚡⚡⚡ Podman system test - as root
🚧 ⚡⚡⚡ Podman system test - as user
🚧 ⚡⚡⚡ xfstests - btrfs
🚧 ⚡⚡⚡ Storage blktests - nvme-tcp
🚧 ⚡⚡⚡ Storage block - storage fio numa
🚧 ⚡⚡⚡ lvm cache test
🚧 ⚡⚡⚡ stress: stress-ng - os
Host 4:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
✅ Reboot test
✅ ACPI table test
✅ ACPI enabled test
⚡⚡⚡ LTP - cve
⚡⚡⚡ LTP - sched
⚡⚡⚡ LTP - syscalls
⚡⚡⚡ LTP - can
⚡⚡⚡ LTP - commands
⚡⚡⚡ LTP - containers
⚡⚡⚡ LTP - dio
⚡⚡⚡ LTP - fs
⚡⚡⚡ LTP - fsx
⚡⚡⚡ LTP - math
⚡⚡⚡ LTP - hugetlb
⚡⚡⚡ LTP - mm
⚡⚡⚡ LTP - nptl
⚡⚡⚡ LTP - pty
⚡⚡⚡ LTP - ipc
⚡⚡⚡ LTP - tracing
⚡⚡⚡ LTP: openposix test suite
⚡⚡⚡ CIFS Connectathon
⚡⚡⚡ POSIX pjd-fstest suites
⚡⚡⚡ NFS Connectathon
⚡⚡⚡ Loopdev Sanity
⚡⚡⚡ jvm - jcstress tests
⚡⚡⚡ Memory: fork_mem
⚡⚡⚡ Memory function: memfd_create
⚡⚡⚡ AMTU (Abstract Machine Test Utility)
⚡⚡⚡ Networking bridge: sanity
⚡⚡⚡ Ethernet drivers sanity
⚡⚡⚡ Networking socket: fuzz
⚡⚡⚡ Networking route: pmtu
⚡⚡⚡ Networking route_func - local
⚡⚡⚡ Networking route_func - forward
⚡⚡⚡ Networking TCP: keepalive test
⚡⚡⚡ Networking UDP: socket
⚡⚡⚡ Networking cki netfilter test
⚡⚡⚡ Networking tunnel: geneve basic test
⚡⚡⚡ Networking tunnel: gre basic
⚡⚡⚡ L2TP basic test
⚡⚡⚡ Networking tunnel: vxlan basic
⚡⚡⚡ Networking ipsec: basic netns - transport
⚡⚡⚡ Networking ipsec: basic netns - tunnel
⚡⚡⚡ Libkcapi AF_ALG test
⚡⚡⚡ pciutils: update pci ids test
⚡⚡⚡ ALSA PCM loopback test
⚡⚡⚡ ALSA Control (mixer) Userspace Element test
⚡⚡⚡ storage: dm/common
⚡⚡⚡ lvm snapper test
⚡⚡⚡ storage: SCSI VPD
⚡⚡⚡ trace: ftrace/tracer
🚧 ⚡⚡⚡ i2c: i2cdetect sanity
🚧 ⚡⚡⚡ Firmware test suite
🚧 ⚡⚡⚡ Memory function: kaslr
🚧 ⚡⚡⚡ Networking: igmp conformance test
🚧 ⚡⚡⚡ audit: audit testsuite test
Host 5:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test
⚡⚡⚡ Reboot test
⚡⚡⚡ Networking bridge: sanity - mlx5
⚡⚡⚡ Ethernet drivers sanity - mlx5
Host 6:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test
⚡⚡⚡ Reboot test
🚧 ⚡⚡⚡ Storage blktests - srp
Host 7:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
⚡⚡⚡ Reboot test
⚡⚡⚡ Networking bridge: sanity - mlx5
⚡⚡⚡ Ethernet drivers sanity - mlx5
ppc64le:
Host 1:
✅ Boot test
✅ Reboot test
✅ LTP - cve
✅ LTP - sched
✅ LTP - syscalls
✅ LTP - can
✅ LTP - commands
✅ LTP - containers
✅ LTP - dio
✅ LTP - fs
✅ LTP - fsx
✅ LTP - math
✅ LTP - hugetlb
✅ LTP - mm
✅ LTP - nptl
✅ LTP - pty
✅ LTP - ipc
✅ LTP - tracing
✅ LTP: openposix test suite
✅ CIFS Connectathon
✅ POSIX pjd-fstest suites
✅ NFS Connectathon
✅ Loopdev Sanity
✅ jvm - jcstress tests
✅ Memory: fork_mem
✅ Memory function: memfd_create
✅ AMTU (Abstract Machine Test Utility)
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking socket: fuzz
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking cki netfilter test
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - tunnel
✅ Libkcapi AF_ALG test
✅ pciutils: update pci ids test
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ storage: dm/common
✅ lvm snapper test
✅ trace: ftrace/tracer
🚧 ✅ xarray-idr-radixtree-test
🚧 ✅ Memory function: kaslr
🚧 ✅ audit: audit testsuite test
Host 2:
✅ Boot test
✅ Reboot test
🚧 ❌ Storage blktests - nvmeof-mp
Host 3:
✅ Boot test
✅ Reboot test
✅ xfstests - ext4
✅ xfstests - xfs
✅ IPMI driver test
✅ IPMItool loop stress test
✅ selinux-policy: serge-testsuite
✅ Storage blktests - blk
✅ Storage block - filesystem fio test
✅ Storage block - queue scheduler test
✅ storage: software RAID testing
✅ Storage: swraid mdadm raid_module test
🚧 ✅ Podman system test - as root
🚧 ✅ Podman system test - as user
🚧 ✅ xfstests - btrfs
🚧 ✅ Storage blktests - nvme-tcp
🚧 ✅ Storage block - storage fio numa
🚧 ✅ Storage: lvm device-mapper test - upstream
🚧 ✅ lvm cache test
Host 4:
✅ Boot test
✅ Reboot test
🚧 ❌ Storage blktests - srp
s390x:
Host 1:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test
⚡⚡⚡ Reboot test
🚧 ⚡⚡⚡ Storage blktests - srp
Host 2:
✅ Boot test
✅ Reboot test
✅ LTP - cve
✅ LTP - sched
✅ LTP - syscalls
✅ LTP - can
✅ LTP - commands
✅ LTP - containers
✅ LTP - dio
✅ LTP - fs
✅ LTP - fsx
✅ LTP - math
✅ LTP - hugetlb
✅ LTP - mm
✅ LTP - nptl
✅ LTP - pty
✅ LTP - ipc
✅ LTP - tracing
✅ LTP: openposix test suite
✅ CIFS Connectathon
✅ POSIX pjd-fstest suites
✅ NFS Connectathon
✅ Loopdev Sanity
✅ jvm - jcstress tests
✅ Memory: fork_mem
✅ Memory function: memfd_create
✅ AMTU (Abstract Machine Test Utility)
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking cki netfilter test
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - transport
✅ Networking ipsec: basic netns - tunnel
✅ Libkcapi AF_ALG test
✅ storage: dm/common
✅ lvm snapper test
✅ trace: ftrace/tracer
🚧 ✅ Memory function: kaslr
🚧 ✅ audit: audit testsuite test
Host 3:
✅ Boot test
✅ Reboot test
🚧 ✅ Storage blktests - nvmeof-mp
Host 4:
✅ Boot test
✅ Reboot test
✅ selinux-policy: serge-testsuite
✅ Storage blktests - blk
✅ Storage: swraid mdadm raid_module test
✅ stress: stress-ng - interrupt
✅ stress: stress-ng - cpu
✅ stress: stress-ng - cpu-cache
✅ stress: stress-ng - memory
🚧 ✅ Podman system test - as root
🚧 ✅ Podman system test - as user
🚧 ✅ Storage blktests - nvme-tcp
🚧 ✅ lvm cache test
🚧 ✅ stress: stress-ng - os
Host 5:
✅ Boot test
✅ Reboot test
🚧 ✅ Storage blktests - srp
x86_64:
Host 1:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test
⚡⚡⚡ Reboot test
🚧 ⚡⚡⚡ Storage blktests - nvmeof-mp
Host 2:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test
⚡⚡⚡ Reboot test
⚡⚡⚡ xfstests - ext4
⚡⚡⚡ xfstests - xfs
⚡⚡⚡ xfstests - nfsv4.2
⚡⚡⚡ xfstests - cifsv3.11
⚡⚡⚡ IPMI driver test
⚡⚡⚡ IPMItool loop stress test
⚡⚡⚡ selinux-policy: serge-testsuite
⚡⚡⚡ Storage blktests - blk
⚡⚡⚡ Storage block - filesystem fio test
⚡⚡⚡ Storage block - queue scheduler test
⚡⚡⚡ storage: software RAID testing
⚡⚡⚡ Storage: swraid mdadm raid_module test
⚡⚡⚡ stress: stress-ng - interrupt
⚡⚡⚡ stress: stress-ng - cpu
⚡⚡⚡ stress: stress-ng - cpu-cache
⚡⚡⚡ stress: stress-ng - memory
🚧 ⚡⚡⚡ Podman system test - as root
🚧 ⚡⚡⚡ Podman system test - as user
🚧 ⚡⚡⚡ CPU: Idle Test
🚧 ⚡⚡⚡ xfstests - btrfs
🚧 ⚡⚡⚡ Storage blktests - nvme-tcp
🚧 ⚡⚡⚡ Storage block - storage fio numa
🚧 ⚡⚡⚡ Storage: lvm device-mapper test - upstream
🚧 ⚡⚡⚡ lvm cache test
🚧 ⚡⚡⚡ stress: stress-ng - os
Host 3:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
✅ Reboot test
✅ ACPI table test
⚡⚡⚡ LTP - cve
⚡⚡⚡ LTP - sched
⚡⚡⚡ LTP - syscalls
⚡⚡⚡ LTP - can
⚡⚡⚡ LTP - commands
⚡⚡⚡ LTP - containers
⚡⚡⚡ LTP - dio
⚡⚡⚡ LTP - fs
⚡⚡⚡ LTP - fsx
⚡⚡⚡ LTP - math
⚡⚡⚡ LTP - hugetlb
⚡⚡⚡ LTP - mm
⚡⚡⚡ LTP - nptl
⚡⚡⚡ LTP - pty
⚡⚡⚡ LTP - ipc
⚡⚡⚡ LTP - tracing
⚡⚡⚡ LTP: openposix test suite
⚡⚡⚡ CIFS Connectathon
⚡⚡⚡ POSIX pjd-fstest suites
⚡⚡⚡ NFS Connectathon
⚡⚡⚡ Loopdev Sanity
⚡⚡⚡ jvm - jcstress tests
⚡⚡⚡ Memory: fork_mem
⚡⚡⚡ Memory function: memfd_create
⚡⚡⚡ AMTU (Abstract Machine Test Utility)
⚡⚡⚡ Networking bridge: sanity
⚡⚡⚡ Ethernet drivers sanity
⚡⚡⚡ Networking socket: fuzz
⚡⚡⚡ Networking route: pmtu
⚡⚡⚡ Networking route_func - local
⚡⚡⚡ Networking route_func - forward
⚡⚡⚡ Networking TCP: keepalive test
⚡⚡⚡ Networking UDP: socket
⚡⚡⚡ Networking cki netfilter test
⚡⚡⚡ Networking tunnel: geneve basic test
⚡⚡⚡ Networking tunnel: gre basic
⚡⚡⚡ L2TP basic test
⚡⚡⚡ Networking tunnel: vxlan basic
⚡⚡⚡ Networking ipsec: basic netns - transport
⚡⚡⚡ Networking ipsec: basic netns - tunnel
⚡⚡⚡ Libkcapi AF_ALG test
⚡⚡⚡ pciutils: sanity smoke test
⚡⚡⚡ pciutils: update pci ids test
⚡⚡⚡ ALSA PCM loopback test
⚡⚡⚡ ALSA Control (mixer) Userspace Element test
⚡⚡⚡ storage: dm/common
⚡⚡⚡ lvm snapper test
⚡⚡⚡ storage: SCSI VPD
⚡⚡⚡ trace: ftrace/tracer
🚧 ⚡⚡⚡ xarray-idr-radixtree-test
🚧 ⚡⚡⚡ i2c: i2cdetect sanity
🚧 ⚡⚡⚡ Firmware test suite
🚧 ⚡⚡⚡ Memory function: kaslr
🚧 ⚡⚡⚡ Networking: igmp conformance test
🚧 ⚡⚡⚡ audit: audit testsuite test
Host 4:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test
⚡⚡⚡ Reboot test
🚧 ⚡⚡⚡ Storage blktests - srp
Host 5:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test
⚡⚡⚡ Reboot test
🚧 ⚡⚡⚡ Storage blktests - srp
Host 6:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test
⚡⚡⚡ Reboot test
🚧 ⚡⚡⚡ Storage blktests - nvmeof-mp
Test sources: https://gitlab.com/cki-project/kernel-tests
💚 Pull requests are welcome for new tests or improvements to existing tests!
Aborted tests
-------------
Tests that didn't complete running successfully are marked with ⚡⚡⚡.
If this was caused by an infrastructure issue, we try to mark that
explicitly in the report.
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Testing timeout
---------------
We aim to provide a report within reasonable timeframe. Tests that haven't
finished running yet are marked with ⏱.
Targeted tests
--------------
Test runs for patches always include a set of base tests, plus some
tests chosen based on the file paths modified by the patch. The latter
are called "targeted tests". If no targeted tests are run, that means
no patch-specific tests are available. Please, consider contributing a
targeted test for related patches to increase test coverage. See
https://docs.engineering.redhat.com/x/_wEZB for more details.
On Thu, Jan 13, 2022 at 02:20:45PM +0100, Borislav Petkov wrote:
> On Thu, Jan 13, 2022 at 01:59:00PM +0100, gregkh(a)linuxfoundation.org wrote:
> >
> > This is a note to let you know that I've just added the patch titled
> >
> > x86/mce: Remove noinstr annotation from mce_setup()
> >
> > to the 5.15-stable tree which can be found at:
> > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
> >
> > The filename of the patch is:
> > x86-mce-remove-noinstr-annotation-from-mce_setup.patch
> > and it can be found in the queue-5.15 subdirectory.
> >
> > If you, or anyone else, feels it should not be added to the stable tree,
> > please let <stable(a)vger.kernel.org> know about it.
> >
> >
> > From 487d654db3edacc31dee86b10258cc740640fad8 Mon Sep 17 00:00:00 2001
> > From: Borislav Petkov <bp(a)suse.de>
> > Date: Tue, 5 Oct 2021 19:54:47 +0200
> > Subject: x86/mce: Remove noinstr annotation from mce_setup()
> >
> > From: Borislav Petkov <bp(a)suse.de>
> >
> > commit 487d654db3edacc31dee86b10258cc740640fad8 upstream.
> >
> > Instead, sandwitch around the call which is done in noinstr context and
> > mark the caller - mce_gather_info() - as noinstr.
> >
> > Also, document what the whole instrumentation strategy with #MC is going
> > to be in the future and where it all is supposed to be going to.
> >
> > Signed-off-by: Borislav Petkov <bp(a)suse.de>
> > Link: https://lore.kernel.org/r/20211208111343.8130-5-bp@alien8.de
> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
> > ---
> > arch/x86/kernel/cpu/mce/core.c | 26 ++++++++++++++++++++------
> > 1 file changed, 20 insertions(+), 6 deletions(-)
>
> I wonder how that can ever be stable material... or are you backporting
> something else and you need this?
I was trying to get rid of this build warning I see with 5.16:
vmlinux.o: warning: objtool: mce_setup()+0x22: call to memset() leaves .noinstr.text section
vmlinux.o: warning: objtool: do_machine_check()+0x9b: call to mce_gather_info() leaves .noinstr.text section
But with this commit applied I now see this:
vmlinux.o: warning: objtool: mce_gather_info()+0x5f: call to v8086_mode.constprop.0() leaves .noinstr.text section
vmlinux.o: warning: objtool: do_machine_check()+0x183: call to memset() leaves .noinstr.text section
So it didn't help that much.
Any hints on how to get rid of this? More patches in the series this
one came from?
thanks,
greg k-h
The mapping from enum port to whatever port numbering scheme is used by
the SWSCI Display Power State Notification is odd, and the memory of it
has faded. In any case, the parameter only has space for ports numbered
[0..4], and UBSAN reports bit shift beyond it when the platform has port
F or more.
Since the SWSCI functionality is supposed to be obsolete for new
platforms (i.e. ones that might have port F or more), just bail out
early if the mapped and mangled port number is beyond what the Display
Power State Notification can support.
Fixes: 9c4b0a683193 ("drm/i915: add opregion function to notify bios of encoder enable/disable")
Cc: <stable(a)vger.kernel.org> # v3.13+
Cc: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/4800
Signed-off-by: Jani Nikula <jani.nikula(a)intel.com>
---
drivers/gpu/drm/i915/display/intel_opregion.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/gpu/drm/i915/display/intel_opregion.c b/drivers/gpu/drm/i915/display/intel_opregion.c
index af9d30f56cc1..ad1afe9df6c3 100644
--- a/drivers/gpu/drm/i915/display/intel_opregion.c
+++ b/drivers/gpu/drm/i915/display/intel_opregion.c
@@ -363,6 +363,21 @@ int intel_opregion_notify_encoder(struct intel_encoder *intel_encoder,
port++;
}
+ /*
+ * The port numbering and mapping here is bizarre. The now-obsolete
+ * swsci spec supports ports numbered [0..4]. Port E is handled as a
+ * special case, but port F and beyond are not. The functionality is
+ * supposed to be obsolete for new platforms. Just bail out if the port
+ * number is out of bounds after mapping.
+ */
+ if (port > 4) {
+ drm_dbg_kms(&dev_priv->drm,
+ "[ENCODER:%d:%s] port %c (index %u) out of bounds for display power state notification\n",
+ intel_encoder->base.base.id, intel_encoder->base.name,
+ port_name(intel_encoder->port), port);
+ return -EINVAL;
+ }
+
if (!enable)
parm |= 4 << 8;
--
2.30.2
When bfqq is shared by multiple processes it can happen that one of the
processes gets moved to a different cgroup (or just starts submitting IO
for different cgroup). In case that happens we need to split the merged
bfqq as otherwise we will have IO for multiple cgroups in one bfqq and
we will just account IO time to wrong entities etc.
Similarly if the bfqq is scheduled to merge with another bfqq but the
merge didn't happen yet, cancel the merge as it need not be valid
anymore.
CC: stable(a)vger.kernel.org
Fixes: e21b7a0b9887 ("block, bfq: add full hierarchical scheduling and cgroups support")
Signed-off-by: Jan Kara <jack(a)suse.cz>
---
block/bfq-cgroup.c | 25 ++++++++++++++++++++++++-
block/bfq-iosched.c | 2 +-
block/bfq-iosched.h | 1 +
3 files changed, 26 insertions(+), 2 deletions(-)
diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
index 24a5c5329bcd..dbc117e00783 100644
--- a/block/bfq-cgroup.c
+++ b/block/bfq-cgroup.c
@@ -730,8 +730,31 @@ static struct bfq_group *__bfq_bic_change_cgroup(struct bfq_data *bfqd,
if (sync_bfqq) {
entity = &sync_bfqq->entity;
- if (entity->sched_data != &bfqg->sched_data)
+ if (entity->sched_data != &bfqg->sched_data) {
+ /*
+ * Was the queue we use merged to a different queue?
+ * Detach process from the queue as merge need not be
+ * valid anymore. We cannot easily cancel the merge as
+ * there may be other processes scheduled to this
+ * queue.
+ */
+ if (sync_bfqq->new_bfqq) {
+ bfq_put_cooperator(sync_bfqq);
+ bfq_release_process_ref(bfqd, sync_bfqq);
+ bic_set_bfqq(bic, NULL, 1);
+ return bfqg;
+ }
+ /*
+ * Moving bfqq that is shared with another process?
+ * Split the queues at the nearest occasion as the
+ * processes can be in different cgroups now.
+ */
+ if (bfq_bfqq_coop(sync_bfqq)) {
+ bic->stably_merged = false;
+ bfq_mark_bfqq_split_coop(sync_bfqq);
+ }
bfq_bfqq_move(bfqd, sync_bfqq, bfqg);
+ }
}
return bfqg;
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 0da47f2ca781..361d321b012a 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -5184,7 +5184,7 @@ static void bfq_put_stable_ref(struct bfq_queue *bfqq)
bfq_put_queue(bfqq);
}
-static void bfq_put_cooperator(struct bfq_queue *bfqq)
+void bfq_put_cooperator(struct bfq_queue *bfqq)
{
struct bfq_queue *__bfqq, *next;
diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
index a73488eec8a4..6e250db2138e 100644
--- a/block/bfq-iosched.h
+++ b/block/bfq-iosched.h
@@ -976,6 +976,7 @@ void bfq_weights_tree_remove(struct bfq_data *bfqd,
void bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq,
bool compensate, enum bfqq_expiration reason);
void bfq_put_queue(struct bfq_queue *bfqq);
+void bfq_put_cooperator(struct bfq_queue *bfqq);
void bfq_end_wr_async_queues(struct bfq_data *bfqd, struct bfq_group *bfqg);
void bfq_release_process_ref(struct bfq_data *bfqd, struct bfq_queue *bfqq);
void bfq_schedule_dispatch(struct bfq_data *bfqd);
--
2.31.1
Good day,
My name is Rashid Shamsi. I would like to discuss something
important that will benefit both of us. I will send you more
details upon your response
Regards
Rashid Shamsi.
Good day,
My name is Rashid Shamsi. I would like to discuss something
important that will benefit both of us. I will send you more
details upon your response
Regards
Rashid Shamsi.
Hello my Dearest
You have been compensated with the sum of 5.4 million dollars in this
united nation the payment will be Issue into ATM visa card and send to
you from the bank,we need your address, passport and your Whatsapp
Number.
Thanks
Mrs.Bill Chantal
It can cause a hang. This is normally not enabled for GPU
hangs on these asics, but was recently enabled for handling
aborted suspends. This causes hangs on some platforms
on suspend.
Fixes: daf8de0874ab5b ("drm/amdgpu: always reset the asic in suspend (v2)")
Cc: stable(a)vger.kernel.org
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1858
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
---
drivers/gpu/drm/amd/amdgpu/cik.c | 4 ++++
drivers/gpu/drm/amd/amdgpu/vi.c | 4 ++++
2 files changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
index 54f28c075f21..f10ce740a29c 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik.c
@@ -1428,6 +1428,10 @@ static int cik_asic_reset(struct amdgpu_device *adev)
{
int r;
+ /* APUs don't have full asic reset */
+ if (adev->flags & AMD_IS_APU)
+ return 0;
+
if (cik_asic_reset_method(adev) == AMD_RESET_METHOD_BACO) {
dev_info(adev->dev, "BACO reset\n");
r = amdgpu_dpm_baco_reset(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index fe9a7cc8d9eb..6645ebbd2696 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -956,6 +956,10 @@ static int vi_asic_reset(struct amdgpu_device *adev)
{
int r;
+ /* APUs don't have full asic reset */
+ if (adev->flags & AMD_IS_APU)
+ return 0;
+
if (vi_asic_reset_method(adev) == AMD_RESET_METHOD_BACO) {
dev_info(adev->dev, "BACO reset\n");
r = amdgpu_dpm_baco_reset(adev);
--
2.34.1
The following patch was proposed as a fix for 5.16 when it was in beta stage but still hasn't been applied to stable 5.16 yet. Thus I am sending it to queue up
commit 9651cf2cb14726c785240e9dc01b274a68e9959e upstream
From: Orlando Chamberlain <redecorating(a)protonmail.com>
This device is found in the MacBookPro16,2, and as the MacBookPro16,1 is
from the same generation of MacBooks and has a UART with bxt_uart_info,
it was incorrectly assumed that the MacBookPro16,2's UART would have the
same info.
This led to the wrong clock speed being used, and the Bluetooth
controller exposed by the UART receiving and sending random data, which
was incorrectly assumed to be an issue with the Bluetooth stuff, not an
error with the UART side of things.
Changing the info to spt_uart_info changes the clock speed and makes it
send and receive data correctly.
Fixes: ddb1ada ("mfd: intel-lpss: Add support for MacBookPro16,2 ICL-N UART")
Signed-off-by: Orlando Chamberlain <redecorating(a)protonmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Signed-off-by: Lee Jones <lee.jones(a)linaro.org>
Link: https://lore.kernel.org/r/20211124091846.11114-1-redecorating@protonmail.com
---
drivers/mfd/intel-lpss-pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
index 9700e5acd0cd2d..a59aa147959b3e 100644
--- a/drivers/mfd/intel-lpss-pci.c
+++ b/drivers/mfd/intel-lpss-pci.c
@@ -254,7 +254,7 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
{ PCI_VDEVICE(INTEL, 0x34eb), (kernel_ulong_t)&bxt_i2c_info },
{ PCI_VDEVICE(INTEL, 0x34fb), (kernel_ulong_t)&spt_info },
/* ICL-N */
- { PCI_VDEVICE(INTEL, 0x38a8), (kernel_ulong_t)&bxt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x38a8), (kernel_ulong_t)&spt_uart_info },
/* TGL-H */
{ PCI_VDEVICE(INTEL, 0x43a7), (kernel_ulong_t)&bxt_uart_info },
{ PCI_VDEVICE(INTEL, 0x43a8), (kernel_ulong_t)&bxt_uart_info },
The patch below has been upstreamed but I believe has not been back ported to stable. The patch fixes a bug which arose in kernel 5.15, thus I request you to back port it to 5.15 and 5.16 as well
Original commit in Linus’ tree :- c9e143084d1a602f829115612e1ec79df3727c8b
From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
The runtime PM callback may be called as soon as the runtime PM facility
is enabled and activated. It means that ->suspend() may be called before
we finish probing the device in the ACPI case. Hence, NULL pointer
dereference:
intel-lpss INT34BA:00: IRQ index 0 not found
BUG: kernel NULL pointer dereference, address: 0000000000000030
...
Workqueue: pm pm_runtime_work
RIP: 0010:intel_lpss_suspend+0xb/0x40 [intel_lpss]
To fix this, first try to register the device and only after that enable
runtime PM facility.
Fixes: 4b45efe ("mfd: Add support for Intel Sunrisepoint LPSS devices")
Reported-by: Orlando Chamberlain <redecorating(a)protonmail.com>
Reported-by: Aditya Garg <gargaditya08(a)live.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Tested-by: Aditya Garg <gargaditya08(a)live.com>
Signed-off-by: Lee Jones <lee.jones(a)linaro.org>
Link: https://lore.kernel.org/r/20211101190008.86473-1-andriy.shevchenko@linux.in…
---
drivers/mfd/intel-lpss-acpi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/mfd/intel-lpss-acpi.c b/drivers/mfd/intel-lpss-acpi.c
index 3f1d976eb67cb7..f2ea6540a01e14 100644
--- a/drivers/mfd/intel-lpss-acpi.c
+++ b/drivers/mfd/intel-lpss-acpi.c
@@ -136,6 +136,7 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev)
{
struct intel_lpss_platform_info *info;
const struct acpi_device_id *id;
+ int ret;
id = acpi_match_device(intel_lpss_acpi_ids, &pdev->dev);
if (!id)
@@ -149,10 +150,14 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev)
info->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
info->irq = platform_get_irq(pdev, 0);
+ ret = intel_lpss_probe(&pdev->dev, info);
+ if (ret)
+ return ret;
+
pm_runtime_set_active(&pdev->dev);
pm_runtime_enable(&pdev->dev);
- return intel_lpss_probe(&pdev->dev, info);
+ return 0;
}
static int intel_lpss_acpi_remove(struct platform_device *pdev)
The patch below does not apply to the 5.16-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From d2f8114f9574509580a8506d2ef72e7e43d1a5bd Mon Sep 17 00:00:00 2001
From: Aditya Garg <gargaditya08(a)live.com>
Date: Thu, 2 Dec 2021 12:41:59 +0000
Subject: [PATCH] Bluetooth: add quirk disabling LE Read Transmit Power
Some devices have a bug causing them to not work if they query
LE tx power on startup. Thus we add a quirk in order to not query it
and default min/max tx power values to HCI_TX_POWER_INVALID.
Signed-off-by: Aditya Garg <gargaditya08(a)live.com>
Reported-by: Orlando Chamberlain <redecorating(a)protonmail.com>
Tested-by: Orlando Chamberlain <redecorating(a)protonmail.com>
Link:
https://lore.kernel.org/r/4970a940-211b-25d6-edab-21a815313954@protonmail.c…
Fixes: 7c395ea521e6 ("Bluetooth: Query LE tx power on startup")
Cc: stable(a)vger.kernel.org
Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org>
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 4343f79bd02c..c5f6b82b9d11 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -246,6 +246,15 @@ enum {
* HCI after resume.
*/
HCI_QUIRK_NO_SUSPEND_NOTIFIER,
+
+ /*
+ * When this quirk is set, LE tx power is not queried on startup
+ * and the min/max tx power values default to HCI_TX_POWER_INVALID.
+ *
+ * This quirk can be set before hci_register_dev is called or
+ * during the hdev->setup vendor callback.
+ */
+ HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER,
};
/* HCI device flags */
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 7ac6c170ec49..ff3f561a45a2 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -3300,7 +3300,8 @@ static int hci_le_read_adv_tx_power_sync(struct hci_dev *hdev)
/* Read LE Min/Max Tx Power*/
static int hci_le_read_tx_power_sync(struct hci_dev *hdev)
{
- if (!(hdev->commands[38] & 0x80))
+ if (!(hdev->commands[38] & 0x80) ||
+ test_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks))
return 0;
return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_TRANSMIT_POWER,
The patch below does not apply to the 5.16-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 3318ae23bbcb14b7f68e9006756ba6d970955635 Mon Sep 17 00:00:00 2001
From: Aditya Garg <gargaditya08(a)live.com>
Date: Mon, 3 Jan 2022 13:28:42 +0000
Subject: [PATCH] Bluetooth: btbcm: disable read tx power for MacBook Air 8,1
and 8,2
The MacBook Air 8,1 and 8,2 also need querying of LE Tx power
to be disabled for Bluetooth to work.
Signed-off-by: Aditya Garg <gargaditya08(a)live.com>
Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org>
Cc: stable(a)vger.kernel.org
diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
index 07fabaa5aa29..d9ceca7a7935 100644
--- a/drivers/bluetooth/btbcm.c
+++ b/drivers/bluetooth/btbcm.c
@@ -363,6 +363,18 @@ static const struct dmi_system_id disable_broken_read_transmit_power[] = {
DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,4"),
},
},
+ {
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,2"),
+ },
+ },
{
.matches = {
DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 3318ae23bbcb14b7f68e9006756ba6d970955635 Mon Sep 17 00:00:00 2001
From: Aditya Garg <gargaditya08(a)live.com>
Date: Mon, 3 Jan 2022 13:28:42 +0000
Subject: [PATCH] Bluetooth: btbcm: disable read tx power for MacBook Air 8,1
and 8,2
The MacBook Air 8,1 and 8,2 also need querying of LE Tx power
to be disabled for Bluetooth to work.
Signed-off-by: Aditya Garg <gargaditya08(a)live.com>
Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org>
Cc: stable(a)vger.kernel.org
diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
index 07fabaa5aa29..d9ceca7a7935 100644
--- a/drivers/bluetooth/btbcm.c
+++ b/drivers/bluetooth/btbcm.c
@@ -363,6 +363,18 @@ static const struct dmi_system_id disable_broken_read_transmit_power[] = {
DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,4"),
},
},
+ {
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,2"),
+ },
+ },
{
.matches = {
DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From d2f8114f9574509580a8506d2ef72e7e43d1a5bd Mon Sep 17 00:00:00 2001
From: Aditya Garg <gargaditya08(a)live.com>
Date: Thu, 2 Dec 2021 12:41:59 +0000
Subject: [PATCH] Bluetooth: add quirk disabling LE Read Transmit Power
Some devices have a bug causing them to not work if they query
LE tx power on startup. Thus we add a quirk in order to not query it
and default min/max tx power values to HCI_TX_POWER_INVALID.
Signed-off-by: Aditya Garg <gargaditya08(a)live.com>
Reported-by: Orlando Chamberlain <redecorating(a)protonmail.com>
Tested-by: Orlando Chamberlain <redecorating(a)protonmail.com>
Link:
https://lore.kernel.org/r/4970a940-211b-25d6-edab-21a815313954@protonmail.c…
Fixes: 7c395ea521e6 ("Bluetooth: Query LE tx power on startup")
Cc: stable(a)vger.kernel.org
Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org>
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 4343f79bd02c..c5f6b82b9d11 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -246,6 +246,15 @@ enum {
* HCI after resume.
*/
HCI_QUIRK_NO_SUSPEND_NOTIFIER,
+
+ /*
+ * When this quirk is set, LE tx power is not queried on startup
+ * and the min/max tx power values default to HCI_TX_POWER_INVALID.
+ *
+ * This quirk can be set before hci_register_dev is called or
+ * during the hdev->setup vendor callback.
+ */
+ HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER,
};
/* HCI device flags */
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 7ac6c170ec49..ff3f561a45a2 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -3300,7 +3300,8 @@ static int hci_le_read_adv_tx_power_sync(struct hci_dev *hdev)
/* Read LE Min/Max Tx Power*/
static int hci_le_read_tx_power_sync(struct hci_dev *hdev)
{
- if (!(hdev->commands[38] & 0x80))
+ if (!(hdev->commands[38] & 0x80) ||
+ test_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks))
return 0;
return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_TRANSMIT_POWER,
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 00c0ee9850b7b0cb7c40b8daba806ae2245e59d4 Mon Sep 17 00:00:00 2001
From: Mark Chen <mark-yw.chen(a)mediatek.com>
Date: Tue, 7 Dec 2021 01:33:42 +0800
Subject: [PATCH] Bluetooth: btusb: Handle download_firmware failure cases
For Mediatek chipset, it can not enabled if there are something wrong
in btmtk_setup_firmware_79xx(). Thus, the process must be terminated
and returned error code.
Fixes: fc342c4dc4087 ("Bluetooth: btusb: Add protocol support for MediaTek MT7921U USB devices")
Co-developed-by: Sean Wang <sean.wang(a)mediatek.com>
Signed-off-by: Sean Wang <sean.wang(a)mediatek.com>
Signed-off-by: Mark Chen <mark-yw.chen(a)mediatek.com>
Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org>
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index fda5622b1d6e..c9619096d763 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2633,6 +2633,10 @@ static int btusb_mtk_setup(struct hci_dev *hdev)
dev_id & 0xffff, (fw_version & 0xff) + 1);
err = btmtk_setup_firmware_79xx(hdev, fw_bin_name,
btusb_mtk_hci_wmt_sync);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to set up firmware (%d)", err);
+ return err;
+ }
/* It's Device EndPoint Reset Option Register */
btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
The patch below does not apply to the 5.16-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 00c0ee9850b7b0cb7c40b8daba806ae2245e59d4 Mon Sep 17 00:00:00 2001
From: Mark Chen <mark-yw.chen(a)mediatek.com>
Date: Tue, 7 Dec 2021 01:33:42 +0800
Subject: [PATCH] Bluetooth: btusb: Handle download_firmware failure cases
For Mediatek chipset, it can not enabled if there are something wrong
in btmtk_setup_firmware_79xx(). Thus, the process must be terminated
and returned error code.
Fixes: fc342c4dc4087 ("Bluetooth: btusb: Add protocol support for MediaTek MT7921U USB devices")
Co-developed-by: Sean Wang <sean.wang(a)mediatek.com>
Signed-off-by: Sean Wang <sean.wang(a)mediatek.com>
Signed-off-by: Mark Chen <mark-yw.chen(a)mediatek.com>
Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org>
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index fda5622b1d6e..c9619096d763 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2633,6 +2633,10 @@ static int btusb_mtk_setup(struct hci_dev *hdev)
dev_id & 0xffff, (fw_version & 0xff) + 1);
err = btmtk_setup_firmware_79xx(hdev, fw_bin_name,
btusb_mtk_hci_wmt_sync);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to set up firmware (%d)", err);
+ return err;
+ }
/* It's Device EndPoint Reset Option Register */
btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
Hello, Greg.
The following two patches that just pulled by Linus need to be backported to
-stable but don't have stable tagged on them.
v5.2+ : 07edfece8bcb ("workqueue: Fix unbind_workers() VS wq_worker_running() race")
v5.16+: 45c753f5f24d ("workqueue: Fix unbind_workers() VS wq_worker_sleeping() race")
Can you please include them in -stable backports?
Thank you.
--
tejun
41d2d848e5c0 ("md: improve io stats accounting") was added during the
5.9 cycle and therefore is present in the 5.10 branch. This patch was
then reverted in mainline during the 5.14 cycle (ad3fc798800f) due to
report of double faults [1].
However the revert was not picked up for the 5.10 branch. I believe it
should be queued up.
Unfortunately, 41d2d848e5c0 in 5.10 cannot be reverted cleanly because
of the later changes in 00fe60eae94. The mainline 5.14 revert commit
also does not apply cleanly on 5.10 because 99dfc43ecbf6 is not in 5.10.
Manually merging the revert is trivial though (I could provide the patch
I've been testing if that's helpful).
Guillaume.
[1]. https://lore.kernel.org/linux-raid/3bf04253-3fad-434a-63a7-20214e38cf26@gma…
--
Guillaume Morin <guillaume(a)morinfr.org>
The old sync_core_before_usermode() comments suggested that a
non-icache-syncing return-to-usermode instruction is x86-specific and that
all other architectures automatically notice cross-modified code on return
to userspace.
This is misleading. The incantation needed to modify code from one
CPU and execute it on another CPU is highly architecture dependent.
On x86, according to the SDM, one must modify the code, issue SFENCE
if the modification was WC or nontemporal, and then issue a "serializing
instruction" on the CPU that will execute the code. membarrier() can do
the latter.
On arm, arm64 and powerpc, one must flush the icache and then flush the
pipeline on the target CPU, although the CPU manuals don't necessarily use
this language.
So let's drop any pretense that we can have a generic way to define or
implement membarrier's SYNC_CORE operation and instead require all
architectures to define the helper and supply their own documentation as to
how to use it. This means x86, arm64, and powerpc for now. Let's also
rename the function from sync_core_before_usermode() to
membarrier_sync_core_before_usermode() because the precise flushing details
may very well be specific to membarrier, and even the concept of
"sync_core" in the kernel is mostly an x86-ism.
(It may well be the case that, on real x86 processors, synchronizing the
icache (which requires no action at all) and "flushing the pipeline" is
sufficient, but trying to use this language would be confusing at best.
LFENCE does something awfully like "flushing the pipeline", but the SDM
does not permit LFENCE as an alternative to a "serializing instruction"
for this purpose.)
Cc: Michael Ellerman <mpe(a)ellerman.id.au>
Cc: Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
Cc: Paul Mackerras <paulus(a)samba.org>
Cc: linuxppc-dev(a)lists.ozlabs.org
Cc: Nicholas Piggin <npiggin(a)gmail.com>
Cc: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: Will Deacon <will(a)kernel.org>
Cc: linux-arm-kernel(a)lists.infradead.org
Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com>
Cc: Nicholas Piggin <npiggin(a)gmail.com>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: x86(a)kernel.org
Cc: stable(a)vger.kernel.org
Acked-by: Will Deacon <will(a)kernel.org> # for arm64
Fixes: 70216e18e519 ("membarrier: Provide core serializing command, *_SYNC_CORE")
Signed-off-by: Andy Lutomirski <luto(a)kernel.org>
---
.../membarrier-sync-core/arch-support.txt | 69 ++++++-------------
arch/arm/include/asm/membarrier.h | 21 ++++++
arch/arm64/include/asm/membarrier.h | 19 +++++
arch/powerpc/include/asm/membarrier.h | 10 +++
arch/x86/Kconfig | 1 -
arch/x86/include/asm/membarrier.h | 25 +++++++
arch/x86/include/asm/sync_core.h | 20 ------
arch/x86/kernel/alternative.c | 2 +-
arch/x86/kernel/cpu/mce/core.c | 2 +-
arch/x86/mm/tlb.c | 3 +-
drivers/misc/sgi-gru/grufault.c | 2 +-
drivers/misc/sgi-gru/gruhandles.c | 2 +-
drivers/misc/sgi-gru/grukservices.c | 2 +-
include/linux/sched/mm.h | 1 -
include/linux/sync_core.h | 21 ------
init/Kconfig | 3 -
kernel/sched/membarrier.c | 14 +++-
17 files changed, 115 insertions(+), 102 deletions(-)
create mode 100644 arch/arm/include/asm/membarrier.h
create mode 100644 arch/arm64/include/asm/membarrier.h
create mode 100644 arch/x86/include/asm/membarrier.h
delete mode 100644 include/linux/sync_core.h
diff --git a/Documentation/features/sched/membarrier-sync-core/arch-support.txt b/Documentation/features/sched/membarrier-sync-core/arch-support.txt
index 883d33b265d6..4009b26bf5c3 100644
--- a/Documentation/features/sched/membarrier-sync-core/arch-support.txt
+++ b/Documentation/features/sched/membarrier-sync-core/arch-support.txt
@@ -5,51 +5,26 @@
#
# Architecture requirements
#
-# * arm/arm64/powerpc
#
-# Rely on implicit context synchronization as a result of exception return
-# when returning from IPI handler, and when returning to user-space.
-#
-# * x86
-#
-# x86-32 uses IRET as return from interrupt, which takes care of the IPI.
-# However, it uses both IRET and SYSEXIT to go back to user-space. The IRET
-# instruction is core serializing, but not SYSEXIT.
-#
-# x86-64 uses IRET as return from interrupt, which takes care of the IPI.
-# However, it can return to user-space through either SYSRETL (compat code),
-# SYSRETQ, or IRET.
-#
-# Given that neither SYSRET{L,Q}, nor SYSEXIT, are core serializing, we rely
-# instead on write_cr3() performed by switch_mm() to provide core serialization
-# after changing the current mm, and deal with the special case of kthread ->
-# uthread (temporarily keeping current mm into active_mm) by issuing a
-# sync_core_before_usermode() in that specific case.
-#
- -----------------------
- | arch |status|
- -----------------------
- | alpha: | TODO |
- | arc: | TODO |
- | arm: | ok |
- | arm64: | ok |
- | csky: | TODO |
- | h8300: | TODO |
- | hexagon: | TODO |
- | ia64: | TODO |
- | m68k: | TODO |
- | microblaze: | TODO |
- | mips: | TODO |
- | nds32: | TODO |
- | nios2: | TODO |
- | openrisc: | TODO |
- | parisc: | TODO |
- | powerpc: | ok |
- | riscv: | TODO |
- | s390: | TODO |
- | sh: | TODO |
- | sparc: | TODO |
- | um: | TODO |
- | x86: | ok |
- | xtensa: | TODO |
- -----------------------
+# An architecture that wants to support
+# MEMBARRIER_CMD_PRIVATE_EXPEDITED_SYNC_CORE needs to define precisely what it
+# is supposed to do and implement membarrier_sync_core_before_usermode() to
+# make it do that. Then it can select ARCH_HAS_MEMBARRIER_SYNC_CORE via
+# Kconfig and document what SYNC_CORE does on that architecture in this
+# list.
+#
+# On x86, a program can safely modify code, issue
+# MEMBARRIER_CMD_PRIVATE_EXPEDITED_SYNC_CORE, and then execute that code, via
+# the modified address or an alias, from any thread in the calling process.
+#
+# On arm and arm64, a program can modify code, flush the icache as needed,
+# and issue MEMBARRIER_CMD_PRIVATE_EXPEDITED_SYNC_CORE to force a "context
+# synchronizing event", aka pipeline flush on all CPUs that might run the
+# calling process. Then the program can execute the modified code as long
+# as it is executed from an address consistent with the icache flush and
+# the CPU's cache type. On arm, cacheflush(2) can be used for the icache
+# flushing operation.
+#
+# On powerpc, a program can use MEMBARRIER_CMD_PRIVATE_EXPEDITED_SYNC_CORE
+# similarly to arm64. It would be nice if the powerpc maintainers could
+# add a more clear explanantion.
diff --git a/arch/arm/include/asm/membarrier.h b/arch/arm/include/asm/membarrier.h
new file mode 100644
index 000000000000..c162a0758657
--- /dev/null
+++ b/arch/arm/include/asm/membarrier.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_ARM_MEMBARRIER_H
+#define _ASM_ARM_MEMBARRIER_H
+
+#include <asm/barrier.h>
+
+/*
+ * On arm, anyone trying to use membarrier() to handle JIT code is required
+ * to first flush the icache (most likely by using cacheflush(2) and then
+ * do SYNC_CORE. All that's needed after the icache flush is to execute a
+ * "context synchronization event".
+ *
+ * Returning to user mode is a context synchronization event, so no
+ * specific action by the kernel is needed other than ensuring that the
+ * kernel is entered.
+ */
+static inline void membarrier_sync_core_before_usermode(void)
+{
+}
+
+#endif /* _ASM_ARM_MEMBARRIER_H */
diff --git a/arch/arm64/include/asm/membarrier.h b/arch/arm64/include/asm/membarrier.h
new file mode 100644
index 000000000000..db8e0ea57253
--- /dev/null
+++ b/arch/arm64/include/asm/membarrier.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_ARM64_MEMBARRIER_H
+#define _ASM_ARM64_MEMBARRIER_H
+
+#include <asm/barrier.h>
+
+/*
+ * On arm64, anyone trying to use membarrier() to handle JIT code is
+ * required to first flush the icache and then do SYNC_CORE. All that's
+ * needed after the icache flush is to execute a "context synchronization
+ * event". Right now, ERET does this, and we are guaranteed to ERET before
+ * any user code runs. If Linux ever programs the CPU to make ERET stop
+ * being a context synchronizing event, then this will need to be adjusted.
+ */
+static inline void membarrier_sync_core_before_usermode(void)
+{
+}
+
+#endif /* _ASM_ARM64_MEMBARRIER_H */
diff --git a/arch/powerpc/include/asm/membarrier.h b/arch/powerpc/include/asm/membarrier.h
index b90766e95bd1..466abe6fdcea 100644
--- a/arch/powerpc/include/asm/membarrier.h
+++ b/arch/powerpc/include/asm/membarrier.h
@@ -1,4 +1,14 @@
#ifndef _ASM_POWERPC_MEMBARRIER_H
#define _ASM_POWERPC_MEMBARRIER_H
+#include <asm/barrier.h>
+
+/*
+ * The RFI family of instructions are context synchronising, and
+ * that is how we return to userspace, so nothing is required here.
+ */
+static inline void membarrier_sync_core_before_usermode(void)
+{
+}
+
#endif /* _ASM_POWERPC_MEMBARRIER_H */
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index d9830e7e1060..5060c38bf560 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -90,7 +90,6 @@ config X86
select ARCH_HAS_SET_DIRECT_MAP
select ARCH_HAS_STRICT_KERNEL_RWX
select ARCH_HAS_STRICT_MODULE_RWX
- select ARCH_HAS_SYNC_CORE_BEFORE_USERMODE
select ARCH_HAS_SYSCALL_WRAPPER
select ARCH_HAS_UBSAN_SANITIZE_ALL
select ARCH_HAS_DEBUG_WX
diff --git a/arch/x86/include/asm/membarrier.h b/arch/x86/include/asm/membarrier.h
new file mode 100644
index 000000000000..9b72a1b49359
--- /dev/null
+++ b/arch/x86/include/asm/membarrier.h
@@ -0,0 +1,25 @@
+#ifndef _ASM_X86_MEMBARRIER_H
+#define _ASM_X86_MEMBARRIER_H
+
+#include <asm/sync_core.h>
+
+/*
+ * Ensure that the CPU notices any instruction changes before the next time
+ * it returns to usermode.
+ */
+static inline void membarrier_sync_core_before_usermode(void)
+{
+ /* With PTI, we unconditionally serialize before running user code. */
+ if (static_cpu_has(X86_FEATURE_PTI))
+ return;
+
+ /*
+ * Even if we're in an interrupt, we might reschedule before returning,
+ * in which case we could switch to a different thread in the same mm
+ * and return using SYSRET or SYSEXIT. Instead of trying to keep
+ * track of our need to sync the core, just sync right away.
+ */
+ sync_core();
+}
+
+#endif /* _ASM_X86_MEMBARRIER_H */
diff --git a/arch/x86/include/asm/sync_core.h b/arch/x86/include/asm/sync_core.h
index ab7382f92aff..bfe4ac4e6be2 100644
--- a/arch/x86/include/asm/sync_core.h
+++ b/arch/x86/include/asm/sync_core.h
@@ -88,24 +88,4 @@ static inline void sync_core(void)
iret_to_self();
}
-/*
- * Ensure that a core serializing instruction is issued before returning
- * to user-mode. x86 implements return to user-space through sysexit,
- * sysrel, and sysretq, which are not core serializing.
- */
-static inline void sync_core_before_usermode(void)
-{
- /* With PTI, we unconditionally serialize before running user code. */
- if (static_cpu_has(X86_FEATURE_PTI))
- return;
-
- /*
- * Even if we're in an interrupt, we might reschedule before returning,
- * in which case we could switch to a different thread in the same mm
- * and return using SYSRET or SYSEXIT. Instead of trying to keep
- * track of our need to sync the core, just sync right away.
- */
- sync_core();
-}
-
#endif /* _ASM_X86_SYNC_CORE_H */
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index e9da3dc71254..b47cd22b2eb1 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -17,7 +17,7 @@
#include <linux/kprobes.h>
#include <linux/mmu_context.h>
#include <linux/bsearch.h>
-#include <linux/sync_core.h>
+#include <asm/sync_core.h>
#include <asm/text-patching.h>
#include <asm/alternative.h>
#include <asm/sections.h>
diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
index 193204aee880..a2529e09f620 100644
--- a/arch/x86/kernel/cpu/mce/core.c
+++ b/arch/x86/kernel/cpu/mce/core.c
@@ -41,12 +41,12 @@
#include <linux/irq_work.h>
#include <linux/export.h>
#include <linux/set_memory.h>
-#include <linux/sync_core.h>
#include <linux/task_work.h>
#include <linux/hardirq.h>
#include <asm/intel-family.h>
#include <asm/processor.h>
+#include <asm/sync_core.h>
#include <asm/traps.h>
#include <asm/tlbflush.h>
#include <asm/mce.h>
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 1ae15172885e..74b7a615bc15 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -12,6 +12,7 @@
#include <linux/sched/mm.h>
#include <asm/tlbflush.h>
+#include <asm/membarrier.h>
#include <asm/mmu_context.h>
#include <asm/nospec-branch.h>
#include <asm/cache.h>
@@ -491,7 +492,7 @@ static void sync_core_if_membarrier_enabled(struct mm_struct *next)
#ifdef CONFIG_MEMBARRIER
if (unlikely(atomic_read(&next->membarrier_state) &
MEMBARRIER_STATE_PRIVATE_EXPEDITED_SYNC_CORE))
- sync_core_before_usermode();
+ membarrier_sync_core_before_usermode();
#endif
}
diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
index d7ef61e602ed..462c667bd6c4 100644
--- a/drivers/misc/sgi-gru/grufault.c
+++ b/drivers/misc/sgi-gru/grufault.c
@@ -20,8 +20,8 @@
#include <linux/io.h>
#include <linux/uaccess.h>
#include <linux/security.h>
-#include <linux/sync_core.h>
#include <linux/prefetch.h>
+#include <asm/sync_core.h>
#include "gru.h"
#include "grutables.h"
#include "grulib.h"
diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
index 1d75d5e540bc..c8cba1c1b00f 100644
--- a/drivers/misc/sgi-gru/gruhandles.c
+++ b/drivers/misc/sgi-gru/gruhandles.c
@@ -16,7 +16,7 @@
#define GRU_OPERATION_TIMEOUT (((cycles_t) local_cpu_data->itc_freq)*10)
#define CLKS2NSEC(c) ((c) *1000000000 / local_cpu_data->itc_freq)
#else
-#include <linux/sync_core.h>
+#include <asm/sync_core.h>
#include <asm/tsc.h>
#define GRU_OPERATION_TIMEOUT ((cycles_t) tsc_khz*10*1000)
#define CLKS2NSEC(c) ((c) * 1000000 / tsc_khz)
diff --git a/drivers/misc/sgi-gru/grukservices.c b/drivers/misc/sgi-gru/grukservices.c
index 0ea923fe6371..ce03ff3f7c3a 100644
--- a/drivers/misc/sgi-gru/grukservices.c
+++ b/drivers/misc/sgi-gru/grukservices.c
@@ -16,10 +16,10 @@
#include <linux/miscdevice.h>
#include <linux/proc_fs.h>
#include <linux/interrupt.h>
-#include <linux/sync_core.h>
#include <linux/uaccess.h>
#include <linux/delay.h>
#include <linux/export.h>
+#include <asm/sync_core.h>
#include <asm/io_apic.h>
#include "gru.h"
#include "grulib.h"
diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h
index e8919995d8dd..e107f292fc42 100644
--- a/include/linux/sched/mm.h
+++ b/include/linux/sched/mm.h
@@ -7,7 +7,6 @@
#include <linux/sched.h>
#include <linux/mm_types.h>
#include <linux/gfp.h>
-#include <linux/sync_core.h>
/*
* Routines for handling mm_structs
diff --git a/include/linux/sync_core.h b/include/linux/sync_core.h
deleted file mode 100644
index 013da4b8b327..000000000000
--- a/include/linux/sync_core.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _LINUX_SYNC_CORE_H
-#define _LINUX_SYNC_CORE_H
-
-#ifdef CONFIG_ARCH_HAS_SYNC_CORE_BEFORE_USERMODE
-#include <asm/sync_core.h>
-#else
-/*
- * This is a dummy sync_core_before_usermode() implementation that can be used
- * on all architectures which return to user-space through core serializing
- * instructions.
- * If your architecture returns to user-space through non-core-serializing
- * instructions, you need to write your own functions.
- */
-static inline void sync_core_before_usermode(void)
-{
-}
-#endif
-
-#endif /* _LINUX_SYNC_CORE_H */
-
diff --git a/init/Kconfig b/init/Kconfig
index 11f8a845f259..bbaf93f9438b 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -2364,9 +2364,6 @@ source "kernel/Kconfig.locks"
config ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
bool
-config ARCH_HAS_SYNC_CORE_BEFORE_USERMODE
- bool
-
# It may be useful for an architecture to override the definitions of the
# SYSCALL_DEFINE() and __SYSCALL_DEFINEx() macros in <linux/syscalls.h>
# and the COMPAT_ variants in <linux/compat.h>, in particular to use a
diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c
index 327830f89c37..eb73eeaedc7d 100644
--- a/kernel/sched/membarrier.c
+++ b/kernel/sched/membarrier.c
@@ -5,6 +5,14 @@
* membarrier system call
*/
#include "sched.h"
+#ifdef CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE
+#include <asm/membarrier.h>
+#else
+static inline void membarrier_sync_core_before_usermode(void)
+{
+ compiletime_assert(0, "architecture does not implement membarrier_sync_core_before_usermode");
+}
+#endif
/*
* The basic principle behind the regular memory barrier mode of
@@ -231,12 +239,12 @@ static void ipi_sync_core(void *info)
* the big comment at the top of this file.
*
* A sync_core() would provide this guarantee, but
- * sync_core_before_usermode() might end up being deferred until
- * after membarrier()'s smp_mb().
+ * membarrier_sync_core_before_usermode() might end up being deferred
+ * until after membarrier()'s smp_mb().
*/
smp_mb(); /* IPIs should be serializing but paranoid. */
- sync_core_before_usermode();
+ membarrier_sync_core_before_usermode();
}
static void ipi_rseq(void *info)
--
2.33.1
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From abf0e8e4ef25478a4390115e6a953d589d1f9ffd Mon Sep 17 00:00:00 2001
From: Alexander Egorenkov <egorenar(a)linux.ibm.com>
Date: Thu, 9 Dec 2021 08:38:17 +0100
Subject: [PATCH] s390/kexec: handle R_390_PLT32DBL rela in
arch_kexec_apply_relocations_add()
Starting with gcc 11.3, the C compiler will generate PLT-relative function
calls even if they are local and do not require it. Later on during linking,
the linker will replace all PLT-relative calls to local functions with
PC-relative ones. Unfortunately, the purgatory code of kexec/kdump is
not being linked as a regular executable or shared library would have been,
and therefore, all PLT-relative addresses remain in the generated purgatory
object code unresolved. This leads to the situation where the purgatory
code is being executed during kdump with all PLT-relative addresses
unresolved. And this results in endless loops within the purgatory code.
Furthermore, the clang C compiler has always behaved like described above
and this commit should fix kdump for kernels built with the latter.
Because the purgatory code is no regular executable or shared library,
contains only calls to local functions and has no PLT, all R_390_PLT32DBL
relocation entries can be resolved just like a R_390_PC32DBL one.
* https://refspecs.linuxfoundation.org/ELF/zSeries/lzsabi0_zSeries/x1633.html…
Relocation entries of purgatory code generated with gcc 11.3
------------------------------------------------------------
$ readelf -r linux/arch/s390/purgatory/purgatory.o
Relocation section '.rela.text' at offset 0x370 contains 5 entries:
Offset Info Type Sym. Value Sym. Name + Addend
00000000005c 000c00000013 R_390_PC32DBL 0000000000000000 purgatory_sha_regions + 2
00000000007a 000d00000014 R_390_PLT32DBL 0000000000000000 sha256_update + 2
00000000008c 000e00000014 R_390_PLT32DBL 0000000000000000 sha256_final + 2
000000000092 000800000013 R_390_PC32DBL 0000000000000000 .LC0 + 2
0000000000a0 000f00000014 R_390_PLT32DBL 0000000000000000 memcmp + 2
Relocation entries of purgatory code generated with gcc 11.2
------------------------------------------------------------
$ readelf -r linux/arch/s390/purgatory/purgatory.o
Relocation section '.rela.text' at offset 0x368 contains 5 entries:
Offset Info Type Sym. Value Sym. Name + Addend
00000000005c 000c00000013 R_390_PC32DBL 0000000000000000 purgatory_sha_regions + 2
00000000007a 000d00000013 R_390_PC32DBL 0000000000000000 sha256_update + 2
00000000008c 000e00000013 R_390_PC32DBL 0000000000000000 sha256_final + 2
000000000092 000800000013 R_390_PC32DBL 0000000000000000 .LC0 + 2
0000000000a0 000f00000013 R_390_PC32DBL 0000000000000000 memcmp + 2
Signed-off-by: Alexander Egorenkov <egorenar(a)linux.ibm.com>
Reported-by: Tao Liu <ltao(a)redhat.com>
Suggested-by: Philipp Rudo <prudo(a)redhat.com>
Reviewed-by: Philipp Rudo <prudo(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20211209073817.82196-1-egorenar@linux.ibm.com
Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com>
diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c
index 876cdd3c994e..8f43575a4dd3 100644
--- a/arch/s390/kernel/machine_kexec_file.c
+++ b/arch/s390/kernel/machine_kexec_file.c
@@ -348,6 +348,10 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
addr = section->sh_addr + relas[i].r_offset;
r_type = ELF64_R_TYPE(relas[i].r_info);
+
+ if (r_type == R_390_PLT32DBL)
+ r_type = R_390_PC32DBL;
+
ret = arch_kexec_do_relocs(r_type, loc, val, addr);
if (ret) {
pr_err("Unknown rela relocation: %d\n", r_type);
When the process is migrated to a different cgroup (or in case of
writeback just starts submitting bios associated with a different
cgroup) bfq_merge_bio() can operate with stale cgroup information in
bic. Thus the bio can be merged to a request from a different cgroup or
it can result in merging of bfqqs for different cgroups or bfqqs of
already dead cgroups and causing possible use-after-free issues. Fix the
problem by updating cgroup information in bfq_merge_bio().
CC: stable(a)vger.kernel.org
Fixes: e21b7a0b9887 ("block, bfq: add full hierarchical scheduling and cgroups support")
Signed-off-by: Jan Kara <jack(a)suse.cz>
---
block/bfq-iosched.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 361d321b012a..8a088d77a0b6 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -2337,10 +2337,17 @@ static bool bfq_bio_merge(struct request_queue *q, struct bio *bio,
spin_lock_irq(&bfqd->lock);
- if (bic)
+ if (bic) {
+ /*
+ * Make sure cgroup info is uptodate for current process before
+ * considering the merge.
+ */
+ bfq_bic_update_cgroup(bic, bio);
+
bfqd->bio_bfqq = bic_to_bfqq(bic, op_is_sync(bio->bi_opf));
- else
+ } else {
bfqd->bio_bfqq = NULL;
+ }
bfqd->bio_bic = bic;
ret = blk_mq_sched_try_merge(q, bio, nr_segs, &free);
--
2.31.1
It can happen that the parent of a bfqq changes between the moment we
decide two queues are worth to merge (and set bic->stable_merge_bfqq)
and the moment bfq_setup_merge() is called. This can happen e.g. because
the process submitted IO for a different cgroup and thus bfqq got
reparented. It can even happen that the bfqq we are merging with has
parent cgroup that is already offline and going to be destroyed in which
case the merge can lead to use-after-free issues such as:
BUG: KASAN: use-after-free in __bfq_deactivate_entity+0x9cb/0xa50
Read of size 8 at addr ffff88800693c0c0 by task runc:[2:INIT]/10544
CPU: 0 PID: 10544 Comm: runc:[2:INIT] Tainted: G E 5.15.2-0.g5fb85fd-default #1 openSUSE Tumbleweed (unreleased) f1f3b891c72369aebecd2e43e4641a6358867c70
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a-rebuilt.opensuse.org 04/01/2014
Call Trace:
<IRQ>
dump_stack_lvl+0x46/0x5a
print_address_description.constprop.0+0x1f/0x140
? __bfq_deactivate_entity+0x9cb/0xa50
kasan_report.cold+0x7f/0x11b
? __bfq_deactivate_entity+0x9cb/0xa50
__bfq_deactivate_entity+0x9cb/0xa50
? update_curr+0x32f/0x5d0
bfq_deactivate_entity+0xa0/0x1d0
bfq_del_bfqq_busy+0x28a/0x420
? resched_curr+0x116/0x1d0
? bfq_requeue_bfqq+0x70/0x70
? check_preempt_wakeup+0x52b/0xbc0
__bfq_bfqq_expire+0x1a2/0x270
bfq_bfqq_expire+0xd16/0x2160
? try_to_wake_up+0x4ee/0x1260
? bfq_end_wr_async_queues+0xe0/0xe0
? _raw_write_unlock_bh+0x60/0x60
? _raw_spin_lock_irq+0x81/0xe0
bfq_idle_slice_timer+0x109/0x280
? bfq_dispatch_request+0x4870/0x4870
__hrtimer_run_queues+0x37d/0x700
? enqueue_hrtimer+0x1b0/0x1b0
? kvm_clock_get_cycles+0xd/0x10
? ktime_get_update_offsets_now+0x6f/0x280
hrtimer_interrupt+0x2c8/0x740
Fix the problem by checking that the parent of the two bfqqs we are
merging in bfq_setup_merge() is the same.
Link: https://lore.kernel.org/linux-block/20211125172809.GC19572@quack2.suse.cz/
CC: stable(a)vger.kernel.org
Fixes: 430a67f9d616 ("block, bfq: merge bursts of newly-created queues")
Signed-off-by: Jan Kara <jack(a)suse.cz>
---
block/bfq-iosched.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 056399185c2f..0da47f2ca781 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -2638,6 +2638,14 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
if (process_refs == 0 || new_process_refs == 0)
return NULL;
+ /*
+ * Make sure merged queues belong to the same parent. Parents could
+ * have changed since the time we decided the two queues are suitable
+ * for merging.
+ */
+ if (new_bfqq->entity.parent != bfqq->entity.parent)
+ return NULL;
+
bfq_log_bfqq(bfqq->bfqd, bfqq, "scheduling merge with queue %d",
new_bfqq->pid);
--
2.31.1
Hello my Dearest
You have been compensated with the sum of 5.4 million dollars in this
united nation the payment will be Issue into ATM visa card and send to
you from the bank,we need your address, passport and your Whatsapp
Number.
Thanks
Mrs.Bill Chantal
From: Sing-Han Chen <singhanc(a)nvidia.com>
CCGx clears Bit 0:Device Interrupt in the INTR_REG
if CCGx is reset successfully. However, there might
be a chance that other bits in INTR_REG are not
cleared due to internal data queued in PPM. This case
misleads the driver that CCGx reset failed.
The commit checks bit 0 in INTR_REG and ignores other
bits. The ucsi driver would reset PPM later.
Fixes: 247c554a14aa ("usb: typec: ucsi: add support for Cypress CCGx")
Cc: stable(a)vger.kernel.org
Signed-off-by: Sing-Han Chen <singhanc(a)nvidia.com>
Signed-off-by: Wayne Chang <waynec(a)nvidia.com>
---
V4 -> V5: Added Cc tag and revised the commit messages
V3 -> V4: Updated the Fixes tag
V2 -> V3: Added the Fixes tag
V1 -> V2: Fixed the name of Sign-off-by
drivers/usb/typec/ucsi/ucsi_ccg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
index bff96d64dddf..6db7c8ddd51c 100644
--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
@@ -325,7 +325,7 @@ static int ucsi_ccg_init(struct ucsi_ccg *uc)
if (status < 0)
return status;
- if (!data)
+ if (!(data & DEV_INT))
return 0;
status = ccg_write(uc, CCGX_RAB_INTR_REG, &data, sizeof(data));
--
2.25.1
Battery status on Elan tablet driver is reported for the HP ENVY x360
15t-dr100. There is no separate battery for the Elan controller resulting
in a battery level report of 0% or 1% depending on whether a stylus has
interacted with the screen. These low battery level reports causes a
variety of bad behavior in desktop environments. This patch adds the
appropriate quirk to indicate that the batery status is unused for this
target.
Signed-off-by: Karl Kurbjun <kkurbjun(a)gmail.com>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-input.c | 2 ++
2 files changed, 3 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 19da07777d62..a5a5a64c7abc 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -398,6 +398,7 @@
#define USB_DEVICE_ID_HP_X2 0x074d
#define USB_DEVICE_ID_HP_X2_10_COVER 0x0755
#define I2C_DEVICE_ID_HP_ENVY_X360_15 0x2d05
+#define I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100 0x29CF
#define I2C_DEVICE_ID_HP_SPECTRE_X360_15 0x2817
#define USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN 0x2544
#define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN 0x2706
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 03f994541981..ca47682cc730 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -329,6 +329,8 @@ static const struct hid_device_id hid_battery_quirks[] = {
HID_BATTERY_QUIRK_IGNORE },
{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15),
HID_BATTERY_QUIRK_IGNORE },
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100),
+ HID_BATTERY_QUIRK_IGNORE },
{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_15),
HID_BATTERY_QUIRK_IGNORE },
{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN),
--
2.34.1
This patch to implement Marvell PHY specific loopback callback function.
Verified working on Marvell 88E1510 at 1Gbps speed only. For 100Mbps and
10Mbps, found that the PHY loopback not able to function properly.
Possible due to limitation in Marvell 88E1510 PHY.
Tested on Intel Elkhart Lake platform (Synopsys Designware QoS MAC and
Marvell 88E1510 PHY).
Mohammad Athari Bin Ismail (1):
net: phy: marvell: add Marvell specific PHY loopback
drivers/net/phy/marvell.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--
2.17.1
This is the start of the stable review cycle for the 4.4.299 release.
There are 14 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 12 Jan 2022 07:18:05 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.299-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.299-rc1
Nathan Chancellor <nathan(a)kernel.org>
power: reset: ltc2952: Fix use of floating point literals
wolfgang huang <huangjinhui(a)kylinos.cn>
mISDN: change function names to avoid conflicts
yangxingwu <xingwu.yang(a)gmail.com>
net: udp: fix alignment problem in udp4_seq_show()
William Zhao <wizhao(a)redhat.com>
ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
Lixiaokeng <lixiaokeng(a)huawei.com>
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
Hangyu Hua <hbh25y(a)gmail.com>
phonet: refcount leak in pep_sock_accep
Thomas Toye <thomas(a)toye.io>
rndis_host: support Hytera digital radios
Darrick J. Wong <djwong(a)kernel.org>
xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
Eric Dumazet <edumazet(a)google.com>
sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
Jedrzej Jagielski <jedrzej.jagielski(a)intel.com>
i40e: Fix incorrect netdev's real number of RX/TX queues
Tom Rix <trix(a)redhat.com>
mac80211: initialize variable have_higher_than_11mbit
Pavel Skripkin <paskripkin(a)gmail.com>
ieee802154: atusb: fix uninit value in atusb_set_extended_addr
Takashi Iwai <tiwai(a)suse.de>
Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models
Daniel Borkmann <daniel(a)iogearbox.net>
bpf, test: fix ld_abs + vlan push/pop stress test
-------------
Diffstat:
Makefile | 4 ++--
drivers/bluetooth/btusb.c | 32 ++++++++++++++++++++++-------
drivers/isdn/mISDN/core.c | 6 +++---
drivers/isdn/mISDN/core.h | 4 ++--
drivers/isdn/mISDN/layer1.c | 4 ++--
drivers/net/ethernet/intel/i40e/i40e_main.c | 32 ++++++++++++++++++++++-------
drivers/net/ieee802154/atusb.c | 10 +++++----
drivers/net/usb/rndis_host.c | 5 +++++
drivers/power/reset/ltc2952-poweroff.c | 4 ++--
drivers/scsi/libiscsi.c | 6 ++++--
fs/xfs/xfs_ioctl.c | 3 ++-
lib/test_bpf.c | 2 +-
net/ipv4/udp.c | 2 +-
net/ipv6/ip6_vti.c | 2 ++
net/mac80211/mlme.c | 2 +-
net/phonet/pep.c | 1 +
net/sched/sch_qfq.c | 6 ++----
17 files changed, 86 insertions(+), 39 deletions(-)
This is the start of the stable review cycle for the 5.4.171 release.
There are 34 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 12 Jan 2022 07:18:05 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.171-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.171-rc1
wolfgang huang <huangjinhui(a)kylinos.cn>
mISDN: change function names to avoid conflicts
Zekun Shen <bruceshenzk(a)gmail.com>
atlantic: Fix buff_ring OOB in aq_ring_rx_clean
yangxingwu <xingwu.yang(a)gmail.com>
net: udp: fix alignment problem in udp4_seq_show()
William Zhao <wizhao(a)redhat.com>
ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
Lixiaokeng <lixiaokeng(a)huawei.com>
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
Chunfeng Yun <chunfeng.yun(a)mediatek.com>
usb: mtu3: fix interval value for intr and isoc
David Ahern <dsahern(a)kernel.org>
ipv6: Do cleanup if attribute validation fails in multipath route
David Ahern <dsahern(a)kernel.org>
ipv6: Continue processing multipath route even if gateway attribute is invalid
Hangyu Hua <hbh25y(a)gmail.com>
phonet: refcount leak in pep_sock_accep
Thomas Toye <thomas(a)toye.io>
rndis_host: support Hytera digital radios
Nathan Chancellor <nathan(a)kernel.org>
power: reset: ltc2952: Fix use of floating point literals
Linus Walleij <linus.walleij(a)linaro.org>
power: supply: core: Break capacity loop
Darrick J. Wong <djwong(a)kernel.org>
xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
Christian Melki <christian.melki(a)t2data.com>
net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8081
Eric Dumazet <edumazet(a)google.com>
sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: mcast: don't send link-local multicast to mcast routers
David Ahern <dsahern(a)kernel.org>
lwtunnel: Validate RTA_ENCAP_TYPE attribute length
David Ahern <dsahern(a)kernel.org>
ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
David Ahern <dsahern(a)kernel.org>
ipv6: Check attribute length for RTA_GATEWAY in multipath route
David Ahern <dsahern(a)kernel.org>
ipv4: Check attribute length for RTA_FLOW in multipath route
David Ahern <dsahern(a)kernel.org>
ipv4: Check attribute length for RTA_GATEWAY in multipath route
Jedrzej Jagielski <jedrzej.jagielski(a)intel.com>
i40e: Fix incorrect netdev's real number of RX/TX queues
Mateusz Palczewski <mateusz.palczewski(a)intel.com>
i40e: Fix for displaying message regarding NVM version
Di Zhu <zhudi2(a)huawei.com>
i40e: fix use-after-free in i40e_sync_filters_subtask()
Tom Rix <trix(a)redhat.com>
mac80211: initialize variable have_higher_than_11mbit
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
RDMA/uverbs: Check for null return of kmalloc_array
Leon Romanovsky <leonro(a)nvidia.com>
RDMA/core: Don't infoleak GRH fields
Karen Sornek <karen.sornek(a)intel.com>
iavf: Fix limit of total number of queues to active queues of VF
Pavel Skripkin <paskripkin(a)gmail.com>
ieee802154: atusb: fix uninit value in atusb_set_extended_addr
Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
tracing: Tag trace_percpu_buffer as a percpu pointer
Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
Shuah Khan <skhan(a)linuxfoundation.org>
selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv()
Nathan Chancellor <nathan(a)kernel.org>
Input: touchscreen - Fix backport of a02dcde595f7cbd240ccd64de96034ad91cffc40
Chao Yu <chao(a)kernel.org>
f2fs: quota: fix potential deadlock
-------------
Diffstat:
Makefile | 4 +-
drivers/infiniband/core/uverbs_marshall.c | 2 +-
drivers/infiniband/core/uverbs_uapi.c | 3 ++
drivers/input/touchscreen/of_touchscreen.c | 8 ++--
drivers/isdn/mISDN/core.c | 6 +--
drivers/isdn/mISDN/core.h | 4 +-
drivers/isdn/mISDN/layer1.c | 4 +-
drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 8 ++++
drivers/net/ethernet/intel/i40e/i40e_main.c | 60 ++++++++++++++++++++----
drivers/net/ethernet/intel/iavf/iavf_main.c | 5 +-
drivers/net/ieee802154/atusb.c | 10 ++--
drivers/net/phy/micrel.c | 1 +
drivers/net/usb/rndis_host.c | 5 ++
drivers/power/reset/ltc2952-poweroff.c | 4 +-
drivers/power/supply/power_supply_core.c | 4 ++
drivers/scsi/libiscsi.c | 6 ++-
drivers/usb/mtu3/mtu3_gadget.c | 4 +-
fs/f2fs/checkpoint.c | 3 +-
fs/xfs/xfs_ioctl.c | 3 +-
kernel/trace/trace.c | 6 +--
net/batman-adv/multicast.c | 15 ++++--
net/batman-adv/multicast.h | 10 ++--
net/batman-adv/soft-interface.c | 7 ++-
net/core/lwtunnel.c | 4 ++
net/ipv4/fib_semantics.c | 49 ++++++++++++++++---
net/ipv4/udp.c | 2 +-
net/ipv6/ip6_vti.c | 2 +
net/ipv6/route.c | 32 ++++++++++++-
net/mac80211/mlme.c | 2 +-
net/phonet/pep.c | 1 +
net/sched/sch_qfq.c | 6 +--
tools/testing/selftests/x86/test_vsyscall.c | 2 +-
32 files changed, 217 insertions(+), 65 deletions(-)
From: Mike Rapoport <rppt(a)linux.ibm.com>
Since commit 974b9b2c68f3 ("mm: consolidate pte_index() and pte_offset_*()
definitions") pte_index is a static inline and there is no define for it
that can be recognized by the preprocessor. As the result,
vm_insert_pages() uses slower loop over vm_insert_page() instead of
insert_pages() that amortizes the cost of spinlock operations when
inserting multiple pages.
Fixes: 974b9b2c68f3 ("mm: consolidate pte_index() and pte_offset_*() definitions")
Reported-by: Christian Dietrich <stettberger(a)dokucode.de>
Signed-off-by: Mike Rapoport <rppt(a)linux.ibm.com>
Cc: stable(a)vger.kernel.org
---
include/linux/pgtable.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h
index e24d2c992b11..d468efcf48f4 100644
--- a/include/linux/pgtable.h
+++ b/include/linux/pgtable.h
@@ -62,6 +62,7 @@ static inline unsigned long pte_index(unsigned long address)
{
return (address >> PAGE_SHIFT) & (PTRS_PER_PTE - 1);
}
+#define pte_index pte_index
#ifndef pmd_index
static inline unsigned long pmd_index(unsigned long address)
base-commit: 2585cf9dfaaddf00b069673f27bb3f8530e2039c
--
2.28.0
In function nvkm_ioctl_map(), the variable "type" could be
uninitialized if "nvkm_object_map()" returns error code, however,
it does not check the return value and directly use the "type" in
the if statement, which is potentially unsafe.
Cc: stable(a)vger.kernel.org
Fixes: 01326050391c ("drm/nouveau/core/object: allow arguments to be passed to map function")
Signed-off-by: Yizhuo Zhai <yzhai003(a)ucr.edu>
---
drivers/gpu/drm/nouveau/nvkm/core/ioctl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/nouveau/nvkm/core/ioctl.c b/drivers/gpu/drm/nouveau/nvkm/core/ioctl.c
index 735cb6816f10..4264d9d79783 100644
--- a/drivers/gpu/drm/nouveau/nvkm/core/ioctl.c
+++ b/drivers/gpu/drm/nouveau/nvkm/core/ioctl.c
@@ -266,6 +266,8 @@ nvkm_ioctl_map(struct nvkm_client *client,
ret = nvkm_object_map(object, data, size, &type,
&args->v0.handle,
&args->v0.length);
+ if (ret)
+ return ret;
if (type == NVKM_OBJECT_MAP_IO)
args->v0.type = NVIF_IOCTL_MAP_V0_IO;
else
--
2.25.1
The following series backports netfilter: nf_tables: autoload modules from abort path
which fixes the bug mentioned in the following:
https://syzkaller.appspot.com/bug?extid=437bf61d165c87bd40fb
----
BUG: corrupted list in __nf_tables_abort
Status: fixed on 2020/03/17 22:09
Reported-by: syzbot+437bf61d165c87bd40fb(a)syzkaller.appspotmail.com
Fix commit: eb014de4fd41 netfilter: nf_tables: autoload modules from the abort path
First crash: 717d, last: 710d
Cause bisection: introduced by (bisect log) :
commit ec7470b834fe7b5d7eff11b6677f5d7fdf5e9a91
Author: Pablo Neira Ayuso <pablo(a)netfilter.org>
Date: Mon Jan 13 17:09:58 2020 +0000
netfilter: nf_tables: store transaction list locally while requesting module
Crash: KASAN: use-after-free Read in __nf_tables_abort (log)
Repro: C syz .config
Fix bisection: fixed by (bisect log) :
commit 34682110abc50ffea7e002b0c2fd7ea9e0000ccc
Author: Max Chou <max.chou(a)realtek.com>
Date: Wed Nov 27 03:01:07 2019 +0000
Bluetooth: btusb: Edit the logical value for Realtek Bluetooth reset
'
From: Nikita Yushchenko <nikita.yushchenko(a)virtuozzo.com>
If start_per_cpu_kthreads() called from osnoise_workload_start() returns
error, event hooks are left in broken state: unhook_irq_events() called
but unhook_thread_events() and unhook_softirq_events() not called, and
trace_osnoise_callback_enabled flag not cleared.
On the next tracer enable, hooks get not installed due to
trace_osnoise_callback_enabled flag.
And on the further tracer disable an attempt to remove non-installed
hooks happened, hitting a WARN_ON_ONCE() in tracepoint_remove_func().
Fix the error path by adding the missing part of cleanup.
While at this, introduce osnoise_unhook_events() to avoid code
duplication between this error path and normal tracer disable.
Link: https://lkml.kernel.org/r/20220109153459.3701773-1-nikita.yushchenko@virtuo…
Cc: stable(a)vger.kernel.org
Fixes: bce29ac9ce0b ("trace: Add osnoise tracer")
Acked-by: Daniel Bristot de Oliveira <bristot(a)kernel.org>
Signed-off-by: Nikita Yushchenko <nikita.yushchenko(a)virtuozzo.com>
Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org>
---
kernel/trace/trace_osnoise.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c
index 4719a848bf17..36d9d5be08b4 100644
--- a/kernel/trace/trace_osnoise.c
+++ b/kernel/trace/trace_osnoise.c
@@ -2122,6 +2122,13 @@ static int osnoise_hook_events(void)
return -EINVAL;
}
+static void osnoise_unhook_events(void)
+{
+ unhook_thread_events();
+ unhook_softirq_events();
+ unhook_irq_events();
+}
+
/*
* osnoise_workload_start - start the workload and hook to events
*/
@@ -2154,7 +2161,14 @@ static int osnoise_workload_start(void)
retval = start_per_cpu_kthreads();
if (retval) {
- unhook_irq_events();
+ trace_osnoise_callback_enabled = false;
+ /*
+ * Make sure that ftrace_nmi_enter/exit() see
+ * trace_osnoise_callback_enabled as false before continuing.
+ */
+ barrier();
+
+ osnoise_unhook_events();
return retval;
}
@@ -2185,9 +2199,7 @@ static void osnoise_workload_stop(void)
stop_per_cpu_kthreads();
- unhook_irq_events();
- unhook_softirq_events();
- unhook_thread_events();
+ osnoise_unhook_events();
}
static void osnoise_tracer_start(struct trace_array *tr)
--
2.33.0
From: Steven Rostedt <rostedt(a)goodmis.org>
Currently, the syscall trace events call trace_buffer_lock_reserve()
directly, which means that it misses out on some of the filtering
optimizations provided by the helper function
trace_event_buffer_lock_reserve(). Have the syscall trace events call that
instead, as it was missed when adding the update to use the temp buffer
when filtering.
Link: https://lkml.kernel.org/r/20220107225839.823118570@goodmis.org
Cc: stable(a)vger.kernel.org
Cc: Ingo Molnar <mingo(a)kernel.org>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Tom Zanussi <zanussi(a)kernel.org>
Reviewed-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Fixes: 0fc1b09ff1ff4 ("tracing: Use temp buffer when filtering events")
Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org>
---
kernel/trace/trace_syscalls.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index 8bfcd3b09422..f755bde42fd0 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -323,8 +323,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
trace_ctx = tracing_gen_ctx();
- buffer = tr->array_buffer.buffer;
- event = trace_buffer_lock_reserve(buffer,
+ event = trace_event_buffer_lock_reserve(&buffer, trace_file,
sys_data->enter_event->event.type, size, trace_ctx);
if (!event)
return;
@@ -367,8 +366,7 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
trace_ctx = tracing_gen_ctx();
- buffer = tr->array_buffer.buffer;
- event = trace_buffer_lock_reserve(buffer,
+ event = trace_event_buffer_lock_reserve(&buffer, trace_file,
sys_data->exit_event->event.type, sizeof(*entry),
trace_ctx);
if (!event)
--
2.33.0
Use down_read_nested() and down_write_nested() when taking the
ctrl->reset_lock rw-sem, passing the number of PCIe hotplug controllers in
the path to the PCI root bus as lock subclass parameter. This fixes the
following false-positive lockdep report when unplugging a Lenovo X1C8 from
a Lenovo 2nd gen TB3 dock:
[ 28.583853] pcieport 0000:06:01.0: pciehp: Slot(1): Link Down
[ 28.583891] pcieport 0000:06:01.0: pciehp: Slot(1): Card not present
[ 28.584849] ============================================
[ 28.584854] WARNING: possible recursive locking detected
[ 28.584858] 5.16.0-rc2+ #621 Not tainted
[ 28.584864] --------------------------------------------
[ 28.584867] irq/124-pciehp/86 is trying to acquire lock:
[ 28.584873] ffff8e5ac4299ef8 (&ctrl->reset_lock){.+.+}-{3:3}, at: pciehp_check_presence+0x23/0x80
[ 28.584904]
but task is already holding lock:
[ 28.584908] ffff8e5ac4298af8 (&ctrl->reset_lock){.+.+}-{3:3}, at: pciehp_ist+0xf3/0x180
[ 28.584929]
other info that might help us debug this:
[ 28.584933] Possible unsafe locking scenario:
[ 28.584936] CPU0
[ 28.584939] ----
[ 28.584942] lock(&ctrl->reset_lock);
[ 28.584949] lock(&ctrl->reset_lock);
[ 28.584955]
*** DEADLOCK ***
[ 28.584959] May be due to missing lock nesting notation
[ 28.584963] 3 locks held by irq/124-pciehp/86:
[ 28.584970] #0: ffff8e5ac4298af8 (&ctrl->reset_lock){.+.+}-{3:3}, at: pciehp_ist+0xf3/0x180
[ 28.584991] #1: ffffffffa3b024e8 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pciehp_unconfigure_device+0x31/0x110
[ 28.585012] #2: ffff8e5ac1ee2248 (&dev->mutex){....}-{3:3}, at: device_release_driver+0x1c/0x40
[ 28.585037]
stack backtrace:
[ 28.585042] CPU: 4 PID: 86 Comm: irq/124-pciehp Not tainted 5.16.0-rc2+ #621
[ 28.585052] Hardware name: LENOVO 20U90SIT19/20U90SIT19, BIOS N2WET30W (1.20 ) 08/26/2021
[ 28.585059] Call Trace:
[ 28.585064] <TASK>
[ 28.585073] dump_stack_lvl+0x59/0x73
[ 28.585087] __lock_acquire.cold+0xc5/0x2c6
[ 28.585106] ? find_held_lock+0x2b/0x80
[ 28.585124] lock_acquire+0xb5/0x2b0
[ 28.585132] ? pciehp_check_presence+0x23/0x80
[ 28.585144] ? lock_is_held_type+0xa8/0x120
[ 28.585161] down_read+0x3e/0x50
[ 28.585172] ? pciehp_check_presence+0x23/0x80
[ 28.585183] pciehp_check_presence+0x23/0x80
[ 28.585194] pciehp_runtime_resume+0x5c/0xa0
[ 28.585206] ? pci_msix_init+0x60/0x60
[ 28.585214] device_for_each_child+0x45/0x70
[ 28.585227] pcie_port_device_runtime_resume+0x20/0x30
[ 28.585236] pci_pm_runtime_resume+0xa7/0xc0
[ 28.585246] ? pci_pm_freeze_noirq+0x100/0x100
[ 28.585257] __rpm_callback+0x41/0x110
[ 28.585271] ? pci_pm_freeze_noirq+0x100/0x100
[ 28.585281] rpm_callback+0x59/0x70
[ 28.585293] rpm_resume+0x512/0x7b0
[ 28.585309] __pm_runtime_resume+0x4a/0x90
[ 28.585322] __device_release_driver+0x28/0x240
[ 28.585338] device_release_driver+0x26/0x40
[ 28.585351] pci_stop_bus_device+0x68/0x90
[ 28.585363] pci_stop_bus_device+0x2c/0x90
[ 28.585373] pci_stop_and_remove_bus_device+0xe/0x20
[ 28.585384] pciehp_unconfigure_device+0x6c/0x110
[ 28.585396] ? __pm_runtime_resume+0x58/0x90
[ 28.585409] pciehp_disable_slot+0x5b/0xe0
[ 28.585421] pciehp_handle_presence_or_link_change+0xc3/0x2f0
[ 28.585436] pciehp_ist+0x179/0x180
[ 28.585449] ? disable_irq_nosync+0x10/0x10
[ 28.585460] irq_thread_fn+0x1d/0x60
[ 28.585470] ? irq_thread+0x81/0x1a0
[ 28.585480] irq_thread+0xcb/0x1a0
[ 28.585491] ? irq_thread_fn+0x60/0x60
[ 28.585502] ? irq_thread_check_affinity+0xb0/0xb0
[ 28.585514] kthread+0x165/0x190
[ 28.585522] ? set_kthread_struct+0x40/0x40
[ 28.585531] ret_from_fork+0x1f/0x30
[ 28.585554] </TASK>
This lockdep warning is triggered because with Thunderbolt, hotplug ports
are nested. When removing multiple devices in a daisy-chain, each hotplug
port's reset_lock may be acquired recursively. It's never the same lock,
so the lockdep splat is a false positive.
Because locks at the same hierarchy level are never acquired recursively,
a per-level lockdep class is sufficient to fix the lockdep warning.
The choice to use one lockdep subclass per pcie-hotplug controller in
the path to the root-bus was made to conserve class keys because their
number is limited and the complexity grows quadratically with number of
keys according to Documentation/locking/lockdep-design.rst.
Link: https://lore.kernel.org/linux-pci/20190402021933.GA2966@mit.edu/
Link: https://lore.kernel.org/linux-pci/de684a28-9038-8fc6-27ca-3f6f2f6400d7@redh…
Cc: stable(a)vger.kernel.org
Reported-by: "Theodore Ts'o" <tytso(a)mit.edu>
Reviewed-by: Lukas Wunner <lukas(a)wunner.de>
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
---
Changes in v2:
- Only use a subclass for each hotplug capable port/parent in the path to
the PCI root bus, instead of one for each level in the PCI hierarchy,
to avoid hitting MAX_LOCKDEP_SUBCLASSES
- Drop the "PCI: Add a pci_dev_depth() helper function" since we now need
a special version of this to only count hotplug ports
- Various commit message improvements
---
drivers/pci/hotplug/pciehp.h | 3 +++
drivers/pci/hotplug/pciehp_core.c | 2 +-
drivers/pci/hotplug/pciehp_hpc.c | 21 ++++++++++++++++++---
3 files changed, 22 insertions(+), 4 deletions(-)
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index 918dccbc74b6..e0a614acee05 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -75,6 +75,8 @@ extern int pciehp_poll_time;
* @reset_lock: prevents access to the Data Link Layer Link Active bit in the
* Link Status register and to the Presence Detect State bit in the Slot
* Status register during a slot reset which may cause them to flap
+ * @depth: Number of additional hotplug ports in the path to the root bus,
+ * used as lock subclass for @reset_lock
* @ist_running: flag to keep user request waiting while IRQ thread is running
* @request_result: result of last user request submitted to the IRQ thread
* @requester: wait queue to wake up on completion of user request,
@@ -106,6 +108,7 @@ struct controller {
struct hotplug_slot hotplug_slot; /* hotplug core interface */
struct rw_semaphore reset_lock;
+ unsigned int depth;
unsigned int ist_running;
int request_result;
wait_queue_head_t requester;
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index f34114d45259..4042d87d539d 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -166,7 +166,7 @@ static void pciehp_check_presence(struct controller *ctrl)
{
int occupied;
- down_read(&ctrl->reset_lock);
+ down_read_nested(&ctrl->reset_lock, ctrl->depth);
mutex_lock(&ctrl->state_lock);
occupied = pciehp_card_present_or_link_active(ctrl);
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 83a0fa119cae..963fb50528da 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -583,7 +583,7 @@ static void pciehp_ignore_dpc_link_change(struct controller *ctrl,
* the corresponding link change may have been ignored above.
* Synthesize it to ensure that it is acted on.
*/
- down_read(&ctrl->reset_lock);
+ down_read_nested(&ctrl->reset_lock, ctrl->depth);
if (!pciehp_check_link_active(ctrl))
pciehp_request(ctrl, PCI_EXP_SLTSTA_DLLSC);
up_read(&ctrl->reset_lock);
@@ -746,7 +746,7 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id)
* Disable requests have higher priority than Presence Detect Changed
* or Data Link Layer State Changed events.
*/
- down_read(&ctrl->reset_lock);
+ down_read_nested(&ctrl->reset_lock, ctrl->depth);
if (events & DISABLE_SLOT)
pciehp_handle_disable_request(ctrl);
else if (events & (PCI_EXP_SLTSTA_PDC | PCI_EXP_SLTSTA_DLLSC))
@@ -906,7 +906,7 @@ int pciehp_reset_slot(struct hotplug_slot *hotplug_slot, bool probe)
if (probe)
return 0;
- down_write(&ctrl->reset_lock);
+ down_write_nested(&ctrl->reset_lock, ctrl->depth);
if (!ATTN_BUTTN(ctrl)) {
ctrl_mask |= PCI_EXP_SLTCTL_PDCE;
@@ -962,6 +962,20 @@ static inline void dbg_ctrl(struct controller *ctrl)
#define FLAG(x, y) (((x) & (y)) ? '+' : '-')
+static inline int pcie_hotplug_depth(struct pci_dev *dev)
+{
+ struct pci_bus *bus = dev->bus;
+ int depth = 0;
+
+ while (bus->parent) {
+ bus = bus->parent;
+ if (bus->self && bus->self->is_hotplug_bridge)
+ depth++;
+ }
+
+ return depth;
+}
+
struct controller *pcie_init(struct pcie_device *dev)
{
struct controller *ctrl;
@@ -975,6 +989,7 @@ struct controller *pcie_init(struct pcie_device *dev)
return NULL;
ctrl->pcie = dev;
+ ctrl->depth = pcie_hotplug_depth(dev->port);
pcie_capability_read_dword(pdev, PCI_EXP_SLTCAP, &slot_cap);
if (pdev->hotplug_user_indicators)
--
2.33.1
I'm announcing the release of the 5.15.14 kernel.
All users of the 5.15 kernel series must upgrade.
The updated 5.15.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm/boot/dts/bcm2711.dtsi | 2
arch/arm/boot/dts/bcm283x.dtsi | 2
arch/x86/kvm/debugfs.c | 3
drivers/auxdisplay/charlcd.c | 3
drivers/edac/i10nm_base.c | 9 +
drivers/gpio/gpio-aspeed-sgpio.c | 2
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1
drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 2
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 48 ++++++++-
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 8 -
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 6 +
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_init.c | 1
drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 25 ++++
drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.h | 31 +++++
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 15 +-
drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c | 3
drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 2
drivers/i2c/busses/i2c-mpc.c | 15 +-
drivers/i2c/i2c-core-base.c | 95 ------------------
drivers/infiniband/core/uverbs_marshall.c | 2
drivers/infiniband/core/uverbs_uapi.c | 3
drivers/infiniband/hw/mlx5/mlx5_ib.h | 6 -
drivers/infiniband/hw/mlx5/mr.c | 26 ++--
drivers/input/touchscreen/zinitix.c | 18 +--
drivers/isdn/mISDN/core.c | 6 -
drivers/isdn/mISDN/core.h | 4
drivers/isdn/mISDN/layer1.c | 4
drivers/md/raid1.c | 3
drivers/net/ethernet/amazon/ena/ena_netdev.c | 49 +++++----
drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 8 +
drivers/net/ethernet/intel/i40e/i40e_main.c | 60 +++++++++--
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 40 ++++++-
drivers/net/ethernet/intel/iavf/iavf_main.c | 5
drivers/net/ethernet/sfc/falcon/rx.c | 5
drivers/net/ethernet/sfc/rx_common.c | 5
drivers/net/ieee802154/atusb.c | 10 +
drivers/net/usb/r8152.c | 9 +
drivers/net/usb/rndis_host.c | 5
drivers/power/reset/ltc2952-poweroff.c | 4
drivers/power/supply/bq25890_charger.c | 4
drivers/power/supply/power_supply_core.c | 4
drivers/reset/reset-rzg2l-usbphy-ctrl.c | 7 +
drivers/scsi/libiscsi.c | 6 -
drivers/usb/mtu3/mtu3_gadget.c | 4
drivers/video/fbdev/core/fbmem.c | 47 ++++++++
fs/xfs/xfs_ioctl.c | 3
include/linux/fb.h | 1
include/linux/fscache.h | 2
include/net/sctp/sctp.h | 3
kernel/cgroup/cgroup-internal.h | 19 +++
kernel/cgroup/cgroup-v1.c | 33 +++---
kernel/cgroup/cgroup.c | 88 +++++++++++-----
kernel/trace/trace.c | 6 -
net/batman-adv/multicast.c | 15 +-
net/batman-adv/multicast.h | 10 +
net/batman-adv/soft-interface.c | 7 -
net/core/lwtunnel.c | 4
net/ipv4/fib_semantics.c | 49 ++++++++-
net/ipv4/udp.c | 2
net/ipv6/ip6_vti.c | 2
net/ipv6/raw.c | 3
net/ipv6/route.c | 32 +++++-
net/mac80211/ieee80211_i.h | 24 ++++
net/mac80211/mesh.h | 22 ----
net/mac80211/mesh_pathtbl.c | 89 +++++-----------
net/mac80211/mlme.c | 2
net/netrom/af_netrom.c | 2
net/phonet/pep.c | 1
net/sched/sch_qfq.c | 6 -
net/sctp/diag.c | 46 +++-----
net/sctp/socket.c | 22 ++--
net/tipc/socket.c | 2
samples/ftrace/ftrace-direct-modify.c | 3
samples/ftrace/ftrace-direct-too.c | 3
samples/ftrace/ftrace-direct.c | 2
tools/testing/selftests/net/udpgro_fwd.sh | 3
tools/testing/selftests/vm/userfaultfd.c | 16 +--
tools/testing/selftests/x86/test_vsyscall.c | 2
79 files changed, 736 insertions(+), 407 deletions(-)
Aaron Ma (1):
Revert "net: usb: r8152: Add MAC passthrough support for more Lenovo Docks"
Alex Deucher (3):
fbdev: fbmem: add a helper to determine if an aperture is used by a fw fb
drm/amdgpu: disable runpm if we are the primary adapter
drm/amdgpu: always reset the asic in suspend (v2)
Arthur Kiyanovski (3):
net: ena: Fix undefined state when tx request id is out of bounds
net: ena: Fix wrong rx request id by resetting device
net: ena: Fix error handling when calculating max IO queues number
Charlene Liu (1):
drm/amd/display: fix B0 TMDS deepcolor no dislay issue
Chris Packham (1):
i2c: mpc: Avoid out of bounds memory access
Christian König (1):
drm/amdgpu: fix dropped backing store handling in amdgpu_dma_buf_move_notify
Christoph Hellwig (1):
netrom: fix copying in user data in nr_setsockopt
Chunfeng Yun (1):
usb: mtu3: fix interval value for intr and isoc
Darrick J. Wong (1):
xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
David Ahern (7):
ipv4: Check attribute length for RTA_GATEWAY in multipath route
ipv4: Check attribute length for RTA_FLOW in multipath route
ipv6: Check attribute length for RTA_GATEWAY in multipath route
ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
lwtunnel: Validate RTA_ENCAP_TYPE attribute length
ipv6: Continue processing multipath route even if gateway attribute is invalid
ipv6: Do cleanup if attribute validation fails in multipath route
Di Zhu (1):
i40e: fix use-after-free in i40e_sync_filters_subtask()
Dominique Martinet (1):
fscache_cookie_enabled: check cookie is valid before accessing it
Eric Dumazet (1):
sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
Evan Quan (2):
drm/amdgpu: put SMU into proper state on runpm suspending for BOCO capable platform
drm/amd/pm: keep the BACO feature enabled for suspend
Greg Kroah-Hartman (1):
Linux 5.15.14
Haimin Zhang (1):
net ticp:fix a kernel-infoleak in __tipc_sendmsg()
Hangyu Hua (1):
phonet: refcount leak in pep_sock_accep
Heiner Kallweit (1):
reset: renesas: Fix Runtime PM usage
Jedrzej Jagielski (1):
i40e: Fix incorrect netdev's real number of RX/TX queues
Jianguo Wu (1):
selftests: net: udpgro_fwd.sh: explicitly checking the available ping feature
Jiasheng Jiang (1):
RDMA/uverbs: Check for null return of kmalloc_array
Jiri Olsa (1):
ftrace/samples: Add missing prototypes direct functions
Karen Sornek (1):
iavf: Fix limit of total number of queues to active queues of VF
Lai, Derek (1):
drm/amd/display: Added power down for DCN10
Len Brown (1):
Revert "drm/amdgpu: stop scheduler when calling hw_fini (v2)"
Leon Romanovsky (1):
RDMA/core: Don't infoleak GRH fields
Lijo Lazar (1):
drm/amd/pm: Fix xgmi link control on aldebaran
Linus Lüssing (1):
batman-adv: mcast: don't send link-local multicast to mcast routers
Linus Walleij (1):
power: supply: core: Break capacity loop
Lixiaokeng (1):
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
Luiz Sampaio (1):
auxdisplay: charlcd: checking for pointer reference before dereferencing
Maor Gottlieb (1):
Revert "RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow"
Martin Habets (1):
sfc: The RX page_ring is optional
Mateusz Palczewski (2):
i40e: Fix to not show opcode msg on unsuccessful VF MAC change
i40e: Fix for displaying message regarding NVM version
Mike Kravetz (1):
userfaultfd/selftests: fix hugetlb area allocations
Nathan Chancellor (1):
power: reset: ltc2952: Fix use of floating point literals
Naveen N. Rao (2):
tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
tracing: Tag trace_percpu_buffer as a percpu pointer
Nikita Travkin (1):
Input: zinitix - make sure the IRQ is allocated before it gets enabled
Nikunj A Dadhania (1):
KVM: x86: Check for rmaps allocation
Pavel Skripkin (2):
ieee802154: atusb: fix uninit value in atusb_set_extended_addr
mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
Phil Elwell (1):
ARM: dts: gpio-ranges property is now required
Prike Liang (1):
drm/amd/pm: skip setting gfx cgpg in the s0ix suspend-resume
Qiuxu Zhuo (1):
EDAC/i10nm: Release mdev/mbase when failing to detect HBM
Shuah Khan (1):
selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv()
Song Liu (1):
md/raid1: fix missing bitmap update w/o WriteMostly devices
Steven Lee (1):
gpio: gpio-aspeed-sgpio: Fix wrong hwirq base in irq handler
Tamir Duberstein (1):
ipv6: raw: check passed optlen before reading
Tejun Heo (3):
cgroup: Use open-time credentials for process migraton perm checks
cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
cgroup: Use open-time cgroup namespace for process migration perm checks
Thomas Toye (1):
rndis_host: support Hytera digital radios
Tom Rix (1):
mac80211: initialize variable have_higher_than_11mbit
William Zhao (1):
ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
Wolfram Sang (1):
Revert "i2c: core: support bus regulator controlling in adapter"
Xin Long (1):
sctp: hold endpoint before calling cb in sctp_transport_lookup_process
Yauhen Kharuzhy (1):
power: bq25890: Enable continuous conversion for ADC at charging
Zekun Shen (1):
atlantic: Fix buff_ring OOB in aq_ring_rx_clean
wolfgang huang (1):
mISDN: change function names to avoid conflicts
yangxingwu (1):
net: udp: fix alignment problem in udp4_seq_show()
Check out this report and any autotriaged failures in our web dashboard:
https://datawarehouse.cki-project.org/kcidb/checkouts/28727
Hello,
We ran automated tests on a recent commit from this kernel tree:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: 7fb4d82fc369 - drm/amd/pm: keep the BACO feature enabled for suspend
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
Targeted tests: NO
All kernel binaries, config files, and logs are available for download here:
https://arr-cki-prod-datawarehouse-public.s3.amazonaws.com/index.html?prefi…
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Compile testing
---------------
We compiled the kernel for 4 architectures:
aarch64:
make options: make -j24 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: make -j24 INSTALL_MOD_STRIP=1 targz-pkg
s390x:
make options: make -j24 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: make -j24 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
ppc64le:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
s390x:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
x86_64:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
Test sources: https://gitlab.com/cki-project/kernel-tests
💚 Pull requests are welcome for new tests or improvements to existing tests!
Aborted tests
-------------
Tests that didn't complete running successfully are marked with ⚡⚡⚡.
If this was caused by an infrastructure issue, we try to mark that
explicitly in the report.
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Testing timeout
---------------
We aim to provide a report within reasonable timeframe. Tests that haven't
finished running yet are marked with ⏱.
Targeted tests
--------------
Test runs for patches always include a set of base tests, plus some
tests chosen based on the file paths modified by the patch. The latter
are called "targeted tests". If no targeted tests are run, that means
no patch-specific tests are available. Please, consider contributing a
targeted test for related patches to increase test coverage. See
https://docs.engineering.redhat.com/x/_wEZB for more details.
I'm announcing the release of the 4.19.225 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
drivers/infiniband/core/uverbs_marshall.c | 2 -
drivers/isdn/mISDN/core.c | 6 +--
drivers/isdn/mISDN/core.h | 4 +-
drivers/isdn/mISDN/layer1.c | 4 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 56 ++++++++++++++++++++++++----
drivers/net/ieee802154/atusb.c | 10 +++--
drivers/net/usb/rndis_host.c | 5 ++
drivers/power/reset/ltc2952-poweroff.c | 4 +-
drivers/scsi/libiscsi.c | 6 ++-
drivers/usb/mtu3/mtu3_gadget.c | 4 +-
fs/xfs/xfs_ioctl.c | 3 +
kernel/trace/trace.c | 6 +--
net/ipv4/udp.c | 2 -
net/ipv6/ip6_vti.c | 2 +
net/ipv6/route.c | 28 +++++++++++++-
net/mac80211/mlme.c | 2 -
net/phonet/pep.c | 1
net/sched/sch_qfq.c | 6 +--
19 files changed, 115 insertions(+), 38 deletions(-)
Chunfeng Yun (1):
usb: mtu3: fix interval value for intr and isoc
Darrick J. Wong (1):
xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
David Ahern (4):
ipv6: Check attribute length for RTA_GATEWAY in multipath route
ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
ipv6: Continue processing multipath route even if gateway attribute is invalid
ipv6: Do cleanup if attribute validation fails in multipath route
Di Zhu (1):
i40e: fix use-after-free in i40e_sync_filters_subtask()
Eric Dumazet (1):
sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
Greg Kroah-Hartman (1):
Linux 4.19.225
Hangyu Hua (1):
phonet: refcount leak in pep_sock_accep
Jedrzej Jagielski (1):
i40e: Fix incorrect netdev's real number of RX/TX queues
Leon Romanovsky (1):
RDMA/core: Don't infoleak GRH fields
Lixiaokeng (1):
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
Nathan Chancellor (1):
power: reset: ltc2952: Fix use of floating point literals
Naveen N. Rao (2):
tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
tracing: Tag trace_percpu_buffer as a percpu pointer
Pavel Skripkin (1):
ieee802154: atusb: fix uninit value in atusb_set_extended_addr
Thomas Toye (1):
rndis_host: support Hytera digital radios
Tom Rix (1):
mac80211: initialize variable have_higher_than_11mbit
William Zhao (1):
ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
wolfgang huang (1):
mISDN: change function names to avoid conflicts
yangxingwu (1):
net: udp: fix alignment problem in udp4_seq_show()
I'm announcing the release of the 4.14.262 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
drivers/bluetooth/btusb.c | 32 ++++++++++++----
drivers/infiniband/core/uverbs_marshall.c | 2 -
drivers/isdn/mISDN/core.c | 6 +--
drivers/isdn/mISDN/core.h | 4 +-
drivers/isdn/mISDN/layer1.c | 4 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 56 ++++++++++++++++++++++++----
drivers/net/ieee802154/atusb.c | 10 +++--
drivers/net/usb/rndis_host.c | 5 ++
drivers/power/reset/ltc2952-poweroff.c | 4 +-
drivers/scsi/libiscsi.c | 6 ++-
drivers/virtio/virtio_pci_common.c | 7 +++
fs/xfs/xfs_ioctl.c | 3 +
kernel/trace/trace.c | 6 +--
net/ipv4/udp.c | 2 -
net/ipv6/ip6_vti.c | 2 +
net/ipv6/route.c | 28 +++++++++++++-
net/mac80211/mlme.c | 2 -
net/phonet/pep.c | 1
net/sched/sch_qfq.c | 6 +--
20 files changed, 145 insertions(+), 43 deletions(-)
Darrick J. Wong (1):
xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
David Ahern (4):
ipv6: Check attribute length for RTA_GATEWAY in multipath route
ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
ipv6: Continue processing multipath route even if gateway attribute is invalid
ipv6: Do cleanup if attribute validation fails in multipath route
Di Zhu (1):
i40e: fix use-after-free in i40e_sync_filters_subtask()
Eric Dumazet (1):
sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
Greg Kroah-Hartman (1):
Linux 4.14.262
Hangyu Hua (1):
phonet: refcount leak in pep_sock_accep
Jedrzej Jagielski (1):
i40e: Fix incorrect netdev's real number of RX/TX queues
Leon Romanovsky (1):
RDMA/core: Don't infoleak GRH fields
Lixiaokeng (1):
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
Nathan Chancellor (1):
power: reset: ltc2952: Fix use of floating point literals
Naveen N. Rao (2):
tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
tracing: Tag trace_percpu_buffer as a percpu pointer
Parav Pandit (1):
virtio_pci: Support surprise removal of virtio pci device
Pavel Skripkin (1):
ieee802154: atusb: fix uninit value in atusb_set_extended_addr
Takashi Iwai (1):
Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models
Thomas Toye (1):
rndis_host: support Hytera digital radios
Tom Rix (1):
mac80211: initialize variable have_higher_than_11mbit
William Zhao (1):
ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
wolfgang huang (1):
mISDN: change function names to avoid conflicts
yangxingwu (1):
net: udp: fix alignment problem in udp4_seq_show()
Some BIOS-es contain a bug where they add addresses which map to system
RAM in the PCI host bridge window returned by the ACPI _CRS method, see
commit 4dc2287c1805 ("x86: avoid E820 regions when allocating address
space").
To work around this bug Linux excludes E820 reserved addresses when
allocating addresses from the PCI host bridge window since 2010.
Recently (2019) some systems have shown-up with E820 reservations which
cover the entire _CRS returned PCI bridge memory window, causing all
attempts to assign memory to PCI BARs which have not been setup by the
BIOS to fail. For example here are the relevant dmesg bits from a
Lenovo IdeaPad 3 15IIL 81WE:
[mem 0x000000004bc50000-0x00000000cfffffff] reserved
pci_bus 0000:00: root bus resource [mem 0x65400000-0xbfffffff window]
The ACPI specifications appear to allow this new behavior:
The relationship between E820 and ACPI _CRS is not really very clear.
ACPI v6.3, sec 15, table 15-374, says AddressRangeReserved means:
This range of addresses is in use or reserved by the system and is
not to be included in the allocatable memory pool of the operating
system's memory manager.
and it may be used when:
The address range is in use by a memory-mapped system device.
Furthermore, sec 15.2 says:
Address ranges defined for baseboard memory-mapped I/O devices, such
as APICs, are returned as reserved.
A PCI host bridge qualifies as a baseboard memory-mapped I/O device,
and its apertures are in use and certainly should not be included in
the general allocatable pool, so the fact that some BIOS-es reports
the PCI aperture as "reserved" in E820 doesn't seem like a BIOS bug.
So it seems that the excluding of E820 reserved addresses is a mistake.
Ideally Linux would fully stop excluding E820 reserved addresses,
but then the old systems this was added for will regress.
Instead keep the old behavior for old systems, while ignoring
the E820 reservations for any systems from now on.
Old systems are defined here as BIOS year < 2018, this was chosen to make
sure that E820 reservations will not be used on the currently affected
systems, while at the same time also taking into account that the systems
for which the E820 checking was originally added may have received BIOS
updates for quite a while (esp. CVE related ones), giving them a more
recent BIOS year then 2010.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206459
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1868899
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1871793
BugLink: https://bugs.launchpad.net/bugs/1878279
BugLink: https://bugs.launchpad.net/bugs/1931715
BugLink: https://bugs.launchpad.net/bugs/1932069
BugLink: https://bugs.launchpad.net/bugs/1921649
Cc: Benoit Grégoire <benoitg(a)coeus.ca>
Cc: Hui Wang <hui.wang(a)canonical.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Mika Westerberg <mika.westerberg(a)linux.intel.com>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
Acked-by: Bjorn Helgaas <bhelgaas(a)google.com>
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
---
Changes in v6:
- Remove the possibility to change the behavior from the commandline
because of worries that users may use this to paper over other problems
Changes in v5:
- Drop mention of Windows behavior from the commit msg, replace with a
reference to the specs
- Improve documentation in Documentation/admin-guide/kernel-parameters.txt
- Reword the big comment added, use "PCI host bridge window" in it and drop
all refences to Windows
Changes in v4:
- Rewrap the big comment block to fit in 80 columns
- Add Rafael's Acked-by
- Add Cc: stable(a)vger.kernel.org
Changes in v3:
- Commit msg tweaks (drop dmesg timestamps, typo fix)
- Use "defined(CONFIG_...)" instead of "defined CONFIG_..."
- Add Mika's Reviewed-by
Changes in v2:
- Replace the per model DMI quirk approach with disabling E820 reservations
checking for all systems with a BIOS year >= 2018
- Add documentation for the new kernel-parameters to
Documentation/admin-guide/kernel-parameters.txt
---
Other patches trying to address the same issue:
https://lore.kernel.org/r/20210624095324.34906-1-hui.wang@canonical.comhttps://lore.kernel.org/r/20200617164734.84845-1-mika.westerberg@linux.inte…
V1 patch:
https://lore.kernel.org/r/20211005150956.303707-1-hdegoede@redhat.com
---
arch/x86/kernel/resource.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/resource.c b/arch/x86/kernel/resource.c
index 9b9fb7882c20..9ae64f9af956 100644
--- a/arch/x86/kernel/resource.c
+++ b/arch/x86/kernel/resource.c
@@ -1,4 +1,5 @@
// SPDX-License-Identifier: GPL-2.0
+#include <linux/dmi.h>
#include <linux/ioport.h>
#include <asm/e820/api.h>
@@ -23,11 +24,31 @@ static void resource_clip(struct resource *res, resource_size_t start,
res->start = end + 1;
}
+/*
+ * Some BIOS-es contain a bug where they add addresses which map to
+ * system RAM in the PCI host bridge window returned by the ACPI _CRS
+ * method, see commit 4dc2287c1805 ("x86: avoid E820 regions when
+ * allocating address space"). To avoid this Linux by default excludes
+ * E820 reservations when allocating addresses since 2010.
+ * In 2019 some systems have shown-up with E820 reservations which cover
+ * the entire _CRS returned PCI host bridge window, causing all attempts
+ * to assign memory to PCI BARs to fail if Linux uses E820 reservations.
+ *
+ * Ideally Linux would fully stop using E820 reservations, but then
+ * the old systems this was added for will regress.
+ * Instead keep the old behavior for old systems, while ignoring the
+ * E820 reservations for any systems from now on.
+ */
static void remove_e820_regions(struct resource *avail)
{
- int i;
+ int i, year = dmi_get_bios_year();
struct e820_entry *entry;
+ if (year >= 2018)
+ return;
+
+ pr_info_once("PCI: Removing E820 reservations from host bridge windows\n");
+
for (i = 0; i < e820_table->nr_entries; i++) {
entry = &e820_table->entries[i];
--
2.33.1
I'm announcing the release of the 4.9.297 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm64/include/asm/sysreg.h | 69 +++++++++++++++++++++--
arch/arm64/kernel/head.S | 49 ++++++----------
arch/arm64/mm/proc.S | 24 --------
drivers/bluetooth/btusb.c | 32 ++++++++--
drivers/isdn/mISDN/core.c | 6 +-
drivers/isdn/mISDN/core.h | 4 -
drivers/isdn/mISDN/layer1.c | 4 -
drivers/net/ethernet/intel/i40e/i40e_main.c | 32 ++++++++--
drivers/net/ieee802154/atusb.c | 10 ++-
drivers/net/usb/rndis_host.c | 5 +
drivers/power/reset/ltc2952-poweroff.c | 4 -
drivers/scsi/libiscsi.c | 6 +-
drivers/virtio/virtio_pci_common.c | 7 ++
fs/xfs/xfs_ioctl.c | 3 -
include/linux/bug.h | 72 ------------------------
include/linux/build_bug.h | 84 ++++++++++++++++++++++++++++
kernel/trace/trace.c | 6 +-
net/ipv4/udp.c | 2
net/ipv6/ip6_vti.c | 2
net/mac80211/mlme.c | 2
net/phonet/pep.c | 1
net/sched/sch_qfq.c | 6 --
23 files changed, 264 insertions(+), 168 deletions(-)
Darrick J. Wong (1):
xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
Eric Dumazet (1):
sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
Greg Kroah-Hartman (1):
Linux 4.9.297
Hangyu Hua (1):
phonet: refcount leak in pep_sock_accep
Ian Abbott (1):
bug: split BUILD_BUG stuff out into <linux/build_bug.h>
James Morse (1):
arm64: sysreg: Move to use definitions for all the SCTLR bits
Jedrzej Jagielski (1):
i40e: Fix incorrect netdev's real number of RX/TX queues
Lixiaokeng (1):
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
Mark Rutland (2):
arm64: reduce el2_setup branching
arm64: move !VHE work to end of el2_setup
Nathan Chancellor (1):
power: reset: ltc2952: Fix use of floating point literals
Naveen N. Rao (2):
tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
tracing: Tag trace_percpu_buffer as a percpu pointer
Parav Pandit (1):
virtio_pci: Support surprise removal of virtio pci device
Pavel Skripkin (1):
ieee802154: atusb: fix uninit value in atusb_set_extended_addr
Stefan Traby (1):
arm64: Remove a redundancy in sysreg.h
Takashi Iwai (1):
Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models
Thomas Toye (1):
rndis_host: support Hytera digital radios
Tom Rix (1):
mac80211: initialize variable have_higher_than_11mbit
William Zhao (1):
ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
wolfgang huang (1):
mISDN: change function names to avoid conflicts
yangxingwu (1):
net: udp: fix alignment problem in udp4_seq_show()
I'm announcing the release of the 4.4.299 kernel.
All users of the 4.4 kernel series must upgrade.
The updated 4.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
drivers/bluetooth/btusb.c | 32 +++++++++++++++++++++-------
drivers/isdn/mISDN/core.c | 6 ++---
drivers/isdn/mISDN/core.h | 4 +--
drivers/isdn/mISDN/layer1.c | 4 +--
drivers/net/ethernet/intel/i40e/i40e_main.c | 32 +++++++++++++++++++++-------
drivers/net/ieee802154/atusb.c | 10 +++++---
drivers/net/usb/rndis_host.c | 5 ++++
drivers/power/reset/ltc2952-poweroff.c | 4 +--
drivers/scsi/libiscsi.c | 6 +++--
fs/xfs/xfs_ioctl.c | 3 +-
lib/test_bpf.c | 2 -
net/ipv4/udp.c | 2 -
net/ipv6/ip6_vti.c | 2 +
net/mac80211/mlme.c | 2 -
net/phonet/pep.c | 1
net/sched/sch_qfq.c | 6 +----
17 files changed, 85 insertions(+), 38 deletions(-)
Daniel Borkmann (1):
bpf, test: fix ld_abs + vlan push/pop stress test
Darrick J. Wong (1):
xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
Eric Dumazet (1):
sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
Greg Kroah-Hartman (1):
Linux 4.4.299
Hangyu Hua (1):
phonet: refcount leak in pep_sock_accep
Jedrzej Jagielski (1):
i40e: Fix incorrect netdev's real number of RX/TX queues
Lixiaokeng (1):
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
Nathan Chancellor (1):
power: reset: ltc2952: Fix use of floating point literals
Pavel Skripkin (1):
ieee802154: atusb: fix uninit value in atusb_set_extended_addr
Takashi Iwai (1):
Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models
Thomas Toye (1):
rndis_host: support Hytera digital radios
Tom Rix (1):
mac80211: initialize variable have_higher_than_11mbit
William Zhao (1):
ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
wolfgang huang (1):
mISDN: change function names to avoid conflicts
yangxingwu (1):
net: udp: fix alignment problem in udp4_seq_show()