4.12.1-stable review
Greg Kroah-Hartman
maintainercover 4.12.1-stable review
This is the start of the stable review cycle for the 4.12.1 release. There are 27 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jul 12 17:00:45 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.12.1-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.12.1-rc1
Stephan Mueller <[email protected]>
crypto: drbg - Fixes panic in wait_for_completion call
Juergen Gross <[email protected]>
xen: avoid deadlock in xenbus driver
Thomas Gleixner <[email protected]>
sched/numa: Hide numa_wake_affine() from UP build
Rik van Riel <[email protected]>
sched/fair: Remove effective_load()
Rik van Riel <[email protected]>
sched/numa: Implement NUMA node level wake_affine()
Rik van Riel <[email protected]>
sched/fair: Simplify wake_affine() for the single socket case
Rik van Riel <[email protected]>
sched/numa: Override part of migrate_degrades_locality() when idle balancing
Vlastimil Babka <[email protected]>
sched/numa: Use down_read_trylock() for the mmap_sem
Peter Zijlstra <[email protected]>
sched/core: Implement new approach to scale select_idle_cpu()
Peter Zijlstra <[email protected]>
sched/fair, cpumask: Export for_each_cpu_wrap()
Paolo Abeni <[email protected]>
x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings
Nicholas Piggin <[email protected]>
powerpc/powernv: Fix CPU_HOTPLUG=n idle.c compile error
Jarkko Sakkinen <[email protected]>
tpm: fix a kernel memory leak in tpm-sysfs.c
Josh Zimmerman <[email protected]>
tpm: Issue a TPM2_Shutdown for TPM2 devices.
Josh Zimmerman <[email protected]>
Add "shutdown" to "struct class".
Andreas Gruenbacher <[email protected]>
gfs2: Fix glock rhashtable rcu bug
Jiahau Chang <[email protected]>
xhci: Limit USB2 port wake support for AMD Promontory hosts
Bjørn Mork <[email protected]>
USB: serial: qcserial: new Sierra Wireless EM7305 device ID
Johan Hovold <[email protected]>
USB: serial: option: add two Longcheer device ids
Johan Hovold <[email protected]>
USB: core: fix device node leak
Benjamin Herrenschmidt <[email protected]>
usb: Fix typo in the definition of Endpoint[out]Request
Devin Heitmueller <[email protected]>
Add USB quirk for HVR-950q to avoid intermittent device resets
Michael Grzeschik <[email protected]>
usb: usbip: set buffer pointers to NULL after free
Jeremie Rapin <[email protected]>
USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
Felipe Balbi <[email protected]>
usb: dwc3: replace %p with %pK
Boris Pismenny <[email protected]>
RDMA/uverbs: Check port number supplied by user verbs cmds
Adrian Salido <[email protected]>
driver core: platform: fix race condition with driver_override
-------------
Diffstat:
Makefile | 4 +- arch/powerpc/platforms/powernv/idle.c | 2 + arch/x86/lib/copy_user_64.S | 7 +- crypto/drbg.c | 1 + drivers/base/core.c | 6 +- drivers/base/platform.c | 11 +- drivers/char/tpm/tpm-chip.c | 34 ++++ drivers/char/tpm/tpm-sysfs.c | 6 +- drivers/infiniband/core/uverbs_cmd.c | 8 + drivers/usb/core/quirks.c | 4 + drivers/usb/core/usb.c | 2 + drivers/usb/dwc3/dwc3-st.c | 2 +- drivers/usb/dwc3/gadget.c | 9 +- drivers/usb/host/xhci-hub.c | 3 + drivers/usb/host/xhci-pci.c | 12 ++ drivers/usb/host/xhci.h | 1 + drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/option.c | 4 + drivers/usb/serial/qcserial.c | 1 + drivers/usb/usbip/stub_main.c | 4 + drivers/usb/usbip/stub_tx.c | 4 + drivers/xen/xenbus/xenbus_comms.c | 21 +-- fs/gfs2/glock.c | 11 +- fs/gfs2/incore.h | 1 + include/linux/cpumask.h | 17 ++ include/linux/device.h | 2 + include/linux/usb/hcd.h | 4 +- kernel/sched/fair.c | 332 +++++++++++----------------------- kernel/sched/features.h | 1 + lib/cpumask.c | 32 ++++ 30 files changed, 292 insertions(+), 255 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/27 driver core: platform: fix race condition with driver_override
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Salido <[email protected]>
commit 6265539776a0810b7ce6398c27866ddb9c6bd154 upstream.
The driver_override implementation is susceptible to race condition when different threads are reading vs storing a different driver override. Add locking to avoid race condition.
--- drivers/base/platform.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/base/platform.c +9 -2
@@ -866,7 +866,7 @@ static ssize_t driver_override_store(str const char *buf, size_t count) {struct platform_device *pdev =to_platform_device (dev); -char *driver_override, *old = pdev->driver_override, *cp; +char *driver_override, *old, *cp;if (count >PATH_MAX )return -EINVAL ;
@@ -879,12 +879,15 @@ static ssize_t driver_override_store(strif (cp) *cp ='\0' ; +device_lock (dev); + old = pdev->driver_override;if (strlen (driver_override)) { pdev->driver_override = driver_override; }else {kfree (driver_override); pdev->driver_override =NULL ; } +device_unlock (dev);kfree (old);
@@ -895,8 +898,12 @@ static ssize_t driver_override_show(stru struct device_attribute *attr, char *buf) { struct platform_device *pdev = to_platform_device(dev); +ssize_t len; -return sprintf (buf,"%s\n" , pdev->driver_override); +device_lock (dev); + len =sprintf (buf,"%s\n" , pdev->driver_override); +device_unlock (dev); +return len; }static DEVICE_ATTR_RW (driver_override);
Greg Kroah-Hartman
maintainerPATCH 2/27 RDMA/uverbs: Check port number supplied by user verbs cmds
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Pismenny <[email protected]>
commit 5ecce4c9b17bed4dc9cb58bfb10447307569b77b upstream.
The ib_uverbs_create_ah() ind ib_uverbs_modify_qp() calls receive the port number from user input as part of its attributes and assumes it is valid. Down on the stack, that parameter is used to access kernel data structures. If the value is invalid, the kernel accesses memory it should not. To prevent this, verify the port number before using it.
BUG: KASAN: use-after-free in ib_uverbs_create_ah+0x6d5/0x7b0 Read of size 4 at addr ffff880018d67ab8 by task syz-executor/313 BUG: KASAN: slab-out-of-bounds in modify_qp.isra.4+0x19d0/0x1ef0 Read of size 4 at addr ffff88006c40ec58 by task syz-executor/819
--- drivers/infiniband/core/uverbs_cmd.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/infiniband/core/uverbs_cmd.c +8 -0
@@ -1931,6 +1931,11 @@ static int modify_qp(struct ib_uverbs_fi goto out; } +if (!rdma_is_port_valid (qp->device, cmd->base.port_num)) { + ret = -EINVAL ; + goto release_qp; + } + attr->qp_state = cmd->base.qp_state; attr->cur_qp_state = cmd->base.cur_qp_state; attr->path_mtu = cmd->base.path_mtu;
@@ -2541,6 +2546,9 @@ ssize_t ib_uverbs_create_ah(struct ib_uvif (copy_from_user (&cmd, buf,sizeof cmd))return -EFAULT ; +if (!rdma_is_port_valid (ib_dev, cmd.attr.port_num)) +return -EINVAL ; +INIT_UDATA (&udata, buf +sizeof (cmd), (unsigned long )cmd.response +sizeof (resp), in_len -sizeof (cmd), out_len -sizeof (resp));
Greg Kroah-Hartman
maintainerPATCH 3/27 usb: dwc3: replace %p with %pK
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit 04fb365c453e14ff9e8a28f1c46050d920a27a4a upstream.
%p will leak kernel pointers, so let's not expose the information on dmesg and instead use %pK. %pK will only show the actual addresses if explicitly enabled under /proc/sys/kernel/kptr_restrict.
--- drivers/usb/dwc3/dwc3-st.c | 2 +- drivers/usb/dwc3/gadget.c | 9 +++------ 2 files changed, 4 insertions(+), 7 deletions(-)
drivers/usb/dwc3/dwc3-st.c +1 -1
@@ -230,7 +230,7 @@ static int st_dwc3_probe(struct platform dwc3_data->syscfg_reg_off = res->start; -dev_vdbg (&pdev->dev,"glue-logic addr 0x%p, syscfg-reg offset 0x%x\n" , +dev_vdbg (&pdev->dev,"glue-logic addr 0x%pK, syscfg-reg offset 0x%x\n" , dwc3_data->glue_base, dwc3_data->syscfg_reg_off); dwc3_data->rstc_pwrdn =
drivers/usb/dwc3/gadget.c +3 -6
@@ -1215,12 +1215,9 @@ static int __dwc3_gadget_ep_queue(structreturn -ESHUTDOWN ; } -if (WARN (req->dep != dep,"request %p belongs to '%s'\n" , - &req->request, req->dep->name)) { -dev_err (dwc->dev,"%s: request %p belongs to '%s'\n" , - dep->name, &req->request, req->dep->name); +if (WARN (req->dep != dep,"request %pK belongs to '%s'\n" , + &req->request, req->dep->name))return -EINVAL ; - }pm_runtime_get (dwc->dev);
@@ -1396,7 +1393,7 @@ static int dwc3_gadget_ep_dequeue(struct } goto out1; } -dev_err (dwc->dev,"request %p was not queued to %s\n" , +dev_err (dwc->dev,"request %pK was not queued to %s\n" , request, ep->name); ret = -EINVAL ; goto out0;
Greg Kroah-Hartman
maintainerPATCH 4/27 USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremie Rapin <[email protected]>
commit fd90f73a9925f248d696bde1cfc836d9fda5570d upstream.
Added the USB serial device ID for the CEL ZigBee EM3588 radio stick.
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -141,6 +141,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ + { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
Greg Kroah-Hartman
maintainerPATCH 5/27 usb: usbip: set buffer pointers to NULL after free
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Grzeschik <[email protected]>
commit b3b51417d0af63fb9a06662dc292200aed9ea53f upstream.
The usbip stack dynamically allocates the transfer_buffer and setup_packet of each urb that got generated by the tcp to usb stub code. As these pointers are always used only once we will set them to NULL after use. This is done likewise to the free_urb code in vudc_dev.c. This patch fixes double kfree situations where the usbip remote side added the URB_FREE_BUFFER.
--- drivers/usb/usbip/stub_main.c | 4 ++++ drivers/usb/usbip/stub_tx.c | 4 ++++ 2 files changed, 8 insertions(+)
drivers/usb/usbip/stub_main.c +4 -0
@@ -262,7 +262,11 @@ void stub_device_cleanup_urbs(struct stukmem_cache_free (stub_priv_cache, priv);kfree (urb->transfer_buffer); + urb->transfer_buffer =NULL ; +kfree (urb->setup_packet); + urb->setup_packet =NULL ; +usb_free_urb (urb); } }
drivers/usb/usbip/stub_tx.c +4 -0
@@ -28,7 +28,11 @@ static void stub_free_priv_and_urb(strucstruct urb *urb = priv->urb;kfree (urb->setup_packet); + urb->setup_packet =NULL ; +kfree (urb->transfer_buffer); + urb->transfer_buffer =NULL ; +list_del (&priv->list);kmem_cache_free (stub_priv_cache, priv);usb_free_urb (urb);
Greg Kroah-Hartman
maintainerPATCH 6/27 Add USB quirk for HVR-950q to avoid intermittent device resets
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devin Heitmueller <[email protected]>
commit 6836796de4019944f4ba4c99a360e8250fd2e735 upstream.
The USB core and sysfs will attempt to enumerate certain parameters which are unsupported by the au0828 - causing inconsistent behavior and sometimes causing the chip to reset. Avoid making these calls.
This problem manifested as intermittent cases where the au8522 would be reset on analog video startup, in particular when starting up ALSA audio streaming in parallel - the sysfs entries created by snd-usb-audio on streaming startup would result in unsupported control messages being sent during tuning which would put the chip into an unknown state.
--- drivers/usb/core/quirks.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/core/quirks.c +4 -0
@@ -223,6 +223,10 @@ static const struct usb_device_id usb_qu/* Blackmagic Design UltraStudio SDI */ { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM }, + /* Hauppauge HVR-950q */ + { USB_DEVICE(0x2040, 0x7200), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + /* INTEL VALUE SSD */ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
Greg Kroah-Hartman
maintainerPATCH 7/27 usb: Fix typo in the definition of Endpoint[out]Request
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Herrenschmidt <[email protected]>
commit 7cf916bd639bd26db7214f2205bccdb4b9306256 upstream.
The current definition is wrong. This breaks my upcoming Aspeed virtual hub driver.
--- include/linux/usb/hcd.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/usb/hcd.h +2 -2
@@ -565,9 +565,9 @@ extern void usb_ep0_reinit(struct usb_de ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8)#define EndpointRequest \ - ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8) + ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_ENDPOINT)<<8)#define EndpointOutRequest \ - ((USB_DIR_OUT|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8) + ((USB_DIR_OUT|USB_TYPE_STANDARD|USB_RECIP_ENDPOINT)<<8)/* class requests from the USB 2.0 hub spec, table 11-15 */ #define HUB_CLASS_REQ (dir, type, request) ((((dir) | (type)) << 8) | (request))
Greg Kroah-Hartman
maintainerPATCH 8/27 USB: core: fix device node leak
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit e271b2c909a22a2c13b2d5f77f2ce0091b74540c upstream.
Make sure to release any OF device-node reference taken when creating the USB device.
Note that we currently do not hold a reference to the root hub device-tree node (i.e. the parent controller node).
--- drivers/usb/core/usb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/core/usb.c +2 -0
@@ -416,6 +416,8 @@ static void usb_release_dev(struct devicusb_destroy_configuration (udev);usb_release_bos_descriptor (udev); +if (udev->parent) +of_node_put (dev->of_node);usb_put_hcd (hcd);kfree (udev->product);kfree (udev->manufacturer);
Greg Kroah-Hartman
maintainerPATCH 11/27 xhci: Limit USB2 port wake support for AMD Promontory hosts
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiahau Chang <[email protected]>
commit dec08194ffeccfa1cf085906b53d301930eae18f upstream.
For AMD Promontory xHCI host, although you can disable USB 2.0 ports in BIOS settings, those ports will be enabled anyway after you remove a device on that port and re-plug it in again. It's a known limitation of the chip. As a workaround we can clear the PORT_WAKE_BITS.
This will disable wake on connect, disconnect and overcurrent on AMD Promontory USB2 ports
--- drivers/usb/host/xhci-hub.c | 3 +++ drivers/usb/host/xhci-pci.c | 12 ++++++++++++ drivers/usb/host/xhci.h | 1 + 3 files changed, 16 insertions(+)
drivers/usb/host/xhci-hub.c +3 -0
@@ -1461,6 +1461,9 @@ int xhci_bus_suspend(struct usb_hcd *hcd t2 |=PORT_WKOC_E |PORT_WKCONN_E ; t2 &= ~PORT_WKDISC_E ; } +if ((xhci->quirks &XHCI_U2_DISABLE_WAKE ) && + (hcd->speed <HCD_USB3 )) + t2 &= ~PORT_WAKE_BITS ; }else t2 &= ~PORT_WAKE_BITS ;
drivers/usb/host/xhci-pci.c +12 -0
@@ -54,6 +54,11 @@#define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8#define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0 +#define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9 +#define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba +#define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb +#define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc +static const char hcd_name[] ="xhci_hcd" ;static struct hc_driver __read_mostly xhci_pci_hc_driver;
@@ -135,6 +140,13 @@ static void xhci_pci_quirks(struct devicif (pdev->vendor ==PCI_VENDOR_ID_AMD ) xhci->quirks |=XHCI_TRUST_TX_LENGTH ; +if ((pdev->vendor ==PCI_VENDOR_ID_AMD ) && + ((pdev->device ==PCI_DEVICE_ID_AMD_PROMONTORYA_4 ) || + (pdev->device ==PCI_DEVICE_ID_AMD_PROMONTORYA_3 ) || + (pdev->device ==PCI_DEVICE_ID_AMD_PROMONTORYA_2 ) || + (pdev->device ==PCI_DEVICE_ID_AMD_PROMONTORYA_1 ))) + xhci->quirks |=XHCI_U2_DISABLE_WAKE ; +if (pdev->vendor ==PCI_VENDOR_ID_INTEL ) { xhci->quirks |=XHCI_LPM_SUPPORT ; xhci->quirks |=XHCI_INTEL_HOST ;
drivers/usb/host/xhci.h +1 -0
@@ -1819,6 +1819,7 @@ struct xhci_hcd {/* For controller with a broken Port Disable implementation */ #define XHCI_BROKEN_PORT_PED (1 << 25)#define XHCI_LIMIT_ENDPOINT_INTERVAL_7 (1 << 26) +#define XHCI_U2_DISABLE_WAKE (1 << 27)unsigned int num_active_eps;unsigned int limit_active_eps;
Greg Kroah-Hartman
maintainerPATCH 12/27 gfs2: Fix glock rhashtable rcu bug
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
commit 961ae1d83d055a4b9ebbfb4cc8ca62ec1a7a3b74 upstream.
Before commit 88ffbf3e03 "GFS2: Use resizable hash table for glocks", glocks were freed via call_rcu to allow reading the glock hashtable locklessly using rcu. This was then changed to free glocks immediately, which made reading the glock hashtable unsafe. Bring back the original code for freeing glocks via call_rcu.
--- fs/gfs2/glock.c | 11 +++++++++-- fs/gfs2/incore.h | 1 + 2 files changed, 10 insertions(+), 2 deletions(-)
fs/gfs2/glock.c +9 -2
@@ -80,9 +80,9 @@ static struct rhashtable_params ht_parmsstatic struct rhashtable gl_hash_table; -void gfs2_glock_free (struct gfs2_glock *gl) +static void gfs2_glock_dealloc (struct rcu_head *rcu) { -struct gfs2_sbd *sdp = gl->gl_name.ln_sbd; + struct gfs2_glock *gl = container_of(rcu, struct gfs2_glock, gl_rcu);if (gl->gl_ops->go_flags &GLOF_ASPACE ) {kmem_cache_free (gfs2_glock_aspace_cachep, gl);
@@ -90,6 +90,13 @@ void gfs2_glock_free(struct gfs2_glock *kfree (gl->gl_lksb.sb_lvbptr);kmem_cache_free (gfs2_glock_cachep, gl); } +} + +void gfs2_glock_free (struct gfs2_glock *gl) +{ +struct gfs2_sbd *sdp = gl->gl_name.ln_sbd; + +call_rcu (&gl->gl_rcu, gfs2_glock_dealloc);if (atomic_dec_and_test (&sdp->sd_glock_disposal))wake_up (&sdp->sd_glock_wait); }
fs/gfs2/incore.h +1 -0
@@ -374,6 +374,7 @@ struct gfs2_glock {loff_t end; } gl_vm; }; +struct rcu_head gl_rcu;struct rhash_head gl_node; };
Greg Kroah-Hartman
maintainerPATCH 13/27 Add "shutdown" to "struct class".
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Zimmerman <[email protected]>
commit f77af15165847406b15d8f70c382c4cb15846b2a upstream.
The TPM class has some common shutdown code that must be executed for all drivers. This adds some needed functionality for that.
--- drivers/base/core.c | 6 +++++- include/linux/device.h | 2 ++ 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/base/core.c +5 -1
@@ -2667,7 +2667,11 @@ void device_shutdown(void)pm_runtime_get_noresume (dev);pm_runtime_barrier (dev); -if (dev->bus && dev->bus->shutdown) { +if (dev->class && dev->class->shutdown) { +if (initcall_debug) +dev_info (dev,"shutdown\n" ); + dev->class->shutdown (dev); + }else if (dev->bus && dev->bus->shutdown) {if (initcall_debug)dev_info (dev,"shutdown\n" ); dev->bus->shutdown (dev);
include/linux/device.h +2 -0
@@ -378,6 +378,7 @@ int subsys_virtual_register(struct bus_t* @suspend: Used to put the device to sleep mode, usually to a low power * state. * @resume: Used to bring the device from the sleep mode. +* @shutdown: Called at shut-down time to quiesce the device. * @ns_type: Callbacks so sysfs can detemine namespaces. * @namespace: Namespace of the device belongs to this class. * @pm: The default device power management operations of this class.
@@ -407,6 +408,7 @@ struct class {int (*suspend)(struct device *dev,pm_message_t state);int (*resume)(struct device *dev); +int (*shutdown)(struct device *dev);const struct kobj_ns_type_operations *ns_type;const void *(*namespace)(struct device *dev);
Greg Kroah-Hartman
maintainerPATCH 14/27 tpm: Issue a TPM2_Shutdown for TPM2 devices.
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Zimmerman <[email protected]>
commit d1bd4a792d3961a04e6154118816b00167aad91a upstream.
If a TPM2 loses power without a TPM2_Shutdown command being issued (a "disorderly reboot"), it may lose some state that has yet to be persisted to NVRam, and will increment the DA counter. After the DA counter gets sufficiently large, the TPM will lock the user out.
NOTE: This only changes behavior on TPM2 devices. Since TPM1 uses sysfs, and sysfs relies on implicit locking on chip->ops, it is not safe to allow this code to run in TPM1, or to add sysfs support to TPM2, until that locking is made explicit.
--- drivers/char/tpm/tpm-chip.c | 34 ++++++++++++++++++++++++++++++++++ drivers/char/tpm/tpm-sysfs.c | 3 +++ 2 files changed, 37 insertions(+)
drivers/char/tpm/tpm-chip.c +34 -0
@@ -143,6 +143,39 @@ static void tpm_devs_release(struct devi }/** +* tpm_class_shutdown() - prepare the TPM device for loss of power. +* @dev: device to which the chip is associated. +* +* Issues a TPM2_Shutdown command prior to loss of power, as required by the +* TPM 2.0 spec. +* Then, calls bus- and device- specific shutdown code. +* +* XXX: This codepath relies on the fact that sysfs is not enabled for +* TPM2: sysfs uses an implicit lock on chip->ops, so this could race if TPM2 +* has sysfs support enabled before TPM sysfs's implicit locking is fixed. +*/ +static int tpm_class_shutdown (struct device *dev) +{ + struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev); + +if (chip->flags &TPM_CHIP_FLAG_TPM2 ) { +down_write (&chip->ops_sem); +tpm2_shutdown (chip,TPM2_SU_CLEAR ); + chip->ops =NULL ; +up_write (&chip->ops_sem); + } +/* Allow bus- and device-specific code to run. Note: since chip->ops +* is NULL, more-specific shutdown code will not be able to issue TPM +* commands. +*/ +if (dev->bus && dev->bus->shutdown) + dev->bus->shutdown (dev); +else if (dev->driver && dev->driver->shutdown) + dev->driver->shutdown (dev); +return 0 ; +} + +/** * tpm_chip_alloc() - allocate a new struct tpm_chip instance * @pdev: device to which the chip is associated * At this point pdev mst be initialized, but does not have to
@@ -181,6 +214,7 @@ struct tpm_chip *tpm_chip_alloc(struct ddevice_initialize (&chip->devs); chip->dev.class = tpm_class; + chip->dev.class->shutdown = tpm_class_shutdown; chip->dev.release = tpm_dev_release; chip->dev.parent = pdev; chip->dev.groups = chip->groups;
drivers/char/tpm/tpm-sysfs.c +3 -0
@@ -294,6 +294,9 @@ static const struct attribute_group tpm_void tpm_sysfs_add_device (struct tpm_chip *chip) { +/* XXX: If you wish to remove this restriction, you must first update +* tpm_sysfs to explicitly lock chip->ops. +*/ if (chip->flags &TPM_CHIP_FLAG_TPM2 )return ;
Greg Kroah-Hartman
maintainerPATCH 15/27 tpm: fix a kernel memory leak in tpm-sysfs.c
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Sakkinen <[email protected]>
commit 13b47cfcfc60495cde216eef4c01040d76174cbe upstream.
While cleaning up sysfs callback that prints EK we discovered a kernel memory leak. This commit fixes the issue by zeroing the buffer used for TPM command/response.
The leak happen when we use either tpm_vtpm_proxy, tpm_ibmvtpm or xen-tpmfront.
--- drivers/char/tpm/tpm-sysfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/char/tpm/tpm-sysfs.c +2 -1
@@ -36,9 +36,10 @@ static ssize_t pubek_show(struct devicessize_t err;int i, rc;char *str = buf; -struct tpm_chip *chip =to_tpm_chip (dev); +memset (&tpm_cmd,0 ,sizeof (tpm_cmd)); + tpm_cmd.header.in = tpm_readpubek_header; err = tpm_transmit_cmd(chip, NULL, &tpm_cmd, READ_PUBEK_RESULT_SIZE, READ_PUBEK_RESULT_MIN_BODY_SIZE, 0,
Greg Kroah-Hartman
maintainerPATCH 16/27 powerpc/powernv: Fix CPU_HOTPLUG=n idle.c compile error
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Piggin <[email protected]>
commit 67d20418088680d22037119d914982cd982b5c5a upstream.
--- arch/powerpc/platforms/powernv/idle.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/platforms/powernv/idle.c +2 -0
@@ -261,6 +261,7 @@ static u64 pnv_deepest_stop_psscr_val;static u64 pnv_deepest_stop_psscr_mask;static bool deepest_stop_found; +#ifdef CONFIG_HOTPLUG_CPU /* * pnv_cpu_offline: A function that puts the CPU into the deepest * available platform idle state on a CPU-Offline.
@@ -293,6 +294,7 @@ unsigned long pnv_cpu_offline(unsigned i return srr1; } +#endif /* * Power ISA 3.0 idle initialization.
Greg Kroah-Hartman
maintainerPATCH 17/27 x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit 236222d39347e0e486010f10c1493e83dbbdfba8 upstream.
According to the Intel datasheet, the REP MOVSB instruction exposes a pretty heavy setup cost (50 ticks), which hurts short string copy operations.
This change tries to avoid this cost by calling the explicit loop available in the unrolled code for strings shorter than 64 bytes.
The 64 bytes cutoff value is arbitrary from the code logic point of view - it has been selected based on measurements, as the largest value that still ensures a measurable gain.
Micro benchmarks of the __copy_from_user() function with lengths in the [0-63] range show this performance gain (shorter the string, larger the gain):
- in the [55%-4%] range on Intel Xeon(R) CPU E5-2690 v4
- in the [72%-9%] range on Intel Core i7-4810MQ
Other tested CPUs - namely Intel Atom S1260 and AMD Opteron 8216 - show no difference, because they do not expose the ERMS feature bit.
--- arch/x86/lib/copy_user_64.S | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
arch/x86/lib/copy_user_64.S +5 -2
@@ -37,7 +37,7 @@ ENTRY(copy_user_generic_unrolled) movl %edx,%ecx andl $63,%edx shrl $6,%ecx - jz 17f + jz .L_copy_short_string 1: movq (%rsi),%r8 2: movq 1*8(%rsi),%r9 3: movq 2*8(%rsi),%r10
@@ -58,7 +58,8 @@ ENTRY(copy_user_generic_unrolled) leaq 64(%rdi),%rdi decl %ecx jnz 1b -17: movl %edx,%ecx +.L_copy_short_string: + movl %edx,%ecx andl $7,%edx shrl $3,%ecx jz 20f
@@ -174,6 +175,8 @@ EXPORT_SYMBOL(copy_user_generic_string) */ ENTRY(copy_user_enhanced_fast_string) ASM_STAC + cmpl $64,%edx + jb .L_copy_short_string /* less then 64 bytes, avoid the costly 'rep' */ movl %edx,%ecx 1: rep movsb
Greg Kroah-Hartman
maintainerPATCH 18/27 sched/fair, cpumask: Export for_each_cpu_wrap()
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit c743f0a5c50f2fcbc628526279cfa24f3dabe182 upstream.
More users for for_each_cpu_wrap() have appeared. Promote the construct to generic cpumask interface.
The implementation is slightly modified to reduce arguments.
--- include/linux/cpumask.h | 17 +++++++++++++++++ kernel/sched/fair.c | 45 ++++----------------------------------------- lib/cpumask.c | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 53 insertions(+), 41 deletions(-)
include/linux/cpumask.h +17 -0
@@ -236,6 +236,23 @@ unsigned int cpumask_local_spread(unsign (cpu) =cpumask_next_zero ((cpu), (mask)), \ (cpu) < nr_cpu_ids;) +extern int cpumask_next_wrap (int n,const struct cpumask *mask,int start,bool wrap); + +/** +* for_each_cpu_wrap - iterate over every cpu in a mask, starting at a specified location +* @cpu: the (optionally unsigned) integer iterator +* @mask: the cpumask poiter +* @start: the start location +* +* The implementation does not assume any bit in @mask is set (including @start). +* +* After the loop, cpu is >= nr_cpu_ids. +*/ +#define for_each_cpu_wrap (cpu, mask, start) \ + for ((cpu) = cpumask_next_wrap((start)-1, (mask), (start), false); \ + (cpu) < nr_cpumask_bits; \ + (cpu) = cpumask_next_wrap((cpu), (mask), (start), true)) +/** * for_each_cpu_and - iterate over every cpu in both masks * @cpu: the (optionally unsigned) integer iterator
kernel/sched/fair.c +4 -41
75 lines not on this page · raw message
lib/cpumask.c +32 -0
@@ -43,6 +43,38 @@ int cpumask_any_but(const struct cpumask }EXPORT_SYMBOL (cpumask_any_but); +/** +* cpumask_next_wrap - helper to implement for_each_cpu_wrap +* @n: the cpu prior to the place to search +* @mask: the cpumask pointer +* @start: the start point of the iteration +* @wrap: assume @n crossing @start terminates the iteration +* +* Returns >= nr_cpu_ids on completion +* +* Note: the @wrap argument is required for the start condition when +* we cannot assume @start is set in @mask. +*/ +int cpumask_next_wrap (int n,const struct cpumask *mask,int start,bool wrap) +{ +int next; + +again: + next =cpumask_next (n, mask); + +if (wrap && n < start && next >= start) { +return nr_cpumask_bits; + + }else if (next >= nr_cpumask_bits) { + wrap = true; + n =-1 ; + goto again; + } + +return next; +} +EXPORT_SYMBOL (cpumask_next_wrap); +/* These are not inline because of header tangles. */ #ifdef CONFIG_CPUMASK_OFFSTACK /**
Greg Kroah-Hartman
maintainerPATCH 19/27 sched/core: Implement new approach to scale select_idle_cpu()
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 1ad3aaf3fcd2444406628a19a9b9e0922b95e2d4 upstream.
Hackbench recently suffered a bunch of pain, first by commit:
4c77b18cf8b7 ("sched/fair: Make select_idle_cpu() more aggressive")
and then by commit:
c743f0a5c50f ("sched/fair, cpumask: Export for_each_cpu_wrap()")
which fixed a bug in the initial for_each_cpu_wrap() implementation that made select_idle_cpu() even more expensive. The bug was that it would skip over CPUs when bits were consequtive in the bitmask.
This however gave me an idea to fix select_idle_cpu(); where the old scheme was a cliff-edge throttle on idle scanning, this introduces a more gradual approach. Instead of stopping to scan entirely, we limit how many CPUs we scan.
Initial benchmarks show that it mostly recovers hackbench while not hurting anything else, except Mason's schbench, but not as bad as the old thing.
It also appears to recover the tbench high-end, which also suffered like hackbench.
--- kernel/sched/fair.c | 21 ++++++++++++++++----- kernel/sched/features.h | 1 + 2 files changed, 17 insertions(+), 5 deletions(-)
kernel/sched/fair.c +16 -5
@@ -5772,27 +5772,38 @@ static inline int select_idle_smt(structstatic int select_idle_cpu (struct task_struct *p,struct sched_domain *sd,int target) {struct sched_domain *this_sd; -u64 avg_cost, avg_idle =this_rq ()->avg_idle; +u64 avg_cost, avg_idle;u64 time, cost;s64 delta; -int cpu; +int cpu, nr =INT_MAX ; this_sd =rcu_dereference (*this_cpu_ptr (&sd_llc));if (!this_sd)return -1 ; - avg_cost = this_sd->avg_scan_cost; -/* * Due to large variance we need a large fuzz factor; hackbench in * particularly is sensitive here. */ -if (sched_feat (SIS_AVG_CPU ) && (avg_idle /512 ) < avg_cost) + avg_idle =this_rq ()->avg_idle /512 ; + avg_cost = this_sd->avg_scan_cost +1 ; + +if (sched_feat (SIS_AVG_CPU ) && avg_idle < avg_cost)return -1 ; +if (sched_feat (SIS_PROP )) { +u64 span_avg = sd->span_weight * avg_idle; +if (span_avg >4 *avg_cost) + nr =div_u64 (span_avg, avg_cost); +else + nr =4 ; + } + time =local_clock ();for_each_cpu_wrap (cpu,sched_domain_span (sd), target) { +if (!--nr) +return -1 ;if (!cpumask_test_cpu (cpu, &p->cpus_allowed))continue ;if (idle_cpu (cpu))
kernel/sched/features.h +1 -0
@@ -55,6 +55,7 @@ SCHED_FEAT(TTWU_QUEUE, true)* When doing wakeups, attempt to limit superfluous scans of the LLC domain. */ SCHED_FEAT(SIS_AVG_CPU, false) +SCHED_FEAT (SIS_PROP , true)/* * Issue a WARN when we do multiple update_rq_clock() calls
Greg Kroah-Hartman
maintainerPATCH 20/27 sched/numa: Use down_read_trylock() for the mmap_sem
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka <[email protected]>
commit 8655d5497735b288f8a9b458bd22e7d1bf95bb61 upstream.
A customer has reported a soft-lockup when running an intensive memory stress test, where the trace on multiple CPU's looks like this:
RIP: 0010:[<ffffffff810c53fe>] [<ffffffff810c53fe>] native_queued_spin_lock_slowpath+0x10e/0x190 ... Call Trace: [<ffffffff81182d07>] queued_spin_lock_slowpath+0x7/0xa [<ffffffff811bc331>] change_protection_range+0x3b1/0x930 [<ffffffff811d4be8>] change_prot_numa+0x18/0x30 [<ffffffff810adefe>] task_numa_work+0x1fe/0x310 [<ffffffff81098322>] task_work_run+0x72/0x90
Further investigation showed that the lock contention here is pmd_lock().
The task_numa_work() function makes sure that only one thread is let to perform the work in a single scan period (via cmpxchg), but if there's a thread with mmap_sem locked for writing for several periods, multiple threads in task_numa_work() can build up a convoy waiting for mmap_sem for read and then all get unblocked at once.
This patch changes the down_read() to the trylock version, which prevents the build up. For a workload experiencing mmap_sem contention, it's probably better to postpone the NUMA balancing work anyway. This seems to have fixed the soft lockups involving pmd_lock(), which is in line with the convoy theory.
--- kernel/sched/fair.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/sched/fair.c +2 -1
@@ -2469,7 +2469,8 @@ void task_numa_work(struct callback_headreturn ; -down_read (&mm->mmap_sem); +if (!down_read_trylock (&mm->mmap_sem)) +return ; vma =find_vma (mm, start);if (!vma) {reset_ptenuma_scan (p);
Greg Kroah-Hartman
maintainerPATCH 21/27 sched/numa: Override part of migrate_degrades_locality() when idle balancing
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
commit 739294fb03f590401bbd7faa6d31a507e3ffada5 upstream.
Several tests in the NAS benchmark seem to run a lot slower with NUMA balancing enabled, than with NUMA balancing disabled. The slower run time corresponds with increased idle time.
Overriding the final test of migrate_degrades_locality (but still doing the other NUMA tests first) seems to improve performance of those benchmarks.
--- kernel/sched/fair.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/sched/fair.c +4 -0
@@ -6661,6 +6661,10 @@ static int migrate_degrades_locality(strif (dst_nid == p->numa_preferred_nid)return 0 ; +/* Leaving a core idle is often worse than degrading locality. */ +if (env->idle !=CPU_NOT_IDLE ) +return -1 ; +if (numa_group) { src_faults =group_faults (p, src_nid); dst_faults =group_faults (p, dst_nid);
Greg Kroah-Hartman
maintainerPATCH 22/27 sched/fair: Simplify wake_affine() for the single socket case
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
commit 7d894e6e34a5cdd12309c7e4a3f830277ad4b7bf upstream.
Then 'this_cpu' and 'prev_cpu' are in the same socket, select_idle_sibling() will do its thing regardless of the return value of wake_affine().
Just return true and don't look at all the other things.
--- kernel/sched/fair.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
kernel/sched/fair.c +12 -1
@@ -5399,6 +5399,13 @@ static int wake_affine(struct sched_doma this_load =target_load (this_cpu, idx);/* +* Common case: CPUs are in the same socket, and select_idle_sibling() +* will do its thing regardless of what we return: +*/ +if (cpus_share_cache (prev_cpu, this_cpu)) +return true; + +/* * If sync wakeup then subtract the (maximum possible) * effect of the currently running task from the load * of the current CPU:
@@ -5986,11 +5993,15 @@ select_task_rq_fair(struct task_struct *if (affine_sd) { sd =NULL ;/* Prefer wake_affine over balance flags */ -if (cpu != prev_cpu &&wake_affine (affine_sd, p, prev_cpu, sync)) +if (cpu == prev_cpu) + goto pick_cpu; + +if (wake_affine (affine_sd, p, prev_cpu, sync)) new_cpu = cpu; }if (!sd) { + pick_cpu:if (sd_flag &SD_BALANCE_WAKE )/* XXX always ? */ new_cpu =select_idle_sibling (p, prev_cpu, new_cpu);
Greg Kroah-Hartman
maintainerPATCH 23/27 sched/numa: Implement NUMA node level wake_affine()
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
commit 3fed382b46baac83703130fe4cd3d9147f427fb9 upstream.
Since select_idle_sibling() can place a task anywhere on a socket, comparing loads between individual CPU cores makes no real sense for deciding whether to do an affine wakeup across sockets, either.
Instead, compare the load between the sockets in a similar way the load balancer and the numa balancing code do.
--- kernel/sched/fair.c | 130 ++++++++++++++++++++++++++++------------------------ 1 file changed, 71 insertions(+), 59 deletions(-)
kernel/sched/fair.c +71 -59
@@ -2585,6 +2585,60 @@ void task_tick_numa(struct rq *rq, struc } } } + +/* +* Can a task be moved from prev_cpu to this_cpu without causing a load +* imbalance that would trigger the load balancer? +*/ +static inline bool numa_wake_affine (struct sched_domain *sd, +struct task_struct *p,int this_cpu, +int prev_cpu,int sync) +{ +struct numa_stats prev_load, this_load; +s64 this_eff_load, prev_eff_load; + +update_numa_stats (&prev_load,cpu_to_node (prev_cpu)); +update_numa_stats (&this_load,cpu_to_node (this_cpu)); + +/* +* If sync wakeup then subtract the (maximum possible) +* effect of the currently running task from the load +* of the current CPU: +*/ +if (sync) { +unsigned long current_load =task_h_load (current); + +if (this_load.load > current_load) + this_load.load -= current_load; +else + this_load.load =0 ; + } + +/* +* In low-load situations, where this_cpu's node is idle due to the +* sync cause above having dropped this_load.load to 0, move the task. +* Moving to an idle socket will not create a bad imbalance. +* +* Otherwise check if the nodes are near enough in load to allow this +* task to be woken on this_cpu's node. +*/ +if (this_load.load >0 ) { +unsigned long task_load =task_h_load (p); + + this_eff_load =100 ; + this_eff_load *= prev_load.compute_capacity; + + prev_eff_load =100 + (sd->imbalance_pct -100 ) /2 ; + prev_eff_load *= this_load.compute_capacity; + + this_eff_load *= this_load.load + task_load; + prev_eff_load *= prev_load.load - task_load; + +return this_eff_load <= prev_eff_load; + } + +return true; +}#else static void task_tick_numa (struct rq *rq,struct task_struct *curr) {
@@ -2597,6 +2651,13 @@ static inline void account_numa_enqueue(static inline void account_numa_dequeue (struct rq *rq,struct task_struct *p) { } + +static inline bool numa_wake_affine (struct sched_domain *sd, +struct task_struct *p,int this_cpu, +int prev_cpu,int sync) +{ +return true; +}#endif /* CONFIG_NUMA_BALANCING */ static void
@@ -5386,74 +5447,25 @@ static int wake_wide(struct task_structstatic int wake_affine (struct sched_domain *sd,struct task_struct *p,int prev_cpu,int sync) { -s64 this_load, load; -s64 this_eff_load, prev_eff_load; -int idx, this_cpu; -struct task_group *tg; -unsigned long weight; -int balanced; - - idx = sd->wake_idx; - this_cpu =smp_processor_id (); - load =source_load (prev_cpu, idx); - this_load =target_load (this_cpu, idx); +int this_cpu =smp_processor_id (); +bool affine = false;/* * Common case: CPUs are in the same socket, and select_idle_sibling() * will do its thing regardless of what we return: */ if (cpus_share_cache (prev_cpu, this_cpu)) -return true; - -/* -* If sync wakeup then subtract the (maximum possible) -* effect of the currently running task from the load -* of the current CPU: -*/ -if (sync) { - tg =task_group (current); - weight = current->se.avg.load_avg; - - this_load +=effective_load (tg, this_cpu, -weight, -weight); - load +=effective_load (tg, prev_cpu,0 , -weight); - } - - tg =task_group (p); - weight = p->se.avg.load_avg; - -/* -* In low-load situations, where prev_cpu is idle and this_cpu is idle -* due to the sync cause above having dropped this_load to 0, we'll -* always have an imbalance, but there's really nothing you can do -* about that, so that's good too. -* -* Otherwise check if either cpus are near enough in load to allow this -* task to be woken on this_cpu. -*/ - this_eff_load =100 ; - this_eff_load *=capacity_of (prev_cpu); - - prev_eff_load =100 + (sd->imbalance_pct -100 ) /2 ; - prev_eff_load *=capacity_of (this_cpu); - -if (this_load >0 ) { - this_eff_load *= this_load + -effective_load (tg, this_cpu, weight, weight); - - prev_eff_load *= load +effective_load (tg, prev_cpu,0 , weight); - } - - balanced = this_eff_load <= prev_eff_load; + affine = true; +else + affine =numa_wake_affine (sd, p, this_cpu, prev_cpu, sync);schedstat_inc (p->se.statistics.nr_wakeups_affine_attempts); +if (affine) { +schedstat_inc (sd->ttwu_move_affine); +schedstat_inc (p->se.statistics.nr_wakeups_affine); + } -if (!balanced) -return 0 ; - -schedstat_inc (sd->ttwu_move_affine); -schedstat_inc (p->se.statistics.nr_wakeups_affine); - -return 1 ; +return affine; }static inline int task_util (struct task_struct *p);
Greg Kroah-Hartman
maintainerPATCH 24/27 sched/fair: Remove effective_load()
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
commit 815abf5af45f04f759f12f3172afd15226fd7f71 upstream.
The effective_load() function was only used by the NUMA balancing code, and not by the regular load balancing code. Now that the NUMA balancing code no longer uses it either, get rid of it.
--- kernel/sched/fair.c | 124 ---------------------------------------------------- 1 file changed, 1 insertion(+), 123 deletions(-)
kernel/sched/fair.c +1 -123
@@ -1381,7 +1381,6 @@ static unsigned long weighted_cpuload(costatic unsigned long source_load (int cpu,int type);static unsigned long target_load (int cpu,int type);static unsigned long capacity_of (int cpu); -static long effective_load (struct task_group *tg,int cpu,long wl,long wg);/* Cached statistics for all CPUs within a node */ struct numa_stats {
@@ -3044,8 +3043,7 @@ __update_load_avg_cfs_rq(u64 now, int cp* differential update where we store the last value we propagated. This in * turn allows skipping updates if the differential is 'small'. * -* Updating tg's load_avg is necessary before update_cfs_share() (which is -* done) and effective_load() (which is not done because it is too costly). +* Updating tg's load_avg is necessary before update_cfs_share(). */ static inline void update_tg_load_avg (struct cfs_rq *cfs_rq,int force) {
@@ -5277,126 +5275,6 @@ static unsigned long cpu_avg_load_per_tareturn 0 ; } -#ifdef CONFIG_FAIR_GROUP_SCHED -/* -* effective_load() calculates the load change as seen from the root_task_group -* -* Adding load to a group doesn't make a group heavier, but can cause movement -* of group shares between cpus. Assuming the shares were perfectly aligned one -* can calculate the shift in shares. -* -* Calculate the effective load difference if @wl is added (subtracted) to @tg -* on this @cpu and results in a total addition (subtraction) of @wg to the -* total group weight. -* -* Given a runqueue weight distribution (rw_i) we can compute a shares -* distribution (s_i) using: -* -* s_i = rw_i / \Sum rw_j (1) -* -* Suppose we have 4 CPUs and our @tg is a direct child of the root group and -* has 7 equal weight tasks, distributed as below (rw_i), with the resulting -* shares distribution (s_i): -* -* rw_i = { 2, 4, 1, 0 } -* s_i = { 2/7, 4/7, 1/7, 0 } -* -* As per wake_affine() we're interested in the load of two CPUs (the CPU the -* task used to run on and the CPU the waker is running on), we need to -* compute the effect of waking a task on either CPU and, in case of a sync -* wakeup, compute the effect of the current task going to sleep. -* -* So for a change of @wl to the local @cpu with an overall group weight change -* of @wl we can compute the new shares distribution (s'_i) using: -* -* s'_i = (rw_i + @wl) / (@wg + \Sum rw_j) (2) -* -* Suppose we're interested in CPUs 0 and 1, and want to compute the load -* differences in waking a task to CPU 0. The additional task changes the -* weight and shares distributions like: -* -* rw'_i = { 3, 4, 1, 0 } -* s'_i = { 3/8, 4/8, 1/8, 0 } -* -* We can then compute the difference in effective weight by using: -* -* dw_i = S * (s'_i - s_i) (3) -* -* Where 'S' is the group weight as seen by its parent. -* -* Therefore the effective change in loads on CPU 0 would be 5/56 (3/8 - 2/7) -* times the weight of the group. The effect on CPU 1 would be -4/56 (4/8 - -* 4/7) times the weight of the group. -*/ -static long effective_load (struct task_group *tg,int cpu,long wl,long wg) -{ -struct sched_entity *se = tg->se[cpu]; - -if (!tg->parent)/* the trivial, non-cgroup case */ -return wl; - -for_each_sched_entity (se) { -struct cfs_rq *cfs_rq = se->my_q; -long W , w =cfs_rq_load_avg (cfs_rq); - - tg = cfs_rq->tg; - -/* -* W = @wg + \Sum rw_j -*/ -W = wg +atomic_long_read (&tg->load_avg); - -/* Ensure \Sum rw_j >= rw_i */ -W -= cfs_rq->tg_load_avg_contrib; -W += w; - -/* -* w = rw_i + @wl -*/ - w += wl; - -/* -* wl = S * s'_i; see (2) -*/ -if (W >0 && w <W ) - wl = (w * (long )scale_load_down (tg->shares)) /W ; -else - wl =scale_load_down (tg->shares); - -/* -* Per the above, wl is the new se->load.weight value; since -* those are clipped to [MIN_SHARES, ...) do so now. See -* calc_cfs_shares(). -*/ -if (wl <MIN_SHARES ) - wl =MIN_SHARES ; - -/* -* wl = dw_i = S * (s'_i - s_i); see (3) -*/ - wl -= se->avg.load_avg; - -/* -* Recursively apply this logic to all parent groups to compute -* the final effective load change on the root group. Since -* only the @tg group gets extra weight, all parent groups can -* only redistribute existing shares. @wl is the shift in shares -* resulting from this level per the above. -*/ - wg =0 ; - } - -return wl; -} -#else - -static long effective_load (struct task_group *tg,int cpu,long wl,long wg) -{ -return wl; -} - -#endif -static void record_wakee (struct task_struct *p) {/*
Greg Kroah-Hartman
maintainerPATCH 25/27 sched/numa: Hide numa_wake_affine() from UP build
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit ff801b716effd652f420204eddb36f6e4a716819 upstream.
Stephen reported the following build warning in UP:
kernel/sched/fair.c:2657:9: warning: 'struct sched_domain' declared inside parameter list
^
/home/sfr/next/next/kernel/sched/fair.c:2657:9: warning: its scope is only this definition or declaration, which is probably not what you want
Hide the numa_wake_affine() inline stub on UP builds to get rid of it.
--- kernel/sched/fair.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/sched/fair.c +2 -0
@@ -2651,12 +2651,14 @@ static inline void account_numa_dequeue( { } +#ifdef CONFIG_SMP static inline bool numa_wake_affine (struct sched_domain *sd,struct task_struct *p,int this_cpu,int prev_cpu,int sync) {return true; } +#endif /* !SMP */ #endif /* CONFIG_NUMA_BALANCING */ static void
Greg Kroah-Hartman
maintainerPATCH 26/27 xen: avoid deadlock in xenbus driver
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
commit 1a3fc2c402810bf336882e695abd1678dbc8d279 upstream.
There has been a report about a deadlock in the xenbus driver:
[ 247.979498] ======================================================
[ 247.985688] WARNING: possible circular locking dependency detected
[ 247.991882] 4.12.0-rc4-00022-gc4b25c0 #575 Not tainted
[ 247.997040] ------------------------------------------------------
[ 248.003232] xenbus/91 is trying to acquire lock:
[ 248.007875] (&u->msgbuffer_mutex){+.+.+.}, at: [<ffff00000863e904>]
xenbus_dev_queue_reply+0x3c/0x230
[ 248.017163]
[ 248.017163] but task is already holding lock:
[ 248.023096] (xb_write_mutex){+.+...}, at: [<ffff00000863a940>]
xenbus_thread+0x5f0/0x798
[ 248.031267]
[ 248.031267] which lock already depends on the new lock.
[ 248.031267]
[ 248.039615]
[ 248.039615] the existing dependency chain (in reverse order) is:
[ 248.047176]
[ 248.047176] -> #1 (xb_write_mutex){+.+...}:
[ 248.052943] __lock_acquire+0x1728/0x1778
[ 248.057498] lock_acquire+0xc4/0x288
[ 248.061630] __mutex_lock+0x84/0x868
[ 248.065755] mutex_lock_nested+0x3c/0x50
[ 248.070227] xs_send+0x164/0x1f8
[ 248.074015] xenbus_dev_request_and_reply+0x6c/0x88
[ 248.079427] xenbus_file_write+0x260/0x420
[ 248.084073] __vfs_write+0x48/0x138
[ 248.088113] vfs_write+0xa8/0x1b8
[ 248.091983] SyS_write+0x54/0xb0
[ 248.095768] el0_svc_naked+0x24/0x28
[ 248.099897]
[ 248.099897] -> #0 (&u->msgbuffer_mutex){+.+.+.}:
[ 248.106088] print_circular_bug+0x80/0x2e0
[ 248.110730] __lock_acquire+0x1768/0x1778
[ 248.115288] lock_acquire+0xc4/0x288
[ 248.119417] __mutex_lock+0x84/0x868
[ 248.123545] mutex_lock_nested+0x3c/0x50
[ 248.128016] xenbus_dev_queue_reply+0x3c/0x230
[ 248.133005] xenbus_thread+0x788/0x798
[ 248.137306] kthread+0x110/0x140
[ 248.141087] ret_from_fork+0x10/0x40It is rather easy to avoid by dropping xb_write_mutex before calling xenbus_dev_queue_reply().
driver for multiple concurrent xenstore accesses").
--- drivers/xen/xenbus/xenbus_comms.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-)
drivers/xen/xenbus/xenbus_comms.c +10 -11
@@ -299,17 +299,7 @@ static int process_msg(void)mutex_lock (&xb_write_mutex);list_for_each_entry (req, &xs_reply_list, list) {if (req->msg.req_id == state.msg.req_id) { -if (req->state == xb_req_state_wait_reply) { - req->msg.type = state.msg.type; - req->msg.len = state.msg.len; - req->body = state.body; - req->state = xb_req_state_got_reply; -list_del (&req->list); - req->cb (req); - }else { -list_del (&req->list); -kfree (req); - } +list_del (&req->list); err =0 ;break ; }
@@ -317,6 +307,15 @@ static int process_msg(void)mutex_unlock (&xb_write_mutex);if (err) goto out; + +if (req->state == xb_req_state_wait_reply) { + req->msg.type = state.msg.type; + req->msg.len = state.msg.len; + req->body = state.body; + req->state = xb_req_state_got_reply; + req->cb (req); + }else +kfree (req); }mutex_unlock (&xs_response_mutex);
Greg Kroah-Hartman
maintainerPATCH 27/27 crypto: drbg - Fixes panic in wait_for_completion call
In reply to Greg Kroah-Hartman4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Mueller <[email protected]>
commit b61929c654f2e725644935737c4c1ea9c741e2f8 upstream.
Initialise ctr_completion variable before use.
--- crypto/drbg.c | 1 + 1 file changed, 1 insertion(+)
crypto/drbg.c +1 -0
@@ -1691,6 +1691,7 @@ static int drbg_init_sym_kernel(struct dreturn PTR_ERR (sk_tfm); } drbg->ctr_handle = sk_tfm; +init_completion (&drbg->ctr_completion); req =skcipher_request_alloc (sk_tfm,GFP_KERNEL );if (!req) {
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.12.1 release. There are 27 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jul 12 17:00:45 UTC 2017. Anything received after that time might be too late.
Build results:
total: 145 pass: 145 fail: 0 Qemu test results: total: 122 pass: 122 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
Greg Kroah-Hartman
maintainerQuoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.12.1 release. There are 27 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jul 12 17:00:45 UTC 2017. Anything received after that time might be too late.
Quoted 6 lines
Build results:
total: 145 pass: 145 fail: 0 Qemu test results: total: 122 pass: 122 fail: 0Details are available at http://kerneltests.org/builders.
Great, thanks for testing all of these and letting me know.
greg k-h