5.7.6-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 439/477 f2fs: split f2fs_d_compare() from f2fs_match_name()
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit f874fa1c7c7905c1744a2037a11516558ed00a81 ]
Sharing f2fs_ci_compare() between comparing cached dentries (f2fs_d_compare()) and comparing on-disk dentries (f2fs_match_name()) doesn't work as well as intended, as these actions fundamentally differ in several ways (e.g. whether the task may sleep, whether the directory is stable, whether the casefolded name was precomputed, whether the dentry will need to be decrypted once we allow casefold+encrypt, etc.)
Just make f2fs_d_compare() implement what it needs directly, and rework f2fs_ci_compare() to be specialized for f2fs_match_name().
--- fs/f2fs/dir.c | 70 +++++++++++++++++++++++++------------------------- fs/f2fs/f2fs.h | 5 ---- 2 files changed, 35 insertions(+), 40 deletions(-)
fs/f2fs/dir.c +35 -35
@@ -107,36 +107,28 @@ static struct f2fs_dir_entry *find_in_block(struct inode *dir,/* * Test whether a case-insensitive directory entry matches the filename * being searched for. -* -* Returns: 0 if the directory entry matches, more than 0 if it -* doesn't match or less than zero on error. */ -int f2fs_ci_compare (const struct inode *parent,const struct qstr *name, -const struct qstr *entry,bool quick) +static bool f2fs_match_ci_name (const struct inode *dir,const struct qstr *name, +const struct qstr *entry,bool quick) { -const struct f2fs_sb_info *sbi =F2FS_SB (parent->i_sb); +const struct f2fs_sb_info *sbi =F2FS_SB (dir->i_sb);const struct unicode_map *um = sbi->s_encoding; -int ret; +int res;if (quick) - ret =utf8_strncasecmp_folded (um, name, entry); + res =utf8_strncasecmp_folded (um, name, entry);else - ret =utf8_strncasecmp (um, name, entry); - -if (ret <0 ) { -/* Handle invalid character sequence as either an error -* or as an opaque byte sequence. + res =utf8_strncasecmp (um, name, entry); +if (res <0 ) { +/* +* In strict mode, ignore invalid names. In non-strict mode, +* fall back to treating them as opaque byte sequences. */ -if (f2fs_has_strict_mode (sbi)) -return -EINVAL ; - -if (name->len != entry->len) -return 1 ; - -return !!memcmp (name->name, entry->name, name->len); +if (f2fs_has_strict_mode (sbi) || name->len != entry->len) +return false; +return !memcmp (name->name, entry->name, name->len); } - -return ret; +return res ==0 ; } static void f2fs_fname_setup_ci_filename(struct inode *dir,
@@ -188,10 +180,10 @@ static inline bool f2fs_match_name(struct f2fs_dentry_ptr *d,if (cf_str->name) {struct qstr cf = {.name = cf_str->name, .len = cf_str->len}; -return !f2fs_ci_compare (parent, &cf, &entry, true); +return f2fs_match_ci_name (parent, &cf, &entry, true); } -return !f2fs_ci_compare (parent, fname->usr_fname, &entry, - false); +return f2fs_match_ci_name (parent, fname->usr_fname, &entry, + false); }#endif if (fscrypt_match_name(fname, d->filename[bit_pos],
@@ -1080,17 +1072,25 @@ const struct file_operations f2fs_dir_operations = {static int f2fs_d_compare (const struct dentry *dentry,unsigned int len,const char *str,const struct qstr *name) { -struct qstr qstr = {.name = str, .len = len };const struct dentry *parent =READ_ONCE (dentry->d_parent); -const struct inode *inode =READ_ONCE (parent->d_inode); - -if (!inode || !IS_CASEFOLDED (inode)) { -if (len != name->len) -return -1 ; -return memcmp (str, name->name, len); - } - -return f2fs_ci_compare (inode, name, &qstr, false); +const struct inode *dir =READ_ONCE (parent->d_inode); +const struct f2fs_sb_info *sbi =F2FS_SB (dentry->d_sb); +struct qstr entry =QSTR_INIT (str, len); +int res; + +if (!dir || !IS_CASEFOLDED (dir)) + goto fallback; + + res =utf8_strncasecmp (sbi->s_encoding, name, &entry); +if (res >=0 ) +return res; + +if (f2fs_has_strict_mode (sbi)) +return -EINVAL ; +fallback: +if (len != name->len) +return 1 ; +return !!memcmp (str, name->name, len); }static int f2fs_d_hash (const struct dentry *dentry,struct qstr *str)
fs/f2fs/f2fs.h +0 -5
@@ -3101,11 +3101,6 @@ int f2fs_update_extension_list(struct f2fs_sb_info *sbi, const char *name, bool hot, bool set);struct dentry *f2fs_get_parent (struct dentry *child); -extern int f2fs_ci_compare (const struct inode *parent, -const struct qstr *name, -const struct qstr *entry, -bool quick); -/* * dir.c */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 440/477 f2fs: avoid utf8_strncasecmp() with unstable name
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit fc3bb095ab02b9e7d89a069ade2cead15c64c504 ]
If the dentry name passed to ->d_compare() fits in dentry::d_iname, then it may be concurrently modified by a rename. This can cause undefined behavior (possibly out-of-bounds memory accesses or crashes) in utf8_strncasecmp(), since fs/unicode/ isn't written to handle strings that may be concurrently modified.
Fix this by first copying the filename to a stack buffer if needed. This way we get a stable snapshot of the filename.
--- fs/f2fs/dir.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
fs/f2fs/dir.c +16 -0
@@ -1076,11 +1076,27 @@ static int f2fs_d_compare(const struct dentry *dentry, unsigned int len,const struct inode *dir =READ_ONCE (parent->d_inode);const struct f2fs_sb_info *sbi =F2FS_SB (dentry->d_sb);struct qstr entry =QSTR_INIT (str, len); +char strbuf[DNAME_INLINE_LEN ];int res;if (!dir || !IS_CASEFOLDED (dir)) goto fallback; +/* +* If the dentry name is stored in-line, then it may be concurrently +* modified by a rename. If this happens, the VFS will eventually retry +* the lookup, so it doesn't matter what ->d_compare() returns. +* However, it's unsafe to call utf8_strncasecmp() with an unstable +* string. Therefore, we have to copy the name into a temporary buffer. +*/ +if (len <=DNAME_INLINE_LEN -1 ) { +memcpy (strbuf, str, len); + strbuf[len] =0 ; + entry.name = strbuf; +/* prevent compiler from optimizing out the temporary buffer */ +barrier (); + } + res =utf8_strncasecmp (sbi->s_encoding, name, &entry);if (res >=0 )return res;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 441/477 s390: fix syscall_get_error for compat processes
In reply to Greg Kroah-HartmanFrom: Dmitry V. Levin <[email protected]>
commit b3583fca5fb654af2cfc1c08259abb9728272538 upstream.
If both the tracer and the tracee are compat processes, and gprs[2] is assigned a value by __poke_user_compat, then the higher 32 bits of gprs[2] are cleared, IS_ERR_VALUE() always returns false, and syscall_get_error() always returns 0.
Fix the implementation by sign-extending the value for compat processes the same way as x86 implementation does.
The bug was exposed to user space by commit 201766a20e30f ("ptrace: add PTRACE_GET_SYSCALL_INFO request") and detected by strace test suite.
This change fixes strace syscall tampering on s390.
arch/s390/include/asm/syscall.h +11 -1
@@ -33,7 +33,17 @@ static inline void syscall_rollback(struct task_struct *task,static inline long syscall_get_error (struct task_struct *task,struct pt_regs *regs) { -return IS_ERR_VALUE (regs->gprs[2 ]) ? regs->gprs[2 ] :0 ; +unsigned long error = regs->gprs[2 ]; +#ifdef CONFIG_COMPAT +if (test_tsk_thread_flag (task,TIF_31BIT )) { +/* +* Sign-extend the value so (int)-EFOO becomes (long)-EFOO +* and will match correctly in comparisons. +*/ + error = (long )(int )error; + } +#endif +return IS_ERR_VALUE (error) ? error :0 ; } static inline long syscall_get_return_value(struct task_struct *task,
Greg Kroah-Hartman
maintainerPATCH 442/477 drm/i915: Fix AUX power domain toggling across TypeC mode resets
In reply to Greg Kroah-HartmanFrom: Imre Deak <[email protected]>
commit d96536f0fe699729a0974eb5b65eb0d87cc747e1 upstream.
Make sure to select the port's AUX power domain while holding the TC port lock. The domain depends on the port's current TC mode, which may get changed under us if we're not holding the lock.
This was left out from
commit 8c10e2262663 ("drm/i915: Keep the TypeC port mode fixed for detect/AUX transfers")
--- drivers/gpu/drm/i915/display/intel_dp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/display/intel_dp.c +3 -2
@@ -1343,8 +1343,7 @@ intel_dp_aux_xfer(struct intel_dp *intelbool is_tc_port =intel_phy_is_tc (i915, phy);i915_reg_t ch_ctl, ch_data[5 ];u32 aux_clock_divider; -enum intel_display_power_domain aux_domain = -intel_aux_power_domain (intel_dig_port); +enum intel_display_power_domain aux_domain;intel_wakeref_t aux_wakeref;intel_wakeref_t pps_wakeref;int i, ret, recv_bytes;
@@ -1359,6 +1358,8 @@ intel_dp_aux_xfer(struct intel_dp *intelif (is_tc_port)intel_tc_port_lock (intel_dig_port); + aux_domain =intel_aux_power_domain (intel_dig_port); + aux_wakeref =intel_display_power_get (i915, aux_domain); pps_wakeref =pps_lock (intel_dp);
Greg Kroah-Hartman
maintainerPATCH 443/477 drm/msm: Check for powered down HW in the devfreq callbacks
In reply to Greg Kroah-HartmanFrom: Jordan Crouse <[email protected]>
commit eadf79286a4badebc95af7061530bdb50a7e6f38 upstream.
Writing to the devfreq sysfs nodes while the GPU is powered down can result in a system crash (on a5xx) or a nasty GMU error (on a6xx):
$ /sys/class/devfreq/5000000.gpu# echo 500000000 > min_freq [ 104.841625] platform 506a000.gmu: [drm:a6xx_gmu_set_oob] *ERROR* Timeout waiting for GMU OOB set GPU_DCVS: 0x0
Despite the fact that we carefully try to suspend the devfreq device when the hardware is powered down there are lots of holes in the governors that don't check for the suspend state and blindly call into the devfreq callbacks that end up triggering hardware reads in the GPU driver.
Call pm_runtime_get_if_in_use() in the gpu_busy() and gpu_set_freq() callbacks to skip the hardware access if it isn't active.
v3: Only check pm_runtime_get_if_in_use() for == 0 per Eric Anholt
v2: Use pm_runtime_get_if_in_use() per Eric Anholt
--- drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 6 ++++++ drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 8 ++++++++ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 7 +++++++ 3 files changed, 21 insertions(+)
drivers/gpu/drm/msm/adreno/a5xx_gpu.c +6 -0
@@ -1404,6 +1404,10 @@ static unsigned long a5xx_gpu_busy(struc {u64 busy_cycles, busy_time; +/* Only read the gpu busy if the hardware is already active */ +if (pm_runtime_get_if_in_use (&gpu->pdev->dev) ==0 ) +return 0 ; + busy_cycles =gpu_read64 (gpu,REG_A5XX_RBBM_PERFCTR_RBBM_0_LO ,REG_A5XX_RBBM_PERFCTR_RBBM_0_HI );
@@ -1412,6 +1416,8 @@ static unsigned long a5xx_gpu_busy(struc gpu->devfreq.busy_cycles = busy_cycles; +pm_runtime_put (&gpu->pdev->dev); +if (WARN_ON (busy_time > ~0LU ))return ~0LU ;
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +8 -0
@@ -108,6 +108,13 @@ static void __a6xx_gmu_set_freq(struct astruct msm_gpu *gpu = &adreno_gpu->base;int ret; +/* +* This can get called from devfreq while the hardware is idle. Don't +* bring up the power if it isn't already active +*/ +if (pm_runtime_get_if_in_use (gmu->dev) ==0 ) +return ; +gmu_write (gmu,REG_A6XX_GMU_DCVS_ACK_OPTION ,0 ); gmu_write(gmu, REG_A6XX_GMU_DCVS_PERF_SETTING,
@@ -134,6 +141,7 @@ static void __a6xx_gmu_set_freq(struct a* for now leave it at max so that the performance is nominal. */ icc_set_bw (gpu->icc_path,0 ,MBps_to_icc (7216 )); +pm_runtime_put (gmu->dev); }void a6xx_gmu_set_freq (struct msm_gpu *gpu,unsigned long freq)
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +7 -0
@@ -810,6 +810,11 @@ static unsigned long a6xx_gpu_busy(strucstruct a6xx_gpu *a6xx_gpu =to_a6xx_gpu (adreno_gpu);u64 busy_cycles, busy_time; + +/* Only read the gpu busy if the hardware is already active */ +if (pm_runtime_get_if_in_use (a6xx_gpu->gmu.dev) ==0 ) +return 0 ; + busy_cycles =gmu_read64 (&a6xx_gpu->gmu,REG_A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_L ,REG_A6XX_GMU_CX_GMU_POWER_COUNTER_XOCLK_0_H );
@@ -819,6 +824,8 @@ static unsigned long a6xx_gpu_busy(struc gpu->devfreq.busy_cycles = busy_cycles; +pm_runtime_put (a6xx_gpu->gmu.dev); +if (WARN_ON (busy_time > ~0LU ))return ~0LU ;
Greg Kroah-Hartman
maintainerPATCH 444/477 drm/i915/gem: Avoid iterating an empty list
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
commit 757a9395f33c51c4e6eff2c7c0fbd50226a58224 upstream.
Our __sgt_iter assumes that the scattergather list has at least one element. But during construction we may fail in allocating the first page, and so mark the first element as the terminator. This is unexpected!
[22555.524752] RIP: 0010:shmem_get_pages+0x506/0x710 [i915] [22555.524759] Code: 49 8b 2c 24 31 c0 66 89 44 24 40 48 85 ed 0f 84 62 01 00 00 4c 8b 75 00 8b 5d 08 44 8b 7d 0c 48 8b 0d 7e 34 07 e2 49 83 e6 fc <49> 8b 16 41 01 df 48 89 cf 48 89 d0 48 c1 e8 2d 48 85 c9 0f 84 c8 [22555.524765] RSP: 0018:ffffc9000053f9d0 EFLAGS: 00010246 [22555.524770] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8881ffffa000 [22555.524774] RDX: fffffffffffffff4 RSI: ffffffffffffffff RDI: ffffffff821efe00 [22555.524778] RBP: ffff8881b099ab00 R08: 0000000000000000 R09: 00000000fffffff4 [22555.524782] R10: 0000000000000002 R11: 00000000ffec0a02 R12: ffff8881cd3c8d60 [22555.524786] R13: 00000000fffffff4 R14: 0000000000000000 R15: 0000000000000000 [22555.524790] FS: 00007f4fbeb9b9c0(0000) GS:ffff8881f8580000(0000) knlGS:0000000000000000 [22555.524795] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [22555.524799] CR2: 0000000000000000 CR3: 00000001ec7f0004 CR4: 00000000001606e0 [22555.524803] Call Trace: [22555.524919] __i915_gem_object_get_pages+0x4f/0x60 [i915]
--- drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/gpu/drm/i915/gem/i915_gem_shmem.c +9 -6
@@ -39,7 +39,6 @@ static int shmem_get_pages(struct drm_i9unsigned long last_pfn =0 ;/* suppress gcc warning */ unsigned int max_segment =i915_sg_segment_size ();unsigned int sg_page_sizes; -struct pagevec pvec;gfp_t noreclaim;int ret;
@@ -192,13 +191,17 @@ err_sg:sg_mark_end (sg); err_pages:mapping_clear_unevictable (mapping); -pagevec_init (&pvec); -for_each_sgt_page (page, sgt_iter, st) { -if (!pagevec_add (&pvec, page)) +if (sg != st->sgl) { +struct pagevec pvec; + +pagevec_init (&pvec); +for_each_sgt_page (page, sgt_iter, st) { +if (!pagevec_add (&pvec, page)) +check_release_pagevec (&pvec); + } +if (pagevec_count (&pvec))check_release_pagevec (&pvec); } -if (pagevec_count (&pvec)) -check_release_pagevec (&pvec);sg_free_table (st);kfree (st);
Greg Kroah-Hartman
maintainerPATCH 445/477 drm/i915: Whitelist context-local timestamp in the gen9 cmdparser
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
commit 273500ae71711c040d258a7b3f4b6f44c368fff2 upstream.
Allow batch buffers to read their own _local_ cumulative HW runtime of their logical context.
--- drivers/gpu/drm/i915/i915_cmd_parser.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/i915/i915_cmd_parser.c +4 -0
@@ -572,6 +572,9 @@ struct drm_i915_reg_descriptor {#define REG32 (_reg, ...) \ { .addr = (_reg), __VA_ARGS__ } +#define REG32_IDX (_reg, idx) \ + { .addr = _reg(idx) } +/* * Convenience macro for adding 64-bit registers. *
@@ -669,6 +672,7 @@ static const struct drm_i915_reg_descripREG64_IDX (RING_TIMESTAMP ,BSD_RING_BASE ),REG32 (BCS_SWCTRL ),REG64_IDX (RING_TIMESTAMP ,BLT_RING_BASE ), +REG32_IDX (RING_CTX_TIMESTAMP ,BLT_RING_BASE ),REG64_IDX (BCS_GPR ,0 ),REG64_IDX (BCS_GPR ,1 ), REG64_IDX(BCS_GPR, 2),
Greg Kroah-Hartman
maintainerPATCH 446/477 drm/connector: notify userspace on hotplug after register complete
In reply to Greg Kroah-HartmanFrom: Jeykumar Sankaran <[email protected]>
commit 968d81a64a883af2d16dd3f8a6ad6b67db2fde58 upstream.
drm connector notifies userspace on hotplug event prematurely before late_register and mode_object register completes. This leads to a race between userspace and kernel on updating the IDR list. So, move the notification to end of connector register.
--- drivers/gpu/drm/drm_connector.c | 5 +++++ drivers/gpu/drm/drm_sysfs.c | 3 --- 2 files changed, 5 insertions(+), 3 deletions(-)
drivers/gpu/drm/drm_connector.c +5 -0
@@ -27,6 +27,7 @@#include <drm/drm_print.h> #include <drm/drm_drv.h> #include <drm/drm_file.h> +#include <drm/drm_sysfs.h> #include <linux/uaccess.h>
@@ -523,6 +524,10 @@ int drm_connector_register(struct drm_codrm_mode_object_register (connector->dev, &connector->base); connector->registration_state =DRM_CONNECTOR_REGISTERED ; + +/* Let userspace know we have a new connector */ +drm_sysfs_hotplug_event (connector->dev); + goto unlock; err_debugfs:
drivers/gpu/drm/drm_sysfs.c +0 -3
@@ -291,9 +291,6 @@ int drm_sysfs_connector_add(struct drm_creturn PTR_ERR (connector->kdev); } -/* Let userspace know we have a new connector */ -drm_sysfs_hotplug_event (dev); -if (connector->ddc)return sysfs_create_link (&connector->kdev->kobj, &connector->ddc->dev.kobj,"ddc" );
Greg Kroah-Hartman
maintainerPATCH 447/477 drm/amdkfd: Use correct major in devcgroup check
In reply to Greg Kroah-HartmanFrom: Lorenz Brun <[email protected]>
commit 99c7b309472787026ce52fd2bc5d00630567a872 upstream.
The existing code used the major version number of the DRM driver instead of the device major number of the DRM subsystem for validating access for a devices cgroup.
This meant that accesses allowed by the devices cgroup weren't permitted and certain accesses denied by the devices cgroup were permitted (if they matched the wrong major device number).
--- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_priv.h +2 -1
@@ -40,6 +40,7 @@#include <drm/drm_file.h> #include <drm/drm_drv.h> #include <drm/drm_device.h> +#include <drm/drm_ioctl.h> #include <kgd_kfd_interface.h> #include <linux/swap.h>
@@ -1053,7 +1054,7 @@ static inline int kfd_devcgroup_check_pe#if defined(CONFIG_CGROUP_DEVICE ) || defined(CONFIG_CGROUP_BPF )struct drm_device *ddev = kfd->ddev; -return devcgroup_check_permission (DEVCG_DEV_CHAR , ddev->driver->major, +return devcgroup_check_permission (DEVCG_DEV_CHAR ,DRM_MAJOR , ddev->render->index,DEVCG_ACC_WRITE |DEVCG_ACC_READ );#else
Greg Kroah-Hartman
maintainerPATCH 448/477 drm/amd/display: Use kvfree() to free coeff in build_regamma()
In reply to Greg Kroah-HartmanFrom: Denis Efremov <[email protected]>
commit 81921a828b94ce2816932c19a5ec74d302972833 upstream.
Use kvfree() instead of kfree() to free coeff in build_regamma() because the memory is allocated with kvzalloc().
--- drivers/gpu/drm/amd/display/modules/color/color_gamma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/modules/color/color_gamma.c +1 -1
@@ -843,7 +843,7 @@ static bool build_regamma(struct pwl_flo pow_buffer_ptr =-1 ;// reset back to no optimize ret = true; release: -kfree (coeff); +kvfree (coeff);return ret; }
Greg Kroah-Hartman
maintainerPATCH 449/477 drm/i915/icl+: Fix hotplug interrupt disabling after storm detection
In reply to Greg Kroah-HartmanFrom: Imre Deak <[email protected]>
commit a3005c2edf7e8c3478880db1ca84028a2b6819bb upstream.
Atm, hotplug interrupts on TypeC ports are left enabled after detecting an interrupt storm, fix this.
Bugzilla: https://gitlab.freedesktop.org/drm/intel/-/issues/1964
--- drivers/gpu/drm/i915/i915_irq.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/i915/i915_irq.c +1 -0
@@ -3092,6 +3092,7 @@ static void gen11_hpd_irq_setup(struct d val =I915_READ (GEN11_DE_HPD_IMR ); val &= ~hotplug_irqs; + val |= ~enabled_irqs & hotplug_irqs;I915_WRITE (GEN11_DE_HPD_IMR , val);POSTING_READ (GEN11_DE_HPD_IMR );
Greg Kroah-Hartman
maintainerPATCH 450/477 drm/i915/tc: fix the reset of ln0
In reply to Greg Kroah-HartmanFrom: Khaled Almahallawy <[email protected]>
commit a43555ac908c604f45ed98628805aec9355b9737 upstream.
Setting ln0 similar to ln1
--- drivers/gpu/drm/i915/display/intel_ddi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/display/intel_ddi.c +1 -1
@@ -2866,7 +2866,7 @@ icl_program_mg_dp_mode(struct intel_digi ln1 =intel_de_read (dev_priv,MG_DP_MODE (1 , tc_port)); } - ln0 &= ~(MG_DP_MODE_CFG_DP_X1_MODE |MG_DP_MODE_CFG_DP_X1_MODE ); + ln0 &= ~(MG_DP_MODE_CFG_DP_X1_MODE |MG_DP_MODE_CFG_DP_X2_MODE ); ln1 &= ~(MG_DP_MODE_CFG_DP_X1_MODE |MG_DP_MODE_CFG_DP_X2_MODE );/* DPPATC */
Greg Kroah-Hartman
maintainerPATCH 451/477 drm/i915/gt: Incrementally check for rewinding
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
commit 8ab3a3812aa90e488813e719308ffd807b865624 upstream.
In commit 5ba32c7be81e ("drm/i915/execlists: Always force a context reload when rewinding RING_TAIL"), we placed the check for rewinding a context on actually submitting the next request in that context. This was so that we only had to check once, and could do so with precision avoiding as many forced restores as possible. For example, to ensure that we can resubmit the same request a couple of times, we include a small wa_tail such that on the next submission, the ring->tail will appear to move forwards when resubmitting the same request. This is very common as it will happen for every lite-restore to fill the second port after a context switch.
However, intel_ring_direction() is limited in precision to movements of upto half the ring size. The consequence being that if we tried to unwind many requests, we could exceed half the ring and flip the sense of the direction, so missing a force restore. As no request can be greater than half the ring (i.e. 2048 bytes in the smallest case), we can check for rollback incrementally. As we check against the tail that would be submitted, we do not lose any sensitivity and allow lite restores for the simple case. We still need to double check upon submitting the context, to allow for multiple preemptions and resubmissions.
--- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 4 drivers/gpu/drm/i915/gt/intel_lrc.c | 21 +++ drivers/gpu/drm/i915/gt/intel_ring.c | 4 drivers/gpu/drm/i915/gt/selftest_mocs.c | 18 ++- drivers/gpu/drm/i915/gt/selftest_ring.c | 110 +++++++++++++++++++ drivers/gpu/drm/i915/selftests/i915_mock_selftests.h | 1 6 files changed, 154 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/gt/intel_engine_cs.c +3 -1
@@ -639,7 +639,7 @@ static int engine_setup_common(struct instruct measure_breadcrumb {struct i915_request rq;struct intel_ring ring; -u32 cs[1024 ]; +u32 cs[2048 ]; };static int measure_breadcrumb_dw (struct intel_context *ce)
@@ -661,6 +661,8 @@ static int measure_breadcrumb_dw(struct frame->ring.vaddr = frame->cs; frame->ring.size =sizeof (frame->cs); + frame->ring.wrap = +BITS_PER_TYPE (frame->ring.size) -ilog2 (frame->ring.size); frame->ring.effective_size = frame->ring.size;intel_ring_update_space (&frame->ring); frame->rq.ring = &frame->ring;
drivers/gpu/drm/i915/gt/intel_lrc.c +20 -1
@@ -972,6 +972,13 @@ __unwind_incomplete_requests(struct intelist_move (&rq->sched.link, pl);set_bit (I915_FENCE_FLAG_PQUEUE , &rq->fence.flags); +/* Check in case we rollback so far we wrap [size/2] */ +if (intel_ring_direction (rq->ring, +intel_ring_wrap (rq->ring, + rq->tail), + rq->ring->tail) >0 ) + rq->context->lrc.desc |=CTX_DESC_FORCE_RESTORE ; + active = rq; }else {struct intel_engine_cs *owner = rq->context->engine;
@@ -1383,8 +1390,9 @@ static u64 execlists_update_context(stru* HW has a tendency to ignore us rewinding the TAIL to the end of * an earlier request. */ +GEM_BUG_ON (ce->lrc_reg_state[CTX_RING_TAIL ] != rq->ring->tail); + prev = rq->ring->tail; tail =intel_ring_set_tail (rq->ring, rq->tail); - prev = ce->lrc_reg_state[CTX_RING_TAIL ];if (unlikely (intel_ring_direction (rq->ring, tail, prev) <=0 )) desc |=CTX_DESC_FORCE_RESTORE ; ce->lrc_reg_state[CTX_RING_TAIL ] = tail;
@@ -4213,6 +4221,14 @@ static int gen12_emit_flush_render(strucreturn 0 ; } +static void assert_request_valid (struct i915_request *rq) +{ +struct intel_ring *ring__maybe_unused = rq->ring; + +/* Can we unwind this request without appearing to go forwards? */ +GEM_BUG_ON (intel_ring_direction (ring, rq->wa_tail, rq->head) <=0 ); +} +/* * Reserve space for 2 NOOPs at the end of each request to be * used as a workaround for not being allowed to do lite
@@ -4225,6 +4241,9 @@ static u32 *gen8_emit_wa_tail(struct i91 *cs++ =MI_NOOP ; request->wa_tail =intel_ring_offset (request, cs); +/* Check that entire request is less than half the ring */ +assert_request_valid (request); +return cs; }
drivers/gpu/drm/i915/gt/intel_ring.c +4 -0
@@ -315,3 +315,7 @@ int intel_ring_cacheline_align(struct i9GEM_BUG_ON (rq->ring->emit & (CACHELINE_BYTES -1 ));return 0 ; } + +#if IS_ENABLED (CONFIG_DRM_I915_SELFTEST ) +#include "selftest_ring.c" +#endif
drivers/gpu/drm/i915/gt/selftest_mocs.c +16 -2
@@ -18,6 +18,20 @@ struct live_mocs {void *vaddr; }; +static struct intel_context *mocs_context_create (struct intel_engine_cs *engine) +{ +struct intel_context *ce; + + ce =intel_context_create (engine); +if (IS_ERR (ce)) +return ce; + +/* We build large requests to read the registers from the ring */ + ce->ring =__intel_context_ring_size (SZ_16K ); + +return ce; +} +static int request_add_sync (struct i915_request *rq,int err) {i915_request_get (rq);
@@ -301,7 +315,7 @@ static int live_mocs_clean(void *arg)for_each_engine (engine, gt, id) {struct intel_context *ce; - ce =intel_context_create (engine); + ce =mocs_context_create (engine);if (IS_ERR (ce)) { err =PTR_ERR (ce);break ;
@@ -395,7 +409,7 @@ static int live_mocs_reset(void *arg)for_each_engine (engine, gt, id) {struct intel_context *ce; - ce =intel_context_create (engine); + ce =mocs_context_create (engine);if (IS_ERR (ce)) { err =PTR_ERR (ce);break ;
drivers/gpu/drm/i915/gt/selftest_ring.c new file +110 -0
110 lines not on this page · raw message
drivers/gpu/drm/i915/selftests/i915_mock_selftests.h +1 -0
@@ -20,6 +20,7 @@ selftest(fence, i915_sw_fence_mock_selft selftest(scatterlist, scatterlist_mock_selftests) selftest(syncmap, i915_syncmap_mock_selftests) selftest(uncore, intel_uncore_mock_selftests) +selftest(ring, intel_ring_mock_selftests) selftest(engine, intel_engine_cs_mock_selftests) selftest(timelines, intel_timeline_mock_selftests)selftest (requests, i915_request_mock_selftests)
Greg Kroah-Hartman
maintainerPATCH 452/477 drm/i915/gt: Move hsw GT workarounds from init_clock_gating to workarounds
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
commit ef50fa9bd17d13d0611e39e13b37bbd3e1ea50bf upstream.
Rescue the GT workarounds from being buried inside init_clock_gating so that we remember to apply them after a GT reset, and that they are included in our verification that the workarounds are applied.
v2: Leave HSW_SCRATCH to set an explicit value, not or in our disable bit.
--- drivers/gpu/drm/i915/gt/intel_workarounds.c | 48 ++++++++++++++++++++++++++++ drivers/gpu/drm/i915/intel_pm.c | 39 +--------------------- 2 files changed, 50 insertions(+), 37 deletions(-)
drivers/gpu/drm/i915/gt/intel_workarounds.c +48 -0
@@ -179,6 +179,12 @@ wa_write_or(struct i915_wa_list *wal, i9 }static void +wa_write_clr (struct i915_wa_list *wal,i915_reg_t reg,u32 clr) +{ +wa_write_masked_or (wal, reg, clr,0 ); +} + +static void wa_masked_en (struct i915_wa_list *wal,i915_reg_t reg,u32 val) {wa_add (wal, reg,0 ,_MASKED_BIT_ENABLE (val), val);
@@ -698,6 +704,46 @@ int intel_engine_emit_ctx_wa(struct i915 }static void +hsw_gt_workarounds_init (struct drm_i915_private *i915,struct i915_wa_list *wal) +{ +/* L3 caching of data atomics doesn't work -- disable it. */ +wa_write (wal,HSW_SCRATCH1 ,HSW_SCRATCH1_L3_DATA_ATOMICS_DISABLE ); + +wa_add (wal, +HSW_ROW_CHICKEN3 ,0 , +_MASKED_BIT_ENABLE (HSW_ROW_CHICKEN3_L3_GLOBAL_ATOMICS_DISABLE ), +0 /* XXX does this reg exist? */ ); + +/* WaVSRefCountFullforceMissDisable:hsw */ +wa_write_clr (wal,GEN7_FF_THREAD_MODE ,GEN7_FF_VS_REF_CNT_FFME ); + +wa_masked_dis (wal, +CACHE_MODE_0_GEN7 , +/* WaDisable_RenderCache_OperationalFlush:hsw */ +RC_OP_FLUSH_ENABLE | +/* enable HiZ Raw Stall Optimization */ +HIZ_RAW_STALL_OPT_DISABLE ); + +/* WaDisable4x2SubspanOptimization:hsw */ +wa_masked_en (wal,CACHE_MODE_1 ,PIXEL_SUBSPAN_COLLECT_OPT_DISABLE ); + +/* +* BSpec recommends 8x4 when MSAA is used, +* however in practice 16x4 seems fastest. +* +* Note that PS/WM thread counts depend on the WIZ hashing +* disable bit, which we don't touch here, but it's good +* to keep in mind (see 3DSTATE_PS and 3DSTATE_WM). +*/ +wa_add (wal,GEN7_GT_MODE ,0 , +_MASKED_FIELD (GEN6_WIZ_HASHING_MASK , GEN6_WIZ_HASHING_16x4), + GEN6_WIZ_HASHING_16x4); + +/* WaSampleCChickenBitEnable:hsw */ +wa_masked_en (wal,HALF_SLICE_CHICKEN3 ,HSW_SAMPLE_C_PERFORMANCE ); +} + +static void gen9_gt_workarounds_init (struct drm_i915_private *i915,struct i915_wa_list *wal) {/* WaDisableKillLogic:bxt,skl,kbl */
@@ -974,6 +1020,8 @@ gt_init_workarounds(struct drm_i915_privbxt_gt_workarounds_init (i915, wal); else if (IS_SKYLAKE(i915)) skl_gt_workarounds_init(i915, wal); + else if (IS_HASWELL(i915)) + hsw_gt_workarounds_init(i915, wal); else if (INTEL_GEN(i915) <= 8) return; else
drivers/gpu/drm/i915/intel_pm.c +2 -37
@@ -6992,45 +6992,10 @@ static void bdw_init_clock_gating(structstatic void hsw_init_clock_gating (struct drm_i915_private *dev_priv) { -/* L3 caching of data atomics doesn't work -- disable it. */ -I915_WRITE (HSW_SCRATCH1 ,HSW_SCRATCH1_L3_DATA_ATOMICS_DISABLE ); -I915_WRITE (HSW_ROW_CHICKEN3 , -_MASKED_BIT_ENABLE (HSW_ROW_CHICKEN3_L3_GLOBAL_ATOMICS_DISABLE )); -/* This is required by WaCatErrorRejectionIssue:hsw */ I915_WRITE (GEN7_SQ_CHICKEN_MBCUNIT_CONFIG , -I915_READ (GEN7_SQ_CHICKEN_MBCUNIT_CONFIG ) | -GEN7_SQ_CHICKEN_MBCUNIT_SQINTMOB ); - -/* WaVSRefCountFullforceMissDisable:hsw */ -I915_WRITE (GEN7_FF_THREAD_MODE , -I915_READ (GEN7_FF_THREAD_MODE ) & ~GEN7_FF_VS_REF_CNT_FFME ); - -/* WaDisable_RenderCache_OperationalFlush:hsw */ -I915_WRITE (CACHE_MODE_0_GEN7 ,_MASKED_BIT_DISABLE (RC_OP_FLUSH_ENABLE )); - -/* enable HiZ Raw Stall Optimization */ -I915_WRITE (CACHE_MODE_0_GEN7 , -_MASKED_BIT_DISABLE (HIZ_RAW_STALL_OPT_DISABLE )); - -/* WaDisable4x2SubspanOptimization:hsw */ -I915_WRITE (CACHE_MODE_1 , -_MASKED_BIT_ENABLE (PIXEL_SUBSPAN_COLLECT_OPT_DISABLE )); - -/* -* BSpec recommends 8x4 when MSAA is used, -* however in practice 16x4 seems fastest. -* -* Note that PS/WM thread counts depend on the WIZ hashing -* disable bit, which we don't touch here, but it's good -* to keep in mind (see 3DSTATE_PS and 3DSTATE_WM). -*/ -I915_WRITE (GEN7_GT_MODE , -_MASKED_FIELD (GEN6_WIZ_HASHING_MASK , GEN6_WIZ_HASHING_16x4)); - -/* WaSampleCChickenBitEnable:hsw */ -I915_WRITE (HALF_SLICE_CHICKEN3 , -_MASKED_BIT_ENABLE (HSW_SAMPLE_C_PERFORMANCE )); +I915_READ (GEN7_SQ_CHICKEN_MBCUNIT_CONFIG ) | +GEN7_SQ_CHICKEN_MBCUNIT_SQINTMOB );/* WaSwitchSolVfFArbitrationPriority:hsw */ I915_WRITE (GAM_ECOCHK ,I915_READ (GAM_ECOCHK ) |HSW_ECOCHK_ARB_PRIO_SOL );
Greg Kroah-Hartman
maintainerPATCH 453/477 drm/i915/gt: Move ivb GT workarounds from init_clock_gating to workarounds
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
commit 7237b190add0794bd95979018a23eda698f2705d upstream.
Rescue the GT workarounds from being buried inside init_clock_gating so that we remember to apply them after a GT reset, and that they are included in our verification that the workarounds are applied.
--- drivers/gpu/drm/i915/gt/intel_workarounds.c | 62 ++++++++++++++++++++++++++++ drivers/gpu/drm/i915/i915_reg.h | 2 drivers/gpu/drm/i915/intel_pm.c | 48 --------------------- 3 files changed, 63 insertions(+), 49 deletions(-)
drivers/gpu/drm/i915/gt/intel_workarounds.c +62 -0
@@ -704,6 +704,66 @@ int intel_engine_emit_ctx_wa(struct i915 }static void +ivb_gt_workarounds_init (struct drm_i915_private *i915,struct i915_wa_list *wal) +{ +/* WaDisableEarlyCull:ivb */ +wa_masked_en (wal, _3D_CHICKEN3, _3D_CHICKEN_SF_DISABLE_OBJEND_CULL); + +/* WaDisablePSDDualDispatchEnable:ivb */ +if (IS_IVB_GT1 (i915)) +wa_masked_en (wal, +GEN7_HALF_SLICE_CHICKEN1 , +GEN7_PSD_SINGLE_PORT_DISPATCH_ENABLE ); + +/* WaDisable_RenderCache_OperationalFlush:ivb */ +wa_masked_dis (wal,CACHE_MODE_0_GEN7 ,RC_OP_FLUSH_ENABLE ); + +/* Apply the WaDisableRHWOOptimizationForRenderHang:ivb workaround. */ +wa_masked_dis (wal, +GEN7_COMMON_SLICE_CHICKEN1 , +GEN7_CSC1_RHWO_OPT_DISABLE_IN_RCC ); + +/* WaApplyL3ControlAndL3ChickenMode:ivb */ +wa_write (wal,GEN7_L3CNTLREG1 ,GEN7_WA_FOR_GEN7_L3_CONTROL ); +wa_write (wal,GEN7_L3_CHICKEN_MODE_REGISTER ,GEN7_WA_L3_CHICKEN_MODE ); + +/* WaForceL3Serialization:ivb */ +wa_write_clr (wal,GEN7_L3SQCREG4 ,L3SQ_URB_READ_CAM_MATCH_DISABLE ); + +/* +* WaVSThreadDispatchOverride:ivb,vlv +* +* This actually overrides the dispatch +* mode for all thread types. +*/ +wa_write_masked_or (wal,GEN7_FF_THREAD_MODE , +GEN7_FF_SCHED_MASK , +GEN7_FF_TS_SCHED_HW | +GEN7_FF_VS_SCHED_HW | +GEN7_FF_DS_SCHED_HW ); + +if (0 ) {/* causes HiZ corruption on ivb:gt1 */ +/* enable HiZ Raw Stall Optimization */ +wa_masked_dis (wal,CACHE_MODE_0_GEN7 ,HIZ_RAW_STALL_OPT_DISABLE ); + } + +/* WaDisable4x2SubspanOptimization:ivb */ +wa_masked_en (wal,CACHE_MODE_1 ,PIXEL_SUBSPAN_COLLECT_OPT_DISABLE ); + +/* +* BSpec recommends 8x4 when MSAA is used, +* however in practice 16x4 seems fastest. +* +* Note that PS/WM thread counts depend on the WIZ hashing +* disable bit, which we don't touch here, but it's good +* to keep in mind (see 3DSTATE_PS and 3DSTATE_WM). +*/ +wa_add (wal,GEN7_GT_MODE ,0 , +_MASKED_FIELD (GEN6_WIZ_HASHING_MASK , GEN6_WIZ_HASHING_16x4), + GEN6_WIZ_HASHING_16x4); +} + +static void hsw_gt_workarounds_init (struct drm_i915_private *i915,struct i915_wa_list *wal) {/* L3 caching of data atomics doesn't work -- disable it. */
@@ -1022,6 +1082,8 @@ gt_init_workarounds(struct drm_i915_privskl_gt_workarounds_init (i915, wal); else if (IS_HASWELL(i915)) hsw_gt_workarounds_init(i915, wal); + else if (IS_IVYBRIDGE(i915)) + ivb_gt_workarounds_init(i915, wal); else if (INTEL_GEN(i915) <= 8) return; else
drivers/gpu/drm/i915/i915_reg.h +1 -1
@@ -7819,7 +7819,7 @@ enum {/* GEN7 chicken */ #define GEN7_COMMON_SLICE_CHICKEN1 _MMIO(0x7010) -#define GEN7_CSC1_RHWO_OPT_DISABLE_IN_RCC ((1 << 10) | (1 << 26)) +#define GEN7_CSC1_RHWO_OPT_DISABLE_IN_RCC (1 << 10)#define GEN9_RHWO_OPTIMIZATION_DISABLE (1 << 14)#define COMMON_SLICE_CHICKEN2 _MMIO(0x7014)
drivers/gpu/drm/i915/intel_pm.c +0 -48
71 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 454/477 drm/i915/gt: Move snb GT workarounds from init_clock_gating to workarounds
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
commit fd2599bda5a989c3332f4956fd7760ec32bd51ee upstream.
Rescue the GT workarounds from being buried inside init_clock_gating so that we remember to apply them after a GT reset, and that they are included in our verification that the workarounds are applied.
--- drivers/gpu/drm/i915/gt/intel_workarounds.c | 41 ++++++++++++++++++++++++++++ drivers/gpu/drm/i915/intel_pm.c | 33 ---------------------- 2 files changed, 41 insertions(+), 33 deletions(-)
drivers/gpu/drm/i915/gt/intel_workarounds.c +41 -0
@@ -704,6 +704,45 @@ int intel_engine_emit_ctx_wa(struct i915 }static void +snb_gt_workarounds_init (struct drm_i915_private *i915,struct i915_wa_list *wal) +{ +/* WaDisableHiZPlanesWhenMSAAEnabled:snb */ +wa_masked_en (wal, + _3D_CHICKEN, + _3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB); + +/* WaDisable_RenderCache_OperationalFlush:snb */ +wa_masked_dis (wal,CACHE_MODE_0 ,RC_OP_FLUSH_ENABLE ); + +/* +* BSpec recommends 8x4 when MSAA is used, +* however in practice 16x4 seems fastest. +* +* Note that PS/WM thread counts depend on the WIZ hashing +* disable bit, which we don't touch here, but it's good +* to keep in mind (see 3DSTATE_PS and 3DSTATE_WM). +*/ +wa_add (wal, +GEN6_GT_MODE ,0 , +_MASKED_FIELD (GEN6_WIZ_HASHING_MASK , GEN6_WIZ_HASHING_16x4), + GEN6_WIZ_HASHING_16x4); + +wa_masked_dis (wal,CACHE_MODE_0 ,CM0_STC_EVICT_DISABLE_LRA_SNB ); + +wa_masked_en (wal, + _3D_CHICKEN3, +/* WaStripsFansDisableFastClipPerformanceFix:snb */ + _3D_CHICKEN3_SF_DISABLE_FASTCLIP_CULL | +/* +* Bspec says: +* "This bit must be set if 3DSTATE_CLIP clip mode is set +* to normal and 3DSTATE_SF number of SF output attributes +* is more than 16." +*/ + _3D_CHICKEN3_SF_DISABLE_PIPELINED_ATTR_FETCH); +} + +static void ivb_gt_workarounds_init (struct drm_i915_private *i915,struct i915_wa_list *wal) {/* WaDisableEarlyCull:ivb */
@@ -1084,6 +1123,8 @@ gt_init_workarounds(struct drm_i915_privhsw_gt_workarounds_init (i915, wal); else if (IS_IVYBRIDGE(i915)) ivb_gt_workarounds_init(i915, wal); + else if (IS_GEN(i915, 6)) + snb_gt_workarounds_init(i915, wal); else if (INTEL_GEN(i915) <= 8) return; else
drivers/gpu/drm/i915/intel_pm.c +0 -33
@@ -6665,27 +6665,6 @@ static void gen6_init_clock_gating(strucI915_READ (ILK_DISPLAY_CHICKEN2 ) | ILK_ELPIN_409_SELECT); -/* WaDisableHiZPlanesWhenMSAAEnabled:snb */ -I915_WRITE (_3D_CHICKEN, -_MASKED_BIT_ENABLE (_3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB)); - -/* WaDisable_RenderCache_OperationalFlush:snb */ -I915_WRITE (CACHE_MODE_0 ,_MASKED_BIT_DISABLE (RC_OP_FLUSH_ENABLE )); - -/* -* BSpec recoomends 8x4 when MSAA is used, -* however in practice 16x4 seems fastest. -* -* Note that PS/WM thread counts depend on the WIZ hashing -* disable bit, which we don't touch here, but it's good -* to keep in mind (see 3DSTATE_PS and 3DSTATE_WM). -*/ -I915_WRITE (GEN6_GT_MODE , -_MASKED_FIELD (GEN6_WIZ_HASHING_MASK , GEN6_WIZ_HASHING_16x4)); - -I915_WRITE (CACHE_MODE_0 , -_MASKED_BIT_DISABLE (CM0_STC_EVICT_DISABLE_LRA_SNB )); - I915_WRITE(GEN6_UCGCTL1, I915_READ(GEN6_UCGCTL1) | GEN6_BLBUNIT_CLOCK_GATE_DISABLE |
@@ -6708,18 +6687,6 @@ static void gen6_init_clock_gating(strucGEN6_RCPBUNIT_CLOCK_GATE_DISABLE | GEN6_RCCUNIT_CLOCK_GATE_DISABLE); -/* WaStripsFansDisableFastClipPerformanceFix:snb */ -I915_WRITE (_3D_CHICKEN3, -_MASKED_BIT_ENABLE (_3D_CHICKEN3_SF_DISABLE_FASTCLIP_CULL)); - -/* -* Bspec says: -* "This bit must be set if 3DSTATE_CLIP clip mode is set to normal and -* 3DSTATE_SF number of SF output attributes is more than 16." -*/ -I915_WRITE (_3D_CHICKEN3, -_MASKED_BIT_ENABLE (_3D_CHICKEN3_SF_DISABLE_PIPELINED_ATTR_FETCH)); -/* * According to the spec the following bits should be * set in order to enable memory self-refresh and fbc:
Greg Kroah-Hartman
maintainerPATCH 455/477 drm/i915/gt: Move ilk GT workarounds from init_clock_gating to workarounds
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
commit eacf21040aa97fd1b3c6bb201bfd43820e1c49be upstream.
Rescue the GT workarounds from being buried inside init_clock_gating so that we remember to apply them after a GT reset, and that they are included in our verification that the workarounds are applied.
--- drivers/gpu/drm/i915/gt/intel_workarounds.c | 14 ++++++++++++++ drivers/gpu/drm/i915/intel_pm.c | 10 ---------- 2 files changed, 14 insertions(+), 10 deletions(-)
drivers/gpu/drm/i915/gt/intel_workarounds.c +14 -0
@@ -704,6 +704,18 @@ int intel_engine_emit_ctx_wa(struct i915 }static void +ilk_gt_workarounds_init (struct drm_i915_private *i915,struct i915_wa_list *wal) +{ +wa_masked_en (wal, _3D_CHICKEN2, _3D_CHICKEN2_WM_READ_PIPELINED); + +/* WaDisableRenderCachePipelinedFlush:ilk */ +wa_masked_en (wal,CACHE_MODE_0 ,CM0_PIPELINED_RENDER_FLUSH_DISABLE ); + +/* WaDisable_RenderCache_OperationalFlush:ilk */ +wa_masked_dis (wal,CACHE_MODE_0 ,RC_OP_FLUSH_ENABLE ); +} + +static void snb_gt_workarounds_init (struct drm_i915_private *i915,struct i915_wa_list *wal) {/* WaDisableHiZPlanesWhenMSAAEnabled:snb */
@@ -1125,6 +1137,8 @@ gt_init_workarounds(struct drm_i915_privivb_gt_workarounds_init (i915, wal); else if (IS_GEN(i915, 6)) snb_gt_workarounds_init(i915, wal); + else if (IS_GEN(i915, 5)) + ilk_gt_workarounds_init(i915, wal); else if (INTEL_GEN(i915) <= 8) return; else
drivers/gpu/drm/i915/intel_pm.c +0 -10
@@ -6593,16 +6593,6 @@ static void ilk_init_clock_gating(structI915_WRITE (ILK_DISPLAY_CHICKEN2 ,I915_READ (ILK_DISPLAY_CHICKEN2 ) |ILK_ELPIN_409_SELECT ); -I915_WRITE (_3D_CHICKEN2, - _3D_CHICKEN2_WM_READ_PIPELINED <<16 | - _3D_CHICKEN2_WM_READ_PIPELINED); - -/* WaDisableRenderCachePipelinedFlush:ilk */ -I915_WRITE (CACHE_MODE_0 , -_MASKED_BIT_ENABLE (CM0_PIPELINED_RENDER_FLUSH_DISABLE )); - -/* WaDisable_RenderCache_OperationalFlush:ilk */ -I915_WRITE (CACHE_MODE_0 ,_MASKED_BIT_DISABLE (RC_OP_FLUSH_ENABLE ));g4x_disable_trickle_feed (dev_priv);
Greg Kroah-Hartman
maintainerPATCH 456/477 drm/i915/gt: Move vlv GT workarounds from init_clock_gating to workarounds
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
commit 695a2b11649e99bbf15d278042247042c42b8728 upstream.
Rescue the GT workarounds from being buried inside init_clock_gating so that we remember to apply them after a GT reset, and that they are included in our verification that the workarounds are applied.
--- drivers/gpu/drm/i915/gt/intel_workarounds.c | 59 +++++++++++++++++++++++++++ drivers/gpu/drm/i915/intel_pm.c | 61 ---------------------------- 2 files changed, 59 insertions(+), 61 deletions(-)
drivers/gpu/drm/i915/gt/intel_workarounds.c +59 -0
@@ -815,6 +815,63 @@ ivb_gt_workarounds_init(struct drm_i915_ }static void +vlv_gt_workarounds_init (struct drm_i915_private *i915,struct i915_wa_list *wal) +{ +/* WaDisableEarlyCull:vlv */ +wa_masked_en (wal, _3D_CHICKEN3, _3D_CHICKEN_SF_DISABLE_OBJEND_CULL); + +/* WaPsdDispatchEnable:vlv */ +/* WaDisablePSDDualDispatchEnable:vlv */ +wa_masked_en (wal, +GEN7_HALF_SLICE_CHICKEN1 , +GEN7_MAX_PS_THREAD_DEP | +GEN7_PSD_SINGLE_PORT_DISPATCH_ENABLE ); + +/* WaDisable_RenderCache_OperationalFlush:vlv */ +wa_masked_dis (wal,CACHE_MODE_0_GEN7 ,RC_OP_FLUSH_ENABLE ); + +/* WaForceL3Serialization:vlv */ +wa_write_clr (wal,GEN7_L3SQCREG4 ,L3SQ_URB_READ_CAM_MATCH_DISABLE ); + +/* +* WaVSThreadDispatchOverride:ivb,vlv +* +* This actually overrides the dispatch +* mode for all thread types. +*/ +wa_write_masked_or (wal, +GEN7_FF_THREAD_MODE , +GEN7_FF_SCHED_MASK , +GEN7_FF_TS_SCHED_HW | +GEN7_FF_VS_SCHED_HW | +GEN7_FF_DS_SCHED_HW ); + +/* +* BSpec says this must be set, even though +* WaDisable4x2SubspanOptimization isn't listed for VLV. +*/ +wa_masked_en (wal,CACHE_MODE_1 ,PIXEL_SUBSPAN_COLLECT_OPT_DISABLE ); + +/* +* BSpec recommends 8x4 when MSAA is used, +* however in practice 16x4 seems fastest. +* +* Note that PS/WM thread counts depend on the WIZ hashing +* disable bit, which we don't touch here, but it's good +* to keep in mind (see 3DSTATE_PS and 3DSTATE_WM). +*/ +wa_add (wal,GEN7_GT_MODE ,0 , +_MASKED_FIELD (GEN6_WIZ_HASHING_MASK , GEN6_WIZ_HASHING_16x4), + GEN6_WIZ_HASHING_16x4); + +/* +* WaIncreaseL3CreditsForVLVB0:vlv +* This is the hardware default actually. +*/ +wa_write (wal,GEN7_L3SQCREG1 ,VLV_B0_WA_L3SQCREG1_VALUE ); +} + +static void hsw_gt_workarounds_init (struct drm_i915_private *i915,struct i915_wa_list *wal) {/* L3 caching of data atomics doesn't work -- disable it. */
@@ -1133,6 +1190,8 @@ gt_init_workarounds(struct drm_i915_privskl_gt_workarounds_init (i915, wal); else if (IS_HASWELL(i915)) hsw_gt_workarounds_init(i915, wal); + else if (IS_VALLEYVIEW(i915)) + vlv_gt_workarounds_init(i915, wal); else if (IS_IVYBRIDGE(i915)) ivb_gt_workarounds_init(i915, wal); else if (IS_GEN(i915, 6))
drivers/gpu/drm/i915/intel_pm.c +0 -61
90 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 457/477 drm/i915/gt: Move gen4 GT workarounds from init_clock_gating to workarounds
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
commit 27582a9c917940bc71c0df0b8e022cbde8d735d2 upstream.
Rescue the GT workarounds from being buried inside init_clock_gating so that we remember to apply them after a GT reset, and that they are included in our verification that the workarounds are applied.
--- drivers/gpu/drm/i915/gt/intel_workarounds.c | 27 ++++++++++++++++++++++----- drivers/gpu/drm/i915/intel_pm.c | 15 --------------- 2 files changed, 22 insertions(+), 20 deletions(-)
drivers/gpu/drm/i915/gt/intel_workarounds.c +22 -5
@@ -704,15 +704,28 @@ int intel_engine_emit_ctx_wa(struct i915 }static void -ilk_gt_workarounds_init (struct drm_i915_private *i915,struct i915_wa_list *wal) +gen4_gt_workarounds_init (struct drm_i915_private *i915, +struct i915_wa_list *wal) { -wa_masked_en (wal, _3D_CHICKEN2, _3D_CHICKEN2_WM_READ_PIPELINED); +/* WaDisable_RenderCache_OperationalFlush:gen4,ilk */ +wa_masked_dis (wal,CACHE_MODE_0 ,RC_OP_FLUSH_ENABLE ); +} + +static void +g4x_gt_workarounds_init (struct drm_i915_private *i915,struct i915_wa_list *wal) +{ +gen4_gt_workarounds_init (i915, wal); -/* WaDisableRenderCachePipelinedFlush:ilk */ +/* WaDisableRenderCachePipelinedFlush:g4x,ilk */ wa_masked_en (wal,CACHE_MODE_0 ,CM0_PIPELINED_RENDER_FLUSH_DISABLE ); +} -/* WaDisable_RenderCache_OperationalFlush:ilk */ -wa_masked_dis (wal,CACHE_MODE_0 ,RC_OP_FLUSH_ENABLE ); +static void +ilk_gt_workarounds_init (struct drm_i915_private *i915,struct i915_wa_list *wal) +{ +g4x_gt_workarounds_init (i915, wal); + +wa_masked_en (wal, _3D_CHICKEN2, _3D_CHICKEN2_WM_READ_PIPELINED); } static void
@@ -1198,6 +1211,10 @@ gt_init_workarounds(struct drm_i915_privsnb_gt_workarounds_init (i915, wal); else if (IS_GEN(i915, 5)) ilk_gt_workarounds_init(i915, wal); + else if (IS_G4X(i915)) + g4x_gt_workarounds_init(i915, wal); + else if (IS_GEN(i915, 4)) + gen4_gt_workarounds_init(i915, wal); else if (INTEL_GEN(i915) <= 8) return; else
drivers/gpu/drm/i915/intel_pm.c +0 -15
@@ -7070,13 +7070,6 @@ static void g4x_init_clock_gating(struct dspclk_gate |=DSSUNIT_CLOCK_GATE_DISABLE ;I915_WRITE (DSPCLK_GATE_D , dspclk_gate); -/* WaDisableRenderCachePipelinedFlush */ -I915_WRITE (CACHE_MODE_0 , -_MASKED_BIT_ENABLE (CM0_PIPELINED_RENDER_FLUSH_DISABLE )); - -/* WaDisable_RenderCache_OperationalFlush:g4x */ -I915_WRITE (CACHE_MODE_0 ,_MASKED_BIT_DISABLE (RC_OP_FLUSH_ENABLE )); -g4x_disable_trickle_feed (dev_priv); }
@@ -7092,11 +7085,6 @@ static void i965gm_init_clock_gating(strintel_uncore_write (uncore,MI_ARB_STATE ,_MASKED_BIT_ENABLE (MI_ARB_DISPLAY_TRICKLE_FEED_DISABLE )); - -/* WaDisable_RenderCache_OperationalFlush:gen4 */ -intel_uncore_write (uncore, -CACHE_MODE_0 , -_MASKED_BIT_DISABLE (RC_OP_FLUSH_ENABLE )); }static void i965g_init_clock_gating (struct drm_i915_private *dev_priv)
@@ -7109,9 +7097,6 @@ static void i965g_init_clock_gating(struI915_WRITE (RENCLK_GATE_D2 ,0 );I915_WRITE (MI_ARB_STATE ,_MASKED_BIT_ENABLE (MI_ARB_DISPLAY_TRICKLE_FEED_DISABLE )); - -/* WaDisable_RenderCache_OperationalFlush:gen4 */ -I915_WRITE (CACHE_MODE_0 ,_MASKED_BIT_DISABLE (RC_OP_FLUSH_ENABLE )); }static void gen3_init_clock_gating (struct drm_i915_private *dev_priv)
Greg Kroah-Hartman
maintainerPATCH 458/477 Revert "drm/amd/display: disable dcn20 abm feature for bring up"
In reply to Greg Kroah-HartmanFrom: Harry Wentland <[email protected]>
commit 14ed1c908a7a623cc0cbf0203f8201d1b7d31d16 upstream.
This reverts commit 96cb7cf13d8530099c256c053648ad576588c387.
This change was used for DCN2 bringup and is no longer desired. In fact it breaks backlight on DCN2 systems.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +5 -8
@@ -1334,7 +1334,7 @@ static int dm_late_init(void *handle)unsigned int linear_lut[16 ];int i;struct dmcu *dmcu = adev->dm.dc->res_pool->dmcu; -bool ret = false; +bool ret;for (i =0 ; i <16 ; i++) linear_lut[i] =0xFFFF * i /15 ;
@@ -1350,13 +1350,10 @@ static int dm_late_init(void *handle)*/ params.min_abm_backlight =0x28F ; -/* todo will enable for navi10 */ -if (adev->asic_type <=CHIP_RAVEN ) { - ret =dmcu_load_iram (dmcu, params); - -if (!ret) -return -EINVAL ; - } + ret =dmcu_load_iram (dmcu, params); + +if (!ret) +return -EINVAL ;return detect_mst_link_for_all_connectors (adev->ddev); }
Greg Kroah-Hartman
maintainerPATCH 459/477 drm/i915/tgl: Make Wa_14010229206 permanent
In reply to Greg Kroah-HartmanFrom: Swathi Dhanavanthri <[email protected]>
commit 63d0f3ea8ebb67160eca281320d255c72b0cb51a upstream.
This workaround now applies to all steppings, not just A0. Wa_1409085225 is a temporary A0-only W/A however it is identical to Wa_14010229206 and hence the combined workaround is made permanent.
Bspec: 52890
--- drivers/gpu/drm/i915/gt/intel_workarounds.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/gpu/drm/i915/gt/intel_workarounds.c +6 -6
@@ -1620,12 +1620,6 @@ rcs_engine_wa_init(struct intel_engine_cGEN7_FF_THREAD_MODE , GEN12_FF_TESSELATION_DOP_GATE_DISABLE); -/* -* Wa_1409085225:tgl -* Wa_14010229206:tgl -*/ -wa_masked_en (wal,GEN9_ROW_CHICKEN4 ,GEN12_DISABLE_TDL_PUSH ); -/* Wa_1408615072:tgl */ wa_write_or (wal,UNSLICE_UNIT_LEVEL_CLKGATE2 ,VSUNIT_CLKGATE_DIS_TGL );
@@ -1643,6 +1637,12 @@ rcs_engine_wa_init(struct intel_engine_cwa_masked_en (wal,GEN9_CS_DEBUG_MODE1 ,FF_DOP_CLOCK_GATE_DISABLE ); + +/* +* Wa_1409085225:tgl +* Wa_14010229206:tgl +*/ +wa_masked_en (wal,GEN9_ROW_CHICKEN4 ,GEN12_DISABLE_TDL_PUSH ); }if (IS_GEN (i915,11 )) {
Greg Kroah-Hartman
maintainerPATCH 460/477 crypto: algif_skcipher - Cap recv SG list at ctx->used
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
commit 7cf81954705b7e5b057f7dc39a7ded54422ab6e1 upstream.
Somewhere along the line the cap on the SG list length for receive was lost. This patch restores it and removes the subsequent test which is now redundant.
--- crypto/algif_skcipher.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
crypto/algif_skcipher.c +1 -5
@@ -74,14 +74,10 @@ static int _skcipher_recvmsg(struct sockreturn PTR_ERR (areq);/* convert iovecs of output buffers into RX SGL */ - err =af_alg_get_rsgl (sk, msg, flags, areq,-1 , &len); + err =af_alg_get_rsgl (sk, msg, flags, areq, ctx->used, &len);if (err) goto free; -/* Process only as much RX buffers for which we have TX data */ -if (len > ctx->used) - len = ctx->used; -/* * If more buffers are to be expected to be processed, process only * full block size buffers.
Greg Kroah-Hartman
maintainerPATCH 461/477 crypto: algboss - dont wait during notifier callback
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit 77251e41f89a813b4090f5199442f217bbf11297 upstream.
When a crypto template needs to be instantiated, CRYPTO_MSG_ALG_REQUEST is sent to crypto_chain. cryptomgr_schedule_probe() handles this by starting a thread to instantiate the template, then waiting for this thread to complete via crypto_larval::completion.
This can deadlock because instantiating the template may require loading modules, and this (apparently depending on userspace) may need to wait for the crc-t10dif module (lib/crc-t10dif.c) to be loaded. But crc-t10dif's module_init function uses crypto_register_notifier() and therefore takes crypto_chain.rwsem for write. That can't proceed until the notifier callback has finished, as it holds this semaphore for read.
Fix this by removing the wait on crypto_larval::completion from within cryptomgr_schedule_probe(). It's actually unnecessary because crypto_alg_mod_lookup() calls crypto_larval_wait() itself after sending CRYPTO_MSG_ALG_REQUEST.
This only actually became a problem in v4.20 due to commit b76377543b73 ("crc-t10dif: Pick better transform if one becomes available"), but the unnecessary wait was much older.
--- crypto/algboss.c | 2 -- 1 file changed, 2 deletions(-)
crypto/algboss.c +0 -2
@@ -178,8 +178,6 @@ static int cryptomgr_schedule_probe(struif (IS_ERR (thread)) goto err_put_larval; -wait_for_completion_interruptible (&larval->completion); -return NOTIFY_STOP ; err_put_larval:
Greg Kroah-Hartman
maintainerPATCH 462/477 tracing: Make ftrace packed events have align of 1
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 4649079b9de1ad86be9f4c989373adb8235a8485 upstream.
When using trace-cmd on 5.6-rt for the function graph tracer, the output was corrupted. It gave output like this:
funcgraph_entry: func=0xffffffff depth=38982 funcgraph_entry: func=0x1ffffffff depth=16044 funcgraph_exit: func=0xffffffff overrun=0x92539aaf00000000 calltime=0x92539c9900000072 rettime=0x100000072 depth=11084 funcgraph_exit: func=0xffffffff overrun=0x9253946e00000000 calltime=0x92539e2100000072 rettime=0x72 depth=26033702 funcgraph_entry: func=0xffffffff depth=85798 funcgraph_entry: func=0x1ffffffff depth=12044
The reason was because the tracefs/events/ftrace/funcgraph_entry/exit format file was incorrect. The -rt kernel adds more common fields to the trace events. Namely, common_migrate_disable and common_preempt_lazy_count. Each is one byte in size. This changes the alignment of the normal payload. Most events are aligned normally, but the function and function graph events are defined with a "PACKED" macro, that packs their payload. As the offsets displayed in the format files are now calculated by an aligned field, the aligned field for function and function graph events should be 1, not their normal alignment.
With aligning of the funcgraph_entry event, the format file has:
field:unsigned short common_type; offset:0; size:2; signed:0;
field:unsigned char common_flags; offset:2; size:1; signed:0;
field:unsigned char common_preempt_count; offset:3; size:1; signed:0;
field:int common_pid; offset:4; size:4; signed:1;
field:unsigned char common_migrate_disable; offset:8; size:1; signed:0;
field:unsigned char common_preempt_lazy_count; offset:9; size:1; signed:0;
field:unsigned long func; offset:16; size:8; signed:0;
field:int depth; offset:24; size:4; signed:1;But the actual alignment is:
field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:unsigned char common_migrate_disable; offset:8; size:1; signed:0; field:unsigned char common_preempt_lazy_count; offset:9; size:1; signed:0; field:unsigned long func; offset:12; size:8; signed:0; field:int depth; offset:20; size:4; signed:1;
--- kernel/trace/trace.h | 3 +++ kernel/trace/trace_entries.h | 14 +++++++------- kernel/trace/trace_export.c | 16 ++++++++++++++++ 3 files changed, 26 insertions(+), 7 deletions(-)
kernel/trace/trace.h +3 -0
@@ -61,6 +61,9 @@ enum trace_type {#undef __field_desc#define __field_desc (type, container, item) +#undef __field_packed +#define __field_packed (type, container, item) +#undef __array#define __array (type, item, size) type item[size];
kernel/trace/trace_entries.h +7 -7
@@ -78,8 +78,8 @@ FTRACE_ENTRY_PACKED(funcgraph_entry, ftr F_STRUCT( __field_struct( struct ftrace_graph_ent, graph_ent ) - __field_desc( unsigned long, graph_ent, func ) - __field_desc( int, graph_ent, depth ) + __field_packed( unsigned long, graph_ent, func ) + __field_packed( int, graph_ent, depth ) ), F_printk("--> %ps (%d)", (void *)__entry->func, __entry->depth)
@@ -92,11 +92,11 @@ FTRACE_ENTRY_PACKED(funcgraph_exit, ftra F_STRUCT( __field_struct( struct ftrace_graph_ret, ret ) - __field_desc( unsigned long, ret, func ) - __field_desc( unsigned long, ret, overrun ) - __field_desc( unsigned long long, ret, calltime) - __field_desc( unsigned long long, ret, rettime ) - __field_desc( int, ret, depth ) + __field_packed( unsigned long, ret, func ) + __field_packed( unsigned long, ret, overrun ) + __field_packed( unsigned long long, ret, calltime) + __field_packed( unsigned long long, ret, rettime ) + __field_packed( int, ret, depth ) ), F_printk("<-- %ps (%d) (start: %llx end: %llx) over: %d",
kernel/trace/trace_export.c +16 -0
@@ -45,6 +45,9 @@ static int ftrace_event_register(struct#undef __field_desc#define __field_desc (type, container, item) type item; +#undef __field_packed +#define __field_packed (type, container, item) type item; +#undef __array#define __array (type, item, size) type item[size];
@@ -85,6 +88,13 @@ static void __always_unused ____ftrace_c .size = sizeof(_type), .align = __alignof__(_type), \ is_signed_type(_type), .filter_type = _filter_type }, + +#undef __field_ext_packed +#define __field_ext_packed (_type, _item, _filter_type) { \ + .type = #_type, .name = #_item, \ + .size = sizeof(_type), .align = 1, \ + is_signed_type(_type), .filter_type = _filter_type }, +#undef __field#define __field (_type, _item) __field_ext(_type, _item, FILTER_OTHER)
@@ -94,6 +104,9 @@ static void __always_unused ____ftrace_c#undef __field_desc#define __field_desc (_type, _container, _item) __field_ext(_type, _item, FILTER_OTHER) +#undef __field_packed +#define __field_packed (_type, _container, _item) __field_ext_packed(_type, _item, FILTER_OTHER) +#undef __array#define __array (_type, _item, _len) { \ .type = #_type"["__stringify(_len)"]", .name = #_item, \
@@ -129,6 +142,9 @@ static struct trace_event_fields ftrace_#undef __field_desc#define __field_desc (type, container, item) +#undef __field_packed +#define __field_packed (type, container, item) +#undef __array#define __array (type, item, len)
Greg Kroah-Hartman
maintainerPATCH 463/477 tracing/probe: Fix memleak in fetch_op_data operations
In reply to Greg Kroah-HartmanFrom: Vamshi K Sthambamkadi <[email protected]>
commit 3aa8fdc37d16735e8891035becf25b3857d3efe0 upstream.
kmemleak report:
[<57dcc2ca>] __kmalloc_track_caller+0x139/0x2b0
[<f1c45d0f>] kstrndup+0x37/0x80
[<f9761eb0>] parse_probe_arg.isra.7+0x3cc/0x630
[<055bf2ba>] traceprobe_parse_probe_arg+0x2f5/0x810
[<655a7766>] trace_kprobe_create+0x2ca/0x950
[<4fc6a02a>] create_or_delete_trace_kprobe+0xf/0x30
[<6d1c8a52>] trace_run_command+0x67/0x80
[<be812cc0>] trace_parse_run_command+0xa7/0x140
[<aecfe401>] probes_write+0x10/0x20
[<2027641c>] __vfs_write+0x30/0x1e0
[<6a4aeee1>] vfs_write+0x96/0x1b0
[<3517fb7d>] ksys_write+0x53/0xc0
[<dad91db7>] __ia32_sys_write+0x15/0x20
[<da347f64>] do_syscall_32_irqs_on+0x3d/0x260
[<fd0b7e7d>] do_fast_syscall_32+0x39/0xb0
[<ea5ae810>] entry_SYSENTER_32+0xaf/0x102Post parse_probe_arg(), the FETCH_OP_DATA operation type is overwritten to FETCH_OP_ST_STRING, as a result memory is never freed since traceprobe_free_probe_arg() iterates only over SYMBOL and DATA op types
Setup fetch string operation correctly after fetch_op_data operation.
--- kernel/trace/trace_probe.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/trace_probe.c +2 -2
@@ -639,8 +639,8 @@ static int traceprobe_parse_probe_arg_bo ret = -EINVAL ; goto fail; } -if ((code->op ==FETCH_OP_IMM || code->op ==FETCH_OP_COMM ) || - parg->count) { +if ((code->op ==FETCH_OP_IMM || code->op ==FETCH_OP_COMM || + code->op ==FETCH_OP_DATA ) || parg->count) {/* * IMM, DATA and COMM is pointing actual address, those * must be kept, and if parg->count != 0, this is an
Greg Kroah-Hartman
maintainerPATCH 464/477 proc/bootconfig: Fix to use correct quotes for value
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
commit 4e264ffd953463cd14c0720eaa9315ac052f5973 upstream.
Fix /proc/bootconfig to select double or single quotes corrctly according to the value.
If a bootconfig value includes a double quote character, we must use single-quotes to quote that value.
This modifies if() condition and blocks for avoiding double-quote in value check in 2 places. Anyway, since xbc_array_for_each_value() can handle the array which has a single node correctly.
Thus,
if (vnode && xbc_node_is_array(vnode)) {
xbc_array_for_each_value(vnode) /* vnode->next != NULL */
...
} else { snprintf(val); /* val is an empty string if !vnode */
}
is equivalent to
if (vnode) {
xbc_array_for_each_value(vnode) /* vnode->next can be NULL */
...
} else { snprintf(""); /* value is always empty */
}
--- fs/proc/bootconfig.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
fs/proc/bootconfig.c +10 -5
@@ -26,8 +26,9 @@ static int boot_config_proc_show(structstatic int __init copy_xbc_key_value_list (char *dst,size_t size) {struct xbc_node *leaf, *vnode; -const char *val;char *key, *end = dst + size; +const char *val; +char q;int ret =0 ; key =kzalloc (XBC_KEYLEN_MAX ,GFP_KERNEL );
@@ -41,16 +42,20 @@ static int __init copy_xbc_key_value_lisbreak ; dst += ret; vnode =xbc_node_get_child (leaf); -if (vnode &&xbc_node_is_array (vnode)) { +if (vnode) {xbc_array_for_each_value (vnode, val) { - ret =snprintf (dst,rest (dst, end),"\"%s\"%s" , - val, vnode->next ?", " :"\n" ); +if (strchr (val,'"' )) + q ='\'' ; +else + q ='"' ; + ret =snprintf (dst,rest (dst, end),"%c%s%c%s" , + q, val, q, vnode->next ?", " :"\n" );if (ret <0 ) goto out; dst += ret; } }else { - ret =snprintf (dst,rest (dst, end),"\"%s\"\n" , val); + ret =snprintf (dst,rest (dst, end),"\"\"\n" );if (ret <0 )break ; dst += ret;
Greg Kroah-Hartman
maintainerPATCH 465/477 tools/bootconfig: Fix to use correct quotes for value
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
commit 272da3279df191f028fd63d1683e5ecd56fcb13b upstream.
Fix bootconfig tool to select double or single quotes correctly according to the value.
If a bootconfig value includes a double quote character, we must use single-quotes to quote that value.
--- tools/bootconfig/main.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
tools/bootconfig/main.c +8 -6
@@ -14,13 +14,18 @@#include <linux/kernel.h> #include <linux/bootconfig.h> -static int xbc_show_array (struct xbc_node *node) +static int xbc_show_value (struct xbc_node *node) {const char *val; +char q;int i =0 ;xbc_array_for_each_value (node, val) { -printf ("\"%s\"%s" , val, node->next ?", " :";\n" ); +if (strchr (val,'"' )) + q ='\'' ; +else + q ='"' ; +printf ("%c%s%c%s" , q, val, q, node->next ?", " :";\n" ); i++; }return i;
@@ -48,10 +53,7 @@ static void xbc_show_compact_tree(void)continue ; }else if (cnode &&xbc_node_is_value (cnode)) {printf ("%s = " ,xbc_node_get_data (node)); -if (cnode->next) -xbc_show_array (cnode); -else -printf ("\"%s\";\n" ,xbc_node_get_data (cnode)); +xbc_show_value (cnode); }else {printf ("%s;\n" ,xbc_node_get_data (node)); }
Greg Kroah-Hartman
maintainerPATCH 466/477 tools/bootconfig: Fix to return 0 if succeeded to show the bootconfig
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
commit f91cb5b7476a603068eae31e5b2cc170dd2b9b1b upstream.
Fix bootconfig to return 0 if succeeded to show the bootconfig in initrd. Without this fix, "bootconfig INITRD" command returns !0 even if the command succeeded to show the bootconfig.
--- tools/bootconfig/main.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
tools/bootconfig/main.c +6 -4
@@ -207,11 +207,13 @@ int show_xbc(const char *path) } ret =load_xbc_from_initrd (fd, &buf); -if (ret <0 ) +if (ret <0 ) {pr_err ("Failed to load a boot config from initrd: %d\n" , ret); -else -xbc_show_compact_tree (); - + goto out; + } +xbc_show_compact_tree (); + ret =0 ; +out:close (fd);free (buf);
Greg Kroah-Hartman
maintainerPATCH 467/477 sample-trace-array: Remove trace_array sample-instance
In reply to Greg Kroah-HartmanFrom: Kefeng Wang <[email protected]>
commit 9fbc01cdba66e988122ccdc6094cfd85d9587769 upstream.
Remove trace_array 'sample-instance' if kthread_run fails in sample_trace_array_init().
--- samples/ftrace/sample-trace-array.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
samples/ftrace/sample-trace-array.c +5 -1
@@ -107,8 +107,12 @@ static int __init sample_trace_array_initrace_printk_init_buffers (); simple_tsk =kthread_run (simple_thread,NULL ,"sample-instance" ); -if (IS_ERR (simple_tsk)) +if (IS_ERR (simple_tsk)) { +trace_array_put (tr); +trace_array_destroy (tr);return -1 ; + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 468/477 sample-trace-array: Fix sleeping function called from invalid context
In reply to Greg Kroah-HartmanFrom: Kefeng Wang <[email protected]>
commit e9b7b1c0c103a623be1a65c39f98719803440871 upstream.
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:935
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/5
1 lock held by swapper/5/0:
#0: ffff80001002bd90 (samples/ftrace/sample-trace-array.c:38){+.-.}-{0:0}, at: call_timer_fn+0x8/0x3e0
CPU: 5 PID: 0 Comm: swapper/5 Not tainted 5.7.0+ #8
Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015
Call trace:
dump_backtrace+0x0/0x1a0
show_stack+0x20/0x30
dump_stack+0xe4/0x150
___might_sleep+0x160/0x200
__might_sleep+0x58/0x90
__mutex_lock+0x64/0x948
mutex_lock_nested+0x3c/0x58
__ftrace_set_clr_event+0x44/0x88
trace_array_set_clr_event+0x24/0x38
mytimer_handler+0x34/0x40 [sample_trace_array]mutex_lock() will be called in interrupt context, using workqueue to fix it.
--- samples/ftrace/sample-trace-array.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
samples/ftrace/sample-trace-array.c +13 -5
@@ -6,6 +6,7 @@#include <linux/timer.h> #include <linux/err.h> #include <linux/jiffies.h> +#include <linux/workqueue.h> /* * Any file that uses trace points, must include the header.
@@ -20,6 +21,16 @@ struct trace_array *tr;static void mytimer_handler (struct timer_list *unused);static struct task_struct *simple_tsk; +static void trace_work_fn (struct work_struct *work) +{ +/* +* Disable tracing for event "sample_event". +*/ +trace_array_set_clr_event (tr,"sample-subsystem" ,"sample_event" , + false); +} +static DECLARE_WORK(trace_work, trace_work_fn); +/* * mytimer: Timer setup to disable tracing for event "sample_event". This * timer is only for the purposes of the sample module to demonstrate access of
@@ -29,11 +40,7 @@ static DEFINE_TIMER(mytimer, mytimer_hanstatic void mytimer_handler (struct timer_list *unused) { -/* -* Disable tracing for event "sample_event". -*/ -trace_array_set_clr_event (tr,"sample-subsystem" ,"sample_event" , - false); +schedule_work (&trace_work); }static void simple_thread_func (int count)
@@ -76,6 +83,7 @@ static int simple_thread(void *arg)simple_thread_func (count++);del_timer (&mytimer); +cancel_work_sync (&trace_work);/* * trace_array_put() decrements the reference counter associated with
Greg Kroah-Hartman
maintainerPATCH 469/477 netfilter: nft_set_rbtree: Dont account for expired elements on insertion
In reply to Greg Kroah-HartmanFrom: Stefano Brivio <[email protected]>
commit 33d077996a87175b155fe88030e8fec7ca76327e upstream.
While checking the validity of insertion in __nft_rbtree_insert(), we currently ignore conflicting elements and intervals only if they are not active within the next generation.
However, if we consider expired elements and intervals as potentially conflicting and overlapping, we'll return error for entries that should be added instead. This is particularly visible with garbage collection intervals that are comparable with the element timeout itself, as reported by Mike Dillinger.
Other than the simple issue of denying insertion of valid entries, this might also result in insertion of a single element (opening or closing) out of a given interval. With single entries (that are inserted as intervals of size 1), this leads in turn to the creation of new intervals. For example:
# nft add element t s { 192.0.2.1 }
# nft list ruleset
[...]
elements = { 192.0.2.1-255.255.255.255 }Always ignore expired elements active in the next generation, while checking for conflicts.
It might be more convenient to introduce a new macro that covers both inactive and expired items, as this type of check also appears quite frequently in other set back-ends. This is however beyond the scope of this fix and can be deferred to a separate patch.
Other than the overlap detection cases introduced by commit 7c84d41416d8 ("netfilter: nft_set_rbtree: Detect partial overlaps on insertion"), we also have to cover the original conflict check dealing with conflicts between two intervals of size 1, which was introduced before support for timeout was introduced. This won't return an error to the user as -EEXIST is masked by nft if NLM_F_EXCL is not given, but would result in a silent failure adding the entry.
--- net/netfilter/nft_set_rbtree.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
net/netfilter/nft_set_rbtree.c +14 -7
@@ -271,12 +271,14 @@ static int __nft_rbtree_insert(const strif (nft_rbtree_interval_start (new)) {if (nft_rbtree_interval_end (rbe) && -nft_set_elem_active (&rbe->ext, genmask)) +nft_set_elem_active (&rbe->ext, genmask) && + !nft_set_elem_expired (&rbe->ext)) overlap = false; }else { overlap =nft_rbtree_interval_end (rbe) &&nft_set_elem_active (&rbe->ext, - genmask); + genmask) && + !nft_set_elem_expired (&rbe->ext); } }else if (d >0 ) { p = &parent->rb_right;
@@ -284,9 +286,11 @@ static int __nft_rbtree_insert(const strif (nft_rbtree_interval_end (new)) { overlap =nft_rbtree_interval_end (rbe) &&nft_set_elem_active (&rbe->ext, - genmask); + genmask) && + !nft_set_elem_expired (&rbe->ext); }else if (nft_rbtree_interval_end (rbe) && -nft_set_elem_active (&rbe->ext, genmask)) { +nft_set_elem_active (&rbe->ext, genmask) && + !nft_set_elem_expired (&rbe->ext)) { overlap = true; } }else {
@@ -294,15 +298,18 @@ static int __nft_rbtree_insert(const str nft_rbtree_interval_start(new)) { p = &parent->rb_left; -if (nft_set_elem_active (&rbe->ext, genmask)) +if (nft_set_elem_active (&rbe->ext, genmask) && + !nft_set_elem_expired (&rbe->ext)) overlap = false; } else if (nft_rbtree_interval_start(rbe) &&nft_rbtree_interval_end (new )) { p = &parent->rb_right; -if (nft_set_elem_active (&rbe->ext, genmask)) +if (nft_set_elem_active (&rbe->ext, genmask) && + !nft_set_elem_expired (&rbe->ext)) overlap = false; - } else if (nft_set_elem_active(&rbe->ext, genmask)) { + } else if (nft_set_elem_active(&rbe->ext, genmask) && + !nft_set_elem_expired(&rbe->ext)) { *ext = &rbe->ext;return -EEXIST ; } else {
Greg Kroah-Hartman
maintainerPATCH 470/477 netfilter: nft_set_pipapo: Disable preemption before getting per-CPU pointer
In reply to Greg Kroah-HartmanFrom: Stefano Brivio <[email protected]>
commit c3829285b2e6a0d5461078d7f6cbb2c2b4bf8c4e upstream.
The lkp kernel test robot reports, with CONFIG_DEBUG_PREEMPT enabled:
[ 165.316525] BUG: using smp_processor_id() in preemptible [00000000] code: nft/6247 [ 165.319547] caller is nft_pipapo_insert+0x464/0x610 [nf_tables] [ 165.321846] CPU: 1 PID: 6247 Comm: nft Not tainted 5.6.0-rc5-01595-ge32a4dc6512ce3 #1 [ 165.332128] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 165.334892] Call Trace: [ 165.336435] dump_stack+0x8f/0xcb [ 165.338128] debug_smp_processor_id+0xb2/0xc0 [ 165.340117] nft_pipapo_insert+0x464/0x610 [nf_tables] [ 165.342290] ? nft_trans_alloc_gfp+0x1c/0x60 [nf_tables] [ 165.344420] ? rcu_read_lock_sched_held+0x52/0x80 [ 165.346460] ? nft_trans_alloc_gfp+0x1c/0x60 [nf_tables] [ 165.348543] ? __mmu_interval_notifier_insert+0xa0/0xf0 [ 165.350629] nft_add_set_elem+0x5ff/0xa90 [nf_tables] [ 165.352699] ? __lock_acquire+0x241/0x1400 [ 165.354573] ? __lock_acquire+0x241/0x1400 [ 165.356399] ? reacquire_held_locks+0x12f/0x200 [ 165.358384] ? nf_tables_valid_genid+0x1f/0x40 [nf_tables] [ 165.360502] ? nla_strcmp+0x10/0x50 [ 165.362199] ? nft_table_lookup+0x4f/0xa0 [nf_tables] [ 165.364217] ? nla_strcmp+0x10/0x50 [ 165.365891] ? nf_tables_newsetelem+0xd5/0x150 [nf_tables] [ 165.367997] nf_tables_newsetelem+0xd5/0x150 [nf_tables] [ 165.370083] nfnetlink_rcv_batch+0x4fd/0x790 [nfnetlink] [ 165.372205] ? __lock_acquire+0x241/0x1400 [ 165.374058] ? __nla_validate_parse+0x57/0x8a0 [ 165.375989] ? cap_inode_getsecurity+0x230/0x230 [ 165.377954] ? security_capable+0x38/0x50 [ 165.379795] nfnetlink_rcv+0x11d/0x140 [nfnetlink] [ 165.381779] netlink_unicast+0x1b2/0x280 [ 165.383612] netlink_sendmsg+0x351/0x470 [ 165.385439] sock_sendmsg+0x5b/0x60 [ 165.387133] ____sys_sendmsg+0x200/0x280 [ 165.388871] ? copy_msghdr_from_user+0xd9/0x160 [ 165.390805] ___sys_sendmsg+0x88/0xd0 [ 165.392524] ? __might_fault+0x3e/0x90 [ 165.394273] ? sock_getsockopt+0x3d5/0xbb0 [ 165.396021] ? __handle_mm_fault+0x545/0x6a0 [ 165.397822] ? find_held_lock+0x2d/0x90 [ 165.399593] ? __sys_sendmsg+0x5e/0xa0 [ 165.401338] __sys_sendmsg+0x5e/0xa0 [ 165.402979] do_syscall_64+0x60/0x280 [ 165.404680] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 165.406621] RIP: 0033:0x7ff1fa46e783 [ 165.408299] Code: c7 c0 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 89 54 24 1c 48 [ 165.414163] RSP: 002b:00007ffedf59ea78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 165.416804] RAX: ffffffffffffffda RBX: 00007ffedf59fc60 RCX: 00007ff1fa46e783 [ 165.419419] RDX: 0000000000000000 RSI: 00007ffedf59fb10 RDI: 0000000000000005 [ 165.421886] RBP: 00007ffedf59fc10 R08: 00007ffedf59ea54 R09: 0000000000000001 [ 165.424445] R10: 00007ff1fa630c6c R11: 0000000000000246 R12: 0000000000020000 [ 165.426954] R13: 0000000000000280 R14: 0000000000000005 R15: 00007ffedf59ea90
Disable preemption before accessing the lookup scratch area in nft_pipapo_insert().
--- net/netfilter/nft_set_pipapo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/netfilter/nft_set_pipapo.c +5 -1
@@ -1242,7 +1242,9 @@ static int nft_pipapo_insert(const struc end +=NFT_PIPAPO_GROUPS_PADDED_SIZE (f); } -if (!*this_cpu_ptr (m->scratch) || bsize_max > m->bsize_max) { +if (!*get_cpu_ptr (m->scratch) || bsize_max > m->bsize_max) { +put_cpu_ptr (m->scratch); + err =pipapo_realloc_scratch (m, bsize_max);if (err)return err;
@@ -1250,6 +1252,8 @@ static int nft_pipapo_insert(const structhis_cpu_write (nft_pipapo_scratch_index, false); m->bsize_max = bsize_max; + }else { +put_cpu_ptr (m->scratch); } *ext2 = &e->ext;
Greg Kroah-Hartman
maintainerPATCH 471/477 kprobes: Fix to protect kick_kprobe_optimizer() by kprobe_mutex
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
commit 1a0aa991a6274161c95a844c58cfb801d681eb59 upstream.
In kprobe_optimizer() kick_kprobe_optimizer() is called without kprobe_mutex, but this can race with other caller which is protected by kprobe_mutex.
To fix that, expand kprobe_mutex protected area to protect kick_kprobe_optimizer() call.
--- kernel/kprobes.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/kprobes.c +2 -1
@@ -586,11 +586,12 @@ static void kprobe_optimizer(struct workmutex_unlock (&module_mutex);mutex_unlock (&text_mutex);cpus_read_unlock (); -mutex_unlock (&kprobe_mutex);/* Step 5: Kick optimizer again if needed */ if (!list_empty (&optimizing_list) || !list_empty (&unoptimizing_list))kick_kprobe_optimizer (); + +mutex_unlock (&kprobe_mutex); }/* Wait for completing optimization and unoptimization */
Greg Kroah-Hartman
maintainerPATCH 472/477 kretprobe: Prevent triggering kretprobe from within kprobe_flush_task
In reply to Greg Kroah-HartmanFrom: Jiri Olsa <[email protected]>
commit 9b38cc704e844e41d9cf74e647bff1d249512cb3 upstream.
Ziqian reported lockup when adding retprobe on _raw_spin_lock_irqsave. My test was also able to trigger lockdep output:
============================================
WARNING: possible recursive locking detected
5.6.0-rc6+ #6 Not tainted
--------------------------------------------
sched-messaging/2767 is trying to acquire lock:
ffffffff9a492798 (&(kretprobe_table_locks[i].lock)){-.-.}, at: kretprobe_hash_lock+0x52/0xa0
but task is already holding lock:
ffffffff9a491a18 (&(kretprobe_table_locks[i].lock)){-.-.}, at: kretprobe_trampoline+0x0/0x50
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&(kretprobe_table_locks[i].lock));
lock(&(kretprobe_table_locks[i].lock));
*** DEADLOCK ***
May be due to missing lock nesting notation
1 lock held by sched-messaging/2767:
#0: ffffffff9a491a18 (&(kretprobe_table_locks[i].lock)){-.-.}, at: kretprobe_trampoline+0x0/0x50
stack backtrace: CPU: 3 PID: 2767 Comm: sched-messaging Not tainted 5.6.0-rc6+ #6 Call Trace: dump_stack+0x96/0xe0 __lock_acquire.cold.57+0x173/0x2b7 ? native_queued_spin_lock_slowpath+0x42b/0x9e0 ? lockdep_hardirqs_on+0x590/0x590 ? __lock_acquire+0xf63/0x4030 lock_acquire+0x15a/0x3d0 ? kretprobe_hash_lock+0x52/0xa0 _raw_spin_lock_irqsave+0x36/0x70 ? kretprobe_hash_lock+0x52/0xa0 kretprobe_hash_lock+0x52/0xa0 trampoline_handler+0xf8/0x940 ? kprobe_fault_handler+0x380/0x380 ? find_held_lock+0x3a/0x1c0 kretprobe_trampoline+0x25/0x50 ? lock_acquired+0x392/0xbc0 ? _raw_spin_lock_irqsave+0x50/0x70 ? __get_valid_kprobe+0x1f0/0x1f0 ? _raw_spin_unlock_irqrestore+0x3b/0x40 ? finish_task_switch+0x4b9/0x6d0 ? __switch_to_asm+0x34/0x70 ? __switch_to_asm+0x40/0x70
The code within the kretprobe handler checks for probe reentrancy, so we won't trigger any _raw_spin_lock_irqsave probe in there.
The problem is in outside kprobe_flush_task, where we call:
kprobe_flush_task
kretprobe_table_lock
raw_spin_lock_irqsave
_raw_spin_lock_irqsave
where _raw_spin_lock_irqsave triggers the kretprobe and installs kretprobe_trampoline handler on _raw_spin_lock_irqsave return.
The kretprobe_trampoline handler is then executed with already locked kretprobe_table_locks, and first thing it does is to lock kretprobe_table_locks ;-) the whole lockup path like:
kprobe_flush_task
kretprobe_table_lock
raw_spin_lock_irqsave
_raw_spin_lock_irqsave ---> probe triggered, kretprobe_trampoline installed
---> kretprobe_table_locks locked
kretprobe_trampoline
trampoline_handler
kretprobe_hash_lock(current, &head, &flags); <--- deadlockAdding kprobe_busy_begin/end helpers that mark code with fake probe installed to prevent triggering of another kprobe within this code.
Using these helpers in kprobe_flush_task, so the probe recursion protection check is hit and the probe is never set to prevent above lockup.
--- arch/x86/kernel/kprobes/core.c | 16 +++------------- include/linux/kprobes.h | 4 ++++ kernel/kprobes.c | 24 ++++++++++++++++++++++++ 3 files changed, 31 insertions(+), 13 deletions(-)
arch/x86/kernel/kprobes/core.c +3 -13
@@ -753,16 +753,11 @@ asm(NOKPROBE_SYMBOL (kretprobe_trampoline);STACK_FRAME_NON_STANDARD (kretprobe_trampoline); -static struct kprobe kretprobe_kprobe = { - .addr = (void *)kretprobe_trampoline, -}; -/* * Called from kretprobe_trampoline */ __used __visible void *trampoline_handler(struct pt_regs *regs) { -struct kprobe_ctlblk *kcb;struct kretprobe_instance *ri =NULL ;struct hlist_head *head, empty_rp;struct hlist_node *tmp;
@@ -772,16 +767,12 @@ __used __visible void *trampoline_handlevoid *frame_pointer;bool skipped = false; -preempt_disable (); -/* * Set a dummy kprobe for avoiding kretprobe recursion. * Since kretprobe never run in kprobe handler, kprobe must not * be running at this point. */ - kcb =get_kprobe_ctlblk (); -__this_cpu_write (current_kprobe, &kretprobe_kprobe); - kcb->kprobe_status =KPROBE_HIT_ACTIVE ; +kprobe_busy_begin ();INIT_HLIST_HEAD (&empty_rp);kretprobe_hash_lock (current, &head, &flags);
@@ -857,7 +848,7 @@ __used __visible void *trampoline_handle__this_cpu_write (current_kprobe, &ri->rp->kp); ri->ret_addr = correct_ret_addr; ri->rp->handler (ri, regs); -__this_cpu_write (current_kprobe, &kretprobe_kprobe); +__this_cpu_write (current_kprobe, &kprobe_busy); }recycle_rp_inst (ri, &empty_rp);
@@ -873,8 +864,7 @@ __used __visible void *trampoline_handlekretprobe_hash_unlock (current, &flags); -__this_cpu_write (current_kprobe,NULL ); -preempt_enable (); +kprobe_busy_end ();hlist_for_each_entry_safe (ri, tmp, &empty_rp, hlist) {hlist_del (&ri->hlist);
include/linux/kprobes.h +4 -0
@@ -350,6 +350,10 @@ static inline struct kprobe_ctlblk *get_return this_cpu_ptr (&kprobe_ctlblk); } +extern struct kprobe kprobe_busy; +void kprobe_busy_begin (void ); +void kprobe_busy_end (void ); +kprobe_opcode_t *kprobe_lookup_name (const char *name,unsigned int offset);int register_kprobe (struct kprobe *p);void unregister_kprobe (struct kprobe *p);
kernel/kprobes.c +24 -0
@@ -1237,6 +1237,26 @@ __releases(hlist_lock) }NOKPROBE_SYMBOL (kretprobe_table_unlock); +struct kprobe kprobe_busy = { + .addr = (void *) get_kprobe, +}; + +void kprobe_busy_begin (void ) +{ +struct kprobe_ctlblk *kcb; + +preempt_disable (); +__this_cpu_write (current_kprobe, &kprobe_busy); + kcb =get_kprobe_ctlblk (); + kcb->kprobe_status =KPROBE_HIT_ACTIVE ; +} + +void kprobe_busy_end (void ) +{ +__this_cpu_write (current_kprobe,NULL ); +preempt_enable (); +} +/* * This function is called from finish_task_switch when task tk becomes dead, * so that we can recycle any function-return probe instances associated
@@ -1254,6 +1274,8 @@ void kprobe_flush_task(struct task_struc/* Early boot. kretprobe_table_locks not yet initialized. */ return ; +kprobe_busy_begin (); +INIT_HLIST_HEAD (&empty_rp); hash =hash_ptr (tk,KPROBE_HASH_BITS ); head = &kretprobe_inst_table[hash];
@@ -1267,6 +1289,8 @@ void kprobe_flush_task(struct task_struchlist_del (&ri->hlist);kfree (ri); } + +kprobe_busy_end (); }NOKPROBE_SYMBOL (kprobe_flush_task);
Greg Kroah-Hartman
maintainerPATCH 473/477 powerpc/64s: Fix KVM interrupt using wrong save area
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
commit 0bdcfa182506526fbe4e088ff9ca86a31b81828d upstream.
The CTR register reload in the KVM interrupt path used the wrong save area for SLB (and NMI) interrupts.
--- arch/powerpc/kernel/exceptions-64s.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/kernel/exceptions-64s.S +2 -2
@@ -270,7 +270,7 @@ BEGIN_FTR_SECTION END_FTR_SECTION_IFSET(CPU_FTR_CFAR) .endif - ld r10,PACA_EXGEN+EX_CTR(r13) + ld r10,IAREA+EX_CTR(r13) mtctr r10 BEGIN_FTR_SECTION ld r10,IAREA+EX_PPR(r13)
@@ -298,7 +298,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR) .if IKVM_SKIP 89: mtocrf 0x80,r9 - ld r10,PACA_EXGEN+EX_CTR(r13) + ld r10,IAREA+EX_CTR(r13) mtctr r10 ld r9,IAREA+EX_R9(r13) ld r10,IAREA+EX_R10(r13)
Greg Kroah-Hartman
maintainerPATCH 474/477 e1000e: Do not wake up the system via WOL if device wakeup is disabled
In reply to Greg Kroah-HartmanFrom: Chen Yu <[email protected]>
commit 6bf6be1127f7e6d4bf39f84d56854e944d045d74 upstream.
Currently the system will be woken up via WOL(Wake On LAN) even if the device wakeup ability has been disabled via sysfs:
cat /sys/devices/pci0000:00/0000:00:1f.6/power/wakeup disabled
The system should not be woken up if the user has explicitly disabled the wake up ability for this device.
This patch clears the WOL ability of this network device if the user has disabled the wake up ability in sysfs.
--- drivers/net/ethernet/intel/e1000e/netdev.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/e1000e/netdev.c +10 -4
@@ -6518,11 +6518,17 @@ static int __e1000_shutdown(struct pci_dstruct net_device *netdev =pci_get_drvdata (pdev);struct e1000_adapter *adapter =netdev_priv (netdev);struct e1000_hw *hw = &adapter->hw; -u32 ctrl, ctrl_ext, rctl, status; -/* Runtime suspend should only enable wakeup for link changes */ -u32 wufc = runtime ?E1000_WUFC_LNKC : adapter->wol; +u32 ctrl, ctrl_ext, rctl, status, wufc;int retval =0 ; +/* Runtime suspend should only enable wakeup for link changes */ +if (runtime) + wufc =E1000_WUFC_LNKC ; +else if (device_may_wakeup (&pdev->dev)) + wufc = adapter->wol; +else + wufc =0 ; + status =er32 (STATUS );if (status &E1000_STATUS_LU ) wufc &= ~E1000_WUFC_LNKC ;
@@ -6579,7 +6585,7 @@ static int __e1000_shutdown(struct pci_dif (adapter->hw.phy.type == e1000_phy_igp_3) {e1000e_igp3_phy_powerdown_workaround_ich8lan (&adapter->hw); }else if (hw->mac.type >= e1000_pch_lpt) { -if (!(wufc & (E1000_WUFC_EX |E1000_WUFC_MC |E1000_WUFC_BC ))) +if (wufc && !(wufc & (E1000_WUFC_EX |E1000_WUFC_MC |E1000_WUFC_BC )))/* ULP does not support wake from unicast, multicast * or broadcast. */
Greg Kroah-Hartman
maintainerPATCH 475/477 net: octeon: mgmt: Repair filling of RX ring
In reply to Greg Kroah-HartmanFrom: Alexander Sverdlin <[email protected]>
commit 0c34bb598c510e070160029f34efeeb217000f8d upstream.
The removal of mips_swiotlb_ops exposed a problem in octeon_mgmt Ethernet driver. mips_swiotlb_ops had an mb() after most of the operations and the removal of the ops had broken the receive functionality of the driver. My code inspection has shown no other places except octeon_mgmt_rx_fill_ring() where an explicit barrier would be obviously missing. The latter function however has to make sure that "ringing the bell" doesn't happen before RX ring entry is really written.
The patch has been successfully tested on Octeon II.
--- drivers/net/ethernet/cavium/octeon/octeon_mgmt.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/cavium/octeon/octeon_mgmt.c +5 -0
@@ -234,6 +234,11 @@ static void octeon_mgmt_rx_fill_ring(str/* Put it in the ring. */ p->rx_ring[p->rx_next_fill] = re.d64; +/* Make sure there is no reorder of filling the ring and ringing +* the bell +*/ +wmb (); +dma_sync_single_for_device (p->dev, p->rx_ring_handle,ring_size_to_bytes (OCTEON_MGMT_RX_RING_SIZE ),DMA_BIDIRECTIONAL );
Greg Kroah-Hartman
maintainerPATCH 476/477 net: core: device_rename: Use rwsem instead of a seqcount
In reply to Greg Kroah-HartmanFrom: Ahmed S. Darwish <[email protected]>
commit 11d6011c2cf29f7c8181ebde6c8bc0c4d83adcd7 upstream.
Sequence counters write paths are critical sections that must never be preempted, and blocking, even for CONFIG_PREEMPTION=n, is not allowed.
Commit 5dbe7c178d3f ("net: fix kernel deadlock with interface rename and netdev name retrieval.") handled a deadlock, observed with CONFIG_PREEMPTION=n, where the devnet_rename seqcount read side was infinitely spinning: it got scheduled after the seqcount write side blocked inside its own critical section.
To fix that deadlock, among other issues, the commit added a cond_resched() inside the read side section. While this will get the non-preemptible kernel eventually unstuck, the seqcount reader is fully exhausting its slice just spinning -- until TIF_NEED_RESCHED is set.
The fix is also still broken: if the seqcount reader belongs to a real-time scheduling policy, it can spin forever and the kernel will livelock.
Disabling preemption over the seqcount write side critical section will not work: inside it are a number of GFP_KERNEL allocations and mutex locking through the drivers/base/ :: device_rename() call chain.
Quoted 1 line
From all the above, replace the seqcount with a rwsem.
--- net/core/dev.c | 40 ++++++++++++++++++---------------------- 1 file changed, 18 insertions(+), 22 deletions(-)
net/core/dev.c +18 -22
@@ -79,6 +79,7 @@#include <linux/sched.h> #include <linux/sched/mm.h> #include <linux/mutex.h> +#include <linux/rwsem.h> #include <linux/string.h> #include <linux/mm.h> #include <linux/socket.h>
@@ -194,7 +195,7 @@ static DEFINE_SPINLOCK(napi_hash_lock);static unsigned int napi_gen_id =NR_CPUS ; static DEFINE_READ_MOSTLY_HASHTABLE(napi_hash, 8); -static seqcount_t devnet_rename_seq; +static DECLARE_RWSEM (devnet_rename_sem);static inline void dev_base_seq_inc (struct net *net) {
@@ -930,33 +931,28 @@ EXPORT_SYMBOL(dev_get_by_napi_id);* @net: network namespace * @name: a pointer to the buffer where the name will be stored. * @ifindex: the ifindex of the interface to get the name from. -* -* The use of raw_seqcount_begin() and cond_resched() before -* retrying is required as we want to give the writers a chance -* to complete when CONFIG_PREEMPTION is not set. */ int netdev_get_name (struct net *net,char *name,int ifindex) {struct net_device *dev; -unsigned int seq; +int ret; -retry: - seq =raw_seqcount_begin (&devnet_rename_seq); +down_read (&devnet_rename_sem);rcu_read_lock (); + dev =dev_get_by_index_rcu (net, ifindex);if (!dev) { -rcu_read_unlock (); -return -ENODEV ; + ret = -ENODEV ; + goto out; }strcpy (name, dev->name); -rcu_read_unlock (); -if (read_seqcount_retry (&devnet_rename_seq, seq)) { -cond_resched (); - goto retry; - } -return 0 ; + ret =0 ; +out: +rcu_read_unlock (); +up_read (&devnet_rename_sem); +return ret; }/**
@@ -1228,10 +1224,10 @@ int dev_change_name(struct net_device *d likely(!(dev->priv_flags & IFF_LIVE_RENAME_OK)))return -EBUSY ; -write_seqcount_begin (&devnet_rename_seq); +down_write (&devnet_rename_sem);if (strncmp (newname, dev->name,IFNAMSIZ ) ==0 ) { -write_seqcount_end (&devnet_rename_seq); +up_write (&devnet_rename_sem);return 0 ; }
@@ -1239,7 +1235,7 @@ int dev_change_name(struct net_device *d err =dev_get_valid_name (net, dev, newname);if (err <0 ) { -write_seqcount_end (&devnet_rename_seq); +up_write (&devnet_rename_sem);return err; }
@@ -1254,11 +1250,11 @@ rollback:if (ret) {memcpy (dev->name, oldname,IFNAMSIZ ); dev->name_assign_type = old_assign_type; -write_seqcount_end (&devnet_rename_seq); +up_write (&devnet_rename_sem);return ret; } -write_seqcount_end (&devnet_rename_seq); +up_write (&devnet_rename_sem);netdev_adjacent_rename_links (dev, oldname);
@@ -1279,7 +1275,7 @@ rollback:/* err >= 0 after dev_alloc_name() or stores the first errno */ if (err >=0 ) { err = ret; -write_seqcount_begin (&devnet_rename_seq); +down_write (&devnet_rename_sem);memcpy (dev->name, oldname,IFNAMSIZ );memcpy (oldname, newname,IFNAMSIZ ); dev->name_assign_type = old_assign_type;
Greg Kroah-Hartman
maintainerPATCH 477/477 iommu/vt-d: Remove real DMA lookup in find_domain
In reply to Greg Kroah-HartmanFrom: Jon Derrick <[email protected]>
commit bba9cc2cf82840bd3c9b3f4f7edac2dc8329c241 upstream.
By removing the real DMA indirection in find_domain(), we can allow sub-devices of a real DMA device to have their own valid device_domain_info. The dmar lookup and context entry removal paths have been fixed to account for sub-devices.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=207575
--- drivers/iommu/intel-iommu.c | 3 --- 1 file changed, 3 deletions(-)
drivers/iommu/intel-iommu.c +0 -3
@@ -2518,9 +2518,6 @@ struct dmar_domain *find_domain(struct dif (unlikely (attach_deferred (dev) ||iommu_dummy (dev)))return NULL ; -if (dev_is_pci (dev)) - dev = &pci_real_dma_dev (to_pci_dev (dev))->dev; -/* No lock here, assumes no domain exit in normal case */ info = dev->archdata.iommu;if (likely (info))
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.7.6 release. There are 477 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 25 Jun 2020 19:52:30 +0000. Anything received after that time might be too late.
[ ... ]
Quoted 3 lines
Christophe JAILLET <[email protected]>
pinctrl: freescale: imx: Use 'devm_of_iomap()' to avoid a resource leak in case of error in 'imx_pinctrl_probe()'
This patch has since been reverted in the upstream kernel (commit 13f2d25b951f) and needs to be dropped.
Guenter
Greg Kroah-Hartman
maintainerQuoted 9 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.7.6 release. There are 477 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 25 Jun 2020 19:52:30 +0000. Anything received after that time might be too late.
Quoted 6 lines
[ ... ]
Quoted 3 lines
Christophe JAILLET <[email protected]>
pinctrl: freescale: imx: Use 'devm_of_iomap()' to avoid a resource leak in case of error in 'imx_pinctrl_probe()'This patch has since been reverted in the upstream kernel (commit
13f2d25b951f) and needs to be dropped.
Now dropped, thanks.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.7.6 release. There are 477 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 25 Jun 2020 19:52:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.7.6-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.7.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Greg Kroah-Hartman
maintainerQuoted 15 lines · Shuah Khan
Quoted 14 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.7.6 release. There are 477 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 25 Jun 2020 19:52:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.7.6-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.7.y
and the diffstat can be found below.
Quoted 6 lines
Quoted 4 lines
thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
Thanks for testing all of these and letting me know.
greg k-h