6.12.19-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 248/269 drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoyu Li <[email protected]>
commit 819cec1dc47cdeac8f5dd6ba81c1dbee2a68c3bb upstream.
In the "pmcmd_ioctl" function, three memory objects allocated by kmalloc are initialized by "hcall_get_cpu_state", which are then copied to user space. The initializer is indeed implemented in "acrn_hypercall2" (arch/x86/include/asm/acrn.h). There is a risk of information leakage due to uninitialized bytes.
--- drivers/virt/acrn/hsm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/virt/acrn/hsm.c +3 -3
@@ -49,7 +49,7 @@ static int pmcmd_ioctl(u64 cmd, void __uswitch (cmd &PMCMD_TYPE_MASK ) {case ACRN_PMCMD_GET_PX_CNT :case ACRN_PMCMD_GET_CX_CNT : - pm_info =kmalloc (sizeof (u64),GFP_KERNEL ); + pm_info =kzalloc (sizeof (u64),GFP_KERNEL );if (!pm_info)return -ENOMEM ;
@@ -64,7 +64,7 @@ static int pmcmd_ioctl(u64 cmd, void __ukfree (pm_info);break ;case ACRN_PMCMD_GET_PX_DATA : - px_data =kmalloc (sizeof (*px_data),GFP_KERNEL ); + px_data =kzalloc (sizeof (*px_data),GFP_KERNEL );if (!px_data)return -ENOMEM ;
@@ -79,7 +79,7 @@ static int pmcmd_ioctl(u64 cmd, void __ukfree (px_data);break ;case ACRN_PMCMD_GET_CX_DATA : - cx_data =kmalloc (sizeof (*cx_data),GFP_KERNEL ); + cx_data =kzalloc (sizeof (*cx_data),GFP_KERNEL );if (!cx_data)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 249/269 iio: filter: admv8818: Force initialization of SDO
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Winchenbach <[email protected]>
commit cc2c3540d9477a9931fb0fd851fcaeba524a5b35 upstream.
When a weak pull-up is present on the SDO line, regmap_update_bits fails to write both the SOFTRESET and SDOACTIVE bits because it incorrectly reads them as already set.
Since the soft reset disables the SDO line, performing a read-modify-write operation on ADI_SPI_CONFIG_A to enable the SDO line doesn't make sense. This change directly writes to the register instead of using regmap_update_bits.
--- drivers/iio/filter/admv8818.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
drivers/iio/filter/admv8818.c +4 -10
@@ -574,21 +574,15 @@ static int admv8818_init(struct admv8818struct spi_device *spi = st->spi;unsigned int chip_id; - ret =regmap_update_bits (st->regmap,ADMV8818_REG_SPI_CONFIG_A , -ADMV8818_SOFTRESET_N_MSK | -ADMV8818_SOFTRESET_MSK , -FIELD_PREP (ADMV8818_SOFTRESET_N_MSK ,1 ) | -FIELD_PREP (ADMV8818_SOFTRESET_MSK ,1 )); + ret =regmap_write (st->regmap,ADMV8818_REG_SPI_CONFIG_A , +ADMV8818_SOFTRESET_N_MSK |ADMV8818_SOFTRESET_MSK );if (ret) {dev_err (&spi->dev,"ADMV8818 Soft Reset failed.\n" );return ret; } - ret =regmap_update_bits (st->regmap,ADMV8818_REG_SPI_CONFIG_A , -ADMV8818_SDOACTIVE_N_MSK | -ADMV8818_SDOACTIVE_MSK , -FIELD_PREP (ADMV8818_SDOACTIVE_N_MSK ,1 ) | -FIELD_PREP (ADMV8818_SDOACTIVE_MSK ,1 )); + ret =regmap_write (st->regmap,ADMV8818_REG_SPI_CONFIG_A , +ADMV8818_SDOACTIVE_N_MSK |ADMV8818_SDOACTIVE_MSK );if (ret) {dev_err (&spi->dev,"ADMV8818 SDO Enable failed.\n" );return ret;
Greg Kroah-Hartman
maintainerPATCH 250/269 iio: light: apds9306: fix max_scale_nano values
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit a96d3e2beca0e51c8444d0a3b6b3ec484c4c5a8f upstream.
The two provided max_scale_nano values must be multiplied by 100 and 10 respectively to achieve nano units. According to the comments:
Max scale for apds0306 is 16.326432 → the fractional part is 0.326432, which is 326432000 in NANO. The current value is 3264320.
Max scale for apds0306-065 is 14.09721 → the fractional part is 0.09712, which is 97120000 in NANO. The current value is 9712000.
Update max_scale_nano initialization to use the right NANO fractional parts.
--- drivers/iio/light/apds9306.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/light/apds9306.c +2 -2
@@ -108,11 +108,11 @@ static const struct part_id_gts_multipli { .part_id = 0xB1, .max_scale_int = 16, - .max_scale_nano = 3264320, + .max_scale_nano = 326432000, }, { .part_id = 0xB3, .max_scale_int = 14, - .max_scale_nano = 9712000, + .max_scale_nano = 97120000, }, };
Greg Kroah-Hartman
maintainerPATCH 251/269 iio: dac: ad3552r: clear reset status flag
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Angelo Dureghello <[email protected]>
commit e17b9f20da7d2bc1f48878ab2230523b2512d965 upstream.
Clear reset status flag, to keep error status register clean after reset (ad3552r manual, rev B table 38).
Reset error flag was left to 1, so debugging registers, the "Error Status Register" was dirty (0x01). It is important to clear this bit, so if there is any reset event over normal working mode, it is possible to detect it.
--- drivers/iio/dac/ad3552r.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/iio/dac/ad3552r.c +6 -0
@@ -714,6 +714,12 @@ static int ad3552r_reset(struct ad3552r_return ret; } +/* Clear reset error flag, see ad3552r manual, rev B table 38. */ + ret =ad3552r_write_reg (dac,AD3552R_REG_ADDR_ERR_STATUS , +AD3552R_MASK_RESET_STATUS ); +if (ret) +return ret; + return ad3552r_update_reg_field(dac, addr_mask_map[AD3552R_ADDR_ASCENSION][0], addr_mask_map[AD3552R_ADDR_ASCENSION][1],
Greg Kroah-Hartman
maintainerPATCH 252/269 iio: adc: ad7192: fix channel select
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Burri <[email protected]>
commit 21d7241faf406e8aee3ce348451cc362d5db6a02 upstream.
Channel configuration doesn't work as expected.
For FIELD_PREP the bit mask is needed and not the bit number.
--- drivers/iio/adc/ad7192.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad7192.c +1 -1
@@ -1082,7 +1082,7 @@ static int ad7192_update_scan_mode(struc conf &= ~AD7192_CONF_CHAN_MASK ;for_each_set_bit (i, scan_mask,8 ) - conf |=FIELD_PREP (AD7192_CONF_CHAN_MASK , i); + conf |=FIELD_PREP (AD7192_CONF_CHAN_MASK ,BIT (i)); ret =ad_sd_write_reg (&st->sd,AD7192_REG_CONF ,3 , conf);if (ret <0 )
Greg Kroah-Hartman
maintainerPATCH 253/269 iio: adc: at91-sama5d2_adc: fix sama7g5 realbits value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayab Sayed <[email protected]>
commit aa5119c36d19639397d29ef305aa53a5ecd72b27 upstream.
The number of valid bits in SAMA7G5 ADC channel data register are 16. Hence changing the realbits value to 16
--- drivers/iio/adc/at91-sama5d2_adc.c | 68 +++++++++++++++++++++---------------- 1 file changed, 40 insertions(+), 28 deletions(-)
drivers/iio/adc/at91-sama5d2_adc.c +40 -28
@@ -329,7 +329,7 @@ static const struct at91_adc_reg_layout#define AT91_HWFIFO_MAX_SIZE_STR "128"#define AT91_HWFIFO_MAX_SIZE 128 -#define AT91_SAMA5D2_CHAN_SINGLE (index, num, addr) \ +#define AT91_SAMA_CHAN_SINGLE (index, num, addr, rbits) \ { \ .type = IIO_VOLTAGE, \ .channel = num, \
@@ -337,7 +337,7 @@ static const struct at91_adc_reg_layout .scan_index = index, \ .scan_type = { \ .sign = 'u', \ - .realbits = 14, \ + .realbits = rbits, \ .storagebits = 16, \ }, \ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \
@@ -350,7 +350,13 @@ static const struct at91_adc_reg_layout .indexed = 1, \ } -#define AT91_SAMA5D2_CHAN_DIFF (index, num, num2, addr) \ +#define AT91_SAMA5D2_CHAN_SINGLE (index, num, addr) \ + AT91_SAMA_CHAN_SINGLE(index, num, addr, 14) + +#define AT91_SAMA7G5_CHAN_SINGLE (index, num, addr) \ + AT91_SAMA_CHAN_SINGLE(index, num, addr, 16) + +#define AT91_SAMA_CHAN_DIFF (index, num, num2, addr, rbits) \ { \ .type = IIO_VOLTAGE, \ .differential = 1, \
@@ -360,7 +366,7 @@ static const struct at91_adc_reg_layout .scan_index = index, \ .scan_type = { \ .sign = 's', \ - .realbits = 14, \ + .realbits = rbits, \ .storagebits = 16, \ }, \ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \
@@ -373,6 +379,12 @@ static const struct at91_adc_reg_layout .indexed = 1, \ } +#define AT91_SAMA5D2_CHAN_DIFF (index, num, num2, addr) \ + AT91_SAMA_CHAN_DIFF(index, num, num2, addr, 14) + +#define AT91_SAMA7G5_CHAN_DIFF (index, num, num2, addr) \ + AT91_SAMA_CHAN_DIFF(index, num, num2, addr, 16) +#define AT91_SAMA5D2_CHAN_TOUCH (num, name, mod) \ { \ .type = IIO_POSITIONRELATIVE, \
@@ -666,30 +678,30 @@ static const struct iio_chan_spec at91_s };static const struct iio_chan_spec at91_sama7g5_adc_channels[] = { -AT91_SAMA5D2_CHAN_SINGLE (0 ,0 ,0x60 ), -AT91_SAMA5D2_CHAN_SINGLE (1 ,1 ,0x64 ), -AT91_SAMA5D2_CHAN_SINGLE (2 ,2 ,0x68 ), -AT91_SAMA5D2_CHAN_SINGLE (3 ,3 ,0x6c ), -AT91_SAMA5D2_CHAN_SINGLE (4 ,4 ,0x70 ), -AT91_SAMA5D2_CHAN_SINGLE (5 ,5 ,0x74 ), -AT91_SAMA5D2_CHAN_SINGLE (6 ,6 ,0x78 ), -AT91_SAMA5D2_CHAN_SINGLE (7 ,7 ,0x7c ), -AT91_SAMA5D2_CHAN_SINGLE (8 ,8 ,0x80 ), -AT91_SAMA5D2_CHAN_SINGLE (9 ,9 ,0x84 ), -AT91_SAMA5D2_CHAN_SINGLE (10 ,10 ,0x88 ), -AT91_SAMA5D2_CHAN_SINGLE (11 ,11 ,0x8c ), -AT91_SAMA5D2_CHAN_SINGLE (12 ,12 ,0x90 ), -AT91_SAMA5D2_CHAN_SINGLE (13 ,13 ,0x94 ), -AT91_SAMA5D2_CHAN_SINGLE (14 ,14 ,0x98 ), -AT91_SAMA5D2_CHAN_SINGLE (15 ,15 ,0x9c ), -AT91_SAMA5D2_CHAN_DIFF (16 ,0 ,1 ,0x60 ), -AT91_SAMA5D2_CHAN_DIFF (17 ,2 ,3 ,0x68 ), -AT91_SAMA5D2_CHAN_DIFF (18 ,4 ,5 ,0x70 ), -AT91_SAMA5D2_CHAN_DIFF (19 ,6 ,7 ,0x78 ), -AT91_SAMA5D2_CHAN_DIFF (20 ,8 ,9 ,0x80 ), -AT91_SAMA5D2_CHAN_DIFF (21 ,10 ,11 ,0x88 ), -AT91_SAMA5D2_CHAN_DIFF (22 ,12 ,13 ,0x90 ), -AT91_SAMA5D2_CHAN_DIFF (23 ,14 ,15 ,0x98 ), +AT91_SAMA7G5_CHAN_SINGLE (0 ,0 ,0x60 ), +AT91_SAMA7G5_CHAN_SINGLE (1 ,1 ,0x64 ), +AT91_SAMA7G5_CHAN_SINGLE (2 ,2 ,0x68 ), +AT91_SAMA7G5_CHAN_SINGLE (3 ,3 ,0x6c ), +AT91_SAMA7G5_CHAN_SINGLE (4 ,4 ,0x70 ), +AT91_SAMA7G5_CHAN_SINGLE (5 ,5 ,0x74 ), +AT91_SAMA7G5_CHAN_SINGLE (6 ,6 ,0x78 ), +AT91_SAMA7G5_CHAN_SINGLE (7 ,7 ,0x7c ), +AT91_SAMA7G5_CHAN_SINGLE (8 ,8 ,0x80 ), +AT91_SAMA7G5_CHAN_SINGLE (9 ,9 ,0x84 ), +AT91_SAMA7G5_CHAN_SINGLE (10 ,10 ,0x88 ), +AT91_SAMA7G5_CHAN_SINGLE (11 ,11 ,0x8c ), +AT91_SAMA7G5_CHAN_SINGLE (12 ,12 ,0x90 ), +AT91_SAMA7G5_CHAN_SINGLE (13 ,13 ,0x94 ), +AT91_SAMA7G5_CHAN_SINGLE (14 ,14 ,0x98 ), +AT91_SAMA7G5_CHAN_SINGLE (15 ,15 ,0x9c ), +AT91_SAMA7G5_CHAN_DIFF (16 ,0 ,1 ,0x60 ), +AT91_SAMA7G5_CHAN_DIFF (17 ,2 ,3 ,0x68 ), +AT91_SAMA7G5_CHAN_DIFF (18 ,4 ,5 ,0x70 ), +AT91_SAMA7G5_CHAN_DIFF (19 ,6 ,7 ,0x78 ), +AT91_SAMA7G5_CHAN_DIFF (20 ,8 ,9 ,0x80 ), +AT91_SAMA7G5_CHAN_DIFF (21 ,10 ,11 ,0x88 ), +AT91_SAMA7G5_CHAN_DIFF (22 ,12 ,13 ,0x90 ), +AT91_SAMA7G5_CHAN_DIFF (23 ,14 ,15 ,0x98 ),IIO_CHAN_SOFT_TIMESTAMP (24 ),AT91_SAMA5D2_CHAN_TEMP (AT91_SAMA7G5_ADC_TEMP_CHANNEL ,"temp" ,0xdc ), };
Greg Kroah-Hartman
maintainerPATCH 254/269 mm: hugetlb: Add huge page size param to huge_ptep_get_and_clear()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <[email protected]>
commit 02410ac72ac3707936c07ede66e94360d0d65319 upstream.
In order to fix a bug, arm64 needs to be told the size of the huge page for which the huge_pte is being cleared in huge_ptep_get_and_clear(). Provide for this by adding an unsigned long sz parameter to the function. This follows the same pattern as huge_pte_clear() and set_huge_pte_at().
This commit makes the required interface modifications to the core mm as well as all arches that implement this function (arm64, loongarch, mips, parisc, powerpc, riscv, s390, sparc). The actual arm64 bug will be fixed in a separate commit.
--- arch/arm64/include/asm/hugetlb.h | 4 ++-- arch/arm64/mm/hugetlbpage.c | 8 +++++--- arch/loongarch/include/asm/hugetlb.h | 6 ++++-- arch/mips/include/asm/hugetlb.h | 6 ++++-- arch/parisc/include/asm/hugetlb.h | 2 +- arch/parisc/mm/hugetlbpage.c | 2 +- arch/powerpc/include/asm/hugetlb.h | 6 ++++-- arch/riscv/include/asm/hugetlb.h | 3 ++- arch/riscv/mm/hugetlbpage.c | 2 +- arch/s390/include/asm/hugetlb.h | 17 ++++++++++++----- arch/s390/mm/hugetlbpage.c | 4 ++-- arch/sparc/include/asm/hugetlb.h | 2 +- arch/sparc/mm/hugetlbpage.c | 2 +- include/asm-generic/hugetlb.h | 2 +- include/linux/hugetlb.h | 4 +++- mm/hugetlb.c | 4 ++-- 16 files changed, 46 insertions(+), 28 deletions(-)
arch/arm64/include/asm/hugetlb.h +2 -2
@@ -34,8 +34,8 @@ extern int huge_ptep_set_access_flags(st unsigned long addr, pte_t *ptep, pte_t pte, int dirty);#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEAR -extern pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep); +extern pte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, +pte_t *ptep,unsigned long sz);#define __HAVE_ARCH_HUGE_PTEP_SET_WRPROTECTextern void huge_ptep_set_wrprotect (struct mm_struct *mm,unsigned long addr,pte_t *ptep);
arch/arm64/mm/hugetlbpage.c +5 -3
@@ -385,8 +385,8 @@ void huge_pte_clear(struct mm_struct *mm__pte_clear (mm, addr, ptep); } -pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep) +pte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, +pte_t *ptep,unsigned long sz) {int ncontig;size_t pgsize;
@@ -538,6 +538,8 @@ bool __init arch_hugetlb_valid_size(unsipte_t huge_ptep_modify_prot_start (struct vm_area_struct *vma,unsigned long addr,pte_t *ptep) { +unsigned long psize =huge_page_size (hstate_vma (vma)); +if (alternative_has_cap_unlikely (ARM64_WORKAROUND_2645198 )) {/* * Break-before-make (BBM) is required for all user space mappings
@@ -547,7 +549,7 @@ pte_t huge_ptep_modify_prot_start(structif (pte_user_exec (__ptep_get (ptep)))return huge_ptep_clear_flush (vma, addr, ptep); } -return huge_ptep_get_and_clear (vma->vm_mm, addr, ptep); +return huge_ptep_get_and_clear (vma->vm_mm, addr, ptep, psize); } void huge_ptep_modify_prot_commit(struct vm_area_struct *vma, unsigned long addr, pte_t *ptep,
arch/loongarch/include/asm/hugetlb.h +4 -2
@@ -41,7 +41,8 @@ static inline void huge_pte_clear(struct#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARstatic inline pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep) +unsigned long addr,pte_t *ptep, +unsigned long sz) {pte_t clear;pte_t pte =ptep_get (ptep);
@@ -56,8 +57,9 @@ static inline pte_t huge_ptep_clear_flus unsigned long addr, pte_t *ptep) { pte_t pte; +unsigned long sz =huge_page_size (hstate_vma (vma)); - pte =huge_ptep_get_and_clear (vma->vm_mm, addr, ptep); + pte =huge_ptep_get_and_clear (vma->vm_mm, addr, ptep, sz);flush_tlb_page (vma, addr);return pte; }
arch/mips/include/asm/hugetlb.h +4 -2
@@ -32,7 +32,8 @@ static inline int prepare_hugepage_range#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARstatic inline pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep) +unsigned long addr,pte_t *ptep, +unsigned long sz) {pte_t clear;pte_t pte = *ptep;
@@ -47,13 +48,14 @@ static inline pte_t huge_ptep_clear_flus unsigned long addr, pte_t *ptep) { pte_t pte; +unsigned long sz =huge_page_size (hstate_vma (vma));/* * clear the huge pte entry firstly, so that the other smp threads will * not get old pte entry after finishing flush_tlb_page and before * setting new huge pte entry */ - pte =huge_ptep_get_and_clear (vma->vm_mm, addr, ptep); + pte =huge_ptep_get_and_clear (vma->vm_mm, addr, ptep, sz);flush_tlb_page (vma, addr);return pte; }
arch/parisc/include/asm/hugetlb.h +1 -1
@@ -10,7 +10,7 @@ void set_huge_pte_at(struct mm_struct *m#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARpte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, -pte_t *ptep); +pte_t *ptep,unsigned long sz);/* * If the arch doesn't supply something else, assume that hugepage
arch/parisc/mm/hugetlbpage.c +1 -1
@@ -147,7 +147,7 @@ void set_huge_pte_at(struct mm_struct *mpte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, -pte_t *ptep) +pte_t *ptep,unsigned long sz) {pte_t entry;
arch/powerpc/include/asm/hugetlb.h +4 -2
@@ -45,7 +45,8 @@ void set_huge_pte_at(struct mm_struct *m#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARstatic inline pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep) +unsigned long addr,pte_t *ptep, +unsigned long sz) {return __pte (pte_update (mm, addr, ptep, ~0UL ,0 ,1 )); }
@@ -55,8 +56,9 @@ static inline pte_t huge_ptep_clear_flus unsigned long addr, pte_t *ptep) { pte_t pte; +unsigned long sz =huge_page_size (hstate_vma (vma)); - pte =huge_ptep_get_and_clear (vma->vm_mm, addr, ptep); + pte =huge_ptep_get_and_clear (vma->vm_mm, addr, ptep, sz);flush_hugetlb_page (vma, addr);return pte; }
arch/riscv/include/asm/hugetlb.h +2 -1
@@ -28,7 +28,8 @@ void set_huge_pte_at(struct mm_struct *m#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARpte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep); +unsigned long addr,pte_t *ptep, +unsigned long sz);#define __HAVE_ARCH_HUGE_PTEP_CLEAR_FLUSH pte_t huge_ptep_clear_flush(struct vm_area_struct *vma,
arch/riscv/mm/hugetlbpage.c +1 -1
@@ -293,7 +293,7 @@ int huge_ptep_set_access_flags(struct vmpte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, -pte_t *ptep) +pte_t *ptep,unsigned long sz) {pte_t orig_pte =ptep_get (ptep);int pte_num;
arch/s390/include/asm/hugetlb.h +12 -5
@@ -20,8 +20,15 @@ void set_huge_pte_at(struct mm_struct *mvoid __set_huge_pte_at (struct mm_struct *mm,unsigned long addr,pte_t *ptep,pte_t pte);pte_t huge_ptep_get (struct mm_struct *mm,unsigned long addr,pte_t *ptep); -pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep); +pte_t __huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, +pte_t *ptep); + +static inline pte_t huge_ptep_get_and_clear (struct mm_struct *mm, +unsigned long addr,pte_t *ptep, +unsigned long sz) +{ +return __huge_ptep_get_and_clear (mm, addr, ptep); +}/* * If the arch doesn't supply something else, assume that hugepage
@@ -57,7 +64,7 @@ static inline void huge_pte_clear(structstatic inline pte_t huge_ptep_clear_flush (struct vm_area_struct *vma,unsigned long address,pte_t *ptep) { -return huge_ptep_get_and_clear (vma->vm_mm, address, ptep); +return __huge_ptep_get_and_clear (vma->vm_mm, address, ptep); } static inline int huge_ptep_set_access_flags(struct vm_area_struct *vma,
@@ -66,7 +73,7 @@ static inline int huge_ptep_set_access_f {int changed = !pte_same (huge_ptep_get (vma->vm_mm, addr, ptep), pte);if (changed) { -huge_ptep_get_and_clear (vma->vm_mm, addr, ptep); +__huge_ptep_get_and_clear (vma->vm_mm, addr, ptep);__set_huge_pte_at (vma->vm_mm, addr, ptep, pte); }return changed;
@@ -75,7 +82,7 @@ static inline int huge_ptep_set_access_fstatic inline void huge_ptep_set_wrprotect (struct mm_struct *mm,unsigned long addr,pte_t *ptep) { -pte_t pte =huge_ptep_get_and_clear (mm, addr, ptep); +pte_t pte =__huge_ptep_get_and_clear (mm, addr, ptep);__set_huge_pte_at (mm, addr, ptep,pte_wrprotect (pte)); }
arch/s390/mm/hugetlbpage.c +2 -2
@@ -174,8 +174,8 @@ pte_t huge_ptep_get(struct mm_struct *mmreturn __rste_to_pte (pte_val (*ptep)); } -pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep) +pte_t __huge_ptep_get_and_clear (struct mm_struct *mm, +unsigned long addr,pte_t *ptep) {pte_t pte =huge_ptep_get (mm, addr, ptep);pmd_t *pmdp = (pmd_t *) ptep;
arch/sparc/include/asm/hugetlb.h +1 -1
@@ -20,7 +20,7 @@ void __set_huge_pte_at(struct mm_struct#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARpte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, -pte_t *ptep); +pte_t *ptep,unsigned long sz);#define __HAVE_ARCH_HUGE_PTEP_CLEAR_FLUSH static inline pte_t huge_ptep_clear_flush(struct vm_area_struct *vma,
arch/sparc/mm/hugetlbpage.c +1 -1
@@ -368,7 +368,7 @@ void set_huge_pte_at(struct mm_struct *m }pte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, -pte_t *ptep) +pte_t *ptep,unsigned long sz) {unsigned int i, nptes, orig_shift, shift;unsigned long size;
include/asm-generic/hugetlb.h +1 -1
@@ -84,7 +84,7 @@ static inline void set_huge_pte_at(struc#ifndef __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARstatic inline pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep) +unsigned long addr,pte_t *ptep,unsigned long sz) {return ptep_get_and_clear (mm, addr, ptep); }
include/linux/hugetlb.h +3 -1
@@ -1009,7 +1009,9 @@ static inline void hugetlb_count_sub(lonstatic inline pte_t huge_ptep_modify_prot_start (struct vm_area_struct *vma,unsigned long addr,pte_t *ptep) { -return huge_ptep_get_and_clear (vma->vm_mm, addr, ptep); +unsigned long psize =huge_page_size (hstate_vma (vma)); + +return huge_ptep_get_and_clear (vma->vm_mm, addr, ptep, psize); }#endif
mm/hugetlb.c +2 -2
@@ -5395,7 +5395,7 @@ static void move_huge_pte(struct vm_areaif (src_ptl != dst_ptl)spin_lock_nested (src_ptl,SINGLE_DEPTH_NESTING ); - pte =huge_ptep_get_and_clear (mm, old_addr, src_pte); + pte =huge_ptep_get_and_clear (mm, old_addr, src_pte, sz);if (need_clear_uffd_wp &&pte_marker_uffd_wp (pte))huge_pte_clear (mm, new_addr, dst_pte, sz);
@@ -5570,7 +5570,7 @@ void __unmap_hugepage_range(struct mmu_gset_vma_resv_flags (vma,HPAGE_RESV_UNMAPPED ); } - pte =huge_ptep_get_and_clear (mm, address, ptep); + pte =huge_ptep_get_and_clear (mm, address, ptep, sz);tlb_remove_huge_tlb_entry (h, tlb, ptep, address);if (huge_pte_dirty (pte))set_page_dirty (page);
Greg Kroah-Hartman
maintainerPATCH 255/269 arm64: hugetlb: Fix huge_ptep_get_and_clear() for non-present ptes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <[email protected]>
commit 49c87f7677746f3c5bd16c81b23700bb6b88bfd4 upstream.
arm64 supports multiple huge_pte sizes. Some of the sizes are covered by a single pte entry at a particular level (PMD_SIZE, PUD_SIZE), and some are covered by multiple ptes at a particular level (CONT_PTE_SIZE, CONT_PMD_SIZE). So the function has to figure out the size from the huge_pte pointer. This was previously done by walking the pgtable to determine the level and by using the PTE_CONT bit to determine the number of ptes at the level.
But the PTE_CONT bit is only valid when the pte is present. For non-present pte values (e.g. markers, migration entries), the previous implementation was therefore erroneously determining the size. There is at least one known caller in core-mm, move_huge_pte(), which may call huge_ptep_get_and_clear() for a non-present pte. So we must be robust to this case. Additionally the "regular" ptep_get_and_clear() is robust to being called for non-present ptes so it makes sense to follow the behavior.
Fix this by using the new sz parameter which is now provided to the function. Additionally when clearing each pte in a contig range, don't gather the access and dirty bits if the pte is not present.
An alternative approach that would not require API changes would be to store the PTE_CONT bit in a spare bit in the swap entry pte for the non-present case. But it felt cleaner to follow other APIs' lead and just pass in the size.
As an aside, PTE_CONT is bit 52, which corresponds to bit 40 in the swap entry offset field (layout of non-present pte). Since hugetlb is never swapped to disk, this field will only be populated for markers, which always set this bit to 0 and hwpoison swap entries, which set the offset field to a PFN; So it would only ever be 1 for a 52-bit PVA system where memory in that high half was poisoned (I think!). So in practice, this bit would almost always be zero for non-present ptes and we would only clear the first entry if it was actually a contiguous block. That's probably a less severe symptom than if it was always interpreted as 1 and cleared out potentially-present neighboring PTEs.
--- arch/arm64/mm/hugetlbpage.c | 51 ++++++++++++++++---------------------------- 1 file changed, 19 insertions(+), 32 deletions(-)
arch/arm64/mm/hugetlbpage.c +19 -32
@@ -100,20 +100,11 @@ static int find_num_contig(struct mm_strstatic inline int num_contig_ptes (unsigned long size,size_t *pgsize) { -int contig_ptes =0 ; +int contig_ptes =1 ; *pgsize = size;switch (size) { -#ifndef __PAGETABLE_PMD_FOLDED -case PUD_SIZE : -if (pud_sect_supported ()) - contig_ptes =1 ; -break ; -#endif -case PMD_SIZE : - contig_ptes =1 ; -break ;case CONT_PMD_SIZE : *pgsize =PMD_SIZE ; contig_ptes =CONT_PMDS ;
@@ -122,6 +113,8 @@ static inline int num_contig_ptes(unsign *pgsize =PAGE_SIZE ; contig_ptes =CONT_PTES ;break ; +default : +WARN_ON (!__hugetlb_valid_size (size)); }return contig_ptes;
@@ -163,24 +156,23 @@ static pte_t get_clear_contig(struct mm_ unsigned long pgsize, unsigned long ncontig) { -pte_t orig_pte =__ptep_get (ptep); -unsigned long i; +pte_t pte, tmp_pte; +bool present; -for (i =0 ; i < ncontig; i++, addr += pgsize, ptep++) { -pte_t pte =__ptep_get_and_clear (mm, addr, ptep); - -/* -* If HW_AFDBM is enabled, then the HW could turn on -* the dirty or accessed bit for any page in the set, -* so check them all. -*/ -if (pte_dirty (pte)) - orig_pte =pte_mkdirty (orig_pte); - -if (pte_young (pte)) - orig_pte =pte_mkyoung (orig_pte); + pte =__ptep_get_and_clear (mm, addr, ptep); + present =pte_present (pte); +while (--ncontig) { + ptep++; + addr += pgsize; + tmp_pte =__ptep_get_and_clear (mm, addr, ptep); +if (present) { +if (pte_dirty (tmp_pte)) + pte =pte_mkdirty (pte); +if (pte_young (tmp_pte)) + pte =pte_mkyoung (pte); + } } -return orig_pte; +return pte; } static pte_t get_clear_contig_flush(struct mm_struct *mm,
@@ -390,13 +382,8 @@ pte_t huge_ptep_get_and_clear(struct mm_ {int ncontig;size_t pgsize; -pte_t orig_pte =__ptep_get (ptep); - -if (!pte_cont (orig_pte)) -return __ptep_get_and_clear (mm, addr, ptep); - - ncontig =find_num_contig (mm, addr, ptep, &pgsize); + ncontig =num_contig_ptes (sz, &pgsize);return get_clear_contig (mm, addr, ptep, pgsize, ncontig); }
Greg Kroah-Hartman
maintainerPATCH 256/269 fs/netfs/read_pgpriv2: skip folio queues without `marks3`
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <[email protected]>
[ Note this patch doesn't apply to v6.14 as it was obsoleted by commit
e2d46f2ec332 ("netfs: Change the read result collector to only use one work item"). ]
At the beginning of the function, folio queues with marks3==0 are skipped, but after that, the marks3 field is ignored. If one such queue is found, slot is set to 64 (because __ffs(0)==64), leading to a buffer overflow in the folioq_folio() call. The resulting crash may look like this:
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 11 UID: 0 PID: 2909 Comm: kworker/u262:1 Not tainted 6.13.1-cm4all2-vm #415 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Workqueue: events_unbound netfs_read_termination_worker RIP: 0010:netfs_pgpriv2_write_to_the_cache+0x15a/0x3f0 Code: 48 85 c0 48 89 44 24 08 0f 84 24 01 00 00 48 8b 80 40 01 00 00 48 8b 7c 24 08 f3 48 0f bc c0 89 44 24 18 89 c0 48 8b 74 c7 08 <48> 8b 06 48 c7 04 24 00 10 00 00 a8 40 74 10 0f b6 4e 40 b8 00 10 RSP: 0018:ffffbbc440effe18 EFLAGS: 00010203 RAX: 0000000000000040 RBX: ffff96f8fc034000 RCX: 0000000000000000 RDX: 0000000000000040 RSI: 0000000000000000 RDI: ffff96f8fc036400 RBP: 0000000000001000 R08: ffff96f9132bb400 R09: 0000000000001000 R10: ffff96f8c1263c80 R11: 0000000000000003 R12: 0000000000001000 R13: ffff96f8fb75ade8 R14: fffffaaf5ca90000 R15: ffff96f8fb75ad00 FS: 0000000000000000(0000) GS:ffff9703cf0c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010c9ca003 CR4: 00000000001706b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die+0x1f/0x60 ? page_fault_oops+0x158/0x450 ? search_extable+0x22/0x30 ? netfs_pgpriv2_write_to_the_cache+0x15a/0x3f0 ? search_module_extables+0xe/0x40 ? exc_page_fault+0x62/0x120 ? asm_exc_page_fault+0x22/0x30 ? netfs_pgpriv2_write_to_the_cache+0x15a/0x3f0 ? netfs_pgpriv2_write_to_the_cache+0xf6/0x3f0 netfs_read_termination_worker+0x1f/0x60 process_one_work+0x138/0x2d0 worker_thread+0x2a5/0x3b0 ? __pfx_worker_thread+0x10/0x10 kthread+0xba/0xe0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x30/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
--- fs/netfs/read_pgpriv2.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/netfs/read_pgpriv2.c +3 -2
@@ -181,16 +181,17 @@ void netfs_pgpriv2_write_to_the_cache(stbreak ;folioq_unmark3 (folioq, slot); -if (!folioq->marks3) { +while (!folioq->marks3) { folioq = folioq->next;if (!folioq) -break ; + goto end_of_queue; } slot =__ffs (folioq->marks3); folio =folioq_folio (folioq, slot); } +end_of_queue:netfs_issue_write (wreq, &wreq->io_streams[1 ]);smp_wmb ();/* Write lists before ALL_QUEUED. */ set_bit (NETFS_RREQ_ALL_QUEUED , &wreq->flags);
Greg Kroah-Hartman
maintainerPATCH 257/269 fs/netfs/read_collect: fix crash due to uninitialized `prev` variable
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <[email protected]>
[ Just like the other two netfs patches I sent yesterday, this one
doesn't apply to v6.14 as it was obsoleted by commit e2d46f2ec332 ("netfs: Change the read result collector to only use one work item"). ]
When checking whether the edges of adjacent subrequests touch, the prev variable is deferenced, but it might not have been initialized. This causes crashes like this one:
BUG: unable to handle page fault for address: 0000000181343843 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 8000001c66db0067 P4D 8000001c66db0067 PUD 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 1 UID: 33333 PID: 24424 Comm: php-cgi8.2 Kdump: loaded Not tainted 6.13.2-cm4all0-hp+ #427 Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 11/23/2021 RIP: 0010:netfs_consume_read_data.isra.0+0x5ef/0xb00 Code: fe ff ff 48 8b 83 88 00 00 00 48 8b 4c 24 30 4c 8b 43 78 48 85 c0 48 8d 51 70 75 20 48 8b 73 30 48 39 d6 74 17 48 8b 7c 24 40 <48> 8b 4f 78 48 03 4f 68 48 39 4b 68 0f 84 ab 02 00 00 49 29 c0 48 RSP: 0000:ffffc90037adbd00 EFLAGS: 00010283 RAX: 0000000000000000 RBX: ffff88811bda0600 RCX: ffff888620e7b980 RDX: ffff888620e7b9f0 RSI: ffff88811bda0428 RDI: 00000001813437cb RBP: 0000000000000000 R08: 0000000000004000 R09: 0000000000000000 R10: ffffffff82e070c0 R11: 0000000007ffffff R12: 0000000000004000 R13: ffff888620e7bb68 R14: 0000000000008000 R15: ffff888620e7bb68 FS: 00007ff2e0e7ddc0(0000) GS:ffff88981f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000181343843 CR3: 0000001bc10ba006 CR4: 00000000001706f0 Call Trace: <TASK> ? __die+0x1f/0x60 ? page_fault_oops+0x15c/0x450 ? search_extable+0x22/0x30 ? netfs_consume_read_data.isra.0+0x5ef/0xb00 ? search_module_extables+0xe/0x40 ? exc_page_fault+0x5e/0x100 ? asm_exc_page_fault+0x22/0x30 ? netfs_consume_read_data.isra.0+0x5ef/0xb00 ? intel_iommu_unmap_pages+0xaa/0x190 ? __pfx_cachefiles_read_complete+0x10/0x10 netfs_read_subreq_terminated+0x24f/0x390 cachefiles_read_complete+0x48/0xf0 iomap_dio_bio_end_io+0x125/0x160 blk_update_request+0xea/0x3e0 scsi_end_request+0x27/0x190 scsi_io_completion+0x43/0x6c0 blk_complete_reqs+0x40/0x50 handle_softirqs+0xd1/0x280 irq_exit_rcu+0x91/0xb0 common_interrupt+0x3b/0xa0 asm_common_interrupt+0x22/0x40 RIP: 0033:0x55fe8470d2ab Code: 00 00 3c 7e 74 3b 3c b6 0f 84 dd 03 00 00 3c 1e 74 2f 83 c1 01 48 83 c2 38 48 83 c7 30 44 39 d1 74 3e 48 63 42 08 85 c0 79 a3 <49> 8b 46 48 8b 04 38 f6 c4 04 75 0b 0f b6 42 30 83 e0 0c 3c 04 75 RSP: 002b:00007ffca5ef2720 EFLAGS: 00000216 RAX: 0000000000000023 RBX: 0000000000000008 RCX: 000000000000001b RDX: 00007ff2e0cdb6f8 RSI: 0000000000000006 RDI: 0000000000000510 RBP: 00007ffca5ef27a0 R08: 00007ffca5ef2720 R09: 0000000000000001 R10: 000000000000001e R11: 00007ff2e0c10d08 R12: 0000000000000001 R13: 0000000000000120 R14: 00007ff2e0cb1ed0 R15: 00000000000000b0 </TASK>
--- fs/netfs/read_collect.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
fs/netfs/read_collect.c +11 -10
@@ -258,17 +258,18 @@ donation_changed:*/ if (!subreq->consumed && !prev_donated && - !list_is_first (&subreq->rreq_link, &rreq->subrequests) && - subreq->start == prev->start + prev->len) { + !list_is_first (&subreq->rreq_link, &rreq->subrequests)) { prev =list_prev_entry (subreq, rreq_link); -WRITE_ONCE (prev->next_donated, prev->next_donated + subreq->len); - subreq->start += subreq->len; - subreq->len =0 ; - subreq->transferred =0 ; -trace_netfs_donate (rreq, subreq, prev, subreq->len, - netfs_trace_donate_to_prev); -trace_netfs_sreq (subreq, netfs_sreq_trace_donate_to_prev); - goto remove_subreq_locked; +if (subreq->start == prev->start + prev->len) { +WRITE_ONCE (prev->next_donated, prev->next_donated + subreq->len); + subreq->start += subreq->len; + subreq->len =0 ; + subreq->transferred =0 ; +trace_netfs_donate (rreq, subreq, prev, subreq->len, + netfs_trace_donate_to_prev); +trace_netfs_sreq (subreq, netfs_sreq_trace_donate_to_prev); + goto remove_subreq_locked; + } }/* If we can't donate down the chain, donate up the chain instead. */
Greg Kroah-Hartman
maintainerPATCH 258/269 kbuild: hdrcheck: fix cross build with clang
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 02e9a22ceef0227175e391902d8760425fa072c6 ]
The headercheck tries to call clang with a mix of compiler arguments that don't include the target architecture. When building e.g. x86 headers on arm64, this produces a warning like
clang: warning: unknown platform, assuming -mfloat-abi=soft
Add in the KBUILD_CPPFLAGS, which contain the target, in order to make it build properly.
See also 1b71c2fb04e7 ("kbuild: userprogs: fix bitsize and target detection on clang").
--- usr/include/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
usr/include/Makefile +1 -1
@@ -10,7 +10,7 @@ UAPI_CFLAGS := -std=c90 -Wall -Werror=implicit-function-declaration # In theory, we do not care -m32 or -m64 for header compile tests. # It is here just because CONFIG_CC_CAN_LINK is tested with -m32 or -m64. -UAPI_CFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS)) +UAPI_CFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) # USERCFLAGS might contain sysroot location for CC. UAPI_CFLAGS += $(USERCFLAGS)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 259/269 ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit d0bbe332669c5db32c8c92bc967f8e7f8d460ddf upstream.
The alternative path leads to a build error after a recent change:
sound/pci/hda/patch_realtek.c: In function 'alc233_fixup_lenovo_low_en_micmute_led':include/linux/stddef.h:9:14: error: called object is not a function or function pointer
9 | #define NULL ((void *)0)
| ^
sound/pci/hda/patch_realtek.c:5041:49: note: in expansion of macro 'NULL'
5041 | #define alc233_fixup_lenovo_line2_mic_hotkey NULL
| ^~~~sound/pci/hda/patch_realtek.c:5063:9: note: in expansion of macro 'alc233_fixup_lenovo_line2_mic_hotkey'
5063 | alc233_fixup_lenovo_line2_mic_hotkey(codec, fix, action);
Using IS_REACHABLE() is somewhat questionable here anyway since it leads to the input code not working when the HDA driver is builtin but input is in a loadable module. Replace this with a hard compile-time dependency on CONFIG_INPUT. In practice this won't chance much other than solve the compiler error because it is rare to require sound output but no input support.
--- sound/pci/hda/Kconfig | 1 + sound/pci/hda/patch_realtek.c | 5 ----- 2 files changed, 1 insertion(+), 5 deletions(-)
sound/pci/hda/Kconfig +1 -0
@@ -208,6 +208,7 @@ comment "Set to Y if you want auto-loadi config SND_HDA_CODEC_REALTEK tristate "Build Realtek HD-audio codec support" + depends on INPUT select SND_HDA_GENERIC select SND_HDA_GENERIC_LEDS select SND_HDA_SCODEC_COMPONENT
sound/pci/hda/patch_realtek.c +0 -5
@@ -5002,7 +5002,6 @@ static void alc298_fixup_samsung_amp_v2_alc298_samsung_v2_init_amps (codec,4 ); } -#if IS_REACHABLE (CONFIG_INPUT )static void gpio2_mic_hotkey_event (struct hda_codec *codec,struct hda_jack_callback *event) {
@@ -5111,10 +5110,6 @@ static void alc233_fixup_lenovo_line2_mi spec->kb_dev =NULL ; } } -#else /* INPUT */ -#define alc280_fixup_hp_gpio2_mic_hotkey NULL -#define alc233_fixup_lenovo_line2_mic_hotkey NULL -#endif /* INPUT */ static void alc269_fixup_hp_line1_mic1_led (struct hda_codec *codec,const struct hda_fixup *fix,int action)
Greg Kroah-Hartman
maintainerPATCH 260/269 nvme-tcp: Fix a C2HTermReq error message
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
commit afb41b08c44e5386f2f52fa859010ac4afd2b66f upstream.
In H2CTermReq, a FES with value 0x05 means "R2T Limit Exceeded"; but in C2HTermReq the same value has a different meaning (Data Transfer Limit Exceeded).
--- drivers/nvme/host/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/tcp.c +1 -1
@@ -788,7 +788,7 @@ static void nvme_tcp_handle_c2h_term(str [NVME_TCP_FES_PDU_SEQ_ERR] = "PDU Sequence Error", [NVME_TCP_FES_HDR_DIGEST_ERR] = "Header Digest Error", [NVME_TCP_FES_DATA_OUT_OF_RANGE] = "Data Transfer Out Of Range", - [NVME_TCP_FES_R2T_LIMIT_EXCEEDED] = "R2T Limit Exceeded", + [NVME_TCP_FES_DATA_LIMIT_EXCEEDED] = "Data Transfer Limit Exceeded", [NVME_TCP_FES_UNSUPPORTED_PARAM] = "Unsupported Parameter", };
Greg Kroah-Hartman
maintainerPATCH 261/269 docs: rust: remove spurious item in `expect` list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit b160dc46dd9af4001c802cc9c7d68b6ba58d27c4 upstream.
This list started as a "when to prefer expect" list, but at some point during writing I changed it to a "prefer expect unless..." one. However, the first bullet remained, which does not make sense anymore.
Thus remove it. In addition, fix nearby typo.
--- Documentation/rust/coding-guidelines.rst | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
Documentation/rust/coding-guidelines.rst +1 -3
@@ -296,9 +296,7 @@ may happen in several situations, e.g.: It also increases the visibility of the remaining ``allow``\ s and reduces the chance of misapplying one. -Thus prefer ``except`` over ``allow`` unless: - -- The lint attribute is intended to be temporary, e.g. while developing. +Thus prefer ``expect`` over ``allow`` unless: - Conditional compilation triggers the warning in some cases but not others.
Greg Kroah-Hartman
maintainerPATCH 262/269 Revert "KVM: e500: always restore irqs"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit 48fe216d7db6b651972c1c1d8e3180cd699971b0 which is commit 87ecfdbc699cc95fac73291b52650283ddcf929d upstream.
It should not have been applied.
--- arch/powerpc/kvm/e500_mmu_host.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/kvm/e500_mmu_host.c +2 -2
@@ -479,6 +479,7 @@ static inline int kvmppc_e500_shadow_mapif (pte_present (pte)) { wimg = (pte_val (pte) >>PTE_WIMGE_SHIFT ) &MAS2_WIMGE_MASK ; +local_irq_restore (flags); }else {local_irq_restore (flags); pr_err_ratelimited("%s: pte not present: gfn %lx,pfn %lx\n",
@@ -487,9 +488,8 @@ static inline int kvmppc_e500_shadow_map goto out; } } -local_irq_restore (flags); - writable =kvmppc_e500_ref_setup (ref, gtlbe, pfn, wimg); +kvmppc_e500_setup_stlbe (&vcpu_e500->vcpu, gtlbe, tsize, ref, gvaddr, stlbe);
Greg Kroah-Hartman
maintainerPATCH 263/269 Revert "KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit 833f69be62ac366b5c23b4a6434389e470dd5c7f which is commit 419cfb983ca93e75e905794521afefcfa07988bb upstream.
It should not have been applied.
--- arch/powerpc/kvm/e500_mmu_host.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
arch/powerpc/kvm/e500_mmu_host.c +5 -3
@@ -322,7 +322,6 @@ static inline int kvmppc_e500_shadow_map {struct kvm_memory_slot *slot;unsigned long pfn =0 ;/* silence GCC warning */ -struct page *page =NULL ;unsigned long hva;int pfnmap =0 ;int tsize =BOOK3E_PAGESZ_4K ;
@@ -444,7 +443,7 @@ static inline int kvmppc_e500_shadow_mapif (likely (!pfnmap)) { tsize_pages =1UL << (tsize +10 -PAGE_SHIFT ); - pfn =__kvm_faultin_pfn (slot, gfn,FOLL_WRITE ,NULL , &page); + pfn =gfn_to_pfn_memslot (slot, gfn);if (is_error_noslot_pfn (pfn)) {if (printk_ratelimit ()) pr_err("%s: real page not found for gfn %lx\n",
@@ -489,6 +488,8 @@ static inline int kvmppc_e500_shadow_map } } writable =kvmppc_e500_ref_setup (ref, gtlbe, pfn, wimg); +if (writable) +kvm_set_pfn_dirty (pfn);kvmppc_e500_setup_stlbe (&vcpu_e500->vcpu, gtlbe, tsize, ref, gvaddr, stlbe);
@@ -497,7 +498,8 @@ static inline int kvmppc_e500_shadow_mapkvmppc_mmu_flush_icache (pfn); out: -kvm_release_faultin_page (kvm, page, !!ret, writable); +/* Drop refcount on page, so that mmu notifiers can clear it */ +kvm_release_pfn_clean (pfn);spin_unlock (&kvm->mmu_lock);return ret; }
Greg Kroah-Hartman
maintainerPATCH 264/269 Revert "KVM: PPC: e500: Mark "struct page" pfn accessed before dropping mmu_lock"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit f2623aec7fdc2675667042c85f87502c9139c098 which is commit 84cf78dcd9d65c45ab73998d4ad50f433d53fb93 upstream.
It should not have been applied.
--- arch/powerpc/kvm/e500_mmu_host.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/kvm/e500_mmu_host.c +3 -1
@@ -498,9 +498,11 @@ static inline int kvmppc_e500_shadow_mapkvmppc_mmu_flush_icache (pfn); out: +spin_unlock (&kvm->mmu_lock); +/* Drop refcount on page, so that mmu notifiers can clear it */ kvm_release_pfn_clean (pfn); -spin_unlock (&kvm->mmu_lock); +return ret; }
Greg Kroah-Hartman
maintainerPATCH 265/269 Revert "KVM: PPC: e500: Mark "struct page" dirty in kvmppc_e500_shadow_map()"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit dec857329fb9a66a5bce4f9db14c97ef64725a32 which is commit c9be85dabb376299504e0d391d15662c0edf8273 upstream.
It should not have been applied.
--- arch/powerpc/kvm/e500_mmu_host.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
arch/powerpc/kvm/e500_mmu_host.c +7 -6
@@ -242,7 +242,7 @@ static inline int tlbe_is_writable(strucreturn tlbe->mas7_3 & (MAS3_SW |MAS3_UW ); } -static inline bool kvmppc_e500_ref_setup (struct tlbe_ref *ref, +static inline void kvmppc_e500_ref_setup (struct tlbe_ref *ref,struct kvm_book3e_206_tlb_entry *gtlbe,kvm_pfn_t pfn,unsigned int wimg) {
@@ -252,7 +252,11 @@ static inline bool kvmppc_e500_ref_setup/* Use guest supplied MAS2_G and MAS2_E */ ref->flags |= (gtlbe->mas2 &MAS2_ATTRIB_MASK ) | wimg; -return tlbe_is_writable (gtlbe); +/* Mark the page accessed */ +kvm_set_pfn_accessed (pfn); + +if (tlbe_is_writable (gtlbe)) +kvm_set_pfn_dirty (pfn); }static inline void kvmppc_e500_ref_release (struct tlbe_ref *ref)
@@ -333,7 +337,6 @@ static inline int kvmppc_e500_shadow_mapunsigned int wimg =0 ;pgd_t *pgdir;unsigned long flags; -bool writable = false;/* used to check for invalidations in progress */ mmu_seq = kvm->mmu_invalidate_seq;
@@ -487,9 +490,7 @@ static inline int kvmppc_e500_shadow_map goto out; } } - writable =kvmppc_e500_ref_setup (ref, gtlbe, pfn, wimg); -if (writable) -kvm_set_pfn_dirty (pfn); +kvmppc_e500_ref_setup (ref, gtlbe, pfn, wimg);kvmppc_e500_setup_stlbe (&vcpu_e500->vcpu, gtlbe, tsize, ref, gvaddr, stlbe);
Greg Kroah-Hartman
maintainerPATCH 266/269 KVM: e500: always restore irqs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit 87ecfdbc699cc95fac73291b52650283ddcf929d upstream.
If find_linux_pte fails, IRQs will not be restored. This is unlikely to happen in practice since it would have been reported as hanging hosts, but it should of course be fixed anyway.
--- arch/powerpc/kvm/e500_mmu_host.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/kvm/e500_mmu_host.c +2 -2
@@ -481,7 +481,6 @@ static inline int kvmppc_e500_shadow_mapif (pte_present (pte)) { wimg = (pte_val (pte) >>PTE_WIMGE_SHIFT ) &MAS2_WIMGE_MASK ; -local_irq_restore (flags); }else {local_irq_restore (flags); pr_err_ratelimited("%s: pte not present: gfn %lx,pfn %lx\n",
@@ -490,8 +489,9 @@ static inline int kvmppc_e500_shadow_map goto out; } } -kvmppc_e500_ref_setup (ref, gtlbe, pfn, wimg); +local_irq_restore (flags); +kvmppc_e500_ref_setup (ref, gtlbe, pfn, wimg);kvmppc_e500_setup_stlbe (&vcpu_e500->vcpu, gtlbe, tsize, ref, gvaddr, stlbe);
Greg Kroah-Hartman
maintainerPATCH 267/269 uprobes: Fix race in uprobe_free_utask
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
commit b583ef82b671c9a752fbe3e95bd4c1c51eab764d upstream.
Max Makarov reported kernel panic [1] in perf user callchain code.
The reason for that is the race between uprobe_free_utask and bpf profiler code doing the perf user stack unwind and is triggered within uprobe_free_utask function:
- after current->utask is freed and
- before current->utask is set to NULL
general protection fault, probably for non-canonical address 0x9e759c37ee555c76: 0000 [#1] SMP PTI RIP: 0010:is_uprobe_at_func_entry+0x28/0x80 ... ? die_addr+0x36/0x90 ? exc_general_protection+0x217/0x420 ? asm_exc_general_protection+0x26/0x30 ? is_uprobe_at_func_entry+0x28/0x80 perf_callchain_user+0x20a/0x360 get_perf_callchain+0x147/0x1d0 bpf_get_stackid+0x60/0x90 bpf_prog_9aac297fb833e2f5_do_perf_event+0x434/0x53b ? __smp_call_single_queue+0xad/0x120 bpf_overflow_handler+0x75/0x110 ... asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:__kmem_cache_free+0x1cb/0x350 ... ? uprobe_free_utask+0x62/0x80 ? acct_collect+0x4c/0x220 uprobe_free_utask+0x62/0x80 mm_release+0x12/0xb0 do_exit+0x26b/0xaa0 __x64_sys_exit+0x1b/0x20 do_syscall_64+0x5a/0x80
It can be easily reproduced by running following commands in separate terminals:
# while :; do bpftrace -e 'uprobe:/bin/ls:_start { printf("hit\n"); }' -c ls; done
# bpftrace -e 'profile:hz:100000 { @[ustack()] = count(); }'Fixing this by making sure current->utask pointer is set to NULL before we start to release the utask object.
[1] https://github.com/grafana/pyroscope/issues/3673
--- kernel/events/uprobes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/uprobes.c +1 -1
@@ -1775,6 +1775,7 @@ void uprobe_free_utask(struct task_strucif (!utask)return ; + t->utask =NULL ;if (utask->active_uprobe)put_uprobe (utask->active_uprobe);
@@ -1784,7 +1785,6 @@ void uprobe_free_utask(struct task_strucxol_free_insn_slot (t);kfree (utask); - t->utask =NULL ; }/*
Greg Kroah-Hartman
maintainerPATCH 268/269 selftests/bpf: Clean up open-coded gettid syscall invocations
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <[email protected]>
commit 0e2fb011a0ba8e2258ce776fdf89fbd589c2a3a6 upstream.
Availability of the gettid definition across glibc versions supported by BPF selftests is not certain. Currently, all users in the tree open-code syscall to gettid. Convert them to a common macro definition.
--- tools/testing/selftests/bpf/benchs/bench_trigger.c | 3 ++- tools/testing/selftests/bpf/bpf_util.h | 9 +++++++++ tools/testing/selftests/bpf/map_tests/task_storage_map.c | 3 ++- tools/testing/selftests/bpf/prog_tests/bpf_cookie.c | 2 +- tools/testing/selftests/bpf/prog_tests/bpf_iter.c | 6 +++--- tools/testing/selftests/bpf/prog_tests/cgrp_local_storage.c | 10 +++++----- tools/testing/selftests/bpf/prog_tests/core_reloc.c | 2 +- tools/testing/selftests/bpf/prog_tests/linked_funcs.c | 2 +- tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c | 2 +- tools/testing/selftests/bpf/prog_tests/rcu_read_lock.c | 4 ++-- tools/testing/selftests/bpf/prog_tests/task_local_storage.c | 8 ++++---- tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c | 2 +- 12 files changed, 32 insertions(+), 21 deletions(-)
tools/testing/selftests/bpf/benchs/bench_trigger.c +2 -1
@@ -4,6 +4,7 @@#include <argp.h> #include <unistd.h> #include <stdint.h> +#include "bpf_util.h" #include "bench.h" #include "trigger_bench.skel.h" #include "trace_helpers.h"
@@ -72,7 +73,7 @@ static __always_inline void inc_counter(unsigned slot;if (unlikely (tid ==0 )) - tid =syscall (SYS_gettid); + tid =sys_gettid ();/* multiplicative hashing, it's fast */ slot =2654435769U * tid;
tools/testing/selftests/bpf/bpf_util.h +9 -0
@@ -6,6 +6,7 @@#include <stdlib.h> #include <string.h> #include <errno.h> +#include <syscall.h> #include <bpf/libbpf.h> /* libbpf_num_possible_cpus */ static inline unsigned int bpf_num_possible_cpus (void )
@@ -59,4 +60,12 @@ static inline void bpf_strlcpy(char *dst (offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))#endif +/* Availability of gettid across glibc versions is hit-and-miss, therefore +* fallback to syscall in this macro and use it everywhere. +*/ +#ifndef sys_gettid +#define sys_gettid () syscall(SYS_gettid) +#endif + +#endif /* __BPF_UTIL__ */
tools/testing/selftests/bpf/map_tests/task_storage_map.c +2 -1
@@ -12,6 +12,7 @@#include <bpf/bpf.h> #include <bpf/libbpf.h> +#include "bpf_util.h" #include "test_maps.h" #include "task_local_storage_helpers.h" #include "read_bpf_task_storage_busy.skel.h"
@@ -115,7 +116,7 @@ void test_task_storage_map_stress_lookupCHECK (err,"attach" ,"error %d\n" , err);/* Trigger program */ -syscall (SYS_gettid); +sys_gettid (); skel->bss->pid =0 ;CHECK (skel->bss->busy !=0 ,"bad bpf_task_storage_busy" ,"got %d\n" , skel->bss->busy);
tools/testing/selftests/bpf/prog_tests/bpf_cookie.c +1 -1
@@ -690,7 +690,7 @@ void test_bpf_cookie(void)if (!ASSERT_OK_PTR (skel,"skel_open" ))return ; - skel->bss->my_tid =syscall (SYS_gettid); + skel->bss->my_tid =sys_gettid ();if (test__start_subtest ("kprobe" ))kprobe_subtest (skel);
tools/testing/selftests/bpf/prog_tests/bpf_iter.c +3 -3
@@ -226,7 +226,7 @@ static void test_task_common_nocheck(strASSERT_OK (pthread_create (&thread_id,NULL , &do_nothing_wait,NULL ),"pthread_create" ); - skel->bss->tid =syscall (SYS_gettid); + skel->bss->tid =sys_gettid ();do_dummy_read_opts (skel->progs.dump_task, opts);
@@ -255,10 +255,10 @@ static void *run_test_task_tid(void *argunion bpf_iter_link_info linfo;int num_unknown_tid, num_known_tid; -ASSERT_NEQ (getpid (),syscall (SYS_gettid),"check_new_thread_id" ); +ASSERT_NEQ (getpid (),sys_gettid (),"check_new_thread_id" );memset (&linfo,0 ,sizeof (linfo)); - linfo.task.tid =syscall (SYS_gettid); + linfo.task.tid =sys_gettid (); opts.link_info = &linfo; opts.link_info_len =sizeof (linfo);test_task_common (&opts,0 ,1 );
tools/testing/selftests/bpf/prog_tests/cgrp_local_storage.c +5 -5
@@ -63,14 +63,14 @@ static void test_tp_btf(int cgroup_fd)if (!ASSERT_OK (err,"map_delete_elem" )) goto out; - skel->bss->target_pid =syscall (SYS_gettid); + skel->bss->target_pid =sys_gettid (); err =cgrp_ls_tp_btf__attach (skel);if (!ASSERT_OK (err,"skel_attach" )) goto out; -syscall (SYS_gettid); -syscall (SYS_gettid); +sys_gettid (); +sys_gettid (); skel->bss->target_pid =0 ;
@@ -154,7 +154,7 @@ static void test_recursion(int cgroup_fd goto out;/* trigger sys_enter, make sure it does not cause deadlock */ -syscall (SYS_gettid); +sys_gettid (); out:cgrp_ls_recursion__destroy (skel);
@@ -224,7 +224,7 @@ static void test_yes_rcu_lock(__u64 cgroreturn ;CGROUP_MODE_SET (skel); - skel->bss->target_pid =syscall (SYS_gettid); + skel->bss->target_pid =sys_gettid ();bpf_program__set_autoload (skel->progs.yes_rcu_lock, true); err =cgrp_ls_sleepable__load (skel);
tools/testing/selftests/bpf/prog_tests/core_reloc.c +1 -1
@@ -1010,7 +1010,7 @@ static void run_core_reloc_tests(bool usstruct data *data;void *mmap_data =NULL ; - my_pid_tgid =getpid () | ((uint64_t )syscall (SYS_gettid) <<32 ); + my_pid_tgid =getpid () | ((uint64_t )sys_gettid () <<32 );for (i =0 ; i <ARRAY_SIZE (test_cases); i++) {char btf_file[] ="/tmp/core_reloc.btf.XXXXXX" ;
tools/testing/selftests/bpf/prog_tests/linked_funcs.c +1 -1
@@ -20,7 +20,7 @@ void test_linked_funcs(void)bpf_program__set_autoload (skel->progs.handler1, true);bpf_program__set_autoload (skel->progs.handler2, true); - skel->rodata->my_tid =syscall (SYS_gettid); + skel->rodata->my_tid =sys_gettid (); skel->bss->syscall_id = SYS_getpgid; err =linked_funcs__load (skel);
tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c +1 -1
@@ -23,7 +23,7 @@ static int get_pid_tgid(pid_t *pid, pid_struct stat st;int err; - *pid =syscall (SYS_gettid); + *pid =sys_gettid (); *tgid =getpid (); err =stat ("/proc/self/ns/pid" , &st);
tools/testing/selftests/bpf/prog_tests/rcu_read_lock.c +2 -2
@@ -21,7 +21,7 @@ static void test_success(void)if (!ASSERT_OK_PTR (skel,"skel_open" ))return ; - skel->bss->target_pid =syscall (SYS_gettid); + skel->bss->target_pid =sys_gettid ();bpf_program__set_autoload (skel->progs.get_cgroup_id, true);bpf_program__set_autoload (skel->progs.task_succ, true);
@@ -58,7 +58,7 @@ static void test_rcuptr_acquire(void)if (!ASSERT_OK_PTR (skel,"skel_open" ))return ; - skel->bss->target_pid =syscall (SYS_gettid); + skel->bss->target_pid =sys_gettid ();bpf_program__set_autoload (skel->progs.task_acquire, true); err =rcu_read_lock__load (skel);
tools/testing/selftests/bpf/prog_tests/task_local_storage.c +4 -4
@@ -23,14 +23,14 @@ static void test_sys_enter_exit(void)if (!ASSERT_OK_PTR (skel,"skel_open_and_load" ))return ; - skel->bss->target_pid =syscall (SYS_gettid); + skel->bss->target_pid =sys_gettid (); err =task_local_storage__attach (skel);if (!ASSERT_OK (err,"skel_attach" )) goto out; -syscall (SYS_gettid); -syscall (SYS_gettid); +sys_gettid (); +sys_gettid ();/* 3x syscalls: 1x attach and 2x gettid */ ASSERT_EQ (skel->bss->enter_cnt,3 ,"enter_cnt" );
@@ -99,7 +99,7 @@ static void test_recursion(void)/* trigger sys_enter, make sure it does not cause deadlock */ skel->bss->test_pid =getpid (); -syscall (SYS_gettid); +sys_gettid (); skel->bss->test_pid =0 ;task_ls_recursion__detach (skel);
tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c +1 -1
@@ -125,7 +125,7 @@ static void *child_thread(void *ctx)struct child *child = ctx;int c =0 , err; - child->tid =syscall (SYS_gettid); + child->tid =sys_gettid ();/* let parent know we are ready */ err =write (child->c2p[1 ], &c,1 );
Greg Kroah-Hartman
maintainerPATCH 269/269 x86/mm: Dont disable PCID when INVLPG has been fixed by microcode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Ruoyao <[email protected]>
commit f24f669d03f884a6ef95cca84317d0f329e93961 upstream.
Per the "Processor Specification Update" documentations referred by the intel-microcode-20240312 release note, this microcode release has fixed the issue for all affected models.
So don't disable PCID if the microcode is new enough. The precise minimum microcode revision fixing the issue was provided by Pawan Intel.
[ dhansen: comment and changelog tweaks ]
--- arch/x86/mm/init.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
arch/x86/mm/init.c +14 -9
@@ -263,28 +263,33 @@ static void __init probe_page_size_mask( }/* -* INVLPG may not properly flush Global entries -* on these CPUs when PCIDs are enabled. +* INVLPG may not properly flush Global entries on +* these CPUs. New microcode fixes the issue. */ static const struct x86_cpu_id invlpg_miss_ids[] = { -X86_MATCH_VFM (INTEL_ALDERLAKE ,0 ), -X86_MATCH_VFM (INTEL_ALDERLAKE_L ,0 ), -X86_MATCH_VFM (INTEL_ATOM_GRACEMONT ,0 ), -X86_MATCH_VFM (INTEL_RAPTORLAKE ,0 ), -X86_MATCH_VFM (INTEL_RAPTORLAKE_P ,0 ), -X86_MATCH_VFM (INTEL_RAPTORLAKE_S ,0 ), +X86_MATCH_VFM (INTEL_ALDERLAKE ,0x2e ), +X86_MATCH_VFM (INTEL_ALDERLAKE_L ,0x42c ), +X86_MATCH_VFM (INTEL_ATOM_GRACEMONT ,0x11 ), +X86_MATCH_VFM (INTEL_RAPTORLAKE ,0x118 ), +X86_MATCH_VFM (INTEL_RAPTORLAKE_P ,0x4117 ), +X86_MATCH_VFM (INTEL_RAPTORLAKE_S ,0x2e ), {} };static void setup_pcid (void ) { +const struct x86_cpu_id *invlpg_miss_match; +if (!IS_ENABLED (CONFIG_X86_64 ))return ;if (!boot_cpu_has (X86_FEATURE_PCID ))return ; -if (x86_match_cpu (invlpg_miss_ids)) { + invlpg_miss_match =x86_match_cpu (invlpg_miss_ids); + +if (invlpg_miss_match && + boot_cpu_data.microcode < invlpg_miss_match->driver_data) {pr_info ("Incomplete global flushes, disabling PCID" );setup_clear_cpu_cap (X86_FEATURE_PCID );return ;
Hello,
Quoted 7 lines · On Mon, 10 Mar 2025 18:02:33 +0100 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.12.19 release. There are 269 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].
[1] https://github.com/damonitor/damon-tests/tree/next/corr
[2] 912e4f3f1c16 ("Linux 6.12.19-rc1")
Thanks,
SJ
[...]
---
ok 9 selftests: damon: damos_tried_regions.py
ok 10 selftests: damon: damon_nr_regions.py
ok 11 selftests: damon: reclaim.sh
ok 12 selftests: damon: lru_sort.sh
ok 13 selftests: damon: debugfs_empty_targets.sh
ok 14 selftests: damon: debugfs_huge_count_read_write.sh
ok 15 selftests: damon: debugfs_duplicate_context_creation.sh ok 16 selftests: damon: debugfs_rm_non_contexts.sh
ok 17 selftests: damon: debugfs_target_ids_read_before_terminate_race.sh ok 18 selftests: damon: debugfs_target_ids_pid_leak.sh
ok 19 selftests: damon: sysfs_update_removed_scheme_dir.sh
ok 20 selftests: damon: sysfs_update_schemes_tried_regions_hang.py ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh # SKIP
ok 12 selftests: damon-tests: build_m68k.sh # SKIP
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.19 release. There are 269 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.19-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Hi Greg,
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.19 release. There are 269 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
No problems seen on x86_64 and aarch64 with our testing.
Thanks,
Harshit
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.19 release. There are 269 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.19-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.12:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
116 tests: 116 pass, 0 failLinux version: 6.12.19-rc1-g53db7cb59db6
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.19 release. There are 269 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.19-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.19 release. There are 269 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.19-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.12.19-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: 53db7cb59db64055714b1a7fd1cadd8d5ef6e2be
* git describe: v6.12.18-270-g53db7cb59db6
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.12.y/build/v6.12.18-270-g53db7cb59db6
## Test Regressions (compared to v6.12.15-529-g7d0ba26d4036)
## Metric Regressions (compared to v6.12.15-529-g7d0ba26d4036)
## Test Fixes (compared to v6.12.15-529-g7d0ba26d4036)
## Metric Fixes (compared to v6.12.15-529-g7d0ba26d4036)
## Test result summary
total: 77388, pass: 61961, fail: 2961, skip: 12426, xfail: 40
## Build Summary
* arc: 6 total, 5 passed, 1 failed
* arm: 143 total, 137 passed, 6 failed
* arm64: 58 total, 54 passed, 4 failed
* i386: 22 total, 19 passed, 3 failed
* mips: 38 total, 33 passed, 5 failed
* parisc: 5 total, 3 passed, 2 failed
* powerpc: 44 total, 43 passed, 1 failed
* riscv: 27 total, 24 passed, 3 failed
* s390: 26 total, 22 passed, 4 failed
* sh: 6 total, 5 passed, 1 failed
* sparc: 5 total, 3 passed, 2 failed
* x86_64: 50 total, 49 passed, 1 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-exec
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-crypto
* ltp-cve
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.19 release. There are 269 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.19 release. There are 269 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.19-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.19 release. There are 269 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
Hi Greg
6.12.19-rc1 compiles, boots and runs here on x86_64 (AMD Ryzen 5 7520U, Slackware64-current), no regressions observed.
Quoted 8 lines · On Mon, 10 Mar 2025 18:02:33 +0100 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.12.19 release. There are 269 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested for loongarch64:
Thanks!
Cheers,
Miguel
Am 10.03.2025 um 18:02 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.12.19 release. There are 269 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
The kernel, bpf tool, perf tool, and kselftest builds fine for v6.12.19-rc1 on x86 and arm64 Azure VM.
Kernel binary size for x86 build:
text data bss dec hex filename 27756160 17713706 6397952 51867818 31770aa vmlinux
Kernel binary size for arm64 build:
text data bss dec hex filename 36399457 14996921 1052816 52449194 3204faa vmlinux
Thanks,
Hardik