The postclose handler can run after the device has been removed (or the
driver has been unbound) since userspace clients are free to hold the
file open as long as they want. Because the device removal callback
frees the entire nouveau_drm structure, any reference to it in the
postclose handler will result in a use-after-free.
To reproduce this, one must simply open the device file, unbind the
driver (or physically remove the device), and then close the device
file. This was found and can be reproduced easily with the IGT
core_hotunplug tests.
To avoid this, all clients are cleaned up in the device finalization
rather than deferring it to the postclose handler, and the postclose
handler is protected by a critical section which ensures the
drm_dev_unplug() and the postclose handler won't race.
This is not an ideal fix, since as I understand the proposed plan for
the kernel<->userspace interface for hotplug support, destroying the
client before the file is closed will cause problems. However, I believe
to properly fix this issue, the lifetime of the nouveau_drm structure
needs to be extended to match the drm_device, and this proved to be a
rather invasive change. Thus, I've broken this out so the fix can be
easily backported.
This fixes with the two previous commits CVE-2020-27820 (Karol).
Cc: stable@vger.kernel.org # 5.4+
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
Tested-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201125202648.5220-4-jcline@redhat.com
Link: https://gitlab.freedesktop.org/drm/nouveau/-/merge_requests/14
__register_blkdev() is used to register a probe callback, and
that callback is typically used to call add_disk(). Now that
we are able to capture errors for add_disk(), we need to fix
those probe calls where add_disk() fails and clean up resources.
We don't extend the probe call to return the error given:
1) we'd have to always special-case the case where the disk
was already present, as otherwise concurrent requests to
open an existing block device would fail, and this would be
a userspace visible change
2) the error from ilookup() on blkdev_get_no_open() is sufficient
3) The only thing the probe call is used for is to support
pre-devtmpfs, pre-udev semantics that want to create disks when
their pre-created device node is accessed, and so we don't care
for failures on probe there.
Expand documentation for the probe callback to ensure users cleanup
resources if add_disk() is used and to clarify this interface may be
removed in the future.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Link: https://lore.kernel.org/r/20211103230437.1639990-12-mcgrof@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Commit bf9c0538e4 ("ataflop: use a separate gendisk for each media
format") introduced ataflop_probe_lock mutex, but forgot to unlock the
mutex when atari_floppy_init() (i.e. module loading) succeeded. This will
result in double lock deadlock if ataflop_probe() is called. Also,
unregister_blkdev() must not be called from atari_floppy_init() with
ataflop_probe_lock held when atari_floppy_init() failed, for
ataflop_probe() waits for ataflop_probe_lock with major_names_lock held
(i.e. AB-BA deadlock).
__register_blkdev() needs to be called last in order to avoid calling
ataflop_probe() when atari_floppy_init() is about to fail, for memory for
completing already-started ataflop_probe() safely will be released as soon
as atari_floppy_init() released ataflop_probe_lock mutex.
As with commit 8b52d8be86 ("loop: reorder loop_exit"),
unregister_blkdev() needs to be called first in order to avoid calling
ataflop_alloc_disk() from ataflop_probe() after del_gendisk() from
atari_floppy_exit().
By relocating __register_blkdev() / unregister_blkdev() as explained above,
we can remove ataflop_probe_lock mutex, for probe function and __exit
function are serialized by major_names_lock mutex.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: bf9c0538e4 ("ataflop: use a separate gendisk for each media format")
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Tested-by: Michael Schmitz <schmitzmic@gmail.com>
Link: https://lore.kernel.org/r/20211103230437.1639990-11-mcgrof@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
We never checked for errors on add_disk() as this function
returned void. Now that this is fixed, use the shiny new
error handling.
Since nvdimm/blk uses devm we just need to move the devm
registration towards the end. And in hindsight, that seems
to also provide a fix given del_gendisk() should not be
called unless the disk was already added via add_disk().
The probably of that issue happening is low though, like
OOM while calling devm_add_action(), so the fix is minor.
We manually unwind in case of add_disk() failure prior
to the devm registration.
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Link: https://lore.kernel.org/r/20211103230437.1639990-5-mcgrof@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
If nd_integrity_init() fails we'd get del_gendisk() called,
but that's not correct as we should only call that if we're
done with device_add_disk(). Fix this by providing unwinding
prior to the devm call being registered and moving the devm
registration to the very end.
This should fix calling del_gendisk() if nd_integrity_init()
fails. I only spotted this issue through code inspection. It
does not fix any real world bug.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Link: https://lore.kernel.org/r/20211103230437.1639990-4-mcgrof@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Nouveau does not currently support hot-unplugging, but it still makes
sense to switch from drm_dev_unregister() to drm_dev_unplug().
drm_dev_unplug() calls drm_dev_unregister() after marking the device as
unplugged, but only after any device critical sections are finished.
Since nouveau isn't using drm_dev_enter() and drm_dev_exit(), there are
no critical sections so this is nearly functionally equivalent. However,
the DRM layer does check to see if the device is unplugged, and if it is
returns appropriate error codes.
In the future nouveau can add critical sections in order to truly
support hot-unplugging.
Cc: stable@vger.kernel.org # 5.4+
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
Tested-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201125202648.5220-2-jcline@redhat.com
Link: https://gitlab.freedesktop.org/drm/nouveau/-/merge_requests/14
Extending these flags using the existing (1 << x) pattern triggers
complaints from checkpatch. Instead of ignoring checkpatch modify the
existing values to use BIT(x) style in a separate commit.
Signed-off-by: Leonard Crestez <cdleonard@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Explicitly pass -6 to netcat when the test is using IPv6 to prevent
failures.
Also make sure to pass "-N" to netcat to close the socket after EOF on
the client side, otherwise we would always hit the timeout and the test
would fail.
Without this fix applied:
TEST: GREv6/v4 - copy file w/ TSO [FAIL]
TEST: GREv6/v4 - copy file w/ GSO [FAIL]
TEST: GREv6/v6 - copy file w/ TSO [FAIL]
TEST: GREv6/v6 - copy file w/ GSO [FAIL]
With this fix applied:
TEST: GREv6/v4 - copy file w/ TSO [ OK ]
TEST: GREv6/v4 - copy file w/ GSO [ OK ]
TEST: GREv6/v6 - copy file w/ TSO [ OK ]
TEST: GREv6/v6 - copy file w/ GSO [ OK ]
Fixes: 025efa0a82 ("selftests: add simple GSO GRE test")
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
In commit 2214c0e772 ("parisc: Move thread_info into task struct")
PA-RISC gained support for THREAD_INFO_IN_TASK while changes were
already underway to keep the CPU field in thread_info rather than move
it into task_struct when THREAD_INFO_IN_TASK is enabled. The result is a
broken build for all PA-RISC configs that enable SMP.
So let's partially revert that commit, and get rid of the ugly hack to
get at the offset of task_struct::cpu without having to include
linux/sched.h, and put the CPU field back where it was before.
Reported-by: Guenter Roeck <linux@roeck-us.net>
Fixes: bcf9033e54 ("sched: move CPU field back into thread_info if THREAD_INFO_IN_TASK=y")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
I no longer think interrupts can be disabled in the futex and cmpxchg
operations because of COW breaks. This not ideal but I suspect it's the
best we can do.
For the cmpxchg operations in syscall.S, we rely on the code to not
schedule off the gateway page. For the futex, I added code to disable
preemption.
So far, I haven't seen the warnings with the attached change but the
change is only lightly tested.
Signed-off-by: Dave Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
If the previous context had interrupts disabled, we should better
keep them disabled. This was noticed in the unwinding code where
a copy_from_kernel_nofault() triggered a page fault, and after
the fixup by the page fault handler interrupts where suddenly
enabled.
Signed-off-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Syzbot triggered the following warning in ovl_workdir_create() ->
ovl_create_real():
if (!err && WARN_ON(!newdentry->d_inode)) {
The reason is that the cgroup2 filesystem returns from mkdir without
instantiating the new dentry.
Weird filesystems such as this will be rejected by overlayfs at a later
stage during setup, but to prevent such a warning, call ovl_mkdir_real()
directly from ovl_workdir_create() and reject this case early.
Reported-and-tested-by: syzbot+75eab84fd0af9e8bf66b@syzkaller.appspotmail.com
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Pull clk updates from Stephen Boyd:
"The usual collection of clk driver updates and new driver additions.
In terms of lines it's mainly Qualcomm and Mediatek code, supporting
various SoCs and their multitude of clk controllers.
New Drivers:
- GCC and RPMcc support for Qualcomm QCM2290 SoCs
- GCC support for Qualcomm MSM8994/MSM8992 SoCs
- LPASSCC and CAMCC support for Qualcomm SC7280 SoCs
- Support for Mediatek MT8195 SoCs
- Initial clock driver for the Exynos850 SoC
- Add i.MX8ULP clock driver and related bindings
Updates:
- Clock power management for new SAMA7G5 SoC
- Updates to the master clock driver and sam9x60-pll to be able to
use cpufreq-dt driver and avoid overclocking of CPU and MCK0
domains while changing the frequency via DVFS
- Use ARRAY_SIZE in qcom clk drivers
- Remove some impractical fallback parent names in qcom clk drivers
- Make Mediatek clk drivers tristate
- Refactoring of the CPU clock code and conversion of Samsung
Exynos5433 CPU clock driver to the platform driver
- A few conversions to devm_platform_ioremap_resource()
- Updates of the Samsung Kconfig help text
- Update video path realted clocks for Amlogic meson8
- Add SPI Multi I/O Bus and SDHI clocks and resets on Renesas RZ/G2L
- Add SPI Multi I/O Bus (RPC) clocks on Renesas R-Car V3U
- Add MediaLB clocks on Renesas R-Car H3, M3-W/W+, and M3-N
- Remove unused helpers from i.MX specific clock header
- Rework all i.MX clk based helpers to use clk_hw based ones
- Rework i.MX gate/mux/divider wrappers
- Rework imx_clk_hw_composite and imx_clk_hw_pll14xx wrappers
- Update i.MX pllv4 and composite clocks to support i.MX8ULP
- Disable i.MX7ULP composite clock during initialization
- Add CLK_SET_RATE_NO_REPARENT flag to the i.MX7ULP composite
- Disable the i.MX pfd when set pfdv2 clock rate
- Add support for i.MX8ULP in pfdv2
- Add the pcc reset controller support on i.MX8ULP
- Fix the build break when clk-imx8ulp is built as module
- Move csi_sel mux to correct base register in i.MX6UL clock drivr
- Fix csi clk gate register in i.MX6UL clock driver
- Fix build bug making CLK_IMX8ULP select MXC_CLK
- Add TPU (PWM), and Z (Cortex-A76) clocks on Renesas R-Car V3U
- Add Ethernet clocks on Renesas RZ/G2L
- Move Rockchip to use module_platform_probe
- Enable usage of Coresight related clocks on Rockchip rk3399"
* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (170 commits)
clk: use clk_core_get_rate_recalc() in clk_rate_get()
clk: at91: sama7g5: set low limit for mck0 at 32KHz
clk: at91: sama7g5: remove prescaler part of master clock
clk: at91: clk-master: add notifier for divider
clk: at91: clk-sam9x60-pll: add notifier for div part of PLL
clk: at91: clk-master: fix prescaler logic
clk: at91: clk-master: mask mckr against layout->mask
clk: at91: clk-master: check if div or pres is zero
clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL
clk: at91: pmc: add sama7g5 to the list of available pmcs
clk: at91: clk-master: improve readability by using local variables
clk: at91: clk-master: add register definition for sama7g5's master clock
clk: at91: sama7g5: add securam's peripheral clock
clk: at91: pmc: execute suspend/resume only for backup mode
clk: at91: re-factor clocks suspend/resume
clk: ux500: Add driver for the reset portions of PRCC
dt-bindings: clock: u8500: Rewrite in YAML and extend
clk: composite: Use rate_ops.determine_rate when also a mux is available
clk: samsung: describe drivers in Kconfig
clk: samsung: exynos5433: update apollo and atlas clock probing
...
Move the soc revision parsing to the initial probe, saving the driver
from parsing the register multiple times.
Use this variable to select the correct divisor table for the AHB clock.
Before this fix the A2 would have used the A0 table.
Fixes: 2d491066cc ("clk: ast2600: Fix AHB clock divider for A1")
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20210922235449.213631-1-joel@jms.id.au
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
The spec recommends that for transfer length larger than the max-single-cmd
attribute (bMAX_DATA_SIZE_FOR_HPB_SINGLE_CMD) it is possible to couple
pre-requests with the HPB-READ command. Being a recommendation, using
pre-requests can be perceived merely as a means of optimization. A common
practice was to send pre-requests for chunks within some interval, and
leave the READ10 untouched if larger.
Now that the pre-request flows have been removed, all the commands are
single commands. Properly handle this attribute and do not send HPB-READ
for transfer lengths larger than max-single-cmd.
[mkp: resolve conflict]
Fixes: 09d9e4d041 ("scsi: ufs: ufshpb: Remove HPB2.0 flows")
Link: https://lore.kernel.org/r/20211031123654.17719-1-avri.altman@wdc.com
Reviewed-by: Daejun Park <daejun7.park@samsung.com>
Signed-off-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
The partial UFS revert in 5.15 is needed for some additional fixes in
the 5.16 SCSI tree. Merge the fixes branch.
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
The changes to issue the abort from the scmd->abort_work instead of the EH
thread introduced a problem if eh_deadline is used. If aborting the
command(s) is successful, and there are never any scmds added to the
shost->eh_cmd_q, there is no code path which will reset the ->last_reset
value back to zero.
The effect of this is that after a successful abort with no EH thread
activity, a subsequent timeout, perhaps a long time later, might
immediately be considered past a user-set eh_deadline time, and the host
will be reset with no attempt at recovery.
Fix this by resetting ->last_reset back to zero in scmd_eh_abort_handler()
if it is determined that the EH thread will not run to do this.
Thanks to Gopinath Marappan for investigating this problem.
Link: https://lore.kernel.org/r/20211029194311.17504-2-emilne@redhat.com
Fixes: e494f6a728 ("[SCSI] improved eh timeout handler")
Cc: stable@vger.kernel.org
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Pull ARM SoC driver updates from Arnd Bergmann:
"These are all the driver updates for SoC specific drivers. There are a
couple of subsystems with individual maintainers picking up their
patches here:
- The reset controller subsystem add support for a few new SoC
variants to existing drivers, along with other minor improvements
- The OP-TEE subsystem gets a driver for the ARM FF-A transport
- The memory controller subsystem has improvements for Tegra,
Mediatek, Renesas, Freescale and Broadcom specific drivers.
- The tegra cpuidle driver changes get merged through this tree this
time. There are only minor changes, but they depend on other tegra
driver updates here.
- The ep93xx platform finally moves to using the drivers/clk/
subsystem, moving the code out of arch/arm in the process. This
depends on a small sound driver change that is included here as
well.
- There are some minor updates for Qualcomm and Tegra specific
firmware drivers.
The other driver updates are mainly for drivers/soc, which contains a
mixture of vendor specific drivers that don't really fit elsewhere:
- Mediatek drivers gain more support for MT8192, with new support for
hw-mutex and mmsys routing, plus support for reset lines in the
mmsys driver.
- Qualcomm gains a new "sleep stats" driver, and support for the
"Generic Packet Router" in the APR driver.
- There is a new user interface for routing the UARTS on ASpeed BMCs,
something that apparently nobody else has needed so far.
- More drivers can now be built as loadable modules, in particular
for Broadcom and Samsung platforms.
- Lots of improvements to the TI sysc driver for better
suspend/resume support"
Finally, there are lots of minor cleanups and new device IDs for
amlogic, renesas, tegra, qualcomm, mediateka, samsung, imx,
layerscape, allwinner, broadcom, and omap"
* tag 'drivers-5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (179 commits)
optee: Fix spelling mistake "reclain" -> "reclaim"
Revert "firmware: qcom: scm: Add support for MC boot address API"
qcom: spm: allow compile-testing
firmware: arm_ffa: Remove unused 'compat_version' variable
soc: samsung: exynos-chipid: add exynosautov9 SoC support
firmware: qcom: scm: Don't break compile test on non-ARM platforms
soc: qcom: smp2p: Add of_node_put() before goto
soc: qcom: apr: Add of_node_put() before return
soc: qcom: qcom_stats: Fix client votes offset
soc: qcom: rpmhpd: fix sm8350_mxc's peer domain
dt-bindings: arm: cpus: Document qcom,msm8916-smp enable-method
ARM: qcom: Add qcom,msm8916-smp enable-method identical to MSM8226
firmware: qcom: scm: Add support for MC boot address API
soc: qcom: spm: Add 8916 SPM register data
dt-bindings: soc: qcom: spm: Document qcom,msm8916-saw2-v3.0-cpu
soc: qcom: socinfo: Add PM8150C and SMB2351 models
firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available()
soc: aspeed: Add UART routing support
soc: fsl: dpio: rename the enqueue descriptor variable
soc: fsl: dpio: use an explicit NULL instead of 0
...
Pull ARM SoC DT updates from Arnd Bergmann:
"This is a rather large update for the ARM devicetree files, after a
few quieter releases, with 775 total commits and 47 branches pulled
into this one.
There are 5 new SoC types plus some minor variations, and a total of
60 new machines, so I'm limiting the summary to the main noteworthy
items:
- Apple M1 gain support for PCI and pinctrl, getting a bit closer to
a usable system out of the box.
- Qualcomm gains support for Snapdragon 690 (aka SM6350) as well as
SM7225, 11 new smartphones, and three additional Chromebooks, and
improvements all over the place.
- Samsung gains support for ExynosAutov9, an automotive version of
their smartphone SoC, but otherwise no major changes.
- Microchip adds the SAMA5D29 SoC in the SAMA5 family, and a number
of improvements for the recently added SAMA7 family. The LAN966 SoC
that was added in the platform code does not have dts files yet.
Two board files are added for the older at91sam9g20 SoC
- Aspeed supports two additional server boards using their AST2600 as
BMC, and improves support for qemu models
- Rockchip RK3566/RK3688 gets added, along with six new development
boards using RK3328/RK3399/RK3566, and one Chromebook tablet.
- Two NAS boxes are added using the ARMv4 based Gemini platform
- One new board is added to the Intel Arria SoC FPGA family
- Marvell adds one network switch based on Armada 381 and the new
MOCHAbin 7040 development board
- NXP adds support for the S32G2 automotive SoC, two imx6 based ebook
readers, and three additional development boards, which is notably
less than their usual additions, but they also gain improvements to
their many existing boards
- STmicroelectronics adds their stm32mp13 SoC family along with a
reference board
- Renesas adds new versions of their R-Car Gen3 SoCs and many updates
for their older generations
- Broadcom adds support for a number of Cisco Meraki wireless
controllers, along with two new boards and other updates for
BCM53xx/BCM47xx networking SoCs and the Raspberry Pi boards
- Mediatek improves support for the MT81xx SoCs used in Chromebooks
as well as the MT76xx networking SoCs
- NVIDIA adds a number of cleanups and additional support for more
hardware on the already supported machines
- TI K3 adds support for three new boards along with cleanups
- Toshiba adds one board for the Visconti family
- Xilinx adds five new ZynqMP based machines
- Amlogic support is added for the Radxa Zero and two Jethub home
automation controllers, along with changes to other machines
- Rob Herring continues his work on fixing dtc warnings all over the
tree.
- Minor updates for TI OMAP, Mstar, Allwinner/sunxi, Hisilicon,
Ux500, Unisoc"
* tag 'dt-5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (720 commits)
arm64: dts: apple: j274: Expose PCI node for the Ethernet MAC address
arm64: dts: apple: t8103: Add root port interrupt routing
arm64: dts: apple: t8103: Add PCIe DARTs
arm64: apple: Add PCIe node
arm64: apple: Add pinctrl nodes
ARM: dts: arm: Update ICST clock nodes 'reg' and node names
ARM: dts: arm: Update register-bit-led nodes 'reg' and node names
arm64: dts: exynos: add chipid node for exynosautov9 SoC
ARM: dts: qcom: fix typo in IPQ8064 thermal-sensor node
Revert "arm64: dts: qcom: msm8916-asus-z00l: Add sensors"
arm64: dts: qcom: ipq6018: Remove unused 'iface_clk' property from dma-controller node
arm64: dts: qcom: ipq6018: Remove unused 'qcom,config-pipe-trust-reg' property
arm64: dts: qcom: sm8350: Add CPU topology and idle-states
arm64: dts: qcom: Drop unneeded extra device-specific includes
arm64: dts: qcom: msm8916: Drop standalone smem node
arm64: dts: qcom: Fix node name of rpm-msg-ram device nodes
arm64: dts: qcom: msm8916-asus-z00l: Add sensors
arm64: dts: qcom: msm8916-asus-z00l: Add SDCard
arm64: dts: qcom: msm8916-asus-z00l: Add touchscreen
arm64: dts: qcom: sdm845-oneplus: remove devinfo-size from ramoops node
...
Pull ARM SoC updates from Arnd Bergmann:
"The SoC updates this time are mainly removing obsolete code from the
OMAP2 platform, another step in the eternal cleanup of that platform.
There are two new SoCs getting added: STMicroelectronics stm32mp13 and
Microchip lan966. Both fit into existing platforms and require minimal
changes here.
A couple of MAINTAINER file updates relate to those changes, and
update some file paths"
* tag 'soc-5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (28 commits)
MAINTAINERS: Update BCM7XXX entry with additional patterns
MAINTAINERS: add pinctrl-apple-gpio to ARM/APPLE MACHINE
MAINTAINERS: Add pasemi i2c to ARM/APPLE MACHINE
ARM: SPEAr: Update MAINTAINERS entries
ARM: OMAP2+: Drop unused CM defines for am3
ARM: OMAP2+: Drop unused CM and SCRM defines for omap4
ARM: OMAP2+: Drop unused CM and SCRM defines for omap5
ARM: OMAP2+: Drop unused CM defines for dra7
ARM: OMAP2+: Drop unused PRM defines for am3
ARM: OMAP2+: Drop unused PRM defines for am4
ARM: OMAP2+: Drop unused PRM defines for omap4
ARM: OMAP2+: Drop unused PRM defines for omap5
ARM: OMAP2+: Drop unused PRM defines for dra7
ARM: OMAP2+: Fix comment typo
ARM: OMAP2+: Fix typo in some comments
ARM: at91: add basic support for new SoC family lan966
dt-bindings: arm: at91: Document lan966 pcb8291 and pcb8290 boards
ARM: at91: Documentation: add lan966 family
ARM: at91: Documentation: add sama7g5 family
MAINTAINERS: add an entry for NXP S32G boards
...
The code which constructs the modules for each engine present on the GPU
passes -1 for 'instance' on non-instanced engines, which affects how the
name for a sub-device is generated. This is then stored as 'instance 0'
in nvkm_subdev.inst, so code can potentially be shared with earlier GPUs
that only had a single instance of an engine.
However, GF100's CE constructor uses this value to calculate the address
of its falcon before it's translated, resulting in CE0 getting the wrong
address.
This slightly modifies the approach, always passing a valid instance for
engines that *can* have multiple copies, and having the code for earlier
GPUs explicitly ask for non-instanced name generation.
Bug: https://gitlab.freedesktop.org/drm/nouveau/-/issues/91
Fixes: 50551b15c7 ("drm/nouveau/ce: switch to instanced constructor")
Cc: <stable@vger.kernel.org> # v5.12+
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Reviewed-by: Karol Herbst <kherbst@redhat.com>
Tested-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211103011057.15344-1-skeggsb@gmail.com
Make use of the struct_size() helper instead of an open-coded version,
in order to avoid any potential type mistakes or integer overflows that,
in the worse scenario, could lead to heap overflows.
Link: https://github.com/KSPP/linux/issues/160
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Pull virtio updates from Michael Tsirkin:
"vhost and virtio fixes and features:
- Hardening work by Jason
- vdpa driver for Alibaba ENI
- Performance tweaks for virtio blk
- virtio rng rework using an internal buffer
- mac/mtu programming for mlx5 vdpa
- Misc fixes, cleanups"
* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (45 commits)
vdpa/mlx5: Forward only packets with allowed MAC address
vdpa/mlx5: Support configuration of MAC
vdpa/mlx5: Fix clearing of VIRTIO_NET_F_MAC feature bit
vdpa_sim_net: Enable user to set mac address and mtu
vdpa: Enable user to set mac and mtu of vdpa device
vdpa: Use kernel coding style for structure comments
vdpa: Introduce query of device config layout
vdpa: Introduce and use vdpa device get, set config helpers
virtio-scsi: don't let virtio core to validate used buffer length
virtio-blk: don't let virtio core to validate used length
virtio-net: don't let virtio core to validate used length
virtio_ring: validate used buffer length
virtio_blk: correct types for status handling
virtio_blk: allow 0 as num_request_queues
i2c: virtio: Add support for zero-length requests
virtio-blk: fixup coccinelle warnings
virtio_ring: fix typos in vring_desc_extra
virtio-pci: harden INTX interrupts
virtio_pci: harden MSI-X interrupts
virtio_config: introduce a new .enable_cbs method
...
tl;dr: AMX state is ~8k. Signal frames can have space for this
~8k and each signal entry writes out all 8k even if it is zeros.
Skip writing zeros for AMX to speed up signal delivery by about
4% overall when AMX is in its init state.
This is a user-visible change to the sigframe ABI.
== Hardware XSAVE Background ==
XSAVE state components may be tracked by the processor as being
in their initial configuration. Software can detect which
features are in this configuration by looking at the XSTATE_BV
field in an XSAVE buffer or with the XGETBV(1) instruction.
Both the XSAVE and XSAVEOPT instructions enumerate features s
being in the initial configuration via the XSTATE_BV field in the
XSAVE header, However, XSAVEOPT declines to actually write
features in their initial configuration to the buffer. XSAVE
writes the feature unconditionally, regardless of whether it is
in the initial configuration or not.
Basically, XSAVE users never need to inspect XSTATE_BV to
determine if the feature has been written to the buffer.
XSAVEOPT users *do* need to inspect XSTATE_BV. They might also
need to clear out the buffer if they want to make an isolated
change to the state, like modifying one register.
== Software Signal / XSAVE Background ==
Signal frames have historically been written with XSAVE itself.
Each state is written in its entirety, regardless of being in its
initial configuration.
In other words, the signal frame ABI uses the XSAVE behavior, not
the XSAVEOPT behavior.
== Problem ==
This means that any application which has acquired permission to
use AMX via ARCH_REQ_XCOMP_PERM will write 8k of state to the
signal frame. This 8k write will occur even when AMX was in its
initial configuration and software *knows* this because of
XSTATE_BV.
This problem also exists to a lesser degree with AVX-512 and its
2k of state. However, AVX-512 use does not require
ARCH_REQ_XCOMP_PERM and is more likely to have existing users
which would be impacted by any change in behavior.
== Solution ==
Stop writing out AMX xfeatures which are in their initial state
to the signal frame. This effectively makes the signal frame
XSAVE buffer look as if it were written with a combination of
XSAVEOPT and XSAVE behavior. Userspace which handles XSAVEOPT-
style buffers should be able to handle this naturally.
For now, include only the AMX xfeatures: XTILE and XTILEDATA in
this new behavior. These require new ABI to use anyway, which
makes their users very unlikely to be broken. This XSAVEOPT-like
behavior should be expected for all future dynamic xfeatures. It
may also be extended to legacy features like AVX-512 in the
future.
Only attempt this optimization on systems with dynamic features.
Disable dynamic feature support (XFD) if XGETBV1 is unavailable
by adding a CPUID dependency.
This has been measured to reduce the *overall* cycle cost of
signal delivery by about 4%.
Fixes: 2308ee57d9 ("x86/fpu/amx: Enable the AMX feature in 64-bit mode")
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: "Chang S. Bae" <chang.seok.bae@intel.com>
Link: https://lore.kernel.org/r/20211102224750.FA412E26@davehans-spike.ostc.intel.com
Pull VFIO updates from Alex Williamson:
- Cleanup vfio iommu_group creation (Christoph Hellwig)
- Add individual device reset for vfio/fsl-mc (Diana Craciun)
- IGD OpRegion 2.0+ support (Colin Xu)
- Use modern cdev lifecycle for vfio_group (Jason Gunthorpe)
- Use new mdev API in vfio_ccw (Jason Gunthorpe)
* tag 'vfio-v5.16-rc1' of git://github.com/awilliam/linux-vfio: (27 commits)
vfio/ccw: Convert to use vfio_register_emulated_iommu_dev()
vfio/ccw: Pass vfio_ccw_private not mdev_device to various functions
vfio/ccw: Use functions for alloc/free of the vfio_ccw_private
vfio/ccw: Remove unneeded GFP_DMA
vfio: Use cdev_device_add() instead of device_create()
vfio: Use a refcount_t instead of a kref in the vfio_group
vfio: Don't leak a group reference if the group already exists
vfio: Do not open code the group list search in vfio_create_group()
vfio: Delete vfio_get/put_group from vfio_iommu_group_notifier()
vfio/pci: Add OpRegion 2.0+ Extended VBT support.
vfio/iommu_type1: remove IS_IOMMU_CAP_DOMAIN_IN_CONTAINER
vfio/iommu_type1: remove the "external" domain
vfio/iommu_type1: initialize pgsize_bitmap in ->open
vfio/spapr_tce: reject mediated devices
vfio: clean up the check for mediated device in vfio_iommu_type1
vfio: remove the unused mdev iommu hook
vfio: move the vfio_iommu_driver_ops interface out of <linux/vfio.h>
vfio: remove unused method from vfio_iommu_driver_ops
vfio: simplify iommu group allocation for mediated devices
vfio: remove the iommudata hack for noiommu groups
...
