14 Nov, 2018

33 commits

  • [ Upstream commit 0ed149cf5239cc6e7e65bf00f769e8f1e91076c0 ]

    The size of the resulting cpu map can be smaller than a multiple of
    sizeof(u64), resulting in SIGBUS on cpus like Sparc as the next event
    will not be aligned properly.

    Signed-off-by: David S. Miller
    Cc: Jiri Olsa
    Cc: Kan Liang
    Fixes: 6c872901af07 ("perf cpu_map: Add cpu_map event synthesize function")
    Link: http://lkml.kernel.org/r/20181011.224655.716771175766946817.davem@davemloft.net
    Signed-off-by: Arnaldo Carvalho de Melo
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    David Miller
     
  • [ Upstream commit 36b8d4628d3cc8f5a748e508cce8673bc00fc63c ]

    When a build is run from something like a cron job, the user's $PATH is
    rather minimal, of note, not including /usr/sbin in my own case. Because
    of that, an automated rpm package build ultimately fails to find
    libperf-jvmti.so, because somewhere within the build, this happens...

    /bin/sh: alternatives: command not found
    /bin/sh: alternatives: command not found
    Makefile.config:849: No openjdk development package found, please install
    JDK package, e.g. openjdk-8-jdk, java-1.8.0-openjdk-devel

    ...and while the build continues, libperf-jvmti.so isn't built, and
    things fall down when rpm tries to find all the %files specified. Exact
    same system builds everything just fine when the job is launched from a
    login shell instead of a cron job, since alternatives is in $PATH, so
    openjdk is actually found.

    The test required to get into this section of code actually specifies
    the full path, as does a block just above it, so let's do that here too.

    Signed-off-by: Jarod Wilson
    Acked-by: Jiri Olsa
    Cc: Alexander Shishkin
    Cc: Namhyung Kim
    Cc: Peter Zijlstra
    Cc: Stephane Eranian
    Cc: William Cohen
    Fixes: d4dfdf00d43e ("perf jvmti: Plug compilation into perf build")
    Link: http://lkml.kernel.org/r/20180906221812.11167-1-jarod@redhat.com
    Signed-off-by: Arnaldo Carvalho de Melo
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Jarod Wilson
     
  • [ Upstream commit 9845c49cc9bbb317a0bc9e9cf78d8e09d54c9af0 ]

    The comment and the code around the update_min_vruntime() call in
    dequeue_entity() are not in agreement.

    >From commit:

    b60205c7c558 ("sched/fair: Fix min_vruntime tracking")

    I think that we want to update min_vruntime when a task is sleeping/migrating.
    So, the check is inverted there - fix it.

    Signed-off-by: Song Muchun
    Cc: Linus Torvalds
    Cc: Mike Galbraith
    Cc: Peter Zijlstra
    Cc: Thomas Gleixner
    Fixes: b60205c7c558 ("sched/fair: Fix min_vruntime tracking")
    Link: http://lkml.kernel.org/r/20181014112612.2614-1-smuchun@gmail.com
    Signed-off-by: Ingo Molnar
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Song Muchun
     
  • [ Upstream commit b3e1eb8e7ac9aaa283989496651d99267c4cad6c ]

    So that when it is unset, ie. '-1', userspace can see it
    properly.

    Signed-off-by: David S. Miller
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    David S. Miller
     
  • [ Upstream commit 455adb3174d2c8518cef1a61140c211f6ac224d2 ]

    Like x86 and arm, call perf_sample_event_took() in perf event
    NMI interrupt handler.

    Signed-off-by: David S. Miller
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    David S. Miller
     
  • [ Upstream commit cfdc3170d214046b9509183fe9b9544dc644d40b ]

    It is important to clear the hw->state value for non-stopped events
    when they are added into the PMU. Otherwise when the event is
    scheduled out, we won't read the counter because HES_UPTODATE is still
    set. This breaks 'perf stat' and similar use cases, causing all the
    events to show zero.

    This worked for multi-pcr because we make explicit sparc_pmu_start()
    calls in calculate_multiple_pcrs(). calculate_single_pcr() doesn't do
    this because the idea there is to accumulate all of the counter
    settings into the single pcr value. So we have to add explicit
    hw->state handling there.

    Like x86, we use the PERF_HES_ARCH bit to track truly stopped events
    so that we don't accidently start them on a reload.

    Related to all of this, sparc_pmu_start() is missing a userpage update
    so add it.

    Signed-off-by: David S. Miller
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    David S. Miller
     
  • [ Upstream commit 94aafb74cee0002e2f2eb6dc5376f54d5951ab4d ]

    Michael reported that he could not stat following event:

    $ perf stat -e unc_p_freq_ge_1200mhz_cycles -a -- ls
    event syntax error: '..e_1200mhz_cycles'
    \___ value too big for format, maximum is 255
    Run 'perf list' for a list of valid events

    The event is unwrapped into:

    uncore_pcu/event=0xb,filter_band0=1200/

    where filter_band0 format says it's one byte only:

    # cat uncore_pcu/format/filter_band0
    config1:0-7

    while JSON files specifies bigger number:

    "Filter": "filter_band0=1200",

    all the filter_band* formats show 1 byte width:

    # cat uncore_pcu/format/filter_band1
    config1:8-15
    # cat uncore_pcu/format/filter_band2
    config1:16-23
    # cat uncore_pcu/format/filter_band3
    config1:24-31

    The reason of the issue is that filter_band* values are supposed to be
    in 100Mhz units.. it's stated in the JSON help for the events, like:

    filter_band3=XXX, with XXX in 100Mhz units

    This patch divides the filter_band* values by 100, plus there's couple
    of changes that actually change the number completely, like:

    - "Filter": "edge=1,filter_band2=4000",
    + "Filter": "edge=1,filter_band2=30",

    Reported-by: Michael Petlan
    Signed-off-by: Jiri Olsa
    Acked-by: Andi Kleen
    Cc: Alexander Shishkin
    Cc: Kan Liang
    Cc: Namhyung Kim
    Cc: Peter Zijlstra
    Link: http://lkml.kernel.org/r/20181010080339.GB15790@krava
    Signed-off-by: Arnaldo Carvalho de Melo
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Jiri Olsa
     
  • [ Upstream commit 9dffff200fd178f11dd50eb1fd8ccd0650c9284e ]

    bydst table/list lookups use rcu, so insertions must use rcu versions.

    Fixes: a7c44247f704e ("xfrm: policy: make xfrm_policy_lookup_bytype lockless")
    Signed-off-by: Florian Westphal
    Signed-off-by: Steffen Klassert
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Florian Westphal
     
  • [ Upstream commit 1b9caa10b31dda0866f4028e4bfb923fb6e4072f ]

    This reverts commit ac0e2cd555373ae6f8f3a3ad3fbbf5b6d1e7aaaa.

    Michael reported an issue with oversized terms values assignment
    and I noticed there was actually a misunderstanding of the max
    value check in the past.

    The above commit's changelog says:

    If bit 21 is set, there is parsing issues as below.

    $ perf stat -a -e uncore_qpi_0/event=0x200002,umask=0x8/
    event syntax error: '..pi_0/event=0x200002,umask=0x8/'
    \___ value too big for format, maximum is 511

    But there's no issue there, because the event value is distributed
    along the value defined by the format. Even if the format defines
    separated bit, the value is treated as a continual number, which
    should follow the format definition.

    In above case it's 9-bit value with last bit separated:
    $ cat uncore_qpi_0/format/event
    config:0-7,21

    Hence the value 0x200002 is correctly reported as format violation,
    because it exceeds 9 bits. It should have been 0x102 instead, which
    sets the 9th bit - the bit 21 of the format.

    $ perf stat -vv -a -e uncore_qpi_0/event=0x102,umask=0x8/
    Using CPUID GenuineIntel-6-2D
    ...
    ------------------------------------------------------------
    perf_event_attr:
    type 10
    size 112
    config 0x200802
    sample_type IDENTIFIER
    ...

    Reported-by: Michael Petlan
    Signed-off-by: Jiri Olsa
    Cc: Alexander Shishkin
    Cc: Andi Kleen
    Cc: Kan Liang
    Cc: Namhyung Kim
    Cc: Peter Zijlstra
    Fixes: ac0e2cd55537 ("perf tools: Fix PMU term format max value calculation")
    Link: http://lkml.kernel.org/r/20181003072046.29276-1-jolsa@kernel.org
    Signed-off-by: Arnaldo Carvalho de Melo
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Jiri Olsa
     
  • [ Upstream commit 262f9d811c7608f1e74258ceecfe1fa213bdf912 ]

    If the current process has unlimited RLIMIT_MEMLOCK,
    we should should leave it as is.

    Fixes: 941ff6f11c02 ("bpf: fix rlimit in reuseport net selftest")
    Signed-off-by: John Sperbeck
    Signed-off-by: Eric Dumazet
    Acked-by: Daniel Borkmann
    Signed-off-by: Daniel Borkmann
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Eric Dumazet
     
  • commit f5e758b8358f6c27e8a351ddf0b441a64cdabb94 upstream.

    PMIC_IRQB and PMIC_KEYINB lines on Exynos4210-based Origen board have
    external pull-up resistors, so disable any pull control for those lines
    in respective pin controller node. This fixes support for MAX8997
    interrupts and enables operation of wakeup from MAX8997 RTC alarm.

    Signed-off-by: Marek Szyprowski
    Fixes: 17419726aaa1 ("ARM: dts: add max8997 device node for exynos4210-origen board")
    Cc:
    Signed-off-by: Krzysztof Kozlowski
    Signed-off-by: Greg Kroah-Hartman

    Marek Szyprowski
     
  • commit 706d51681d636a0c4a5ef53395ec3b803e45ed4d upstream.

    Future Intel processors will support "Enhanced IBRS" which is an "always
    on" mode i.e. IBRS bit in SPEC_CTRL MSR is enabled once and never
    disabled.

    From the specification [1]:

    "With enhanced IBRS, the predicted targets of indirect branches
    executed cannot be controlled by software that was executed in a less
    privileged predictor mode or on another logical processor. As a
    result, software operating on a processor with enhanced IBRS need not
    use WRMSR to set IA32_SPEC_CTRL.IBRS after every transition to a more
    privileged predictor mode. Software can isolate predictor modes
    effectively simply by setting the bit once. Software need not disable
    enhanced IBRS prior to entering a sleep state such as MWAIT or HLT."

    If Enhanced IBRS is supported by the processor then use it as the
    preferred spectre v2 mitigation mechanism instead of Retpoline. Intel's
    Retpoline white paper [2] states:

    "Retpoline is known to be an effective branch target injection (Spectre
    variant 2) mitigation on Intel processors belonging to family 6
    (enumerated by the CPUID instruction) that do not have support for
    enhanced IBRS. On processors that support enhanced IBRS, it should be
    used for mitigation instead of retpoline."

    The reason why Enhanced IBRS is the recommended mitigation on processors
    which support it is that these processors also support CET which
    provides a defense against ROP attacks. Retpoline is very similar to ROP
    techniques and might trigger false positives in the CET defense.

    If Enhanced IBRS is selected as the mitigation technique for spectre v2,
    the IBRS bit in SPEC_CTRL MSR is set once at boot time and never
    cleared. Kernel also has to make sure that IBRS bit remains set after
    VMEXIT because the guest might have cleared the bit. This is already
    covered by the existing x86_spec_ctrl_set_guest() and
    x86_spec_ctrl_restore_host() speculation control functions.

    Enhanced IBRS still requires IBPB for full mitigation.

    [1] Speculative-Execution-Side-Channel-Mitigations.pdf
    [2] Retpoline-A-Branch-Target-Injection-Mitigation.pdf
    Both documents are available at:
    https://bugzilla.kernel.org/show_bug.cgi?id=199511

    Originally-by: David Woodhouse
    Signed-off-by: Sai Praneeth Prakhya
    Signed-off-by: Thomas Gleixner
    Cc: Tim C Chen
    Cc: Dave Hansen
    Cc: Ravi Shankar
    Link: https://lkml.kernel.org/r/1533148945-24095-1-git-send-email-sai.praneeth.prakhya@intel.com
    Signed-off-by: Greg Kroah-Hartman

    Sai Praneeth
     
  • commit f77084d96355f5fba8e2c1fb3a51a393b1570de7 upstream.

    The WARN_ON_ONCE(__read_cr3() != build_cr3()) in switch_mm_irqs_off()
    triggers every once in a while during a snapshotted system upgrade.

    The warning triggers since commit decab0888e6e ("x86/mm: Remove
    preempt_disable/enable() from __native_flush_tlb()"). The callchain is:

    get_page_from_freelist() -> post_alloc_hook() -> __kernel_map_pages()

    with CONFIG_DEBUG_PAGEALLOC enabled.

    Disable preemption during CR3 reset / __flush_tlb_all() and add a comment
    why preemption has to be disabled so it won't be removed accidentaly.

    Add another preemptible() check in __flush_tlb_all() to catch callers with
    enabled preemption when PGE is enabled, because PGE enabled does not
    trigger the warning in __native_flush_tlb(). Suggested by Andy Lutomirski.

    Fixes: decab0888e6e ("x86/mm: Remove preempt_disable/enable() from __native_flush_tlb()")
    Signed-off-by: Sebastian Andrzej Siewior
    Signed-off-by: Thomas Gleixner
    Cc: Andy Lutomirski
    Cc: Dave Hansen
    Cc: Peter Zijlstra
    Cc: Borislav Petkov
    Cc: stable@vger.kernel.org
    Link: https://lkml.kernel.org/r/20181017103432.zgv46nlu3hc7k4rq@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Sebastian Andrzej Siewior
     
  • …thout value is provided

    commit ccde460b9ae5c2bd5e4742af0a7f623c2daad566 upstream.

    memory_corruption_check[{_period|_size}]()'s handlers do not check input
    argument before passing it to kstrtoul() or simple_strtoull(). The argument
    would be a NULL pointer if each of the kernel parameters, without its
    value, is set in command line and thus cause the following panic.

    PANIC: early exception 0xe3 IP 10:ffffffff73587c22 error 0 cr2 0x0
    [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.18-rc8+ #2
    [ 0.000000] RIP: 0010:kstrtoull+0x2/0x10
    ...
    [ 0.000000] Call Trace
    [ 0.000000] ? set_corruption_check+0x21/0x49
    [ 0.000000] ? do_early_param+0x4d/0x82
    [ 0.000000] ? parse_args+0x212/0x330
    [ 0.000000] ? rdinit_setup+0x26/0x26
    [ 0.000000] ? parse_early_options+0x20/0x23
    [ 0.000000] ? rdinit_setup+0x26/0x26
    [ 0.000000] ? parse_early_param+0x2d/0x39
    [ 0.000000] ? setup_arch+0x2f7/0xbf4
    [ 0.000000] ? start_kernel+0x5e/0x4c2
    [ 0.000000] ? load_ucode_bsp+0x113/0x12f
    [ 0.000000] ? secondary_startup_64+0xa5/0xb0

    This patch adds checks to prevent the panic.

    Signed-off-by: He Zhe <zhe.he@windriver.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: gregkh@linuxfoundation.org
    Cc: kstewart@linuxfoundation.org
    Cc: pombredanne@nexb.com
    Cc: stable@vger.kernel.org
    Link: http://lkml.kernel.org/r/1534260823-87917-1-git-send-email-zhe.he@windriver.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    He Zhe
     
  • commit 357d291ce035d1b757568058f3c9898c60d125b1 upstream.

    The boot loader version reported via sysfs is wrong in case of the
    kernel being booted via the Xen PVH boot entry. it should be 2.12
    (0x020c), but it is reported to be 2.18 (0x0212).

    As the current way to set the version is error prone use the more
    readable variant (2 << 8) | 12.

    Signed-off-by: Juergen Gross
    Cc: # 4.12
    Cc: Linus Torvalds
    Cc: Peter Zijlstra
    Cc: Thomas Gleixner
    Cc: boris.ostrovsky@oracle.com
    Cc: bp@alien8.de
    Cc: corbet@lwn.net
    Cc: linux-doc@vger.kernel.org
    Cc: xen-devel@lists.xenproject.org
    Link: http://lkml.kernel.org/r/20181010061456.22238-2-jgross@suse.com
    Signed-off-by: Ingo Molnar
    Signed-off-by: Greg Kroah-Hartman

    Juergen Gross
     
  • commit 53c613fe6349994f023245519265999eed75957f upstream.

    STIBP is a feature provided by certain Intel ucodes / CPUs. This feature
    (once enabled) prevents cross-hyperthread control of decisions made by
    indirect branch predictors.

    Enable this feature if

    - the CPU is vulnerable to spectre v2
    - the CPU supports SMT and has SMT siblings online
    - spectre_v2 mitigation autoselection is enabled (default)

    After some previous discussion, this leaves STIBP on all the time, as wrmsr
    on crossing kernel boundary is a no-no. This could perhaps later be a bit
    more optimized (like disabling it in NOHZ, experiment with disabling it in
    idle, etc) if needed.

    Note that the synchronization of the mask manipulation via newly added
    spec_ctrl_mutex is currently not strictly needed, as the only updater is
    already being serialized by cpu_add_remove_lock, but let's make this a
    little bit more future-proof.

    Signed-off-by: Jiri Kosina
    Signed-off-by: Thomas Gleixner
    Cc: Peter Zijlstra
    Cc: Josh Poimboeuf
    Cc: Andrea Arcangeli
    Cc: "WoodhouseDavid"
    Cc: Andi Kleen
    Cc: Tim Chen
    Cc: "SchauflerCasey"
    Cc: stable@vger.kernel.org
    Link: https://lkml.kernel.org/r/nycvar.YFH.7.76.1809251438240.15880@cbobk.fhfr.pm
    Signed-off-by: Greg Kroah-Hartman

    Jiri Kosina
     
  • commit ac237c28d5ac1b241d58b1b7b4b9fa10efb22fb5 upstream.

    The Creative Audigy SE (SB0570) card currently exhibits an audible pop
    whenever playback is stopped or resumed, or during silent periods of an
    audio stream. Initialise the IZD bit to the 0 to eliminate these pops.

    The Infinite Zero Detection (IZD) feature on the DAC causes the output
    to be shunted to Vcap after 2048 samples of silence. This discharges the
    AC coupling capacitor through the output and causes the aforementioned
    pop/click noise.

    The behaviour of the IZD bit is described on page 15 of the WM8768GEDS
    datasheet: "With IZD=1, applying MUTE for 1024 consecutive input samples
    will cause all outputs to be connected directly to VCAP. This also
    happens if 2048 consecutive zero input samples are applied to all 6
    channels, and IZD=0. It will be removed as soon as any channel receives
    a non-zero input". I believe the second sentence might be referring to
    IZD=1 instead of IZD=0 given the observed behaviour of the card.

    This change should make the DAC initialisation consistent with
    Creative's Windows driver, as this popping persists when initialising
    the card in Linux and soft rebooting into Windows, but is not present on
    a cold boot to Windows.

    Signed-off-by: Alex Stanoev
    Cc:
    Signed-off-by: Takashi Iwai
    Signed-off-by: Greg Kroah-Hartman

    Alex Stanoev
     
  • commit e7bb6ad5685f05685dd8a6a5eda7bfcd14d5f95b upstream.

    The Lenovo G50-30, like other G50 models, has a Conexant codec that
    requires a quirk for its inverted stereo dmic.

    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1249364
    Reported-by: Alexander Ploumistos
    Tested-by: Alexander Ploumistos
    Cc: stable@vger.kernel.org
    Signed-off-by: Jeremy Cline
    Signed-off-by: Takashi Iwai
    Signed-off-by: Greg Kroah-Hartman

    Jeremy Cline
     
  • commit d06fb562bff5d14defdacbd92449bacbaedd5cdf upstream.

    The front MIC on the Lenovo M715 can't record sound, after applying
    the ALC294_FIXUP_LENOVO_MIC_LOCATION, the problem is fixed. So add
    the pin configuration of this machine to the pin quirk table.

    Cc:
    Signed-off-by: Hui Wang
    Signed-off-by: Takashi Iwai
    Signed-off-by: Greg Kroah-Hartman

    Hui Wang
     
  • commit 5b7c5e1f4c36b99d0f694f38b9ad910f520cb7ef upstream.

    BIOS on ASUS G751 doesn't seem to map the headphone pin (NID 0x16)
    correctly. Add a quirk to address it, as well as chaining to the
    previous fix for the microphone.

    Reported-by: Håvard
    Cc:
    Signed-off-by: Takashi Iwai
    Signed-off-by: Greg Kroah-Hartman

    Takashi Iwai
     
  • commit 11ba6111160290ccd35562f4e05cec08942a6c4c upstream.

    ASUS G751 requires the extra COEF initialization to make it microphone
    working properly.

    Reported-and-tested-by: Håvard
    Cc:
    Signed-off-by: Takashi Iwai
    Signed-off-by: Greg Kroah-Hartman

    Takashi Iwai
     
  • commit 99a3ae51d557d8e38a7aece65678a31f9db215ee upstream.

    In the C-code we need to put the physical address of the hpmc handler in
    the interrupt vector table (IVA) in order to get HPMCs working. Since
    on parisc64 function pointers are indirect (in fact they are function
    descriptors) we instead export the address as variable and not as
    function.

    This reverts a small part of commit f39cce654f9a ("parisc: Add
    cfi_startproc and cfi_endproc to assembly code").

    Signed-off-by: Helge Deller
    Cc: [4.9+]
    Signed-off-by: Greg Kroah-Hartman

    Helge Deller
     
  • commit 3c229b3f2dd8133f61bb81d3cb018be92f4bba39 upstream.

    Fix a long-existing small nasty bug in the map_pages() implementation which
    leads to overwriting already written pte entries with zero, *if* map_pages() is
    called a second time with an end address which isn't aligned on a pmd boundry.
    This happens for example if we want to remap only the text segment read/write
    in order to run alternative patching on the code. Exiting the loop when we
    reach the end address fixes this.

    Cc: stable@vger.kernel.org
    Signed-off-by: Helge Deller
    Signed-off-by: Greg Kroah-Hartman

    Helge Deller
     
  • commit 1138b6718ff74d2a934459643e3754423d23b5e2 upstream.

    Helge noticed that the address of the os_hpmc handler was not being
    correctly calculated in the hpmc macro. As a result, PDCE_CHECK would
    fail to call os_hpmc:

    e800009802e00000 0000000000000000 CC_ERR_CHECK_HPMC
    37000f7302e00000 8040004000000000 CC_ERR_CPU_CHECK_SUMMARY
    f600105e02e00000 fffffff0f0c00000 CC_MC_HPMC_MONARCH_SELECTED
    140003b202e00000 000000000000000b CC_ERR_HPMC_STATE_ENTRY
    5600100b02e00000 00000000000001a0 CC_MC_OS_HPMC_LEN_ERR
    5600106402e00000 fffffff0f0438e70 CC_MC_BR_TO_OS_HPMC_FAILED
    e800009802e00000 0000000000000000 CC_ERR_CHECK_HPMC
    37000f7302e00000 8040004000000000 CC_ERR_CPU_CHECK_SUMMARY
    4000109f02e00000 0000000000000000 CC_MC_HPMC_INITIATED
    4000101902e00000 0000000000000000 CC_MC_MULTIPLE_HPMCS
    030010d502e00000 0000000000000000 CC_CPU_STOP

    The address problem can be seen by dumping the fault vector:

    0000000040159000 :
    40159000: 63 6f 77 73 stb r15,-2447(dp)
    40159004: 20 63 61 6e ldil L%b747000,r3
    40159008: 20 66 6c 79 ldil L%-1c3b3000,r3
    ...
    40159020: 08 00 02 40 nop
    40159024: 20 6e 60 02 ldil L%15d000,r3
    40159028: 34 63 00 00 ldo 0(r3),r3
    4015902c: e8 60 c0 02 bv,n r0(r3)
    40159030: 08 00 02 40 nop
    40159034: 00 00 00 00 break 0,0
    40159038: c0 00 70 00 bb,*< r0,sar,40159840
    4015903c: 00 00 00 00 break 0,0

    Location 40159038 should contain the physical address of os_hpmc:

    000000004015d000 :
    4015d000: 08 1a 02 43 copy r26,r3
    4015d004: 01 c0 08 a4 mfctl iva,r4
    4015d008: 48 85 00 68 ldw 34(r4),r5

    This patch moves the address setup into initialize_ivt to resolve the
    above problem. I tested the change by dumping the HPMC entry after setup:

    0000000040209020: 8000240
    0000000040209024: 206a2004
    0000000040209028: 34630ac0
    000000004020902c: e860c002
    0000000040209030: 8000240
    0000000040209034: 1bdddce6
    0000000040209038: 15d000
    000000004020903c: 1a0

    Signed-off-by: John David Anglin
    Cc:
    Signed-off-by: Helge Deller
    Signed-off-by: Greg Kroah-Hartman

    John David Anglin
     
  • commit 0711e8c1b4572d076264e71b0002d223f2666ed7 upstream.

    Please note that below oops is from an older kernel, but the same
    race seems to be present in the upstream kernel too.

    ---8
    Cc: # 3.19
    Signed-off-by: Corey Minyard
    Signed-off-by: Greg Kroah-Hartman

    Jan Glauber
     
  • commit 95691e3eddc41da2d1cd3cca51fecdfb46bd85bc upstream.

    Currently, "disable_clkrun" yenta_socket module parameter is only
    implemented for TI CardBus bridges.
    Add also an implementation for Ricoh bridges that have the necessary
    setting documented in publicly available datasheets.

    Tested on a RL5C476II with a Sunrich C-160 CardBus NIC that doesn't work
    correctly unless the CLKRUN protocol is disabled.

    Let's also make it clear in its description that the "disable_clkrun"
    module parameter only works on these two previously mentioned brands of
    CardBus bridges.

    Signed-off-by: Maciej S. Szmigiero
    Cc: stable@vger.kernel.org
    Signed-off-by: Dominik Brodowski
    Signed-off-by: Greg Kroah-Hartman

    Maciej S. Szmigiero
     
  • commit da5e79bc70b84971d2b3a55fb252e34e51d81d48 upstream.

    If the policy limits change between invocations of cs_dbs_update(),
    the requested frequency value stored in dbs_info may not be updated
    and the function may use a stale value of it next time. Moreover, if
    idle periods are takem into account by cs_dbs_update(), the requested
    frequency value stored in dbs_info may be below the min policy limit,
    which is incorrect.

    To fix these problems, always update the requested frequency value
    in dbs_info along with the local copy of it when the previous
    requested frequency is beyond the policy limits and avoid decreasing
    the requested frequency below the min policy limit when taking
    idle periods into account.

    Fixes: abb6627910a1 (cpufreq: conservative: Fix next frequency selection)
    Fixes: 00bfe05889e9 (cpufreq: conservative: Decrease frequency faster for deferred updates)
    Reported-by: Waldemar Rymarkiewicz
    Cc: All applicable
    Signed-off-by: Rafael J. Wysocki
    Acked-by: Waldemar Rymarkiewicz
    Acked-by: Viresh Kumar
    Signed-off-by: Greg Kroah-Hartman

    Rafael J. Wysocki
     
  • commit 92e2921f7eee63450a5f953f4b15dc6210219430 upstream.

    When an invalid mount option is passed to jffs2, jffs2_parse_options()
    will fail and jffs2_sb_info will be freed, but then jffs2_sb_info will
    be used (use-after-free) and freeed (double-free) in jffs2_kill_sb().

    Fix it by removing the buggy invocation of kfree() when getting invalid
    mount options.

    Fixes: 92abc475d8de ("jffs2: implement mount option parsing and compression overriding")
    Cc: stable@kernel.org
    Signed-off-by: Hou Tao
    Reviewed-by: Richard Weinberger
    Signed-off-by: Boris Brezillon
    Signed-off-by: Greg Kroah-Hartman

    Hou Tao
     
  • commit e7c6a55606b5c46b449d76588968b4d8caae903f upstream.

    Devices with compatible="pmbus" field have zero initial page count,
    and pmbus_clear_faults() being called before the page count auto-
    detection does not actually clear faults because it depends on the
    page count. Non-cleared faults in its turn may fail the subsequent
    page count auto-detection.

    This patch fixes this problem by calling pmbus_clear_fault_page()
    for currently set page and calling pmbus_clear_faults() after the
    page count was detected.

    Cc: stable@vger.kernel.org
    Signed-off-by: Dmitry Bazhenov
    Signed-off-by: Guenter Roeck
    Signed-off-by: Greg Kroah-Hartman

    Dmitry Bazhenov
     
  • commit 2d6cb6edd2c7fb4f40998895bda45006281b1ac5 upstream.

    refill->end record the last key of writeback, for example, at the first
    time, keys (1,128K) to (1,1024K) are flush to the backend device, but
    the end key (1,1024K) is not included, since the bellow code:
    if (bkey_cmp(k, refill->end) >= 0) {
    ret = MAP_DONE;
    goto out;
    }
    And in the next time when we refill writeback keybuf again, we searched
    key start from (1,1024K), and got a key bigger than it, so the key
    (1,1024K) missed.
    This patch modify the above code, and let the end key to be included to
    the writeback key buffer.

    Signed-off-by: Tang Junhui
    Cc: stable@vger.kernel.org
    Signed-off-by: Coly Li
    Signed-off-by: Jens Axboe
    Signed-off-by: Greg Kroah-Hartman

    Tang Junhui
     
  • commit 502b291568fc7faf1ebdb2c2590f12851db0ff76 upstream.

    Missed reading IOs are identified by s->cache_missed, not the
    s->cache_miss, so in trace_bcache_read() using trace_bcache_read
    to identify whether the IO is missed or not.

    Signed-off-by: Tang Junhui
    Cc: stable@vger.kernel.org
    Signed-off-by: Coly Li
    Signed-off-by: Jens Axboe
    Signed-off-by: Greg Kroah-Hartman

    Tang Junhui
     
  • commit 940ec770c295682993d1cccce3081fd7c74fece8 upstream.

    Fixing/optimizing bcm_qspi_bspi_read() performance introduced two
    changes:
    1) It added a loop to read all requested data using multiple BSPI ops.
    2) It bumped max size of a single BSPI block request from 256 to 512 B.

    The later change resulted in occasional BSPI timeouts causing a
    regression.

    For some unknown reason hardware doesn't always handle reads as expected
    when using 512 B chunks. In such cases it may happen that BSPI returns
    amount of requested bytes without the last 1-3 ones. It provides the
    remaining bytes later but doesn't raise an interrupt until another LR
    start.

    Switching back to 256 B reads fixes that problem and regression.

    Fixes: 345309fa7c0c ("spi: bcm-qspi: Fix bcm_qspi_bspi_read() performance")
    Signed-off-by: Rafał Miłecki
    Signed-off-by: Mark Brown
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman

    Rafał Miłecki
     
  • commit 41fe242979e463d6ad251077ded01b825a330b7e upstream.

    If the size of spi-nor flash is larger than 16MB, the read_opcode
    is set to SPINOR_OP_READ_1_1_4_4B, and fsl_qspi_get_seqid() will
    return -EINVAL when cmd is SPINOR_OP_READ_1_1_4_4B. This can
    cause read operation fail.

    Fixes: e46ecda764dc ("mtd: spi-nor: Add Freescale QuadSPI driver")
    Cc:
    Signed-off-by: Liu Xiang
    Signed-off-by: Boris Brezillon
    Signed-off-by: Greg Kroah-Hartman

    Liu Xiang
     

10 Nov, 2018

7 commits

  • Greg Kroah-Hartman
     
  • [ Upstream commit f8b39039cbf2a15f2b8c9f081e1cbd5dee00aaf5 ]

    In case of TX timeout, fs_timeout() calls phy_stop(), which
    triggers the following BUG_ON() as we are in interrupt.

    [92708.199889] kernel BUG at drivers/net/phy/mdio_bus.c:482!
    [92708.204985] Oops: Exception in kernel mode, sig: 5 [#1]
    [92708.210119] PREEMPT
    [92708.212107] CMPC885
    [92708.214216] CPU: 0 PID: 3 Comm: ksoftirqd/0 Tainted: G W 4.9.61 #39
    [92708.223227] task: c60f0a40 task.stack: c6104000
    [92708.227697] NIP: c02a84bc LR: c02a947c CTR: c02a93d8
    [92708.232614] REGS: c6105c70 TRAP: 0700 Tainted: G W (4.9.61)
    [92708.241193] MSR: 00021032 [92708.244818] CR: 24000822 XER: 20000000
    [92708.248767]
    GPR00: c02a947c c6105d20 c60f0a40 c62b4c00 00000005 0000001f c069aad8 0001a688
    GPR08: 00000007 00000100 c02a93d8 00000000 000005fc 00000000 c6213240 c06338e4
    GPR16: 00000001 c06330d4 c0633094 00000000 c0680000 c6104000 c6104000 00000000
    GPR24: 00000200 00000000 ffffffff 00000004 00000078 00009032 00000000 c62b4c00
    NIP [c02a84bc] mdiobus_read+0x20/0x74
    [92708.281517] LR [c02a947c] kszphy_config_intr+0xa4/0xc4
    [92708.286547] Call Trace:
    [92708.288980] [c6105d20] [c6104000] 0xc6104000 (unreliable)
    [92708.294339] [c6105d40] [c02a947c] kszphy_config_intr+0xa4/0xc4
    [92708.300098] [c6105d50] [c02a5330] phy_stop+0x60/0x9c
    [92708.305007] [c6105d60] [c02c84d0] fs_timeout+0xdc/0x110
    [92708.310197] [c6105d80] [c035cd48] dev_watchdog+0x268/0x2a0
    [92708.315593] [c6105db0] [c0060288] call_timer_fn+0x34/0x17c
    [92708.321014] [c6105dd0] [c00605f0] run_timer_softirq+0x21c/0x2e4
    [92708.326887] [c6105e50] [c001e19c] __do_softirq+0xf4/0x2f4
    [92708.332207] [c6105eb0] [c001e3c8] run_ksoftirqd+0x2c/0x40
    [92708.337560] [c6105ec0] [c003b420] smpboot_thread_fn+0x1f0/0x258
    [92708.343405] [c6105ef0] [c003745c] kthread+0xbc/0xd0
    [92708.348217] [c6105f40] [c000c400] ret_from_kernel_thread+0x5c/0x64
    [92708.354275] Instruction dump:
    [92708.357207] 7c0803a6 bbc10018 38210020 4e800020 7c0802a6 9421ffe0 54290024 bfc10018
    [92708.364865] 90010024 7c7f1b78 81290008 552902ee 3bc3002c 7fc3f378 90810008
    [92708.372711] ---[ end trace 42b05441616fafd7 ]---

    This patch moves fs_timeout() actions into an async worker.

    Fixes: commit 48257c4f168e5 ("Add fs_enet ethernet network driver, for several embedded platforms")
    Signed-off-by: Christophe Leroy
    Signed-off-by: David S. Miller
    Signed-off-by: Sasha Levin

    Christophe Leroy
     
  • …tch if there is an FPU

    commit 2224d616528194b02424c91c2ee254b3d29942c3 upstream.

    Booting an i486 with "no387 nofxsr" ends with with the following crash:

    math_emulate: 0060:c101987d
    Kernel panic - not syncing: Math emulation needed in kernel

    on the first context switch in user land.

    The reason is that copy_fpregs_to_fpstate() tries FNSAVE which does not work
    as the FPU is turned off.

    This bug was introduced in:

    f1c8cd0176078 ("x86/fpu: Change fpu->fpregs_active users to fpu->fpstate_active")

    Add a check for X86_FEATURE_FPU before trying to save FPU registers (we
    have such a check in switch_fpu_finish() already).

    Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Reviewed-by: Andy Lutomirski <luto@kernel.org>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: stable@vger.kernel.org
    Fixes: f1c8cd0176078 ("x86/fpu: Change fpu->fpregs_active users to fpu->fpstate_active")
    Link: http://lkml.kernel.org/r/20181016202525.29437-4-bigeasy@linutronix.de
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    Sebastian Andrzej Siewior
     
  • commit 53c13ba8ed39e89f21a0b98f4c8a241bb44e483d upstream.

    Clang warns that the declaration of jiffies in include/linux/jiffies.h
    doesn't match the definition in arch/x86/time/kernel.c:

    arch/x86/kernel/time.c:29:42: warning: section does not match previous declaration [-Wsection]
    __visible volatile unsigned long jiffies __cacheline_aligned = INITIAL_JIFFIES;
    ^
    ./include/linux/cache.h:49:4: note: expanded from macro '__cacheline_aligned'
    __section__(".data..cacheline_aligned")))
    ^
    ./include/linux/jiffies.h:81:31: note: previous attribute is here
    extern unsigned long volatile __cacheline_aligned_in_smp __jiffy_arch_data jiffies;
    ^
    ./arch/x86/include/asm/cache.h:20:2: note: expanded from macro '__cacheline_aligned_in_smp'
    __page_aligned_data
    ^
    ./include/linux/linkage.h:39:29: note: expanded from macro '__page_aligned_data'
    #define __page_aligned_data __section(.data..page_aligned) __aligned(PAGE_SIZE)
    ^
    ./include/linux/compiler_attributes.h:233:56: note: expanded from macro '__section'
    #define __section(S) __attribute__((__section__(#S)))
    ^
    1 warning generated.

    The declaration was changed in commit 7c30f352c852 ("jiffies.h: declare
    jiffies and jiffies_64 with ____cacheline_aligned_in_smp") but wasn't
    updated here. Make them match so Clang no longer warns.

    Fixes: 7c30f352c852 ("jiffies.h: declare jiffies and jiffies_64 with ____cacheline_aligned_in_smp")
    Signed-off-by: Nathan Chancellor
    Signed-off-by: Thomas Gleixner
    Cc: Borislav Petkov
    Cc: "H. Peter Anvin"
    Cc: Nick Desaulniers
    Cc: stable@vger.kernel.org
    Link: https://lkml.kernel.org/r/20181013005311.28617-1-natechancellor@gmail.com
    Signed-off-by: Greg Kroah-Hartman

    Nathan Chancellor
     
  • commit b59167ac7bafd804c91e49ad53c6d33a7394d4c8 upstream.

    Eric reported that a sequence count loop using this_cpu_read() got
    optimized out. This is wrong, this_cpu_read() must imply READ_ONCE()
    because the interface is IRQ-safe, therefore an interrupt can have
    changed the per-cpu value.

    Fixes: 7c3576d261ce ("[PATCH] i386: Convert PDA into the percpu section")
    Reported-by: Eric Dumazet
    Signed-off-by: Peter Zijlstra (Intel)
    Signed-off-by: Thomas Gleixner
    Acked-by: Eric Dumazet
    Cc: hpa@zytor.com
    Cc: eric.dumazet@gmail.com
    Cc: bp@alien8.de
    Cc: stable@vger.kernel.org
    Link: https://lkml.kernel.org/r/20181011104019.748208519@infradead.org
    Signed-off-by: Greg Kroah-Hartman

    Peter Zijlstra
     
  • commit cc55f7537db6af371e9c1c6a71161ee40f918824 upstream.

    On 32bit systems, nosave_regions(non RAM areas) located between
    max_low_pfn and max_pfn are not excluded from hibernation snapshot
    currently, which may result in a machine check exception when
    trying to access these unsafe regions during hibernation:

    [ 612.800453] Disabling lock debugging due to kernel taint
    [ 612.805786] mce: [Hardware Error]: CPU 0: Machine Check Exception: 5 Bank 6: fe00000000801136
    [ 612.814344] mce: [Hardware Error]: RIP !INEXACT! 60: {swsusp_save+0x436/0x560}
    [ 612.823167] mce: [Hardware Error]: TSC 1f5939fe276 ADDR dd000000 MISC 30e0000086
    [ 612.830677] mce: [Hardware Error]: PROCESSOR 0:306c3 TIME 1529487426 SOCKET 0 APIC 0 microcode 24
    [ 612.839581] mce: [Hardware Error]: Run the above through 'mcelog --ascii'
    [ 612.846394] mce: [Hardware Error]: Machine check: Processor context corrupt
    [ 612.853380] Kernel panic - not syncing: Fatal machine check
    [ 612.858978] Kernel Offset: 0x18000000 from 0xc1000000 (relocation range: 0xc0000000-0xf7ffdfff)

    This is because on 32bit systems, pages above max_low_pfn are regarded
    as high memeory, and accessing unsafe pages might cause expected MCE.
    On the problematic 32bit system, there are reserved memory above low
    memory, which triggered the MCE:

    e820 memory mapping:
    [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009d7ff] usable
    [ 0.000000] BIOS-e820: [mem 0x000000000009d800-0x000000000009ffff] reserved
    [ 0.000000] BIOS-e820: [mem 0x00000000000e0000-0x00000000000fffff] reserved
    [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000d160cfff] usable
    [ 0.000000] BIOS-e820: [mem 0x00000000d160d000-0x00000000d1613fff] ACPI NVS
    [ 0.000000] BIOS-e820: [mem 0x00000000d1614000-0x00000000d1a44fff] usable
    [ 0.000000] BIOS-e820: [mem 0x00000000d1a45000-0x00000000d1ecffff] reserved
    [ 0.000000] BIOS-e820: [mem 0x00000000d1ed0000-0x00000000d7eeafff] usable
    [ 0.000000] BIOS-e820: [mem 0x00000000d7eeb000-0x00000000d7ffffff] reserved
    [ 0.000000] BIOS-e820: [mem 0x00000000d8000000-0x00000000d875ffff] usable
    [ 0.000000] BIOS-e820: [mem 0x00000000d8760000-0x00000000d87fffff] reserved
    [ 0.000000] BIOS-e820: [mem 0x00000000d8800000-0x00000000d8fadfff] usable
    [ 0.000000] BIOS-e820: [mem 0x00000000d8fae000-0x00000000d8ffffff] ACPI data
    [ 0.000000] BIOS-e820: [mem 0x00000000d9000000-0x00000000da71bfff] usable
    [ 0.000000] BIOS-e820: [mem 0x00000000da71c000-0x00000000da7fffff] ACPI NVS
    [ 0.000000] BIOS-e820: [mem 0x00000000da800000-0x00000000dbb8bfff] usable
    [ 0.000000] BIOS-e820: [mem 0x00000000dbb8c000-0x00000000dbffffff] reserved
    [ 0.000000] BIOS-e820: [mem 0x00000000dd000000-0x00000000df1fffff] reserved
    [ 0.000000] BIOS-e820: [mem 0x00000000f8000000-0x00000000fbffffff] reserved
    [ 0.000000] BIOS-e820: [mem 0x00000000fec00000-0x00000000fec00fff] reserved
    [ 0.000000] BIOS-e820: [mem 0x00000000fed00000-0x00000000fed03fff] reserved
    [ 0.000000] BIOS-e820: [mem 0x00000000fed1c000-0x00000000fed1ffff] reserved
    [ 0.000000] BIOS-e820: [mem 0x00000000fee00000-0x00000000fee00fff] reserved
    [ 0.000000] BIOS-e820: [mem 0x00000000ff000000-0x00000000ffffffff] reserved
    [ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000041edfffff] usable

    Fix this problem by changing pfn limit from max_low_pfn to max_pfn.
    This fix does not impact 64bit system because on 64bit max_low_pfn
    is the same as max_pfn.

    Signed-off-by: Zhimin Gu
    Acked-by: Pavel Machek
    Signed-off-by: Chen Yu
    Acked-by: Thomas Gleixner
    Cc: All applicable
    Signed-off-by: Rafael J. Wysocki
    Signed-off-by: Greg Kroah-Hartman

    Zhimin Gu
     
  • commit 4907c68abd3f60f650f98d5a69d4ec77c0bde44f upstream.

    Looking at the asm for native_sched_clock() I noticed we don't inline
    enough. Mostly caused by sharing code with cyc2ns_read_begin(), which
    we didn't used to do. So mark all that __force_inline to make it DTRT.

    Fixes: 59eaef78bfea ("x86/tsc: Remodel cyc2ns to use seqcount_latch()")
    Reported-by: Eric Dumazet
    Signed-off-by: Peter Zijlstra (Intel)
    Signed-off-by: Thomas Gleixner
    Cc: hpa@zytor.com
    Cc: eric.dumazet@gmail.com
    Cc: bp@alien8.de
    Cc: stable@vger.kernel.org
    Link: https://lkml.kernel.org/r/20181011104019.695196158@infradead.org
    Signed-off-by: Greg Kroah-Hartman

    Peter Zijlstra