From: Greg Kroah-Hartman Date: Mon, 31 Aug 2020 12:07:47 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.4.235~36 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=83f580f47654b8a2f305850ebbb1ceafecfb903e;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: arm64-vdso32-make-vdso32-install-conditional.patch crypto-af_alg-work-around-empty-control-messages-without-msg_more.patch device-property-fix-the-secondary-firmware-node-handling-in-set_primary_fwnode.patch drm-amd-pm-correct-the-thermal-alert-temperature-limit-settings.patch drm-amd-pm-correct-vega10-swctf-limit-setting.patch drm-amd-pm-correct-vega12-swctf-limit-setting.patch drm-amd-pm-correct-vega20-swctf-limit-setting.patch drm-amd-powerplay-fix-hardmins-not-being-sent-to-smu-for-rv.patch drm-amdgpu-fix-buffer-overflow-in-info-ioctl.patch drm-amdgpu-gfx10-refine-mgcg-setting.patch genirq-matrix-deal-with-the-sillyness-of-for_each_cpu-on-up.patch irqchip-stm32-exti-avoid-losing-interrupts-due-to-clearing-pending-bits-by-mistake.patch pm-sleep-core-fix-the-handling-of-pending-runtime-resume-requests.patch powerpc-perf-fix-crashes-with-generic_compat_pmu-bhrb.patch x86-hotplug-silence-apic-only-after-all-interrupts-are-migrated.patch --- diff --git a/queue-5.4/arm64-vdso32-make-vdso32-install-conditional.patch b/queue-5.4/arm64-vdso32-make-vdso32-install-conditional.patch new file mode 100644 index 00000000000..24b0d44aad8 --- /dev/null +++ b/queue-5.4/arm64-vdso32-make-vdso32-install-conditional.patch @@ -0,0 +1,36 @@ +From 5d28ba5f8a0cfa3a874fa96c33731b8fcd141b3a Mon Sep 17 00:00:00 2001 +From: Frank van der Linden +Date: Thu, 27 Aug 2020 23:40:12 +0000 +Subject: arm64: vdso32: make vdso32 install conditional + +From: Frank van der Linden + +commit 5d28ba5f8a0cfa3a874fa96c33731b8fcd141b3a upstream. + +vdso32 should only be installed if CONFIG_COMPAT_VDSO is enabled, +since it's not even supposed to be compiled otherwise, and arm64 +builds without a 32bit crosscompiler will fail. + +Fixes: 8d75785a8142 ("ARM64: vdso32: Install vdso32 from vdso_install") +Signed-off-by: Frank van der Linden +Cc: stable@vger.kernel.org [5.4+] +Link: https://lore.kernel.org/r/20200827234012.19757-1-fllinden@amazon.com +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/Makefile | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm64/Makefile ++++ b/arch/arm64/Makefile +@@ -146,7 +146,8 @@ zinstall install: + PHONY += vdso_install + vdso_install: + $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso $@ +- $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso32 $@ ++ $(if $(CONFIG_COMPAT_VDSO), \ ++ $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso32 $@) + + # We use MRPROPER_FILES and CLEAN_FILES now + archclean: diff --git a/queue-5.4/crypto-af_alg-work-around-empty-control-messages-without-msg_more.patch b/queue-5.4/crypto-af_alg-work-around-empty-control-messages-without-msg_more.patch new file mode 100644 index 00000000000..eb9df368b02 --- /dev/null +++ b/queue-5.4/crypto-af_alg-work-around-empty-control-messages-without-msg_more.patch @@ -0,0 +1,64 @@ +From c195d66a8a75c60515819b101975f38b7ec6577f Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Thu, 27 Aug 2020 17:14:36 +1000 +Subject: crypto: af_alg - Work around empty control messages without MSG_MORE + +From: Herbert Xu + +commit c195d66a8a75c60515819b101975f38b7ec6577f upstream. + +The iwd daemon uses libell which sets up the skcipher operation with +two separate control messages. As the first control message is sent +without MSG_MORE, it is interpreted as an empty request. + +While libell should be fixed to use MSG_MORE where appropriate, this +patch works around the bug in the kernel so that existing binaries +continue to work. + +We will print a warning however. + +A separate issue is that the new kernel code no longer allows the +control message to be sent twice within the same request. This +restriction is obviously incompatible with what iwd was doing (first +setting an IV and then sending the real control message). This +patch changes the kernel so that this is explicitly allowed. + +Reported-by: Caleb Jorden +Fixes: f3c802a1f300 ("crypto: algif_aead - Only wake up when...") +Cc: +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/af_alg.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -847,9 +848,15 @@ int af_alg_sendmsg(struct socket *sock, + } + + lock_sock(sk); +- if (ctx->init && (init || !ctx->more)) { +- err = -EINVAL; +- goto unlock; ++ if (ctx->init && !ctx->more) { ++ if (ctx->used) { ++ err = -EINVAL; ++ goto unlock; ++ } ++ ++ pr_info_once( ++ "%s sent an empty control message without MSG_MORE.\n", ++ current->comm); + } + ctx->init = true; + diff --git a/queue-5.4/device-property-fix-the-secondary-firmware-node-handling-in-set_primary_fwnode.patch b/queue-5.4/device-property-fix-the-secondary-firmware-node-handling-in-set_primary_fwnode.patch new file mode 100644 index 00000000000..4313c1cab3f --- /dev/null +++ b/queue-5.4/device-property-fix-the-secondary-firmware-node-handling-in-set_primary_fwnode.patch @@ -0,0 +1,59 @@ +From c15e1bdda4365a5f17cdadf22bf1c1df13884a9e Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Fri, 21 Aug 2020 13:53:42 +0300 +Subject: device property: Fix the secondary firmware node handling in set_primary_fwnode() + +From: Heikki Krogerus + +commit c15e1bdda4365a5f17cdadf22bf1c1df13884a9e upstream. + +When the primary firmware node pointer is removed from a +device (set to NULL) the secondary firmware node pointer, +when it exists, is made the primary node for the device. +However, the secondary firmware node pointer of the original +primary firmware node is never cleared (set to NULL). + +To avoid situation where the secondary firmware node pointer +is pointing to a non-existing object, clearing it properly +when the primary node is removed from a device in +set_primary_fwnode(). + +Fixes: 97badf873ab6 ("device property: Make it possible to use secondary firmware nodes") +Cc: All applicable +Signed-off-by: Heikki Krogerus +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/core.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -3400,9 +3400,9 @@ static inline bool fwnode_is_primary(str + */ + void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) + { +- if (fwnode) { +- struct fwnode_handle *fn = dev->fwnode; ++ struct fwnode_handle *fn = dev->fwnode; + ++ if (fwnode) { + if (fwnode_is_primary(fn)) + fn = fn->secondary; + +@@ -3412,8 +3412,12 @@ void set_primary_fwnode(struct device *d + } + dev->fwnode = fwnode; + } else { +- dev->fwnode = fwnode_is_primary(dev->fwnode) ? +- dev->fwnode->secondary : NULL; ++ if (fwnode_is_primary(fn)) { ++ dev->fwnode = fn->secondary; ++ fn->secondary = NULL; ++ } else { ++ dev->fwnode = NULL; ++ } + } + } + EXPORT_SYMBOL_GPL(set_primary_fwnode); diff --git a/queue-5.4/drm-amd-pm-correct-the-thermal-alert-temperature-limit-settings.patch b/queue-5.4/drm-amd-pm-correct-the-thermal-alert-temperature-limit-settings.patch new file mode 100644 index 00000000000..df9931244c1 --- /dev/null +++ b/queue-5.4/drm-amd-pm-correct-the-thermal-alert-temperature-limit-settings.patch @@ -0,0 +1,127 @@ +From 28e628645333b7e581c4a7b04d958e4804ea10fe Mon Sep 17 00:00:00 2001 +From: Evan Quan +Date: Tue, 25 Aug 2020 10:35:11 +0800 +Subject: drm/amd/pm: correct the thermal alert temperature limit settings + +From: Evan Quan + +commit 28e628645333b7e581c4a7b04d958e4804ea10fe upstream. + +Do the maths in celsius degree. This can fix the issues caused +by the changes below: + +drm/amd/pm: correct Vega20 swctf limit setting +drm/amd/pm: correct Vega12 swctf limit setting +drm/amd/pm: correct Vega10 swctf limit setting + +Signed-off-by: Evan Quan +Reviewed-by: Kenneth Feng +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c | 15 +++++++-------- + drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c | 15 +++++++-------- + drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c | 15 +++++++-------- + 3 files changed, 21 insertions(+), 24 deletions(-) + +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c +@@ -368,14 +368,13 @@ static int vega10_thermal_set_temperatur + (struct phm_ppt_v2_information *)(hwmgr->pptable); + struct phm_tdp_table *tdp_table = pp_table_info->tdp_table; + struct amdgpu_device *adev = hwmgr->adev; +- int low = VEGA10_THERMAL_MINIMUM_ALERT_TEMP * +- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; +- int high = VEGA10_THERMAL_MAXIMUM_ALERT_TEMP * +- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; ++ int low = VEGA10_THERMAL_MINIMUM_ALERT_TEMP; ++ int high = VEGA10_THERMAL_MAXIMUM_ALERT_TEMP; + uint32_t val; + +- if (low < range->min) +- low = range->min; ++ /* compare them in unit celsius degree */ ++ if (low < range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES) ++ low = range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES; + if (high > tdp_table->usSoftwareShutdownTemp) + high = tdp_table->usSoftwareShutdownTemp; + +@@ -386,8 +385,8 @@ static int vega10_thermal_set_temperatur + + val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, MAX_IH_CREDIT, 5); + val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, THERM_IH_HW_ENA, 1); +- val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, (high / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)); +- val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, (low / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)); ++ val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, high); ++ val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, low); + val &= (~THM_THERMAL_INT_CTRL__THERM_TRIGGER_MASK_MASK) & + (~THM_THERMAL_INT_CTRL__THERM_INTH_MASK_MASK) & + (~THM_THERMAL_INT_CTRL__THERM_INTL_MASK_MASK); +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c +@@ -173,14 +173,13 @@ static int vega12_thermal_set_temperatur + struct phm_ppt_v3_information *pptable_information = + (struct phm_ppt_v3_information *)hwmgr->pptable; + struct amdgpu_device *adev = hwmgr->adev; +- int low = VEGA12_THERMAL_MINIMUM_ALERT_TEMP * +- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; +- int high = VEGA12_THERMAL_MAXIMUM_ALERT_TEMP * +- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; ++ int low = VEGA12_THERMAL_MINIMUM_ALERT_TEMP; ++ int high = VEGA12_THERMAL_MAXIMUM_ALERT_TEMP; + uint32_t val; + +- if (low < range->min) +- low = range->min; ++ /* compare them in unit celsius degree */ ++ if (low < range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES) ++ low = range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES; + if (high > pptable_information->us_software_shutdown_temp) + high = pptable_information->us_software_shutdown_temp; + +@@ -191,8 +190,8 @@ static int vega12_thermal_set_temperatur + + val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, MAX_IH_CREDIT, 5); + val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, THERM_IH_HW_ENA, 1); +- val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, (high / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)); +- val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, (low / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)); ++ val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, high); ++ val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, low); + val = val & (~THM_THERMAL_INT_CTRL__THERM_TRIGGER_MASK_MASK); + + WREG32_SOC15(THM, 0, mmTHM_THERMAL_INT_CTRL, val); +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c +@@ -243,14 +243,13 @@ static int vega20_thermal_set_temperatur + struct phm_ppt_v3_information *pptable_information = + (struct phm_ppt_v3_information *)hwmgr->pptable; + struct amdgpu_device *adev = hwmgr->adev; +- int low = VEGA20_THERMAL_MINIMUM_ALERT_TEMP * +- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; +- int high = VEGA20_THERMAL_MAXIMUM_ALERT_TEMP * +- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; ++ int low = VEGA20_THERMAL_MINIMUM_ALERT_TEMP; ++ int high = VEGA20_THERMAL_MAXIMUM_ALERT_TEMP; + uint32_t val; + +- if (low < range->min) +- low = range->min; ++ /* compare them in unit celsius degree */ ++ if (low < range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES) ++ low = range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES; + if (high > pptable_information->us_software_shutdown_temp) + high = pptable_information->us_software_shutdown_temp; + +@@ -261,8 +260,8 @@ static int vega20_thermal_set_temperatur + + val = CGS_REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, MAX_IH_CREDIT, 5); + val = CGS_REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, THERM_IH_HW_ENA, 1); +- val = CGS_REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, (high / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)); +- val = CGS_REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, (low / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)); ++ val = CGS_REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, high); ++ val = CGS_REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, low); + val = val & (~THM_THERMAL_INT_CTRL__THERM_TRIGGER_MASK_MASK); + + WREG32_SOC15(THM, 0, mmTHM_THERMAL_INT_CTRL, val); diff --git a/queue-5.4/drm-amd-pm-correct-vega10-swctf-limit-setting.patch b/queue-5.4/drm-amd-pm-correct-vega10-swctf-limit-setting.patch new file mode 100644 index 00000000000..4047e55548b --- /dev/null +++ b/queue-5.4/drm-amd-pm-correct-vega10-swctf-limit-setting.patch @@ -0,0 +1,46 @@ +From b05d71b51078fc428c6b72582126d9d75d3c1f4c Mon Sep 17 00:00:00 2001 +From: Evan Quan +Date: Fri, 21 Aug 2020 12:05:03 +0800 +Subject: drm/amd/pm: correct Vega10 swctf limit setting + +From: Evan Quan + +commit b05d71b51078fc428c6b72582126d9d75d3c1f4c upstream. + +Correct the Vega10 thermal swctf limit. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1267 + +Signed-off-by: Evan Quan +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c +@@ -364,6 +364,9 @@ int vega10_thermal_get_temperature(struc + static int vega10_thermal_set_temperature_range(struct pp_hwmgr *hwmgr, + struct PP_TemperatureRange *range) + { ++ struct phm_ppt_v2_information *pp_table_info = ++ (struct phm_ppt_v2_information *)(hwmgr->pptable); ++ struct phm_tdp_table *tdp_table = pp_table_info->tdp_table; + struct amdgpu_device *adev = hwmgr->adev; + int low = VEGA10_THERMAL_MINIMUM_ALERT_TEMP * + PP_TEMPERATURE_UNITS_PER_CENTIGRADES; +@@ -373,8 +376,8 @@ static int vega10_thermal_set_temperatur + + if (low < range->min) + low = range->min; +- if (high > range->max) +- high = range->max; ++ if (high > tdp_table->usSoftwareShutdownTemp) ++ high = tdp_table->usSoftwareShutdownTemp; + + if (low > high) + return -EINVAL; diff --git a/queue-5.4/drm-amd-pm-correct-vega12-swctf-limit-setting.patch b/queue-5.4/drm-amd-pm-correct-vega12-swctf-limit-setting.patch new file mode 100644 index 00000000000..1559c1e3b8b --- /dev/null +++ b/queue-5.4/drm-amd-pm-correct-vega12-swctf-limit-setting.patch @@ -0,0 +1,43 @@ +From e0ffd340249699ad27a6c91abdfa3e89f7823941 Mon Sep 17 00:00:00 2001 +From: Evan Quan +Date: Fri, 21 Aug 2020 12:18:58 +0800 +Subject: drm/amd/pm: correct Vega12 swctf limit setting + +From: Evan Quan + +commit e0ffd340249699ad27a6c91abdfa3e89f7823941 upstream. + +Correct the Vega12 thermal swctf limit. + +Signed-off-by: Evan Quan +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c +@@ -170,6 +170,8 @@ int vega12_thermal_get_temperature(struc + static int vega12_thermal_set_temperature_range(struct pp_hwmgr *hwmgr, + struct PP_TemperatureRange *range) + { ++ struct phm_ppt_v3_information *pptable_information = ++ (struct phm_ppt_v3_information *)hwmgr->pptable; + struct amdgpu_device *adev = hwmgr->adev; + int low = VEGA12_THERMAL_MINIMUM_ALERT_TEMP * + PP_TEMPERATURE_UNITS_PER_CENTIGRADES; +@@ -179,8 +181,8 @@ static int vega12_thermal_set_temperatur + + if (low < range->min) + low = range->min; +- if (high > range->max) +- high = range->max; ++ if (high > pptable_information->us_software_shutdown_temp) ++ high = pptable_information->us_software_shutdown_temp; + + if (low > high) + return -EINVAL; diff --git a/queue-5.4/drm-amd-pm-correct-vega20-swctf-limit-setting.patch b/queue-5.4/drm-amd-pm-correct-vega20-swctf-limit-setting.patch new file mode 100644 index 00000000000..1029f2185f3 --- /dev/null +++ b/queue-5.4/drm-amd-pm-correct-vega20-swctf-limit-setting.patch @@ -0,0 +1,43 @@ +From 9b51c4b2ba31396f3894ccc7df8bdf067243e9f5 Mon Sep 17 00:00:00 2001 +From: Evan Quan +Date: Fri, 21 Aug 2020 12:21:30 +0800 +Subject: drm/amd/pm: correct Vega20 swctf limit setting + +From: Evan Quan + +commit 9b51c4b2ba31396f3894ccc7df8bdf067243e9f5 upstream. + +Correct the Vega20 thermal swctf limit. + +Signed-off-by: Evan Quan +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c +@@ -240,6 +240,8 @@ int vega20_thermal_get_temperature(struc + static int vega20_thermal_set_temperature_range(struct pp_hwmgr *hwmgr, + struct PP_TemperatureRange *range) + { ++ struct phm_ppt_v3_information *pptable_information = ++ (struct phm_ppt_v3_information *)hwmgr->pptable; + struct amdgpu_device *adev = hwmgr->adev; + int low = VEGA20_THERMAL_MINIMUM_ALERT_TEMP * + PP_TEMPERATURE_UNITS_PER_CENTIGRADES; +@@ -249,8 +251,8 @@ static int vega20_thermal_set_temperatur + + if (low < range->min) + low = range->min; +- if (high > range->max) +- high = range->max; ++ if (high > pptable_information->us_software_shutdown_temp) ++ high = pptable_information->us_software_shutdown_temp; + + if (low > high) + return -EINVAL; diff --git a/queue-5.4/drm-amd-powerplay-fix-hardmins-not-being-sent-to-smu-for-rv.patch b/queue-5.4/drm-amd-powerplay-fix-hardmins-not-being-sent-to-smu-for-rv.patch new file mode 100644 index 00000000000..6f74dc2732e --- /dev/null +++ b/queue-5.4/drm-amd-powerplay-fix-hardmins-not-being-sent-to-smu-for-rv.patch @@ -0,0 +1,64 @@ +From e2bf3723db563457c0abe4eaeedac25bbbbd1d76 Mon Sep 17 00:00:00 2001 +From: Nicholas Kazlauskas +Date: Fri, 14 Aug 2020 11:49:13 -0400 +Subject: drm/amd/powerplay: Fix hardmins not being sent to SMU for RV + +From: Nicholas Kazlauskas + +commit e2bf3723db563457c0abe4eaeedac25bbbbd1d76 upstream. + +[Why] +DC uses these to raise the voltage as needed for higher dispclk/dppclk +and to ensure that we have enough bandwidth to drive the displays. + +There's a bug preventing these from actuially sending messages since +it's checking the actual clock (which is 0) instead of the incoming +clock (which shouldn't be 0) when deciding to send the hardmin. + +[How] +Check the clocks != 0 instead of the actual clocks. + +Fixes: 9ed9203c3ee7 ("drm/amd/powerplay: rv dal-pplib interface refactor powerplay part") +Signed-off-by: Nicholas Kazlauskas +Reviewed-by: Alex Deucher +Reviewed-by: Evan Quan +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c +@@ -209,8 +209,7 @@ static int smu10_set_min_deep_sleep_dcef + { + struct smu10_hwmgr *smu10_data = (struct smu10_hwmgr *)(hwmgr->backend); + +- if (smu10_data->need_min_deep_sleep_dcefclk && +- smu10_data->deep_sleep_dcefclk != clock) { ++ if (clock && smu10_data->deep_sleep_dcefclk != clock) { + smu10_data->deep_sleep_dcefclk = clock; + smum_send_msg_to_smc_with_parameter(hwmgr, + PPSMC_MSG_SetMinDeepSleepDcefclk, +@@ -223,8 +222,7 @@ static int smu10_set_hard_min_dcefclk_by + { + struct smu10_hwmgr *smu10_data = (struct smu10_hwmgr *)(hwmgr->backend); + +- if (smu10_data->dcf_actual_hard_min_freq && +- smu10_data->dcf_actual_hard_min_freq != clock) { ++ if (clock && smu10_data->dcf_actual_hard_min_freq != clock) { + smu10_data->dcf_actual_hard_min_freq = clock; + smum_send_msg_to_smc_with_parameter(hwmgr, + PPSMC_MSG_SetHardMinDcefclkByFreq, +@@ -237,8 +235,7 @@ static int smu10_set_hard_min_fclk_by_fr + { + struct smu10_hwmgr *smu10_data = (struct smu10_hwmgr *)(hwmgr->backend); + +- if (smu10_data->f_actual_hard_min_freq && +- smu10_data->f_actual_hard_min_freq != clock) { ++ if (clock && smu10_data->f_actual_hard_min_freq != clock) { + smu10_data->f_actual_hard_min_freq = clock; + smum_send_msg_to_smc_with_parameter(hwmgr, + PPSMC_MSG_SetHardMinFclkByFreq, diff --git a/queue-5.4/drm-amdgpu-fix-buffer-overflow-in-info-ioctl.patch b/queue-5.4/drm-amdgpu-fix-buffer-overflow-in-info-ioctl.patch new file mode 100644 index 00000000000..3e8d034b74a --- /dev/null +++ b/queue-5.4/drm-amdgpu-fix-buffer-overflow-in-info-ioctl.patch @@ -0,0 +1,39 @@ +From b5b97cab55eb71daba3283c8b1d2cce456d511a1 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 25 Aug 2020 11:43:45 -0400 +Subject: drm/amdgpu: Fix buffer overflow in INFO ioctl + +From: Alex Deucher + +commit b5b97cab55eb71daba3283c8b1d2cce456d511a1 upstream. + +The values for "se_num" and "sh_num" come from the user in the ioctl. +They can be in the 0-255 range but if they're more than +AMDGPU_GFX_MAX_SE (4) or AMDGPU_GFX_MAX_SH_PER_SE (2) then it results in +an out of bounds read. + +Reported-by: Dan Carpenter +Acked-by: Dan Carpenter +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -638,8 +638,12 @@ static int amdgpu_info_ioctl(struct drm_ + * in the bitfields */ + if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK) + se_num = 0xffffffff; ++ else if (se_num >= AMDGPU_GFX_MAX_SE) ++ return -EINVAL; + if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK) + sh_num = 0xffffffff; ++ else if (sh_num >= AMDGPU_GFX_MAX_SH_PER_SE) ++ return -EINVAL; + + if (info->read_mmr_reg.count > 128) + return -EINVAL; diff --git a/queue-5.4/drm-amdgpu-gfx10-refine-mgcg-setting.patch b/queue-5.4/drm-amdgpu-gfx10-refine-mgcg-setting.patch new file mode 100644 index 00000000000..1373e7ece9b --- /dev/null +++ b/queue-5.4/drm-amdgpu-gfx10-refine-mgcg-setting.patch @@ -0,0 +1,37 @@ +From de7a1b0b8753e1b0000084f0e339ffab295d27ef Mon Sep 17 00:00:00 2001 +From: Jiansong Chen +Date: Mon, 24 Aug 2020 18:44:09 +0800 +Subject: drm/amdgpu/gfx10: refine mgcg setting + +From: Jiansong Chen + +commit de7a1b0b8753e1b0000084f0e339ffab295d27ef upstream. + +1. enable ENABLE_CGTS_LEGACY to fix specviewperf11 random hang. +2. remove obsolete RLC_CGTT_SCLK_OVERRIDE workaround. + +Signed-off-by: Jiansong Chen +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -4094,10 +4094,8 @@ static void gfx_v10_0_update_medium_grai + def = data = RREG32_SOC15(GC, 0, mmRLC_CGTT_MGCG_OVERRIDE); + data &= ~(RLC_CGTT_MGCG_OVERRIDE__GRBM_CGTT_SCLK_OVERRIDE_MASK | + RLC_CGTT_MGCG_OVERRIDE__GFXIP_MGCG_OVERRIDE_MASK | +- RLC_CGTT_MGCG_OVERRIDE__GFXIP_MGLS_OVERRIDE_MASK); +- +- /* only for Vega10 & Raven1 */ +- data |= RLC_CGTT_MGCG_OVERRIDE__RLC_CGTT_SCLK_OVERRIDE_MASK; ++ RLC_CGTT_MGCG_OVERRIDE__GFXIP_MGLS_OVERRIDE_MASK | ++ RLC_CGTT_MGCG_OVERRIDE__ENABLE_CGTS_LEGACY_MASK); + + if (def != data) + WREG32_SOC15(GC, 0, mmRLC_CGTT_MGCG_OVERRIDE, data); diff --git a/queue-5.4/genirq-matrix-deal-with-the-sillyness-of-for_each_cpu-on-up.patch b/queue-5.4/genirq-matrix-deal-with-the-sillyness-of-for_each_cpu-on-up.patch new file mode 100644 index 00000000000..afd71422152 --- /dev/null +++ b/queue-5.4/genirq-matrix-deal-with-the-sillyness-of-for_each_cpu-on-up.patch @@ -0,0 +1,48 @@ +From 784a0830377d0761834e385975bc46861fea9fa0 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Sun, 30 Aug 2020 19:07:53 +0200 +Subject: genirq/matrix: Deal with the sillyness of for_each_cpu() on UP + +From: Thomas Gleixner + +commit 784a0830377d0761834e385975bc46861fea9fa0 upstream. + +Most of the CPU mask operations behave the same way, but for_each_cpu() and +it's variants ignore the cpumask argument and claim that CPU0 is always in +the mask. This is historical, inconsistent and annoying behaviour. + +The matrix allocator uses for_each_cpu() and can be called on UP with an +empty cpumask. The calling code does not expect that this succeeds but +until commit e027fffff799 ("x86/irq: Unbreak interrupt affinity setting") +this went unnoticed. That commit added a WARN_ON() to catch cases which +move an interrupt from one vector to another on the same CPU. The warning +triggers on UP. + +Add a check for the cpumask being empty to prevent this. + +Fixes: 2f75d9e1c905 ("genirq: Implement bitmap matrix allocator") +Reported-by: kernel test robot +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/irq/matrix.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/kernel/irq/matrix.c ++++ b/kernel/irq/matrix.c +@@ -380,6 +380,13 @@ int irq_matrix_alloc(struct irq_matrix * + unsigned int cpu, bit; + struct cpumap *cm; + ++ /* ++ * Not required in theory, but matrix_find_best_cpu() uses ++ * for_each_cpu() which ignores the cpumask on UP . ++ */ ++ if (cpumask_empty(msk)) ++ return -EINVAL; ++ + cpu = matrix_find_best_cpu(m, msk); + if (cpu == UINT_MAX) + return -ENOSPC; diff --git a/queue-5.4/irqchip-stm32-exti-avoid-losing-interrupts-due-to-clearing-pending-bits-by-mistake.patch b/queue-5.4/irqchip-stm32-exti-avoid-losing-interrupts-due-to-clearing-pending-bits-by-mistake.patch new file mode 100644 index 00000000000..7fc4c380b07 --- /dev/null +++ b/queue-5.4/irqchip-stm32-exti-avoid-losing-interrupts-due-to-clearing-pending-bits-by-mistake.patch @@ -0,0 +1,72 @@ +From e579076ac0a3bebb440fab101aef3c42c9f4c709 Mon Sep 17 00:00:00 2001 +From: qiuguorui1 +Date: Thu, 20 Aug 2020 11:16:29 +0800 +Subject: irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake + +From: qiuguorui1 + +commit e579076ac0a3bebb440fab101aef3c42c9f4c709 upstream. + +In the current code, when the eoi callback of the exti clears the pending +bit of the current interrupt, it will first read the values of fpr and +rpr, then logically OR the corresponding bit of the interrupt number, +and finally write back to fpr and rpr. + +We found through experiments that if two exti interrupts, +we call them int1/int2, arrive almost at the same time. in our scenario, +the time difference is 30 microseconds, assuming int1 is triggered first. + +there will be an extreme scenario: both int's pending bit are set to 1, +the irq handle of int1 is executed first, and eoi handle is then executed, +at this moment, all pending bits are cleared, but the int 2 has not +finally been reported to the cpu yet, which eventually lost int2. + +According to stm32's TRM description about rpr and fpr: Writing a 1 to this +bit will trigger a rising edge event on event x, Writing 0 has no +effect. + +Therefore, when clearing the pending bit, we only need to clear the +pending bit of the irq. + +Fixes: 927abfc4461e7 ("irqchip/stm32: Add stm32mp1 support with hierarchy domain") +Signed-off-by: qiuguorui1 +Signed-off-by: Marc Zyngier +Cc: stable@vger.kernel.org # v4.18+ +Link: https://lore.kernel.org/r/20200820031629.15582-1-qiuguorui1@huawei.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/irqchip/irq-stm32-exti.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/irqchip/irq-stm32-exti.c ++++ b/drivers/irqchip/irq-stm32-exti.c +@@ -431,6 +431,16 @@ static void stm32_irq_ack(struct irq_dat + irq_gc_unlock(gc); + } + ++/* directly set the target bit without reading first. */ ++static inline void stm32_exti_write_bit(struct irq_data *d, u32 reg) ++{ ++ struct stm32_exti_chip_data *chip_data = irq_data_get_irq_chip_data(d); ++ void __iomem *base = chip_data->host_data->base; ++ u32 val = BIT(d->hwirq % IRQS_PER_BANK); ++ ++ writel_relaxed(val, base + reg); ++} ++ + static inline u32 stm32_exti_set_bit(struct irq_data *d, u32 reg) + { + struct stm32_exti_chip_data *chip_data = irq_data_get_irq_chip_data(d); +@@ -464,9 +474,9 @@ static void stm32_exti_h_eoi(struct irq_ + + raw_spin_lock(&chip_data->rlock); + +- stm32_exti_set_bit(d, stm32_bank->rpr_ofst); ++ stm32_exti_write_bit(d, stm32_bank->rpr_ofst); + if (stm32_bank->fpr_ofst != UNDEF_REG) +- stm32_exti_set_bit(d, stm32_bank->fpr_ofst); ++ stm32_exti_write_bit(d, stm32_bank->fpr_ofst); + + raw_spin_unlock(&chip_data->rlock); + diff --git a/queue-5.4/pm-sleep-core-fix-the-handling-of-pending-runtime-resume-requests.patch b/queue-5.4/pm-sleep-core-fix-the-handling-of-pending-runtime-resume-requests.patch new file mode 100644 index 00000000000..346499b8fe5 --- /dev/null +++ b/queue-5.4/pm-sleep-core-fix-the-handling-of-pending-runtime-resume-requests.patch @@ -0,0 +1,82 @@ +From e3eb6e8fba65094328b8dca635d00de74ba75b45 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Mon, 24 Aug 2020 19:35:31 +0200 +Subject: PM: sleep: core: Fix the handling of pending runtime resume requests + +From: Rafael J. Wysocki + +commit e3eb6e8fba65094328b8dca635d00de74ba75b45 upstream. + +It has been reported that system-wide suspend may be aborted in the +absence of any wakeup events due to unforseen interactions of it with +the runtume PM framework. + +One failing scenario is when there are multiple devices sharing an +ACPI power resource and runtime-resume needs to be carried out for +one of them during system-wide suspend (for example, because it needs +to be reconfigured before the whole system goes to sleep). In that +case, the runtime-resume of that device involves turning the ACPI +power resource "on" which in turn causes runtime-resume requests +to be queued up for all of the other devices sharing it. Those +requests go to the runtime PM workqueue which is frozen during +system-wide suspend, so they are not actually taken care of until +the resume of the whole system, but the pm_runtime_barrier() +call in __device_suspend() sees them and triggers system wakeup +events for them which then cause the system-wide suspend to be +aborted if wakeup source objects are in active use. + +Of course, the logic that leads to triggering those wakeup events is +questionable in the first place, because clearly there are cases in +which a pending runtime resume request for a device is not connected +to any real wakeup events in any way (like the one above). Moreover, +it is racy, because the device may be resuming already by the time +the pm_runtime_barrier() runs and so if the driver doesn't take care +of signaling the wakeup event as appropriate, it will be lost. +However, if the driver does take care of that, the extra +pm_wakeup_event() call in the core is redundant. + +Accordingly, drop the conditional pm_wakeup_event() call fron +__device_suspend() and make the latter call pm_runtime_barrier() +alone. Also modify the comment next to that call to reflect the new +code and extend it to mention the need to avoid unwanted interactions +between runtime PM and system-wide device suspend callbacks. + +Fixes: 1e2ef05bb8cf8 ("PM: Limit race conditions between runtime PM and system sleep (v2)") +Signed-off-by: Rafael J. Wysocki +Acked-by: Alan Stern +Reported-by: Utkarsh H Patel +Tested-by: Utkarsh H Patel +Tested-by: Pengfei Xu +Cc: All applicable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/power/main.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -1728,13 +1728,17 @@ static int __device_suspend(struct devic + } + + /* +- * If a device configured to wake up the system from sleep states +- * has been suspended at run time and there's a resume request pending +- * for it, this is equivalent to the device signaling wakeup, so the +- * system suspend operation should be aborted. ++ * Wait for possible runtime PM transitions of the device in progress ++ * to complete and if there's a runtime resume request pending for it, ++ * resume it before proceeding with invoking the system-wide suspend ++ * callbacks for it. ++ * ++ * If the system-wide suspend callbacks below change the configuration ++ * of the device, they must disable runtime PM for it or otherwise ++ * ensure that its runtime-resume callbacks will not be confused by that ++ * change in case they are invoked going forward. + */ +- if (pm_runtime_barrier(dev) && device_may_wakeup(dev)) +- pm_wakeup_event(dev, 0); ++ pm_runtime_barrier(dev); + + if (pm_wakeup_pending()) { + dev->power.direct_complete = false; diff --git a/queue-5.4/powerpc-perf-fix-crashes-with-generic_compat_pmu-bhrb.patch b/queue-5.4/powerpc-perf-fix-crashes-with-generic_compat_pmu-bhrb.patch new file mode 100644 index 00000000000..bdaa963d157 --- /dev/null +++ b/queue-5.4/powerpc-perf-fix-crashes-with-generic_compat_pmu-bhrb.patch @@ -0,0 +1,74 @@ +From b460b512417ae9c8b51a3bdcc09020cd6c60ff69 Mon Sep 17 00:00:00 2001 +From: Alexey Kardashevskiy +Date: Tue, 2 Jun 2020 12:56:12 +1000 +Subject: powerpc/perf: Fix crashes with generic_compat_pmu & BHRB + +From: Alexey Kardashevskiy + +commit b460b512417ae9c8b51a3bdcc09020cd6c60ff69 upstream. + +The bhrb_filter_map ("The Branch History Rolling Buffer") callback is +only defined in raw CPUs' power_pmu structs. The "architected" CPUs +use generic_compat_pmu, which does not have this callback, and crashes +occur if a user tries to enable branch stack for an event. + +This add a NULL pointer check for bhrb_filter_map() which behaves as +if the callback returned an error. + +This does not add the same check for config_bhrb() as the only caller +checks for cpuhw->bhrb_users which remains zero if bhrb_filter_map==0. + +Fixes: be80e758d0c2 ("powerpc/perf: Add generic compat mode pmu driver") +Cc: stable@vger.kernel.org # v5.2+ +Signed-off-by: Alexey Kardashevskiy +Reviewed-by: Madhavan Srinivasan +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200602025612.62707-1-aik@ozlabs.ru +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/perf/core-book3s.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -1522,9 +1522,16 @@ nocheck: + ret = 0; + out: + if (has_branch_stack(event)) { +- power_pmu_bhrb_enable(event); +- cpuhw->bhrb_filter = ppmu->bhrb_filter_map( +- event->attr.branch_sample_type); ++ u64 bhrb_filter = -1; ++ ++ if (ppmu->bhrb_filter_map) ++ bhrb_filter = ppmu->bhrb_filter_map( ++ event->attr.branch_sample_type); ++ ++ if (bhrb_filter != -1) { ++ cpuhw->bhrb_filter = bhrb_filter; ++ power_pmu_bhrb_enable(event); ++ } + } + + perf_pmu_enable(event->pmu); +@@ -1846,7 +1853,6 @@ static int power_pmu_event_init(struct p + int n; + int err; + struct cpu_hw_events *cpuhw; +- u64 bhrb_filter; + + if (!ppmu) + return -ENOENT; +@@ -1952,7 +1958,10 @@ static int power_pmu_event_init(struct p + err = power_check_constraints(cpuhw, events, cflags, n + 1); + + if (has_branch_stack(event)) { +- bhrb_filter = ppmu->bhrb_filter_map( ++ u64 bhrb_filter = -1; ++ ++ if (ppmu->bhrb_filter_map) ++ bhrb_filter = ppmu->bhrb_filter_map( + event->attr.branch_sample_type); + + if (bhrb_filter == -1) { diff --git a/queue-5.4/series b/queue-5.4/series index f7e4a8717f3..0f331902c03 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -171,3 +171,18 @@ xen-uses-irqdesc-irq_data_common-handler_data-to-store-a-per-interrupt-xen-data- usb-host-xhci-fix-ep-context-print-mismatch-in-debugfs.patch xhci-do-warm-reset-when-both-cas-and-xdev_resume-are-set.patch xhci-always-restore-ep_soft_clear_toggle-even-if-ep-reset-failed.patch +arm64-vdso32-make-vdso32-install-conditional.patch +pm-sleep-core-fix-the-handling-of-pending-runtime-resume-requests.patch +powerpc-perf-fix-crashes-with-generic_compat_pmu-bhrb.patch +device-property-fix-the-secondary-firmware-node-handling-in-set_primary_fwnode.patch +crypto-af_alg-work-around-empty-control-messages-without-msg_more.patch +genirq-matrix-deal-with-the-sillyness-of-for_each_cpu-on-up.patch +irqchip-stm32-exti-avoid-losing-interrupts-due-to-clearing-pending-bits-by-mistake.patch +x86-hotplug-silence-apic-only-after-all-interrupts-are-migrated.patch +drm-amdgpu-fix-buffer-overflow-in-info-ioctl.patch +drm-amdgpu-gfx10-refine-mgcg-setting.patch +drm-amd-powerplay-fix-hardmins-not-being-sent-to-smu-for-rv.patch +drm-amd-pm-correct-vega10-swctf-limit-setting.patch +drm-amd-pm-correct-vega12-swctf-limit-setting.patch +drm-amd-pm-correct-vega20-swctf-limit-setting.patch +drm-amd-pm-correct-the-thermal-alert-temperature-limit-settings.patch diff --git a/queue-5.4/x86-hotplug-silence-apic-only-after-all-interrupts-are-migrated.patch b/queue-5.4/x86-hotplug-silence-apic-only-after-all-interrupts-are-migrated.patch new file mode 100644 index 00000000000..1bab67f6039 --- /dev/null +++ b/queue-5.4/x86-hotplug-silence-apic-only-after-all-interrupts-are-migrated.patch @@ -0,0 +1,92 @@ +From 52d6b926aabc47643cd910c85edb262b7f44c168 Mon Sep 17 00:00:00 2001 +From: Ashok Raj +Date: Wed, 26 Aug 2020 21:12:10 -0700 +Subject: x86/hotplug: Silence APIC only after all interrupts are migrated + +From: Ashok Raj + +commit 52d6b926aabc47643cd910c85edb262b7f44c168 upstream. + +There is a race when taking a CPU offline. Current code looks like this: + +native_cpu_disable() +{ + ... + apic_soft_disable(); + /* + * Any existing set bits for pending interrupt to + * this CPU are preserved and will be sent via IPI + * to another CPU by fixup_irqs(). + */ + cpu_disable_common(); + { + .... + /* + * Race window happens here. Once local APIC has been + * disabled any new interrupts from the device to + * the old CPU are lost + */ + fixup_irqs(); // Too late to capture anything in IRR. + ... + } +} + +The fix is to disable the APIC *after* cpu_disable_common(). + +Testing was done with a USB NIC that provided a source of frequent +interrupts. A script migrated interrupts to a specific CPU and +then took that CPU offline. + +Fixes: 60dcaad5736f ("x86/hotplug: Silence APIC and NMI when CPU is dead") +Reported-by: Evan Green +Signed-off-by: Ashok Raj +Signed-off-by: Thomas Gleixner +Tested-by: Mathias Nyman +Tested-by: Evan Green +Reviewed-by: Evan Green +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/lkml/875zdarr4h.fsf@nanos.tec.linutronix.de/ +Link: https://lore.kernel.org/r/1598501530-45821-1-git-send-email-ashok.raj@intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/smpboot.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -1599,14 +1599,28 @@ int native_cpu_disable(void) + if (ret) + return ret; + +- /* +- * Disable the local APIC. Otherwise IPI broadcasts will reach +- * it. It still responds normally to INIT, NMI, SMI, and SIPI +- * messages. +- */ +- apic_soft_disable(); + cpu_disable_common(); + ++ /* ++ * Disable the local APIC. Otherwise IPI broadcasts will reach ++ * it. It still responds normally to INIT, NMI, SMI, and SIPI ++ * messages. ++ * ++ * Disabling the APIC must happen after cpu_disable_common() ++ * which invokes fixup_irqs(). ++ * ++ * Disabling the APIC preserves already set bits in IRR, but ++ * an interrupt arriving after disabling the local APIC does not ++ * set the corresponding IRR bit. ++ * ++ * fixup_irqs() scans IRR for set bits so it can raise a not ++ * yet handled interrupt on the new destination CPU via an IPI ++ * but obviously it can't do so for IRR bits which are not set. ++ * IOW, interrupts arriving after disabling the local APIC will ++ * be lost. ++ */ ++ apic_soft_disable(); ++ + return 0; + } +