From aeb2a9edecf1ec1473079fa1430d5ad4936ecf50 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 21 Oct 2024 10:24:40 +0200 Subject: [PATCH] 6.1-stable patches added patches: irqchip-gic-v4-don-t-allow-a-vmovp-on-a-dying-vpe.patch irqchip-sifive-plic-unmask-interrupt-in-plic_irq_enable.patch pinctrl-apple-check-devm_kasprintf-returned-value.patch pinctrl-ocelot-fix-system-hang-on-level-based-interrupts.patch --- ...4-don-t-allow-a-vmovp-on-a-dying-vpe.patch | 103 ++++++++++++++++++ ...-unmask-interrupt-in-plic_irq_enable.patch | 81 ++++++++++++++ ...-check-devm_kasprintf-returned-value.patch | 37 +++++++ ...ystem-hang-on-level-based-interrupts.patch | 76 +++++++++++++ queue-6.1/series | 4 + 5 files changed, 301 insertions(+) create mode 100644 queue-6.1/irqchip-gic-v4-don-t-allow-a-vmovp-on-a-dying-vpe.patch create mode 100644 queue-6.1/irqchip-sifive-plic-unmask-interrupt-in-plic_irq_enable.patch create mode 100644 queue-6.1/pinctrl-apple-check-devm_kasprintf-returned-value.patch create mode 100644 queue-6.1/pinctrl-ocelot-fix-system-hang-on-level-based-interrupts.patch diff --git a/queue-6.1/irqchip-gic-v4-don-t-allow-a-vmovp-on-a-dying-vpe.patch b/queue-6.1/irqchip-gic-v4-don-t-allow-a-vmovp-on-a-dying-vpe.patch new file mode 100644 index 00000000000..d896d1aa9c5 --- /dev/null +++ b/queue-6.1/irqchip-gic-v4-don-t-allow-a-vmovp-on-a-dying-vpe.patch @@ -0,0 +1,103 @@ +From 1442ee0011983f0c5c4b92380e6853afb513841a Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Wed, 2 Oct 2024 21:49:59 +0100 +Subject: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE + +From: Marc Zyngier + +commit 1442ee0011983f0c5c4b92380e6853afb513841a upstream. + +Kunkun Jiang reported that there is a small window of opportunity for +userspace to force a change of affinity for a VPE while the VPE has already +been unmapped, but the corresponding doorbell interrupt still visible in +/proc/irq/. + +Plug the race by checking the value of vmapp_count, which tracks whether +the VPE is mapped ot not, and returning an error in this case. + +This involves making vmapp_count common to both GICv4.1 and its v4.0 +ancestor. + +Fixes: 64edfaa9a234 ("irqchip/gic-v4.1: Implement the v4.1 flavour of VMAPP") +Reported-by: Kunkun Jiang +Signed-off-by: Marc Zyngier +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/c182ece6-2ba0-ce4f-3404-dba7a3ab6c52@huawei.com +Link: https://lore.kernel.org/all/20241002204959.2051709-1-maz@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-gic-v3-its.c | 18 ++++++++++++------ + include/linux/irqchip/arm-gic-v4.h | 4 +++- + 2 files changed, 15 insertions(+), 7 deletions(-) + +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -793,8 +793,8 @@ static struct its_vpe *its_build_vmapp_c + its_encode_valid(cmd, desc->its_vmapp_cmd.valid); + + if (!desc->its_vmapp_cmd.valid) { ++ alloc = !atomic_dec_return(&desc->its_vmapp_cmd.vpe->vmapp_count); + if (is_v4_1(its)) { +- alloc = !atomic_dec_return(&desc->its_vmapp_cmd.vpe->vmapp_count); + its_encode_alloc(cmd, alloc); + /* + * Unmapping a VPE is self-synchronizing on GICv4.1, +@@ -813,13 +813,13 @@ static struct its_vpe *its_build_vmapp_c + its_encode_vpt_addr(cmd, vpt_addr); + its_encode_vpt_size(cmd, LPI_NRBITS - 1); + ++ alloc = !atomic_fetch_inc(&desc->its_vmapp_cmd.vpe->vmapp_count); ++ + if (!is_v4_1(its)) + goto out; + + vconf_addr = virt_to_phys(page_address(desc->its_vmapp_cmd.vpe->its_vm->vprop_page)); + +- alloc = !atomic_fetch_inc(&desc->its_vmapp_cmd.vpe->vmapp_count); +- + its_encode_alloc(cmd, alloc); + + /* +@@ -3796,6 +3796,13 @@ static int its_vpe_set_affinity(struct i + int from, cpu; + + /* ++ * Check if we're racing against a VPE being destroyed, for ++ * which we don't want to allow a VMOVP. ++ */ ++ if (!atomic_read(&vpe->vmapp_count)) ++ return -EINVAL; ++ ++ /* + * Changing affinity is mega expensive, so let's be as lazy as + * we can and only do it if we really have to. Also, if mapped + * into the proxy device, we need to move the doorbell +@@ -4431,9 +4438,8 @@ static int its_vpe_init(struct its_vpe * + raw_spin_lock_init(&vpe->vpe_lock); + vpe->vpe_id = vpe_id; + vpe->vpt_page = vpt_page; +- if (gic_rdists->has_rvpeid) +- atomic_set(&vpe->vmapp_count, 0); +- else ++ atomic_set(&vpe->vmapp_count, 0); ++ if (!gic_rdists->has_rvpeid) + vpe->vpe_proxy_event = -1; + + return 0; +--- a/include/linux/irqchip/arm-gic-v4.h ++++ b/include/linux/irqchip/arm-gic-v4.h +@@ -58,10 +58,12 @@ struct its_vpe { + bool enabled; + bool group; + } sgi_config[16]; +- atomic_t vmapp_count; + }; + }; + ++ /* Track the VPE being mapped */ ++ atomic_t vmapp_count; ++ + /* + * Ensures mutual exclusion between affinity setting of the + * vPE and vLPI operations using vpe->col_idx. diff --git a/queue-6.1/irqchip-sifive-plic-unmask-interrupt-in-plic_irq_enable.patch b/queue-6.1/irqchip-sifive-plic-unmask-interrupt-in-plic_irq_enable.patch new file mode 100644 index 00000000000..ba9bf03aa35 --- /dev/null +++ b/queue-6.1/irqchip-sifive-plic-unmask-interrupt-in-plic_irq_enable.patch @@ -0,0 +1,81 @@ +From 6b1e0651e9ce8ce418ad4ff360e7b9925dc5da79 Mon Sep 17 00:00:00 2001 +From: Nam Cao +Date: Thu, 3 Oct 2024 10:41:52 +0200 +Subject: irqchip/sifive-plic: Unmask interrupt in plic_irq_enable() + +From: Nam Cao + +commit 6b1e0651e9ce8ce418ad4ff360e7b9925dc5da79 upstream. + +It is possible that an interrupt is disabled and masked at the same time. +When the interrupt is enabled again by enable_irq(), only plic_irq_enable() +is called, not plic_irq_unmask(). The interrupt remains masked and never +raises. + +An example where interrupt is both disabled and masked is when +handle_fasteoi_irq() is the handler, and IRQS_ONESHOT is set. The interrupt +handler: + + 1. Mask the interrupt + 2. Handle the interrupt + 3. Check if interrupt is still enabled, and unmask it (see + cond_unmask_eoi_irq()) + +If another task disables the interrupt in the middle of the above steps, +the interrupt will not get unmasked, and will remain masked when it is +enabled in the future. + +The problem is occasionally observed when PREEMPT_RT is enabled, because +PREEMPT_RT adds the IRQS_ONESHOT flag. But PREEMPT_RT only makes the problem +more likely to appear, the bug has been around since commit a1706a1c5062 +("irqchip/sifive-plic: Separate the enable and mask operations"). + +Fix it by unmasking interrupt in plic_irq_enable(). + +Fixes: a1706a1c5062 ("irqchip/sifive-plic: Separate the enable and mask operations") +Signed-off-by: Nam Cao +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20241003084152.2422969-1-namcao@linutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-sifive-plic.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +--- a/drivers/irqchip/irq-sifive-plic.c ++++ b/drivers/irqchip/irq-sifive-plic.c +@@ -116,16 +116,6 @@ static inline void plic_irq_toggle(const + } + } + +-static void plic_irq_enable(struct irq_data *d) +-{ +- plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1); +-} +- +-static void plic_irq_disable(struct irq_data *d) +-{ +- plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0); +-} +- + static void plic_irq_unmask(struct irq_data *d) + { + struct plic_priv *priv = irq_data_get_irq_chip_data(d); +@@ -140,6 +130,17 @@ static void plic_irq_mask(struct irq_dat + writel(0, priv->regs + PRIORITY_BASE + d->hwirq * PRIORITY_PER_ID); + } + ++static void plic_irq_enable(struct irq_data *d) ++{ ++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1); ++ plic_irq_unmask(d); ++} ++ ++static void plic_irq_disable(struct irq_data *d) ++{ ++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0); ++} ++ + static void plic_irq_eoi(struct irq_data *d) + { + struct plic_handler *handler = this_cpu_ptr(&plic_handlers); diff --git a/queue-6.1/pinctrl-apple-check-devm_kasprintf-returned-value.patch b/queue-6.1/pinctrl-apple-check-devm_kasprintf-returned-value.patch new file mode 100644 index 00000000000..5f381a6532c --- /dev/null +++ b/queue-6.1/pinctrl-apple-check-devm_kasprintf-returned-value.patch @@ -0,0 +1,37 @@ +From 665a58fe663ac7a9ea618dc0b29881649324b116 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Thu, 5 Sep 2024 10:09:17 +0800 +Subject: pinctrl: apple: check devm_kasprintf() returned value + +From: Ma Ke + +commit 665a58fe663ac7a9ea618dc0b29881649324b116 upstream. + +devm_kasprintf() can return a NULL pointer on failure but this returned +value is not checked. Fix this lack and check the returned value. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: a0f160ffcb83 ("pinctrl: add pinctrl/GPIO driver for Apple SoCs") +Signed-off-by: Ma Ke +Reviewed-by: Christophe JAILLET +Link: https://lore.kernel.org/20240905020917.356534-1-make24@iscas.ac.cn +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-apple-gpio.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/pinctrl/pinctrl-apple-gpio.c ++++ b/drivers/pinctrl/pinctrl-apple-gpio.c +@@ -471,6 +471,9 @@ static int apple_gpio_pinctrl_probe(stru + for (i = 0; i < npins; i++) { + pins[i].number = i; + pins[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "PIN%u", i); ++ if (!pins[i].name) ++ return -ENOMEM; ++ + pins[i].drv_data = pctl; + pin_names[i] = pins[i].name; + pin_nums[i] = i; diff --git a/queue-6.1/pinctrl-ocelot-fix-system-hang-on-level-based-interrupts.patch b/queue-6.1/pinctrl-ocelot-fix-system-hang-on-level-based-interrupts.patch new file mode 100644 index 00000000000..71808844874 --- /dev/null +++ b/queue-6.1/pinctrl-ocelot-fix-system-hang-on-level-based-interrupts.patch @@ -0,0 +1,76 @@ +From 93b8ddc54507a227087c60a0013ed833b6ae7d3c Mon Sep 17 00:00:00 2001 +From: Sergey Matsievskiy +Date: Sat, 12 Oct 2024 13:57:43 +0300 +Subject: pinctrl: ocelot: fix system hang on level based interrupts + +From: Sergey Matsievskiy + +commit 93b8ddc54507a227087c60a0013ed833b6ae7d3c upstream. + +The current implementation only calls chained_irq_enter() and +chained_irq_exit() if it detects pending interrupts. + +``` +for (i = 0; i < info->stride; i++) { + uregmap_read(info->map, id_reg + 4 * i, ®); + if (!reg) + continue; + + chained_irq_enter(parent_chip, desc); +``` + +However, in case of GPIO pin configured in level mode and the parent +controller configured in edge mode, GPIO interrupt might be lowered by the +hardware. In the result, if the interrupt is short enough, the parent +interrupt is still pending while the GPIO interrupt is cleared; +chained_irq_enter() never gets called and the system hangs trying to +service the parent interrupt. + +Moving chained_irq_enter() and chained_irq_exit() outside the for loop +ensures that they are called even when GPIO interrupt is lowered by the +hardware. + +The similar code with chained_irq_enter() / chained_irq_exit() functions +wrapping interrupt checking loop may be found in many other drivers: +``` +grep -r -A 10 chained_irq_enter drivers/pinctrl +``` + +Cc: stable@vger.kernel.org +Signed-off-by: Sergey Matsievskiy +Reviewed-by: Alexandre Belloni +Link: https://lore.kernel.org/20241012105743.12450-2-matsievskiysv@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-ocelot.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/pinctrl/pinctrl-ocelot.c ++++ b/drivers/pinctrl/pinctrl-ocelot.c +@@ -1962,21 +1962,21 @@ static void ocelot_irq_handler(struct ir + unsigned int reg = 0, irq, i; + unsigned long irqs; + ++ chained_irq_enter(parent_chip, desc); ++ + for (i = 0; i < info->stride; i++) { + regmap_read(info->map, id_reg + 4 * i, ®); + if (!reg) + continue; + +- chained_irq_enter(parent_chip, desc); +- + irqs = reg; + + for_each_set_bit(irq, &irqs, + min(32U, info->desc->npins - 32 * i)) + generic_handle_domain_irq(chip->irq.domain, irq + 32 * i); +- +- chained_irq_exit(parent_chip, desc); + } ++ ++ chained_irq_exit(parent_chip, desc); + } + + static int ocelot_gpiochip_register(struct platform_device *pdev, diff --git a/queue-6.1/series b/queue-6.1/series index d32b9b7c946..08f2771e826 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -80,3 +80,7 @@ x86-apic-always-explicitly-disarm-tsc-deadline-timer.patch x86-entry_32-do-not-clobber-user-eflags.zf.patch x86-entry_32-clear-cpu-buffers-after-register-restore-in-nmi-return.patch tty-n_gsm-fix-use-after-free-in-gsm_cleanup_mux.patch +pinctrl-ocelot-fix-system-hang-on-level-based-interrupts.patch +pinctrl-apple-check-devm_kasprintf-returned-value.patch +irqchip-gic-v4-don-t-allow-a-vmovp-on-a-dying-vpe.patch +irqchip-sifive-plic-unmask-interrupt-in-plic_irq_enable.patch -- 2.47.3