From: Sasha Levin Date: Sat, 7 Jan 2023 17:15:50 +0000 (-0500) Subject: Fixes for 5.10 X-Git-Tag: v5.15.87~54 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b4b871bbe05bb05b602f53b5cedf1f2c4f9e19f8;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/btrfs-replace-strncpy-with-strscpy.patch b/queue-5.10/btrfs-replace-strncpy-with-strscpy.patch new file mode 100644 index 00000000000..fbb7094a607 --- /dev/null +++ b/queue-5.10/btrfs-replace-strncpy-with-strscpy.patch @@ -0,0 +1,63 @@ +From 2fe7e48813bfa23370815b5f43cca6301bd7d709 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 11:14:45 -0500 +Subject: btrfs: replace strncpy() with strscpy() + +[ Upstream commit 63d5429f68a3d4c4aa27e65a05196c17f86c41d6 ] + +Using strncpy() on NUL-terminated strings are deprecated. To avoid +possible forming of non-terminated string strscpy() should be used. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +CC: stable@vger.kernel.org # 4.9+ +Signed-off-by: Artem Chernyshev +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ioctl.c | 9 +++------ + fs/btrfs/rcu-string.h | 6 +++++- + 2 files changed, 8 insertions(+), 7 deletions(-) + +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index a17076a05c4d..fc335b5e44df 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -3401,13 +3401,10 @@ static long btrfs_ioctl_dev_info(struct btrfs_fs_info *fs_info, + di_args->bytes_used = btrfs_device_get_bytes_used(dev); + di_args->total_bytes = btrfs_device_get_total_bytes(dev); + memcpy(di_args->uuid, dev->uuid, sizeof(di_args->uuid)); +- if (dev->name) { +- strncpy(di_args->path, rcu_str_deref(dev->name), +- sizeof(di_args->path) - 1); +- di_args->path[sizeof(di_args->path) - 1] = 0; +- } else { ++ if (dev->name) ++ strscpy(di_args->path, rcu_str_deref(dev->name), sizeof(di_args->path)); ++ else + di_args->path[0] = '\0'; +- } + + out: + rcu_read_unlock(); +diff --git a/fs/btrfs/rcu-string.h b/fs/btrfs/rcu-string.h +index 5c1a617eb25d..5c2b66d155ef 100644 +--- a/fs/btrfs/rcu-string.h ++++ b/fs/btrfs/rcu-string.h +@@ -18,7 +18,11 @@ static inline struct rcu_string *rcu_string_strdup(const char *src, gfp_t mask) + (len * sizeof(char)), mask); + if (!ret) + return ret; +- strncpy(ret->str, src, len); ++ /* Warn if the source got unexpectedly truncated. */ ++ if (WARN_ON(strscpy(ret->str, src, len) < 0)) { ++ kfree(ret); ++ return NULL; ++ } + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.10/media-s5p-mfc-clear-workbit-to-handle-error-conditio.patch b/queue-5.10/media-s5p-mfc-clear-workbit-to-handle-error-conditio.patch new file mode 100644 index 00000000000..261ac145c57 --- /dev/null +++ b/queue-5.10/media-s5p-mfc-clear-workbit-to-handle-error-conditio.patch @@ -0,0 +1,43 @@ +From 0a06142023c053fc4b3c00a58bf6833cef00c6ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 16:02:26 +0530 +Subject: media: s5p-mfc: Clear workbit to handle error condition + +From: Smitha T Murthy + +[ Upstream commit d3f3c2fe54e30b0636496d842ffbb5ad3a547f9b ] + +During error on CLOSE_INSTANCE command, ctx_work_bits was not getting +cleared. During consequent mfc execution NULL pointer dereferencing of +this context led to kernel panic. This patch fixes this issue by making +sure to clear ctx_work_bits always. + +Fixes: 818cd91ab8c6 ("[media] s5p-mfc: Extract open/close MFC instance commands") +Cc: stable@vger.kernel.org +Cc: linux-fsd@tesla.com +Signed-off-by: Smitha T Murthy +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c +index da138c314963..58822ec5370e 100644 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c +@@ -468,8 +468,10 @@ void s5p_mfc_close_mfc_inst(struct s5p_mfc_dev *dev, struct s5p_mfc_ctx *ctx) + s5p_mfc_hw_call(dev->mfc_ops, try_run, dev); + /* Wait until instance is returned or timeout occurred */ + if (s5p_mfc_wait_for_done_ctx(ctx, +- S5P_MFC_R2H_CMD_CLOSE_INSTANCE_RET, 0)) ++ S5P_MFC_R2H_CMD_CLOSE_INSTANCE_RET, 0)){ ++ clear_work_bit_irqsave(ctx); + mfc_err("Err returning instance\n"); ++ } + + /* Free resources */ + s5p_mfc_hw_call(dev->mfc_ops, release_codec_buffers, ctx); +-- +2.35.1 + diff --git a/queue-5.10/media-s5p-mfc-fix-in-register-read-and-write-for-h26.patch b/queue-5.10/media-s5p-mfc-fix-in-register-read-and-write-for-h26.patch new file mode 100644 index 00000000000..110358a0fb0 --- /dev/null +++ b/queue-5.10/media-s5p-mfc-fix-in-register-read-and-write-for-h26.patch @@ -0,0 +1,85 @@ +From e212551961ff910583bfe437d5036d18acabd26c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 16:02:25 +0530 +Subject: media: s5p-mfc: Fix in register read and write for H264 + +From: Smitha T Murthy + +[ Upstream commit 06710cd5d2436135046898d7e4b9408c8bb99446 ] + +Few of the H264 encoder registers written were not getting reflected +since the read values were not stored and getting overwritten. + +Fixes: 6a9c6f681257 ("[media] s5p-mfc: Add variants to access mfc registers") + +Cc: stable@vger.kernel.org +Cc: linux-fsd@tesla.com +Signed-off-by: Smitha T Murthy +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c +index a1453053e31a..ef8169f6c428 100644 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c +@@ -1060,7 +1060,7 @@ static int s5p_mfc_set_enc_params_h264(struct s5p_mfc_ctx *ctx) + } + + /* aspect ratio VUI */ +- readl(mfc_regs->e_h264_options); ++ reg = readl(mfc_regs->e_h264_options); + reg &= ~(0x1 << 5); + reg |= ((p_h264->vui_sar & 0x1) << 5); + writel(reg, mfc_regs->e_h264_options); +@@ -1083,7 +1083,7 @@ static int s5p_mfc_set_enc_params_h264(struct s5p_mfc_ctx *ctx) + + /* intra picture period for H.264 open GOP */ + /* control */ +- readl(mfc_regs->e_h264_options); ++ reg = readl(mfc_regs->e_h264_options); + reg &= ~(0x1 << 4); + reg |= ((p_h264->open_gop & 0x1) << 4); + writel(reg, mfc_regs->e_h264_options); +@@ -1097,23 +1097,23 @@ static int s5p_mfc_set_enc_params_h264(struct s5p_mfc_ctx *ctx) + } + + /* 'WEIGHTED_BI_PREDICTION' for B is disable */ +- readl(mfc_regs->e_h264_options); ++ reg = readl(mfc_regs->e_h264_options); + reg &= ~(0x3 << 9); + writel(reg, mfc_regs->e_h264_options); + + /* 'CONSTRAINED_INTRA_PRED_ENABLE' is disable */ +- readl(mfc_regs->e_h264_options); ++ reg = readl(mfc_regs->e_h264_options); + reg &= ~(0x1 << 14); + writel(reg, mfc_regs->e_h264_options); + + /* ASO */ +- readl(mfc_regs->e_h264_options); ++ reg = readl(mfc_regs->e_h264_options); + reg &= ~(0x1 << 6); + reg |= ((p_h264->aso & 0x1) << 6); + writel(reg, mfc_regs->e_h264_options); + + /* hier qp enable */ +- readl(mfc_regs->e_h264_options); ++ reg = readl(mfc_regs->e_h264_options); + reg &= ~(0x1 << 8); + reg |= ((p_h264->open_gop & 0x1) << 8); + writel(reg, mfc_regs->e_h264_options); +@@ -1134,7 +1134,7 @@ static int s5p_mfc_set_enc_params_h264(struct s5p_mfc_ctx *ctx) + writel(reg, mfc_regs->e_h264_num_t_layer); + + /* frame packing SEI generation */ +- readl(mfc_regs->e_h264_options); ++ reg = readl(mfc_regs->e_h264_options); + reg &= ~(0x1 << 25); + reg |= ((p_h264->sei_frame_packing & 0x1) << 25); + writel(reg, mfc_regs->e_h264_options); +-- +2.35.1 + diff --git a/queue-5.10/media-s5p-mfc-fix-to-handle-reference-queue-during-f.patch b/queue-5.10/media-s5p-mfc-fix-to-handle-reference-queue-during-f.patch new file mode 100644 index 00000000000..6ae60a7af63 --- /dev/null +++ b/queue-5.10/media-s5p-mfc-fix-to-handle-reference-queue-during-f.patch @@ -0,0 +1,67 @@ +From 2cb1dfcc1c2eda892cb327cc1031f263daa337d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 16:02:27 +0530 +Subject: media: s5p-mfc: Fix to handle reference queue during finishing + +From: Smitha T Murthy + +[ Upstream commit d8a46bc4e1e0446459daa77c4ce14218d32dacf9 ] + +On receiving last buffer driver puts MFC to MFCINST_FINISHING state which +in turn skips transferring of frame from SRC to REF queue. This causes +driver to stop MFC encoding and last frame is lost. + +This patch guarantees safe handling of frames during MFCINST_FINISHING and +correct clearing of workbit to avoid early stopping of encoding. + +Fixes: af9357467810 ("[media] MFC: Add MFC 5.1 V4L2 driver") + +Cc: stable@vger.kernel.org +Cc: linux-fsd@tesla.com +Signed-off-by: Smitha T Murthy +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/s5p-mfc/s5p_mfc_enc.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c +index acc2217dd7e9..62a1ad347fa7 100644 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c +@@ -1218,6 +1218,7 @@ static int enc_post_frame_start(struct s5p_mfc_ctx *ctx) + unsigned long mb_y_addr, mb_c_addr; + int slice_type; + unsigned int strm_size; ++ bool src_ready; + + slice_type = s5p_mfc_hw_call(dev->mfc_ops, get_enc_slice_type, dev); + strm_size = s5p_mfc_hw_call(dev->mfc_ops, get_enc_strm_size, dev); +@@ -1257,7 +1258,8 @@ static int enc_post_frame_start(struct s5p_mfc_ctx *ctx) + } + } + } +- if ((ctx->src_queue_cnt > 0) && (ctx->state == MFCINST_RUNNING)) { ++ if (ctx->src_queue_cnt > 0 && (ctx->state == MFCINST_RUNNING || ++ ctx->state == MFCINST_FINISHING)) { + mb_entry = list_entry(ctx->src_queue.next, struct s5p_mfc_buf, + list); + if (mb_entry->flags & MFC_BUF_FLAG_USED) { +@@ -1288,7 +1290,13 @@ static int enc_post_frame_start(struct s5p_mfc_ctx *ctx) + vb2_set_plane_payload(&mb_entry->b->vb2_buf, 0, strm_size); + vb2_buffer_done(&mb_entry->b->vb2_buf, VB2_BUF_STATE_DONE); + } +- if ((ctx->src_queue_cnt == 0) || (ctx->dst_queue_cnt == 0)) ++ ++ src_ready = true; ++ if (ctx->state == MFCINST_RUNNING && ctx->src_queue_cnt == 0) ++ src_ready = false; ++ if (ctx->state == MFCINST_FINISHING && ctx->ref_queue_cnt == 0) ++ src_ready = false; ++ if (!src_ready || ctx->dst_queue_cnt == 0) + clear_work_bit(ctx); + + return 0; +-- +2.35.1 + diff --git a/queue-5.10/perf-x86-intel-uncore-clear-attr_update-properly.patch b/queue-5.10/perf-x86-intel-uncore-clear-attr_update-properly.patch new file mode 100644 index 00000000000..bd8fb6fce14 --- /dev/null +++ b/queue-5.10/perf-x86-intel-uncore-clear-attr_update-properly.patch @@ -0,0 +1,66 @@ +From ebe0c991b84dded1cbf72125bea6061f26a367d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 12:28:25 +0000 +Subject: perf/x86/intel/uncore: Clear attr_update properly + +From: Alexander Antonov + +[ Upstream commit 6532783310e2b2f50dc13f46c49aa6546cb6e7a3 ] + +Current clear_attr_update procedure in pmu_set_mapping() sets attr_update +field in NULL that is not correct because intel_uncore_type pmu types can +contain several groups in attr_update field. For example, SPR platform +already has uncore_alias_group to update and then UPI topology group will +be added in next patches. + +Fix current behavior and clear attr_update group related to mapping only. + +Fixes: bb42b3d39781 ("perf/x86/intel/uncore: Expose an Uncore unit to IIO PMON mapping") +Signed-off-by: Alexander Antonov +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kan Liang +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20221117122833.3103580-4-alexander.antonov@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/uncore_snbep.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c +index 03e34a440cdf..ad084a5a1463 100644 +--- a/arch/x86/events/intel/uncore_snbep.c ++++ b/arch/x86/events/intel/uncore_snbep.c +@@ -3747,6 +3747,21 @@ static const struct attribute_group *skx_iio_attr_update[] = { + NULL, + }; + ++static void pmu_clear_mapping_attr(const struct attribute_group **groups, ++ struct attribute_group *ag) ++{ ++ int i; ++ ++ for (i = 0; groups[i]; i++) { ++ if (groups[i] == ag) { ++ for (i++; groups[i]; i++) ++ groups[i - 1] = groups[i]; ++ groups[i - 1] = NULL; ++ break; ++ } ++ } ++} ++ + static int + pmu_iio_set_mapping(struct intel_uncore_type *type, struct attribute_group *ag) + { +@@ -3795,7 +3810,7 @@ pmu_iio_set_mapping(struct intel_uncore_type *type, struct attribute_group *ag) + clear_topology: + kfree(type->topology); + clear_attr_update: +- type->attr_update = NULL; ++ pmu_clear_mapping_attr(type->attr_update, ag); + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.10/perf-x86-intel-uncore-generalize-i-o-stacks-to-pmon-.patch b/queue-5.10/perf-x86-intel-uncore-generalize-i-o-stacks-to-pmon-.patch new file mode 100644 index 00000000000..fa381958210 --- /dev/null +++ b/queue-5.10/perf-x86-intel-uncore-generalize-i-o-stacks-to-pmon-.patch @@ -0,0 +1,118 @@ +From 296f2965ec81640be73b1661a7e8a1b444f44c2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 16:16:12 +0300 +Subject: perf/x86/intel/uncore: Generalize I/O stacks to PMON mapping + procedure + +From: Alexander Antonov + +[ Upstream commit f471fac77b41a2573c7b677ef790bf18a0e64195 ] + +Currently I/O stacks to IIO PMON mapping is available on Skylake servers +only and need to make code more general to easily enable further platforms. +So, introduce get_topology() callback in struct intel_uncore_type which +allows to move common code to separate function and make mapping procedure +more general. + +Signed-off-by: Alexander Antonov +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kan Liang +Link: https://lkml.kernel.org/r/20210426131614.16205-2-alexander.antonov@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/uncore.h | 1 + + arch/x86/events/intel/uncore_snbep.c | 28 +++++++++++++++++++++------- + 2 files changed, 22 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h +index 9efea154349d..4e2953a9eff0 100644 +--- a/arch/x86/events/intel/uncore.h ++++ b/arch/x86/events/intel/uncore.h +@@ -84,6 +84,7 @@ struct intel_uncore_type { + /* + * Optional callbacks for managing mapping of Uncore units to PMONs + */ ++ int (*get_topology)(struct intel_uncore_type *type); + int (*set_mapping)(struct intel_uncore_type *type); + void (*cleanup_mapping)(struct intel_uncore_type *type); + }; +diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c +index 2fd49cd515f5..03e34a440cdf 100644 +--- a/arch/x86/events/intel/uncore_snbep.c ++++ b/arch/x86/events/intel/uncore_snbep.c +@@ -3643,12 +3643,19 @@ static inline u8 skx_iio_stack(struct intel_uncore_pmu *pmu, int die) + } + + static umode_t +-skx_iio_mapping_visible(struct kobject *kobj, struct attribute *attr, int die) ++pmu_iio_mapping_visible(struct kobject *kobj, struct attribute *attr, ++ int die, int zero_bus_pmu) + { + struct intel_uncore_pmu *pmu = dev_to_uncore_pmu(kobj_to_dev(kobj)); + +- /* Root bus 0x00 is valid only for die 0 AND pmu_idx = 0. */ +- return (!skx_iio_stack(pmu, die) && pmu->pmu_idx) ? 0 : attr->mode; ++ return (!skx_iio_stack(pmu, die) && pmu->pmu_idx != zero_bus_pmu) ? 0 : attr->mode; ++} ++ ++static umode_t ++skx_iio_mapping_visible(struct kobject *kobj, struct attribute *attr, int die) ++{ ++ /* Root bus 0x00 is valid only for pmu_idx = 0. */ ++ return pmu_iio_mapping_visible(kobj, attr, die, 0); + } + + static ssize_t skx_iio_mapping_show(struct device *dev, +@@ -3740,7 +3747,8 @@ static const struct attribute_group *skx_iio_attr_update[] = { + NULL, + }; + +-static int skx_iio_set_mapping(struct intel_uncore_type *type) ++static int ++pmu_iio_set_mapping(struct intel_uncore_type *type, struct attribute_group *ag) + { + char buf[64]; + int ret; +@@ -3748,8 +3756,8 @@ static int skx_iio_set_mapping(struct intel_uncore_type *type) + struct attribute **attrs = NULL; + struct dev_ext_attribute *eas = NULL; + +- ret = skx_iio_get_topology(type); +- if (ret) ++ ret = type->get_topology(type); ++ if (ret < 0) + goto clear_attr_update; + + ret = -ENOMEM; +@@ -3775,7 +3783,7 @@ static int skx_iio_set_mapping(struct intel_uncore_type *type) + eas[die].var = (void *)die; + attrs[die] = &eas[die].attr.attr; + } +- skx_iio_mapping_group.attrs = attrs; ++ ag->attrs = attrs; + + return 0; + err: +@@ -3791,6 +3799,11 @@ static int skx_iio_set_mapping(struct intel_uncore_type *type) + return ret; + } + ++static int skx_iio_set_mapping(struct intel_uncore_type *type) ++{ ++ return pmu_iio_set_mapping(type, &skx_iio_mapping_group); ++} ++ + static void skx_iio_cleanup_mapping(struct intel_uncore_type *type) + { + struct attribute **attr = skx_iio_mapping_group.attrs; +@@ -3821,6 +3834,7 @@ static struct intel_uncore_type skx_uncore_iio = { + .ops = &skx_uncore_iio_ops, + .format_group = &skx_uncore_iio_format_group, + .attr_update = skx_iio_attr_update, ++ .get_topology = skx_iio_get_topology, + .set_mapping = skx_iio_set_mapping, + .cleanup_mapping = skx_iio_cleanup_mapping, + }; +-- +2.35.1 + diff --git a/queue-5.10/series b/queue-5.10/series index 6f52495ffac..34580565389 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -689,3 +689,11 @@ drm-amdgpu-handle-polaris10-11-overlap-asics-v2.patch drm-amdgpu-make-display-pinning-more-flexible-v2.patch cifs-prevent-copying-past-input-buffer-boundaries.patch arm-renumber-bits-related-to-_tif_work_mask.patch +perf-x86-intel-uncore-generalize-i-o-stacks-to-pmon-.patch +perf-x86-intel-uncore-clear-attr_update-properly.patch +btrfs-replace-strncpy-with-strscpy.patch +x86-mce-get-rid-of-msr_ops.patch +x86-mce-amd-clear-dfr-errors-found-in-thr-handler.patch +media-s5p-mfc-fix-to-handle-reference-queue-during-f.patch +media-s5p-mfc-clear-workbit-to-handle-error-conditio.patch +media-s5p-mfc-fix-in-register-read-and-write-for-h26.patch diff --git a/queue-5.10/x86-mce-amd-clear-dfr-errors-found-in-thr-handler.patch b/queue-5.10/x86-mce-amd-clear-dfr-errors-found-in-thr-handler.patch new file mode 100644 index 00000000000..7c58b43321c --- /dev/null +++ b/queue-5.10/x86-mce-amd-clear-dfr-errors-found-in-thr-handler.patch @@ -0,0 +1,101 @@ +From d2d0cb10bd73baf3ad2c5f5f1beea9e6a46fc499 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jun 2022 15:59:43 +0000 +Subject: x86/MCE/AMD: Clear DFR errors found in THR handler + +From: Yazen Ghannam + +[ Upstream commit bc1b705b0eee4c645ad8b3bbff3c8a66e9688362 ] + +AMD's MCA Thresholding feature counts errors of all severity levels, not +just correctable errors. If a deferred error causes the threshold limit +to be reached (it was the error that caused the overflow), then both a +deferred error interrupt and a thresholding interrupt will be triggered. + +The order of the interrupts is not guaranteed. If the threshold +interrupt handler is executed first, then it will clear MCA_STATUS for +the error. It will not check or clear MCA_DESTAT which also holds a copy +of the deferred error. When the deferred error interrupt handler runs it +will not find an error in MCA_STATUS, but it will find the error in +MCA_DESTAT. This will cause two errors to be logged. + +Check for deferred errors when handling a threshold interrupt. If a bank +contains a deferred error, then clear the bank's MCA_DESTAT register. + +Define a new helper function to do the deferred error check and clearing +of MCA_DESTAT. + + [ bp: Simplify, convert comment to passive voice. ] + +Fixes: 37d43acfd79f ("x86/mce/AMD: Redo error logging from APIC LVT interrupt handlers") +Signed-off-by: Yazen Ghannam +Signed-off-by: Borislav Petkov +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20220621155943.33623-1-yazen.ghannam@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mce/amd.c | 33 ++++++++++++++++++++------------- + 1 file changed, 20 insertions(+), 13 deletions(-) + +diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c +index 34ebe1aea1c7..4f9b7c1cfc36 100644 +--- a/arch/x86/kernel/cpu/mce/amd.c ++++ b/arch/x86/kernel/cpu/mce/amd.c +@@ -952,6 +952,24 @@ _log_error_bank(unsigned int bank, u32 msr_stat, u32 msr_addr, u64 misc) + return status & MCI_STATUS_DEFERRED; + } + ++static bool _log_error_deferred(unsigned int bank, u32 misc) ++{ ++ if (!_log_error_bank(bank, mca_msr_reg(bank, MCA_STATUS), ++ mca_msr_reg(bank, MCA_ADDR), misc)) ++ return false; ++ ++ /* ++ * Non-SMCA systems don't have MCA_DESTAT/MCA_DEADDR registers. ++ * Return true here to avoid accessing these registers. ++ */ ++ if (!mce_flags.smca) ++ return true; ++ ++ /* Clear MCA_DESTAT if the deferred error was logged from MCA_STATUS. */ ++ wrmsrl(MSR_AMD64_SMCA_MCx_DESTAT(bank), 0); ++ return true; ++} ++ + /* + * We have three scenarios for checking for Deferred errors: + * +@@ -963,19 +981,8 @@ _log_error_bank(unsigned int bank, u32 msr_stat, u32 msr_addr, u64 misc) + */ + static void log_error_deferred(unsigned int bank) + { +- bool defrd; +- +- defrd = _log_error_bank(bank, mca_msr_reg(bank, MCA_STATUS), +- mca_msr_reg(bank, MCA_ADDR), 0); +- +- if (!mce_flags.smca) +- return; +- +- /* Clear MCA_DESTAT if we logged the deferred error from MCA_STATUS. */ +- if (defrd) { +- wrmsrl(MSR_AMD64_SMCA_MCx_DESTAT(bank), 0); ++ if (_log_error_deferred(bank, 0)) + return; +- } + + /* + * Only deferred errors are logged in MCA_DE{STAT,ADDR} so just check +@@ -996,7 +1003,7 @@ static void amd_deferred_error_interrupt(void) + + static void log_error_thresholding(unsigned int bank, u64 misc) + { +- _log_error_bank(bank, mca_msr_reg(bank, MCA_STATUS), mca_msr_reg(bank, MCA_ADDR), misc); ++ _log_error_deferred(bank, misc); + } + + static void log_and_reset_block(struct threshold_block *block) +-- +2.35.1 + diff --git a/queue-5.10/x86-mce-get-rid-of-msr_ops.patch b/queue-5.10/x86-mce-get-rid-of-msr_ops.patch new file mode 100644 index 00000000000..7d3c8cf2932 --- /dev/null +++ b/queue-5.10/x86-mce-get-rid-of-msr_ops.patch @@ -0,0 +1,294 @@ +From d2b8054a43cfba73270dbb22b5c6de6abaf8a262 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Sep 2021 13:33:22 +0200 +Subject: x86/mce: Get rid of msr_ops + +From: Borislav Petkov + +[ Upstream commit 8121b8f947be0033f567619be204639a50cad298 ] + +Avoid having indirect calls and use a normal function which returns the +proper MSR address based on ->smca setting. + +No functional changes. + +Signed-off-by: Borislav Petkov +Reviewed-by: Tony Luck +Link: https://lkml.kernel.org/r/20210922165101.18951-4-bp@alien8.de +Stable-dep-of: bc1b705b0eee ("x86/MCE/AMD: Clear DFR errors found in THR handler") +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mce/amd.c | 10 ++-- + arch/x86/kernel/cpu/mce/core.c | 95 ++++++++++-------------------- + arch/x86/kernel/cpu/mce/internal.h | 12 ++-- + 3 files changed, 42 insertions(+), 75 deletions(-) + +diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c +index 09f7c652346a..34ebe1aea1c7 100644 +--- a/arch/x86/kernel/cpu/mce/amd.c ++++ b/arch/x86/kernel/cpu/mce/amd.c +@@ -513,7 +513,7 @@ static u32 get_block_address(u32 current_addr, u32 low, u32 high, + /* Fall back to method we used for older processors: */ + switch (block) { + case 0: +- addr = msr_ops.misc(bank); ++ addr = mca_msr_reg(bank, MCA_MISC); + break; + case 1: + offset = ((low & MASK_BLKPTR_LO) >> 21); +@@ -965,8 +965,8 @@ static void log_error_deferred(unsigned int bank) + { + bool defrd; + +- defrd = _log_error_bank(bank, msr_ops.status(bank), +- msr_ops.addr(bank), 0); ++ defrd = _log_error_bank(bank, mca_msr_reg(bank, MCA_STATUS), ++ mca_msr_reg(bank, MCA_ADDR), 0); + + if (!mce_flags.smca) + return; +@@ -996,7 +996,7 @@ static void amd_deferred_error_interrupt(void) + + static void log_error_thresholding(unsigned int bank, u64 misc) + { +- _log_error_bank(bank, msr_ops.status(bank), msr_ops.addr(bank), misc); ++ _log_error_bank(bank, mca_msr_reg(bank, MCA_STATUS), mca_msr_reg(bank, MCA_ADDR), misc); + } + + static void log_and_reset_block(struct threshold_block *block) +@@ -1384,7 +1384,7 @@ static int threshold_create_bank(struct threshold_bank **bp, unsigned int cpu, + } + } + +- err = allocate_threshold_blocks(cpu, b, bank, 0, msr_ops.misc(bank)); ++ err = allocate_threshold_blocks(cpu, b, bank, 0, mca_msr_reg(bank, MCA_MISC)); + if (err) + goto out_kobj; + +diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c +index 5cf1a024408b..1906387a0faf 100644 +--- a/arch/x86/kernel/cpu/mce/core.c ++++ b/arch/x86/kernel/cpu/mce/core.c +@@ -176,53 +176,27 @@ void mce_unregister_decode_chain(struct notifier_block *nb) + } + EXPORT_SYMBOL_GPL(mce_unregister_decode_chain); + +-static inline u32 ctl_reg(int bank) ++u32 mca_msr_reg(int bank, enum mca_msr reg) + { +- return MSR_IA32_MCx_CTL(bank); +-} +- +-static inline u32 status_reg(int bank) +-{ +- return MSR_IA32_MCx_STATUS(bank); +-} +- +-static inline u32 addr_reg(int bank) +-{ +- return MSR_IA32_MCx_ADDR(bank); +-} +- +-static inline u32 misc_reg(int bank) +-{ +- return MSR_IA32_MCx_MISC(bank); +-} +- +-static inline u32 smca_ctl_reg(int bank) +-{ +- return MSR_AMD64_SMCA_MCx_CTL(bank); +-} +- +-static inline u32 smca_status_reg(int bank) +-{ +- return MSR_AMD64_SMCA_MCx_STATUS(bank); +-} ++ if (mce_flags.smca) { ++ switch (reg) { ++ case MCA_CTL: return MSR_AMD64_SMCA_MCx_CTL(bank); ++ case MCA_ADDR: return MSR_AMD64_SMCA_MCx_ADDR(bank); ++ case MCA_MISC: return MSR_AMD64_SMCA_MCx_MISC(bank); ++ case MCA_STATUS: return MSR_AMD64_SMCA_MCx_STATUS(bank); ++ } ++ } + +-static inline u32 smca_addr_reg(int bank) +-{ +- return MSR_AMD64_SMCA_MCx_ADDR(bank); +-} ++ switch (reg) { ++ case MCA_CTL: return MSR_IA32_MCx_CTL(bank); ++ case MCA_ADDR: return MSR_IA32_MCx_ADDR(bank); ++ case MCA_MISC: return MSR_IA32_MCx_MISC(bank); ++ case MCA_STATUS: return MSR_IA32_MCx_STATUS(bank); ++ } + +-static inline u32 smca_misc_reg(int bank) +-{ +- return MSR_AMD64_SMCA_MCx_MISC(bank); ++ return 0; + } + +-struct mca_msr_regs msr_ops = { +- .ctl = ctl_reg, +- .status = status_reg, +- .addr = addr_reg, +- .misc = misc_reg +-}; +- + static void __print_mce(struct mce *m) + { + pr_emerg(HW_ERR "CPU %d: Machine Check%s: %Lx Bank %d: %016Lx\n", +@@ -371,11 +345,11 @@ static int msr_to_offset(u32 msr) + + if (msr == mca_cfg.rip_msr) + return offsetof(struct mce, ip); +- if (msr == msr_ops.status(bank)) ++ if (msr == mca_msr_reg(bank, MCA_STATUS)) + return offsetof(struct mce, status); +- if (msr == msr_ops.addr(bank)) ++ if (msr == mca_msr_reg(bank, MCA_ADDR)) + return offsetof(struct mce, addr); +- if (msr == msr_ops.misc(bank)) ++ if (msr == mca_msr_reg(bank, MCA_MISC)) + return offsetof(struct mce, misc); + if (msr == MSR_IA32_MCG_STATUS) + return offsetof(struct mce, mcgstatus); +@@ -694,10 +668,10 @@ static struct notifier_block mce_default_nb = { + static noinstr void mce_read_aux(struct mce *m, int i) + { + if (m->status & MCI_STATUS_MISCV) +- m->misc = mce_rdmsrl(msr_ops.misc(i)); ++ m->misc = mce_rdmsrl(mca_msr_reg(i, MCA_MISC)); + + if (m->status & MCI_STATUS_ADDRV) { +- m->addr = mce_rdmsrl(msr_ops.addr(i)); ++ m->addr = mce_rdmsrl(mca_msr_reg(i, MCA_ADDR)); + + /* + * Mask the reported address by the reported granularity. +@@ -767,7 +741,7 @@ bool machine_check_poll(enum mcp_flags flags, mce_banks_t *b) + m.bank = i; + + barrier(); +- m.status = mce_rdmsrl(msr_ops.status(i)); ++ m.status = mce_rdmsrl(mca_msr_reg(i, MCA_STATUS)); + + /* If this entry is not valid, ignore it */ + if (!(m.status & MCI_STATUS_VAL)) +@@ -835,7 +809,7 @@ bool machine_check_poll(enum mcp_flags flags, mce_banks_t *b) + /* + * Clear state for this bank. + */ +- mce_wrmsrl(msr_ops.status(i), 0); ++ mce_wrmsrl(mca_msr_reg(i, MCA_STATUS), 0); + } + + /* +@@ -860,7 +834,7 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp, + int i; + + for (i = 0; i < this_cpu_read(mce_num_banks); i++) { +- m->status = mce_rdmsrl(msr_ops.status(i)); ++ m->status = mce_rdmsrl(mca_msr_reg(i, MCA_STATUS)); + if (!(m->status & MCI_STATUS_VAL)) + continue; + +@@ -1149,7 +1123,7 @@ static void mce_clear_state(unsigned long *toclear) + + for (i = 0; i < this_cpu_read(mce_num_banks); i++) { + if (test_bit(i, toclear)) +- mce_wrmsrl(msr_ops.status(i), 0); ++ mce_wrmsrl(mca_msr_reg(i, MCA_STATUS), 0); + } + } + +@@ -1208,7 +1182,7 @@ static void __mc_scan_banks(struct mce *m, struct pt_regs *regs, struct mce *fin + m->addr = 0; + m->bank = i; + +- m->status = mce_rdmsrl(msr_ops.status(i)); ++ m->status = mce_rdmsrl(mca_msr_reg(i, MCA_STATUS)); + if (!(m->status & MCI_STATUS_VAL)) + continue; + +@@ -1704,8 +1678,8 @@ static void __mcheck_cpu_init_clear_banks(void) + + if (!b->init) + continue; +- wrmsrl(msr_ops.ctl(i), b->ctl); +- wrmsrl(msr_ops.status(i), 0); ++ wrmsrl(mca_msr_reg(i, MCA_CTL), b->ctl); ++ wrmsrl(mca_msr_reg(i, MCA_STATUS), 0); + } + } + +@@ -1731,7 +1705,7 @@ static void __mcheck_cpu_check_banks(void) + if (!b->init) + continue; + +- rdmsrl(msr_ops.ctl(i), msrval); ++ rdmsrl(mca_msr_reg(i, MCA_CTL), msrval); + b->init = !!msrval; + } + } +@@ -1890,13 +1864,6 @@ static void __mcheck_cpu_init_early(struct cpuinfo_x86 *c) + mce_flags.succor = !!cpu_has(c, X86_FEATURE_SUCCOR); + mce_flags.smca = !!cpu_has(c, X86_FEATURE_SMCA); + mce_flags.amd_threshold = 1; +- +- if (mce_flags.smca) { +- msr_ops.ctl = smca_ctl_reg; +- msr_ops.status = smca_status_reg; +- msr_ops.addr = smca_addr_reg; +- msr_ops.misc = smca_misc_reg; +- } + } + } + +@@ -2272,7 +2239,7 @@ static void mce_disable_error_reporting(void) + struct mce_bank *b = &mce_banks[i]; + + if (b->init) +- wrmsrl(msr_ops.ctl(i), 0); ++ wrmsrl(mca_msr_reg(i, MCA_CTL), 0); + } + return; + } +@@ -2624,7 +2591,7 @@ static void mce_reenable_cpu(void) + struct mce_bank *b = &mce_banks[i]; + + if (b->init) +- wrmsrl(msr_ops.ctl(i), b->ctl); ++ wrmsrl(mca_msr_reg(i, MCA_CTL), b->ctl); + } + } + +diff --git a/arch/x86/kernel/cpu/mce/internal.h b/arch/x86/kernel/cpu/mce/internal.h +index 88dcc79cfb07..3a485c0d5791 100644 +--- a/arch/x86/kernel/cpu/mce/internal.h ++++ b/arch/x86/kernel/cpu/mce/internal.h +@@ -168,14 +168,14 @@ struct mce_vendor_flags { + + extern struct mce_vendor_flags mce_flags; + +-struct mca_msr_regs { +- u32 (*ctl) (int bank); +- u32 (*status) (int bank); +- u32 (*addr) (int bank); +- u32 (*misc) (int bank); ++enum mca_msr { ++ MCA_CTL, ++ MCA_STATUS, ++ MCA_ADDR, ++ MCA_MISC, + }; + +-extern struct mca_msr_regs msr_ops; ++u32 mca_msr_reg(int bank, enum mca_msr reg); + + /* Decide whether to add MCE record to MCE event pool or filter it out. */ + extern bool filter_mce(struct mce *m); +-- +2.35.1 +