From: Sasha Levin Date: Mon, 16 Oct 2023 02:50:05 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v5.15.136~24^2~3 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c5e88a79bf067a90f5c0e7c70bfa61f69bf3b7e4;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/dmaengine-idxd-use-spin_lock_irqsave-before-wait_eve.patch b/queue-5.15/dmaengine-idxd-use-spin_lock_irqsave-before-wait_eve.patch new file mode 100644 index 00000000000..94eb92b05a9 --- /dev/null +++ b/queue-5.15/dmaengine-idxd-use-spin_lock_irqsave-before-wait_eve.patch @@ -0,0 +1,92 @@ +From 12d3a3a7120a0c1184f2f453d7c5449f16d441a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Sep 2023 14:06:19 +0800 +Subject: dmaengine: idxd: use spin_lock_irqsave before wait_event_lock_irq + +From: Rex Zhang + +[ Upstream commit c0409dd3d151f661e7e57b901a81a02565df163c ] + +In idxd_cmd_exec(), wait_event_lock_irq() explicitly calls +spin_unlock_irq()/spin_lock_irq(). If the interrupt is on before entering +wait_event_lock_irq(), it will become off status after +wait_event_lock_irq() is called. Later, wait_for_completion() may go to +sleep but irq is disabled. The scenario is warned in might_sleep(). + +Fix it by using spin_lock_irqsave() instead of the primitive spin_lock() +to save the irq status before entering wait_event_lock_irq() and using +spin_unlock_irqrestore() instead of the primitive spin_unlock() to restore +the irq status before entering wait_for_completion(). + +Before the change: +idxd_cmd_exec() { +interrupt is on +spin_lock() // interrupt is on + wait_event_lock_irq() + spin_unlock_irq() // interrupt is enabled + ... + spin_lock_irq() // interrupt is disabled +spin_unlock() // interrupt is still disabled +wait_for_completion() // report "BUG: sleeping function + // called from invalid context... + // in_atomic() irqs_disabled()" +} + +After applying spin_lock_irqsave(): +idxd_cmd_exec() { +interrupt is on +spin_lock_irqsave() // save the on state + // interrupt is disabled + wait_event_lock_irq() + spin_unlock_irq() // interrupt is enabled + ... + spin_lock_irq() // interrupt is disabled +spin_unlock_irqrestore() // interrupt is restored to on +wait_for_completion() // No Call trace +} + +Fixes: f9f4082dbc56 ("dmaengine: idxd: remove interrupt disable for cmd_lock") +Signed-off-by: Rex Zhang +Signed-off-by: Lijun Pan +Reviewed-by: Dave Jiang +Reviewed-by: Fenghua Yu +Link: https://lore.kernel.org/r/20230916060619.3744220-1-rex.zhang@intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/device.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c +index 535f021911c55..f2cfefc505a8c 100644 +--- a/drivers/dma/idxd/device.c ++++ b/drivers/dma/idxd/device.c +@@ -490,6 +490,7 @@ static void idxd_cmd_exec(struct idxd_device *idxd, int cmd_code, u32 operand, + union idxd_command_reg cmd; + DECLARE_COMPLETION_ONSTACK(done); + u32 stat; ++ unsigned long flags; + + if (idxd_device_is_halted(idxd)) { + dev_warn(&idxd->pdev->dev, "Device is HALTED!\n"); +@@ -503,7 +504,7 @@ static void idxd_cmd_exec(struct idxd_device *idxd, int cmd_code, u32 operand, + cmd.operand = operand; + cmd.int_req = 1; + +- spin_lock(&idxd->cmd_lock); ++ spin_lock_irqsave(&idxd->cmd_lock, flags); + wait_event_lock_irq(idxd->cmd_waitq, + !test_bit(IDXD_FLAG_CMD_RUNNING, &idxd->flags), + idxd->cmd_lock); +@@ -520,7 +521,7 @@ static void idxd_cmd_exec(struct idxd_device *idxd, int cmd_code, u32 operand, + * After command submitted, release lock and go to sleep until + * the command completes via interrupt. + */ +- spin_unlock(&idxd->cmd_lock); ++ spin_unlock_irqrestore(&idxd->cmd_lock, flags); + wait_for_completion(&done); + stat = ioread32(idxd->reg_base + IDXD_CMDSTS_OFFSET); + spin_lock(&idxd->cmd_lock); +-- +2.40.1 + diff --git a/queue-5.15/dmaengine-mediatek-fix-deadlock-caused-by-synchroniz.patch b/queue-5.15/dmaengine-mediatek-fix-deadlock-caused-by-synchroniz.patch new file mode 100644 index 00000000000..f593194223d --- /dev/null +++ b/queue-5.15/dmaengine-mediatek-fix-deadlock-caused-by-synchroniz.patch @@ -0,0 +1,53 @@ +From c06967cb8ec5ef493c46f57f657eff39805e7324 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Aug 2023 11:25:11 +0800 +Subject: dmaengine: mediatek: Fix deadlock caused by synchronize_irq() + +From: Duoming Zhou + +[ Upstream commit 01f1ae2733e2bb4de92fefcea5fda847d92aede1 ] + +The synchronize_irq(c->irq) will not return until the IRQ handler +mtk_uart_apdma_irq_handler() is completed. If the synchronize_irq() +holds a spin_lock and waits the IRQ handler to complete, but the +IRQ handler also needs the same spin_lock. The deadlock will happen. +The process is shown below: + + cpu0 cpu1 +mtk_uart_apdma_device_pause() | mtk_uart_apdma_irq_handler() + spin_lock_irqsave() | + | spin_lock_irqsave() + //hold the lock to wait | + synchronize_irq() | + +This patch reorders the synchronize_irq(c->irq) outside the spin_lock +in order to mitigate the bug. + +Fixes: 9135408c3ace ("dmaengine: mediatek: Add MediaTek UART APDMA support") +Signed-off-by: Duoming Zhou +Reviewed-by: Eugen Hristev +Link: https://lore.kernel.org/r/20230806032511.45263-1-duoming@zju.edu.cn +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/mediatek/mtk-uart-apdma.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/dma/mediatek/mtk-uart-apdma.c b/drivers/dma/mediatek/mtk-uart-apdma.c +index a1517ef1f4a01..0acf6a92a4ad3 100644 +--- a/drivers/dma/mediatek/mtk-uart-apdma.c ++++ b/drivers/dma/mediatek/mtk-uart-apdma.c +@@ -451,9 +451,8 @@ static int mtk_uart_apdma_device_pause(struct dma_chan *chan) + mtk_uart_apdma_write(c, VFF_EN, VFF_EN_CLR_B); + mtk_uart_apdma_write(c, VFF_INT_EN, VFF_INT_EN_CLR_B); + +- synchronize_irq(c->irq); +- + spin_unlock_irqrestore(&c->vc.lock, flags); ++ synchronize_irq(c->irq); + + return 0; + } +-- +2.40.1 + diff --git a/queue-5.15/powerpc-64e-fix-wrong-test-in-__ptep_test_and_clear_.patch b/queue-5.15/powerpc-64e-fix-wrong-test-in-__ptep_test_and_clear_.patch new file mode 100644 index 00000000000..050eb0b8f31 --- /dev/null +++ b/queue-5.15/powerpc-64e-fix-wrong-test-in-__ptep_test_and_clear_.patch @@ -0,0 +1,52 @@ +From 3c61b75d9d040acb8b3908227819ba2109792969 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 20:31:16 +0200 +Subject: powerpc/64e: Fix wrong test in __ptep_test_and_clear_young() + +From: Christophe Leroy + +[ Upstream commit 5ea0bbaa32e8f54e9a57cfee4a3b8769b80be0d2 ] + +Commit 45201c879469 ("powerpc/nohash: Remove hash related code from +nohash headers.") replaced: + + if ((pte_val(*ptep) & (_PAGE_ACCESSED | _PAGE_HASHPTE)) == 0) + return 0; + +By: + + if (pte_young(*ptep)) + return 0; + +But it should be: + + if (!pte_young(*ptep)) + return 0; + +Fix it. + +Fixes: 45201c879469 ("powerpc/nohash: Remove hash related code from nohash headers.") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/8bb7f06494e21adada724ede47a4c3d97e879d40.1695659959.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/nohash/64/pgtable.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/include/asm/nohash/64/pgtable.h b/arch/powerpc/include/asm/nohash/64/pgtable.h +index 2225991c69b55..6ad4714352c7a 100644 +--- a/arch/powerpc/include/asm/nohash/64/pgtable.h ++++ b/arch/powerpc/include/asm/nohash/64/pgtable.h +@@ -209,7 +209,7 @@ static inline int __ptep_test_and_clear_young(struct mm_struct *mm, + { + unsigned long old; + +- if (pte_young(*ptep)) ++ if (!pte_young(*ptep)) + return 0; + old = pte_update(mm, addr, ptep, _PAGE_ACCESSED, 0, 0); + return (old & _PAGE_ACCESSED) != 0; +-- +2.40.1 + diff --git a/queue-5.15/powerpc-8xx-fix-pte_access_permitted-for-page_none.patch b/queue-5.15/powerpc-8xx-fix-pte_access_permitted-for-page_none.patch new file mode 100644 index 00000000000..fcf5d3fde4e --- /dev/null +++ b/queue-5.15/powerpc-8xx-fix-pte_access_permitted-for-page_none.patch @@ -0,0 +1,62 @@ +From f864e63cf8674854a8d1b3edc95ec584ae59b04d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 20:31:15 +0200 +Subject: powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE + +From: Christophe Leroy + +[ Upstream commit 5d9cea8a552ee122e21fbd5a3c5d4eb85f648e06 ] + +On 8xx, PAGE_NONE is handled by setting _PAGE_NA instead of clearing +_PAGE_USER. + +But then pte_user() returns 1 also for PAGE_NONE. + +As _PAGE_NA prevent reads, add a specific version of pte_read() +that returns 0 when _PAGE_NA is set instead of always returning 1. + +Fixes: 351750331fc1 ("powerpc/mm: Introduce _PAGE_NA") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/57bcfbe578e43123f9ed73e040229b80f1ad56ec.1695659959.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/nohash/32/pte-8xx.h | 7 +++++++ + arch/powerpc/include/asm/nohash/pgtable.h | 2 ++ + 2 files changed, 9 insertions(+) + +diff --git a/arch/powerpc/include/asm/nohash/32/pte-8xx.h b/arch/powerpc/include/asm/nohash/32/pte-8xx.h +index 1a89ebdc3acc9..0238e6bd0d6c1 100644 +--- a/arch/powerpc/include/asm/nohash/32/pte-8xx.h ++++ b/arch/powerpc/include/asm/nohash/32/pte-8xx.h +@@ -94,6 +94,13 @@ static inline pte_t pte_wrprotect(pte_t pte) + + #define pte_wrprotect pte_wrprotect + ++static inline int pte_read(pte_t pte) ++{ ++ return (pte_val(pte) & _PAGE_RO) != _PAGE_NA; ++} ++ ++#define pte_read pte_read ++ + static inline int pte_write(pte_t pte) + { + return !(pte_val(pte) & _PAGE_RO); +diff --git a/arch/powerpc/include/asm/nohash/pgtable.h b/arch/powerpc/include/asm/nohash/pgtable.h +index ac75f4ab0dba1..7ad1d1b042a60 100644 +--- a/arch/powerpc/include/asm/nohash/pgtable.h ++++ b/arch/powerpc/include/asm/nohash/pgtable.h +@@ -45,7 +45,9 @@ static inline int pte_write(pte_t pte) + return pte_val(pte) & _PAGE_RW; + } + #endif ++#ifndef pte_read + static inline int pte_read(pte_t pte) { return 1; } ++#endif + static inline int pte_dirty(pte_t pte) { return pte_val(pte) & _PAGE_DIRTY; } + static inline int pte_special(pte_t pte) { return pte_val(pte) & _PAGE_SPECIAL; } + static inline int pte_none(pte_t pte) { return (pte_val(pte) & ~_PTE_NONE_MASK) == 0; } +-- +2.40.1 + diff --git a/queue-5.15/series b/queue-5.15/series index d9090a39184..4a9000066c7 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -77,3 +77,7 @@ counter-microchip-tcb-capture-fix-the-use-of-internal-gclk-logic.patch usb-gadget-udc-xilinx-replace-memcpy-with-memcpy_toio.patch usb-gadget-ncm-handle-decoding-of-multiple-ntb-s-in-unwrap-call.patch usb-cdnsp-fixes-issue-with-dequeuing-not-queued-requests.patch +dmaengine-idxd-use-spin_lock_irqsave-before-wait_eve.patch +dmaengine-mediatek-fix-deadlock-caused-by-synchroniz.patch +powerpc-8xx-fix-pte_access_permitted-for-page_none.patch +powerpc-64e-fix-wrong-test-in-__ptep_test_and_clear_.patch