A page table upgrade in a kernel section that uses secondary address
mode will mess up the kernel instructions as follows:
Consider the following scenario: two threads are sharing memory.
On CPU1 thread 1 does e.g. strnlen_user(). That gets to
old_fs = enable_sacf_uaccess();
len = strnlen_user_srst(src, size);
and
" la %2,0(%1)\n"
" la %3,0(%0,%1)\n"
" slgr %0,%0\n"
" sacf 256\n"
"0: srst %3,%2\n"
in strnlen_user_srst(). At that point we are in secondary space mode,
control register 1 points to kernel page table and instruction fetching
happens via c1, rather than usual c13. Interrupts are not disabled, for
obvious reasons.
On CPU2 thread 2 does MAP_FIXED mmap(), forcing the upgrade of page table
from 3-level to e.g. 4-level one. We'd allocated new top-level table,
set it up and now we hit this:
notify = 1;
spin_unlock_bh(&mm->page_table_lock);
}
if (notify)
on_each_cpu(__crst_table_upgrade, mm, 0);
OK, we need to actually change over to use of new page table and we
need that to happen in all threads that are currently running. Which
happens to include the thread 1. IPI is delivered and we have
static void __crst_table_upgrade(void *arg)
{
struct mm_struct *mm = arg;
if (current->active_mm == mm)
set_user_asce(mm);
__tlb_flush_local();
}
run on CPU1. That does
static inline void set_user_asce(struct mm_struct *mm)
{
S390_lowcore.user_asce = mm->context.asce;
OK, user page table address updated...
__ctl_load(S390_lowcore.user_asce, 1, 1);
... and control register 1 set to it.
clear_cpu_flag(CIF_ASCE_PRIMARY);
}
IPI is run in home space mode, so it's fine - insns are fetched
using c13, which always points to kernel page table. But as soon
as we return from the interrupt, previous PSW is restored, putting
CPU1 back into secondary space mode, at which point we no longer
get the kernel instructions from the kernel mapping.
The fix is to only fixup the control registers that are currently in use
for user processes during the page table update. We must also disable
interrupts in enable_sacf_uaccess to synchronize the cr and
thread.mm_segment updates against the on_each-cpu.
Fixes: 0aaba41b58bc ("s390: remove all code using the access register mode") Cc: stable@vger.kernel.org # 4.15+ Reported-by: Al Viro <viro@zeniv.linux.org.uk> Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
References: CVE-2020-11884 Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
CVE-2020-11884 Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Acked-by: Seth Forshee <seth.forshee@canonical.com> Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Andrea Righi [Mon, 20 Apr 2020 14:19:03 +0000 (16:19 +0200)]
UBUNTU: SAUCE: drm/i915: prevent direct writeback from the shrinker
BugLink: https://bugs.launchpad.net/bugs/1861359
The i915 shrinker can make the system unresponsive and kill interactive
performance by swapping out dirty objects to reclaim more memory.
Avoid the lags by preventing to swap out dirty objects from any task
(except kswapd).
This is not required in 5.5+, because it is properly fixed by commit 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex")
However, backporting this commit to 5.4 is not trivial and the
regression potential is high. A simple change like this can be a
reasonable compromise to prevent the problem and avoid the risk of
introducing other bugs.
Fixes: 2d6692e642e7 ("drm/i915: Start writeback from the shrinker") Signed-off-by: Sultan Alsawaf <sultan.alsawaf@canonical.com> Signed-off-by: Andrea Righi <andrea.righi@canonical.com> Acked-by: Seth Forshee <seth.forshee@canonical.com> Acked-by: Kamal Mostafa <kamal@canonical.com> Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Paolo Pisati [Fri, 17 Apr 2020 11:29:46 +0000 (13:29 +0200)]
UBUNTU: [Config] lowlatency: turn off RT_GROUP_SCHED
BugLink: https://bugs.launchpad.net/bugs/1873315 Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com> Acked-by: Andrea Righi <andrea.righi@canonical.com> Acked-by: Stefan Bader <stefan.bader@canonical.com> Acked-by: Kamal Mostafa <kamal@canonical.com> Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
After the referenced fix it turned out that one particular RTL8168
chip version (RTL8105e) does not work on 5.4 because no dedicated PHY
driver exists. Adding this PHY driver was done for fixing a different
issue for versions from 5.5 already. I re-send the same change for 5.4
because the commit message differs.
Fixes: 2e8c339b4946 ("r8169: fix PHY driver check on platforms w/o module softdeps") Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 3fcd53b1d859799686a08785afb8990566c31cfa
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git) Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com> Acked-by: Seth Forshee <seth.forshee@canonical.com> Acked-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: Jon Derrick <jonathan.derrick@intel.com> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
(cherry picked from commit ec11e5c213cc20cac5e8310728b06793448b9f6d) Signed-off-by: You-Sheng Yang <vicamo.yang@canonical.com> Acked-by: Anthony Wong <anthony.wong@canonical.com> Acked-by: Po-Hsu Lin <po-hsu.lin@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Jon Derrick [Thu, 16 Apr 2020 08:56:58 +0000 (16:56 +0800)]
PCI: vmd: Add bus 224-255 restriction decode
BugLink: https://bugs.launchpad.net/bugs/1855954
VMD bus restrictions are required when IO fabric is multiplexed such
that VMD cannot use the entire bus range. This patch adds another bus
restriction decode bit that can be set by firmware to restrict the VMD
bus range to between 224-255.
Signed-off-by: Jon Derrick <jonathan.derrick@intel.com> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
(cherry picked from commit 08bcdd22ecdb01dd60d9284a55f8220a8a40150e) Signed-off-by: You-Sheng Yang <vicamo.yang@canonical.com> Acked-by: Anthony Wong <anthony.wong@canonical.com> Acked-by: Po-Hsu Lin <po-hsu.lin@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Jian-Hong Pan [Tue, 14 Apr 2020 10:06:19 +0000 (18:06 +0800)]
ahci: Add Intel Comet Lake PCH RAID PCI ID
BugLink: https://bugs.launchpad.net/bugs/1871812
Intel Comet Lake should use the default LPM policy for mobile chipsets.
So, add the PCI ID to the driver list of supported devices.
Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit 7667e63c8af90e287f9e2d070599024cbabe63f5) Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com> Acked-by: Po-Hsu Lin <po-hsu.lin@canonical.com> Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
UBUNTU: SAUCE: selftests/seccomp: allow clock_nanosleep instead of nanosleep
glibc 2.31 calls clock_nanosleep when its nanosleep function is used. So
the restart_syscall fails after that. In order to deal with it, we trace
clock_nanosleep and nanosleep. Then we check for either.
This works just fine on systems with both glibc 2.30 and glibc 2.31,
whereas it failed before on a system with glibc 2.31.
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Acked-by: Andrea Righi <andrea.righi@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
UBUNTU: [Config] CONTEXT_TRACKING_FORCE policy should be unset
BugLink: https://bugs.launchpad.net/bugs/1349028
Though that option depends on others we don't set and, thus, is not
currently prompted, we would rather have it annotated and enforced to
avoid regressing it. Enabling this option has the possible consequence
of regressing some userspace code.
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/1047527
We don't really want to enable USB_OTG. Enabling USB_OTG_FSM is not a
problem per se. As it used to select USB_OTG instead of depending on it, it
was required to be annotated. That is not the case anymore, as it no longer
selects the problematic option.
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
The config option itself was removed in a previous local commit. Remove the
corresponding annotations, considering there is an alternative interface
now.
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Mateusz Nosek [Tue, 3 Mar 2020 18:30:23 +0000 (19:30 +0100)]
UBUNTU: SAUCE: security/apparmor/label.c: Clean code by removing redundant instructions
Previously 'label->proxy->label' value checking
and conditional reassigning were done twice in the same function.
The second one is redundant and can be removed.
Xiyu Yang [Sun, 5 Apr 2020 05:11:55 +0000 (13:11 +0800)]
UBUNTU: SAUCE: apparmor: fix potential label refcnt leak in aa_change_profile
aa_change_profile() invokes aa_get_current_label(), which returns
a reference of the current task's label.
According to the comment of aa_get_current_label(), the returned
reference must be put with aa_put_label().
However, when the original object pointed by "label" becomes
unreachable because aa_change_profile() returns or a new object
is assigned to "label", reference count increased by
aa_get_current_label() is not decreased, causing a refcnt leak.
Fix this by calling aa_put_label() before aa_change_profile() return
and dropping unnecessary aa_get_current_label().
Fixes: 9fcf78cca198 ("apparmor: update domain transitions that are subsets of confinement at nnp") Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
John Johansen [Tue, 31 Mar 2020 06:37:54 +0000 (23:37 -0700)]
UBUNTU: SAUCE: apparmor: ensure that dfa state tables have entries
Currently it is possible to specify a state machine table with 0 length,
this is not valid as optional tables are specified by not defining
the table as present. Further this allows by-passing the base tables
range check against the next/check tables.
Fixes: d901d6a298dc ("apparmor: dfa split verification of table headers") Reported-by: Mike Salvatore <mike.salvatore@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
commit 1180b4c757aa ("apparmor: fix dangling symlinks to policy
rawdata after replacement") reworked how the rawdata symlink is
handled but failedto remove aafs_create_symlink which was reduced to a
useles stub.
Fixes: 1180b4c757aa ("apparmor: fix dangling symlinks to policy rawdata after replacement") Reported-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
John Johansen [Fri, 31 May 2019 13:54:54 +0000 (06:54 -0700)]
apparmor: increase left match history buffer size
There have been cases reported where a history buffer size of 8 was
not enough to resolve conflict overlaps. Increase the buffer to and
get rid of the size element which is currently just storing the
constant WB_HISTORY_SIZE.
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 136db994852a9b405ac1074de0e7a1c4c840b8ee) Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
slcan: Don't transmit uninitialized stack data in padding
CVE-2020-11494
struct can_frame contains some padding which is not explicitly zeroed in
slc_bump. This uninitialized data will then be transmitted if the stack
initialization hardening feature is not enabled (CONFIG_INIT_STACK_ALL).
This commit just zeroes the whole struct including the padding.
Signed-off-by: Richard Palethorpe <rpalethorpe@suse.com> Fixes: a1044e36e457 ("can: add slcan driver for serial/USB-serial CAN adapters") Reviewed-by: Kees Cook <keescook@chromium.org> Cc: linux-can@vger.kernel.org Cc: netdev@vger.kernel.org Cc: security@kernel.org Cc: wg@grandegger.com Cc: mkl@pengutronix.de Cc: davem@davemloft.net Acked-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit b9258a2cece4ec1f020715fe3554bc2e360f6264) Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com> Acked-by: Andrea Righi <andrea.righi@canonical.com> Acked-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Sultan Alsawaf [Tue, 7 Apr 2020 22:27:40 +0000 (15:27 -0700)]
UBUNTU: SAUCE: drm/i915: Synchronize active and retire callbacks
Active and retire callbacks can run simultaneously, causing panics and
mayhem. The most notable case is with the intel_context_pin/unpin race
that causes ring and page table corruption. In 5.4, this race is more
noticeable because intel_ring_unpin() sets ring->vaddr to NULL and
causes a clean NULL-pointer-dereference panic, but in newer kernels this
race goes unnoticed.
Here is an example of a crash caused by this race on 5.4:
BUG: unable to handle page fault for address: 0000000000003448
RIP: 0010:gen8_emit_flush_render+0x163/0x190
Call Trace:
execlists_request_alloc+0x25/0x40
__i915_request_create+0x1f4/0x2c0
i915_request_create+0x71/0xc0
i915_gem_do_execbuffer+0xb98/0x1a80
? preempt_count_add+0x68/0xa0
? _raw_spin_lock+0x13/0x30
? _raw_spin_unlock+0x16/0x30
i915_gem_execbuffer2_ioctl+0x1de/0x3c0
? i915_gem_busy_ioctl+0x7f/0x1d0
? i915_gem_execbuffer_ioctl+0x2d0/0x2d0
drm_ioctl_kernel+0xb2/0x100
drm_ioctl+0x209/0x360
? i915_gem_execbuffer_ioctl+0x2d0/0x2d0
ksys_ioctl+0x87/0xc0
__x64_sys_ioctl+0x16/0x20
do_syscall_64+0x4e/0x150
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Protect the active and retire callbacks with their own lock to prevent
them from running at the same time as one another.
Fixes: 12c255b5dad1 ("drm/i915: Provide an i915_active.acquire callback") Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com> Signed-off-by: Sultan Alsawaf <sultan.alsawaf@canonical.com> Cc: <stable@vger.kernel.org> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Sultan Alsawaf [Tue, 7 Apr 2020 22:27:39 +0000 (15:27 -0700)]
UBUNTU: SAUCE: drm/i915: Fix ref->mutex deadlock in i915_active_wait()
The following deadlock exists in i915_active_wait() due to a double lock
on ref->mutex (call chain listed in order from top to bottom):
i915_active_wait();
mutex_lock_interruptible(&ref->mutex); <-- ref->mutex first acquired
i915_active_request_retire();
node_retire();
active_retire();
mutex_lock_nested(&ref->mutex, SINGLE_DEPTH_NESTING); <-- DEADLOCK
Fix the deadlock by skipping the second ref->mutex lock when
active_retire() is called through i915_active_request_retire().
Note that this bug only affects 5.4 and has since been fixed in 5.5.
Normally, a backport of the fix from 5.5 would be in order, but the
patch set that fixes this deadlock involves massive changes that are
neither feasible nor desirable for backporting [1][2][3]. Therefore,
this small patch was made to address the deadlock specifically for 5.4.
[1] 274cbf20fd10 ("drm/i915: Push the i915_active.retire into a worker")
[2] 093b92287363 ("drm/i915: Split i915_active.mutex into an irq-safe spinlock for the rbtree")
[3] 750bde2fd4ff ("drm/i915: Serialise with remote retirement")
Fixes: 12c255b5dad1 ("drm/i915: Provide an i915_active.acquire callback") Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com> Signed-off-by: Sultan Alsawaf <sultan.alsawaf@canonical.com> Acked-by: Andrea Righi <andrea.righi@canonical.com> Cc: <stable@vger.kernel.org> # 5.4.x Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
UBUNTU: SAUCE: drm/amdgpu: Remove missing firmware files from modinfo
A number of amdgpu firmware files referenced by the driver are
not in linux-firmware. This causes warnings to be printed during
initramfs generation on systems which use this driver. Remove the
MODULE_FIRMWARE statements for these files until such time as the
files are available.
Lang Cheng [Thu, 12 Mar 2020 09:50:24 +0000 (17:50 +0800)]
RDMA/hns: Check if depth of qp is 0 before configure
BugLink: https://launchpad.net/bugs/1864950
Depth of qp shouldn't be allowed to be set to zero, after ensuring that,
subsequent process can be simplified. And when qp is changed from reset to
reset, the capability of minimum qp depth was used to identify hardware of
hip06, it should be changed into a more readable form.
Xi Wang [Mon, 24 Feb 2020 06:37:38 +0000 (14:37 +0800)]
RDMA/hns: Optimize qp doorbell allocation flow
BugLink: https://launchpad.net/bugs/1864950
Encapsulate the kernel qp doorbell allocation related code into 2
functions: alloc_qp_db() and free_qp_db().
Xi Wang [Mon, 24 Feb 2020 06:37:37 +0000 (14:37 +0800)]
RDMA/hns: Optimize kernel qp wrid allocation flow
BugLink: https://launchpad.net/bugs/1864950
Encapsulate the kernel qp wrid allocation related code into 2 functions:
alloc_kernel_wrid() and free_kernel_wrid().
Xi Wang [Mon, 24 Feb 2020 06:37:35 +0000 (14:37 +0800)]
RDMA/hns: Optimize qp buffer allocation flow
BugLink: https://launchpad.net/bugs/1864950
Encapsulate qp buffer allocation related code into 3 functions:
alloc_qp_buf(), map_wqe_buf() and free_qp_buf().
Xi Wang [Mon, 24 Feb 2020 06:37:33 +0000 (14:37 +0800)]
RDMA/hns: Optimize qp context create and destroy flow
BugLink: https://launchpad.net/bugs/1864950
Rename the qp context related functions and adjusts the code location to
distinguish between the qp context and the entire qp.
Xi Wang [Mon, 24 Feb 2020 06:37:32 +0000 (14:37 +0800)]
RDMA/hns: Optimize qp destroy flow
BugLink: https://launchpad.net/bugs/1864950
Wrap the duplicate code in hip08 and hip06 qp destruction process as
hns_roce_qp_destroy() to simply the qp destroy flow.
Yixian Liu [Sat, 22 Feb 2020 10:25:58 +0000 (18:25 +0800)]
RDMA/hns: Stop doorbell update while qp state error
BugLink: https://launchpad.net/bugs/1864950
There are two paths to update qp producer index into hardware now, one
path is doorbell in post verbs (send and recv), the another is mailbox in
modify qp verb which is called by flush process. This will lead the
hardware to be broken to correctly generate flush cqe. With stopping
doorbell update and holding qp spinlock in modify qp during flush process,
the problem can be solved.
Yixian Liu [Sat, 22 Feb 2020 10:25:57 +0000 (18:25 +0800)]
RDMA/hns: Use flush framework for the case in aeq
BugLink: https://launchpad.net/bugs/1864950
As now we already have flush framework, using it instead of current flush
process for qp error in asynchronized interrupt (aeq).
Yixian Liu [Thu, 6 Feb 2020 09:56:45 +0000 (17:56 +0800)]
RDMA/hns: Delayed flush cqe process with workqueue
BugLink: https://launchpad.net/bugs/1864950
HiP08 RoCE hardware lacks ability(a known hardware problem) to flush
outstanding WQEs if QP state gets into errored mode for some reason. To
overcome this hardware problem and as a workaround, when QP is detected to
be in errored state during various legs like post send, post receive
etc[1], flush needs to be performed from the driver.
The earlier patch[1] sent to solve the hardware limitation explained in
the cover-letter had a bug in the software flushing leg. It acquired mutex
while modifying QP state to errored state and while conveying it to the
hardware using the mailbox. This caused leg to sleep while holding
spin-lock and caused crash.
Suggested Solution: we have proposed to defer the flushing of the QP in
the Errored state using the workqueue to get around with the limitation of
our hardware.
This patch specifically adds the calls to the flush handler from where
parts of the code like post_send/post_recv etc. when the QP state gets
into the errored mode.
Yixian Liu [Thu, 6 Feb 2020 09:56:44 +0000 (17:56 +0800)]
RDMA/hns: Add the workqueue framework for flush cqe handler
BugLink: https://launchpad.net/bugs/1864950
HiP08 RoCE hardware lacks ability(a known hardware problem) to flush
outstanding WQEs if QP state gets into errored mode for some reason. To
overcome this hardware problem and as a workaround, when QP is detected to
be in errored state during various legs like post send, post receive etc
[1], flush needs to be performed from the driver.
The earlier patch[1] sent to solve the hardware limitation explained in
the cover-letter had a bug in the software flushing leg. It acquired mutex
while modifying QP state to errored state and while conveying it to the
hardware using the mailbox. This caused leg to sleep while holding
spin-lock and caused crash.
Suggested Solution:
we have proposed to defer the flushing of the QP in the Errored state
using the workqueue to get around with the limitation of our hardware.
This patch adds the framework of the workqueue and the flush handler
function.
Xi Wang [Sun, 26 Jan 2020 14:58:35 +0000 (22:58 +0800)]
RDMA/hns: Optimize eqe buffer allocation flow
BugLink: https://launchpad.net/bugs/1864950
The eqe has a private multi-hop addressing implementation, but there is
already a set of interfaces in the hns driver that can achieve this.
So, simplify the eqe buffer allocation process by using the mtr interface
and remove large amount of repeated logic.
Yufeng Mo [Sat, 7 Mar 2020 03:42:50 +0000 (11:42 +0800)]
net: hns3: delete unnecessary logs after kzalloc fails
BugLink: https://launchpad.net/bugs/1867586
Since kernel already has logs after kzalloc fails,
it's unnecessary to print duplicate logs. So this
patch deletes these logs.
Signed-off-by: Yufeng Mo <moyufeng@huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit fbdc4d79fcc2e226a36c9b8e2f1cdd80ca549094) Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 8de91e92070b5a083e4705cd4684c1802f7f730e) Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Yufeng Mo [Sat, 7 Mar 2020 03:42:48 +0000 (11:42 +0800)]
net: hns3: print out command code when dump fails in debugfs
BugLink: https://launchpad.net/bugs/1867586
This patch adds a local variable to save the command code in
some dump cases which need to modify the command code, then
the failing command code can be print out for debugging.
Signed-off-by: Yufeng Mo <moyufeng@huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 77ba415d192011b5ef9e9979638772b42b5d4107) Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Huazhong Tan [Sat, 7 Mar 2020 03:42:47 +0000 (11:42 +0800)]
net: hns3: print out status register when VF receives unknown source interrupt
BugLink: https://launchpad.net/bugs/1867586
When received an unknown vector 0 interrupt, there is not a
helpful information for user to realize that now. So this patch
prints out the value of the status register for this case, and
uses dev_info() instead of dev_dbg() in hclge_check_event_cause().
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit e45afb396e233b972aee187c7adb058859c5ac53) Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Yonglong Liu [Sat, 7 Mar 2020 03:42:46 +0000 (11:42 +0800)]
net: hns3: add a check before PF inform VF to reset
BugLink: https://launchpad.net/bugs/1867586
When setting VF's MAC from PF, if the VF driver not loaded, the
firmware will return error to PF.
So PF should check whether VF is alive before sending message to
VF when setting VF's MAC.
Signed-off-by: Yonglong Liu <liuyonglong@huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 9091367037d3e6db590d9f8cd9a163336665ef27) Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Guojia Liao [Sat, 7 Mar 2020 03:42:45 +0000 (11:42 +0800)]
net: hns3: delete some reduandant code
BugLink: https://launchpad.net/bugs/1867586
In hclge_add_mc_addr_common() and hclge_rm_mc_addr_common(),
variable req had been set as "0" by memset(), so it's unnecessary
to set .entry_type field as "0" with hnae3_set_bit() again.
Signed-off-by: Guojia Liao <liaoguojia@huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 01c45c521a5aa2e3a077b27d090f05a20012dd65) Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Yufeng Mo [Sat, 7 Mar 2020 03:42:44 +0000 (11:42 +0800)]
net: hns3: remove an unnecessary resetting check in hclge_handle_hw_ras_error()
BugLink: https://launchpad.net/bugs/1867586
In hclge_handle_hw_ras_error(), it is unnecessary to check
HCLGE_STATE_RST_HANDLING flag, because the reset priority
has been ensured by the process itself.
Signed-off-by: Yufeng Mo <moyufeng@huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 89a85559302f473d2c7f22c774b31f979a0e62dc) Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
BugLink: https://launchpad.net/bugs/1867586
The name of macro HCLGE_MAX_NCL_CONFIG_LENGTH is inaccurate,
this patch renames it to HCLGE_NCL_CONFIG_LENGTH_IN_EACH_CMD.
Signed-off-by: Yufeng Mo <moyufeng@huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 4960cabff63e09066a8d02b0375b654d41ce174f) Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Guojia Liao [Sat, 7 Mar 2020 03:42:42 +0000 (11:42 +0800)]
net: hns3: fix some mixed type assignment
BugLink: https://launchpad.net/bugs/1867586
This patch cleans up some incorrect type in assignment reported by sparse
and compiler.
The warning as below:
- warning : restricted __le16 degrades to integer
- warning : cast from restricted __le32
- warning : cast from restricted __be32
- warning : cast from restricted __be16
and "mixed operation".
Signed-off-by: Guojia Liao <liaoguojia@huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 72fa490480ce5cd6a1b8ec741b369a470f93d61d) Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Yonglong Liu [Wed, 19 Feb 2020 01:23:33 +0000 (09:23 +0800)]
net: hns3: add missing help info for QS shaper in debugfs
BugLink: https://launchpad.net/bugs/1867586
HNS3 driver can dump QS shaper configs via debugfs, but missing
help info in debugfs for this operation.
Signed-off-by: Yonglong Liu <liuyonglong@huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 89ec9485282a3470217628fbabf34c789b475763) Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Yufeng Mo [Wed, 19 Feb 2020 01:23:32 +0000 (09:23 +0800)]
net: hns3: add support for dump MAC ID and loopback status in debugfs
BugLink: https://launchpad.net/bugs/1867586
The MAC ID and loopback status information are obtained from
the hardware, which will be helpful for debugging. This patch
adds support for these two items in debugfs.
Signed-off-by: Yufeng Mo <moyufeng@huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit ded45d406ca736b3c23e7d099318465620fcd0f1) Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Yonglong Liu [Wed, 19 Feb 2020 01:23:31 +0000 (09:23 +0800)]
net: hns3: add enabled TC numbers and DWRR weight info in debugfs
BugLink: https://launchpad.net/bugs/1867586
The actual enabled TC numbers and the DWRR weight of each
TC may be helpful for debugging, so adds them into debugfs.
Signed-off-by: Yonglong Liu <liuyonglong@huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit a8adbb8a91a4cc260aeef7d670f3735b7b52865f) Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Guangbin Huang [Wed, 19 Feb 2020 01:23:30 +0000 (09:23 +0800)]
net: hns3: modify an unsuitable print when setting unknown duplex to fibre
BugLink: https://launchpad.net/bugs/1867586
Currently, if device is in link down status and user uses
'ethtool -s' command to set speed but not specify duplex
mode, the duplex mode passed from ethtool to driver is
unknown value(255), and the fibre port will identify this
value as half duplex mode and print "only copper port
supports half duplex!". This message is confusing.
So for fibre port, only the setting duplex is half, prints
error and returns.
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 2d3db26d78805c9e06e26def0081c76e9bb0b7d6) Signed-off-by: Ike Panhc <ike.pan@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Aaron Ma [Tue, 7 Apr 2020 08:23:31 +0000 (16:23 +0800)]
UBUNTU: SAUCE: drm/amdgpu: Fix oops when pp_funcs is unset in ACPI event
BugLink: https://bugs.launchpad.net/bugs/1871316
On ARCTURUS and RENOIR, powerplay is not supported yet.
When plug in or unplug power jack, ACPI event will issue.
Then kernel NULL pointer BUG will be triggered.
Check for NULL pointers before calling.
Signed-off-by: Aaron Ma <aaron.ma@canonical.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 170dbbf5ee571dbe11f847c27a15c6e28fdacfab
git://people.freedesktop.org/~agd5f/linux drm-next) Signed-off-by: Aaron Ma <aaron.ma@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Bruno Meneguele [Tue, 7 Apr 2020 08:13:47 +0000 (10:13 +0200)]
net/bpfilter: remove superfluous testing message
A testing message was brought by 13d0f7b814d9 ("net/bpfilter: fix dprintf
usage for /dev/kmsg") but should've been deleted before patch submission.
Although it doesn't cause any harm to the code or functionality itself, it's
totally unpleasant to have it displayed on every loop iteration with no real
use case. Thus remove it unconditionally.
Fixes: 13d0f7b814d9 ("net/bpfilter: fix dprintf usage for /dev/kmsg") Signed-off-by: Bruno Meneguele <bmeneg@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 41c55ea6c2a7ca4c663eeec05bdf54f4e2419699) Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com> Acked-by: Colin Ian King <colin.king@canonical.com> Acked-by: Andrea Righi <andrea.righi@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/1871284
We've got quite a few bug reports showing the SOF driver being loaded
unintentionally recently, and the reason seems to be that users didn't
know the module option change: with the recent kernel, a new option
dsp_driver=1 has to be passed to a new module snd-intel-dspcfg
instead of snd_hda_intel.dmic_detect=0 option.
That is, actually there are two tricky things here:
- We changed the whole detection in another module and another
option semantics.
- The existing option for skipping the DSP probe was also renamed.
For avoiding the confusion and giving user more hint, this patch
reverts the renamed option dsp_driver back to dmic_detect for
snd-hda-intel module, and show the warning about the module option
change when the non-default value is passed.
BugLink: https://bugs.launchpad.net/bugs/1871284
Apply const prefix to the remaining possible places: the string
tables, the rate tables, the verb tables, the index tables, etc.
Just for minor optimization and no functional changes.
BugLink: https://bugs.launchpad.net/bugs/1871284
The recent addition of snd_intel_dsp_driver_probe() check caused a
spurious kernel warning when the driver is loaded for a non-Intel
hardware due to snd_BUG_ON(). Moreover, for such a hardware, we
should always return SND_INTEL_DSP_DRIVER_ANY, not check the
dsp_driver option at all.
This patch fixes these issues for non-Intel devices.
BugLink: https://bugs.launchpad.net/bugs/1871284
For distributions, we need one place where we can decide
which driver will be activated for the auto-configation of the
Intel's HDA hardware with DSP. Actually, we cover three drivers:
All those drivers registers similar PCI IDs, so the first
driver probed from the PCI stack can win. But... it is not
guaranteed that the correct driver wins.
This commit changes Intel's NHLT ACPI module to a common
DSP probe module for the Intel's hardware. All above sound
drivers calls this code. The user can force another behaviour
using the module parameter 'dsp_driver' located in
the 'snd-intel-dspcfg' module.
This change allows to add specific dmi checks for the specific
systems. The examples are taken from the pull request:
Since commit a08bf91ce28e ("KEYS: allow reaching the keys quotas exactly"),
we can reach max bytes/keys in key_alloc, but we forget to remove this
limit when we reserver space for payload in key_payload_reserve. So we
can only reach max keys but not max bytes when having delta between plen
and type->def_datalen. Remove this limit when instantiating the key, so we
can keep consistent with key_alloc.
Also, fix the similar problem in keyctl_chown_key().
Fixes: 0b77f5bfb45c ("keys: make the keyring quotas controllable through /proc/sys") Fixes: a08bf91ce28e ("KEYS: allow reaching the keys quotas exactly") Cc: stable@vger.kernel.org # 5.0.x Cc: Eric Biggers <ebiggers@google.com> Signed-off-by: Yang Xu <xuyang2018.jy@cn.fujitsu.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
(cherry picked from commit 2e356101e72ab1361821b3af024d64877d9a798d) Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com> Acked-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
UBUNTU: SAUCE: rtw88: Move driver IQK to set channel before association for 11N chip
BugLink: https://bugs.launchpad.net/bugs/1871300
Originally, driver do IQK after auth/assoc, but it's doing 4-way handshake
if we connect to an AP with WPA2 security. Since 11N chips use software IQK
that causes more than 100ms, so IQK and 4-way handshake can be overlap, then
4-way handshake may be failed. To resolve this issue, move IQK prior to
issue auth.
UBUNTU: SAUCE: rtw88: No retry and report for auth and assoc
BugLink: https://bugs.launchpad.net/bugs/1871300
The certain AP can't handle quick auth/assoc retry proerply, so disable
auth/assoc L2 retry and doesn't report TX status immediately, then wait for
cfg80211 connection retry that in period of 100ms.
Po-Hsu Lin [Mon, 6 Apr 2020 05:57:45 +0000 (13:57 +0800)]
selftests/powerpc: Turn off timeout setting for benchmarks, dscr, signal, tm
BugLink: https://bugs.launchpad.net/bugs/1864642
Some specific tests in powerpc can take longer than the default 45
seconds that added in commit 852c8cbf34d3 ("selftests/kselftest/runner.sh:
Add 45 second timeout per test") to run, the following test result was
collected across 2 Power8 nodes and 1 Power9 node in our pool:
powerpc/benchmarks/futex_bench - 52s
powerpc/dscr/dscr_sysfs_test - 116s
powerpc/signal/signal_fuzzer - 88s
powerpc/tm/tm_unavailable_test - 168s
powerpc/tm/tm-poison - 240s
Thus they will fail with TIMEOUT error. Disable the timeout setting
for these sub-tests to allow them finish properly.
https://bugs.launchpad.net/bugs/1864642 Fixes: 852c8cbf34d3 ("selftests/kselftest/runner.sh: Add 45 second timeout per test") Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20200318060004.10685-1-po-hsu.lin@canonical.com
(backported from commit 850507f30c38dff21ed557cb98ab16db26c32bbc)
[PHLin: fuzzy context adjustment] Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Prabhath Sajeepa [Mon, 28 Oct 2019 22:56:48 +0000 (16:56 -0600)]
nvme: Fix parsing of ANA log page
BugLink: https://bugs.launchpad.net/bugs/1856340
Check validity of offset into ANA log buffer before accessing
nvme_ana_group_desc. This check ensures the size of ANA log buffer >=
offset + sizeof(nvme_ana_group_desc)
Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Prabhath Sajeepa <psajeepa@purestorage.com> Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit 64fab7290dc3561729bbc1e35895a517eb2e549e) Signed-off-by: Jeff Lane <jeffrey.lane@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Remove ambiguity and unconditionally clear the association_id if the
association has been terminated.
Signed-off-by: James Smart <jsmart2021@gmail.com> Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit bcde5f0fc7d318c98d4234b52bcc1a87fc2162d9) Signed-off-by: Jeff Lane <jeffrey.lane@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Ewan D. Milne <emilne@redhat.com> Signed-off-by: James Smart <jsmart2021@gmail.com> Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit 7db394848ece0e0706dfe8e4940b24e949f3b88f) Signed-off-by: Jeff Lane <jeffrey.lane@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: James Smart <jsmart2021@gmail.com> Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit 44fbf3bb1ac3dbebc6bd07eb68abf2d0badfae65) Signed-off-by: Jeff Lane <jeffrey.lane@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Tested interoperability with success:
- prior initiator with new target
- prior target with new initiator
- new on new
Signed-off-by: James Smart <jsmart2021@gmail.com> Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit 53b2b2f59967c0b7eb4df265136b1cc25b9fb287) Signed-off-by: Jeff Lane <jeffrey.lane@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Includes some minor mods where pre-release field names changed
by the time the spec was released.
Signed-off-by: James Smart <jsmart2021@gmail.com> Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit f16583614222d015968541f2e50447c67c277f74) Signed-off-by: Jeff Lane <jeffrey.lane@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
James Smart [Mon, 10 Feb 2020 17:31:55 +0000 (09:31 -0800)]
scsi: lpfc: add RDF registration and Link Integrity FPIN logging
BugLink: https://bugs.launchpad.net/bugs/1855303
This patch modifies lpfc to register for Link Integrity events via the use
of an RDF ELS and to perform Link Integrity FPIN logging.
Specifically, the driver was modified to:
- Format and issue the RDF ELS immediately following SCR registration.
This registers the ability of the driver to receive FPIN ELS.
- Adds decoding of the FPIN els into the received descriptors, with
logging of the Link Integrity event information. After decoding, the ELS
is delivered to the scsi fc transport to be delivered to any user-space
applications.
- To aid in logging, simple helpers were added to create enum to name
string lookup functions that utilize the initialization helpers from the
fc_els.h header.
- Note: base header definitions for the ELS's don't populate the
descriptor payloads. As such, lpfc creates it's own version of the
structures, using the base definitions (mostly headers) and additionally
declaring the descriptors that will complete the population of the ELS.
Link: https://lore.kernel.org/r/20200210173155.547-3-jsmart2021@gmail.com Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com> Signed-off-by: James Smart <jsmart2021@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit df3fe76658ed47617741819a501e2bd2ae446962 linux-next) Signed-off-by: Jeff Lane <jeffrey.lane@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
RDF is used to register for diagnostic events.
FPIN is how the fabric reports a diagnostic event.
Specifically, this patch:
- Adds the formal definition of TLV descriptors that are now used in a lot
of the FC spec. The simplistic fc_fn_desc structure, basically no more
than the tlv definition, is removed.
- Small tlv helper functions are added as defines.
- The list of known Descriptor tags (identifying the TLV) is expanded and
a name initializer introduced.
- The LSRI descriptor, returned in many new ELS response payloads is
added.
- The RDF ELS code is added, and the RDF request response structures
added.
- The FPIN els definition is corrected.
- A full definition of a Link Integrity Notification descriptor is added,
[mkp: rolled in kbuild warning fix]
Link: https://lore.kernel.org/r/20200210173155.547-2-jsmart2021@gmail.com Reported-by: kbuild test robot <lkp@intel.com> Signed-off-by: James Smart <jsmart2021@gmail.com> Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 73ec6d2748dc35db2b32cf3c182a27c4a0837b9b linux-next) Signed-off-by: Jeff Lane <jeffrey.lane@canonical.com> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
James Smart [Tue, 28 Jan 2020 00:23:09 +0000 (16:23 -0800)]
scsi: lpfc: Clean up hba max_lun_queue_depth checks
BugLink: https://bugs.launchpad.net/bugs/1855303
The current code does some odd +1 over maximum xri count checks and
requires that the lun_queue_count can't be bigger than maximum xri count
divided by 8. These items are bogus.
Clean the code up to cap lun_queue_count to maximum xri count.
projects / mirror_ubuntu-focal-kernel.git / log