Linux v4.5.4
This commit is contained in:
Justin M. Forbes
parent
a61e13195e
commit
399e5b04d1
|
|
@ -1,169 +0,0 @@
|
|||
From a21211672c9a1d730a39aa65d4a5b3414700adfb Mon Sep 17 00:00:00 2001
|
||||
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
|
||||
Date: Wed, 23 Mar 2016 21:07:39 -0700
|
||||
Subject: [PATCH] ACPI / processor: Request native thermal interrupt handling
|
||||
via _OSC
|
||||
|
||||
There are several reports of freeze on enabling HWP (Hardware PStates)
|
||||
feature on Skylake-based systems by the Intel P-states driver. The root
|
||||
cause is identified as the HWP interrupts causing BIOS code to freeze.
|
||||
|
||||
HWP interrupts use the thermal LVT which can be handled by Linux
|
||||
natively, but on the affected Skylake-based systems SMM will respond
|
||||
to it by default. This is a problem for several reasons:
|
||||
- On the affected systems the SMM thermal LVT handler is broken (it
|
||||
will crash when invoked) and a BIOS update is necessary to fix it.
|
||||
- With thermal interrupt handled in SMM we lose all of the reporting
|
||||
features of the arch/x86/kernel/cpu/mcheck/therm_throt driver.
|
||||
- Some thermal drivers like x86-package-temp depend on the thermal
|
||||
threshold interrupts signaled via the thermal LVT.
|
||||
- The HWP interrupts are useful for debugging and tuning
|
||||
performance (if the kernel can handle them).
|
||||
The native handling of thermal interrupts needs to be enabled
|
||||
because of that.
|
||||
|
||||
This requires some way to tell SMM that the OS can handle thermal
|
||||
interrupts. That can be done by using _OSC/_PDC in processor
|
||||
scope very early during ACPI initialization.
|
||||
|
||||
The meaning of _OSC/_PDC bit 12 in processor scope is whether or
|
||||
not the OS supports native handling of interrupts for Collaborative
|
||||
Processor Performance Control (CPPC) notifications. Since on
|
||||
HWP-capable systems CPPC is a firmware interface to HWP, setting
|
||||
this bit effectively tells the firmware that the OS will handle
|
||||
thermal interrupts natively going forward.
|
||||
|
||||
For details on _OSC/_PDC refer to:
|
||||
http://www.intel.com/content/www/us/en/standards/processor-vendor-specific-acpi-specification.html
|
||||
|
||||
To implement the _OSC/_PDC handshake as described, introduce a new
|
||||
function, acpi_early_processor_osc(), that walks the ACPI
|
||||
namespace looking for ACPI processor objects and invokes _OSC for
|
||||
them with bit 12 in the capabilities buffer set and terminates the
|
||||
namespace walk on the first success.
|
||||
|
||||
Also modify intel_thermal_interrupt() to clear HWP status bits in
|
||||
the HWP_STATUS MSR to acknowledge HWP interrupts (which prevents
|
||||
them from firing continuously).
|
||||
|
||||
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
|
||||
[ rjw: Subject & changelog, function rename ]
|
||||
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
|
||||
---
|
||||
arch/x86/kernel/cpu/mcheck/therm_throt.c | 3 ++
|
||||
drivers/acpi/acpi_processor.c | 52 ++++++++++++++++++++++++++++++++
|
||||
drivers/acpi/bus.c | 3 ++
|
||||
drivers/acpi/internal.h | 6 ++++
|
||||
4 files changed, 64 insertions(+)
|
||||
|
||||
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
|
||||
index 2c5aaf8..0553858 100644
|
||||
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
|
||||
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
|
||||
@@ -385,6 +385,9 @@ static void intel_thermal_interrupt(void)
|
||||
{
|
||||
__u64 msr_val;
|
||||
|
||||
+ if (static_cpu_has(X86_FEATURE_HWP))
|
||||
+ wrmsrl_safe(MSR_HWP_STATUS, 0);
|
||||
+
|
||||
rdmsrl(MSR_IA32_THERM_STATUS, msr_val);
|
||||
|
||||
/* Check for violation of core thermal thresholds*/
|
||||
diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
|
||||
index b5e54f2..0d92d0f 100644
|
||||
--- a/drivers/acpi/acpi_processor.c
|
||||
+++ b/drivers/acpi/acpi_processor.c
|
||||
@@ -491,6 +491,58 @@ static void acpi_processor_remove(struct acpi_device *device)
|
||||
}
|
||||
#endif /* CONFIG_ACPI_HOTPLUG_CPU */
|
||||
|
||||
+#ifdef CONFIG_X86
|
||||
+static bool acpi_hwp_native_thermal_lvt_set;
|
||||
+static acpi_status __init acpi_hwp_native_thermal_lvt_osc(acpi_handle handle,
|
||||
+ u32 lvl,
|
||||
+ void *context,
|
||||
+ void **rv)
|
||||
+{
|
||||
+ u8 sb_uuid_str[] = "4077A616-290C-47BE-9EBD-D87058713953";
|
||||
+ u32 capbuf[2];
|
||||
+ struct acpi_osc_context osc_context = {
|
||||
+ .uuid_str = sb_uuid_str,
|
||||
+ .rev = 1,
|
||||
+ .cap.length = 8,
|
||||
+ .cap.pointer = capbuf,
|
||||
+ };
|
||||
+
|
||||
+ if (acpi_hwp_native_thermal_lvt_set)
|
||||
+ return AE_CTRL_TERMINATE;
|
||||
+
|
||||
+ capbuf[0] = 0x0000;
|
||||
+ capbuf[1] = 0x1000; /* set bit 12 */
|
||||
+
|
||||
+ if (ACPI_SUCCESS(acpi_run_osc(handle, &osc_context))) {
|
||||
+ if (osc_context.ret.pointer && osc_context.ret.length > 1) {
|
||||
+ u32 *capbuf_ret = osc_context.ret.pointer;
|
||||
+
|
||||
+ if (capbuf_ret[1] & 0x1000) {
|
||||
+ acpi_handle_info(handle,
|
||||
+ "_OSC native thermal LVT Acked\n");
|
||||
+ acpi_hwp_native_thermal_lvt_set = true;
|
||||
+ }
|
||||
+ }
|
||||
+ kfree(osc_context.ret.pointer);
|
||||
+ }
|
||||
+
|
||||
+ return AE_OK;
|
||||
+}
|
||||
+
|
||||
+void __init acpi_early_processor_osc(void)
|
||||
+{
|
||||
+ if (boot_cpu_has(X86_FEATURE_HWP)) {
|
||||
+ acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
|
||||
+ ACPI_UINT32_MAX,
|
||||
+ acpi_hwp_native_thermal_lvt_osc,
|
||||
+ NULL, NULL, NULL);
|
||||
+ acpi_get_devices(ACPI_PROCESSOR_DEVICE_HID,
|
||||
+ acpi_hwp_native_thermal_lvt_osc,
|
||||
+ NULL, NULL);
|
||||
+ }
|
||||
+}
|
||||
+#endif
|
||||
+
|
||||
/*
|
||||
* The following ACPI IDs are known to be suitable for representing as
|
||||
* processor devices.
|
||||
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
|
||||
index 891c42d..f9081b7 100644
|
||||
--- a/drivers/acpi/bus.c
|
||||
+++ b/drivers/acpi/bus.c
|
||||
@@ -1005,6 +1005,9 @@ static int __init acpi_bus_init(void)
|
||||
goto error1;
|
||||
}
|
||||
|
||||
+ /* Set capability bits for _OSC under processor scope */
|
||||
+ acpi_early_processor_osc();
|
||||
+
|
||||
/*
|
||||
* _OSC method may exist in module level code,
|
||||
* so it must be run after ACPI_FULL_INITIALIZATION
|
||||
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
|
||||
index 1e6833a..6f41c73 100644
|
||||
--- a/drivers/acpi/internal.h
|
||||
+++ b/drivers/acpi/internal.h
|
||||
@@ -138,6 +138,12 @@ void acpi_early_processor_set_pdc(void);
|
||||
static inline void acpi_early_processor_set_pdc(void) {}
|
||||
#endif
|
||||
|
||||
+#ifdef CONFIG_X86
|
||||
+void acpi_early_processor_osc(void);
|
||||
+#else
|
||||
+static inline void acpi_early_processor_osc(void) {}
|
||||
+#endif
|
||||
+
|
||||
/* --------------------------------------------------------------------------
|
||||
Embedded Controller
|
||||
-------------------------------------------------------------------------- */
|
||||
--
|
||||
2.5.5
|
||||
|
||||
|
|
@ -1,37 +0,0 @@
|
|||
From 88fd0f33c3cc5aa6a26f56902241941ac717e9f8 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Robinson <pbrobinson@gmail.com>
|
||||
Date: Wed, 27 Apr 2016 13:44:05 +0100
|
||||
Subject: [PATCH] gpu: ipu-v3: Fix imx-ipuv3-crtc module autoloading
|
||||
|
||||
---
|
||||
drivers/gpu/ipu-v3/ipu-common.c | 7 ++++++-
|
||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
|
||||
index e00db3f..abb98c7 100644
|
||||
--- a/drivers/gpu/ipu-v3/ipu-common.c
|
||||
+++ b/drivers/gpu/ipu-v3/ipu-common.c
|
||||
@@ -1068,7 +1068,6 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base)
|
||||
goto err_register;
|
||||
}
|
||||
|
||||
- pdev->dev.of_node = of_node;
|
||||
pdev->dev.parent = dev;
|
||||
|
||||
ret = platform_device_add_data(pdev, ®->pdata,
|
||||
@@ -1079,6 +1078,12 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base)
|
||||
platform_device_put(pdev);
|
||||
goto err_register;
|
||||
}
|
||||
+
|
||||
+ /*
|
||||
+ * Set of_node only after calling platform_device_add. Otherwise
|
||||
+ * the platform:imx-ipuv3-crtc modalias won't be used.
|
||||
+ */
|
||||
+ pdev->dev.of_node = of_node;
|
||||
}
|
||||
|
||||
return 0;
|
||||
--
|
||||
2.7.4
|
||||
|
||||
14
kernel.spec
14
kernel.spec
|
|
@ -54,7 +54,7 @@ Summary: The Linux kernel
|
|||
%if 0%{?released_kernel}
|
||||
|
||||
# Do we have a -stable update to apply?
|
||||
%define stable_update 3
|
||||
%define stable_update 4
|
||||
# Set rpm version accordingly
|
||||
%if 0%{?stable_update}
|
||||
%define stablerev %{stable_update}
|
||||
|
|
@ -506,9 +506,6 @@ Patch422: geekbox-v4-device-tree-support.patch
|
|||
# http://www.spinics.net/lists/arm-kernel/msg483898.html
|
||||
Patch423: Initial-AllWinner-A64-and-PINE64-support.patch
|
||||
|
||||
# rhbz 1321330 http://www.spinics.net/lists/dri-devel/msg105829.html
|
||||
Patch425: 0001-gpu-ipu-v3-Fix-imx-ipuv3-crtc-module-autoloading.patch
|
||||
|
||||
# http://www.spinics.net/lists/linux-tegra/msg26029.html
|
||||
Patch426: usb-phy-tegra-Add-38.4MHz-clock-table-entry.patch
|
||||
|
||||
|
|
@ -632,9 +629,6 @@ Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
|
|||
# CVE-2016-3672 rhbz 1324749 1324750
|
||||
Patch689: x86-mm-32-Enable-full-randomization-on-i386-and-X86_.patch
|
||||
|
||||
#rhbz 1309980
|
||||
Patch698: 0001-ACPI-processor-Request-native-thermal-interrupt-hand.patch
|
||||
|
||||
#rhbz 1309487
|
||||
Patch701: antenna_select.patch
|
||||
|
||||
|
|
@ -657,9 +651,6 @@ Patch706: USB-usbfs-fix-potential-infoleak-in-devio.patch
|
|||
Patch707: net-fix-infoleak-in-llc.patch
|
||||
Patch708: net-fix-infoleak-in-rtnetlink.patch
|
||||
|
||||
#CVE-2016-xxxx rhbz 1333712 1333713
|
||||
Patch709: propogate_mnt-Handle-the-first-propogated-copy-being.patch
|
||||
|
||||
#CVE-2016-4557 CVE-2016-4558 rhbz 1334307 1334303 1334311
|
||||
Patch711: bpf-fix-double-fdput-in-replace_map_fd_with_map_ptr.patch
|
||||
Patch712: bpf-fix-refcnt-overflow.patch
|
||||
|
|
@ -2193,6 +2184,9 @@ fi
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Wed May 11 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.5.4-200
|
||||
- Linux v4.5.4
|
||||
|
||||
* Tue May 10 2016 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- Enable XEN SCSI front and backend (rhbz 1334512)
|
||||
- CVE-2016-4569 info leak in sound module (rhbz 1334643 1334645)
|
||||
|
|
|
|||
|
|
@ -1,131 +0,0 @@
|
|||
From ba23dd7749dfeab511f2eab29eef21dde31ad480 Mon Sep 17 00:00:00 2001
|
||||
From: "Eric W. Biederman" <ebiederm@xmission.com>
|
||||
Date: Thu, 5 May 2016 09:29:29 -0500
|
||||
Subject: [PATCH] propogate_mnt: Handle the first propogated copy being a slave
|
||||
|
||||
When the first propgated copy was a slave the following oops would result:
|
||||
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
|
||||
> IP: [<ffffffff811fba4e>] propagate_one+0xbe/0x1c0
|
||||
> PGD bacd4067 PUD bac66067 PMD 0
|
||||
> Oops: 0000 [#1] SMP
|
||||
> Modules linked in:
|
||||
> CPU: 1 PID: 824 Comm: mount Not tainted 4.6.0-rc5userns+ #1523
|
||||
> Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
|
||||
> task: ffff8800bb0a8000 ti: ffff8800bac3c000 task.ti: ffff8800bac3c000
|
||||
> RIP: 0010:[<ffffffff811fba4e>] [<ffffffff811fba4e>] propagate_one+0xbe/0x1c0
|
||||
> RSP: 0018:ffff8800bac3fd38 EFLAGS: 00010283
|
||||
> RAX: 0000000000000000 RBX: ffff8800bb77ec00 RCX: 0000000000000010
|
||||
> RDX: 0000000000000000 RSI: ffff8800bb58c000 RDI: ffff8800bb58c480
|
||||
> RBP: ffff8800bac3fd48 R08: 0000000000000001 R09: 0000000000000000
|
||||
> R10: 0000000000001ca1 R11: 0000000000001c9d R12: 0000000000000000
|
||||
> R13: ffff8800ba713800 R14: ffff8800bac3fda0 R15: ffff8800bb77ec00
|
||||
> FS: 00007f3c0cd9b7e0(0000) GS:ffff8800bfb00000(0000) knlGS:0000000000000000
|
||||
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
|
||||
> CR2: 0000000000000010 CR3: 00000000bb79d000 CR4: 00000000000006e0
|
||||
> Stack:
|
||||
> ffff8800bb77ec00 0000000000000000 ffff8800bac3fd88 ffffffff811fbf85
|
||||
> ffff8800bac3fd98 ffff8800bb77f080 ffff8800ba713800 ffff8800bb262b40
|
||||
> 0000000000000000 0000000000000000 ffff8800bac3fdd8 ffffffff811f1da0
|
||||
> Call Trace:
|
||||
> [<ffffffff811fbf85>] propagate_mnt+0x105/0x140
|
||||
> [<ffffffff811f1da0>] attach_recursive_mnt+0x120/0x1e0
|
||||
> [<ffffffff811f1ec3>] graft_tree+0x63/0x70
|
||||
> [<ffffffff811f1f6b>] do_add_mount+0x9b/0x100
|
||||
> [<ffffffff811f2c1a>] do_mount+0x2aa/0xdf0
|
||||
> [<ffffffff8117efbe>] ? strndup_user+0x4e/0x70
|
||||
> [<ffffffff811f3a45>] SyS_mount+0x75/0xc0
|
||||
> [<ffffffff8100242b>] do_syscall_64+0x4b/0xa0
|
||||
> [<ffffffff81988f3c>] entry_SYSCALL64_slow_path+0x25/0x25
|
||||
> Code: 00 00 75 ec 48 89 0d 02 22 22 01 8b 89 10 01 00 00 48 89 05 fd 21 22 01 39 8e 10 01 00 00 0f 84 e0 00 00 00 48 8b 80 d8 00 00 00 <48> 8b 50 10 48 89 05 df 21 22 01 48 89 15 d0 21 22 01 8b 53 30
|
||||
> RIP [<ffffffff811fba4e>] propagate_one+0xbe/0x1c0
|
||||
> RSP <ffff8800bac3fd38>
|
||||
> CR2: 0000000000000010
|
||||
> ---[ end trace 2725ecd95164f217 ]---
|
||||
|
||||
This oops happens with the namespace_sem held and can be triggered by
|
||||
non-root users. An all around not pleasant experience.
|
||||
|
||||
To avoid this scenario when finding the appropriate source mount to
|
||||
copy stop the walk up the mnt_master chain when the first source mount
|
||||
is encountered.
|
||||
|
||||
Further rewrite the walk up the last_source mnt_master chain so that
|
||||
it is clear what is going on.
|
||||
|
||||
The reason why the first source mount is special is that it it's
|
||||
mnt_parent is not a mount in the dest_mnt propagation tree, and as
|
||||
such termination conditions based up on the dest_mnt mount propgation
|
||||
tree do not make sense.
|
||||
|
||||
To avoid other kinds of confusion last_dest is not changed when
|
||||
computing last_source. last_dest is only used once in propagate_one
|
||||
and that is above the point of the code being modified, so changing
|
||||
the global variable is meaningless and confusing.
|
||||
|
||||
Cc: stable@vger.kernel.org
|
||||
fixes: f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 ("smarter propagate_mnt()")
|
||||
Reported-by: Tycho Andersen <tycho.andersen@canonical.com>
|
||||
Reviewed-by: Seth Forshee <seth.forshee@canonical.com>
|
||||
Tested-by: Seth Forshee <seth.forshee@canonical.com>
|
||||
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
|
||||
---
|
||||
fs/pnode.c | 25 ++++++++++++++-----------
|
||||
1 file changed, 14 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/fs/pnode.c b/fs/pnode.c
|
||||
index c524fdddc7fb..99899705b105 100644
|
||||
--- a/fs/pnode.c
|
||||
+++ b/fs/pnode.c
|
||||
@@ -198,7 +198,7 @@ static struct mount *next_group(struct mount *m, struct mount *origin)
|
||||
|
||||
/* all accesses are serialized by namespace_sem */
|
||||
static struct user_namespace *user_ns;
|
||||
-static struct mount *last_dest, *last_source, *dest_master;
|
||||
+static struct mount *last_dest, *first_source, *last_source, *dest_master;
|
||||
static struct mountpoint *mp;
|
||||
static struct hlist_head *list;
|
||||
|
||||
@@ -221,20 +221,22 @@ static int propagate_one(struct mount *m)
|
||||
type = CL_MAKE_SHARED;
|
||||
} else {
|
||||
struct mount *n, *p;
|
||||
+ bool done;
|
||||
for (n = m; ; n = p) {
|
||||
p = n->mnt_master;
|
||||
- if (p == dest_master || IS_MNT_MARKED(p)) {
|
||||
- while (last_dest->mnt_master != p) {
|
||||
- last_source = last_source->mnt_master;
|
||||
- last_dest = last_source->mnt_parent;
|
||||
- }
|
||||
- if (!peers(n, last_dest)) {
|
||||
- last_source = last_source->mnt_master;
|
||||
- last_dest = last_source->mnt_parent;
|
||||
- }
|
||||
+ if (p == dest_master || IS_MNT_MARKED(p))
|
||||
break;
|
||||
- }
|
||||
}
|
||||
+ do {
|
||||
+ struct mount *parent = last_source->mnt_parent;
|
||||
+ if (last_source == first_source)
|
||||
+ break;
|
||||
+ done = parent->mnt_master == p;
|
||||
+ if (done && peers(n, parent))
|
||||
+ break;
|
||||
+ last_source = last_source->mnt_master;
|
||||
+ } while (!done);
|
||||
+
|
||||
type = CL_SLAVE;
|
||||
/* beginning of peer group among the slaves? */
|
||||
if (IS_MNT_SHARED(m))
|
||||
@@ -286,6 +288,7 @@ int propagate_mnt(struct mount *dest_mnt, struct mountpoint *dest_mp,
|
||||
*/
|
||||
user_ns = current->nsproxy->mnt_ns->user_ns;
|
||||
last_dest = dest_mnt;
|
||||
+ first_source = source_mnt;
|
||||
last_source = source_mnt;
|
||||
mp = dest_mp;
|
||||
list = tree_list;
|
||||
--
|
||||
2.5.5
|
||||
|
||||
Loading…
Reference in New Issue