Update ov5693 and intel-skl-int3472 drivers #86

djrscally · 2021-03-07T00:00:49Z

This PR updates the two main in-progress camera modules.

The intel-skl-int3472 driver actually has little functional change, because I'd already merged the main functional updates separately. The most major change is that the indicator-led will no longer be exposed to the sensor drivers and instead is simply triggered along with the clock enable pin.

The ov5693 driver has been extensively cleaned up (I will be upstreaming this soon, possibly tomorrow...or atleast submitting a v1 that will probably elicit a lot of feedback!). Main things to point out:

I reduced the modes to 3 (2592x1944, 1920x1080 and 1280x720), primarily I can't see any reason to have more than that. All the modes have full field of view, through either scaling or binning. Defining modes now echoes the ov8865/ov5648 driver, I.E. you can use raw values in a struct instead of incomprehensible register values, so adding more if desired should be easy.
All mandatory, recommended and optional controls for libcamera are now included, meaning you should receive no errors or warnings running qcam
Added a test pattern control...quite fun to turn it on and see the snow.
.probe() now checks for the cio2-bridge created endpoint and returns -EPROBE_DEFER if it's not present; this is necessary to ensure @fabwu's rotation and orientation controls patch works reliably.

There's one remaining message in dmesg to this effect:

use of bytesused == 0 is deprecated and will be removed in the future, use the acutal size instead

This comes from the V4L2 framework, but I haven't tracked down the cause yet.

In preparation for loading the v3 code, remove the v2. Signed-off-by: Daniel Scally <djrscally@gmail.com>

Remove the old version of the ov5693 driver, in preparation for merging in the newer one. Signed-off-by: Daniel Scally <djrscally@gmail.com>

This reverts commit 8a14e90.

This reverts commit cd72ad7.

This reverts commit 40e472f.

This reverts commit 0502b78.

This reverts commit da9d6f9.

This reverts commit 5ecff4b.

Some places in the kernel allow users to map resources to a device using device name (for example, in the struct gpiod_lookup_table). Currently this involves waiting for the I2C client to have been registered so we can use dev_name(&client->dev). We want to add a function to allow users to refer to an I2C device by name before it has been instantiated, so create a macro for the format that's accessible outside the I2C layer and use it in i2c_dev_set_name(). Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Daniel Scally <djrscally@gmail.com>

I need to be able to translate GPIO resources in an ACPI device's _CRS into GPIO descriptor array. Those are represented in _CRS as a pathname to a GPIO device plus the pin's index number: this function is perfect for that purpose. As it's currently only used internally within the GPIO layer, provide and export a wrapper function that additionally holds a reference to the GPIO device. Signed-off-by: Daniel Scally <djrscally@gmail.com>

qzed

Some testing results: Before updating libcamera, it works as before, i.e. the image is flipped and has a green tint. After updating libcamera, the image is now correctly rotated and now has a blue tint. Neither version seems to have any complaints wrt. missing controls or other things.

Apart from that, the LED still blinks on startup and I do still get some occasional errors in dmesg, although I can't see any real issues:

[  955.357019] ipu3-cio2 0000:00:14.3: CSI-2 receiver port 1: incomplete long packet detected
[  955.390497] ipu3-cio2 0000:00:14.3: port 1 error PKT2SHORT
[  955.390501] ipu3-cio2 0000:00:14.3: CSI-2 receiver port 1: frame sync error

Otherwise small things mostly, looks good overall. What's the status on the LED issue?

@fabwu Do you want to look over this too?

drivers/gpio/gpiolib-acpi.c

drivers/acpi/scan.c

drivers/platform/x86/intel-int3472/intel_skl_int3472_discrete.c

drivers/media/i2c/ov5693.c

djrscally · 2021-03-07T21:00:19Z

@qzed thanks for the comments - much appreciated.

Some testing results: Before updating libcamera, it works as before, i.e. the image is flipped and has a green tint. After updating libcamera, the image is now correctly rotated and now has a blue tint. Neither version seems to have any complaints wrt. missing controls or other things.

Hm, weird. I don't get a blue tint, I'll pull libcamera master and see what that does.

Apart from that, the LED still blinks on startup and I do still get some occasional errors in dmesg, although I can't see any real issues:
[  955.357019] ipu3-cio2 0000:00:14.3: CSI-2 receiver port 1: incomplete long packet detected
[  955.390497] ipu3-cio2 0000:00:14.3: port 1 error PKT2SHORT
[  955.390501] ipu3-cio2 0000:00:14.3: CSI-2 receiver port 1: frame sync error
Otherwise small things mostly, looks good overall. What's the status on the LED issue?

Alas, with the move to run the LED at the same time as the clock @fabwu's fix for that no longer applies...I'm sure I remember Sakari fixing it somehow on the mailing lists recently, I'll hunt that down when I get time. Or do you mean the chap from reddit who's LED came on permanently? I got him to send me dmesg output, but nothing in there looks unusual. My best guess at the moment is some kind of pm_runtime jiggery-pokery, like maybe it's not suspending properly or something...not sure yet.

I'd really like those CSI-2 errors to not be there...any chance you can try the make clean && make thing that managed to get it working last time at some point?

@fabwu Do you want to look over this too?

qzed · 2021-03-07T21:17:45Z

Hm, weird. I don't get a blue tint, I'll pull libcamera master and see what that does.

Happened after I've updated to kbingham/libcamera@de1b994 today. Pretty sure that change is not related to the kernel driver.

Alas, with the move to run the LED at the same time as the clock @fabwu's fix for that no longer applies...I'm sure I remember Sakari fixing it somehow on the mailing lists recently, I'll hunt that down when I get time. Or do you mean the chap from reddit who's LED came on permanently? I got him to send me dmesg output, but nothing in there looks unusual. My best guess at the moment is some kind of pm_runtime jiggery-pokery, like maybe it's not suspending properly or something...not sure yet.

I actually meant the reddit issue. Thanks! I think you're probably right with the PM guess, I think that's the only thing that changed in that range with regards to the LED.

I'd really like those CSI-2 errors to not be there...any chance you can try the make clean && make thing that managed to get it working last time at some point?

I can try, but might take a bit until I get around to that. I'm currently busy bisecting some GPIO issue on v5.12-rc2... gpiod_get() fails with ENOENT for some surface drivers (hotplug and aggregator).

Edit: That didn't get rid of the messages last time around though and I have the feeling that they aren't directly related to any drivers in this PR. It kinda looks like maybe one of the initial transmissions via CIO2 after starting up qcam is somehow faulty. By the wording, I'd kinda expect the messages to be in that part of the code, decoding those messages. And they don't repeat after it started capturing, so it doesn't seem like it's all too critical.

djrscally · 2021-03-07T21:46:06Z

Hm, weird. I don't get a blue tint, I'll pull libcamera master and see what that does.

Happened after I've updated to kbingham/libcamera@de1b994 today. Pretty sure that change is not related to the kernel driver.

Alas, with the move to run the LED at the same time as the clock @fabwu's fix for that no longer applies...I'm sure I remember Sakari fixing it somehow on the mailing lists recently, I'll hunt that down when I get time. Or do you mean the chap from reddit who's LED came on permanently? I got him to send me dmesg output, but nothing in there looks unusual. My best guess at the moment is some kind of pm_runtime jiggery-pokery, like maybe it's not suspending properly or something...not sure yet.

I actually meant the reddit issue. Thanks! I think you're probably right with the PM guess, I think that's the only thing that changed in that range with regards to the LED.

Yeah...I'll get him to ramp up the kernel log level and try again.

I'd really like those CSI-2 errors to not be there...any chance you can try the make clean && make thing that managed to get it working last time at some point?

I can try, but might take a bit until I get around to that. I'm currently busy bisecting some GPIO issue on v5.12-rc2... gpiod_get() fails with ENOENT for some surface drivers (hotplug and aggregator).

Edit: That didn't get rid of the messages last time around though and I have the feeling that they aren't directly related to any drivers in this PR. It kinda looks like maybe one of the initial transmissions via CIO2 after starting up qcam is somehow faulty. By the wording, I'd kinda expect the messages to be in that part of the code, decoding those messages. And they don't repeat after it started capturing, so it doesn't seem like it's all too critical.

Ah, sorry. Must have misunderstood before. Did they ever go away from the last PR then, or where they always there? I was under the impression they'd gone. It could be something in libcamera or qcam too I suppose yes.

qzed · 2021-03-07T21:51:14Z

Ah, sorry. Must have misunderstood before. Did they ever go away from the last PR then, or where they always there? I was under the impression they'd gone. It could be something in libcamera or qcam too I suppose yes.

I didn't test that much, but I'm fairly certain now that they've always been there. Before and after the last PR. Usually the first time starting qcam works without messages, but repeated starts seem to cause them. Thinking of it, could it be some kind of buffer that doesn't get cleared when closing and is read in the next time?

The acpi_walk_dep_device_list() is not as generalisable as its name implies, serving only to decrement the dependency count for each dependent device of the input. Extend the function to instead accept a callback which can be applied to all the dependencies in acpi_dep_list. Replace all existing calls to the function with calls to a wrapper, passing a callback that applies the same dependency reduction. Signed-off-by: Daniel Scally <djrscally@gmail.com>

In some ACPI tables we encounter, devices use the _DEP method to assert a dependence on other ACPI devices as opposed to the OpRegions that the specification intends. We need to be able to find those devices "from" the dependee, so add a callback and a wrapper to walk over the acpi_dep_list and return the dependent ACPI device. Signed-off-by: Daniel Scally <djrscally@gmail.com>

Not much in the way of functional change; primarily that the indicator LED is no longer driven by the camera driver and instead is activated along with the clk. Signed-off-by: Daniel Scally <djrscally@gmail.com>

The OV5693 is a 5 Mpx CMOS image sensor, connected via MIPI CSI-2. The chip is capable of a single lane configuration, but currently only two lanes are supported. Most of the sensor's features are supported, with the main exception being the lens correction algorithm. The driver provides all mandatory, optional and recommended V4L2 controls for maximum compatibility with libcamera. Signed-off-by: Daniel Scally <djrscally@gmail.com>

qzed · 2021-03-08T14:48:54Z

drivers/platform/x86/intel-int3472/intel_skl_int3472_discrete.c

+	ret = acpi_dev_get_resources(int3472->adev, &resource_list,
+				     skl_int3472_handle_gpio_resources,
+				     int3472);
+	if (ret)


Should this be ret < 0? From acpi_dev_get_resources():

The number of resources in the output list is returned on success, an error code reflecting the error condition is returned otherwise.

I think otherwise add a comment that you're actually checking for there to be zero resources. Also if you're checking for zero resources, you may still be returning a positive value here which will cause skl_int3472_discrete_probe() to fail.

I assume this currently works as no resources get collected due to returning 1 in the callback? Anyway, I think ret < 0 or a comment would be clearer.

Great catch. It should be ret < 0; thank you!

qzed · 2021-03-08T14:54:40Z

drivers/platform/x86/intel-int3472/intel_skl_int3472_discrete.c

+				     skl_int3472_handle_gpio_resources,
+				     int3472);
+	if (ret)
+		goto out_free_res_list;


If this is on the error path (i.e. ret < 0 above), there's no need to call acpi_dev_free_resource_list(). It's already done here: https://elixir.bootlin.com/linux/latest/source/drivers/acpi/resource.c#L584.

Also good catch; that's been through three rounds of review now without being noticed. Thanks very much!

I don't think it should've caused any problems (e.g. double free or something like that) since it's walking over the list and freeing/deleting the nodes (so the second call should just receive an empty list).

drivers/platform/x86/intel-int3472/intel_skl_int3472_discrete.c

fabwu · 2021-03-08T17:26:20Z

I tried a make clean && make and get this error:

ld: fs/efivarfs/file.o: in function `acpi_get_gpiod':
file.c:(.text+0x430): multiple definition of `acpi_get_gpiod'; fs/efivarfs/inode.o:inode.c:(.text+0x40): first defined here
ld: fs/efivarfs/super.o: in function `acpi_get_gpiod':
super.c:(.text+0x510): multiple definition of `acpi_get_gpiod'; fs/efivarfs/inode.o:inode.c:(.text+0x40): first defined here
make[2]: *** [scripts/Makefile.build:430: fs/efivarfs/efivarfs.o] Error 1
make[1]: *** [scripts/Makefile.build:496: fs/efivarfs] Error 2
make: *** [Makefile:1800: fs] Error 2

@djrscally Have you ever tried to build your changes on a clean kernel?

djrscally · 2021-03-08T19:59:57Z

I tried a make clean && make and get this error:

ld: fs/efivarfs/file.o: in function `acpi_get_gpiod':
file.c:(.text+0x430): multiple definition of `acpi_get_gpiod'; fs/efivarfs/inode.o:inode.c:(.text+0x40): first defined here
ld: fs/efivarfs/super.o: in function `acpi_get_gpiod':
super.c:(.text+0x510): multiple definition of `acpi_get_gpiod'; fs/efivarfs/inode.o:inode.c:(.text+0x40): first defined here
make[2]: *** [scripts/Makefile.build:430: fs/efivarfs/efivarfs.o] Error 1
make[1]: *** [scripts/Makefile.build:496: fs/efivarfs] Error 2
make: *** [Makefile:1800: fs] Error 2

@djrscally Have you ever tried to build your changes on a clean kernel?

Oh shoot! I haven't, no. Sorry...didn't realise that could result in missed issues like this. I'll do that now and fix what crops up.

qzed · 2021-03-08T20:21:35Z

Hmm, I thought I did clean-build this. I usually run make distclean and ./scripts/kconfig/merge_config.sh ... if I check out any new branches.

djrscally · 2021-03-08T20:28:55Z

Yeah, actually I did make clean && make now, and it's built without error for me.

fabwu · 2021-03-09T06:56:47Z

Mmh that's strange I'll try make distclean maybe that helps.

qzed · 2021-05-05T13:48:05Z

@djrscally I've added a new v5.12 based branch (v5.12-surface-devel) with the camera commits taken from your latest kernel submissions (v2 "Introduce intel_skl_int3472 driver" and v2 "Add support for OV5693", plus some commits from @fabwu from v5.11-surface-devel, the rest should already be upstream). I think it's best if you open a new PR and base any updates on that.

Also feel free to have a look over the camera related commits on that branch and let me know if it's missing anything (front camera works as far as I can tell, does have a purple tint though).

djrscally · 2021-05-05T14:06:26Z

@qzed thanks! Sorry, kinda abandoned this, time constraints lately. I'll get back to it asap :)

qzed · 2021-05-05T14:07:10Z

No worries.

fabwu · 2021-05-06T05:58:11Z

Thanks for merging! I saw some of the surface patches are upstream that's awesome.

I added on tiny PR #95 just to make sure everything is working.

Quick question: I sent a patch a month ago and haven't yet received an answer. Should I resend it or is it too early? Or maybe write directly to the person who's responsible for it?

djrscally · 2021-05-06T07:10:47Z

Quick question: I sent a patch a month ago and haven't yet received an answer. Should I resend it or is it too early? Or maybe write directly to the person who's responsible for it?

Yeah I was just starting to think about chasing them on that - I would reply to Rafael's mail asking erik to pick up the 1/2 patch for ACPICA and ask if anything else needs doing...and maybe just a general ping on the 2/2 asking for any more comments, or for it to be picked up - it'll probably be Sakari who has to pick it anyway so he should see that.

Liajian reported a bug_on hit on a ThunderX2 arm64 server with FastLinQ QL41000 ethernet controller: BUG: scheduling while atomic: kworker/0:4/531/0x00000200 [qed_probe:488()]hw prepare failed kernel BUG at mm/vmalloc.c:2355! Internal error: Oops - BUG: 0 [#1] SMP CPU: 0 PID: 531 Comm: kworker/0:4 Tainted: G W 5.4.0-77-generic linux-surface#86-Ubuntu pstate: 00400009 (nzcv daif +PAN -UAO) Call trace: vunmap+0x4c/0x50 iounmap+0x48/0x58 qed_free_pci+0x60/0x80 [qed] qed_probe+0x35c/0x688 [qed] __qede_probe+0x88/0x5c8 [qede] qede_probe+0x60/0xe0 [qede] local_pci_probe+0x48/0xa0 work_for_cpu_fn+0x24/0x38 process_one_work+0x1d0/0x468 worker_thread+0x238/0x4e0 kthread+0xf0/0x118 ret_from_fork+0x10/0x18 In this case, qed_hw_prepare() returns error due to hw/fw error, but in theory work queue should be in process context instead of interrupt. The root cause might be the unpaired spin_{un}lock_bh() in _qed_mcp_cmd_and_union(), which causes botton half is disabled incorrectly. Reported-by: Lijian Zhang <Lijian.Zhang@arm.com> Signed-off-by: Jia He <justin.he@arm.com> Signed-off-by: David S. Miller <davem@davemloft.net>

In some cases skb head could be locked and entire header data is pulled from skb. When skb_zerocopy() called in such cases, following BUG is triggered. This patch fixes it by copying entire skb in such cases. This could be optimized incase this is performance bottleneck. ---8<--- kernel BUG at net/core/skbuff.c:2961! invalid opcode: 0000 [#1] SMP PTI CPU: 2 PID: 0 Comm: swapper/2 Tainted: G OE 5.4.0-77-generic linux-surface#86-Ubuntu Hardware name: OpenStack Foundation OpenStack Nova, BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:skb_zerocopy+0x37a/0x3a0 RSP: 0018:ffffbcc70013ca38 EFLAGS: 00010246 Call Trace: <IRQ> queue_userspace_packet+0x2af/0x5e0 [openvswitch] ovs_dp_upcall+0x3d/0x60 [openvswitch] ovs_dp_process_packet+0x125/0x150 [openvswitch] ovs_vport_receive+0x77/0xd0 [openvswitch] netdev_port_receive+0x87/0x130 [openvswitch] netdev_frame_hook+0x4b/0x60 [openvswitch] __netif_receive_skb_core+0x2b4/0xc90 __netif_receive_skb_one_core+0x3f/0xa0 __netif_receive_skb+0x18/0x60 process_backlog+0xa9/0x160 net_rx_action+0x142/0x390 __do_softirq+0xe1/0x2d6 irq_exit+0xae/0xb0 do_IRQ+0x5a/0xf0 common_interrupt+0xf/0xf Code that triggered BUG: int skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) { int i, j = 0; int plen = 0; /* length of skb->head fragment */ int ret; struct page *page; unsigned int offset; BUG_ON(!from->head_frag && !hlen); Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Signed-off-by: David S. Miller <davem@davemloft.net>

[ Upstream commit 6206b79 ] Liajian reported a bug_on hit on a ThunderX2 arm64 server with FastLinQ QL41000 ethernet controller: BUG: scheduling while atomic: kworker/0:4/531/0x00000200 [qed_probe:488()]hw prepare failed kernel BUG at mm/vmalloc.c:2355! Internal error: Oops - BUG: 0 [#1] SMP CPU: 0 PID: 531 Comm: kworker/0:4 Tainted: G W 5.4.0-77-generic #86-Ubuntu pstate: 00400009 (nzcv daif +PAN -UAO) Call trace: vunmap+0x4c/0x50 iounmap+0x48/0x58 qed_free_pci+0x60/0x80 [qed] qed_probe+0x35c/0x688 [qed] __qede_probe+0x88/0x5c8 [qede] qede_probe+0x60/0xe0 [qede] local_pci_probe+0x48/0xa0 work_for_cpu_fn+0x24/0x38 process_one_work+0x1d0/0x468 worker_thread+0x238/0x4e0 kthread+0xf0/0x118 ret_from_fork+0x10/0x18 In this case, qed_hw_prepare() returns error due to hw/fw error, but in theory work queue should be in process context instead of interrupt. The root cause might be the unpaired spin_{un}lock_bh() in _qed_mcp_cmd_and_union(), which causes botton half is disabled incorrectly. Reported-by: Lijian Zhang <Lijian.Zhang@arm.com> Signed-off-by: Jia He <justin.he@arm.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit a17ad09 ] In some cases skb head could be locked and entire header data is pulled from skb. When skb_zerocopy() called in such cases, following BUG is triggered. This patch fixes it by copying entire skb in such cases. This could be optimized incase this is performance bottleneck. ---8<--- kernel BUG at net/core/skbuff.c:2961! invalid opcode: 0000 [#1] SMP PTI CPU: 2 PID: 0 Comm: swapper/2 Tainted: G OE 5.4.0-77-generic #86-Ubuntu Hardware name: OpenStack Foundation OpenStack Nova, BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:skb_zerocopy+0x37a/0x3a0 RSP: 0018:ffffbcc70013ca38 EFLAGS: 00010246 Call Trace: <IRQ> queue_userspace_packet+0x2af/0x5e0 [openvswitch] ovs_dp_upcall+0x3d/0x60 [openvswitch] ovs_dp_process_packet+0x125/0x150 [openvswitch] ovs_vport_receive+0x77/0xd0 [openvswitch] netdev_port_receive+0x87/0x130 [openvswitch] netdev_frame_hook+0x4b/0x60 [openvswitch] __netif_receive_skb_core+0x2b4/0xc90 __netif_receive_skb_one_core+0x3f/0xa0 __netif_receive_skb+0x18/0x60 process_backlog+0xa9/0x160 net_rx_action+0x142/0x390 __do_softirq+0xe1/0x2d6 irq_exit+0xae/0xb0 do_IRQ+0x5a/0xf0 common_interrupt+0xf/0xf Code that triggered BUG: int skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) { int i, j = 0; int plen = 0; /* length of skb->head fragment */ int ret; struct page *page; unsigned int offset; BUG_ON(!from->head_frag && !hlen); Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit 6206b79 ] Liajian reported a bug_on hit on a ThunderX2 arm64 server with FastLinQ QL41000 ethernet controller: BUG: scheduling while atomic: kworker/0:4/531/0x00000200 [qed_probe:488()]hw prepare failed kernel BUG at mm/vmalloc.c:2355! Internal error: Oops - BUG: 0 [#1] SMP CPU: 0 PID: 531 Comm: kworker/0:4 Tainted: G W 5.4.0-77-generic #86-Ubuntu pstate: 00400009 (nzcv daif +PAN -UAO) Call trace: vunmap+0x4c/0x50 iounmap+0x48/0x58 qed_free_pci+0x60/0x80 [qed] qed_probe+0x35c/0x688 [qed] __qede_probe+0x88/0x5c8 [qede] qede_probe+0x60/0xe0 [qede] local_pci_probe+0x48/0xa0 work_for_cpu_fn+0x24/0x38 process_one_work+0x1d0/0x468 worker_thread+0x238/0x4e0 kthread+0xf0/0x118 ret_from_fork+0x10/0x18 In this case, qed_hw_prepare() returns error due to hw/fw error, but in theory work queue should be in process context instead of interrupt. The root cause might be the unpaired spin_{un}lock_bh() in _qed_mcp_cmd_and_union(), which causes botton half is disabled incorrectly. Reported-by: Lijian Zhang <Lijian.Zhang@arm.com> Signed-off-by: Jia He <justin.he@arm.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit a17ad09 ] In some cases skb head could be locked and entire header data is pulled from skb. When skb_zerocopy() called in such cases, following BUG is triggered. This patch fixes it by copying entire skb in such cases. This could be optimized incase this is performance bottleneck. ---8<--- kernel BUG at net/core/skbuff.c:2961! invalid opcode: 0000 [#1] SMP PTI CPU: 2 PID: 0 Comm: swapper/2 Tainted: G OE 5.4.0-77-generic #86-Ubuntu Hardware name: OpenStack Foundation OpenStack Nova, BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:skb_zerocopy+0x37a/0x3a0 RSP: 0018:ffffbcc70013ca38 EFLAGS: 00010246 Call Trace: <IRQ> queue_userspace_packet+0x2af/0x5e0 [openvswitch] ovs_dp_upcall+0x3d/0x60 [openvswitch] ovs_dp_process_packet+0x125/0x150 [openvswitch] ovs_vport_receive+0x77/0xd0 [openvswitch] netdev_port_receive+0x87/0x130 [openvswitch] netdev_frame_hook+0x4b/0x60 [openvswitch] __netif_receive_skb_core+0x2b4/0xc90 __netif_receive_skb_one_core+0x3f/0xa0 __netif_receive_skb+0x18/0x60 process_backlog+0xa9/0x160 net_rx_action+0x142/0x390 __do_softirq+0xe1/0x2d6 irq_exit+0xae/0xb0 do_IRQ+0x5a/0xf0 common_interrupt+0xf/0xf Code that triggered BUG: int skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) { int i, j = 0; int plen = 0; /* length of skb->head fragment */ int ret; struct page *page; unsigned int offset; BUG_ON(!from->head_frag && !hlen); Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit 6206b79 ] Liajian reported a bug_on hit on a ThunderX2 arm64 server with FastLinQ QL41000 ethernet controller: BUG: scheduling while atomic: kworker/0:4/531/0x00000200 [qed_probe:488()]hw prepare failed kernel BUG at mm/vmalloc.c:2355! Internal error: Oops - BUG: 0 [#1] SMP CPU: 0 PID: 531 Comm: kworker/0:4 Tainted: G W 5.4.0-77-generic #86-Ubuntu pstate: 00400009 (nzcv daif +PAN -UAO) Call trace: vunmap+0x4c/0x50 iounmap+0x48/0x58 qed_free_pci+0x60/0x80 [qed] qed_probe+0x35c/0x688 [qed] __qede_probe+0x88/0x5c8 [qede] qede_probe+0x60/0xe0 [qede] local_pci_probe+0x48/0xa0 work_for_cpu_fn+0x24/0x38 process_one_work+0x1d0/0x468 worker_thread+0x238/0x4e0 kthread+0xf0/0x118 ret_from_fork+0x10/0x18 In this case, qed_hw_prepare() returns error due to hw/fw error, but in theory work queue should be in process context instead of interrupt. The root cause might be the unpaired spin_{un}lock_bh() in _qed_mcp_cmd_and_union(), which causes botton half is disabled incorrectly. Reported-by: Lijian Zhang <Lijian.Zhang@arm.com> Signed-off-by: Jia He <justin.he@arm.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit a17ad09 ] In some cases skb head could be locked and entire header data is pulled from skb. When skb_zerocopy() called in such cases, following BUG is triggered. This patch fixes it by copying entire skb in such cases. This could be optimized incase this is performance bottleneck. ---8<--- kernel BUG at net/core/skbuff.c:2961! invalid opcode: 0000 [#1] SMP PTI CPU: 2 PID: 0 Comm: swapper/2 Tainted: G OE 5.4.0-77-generic #86-Ubuntu Hardware name: OpenStack Foundation OpenStack Nova, BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:skb_zerocopy+0x37a/0x3a0 RSP: 0018:ffffbcc70013ca38 EFLAGS: 00010246 Call Trace: <IRQ> queue_userspace_packet+0x2af/0x5e0 [openvswitch] ovs_dp_upcall+0x3d/0x60 [openvswitch] ovs_dp_process_packet+0x125/0x150 [openvswitch] ovs_vport_receive+0x77/0xd0 [openvswitch] netdev_port_receive+0x87/0x130 [openvswitch] netdev_frame_hook+0x4b/0x60 [openvswitch] __netif_receive_skb_core+0x2b4/0xc90 __netif_receive_skb_one_core+0x3f/0xa0 __netif_receive_skb+0x18/0x60 process_backlog+0xa9/0x160 net_rx_action+0x142/0x390 __do_softirq+0xe1/0x2d6 irq_exit+0xae/0xb0 do_IRQ+0x5a/0xf0 common_interrupt+0xf/0xf Code that triggered BUG: int skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) { int i, j = 0; int plen = 0; /* length of skb->head fragment */ int ret; struct page *page; unsigned int offset; BUG_ON(!from->head_frag && !hlen); Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit a17ad09 ] In some cases skb head could be locked and entire header data is pulled from skb. When skb_zerocopy() called in such cases, following BUG is triggered. This patch fixes it by copying entire skb in such cases. This could be optimized incase this is performance bottleneck. ---8<--- kernel BUG at net/core/skbuff.c:2961! invalid opcode: 0000 [#1] SMP PTI CPU: 2 PID: 0 Comm: swapper/2 Tainted: G OE 5.4.0-77-generic linux-surface#86-Ubuntu Hardware name: OpenStack Foundation OpenStack Nova, BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:skb_zerocopy+0x37a/0x3a0 RSP: 0018:ffffbcc70013ca38 EFLAGS: 00010246 Call Trace: <IRQ> queue_userspace_packet+0x2af/0x5e0 [openvswitch] ovs_dp_upcall+0x3d/0x60 [openvswitch] ovs_dp_process_packet+0x125/0x150 [openvswitch] ovs_vport_receive+0x77/0xd0 [openvswitch] netdev_port_receive+0x87/0x130 [openvswitch] netdev_frame_hook+0x4b/0x60 [openvswitch] __netif_receive_skb_core+0x2b4/0xc90 __netif_receive_skb_one_core+0x3f/0xa0 __netif_receive_skb+0x18/0x60 process_backlog+0xa9/0x160 net_rx_action+0x142/0x390 __do_softirq+0xe1/0x2d6 irq_exit+0xae/0xb0 do_IRQ+0x5a/0xf0 common_interrupt+0xf/0xf Code that triggered BUG: int skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) { int i, j = 0; int plen = 0; /* length of skb->head fragment */ int ret; struct page *page; unsigned int offset; BUG_ON(!from->head_frag && !hlen); Signed-off-by: Pravin B Shelar <pshelar@ovn.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>

…ging The following bug is reported to be triggered when starting X on x86-32 system with i915: [ 225.777375] kernel BUG at mm/memory.c:2664! [ 225.777391] invalid opcode: 0000 [#1] PREEMPT SMP [ 225.777405] CPU: 0 PID: 2402 Comm: Xorg Not tainted 6.1.0-rc3-bdg+ #86 [ 225.777415] Hardware name: /8I865G775-G, BIOS F1 08/29/2006 [ 225.777421] EIP: __apply_to_page_range+0x24d/0x31c [ 225.777437] Code: ff ff 8b 55 e8 8b 45 cc e8 0a 11 ec ff 89 d8 83 c4 28 5b 5e 5f 5d c3 81 7d e0 a0 ef 96 c1 74 ad 8b 45 d0 e8 2d 83 49 00 eb a3 <0f> 0b 25 00 f0 ff ff 81 eb 00 00 00 40 01 c3 8b 45 ec 8b 00 e8 76 [ 225.777446] EAX: 00000001 EBX: c53a3b58 ECX: b5c00000 EDX: c258aa00 [ 225.777454] ESI: b5c00000 EDI: b5900000 EBP: c4b0fdb4 ESP: c4b0fd80 [ 225.777462] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00010202 [ 225.777470] CR0: 80050033 CR2: b5900000 CR3: 053a3000 CR4: 000006d0 [ 225.777479] Call Trace: [ 225.777486] ? i915_memcpy_init_early+0x63/0x63 [i915] [ 225.777684] apply_to_page_range+0x21/0x27 [ 225.777694] ? i915_memcpy_init_early+0x63/0x63 [i915] [ 225.777870] remap_io_mapping+0x49/0x75 [i915] [ 225.778046] ? i915_memcpy_init_early+0x63/0x63 [i915] [ 225.778220] ? mutex_unlock+0xb/0xd [ 225.778231] ? i915_vma_pin_fence+0x6d/0xf7 [i915] [ 225.778420] vm_fault_gtt+0x2a9/0x8f1 [i915] [ 225.778644] ? lock_is_held_type+0x56/0xe7 [ 225.778655] ? lock_is_held_type+0x7a/0xe7 [ 225.778663] ? 0xc1000000 [ 225.778670] __do_fault+0x21/0x6a [ 225.778679] handle_mm_fault+0x708/0xb21 [ 225.778686] ? mt_find+0x21e/0x5ae [ 225.778696] exc_page_fault+0x185/0x705 [ 225.778704] ? doublefault_shim+0x127/0x127 [ 225.778715] handle_exception+0x130/0x130 [ 225.778723] EIP: 0xb700468a Recently pud_huge() got aware of non-present entry by commit 3a194f3 ("mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present pud entry") to handle some special states of gigantic page. However, it's overlooked that pud_none() always returns false when running with 2-level paging, and as a result pud_huge() can return true pointlessly. Introduce "#if CONFIG_PGTABLE_LEVELS > 2" to pud_huge() to deal with this. Link: https://lkml.kernel.org/r/20221107021010.2449306-1-naoya.horiguchi@linux.dev Fixes: 3a194f3 ("mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present pud entry") Signed-off-by: Naoya Horiguchi <naoya.horiguchi@nec.com> Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Miaohe Lin <linmiaohe@huawei.com> Cc: David Hildenbrand <david@redhat.com> Cc: Liu Shixin <liushixin2@huawei.com> Cc: Mike Kravetz <mike.kravetz@oracle.com> Cc: Muchun Song <songmuchun@bytedance.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Yang Shi <shy828301@gmail.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

…ging commit 1fdbed6 upstream. The following bug is reported to be triggered when starting X on x86-32 system with i915: [ 225.777375] kernel BUG at mm/memory.c:2664! [ 225.777391] invalid opcode: 0000 [#1] PREEMPT SMP [ 225.777405] CPU: 0 PID: 2402 Comm: Xorg Not tainted 6.1.0-rc3-bdg+ #86 [ 225.777415] Hardware name: /8I865G775-G, BIOS F1 08/29/2006 [ 225.777421] EIP: __apply_to_page_range+0x24d/0x31c [ 225.777437] Code: ff ff 8b 55 e8 8b 45 cc e8 0a 11 ec ff 89 d8 83 c4 28 5b 5e 5f 5d c3 81 7d e0 a0 ef 96 c1 74 ad 8b 45 d0 e8 2d 83 49 00 eb a3 <0f> 0b 25 00 f0 ff ff 81 eb 00 00 00 40 01 c3 8b 45 ec 8b 00 e8 76 [ 225.777446] EAX: 00000001 EBX: c53a3b58 ECX: b5c00000 EDX: c258aa00 [ 225.777454] ESI: b5c00000 EDI: b5900000 EBP: c4b0fdb4 ESP: c4b0fd80 [ 225.777462] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00010202 [ 225.777470] CR0: 80050033 CR2: b5900000 CR3: 053a3000 CR4: 000006d0 [ 225.777479] Call Trace: [ 225.777486] ? i915_memcpy_init_early+0x63/0x63 [i915] [ 225.777684] apply_to_page_range+0x21/0x27 [ 225.777694] ? i915_memcpy_init_early+0x63/0x63 [i915] [ 225.777870] remap_io_mapping+0x49/0x75 [i915] [ 225.778046] ? i915_memcpy_init_early+0x63/0x63 [i915] [ 225.778220] ? mutex_unlock+0xb/0xd [ 225.778231] ? i915_vma_pin_fence+0x6d/0xf7 [i915] [ 225.778420] vm_fault_gtt+0x2a9/0x8f1 [i915] [ 225.778644] ? lock_is_held_type+0x56/0xe7 [ 225.778655] ? lock_is_held_type+0x7a/0xe7 [ 225.778663] ? 0xc1000000 [ 225.778670] __do_fault+0x21/0x6a [ 225.778679] handle_mm_fault+0x708/0xb21 [ 225.778686] ? mt_find+0x21e/0x5ae [ 225.778696] exc_page_fault+0x185/0x705 [ 225.778704] ? doublefault_shim+0x127/0x127 [ 225.778715] handle_exception+0x130/0x130 [ 225.778723] EIP: 0xb700468a Recently pud_huge() got aware of non-present entry by commit 3a194f3 ("mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present pud entry") to handle some special states of gigantic page. However, it's overlooked that pud_none() always returns false when running with 2-level paging, and as a result pud_huge() can return true pointlessly. Introduce "#if CONFIG_PGTABLE_LEVELS > 2" to pud_huge() to deal with this. Link: https://lkml.kernel.org/r/20221107021010.2449306-1-naoya.horiguchi@linux.dev Fixes: 3a194f3 ("mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present pud entry") Signed-off-by: Naoya Horiguchi <naoya.horiguchi@nec.com> Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Miaohe Lin <linmiaohe@huawei.com> Cc: David Hildenbrand <david@redhat.com> Cc: Liu Shixin <liushixin2@huawei.com> Cc: Mike Kravetz <mike.kravetz@oracle.com> Cc: Muchun Song <songmuchun@bytedance.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Yang Shi <shy828301@gmail.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The inline assembly for arm64's cmpxchg_double*() implementations use a +Q constraint to hazard against other accesses to the memory location being exchanged. However, the pointer passed to the constraint is a pointer to unsigned long, and thus the hazard only applies to the first 8 bytes of the location. GCC can take advantage of this, assuming that other portions of the location are unchanged, leading to a number of potential problems. This is similar to what we fixed back in commit: fee960b ("arm64: xchg: hazard against entire exchange variable") ... but we forgot to adjust cmpxchg_double*() similarly at the same time. The same problem applies, as demonstrated with the following test: | struct big { | u64 lo, hi; | } __aligned(128); | | unsigned long foo(struct big *b) | { | u64 hi_old, hi_new; | | hi_old = b->hi; | cmpxchg_double_local(&b->lo, &b->hi, 0x12, 0x34, 0x56, 0x78); | hi_new = b->hi; | | return hi_old ^ hi_new; | } ... which GCC 12.1.0 compiles as: | 0000000000000000 <foo>: | 0: d503233f paciasp | 4: aa0003e4 mov x4, x0 | 8: 1400000e b 40 <foo+0x40> | c: d2800240 mov x0, #0x12 // #18 | 10: d2800681 mov x1, #0x34 // #52 | 14: aa0003e5 mov x5, x0 | 18: aa0103e6 mov x6, x1 | 1c: d2800ac2 mov x2, #0x56 // #86 | 20: d2800f03 mov x3, #0x78 // #120 | 24: 48207c82 casp x0, x1, x2, x3, [x4] | 28: ca050000 eor x0, x0, x5 | 2c: ca060021 eor x1, x1, x6 | 30: aa010000 orr x0, x0, x1 | 34: d2800000 mov x0, #0x0 // #0 <--- BANG | 38: d50323bf autiasp | 3c: d65f03c0 ret | 40: d2800240 mov x0, #0x12 // #18 | 44: d2800681 mov x1, #0x34 // #52 | 48: d2800ac2 mov x2, #0x56 // #86 | 4c: d2800f03 mov x3, #0x78 // #120 | 50: f9800091 prfm pstl1strm, [x4] | 54: c87f1885 ldxp x5, x6, [x4] | 58: ca0000a5 eor x5, x5, x0 | 5c: ca0100c6 eor x6, x6, x1 | 60: aa0600a6 orr x6, x5, x6 | 64: b5000066 cbnz x6, 70 <foo+0x70> | 68: c8250c82 stxp w5, x2, x3, [x4] | 6c: 35ffff45 cbnz w5, 54 <foo+0x54> | 70: d2800000 mov x0, #0x0 // #0 <--- BANG | 74: d50323bf autiasp | 78: d65f03c0 ret Notice that at the lines with "BANG" comments, GCC has assumed that the higher 8 bytes are unchanged by the cmpxchg_double() call, and that `hi_old ^ hi_new` can be reduced to a constant zero, for both LSE and LL/SC versions of cmpxchg_double(). This patch fixes the issue by passing a pointer to __uint128_t into the +Q constraint, ensuring that the compiler hazards against the entire 16 bytes being modified. With this change, GCC 12.1.0 compiles the above test as: | 0000000000000000 <foo>: | 0: f9400407 ldr x7, [x0, #8] | 4: d503233f paciasp | 8: aa0003e4 mov x4, x0 | c: 1400000f b 48 <foo+0x48> | 10: d2800240 mov x0, #0x12 // #18 | 14: d2800681 mov x1, #0x34 // #52 | 18: aa0003e5 mov x5, x0 | 1c: aa0103e6 mov x6, x1 | 20: d2800ac2 mov x2, #0x56 // #86 | 24: d2800f03 mov x3, #0x78 // #120 | 28: 48207c82 casp x0, x1, x2, x3, [x4] | 2c: ca050000 eor x0, x0, x5 | 30: ca060021 eor x1, x1, x6 | 34: aa010000 orr x0, x0, x1 | 38: f9400480 ldr x0, [x4, #8] | 3c: d50323bf autiasp | 40: ca0000e0 eor x0, x7, x0 | 44: d65f03c0 ret | 48: d2800240 mov x0, #0x12 // #18 | 4c: d2800681 mov x1, #0x34 // #52 | 50: d2800ac2 mov x2, #0x56 // #86 | 54: d2800f03 mov x3, #0x78 // #120 | 58: f9800091 prfm pstl1strm, [x4] | 5c: c87f1885 ldxp x5, x6, [x4] | 60: ca0000a5 eor x5, x5, x0 | 64: ca0100c6 eor x6, x6, x1 | 68: aa0600a6 orr x6, x5, x6 | 6c: b5000066 cbnz x6, 78 <foo+0x78> | 70: c8250c82 stxp w5, x2, x3, [x4] | 74: 35ffff45 cbnz w5, 5c <foo+0x5c> | 78: f9400480 ldr x0, [x4, #8] | 7c: d50323bf autiasp | 80: ca0000e0 eor x0, x7, x0 | 84: d65f03c0 ret ... sampling the high 8 bytes before and after the cmpxchg, and performing an EOR, as we'd expect. For backporting, I've tested this atop linux-4.9.y with GCC 5.5.0. Note that linux-4.9.y is oldest currently supported stable release, and mandates GCC 5.1+. Unfortunately I couldn't get a GCC 5.1 binary to run on my machines due to library incompatibilities. I've also used a standalone test to check that we can use a __uint128_t pointer in a +Q constraint at least as far back as GCC 4.8.5 and LLVM 3.9.1. Fixes: 5284e1b ("arm64: xchg: Implement cmpxchg_double") Fixes: e9a4b79 ("arm64: cmpxchg_dbl: patch in lse instructions when supported by the CPU") Reported-by: Boqun Feng <boqun.feng@gmail.com> Link: https://lore.kernel.org/lkml/Y6DEfQXymYVgL3oJ@boqun-archlinux/ Reported-by: Peter Zijlstra <peterz@infradead.org> Link: https://lore.kernel.org/lkml/Y6GXoO4qmH9OIZ5Q@hirez.programming.kicks-ass.net/ Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: stable@vger.kernel.org Cc: Arnd Bergmann <arnd@arndb.de> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Steve Capper <steve.capper@arm.com> Cc: Will Deacon <will@kernel.org> Link: https://lore.kernel.org/r/20230104151626.3262137-1-mark.rutland@arm.com Signed-off-by: Will Deacon <will@kernel.org>

commit 031af50 upstream. The inline assembly for arm64's cmpxchg_double*() implementations use a +Q constraint to hazard against other accesses to the memory location being exchanged. However, the pointer passed to the constraint is a pointer to unsigned long, and thus the hazard only applies to the first 8 bytes of the location. GCC can take advantage of this, assuming that other portions of the location are unchanged, leading to a number of potential problems. This is similar to what we fixed back in commit: fee960b ("arm64: xchg: hazard against entire exchange variable") ... but we forgot to adjust cmpxchg_double*() similarly at the same time. The same problem applies, as demonstrated with the following test: | struct big { | u64 lo, hi; | } __aligned(128); | | unsigned long foo(struct big *b) | { | u64 hi_old, hi_new; | | hi_old = b->hi; | cmpxchg_double_local(&b->lo, &b->hi, 0x12, 0x34, 0x56, 0x78); | hi_new = b->hi; | | return hi_old ^ hi_new; | } ... which GCC 12.1.0 compiles as: | 0000000000000000 <foo>: | 0: d503233f paciasp | 4: aa0003e4 mov x4, x0 | 8: 1400000e b 40 <foo+0x40> | c: d2800240 mov x0, #0x12 // #18 | 10: d2800681 mov x1, #0x34 // #52 | 14: aa0003e5 mov x5, x0 | 18: aa0103e6 mov x6, x1 | 1c: d2800ac2 mov x2, #0x56 // #86 | 20: d2800f03 mov x3, #0x78 // #120 | 24: 48207c82 casp x0, x1, x2, x3, [x4] | 28: ca050000 eor x0, x0, x5 | 2c: ca060021 eor x1, x1, x6 | 30: aa010000 orr x0, x0, x1 | 34: d2800000 mov x0, #0x0 // #0 <--- BANG | 38: d50323bf autiasp | 3c: d65f03c0 ret | 40: d2800240 mov x0, #0x12 // #18 | 44: d2800681 mov x1, #0x34 // #52 | 48: d2800ac2 mov x2, #0x56 // #86 | 4c: d2800f03 mov x3, #0x78 // #120 | 50: f9800091 prfm pstl1strm, [x4] | 54: c87f1885 ldxp x5, x6, [x4] | 58: ca0000a5 eor x5, x5, x0 | 5c: ca0100c6 eor x6, x6, x1 | 60: aa0600a6 orr x6, x5, x6 | 64: b5000066 cbnz x6, 70 <foo+0x70> | 68: c8250c82 stxp w5, x2, x3, [x4] | 6c: 35ffff45 cbnz w5, 54 <foo+0x54> | 70: d2800000 mov x0, #0x0 // #0 <--- BANG | 74: d50323bf autiasp | 78: d65f03c0 ret Notice that at the lines with "BANG" comments, GCC has assumed that the higher 8 bytes are unchanged by the cmpxchg_double() call, and that `hi_old ^ hi_new` can be reduced to a constant zero, for both LSE and LL/SC versions of cmpxchg_double(). This patch fixes the issue by passing a pointer to __uint128_t into the +Q constraint, ensuring that the compiler hazards against the entire 16 bytes being modified. With this change, GCC 12.1.0 compiles the above test as: | 0000000000000000 <foo>: | 0: f9400407 ldr x7, [x0, #8] | 4: d503233f paciasp | 8: aa0003e4 mov x4, x0 | c: 1400000f b 48 <foo+0x48> | 10: d2800240 mov x0, #0x12 // #18 | 14: d2800681 mov x1, #0x34 // #52 | 18: aa0003e5 mov x5, x0 | 1c: aa0103e6 mov x6, x1 | 20: d2800ac2 mov x2, #0x56 // #86 | 24: d2800f03 mov x3, #0x78 // #120 | 28: 48207c82 casp x0, x1, x2, x3, [x4] | 2c: ca050000 eor x0, x0, x5 | 30: ca060021 eor x1, x1, x6 | 34: aa010000 orr x0, x0, x1 | 38: f9400480 ldr x0, [x4, #8] | 3c: d50323bf autiasp | 40: ca0000e0 eor x0, x7, x0 | 44: d65f03c0 ret | 48: d2800240 mov x0, #0x12 // #18 | 4c: d2800681 mov x1, #0x34 // #52 | 50: d2800ac2 mov x2, #0x56 // #86 | 54: d2800f03 mov x3, #0x78 // #120 | 58: f9800091 prfm pstl1strm, [x4] | 5c: c87f1885 ldxp x5, x6, [x4] | 60: ca0000a5 eor x5, x5, x0 | 64: ca0100c6 eor x6, x6, x1 | 68: aa0600a6 orr x6, x5, x6 | 6c: b5000066 cbnz x6, 78 <foo+0x78> | 70: c8250c82 stxp w5, x2, x3, [x4] | 74: 35ffff45 cbnz w5, 5c <foo+0x5c> | 78: f9400480 ldr x0, [x4, #8] | 7c: d50323bf autiasp | 80: ca0000e0 eor x0, x7, x0 | 84: d65f03c0 ret ... sampling the high 8 bytes before and after the cmpxchg, and performing an EOR, as we'd expect. For backporting, I've tested this atop linux-4.9.y with GCC 5.5.0. Note that linux-4.9.y is oldest currently supported stable release, and mandates GCC 5.1+. Unfortunately I couldn't get a GCC 5.1 binary to run on my machines due to library incompatibilities. I've also used a standalone test to check that we can use a __uint128_t pointer in a +Q constraint at least as far back as GCC 4.8.5 and LLVM 3.9.1. Fixes: 5284e1b ("arm64: xchg: Implement cmpxchg_double") Fixes: e9a4b79 ("arm64: cmpxchg_dbl: patch in lse instructions when supported by the CPU") Reported-by: Boqun Feng <boqun.feng@gmail.com> Link: https://lore.kernel.org/lkml/Y6DEfQXymYVgL3oJ@boqun-archlinux/ Reported-by: Peter Zijlstra <peterz@infradead.org> Link: https://lore.kernel.org/lkml/Y6GXoO4qmH9OIZ5Q@hirez.programming.kicks-ass.net/ Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: stable@vger.kernel.org Cc: Arnd Bergmann <arnd@arndb.de> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Steve Capper <steve.capper@arm.com> Cc: Will Deacon <will@kernel.org> Link: https://lore.kernel.org/r/20230104151626.3262137-1-mark.rutland@arm.com Signed-off-by: Will Deacon <will@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

@2

[ Upstream commit 8ecf3c1 ] Recent additions in BPF like cpu v4 instructions, test_bpf module exhibits the following failures: test_bpf: #82 ALU_MOVSX | BPF_B jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times) test_bpf: #83 ALU_MOVSX | BPF_H jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times) test_bpf: #84 ALU64_MOVSX | BPF_B jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times) test_bpf: #85 ALU64_MOVSX | BPF_H jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times) test_bpf: #86 ALU64_MOVSX | BPF_W jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times) test_bpf: #165 ALU_SDIV_X: -6 / 2 = -3 jited:1 ret 2147483645 != -3 (0x7ffffffd != 0xfffffffd)FAIL (1 times) test_bpf: #166 ALU_SDIV_K: -6 / 2 = -3 jited:1 ret 2147483645 != -3 (0x7ffffffd != 0xfffffffd)FAIL (1 times) test_bpf: #169 ALU_SMOD_X: -7 % 2 = -1 jited:1 ret 1 != -1 (0x1 != 0xffffffff)FAIL (1 times) test_bpf: #170 ALU_SMOD_K: -7 % 2 = -1 jited:1 ret 1 != -1 (0x1 != 0xffffffff)FAIL (1 times) test_bpf: #172 ALU64_SMOD_K: -7 % 2 = -1 jited:1 ret 1 != -1 (0x1 != 0xffffffff)FAIL (1 times) test_bpf: #313 BSWAP 16: 0x0123456789abcdef -> 0xefcd eBPF filter opcode 00d7 (@2) unsupported jited:0 301 PASS test_bpf: #314 BSWAP 32: 0x0123456789abcdef -> 0xefcdab89 eBPF filter opcode 00d7 (@2) unsupported jited:0 555 PASS test_bpf: #315 BSWAP 64: 0x0123456789abcdef -> 0x67452301 eBPF filter opcode 00d7 (@2) unsupported jited:0 268 PASS test_bpf: #316 BSWAP 64: 0x0123456789abcdef >> 32 -> 0xefcdab89 eBPF filter opcode 00d7 (@2) unsupported jited:0 269 PASS test_bpf: #317 BSWAP 16: 0xfedcba9876543210 -> 0x1032 eBPF filter opcode 00d7 (@2) unsupported jited:0 460 PASS test_bpf: #318 BSWAP 32: 0xfedcba9876543210 -> 0x10325476 eBPF filter opcode 00d7 (@2) unsupported jited:0 320 PASS test_bpf: #319 BSWAP 64: 0xfedcba9876543210 -> 0x98badcfe eBPF filter opcode 00d7 (@2) unsupported jited:0 222 PASS test_bpf: #320 BSWAP 64: 0xfedcba9876543210 >> 32 -> 0x10325476 eBPF filter opcode 00d7 (@2) unsupported jited:0 273 PASS test_bpf: #344 BPF_LDX_MEMSX | BPF_B eBPF filter opcode 0091 (@5) unsupported jited:0 432 PASS test_bpf: #345 BPF_LDX_MEMSX | BPF_H eBPF filter opcode 0089 (@5) unsupported jited:0 381 PASS test_bpf: #346 BPF_LDX_MEMSX | BPF_W eBPF filter opcode 0081 (@5) unsupported jited:0 505 PASS test_bpf: #490 JMP32_JA: Unconditional jump: if (true) return 1 eBPF filter opcode 0006 (@1) unsupported jited:0 261 PASS test_bpf: Summary: 1040 PASSED, 10 FAILED, [924/1038 JIT'ed] Fix them by adding missing processing. Fixes: daabb2b ("bpf/tests: add tests for cpuv4 instructions") Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://msgid.link/91de862dda99d170697eb79ffb478678af7e0b27.1709652689.git.christophe.leroy@csgroup.eu Signed-off-by: Sasha Levin <sashal@kernel.org>

djrscally added 10 commits March 6, 2021 21:19

platform: x86: Remove v2 of intel-skl-int3472 module

575dd04

In preparation for loading the v3 code, remove the v2. Signed-off-by: Daniel Scally <djrscally@gmail.com>

media: i2c: Remove old version of ov5693 driver

bdef1e3

Remove the old version of the ov5693 driver, in preparation for merging in the newer one. Signed-off-by: Daniel Scally <djrscally@gmail.com>

Revert "gpio: gpiolib-acpi: Export acpi_get_gpiod()"

2534b2c

This reverts commit 8a14e90.

Revert "mfd: Remove tps68470 MFD driver"

87c2e5b

This reverts commit cd72ad7.

Revert "i2c: i2c-core-acpi: Add i2c_acpi_dev_name()"

3a999bc

This reverts commit 40e472f.

Revert "i2c: i2c-core-base: Use format macro in i2c_dev_set_name()"

a4a5b5f

This reverts commit 0502b78.

Revert "acpi: utils: Add function to fetch dependent acpi_devices"

ba7ef8a

This reverts commit da9d6f9.

Revert "acpi: utils: move acpi_lpss_dep() to utils"

48960fc

This reverts commit 5ecff4b.

qzed reviewed Mar 7, 2021

View reviewed changes

djrscally added 4 commits March 7, 2021 22:51

platform: x86: Add v3 of intel-skl-int3472 module

8f70298

Not much in the way of functional change; primarily that the indicator LED is no longer driven by the camera driver and instead is activated along with the clk. Signed-off-by: Daniel Scally <djrscally@gmail.com>

djrscally force-pushed the camera-updates branch from e701190 to 7bde9d9 Compare March 7, 2021 23:04

qzed reviewed Mar 8, 2021

View reviewed changes

qzed closed this May 5, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update ov5693 and intel-skl-int3472 drivers #86

Update ov5693 and intel-skl-int3472 drivers #86

djrscally commented Mar 7, 2021 •

edited

Loading

qzed left a comment

djrscally commented Mar 7, 2021

qzed commented Mar 7, 2021 •

edited

Loading

djrscally commented Mar 7, 2021

qzed commented Mar 7, 2021

qzed Mar 8, 2021 •

edited

Loading

djrscally Mar 8, 2021

qzed Mar 8, 2021

djrscally Mar 8, 2021

qzed Mar 8, 2021

fabwu commented Mar 8, 2021

djrscally commented Mar 8, 2021

qzed commented Mar 8, 2021

djrscally commented Mar 8, 2021

fabwu commented Mar 9, 2021

qzed commented May 5, 2021

djrscally commented May 5, 2021

qzed commented May 5, 2021

fabwu commented May 6, 2021

djrscally commented May 6, 2021 •

edited

Loading

Update ov5693 and intel-skl-int3472 drivers #86

Update ov5693 and intel-skl-int3472 drivers #86

Conversation

djrscally commented Mar 7, 2021 • edited Loading

qzed left a comment

Choose a reason for hiding this comment

djrscally commented Mar 7, 2021

qzed commented Mar 7, 2021 • edited Loading

djrscally commented Mar 7, 2021

qzed commented Mar 7, 2021

qzed Mar 8, 2021 • edited Loading

Choose a reason for hiding this comment

djrscally Mar 8, 2021

Choose a reason for hiding this comment

qzed Mar 8, 2021

Choose a reason for hiding this comment

djrscally Mar 8, 2021

Choose a reason for hiding this comment

qzed Mar 8, 2021

Choose a reason for hiding this comment

fabwu commented Mar 8, 2021

djrscally commented Mar 8, 2021

qzed commented Mar 8, 2021

djrscally commented Mar 8, 2021

fabwu commented Mar 9, 2021

qzed commented May 5, 2021

djrscally commented May 5, 2021

qzed commented May 5, 2021

fabwu commented May 6, 2021

djrscally commented May 6, 2021 • edited Loading

djrscally commented Mar 7, 2021 •

edited

Loading

qzed commented Mar 7, 2021 •

edited

Loading

qzed Mar 8, 2021 •

edited

Loading

djrscally commented May 6, 2021 •

edited

Loading