1. 10 Oct, 2023 2 commits
  2. 09 Oct, 2023 2 commits
    • Zack Rusin's avatar
      drm/vmwgfx: Keep a gem reference to user bos in surfaces · 91398b41
      Zack Rusin authored
      Surfaces can be backed (i.e. stored in) memory objects (mob's) which
      are created and managed by the userspace as GEM buffers. Surfaces
      grab only a ttm reference which means that the gem object can
      be deleted underneath us, especially in cases where prime buffer
      export is used.
      
      Make sure that all userspace surfaces which are backed by gem objects
      hold a gem reference to make sure they're not deleted before vmw
      surfaces are done with them, which fixes:
      ------------[ cut here ]------------
      refcount_t: underflow; use-after-free.
      WARNING: CPU: 2 PID: 2632 at lib/refcount.c:28 refcount_warn_saturate+0xfb/0x150
      Modules linked in: overlay vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock snd_ens1371 snd_ac97_codec ac97_bus snd_pcm gameport>
      CPU: 2 PID: 2632 Comm: vmw_ref_count Not tainted 6.5.0-rc2-vmwgfx #1
      Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
      RIP: 0010:refcount_warn_saturate+0xfb/0x150
      Code: eb 9e 0f b6 1d 8b 5b a6 01 80 fb 01 0f 87 ba e4 80 00 83 e3 01 75 89 48 c7 c7 c0 3c f9 a3 c6 05 6f 5b a6 01 01 e8 15 81 98 ff <0f> 0b e9 6f ff ff ff 0f b>
      RSP: 0018:ffffbdc34344bba0 EFLAGS: 00010286
      RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000027
      RDX: ffff960475ea1548 RSI: 0000000000000001 RDI: ffff960475ea1540
      RBP: ffffbdc34344bba8 R08: 0000000000000003 R09: 65646e75203a745f
      R10: ffffffffa5b32b20 R11: 72657466612d6573 R12: ffff96037d6a6400
      R13: ffff9603484805b0 R14: 000000000000000b R15: ffff9603bed06060
      FS:  00007f5fd8520c40(0000) GS:ffff960475e80000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007f5fda755000 CR3: 000000010d012005 CR4: 00000000003706e0
      Call Trace:
       <TASK>
       ? show_regs+0x6e/0x80
       ? refcount_warn_saturate+0xfb/0x150
       ? __warn+0x91/0x150
       ? refcount_warn_saturate+0xfb/0x150
       ? report_bug+0x19d/0x1b0
       ? handle_bug+0x46/0x80
       ? exc_invalid_op+0x1d/0x80
       ? asm_exc_invalid_op+0x1f/0x30
       ? refcount_warn_saturate+0xfb/0x150
       drm_gem_object_handle_put_unlocked+0xba/0x110 [drm]
       drm_gem_object_release_handle+0x6e/0x80 [drm]
       drm_gem_handle_delete+0x6a/0xc0 [drm]
       ? __pfx_vmw_bo_unref_ioctl+0x10/0x10 [vmwgfx]
       vmw_bo_unref_ioctl+0x33/0x40 [vmwgfx]
       drm_ioctl_kernel+0xbc/0x160 [drm]
       drm_ioctl+0x2d2/0x580 [drm]
       ? __pfx_vmw_bo_unref_ioctl+0x10/0x10 [vmwgfx]
       ? do_vmi_munmap+0xee/0x180
       vmw_generic_ioctl+0xbd/0x180 [vmwgfx]
       vmw_unlocked_ioctl+0x19/0x20 [vmwgfx]
       __x64_sys_ioctl+0x99/0xd0
       do_syscall_64+0x5d/0x90
       ? syscall_exit_to_user_mode+0x2a/0x50
       ? do_syscall_64+0x6d/0x90
       ? handle_mm_fault+0x16e/0x2f0
       ? exit_to_user_mode_prepare+0x34/0x170
       ? irqentry_exit_to_user_mode+0xd/0x20
       ? irqentry_exit+0x3f/0x50
       ? exc_page_fault+0x8e/0x190
       entry_SYSCALL_64_after_hwframe+0x6e/0xd8
      RIP: 0033:0x7f5fda51aaff
      Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 7>
      RSP: 002b:00007ffd536a4d30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      RAX: ffffffffffffffda RBX: 00007ffd536a4de0 RCX: 00007f5fda51aaff
      RDX: 00007ffd536a4de0 RSI: 0000000040086442 RDI: 0000000000000003
      RBP: 0000000040086442 R08: 000055fa603ada50 R09: 0000000000000000
      R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffd536a51b8
      R13: 0000000000000003 R14: 000055fa5ebb4c80 R15: 00007f5fda90f040
       </TASK>
      ---[ end trace 0000000000000000 ]---
      
      A lot of the analyis on the bug was done by Murray McAllister and
      Ian Forbes.
      Reported-by: default avatarMurray McAllister <murray.mcallister@gmail.com>
      Cc: Ian Forbes <iforbes@vmware.com>
      Signed-off-by: default avatarZack Rusin <zackr@vmware.com>
      Fixes: a950b989 ("drm/vmwgfx: Do not drop the reference to the handle too soon")
      Cc: <stable@vger.kernel.org> # v6.2+
      Reviewed-by: default avatarMartin Krastev <krastevm@vmware.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20230928041355.737635-1-zack@kde.org
      91398b41
    • Konstantin Meskhidze's avatar
      drm/vmwgfx: fix typo of sizeof argument · 39465cac
      Konstantin Meskhidze authored
      Since size of 'header' pointer and '*header' structure is equal on 64-bit
      machines issue probably didn't cause any wrong behavior. But anyway,
      fixing typo is required.
      
      Fixes: 7a73ba74 ("drm/vmwgfx: Use TTM handles instead of SIDs as user-space surface handles.")
      Co-developed-by: default avatarIvanov Mikhail <ivanov.mikhail1@huawei-partners.com>
      Signed-off-by: default avatarKonstantin Meskhidze <konstantin.meskhidze@huawei.com>
      Reviewed-by: default avatarZack Rusin <zackr@vmware.com>
      Signed-off-by: default avatarZack Rusin <zackr@vmware.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20230905100203.1716731-1-konstantin.meskhidze@huawei.com
      39465cac
  3. 05 Oct, 2023 1 commit
  4. 03 Oct, 2023 4 commits
  5. 30 Sep, 2023 1 commit
  6. 27 Sep, 2023 6 commits
  7. 25 Sep, 2023 1 commit
  8. 21 Sep, 2023 1 commit
    • Thomas Zimmermann's avatar
      fbdev/sh7760fb: Depend on FB=y · f75f71b2
      Thomas Zimmermann authored
      Fix linker error if FB=m about missing fb_io_read and fb_io_write. The
      linker's error message suggests that this config setting has already
      been broken for other symbols.
      
        All errors (new ones prefixed by >>):
      
           sh4-linux-ld: drivers/video/fbdev/sh7760fb.o: in function `sh7760fb_probe':
           sh7760fb.c:(.text+0x374): undefined reference to `framebuffer_alloc'
           sh4-linux-ld: sh7760fb.c:(.text+0x394): undefined reference to `fb_videomode_to_var'
           sh4-linux-ld: sh7760fb.c:(.text+0x39c): undefined reference to `fb_alloc_cmap'
           sh4-linux-ld: sh7760fb.c:(.text+0x3a4): undefined reference to `register_framebuffer'
           sh4-linux-ld: sh7760fb.c:(.text+0x3ac): undefined reference to `fb_dealloc_cmap'
           sh4-linux-ld: sh7760fb.c:(.text+0x434): undefined reference to `framebuffer_release'
           sh4-linux-ld: drivers/video/fbdev/sh7760fb.o: in function `sh7760fb_remove':
           sh7760fb.c:(.text+0x800): undefined reference to `unregister_framebuffer'
           sh4-linux-ld: sh7760fb.c:(.text+0x804): undefined reference to `fb_dealloc_cmap'
           sh4-linux-ld: sh7760fb.c:(.text+0x814): undefined reference to `framebuffer_release'
        >> sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0xc): undefined reference to `fb_io_read'
        >> sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x10): undefined reference to `fb_io_write'
           sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x2c): undefined reference to `cfb_fillrect'
           sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x30): undefined reference to `cfb_copyarea'
           sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x34): undefined reference to `cfb_imageblit'
      Suggested-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Closes: https://lore.kernel.org/oe-kbuild-all/202309130632.LS04CPWu-lkp@intel.com/Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Reviewed-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
      Acked-by: default avatarJohn Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
      Link: https://patchwork.freedesktop.org/patch/msgid/20230918090400.13264-1-tzimmermann@suse.de
      f75f71b2
  9. 20 Sep, 2023 3 commits
  10. 19 Sep, 2023 4 commits
  11. 18 Sep, 2023 1 commit
    • Arnd Bergmann's avatar
      drm: fix up fbdev Kconfig defaults · bb6c4507
      Arnd Bergmann authored
      As a result of the recent Kconfig reworks, the default settings for the
      framebuffer interfaces changed in unexpected ways:
      
      Configurations that leave CONFIG_FB disabled but use DRM now get
      DRM_FBDEV_EMULATION by default. This also turns on the deprecated /dev/fb
      device nodes for machines that don't actually want it.
      
      In turn, configurations that previously had DRM_FBDEV_EMULATION enabled
      now only get the /dev/fb front-end but not the more useful framebuffer
      console, which is not selected any more.
      
      We had previously decided that any combination of the three frontends
      (FB_DEVICE, FRAMEBUFFER_CONSOLE and LOGO) should be selectable, but the
      new default settings mean that a lot of defconfig files would have to
      get adapted.
      
      Change the defaults back to what they were in Linux 6.5:
      
       - Leave DRM_FBDEV_EMULATION turned off unless CONFIG_FB
         is enabled. Previously this was a hard dependency but now the two are
         independent. However, configurations that enable CONFIG_FB probably
         also want to keep the emulation for DRM, while those without FB
         presumably did that intentionally in the past.
      
       - Leave FB_DEVICE turned off for FB=n. Following the same
         logic, the deprecated option should not automatically get enabled
         here, most users that had FB turned off in the past do not want it,
         even if they want the console
      
       - Turn the FRAMEBUFFER_CONSOLE option on if
         DRM_FBDEV_EMULATION is set to avoid having to change defconfig
         files that relied on it being selected unconditionally in the past.
         This also makes sense since both LOGO and FB_DEVICE are now disabled
         by default for builds without CONFIG_FB, but DRM_FBDEV_EMULATION
         would make no sense if all three are disabled.
      
      Fixes: a5ae331e ("drm: Drop select FRAMEBUFFER_CONSOLE for DRM_FBDEV_EMULATION")
      Fixes: 701d2054 ("fbdev: Make support for userspace interfaces configurable")
      Reported-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Reviewed-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
      Reviewed-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Acked-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Signed-off-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20230911205338.2385278-1-arnd@kernel.org
      bb6c4507
  12. 15 Sep, 2023 1 commit
  13. 14 Sep, 2023 2 commits
    • Thomas Hellström's avatar
      drm/tests: helpers: Avoid a driver uaf · 139a2785
      Thomas Hellström authored
      when using __drm_kunit_helper_alloc_drm_device() the driver may be
      dereferenced by device-managed resources up until the device is
      freed, which is typically later than the kunit-managed resource code
      frees it. Fix this by simply make the driver device-managed as well.
      
      In short, the sequence leading to the UAF is as follows:
      
      INIT:
      Code allocates a struct device as a kunit-managed resource.
      Code allocates a drm driver as a kunit-managed resource.
      Code allocates a drm device as a device-managed resource.
      
      EXIT:
      Kunit resource cleanup frees the drm driver
      Kunit resource cleanup puts the struct device, which starts a
            device-managed resource cleanup
      device-managed cleanup calls drm_dev_put()
      drm_dev_put() dereferences the (now freed) drm driver -> Boom.
      
      Related KASAN message:
      [55272.551542] ==================================================================
      [55272.551551] BUG: KASAN: slab-use-after-free in drm_dev_put.part.0+0xd4/0xe0 [drm]
      [55272.551603] Read of size 8 at addr ffff888127502828 by task kunit_try_catch/10353
      
      [55272.551612] CPU: 4 PID: 10353 Comm: kunit_try_catch Tainted: G     U           N 6.5.0-rc7+ #155
      [55272.551620] Hardware name: ASUS System Product Name/PRIME B560M-A AC, BIOS 0403 01/26/2021
      [55272.551626] Call Trace:
      [55272.551629]  <TASK>
      [55272.551633]  dump_stack_lvl+0x57/0x90
      [55272.551639]  print_report+0xcf/0x630
      [55272.551645]  ? _raw_spin_lock_irqsave+0x5f/0x70
      [55272.551652]  ? drm_dev_put.part.0+0xd4/0xe0 [drm]
      [55272.551694]  kasan_report+0xd7/0x110
      [55272.551699]  ? drm_dev_put.part.0+0xd4/0xe0 [drm]
      [55272.551742]  drm_dev_put.part.0+0xd4/0xe0 [drm]
      [55272.551783]  devres_release_all+0x15d/0x1f0
      [55272.551790]  ? __pfx_devres_release_all+0x10/0x10
      [55272.551797]  device_unbind_cleanup+0x16/0x1a0
      [55272.551802]  device_release_driver_internal+0x3e5/0x540
      [55272.551808]  ? kobject_put+0x5d/0x4b0
      [55272.551814]  bus_remove_device+0x1f1/0x3f0
      [55272.551819]  device_del+0x342/0x910
      [55272.551826]  ? __pfx_device_del+0x10/0x10
      [55272.551830]  ? lock_release+0x339/0x5e0
      [55272.551836]  ? kunit_remove_resource+0x128/0x290 [kunit]
      [55272.551845]  ? __pfx_lock_release+0x10/0x10
      [55272.551851]  platform_device_del.part.0+0x1f/0x1e0
      [55272.551856]  ? _raw_spin_unlock_irqrestore+0x30/0x60
      [55272.551863]  kunit_remove_resource+0x195/0x290 [kunit]
      [55272.551871]  ? _raw_spin_unlock_irqrestore+0x30/0x60
      [55272.551877]  kunit_cleanup+0x78/0x120 [kunit]
      [55272.551885]  ? __kthread_parkme+0xc1/0x1f0
      [55272.551891]  ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [kunit]
      [55272.551900]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [kunit]
      [55272.551909]  kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit]
      [55272.551919]  kthread+0x2e7/0x3c0
      [55272.551924]  ? __pfx_kthread+0x10/0x10
      [55272.551929]  ret_from_fork+0x2d/0x70
      [55272.551935]  ? __pfx_kthread+0x10/0x10
      [55272.551940]  ret_from_fork_asm+0x1b/0x30
      [55272.551948]  </TASK>
      
      [55272.551953] Allocated by task 10351:
      [55272.551956]  kasan_save_stack+0x1c/0x40
      [55272.551962]  kasan_set_track+0x21/0x30
      [55272.551966]  __kasan_kmalloc+0x8b/0x90
      [55272.551970]  __kmalloc+0x5e/0x160
      [55272.551976]  kunit_kmalloc_array+0x1c/0x50 [kunit]
      [55272.551984]  drm_exec_test_init+0xfa/0x2c0 [drm_exec_test]
      [55272.551991]  kunit_try_run_case+0xdd/0x250 [kunit]
      [55272.551999]  kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit]
      [55272.552008]  kthread+0x2e7/0x3c0
      [55272.552012]  ret_from_fork+0x2d/0x70
      [55272.552017]  ret_from_fork_asm+0x1b/0x30
      
      [55272.552024] Freed by task 10353:
      [55272.552027]  kasan_save_stack+0x1c/0x40
      [55272.552032]  kasan_set_track+0x21/0x30
      [55272.552036]  kasan_save_free_info+0x27/0x40
      [55272.552041]  __kasan_slab_free+0x106/0x180
      [55272.552046]  slab_free_freelist_hook+0xb3/0x160
      [55272.552051]  __kmem_cache_free+0xb2/0x290
      [55272.552056]  kunit_remove_resource+0x195/0x290 [kunit]
      [55272.552064]  kunit_cleanup+0x78/0x120 [kunit]
      [55272.552072]  kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit]
      [55272.552080]  kthread+0x2e7/0x3c0
      [55272.552085]  ret_from_fork+0x2d/0x70
      [55272.552089]  ret_from_fork_asm+0x1b/0x30
      
      [55272.552096] The buggy address belongs to the object at ffff888127502800
                      which belongs to the cache kmalloc-512 of size 512
      [55272.552105] The buggy address is located 40 bytes inside of
                      freed 512-byte region [ffff888127502800, ffff888127502a00)
      
      [55272.552115] The buggy address belongs to the physical page:
      [55272.552119] page:00000000af6c70ff refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x127500
      [55272.552127] head:00000000af6c70ff order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
      [55272.552133] anon flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
      [55272.552141] page_type: 0xffffffff()
      [55272.552145] raw: 0017ffffc0010200 ffff888100042c80 0000000000000000 dead000000000001
      [55272.552152] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
      [55272.552157] page dumped because: kasan: bad access detected
      
      [55272.552163] Memory state around the buggy address:
      [55272.552167]  ffff888127502700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [55272.552173]  ffff888127502780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [55272.552178] >ffff888127502800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [55272.552184]                                   ^
      [55272.552187]  ffff888127502880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [55272.552193]  ffff888127502900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [55272.552198] ==================================================================
      [55272.552203] Disabling lock debugging due to kernel taint
      
      v2:
      - Update commit message, add Fixes: tag and Cc stable.
      v3:
      - Further commit message updates (Maxime Ripard).
      
      Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Cc: Maxime Ripard <mripard@kernel.org>
      Cc: Thomas Zimmermann <tzimmermann@suse.de>
      Cc: David Airlie <airlied@gmail.com>
      Cc: Daniel Vetter <daniel@ffwll.ch>
      Cc: dri-devel@lists.freedesktop.org
      Cc: stable@vger.kernel.org # v6.3+
      Fixes: d9878031 ("drm/tests: helpers: Allow to pass a custom drm_driver")
      Signed-off-by: default avatarThomas Hellström <thomas.hellstrom@linux.intel.com>
      Reviewed-by: default avatarFrancois Dugast <francois.dugast@intel.com>
      Acked-by: default avatarMaxime Ripard <mripard@kernel.org>
      Link: https://lore.kernel.org/r/20230907135339.7971-2-thomas.hellstrom@linux.intel.comSigned-off-by: default avatarMaxime Ripard <mripard@kernel.org>
      139a2785
    • Maíra Canal's avatar
      Revert "drm/vkms: Fix race-condition between the hrtimer and the atomic commit" · 7908632f
      Maíra Canal authored
      This reverts commit a0e6a017.
      
      Unlocking a mutex in the context of a hrtimer callback is violating mutex
      locking rules, as mutex_unlock() from interrupt context is not permitted.
      
      Link: https://lore.kernel.org/dri-devel/ZQLAc%2FFwkv%2FGiVoK@phenom.ffwll.local/T/#tAcked-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: default avatarMaíra Canal <mcanal@igalia.com>
      Signed-off-by: default avatarMaíra Canal <mairacanal@riseup.net>
      Link: https://patchwork.freedesktop.org/patch/msgid/20230914102024.1789154-1-mcanal@igalia.com
      7908632f
  14. 12 Sep, 2023 1 commit
  15. 11 Sep, 2023 1 commit
  16. 10 Sep, 2023 6 commits
    • Linus Torvalds's avatar
      Linux 6.6-rc1 · 0bb80ecc
      Linus Torvalds authored
      0bb80ecc
    • Linus Torvalds's avatar
      Merge tag 'topic/drm-ci-2023-08-31-1' of git://anongit.freedesktop.org/drm/drm · 1548b060
      Linus Torvalds authored
      Pull drm ci scripts from Dave Airlie:
       "This is a bunch of ci integration for the freedesktop gitlab instance
        where we currently do upstream userspace testing on diverse sets of
        GPU hardware. From my perspective I think it's an experiment worth
        going with and seeing how the benefits/noise playout keeping these
        files useful.
      
        Ideally I'd like to get this so we can do pre-merge testing on PRs
        eventually.
      
        Below is some info from danvet on why we've ended up making the
        decision and how we can roll it back if we decide it was a bad plan.
      
        Why in upstream?
      
         - like documentation, testcases, tools CI integration is one of these
           things where you can waste endless amounts of time if you
           accidentally have a version that doesn't match your source code
      
         - but also like the above, there's a balance, this is the initial cut
           of what we think makes sense to keep in sync vs out-of-tree,
           probably needs adjustment
      
         - gitlab supports out-of-repo gitlab integration and that's what's
           been used for the kernel in drm, but it results in per-driver
           fragmentation and lots of duplicated effort. the simple act of
           smashing an arbitrary winner into a topic branch already started
           surfacing patches on dri-devel and sparking good cross driver team
           discussions
      
        Why gitlab?
      
         - it's not any more shit than any of the other CI
      
         - drm userspace uses it extensively for everything in userspace, we
           have a lot of people and experience with this, including
           integration of hw testing labs
      
         - media userspace like gstreamer is also on gitlab.fd.o, and there's
           discussion to extend this to the media subsystem in some fashion
      
        Can this be shared?
      
         - there's definitely a pile of code that could move to scripts/ if
           other subsystem adopt ci integration in upstream kernel git. other
           bits are more drm/gpu specific like the igt-gpu-tests/tools
           integration
      
         - docker images can be run locally or in other CI runners
      
        Will we regret this?
      
         - it's all in one directory, intentionally, for easy deletion
      
         - probably 1-2 years in upstream to see whether this is worth it or a
           Big Mistake. that's roughly what it took to _really_ roll out solid
           CI in the bigger userspace projects we have on gitlab.fd.o like
           mesa3d"
      
      * tag 'topic/drm-ci-2023-08-31-1' of git://anongit.freedesktop.org/drm/drm:
        drm: ci: docs: fix build warning - add missing escape
        drm: Add initial ci/ subdirectory
      1548b060
    • Linus Torvalds's avatar
      Merge tag 'x86-urgent-2023-09-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · e56b2b60
      Linus Torvalds authored
      Pull x86 fixes from Ingo Molnar:
       "Fix preemption delays in the SGX code, remove unnecessarily
        UAPI-exported code, fix a ld.lld linker (in)compatibility quirk and
        make the x86 SMP init code a bit more conservative to fix kexec()
        lockups"
      
      * tag 'x86-urgent-2023-09-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/sgx: Break up long non-preemptible delays in sgx_vepc_release()
        x86: Remove the arch_calc_vm_prot_bits() macro from the UAPI
        x86/build: Fix linker fill bytes quirk/incompatibility for ld.lld
        x86/smp: Don't send INIT to non-present and non-booted CPUs
      e56b2b60
    • Linus Torvalds's avatar
      Merge tag 'perf-urgent-2023-09-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · e79dbf03
      Linus Torvalds authored
      Pull x86 perf event fix from Ingo Molnar:
       "Work around a firmware bug in the uncore PMU driver, affecting certain
        Intel systems"
      
      * tag 'perf-urgent-2023-09-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/x86/uncore: Correct the number of CHAs on EMR
      e79dbf03
    • Linus Torvalds's avatar
      Merge tag 'perf-tools-for-v6.6-1-2023-09-05' of... · 535a265d
      Linus Torvalds authored
      Merge tag 'perf-tools-for-v6.6-1-2023-09-05' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools
      
      Pull perf tools updates from Arnaldo Carvalho de Melo:
       "perf tools maintainership:
      
         - Add git information for perf-tools and perf-tools-next trees and
           branches to the MAINTAINERS file. That is where development now
           takes place and myself and Namhyung Kim have write access, more
           people to come as we emulate other maintainer groups.
      
        perf record:
      
         - Record kernel data maps when 'perf record --data' is used, so that
           global variables can be resolved and used in tools that do data
           profiling.
      
        perf trace:
      
         - Remove the old, experimental support for BPF events in which a .c
           file was passed as an event: "perf trace -e hello.c" to then get
           compiled and loaded.
      
           The only known usage for that, that shipped with the kernel as an
           example for such events, augmented the raw_syscalls tracepoints and
           was converted to a libbpf skeleton, reusing all the user space
           components and the BPF code connected to the syscalls.
      
           In the end just the way to glue the BPF part and the user space
           type beautifiers changed, now being performed by libbpf skeletons.
      
           The next step is to use BTF to do pretty printing of all syscall
           types, as discussed with Alan Maguire and others.
      
           Now, on a perf built with BUILD_BPF_SKEL=1 we get most if not all
           path/filenames/strings, some of the networking data structures,
           perf_event_attr, etc, i.e. systemwide tracing of nanosleep calls
           and perf_event_open syscalls while 'perf stat' runs 'sleep' for 5
           seconds:
      
            # perf trace -a -e *nanosleep,perf* perf stat -e cycles,instructions sleep 5
               0.000 (   9.034 ms): perf/327641 perf_event_open(attr_uptr: { type: 0 (PERF_TYPE_HARDWARE), size: 136, config: 0 (PERF_COUNT_HW_CPU_CYCLES), sample_type: IDENTIFIER, read_format: TOTAL_TIME_ENABLED|TOTAL_TIME_RUNNING, disabled: 1, inherit: 1, enable_on_exec: 1, exclude_guest: 1 }, pid: 327642 (perf), cpu: -1, group_fd: -1, flags: FD_CLOEXEC) = 3
               9.039 (   0.006 ms): perf/327641 perf_event_open(attr_uptr: { type: 0 (PERF_TYPE_HARDWARE), size: 136, config: 0x1 (PERF_COUNT_HW_INSTRUCTIONS), sample_type: IDENTIFIER, read_format: TOTAL_TIME_ENABLED|TOTAL_TIME_RUNNING, disabled: 1, inherit: 1, enable_on_exec: 1, exclude_guest: 1 }, pid: 327642 (perf-exec), cpu: -1, group_fd: -1, flags: FD_CLOEXEC) = 4
                   ? (           ): gpm/991  ... [continued]: clock_nanosleep())               = 0
              10.133 (           ): sleep/327642 clock_nanosleep(rqtp: { .tv_sec: 5, .tv_nsec: 0 }, rmtp: 0x7ffd36f83ed0) ...
                   ? (           ): pool-gsd-smart/3051  ... [continued]: clock_nanosleep())   = 0
              30.276 (           ): gpm/991 clock_nanosleep(rqtp: { .tv_sec: 2, .tv_nsec: 0 }, rmtp: 0x7ffcc6f73710) ...
             223.215 (1000.430 ms): pool-gsd-smart/3051 clock_nanosleep(rqtp: { .tv_sec: 1, .tv_nsec: 0 }, rmtp: 0x7f6e7fffec90) = 0
              30.276 (2000.394 ms): gpm/991  ... [continued]: clock_nanosleep())               = 0
            1230.814 (           ): pool-gsd-smart/3051 clock_nanosleep(rqtp: { .tv_sec: 1, .tv_nsec: 0 }, rmtp: 0x7f6e7fffec90) ...
            1230.814 (1000.404 ms): pool-gsd-smart/3051  ... [continued]: clock_nanosleep())   = 0
            2030.886 (           ): gpm/991 clock_nanosleep(rqtp: { .tv_sec: 2, .tv_nsec: 0 }, rmtp: 0x7ffcc6f73710) ...
            2237.709 (1000.153 ms): pool-gsd-smart/3051 clock_nanosleep(rqtp: { .tv_sec: 1, .tv_nsec: 0 }, rmtp: 0x7f6e7fffec90) = 0
                   ? (           ): crond/1172  ... [continued]: clock_nanosleep())            = 0
            3242.699 (           ): pool-gsd-smart/3051 clock_nanosleep(rqtp: { .tv_sec: 1, .tv_nsec: 0 }, rmtp: 0x7f6e7fffec90) ...
            2030.886 (2000.385 ms): gpm/991  ... [continued]: clock_nanosleep())               = 0
            3728.078 (           ): crond/1172 clock_nanosleep(rqtp: { .tv_sec: 60, .tv_nsec: 0 }, rmtp: 0x7ffe0971dcf0) ...
            3242.699 (1000.158 ms): pool-gsd-smart/3051  ... [continued]: clock_nanosleep())   = 0
            4031.409 (           ): gpm/991 clock_nanosleep(rqtp: { .tv_sec: 2, .tv_nsec: 0 }, rmtp: 0x7ffcc6f73710) ...
              10.133 (5000.375 ms): sleep/327642  ... [continued]: clock_nanosleep())          = 0
      
            Performance counter stats for 'sleep 5':
      
                   2,617,347      cycles
                   1,855,997      instructions                     #    0.71  insn per cycle
      
                 5.002282128 seconds time elapsed
      
                 0.000855000 seconds user
                 0.000852000 seconds sys
      
        perf annotate:
      
         - Building with binutils' libopcode now is opt-in (BUILD_NONDISTRO=1)
           for licensing reasons, and we missed a build test on
           tools/perf/tests makefile.
      
           Since we now default to NDEBUG=1, we ended up segfaulting when
           building with BUILD_NONDISTRO=1 because a needed initialization
           routine was being "error checked" via an assert.
      
           Fix it by explicitly checking the result and aborting instead if it
           fails.
      
           We better back propagate the error, but at least 'perf annotate' on
           samples collected for a BPF program is back working when perf is
           built with BUILD_NONDISTRO=1.
      
        perf report/top:
      
         - Add back TUI hierarchy mode header, that is seen when using 'perf
           report/top --hierarchy'.
      
         - Fix the number of entries for 'e' key in the TUI that was
           preventing navigation of lines when expanding an entry.
      
        perf report/script:
      
         - Support cross platform register handling, allowing a perf.data file
           collected on one architecture to have registers sampled correctly
           displayed when analysis tools such as 'perf report' and 'perf
           script' are used on a different architecture.
      
         - Fix handling of event attributes in pipe mode, i.e. when one uses:
      
        	perf record -o - | perf report -i -
      
           When no perf.data files are used.
      
         - Handle files generated via pipe mode with a version of perf and
           then read also via pipe mode with a different version of perf,
           where the event attr record may have changed, use the record size
           field to properly support this version mismatch.
      
        perf probe:
      
         - Accessing global variables from uprobes isn't supported, make the
           error message state that instead of stating that some minimal
           kernel version is needed to have that feature. This seems just a
           tool limitation, the kernel probably has all that is needed.
      
        perf tests:
      
         - Fix a reference count related leak in the dlfilter v0 API where the
           result of a thread__find_symbol_fb() is not matched with an
           addr_location__exit() to drop the reference counts of the resolved
           components (machine, thread, map, symbol, etc). Add a dlfilter test
           to make sure that doesn't regresses.
      
         - Lots of fixes for the 'perf test' written in shell script related
           to problems found with the shellcheck utility.
      
         - Fixes for 'perf test' shell scripts testing features enabled when
           perf is built with BUILD_BPF_SKEL=1, such as 'perf stat' bpf
           counters.
      
         - Add perf record sample filtering test, things like the following
           example, that gets implemented as a BPF filter attached to the
           event:
      
             # perf record -e task-clock -c 10000 --filter 'ip < 0xffffffff00000000'
      
         - Improve the way the task_analyzer test checks if libtraceevent is
           linked, using 'perf version --build-options' instead of the more
           expensinve 'perf record -e "sched:sched_switch"'.
      
         - Add support for riscv in the mmap-basic test. (This went as well
           via the RiscV tree, same contents).
      
        libperf:
      
         - Implement riscv mmap support (This went as well via the RiscV tree,
           same contents).
      
        perf script:
      
         - New tool that converts perf.data files to the firefox profiler
           format so that one can use the visualizer at
           https://profiler.firefox.com/. Done by Anup Sharma as part of this
           year's Google Summer of Code.
      
           One can generate the output and upload it to the web interface but
           Anup also automated everything:
      
             perf script gecko -F 99 -a sleep 60
      
         - Support syscall name parsing on arm64.
      
         - Print "cgroup" field on the same line as "comm".
      
        perf bench:
      
         - Add new 'uprobe' benchmark to measure the overhead of uprobes
           with/without BPF programs attached to it.
      
         - breakpoints are not available on power9, skip that test.
      
        perf stat:
      
         - Add #num_cpus_online literal to be used in 'perf stat' metrics, and
           add this extra 'perf test' check that exemplifies its purpose:
      
        	TEST_ASSERT_VAL("#num_cpus_online",
                               expr__parse(&num_cpus_online, ctx, "#num_cpus_online") == 0);
        	TEST_ASSERT_VAL("#num_cpus", expr__parse(&num_cpus, ctx, "#num_cpus") == 0);
        	TEST_ASSERT_VAL("#num_cpus >= #num_cpus_online", num_cpus >= num_cpus_online);
      
        Miscellaneous:
      
         - Improve tool startup time by lazily reading PMU, JSON, sysfs data.
      
         - Improve error reporting in the parsing of events, passing YYLTYPE
           to error routines, so that the output can show were the parsing
           error was found.
      
         - Add 'perf test' entries to check the parsing of events
           improvements.
      
         - Fix various leak for things detected by -fsanitize=address, mostly
           things that would be freed at tool exit, including:
      
             - Free evsel->filter on the destructor.
      
             - Allow tools to register a thread->priv destructor and use it in
               'perf trace'.
      
             - Free evsel->priv in 'perf trace'.
      
             - Free string returned by synthesize_perf_probe_point() when the
               caller fails to do all it needs.
      
         - Adjust various compiler options to not consider errors some
           warnings when building with broken headers found in things like
           python, flex, bison, as we otherwise build with -Werror. Some for
           gcc, some for clang, some for some specific version of those, some
           for some specific version of flex or bison, or some specific
           combination of these components, bah.
      
         - Allow customization of clang options for BPF target, this helps
           building on gentoo where there are other oddities where BPF targets
           gets passed some compiler options intended for the native build, so
           building with WERROR=0 helps while these oddities are fixed.
      
         - Dont pass ERR_PTR() values to perf_session__delete() in 'perf top'
           and 'perf lock', fixing some segfaults when handling some odd
           failures.
      
         - Add LTO build option.
      
         - Fix format of unordered lists in the perf docs
           (tools/perf/Documentation)
      
         - Overhaul the bison files, using constructs such as YYNOMEM.
      
         - Remove unused tokens from the bison .y files.
      
         - Add more comments to various structs.
      
         - A few LoongArch enablement patches.
      
        Vendor events (JSON):
      
         - Add JSON metrics for Yitian 710 DDR (aarch64). Things like:
      
        	EventName, BriefDescription
        	visible_window_limit_reached_rd, "At least one entry in read queue reaches the visible window limit.",
        	visible_window_limit_reached_wr, "At least one entry in write queue reaches the visible window limit.",
        	op_is_dqsosc_mpc	       , "A DQS Oscillator MPC command to DRAM.",
        	op_is_dqsosc_mrr	       , "A DQS Oscillator MRR command to DRAM.",
        	op_is_tcr_mrr		       , "A Temperature Compensated Refresh(TCR) MRR command to DRAM.",
      
         - Add AmpereOne metrics (aarch64).
      
         - Update N2 and V2 metrics (aarch64) and events using Arm telemetry
           repo.
      
         - Update scale units and descriptions of common topdown metrics on
           aarch64. Things like:
             - "MetricExpr": "stall_slot_frontend / (#slots * cpu_cycles)",
             - "BriefDescription": "Frontend bound L1 topdown metric",
             + "MetricExpr": "100 * (stall_slot_frontend / (#slots * cpu_cycles))",
             + "BriefDescription": "This metric is the percentage of total slots that were stalled due to resource constraints in the frontend of the processor.",
      
         - Update events for intel: meteorlake to 1.04, sapphirerapids to
           1.15, Icelake+ metric constraints.
      
         - Update files for the power10 platform"
      
      * tag 'perf-tools-for-v6.6-1-2023-09-05' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (217 commits)
        perf parse-events: Fix driver config term
        perf parse-events: Fixes relating to no_value terms
        perf parse-events: Fix propagation of term's no_value when cloning
        perf parse-events: Name the two term enums
        perf list: Don't print Unit for "default_core"
        perf vendor events intel: Fix modifier in tma_info_system_mem_parallel_reads for skylake
        perf dlfilter: Avoid leak in v0 API test use of resolve_address()
        perf metric: Add #num_cpus_online literal
        perf pmu: Remove str from perf_pmu_alias
        perf parse-events: Make common term list to strbuf helper
        perf parse-events: Minor help message improvements
        perf pmu: Avoid uninitialized use of alias->str
        perf jevents: Use "default_core" for events with no Unit
        perf test stat_bpf_counters_cgrp: Enhance perf stat cgroup BPF counter test
        perf test shell stat_bpf_counters: Fix test on Intel
        perf test shell record_bpf_filter: Skip 6.2 kernel
        libperf: Get rid of attr.id field
        perf tools: Convert to perf_record_header_attr_id()
        libperf: Add perf_record_header_attr_id()
        perf tools: Handle old data in PERF_RECORD_ATTR
        ...
      535a265d
    • Linus Torvalds's avatar
      Merge tag '6.6-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6 · fd3a5940
      Linus Torvalds authored
      Pull smb client fixes from Steve French:
      
       - six smb3 client fixes including ones to allow controlling smb3
         directory caching timeout and limits, and one debugging improvement
      
       - one fix for nls Kconfig (don't need to expose NLS_UCS2_UTILS option)
      
       - one minor spnego registry update
      
      * tag '6.6-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6:
        spnego: add missing OID to oid registry
        smb3: fix minor typo in SMB2_GLOBAL_CAP_LARGE_MTU
        cifs: update internal module version number for cifs.ko
        smb3: allow controlling maximum number of cached directories
        smb3: add trace point for queryfs (statfs)
        nls: Hide new NLS_UCS2_UTILS
        smb3: allow controlling length of time directory entries are cached with dir leases
        smb: propagate error code of extract_sharename()
      fd3a5940
  17. 09 Sep, 2023 3 commits
    • David Howells's avatar
      iov_iter: Kunit tests for page extraction · a3c57ab7
      David Howells authored
      Add some kunit tests for page extraction for ITER_BVEC, ITER_KVEC and
      ITER_XARRAY type iterators.  ITER_UBUF and ITER_IOVEC aren't dealt with
      as they require userspace VM interaction.  ITER_DISCARD isn't dealt with
      either as that can't be extracted.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Christian Brauner <brauner@kernel.org>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: David Hildenbrand <david@redhat.com>
      Cc: John Hubbard <jhubbard@nvidia.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a3c57ab7
    • David Howells's avatar
      iov_iter: Kunit tests for copying to/from an iterator · 2d71340f
      David Howells authored
      Add some kunit tests for page extraction for ITER_BVEC, ITER_KVEC and
      ITER_XARRAY type iterators.  ITER_UBUF and ITER_IOVEC aren't dealt with
      as they require userspace VM interaction.  ITER_DISCARD isn't dealt with
      either as that does nothing.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Christian Brauner <brauner@kernel.org>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: David Hildenbrand <david@redhat.com>
      Cc: John Hubbard <jhubbard@nvidia.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2d71340f
    • David Howells's avatar
      iov_iter: Fix iov_iter_extract_pages() with zero-sized entries · f741bd71
      David Howells authored
      iov_iter_extract_pages() doesn't correctly handle skipping over initial
      zero-length entries in ITER_KVEC and ITER_BVEC-type iterators.
      
      The problem is that it accidentally reduces maxsize to 0 when it
      skipping and thus runs to the end of the array and returns 0.
      
      Fix this by sticking the calculated size-to-copy in a new variable
      rather than back in maxsize.
      
      Fixes: 7d58fe73 ("iov_iter: Add a function to extract a page list from an iterator")
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Cc: Christian Brauner <brauner@kernel.org>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: David Hildenbrand <david@redhat.com>
      Cc: John Hubbard <jhubbard@nvidia.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f741bd71