From nobody Tue Jun 30 04:29:31 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 80431C433F5 for ; Thu, 27 Jan 2022 18:09:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245039AbiA0SJ5 (ORCPT ); Thu, 27 Jan 2022 13:09:57 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:58766 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245009AbiA0SJ0 (ORCPT ); Thu, 27 Jan 2022 13:09:26 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 10559B820C4; Thu, 27 Jan 2022 18:09:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 05CC2C340E8; Thu, 27 Jan 2022 18:09:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643306963; bh=s5v9SVin3iJiW+7QHguVCNmh9tK/o9bh3oawvFMvR+0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uj5+XuD5tJC2hdXkUb3pyepJGO80BecIKJsiHTQEuuuLm8kSgxltExzYuSko/X05R 4cfY91A2wIpyCwKN1/xhoWAkfjw32z+0rBCbXj/idkRkfKhYONpG9flyL1TeIqcFKD c7eIPpynqime592s6qM/Q383AoQIA7sMd5JhJF+M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tvrtko Ursulin , Sushma Venkatesh Reddy , Daniel Vetter , Dave Airlie , Jon Bloomfield , Joonas Lahtinen , Jani Nikula , Linus Torvalds Subject: [PATCH 4.19 1/3] drm/i915: Flush TLBs before releasing backing store Date: Thu, 27 Jan 2022 19:09:01 +0100 Message-Id: <20220127180256.882642458@linuxfoundation.org> X-Mailer: git-send-email 2.35.0 In-Reply-To: <20220127180256.837257619@linuxfoundation.org> References: <20220127180256.837257619@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tvrtko Ursulin commit 7938d61591d33394a21bdd7797a245b65428f44c upstream. We need to flush TLBs before releasing backing store otherwise userspace is able to encounter stale entries if a) it is not declaring access to certain buffers and b) it races with the backing store release from a such undeclared execution already executing on the GPU in parallel. The approach taken is to mark any buffer objects which were ever bound to the GPU and to trigger a serialized TLB flush when their backing store is released. Alternatively the flushing could be done on VMA unbind, at which point we would be able to ascertain whether there is potential a parallel GPU execution (which could race), but essentially it boils down to paying the cost of TLB flushes potentially needlessly at VMA unbind time (when the backing store is not known to be going away so not needed for safety), versus potentially needlessly at backing store relase time (since we at that point cannot tell whether there is anything executing on the GPU which uses that object). Thereforce simplicity of implementation has been chosen for now with scope to benchmark and refine later as required. Signed-off-by: Tvrtko Ursulin Reported-by: Sushma Venkatesh Reddy Reviewed-by: Daniel Vetter Acked-by: Dave Airlie Cc: Daniel Vetter Cc: Jon Bloomfield Cc: Joonas Lahtinen Cc: Jani Nikula Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/i915/i915_drv.h | 2=20 drivers/gpu/drm/i915/i915_gem.c | 83 ++++++++++++++++++++++++++++= +++++ drivers/gpu/drm/i915/i915_gem_object.h | 1=20 drivers/gpu/drm/i915/i915_reg.h | 6 ++ drivers/gpu/drm/i915/i915_vma.c | 4 + 5 files changed, 96 insertions(+) --- a/drivers/gpu/drm/i915/i915_drv.h +++ b/drivers/gpu/drm/i915/i915_drv.h @@ -1595,6 +1595,8 @@ struct drm_i915_private { =20 struct intel_uncore uncore; =20 + struct mutex tlb_invalidate_lock; + struct i915_virtual_gpu vgpu; =20 struct intel_gvt *gvt; --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -2446,6 +2446,78 @@ static void __i915_gem_object_reset_page rcu_read_unlock(); } =20 +struct reg_and_bit { + i915_reg_t reg; + u32 bit; +}; + +static struct reg_and_bit +get_reg_and_bit(const struct intel_engine_cs *engine, + const i915_reg_t *regs, const unsigned int num) +{ + const unsigned int class =3D engine->class; + struct reg_and_bit rb =3D { .bit =3D 1 }; + + if (WARN_ON_ONCE(class >=3D num || !regs[class].reg)) + return rb; + + rb.reg =3D regs[class]; + if (class =3D=3D VIDEO_DECODE_CLASS) + rb.reg.reg +=3D 4 * engine->instance; /* GEN8_M2TCR */ + + return rb; +} + +static void invalidate_tlbs(struct drm_i915_private *dev_priv) +{ + static const i915_reg_t gen8_regs[] =3D { + [RENDER_CLASS] =3D GEN8_RTCR, + [VIDEO_DECODE_CLASS] =3D GEN8_M1TCR, /* , GEN8_M2TCR */ + [VIDEO_ENHANCEMENT_CLASS] =3D GEN8_VTCR, + [COPY_ENGINE_CLASS] =3D GEN8_BTCR, + }; + const unsigned int num =3D ARRAY_SIZE(gen8_regs); + const i915_reg_t *regs =3D gen8_regs; + struct intel_engine_cs *engine; + enum intel_engine_id id; + + if (INTEL_GEN(dev_priv) < 8) + return; + + GEM_TRACE("\n"); + + assert_rpm_wakelock_held(dev_priv); + + mutex_lock(&dev_priv->tlb_invalidate_lock); + intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL); + + for_each_engine(engine, dev_priv, id) { + /* + * HW architecture suggest typical invalidation time at 40us, + * with pessimistic cases up to 100us and a recommendation to + * cap at 1ms. We go a bit higher just in case. + */ + const unsigned int timeout_us =3D 100; + const unsigned int timeout_ms =3D 4; + struct reg_and_bit rb; + + rb =3D get_reg_and_bit(engine, regs, num); + if (!i915_mmio_reg_offset(rb.reg)) + continue; + + I915_WRITE_FW(rb.reg, rb.bit); + if (__intel_wait_for_register_fw(dev_priv, + rb.reg, rb.bit, 0, + timeout_us, timeout_ms, + NULL)) + DRM_ERROR_RATELIMITED("%s TLB invalidation did not complete in %ums!\n", + engine->name, timeout_ms); + } + + intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL); + mutex_unlock(&dev_priv->tlb_invalidate_lock); +} + static struct sg_table * __i915_gem_object_unset_pages(struct drm_i915_gem_object *obj) { @@ -2475,6 +2547,15 @@ __i915_gem_object_unset_pages(struct drm __i915_gem_object_reset_page_iter(obj); obj->mm.page_sizes.phys =3D obj->mm.page_sizes.sg =3D 0; =20 + if (test_and_clear_bit(I915_BO_WAS_BOUND_BIT, &obj->flags)) { + struct drm_i915_private *i915 =3D to_i915(obj->base.dev); + + if (intel_runtime_pm_get_if_in_use(i915)) { + invalidate_tlbs(i915); + intel_runtime_pm_put(i915); + } + } + return pages; } =20 @@ -5792,6 +5873,8 @@ int i915_gem_init_early(struct drm_i915_ =20 spin_lock_init(&dev_priv->fb_tracking.lock); =20 + mutex_init(&dev_priv->tlb_invalidate_lock); + err =3D i915_gemfs_init(dev_priv); if (err) DRM_NOTE("Unable to create a private tmpfs mount, hugepage support will = be disabled(%d).\n", err); --- a/drivers/gpu/drm/i915/i915_gem_object.h +++ b/drivers/gpu/drm/i915/i915_gem_object.h @@ -136,6 +136,7 @@ struct drm_i915_gem_object { * activity? */ #define I915_BO_ACTIVE_REF 0 +#define I915_BO_WAS_BOUND_BIT 1 =20 /* * Is the object to be mapped as read-only to the GPU --- a/drivers/gpu/drm/i915/i915_reg.h +++ b/drivers/gpu/drm/i915/i915_reg.h @@ -2431,6 +2431,12 @@ enum i915_power_well_id { #define GAMT_CHKN_DISABLE_DYNAMIC_CREDIT_SHARING (1 << 28) #define GAMT_CHKN_DISABLE_I2M_CYCLE_ON_WR_PORT (1 << 24) =20 +#define GEN8_RTCR _MMIO(0x4260) +#define GEN8_M1TCR _MMIO(0x4264) +#define GEN8_M2TCR _MMIO(0x4268) +#define GEN8_BTCR _MMIO(0x426c) +#define GEN8_VTCR _MMIO(0x4270) + #if 0 #define PRB0_TAIL _MMIO(0x2030) #define PRB0_HEAD _MMIO(0x2034) --- a/drivers/gpu/drm/i915/i915_vma.c +++ b/drivers/gpu/drm/i915/i915_vma.c @@ -335,6 +335,10 @@ int i915_vma_bind(struct i915_vma *vma, return ret; =20 vma->flags |=3D bind_flags; + + if (vma->obj) + set_bit(I915_BO_WAS_BOUND_BIT, &vma->obj->flags); + return 0; } =20 From nobody Tue Jun 30 04:29:31 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ED368C4332F for ; Thu, 27 Jan 2022 18:10:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245298AbiA0SKc (ORCPT ); Thu, 27 Jan 2022 13:10:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45306 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245097AbiA0SKG (ORCPT ); Thu, 27 Jan 2022 13:10:06 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 681A4C06175E; Thu, 27 Jan 2022 10:09:34 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0792061998; Thu, 27 Jan 2022 18:09:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EFBF7C340E8; Thu, 27 Jan 2022 18:09:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643306973; bh=cTzy/uUSa4SbHM+Sg65a3vUrWjXyn+gy5N/7gXWhp/w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1xtbrkqICQenRVWrbg2ujnhODqnOwR5v2ilynetkPKdDk5J7V4a5UUtJZec8XPkCV I25kgo992H7KzQcP3AclSsgxdXJUOrkoHThO15jrwgQ4i8JRu6R92OPCkdUxNFnqKp PCjL9ECw8+Si6dySXSJ37vb6En1aOczhgcs/cin0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nikolay Aleksandrov , "David S. Miller" , Huang Guobin Subject: [PATCH 4.19 2/3] net: bridge: clear bridges private skb space on xmit Date: Thu, 27 Jan 2022 19:09:02 +0100 Message-Id: <20220127180256.913580967@linuxfoundation.org> X-Mailer: git-send-email 2.35.0 In-Reply-To: <20220127180256.837257619@linuxfoundation.org> References: <20220127180256.837257619@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nikolay Aleksandrov commit fd65e5a95d08389444e8591a20538b3edece0e15 upstream. We need to clear all of the bridge private skb variables as they can be stale due to the packet being recirculated through the stack and then transmitted through the bridge device. Similar memset is already done on bridge's input. We've seen cases where proxyarp_replied was 1 on routed multicast packets transmitted through the bridge to ports with neigh suppress which were getting dropped. Same thing can in theory happen with the port isolation bit as well. Fixes: 821f1b21cabb ("bridge: add new BR_NEIGH_SUPPRESS port flag to suppre= ss arp and nd flood") Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller Signed-off-by: Huang Guobin Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/bridge/br_device.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/bridge/br_device.c +++ b/net/bridge/br_device.c @@ -42,6 +42,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff * struct ethhdr *eth; u16 vid =3D 0; =20 + memset(skb->cb, 0, sizeof(struct br_input_skb_cb)); + rcu_read_lock(); nf_ops =3D rcu_dereference(nf_br_ops); if (nf_ops && nf_ops->br_dev_xmit_hook(skb)) { From nobody Tue Jun 30 04:29:31 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BCCE1C433FE for ; Thu, 27 Jan 2022 18:10:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244948AbiA0SKN (ORCPT ); Thu, 27 Jan 2022 13:10:13 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45326 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245135AbiA0SJq (ORCPT ); Thu, 27 Jan 2022 13:09:46 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ABDCBC06175D; Thu, 27 Jan 2022 10:09:32 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6ADA2B820C8; Thu, 27 Jan 2022 18:09:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9376CC340E4; Thu, 27 Jan 2022 18:09:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643306970; bh=EmDU9pBT/xPBJnM3VVz+DnGxxc7WqCOmuKLje9v9Pug=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aetIdn9Ew+pulrCIZ9Km7apsnhUSxk8qVb0CMqajSMeR/xLyQqxagVBmu96ebt9yN Xgaz+FgCyfIuI0IrU/aiPt5/ar8EjKKoGOz6JsRviNPOIUjdxwH7mQnf6xnjHuHX3w shmIBbfLyumYAqUcAV2JfqCj8Mb3u2DC0KsJj2TY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Torvalds , Jan Kara Subject: [PATCH 4.19 3/3] select: Fix indefinitely sleeping task in poll_schedule_timeout() Date: Thu, 27 Jan 2022 19:09:03 +0100 Message-Id: <20220127180256.943514512@linuxfoundation.org> X-Mailer: git-send-email 2.35.0 In-Reply-To: <20220127180256.837257619@linuxfoundation.org> References: <20220127180256.837257619@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jan Kara commit 68514dacf2715d11b91ca50d88de047c086fea9c upstream. A task can end up indefinitely sleeping in do_select() -> poll_schedule_timeout() when the following race happens: TASK1 (thread1) TASK2 TASK1 (thread2) do_select() setup poll_wqueues table with 'fd' write data to 'fd' pollwake() table->triggered =3D 1 closes 'fd' thread1 is waiting for poll_schedule_timeout() - sees table->triggered table->triggered =3D 0 return -EINTR loop back in do_select() But at this point when TASK1 loops back, the fdget() in the setup of poll_wqueues fails. So now so we never find 'fd' is ready for reading and sleep in poll_schedule_timeout() indefinitely. Treat an fd that got closed as a fd on which some event happened. This makes sure cannot block indefinitely in do_select(). Another option would be to return -EBADF in this case but that has a potential of subtly breaking applications that excercise this behavior and it happens to work for them. So returning fd as active seems like a safer choice. Suggested-by: Linus Torvalds CC: stable@vger.kernel.org Signed-off-by: Jan Kara Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/select.c | 63 +++++++++++++++++++++++++++++++------------------------= ----- 1 file changed, 33 insertions(+), 30 deletions(-) --- a/fs/select.c +++ b/fs/select.c @@ -431,9 +431,11 @@ get_max: return max; } =20 -#define POLLIN_SET (EPOLLRDNORM | EPOLLRDBAND | EPOLLIN | EPOLLHUP | EPOLL= ERR) -#define POLLOUT_SET (EPOLLWRBAND | EPOLLWRNORM | EPOLLOUT | EPOLLERR) -#define POLLEX_SET (EPOLLPRI) +#define POLLIN_SET (EPOLLRDNORM | EPOLLRDBAND | EPOLLIN | EPOLLHUP | EPOLL= ERR |\ + EPOLLNVAL) +#define POLLOUT_SET (EPOLLWRBAND | EPOLLWRNORM | EPOLLOUT | EPOLLERR |\ + EPOLLNVAL) +#define POLLEX_SET (EPOLLPRI | EPOLLNVAL) =20 static inline void wait_key_set(poll_table *wait, unsigned long in, unsigned long out, unsigned long bit, @@ -500,6 +502,7 @@ static int do_select(int n, fd_set_bits break; if (!(bit & all_bits)) continue; + mask =3D EPOLLNVAL; f =3D fdget(i); if (f.file) { wait_key_set(wait, in, out, bit, @@ -507,34 +510,34 @@ static int do_select(int n, fd_set_bits mask =3D vfs_poll(f.file, wait); =20 fdput(f); - if ((mask & POLLIN_SET) && (in & bit)) { - res_in |=3D bit; - retval++; - wait->_qproc =3D NULL; - } - if ((mask & POLLOUT_SET) && (out & bit)) { - res_out |=3D bit; - retval++; - wait->_qproc =3D NULL; - } - if ((mask & POLLEX_SET) && (ex & bit)) { - res_ex |=3D bit; - retval++; - wait->_qproc =3D NULL; - } - /* got something, stop busy polling */ - if (retval) { - can_busy_loop =3D false; - busy_flag =3D 0; - - /* - * only remember a returned - * POLL_BUSY_LOOP if we asked for it - */ - } else if (busy_flag & mask) - can_busy_loop =3D true; - } + if ((mask & POLLIN_SET) && (in & bit)) { + res_in |=3D bit; + retval++; + wait->_qproc =3D NULL; + } + if ((mask & POLLOUT_SET) && (out & bit)) { + res_out |=3D bit; + retval++; + wait->_qproc =3D NULL; + } + if ((mask & POLLEX_SET) && (ex & bit)) { + res_ex |=3D bit; + retval++; + wait->_qproc =3D NULL; + } + /* got something, stop busy polling */ + if (retval) { + can_busy_loop =3D false; + busy_flag =3D 0; + + /* + * only remember a returned + * POLL_BUSY_LOOP if we asked for it + */ + } else if (busy_flag & mask) + can_busy_loop =3D true; + } if (res_in) *rinp =3D res_in;