{"push_id":1193882786,"size":11,"distinct_size":11,"ref":"refs/heads/master","head":"7ed18e2d1b6782989eb399ef79a8cc1a1b583b3c","before":"ac904ae6e6f0a56be7b9a1cf66fbd50dd025fb06","commits":[{"sha":"65c0554b73c920023cc8998802e508b798113b46","author":{"name":"Rafael J. Wysocki","email":"eb3c82195bc87396d74859a40992e20b7267b462@intel.com"},"message":"x86/power/64: Fix kernel text mapping corruption during image restoration\n\nLogan Gunthorpe reports that hibernation stopped working reliably for\nhim after commit ab76f7b4ab23 (x86/mm: Set NX on gap between __ex_table\nand rodata).\n\nThat turns out to be a consequence of a long-standing issue with the\n64-bit image restoration code on x86, which is that the temporary\npage tables set up by it to avoid page tables corruption when the\nlast bits of the image kernel's memory contents are copied into\ntheir original page frames re-use the boot kernel's text mapping,\nbut that mapping may very well get corrupted just like any other\npart of the page tables.  Of course, if that happens, the final\njump to the image kernel's entry point will go to nowhere.\n\nThe exact reason why commit ab76f7b4ab23 matters here is that it\nsometimes causes a PMD of a large page to be split into PTEs\nthat are allocated dynamically and get corrupted during image\nrestoration as described above.\n\nTo fix that issue note that the code copying the last bits of the\nimage kernel's memory contents to the page frames occupied by them\nprevioulsy doesn't use the kernel text mapping, because it runs from\na special page covered by the identity mapping set up for that code\nfrom scratch.  Hence, the kernel text mapping is only needed before\nthat code starts to run and then it will only be used just for the\nfinal jump to the image kernel's entry point.\n\nAccordingly, the temporary page tables set up in swsusp_arch_resume()\non x86-64 need to contain the kernel text mapping too.  That mapping\nis only going to be used for the final jump to the image kernel, so\nit only needs to cover the image kernel's entry point, because the\nfirst thing the image kernel does after getting control back is to\nswitch over to its own original page tables.  Moreover, the virtual\naddress of the image kernel's entry point in that mapping has to be\nthe same as the one mapped by the image kernel's page tables.\n\nWith that in mind, modify the x86-64's arch_hibernation_header_save()\nand arch_hibernation_header_restore() routines to pass the physical\naddress of the image kernel's entry point (in addition to its virtual\naddress) to the boot kernel (a small piece of assembly code involved\nin passing the entry point's virtual address to the image kernel is\nnot necessary any more after that, so drop it).  Update RESTORE_MAGIC\ntoo to reflect the image header format change.\n\nNext, in set_up_temporary_mappings(), use the physical and virtual\naddresses of the image kernel's entry point passed in the image\nheader to set up a minimum kernel text mapping (using memory pages\nthat won't be overwritten by the image kernel's memory contents) that\nwill map those addresses to each other as appropriate.\n\nThis makes the concern about the possible corruption of the original\nboot kernel text mapping go away and if the the minimum kernel text\nmapping used for the final jump marks the image kernel's entry point\nmemory as executable, the jump to it is guaraneed to succeed.\n\nFixes: ab76f7b4ab23 (x86/mm: Set NX on gap between __ex_table and rodata)\nLink: http://marc.info/?l=linux-pm&m=146372852823760&w=2\nReported-by: Logan Gunthorpe <logang@deltatee.com>\nReported-and-tested-by: Borislav Petkov <bp@suse.de>\nTested-by: Kees Cook <keescook@chromium.org>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/65c0554b73c920023cc8998802e508b798113b46"},{"sha":"4a6e68bf96c1fa293717d2f00a68a68c92fa4150","author":{"name":"Sinan Kaya","email":"d69938a14bcf049b5e473683096ff9f59131f008@codeaurora.org"},"message":"ACPI,PCI,IRQ: factor in PCI possible\n\nThe change introduced in commit 103544d86976 (ACPI,PCI,IRQ: reduce\nresource requirements) omitted the initially applied PCI_POSSIBLE\npenalty when the IRQ is active.\n\nIncorrect calculation of the penalty leads the ACPI code to assigning\na wrong interrupt number to a PCI INTx interrupt.\n\nThis would not be as bad as it sounds in theory.  It would just cause\nthe interrupts to be shared and result in performance penalty.\n\nHowever, some drivers (like the parallel port driver) don't like\ninterrupt sharing and in the above case they will causes all of\nthe PCI drivers wanting to share the interrupt to be unable to\nrequest it.\n\nThe issue has not been caught in testing because the behavior is\nplatform-specific and depends on the peripherals ending up sharing\nthe IRQ and their drivers.\n\nBefore the above commit the code would add the PCI_POSSIBLE value\ndivided by the number of possible IRQ users to the IRQ penalty\nduring initialization.\n\nLater in that code path, if the IRQ is chosen as the active IRQ or\nif it is used by ISA; additional penalties are added.\n\nFixes: 103544d86976 (ACPI,PCI,IRQ: reduce resource requirements)\nSigned-off-by: Sinan Kaya <okaya@codeaurora.org>\nTested-by: Wim Osterholt <wim@djo.tudelft.nl>\n[ rjw: Changelog ]\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/4a6e68bf96c1fa293717d2f00a68a68c92fa4150"},{"sha":"487cf917ed0d12afaf403d9d77684bf44b8c13be","author":{"name":"Sinan Kaya","email":"d69938a14bcf049b5e473683096ff9f59131f008@codeaurora.org"},"message":"Revert \"ACPI, PCI, IRQ: remove redundant code in acpi_irq_penalty_init()\"\n\nTrying to make the ISA and PCI init functionality common turned out\nto be a bad idea, because the ISA path depends on external\nfunctionality.\n\nRestore the previous behavior and limit the refactoring to PCI\ninterrupts only.\n\nFixes: 1fcb6a813c4f \"ACPI,PCI,IRQ: remove redundant code in acpi_irq_penalty_init()\"\nSigned-off-by: Sinan Kaya <okaya@codeaurora.org>\nTested-by: Wim Osterholt <wim@djo.tudelft.nl>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/487cf917ed0d12afaf403d9d77684bf44b8c13be"},{"sha":"f7eca374f000bd8bd6aacc2619475fdba0b7ecca","author":{"name":"Sinan Kaya","email":"d69938a14bcf049b5e473683096ff9f59131f008@codeaurora.org"},"message":"ACPI,PCI,IRQ: separate ISA penalty calculation\n\nSince commit 103544d86976 (ACPI,PCI,IRQ: reduce resource requirements)\nthe penalty values are calculated on the fly rather than at boot time.\n\nThis works fine for PCI interrupts but not so well for ISA interrupts.\n\nThe information on whether or not an ISA interrupt is in use is not\navailable to the pci_link.c code directly.  That information is\nobtained from the outside via acpi_penalize_isa_irq().  [If its\n\"active\" argument is true, then the IRQ is in use by ISA.]\n\nSince the current code relies on PCI Link objects for determination\nof penalties, we are factoring in the PCI penalty twice after\nacpi_penalize_isa_irq() function is called.\n\nTo avoid that, limit the newly added functionality to just PCI\ninterrupts so that old behavior is still maintained.\n\nFixes: 103544d86976 (ACPI,PCI,IRQ: reduce resource requirements)\nSigned-off-by: Sinan Kaya <okaya@codeaurora.org>\nTested-by: Wim Osterholt <wim@djo.tudelft.nl>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/f7eca374f000bd8bd6aacc2619475fdba0b7ecca"},{"sha":"dbd1b8ea43b17e2ed4acda72f83ea17f69408682","author":{"name":"Shreyas B. Prabhu","email":"a3640402c0177ee3e4f496d06956fd4c8c76af76@linux.vnet.ibm.com"},"message":"cpuidle: Fix last_residency division\n\nSnooze is a poll idle state in powernv and pseries platforms. Snooze\nhas a timeout so that if a CPU stays in snooze for more than target\nresidency of the next available idle state, then it would exit\nthereby giving chance to the cpuidle governor to re-evaluate and\npromote the CPU to a deeper idle state. Therefore whenever snooze\nexits due to this timeout, its last_residency will be target_residency\nof the next deeper state.\n\nCommit e93e59ce5b85 \"cpuidle: Replace ktime_get() with local_clock()\"\nchanged the math around last_residency calculation. Specifically,\nwhile converting last_residency value from nano- to microseconds, it\ncarries out right shift by 10. Because of that, in snooze timeout\nexit scenarios last_residency calculated is roughly 2.3% less than\ntarget_residency of the next available state. This pattern is picked\nup by get_typical_interval() in the menu governor and therefore\nexpected_interval in menu_select() is frequently less than the\ntarget_residency of any state other than snooze.\n\nDue to this we are entering snooze at a higher rate, thereby\naffecting the single thread performance.\n\nFix this by using more precise division via ktime_us_delta().\n\nFixes: e93e59ce5b85 \"cpuidle: Replace ktime_get() with local_clock()\"\nReported-by: Anton Blanchard <anton@samba.org>\nBisected-by: Shilpasri G Bhat <shilpa.bhat@linux.vnet.ibm.com>\nSigned-off-by: Shreyas B. Prabhu <shreyas@linux.vnet.ibm.com>\nAcked-by: Daniel Lezcano <daniel.lezcano@linaro.org>\nAcked-by: Balbir Singh <bsingharora@gmail.com>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/dbd1b8ea43b17e2ed4acda72f83ea17f69408682"},{"sha":"45209046c47b93fadf26dc59a9da724f387b9cf2","author":{"name":"Lv Zheng","email":"f0c41b314c594069e5d4753e5ec1decf6cfc6526@intel.com"},"message":"ACPICA: Namespace: Fix namespace/interpreter lock ordering\n\nThere is a lock order issue in acpi_load_tables(). The namespace lock\nis held before holding the interpreter lock.\n\nWith ACPI_MUTEX_DEBUG enabled in the kernel, this is printed to the\nlog during boot:\n\n  [    0.885699] ACPI Error: Invalid acquire order: Thread 405884224 owns [ACPI_MTX_Namespace], wants [ACPI_MTX_Interpreter] (20160422/utmutex-263)\n  [    0.885881] ACPI Error: Could not acquire AML Interpreter mutex (20160422/exutils-95)\n  [    0.893846] ACPI Error: Mutex [0x0] is not acquired, cannot release (20160422/utmutex-326)\n  [    0.894019] ACPI Error: Could not release AML Interpreter mutex (20160422/exutils-133)\n\nThe issue has been introduced by the following commit:\n\n  Commit: 2f38b1b16d9280689e5cfa47a4c50956bf437f0d\n  ACPICA Commit: bfe03ffcde8ed56a7eae38ea0b188aeb12f9c52e\n  Subject: ACPICA: Namespace: Fix a regression that MLC support triggers\n           dead lock in dynamic table loading\n\nWhich fixed a deadlock issue for acpi_ns_load_table() in\nacpi_ex_add_table() but didn't take care of the lock order in\nacpi_ns_load_table() correctly.\n\nOriginally (before the above commit), ACPICA used the\nnamespace/interpreter locks in the following 2 key code\npaths:\n\n 1. Table loading:\n acpi_ns_load_table\n\tL(Namespace)\n\t\tacpi_ns_parse_table\n\t\t\tacpi_ns_one_complete_parse\n\tU(Namespace)\n 2. Object evaluation:\n acpi_ns_evaluate\n\tL(Interpreter)\n\tacpi_ps_execute_method\n\t\tU(Interpreter)\n\t\tacpi_ns_load_table\n\t\t\tL(Namespace)\n\t\t\tU(Namespace)\n\t\tacpi_ev_initialize_region\n\t\t\tL(Namespace)\n\t\t\tU(Namespace)\n\t\taddress_space.setup\n\t\t\tL(Namespace)\n\t\t\tU(Namespace)\n\t\taddress_space.handler\n\t\t\tL(Namespace)\n\t\t\tU(Namespace)\n\t\tacpi_os_wait_semaphore\n\t\tacpi_os_acquire_mutex\n\t\tacpi_os_sleep\n\t\tL(Interpreter)\n\tU(Interpreter)\n\nDuring runtime, while acpi_ns_evaluate is called, the lock order is\nalways Interpreter -> Namespace.\n\nIn turn, the problematic commit acquires the locks in the following\norder:\n\n 3. Table loading:\n acpi_ns_load_table\n\tL(Namespace)\n\t\tacpi_ns_parse_table\n\t\tL(Interpreter)\n\t\t\tacpi_ns_one_complete_parse\n\t\tU(Interpreter)\n\tU(Namespace)\n\nTo fix the lock order issue, move the interpreter lock to\nacpi_ns_load_table() to ensure the lock order correctness:\n\n 4. Table loading:\n acpi_ns_load_table\n\tL(Interpreter)\n\tL(Namespace)\n\t\tacpi_ns_parse_table\n\t\t\tacpi_ns_one_complete_parse\n\tU(Namespace)\n\tU(Interpreter)\n\nHowever, this doesn't fix the current design issues related to the\nnamespace lock. For example, we can notice that in acpi_ns_evaluate(),\noutside of acpi_ns_load_table(), the namespace objects may be created\nby the named object creation control methods. And the creation of\nthe method-owned namespace objects are not locked by the namespace\nlock. This patch doesn't try to fix such kind of existing issues.\n\nFixes: 2f38b1b16d92 (ACPICA: Namespace: Fix a regression that MLC support triggers dead lock in dynamic table loading)\nSigned-off-by: Lv Zheng <lv.zheng@intel.com>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/45209046c47b93fadf26dc59a9da724f387b9cf2"},{"sha":"7e3fd813717693597daaa95dee875f4cb2d911ef","author":{"name":"Lv Zheng","email":"f0c41b314c594069e5d4753e5ec1decf6cfc6526@intel.com"},"message":"ACPI / debugger: Fix regression introduced by IS_ERR_VALUE() removal\n\nThe FIFO unlocking mechanism in acpi_dbg has been broken by the\nfollowing commit:\n\n  Commit: 287980e49ffc0f6d911601e7e352a812ed27768e\n  Subject: remove lots of IS_ERR_VALUE abuses\n\nIt converted !IS_ERR_VALUE(ret) into !ret which was not entirely\ncorrect. Fix the regression by taking ret > 0 into account too as\nappropriate.\n\nFixes: 287980e49ffc (remove lots of IS_ERR_VALUE abuses)\nSigned-off-by: Lv Zheng <lv.zheng@intel.com>\n[ rjw: Simplifications, changelog & subject massage ]\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/7e3fd813717693597daaa95dee875f4cb2d911ef"},{"sha":"7fe39a21557b251e101671f2c3f79558a756afef","author":{"name":"Rafael J. Wysocki","email":"eb3c82195bc87396d74859a40992e20b7267b462@intel.com"},"message":"Merge branches 'pm-cpuidle-fixes' and 'pm-sleep-fixes'\n\n* pm-cpuidle-fixes:\n  cpuidle: Fix last_residency division\n\n* pm-sleep-fixes:\n  x86/power/64: Fix kernel text mapping corruption during image restoration","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/7fe39a21557b251e101671f2c3f79558a756afef"},{"sha":"b6d90158c935d4a22e56f41647b479ab5ea449d4","author":{"name":"Rafael J. Wysocki","email":"eb3c82195bc87396d74859a40992e20b7267b462@intel.com"},"message":"Merge branches 'acpica-fixes', 'acpi-pci-fixes' and 'acpi-debug-fixes'\n\n* acpica-fixes:\n  ACPICA: Namespace: Fix namespace/interpreter lock ordering\n\n* acpi-pci-fixes:\n  ACPI,PCI,IRQ: separate ISA penalty calculation\n  Revert \"ACPI, PCI, IRQ: remove redundant code in acpi_irq_penalty_init()\"\n  ACPI,PCI,IRQ: factor in PCI possible\n\n* acpi-debug-fixes:\n  ACPI / debugger: Fix regression introduced by IS_ERR_VALUE() removal","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/b6d90158c935d4a22e56f41647b479ab5ea449d4"},{"sha":"c09230f30876589e246c83a4b4649e60534638cf","author":{"name":"Linus Torvalds","email":"ead7104581934751970e9decb2db5deb20a9e407@linux-foundation.org"},"message":"Merge tag 'pm-4.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"One fix for a recent cpuidle core change that, against all odds,\n  introduced a functional regression on Power systems and the fix for\n  the crash during resume from hibernation on x86-64 that has been in\n  the works for the last few weeks (it actually was ready last week, but\n  I wanted to allow the reporters to test if for some more time).\n\n  Specifics:\n\n   - Fix a recent performance regression on Power systems (powernv and\n     pseries) introduced by a core cpuidle commit that decreased the\n     precision of the last_residency conversion from nano- to\n     microseconds, which should not matter in theory, but turned out to\n     play not-so-well with the special \"snooze\" idle state on Power\n     (Shreyas B Prabhu).\n\n   - Fix a crash during resume from hibernation on x86-64 caused by\n     possible corruption of the kernel text part of page tables in the\n     last phase of image restoration exposed by a security-related\n     change during the 4.3 development cycle (Rafael Wysocki)\"\n\n* tag 'pm-4.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n  cpuidle: Fix last_residency division\n  x86/power/64: Fix kernel text mapping corruption during image restoration","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/c09230f30876589e246c83a4b4649e60534638cf"},{"sha":"7ed18e2d1b6782989eb399ef79a8cc1a1b583b3c","author":{"name":"Linus Torvalds","email":"ead7104581934751970e9decb2db5deb20a9e407@linux-foundation.org"},"message":"Merge tag 'acpi-4.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI fixes from Rafael Wysocki:\n \"All of these fix recent regressions in ACPICA, in the ACPI PCI IRQ\n  management code and in the ACPI AML debugger.\n\n  Specifics:\n\n   - Fix a lock ordering issue in ACPICA introduced by a recent commit\n     that attempted to fix a deadlock in the dynamic table loading code\n     which in turn appeared after changes related to the handling of\n     module-level AML also made in this cycle (Lv Zheng).\n\n   - Fix a recent regression in the ACPI IRQ management code that may\n     cause PCI drivers to be unable to register an IRQ if that IRQ\n     happens to be shared with a device on the ISA bus, like the\n     parallel port, by reverting one commit entirely and restoring the\n     previous behavior in two other places (Sinan Kaya).\n\n   - Fix a recent regression in the ACPI AML debugger introduced by the\n     commit that removed incorrect usage of IS_ERR_VALUE() from multiple\n     places (Lv Zheng)\"\n\n* tag 'acpi-4.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n  ACPI / debugger: Fix regression introduced by IS_ERR_VALUE() removal\n  ACPICA: Namespace: Fix namespace/interpreter lock ordering\n  ACPI,PCI,IRQ: separate ISA penalty calculation\n  Revert \"ACPI, PCI, IRQ: remove redundant code in acpi_irq_penalty_init()\"\n  ACPI,PCI,IRQ: factor in PCI possible","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/7ed18e2d1b6782989eb399ef79a8cc1a1b583b3c"}]}
{"actor":{"display_login":"torvalds"}}