drm: fix use of freed memory in drm_mode_setcrtc
Sasha Levin
maintainerPATCH 1/33 drm: fix use of freed memory in drm_mode_setcrtc
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 064253c1c0625efd0362a0b7ecdbe8bee2a2904d ]
drm_mode_setcrtc() retries modesetting in case one of the functions it calls returns -EDEADLK. connector_set, mode and fb are freed before retrying, but they are not set to NULL. This can cause drm_mode_setcrtc() to use those variables.
For example: On the first try __drm_mode_set_config_internal() returns -EDEADLK. connector_set, mode and fb are freed. Next retry starts, and drm_modeset_lock_all_ctx() returns -EDEADLK, and we jump to 'out'. The code will happily try to release all three again.
This leads to crashes of different kinds, depending on the sequence the EDEADLKs happen.
Fix this by setting the three variables to NULL at the start of the retry loop.
--- drivers/gpu/drm/drm_crtc.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/gpu/drm/drm_crtc.c +7 -3
@@ -560,9 +560,9 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,struct drm_mode_crtc *crtc_req = data;struct drm_crtc *crtc;struct drm_plane *plane; -struct drm_connector **connector_set =NULL , *connector; -struct drm_framebuffer *fb =NULL ; -struct drm_display_mode *mode =NULL ; +struct drm_connector **connector_set, *connector; +struct drm_framebuffer *fb; +struct drm_display_mode *mode;struct drm_mode_set set;uint32_t __user *set_connectors_ptr;struct drm_modeset_acquire_ctx ctx;
@@ -591,6 +591,10 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,mutex_lock (&crtc->dev->mode_config.mutex);drm_modeset_acquire_init (&ctx,DRM_MODESET_ACQUIRE_INTERRUPTIBLE ); retry: + connector_set =NULL ; + fb =NULL ; + mode =NULL ; + ret =drm_modeset_lock_all_ctx (crtc->dev, &ctx);if (ret) goto out;
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 2/33 bpf: do not blindly change rlimit in reuseport net selftest
From: Eric Dumazet <[email protected]>
[ Upstream commit 262f9d811c7608f1e74258ceecfe1fa213bdf912 ]
If the current process has unlimited RLIMIT_MEMLOCK, we should should leave it as is.
--- tools/testing/selftests/net/reuseport_bpf.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
tools/testing/selftests/net/reuseport_bpf.c +9 -4
@@ -437,14 +437,19 @@ void enable_fastopen(void) } } -static struct rlimit rlim_old, rlim_new; +static struct rlimit rlim_old;static __attribute__((constructor))void main_ctor (void ) {getrlimit (RLIMIT_MEMLOCK , &rlim_old); - rlim_new.rlim_cur = rlim_old.rlim_cur + (1UL <<20 ); - rlim_new.rlim_max = rlim_old.rlim_max + (1UL <<20 ); -setrlimit (RLIMIT_MEMLOCK , &rlim_new); + +if (rlim_old.rlim_cur !=RLIM_INFINITY ) { +struct rlimit rlim_new; + + rlim_new.rlim_cur = rlim_old.rlim_cur + (1UL <<20 ); + rlim_new.rlim_max = rlim_old.rlim_max + (1UL <<20 ); +setrlimit (RLIMIT_MEMLOCK , &rlim_new); + } }static __attribute__((destructor))void main_dtor (void )
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 3/33 nvme: remove ns sibling before clearing path
In reply to Sasha LevinFrom: Keith Busch <[email protected]>
[ Upstream commit 48f78be3326052a7718678ff9a78d6d884a50323 ]
The code had been clearing a namespace being deleted as the current path while that namespace was still in the path siblings list. It is possible a new IO could set that namespace back to the current path since it appeared to be an eligable path to select, which may result in a use-after-free error.
This patch ensures a namespace being removed is not eligable to be reset as a current path prior to clearing it as the current path.
--- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/core.c +1 -1
@@ -3119,8 +3119,8 @@ static void nvme_ns_remove(struct nvme_ns *ns) }mutex_lock (&ns->ctrl->subsys->lock); -nvme_mpath_clear_current_path (ns);list_del_rcu (&ns->siblings); +nvme_mpath_clear_current_path (ns);mutex_unlock (&ns->ctrl->subsys->lock);down_write (&ns->ctrl->namespaces_rwsem);
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 4/33 Revert "perf tools: Fix PMU term format max value calculation"
In reply to Sasha LevinFrom: Jiri Olsa <[email protected]>
[ Upstream commit 1b9caa10b31dda0866f4028e4bfb923fb6e4072f ]
This reverts commit ac0e2cd555373ae6f8f3a3ad3fbbf5b6d1e7aaaa.
Michael reported an issue with oversized terms values assignment and I noticed there was actually a misunderstanding of the max value check in the past.
The above commit's changelog says:
If bit 21 is set, there is parsing issues as below.
$ perf stat -a -e uncore_qpi_0/event=0x200002,umask=0x8/
event syntax error: '..pi_0/event=0x200002,umask=0x8/'
\___ value too big for format, maximum is 511But there's no issue there, because the event value is distributed along the value defined by the format. Even if the format defines separated bit, the value is treated as a continual number, which should follow the format definition.
In above case it's 9-bit value with last bit separated:
$ cat uncore_qpi_0/format/event config:0-7,21
Hence the value 0x200002 is correctly reported as format violation, because it exceeds 9 bits. It should have been 0x102 instead, which sets the 9th bit - the bit 21 of the format.
$ perf stat -vv -a -e uncore_qpi_0/event=0x102,umask=0x8/
Using CPUID GenuineIntel-6-2D
...
------------------------------------------------------------
perf_event_attr:
type 10
size 112
config 0x200802
sample_type IDENTIFIER
...--- tools/perf/util/pmu.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
tools/perf/util/pmu.c +7 -6
@@ -936,13 +936,14 @@ static void pmu_format_value(unsigned long *format, __u64 value, __u64 *v,static __u64 pmu_format_max_value (const unsigned long *format) { -__u64 w =0 ; -int fbit; - -for_each_set_bit (fbit, format,PERF_PMU_FORMAT_BITS ) - w |= (1ULL << fbit); +int w; -return w; + w =bitmap_weight (format,PERF_PMU_FORMAT_BITS ); +if (!w) +return 0 ; +if (w <64 ) +return (1ULL << w) -1 ; +return -1 ; }/*
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 5/33 selftests: usbip: add wait after attach and before checking port status
In reply to Sasha LevinFrom: "Shuah Khan (Samsung OSG)" <[email protected]>
[ Upstream commit 4b0aaacee51eb6592a03fdefd5ce97558518e291 ]
Add sleep between attach and "usbip port" check to make sure status is updated. Running attach and query back shows incorrect status.
--- tools/testing/selftests/drivers/usb/usbip/usbip_test.sh | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/drivers/usb/usbip/usbip_test.sh +4 -0
@@ -143,6 +143,10 @@ echo "Import devices from localhost - should work" src/usbip attach -r localhost -b $busid; echo "==============================================================" +# Wait for sysfs file to be updated. Without this sleep, usbip port +# shows no imported devices. +sleep 3; + echo "List imported devices - expect to see imported devices"; src/usbip port; echo "=============================================================="
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 6/33 net/mlx5: Fix memory leak when setting fpga ipsec caps
In reply to Sasha LevinFrom: Talat Batheesh <[email protected]>
[ Upstream commit fd7e848077c1a466b9187537adce16658f7cb94b ]
Allocated memory for context should be freed once finished working with it.
--- drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c +4 -5
@@ -245,7 +245,7 @@ static void *mlx5_fpga_ipsec_cmd_exec(struct mlx5_core_dev *mdev,return ERR_PTR (res); } -/* Context will be freed by wait func after completion */ +/* Context should be freed by the caller after completion. */ return context; }
@@ -418,10 +418,8 @@ static int mlx5_fpga_ipsec_set_caps(struct mlx5_core_dev *mdev, u32 flags) cmd.cmd =htonl (MLX5_FPGA_IPSEC_CMD_OP_SET_CAP ); cmd.flags =htonl (flags); context =mlx5_fpga_ipsec_cmd_exec (mdev, &cmd,sizeof (cmd)); -if (IS_ERR (context)) { - err =PTR_ERR (context); - goto out; - } +if (IS_ERR (context)) +return PTR_ERR (context); err =mlx5_fpga_ipsec_cmd_wait (context);if (err)
@@ -435,6 +433,7 @@ static int mlx5_fpga_ipsec_set_caps(struct mlx5_core_dev *mdev, u32 flags) } out: +kfree (context);return err; }
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 7/33 net/mlx5: Take only bit 24-26 of wqe.pftype_wq for page fault type
In reply to Sasha LevinFrom: Huy Nguyen <[email protected]>
[ Upstream commit a48bc513159d4767f9988f0d857b2b0c38a4d614 ]
The HW spec defines only bits 24-26 of pftype_wq as the page fault type, use the required mask to ensure that.
--- drivers/net/ethernet/mellanox/mlx5/core/eq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/eq.c +1 -1
@@ -269,7 +269,7 @@ static void eq_pf_process(struct mlx5_eq *eq)case MLX5_PFAULT_SUBTYPE_WQE :/* WQE based event */ pfault->type = -be32_to_cpu (pf_eqe->wqe.pftype_wq) >>24 ; + (be32_to_cpu (pf_eqe->wqe.pftype_wq) >>24 ) &0x7 ; pfault->token =be32_to_cpu (pf_eqe->wqe.token); pfault->wqe.wq_num =
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 8/33 net/mlx5: WQ, fixes for fragmented WQ buffers API
In reply to Sasha LevinFrom: Tariq Toukan <[email protected]>
[ Upstream commit 37fdffb217a45609edccbb8b407d031143f551c0 ]
mlx5e netdevice used to calculate fragment edges by a call to mlx5_wq_cyc_get_frag_size(). This calculation did not give the correct indication for queues smaller than a PAGE_SIZE, (broken by default on PowerPC, where PAGE_SIZE == 64KB). Here it is replaced by the correct new calls/API.
Since (TX/RX) Work Queues buffers are fragmented, here we introduce changes to the API in core driver, so that it gets a stride index and returns the index of last stride on same fragment, and an additional wrapping function that returns the number of physically contiguous strides that can be written contiguously to the work queue.
This obsoletes the following API functions, and their buggy usage in EN driver:
* mlx5_wq_cyc_get_frag_size()
* mlx5_wq_cyc_ctr2fragix()
The new API improves modularity and hides the details of such calculation for mlx5e netdevice and mlx5_ib rdma drivers.
New calculation is also more efficient, and improves performance as follows:
Packet rate test: pktgen, UDP / IPv4, 64byte, single ring, 8K ring size.
Before: 16,477,619 pps After: 17,085,793 pps
3.7% improvement
--- .../net/ethernet/mellanox/mlx5/core/en_rx.c | 12 +++++----- .../net/ethernet/mellanox/mlx5/core/en_tx.c | 22 +++++++++---------- .../ethernet/mellanox/mlx5/core/ipoib/ipoib.h | 5 ++--- drivers/net/ethernet/mellanox/mlx5/core/wq.c | 5 ----- drivers/net/ethernet/mellanox/mlx5/core/wq.h | 11 +++++----- include/linux/mlx5/driver.h | 8 +++++++ 6 files changed, 31 insertions(+), 32 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +5 -7
@@ -429,10 +429,9 @@ static inline u16 mlx5e_icosq_wrap_cnt(struct mlx5e_icosq *sq)static inline void mlx5e_fill_icosq_frag_edge (struct mlx5e_icosq *sq,struct mlx5_wq_cyc *wq, -u16 pi,u16 frag_pi) +u16 pi,u16 nnops) {struct mlx5e_sq_wqe_info *edge_wi, *wi = &sq->db.ico_wqe[pi]; -u8 nnops =mlx5_wq_cyc_get_frag_size (wq) - frag_pi; edge_wi = wi + nnops;
@@ -451,15 +450,14 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix)struct mlx5_wq_cyc *wq = &sq->wq;struct mlx5e_umr_wqe *umr_wqe;u16 xlt_offset = ix << (MLX5E_LOG_ALIGNED_MPWQE_PPW -1 ); -u16 pi, frag_pi; +u16 pi, contig_wqebbs_room;int err;int i; pi =mlx5_wq_cyc_ctr2ix (wq, sq->pc); - frag_pi =mlx5_wq_cyc_ctr2fragix (wq, sq->pc); - -if (unlikely (frag_pi +MLX5E_UMR_WQEBBS >mlx5_wq_cyc_get_frag_size (wq))) { -mlx5e_fill_icosq_frag_edge (sq, wq, pi, frag_pi); + contig_wqebbs_room =mlx5_wq_cyc_get_contig_wqebbs (wq, pi); +if (unlikely (contig_wqebbs_room <MLX5E_UMR_WQEBBS )) { +mlx5e_fill_icosq_frag_edge (sq, wq, pi, contig_wqebbs_room); pi =mlx5_wq_cyc_ctr2ix (wq, sq->pc); }
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +11 -11
@@ -287,10 +287,9 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb,static inline void mlx5e_fill_sq_frag_edge (struct mlx5e_txqsq *sq,struct mlx5_wq_cyc *wq, -u16 pi,u16 frag_pi) +u16 pi,u16 nnops) {struct mlx5e_tx_wqe_info *edge_wi, *wi = &sq->db.wqe_info[pi]; -u8 nnops =mlx5_wq_cyc_get_frag_size (wq) - frag_pi; edge_wi = wi + nnops;
@@ -345,8 +344,8 @@ netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,struct mlx5e_tx_wqe_info *wi;struct mlx5e_sq_stats *stats = sq->stats; +u16 headlen, ihs, contig_wqebbs_room;u16 ds_cnt, ds_cnt_inl =0 ; -u16 headlen, ihs, frag_pi;u8 num_wqebbs, opcode;u32 num_bytes;int num_dma;
@@ -383,9 +382,9 @@ netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb, } num_wqebbs =DIV_ROUND_UP (ds_cnt,MLX5_SEND_WQEBB_NUM_DS ); - frag_pi =mlx5_wq_cyc_ctr2fragix (wq, sq->pc); -if (unlikely (frag_pi + num_wqebbs >mlx5_wq_cyc_get_frag_size (wq))) { -mlx5e_fill_sq_frag_edge (sq, wq, pi, frag_pi); + contig_wqebbs_room =mlx5_wq_cyc_get_contig_wqebbs (wq, pi); +if (unlikely (contig_wqebbs_room < num_wqebbs)) { +mlx5e_fill_sq_frag_edge (sq, wq, pi, contig_wqebbs_room);mlx5e_sq_fetch_wqe (sq, &wqe, &pi); }
@@ -629,7 +628,7 @@ netdev_tx_t mlx5i_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,struct mlx5e_tx_wqe_info *wi;struct mlx5e_sq_stats *stats = sq->stats; -u16 headlen, ihs, pi, frag_pi; +u16 headlen, ihs, pi, contig_wqebbs_room;u16 ds_cnt, ds_cnt_inl =0 ;u8 num_wqebbs, opcode;u32 num_bytes;
@@ -665,13 +664,14 @@ netdev_tx_t mlx5i_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb, } num_wqebbs =DIV_ROUND_UP (ds_cnt,MLX5_SEND_WQEBB_NUM_DS ); - frag_pi =mlx5_wq_cyc_ctr2fragix (wq, sq->pc); -if (unlikely (frag_pi + num_wqebbs >mlx5_wq_cyc_get_frag_size (wq))) { + pi =mlx5_wq_cyc_ctr2ix (wq, sq->pc); + contig_wqebbs_room =mlx5_wq_cyc_get_contig_wqebbs (wq, pi); +if (unlikely (contig_wqebbs_room < num_wqebbs)) { +mlx5e_fill_sq_frag_edge (sq, wq, pi, contig_wqebbs_room); pi =mlx5_wq_cyc_ctr2ix (wq, sq->pc); -mlx5e_fill_sq_frag_edge (sq, wq, pi, frag_pi); } -mlx5i_sq_fetch_wqe (sq, &wqe, &pi); +mlx5i_sq_fetch_wqe (sq, &wqe, pi);/* fill wqe */ wi = &sq->db.wqe_info[pi];
drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.h +2 -3
@@ -109,12 +109,11 @@ struct mlx5i_tx_wqe {static inline void mlx5i_sq_fetch_wqe (struct mlx5e_txqsq *sq,struct mlx5i_tx_wqe **wqe, -u16 *pi) +u16 pi) {struct mlx5_wq_cyc *wq = &sq->wq; - *pi =mlx5_wq_cyc_ctr2ix (wq, sq->pc); - *wqe =mlx5_wq_cyc_get_wqe (wq, *pi); + *wqe =mlx5_wq_cyc_get_wqe (wq, pi);memset (*wqe,0 ,sizeof (**wqe)); }
drivers/net/ethernet/mellanox/mlx5/core/wq.c +0 -5
@@ -39,11 +39,6 @@ u32 mlx5_wq_cyc_get_size(struct mlx5_wq_cyc *wq)return (u32 )wq->fbc.sz_m1 +1 ; } -u16 mlx5_wq_cyc_get_frag_size (struct mlx5_wq_cyc *wq) -{ -return wq->fbc.frag_sz_m1 +1 ; -} -u32 mlx5_cqwq_get_size (struct mlx5_cqwq *wq) {return wq->fbc.sz_m1 +1 ;
drivers/net/ethernet/mellanox/mlx5/core/wq.h +5 -6
@@ -80,7 +80,6 @@ int mlx5_wq_cyc_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param, void *wqc, struct mlx5_wq_cyc *wq, struct mlx5_wq_ctrl *wq_ctrl);u32 mlx5_wq_cyc_get_size (struct mlx5_wq_cyc *wq); -u16 mlx5_wq_cyc_get_frag_size (struct mlx5_wq_cyc *wq); int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param, void *qpc, struct mlx5_wq_qp *wq,
@@ -140,11 +139,6 @@ static inline u16 mlx5_wq_cyc_ctr2ix(struct mlx5_wq_cyc *wq, u16 ctr)return ctr & wq->fbc.sz_m1; } -static inline u16 mlx5_wq_cyc_ctr2fragix (struct mlx5_wq_cyc *wq,u16 ctr) -{ -return ctr & wq->fbc.frag_sz_m1; -} -static inline u16 mlx5_wq_cyc_get_head (struct mlx5_wq_cyc *wq) {return mlx5_wq_cyc_ctr2ix (wq, wq->wqe_ctr);
@@ -160,6 +154,11 @@ static inline void *mlx5_wq_cyc_get_wqe(struct mlx5_wq_cyc *wq, u16 ix)return mlx5_frag_buf_get_wqe (&wq->fbc, ix); } +static inline u16 mlx5_wq_cyc_get_contig_wqebbs (struct mlx5_wq_cyc *wq,u16 ix) +{ +return mlx5_frag_buf_get_idx_last_contig_stride (&wq->fbc, ix) - ix +1 ; +} +static inline int mlx5_wq_cyc_cc_bigger (u16 cc1,u16 cc2) {int equal = (cc1 == cc2);
include/linux/mlx5/driver.h +8 -0
@@ -1022,6 +1022,14 @@ static inline void *mlx5_frag_buf_get_wqe(struct mlx5_frag_buf_ctrl *fbc, ((fbc->frag_sz_m1 & ix) << fbc->log_stride); } +static inline u32 +mlx5_frag_buf_get_idx_last_contig_stride (struct mlx5_frag_buf_ctrl *fbc,u32 ix) +{ +u32 last_frag_stride_idx = (ix + fbc->strides_offset) | fbc->frag_sz_m1; + +return min_t (u32, last_frag_stride_idx - fbc->strides_offset, fbc->sz_m1); +} +int mlx5_cmd_init (struct mlx5_core_dev *dev);void mlx5_cmd_cleanup (struct mlx5_core_dev *dev);void mlx5_cmd_use_events (struct mlx5_core_dev *dev);
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 9/33 xsk: do not call synchronize_net() under RCU read lock
In reply to Sasha LevinFrom: Björn Töpel <[email protected]>
[ Upstream commit cee271678d0e3177a25d0fcb2fa5e051d48e4262 ]
The XSKMAP update and delete functions called synchronize_net(), which can sleep. It is not allowed to sleep during an RCU read section.
Instead we need to make sure that the sock sk_destruct (xsk_destruct) function is asynchronously called after an RCU grace period. Setting the SOCK_RCU_FREE flag for XDP sockets takes care of this.
--- kernel/bpf/xskmap.c | 10 ++-------- net/xdp/xsk.c | 2 ++ 2 files changed, 4 insertions(+), 8 deletions(-)
kernel/bpf/xskmap.c +2 -8
@@ -191,11 +191,8 @@ static int xsk_map_update_elem(struct bpf_map *map, void *key, void *value,sock_hold (sock->sk); old_xs =xchg (&m->xsk_map[i], xs); -if (old_xs) { -/* Make sure we've flushed everything. */ -synchronize_net (); +if (old_xs)sock_put ((struct sock *)old_xs); - }sockfd_put (sock);return 0 ;
@@ -211,11 +208,8 @@ static int xsk_map_delete_elem(struct bpf_map *map, void *key)return -EINVAL ; old_xs =xchg (&m->xsk_map[k],NULL ); -if (old_xs) { -/* Make sure we've flushed everything. */ -synchronize_net (); +if (old_xs)sock_put ((struct sock *)old_xs); - }return 0 ; }
net/xdp/xsk.c +2 -0
@@ -744,6 +744,8 @@ static int xsk_create(struct net *net, struct socket *sock, int protocol, sk->sk_destruct = xsk_destruct;sk_refcnt_debug_inc (sk); +sock_set_flag (sk,SOCK_RCU_FREE ); + xs =xdp_sk (sk);mutex_init (&xs->mutex);spin_lock_init (&xs->tx_completion_lock);
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 10/33 xfrm: policy: use hlist rcu variants on insert
In reply to Sasha LevinFrom: Florian Westphal <[email protected]>
[ Upstream commit 9dffff200fd178f11dd50eb1fd8ccd0650c9284e ]
bydst table/list lookups use rcu, so insertions must use rcu versions.
--- net/xfrm/xfrm_policy.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/xfrm/xfrm_policy.c +4 -4
@@ -625,9 +625,9 @@ static void xfrm_hash_rebuild(struct work_struct *work)break ; }if (newpos) -hlist_add_behind (&policy->bydst, newpos); +hlist_add_behind_rcu (&policy->bydst, newpos);else -hlist_add_head (&policy->bydst, chain); +hlist_add_head_rcu (&policy->bydst, chain); }spin_unlock_bh (&net->xfrm.xfrm_policy_lock);
@@ -766,9 +766,9 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)break ; }if (newpos) -hlist_add_behind (&policy->bydst, newpos); +hlist_add_behind_rcu (&policy->bydst, newpos);else -hlist_add_head (&policy->bydst, chain); +hlist_add_head_rcu (&policy->bydst, chain);__xfrm_policy_link (policy, dir);/* After previous checking, family can either be AF_INET or AF_INET6 */
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 11/33 perf vendor events intel: Fix wrong filter_band* values for uncore events
In reply to Sasha LevinFrom: Jiri Olsa <[email protected]>
[ Upstream commit 94aafb74cee0002e2f2eb6dc5376f54d5951ab4d ]
Michael reported that he could not stat following event:
$ perf stat -e unc_p_freq_ge_1200mhz_cycles -a -- ls
event syntax error: '..e_1200mhz_cycles'
\___ value too big for format, maximum is 255
Run 'perf list' for a list of valid eventsThe event is unwrapped into:
uncore_pcu/event=0xb,filter_band0=1200/
where filter_band0 format says it's one byte only:
# cat uncore_pcu/format/filter_band0 config1:0-7
while JSON files specifies bigger number:
"Filter": "filter_band0=1200",
all the filter_band* formats show 1 byte width:
# cat uncore_pcu/format/filter_band1 config1:8-15 # cat uncore_pcu/format/filter_band2 config1:16-23 # cat uncore_pcu/format/filter_band3 config1:24-31
The reason of the issue is that filter_band* values are supposed to be in 100Mhz units.. it's stated in the JSON help for the events, like:
filter_band3=XXX, with XXX in 100Mhz units
This patch divides the filter_band* values by 100, plus there's couple of changes that actually change the number completely, like:
- "Filter": "edge=1,filter_band2=4000",
+ "Filter": "edge=1,filter_band2=30",
--- .../arch/x86/ivytown/uncore-power.json | 16 ++++++++-------- .../arch/x86/jaketown/uncore-power.json | 16 ++++++++-------- 2 files changed, 16 insertions(+), 16 deletions(-)
tools/perf/pmu-events/arch/x86/ivytown/uncore-power.json +8 -8
@@ -188,7 +188,7 @@ "Counter": "0,1,2,3", "EventCode": "0xb", "EventName": "UNC_P_FREQ_GE_1200MHZ_CYCLES", - "Filter": "filter_band0=1200", + "Filter": "filter_band0=12", "MetricExpr": "(UNC_P_FREQ_GE_1200MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_1200mhz_cycles %", "PerPkg": "1",
@@ -199,7 +199,7 @@ "Counter": "0,1,2,3", "EventCode": "0xc", "EventName": "UNC_P_FREQ_GE_2000MHZ_CYCLES", - "Filter": "filter_band1=2000", + "Filter": "filter_band1=20", "MetricExpr": "(UNC_P_FREQ_GE_2000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_2000mhz_cycles %", "PerPkg": "1",
@@ -210,7 +210,7 @@ "Counter": "0,1,2,3", "EventCode": "0xd", "EventName": "UNC_P_FREQ_GE_3000MHZ_CYCLES", - "Filter": "filter_band2=3000", + "Filter": "filter_band2=30", "MetricExpr": "(UNC_P_FREQ_GE_3000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_3000mhz_cycles %", "PerPkg": "1",
@@ -221,7 +221,7 @@ "Counter": "0,1,2,3", "EventCode": "0xe", "EventName": "UNC_P_FREQ_GE_4000MHZ_CYCLES", - "Filter": "filter_band3=4000", + "Filter": "filter_band3=40", "MetricExpr": "(UNC_P_FREQ_GE_4000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_4000mhz_cycles %", "PerPkg": "1",
@@ -232,7 +232,7 @@ "Counter": "0,1,2,3", "EventCode": "0xb", "EventName": "UNC_P_FREQ_GE_1200MHZ_TRANSITIONS", - "Filter": "edge=1,filter_band0=1200", + "Filter": "edge=1,filter_band0=12", "MetricExpr": "(UNC_P_FREQ_GE_1200MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_1200mhz_cycles %", "PerPkg": "1",
@@ -243,7 +243,7 @@ "Counter": "0,1,2,3", "EventCode": "0xc", "EventName": "UNC_P_FREQ_GE_2000MHZ_TRANSITIONS", - "Filter": "edge=1,filter_band1=2000", + "Filter": "edge=1,filter_band1=20", "MetricExpr": "(UNC_P_FREQ_GE_2000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_2000mhz_cycles %", "PerPkg": "1",
@@ -254,7 +254,7 @@ "Counter": "0,1,2,3", "EventCode": "0xd", "EventName": "UNC_P_FREQ_GE_3000MHZ_TRANSITIONS", - "Filter": "edge=1,filter_band2=4000", + "Filter": "edge=1,filter_band2=30", "MetricExpr": "(UNC_P_FREQ_GE_3000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_3000mhz_cycles %", "PerPkg": "1",
@@ -265,7 +265,7 @@ "Counter": "0,1,2,3", "EventCode": "0xe", "EventName": "UNC_P_FREQ_GE_4000MHZ_TRANSITIONS", - "Filter": "edge=1,filter_band3=4000", + "Filter": "edge=1,filter_band3=40", "MetricExpr": "(UNC_P_FREQ_GE_4000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_4000mhz_cycles %", "PerPkg": "1",
tools/perf/pmu-events/arch/x86/jaketown/uncore-power.json +8 -8
@@ -187,7 +187,7 @@ "Counter": "0,1,2,3", "EventCode": "0xb", "EventName": "UNC_P_FREQ_GE_1200MHZ_CYCLES", - "Filter": "filter_band0=1200", + "Filter": "filter_band0=12", "MetricExpr": "(UNC_P_FREQ_GE_1200MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_1200mhz_cycles %", "PerPkg": "1",
@@ -198,7 +198,7 @@ "Counter": "0,1,2,3", "EventCode": "0xc", "EventName": "UNC_P_FREQ_GE_2000MHZ_CYCLES", - "Filter": "filter_band1=2000", + "Filter": "filter_band1=20", "MetricExpr": "(UNC_P_FREQ_GE_2000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_2000mhz_cycles %", "PerPkg": "1",
@@ -209,7 +209,7 @@ "Counter": "0,1,2,3", "EventCode": "0xd", "EventName": "UNC_P_FREQ_GE_3000MHZ_CYCLES", - "Filter": "filter_band2=3000", + "Filter": "filter_band2=30", "MetricExpr": "(UNC_P_FREQ_GE_3000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_3000mhz_cycles %", "PerPkg": "1",
@@ -220,7 +220,7 @@ "Counter": "0,1,2,3", "EventCode": "0xe", "EventName": "UNC_P_FREQ_GE_4000MHZ_CYCLES", - "Filter": "filter_band3=4000", + "Filter": "filter_band3=40", "MetricExpr": "(UNC_P_FREQ_GE_4000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_4000mhz_cycles %", "PerPkg": "1",
@@ -231,7 +231,7 @@ "Counter": "0,1,2,3", "EventCode": "0xb", "EventName": "UNC_P_FREQ_GE_1200MHZ_TRANSITIONS", - "Filter": "edge=1,filter_band0=1200", + "Filter": "edge=1,filter_band0=12", "MetricExpr": "(UNC_P_FREQ_GE_1200MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_1200mhz_cycles %", "PerPkg": "1",
@@ -242,7 +242,7 @@ "Counter": "0,1,2,3", "EventCode": "0xc", "EventName": "UNC_P_FREQ_GE_2000MHZ_TRANSITIONS", - "Filter": "edge=1,filter_band1=2000", + "Filter": "edge=1,filter_band1=20", "MetricExpr": "(UNC_P_FREQ_GE_2000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_2000mhz_cycles %", "PerPkg": "1",
@@ -253,7 +253,7 @@ "Counter": "0,1,2,3", "EventCode": "0xd", "EventName": "UNC_P_FREQ_GE_3000MHZ_TRANSITIONS", - "Filter": "edge=1,filter_band2=4000", + "Filter": "edge=1,filter_band2=30", "MetricExpr": "(UNC_P_FREQ_GE_3000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_3000mhz_cycles %", "PerPkg": "1",
@@ -264,7 +264,7 @@ "Counter": "0,1,2,3", "EventCode": "0xe", "EventName": "UNC_P_FREQ_GE_4000MHZ_TRANSITIONS", - "Filter": "edge=1,filter_band3=4000", + "Filter": "edge=1,filter_band3=40", "MetricExpr": "(UNC_P_FREQ_GE_4000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.", "MetricName": "freq_ge_4000mhz_cycles %", "PerPkg": "1",
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 12/33 sparc: Fix single-pcr perf event counter management.
In reply to Sasha LevinFrom: "David S. Miller" <[email protected]>
[ Upstream commit cfdc3170d214046b9509183fe9b9544dc644d40b ]
It is important to clear the hw->state value for non-stopped events when they are added into the PMU. Otherwise when the event is scheduled out, we won't read the counter because HES_UPTODATE is still set. This breaks 'perf stat' and similar use cases, causing all the events to show zero.
This worked for multi-pcr because we make explicit sparc_pmu_start() calls in calculate_multiple_pcrs(). calculate_single_pcr() doesn't do this because the idea there is to accumulate all of the counter settings into the single pcr value. So we have to add explicit hw->state handling there.
Like x86, we use the PERF_HES_ARCH bit to track truly stopped events so that we don't accidently start them on a reload.
Related to all of this, sparc_pmu_start() is missing a userpage update so add it.
--- arch/sparc/kernel/perf_event.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
arch/sparc/kernel/perf_event.c +13 -4
@@ -927,6 +927,8 @@ static void read_in_all_counters(struct cpu_hw_events *cpuc)sparc_perf_event_update (cp, &cp->hw, cpuc->current_idx[i]); cpuc->current_idx[i] =PIC_NO_INDEX ; +if (cp->hw.state &PERF_HES_STOPPED ) + cp->hw.state |=PERF_HES_ARCH ; } } }
@@ -959,10 +961,12 @@ static void calculate_single_pcr(struct cpu_hw_events *cpuc) enc =perf_event_get_enc (cpuc->events[i]); cpuc->pcr[0 ] &= ~mask_for_index (idx); -if (hwc->state &PERF_HES_STOPPED ) +if (hwc->state &PERF_HES_ARCH ) { cpuc->pcr[0 ] |=nop_for_index (idx); -else + }else { cpuc->pcr[0 ] |=event_encoding (enc, idx); + hwc->state =0 ; + } } out: cpuc->pcr[0 ] |= cpuc->event[0 ]->hw.config_base;
@@ -988,6 +992,9 @@ static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc) cpuc->current_idx[i] = idx; +if (cp->hw.state &PERF_HES_ARCH ) +continue ; +sparc_pmu_start (cp,PERF_EF_RELOAD ); } out:
@@ -1079,6 +1086,8 @@ static void sparc_pmu_start(struct perf_event *event, int flags) event->hw.state =0 ;sparc_pmu_enable_event (cpuc, &event->hw, idx); + +perf_event_update_userpage (event); }static void sparc_pmu_stop (struct perf_event *event,int flags)
@@ -1371,9 +1380,9 @@ static int sparc_pmu_add(struct perf_event *event, int ef_flags) cpuc->events[n0] = event->hw.event_base; cpuc->current_idx[n0] =PIC_NO_INDEX ; - event->hw.state =PERF_HES_UPTODATE ; + event->hw.state =PERF_HES_UPTODATE |PERF_HES_STOPPED ;if (!(ef_flags &PERF_EF_START )) - event->hw.state |=PERF_HES_STOPPED ; + event->hw.state |=PERF_HES_ARCH ;/* * If group events scheduling transaction was started,
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 13/33 sparc: Throttle perf events properly.
In reply to Sasha LevinFrom: "David S. Miller" <[email protected]>
[ Upstream commit 455adb3174d2c8518cef1a61140c211f6ac224d2 ]
Like x86 and arm, call perf_sample_event_took() in perf event NMI interrupt handler.
--- arch/sparc/kernel/perf_event.c | 9 +++++++++ 1 file changed, 9 insertions(+)
arch/sparc/kernel/perf_event.c +9 -0
@@ -24,6 +24,7 @@#include <asm/cpudata.h> #include <linux/uaccess.h> #include <linux/atomic.h> +#include <linux/sched/clock.h> #include <asm/nmi.h> #include <asm/pcr.h> #include <asm/cacheflush.h>
@@ -1612,6 +1613,8 @@ static int __kprobes perf_event_nmi_handler(struct notifier_block *self,struct perf_sample_data data;struct cpu_hw_events *cpuc;struct pt_regs *regs; +u64 finish_clock; +u64 start_clock;int i;if (!atomic_read (&active_events))
@@ -1625,6 +1628,8 @@ static int __kprobes perf_event_nmi_handler(struct notifier_block *self,return NOTIFY_DONE ; } + start_clock =sched_clock (); + regs = args->regs; cpuc =this_cpu_ptr (&cpu_hw_events);
@@ -1663,6 +1668,10 @@ static int __kprobes perf_event_nmi_handler(struct notifier_block *self,sparc_pmu_stop (event,0 ); } + finish_clock =sched_clock (); + +perf_sample_event_took (finish_clock - start_clock); +return NOTIFY_STOP ; }
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 14/33 sparc64: Make proc_id signed.
In reply to Sasha LevinFrom: "David S. Miller" <[email protected]>
[ Upstream commit b3e1eb8e7ac9aaa283989496651d99267c4cad6c ]
So that when it is unset, ie. '-1', userspace can see it properly.
--- arch/sparc/include/asm/cpudata_64.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sparc/include/asm/cpudata_64.h +1 -1
@@ -28,7 +28,7 @@ typedef struct {unsigned short sock_id;/* physical package */ unsigned short core_id;unsigned short max_cache_id;/* groupings of highest shared cache */ -unsigned short proc_id;/* strand (aka HW thread) id */ +signed short proc_id;/* strand (aka HW thread) id */ } cpuinfo_sparc;DECLARE_PER_CPU (cpuinfo_sparc, __cpu_data);
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 15/33 r8169: Enable MSI-X on RTL8106e
In reply to Sasha LevinFrom: Jian-Hong Pan <[email protected]>
[ Upstream commit d49c88d7677ba737e9d2759a87db0402d5ab2607 ]
Originally, we have an issue where r8169 MSI-X interrupt is broken after S3 suspend/resume on RTL8106e of ASUS X441UAR.
02:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd. RTL8101/2/6E PCI Express Fast/Gigabit Ethernet controller [10ec:8136] (rev 07)
Subsystem: ASUSTeK Computer Inc. RTL810xE PCI Express Fast
Ethernet controller [1043:200f]
Flags: bus master, fast devsel, latency 0, IRQ 16 I/O ports at e000 [size=256]
Memory at ef100000 (64-bit, non-prefetchable) [size=4K] Memory at e0000000 (64-bit, prefetchable) [size=16K]
Capabilities: [40] Power Management version 3
Capabilities: [50] MSI: Enable- Count=1/1 Maskable- 64bit+
Capabilities: [70] Express Endpoint, MSI 01
Capabilities: [b0] MSI-X: Enable+ Count=4 Masked-
Capabilities: [d0] Vital Product Data
Capabilities: [100] Advanced Error Reporting
Capabilities: [140] Virtual Channel
Capabilities: [160] Device Serial Number 01-00-00-00-36-4c-e0-00
Capabilities: [170] Latency Tolerance Reporting Kernel driver in use: r8169
Kernel modules: r8169
We found the all of the values in PCI BAR=4 of the ethernet adapter become 0xFF after system resumes. That breaks the MSI-X interrupt. Therefore, we can only fall back to MSI interrupt to fix the issue at that time.
However, there is a commit which resolves the drivers getting nothing in PCI BAR=4 after system resumes. It is 04cb3ae895d7 "PCI: Reprogram bridge prefetch registers on resume" by Daniel Drake.
After apply the patch, the ethernet adapter works fine before suspend and after resume. So, we can revert the workaround after the commit "PCI: Reprogram bridge prefetch registers on resume" is merged into main tree.
This patch reverts commit 7bb05b85bc2d1a1b647b91424b2ed4a18e6ecd81 "r8169: don't use MSI-X on RTL8106e".
--- drivers/net/ethernet/realtek/r8169.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/net/ethernet/realtek/r8169.c +3 -6
@@ -7541,20 +7541,17 @@ static int rtl_alloc_irq(struct rtl8169_private *tp) {unsigned int flags; -switch (tp->mac_version) { - case RTL_GIGA_MAC_VER_01 ... RTL_GIGA_MAC_VER_06: +if (tp->mac_version <=RTL_GIGA_MAC_VER_06 ) {RTL_W8 (tp, Cfg9346, Cfg9346_Unlock);RTL_W8 (tp, Config2,RTL_R8 (tp, Config2) & ~MSIEnable);RTL_W8 (tp, Cfg9346, Cfg9346_Lock); flags =PCI_IRQ_LEGACY ; -break ; - case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_40: + }else if (tp->mac_version ==RTL_GIGA_MAC_VER_40 ) {/* This version was reported to have issues with resume * from suspend when using MSI-X */ flags =PCI_IRQ_LEGACY |PCI_IRQ_MSI ; -break ; -default : + }else { flags =PCI_IRQ_ALL_TYPES ; }
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 16/33 net: bcmgenet: Poll internal PHY for GENETv5
In reply to Sasha LevinFrom: Florian Fainelli <[email protected]>
[ Upstream commit 64bd9c8135751b561f27edaaffe93d07093f81af ]
On GENETv5, there is a hardware issue which prevents the GENET hardware from generating a link UP interrupt when the link is operating at 10Mbits/sec. Since we do not have any way to configure the link detection logic, fallback to polling in that case.
--- drivers/net/ethernet/broadcom/genet/bcmmii.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmmii.c +5 -2
@@ -321,9 +321,12 @@ int bcmgenet_mii_probe(struct net_device *dev) phydev->advertising = phydev->supported;/* The internal PHY has its link interrupts routed to the -* Ethernet MAC ISRs +* Ethernet MAC ISRs. On GENETv5 there is a hardware issue +* that prevents the signaling of link UP interrupts when +* the link operates at 10Mbps, so fallback to polling for +* those versions of GENET. */ -if (priv->internal_phy) +if (priv->internal_phy && !GENET_IS_V5 (priv)) dev->phydev->irq =PHY_IGNORE_INTERRUPT ;return 0 ;
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 17/33 net: fec: don't dump RX FIFO register when not available
In reply to Sasha LevinFrom: Fugang Duan <[email protected]>
[ Upstream commit ec20a63aa8b8ec3223fb25cdb2a49f9f9dfda88c ]
Commit db65f35f50e0 ("net: fec: add support of ethtool get_regs") introduce ethool "--register-dump" interface to dump all FEC registers.
But not all silicon implementations of the Freescale FEC hardware module have the FRBR (FIFO Receive Bound Register) and FRSR (FIFO Receive Start Register) register, so we should not be trying to dump them on those that don't.
To fix it we create a quirk flag, FEC_QUIRK_HAS_RFREG, and check it before dump those RX FIFO registers.
--- drivers/net/ethernet/freescale/fec.h | 4 ++++ drivers/net/ethernet/freescale/fec_main.c | 16 ++++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-)
drivers/net/ethernet/freescale/fec.h +4 -0
@@ -452,6 +452,10 @@ struct bufdesc_ex {* initialisation. */ #define FEC_QUIRK_MIB_CLEAR (1 << 15) +/* Only i.MX25/i.MX27/i.MX28 controller supports FRBR,FRSR registers, +* those FIFO receive registers are resolved in other platforms. +*/ +#define FEC_QUIRK_HAS_FRREG (1 << 16)struct bufdesc_prop {int qid;
drivers/net/ethernet/freescale/fec_main.c +12 -4
@@ -90,14 +90,16 @@ static struct platform_device_id fec_devtype[] = { .driver_data = 0, }, { .name = "imx25-fec", - .driver_data = FEC_QUIRK_USE_GASKET | FEC_QUIRK_MIB_CLEAR, + .driver_data = FEC_QUIRK_USE_GASKET | FEC_QUIRK_MIB_CLEAR | + FEC_QUIRK_HAS_FRREG, }, { .name = "imx27-fec", - .driver_data = FEC_QUIRK_MIB_CLEAR, + .driver_data = FEC_QUIRK_MIB_CLEAR | FEC_QUIRK_HAS_FRREG, }, { .name = "imx28-fec", .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_SWAP_FRAME | - FEC_QUIRK_SINGLE_MDIO | FEC_QUIRK_HAS_RACC, + FEC_QUIRK_SINGLE_MDIO | FEC_QUIRK_HAS_RACC | + FEC_QUIRK_HAS_FRREG, }, { .name = "imx6q-fec", .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
@@ -2163,7 +2165,13 @@ static void fec_enet_get_regs(struct net_device *ndev,memset (buf,0 , regs->len);for (i =0 ; i <ARRAY_SIZE (fec_enet_register_offset); i++) { - off = fec_enet_register_offset[i] /4 ; + off = fec_enet_register_offset[i]; + +if ((off ==FEC_R_BOUND || off ==FEC_R_FSTART ) && + !(fep->quirks &FEC_QUIRK_HAS_FRREG )) +continue ; + + off >>=2 ; buf[off] =readl (&theregs[off]); } }
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 18/33 nfp: flower: fix pedit set actions for multiple partial masks
In reply to Sasha LevinFrom: Pieter Jansen van Vuuren <[email protected]>
[ Upstream commit 8913806f166e47c6b3fe8253e9cfb9caabe64341 ]
Previously we did not correctly change headers when using multiple pedit actions with partial masks. We now take this into account and no longer just commit the last pedit action.
--- .../net/ethernet/netronome/nfp/flower/action.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/net/ethernet/netronome/nfp/flower/action.c +9 -6
@@ -314,12 +314,14 @@ nfp_fl_set_ip4(const struct tc_action *action, int idx, u32 off,switch (off) {case offsetof(struct iphdr , daddr): - set_ip_addr->ipv4_dst_mask = mask; - set_ip_addr->ipv4_dst = exact; + set_ip_addr->ipv4_dst_mask |= mask; + set_ip_addr->ipv4_dst &= ~mask; + set_ip_addr->ipv4_dst |= exact & mask;break ;case offsetof(struct iphdr , saddr): - set_ip_addr->ipv4_src_mask = mask; - set_ip_addr->ipv4_src = exact; + set_ip_addr->ipv4_src_mask |= mask; + set_ip_addr->ipv4_src &= ~mask; + set_ip_addr->ipv4_src |= exact & mask;break ;default :return -EOPNOTSUPP ;
@@ -336,8 +338,9 @@ static void nfp_fl_set_ip6_helper(int opcode_tag, int idx, __be32 exact, __be32 mask, struct nfp_fl_set_ipv6_addr *ip6) { - ip6->ipv6[idx % 4].mask = mask; - ip6->ipv6[idx %4 ].exact = exact; + ip6->ipv6[idx % 4].mask |= mask; + ip6->ipv6[idx %4 ].exact &= ~mask; + ip6->ipv6[idx %4 ].exact |= exact & mask; ip6->reserved =cpu_to_be16 (0 ); ip6->head.jump_id = opcode_tag;
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 19/33 nfp: flower: use offsets provided by pedit instead of index for ipv6
In reply to Sasha LevinFrom: Pieter Jansen van Vuuren <[email protected]>
[ Upstream commit 140b6abac26d799f75d772ab5e969b34ad8d68f1 ]
Previously when populating the set ipv6 address action, we incorrectly made use of pedit's key index to determine which 32bit word should be set. We now calculate which word has been selected based on the offset provided by the pedit action.
--- .../ethernet/netronome/nfp/flower/action.c | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-)
drivers/net/ethernet/netronome/nfp/flower/action.c +15 -11
@@ -335,12 +335,12 @@ nfp_fl_set_ip4(const struct tc_action *action, int idx, u32 off, }static void -nfp_fl_set_ip6_helper (int opcode_tag,int idx,__be32 exact,__be32 mask, +nfp_fl_set_ip6_helper (int opcode_tag,u8 word,__be32 exact,__be32 mask,struct nfp_fl_set_ipv6_addr *ip6) { - ip6->ipv6[idx %4 ].mask |= mask; - ip6->ipv6[idx %4 ].exact &= ~mask; - ip6->ipv6[idx %4 ].exact |= exact & mask; + ip6->ipv6[word].mask |= mask; + ip6->ipv6[word].exact &= ~mask; + ip6->ipv6[word].exact |= exact & mask; ip6->reserved =cpu_to_be16 (0 ); ip6->head.jump_id = opcode_tag;
@@ -353,6 +353,7 @@ nfp_fl_set_ip6(const struct tc_action *action, int idx, u32 off, struct nfp_fl_set_ipv6_addr *ip_src) {__be32 exact, mask; +u8 word;/* We are expecting tcf_pedit to return a big endian value */ mask = (__force __be32 )~tcf_pedit_mask (action, idx);
@@ -361,17 +362,20 @@ nfp_fl_set_ip6(const struct tc_action *action, int idx, u32 off,if (exact & ~mask)return -EOPNOTSUPP ; -if (off < offsetof(struct ipv6hdr , saddr)) +if (off < offsetof(struct ipv6hdr , saddr)) {return -EOPNOTSUPP ; -else if (off < offsetof(struct ipv6hdr , daddr)) -nfp_fl_set_ip6_helper (NFP_FL_ACTION_OPCODE_SET_IPV6_SRC , idx, + }else if (off < offsetof(struct ipv6hdr , daddr)) { + word = (off - offsetof(struct ipv6hdr , saddr)) /sizeof (exact); +nfp_fl_set_ip6_helper (NFP_FL_ACTION_OPCODE_SET_IPV6_SRC , word, exact, mask, ip_src); -else if (off < offsetof(struct ipv6hdr , daddr) + -sizeof (struct in6_addr )) -nfp_fl_set_ip6_helper (NFP_FL_ACTION_OPCODE_SET_IPV6_DST , idx, + }else if (off < offsetof(struct ipv6hdr , daddr) + +sizeof (struct in6_addr )) { + word = (off - offsetof(struct ipv6hdr , daddr)) /sizeof (exact); +nfp_fl_set_ip6_helper (NFP_FL_ACTION_OPCODE_SET_IPV6_DST , word, exact, mask, ip_dst); -else + }else {return -EOPNOTSUPP ; + }return 0 ; }
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 20/33 sched/fair: Fix the min_vruntime update logic in dequeue_entity()
In reply to Sasha LevinFrom: Song Muchun <[email protected]>
[ Upstream commit 9845c49cc9bbb317a0bc9e9cf78d8e09d54c9af0 ]
The comment and the code around the update_min_vruntime() call in dequeue_entity() are not in agreement.
Quoted 1 line
From commit:
b60205c7c558 ("sched/fair: Fix min_vruntime tracking")
I think that we want to update min_vruntime when a task is sleeping/migrating. So, the check is inverted there - fix it.
--- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/fair.c +1 -1
@@ -4321,7 +4321,7 @@ dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)* put back on, and if we advance min_vruntime, we'll be placed back * further than we started -- ie. we'll be penalized. */ -if ((flags & (DEQUEUE_SAVE |DEQUEUE_MOVE )) ==DEQUEUE_SAVE ) +if ((flags & (DEQUEUE_SAVE |DEQUEUE_MOVE )) !=DEQUEUE_SAVE )update_min_vruntime (cfs_rq); }
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 21/33 perf evsel: Store ids for events with their own cpus perf_event__synthesize_event_update_cpus
In reply to Sasha LevinFrom: Jiri Olsa <[email protected]>
[ Upstream commit 4ab8455f8bd83298bf7f67ab9357e3b1cc765c7d ]
John reported crash when recording on an event under PMU with cpumask defined:
root at localhost:~# ./perf_debug_ record -e armv8_pmuv3_0/br_mis_pred/ sleep 1
perf: Segmentation fault
Obtained 9 stack frames.
./perf_debug_() [0x4c5ef8]
[0xffff82ba267c]
./perf_debug_() [0x4bc5a8]
./perf_debug_() [0x419550]
./perf_debug_() [0x41a928]
./perf_debug_() [0x472f58]
./perf_debug_() [0x473210]
./perf_debug_() [0x4070f4] /lib/aarch64-linux-gnu/libc.so.6(__libc_start_main+0xe0) [0xffff8294c8a0] Segmentation fault (core dumped)
We synthesize an update event that needs to touch the evsel id array, which is not defined at that time. Fixing this by forcing the id allocation for events with their own cpus.
--- tools/perf/builtin-report.c | 1 + tools/perf/util/evsel.c | 3 +++ 2 files changed, 4 insertions(+)
tools/perf/builtin-report.c +1 -0
@@ -981,6 +981,7 @@ int cmd_report(int argc, const char **argv) .id_index = perf_event__process_id_index, .auxtrace_info = perf_event__process_auxtrace_info, .auxtrace = perf_event__process_auxtrace, + .event_update = perf_event__process_event_update, .feature = process_feature_event, .ordered_events = true, .ordering_requires_timestamps = true,
tools/perf/util/evsel.c +3 -0
@@ -1078,6 +1078,9 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts, attr->exclude_user =1 ; } +if (evsel->own_cpus) + evsel->attr.read_format |=PERF_FORMAT_ID ; +/* * Apply event specific term settings, * it overloads any global configuration.
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 22/33 perf tools: Fix use of alternatives to find JDIR
In reply to Sasha LevinFrom: Jarod Wilson <[email protected]>
[ Upstream commit 36b8d4628d3cc8f5a748e508cce8673bc00fc63c ]
When a build is run from something like a cron job, the user's $PATH is rather minimal, of note, not including /usr/sbin in my own case. Because of that, an automated rpm package build ultimately fails to find libperf-jvmti.so, because somewhere within the build, this happens...
/bin/sh: alternatives: command not found
/bin/sh: alternatives: command not found
Makefile.config:849: No openjdk development package found, please install JDK package, e.g. openjdk-8-jdk, java-1.8.0-openjdk-devel
...and while the build continues, libperf-jvmti.so isn't built, and things fall down when rpm tries to find all the %files specified. Exact same system builds everything just fine when the job is launched from a login shell instead of a cron job, since alternatives is in $PATH, so openjdk is actually found.
The test required to get into this section of code actually specifies the full path, as does a block just above it, so let's do that here too.
--- tools/perf/Makefile.config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/Makefile.config +1 -1
@@ -831,7 +831,7 @@ ifndef NO_JVMTI JDIR=$(shell /usr/sbin/update-java-alternatives -l | head -1 | awk '{print $$3}') else ifneq (,$(wildcard /usr/sbin/alternatives)) - JDIR=$(shell alternatives --display java | tail -1 | cut -d' ' -f 5 | sed 's%/jre/bin/java.%%g') + JDIR=$(shell /usr/sbin/alternatives --display java | tail -1 | cut -d' ' -f 5 | sed 's%/jre/bin/java.%%g') endif endif ifndef JDIR
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 23/33 perf cpu_map: Align cpu map synthesized events properly.
In reply to Sasha LevinFrom: David Miller <[email protected]>
[ Upstream commit 0ed149cf5239cc6e7e65bf00f769e8f1e91076c0 ]
The size of the resulting cpu map can be smaller than a multiple of sizeof(u64), resulting in SIGBUS on cpus like Sparc as the next event will not be aligned properly.
--- tools/perf/util/event.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/util/event.c +1 -0
@@ -1074,6 +1074,7 @@ void *cpu_map_data__alloc(struct cpu_map *map, size_t *size, u16 *type, int *max } *size +=sizeof (struct cpu_map_data ); + *size =PERF_ALIGN (*size,sizeof (u64));return zalloc (*size); }
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 24/33 perf report: Don't crash on invalid inline debug information
In reply to Sasha LevinFrom: Milian Wolff <[email protected]>
[ Upstream commit d4046e8e17b9f378cb861982ef71c63911b5dff3 ]
When the function name for an inline frame is invalid, we must not try to demangle this symbol, otherwise we crash with:
#0 0x0000555555895c01 in bfd_demangle ()
#1 0x0000555555823262 in demangle_sym (dso=0x555555d92b90, elf_name=0x0, kmodule=0) at util/symbol-elf.c:215
#2 dso__demangle_sym (dso=dso@entry=0x555555d92b90, kmodule=<optimized out>, kmodule@entry=0, elf_name=elf_name@entry=0x0) at util/symbol-elf.c:400
#3 0x00005555557fef4b in new_inline_sym (funcname=0x0, base_sym=0x555555d92b90, dso=0x555555d92b90) at util/srcline.c:89
#4 inline_list__append_dso_a2l (dso=dso@entry=0x555555c7bb00, node=node@entry=0x555555e31810, sym=sym@entry=0x555555d92b90) at util/srcline.c:264
#5 0x00005555557ff27f in addr2line (dso_name=dso_name@entry=0x555555d92430 "/home/milian/.debug/.build-id/f7/186d14bb94f3c6161c010926da66033d24fce5/elf", addr=addr@entry=2888, file=file@entry=0x0,
line=line@entry=0x0, dso=dso@entry=0x555555c7bb00, unwind_inlines=unwind_inlines@entry=true, node=0x555555e31810, sym=0x555555d92b90) at util/srcline.c:313
#6 0x00005555557ffe7c in addr2inlines (sym=0x555555d92b90, dso=0x555555c7bb00, addr=2888, dso_name=0x555555d92430 "/home/milian/.debug/.build-id/f7/186d14bb94f3c6161c010926da66033d24fce5/elf")
at util/srcline.c:358So instead handle the case where we get invalid function names for inlined frames and use a fallback '??' function name instead.
While this crash was originally reported by Hadrien for rust code, I can now also reproduce it with trivial C++ code. Indeed, it seems like libbfd fails to interpret the debug information for the inline frame symbol name:
$ addr2line -e /home/milian/.debug/.build-id/f7/186d14bb94f3c6161c010926da66033d24fce5/elf -if b48 main /usr/include/c++/8.2.1/complex:610 ?? /usr/include/c++/8.2.1/complex:618 ?? /usr/include/c++/8.2.1/complex:675 ?? /usr/include/c++/8.2.1/complex:685 main /home/milian/projects/kdab/rnd/hotspot/tests/test-clients/cpp-inlining/main.cpp:39
I've reported this bug upstream and also attached a patch there which should fix this issue:
https://sourceware.org/bugzilla/show_bug.cgi?id=23715
[ The above 'Fixes:' cset is where originally the problem was
introduced, i.e. using a2l->funcname without checking if it is NULL, but this current patch fixes the current codebase, i.e. multiple csets were applied after a64489c56c30 before the problem was reported by Hadrien ]
--- tools/perf/util/srcline.c | 3 +++ 1 file changed, 3 insertions(+)
tools/perf/util/srcline.c +3 -0
@@ -85,6 +85,9 @@ static struct symbol *new_inline_sym(struct dso *dso,struct symbol *inline_sym;char *demangled =NULL ; +if (!funcname) + funcname ="??" ; +if (dso) { demangled =dso__demangle_sym (dso,0 , funcname);if (demangled)
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 25/33 x86/fpu: Remove second definition of fpu in __fpu__restore_sig()
In reply to Sasha LevinFrom: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 6aa676761d4c1acfa31320e55fa1f83f3fcbbc7a ]
Commit:
c5bedc6847c3b ("x86/fpu: Get rid of PF_USED_MATH usage, convert it to fpu->fpstate_active")
introduced the 'fpu' variable at top of __restore_xstate_sig(), which now shadows the other definition:
arch/x86/kernel/fpu/signal.c:318:28: warning: symbol 'fpu' shadows an earlier one arch/x86/kernel/fpu/signal.c:271:20: originally declared here
Remove the shadowed definition of 'fpu', as the two definitions are the same.
--- arch/x86/kernel/fpu/signal.c | 1 - 1 file changed, 1 deletion(-)
arch/x86/kernel/fpu/signal.c +0 -1
@@ -314,7 +314,6 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)* thread's fpu state, reconstruct fxstate from the fsave * header. Validate and sanitize the copied state. */ -struct fpu *fpu = &tsk->thread.fpu;struct user_i387_ia32_struct env;int err =0 ;
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 26/33 net: qla3xxx: Remove overflowing shift statement
In reply to Sasha LevinFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 8c3bf9b62b667456a57aefcf1689e826df146159 ]
Clang currently warns:
drivers/net/ethernet/qlogic/qla3xxx.c:384:24: warning: signed shift result (0xF00000000) requires 37 bits to represent, but 'int' only has 32 bits [-Wshift-overflow]
((ISP_NVRAM_MASK << 16) | qdev->eeprom_cmd_data));
~~~~~~~~~~~~~~ ^ ~~1 warning generated.
The warning is certainly accurate since ISP_NVRAM_MASK is defined as (0x000F << 16) which is then shifted by 16, resulting in 64424509440, well above UINT_MAX.
Given that this is the only location in this driver where ISP_NVRAM_MASK is shifted again, it seems likely that ISP_NVRAM_MASK was originally defined without a shift and during the move of the shift to the definition, this statement wasn't properly removed (since ISP_NVRAM_MASK is used in the statenent right above this). Only the maintainers can confirm this since this statment has been here since the driver was first added to the kernel.
--- drivers/net/ethernet/qlogic/qla3xxx.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/qlogic/qla3xxx.c +0 -2
@@ -380,8 +380,6 @@ static void fm93c56a_select(struct ql3_adapter *qdev) qdev->eeprom_cmd_data =AUBURN_EEPROM_CS_1 ;ql_write_nvram_reg (qdev, spir,ISP_NVRAM_MASK | qdev->eeprom_cmd_data); -ql_write_nvram_reg (qdev, spir, - ((ISP_NVRAM_MASK <<16 ) | qdev->eeprom_cmd_data)); }/*
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 27/33 r8169: re-enable MSI-X on RTL8168g
In reply to Sasha LevinFrom: Heiner Kallweit <[email protected]>
[ Upstream commit 9675931e6b65d160d16bcc9472c1acef15524def ]
Similar to d49c88d7677b ("r8169: Enable MSI-X on RTL8106e") after e9d0ba506ea8 ("PCI: Reprogram bridge prefetch registers on resume") we can safely assume that this also fixes the root cause of the issue worked around by 7c53a722459c ("r8169: don't use MSI-X on RTL8168g"). So let's revert it.
--- drivers/net/ethernet/realtek/r8169.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/net/ethernet/realtek/r8169.c +0 -5
@@ -7546,11 +7546,6 @@ static int rtl_alloc_irq(struct rtl8169_private *tp)RTL_W8 (tp, Config2,RTL_R8 (tp, Config2) & ~MSIEnable);RTL_W8 (tp, Cfg9346, Cfg9346_Lock); flags =PCI_IRQ_LEGACY ; - }else if (tp->mac_version ==RTL_GIGA_MAC_VER_40 ) { -/* This version was reported to have issues with resume -* from suspend when using MSI-X -*/ - flags =PCI_IRQ_LEGACY |PCI_IRQ_MSI ; }else { flags =PCI_IRQ_ALL_TYPES ; }
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 28/33 virtio_net: avoid using netif_tx_disable() for serializing tx routine
In reply to Sasha LevinFrom: Ake Koomsin <[email protected]>
[ Upstream commit 05c998b738fdd3e5d6a257bcacc8f34b6284d795 ]
Commit 713a98d90c5e ("virtio-net: serialize tx routine during reset") introduces netif_tx_disable() after netif_device_detach() in order to avoid use-after-free of tx queues. However, there are two issues.
1) Its operation is redundant with netif_device_detach() in case the interface is running.
2) In case of the interface is not running before suspending and resuming, the tx does not get resumed by netif_device_attach(). This results in losing network connectivity.
It is better to use netif_tx_lock_bh()/netif_tx_unlock_bh() instead for serializing tx routine during reset. This also preserves the symmetry of netif_device_detach() and netif_device_attach().
Fixes commit 713a98d90c5e ("virtio-net: serialize tx routine during reset")
--- drivers/net/virtio_net.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/virtio_net.c +4 -1
@@ -2162,8 +2162,9 @@ static void virtnet_freeze_down(struct virtio_device *vdev)/* Make sure no work handler is accessing the device */ flush_work (&vi->config_work); +netif_tx_lock_bh (vi->dev);netif_device_detach (vi->dev); -netif_tx_disable (vi->dev); +netif_tx_unlock_bh (vi->dev);cancel_delayed_work_sync (&vi->refill);if (netif_running (vi->dev)) {
@@ -2199,7 +2200,9 @@ static int virtnet_restore_up(struct virtio_device *vdev) } } +netif_tx_lock_bh (vi->dev);netif_device_attach (vi->dev); +netif_tx_unlock_bh (vi->dev);return err; }
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 29/33 drm: Get ref on CRTC commit object when waiting for flip_done
In reply to Sasha LevinFrom: Leo Li <[email protected]>
[ Upstream commit 4364bcb2cd21d042bde4776448417ddffbc54045 ]
This fixes a general protection fault, caused by accessing the contents of a flip_done completion object that has already been freed. It occurs due to the preemption of a non-blocking commit worker thread W by another commit thread X. X continues to clear its atomic state at the end, destroying the CRTC commit object that W still needs. Switching back to W and accessing the commit objects then leads to bad results.
Worker W becomes preemptable when waiting for flip_done to complete. At this point, a frequently occurring commit thread X can take over. Here's an example where W is a worker thread that flips on both CRTCs, and X does a legacy cursor update on both CRTCs:
...
1. W does flip work
2. W runs commit_hw_done()
3. W waits for flip_done on CRTC 1
4. > flip_done for CRTC 1 completes
5. W finishes waiting for CRTC 1
6. W waits for flip_done on CRTC 2
7. > Preempted by X
8. > flip_done for CRTC 2 completes
9. X atomic_check: hw_done and flip_done are complete on all CRTCs
10. X updates cursor on both CRTCs
11. X destroys atomic state
12. X done
13. > Switch back to W
14. W waits for flip_done on CRTC 2
15. W raises general protection fault
The error looks like so:
general protection fault: 0000 [#1] PREEMPT SMP PTI
**snip**
Call Trace:
lock_acquire+0xa2/0x1b0
_raw_spin_lock_irq+0x39/0x70
wait_for_completion_timeout+0x31/0x130
drm_atomic_helper_wait_for_flip_done+0x64/0x90 [drm_kms_helper]
amdgpu_dm_atomic_commit_tail+0xcae/0xdd0 [amdgpu]
commit_tail+0x3d/0x70 [drm_kms_helper]
process_one_work+0x212/0x650
worker_thread+0x49/0x420
kthread+0xfb/0x130
ret_from_fork+0x3a/0x50
Modules linked in: x86_pkg_temp_thermal amdgpu(O) chash(O)
gpu_sched(O) drm_kms_helper(O) syscopyarea sysfillrect sysimgblt
fb_sys_fops ttm(O) drm(O)Note that i915 has this issue masked, since hw_done is signaled after waiting for flip_done. Doing so will block the cursor update from happening until hw_done is signaled, preventing the cursor commit from destroying the state.
v2: The reference on the commit object needs to be obtained before
hw_done() is signaled, since that's the point where another commit is allowed to modify the state. Assuming that the new_crtc_state->commit object still exists within flip_done() is incorrect.
Fix by getting a reference in setup_commit(), and releasing it during default_clear().
--- drivers/gpu/drm/drm_atomic.c | 5 +++++ drivers/gpu/drm/drm_atomic_helper.c | 12 ++++++++---- include/drm/drm_atomic.h | 11 +++++++++++ 3 files changed, 24 insertions(+), 4 deletions(-)
drivers/gpu/drm/drm_atomic.c +5 -0
@@ -173,6 +173,11 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state) state->crtcs[i].state =NULL ; state->crtcs[i].old_state =NULL ; state->crtcs[i].new_state =NULL ; + +if (state->crtcs[i].commit) { +drm_crtc_commit_put (state->crtcs[i].commit); + state->crtcs[i].commit =NULL ; + } }for (i =0 ; i < config->num_total_plane; i++) {
drivers/gpu/drm/drm_atomic_helper.c +8 -4
@@ -1384,15 +1384,16 @@ EXPORT_SYMBOL(drm_atomic_helper_wait_for_vblanks);void drm_atomic_helper_wait_for_flip_done (struct drm_device *dev,struct drm_atomic_state *old_state) { -struct drm_crtc_state *new_crtc_state;struct drm_crtc *crtc;int i; -for_each_new_crtc_in_state (old_state, crtc, new_crtc_state, i) { -struct drm_crtc_commit *commit = new_crtc_state->commit; +for (i =0 ; i < dev->mode_config.num_crtc; i++) { +struct drm_crtc_commit *commit = old_state->crtcs[i].commit;int ret; -if (!commit) + crtc = old_state->crtcs[i].ptr; + +if (!crtc || !commit)continue ; ret =wait_for_completion_timeout (&commit->flip_done,10 *HZ );
@@ -1906,6 +1907,9 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state,drm_crtc_commit_get (commit); commit->abort_completion = true; + + state->crtcs[i].commit = commit; +drm_crtc_commit_get (commit); }for_each_oldnew_connector_in_state (state, conn, old_conn_state, new_conn_state, i) {
include/drm/drm_atomic.h +11 -0
@@ -153,6 +153,17 @@ struct __drm_planes_state {struct __drm_crtcs_state {struct drm_crtc *ptr;struct drm_crtc_state *state, *old_state, *new_state; + +/** +* @commit: +* +* A reference to the CRTC commit object that is kept for use by +* drm_atomic_helper_wait_for_flip_done() after +* drm_atomic_helper_commit_hw_done() is called. This ensures that a +* concurrent commit won't free a commit object that is still in use. +*/ +struct drm_crtc_commit *commit; +s32 __user *out_fence_ptr;u64 last_vblank_count; };
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 30/33 r8169: fix NAPI handling under high load
In reply to Sasha LevinFrom: Heiner Kallweit <[email protected]>
[ Upstream commit 6b839b6cf9eada30b086effb51e5d6076bafc761 ]
rtl_rx() and rtl_tx() are called only if the respective bits are set in the interrupt status register. Under high load NAPI may not be able to process all data (work_done == budget) and it will schedule subsequent calls to the poll callback.rtl_ack_events() however resets the bits in the interrupt status register, therefore subsequent calls to rtl8169_poll() won't call rtl_rx() and rtl_tx() - chip interrupts are still disabled.
Fix this by calling rtl_rx() and rtl_tx() independent of the bits set in the interrupt status register. Both functions will detect if there's nothing to do for them.
--- drivers/net/ethernet/realtek/r8169.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/net/ethernet/realtek/r8169.c +3 -5
@@ -7044,17 +7044,15 @@ static int rtl8169_poll(struct napi_struct *napi, int budget) struct rtl8169_private *tp = container_of(napi, struct rtl8169_private, napi);struct net_device *dev = tp->dev;u16 enable_mask =RTL_EVENT_NAPI | tp->event_slow; -int work_done=0 ; +int work_done;u16 status; status =rtl_get_events (tp);rtl_ack_events (tp, status & ~tp->event_slow); -if (status &RTL_EVENT_NAPI_RX ) - work_done =rtl_rx (dev, tp, (u32 ) budget); + work_done =rtl_rx (dev, tp, (u32 ) budget); -if (status &RTL_EVENT_NAPI_TX ) -rtl_tx (dev, tp); +rtl_tx (dev, tp);if (status & tp->event_slow) { enable_mask &= ~tp->event_slow;
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 31/33 selftests: ftrace: Add synthetic event syntax testcase
In reply to Sasha LevinFrom: Masami Hiramatsu <[email protected]>
[ Upstream commit ba0e41ca81b935b958006c7120466e2217357827 ]
Add a testcase to check the syntax and field types for synthetic_events interface.
--- .../trigger-synthetic-event-syntax.tc | 80 +++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc
tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc new file +80 -0
@@ -0,0 +1,80 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0 +# description: event trigger - test synthetic_events syntax parser + +do_reset() { + reset_trigger + echo > set_event + clear_trace +} + +fail() { #msg + do_reset + echo $1 + exit_fail +} + +if [ ! -f set_event ]; then + echo "event tracing is not supported" + exit_unsupported +fi + +if [ ! -f synthetic_events ]; then + echo "synthetic event is not supported" + exit_unsupported +fi + +reset_tracer +do_reset + +echo "Test synthetic_events syntax parser" + +echo > synthetic_events + +# synthetic event must have a field +! echo "myevent" >> synthetic_events +echo "myevent u64 var1" >> synthetic_events + +# synthetic event must be found in synthetic_events +grep "myevent[[:space:]]u64 var1" synthetic_events + +# it is not possible to add same name event +! echo "myevent u64 var2" >> synthetic_events + +# Non-append open will cleanup all events and add new one +echo "myevent u64 var2" > synthetic_events + +# multiple fields with different spaces +echo "myevent u64 var1; u64 var2;" > synthetic_events +grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events +echo "myevent u64 var1 ; u64 var2 ;" > synthetic_events +grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events +echo "myevent u64 var1 ;u64 var2" > synthetic_events +grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events + +# test field types +echo "myevent u32 var" > synthetic_events +echo "myevent u16 var" > synthetic_events +echo "myevent u8 var" > synthetic_events +echo "myevent s64 var" > synthetic_events +echo "myevent s32 var" > synthetic_events +echo "myevent s16 var" > synthetic_events +echo "myevent s8 var" > synthetic_events + +echo "myevent char var" > synthetic_events +echo "myevent int var" > synthetic_events +echo "myevent long var" > synthetic_events +echo "myevent pid_t var" > synthetic_events + +echo "myevent unsigned char var" > synthetic_events +echo "myevent unsigned int var" > synthetic_events +echo "myevent unsigned long var" > synthetic_events +grep "myevent[[:space:]]unsigned long var" synthetic_events + +# test string type +echo "myevent char var[10]" > synthetic_events +grep "myevent[[:space:]]char\[10\] var" synthetic_events + +do_reset + +exit 0
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 32/33 net: fix pskb_trim_rcsum_slow() with odd trim offset
In reply to Sasha LevinFrom: Dimitris Michailidis <[email protected]>
[ Upstream commit d55bef5059dd057bd077155375c581b49d25be7e ]
We've been getting checksum errors involving small UDP packets, usually 59B packets with 1 extra non-zero padding byte. netdev_rx_csum_fault() has been complaining that HW is providing bad checksums. Turns out the problem is in pskb_trim_rcsum_slow(), introduced in commit 88078d98d1bb ("net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends").
The source of the problem is that when the bytes we are trimming start at an odd address, as in the case of the 1 padding byte above, skb_checksum() returns a byte-swapped value. We cannot just combine this with skb->csum using csum_sub(). We need to use csum_block_sub() here that takes into account the parity of the start address and handles the swapping.
Matches existing code in __skb_postpull_rcsum() and esp_remove_trailer().
--- net/core/skbuff.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/core/skbuff.c +3 -2
@@ -1845,8 +1845,9 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len)if (skb->ip_summed ==CHECKSUM_COMPLETE ) {int delta = skb->len - len; - skb->csum =csum_sub (skb->csum, -skb_checksum (skb, len, delta,0 )); + skb->csum =csum_block_sub (skb->csum, +skb_checksum (skb, len, delta,0 ), + len); }return __pskb_trim (skb, len); }
Signature · 1 line
2.17.1
Sasha Levin
maintainerPATCH 33/33 i2c: rcar: cleanup DMA for all kinds of failure
In reply to Sasha LevinFrom: Wolfram Sang <[email protected]>
[ Upstream commit 31d86033a0749a0463ea654130b2de5c163154f1 ]
DMA needs to be cleaned up not only on timeout, but on all errors where it has been setup before.
--- drivers/i2c/busses/i2c-rcar.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-rcar.c +5 -1
@@ -812,8 +812,12 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap, time_left =wait_event_timeout (priv->wait, priv->flags &ID_DONE , num * adap->timeout); -if (!time_left) { + +/* cleanup DMA if it couldn't complete properly due to an error */ +if (priv->dma_direction !=DMA_NONE )rcar_i2c_cleanup_dma (priv); + +if (!time_left) {rcar_i2c_init (priv); ret = -ETIMEDOUT ; }else if (priv->flags &ID_NACK ) {
Signature · 1 line
2.17.1