4.19.29-stable review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 4.19.29-stable review
This is the start of the stable review cycle for the 4.19.29 release. There are 149 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Mar 14 17:02:30 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.29-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.29-rc1
Peter Zijlstra (Intel) <[email protected]>
perf/x86/intel: Implement support for TSX Force Abort
Peter Zijlstra (Intel) <[email protected]>
x86: Add TSX Force Abort CPUID/MSR
Peter Zijlstra (Intel) <[email protected]>
perf/x86/intel: Generalize dynamic constraint creation
Peter Zijlstra (Intel) <[email protected]>
perf/x86/intel: Make cpuc allocations consistent
Geert Uytterhoeven <[email protected]>
driver core: Postpone DMA tear-down until after devres release
Daniel F. Dickinson <[email protected]>
ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom
Ronnie Sahlberg <[email protected]>
cifs: allow calling SMB2_xxx_free(NULL)
Gao Xiang <[email protected]>
staging: erofs: keep corrupted fs from crashing kernel in erofs_namei()
Gao Xiang <[email protected]>
staging: erofs: fix race of initializing xattrs of a inode at the same time
Gao Xiang <[email protected]>
staging: erofs: fix memleak of inode's shared xattr array
Gao Xiang <[email protected]>
staging: erofs: fix fast symlink w/o xattr when fs xattr is on
Gao Xiang <[email protected]>
staging: erofs: add error handling for xattr submodule
Andreas Gruenbacher <[email protected]>
gfs2: Fix missed wakeups in find_insert_glock
Taehee Yoo <[email protected]>
netfilter: xt_TEE: add missing code to get interface index in checkentry.
Taehee Yoo <[email protected]>
netfilter: xt_TEE: fix wrong interface selection
Ard Biesheuvel <[email protected]>
drm: disable uncached DMA optimization for ARM and arm64
Marek Szyprowski <[email protected]>
ARM: dts: exynos: Fix max voltage for buck8 regulator on Odroid XU3/XU4
Marek Szyprowski <[email protected]>
ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
Marek Szyprowski <[email protected]>
ARM: dts: exynos: Fix pinctrl definition for eMMC RTSN line on Odroid X2/U3
Alistair Strachan <[email protected]>
arm64: dts: hikey: Revert "Enable HS200 mode on eMMC"
Jan Kiszka <[email protected]>
arm64: dts: hikey: Give wifi some time after power-on
Jan Kiszka <[email protected]>
arm64: dts: zcu100-revC: Give wifi some time after power-on
Alexander Shishkin <[email protected]>
x86/PCI: Fixup RTIT_BAR of Intel Denverton Trace Hub
Gustavo A. R. Silva <[email protected]>
scsi: aacraid: Fix missing break in switch statement
Gustavo A. R. Silva <[email protected]>
iscsi_ibft: Fix missing break in switch statement
Vincent Batts <[email protected]>
Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
Jason Gerecke <[email protected]>
Input: wacom_serial4 - add support for Wacom ArtPad II tablet
Keith Busch <[email protected]>
nvme-pci: add missing unlock for reset error
Liu Bo <[email protected]>
blk-iolatency: fix IO hang due to negative inflight counter
Sudarsana Reddy Kalluru <[email protected]>
qede: Fix system crash on configuring channels.
Sudarsana Reddy Kalluru <[email protected]>
qed: Consider TX tcs while deriving the max num_queues for PF.
Manish Chopra <[email protected]>
qed: Fix EQ full firmware assert.
Tetsuo Handa <[email protected]>
fs: ratelimit __find_get_block_slow() failure message.
Keith Busch <[email protected]>
nvme-pci: fix rapid add remove sequence
Keith Busch <[email protected]>
nvme: lock NS list changes while handling command effects
Philip Yang <[email protected]>
drm/amdgpu: use spin_lock_irqsave to protect vm_manager.pasid_idr
Tony Lindgren <[email protected]>
i2c: omap: Use noirq system sleep pm ops to idle device for suspend
Ross Lagerwall <[email protected]>
Revert "scsi: libfc: Add WARN_ON() when deleting rports"
Jun-Ru Chang <[email protected]>
MIPS: Remove function size check in get_frame_info()
Huacai Chen <[email protected]>
MIPS: Loongson: Introduce and use loongson_llsc_mb()
Arnaldo Carvalho de Melo <[email protected]>
perf trace: Support multiple "vfs_getname" probes
Jiri Olsa <[email protected]>
perf symbols: Filter out hidden symbols from labels
Julian Wiedmann <[email protected]>
s390/qeth: cancel close_dev work before removing a card
Julian Wiedmann <[email protected]>
s390/qeth: fix use-after-free in error path
Julian Wiedmann <[email protected]>
s390/qeth: release cmd buffer in error paths
Martynas Pumputis <[email protected]>
netfilter: nf_nat: skip nat clash resolution for same-origin entries
Florian Westphal <[email protected]>
selftests: netfilter: add simple masq/redirect test cases
Naresh Kamboju <[email protected]>
selftests: netfilter: fix config fragment CONFIG_NF_TABLES_INET
Andy Shevchenko <[email protected]>
dmaengine: dmatest: Abort test in case of mapping error
Stefano Garzarella <[email protected]>
vsock/virtio: reset connected sockets on device removal
Stefano Garzarella <[email protected]>
vsock/virtio: fix kernel panic after device hot-unplug
Codrin Ciubotariu <[email protected]>
dmaengine: at_xdmac: Fix wrongfull report of a channel as in use
Paul Kocialkowski <[email protected]>
drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init
Martin KaFai Lau <[email protected]>
bpf: Fix syscall's stackmap lookup potential deadlock
Alexei Starovoitov <[email protected]>
bpf: fix potential deadlock in bpf_prog_register
Alexei Starovoitov <[email protected]>
bpf: fix lockdep false positive in percpu_freelist
Martynas Pumputis <[email protected]>
bpf, selftests: fix handling of sparse CPU allocations
Greg Kroah-Hartman <[email protected]>
relay: check return of create_buf_file() properly
Zenghui Yu <[email protected]>
irqchip/gic-v3-its: Fix ITT_entry_size accessor
Jose Abreu <[email protected]>
net: stmmac: Disable EEE mode earlier in XMIT callback
Jose Abreu <[email protected]>
net: stmmac: Send TSO packets always from Queue 0
Jose Abreu <[email protected]>
net: stmmac: Fallback to Platform Data clock in Watchdog conversion
Chris Wilson <[email protected]>
drm/amdgpu: Transfer fences to dmabuf importer
Alex Deucher <[email protected]>
drm/radeon: check if device is root before getting pci speed caps
Alex Deucher <[email protected]>
drm/amdgpu: Add missing power attribute to APU check
Lubomir Rintel <[email protected]>
irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
Marc Zyngier <[email protected]>
irqchip/gic-v3-its: Gracefully fail on LPI exhaustion
Heyi Guo <[email protected]>
irqchip/gic-v4: Fix occasional VLPI drop
Anders Roxell <[email protected]>
usb: phy: fix link errors
Zhou Yanjie <[email protected]>
DTS: CI20: Fix bugs in ci20's device tree.
Felix Fietkau <[email protected]>
batman-adv: release station info tidstats
Srinivas Kandagatla <[email protected]>
arm64: dts: add msm8996 compatible to gicv3
Peng Hao <[email protected]>
ARM: pxa: ssp: unneeded to free devm_ allocated data
Yafang Shao <[email protected]>
bpf: sock recvbuff must be limited by rmem_max in bpf_setsockopt()
Paolo Abeni <[email protected]>
bpftool: fix percpu maps updating
Jiri Olsa <[email protected]>
bpftool: Fix prog dump by tag
Ulf Hansson <[email protected]>
wlcore: sdio: Fixup power on/off sequence
Jason Kridner <[email protected]>
pinctrl: mcp23s08: spi: Fix regmap allocation for mcp23s18
Madalin Bucur <[email protected]>
soc: fsl: qbman: avoid race in clearing QMan interrupt
Geert Uytterhoeven <[email protected]>
arm64: dts: renesas: r8a77965: Enable DMA for SCIF2
Geert Uytterhoeven <[email protected]>
arm64: dts: renesas: r8a7796: Enable DMA for SCIF2
Anson Huang <[email protected]>
ARM: dts: imx6sx: correct backward compatible of gpt
Martin Blumenstingl <[email protected]>
ARM: dts: meson8m2: mxiii-plus: mark the SD card detection GPIO active-low
Martin Blumenstingl <[email protected]>
ARM: dts: meson8b: odroidc1: mark the SD card detection GPIO active-low
Carlo Caione <[email protected]>
arm: dts: meson: Fix IRQ trigger type for macirq
Jernej Skrabec <[email protected]>
ARM: dts: sun8i: h3: Add ethernet0 alias to Beelink X2
Tony Lindgren <[email protected]>
ARM: dts: omap4-droid4: Fix typo in cpcap IRQ flags
Aaro Koskinen <[email protected]>
ARM: OMAP: dts: N950/N9: fix onenand timings
Michal Hocko <[email protected]>
mm, memory_hotplug: fix off-by-one in is_pageblock_removable
Ian Kent <[email protected]>
autofs: fix error return in autofs_fill_super()
Pan Bian <[email protected]>
autofs: drop dentry reference only when it is never used
Jan Kara <[email protected]>
fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
Dan Carpenter <[email protected]>
lib/test_kmod.c: potential double free in error handling
Mikhail Zaslonko <[email protected]>
mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone
Michal Hocko <[email protected]>
mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
Qian Cai <[email protected]>
x86_64: increase stack size for KASAN_EXTRA
Alexey Dobriyan <[email protected]>
proc: fix /proc/net/* after setns(2)
Kairui Song <[email protected]>
x86/kexec: Don't setup EFI info if EFI runtime is not enabled
John Johansen <[email protected]>
apparmor: Fix aa_label_build() error handling for failed merges
James Morse <[email protected]>
arm64: kprobe: Always blacklist the KVM world-switch code
Thomas Lendacky <[email protected]>
x86/microcode/amd: Don't falsely trick the late loading mechanism
Ronnie Sahlberg <[email protected]>
cifs: fix computation for MAX_SMB2_HDR_SIZE
Wei Huang <[email protected]>
x86/boot/compressed/64: Set EFER.LME=1 in 32-bit trampoline before returning to long mode
Harini Katakam <[email protected]>
net: macb: Apply RXUBR workaround only to versions with errata
Sinan Kaya <[email protected]>
platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
Sinan Kaya <[email protected]>
platform/x86: Fix unmet dependency warning for ACPI_CMPC
Dan Carpenter <[email protected]>
scsi: 53c700: pass correct "dev" to dma_alloc_attrs()
Dan Carpenter <[email protected]>
scsi: bnx2fc: Fix error handling in probe()
Douglas Gilbert <[email protected]>
scsi: scsi_debug: fix write_same with virtual_gb problem
Ming Lu <[email protected]>
scsi: libfc: free skb when receiving invalid flogi resp
Manish Chopra <[email protected]>
qed: Fix stack out of bounds bug
Manish Chopra <[email protected]>
qed: Fix system crash in ll2 xmit
Manish Chopra <[email protected]>
qed: Fix VF probe failure while FLR
Manish Chopra <[email protected]>
qed: Fix LACP pdu drops for VFs
Manish Chopra <[email protected]>
qed: Fix bug in tx promiscuous mode settings
Yao Liu <[email protected]>
nfs: Fix NULL pointer dereference of dev_name
Fathi Boudra <[email protected]>
selftests: timers: use LDLIBS instead of LDFLAGS
Fathi Boudra <[email protected]>
selftests: net: use LDLIBS instead of LDFLAGS
Andrew Lunn <[email protected]>
gpio: vf610: Mask all GPIO interrupts
Florian Westphal <[email protected]>
netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present
Alexey Khoroshilov <[email protected]>
net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup()
Yonglong Liu <[email protected]>
net: hns: Fix wrong read accesses via Clause 45 MDIO protocol
Yonglong Liu <[email protected]>
net: hns: Restart autoneg need return failed when autoneg off
Yonglong Liu <[email protected]>
net: hns: Fix for missing of_node_put() after of_parse_phandle()
Tomonori Sakita <[email protected]>
net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
Max Filippov <[email protected]>
xtensa: SMP: limit number of possible CPUs by NR_CPUS
Christoph Hellwig <[email protected]>
iomap: fix a use after free in iomap_dio_rw
Piotr Jaroszynski <[email protected]>
iomap: get/put the page in iomap_page_create/release()
Max Filippov <[email protected]>
xtensa: SMP: mark each possible CPU as present
Max Filippov <[email protected]>
xtensa: smp_lx200_defconfig: fix vectors clash
Max Filippov <[email protected]>
xtensa: SMP: fix secondary CPU initialization
Colin Ian King <[email protected]>
selftests: cpu-hotplug: fix case where CPUs offline > CPUs present
Feras Daoud <[email protected]>
IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start
Alexandre Ghiti <[email protected]>
riscv: Adjust mmap base address at a third of task size
Max Filippov <[email protected]>
xtensa: SMP: fix ccount_timer_shutdown
Taniya Das <[email protected]>
clk: qcom: gcc: Use active only source for CPUSS clocks
Dan Carpenter <[email protected]>
clk: ti: Fix error handling in ti_clk_parse_divider_data()
Suravee Suthikulpanit <[email protected]>
iommu/amd: Fix IOMMU page flush when detach device from a domain
ZhangXiaoxu <[email protected]>
ipvs: Fix signed integer overflow when setsockopt timeout
Guo Ren <[email protected]>
riscv: fixup max_low_pfn with PFN_DOWN.
Jerry Snitselaar <[email protected]>
iommu/amd: Unmap all mapped pages in error path of map_sg
Jerry Snitselaar <[email protected]>
iommu/amd: Call free_iova_fast with pfn in map_sg
Brian Welty <[email protected]>
IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM
Tony Jones <[email protected]>
perf script: Fix crash when processing recorded stat data
Stephane Eranian <[email protected]>
perf tools: Handle TOPOLOGY headers with no CPU
Stephane Eranian <[email protected]>
perf core: Fix perf_proc_update_handler() bug
Andi Kleen <[email protected]>
perf script: Fix crash with printing mixed trace point and other events
Su Yanjun <[email protected]>
vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel
Alistair Strachan <[email protected]>
media: uvcvideo: Fix 'type' check leading to overflow
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/exynos3250.dtsi | 3 + arch/arm/boot/dts/exynos4412-odroid-common.dtsi | 13 +- arch/arm/boot/dts/exynos5422-odroid-core.dtsi | 2 +- arch/arm/boot/dts/imx6sx.dtsi | 2 +- arch/arm/boot/dts/meson.dtsi | 2 +- arch/arm/boot/dts/meson8b-odroidc1.dts | 4 +- arch/arm/boot/dts/meson8m2-mxiii-plus.dts | 3 +- arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi | 2 +- arch/arm/boot/dts/omap3-n950-n9.dtsi | 42 +- arch/arm/boot/dts/sun8i-h3-beelink-x2.dts | 2 +- arch/arm/plat-pxa/ssp.c | 3 - arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts | 2 +- arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- arch/arm64/boot/dts/renesas/r8a7796.dtsi | 3 + arch/arm64/boot/dts/renesas/r8a77965.dtsi | 3 + arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts | 1 + arch/arm64/kernel/probes/kprobes.c | 6 +- arch/mips/Kconfig | 15 + arch/mips/boot/dts/ingenic/ci20.dts | 8 +- arch/mips/include/asm/atomic.h | 6 + arch/mips/include/asm/barrier.h | 36 + arch/mips/include/asm/bitops.h | 5 + arch/mips/include/asm/futex.h | 3 + arch/mips/include/asm/pgtable.h | 2 + arch/mips/kernel/process.c | 7 +- arch/mips/loongson64/Platform | 23 + arch/mips/mm/tlbex.c | 10 + arch/riscv/include/asm/processor.h | 2 +- arch/riscv/kernel/setup.c | 2 +- arch/riscv/mm/init.c | 3 +- arch/x86/boot/compressed/head_64.S | 8 + arch/x86/boot/compressed/pgtable.h | 2 +- arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 154 ++++- arch/x86/events/perf_event.h | 17 +- arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/msr-index.h | 6 + arch/x86/include/asm/page_64_types.h | 4 + arch/x86/kernel/cpu/microcode/amd.c | 2 +- arch/x86/kernel/kexec-bzimage64.c | 3 + arch/x86/pci/fixup.c | 16 + arch/xtensa/configs/smp_lx200_defconfig | 1 + arch/xtensa/kernel/head.S | 5 +- arch/xtensa/kernel/smp.c | 41 +- arch/xtensa/kernel/time.c | 2 +- block/blk-iolatency.c | 52 +- drivers/base/dd.c | 2 +- drivers/clk/qcom/gcc-sdm845.c | 14 +- drivers/clk/ti/divider.c | 11 +- drivers/dma/at_xdmac.c | 19 +- drivers/dma/dmatest.c | 28 +- drivers/firmware/iscsi_ibft.c | 1 + drivers/gpio/gpio-vf610.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c | 59 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 5 +- drivers/gpu/drm/radeon/ci_dpm.c | 5 +- drivers/gpu/drm/radeon/si_dpm.c | 5 +- drivers/gpu/drm/sun4i/sun4i_tcon.c | 2 + drivers/i2c/busses/i2c-omap.c | 13 +- drivers/infiniband/hw/hfi1/ud.c | 1 - drivers/infiniband/hw/qib/qib_ud.c | 1 - drivers/infiniband/ulp/ipoib/ipoib.h | 1 - drivers/infiniband/ulp/ipoib/ipoib_cm.c | 3 +- drivers/input/mouse/elan_i2c_core.c | 1 + drivers/input/tablet/wacom_serial4.c | 2 + drivers/iommu/amd_iommu.c | 19 +- drivers/irqchip/irq-gic-v3-its.c | 69 +- drivers/irqchip/irq-mmp.c | 6 +- drivers/media/usb/uvc/uvc_driver.c | 14 +- drivers/net/ethernet/altera/altera_msgdma.c | 3 +- drivers/net/ethernet/cadence/macb.h | 3 + drivers/net/ethernet/cadence/macb_main.c | 28 +- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 5 + drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 16 +- drivers/net/ethernet/hisilicon/hns_mdio.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_dev.c | 8 +- drivers/net/ethernet/qlogic/qed/qed_l2.c | 17 +- drivers/net/ethernet/qlogic/qed/qed_l2.h | 3 + drivers/net/ethernet/qlogic/qed/qed_ll2.c | 20 +- drivers/net/ethernet/qlogic/qed/qed_sp.h | 1 + drivers/net/ethernet/qlogic/qed/qed_spq.c | 15 +- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 10 +- drivers/net/ethernet/qlogic/qed/qed_vf.c | 10 + drivers/net/ethernet/qlogic/qede/qede.h | 3 + drivers/net/ethernet/qlogic/qede/qede_fp.c | 13 + drivers/net/ethernet/qlogic/qede/qede_main.c | 3 + drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 4 +- .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 17 +- drivers/net/wireless/ath/ath9k/init.c | 6 +- drivers/net/wireless/ti/wlcore/sdio.c | 15 +- drivers/nvme/host/core.c | 8 +- drivers/nvme/host/nvme.h | 1 + drivers/nvme/host/pci.c | 30 +- drivers/pinctrl/pinctrl-mcp23s08.c | 7 +- drivers/platform/x86/Kconfig | 2 + drivers/s390/net/qeth_core.h | 1 + drivers/s390/net/qeth_core_main.c | 21 +- drivers/s390/net/qeth_l2_main.c | 2 + drivers/s390/net/qeth_l3_main.c | 1 + drivers/scsi/53c700.c | 2 +- drivers/scsi/aacraid/commsup.c | 5 +- drivers/scsi/bnx2fc/bnx2fc_io.c | 4 +- drivers/scsi/libfc/fc_lport.c | 6 +- drivers/scsi/libfc/fc_rport.c | 1 - drivers/scsi/scsi_debug.c | 41 +- drivers/soc/fsl/qbman/qman.c | 9 +- drivers/staging/erofs/inode.c | 8 +- drivers/staging/erofs/internal.h | 16 +- drivers/staging/erofs/namei.c | 189 ++--- drivers/staging/erofs/xattr.c | 165 +++-- drivers/usb/phy/Kconfig | 2 +- fs/autofs/expire.c | 3 +- fs/autofs/inode.c | 4 +- fs/buffer.c | 19 +- fs/cifs/smb2pdu.c | 16 +- fs/cifs/smb2pdu.h | 4 +- fs/drop_caches.c | 8 +- fs/gfs2/glock.c | 2 +- fs/iomap.c | 37 +- fs/nfs/super.c | 5 + fs/proc/generic.c | 4 +- fs/proc/internal.h | 1 + fs/proc/proc_net.c | 20 + include/drm/drm_cache.h | 18 + include/linux/irqchip/arm-gic-v3.h | 2 +- include/linux/stmmac.h | 1 + kernel/bpf/hashtab.c | 4 +- kernel/bpf/percpu_freelist.c | 41 +- kernel/bpf/percpu_freelist.h | 4 + kernel/bpf/syscall.c | 12 +- kernel/events/core.c | 14 +- kernel/relay.c | 4 +- kernel/trace/bpf_trace.c | 14 +- lib/test_kmod.c | 2 +- mm/memory_hotplug.c | 29 +- net/batman-adv/bat_v_elp.c | 3 + net/bridge/netfilter/ebtables.c | 9 +- net/core/filter.c | 2 + net/ipv4/ip_vti.c | 50 ++ net/netfilter/ipvs/ip_vs_ctl.c | 12 + net/netfilter/nf_conntrack_core.c | 16 + net/netfilter/xt_TEE.c | 76 +- net/vmw_vsock/virtio_transport.c | 29 +- security/apparmor/domain.c | 5 +- tools/bpf/bpftool/map.c | 16 + tools/bpf/bpftool/prog.c | 5 +- tools/perf/builtin-script.c | 9 +- tools/perf/builtin-trace.c | 25 +- tools/perf/util/cpumap.c | 11 +- tools/perf/util/symbol-elf.c | 9 +- tools/testing/selftests/bpf/bpf_util.h | 30 +- .../selftests/cpu-hotplug/cpu-on-off-test.sh | 13 +- tools/testing/selftests/net/Makefile | 2 +- tools/testing/selftests/netfilter/Makefile | 2 +- tools/testing/selftests/netfilter/config | 2 +- tools/testing/selftests/netfilter/nft_nat.sh | 762 +++++++++++++++++++++ tools/testing/selftests/proc/.gitignore | 1 + tools/testing/selftests/proc/Makefile | 1 + tools/testing/selftests/proc/setns-dcache.c | 129 ++++ tools/testing/selftests/timers/Makefile | 2 +- 163 files changed, 2451 insertions(+), 612 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/149 media: uvcvideo: Fix type check leading to overflow
4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Strachan <[email protected]>
commit 47bb117911b051bbc90764a8bff96543cbd2005f upstream.
When initially testing the Camera Terminal Descriptor wTerminalType field (buffer[4]), no mask is used. Later in the function, the MSB is overloaded to store the descriptor subtype, and so a mask of 0x7fff is used to check the type.
If a descriptor is specially crafted to set this overloaded bit in the original wTerminalType field, the initial type check will fail (falling through, without adjusting the buffer size), but the later type checks will pass, assuming the buffer has been made suitably large, causing an overflow.
Avoid this problem by checking for the MSB in the wTerminalType field. If the bit is set, assume the descriptor is bad, and abort parsing it.
Originally reported here:
https://groups.google.com/forum/#!topic/syzkaller/Ot1fOE6v1d8
A similar (non-compiling) patch was provided at that time.
--- drivers/media/usb/uvc/uvc_driver.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/media/usb/uvc/uvc_driver.c +11 -3
@@ -1065,11 +1065,19 @@ static int uvc_parse_standard_control(streturn -EINVAL ; } -/* Make sure the terminal type MSB is not null, otherwise it -* could be confused with a unit. +/* +* Reject invalid terminal types that would cause issues: +* +* - The high byte must be non-zero, otherwise it would be +* confused with a unit. +* +* - Bit 15 must be 0, as we use it internally as a terminal +* direction flag. +* +* Other unknown types are accepted. */ type =get_unaligned_le16 (&buffer[4 ]); -if ((type &0xff00 ) ==0 ) { +if ((type &0x7f00 ) ==0 || (type &0x8000 ) !=0 ) { uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol " "interface %d INPUT_TERMINAL %d has invalid " "type 0x%04x, skipping\n", udev->devnum,
Greg Kroah-Hartman
maintainerPATCH 2/149 vti4: Fix a ipip packet processing bug in IPCOMP virtual tunnel
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit dd9ee3444014e8f28c0eefc9fffc9ac9c5248c12 ]
Recently we run a network test over ipcomp virtual tunnel.We find that if a ipv4 packet needs fragment, then the peer can't receive it.
We deep into the code and find that when packet need fragment the smaller fragment will be encapsulated by ipip not ipcomp. So when the ipip packet goes into xfrm, it's skb->dev is not properly set. The ipv4 reassembly code always set skb'dev to the last fragment's dev. After ipv4 defrag processing, when the kernel rp_filter parameter is set, the skb will be drop by -EXDEV error.
This patch adds compatible support for the ipip process in ipcomp virtual tunnel.
--- net/ipv4/ip_vti.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+)
net/ipv4/ip_vti.c +50 -0
@@ -74,6 +74,33 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,return 0 ; } +static int vti_input_ipip (struct sk_buff *skb,int nexthdr,__be32 spi, +int encap_type) +{ +struct ip_tunnel *tunnel; +const struct iphdr *iph =ip_hdr (skb); +struct net *net =dev_net (skb->dev); +struct ip_tunnel_net *itn =net_generic (net, vti_net_id); + + tunnel =ip_tunnel_lookup (itn, skb->dev->ifindex,TUNNEL_NO_KEY , + iph->saddr, iph->daddr,0 ); +if (tunnel) { +if (!xfrm4_policy_check (NULL ,XFRM_POLICY_IN , skb)) + goto drop; + +XFRM_TUNNEL_SKB_CB (skb)->tunnel.ip4 = tunnel; + + skb->dev = tunnel->dev; + +return xfrm_input (skb, nexthdr, spi, encap_type); + } + +return -EINVAL ; +drop: +kfree_skb (skb); +return 0 ; +} +static int vti_rcv (struct sk_buff *skb) {XFRM_SPI_SKB_CB (skb)->family =AF_INET ;
@@ -82,6 +109,14 @@ static int vti_rcv(struct sk_buff *skb)return vti_input (skb,ip_hdr (skb)->protocol,0 ,0 ); } +static int vti_rcv_ipip (struct sk_buff *skb) +{ +XFRM_SPI_SKB_CB (skb)->family =AF_INET ; +XFRM_SPI_SKB_CB (skb)->daddroff = offsetof(struct iphdr , daddr); + +return vti_input_ipip (skb,ip_hdr (skb)->protocol,ip_hdr (skb)->saddr,0 ); +} +static int vti_rcv_cb (struct sk_buff *skb,int err) {unsigned short family;
@@ -435,6 +470,12 @@ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = { .priority = 100, }; +static struct xfrm_tunnel ipip_handler__read_mostly = { + .handler = vti_rcv_ipip, + .err_handler = vti4_err, + .priority =0 , +}; +static int __net_init vti_init_net (struct net *net) {int err;
@@ -603,6 +644,13 @@ static int __init vti_init(void)if (err <0 ) goto xfrm_proto_comp_failed; + msg ="ipip tunnel" ; + err =xfrm4_tunnel_register (&ipip_handler,AF_INET ); +if (err <0 ) { +pr_info ("%s: cant't register tunnel\n" ,__func__); + goto xfrm_tunnel_failed; + } + msg ="netlink interface" ; err =rtnl_link_register (&vti_link_ops);if (err <0 )
@@ -612,6 +660,8 @@ static int __init vti_init(void) rtnl_link_failed:xfrm4_protocol_deregister (&vti_ipcomp4_protocol,IPPROTO_COMP ); +xfrm_tunnel_failed: +xfrm4_tunnel_deregister (&ipip_handler,AF_INET ); xfrm_proto_comp_failed:xfrm4_protocol_deregister (&vti_ah4_protocol,IPPROTO_AH ); xfrm_proto_ah_failed:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 3/149 perf script: Fix crash with printing mixed trace point and other events
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 96167167b6e17b25c0e05ecc31119b73baeab094 ]
'perf script' crashes currently when printing mixed trace points and other events because the trace format does not handle events without trace meta data. Add a simple check to avoid that.
% cat > test.c
main()
{
printf("Hello world\n");
}
^D
% gcc -g -o test test.c
% sudo perf probe -x test 'test.c:3'
% perf record -e '{cpu/cpu-cycles,period=10000/,probe_test:main}:S' ./test
% perf script
<segfault>Committer testing:
Before:
# perf probe -x /lib64/libc-2.28.so malloc
Added new event:
probe_libc:malloc (on malloc in /usr/lib64/libc-2.28.so)You can now use it in all perf tools, such as:
perf record -e probe_libc:malloc -aR sleep 1
# perf probe -l
probe_libc:malloc (on __libc_malloc@malloc/malloc.c in /usr/lib64/libc-2.28.so)
# perf record -e '{cpu/cpu-cycles,period=10000/,probe_libc:*}:S' sleep 1
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.023 MB perf.data (40 samples) ]
# perf script
Segmentation fault (core dumped)
^C
#After:
# perf script | head -6
sleep 2888 94796.944981: 16198 cpu/cpu-cycles,period=10000/: ffffffff925dc04f get_random_u32+0x1f (/lib/modules/5.0.0-rc2+/build/vmlinux)
sleep 2888 [-01] 94796.944981: probe_libc:malloc:
sleep 2888 94796.944983: 4713 cpu/cpu-cycles,period=10000/: ffffffff922763af change_protection+0xcf (/lib/modules/5.0.0-rc2+/build/vmlinux)
sleep 2888 [-01] 94796.944983: probe_libc:malloc:
sleep 2888 94796.944986: 9934 cpu/cpu-cycles,period=10000/: ffffffff922777e0 move_page_tables+0x0 (/lib/modules/5.0.0-rc2+/build/vmlinux)
sleep 2888 [-01] 94796.944986: probe_libc:malloc:
#--- tools/perf/builtin-script.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/builtin-script.c +1 -1
@@ -1658,7 +1658,7 @@ static void process_event(struct perf_script *script,return ; } -if (PRINT_FIELD (TRACE )) { +if (PRINT_FIELD (TRACE ) && sample->raw_data) {event_format__fprintf (evsel->tp_format, sample->cpu, sample->raw_data, sample->raw_size, fp); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 4/149 perf core: Fix perf_proc_update_handler() bug
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1a51c5da5acc6c188c917ba572eebac5f8793432 ]
The perf_proc_update_handler() handles /proc/sys/kernel/perf_event_max_sample_rate syctl variable. When the PMU IRQ handler timing monitoring is disabled, i.e, when /proc/sys/kernel/perf_cpu_time_max_percent is equal to 0 or 100, then no modification to sysctl_perf_event_sample_rate is allowed to prevent possible hang from wrong values.
The problem is that the test to prevent modification is made after the sysctl variable is modified in perf_proc_update_handler().
You get an error:
$ echo 10001 >/proc/sys/kernel/perf_event_max_sample_rate echo: write error: invalid argument
But the value is still modified causing all sorts of inconsistencies:
$ cat /proc/sys/kernel/perf_event_max_sample_rate 10001
This patch fixes the problem by moving the parsing of the value after the test.
Committer testing:
# echo 100 > /proc/sys/kernel/perf_cpu_time_max_percent # echo 10001 > /proc/sys/kernel/perf_event_max_sample_rate -bash: echo: write error: Invalid argument # cat /proc/sys/kernel/perf_event_max_sample_rate 10001 #
--- kernel/events/core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
kernel/events/core.c +7 -7
@@ -436,18 +436,18 @@ int perf_proc_update_handler(struct ctl_table *table, int write, void __user *buffer, size_t *lenp, loff_t *ppos) { - int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); - -if (ret || !write) -return ret; - + int ret; +int perf_cpu = sysctl_perf_cpu_time_max_percent;/* * If throttling is disabled don't allow the write: */ -if (sysctl_perf_cpu_time_max_percent ==100 || - sysctl_perf_cpu_time_max_percent ==0 ) +if (write && (perf_cpu ==100 || perf_cpu ==0 ))return -EINVAL ; + ret =proc_dointvec_minmax (table, write, buffer, lenp, ppos); +if (ret || !write) +return ret; + max_samples_per_tick =DIV_ROUND_UP (sysctl_perf_event_sample_rate,HZ ); perf_sample_period_ns =NSEC_PER_SEC / sysctl_perf_event_sample_rate;update_perf_cpu_limits ();
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 5/149 perf tools: Handle TOPOLOGY headers with no CPU
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1497e804d1a6e2bd9107ddf64b0310449f4673eb ]
This patch fixes an issue in cpumap.c when used with the TOPOLOGY header. In some configurations, some NUMA nodes may have no CPU (empty cpulist). Yet a cpumap map must be created otherwise perf abort with an error. This patch handles this case by creating a dummy map.
Before:
$ perf record -o - -e cycles noploop 2 | perf script -i - 0x6e8 [0x6c]: failed to process type: 80
After:
$ perf record -o - -e cycles noploop 2 | perf script -i - noploop for 2 seconds
--- tools/perf/util/cpumap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
tools/perf/util/cpumap.c +9 -2
@@ -134,7 +134,12 @@ struct cpu_map *cpu_map__new(const char *cpu_list)if (!cpu_list)return cpu_map__read_all_cpu_map (); -if (!isdigit (*cpu_list)) +/* +* must handle the case of empty cpumap to cover +* TOPOLOGY header for NUMA nodes with no CPU +* ( e.g., because of CPU hotplug) +*/ +if (!isdigit (*cpu_list) && *cpu_list !='\0' ) goto out;while (isdigit (*cpu_list)) {
@@ -181,8 +186,10 @@ struct cpu_map *cpu_map__new(const char *cpu_list)if (nr_cpus >0 ) cpus =cpu_map__trim_new (nr_cpus, tmp_cpus); -else +else if (*cpu_list !='\0' ) cpus =cpu_map__default_new (); +else + cpus =cpu_map__dummy_new (); invalid:free (tmp_cpus); out:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 6/149 perf script: Fix crash when processing recorded stat data
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8bf8c6da53c2265aea365a1de6038f118f522113 ]
While updating perf to work with Python3 and Python2 I noticed that the stat-cpi script was dumping core.
$ perf stat -e cycles,instructions record -o /tmp/perf.data /bin/false
Performance counter stats for '/bin/false':
802,148 cycles
604,622 instructions 802,148 cycles
604,622 instructions
0.001445842 seconds time elapsed$ perf script -i /tmp/perf.data -s scripts/python/stat-cpi.py
Segmentation fault (core dumped)
...
...
rblist=rblist@entry=0xb2a200 <rt_stat>,
new_entry=new_entry@entry=0x7ffcb755c310) at util/rblist.c:33
ctx=<optimized out>, type=<optimized out>, create=<optimized out>,
cpu=<optimized out>, evsel=<optimized out>) at util/stat-shadow.c:118
ctx=<optimized out>, type=<optimized out>, st=<optimized out>)
at util/stat-shadow.c:196
count=count@entry=727442, cpu=cpu@entry=0, st=0xb2a200 <rt_stat>)
at util/stat-shadow.c:239
config=config@entry=0xafeb40 <stat_config>,
counter=counter@entry=0x133c6e0) at util/stat.c:372
...
...The issue is that since 1fcd03946b52 perf_stat__update_shadow_stats now calls update_runtime_stat passing rt_stat rather than calling update_stats but perf_stat__init_shadow_stats has never been called to initialize rt_stat in the script path processing recorded stat data.
Since I can't see any reason why perf_stat__init_shadow_stats() is presently initialized like it is in builtin-script.c::perf_sample__fprint_metric() [4bd1bef8bba2f] I'm proposing it instead be initialized once in __cmd_script
Committer testing:
After applying the patch:
# perf script -i /tmp/perf.data -s tools/perf/scripts/python/stat-cpi.py
0.001970: cpu -1, thread -1 -> cpi 1.709079 (1075684/629394)
#No segfault.
--- tools/perf/builtin-script.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
tools/perf/builtin-script.c +2 -5
@@ -1589,13 +1589,8 @@ static void perf_sample__fprint_metric(struct perf_script *script, .force_header = false, };struct perf_evsel *ev2; -static bool init;u64 val; -if (!init) { -perf_stat__init_shadow_stats (); - init = true; - }if (!evsel->stats)perf_evlist__alloc_stats (script->session->evlist, false);if (evsel_script (evsel->leader)->gnum++ ==0 )
@@ -2214,6 +2209,8 @@ static int __cmd_script(struct perf_script *script)signal (SIGINT , sig_handler); +perf_stat__init_shadow_stats (); +/* override event processing functions */ if (script->show_task_events) { script->tool.comm = process_comm_event;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 7/149 IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 904bba211acc2112fdf866e5a2bc6cd9ecd0de1b ]
The work completion length for a receiving a UD send with immediate is short by 4 bytes causing application using this opcode to fail.
The UD receive logic incorrectly subtracts 4 bytes for immediate value. These bytes are already included in header length and are used to calculate header/payload split, so the result is these 4 bytes are subtracted twice, once when the header length subtracted from the overall length and once again in the UD opcode specific path.
Remove the extra subtraction when handling the opcode.
--- drivers/infiniband/hw/hfi1/ud.c | 1 - drivers/infiniband/hw/qib/qib_ud.c | 1 - 2 files changed, 2 deletions(-)
drivers/infiniband/hw/hfi1/ud.c +0 -1
@@ -980,7 +980,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet) opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) { wc.ex.imm_data = packet->ohdr->u.ud.imm_data; wc.wc_flags =IB_WC_WITH_IMM ; - tlen -=sizeof (u32); } else if (opcode == IB_OPCODE_UD_SEND_ONLY) { wc.ex.imm_data =0 ; wc.wc_flags =0 ;
drivers/infiniband/hw/qib/qib_ud.c +0 -1
@@ -513,7 +513,6 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct ib_header *hdr, opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) { wc.ex.imm_data = ohdr->u.ud.imm_data; wc.wc_flags =IB_WC_WITH_IMM ; - tlen -=sizeof (u32); } else if (opcode == IB_OPCODE_UD_SEND_ONLY) { wc.ex.imm_data =0 ; wc.wc_flags =0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 8/149 iommu/amd: Call free_iova_fast with pfn in map_sg
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 51d8838d66d3249508940d8f59b07701f2129723 ]
In the error path of map_sg, free_iova_fast is being called with address instead of the pfn. This results in a bad value getting into the rcache, and can result in hitting a BUG_ON when iova_magazine_free_pfns is called.
--- drivers/iommu/amd_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/amd_iommu.c +1 -1
@@ -2561,7 +2561,7 @@ static int map_sg(struct device *dev, struct scatterlist *sglist, } out_free_iova: -free_iova_fast (&dma_dom->iovad, address, npages); +free_iova_fast (&dma_dom->iovad, address >>PAGE_SHIFT , npages); out_err:return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 9/149 iommu/amd: Unmap all mapped pages in error path of map_sg
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f1724c0883bb0ce93b8dcb94b53dcca3b75ac9a7 ]
In the error path of map_sg there is an incorrect if condition for breaking out of the loop that searches the scatterlist for mapped pages to unmap. Instead of breaking out of the loop once all the pages that were mapped have been unmapped, it will break out of the loop after it has unmapped 1 page. Fix the condition, so it breaks out of the loop only after all the mapped pages have been unmapped.
--- drivers/iommu/amd_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/amd_iommu.c +1 -1
@@ -2555,7 +2555,7 @@ static int map_sg(struct device *dev, struct scatterlist *sglist, bus_addr = address + s->dma_address + (j <<PAGE_SHIFT );iommu_unmap_page (domain, bus_addr,PAGE_SIZE ); -if (--mapped_pages) +if (--mapped_pages ==0 ) goto out_free_iova; } }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 10/149 riscv: fixup max_low_pfn with PFN_DOWN.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 28198c4639b39899a728ac89aea29d2a7a72562f ]
max_low_pfn should be pfn_size not byte_size.
--- arch/riscv/kernel/setup.c | 2 +- arch/riscv/mm/init.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
arch/riscv/kernel/setup.c +1 -1
@@ -186,7 +186,7 @@ static void __init setup_bootmem(void)BUG_ON (mem_size ==0 );set_max_mapnr (PFN_DOWN (mem_size)); - max_low_pfn =memblock_end_of_DRAM (); + max_low_pfn =PFN_DOWN (memblock_end_of_DRAM ());#ifdef CONFIG_BLK_DEV_INITRD setup_initrd ();
arch/riscv/mm/init.c +2 -1
@@ -29,7 +29,8 @@ static void __init zone_sizes_init(void)unsigned long max_zone_pfns[MAX_NR_ZONES ] = {0 , };#ifdef CONFIG_ZONE_DMA32 - max_zone_pfns[ZONE_DMA32 ] =PFN_DOWN (min (4UL *SZ_1G , max_low_pfn)); + max_zone_pfns[ZONE_DMA32 ] =PFN_DOWN (min (4UL *SZ_1G , + (unsigned long )PFN_PHYS (max_low_pfn)));#endif max_zone_pfns[ZONE_NORMAL ] = max_low_pfn;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 11/149 ipvs: Fix signed integer overflow when setsockopt timeout
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 53ab60baa1ac4f20b080a22c13b77b6373922fd7 ]
There is a UBSAN bug report as below:
UBSAN: Undefined behaviour in net/netfilter/ipvs/ip_vs_ctl.c:2227:21
signed integer overflow:
-2147483647 * 1000 cannot be represented in type 'int'
Reproduce program:
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#define IPPROTO_IP 0
#define IPPROTO_RAW 255
#define IP_VS_BASE_CTL (64+1024+64)
#define IP_VS_SO_SET_TIMEOUT (IP_VS_BASE_CTL+10)
/* The argument to IP_VS_SO_GET_TIMEOUT */
struct ipvs_timeout_t {
int tcp_timeout;
int tcp_fin_timeout;
int udp_timeout;
};
int main() {
int ret = -1;
int sockfd = -1;
struct ipvs_timeout_t to;
sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
if (sockfd == -1) {
printf("socket init error\n");
return -1;
}
to.tcp_timeout = -2147483647;
to.tcp_fin_timeout = -2147483647;
to.udp_timeout = -2147483647;
ret = setsockopt(sockfd,
IPPROTO_IP,
IP_VS_SO_SET_TIMEOUT,
(char *)(&to),
sizeof(to));
printf("setsockopt return %d\n", ret);
return ret;
}Return -EINVAL if the timeout value is negative or max than 'INT_MAX / HZ'.
--- net/netfilter/ipvs/ip_vs_ctl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
net/netfilter/ipvs/ip_vs_ctl.c +12 -0
@@ -2220,6 +2220,18 @@ static int ip_vs_set_timeout(struct netns_ipvs *ipvs, struct ip_vs_timeout_user u->tcp_fin_timeout, u->udp_timeout); +#ifdef CONFIG_IP_VS_PROTO_TCP +if (u->tcp_timeout <0 || u->tcp_timeout > (INT_MAX /HZ ) || + u->tcp_fin_timeout <0 || u->tcp_fin_timeout > (INT_MAX /HZ )) { +return -EINVAL ; + } +#endif + +#ifdef CONFIG_IP_VS_PROTO_UDP +if (u->udp_timeout <0 || u->udp_timeout > (INT_MAX /HZ )) +return -EINVAL ; +#endif +#ifdef CONFIG_IP_VS_PROTO_TCP if (u->tcp_timeout) { pd =ip_vs_proto_data_get (ipvs,IPPROTO_TCP );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 12/149 iommu/amd: Fix IOMMU page flush when detach device from a domain
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9825bd94e3a2baae1f4874767ae3a7d4c049720e ]
When a VM is terminated, the VFIO driver detaches all pass-through devices from VFIO domain by clearing domain id and page table root pointer from each device table entry (DTE), and then invalidates the DTE. Then, the VFIO driver unmap pages and invalidate IOMMU pages.
Currently, the IOMMU driver keeps track of which IOMMU and how many devices are attached to the domain. When invalidate IOMMU pages, the driver checks if the IOMMU is still attached to the domain before issuing the invalidate page command.
However, since VFIO has already detached all devices from the domain, the subsequent INVALIDATE_IOMMU_PAGES commands are being skipped as there is no IOMMU attached to the domain. This results in data corruption and could cause the PCI device to end up in indeterministic state.
Fix this by invalidate IOMMU pages when detach a device, and before decrementing the per-domain device reference counts.
--- drivers/iommu/amd_iommu.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/iommu/amd_iommu.c +11 -4
@@ -1929,16 +1929,13 @@ static void do_attach(struct iommu_dev_data *dev_data,static void do_detach (struct iommu_dev_data *dev_data) { +struct protection_domain *domain = dev_data->domain;struct amd_iommu *iommu;u16 alias; iommu = amd_iommu_rlookup_table[dev_data->devid]; alias = dev_data->alias; -/* decrease reference counters */ - dev_data->domain->dev_iommu[iommu->index] -=1 ; - dev_data->domain->dev_cnt -=1 ; -/* Update data structures */ dev_data->domain =NULL ;list_del (&dev_data->list);
@@ -1948,6 +1945,16 @@ static void do_detach(struct iommu_dev_data *dev_data)/* Flush the DTE entry */ device_flush_dte (dev_data); + +/* Flush IOTLB */ +domain_flush_tlb_pde (domain); + +/* Wait for the flushes to finish */ +domain_flush_complete (domain); + +/* decrease reference counters - needs to happen after the flushes */ + domain->dev_iommu[iommu->index] -=1 ; + domain->dev_cnt -=1 ; }/*
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 13/149 clk: ti: Fix error handling in ti_clk_parse_divider_data()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 303aef8b84272d73999a3207dd05bbe10ed89dc5 ]
The ti_clk_parse_divider_data() function is only called from _get_div_table_from_setup(). That function doesn't look at the return value but instead looks at the "*table" pointer. In this case, if the kcalloc() fails then *table is NULL (which means success). It should instead be an error pointer.
The ti_clk_parse_divider_data() function has two callers. One checks for errors and the other doesn't. I have fixed it so now both handle errors.
--- drivers/clk/ti/divider.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/clk/ti/divider.c +10 -1
@@ -367,8 +367,10 @@ int ti_clk_parse_divider_data(int *div_table, int num_dividers, int max_div, num_dividers = i; tmp =kcalloc (valid_div +1 ,sizeof (*tmp),GFP_KERNEL ); -if (!tmp) +if (!tmp) { + *table =ERR_PTR (-ENOMEM );return -ENOMEM ; + } valid_div =0 ; *width =0 ;
@@ -403,6 +405,7 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup) {struct clk_omap_divider *div;struct clk_omap_reg *reg; +int ret;if (!setup)return NULL ;
@@ -422,6 +425,12 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup) div->flags |=CLK_DIVIDER_POWER_OF_TWO ; div->table =_get_div_table_from_setup (setup, &div->width); +if (IS_ERR (div->table)) { + ret =PTR_ERR (div->table); +kfree (div); +return ERR_PTR (ret); + } + div->shift = setup->bit_shift; div->latch = -EINVAL ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 14/149 clk: qcom: gcc: Use active only source for CPUSS clocks
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9ff1a3b4912528f853048ccd9757ba6a2cc75557 ]
The clocks of the CPUSS such as "gcc_cpuss_ahb_clk_src" is a CRITICAL clock and needs to vote on the active only source of XO, so as to keep the vote as long as CPUSS is active. Similar rbcpr_clk_src is also has the same requirement.
--- drivers/clk/qcom/gcc-sdm845.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/clk/qcom/gcc-sdm845.c +10 -4
@@ -131,8 +131,8 @@ static const char * const gcc_parent_names_6[] = { "core_bi_pll_test_se", }; -static const char *const gcc_parent_names_7[] = { -"bi_tcxo" , +static const char *const gcc_parent_names_7_ao[] = { +"bi_tcxo_ao" ,"gpll0" ,"gpll0_out_even" ,"core_bi_pll_test_se" ,
@@ -144,6 +144,12 @@ static const char * const gcc_parent_names_8[] = { "core_bi_pll_test_se", }; +static const char *const gcc_parent_names_8_ao[] = { +"bi_tcxo_ao" , +"gpll0" , +"core_bi_pll_test_se" , +}; +static const struct parent_map gcc_parent_map_10[] = { {P_BI_TCXO ,0 }, {P_GPLL0_OUT_MAIN ,1 },
@@ -226,7 +232,7 @@ static struct clk_rcg2 gcc_cpuss_ahb_clk_src = { .freq_tbl = ftbl_gcc_cpuss_ahb_clk_src, .clkr.hw.init = &(struct clk_init_data ){ .name ="gcc_cpuss_ahb_clk_src" , - .parent_names = gcc_parent_names_7, + .parent_names = gcc_parent_names_7_ao, .num_parents =4 , .ops = &clk_rcg2_ops, },
@@ -245,7 +251,7 @@ static struct clk_rcg2 gcc_cpuss_rbcpr_clk_src = { .freq_tbl = ftbl_gcc_cpuss_rbcpr_clk_src, .clkr.hw.init = &(struct clk_init_data ){ .name ="gcc_cpuss_rbcpr_clk_src" , - .parent_names = gcc_parent_names_8, + .parent_names = gcc_parent_names_8_ao, .num_parents =3 , .ops = &clk_rcg2_ops, },
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 15/149 xtensa: SMP: fix ccount_timer_shutdown
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4fe8713b873fc881284722ce4ac47995de7cf62c ]
ccount_timer_shutdown is called from the atomic context in the secondary_start_kernel, resulting in the following BUG:
BUG: sleeping function called from invalid context in_atomic(): 1, irqs_disabled(): 1, pid: 0, name: swapper/1 Preemption disabled at: secondary_start_kernel+0xa1/0x130 Call Trace: ___might_sleep+0xe7/0xfc __might_sleep+0x41/0x44 synchronize_irq+0x24/0x64 disable_irq+0x11/0x14 ccount_timer_shutdown+0x12/0x20 clockevents_switch_state+0x82/0xb4 clockevents_exchange_device+0x54/0x60 tick_check_new_device+0x46/0x70 clockevents_register_device+0x8c/0xc8 clockevents_config_and_register+0x1d/0x2c local_timer_setup+0x75/0x7c secondary_start_kernel+0xb4/0x130 should_never_return+0x32/0x35
Use disable_irq_nosync instead of disable_irq to avoid it. This is safe because the ccount timer IRQ is per-CPU, and once IRQ is masked the ISR will not be called.
--- arch/xtensa/kernel/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/xtensa/kernel/time.c +1 -1
@@ -89,7 +89,7 @@ static int ccount_timer_shutdown(struct clock_event_device *evt) container_of(evt, struct ccount_timer, evt);if (timer->irq_enabled) { -disable_irq (evt->irq); +disable_irq_nosync (evt->irq); timer->irq_enabled =0 ; }return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 16/149 riscv: Adjust mmap base address at a third of task size
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ae662eec8a515ab550524e04c793b5ddf1aae3a1 ]
This ratio is the most used among all other architectures and make icache_hygiene libhugetlbfs test pass: this test mmap lots of hugepages whose addresses, without this patch, reach the end of the process user address space.
--- arch/riscv/include/asm/processor.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/include/asm/processor.h +1 -1
@@ -22,7 +22,7 @@* This decides where the kernel will search for a free chunk of vm * space during mmap's. */ -#define TASK_UNMAPPED_BASE PAGE_ALIGN(TASK_SIZE >> 1) +#define TASK_UNMAPPED_BASE PAGE_ALIGN(TASK_SIZE / 3)#define STACK_TOP TASK_SIZE#define STACK_TOP_MAX STACK_TOP
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 17/149 IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6ab4aba00f811a5265acc4d3eb1863bb3ca60562 ]
The following BUG was reported by kasan:
BUG: KASAN: use-after-free in ipoib_cm_tx_start+0x430/0x1390 [ib_ipoib]
Read of size 80 at addr ffff88034c30bcd0 by task kworker/u16:1/24020
Workqueue: ipoib_wq ipoib_cm_tx_start [ib_ipoib]
Call Trace:
dump_stack+0x9a/0xeb
print_address_description+0xe3/0x2e0
kasan_report+0x18a/0x2e0
? ipoib_cm_tx_start+0x430/0x1390 [ib_ipoib]
memcpy+0x1f/0x50
ipoib_cm_tx_start+0x430/0x1390 [ib_ipoib]
? kvm_clock_read+0x1f/0x30
? ipoib_cm_skb_reap+0x610/0x610 [ib_ipoib]
? __lock_is_held+0xc2/0x170
? process_one_work+0x880/0x1960
? process_one_work+0x912/0x1960
process_one_work+0x912/0x1960
? wq_pool_ids_show+0x310/0x310
? lock_acquire+0x145/0x440
worker_thread+0x87/0xbb0
? process_one_work+0x1960/0x1960
kthread+0x314/0x3d0
? kthread_create_worker_on_cpu+0xc0/0xc0
ret_from_fork+0x3a/0x50
Allocated by task 0:
kasan_kmalloc+0xa0/0xd0
kmem_cache_alloc_trace+0x168/0x3e0
path_rec_create+0xa2/0x1f0 [ib_ipoib]
ipoib_start_xmit+0xa98/0x19e0 [ib_ipoib]
dev_hard_start_xmit+0x159/0x8d0
sch_direct_xmit+0x226/0xb40
__dev_queue_xmit+0x1d63/0x2950
neigh_update+0x889/0x1770
arp_process+0xc47/0x21f0
arp_rcv+0x462/0x760
__netif_receive_skb_core+0x1546/0x2da0
netif_receive_skb_internal+0xf2/0x590
napi_gro_receive+0x28e/0x390
ipoib_ib_handle_rx_wc_rss+0x873/0x1b60 [ib_ipoib]
ipoib_rx_poll_rss+0x17d/0x320 [ib_ipoib]
net_rx_action+0x427/0xe30
__do_softirq+0x28e/0xc42
Freed by task 26680:
__kasan_slab_free+0x11d/0x160
kfree+0xf5/0x360
ipoib_flush_paths+0x532/0x9d0 [ib_ipoib]
ipoib_set_mode_rss+0x1ad/0x560 [ib_ipoib]
set_mode+0xc8/0x150 [ib_ipoib]
kernfs_fop_write+0x279/0x440
__vfs_write+0xd8/0x5c0
vfs_write+0x15e/0x470
ksys_write+0xb8/0x180
do_syscall_64+0x9b/0x420
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff88034c30bcc8
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 8 bytes inside of
512-byte region [ffff88034c30bcc8, ffff88034c30bec8)
The buggy address belongs to the page:The following race between change mode and xmit flow is the reason for this use-after-free:
Change mode Send packet 1 to GID XX Send packet 2 to GID XX
| | |
start | |
| | |
| | |
| Create new path for GID XX |
| and update neigh path |
| | |
| | |
| | |
flush_paths | |
| |
queue_work(cm.start_task) |
| Path for GID XX not found
| create new path
|
| start_task runs with old
released path
There is no locking to protect the lifetime of the path through the ipoib_cm_tx struct, so delete it entirely and always use the newly looked up path under the priv->lock.
--- drivers/infiniband/ulp/ipoib/ipoib.h | 1 - drivers/infiniband/ulp/ipoib/ipoib_cm.c | 3 +-- 2 files changed, 1 insertion(+), 3 deletions(-)
drivers/infiniband/ulp/ipoib/ipoib.h +0 -1
@@ -248,7 +248,6 @@ struct ipoib_cm_tx {struct list_head list;struct net_device *dev;struct ipoib_neigh *neigh; -struct ipoib_path *path;struct ipoib_tx_buf *tx_ring;unsigned int tx_head;unsigned int tx_tail;
drivers/infiniband/ulp/ipoib/ipoib_cm.c +1 -2
@@ -1312,7 +1312,6 @@ struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path neigh->cm = tx; tx->neigh = neigh; - tx->path = path; tx->dev = dev;list_add (&tx->list, &priv->cm.start_list);set_bit (IPOIB_FLAG_INITIALIZED , &tx->flags);
@@ -1371,7 +1370,7 @@ static void ipoib_cm_tx_start(struct work_struct *work) neigh->daddr + QPN_AND_OPTIONS_OFFSET); goto free_neigh; } -memcpy (&pathrec, &p->path->pathrec,sizeof (pathrec)); +memcpy (&pathrec, &path->pathrec,sizeof (pathrec));spin_unlock_irqrestore (&priv->lock, flags);netif_tx_unlock_bh (dev);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 18/149 selftests: cpu-hotplug: fix case where CPUs offline > CPUs present
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2b531b6137834a55857a337ac17510d6436b6fbb ]
The cpu-hotplug test assumes that we can offline the maximum CPU as described by /sys/devices/system/cpu/offline. However, in the case where the number of CPUs exceeds like kernel configuration then the offline count can be greater than the present count and we end up trying to test the offlining of a CPU that is not available to offline. Fix this by testing the maximum present CPU instead.
Also, the test currently offlines the CPU and does not online it, so fix this by onlining the CPU after the test.
--- .../selftests/cpu-hotplug/cpu-on-off-test.sh | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh +10 -3
@@ -37,6 +37,10 @@ prerequisite() exit $ksft_skip fi + present_cpus=`cat $SYSFS/devices/system/cpu/present` + present_max=${present_cpus##*-} + echo "present_cpus = $present_cpus present_max = $present_max" + echo -e "\t Cpus in online state: $online_cpus" offline_cpus=`cat $SYSFS/devices/system/cpu/offline`
@@ -151,6 +155,8 @@ online_cpus=0 online_max=0 offline_cpus=0 offline_max=0 +present_cpus=0 +present_max=0 while getopts e:ahp: opt; do case $opt in
@@ -190,9 +196,10 @@ if [ $allcpus -eq 0 ]; then online_cpu_expect_success $online_max if [[ $offline_cpus -gt 0 ]]; then - echo -e "\t offline to online to offline: cpu $offline_max" - online_cpu_expect_success $offline_max - offline_cpu_expect_success $offline_max + echo -e "\t offline to online to offline: cpu $present_max" + online_cpu_expect_success $present_max + offline_cpu_expect_success $present_max + online_cpu $present_max fi exit 0 else
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 19/149 xtensa: SMP: fix secondary CPU initialization
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 32a7726c4f4aadfabdb82440d84f88a5a2c8fe13 ]
- add missing memory barriers to the secondary CPU synchronization spin loops; add comment to the matching memory barrier in the boot_secondary and __cpu_die functions;
- use READ_ONCE/WRITE_ONCE to access cpu_start_id/cpu_start_ccount instead of reading/writing them directly;
- re-initialize cpu_running every time before starting secondary CPU to flush possible previous CPU startup results.
--- arch/xtensa/kernel/head.S | 5 ++++- arch/xtensa/kernel/smp.c | 34 +++++++++++++++++++++------------- 2 files changed, 25 insertions(+), 14 deletions(-)
arch/xtensa/kernel/head.S +4 -1
@@ -280,12 +280,13 @@ should_never_return: movi a2, cpu_start_ccount 1: + memw l32i a3, a2, 0 beqi a3, 0, 1b movi a3, 0 s32i a3, a2, 0 - memw 1: + memw l32i a3, a2, 0 beqi a3, 0, 1b wsr a3, ccount
@@ -321,11 +322,13 @@ ENTRY(cpu_restart) rsr a0, prid neg a2, a0 movi a3, cpu_start_id + memw s32i a2, a3, 0 #if XCHAL_DCACHE_IS_WRITEBACK dhwbi a3, 0 #endif 1: + memw l32i a2, a3, 0 dhi a3, 0 bne a2, a0, 1b
arch/xtensa/kernel/smp.c +21 -13
@@ -195,9 +195,11 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)int i;#ifdef CONFIG_HOTPLUG_CPU - cpu_start_id = cpu; -system_flush_invalidate_dcache_range ( - (unsigned long )&cpu_start_id,sizeof (cpu_start_id)); +WRITE_ONCE (cpu_start_id, cpu); +/* Pairs with the third memw in the cpu_restart */ +mb (); +system_flush_invalidate_dcache_range ((unsigned long )&cpu_start_id, +sizeof (cpu_start_id));#endif smp_call_function_single (0 , mx_cpu_start, (void *)cpu,1 );
@@ -206,18 +208,21 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts) ccount =get_ccount ();while (!ccount); - cpu_start_ccount = ccount; +WRITE_ONCE (cpu_start_ccount, ccount); -while (time_before (jiffies, timeout)) { +do { +/* +* Pairs with the first two memws in the +* .Lboot_secondary. +*/ mb (); -if (!cpu_start_ccount) -break ; - } + ccount =READ_ONCE (cpu_start_ccount); + }while (ccount &&time_before (jiffies, timeout)); -if (cpu_start_ccount) { +if (ccount) {smp_call_function_single (0 , mx_cpu_stop, - (void *)cpu,1 ); - cpu_start_ccount =0 ; + (void *)cpu,1 ); +WRITE_ONCE (cpu_start_ccount,0 );return -EIO ; } }
@@ -237,6 +242,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)pr_debug ("%s: Calling wakeup_secondary(cpu:%d, idle:%p, sp: %08lx)\n" , __func__, cpu, idle, start_info.stack); +init_completion (&cpu_running); ret =boot_secondary (cpu, idle);if (ret ==0 ) { wait_for_completion_timeout(&cpu_running,
@@ -298,8 +304,10 @@ void __cpu_die(unsigned int cpu)unsigned long timeout = jiffies +msecs_to_jiffies (1000 );while (time_before (jiffies, timeout)) {system_invalidate_dcache_range ((unsigned long )&cpu_start_id, -sizeof (cpu_start_id)); -if (cpu_start_id == -cpu) { +sizeof (cpu_start_id)); +/* Pairs with the second memw in the cpu_restart */ +mb (); +if (READ_ONCE (cpu_start_id) == -cpu) {platform_cpu_kill (cpu);return ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 20/149 xtensa: smp_lx200_defconfig: fix vectors clash
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 306b38305c0f86de7f17c5b091a95451dcc93d7d ]
Secondary CPU reset vector overlaps part of the double exception handler code, resulting in weird crashes and hangups when running user code. Move exception vectors one page up so that they don't clash with the secondary CPU reset vector.
--- arch/xtensa/configs/smp_lx200_defconfig | 1 + 1 file changed, 1 insertion(+)
arch/xtensa/configs/smp_lx200_defconfig +1 -0
@@ -33,6 +33,7 @@ CONFIG_SMP=y CONFIG_HOTPLUG_CPU=y # CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX is not set # CONFIG_PCI is not set +CONFIG_VECTORS_OFFSET=0x00002000 CONFIG_XTENSA_PLATFORM_XTFPGA=y CONFIG_CMDLINE_BOOL=y CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=96M@0"
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 21/149 xtensa: SMP: mark each possible CPU as present
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8b1c42cdd7181200dc1fff39dcb6ac1a3fac2c25 ]
Otherwise it is impossible to enable CPUs after booting with 'maxcpus' parameter.
--- arch/xtensa/kernel/smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/xtensa/kernel/smp.c +1 -1
@@ -83,7 +83,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus) {unsigned i; -for (i =0 ; i < max_cpus; ++i) +for_each_possible_cpu (i)set_cpu_present (i, true); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 22/149 iomap: get/put the page in iomap_page_create/release()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8e47a457321ca1a74ad194ab5dcbca764bc70731 ]
migrate_page_move_mapping() expects pages with private data set to have a page_count elevated by 1. This is what used to happen for xfs through the buffer_heads code before the switch to iomap in commit 82cb14175e7d ("xfs: add support for sub-pagesize writeback without buffer_heads"). Not having the count elevated causes move_pages() to fail on memory mapped files coming from xfs.
Make iomap compatible with the migrate_page_move_mapping() assumption by elevating the page count as part of iomap_page_create() and lowering it in iomap_page_release().
It causes the move_pages() syscall to misbehave on memory mapped files from xfs. It does not not move any pages, which I suppose is "just" a perf issue, but it also ends up returning a positive number which is out of spec for the syscall. Talking to Michal Hocko, it sounds like returning positive numbers might be a necessary update to move_pages() anyway though.
[hch: actually get/put the page iomap_migrate_page() to make it work
properly]
--- fs/iomap.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/iomap.c +9 -0
@@ -117,6 +117,12 @@ iomap_page_create(struct inode *inode, struct page *page)atomic_set (&iop->read_count,0 );atomic_set (&iop->write_count,0 );bitmap_zero (iop->uptodate,PAGE_SIZE /SECTOR_SIZE ); + +/* +* migrate_page_move_mapping() assumes that pages with private data have +* their count elevated by 1. +*/ +get_page (page);set_page_private (page, (unsigned long )iop);SetPagePrivate (page);return iop;
@@ -133,6 +139,7 @@ iomap_page_release(struct page *page)WARN_ON_ONCE (atomic_read (&iop->write_count));ClearPagePrivate (page);set_page_private (page,0 ); +put_page (page);kfree (iop); }
@@ -565,8 +572,10 @@ iomap_migrate_page(struct address_space *mapping, struct page *newpage,if (page_has_private (page)) {ClearPagePrivate (page); +get_page (newpage);set_page_private (newpage,page_private (page));set_page_private (page,0 ); +put_page (page);SetPagePrivate (newpage); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 23/149 iomap: fix a use after free in iomap_dio_rw
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4ea899ead2786a30aaa8181fefa81a3df4ad28f6 ]
Introduce a local wait_for_completion variable to avoid an access to the potentially freed dio struture after dropping the last reference count.
Also use the chance to document the completion behavior to make the refcounting clear to the reader of the code.
--- fs/iomap.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
fs/iomap.c +21 -7
@@ -1787,6 +1787,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,loff_t pos = iocb->ki_pos, start = pos;loff_t end = iocb->ki_pos + count -1 , ret =0 ;unsigned int flags =IOMAP_DIRECT ; +bool wait_for_completion =is_sync_kiocb (iocb);struct blk_plug plug;struct iomap_dio *dio;
@@ -1806,7 +1807,6 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, dio->end_io = end_io; dio->error =0 ; dio->flags =0 ; - dio->wait_for_completion =is_sync_kiocb (iocb); dio->submit.iter = iter; dio->submit.waiter = current;
@@ -1861,7 +1861,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,dio_warn_stale_pagecache (iocb->ki_filp); ret =0 ; -if (iov_iter_rw (iter) ==WRITE && !dio->wait_for_completion && +if (iov_iter_rw (iter) ==WRITE && !wait_for_completion && !inode->i_sb->s_dio_done_wq) { ret =sb_init_dio_done_wq (inode->i_sb);if (ret <0 )
@@ -1877,7 +1877,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,if (ret <=0 ) {/* magic error code to fall back to buffered I/O */ if (ret == -ENOTBLK ) { - dio->wait_for_completion = true; + wait_for_completion = true; ret =0 ; }break ;
@@ -1899,8 +1899,24 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,if (dio->flags &IOMAP_DIO_WRITE_FUA ) dio->flags &= ~IOMAP_DIO_NEED_SYNC ; +/* +* We are about to drop our additional submission reference, which +* might be the last reference to the dio. There are three three +* different ways we can progress here: +* +* (a) If this is the last reference we will always complete and free +* the dio ourselves. +* (b) If this is not the last reference, and we serve an asynchronous +* iocb, we must never touch the dio after the decrement, the +* I/O completion handler will complete and free it. +* (c) If this is not the last reference, but we serve a synchronous +* iocb, the I/O completion handler will wake us up on the drop +* of the final reference, and we will complete and free it here +* after we got woken by the I/O completion handler. +*/ + dio->wait_for_completion = wait_for_completion;if (!atomic_dec_and_test (&dio->ref)) { -if (!dio->wait_for_completion) +if (!wait_for_completion)return -EIOCBQUEUED ;for (;;) {
@@ -1917,9 +1933,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,__set_current_state (TASK_RUNNING ); } - ret =iomap_dio_complete (dio); - -return ret; +return iomap_dio_complete (dio); out_free_dio:kfree (dio);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 24/149 xtensa: SMP: limit number of possible CPUs by NR_CPUS
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 25384ce5f9530def39421597b1457d9462df6455 ]
This fixes the following warning at boot when the kernel is booted on a board with more CPU cores than was configured in NR_CPUS:
smp_init_cpus: Core Count = 8
smp_init_cpus: Core Id = 0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at include/linux/cpumask.h:121 smp_init_cpus+0x54/0x74
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.0.0-rc3-00015-g1459333f88a0 #124
Call Trace:
__warn$part$3+0x6a/0x7c
warn_slowpath_null+0x35/0x3c
smp_init_cpus+0x54/0x74
setup_arch+0x1c0/0x1d0
start_kernel+0x44/0x310
_startup+0x107/0x107--- arch/xtensa/kernel/smp.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/xtensa/kernel/smp.c +5 -0
@@ -96,6 +96,11 @@ void __init smp_init_cpus(void)pr_info ("%s: Core Count = %d\n" , __func__, ncpus);pr_info ("%s: Core Id = %d\n" , __func__, core_id); +if (ncpus >NR_CPUS ) { + ncpus =NR_CPUS ; +pr_info ("%s: limiting core count by %d\n" , __func__, ncpus); + } +for (i =0 ; i < ncpus; ++i)set_cpu_possible (i, true); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 25/149 net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6571ebce112a21ec9be68ef2f53b96fcd41fd81b ]
If fill_level was not zero and status was not BUSY, result of "tx_prod - tx_cons - inuse" might be zero. Subtracting 1 unconditionally results invalid negative return value on this case.
Make sure not to return an negative value.
--- drivers/net/ethernet/altera/altera_msgdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/altera/altera_msgdma.c +2 -1
@@ -145,7 +145,8 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv) &0xffff ;if (inuse) {/* Tx FIFO is not empty */ - ready = priv->tx_prod - priv->tx_cons - inuse -1 ; + ready =max_t (int, + priv->tx_prod - priv->tx_cons - inuse -1 ,0 ); }else {/* Check for buffered last packet */ status =csrrd32 (priv->tx_dma_csr,msgdma_csroffs (status));
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 26/149 net: hns: Fix for missing of_node_put() after of_parse_phandle()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 263c6d75f9a544a3c2f8f6a26de4f4808d8f59cf ]
In hns enet driver, we use of_parse_handle() to get hold of the device node related to "ae-handle" but we have missed to put the node reference using of_node_put() after we are done using the node. This patch fixes it.
Note:
This problem is stated in Link: https://lkml.org/lkml/2018/12/22/217
--- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/hisilicon/hns/hns_enet.c +5 -0
@@ -2419,6 +2419,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev) out_notify_fail: (void )cancel_work_sync (&priv->service_task); out_read_prop_fail: +/* safe for ACPI FW */ +of_node_put (to_of_node (priv->fwnode));free_netdev (ndev);return ret; }
@@ -2448,6 +2450,9 @@ static int hns_nic_dev_remove(struct platform_device *pdev)set_bit (NIC_STATE_REMOVING , &priv->state); (void )cancel_work_sync (&priv->service_task); +/* safe for ACPI FW */ +of_node_put (to_of_node (priv->fwnode)); +free_netdev (ndev);return 0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 27/149 net: hns: Restart autoneg need return failed when autoneg off
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ed29ca8b9592562559c64d027fb5eb126e463e2c ]
The hns driver of earlier devices, when autoneg off, restart autoneg will return -EINVAL, so make the hns driver for the latest devices do the same.
--- drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +9 -7
@@ -1157,16 +1157,18 @@ static int hns_get_regs_len(struct net_device *net_dev)*/ static int hns_nic_nway_reset (struct net_device *netdev) { -int ret =0 ;struct phy_device *phy = netdev->phydev; -if (netif_running (netdev)) { -/* if autoneg is disabled, don't restart auto-negotiation */ -if (phy && phy->autoneg ==AUTONEG_ENABLE ) - ret =genphy_restart_aneg (phy); - } +if (!netif_running (netdev)) +return 0 ; -return ret; +if (!phy) +return -EOPNOTSUPP ; + +if (phy->autoneg !=AUTONEG_ENABLE ) +return -EINVAL ; + +return genphy_restart_aneg (phy); } static u32
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 28/149 net: hns: Fix wrong read accesses via Clause 45 MDIO protocol
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit cec8abba13e6a26729dfed41019720068eeeff2b ]
When reading phy registers via Clause 45 MDIO protocol, after write address operation, the driver use another write address operation, so can not read the right value of any phy registers. This patch fixes it.
--- drivers/net/ethernet/hisilicon/hns_mdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns_mdio.c +1 -1
@@ -321,7 +321,7 @@ static int hns_mdio_read(struct mii_bus *bus, int phy_id, int regnum) }hns_mdio_cmd_write (mdio_dev, is_c45, -MDIO_C45_WRITE_ADDR , phy_id, devad); +MDIO_C45_READ , phy_id, devad); }/* Step 5: waitting for MDIO_COMMAND_REG 's mdio_start==0,*/
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 29/149 net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c69c29a1a0a8f68cd87e98ba4a5a79fb8ef2a58c ]
If phy_power_on() fails in rk_gmac_powerup(), clocks are left enabled.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +3 -1
@@ -1342,8 +1342,10 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv) } ret =phy_power_on (bsp_priv, true); -if (ret) +if (ret) { +gmac_clk_enable (bsp_priv, false);return ret; + }pm_runtime_enable (dev);pm_runtime_get_sync (dev);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 30/149 netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2035f3ff8eaa29cfb5c8e2160b0f6e85eeb21a95 ]
Unlike ip(6)tables ebtables only counts user-defined chains.
The effect is that a 32bit ebtables binary on a 64bit kernel can do 'ebtables -N FOO' only after adding at least one rule, else the request fails with -EINVAL.
This is a similar fix as done in3f1e53abff84 ("netfilter: ebtables: don't attempt to allocate 0-sized compat array").
--- net/bridge/netfilter/ebtables.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
net/bridge/netfilter/ebtables.c +6 -3
@@ -2293,9 +2293,12 @@ static int compat_do_replace(struct net *net, void __user *user,xt_compat_lock (NFPROTO_BRIDGE ); - ret =xt_compat_init_offsets (NFPROTO_BRIDGE , tmp.nentries); -if (ret <0 ) - goto out_unlock; +if (tmp.nentries) { + ret =xt_compat_init_offsets (NFPROTO_BRIDGE , tmp.nentries); +if (ret <0 ) + goto out_unlock; + } + ret =compat_copy_entries (entries_tmp, tmp.entries_size, &state);if (ret <0 ) goto out_unlock;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 31/149 gpio: vf610: Mask all GPIO interrupts
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7ae710f9f8b2cf95297e7bbfe1c09789a7dc43d4 ]
On SoC reset all GPIO interrupts are disable. However, if kexec is used to boot into a new kernel, the SoC does not experience a reset. Hence GPIO interrupts can be left enabled from the previous kernel. It is then possible for the interrupt to fire before an interrupt handler is registered, resulting in the kernel complaining of an "unexpected IRQ trap", the interrupt is never cleared, and so fires again, resulting in an interrupt storm.
Disable all GPIO interrupts before registering the GPIO IRQ chip.
--- drivers/gpio/gpio-vf610.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpio/gpio-vf610.c +5 -0
@@ -259,6 +259,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)struct vf610_gpio_port *port;struct resource *iores;struct gpio_chip *gc; +int i;int ret; port =devm_kzalloc (&pdev->dev,sizeof (*port),GFP_KERNEL );
@@ -298,6 +299,10 @@ static int vf610_gpio_probe(struct platform_device *pdev)if (ret <0 )return ret; +/* Mask all GPIO interrupts */ +for (i =0 ; i < gc->ngpio; i++) +vf610_gpio_writel (0 , port->base +PORT_PCR (i)); +/* Clear the interrupt status register for all GPIO's */ vf610_gpio_writel (~0 , port->base +PORT_ISFR );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 32/149 selftests: net: use LDLIBS instead of LDFLAGS
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 870f193d48c25a97d61a8e6c04e3c29a2c606850 ]
reuseport_bpf_numa fails to build due to undefined reference errors:
aarch64-linaro-linux-gcc
--sysroot=/build/tmp-rpb-glibc/sysroots/hikey -Wall
-Wl,--no-as-needed -O2 -g -I../../../../usr/include/ -Wl,-O1
-Wl,--hash-style=gnu -Wl,--as-needed -lnuma reuseport_bpf_numa.c
-o /build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/net/reuseport_bpf_numa /tmp/ccfUuExT.o: In function `send_from_node':
/build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/net/reuseport_bpf_numa.c:138:
undefined reference to `numa_run_on_node'
/tmp/ccfUuExT.o: In function `main':
/build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/net/reuseport_bpf_numa.c:230:
undefined reference to `numa_available' /build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/net/reuseport_bpf_numa.c:233:
undefined reference to `numa_max_node'
It's GNU Make and linker specific.
The default Makefile rule looks like:
$(CC) $(CFLAGS) $(LDFLAGS) $@ $^ $(LDLIBS)
When linking is done by gcc itself, no issue, but when it needs to be passed to proper ld, only LDLIBS follows and then ld cannot know what libs to link with.
More detail:
https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html
LDFLAGS
Extra flags to give to compilers when they are supposed to invoke the linker, ‘ld’, such as -L. Libraries (-lfoo) should be added to the LDLIBS variable instead.
LDLIBS
Library flags or names given to compilers when they are supposed to invoke the linker, ‘ld’. LOADLIBES is a deprecated (but still supported) alternative to LDLIBS. Non-library linker flags, such as -L, should go in the LDFLAGS variable.
https://lkml.org/lkml/2010/2/10/362
tools/perf: libraries must come after objects
Link order matters, use LDLIBS instead of LDFLAGS to properly link against libnuma.
--- tools/testing/selftests/net/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/Makefile +1 -1
@@ -18,6 +18,6 @@ TEST_GEN_PROGS += reuseport_dualstack reuseaddr_conflict tls KSFT_KHDR_INSTALL := 1 include ../lib.mk -$(OUTPUT)/reuseport_bpf_numa: LDFLAGS += -lnuma +$(OUTPUT)/reuseport_bpf_numa: LDLIBS += -lnuma $(OUTPUT)/tcp_mmap: LDFLAGS += -lpthread $(OUTPUT)/tcp_inq: LDFLAGS += -lpthread
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 33/149 selftests: timers: use LDLIBS instead of LDFLAGS
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7d4e591bc051d3382c45caaa2530969fb42ed23d ]
posix_timers fails to build due to undefined reference errors:
aarch64-linaro-linux-gcc --sysroot=/build/tmp-rpb-glibc/sysroots/hikey
-O2 -pipe -g -feliminate-unused-debug-types -O3 -Wl,-no-as-needed -Wall
-DKTEST -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -lrt -lpthread
posix_timers.c
-o /build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/timers/posix_timers /tmp/cc1FTZzT.o: In function `check_timer_create':
/usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/timers/posix_timers.c:157:
undefined reference to `timer_create' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/timers/posix_timers.c:170:
undefined reference to `timer_settime'
collect2: error: ld returned 1 exit status
It's GNU Make and linker specific.
The default Makefile rule looks like:
$(CC) $(CFLAGS) $(LDFLAGS) $@ $^ $(LDLIBS)
When linking is done by gcc itself, no issue, but when it needs to be passed to proper ld, only LDLIBS follows and then ld cannot know what libs to link with.
More detail:
https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html
LDFLAGS
Extra flags to give to compilers when they are supposed to invoke the linker, ‘ld’, such as -L. Libraries (-lfoo) should be added to the LDLIBS variable instead.
LDLIBS
Library flags or names given to compilers when they are supposed to invoke the linker, ‘ld’. LOADLIBES is a deprecated (but still supported) alternative to LDLIBS. Non-library linker flags, such as -L, should go in the LDFLAGS variable.
https://lkml.org/lkml/2010/2/10/362
tools/perf: libraries must come after objects
Link order matters, use LDLIBS instead of LDFLAGS to properly link against libpthread.
--- tools/testing/selftests/timers/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/timers/Makefile +1 -1
@@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 CFLAGS += -O3 -Wl,-no-as-needed -Wall -LDFLAGS += -lrt -lpthread -lm +LDLIBS += -lrt -lpthread -lm # these are all "safe" tests that don't modify # system time or require escalated privileges
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 34/149 nfs: Fix NULL pointer dereference of dev_name
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 80ff00172407e0aad4b10b94ef0816fc3e7813cb ]
There is a NULL pointer dereference of dev_name in nfs_parse_devname()
The oops looks something like:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 ... RIP: 0010:nfs_fs_mount+0x3b6/0xc20 [nfs] ... Call Trace: ? ida_alloc_range+0x34b/0x3d0 ? nfs_clone_super+0x80/0x80 [nfs] ? nfs_free_parsed_mount_data+0x60/0x60 [nfs] mount_fs+0x52/0x170 ? __init_waitqueue_head+0x3b/0x50 vfs_kern_mount+0x6b/0x170 do_mount+0x216/0xdc0 ksys_mount+0x83/0xd0 __x64_sys_mount+0x25/0x30 do_syscall_64+0x65/0x220 entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fix this by adding a NULL check on dev_name
--- fs/nfs/super.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/nfs/super.c +5 -0
@@ -1906,6 +1906,11 @@ static int nfs_parse_devname(const char *dev_name,size_t len;char *end; +if (unlikely (!dev_name || !*dev_name)) { +dfprintk (MOUNT ,"NFS: device name not specified\n" ); +return -EINVAL ; + } +/* Is the host name protected with square brakcets? */ if (*dev_name =='[' ) { end =strchr (++dev_name,']' );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 35/149 qed: Fix bug in tx promiscuous mode settings
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9e71a15d8b5bbce25c637f7f8833cd3f45b65646 ]
When running tx switched traffic between VNICs created via a bridge(to which VFs are added), adapter drops the unicast packets in tx flow due to VNIC's ucast mac being unknown to it. But VF interfaces being in promiscuous mode should have caused adapter to accept all the unknown ucast packets. Later, it was found that driver doesn't really configure tx promiscuous mode settings to accept all unknown unicast macs.
This patch fixes tx promiscuous mode settings to accept all unknown/unmatched unicast macs and works out the scenario.
--- drivers/net/ethernet/qlogic/qed/qed_l2.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/qlogic/qed/qed_l2.c +6 -1
@@ -609,6 +609,10 @@ qed_sp_update_accept_mode(struct qed_hwfn *p_hwfn, (!!(accept_filter &QED_ACCEPT_MCAST_MATCHED ) && !!(accept_filter & QED_ACCEPT_MCAST_UNMATCHED))); +SET_FIELD (state,ETH_VPORT_TX_MODE_UCAST_ACCEPT_ALL , + (!!(accept_filter &QED_ACCEPT_UCAST_MATCHED ) && + !!(accept_filter &QED_ACCEPT_UCAST_UNMATCHED ))); +SET_FIELD (state,ETH_VPORT_TX_MODE_BCAST_ACCEPT_ALL , !!(accept_filter &QED_ACCEPT_BCAST ));
@@ -2688,7 +2692,8 @@ static int qed_configure_filter_rx_mode(struct qed_dev *cdev,if (type ==QED_FILTER_RX_MODE_TYPE_PROMISC ) { accept_flags.rx_accept_filter |=QED_ACCEPT_UCAST_UNMATCHED |QED_ACCEPT_MCAST_UNMATCHED ; - accept_flags.tx_accept_filter |=QED_ACCEPT_MCAST_UNMATCHED ; + accept_flags.tx_accept_filter |=QED_ACCEPT_UCAST_UNMATCHED | +QED_ACCEPT_MCAST_UNMATCHED ; }else if (type ==QED_FILTER_RX_MODE_TYPE_MULTI_PROMISC ) { accept_flags.rx_accept_filter |=QED_ACCEPT_MCAST_UNMATCHED ; accept_flags.tx_accept_filter |=QED_ACCEPT_MCAST_UNMATCHED ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 36/149 qed: Fix LACP pdu drops for VFs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ff9296966e5e00b0d0d00477b2365a178f0f06a3 ]
VF is always configured to drop control frames (with reserved mac addresses) but to work LACP on the VFs, it would require LACP control frames to be forwarded or transmitted successfully.
This patch fixes this in such a way that trusted VFs (marked through ndo_set_vf_trust) would be allowed to pass the control frames such as LACP pdus.
--- drivers/net/ethernet/qlogic/qed/qed_l2.c | 5 +++++ drivers/net/ethernet/qlogic/qed/qed_l2.h | 3 +++ drivers/net/ethernet/qlogic/qed/qed_sriov.c | 10 ++++++++-- 3 files changed, 16 insertions(+), 2 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_l2.c +5 -0
@@ -748,6 +748,11 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn,return rc; } +if (p_params->update_ctl_frame_check) { + p_cmn->ctl_frame_mac_check_en = p_params->mac_chk_en; + p_cmn->ctl_frame_ethtype_check_en = p_params->ethtype_chk_en; + } +/* Update mcast bins for VFs, PF doesn't use this functionality */ qed_sp_update_mcast_bin (p_hwfn, p_ramrod, p_params);
drivers/net/ethernet/qlogic/qed/qed_l2.h +3 -0
@@ -219,6 +219,9 @@ struct qed_sp_vport_update_params {struct qed_rss_params *rss_params;struct qed_filter_accept_flags accept_flags;struct qed_sge_tpa_params *sge_tpa_params; +u8 update_ctl_frame_check; +u8 mac_chk_en; +u8 ethtype_chk_en; }; int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
drivers/net/ethernet/qlogic/qed/qed_sriov.c +8 -2
@@ -1969,7 +1969,9 @@ static void qed_iov_vf_mbx_start_vport(struct qed_hwfn *p_hwfn, params.vport_id = vf->vport_id; params.max_buffers_per_cqe = start->max_buffers_per_cqe; params.mtu = vf->mtu; - params.check_mac = true; + +/* Non trusted VFs should enable control frame filtering */ + params.check_mac = !vf->p_vf_info.is_trusted_configured; rc =qed_sp_eth_vport_start (p_hwfn, ¶ms);if (rc) {
@@ -5130,6 +5132,9 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) params.opaque_fid = vf->opaque_fid; params.vport_id = vf->vport_id; + params.update_ctl_frame_check =1 ; + params.mac_chk_en = !vf_info->is_trusted_configured; +if (vf_info->rx_accept_mode & mask) { flags->update_rx_mode_config =1 ; flags->rx_accept_filter = vf_info->rx_accept_mode;
@@ -5147,7 +5152,8 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) }if (flags->update_rx_mode_config || - flags->update_tx_mode_config) + flags->update_tx_mode_config || + params.update_ctl_frame_check)qed_sp_vport_update (hwfn, ¶ms,QED_SPQ_MODE_EBLOCK ,NULL ); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 37/149 qed: Fix VF probe failure while FLR
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 327852ec64205bb651be391a069784872098a3b2 ]
VFs may hit VF-PF channel timeout while probing, as in some cases it was observed that VF FLR and VF "acquire" message transaction (i.e first message from VF to PF in VF's probe flow) could occur simultaneously which could lead VF to fail sending "acquire" message to PF as VF is marked disabled from HW perspective due to FLR, which will result into channel timeout and VF probe failure.
In such cases, try retrying VF "acquire" message so that in later attempts it could be successful to pass message to PF after the VF FLR is completed and can be probed successfully.
--- drivers/net/ethernet/qlogic/qed/qed_vf.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/qlogic/qed/qed_vf.c +10 -0
@@ -261,6 +261,7 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)struct pfvf_acquire_resp_tlv *resp = &p_iov->pf2vf_reply->acquire_resp;struct pf_vf_pfdev_info *pfdev_info = &resp->pfdev_info;struct vf_pf_resc_request *p_resc; +u8 retry_cnt =VF_ACQUIRE_THRESH ;bool resources_acquired = false;struct vfpf_acquire_tlv *req;int rc =0 , attempts =0 ;
@@ -314,6 +315,15 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)/* send acquire request */ rc =qed_send_msg2pf (p_hwfn, &resp->hdr.status,sizeof (*resp)); + +/* Re-try acquire in case of vf-pf hw channel timeout */ +if (retry_cnt && rc == -EBUSY ) { +DP_VERBOSE (p_hwfn,QED_MSG_IOV , +"VF retrying to acquire due to VPC timeout\n" ); + retry_cnt--; +continue ; + } +if (rc) goto exit;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 38/149 qed: Fix system crash in ll2 xmit
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7c81626a3c37e4ac320b8ad785694ba498f24794 ]
Cache number of fragments in the skb locally as in case of linear skb (with zero fragments), tx completion (or freeing of skb) may happen before driver tries to get number of frgaments from the skb which could lead to stale access to an already freed skb.
--- drivers/net/ethernet/qlogic/qed/qed_ll2.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_ll2.c +15 -5
@@ -2430,19 +2430,24 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb, {struct qed_ll2_tx_pkt_info pkt;const skb_frag_t *frag; +u8 flags =0 , nr_frags;int rc = -EINVAL , i;dma_addr_t mapping;u16 vlan =0 ; -u8 flags =0 ;if (unlikely (skb->ip_summed !=CHECKSUM_NONE )) {DP_INFO (cdev,"Cannot transmit a checksummed packet\n" );return -EINVAL ; } -if (1 +skb_shinfo (skb)->nr_frags >CORE_LL2_TX_MAX_BDS_PER_PACKET ) { +/* Cache number of fragments from SKB since SKB may be freed by +* the completion routine after calling qed_ll2_prepare_tx_packet() +*/ + nr_frags =skb_shinfo (skb)->nr_frags; + +if (1 + nr_frags >CORE_LL2_TX_MAX_BDS_PER_PACKET ) {DP_ERR (cdev,"Cannot transmit a packet with %d fragments\n" , -1 +skb_shinfo (skb)->nr_frags); +1 + nr_frags);return -EINVAL ; }
@@ -2464,7 +2469,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb, }memset (&pkt,0 ,sizeof (pkt)); - pkt.num_of_bds =1 +skb_shinfo (skb)->nr_frags; + pkt.num_of_bds =1 + nr_frags; pkt.vlan = vlan; pkt.bd_flags = flags; pkt.tx_dest =QED_LL2_TX_DEST_NW ;
@@ -2475,12 +2480,17 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb, test_bit(QED_LL2_XMIT_FLAGS_FIP_DISCOVERY, &xmit_flags)) pkt.remove_stag = true; +/* qed_ll2_prepare_tx_packet() may actually send the packet if +* there are no fragments in the skb and subsequently the completion +* routine may run and free the SKB, so no dereferencing the SKB +* beyond this point unless skb has any fragments. +*/ rc =qed_ll2_prepare_tx_packet (&cdev->hwfns[0 ], cdev->ll2->handle, &pkt,1 );if (rc) goto err; -for (i =0 ; i <skb_shinfo (skb)->nr_frags; i++) { +for (i =0 ; i < nr_frags; i++) { frag = &skb_shinfo (skb)->frags[i]; mapping = skb_frag_dma_map(&cdev->pdev->dev, frag, 0,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 39/149 qed: Fix stack out of bounds bug
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ffb057f98928aa099b08e419bbe5afc26ec9f448 ]
KASAN reported following bug in qed_init_qm_get_idx_from_flags due to inappropriate casting of "pq_flags". Fix the type of "pq_flags".
[ 196.624707] BUG: KASAN: stack-out-of-bounds in qed_init_qm_get_idx_from_flags+0x1a4/0x1b8 [qed] [ 196.624712] Read of size 8 at addr ffff809b00bc7360 by task kworker/0:9/1712 [ 196.624714] [ 196.624720] CPU: 0 PID: 1712 Comm: kworker/0:9 Not tainted 4.18.0-60.el8.aarch64+debug #1 [ 196.624723] Hardware name: To be filled by O.E.M. Saber/Saber, BIOS 0ACKL024 09/26/2018 [ 196.624733] Workqueue: events work_for_cpu_fn [ 196.624738] Call trace: [ 196.624742] dump_backtrace+0x0/0x2f8 [ 196.624745] show_stack+0x24/0x30 [ 196.624749] dump_stack+0xe0/0x11c [ 196.624755] print_address_description+0x68/0x260 [ 196.624759] kasan_report+0x178/0x340 [ 196.624762] __asan_report_load_n_noabort+0x38/0x48 [ 196.624786] qed_init_qm_get_idx_from_flags+0x1a4/0x1b8 [qed] [ 196.624808] qed_init_qm_info+0xec0/0x2200 [qed] [ 196.624830] qed_resc_alloc+0x284/0x7e8 [qed] [ 196.624853] qed_slowpath_start+0x6cc/0x1ae8 [qed] [ 196.624864] __qede_probe.isra.10+0x1cc/0x12c0 [qede] [ 196.624874] qede_probe+0x78/0xf0 [qede] [ 196.624879] local_pci_probe+0xc4/0x180 [ 196.624882] work_for_cpu_fn+0x54/0x98 [ 196.624885] process_one_work+0x758/0x1900 [ 196.624888] worker_thread+0x4e0/0xd18 [ 196.624892] kthread+0x2c8/0x350 [ 196.624897] ret_from_fork+0x10/0x18 [ 196.624899] [ 196.624902] Allocated by task 2: [ 196.624906] kasan_kmalloc.part.1+0x40/0x108 [ 196.624909] kasan_kmalloc+0xb4/0xc8 [ 196.624913] kasan_slab_alloc+0x14/0x20 [ 196.624916] kmem_cache_alloc_node+0x1dc/0x480 [ 196.624921] copy_process.isra.1.part.2+0x1d8/0x4a98 [ 196.624924] _do_fork+0x150/0xfa0 [ 196.624926] kernel_thread+0x48/0x58 [ 196.624930] kthreadd+0x3a4/0x5a0 [ 196.624932] ret_from_fork+0x10/0x18 [ 196.624934] [ 196.624937] Freed by task 0: [ 196.624938] (stack is not available) [ 196.624940] [ 196.624943] The buggy address belongs to the object at ffff809b00bc0000 [ 196.624943] which belongs to the cache thread_stack of size 32768 [ 196.624946] The buggy address is located 29536 bytes inside of [ 196.624946] 32768-byte region [ffff809b00bc0000, ffff809b00bc8000) [ 196.624948] The buggy address belongs to the page: [ 196.624952] page:ffff7fe026c02e00 count:1 mapcount:0 mapping:ffff809b4001c000 index:0x0 compound_mapcount: 0 [ 196.624960] flags: 0xfffff8000008100(slab|head) [ 196.624967] raw: 0fffff8000008100 dead000000000100 dead000000000200 ffff809b4001c000 [ 196.624970] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 196.624973] page dumped because: kasan: bad access detected [ 196.624974] [ 196.624976] Memory state around the buggy address: [ 196.624980] ffff809b00bc7200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 196.624983] ffff809b00bc7280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 196.624985] >ffff809b00bc7300: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f2 f2 [ 196.624988] ^ [ 196.624990] ffff809b00bc7380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 196.624993] ffff809b00bc7400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 196.624995] ==================================================================
--- drivers/net/ethernet/qlogic/qed/qed_dev.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_dev.c +4 -4
@@ -473,19 +473,19 @@ static void qed_init_qm_pq(struct qed_hwfn *p_hwfn,/* get pq index according to PQ_FLAGS */ static u16 *qed_init_qm_get_idx_from_flags (struct qed_hwfn *p_hwfn, -u32 pq_flags) +unsigned long pq_flags) {struct qed_qm_info *qm_info = &p_hwfn->qm_info;/* Can't have multiple flags set here */ -if (bitmap_weight ((unsigned long *)&pq_flags, +if (bitmap_weight (&pq_flags,sizeof (pq_flags) *BITS_PER_BYTE ) >1 ) { -DP_ERR (p_hwfn,"requested multiple pq flags 0x%x\n" , pq_flags); +DP_ERR (p_hwfn,"requested multiple pq flags 0x%lx\n" , pq_flags); goto err; }if (!(qed_get_pq_flags (p_hwfn) & pq_flags)) { -DP_ERR (p_hwfn,"pq flag 0x%x is not set\n" , pq_flags); +DP_ERR (p_hwfn,"pq flag 0x%lx is not set\n" , pq_flags); goto err; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 40/149 scsi: libfc: free skb when receiving invalid flogi resp
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5d8fc4a9f0eec20b6c07895022a6bea3fb6dfb38 ]
The issue to be fixed in this commit is when libfc found it received a invalid FLOGI response from FC switch, it would return without freeing the fc frame, which is just the skb data. This would cause memory leak if FC switch keeps sending invalid FLOGI responses.
This fix is just to make it execute fc_frame_free(fp) before returning from function fc_lport_flogi_resp.
--- drivers/scsi/libfc/fc_lport.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/libfc/fc_lport.c +3 -3
@@ -1726,14 +1726,14 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp, fc_frame_payload_op(fp) != ELS_LS_ACC) {FC_LPORT_DBG (lport,"FLOGI not accepted or bad response\n" );fc_lport_error (lport, fp); - goto err; + goto out; } flp =fc_frame_payload_get (fp,sizeof (*flp));if (!flp) {FC_LPORT_DBG (lport,"FLOGI bad response\n" );fc_lport_error (lport, fp); - goto err; + goto out; } mfs = ntohs(flp->fl_csp.sp_bb_data) &
@@ -1743,7 +1743,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,FC_LPORT_DBG (lport,"FLOGI bad mfs:%hu response, " "lport->mfs:%hu\n" , mfs, lport->mfs);fc_lport_error (lport, fp); - goto err; + goto out; }if (mfs <= lport->mfs) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 41/149 scsi: scsi_debug: fix write_same with virtual_gb problem
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 40d07b523cf434f252b134c86b1f8f2d907ffb0b ]
The WRITE SAME(10) and (16) implementations didn't take account of the buffer wrap required when the virtual_gb parameter is greater than 0.
Fix that and rename the fake_store() function to lba2fake_store() to lessen confusion with the global fake_storep pointer. Bump version date.
Tested by: Bart Van Assche <[email protected]>
--- drivers/scsi/scsi_debug.c | 41 ++++++++++++++++++++------------------- 1 file changed, 21 insertions(+), 20 deletions(-)
drivers/scsi/scsi_debug.c +21 -20
@@ -62,7 +62,7 @@/* make sure inq_product_rev string corresponds to this version */ #define SDEBUG_VERSION "0188"/* format to fit INQUIRY revision field */ -static const char *sdebug_version_date ="20180128" ; +static const char *sdebug_version_date ="20190125" ;#define MY_NAME "scsi_debug"
@@ -735,7 +735,7 @@ static inline bool scsi_debug_lbp(void) (sdebug_lbpu || sdebug_lbpws || sdebug_lbpws10); } -static void *fake_store (unsigned long long lba) +static void *lba2fake_store (unsigned long long lba) { lba =do_div (lba, sdebug_store_sectors);
@@ -2514,8 +2514,8 @@ static int do_device_access(struct scsi_cmnd *scmd, u32 sg_skip, u64 lba,return ret; } -/* If fake_store(lba,num) compares equal to arr(num), then copy top half of -* arr into fake_store(lba,num) and return true. If comparison fails then +/* If lba2fake_store(lba,num) compares equal to arr(num), then copy top half of +* arr into lba2fake_store(lba,num) and return true. If comparison fails then * return false. */ static bool comp_write_worker (u64 lba,u32 num,const u8 *arr) {
@@ -2643,7 +2643,7 @@ static int prot_verify_read(struct scsi_cmnd *SCpnt, sector_t start_sec,if (sdt->app_tag ==cpu_to_be16 (0xffff ))continue ; - ret =dif_verify (sdt,fake_store (sector), sector, ei_lba); + ret =dif_verify (sdt,lba2fake_store (sector), sector, ei_lba);if (ret) { dif_errors++;return ret;
@@ -3261,10 +3261,12 @@ static int resp_write_scat(struct scsi_cmnd *scp,static int resp_write_same (struct scsi_cmnd *scp,u64 lba,u32 num,u32 ei_lba,bool unmap,bool ndob) { +int ret;unsigned long iflags;unsigned long long i; -int ret; -u64 lba_off; +u32 lb_size = sdebug_sector_size; +u64 block, lbaa; +u8 *fs1p; ret =check_device_access_params (scp, lba, num);if (ret)
@@ -3276,31 +3278,30 @@ static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num,unmap_region (lba, num); goto out; } - - lba_off = lba * sdebug_sector_size; + lbaa = lba; + block =do_div (lbaa, sdebug_store_sectors);/* if ndob then zero 1 logical block, else fetch 1 logical block */ + fs1p = fake_storep + (block * lb_size);if (ndob) { -memset (fake_storep + lba_off,0 , sdebug_sector_size); +memset (fs1p,0 , lb_size); ret =0 ; }else - ret =fetch_to_dev_buffer (scp, fake_storep + lba_off, - sdebug_sector_size); + ret =fetch_to_dev_buffer (scp, fs1p, lb_size);if (-1 == ret) {write_unlock_irqrestore (&atomic_rw, iflags);return DID_ERROR <<16 ; - }else if (sdebug_verbose && !ndob && (ret < sdebug_sector_size)) + }else if (sdebug_verbose && !ndob && (ret < lb_size))sdev_printk (KERN_INFO , scp->device,"%s: %s: lb size=%u, IO sent=%d bytes\n" , - my_name,"write same" , - sdebug_sector_size, ret); + my_name,"write same" , lb_size, ret);/* Copy first sector to remaining blocks */ -for (i =1 ; i < num ; i++) -memcpy (fake_storep + ((lba + i) * sdebug_sector_size), - fake_storep + lba_off, - sdebug_sector_size); - +for (i =1 ; i < num ; i++) { + lbaa = lba + i; + block =do_div (lbaa, sdebug_store_sectors); +memmove (fake_storep + (block * lb_size), fs1p, lb_size); + }if (scsi_debug_lbp ())map_region (lba, num); out:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 42/149 scsi: bnx2fc: Fix error handling in probe()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b2d3492fc591b1fb46b81d79ca1fc44cac6ae0ae ]
There are two issues here. First if cmgr->hba is not set early enough then it leads to a NULL dereference. Second if we don't completely initialize cmgr->io_bdt_pool[] then we end up dereferencing uninitialized pointers.
--- drivers/scsi/bnx2fc/bnx2fc_io.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/bnx2fc/bnx2fc_io.c +2 -2
@@ -240,6 +240,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)return NULL ; } + cmgr->hba = hba; cmgr->free_list =kcalloc (arr_sz,sizeof (*cmgr->free_list),GFP_KERNEL );if (!cmgr->free_list) {
@@ -256,7 +257,6 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba) goto mem_err; } - cmgr->hba = hba; cmgr->cmds = (struct bnx2fc_cmd **)(cmgr +1 );for (i =0 ; i < arr_sz; i++) {
@@ -295,7 +295,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)/* Allocate pool of io_bdts - one for each bnx2fc_cmd */ mem_size = num_ios *sizeof (struct io_bdt *); - cmgr->io_bdt_pool =kmalloc (mem_size,GFP_KERNEL ); + cmgr->io_bdt_pool =kzalloc (mem_size,GFP_KERNEL );if (!cmgr->io_bdt_pool) { printk(KERN_ERR PFX "failed to alloc io_bdt_pool\n"); goto mem_err;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 43/149 scsi: 53c700: pass correct "dev" to dma_alloc_attrs()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8437fcf14deed67e5ad90b5e8abf62fb20f30881 ]
The "hostdata->dev" pointer is NULL here. We set "hostdata->dev = dev;" later in the function and we also use "hostdata->dev" when we call dma_free_attrs() in NCR_700_release().
This bug predates git version control.
--- drivers/scsi/53c700.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/53c700.c +1 -1
@@ -295,7 +295,7 @@ NCR_700_detect(struct scsi_host_template *tpnt,if (tpnt->sdev_attrs ==NULL ) tpnt->sdev_attrs = NCR_700_dev_attrs; - memory =dma_alloc_attrs (hostdata->dev,TOTAL_MEM_SIZE , &pScript, + memory =dma_alloc_attrs (dev,TOTAL_MEM_SIZE , &pScript,GFP_KERNEL ,DMA_ATTR_NON_CONSISTENT );if (memory ==NULL ) {printk (KERN_ERR "53c700: Failed to allocate memory for driver, detaching\n" );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 44/149 platform/x86: Fix unmet dependency warning for ACPI_CMPC
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d58bf90a32a33becec78c3034e781735049fcd25 ]
Add BACKLIGHT_LCD_SUPPORT for ACPI_CMPC to fix the
warning: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE.
ACPI_CMPC selects BACKLIGHT_CLASS_DEVICE but BACKLIGHT_CLASS_DEVICE depends on BACKLIGHT_LCD_SUPPORT.
Copy BACKLIGHT_LCD_SUPPORT dependency into ACPI_CMPC to fix
WARNING: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE
Depends on [n]: HAS_IOMEM [=y] && BACKLIGHT_LCD_SUPPORT [=n]
Selected by [y]:
- ACPI_CMPC [=y] && X86 [=y] && X86_PLATFORM_DEVICES [=y] && ACPI [=y] && INPUT [=y] && (RFKILL [=n] || RFKILL [=n]=n)
--- drivers/platform/x86/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/Kconfig +1 -0
@@ -856,6 +856,7 @@ config TOSHIBA_WMI config ACPI_CMPC tristate "CMPC Laptop Extras" depends on ACPI && INPUT + depends on BACKLIGHT_LCD_SUPPORT depends on RFKILL || RFKILL=n select BACKLIGHT_CLASS_DEVICE help
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 45/149 platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0ee4b5f801b73b83a9fb3921d725f2162fd4a2e5 ]
Add BACKLIGHT_LCD_SUPPORT for SAMSUNG_Q10 to fix the
warning: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE.
SAMSUNG_Q10 selects BACKLIGHT_CLASS_DEVICE but BACKLIGHT_CLASS_DEVICE depends on BACKLIGHT_LCD_SUPPORT.
Copy BACKLIGHT_LCD_SUPPORT dependency into SAMSUNG_Q10 to fix:
WARNING: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE
Depends on [n]: HAS_IOMEM [=y] && BACKLIGHT_LCD_SUPPORT [=n] Selected by [y]:
- SAMSUNG_Q10 [=y] && X86 [=y] && X86_PLATFORM_DEVICES [=y] && ACPI [=y]
--- drivers/platform/x86/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/Kconfig +1 -0
@@ -1078,6 +1078,7 @@ config INTEL_OAKTRAIL config SAMSUNG_Q10 tristate "Samsung Q10 Extras" depends on ACPI + depends on BACKLIGHT_LCD_SUPPORT select BACKLIGHT_CLASS_DEVICE ---help--- This driver provides support for backlight control on Samsung Q10
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 46/149 net: macb: Apply RXUBR workaround only to versions with errata
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e501070e4db0b67a4c17a5557d1e9d098f3db310 ]
The interrupt handler contains a workaround for RX hang applicable to Zynq and AT91RM9200 only. Subsequent versions do not need this workaround. This workaround unnecessarily resets RX whenever RX used bit read is observed, which can be often under heavy traffic. There is no other action performed on RX UBR interrupt. Hence introduce a CAPS mask; enable this interrupt and workaround only on affected versions.
--- drivers/net/ethernet/cadence/macb.h | 3 +++ drivers/net/ethernet/cadence/macb_main.c | 28 ++++++++++++++---------- 2 files changed, 20 insertions(+), 11 deletions(-)
drivers/net/ethernet/cadence/macb.h +3 -0
@@ -643,6 +643,7 @@#define MACB_CAPS_JUMBO 0x00000020#define MACB_CAPS_GEM_HAS_PTP 0x00000040#define MACB_CAPS_BD_RD_PREFETCH 0x00000080 +#define MACB_CAPS_NEEDS_RSTONUBR 0x00000100#define MACB_CAPS_FIFO_MODE 0x10000000#define MACB_CAPS_GIGABIT_MODE_AVAILABLE 0x20000000#define MACB_CAPS_SG_DISABLED 0x40000000
@@ -1214,6 +1215,8 @@ struct macb {int rx_bd_rd_prefetch;int tx_bd_rd_prefetch; + +u32 rx_intr_mask; };#ifdef CONFIG_MACB_USE_HWSTAMP
drivers/net/ethernet/cadence/macb_main.c +17 -11
@@ -56,8 +56,7 @@/* level of occupied TX descriptors under which we wake up TX process */ #define MACB_TX_WAKEUP_THRESH (bp) (3 * (bp)->tx_ring_size / 4) -#define MACB_RX_INT_FLAGS (MACB_BIT(RCOMP) | MACB_BIT(RXUBR) \ - | MACB_BIT(ISR_ROVR)) +#define MACB_RX_INT_FLAGS (MACB_BIT(RCOMP) | MACB_BIT(ISR_ROVR))#define MACB_TX_ERR_FLAGS (MACB_BIT(ISR_TUND) \ | MACB_BIT(ISR_RLE) \ | MACB_BIT(TXERR))
@@ -1271,7 +1270,7 @@ static int macb_poll(struct napi_struct *napi, int budget)queue_writel (queue,ISR ,MACB_BIT (RCOMP ));napi_reschedule (napi); }else { -queue_writel (queue,IER ,MACB_RX_INT_FLAGS ); +queue_writel (queue,IER , bp->rx_intr_mask); } }
@@ -1289,7 +1288,7 @@ static void macb_hresp_error_task(unsigned long data)u32 ctrl;for (q =0 , queue = bp->queues; q < bp->num_queues; ++q, ++queue) { -queue_writel (queue,IDR ,MACB_RX_INT_FLAGS | +queue_writel (queue,IDR , bp->rx_intr_mask |MACB_TX_INT_FLAGS |MACB_BIT (HRESP )); }
@@ -1319,7 +1318,7 @@ static void macb_hresp_error_task(unsigned long data)/* Enable interrupts */ queue_writel (queue,IER , -MACB_RX_INT_FLAGS | + bp->rx_intr_mask |MACB_TX_INT_FLAGS |MACB_BIT (HRESP )); }
@@ -1373,14 +1372,14 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id) (unsigned int )(queue - bp->queues), (unsigned long)status); -if (status &MACB_RX_INT_FLAGS ) { +if (status & bp->rx_intr_mask) {/* There's no point taking any more interrupts * until we have processed the buffers. The * scheduling call may fail if the poll routine * is already scheduled, so disable interrupts * now. */ -queue_writel (queue,IDR ,MACB_RX_INT_FLAGS ); +queue_writel (queue,IDR , bp->rx_intr_mask);if (bp->caps &MACB_CAPS_ISR_CLEAR_ON_WRITE )queue_writel (queue,ISR ,MACB_BIT (RCOMP ));
@@ -1413,8 +1412,9 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)/* There is a hardware issue under heavy load where DMA can * stop, this causes endless "used buffer descriptor read" * interrupts but it can be cleared by re-enabling RX. See -* the at91 manual, section 41.3.1 or the Zynq manual -* section 16.7.4 for details. +* the at91rm9200 manual, section 41.3.1 or the Zynq manual +* section 16.7.4 for details. RXUBR is only enabled for +* these two versions. */ if (status &MACB_BIT (RXUBR )) { ctrl =macb_readl (bp,NCR );
@@ -2264,7 +2264,7 @@ static void macb_init_hw(struct macb *bp)/* Enable interrupts */ queue_writel (queue,IER , -MACB_RX_INT_FLAGS | + bp->rx_intr_mask |MACB_TX_INT_FLAGS |MACB_BIT (HRESP )); }
@@ -3912,6 +3912,7 @@ static const struct macb_config sama5d4_config = { };static const struct macb_config emac_config = { + .caps =MACB_CAPS_NEEDS_RSTONUBR , .clk_init = at91ether_clk_init, .init = at91ether_init, };
@@ -3933,7 +3934,8 @@ static const struct macb_config zynqmp_config = { };static const struct macb_config zynq_config = { - .caps =MACB_CAPS_GIGABIT_MODE_AVAILABLE |MACB_CAPS_NO_GIGABIT_HALF , + .caps =MACB_CAPS_GIGABIT_MODE_AVAILABLE |MACB_CAPS_NO_GIGABIT_HALF | +MACB_CAPS_NEEDS_RSTONUBR , .dma_burst_length =16 , .clk_init = macb_clk_init, .init = macb_init,
@@ -4088,6 +4090,10 @@ static int macb_probe(struct platform_device *pdev)macb_dma_desc_get_size (bp); } + bp->rx_intr_mask =MACB_RX_INT_FLAGS ; +if (bp->caps &MACB_CAPS_NEEDS_RSTONUBR ) + bp->rx_intr_mask |=MACB_BIT (RXUBR ); + mac =of_get_mac_address (np);if (mac) {ether_addr_copy (bp->dev->dev_addr, mac);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 47/149 x86/boot/compressed/64: Set EFER.LME=1 in 32-bit trampoline before returning to long mode
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b677dfae5aa197afc5191755a76a8727ffca538a ]
In some old AMD KVM implementation, guest's EFER.LME bit is cleared by KVM when the hypervsior detects that the guest sets CR0.PG to 0. This causes the guest OS to reboot when it tries to return from 32-bit trampoline code because the CPU is in incorrect state: CR4.PAE=1, CR0.PG=1, CS.L=1, but EFER.LME=0. As a precaution, set EFER.LME=1 as part of long mode activation procedure. This extra step won't cause any harm when Linux is booted on a bare-metal machine.
--- arch/x86/boot/compressed/head_64.S | 8 ++++++++ arch/x86/boot/compressed/pgtable.h | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-)
arch/x86/boot/compressed/head_64.S +8 -0
@@ -600,6 +600,14 @@ ENTRY(trampoline_32bit_src) leal TRAMPOLINE_32BIT_PGTABLE_OFFSET(%ecx), %eax movl %eax, %cr3 3: + /* Set EFER.LME=1 as a precaution in case hypervsior pulls the rug */ + pushl %ecx + movl $MSR_EFER, %ecx + rdmsr + btsl $_EFER_LME, %eax + wrmsr + popl %ecx + /* Enable PAE and LA57 (if required) paging modes */ movl $X86_CR4_PAE, %eax cmpl $0, %edx
arch/x86/boot/compressed/pgtable.h +1 -1
@@ -6,7 +6,7 @@#define TRAMPOLINE_32BIT_PGTABLE_OFFSET 0#define TRAMPOLINE_32BIT_CODE_OFFSET PAGE_SIZE -#define TRAMPOLINE_32BIT_CODE_SIZE 0x60 +#define TRAMPOLINE_32BIT_CODE_SIZE 0x70#define TRAMPOLINE_32BIT_STACK_END TRAMPOLINE_32BIT_SIZE
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 48/149 cifs: fix computation for MAX_SMB2_HDR_SIZE
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 58d15ed1203f4d858c339ea4d7dafa94bd2a56d3 ]
The size of the fixed part of the create response is 88 bytes not 56.
--- fs/cifs/smb2pdu.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/cifs/smb2pdu.h +2 -2
@@ -84,8 +84,8 @@#define NUMBER_OF_SMB2_COMMANDS 0x0013 -/* 4 len + 52 transform hdr + 64 hdr + 56 create rsp */ -#define MAX_SMB2_HDR_SIZE 0x00b0 +/* 52 transform hdr + 64 hdr + 88 create rsp */ +#define MAX_SMB2_HDR_SIZE 204#define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe)#define SMB2_TRANSFORM_PROTO_NUM cpu_to_le32(0x424d53fd)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 49/149 x86/microcode/amd: Dont falsely trick the late loading mechanism
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 912139cfbfa6a2bc1da052314d2c29338dae1f6a ]
The load_microcode_amd() function searches for microcode patches and attempts to apply a microcode patch if it is of different level than the currently installed level.
While the processor won't actually load a level that is less than what is already installed, the logic wrongly returns UCODE_NEW thus signaling to its caller reload_store() that a late loading should be attempted.
If the file-system contains an older microcode revision than what is currently running, such a late microcode reload can result in these misleading messages:
x86/CPU: CPU features have changed after loading microcode, but might not take effect. x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.
These messages were issued on a system where SME/SEV are not enabled by the BIOS (MSR C001_0010[23] = 0b) because during boot, early_detect_mem_encrypt() is called and cleared the SME and SEV features in this case.
However, after the wrong late load attempt, get_cpu_cap() is called and reloads the SME and SEV feature bits, resulting in the messages.
Update the microcode level check to not attempt microcode loading if the current level is greater than(!) and not only equal to the current patch level.
[ bp: massage commit message. ]
--- arch/x86/kernel/cpu/microcode/amd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/microcode/amd.c +1 -1
@@ -707,7 +707,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)if (!p) {return ret; }else { -if (boot_cpu_data.microcode == p->patch_id) +if (boot_cpu_data.microcode >= p->patch_id)return ret; ret =UCODE_NEW ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 50/149 arm64: kprobe: Always blacklist the KVM world-switch code
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f2b3d8566d81deaca31f4e3163def0bea7746e11 ]
On systems with VHE the kernel and KVM's world-switch code run at the same exception level. Code that is only used on a VHE system does not need to be annotated as __hyp_text as it can reside anywhere in the
kernel text.
__hyp_text was also used to prevent kprobes from patching breakpoint instructions into this region, as this code runs at a different exception level. While this is no longer true with VHE, KVM still switches VBAR_EL1, meaning a kprobe's breakpoint executed in the world-switch code will cause a hyp-panic.
Move the __hyp_text check in the kprobes blacklist so it applies on VHE systems too, to cover the common code and guest enter/exit assembly.
--- arch/arm64/kernel/probes/kprobes.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/kernel/probes/kprobes.c +3 -3
@@ -478,13 +478,13 @@ bool arch_within_kprobe_blacklist(unsigned long addr) addr < (unsigned long)__entry_text_end) || (addr >= (unsigned long )__idmap_text_start && addr < (unsigned long )__idmap_text_end) || + (addr >= (unsigned long )__hyp_text_start && + addr < (unsigned long )__hyp_text_end) || !!search_exception_tables(addr)) return true;if (!is_kernel_in_hyp_mode ()) { -if ((addr >= (unsigned long )__hyp_text_start && - addr < (unsigned long )__hyp_text_end) || - (addr >= (unsigned long )__hyp_idmap_text_start && +if ((addr >= (unsigned long )__hyp_idmap_text_start && addr < (unsigned long )__hyp_idmap_text_end))return true; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 51/149 apparmor: Fix aa_label_build() error handling for failed merges
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d6d478aee003e19ef90321176552a8ad2929a47f ]
aa_label_merge() can return NULL for memory allocations failures make sure to handle and set the correct error in this case.
--- security/apparmor/domain.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
security/apparmor/domain.c +4 -1
@@ -1444,7 +1444,10 @@ int aa_change_profile(const char *fqname, int flags) new =aa_label_merge (label, target,GFP_KERNEL );if (IS_ERR_OR_NULL (new)) { info ="failed to build target label" ; - error =PTR_ERR (new); +if (!new) + error = -ENOMEM ; +else + error =PTR_ERR (new); new =NULL ; perms.allow =0 ; goto audit;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 52/149 x86/kexec: Dont setup EFI info if EFI runtime is not enabled
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2aa958c99c7fd3162b089a1a56a34a0cdb778de1 ]
Kexec-ing a kernel with "efi=noruntime" on the first kernel's command line causes the following null pointer dereference:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 #PF error: [normal kernel read fault] Call Trace: efi_runtime_map_copy+0x28/0x30 bzImage64_load+0x688/0x872 arch_kexec_kernel_image_load+0x6d/0x70 kimage_file_alloc_init+0x13e/0x220 __x64_sys_kexec_file_load+0x144/0x290 do_syscall_64+0x55/0x1a0 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Just skip the EFI info setup if EFI runtime services are not enabled.
[ bp: Massage commit message. ]
--- arch/x86/kernel/kexec-bzimage64.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kernel/kexec-bzimage64.c +3 -0
@@ -167,6 +167,9 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,struct efi_info *current_ei = &boot_params.efi_info;struct efi_info *ei = ¶ms->efi_info; +if (!efi_enabled (EFI_RUNTIME_SERVICES )) +return 0 ; +if (!current_ei->efi_memmap_size)return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 53/149 proc: fix /proc/net/* after setns(2)
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1fde6f21d90f8ba5da3cb9c54ca991ed72696c43 ]
/proc entries under /proc/net/* can't be cached into dcache because setns(2) can change current net namespace.
--- fs/proc/generic.c | 4 +- fs/proc/internal.h | 1 + fs/proc/proc_net.c | 20 +++ tools/testing/selftests/proc/.gitignore | 1 + tools/testing/selftests/proc/Makefile | 1 + tools/testing/selftests/proc/setns-dcache.c | 129 ++++++++++++++++++++ 6 files changed, 155 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/proc/setns-dcache.c
fs/proc/generic.c +3 -1
@@ -256,7 +256,7 @@ struct dentry *proc_lookup_de(struct inode *dir, struct dentry *dentry, inode =proc_get_inode (dir->i_sb, de);if (!inode)return ERR_PTR (-ENOMEM ); -d_set_d_op (dentry, &proc_misc_dentry_ops); +d_set_d_op (dentry, de->proc_dops);return d_splice_alias (inode, dentry); }read_unlock (&proc_subdir_lock);
@@ -429,6 +429,8 @@ static struct proc_dir_entry *__proc_create(struct proc_dir_entry **parent,INIT_LIST_HEAD (&ent->pde_openers);proc_set_user (ent, (*parent)->uid, (*parent)->gid); + ent->proc_dops = &proc_misc_dentry_ops; + out:return ent; }
fs/proc/internal.h +1 -0
@@ -44,6 +44,7 @@ struct proc_dir_entry {struct completion *pde_unload_completion;const struct inode_operations *proc_iops;const struct file_operations *proc_fops; +const struct dentry_operations *proc_dops;union {const struct seq_operations *seq_ops;int (*single_show)(struct seq_file *,void *);
fs/proc/proc_net.c +20 -0
@@ -38,6 +38,22 @@ static struct net *get_proc_net(const struct inode *inode)return maybe_get_net (PDE_NET (PDE (inode))); } +static int proc_net_d_revalidate (struct dentry *dentry,unsigned int flags) +{ +return 0 ; +} + +static const struct dentry_operations proc_net_dentry_ops = { + .d_revalidate = proc_net_d_revalidate, + .d_delete = always_delete_dentry, +}; + +static void pde_force_lookup (struct proc_dir_entry *pde) +{ +/* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */ + pde->proc_dops = &proc_net_dentry_ops; +} +static int seq_open_net (struct inode *inode,struct file *file) {unsigned int state_size =PDE (inode)->state_size;
@@ -90,6 +106,7 @@ struct proc_dir_entry *proc_create_net_data(const char *name, umode_t mode, p =proc_create_reg (name, mode, &parent, data);if (!p)return NULL ; +pde_force_lookup (p); p->proc_fops = &proc_net_seq_fops; p->seq_ops = ops; p->state_size = state_size;
@@ -133,6 +150,7 @@ struct proc_dir_entry *proc_create_net_data_write(const char *name, umode_t mode p =proc_create_reg (name, mode, &parent, data);if (!p)return NULL ; +pde_force_lookup (p); p->proc_fops = &proc_net_seq_fops; p->seq_ops = ops; p->state_size = state_size;
@@ -181,6 +199,7 @@ struct proc_dir_entry *proc_create_net_single(const char *name, umode_t mode, p =proc_create_reg (name, mode, &parent, data);if (!p)return NULL ; +pde_force_lookup (p); p->proc_fops = &proc_net_single_fops; p->single_show = show;return proc_register (parent, p);
@@ -223,6 +242,7 @@ struct proc_dir_entry *proc_create_net_single_write(const char *name, umode_t mo p =proc_create_reg (name, mode, &parent, data);if (!p)return NULL ; +pde_force_lookup (p); p->proc_fops = &proc_net_single_fops; p->single_show = show; p->write = write;
tools/testing/selftests/proc/.gitignore +1 -0
@@ -10,4 +10,5 @@ /proc-uptime-002 /read /self +/setns-dcache /thread-self
tools/testing/selftests/proc/Makefile +1 -0
@@ -14,6 +14,7 @@ TEST_GEN_PROGS += proc-uptime-001 TEST_GEN_PROGS += proc-uptime-002 TEST_GEN_PROGS += read TEST_GEN_PROGS += self +TEST_GEN_PROGS += setns-dcache TEST_GEN_PROGS += thread-self include ../lib.mk
tools/testing/selftests/proc/setns-dcache.c new file +129 -0
129 lines not on this page · raw message
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 54/149 x86_64: increase stack size for KASAN_EXTRA
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a8e911d13540487942d53137c156bd7707f66e5d ]
If the kernel is configured with KASAN_EXTRA, the stack size is increasted significantly because this option sets "-fstack-reuse" to "none" in GCC [1]. As a result, it triggers stack overrun quite often with 32k stack size compiled using GCC 8. For example, this reproducer
https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/syscalls/madvise/madvise06.c
triggers a "corrupted stack end detected inside scheduler" very reliably with CONFIG_SCHED_STACK_END_CHECK enabled.
There are just too many functions that could have a large stack with KASAN_EXTRA due to large local variables that have been called over and over again without being able to reuse the stacks. Some noticiable ones are
size
7648 shrink_page_list
3584 xfs_rmap_convert
3312 migrate_page_move_mapping
3312 dev_ethtool
3200 migrate_misplaced_transhuge_page
3168 copy_process
There are other 49 functions are over 2k in size while compiling kernel with "-Wframe-larger-than=" even with a related minimal config on this machine. Hence, it is too much work to change Makefiles for each object to compile without "-fsanitize-address-use-after-scope" individually.
[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715#c23
Although there is a patch in GCC 9 to help the situation, GCC 9 probably won't be released in a few months and then it probably take another 6-month to 1-year for all major distros to include it as a default. Hence, the stack usage with KASAN_EXTRA can be revisited again in 2020 when GCC 9 is everywhere. Until then, this patch will help users avoid stack overrun.
This has already been fixed for arm64 for the same reason via 6e8830674ea ("arm64: kasan: Increase stack size for KASAN_EXTRA").
--- arch/x86/include/asm/page_64_types.h | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/include/asm/page_64_types.h +4 -0
@@ -7,7 +7,11 @@#endif #ifdef CONFIG_KASAN +#ifdef CONFIG_KASAN_EXTRA +#define KASAN_STACK_ORDER 2 +#else #define KASAN_STACK_ORDER 1 +#endif #else #define KASAN_STACK_ORDER 0#endif
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 55/149 mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit efad4e475c312456edb3c789d0996d12ed744c13 ]
Patch series "mm, memory_hotplug: fix uninitialized pages fallouts", v2.
Mikhail Zaslonko has posted fixes for the two bugs quite some time ago [1]. I have pushed back on those fixes because I believed that it is much better to plug the problem at the initialization time rather than play whack-a-mole all over the hotplug code and find all the places which expect the full memory section to be initialized.
We have ended up with commit 2830bf6f05fb ("mm, memory_hotplug:
initialize struct pages for the full memory section") merged and cause a regression [2][3]. The reason is that there might be memory layouts when two NUMA nodes share the same memory section so the merged fix is simply incorrect.
In order to plug this hole we really have to be zone range aware in those handlers. I have split up the original patch into two. One is unchanged (patch 2) and I took a different approach for `removable' crash.
[1] http://lkml.kernel.org/r/[email protected]
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1666948
[3] http://lkml.kernel.org/r/[email protected]
This patch (of 2):
Mikhail has reported the following VM_BUG_ON triggered when reading sysfs removable state of a memory block:
page:000003d08300c000 is uninitialized and poisoned
page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) Call Trace: is_mem_section_removable+0xb4/0x190 show_mem_removable+0x9a/0xd8 dev_attr_show+0x34/0x70 sysfs_kf_seq_show+0xc8/0x148 seq_read+0x204/0x480 __vfs_read+0x32/0x178 vfs_read+0x82/0x138 ksys_read+0x5a/0xb0 system_call+0xdc/0x2d8 Last Breaking-Event-Address: is_mem_section_removable+0xb4/0x190 Kernel panic - not syncing: Fatal exception: panic_on_oops
The reason is that the memory block spans the zone boundary and we are stumbling over an unitialized struct page. Fix this by enforcing zone range in is_mem_section_removable so that we never run away from a zone.
--- mm/memory_hotplug.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
mm/memory_hotplug.c +2 -1
@@ -1258,7 +1258,8 @@ static bool is_pageblock_removable_nolock(struct page *page)bool is_mem_section_removable (unsigned long start_pfn,unsigned long nr_pages) {struct page *page =pfn_to_page (start_pfn); -struct page *end_page = page + nr_pages; +unsigned long end_pfn =min (start_pfn + nr_pages,zone_end_pfn (page_zone (page))); +struct page *end_page =pfn_to_page (end_pfn);/* Check the starting page of each pageblock within the range */ for (; page < end_page; page =next_active_pageblock (page)) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 56/149 mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 24feb47c5fa5b825efb0151f28906dfdad027e61 ]
If memory end is not aligned with the sparse memory section boundary, the mapping of such a section is only partly initialized. This may lead to VM_BUG_ON due to uninitialized struct pages access from test_pages_in_a_zone() function triggered by memory_hotplug sysfs handlers.
Here are the the panic examples:
CONFIG_DEBUG_VM_PGFLAGS=y
kernel parameter mem=2050M
--------------------------
page:000003d082008000 is uninitialized and poisoned
page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) Call Trace: test_pages_in_a_zone+0xde/0x160 show_valid_zones+0x5c/0x190 dev_attr_show+0x34/0x70 sysfs_kf_seq_show+0xc8/0x148 seq_read+0x204/0x480 __vfs_read+0x32/0x178 vfs_read+0x82/0x138 ksys_read+0x5a/0xb0 system_call+0xdc/0x2d8 Last Breaking-Event-Address: test_pages_in_a_zone+0xde/0x160 Kernel panic - not syncing: Fatal exception: panic_on_oops
Fix this by checking whether the pfn to check is within the zone.
[[email protected]: separated this change from
http://lkml.kernel.org/r/[email protected]]
--- mm/memory_hotplug.c | 3 +++ 1 file changed, 3 insertions(+)
mm/memory_hotplug.c +3 -0
@@ -1299,6 +1299,9 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, i++;if (i ==MAX_ORDER_NR_PAGES || pfn + i >= end_pfn)continue ; +/* Check if we got outside of the zone */ +if (zone && !zone_spans_pfn (zone, pfn + i)) +return 0 ; page =pfn_to_page (pfn + i);if (zone &&page_zone (page) != zone)return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 57/149 lib/test_kmod.c: potential double free in error handling
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit db7ddeab3ce5d64c9696e70d61f45ea9909cd196 ]
There is a copy and paste bug so we set "config->test_driver" to NULL twice instead of setting "config->test_fs". Smatch complains that it leads to a double free:
lib/test_kmod.c:840 __kmod_config_init() warn: 'config->test_fs' double freed
--- lib/test_kmod.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/test_kmod.c +1 -1
@@ -632,7 +632,7 @@ static void __kmod_config_free(struct test_config *config) config->test_driver =NULL ;kfree_const (config->test_fs); - config->test_driver =NULL ; + config->test_fs =NULL ; }static void kmod_config_free (struct kmod_test_device *test_dev)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 58/149 fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c27d82f52f75fc9d8d9d40d120d2a96fdeeada5e ]
When superblock has lots of inodes without any pagecache (like is the case for /proc), drop_pagecache_sb() will iterate through all of them without dropping sb->s_inode_list_lock which can lead to softlockups (one of our customers hit this).
Fix the problem by going to the slow path and doing cond_resched() in case the process needs rescheduling.
--- fs/drop_caches.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/drop_caches.c +7 -1
@@ -21,8 +21,13 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)spin_lock (&sb->s_inode_list_lock);list_for_each_entry (inode, &sb->s_inodes, i_sb_list) {spin_lock (&inode->i_lock); +/* +* We must skip inodes in unusual state. We may also skip +* inodes without pages but we deliberately won't in case +* we need to reschedule to avoid softlockups. +*/ if ((inode->i_state & (I_FREEING |I_WILL_FREE |I_NEW )) || - (inode->i_mapping->nrpages ==0 )) { + (inode->i_mapping->nrpages ==0 && !need_resched ())) {spin_unlock (&inode->i_lock);continue ; }
@@ -30,6 +35,7 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)spin_unlock (&inode->i_lock);spin_unlock (&sb->s_inode_list_lock); +cond_resched ();invalidate_mapping_pages (inode->i_mapping,0 ,-1 );iput (toput_inode); toput_inode = inode;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 59/149 autofs: drop dentry reference only when it is never used
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 63ce5f552beb9bdb41546b3a26c4374758b21815 ]
autofs_expire_run() calls dput(dentry) to drop the reference count of dentry. However, dentry is read via autofs_dentry_ino(dentry) after that. This may result in a use-free-bug. The patch drops the reference count of dentry only when it is never used.
--- fs/autofs/expire.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/autofs/expire.c +2 -1
@@ -596,7 +596,6 @@ int autofs_expire_run(struct super_block *sb, pkt.len = dentry->d_name.len;memcpy (pkt.name, dentry->d_name.name, pkt.len); pkt.name[pkt.len] ='\0' ; -dput (dentry);if (copy_to_user (pkt_p, &pkt,sizeof (struct autofs_packet_expire ))) ret = -EFAULT ;
@@ -609,6 +608,8 @@ int autofs_expire_run(struct super_block *sb,complete_all (&ino->expire_complete);spin_unlock (&sbi->fs_lock); +dput (dentry); +return ret; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 60/149 autofs: fix error return in autofs_fill_super()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f585b283e3f025754c45bbe7533fc6e5c4643700 ]
In autofs_fill_super() on error of get inode/make root dentry the return should be ENOMEM as this is the only failure case of the called functions.
--- fs/autofs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/autofs/inode.c +3 -1
@@ -255,8 +255,10 @@ int autofs_fill_super(struct super_block *s, void *data, int silent) } root_inode =autofs_get_inode (s,S_IFDIR |0755 ); root =d_make_root (root_inode); -if (!root) +if (!root) { + ret = -ENOMEM ; goto fail_ino; + } pipe =NULL ; root->d_fsdata = ino;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 61/149 mm, memory_hotplug: fix off-by-one in is_pageblock_removable
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 891cb2a72d821f930a39d5900cb7a3aa752c1d5b ]
Rong Chen has reported the following boot crash:
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 1 PID: 239 Comm: udevd Not tainted 5.0.0-rc4-00149-gefad4e4 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
RIP: 0010:page_mapping+0x12/0x80
Code: 5d c3 48 89 df e8 0e ad 02 00 85 c0 75 da 89 e8 5b 5d c3 0f 1f 44 00 00 53 48 89 fb 48 8b 43 08 48 8d 50 ff a8 01 48 0f 45 da <48> 8b 53 08 48 8d 42 ff 83 e2 01 48 0f 44 c3 48 83 38 ff 74 2f 48
RSP: 0018:ffff88801fa87cd8 EFLAGS: 00010202
RAX: ffffffffffffffff RBX: fffffffffffffffe RCX: 000000000000000a
RDX: fffffffffffffffe RSI: ffffffff820b9a20 RDI: ffff88801e5c0000
RBP: 6db6db6db6db6db7 R08: ffff88801e8bb000 R09: 0000000001b64d13
R10: ffff88801fa87cf8 R11: 0000000000000001 R12: ffff88801e640000
R13: ffffffff820b9a20 R14: ffff88801f145258 R15: 0000000000000001
FS: 00007fb2079817c0(0000) GS:ffff88801dd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000006 CR3: 000000001fa82000 CR4: 00000000000006a0
Call Trace:
__dump_page+0x14/0x2c0
is_mem_section_removable+0x24c/0x2c0
removable_show+0x87/0xa0
dev_attr_show+0x25/0x60
sysfs_kf_seq_show+0xba/0x110
seq_read+0x196/0x3f0
__vfs_read+0x34/0x180
vfs_read+0xa0/0x150
ksys_read+0x44/0xb0
do_syscall_64+0x5e/0x4a0
entry_SYSCALL_64_after_hwframe+0x49/0xbeand bisected it down to commit efad4e475c31 ("mm, memory_hotplug:is_mem_section_removable do not pass the end of a zone").
The reason for the crash is that the mapping is garbage for poisoned (uninitialized) page. This shouldn't happen as all pages in the zone's boundary should be initialized.
Later debugging revealed that the actual problem is an off-by-one when evaluating the end_page. 'start_pfn + nr_pages' resp 'zone_end_pfn' refers to a pfn after the range and as such it might belong to a differen memory section.
This along with CONFIG_SPARSEMEM then makes the loop condition completely bogus because a pointer arithmetic doesn't work for pages from two different sections in that memory model.
Fix the issue by reworking is_pageblock_removable to be pfn based and only use struct page where necessary. This makes the code slightly easier to follow and we will remove the problematic pointer arithmetic completely.
--- mm/memory_hotplug.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
mm/memory_hotplug.c +15 -12
@@ -1213,11 +1213,13 @@ static inline int pageblock_free(struct page *page)return PageBuddy (page) &&page_order (page) >= pageblock_order; } -/* Return the start of the next active pageblock after a given page */ -static struct page *next_active_pageblock (struct page *page) +/* Return the pfn of the start of the next active pageblock after a given pfn */ +static unsigned long next_active_pageblock (unsigned long pfn) { +struct page *page =pfn_to_page (pfn); +/* Ensure the starting page is pageblock-aligned */ -BUG_ON (page_to_pfn (page) & (pageblock_nr_pages -1 )); +BUG_ON (pfn & (pageblock_nr_pages -1 ));/* If the entire pageblock is free, move to the end of free page */ if (pageblock_free (page)) {
@@ -1225,16 +1227,16 @@ static struct page *next_active_pageblock(struct page *page)/* be careful. we don't have locks, page_order can be changed.*/ order =page_order (page);if ((order <MAX_ORDER ) && (order >= pageblock_order)) -return page + (1 << order); +return pfn + (1 << order); } -return page + pageblock_nr_pages; +return pfn + pageblock_nr_pages; } -static bool is_pageblock_removable_nolock (struct page *page) +static bool is_pageblock_removable_nolock (unsigned long pfn) { +struct page *page =pfn_to_page (pfn);struct zone *zone; -unsigned long pfn;/* * We have to be careful here because we are iterating over memory
@@ -1257,13 +1259,14 @@ static bool is_pageblock_removable_nolock(struct page *page)/* Checks if this range of memory is likely to be hot-removable. */ bool is_mem_section_removable (unsigned long start_pfn,unsigned long nr_pages) { -struct page *page =pfn_to_page (start_pfn); -unsigned long end_pfn =min (start_pfn + nr_pages,zone_end_pfn (page_zone (page))); -struct page *end_page =pfn_to_page (end_pfn); +unsigned long end_pfn, pfn; + + end_pfn =min (start_pfn + nr_pages, +zone_end_pfn (page_zone (pfn_to_page (start_pfn))));/* Check the starting page of each pageblock within the range */ -for (; page < end_page; page =next_active_pageblock (page)) { -if (!is_pageblock_removable_nolock (page)) +for (pfn = start_pfn; pfn < end_pfn; pfn =next_active_pageblock (pfn)) { +if (!is_pageblock_removable_nolock (pfn))return false;cond_resched (); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 62/149 ARM: OMAP: dts: N950/N9: fix onenand timings
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8443e4843e1c2594bf5664e1d993a1be71d1befb ]
Commit a758f50f10cf ("mtd: onenand: omap2: Configure driver from DT") started using DT specified timings for GPMC, and as a result the OneNAND stopped working on N950/N9 as we had wrong values in the DT. Fix by updating the values to bootloader timings that have been tested to be working on both Nokia N950 and N9.
--- arch/arm/boot/dts/omap3-n950-n9.dtsi | 42 ++++++++++++++++++---------- 1 file changed, 28 insertions(+), 14 deletions(-)
arch/arm/boot/dts/omap3-n950-n9.dtsi +28 -14
@@ -370,6 +370,19 @@ compatible = "ti,omap2-onenand"; reg = <0 0 0x20000>; /* CS0, offset 0, IO size 128K */ + /* + * These timings are based on CONFIG_OMAP_GPMC_DEBUG=y reported + * bootloader set values when booted with v4.19 using both N950 + * and N9 devices (OneNAND Manufacturer: Samsung): + * + * gpmc cs0 before gpmc_cs_program_settings: + * cs0 GPMC_CS_CONFIG1: 0xfd001202 + * cs0 GPMC_CS_CONFIG2: 0x00181800 + * cs0 GPMC_CS_CONFIG3: 0x00030300 + * cs0 GPMC_CS_CONFIG4: 0x18001804 + * cs0 GPMC_CS_CONFIG5: 0x03171d1d + * cs0 GPMC_CS_CONFIG6: 0x97080000 + */ gpmc,sync-read; gpmc,sync-write; gpmc,burst-length = <16>;
@@ -379,26 +392,27 @@ gpmc,device-width = <2>; gpmc,mux-add-data = <2>; gpmc,cs-on-ns = <0>; - gpmc,cs-rd-off-ns = <87>; - gpmc,cs-wr-off-ns = <87>; + gpmc,cs-rd-off-ns = <122>; + gpmc,cs-wr-off-ns = <122>; gpmc,adv-on-ns = <0>; - gpmc,adv-rd-off-ns = <10>; - gpmc,adv-wr-off-ns = <10>; - gpmc,oe-on-ns = <15>; - gpmc,oe-off-ns = <87>; + gpmc,adv-rd-off-ns = <15>; + gpmc,adv-wr-off-ns = <15>; + gpmc,oe-on-ns = <20>; + gpmc,oe-off-ns = <122>; gpmc,we-on-ns = <0>; - gpmc,we-off-ns = <87>; - gpmc,rd-cycle-ns = <112>; - gpmc,wr-cycle-ns = <112>; - gpmc,access-ns = <81>; + gpmc,we-off-ns = <122>; + gpmc,rd-cycle-ns = <148>; + gpmc,wr-cycle-ns = <148>; + gpmc,access-ns = <117>; gpmc,page-burst-access-ns = <15>; gpmc,bus-turnaround-ns = <0>; gpmc,cycle2cycle-delay-ns = <0>; gpmc,wait-monitoring-ns = <0>; - gpmc,clk-activation-ns = <5>; - gpmc,wr-data-mux-bus-ns = <30>; - gpmc,wr-access-ns = <81>; - gpmc,sync-clk-ps = <15000>; + gpmc,clk-activation-ns = <10>; + gpmc,wr-data-mux-bus-ns = <40>; + gpmc,wr-access-ns = <117>; + + gpmc,sync-clk-ps = <15000>; /* TBC; Where this value came? */ /* * MTD partition table corresponding to Nokia's MeeGo 1.2
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 63/149 ARM: dts: omap4-droid4: Fix typo in cpcap IRQ flags
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ef4a55b9197a8f844ea0663138e902dcce3e2f36 ]
We're now getting the following error:
genirq: Setting trigger mode 1 for irq 230 failed (regmap_irq_set_type+0x0/0x15c)
cpcap-usb-phy cpcap-usb-phy.0: could not get irq dp: -524
--- arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi +1 -1
@@ -105,7 +105,7 @@ interrupts-extended = < &cpcap 15 0 &cpcap 14 0 &cpcap 28 0 &cpcap 19 0 &cpcap 18 0 &cpcap 17 0 &cpcap 16 0 &cpcap 49 0 - &cpcap 48 1 + &cpcap 48 0 >; interrupt-names = "id_ground", "id_float", "se0conn", "vbusvld",
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 64/149 ARM: dts: sun8i: h3: Add ethernet0 alias to Beelink X2
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit cc4bddade114b696ab27c1a77cfc7040151306da ]
Because "ethernet0" alias is missing, U-Boot doesn't generate board specific MAC address. Effect of this is random MAC address every boot and thus new IP address is assigned to the board.
Fix this by adding alias.
--- arch/arm/boot/dts/sun8i-h3-beelink-x2.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/sun8i-h3-beelink-x2.dts +1 -1
@@ -53,7 +53,7 @@ aliases { serial0 = &uart0; - /* ethernet0 is the H3 emac, defined in sun8i-h3.dtsi */ + ethernet0 = &emac; ethernet1 = &sdiowifi; };
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 65/149 arm: dts: meson: Fix IRQ trigger type for macirq
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e35e26b26e955c53e61c154ba26b9bb15da6b858 ]
A long running stress test on a custom board shipping an AXG SoCs and a Realtek RTL8211F PHY revealed that after a few hours the connection speed would drop drastically, from ~1000Mbps to ~3Mbps. At the same time the 'macirq' (eth0) IRQ would stop being triggered at all and as consequence the GMAC IRQs never ACKed.
After a painful investigation the problem seemed to be due to a wrong defined IRQ type for the GMAC IRQ that should be LEVEL_HIGH instead of EDGE_RISING.
The change in the macirq IRQ type also solved another long standing issue affecting this SoC/PHY where EEE was causing the network connection to die after stressing it with iperf3 (even though much sooner). It's now possible to remove the 'eee-broken-1000t' quirk as well.
--- arch/arm/boot/dts/meson.dtsi | 2 +- arch/arm/boot/dts/meson8b-odroidc1.dts | 1 - 2 files changed, 1 insertion(+), 2 deletions(-)
arch/arm/boot/dts/meson.dtsi +1 -1
@@ -263,7 +263,7 @@ compatible = "amlogic,meson6-dwmac", "snps,dwmac"; reg = <0xc9410000 0x10000 0xc1108108 0x4>; - interrupts = <GIC_SPI 8 IRQ_TYPE_EDGE_RISING>; + interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "macirq"; status = "disabled"; };
arch/arm/boot/dts/meson8b-odroidc1.dts +0 -1
@@ -125,7 +125,6 @@ /* Realtek RTL8211F (0x001cc916) */ eth_phy: ethernet-phy@0 { reg = <0>; - eee-broken-1000t; interrupt-parent = <&gpio_intc>; /* GPIOH_3 */ interrupts = <17 IRQ_TYPE_LEVEL_LOW>;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 66/149 ARM: dts: meson8b: odroidc1: mark the SD card detection GPIO active-low
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 3fb348e030319f20ebbde082a449d4bf8a96f2fd ]
After commit 89a5e15bcba87d ("gpio/mmc/of: Respect polarity in the device tree") SD cards are not detected anymore.
The CD GPIO is "active low" on Odroid-C1. The MMC dt-bindings specify:
"[...] using the "cd-inverted" property means, that the CD line is active high, i.e. it is high, when a card is inserted".
Fix the description of the SD card by marking it as GPIO_ACTIVE_LOW and drop the "cd-inverted" property. This makes the definition consistent with the existing dt-bindings and fixes the check whether an SD card is inserted.
--- arch/arm/boot/dts/meson8b-odroidc1.dts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/arm/boot/dts/meson8b-odroidc1.dts +1 -2
@@ -171,8 +171,7 @@ cap-sd-highspeed; disable-wp; - cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>; - cd-inverted; + cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>; vmmc-supply = <&tflash_vdd>; vqmmc-supply = <&tf_io>;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 67/149 ARM: dts: meson8m2: mxiii-plus: mark the SD card detection GPIO active-low
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8615f5596335db0978cea593dcd0070dc5f8b116 ]
After commit 89a5e15bcba87d ("gpio/mmc/of: Respect polarity in the device tree") SD cards are not detected anymore.
The CD GPIO is "active low" on the MXIII-Plus. The MMC dt-bindings
specify: "[...] using the "cd-inverted" property means, that the CD line is active high, i.e. it is high, when a card is inserted".
Fix the description of the SD card by marking it as GPIO_ACTIVE_LOW and drop the "cd-inverted" property. This makes the definition consistent with the existing dt-bindings and fixes the check whether an SD card is inserted.
--- arch/arm/boot/dts/meson8m2-mxiii-plus.dts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/arm/boot/dts/meson8m2-mxiii-plus.dts +1 -2
@@ -206,8 +206,7 @@ cap-sd-highspeed; disable-wp; - cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>; - cd-inverted; + cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>; vmmc-supply = <&vcc_3v3>; };
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 68/149 ARM: dts: imx6sx: correct backward compatible of gpt
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ba0f4560526ba19300c07ed5a3c1df7592815dc6 ]
i.MX6SX has same GPT type as i.MX6DL, in GPT driver, it uses below TIMER_OF_DECLARE, so the backward compatible should be "fsl,imx6dl-gpt", correct it.
TIMER_OF_DECLARE(imx6sx_timer, "fsl,imx6sx-gpt", imx6dl_timer_init_dt);
--- arch/arm/boot/dts/imx6sx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx6sx.dtsi +1 -1
@@ -462,7 +462,7 @@ }; gpt: gpt@2098000 { - compatible = "fsl,imx6sx-gpt", "fsl,imx31-gpt"; + compatible = "fsl,imx6sx-gpt", "fsl,imx6dl-gpt"; reg = <0x02098000 0x4000>; interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX6SX_CLK_GPT_BUS>,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 69/149 arm64: dts: renesas: r8a7796: Enable DMA for SCIF2
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 97f26702bc95b5c3a72671d5c6675e4d6ee0a2f4 ]
SCIF2 on R-Car M3-W can be used with both DMAC1 and DMAC2.
--- arch/arm64/boot/dts/renesas/r8a7796.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/renesas/r8a7796.dtsi +3 -0
@@ -1161,6 +1161,9 @@ <&cpg CPG_CORE R8A7796_CLK_S3D1>, <&scif_clk>; clock-names = "fck", "brg_int", "scif_clk"; + dmas = <&dmac1 0x13>, <&dmac1 0x12>, + <&dmac2 0x13>, <&dmac2 0x12>; + dma-names = "tx", "rx", "tx", "rx"; power-domains = <&sysc R8A7796_PD_ALWAYS_ON>; resets = <&cpg 310>; status = "disabled";
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 70/149 arm64: dts: renesas: r8a77965: Enable DMA for SCIF2
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 05c8478abd485507c25aa565afab604af8d8fe46 ]
SCIF2 on R-Car M3-N can be used with both DMAC1 and DMAC2.
--- arch/arm64/boot/dts/renesas/r8a77965.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/renesas/r8a77965.dtsi +3 -0
@@ -951,6 +951,9 @@ <&cpg CPG_CORE R8A77965_CLK_S3D1>, <&scif_clk>; clock-names = "fck", "brg_int", "scif_clk"; + dmas = <&dmac1 0x13>, <&dmac1 0x12>, + <&dmac2 0x13>, <&dmac2 0x12>; + dma-names = "tx", "rx", "tx", "rx"; power-domains = <&sysc R8A77965_PD_ALWAYS_ON>; resets = <&cpg 310>; status = "disabled";
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 71/149 soc: fsl: qbman: avoid race in clearing QMan interrupt
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 89857a8a5c89a406b967ab2be7bd2ccdbe75e73d ]
By clearing all interrupt sources, not only those that already occurred, the existing code may acknowledge by mistake interrupts that occurred after the code checks for them.
--- drivers/soc/fsl/qbman/qman.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/soc/fsl/qbman/qman.c +5 -4
@@ -1081,18 +1081,19 @@ static void qm_mr_process_task(struct work_struct *work);static irqreturn_t portal_isr (int irq,void *ptr) {struct qman_portal *p = ptr; - -u32 clear =QM_DQAVAIL_MASK | p->irq_sources;u32 is =qm_in (&p->p,QM_REG_ISR ) & p->irq_sources; +u32 clear =0 ;if (unlikely (!is))return IRQ_NONE ;/* DQRR-handling if it's interrupt-driven */ -if (is &QM_PIRQ_DQRI ) +if (is &QM_PIRQ_DQRI ) {__poll_portal_fast (p,QMAN_POLL_LIMIT ); + clear =QM_DQAVAIL_MASK |QM_PIRQ_DQRI ; + }/* Handling of anything else that's interrupt-driven */ - clear |=__poll_portal_slow (p, is); + clear |=__poll_portal_slow (p, is) &QM_PIRQ_SLOW ;qm_out (&p->p,QM_REG_ISR , clear);return IRQ_HANDLED ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 72/149 pinctrl: mcp23s08: spi: Fix regmap allocation for mcp23s18
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f165988b77ef849eb0c1aebd94fe778024f88314 ]
Fixes issue created by 9b3e4207661e67f04c72af15e29f74cd944f5964.
It wasn't possible for one_regmap_config to be non-NULL at the point it was tested for mcp23s18 devices.
Applied the same pattern of allocating one_regmap_config using devm_kmemdump() and then initializing the local regmap structure from that.
--- drivers/pinctrl/pinctrl-mcp23s08.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-mcp23s08.c +6 -1
@@ -832,8 +832,13 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,break ;case MCP_TYPE_S18 : + one_regmap_config = +devm_kmemdup (dev, &mcp23x17_regmap, +sizeof (struct regmap_config ),GFP_KERNEL ); +if (!one_regmap_config) +return -ENOMEM ; mcp->regmap =devm_regmap_init (dev, &mcp23sxx_spi_regmap, mcp, - &mcp23x17_regmap); + one_regmap_config); mcp->reg_shift =1 ; mcp->chip.ngpio =16 ; mcp->chip.label ="mcp23s18" ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 73/149 wlcore: sdio: Fixup power on/off sequence
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 13e62626c578d9889ebbda7c521be5adff9bef8e ]
During "wlan-up", we are programming the FW into the WiFi-chip. However, re-programming the FW doesn't work, unless a power cycle of the WiFi-chip is made in-between the programmings.
To conform to this requirement and to fix the regression in a simple way, let's start by allowing that the SDIO card (WiFi-chip) may stay powered on (runtime resumed) when wl12xx_sdio_power_off() returns. The intent with the current code is to treat this scenario as an error, but unfortunate this doesn't work as expected, so let's fix this.
The other part is to guarantee that a power cycle of the SDIO card has been completed when wl12xx_sdio_power_on() returns, as to allow the FW programming to succeed. However, relying solely on runtime PM to deal with this isn't sufficient. For example, userspace may prevent runtime suspend via sysfs for the device that represents the SDIO card, leading to that the mmc core also keeps it powered on. For this reason, let's instead do a brute force power cycle in wl12xx_sdio_power_on().
--- drivers/net/wireless/ti/wlcore/sdio.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/net/wireless/ti/wlcore/sdio.c +7 -8
@@ -164,6 +164,12 @@ static int wl12xx_sdio_power_on(struct wl12xx_sdio_glue *glue) }sdio_claim_host (func); +/* +* To guarantee that the SDIO card is power cycled, as required to make +* the FW programming to succeed, let's do a brute force HW reset. +*/ +mmc_hw_reset (card->host); +sdio_enable_func (func);sdio_release_host (func);
@@ -174,20 +180,13 @@ static int wl12xx_sdio_power_off(struct wl12xx_sdio_glue *glue) {struct sdio_func *func =dev_to_sdio_func (glue->dev);struct mmc_card *card = func->card; -int error;sdio_claim_host (func);sdio_disable_func (func);sdio_release_host (func);/* Let runtime PM know the card is powered off */ - error =pm_runtime_put (&card->dev); -if (error <0 && error != -EBUSY ) { -dev_err (&card->dev,"%s failed: %i\n" , __func__, error); - -return error; - } - +pm_runtime_put (&card->dev);return 0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 74/149 bpftool: Fix prog dump by tag
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 752bcf80f5549c9901b2e8bc77b2138de55b1026 ]
Lance reported an issue with bpftool not being able to dump program if there are more programs loaded and you want to dump any but the first program, like:
# bpftool prog 28: kprobe name trace_req_start tag 1dfc28ba8b3dd597 gpl loaded_at 2019-01-18T17:02:40+1100 uid 0 xlated 112B jited 109B memlock 4096B map_ids 13 29: kprobe name trace_req_compl tag 5b6a5ecc6030a683 gpl loaded_at 2019-01-18T17:02:40+1100 uid 0 xlated 928B jited 575B memlock 4096B map_ids 13,14 # bpftool prog dum jited tag 1dfc28ba8b3dd597 0: push %rbp 1: mov %rsp,%rbp ...
# bpftool prog dum jited tag 5b6a5ecc6030a683
Error: can't get prog info (29): Bad address
The problem is in the prog_fd_by_tag function not cleaning the struct bpf_prog_info before another request, so the previous program length is still in there and kernel assumes it needs to dump the program, which fails because there's no user pointer set.
Moving the struct bpf_prog_info declaration into the loop, so it gets cleaned before each query.
--- tools/bpf/bpftool/prog.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/bpf/bpftool/prog.c +3 -2
@@ -109,13 +109,14 @@ static void print_boot_time(__u64 nsecs, char *buf, unsigned int size)static int prog_fd_by_tag (unsigned char *tag) { -struct bpf_prog_info info = {}; -__u32 len =sizeof (info);unsigned int id =0 ;int err;int fd;while (true) { +struct bpf_prog_info info = {}; +__u32 len =sizeof (info); + err =bpf_prog_get_next_id (id, &id);if (err) {p_err ("%s" ,strerror (errno));
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 75/149 bpftool: fix percpu maps updating
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b0ca5ecb8e2279d706261f525f1bd0ba9e3fe800 ]
When updating a percpu map, bpftool currently copies the provided value only into the first per CPU copy of the specified value, all others instances are left zeroed.
This change explicitly copies the user-provided bytes to all the per CPU instances, keeping the sub-command syntax unchanged.
v2 -> v3:
- drop unused argument, as per Quentin's suggestion
v1 -> v2:
- rename the helper as per Quentin's suggestion
--- tools/bpf/bpftool/map.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
tools/bpf/bpftool/map.c +16 -0
@@ -370,6 +370,20 @@ static char **parse_bytes(char **argv, const char *name, unsigned char *val,return argv + i; } +/* on per cpu maps we must copy the provided value on all value instances */ +static void fill_per_cpu_value (struct bpf_map_info *info,void *value) +{ +unsigned int i, n, step; + +if (!map_is_per_cpu (info->type)) +return ; + + n =get_possible_cpus (); + step =round_up (info->value_size,8 ); +for (i =1 ; i < n; i++) +memcpy (value + i * step, value, info->value_size); +} +static int parse_elem (char **argv,struct bpf_map_info *info,void *key,void *value,__u32 key_size,__u32 value_size,__u32 *flags,__u32 **value_fd)
@@ -449,6 +463,8 @@ static int parse_elem(char **argv, struct bpf_map_info *info, argv =parse_bytes (argv,"value" , value, value_size);if (!argv)return -1 ; + +fill_per_cpu_value (info, value); } return parse_elem(argv, info, key, NULL, key_size, value_size,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 76/149 bpf: sock recvbuff must be limited by rmem_max in bpf_setsockopt()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c9e4576743eeda8d24dedc164d65b78877f9a98c ]
When sock recvbuff is set by bpf_setsockopt(), the value must by limited by rmem_max. It is the same with sendbuff.
--- net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/filter.c +2 -0
@@ -3909,10 +3909,12 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,/* Only some socketops are supported */ switch (optname) {case SO_RCVBUF : + val =min_t (u32, val, sysctl_rmem_max); sk->sk_userlocks |=SOCK_RCVBUF_LOCK ; sk->sk_rcvbuf =max_t (int, val *2 ,SOCK_MIN_RCVBUF );break ;case SO_SNDBUF : + val =min_t (u32, val, sysctl_wmem_max); sk->sk_userlocks |=SOCK_SNDBUF_LOCK ; sk->sk_sndbuf =max_t (int, val *2 ,SOCK_MIN_SNDBUF );break ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 77/149 ARM: pxa: ssp: unneeded to free devm_ allocated data
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ba16adeb346387eb2d1ada69003588be96f098fa ]
devm_ allocated data will be automatically freed. The free of devm_ allocated data is invalid.
--- arch/arm/plat-pxa/ssp.c | 3 --- 1 file changed, 3 deletions(-)
arch/arm/plat-pxa/ssp.c +0 -3
@@ -190,8 +190,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)if (ssp ==NULL )return -ENODEV ; -iounmap (ssp->mmio_base); - res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );release_mem_region (res->start,resource_size (res));
@@ -201,7 +199,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)list_del (&ssp->node);mutex_unlock (&ssp_lock); -kfree (ssp);return 0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 78/149 arm64: dts: add msm8996 compatible to gicv3
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2a81efb0de0e33f2d2c83154af0bd3ce389b3269 ]
Add compatible to gicv3 node to enable quirk required to restrict writing to GICR_WAKER register which is restricted on msm8996 SoC in Hypervisor.
With this quirk MSM8996 can at least boot out of mainline, which can help community to work with boards based on MSM8996.
Without this patch Qualcomm DB820c board reboots on mainline.
--- arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/msm8996.dtsi +1 -1
@@ -399,7 +399,7 @@ }; intc: interrupt-controller@9bc0000 { - compatible = "arm,gic-v3"; + compatible = "qcom,msm8996-gic-v3", "arm,gic-v3"; #interrupt-cells = <3>; interrupt-controller; #redistributor-regions = <1>;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 79/149 batman-adv: release station info tidstats
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7d652669b61d702c6e62a39579d17f6881670ab6 ]
With the addition of TXQ stats in the per-tid statistics the struct station_info grew significantly. This resulted in stack size warnings due to the structure itself being above the limit for the warnings.
To work around this, the TID array was allocated dynamically. Also a function to free this content was introduced with commit 7ea3e110f2f8 ("cfg80211: release station info tidstats where needed") but the necessary changes were not provided for batman-adv's B.A.T.M.A.N. V implementation.
--- net/batman-adv/bat_v_elp.c | 3 +++ 1 file changed, 3 insertions(+)
net/batman-adv/bat_v_elp.c +3 -0
@@ -104,6 +104,9 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh) ret =cfg80211_get_station (real_netdev, neigh->addr, &sinfo); +/* free the TID stats immediately */ +cfg80211_sinfo_release_content (&sinfo); +dev_put (real_netdev);if (ret == -ENOENT ) {/* Node is not associated anymore! It would be
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 80/149 DTS: CI20: Fix bugs in ci20s device tree.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1ca1c87f91d9dc50d6a38e2177b2032996e7901c ]
According to the Schematic, the hardware of ci20 leads to uart3, but not to uart2. Uart2 is miswritten in the original code.
--- arch/mips/boot/dts/ingenic/ci20.dts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/mips/boot/dts/ingenic/ci20.dts +4 -4
@@ -76,7 +76,7 @@ status = "okay"; pinctrl-names = "default"; - pinctrl-0 = <&pins_uart2>; + pinctrl-0 = <&pins_uart3>; }; &uart4 {
@@ -196,9 +196,9 @@ bias-disable; }; - pins_uart2: uart2 { - function = "uart2"; - groups = "uart2-data", "uart2-hwflow"; + pins_uart3: uart3 { + function = "uart3"; + groups = "uart3-data", "uart3-hwflow"; bias-disable; };
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 81/149 usb: phy: fix link errors
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f2105d42597f4d10e431b195d69e96dccaf9b012 ]
Fix link errors when CONFIG_FSL_USB2_OTG is enabled and USB_OTG_FSM is set to module then the following link error occurs.
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_ioctl':drivers/usb/phy/phy-fsl-usb.c:1083: undefined reference to `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:1083:(.text+0x574): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_start_srp':drivers/usb/phy/phy-fsl-usb.c:674: undefined reference to `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:674:(.text+0x61c): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_set_host':drivers/usb/phy/phy-fsl-usb.c:593: undefined reference to `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:593:(.text+0x7a4): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_start_hnp':drivers/usb/phy/phy-fsl-usb.c:695: undefined reference to `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:695:(.text+0x858): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `a_wait_enum':drivers/usb/phy/phy-fsl-usb.c:274: undefined reference to `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:274:(.text+0x16f0): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o:drivers/usb/phy/phy-fsl-usb.c:619: more undefined references to `otg_statemachine' follow
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_set_peripheral':
drivers/usb/phy/phy-fsl-usb.c:619:(.text+0x1fa0): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine' make[1]: *** [Makefile:1020: vmlinux] Error 1
make[1]: Target 'Image' not remade because of errors.
make: *** [Makefile:152: sub-make] Error 2
make: Target 'Image' not remade because of errors.
Rework so that FSL_USB2_OTG depends on that the USB_OTG_FSM is builtin.
--- drivers/usb/phy/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/phy/Kconfig +1 -1
@@ -21,7 +21,7 @@ config AB8500_USB config FSL_USB2_OTG bool "Freescale USB OTG Transceiver Driver" - depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM && PM + depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y' select USB_PHY help
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 82/149 irqchip/gic-v4: Fix occasional VLPI drop
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6479450f72c1391c03f08affe0d0110f41ae7ca0 ]
1. In current implementation, every VLPI will temporarily be mapped to the first CPU in system (normally CPU0) and then moved to the real scheduled CPU later.
2. So there is a time window and a VLPI may be sent to CPU0 instead of the real scheduled vCPU, in a multi-CPU virtual machine.
3. However, CPU0 may have not been scheduled as a virtual CPU after system boots up, so the value of its GICR_VPROPBASER is unknown at that moment.
4. If the INTID of VLPI is larger than 2^(GICR_VPROPBASER.IDbits+1), while IDbits is also in unknown state, GIC will behave as if the VLPI is out of range and simply drop it, which results in interrupt missing in Guest.
As no code will clear GICR_VPROPBASER at runtime, we can safely initialize the IDbits field at boot time for each CPU to get rid of this issue.
We also clear Valid bit of GICR_VPENDBASER in case any ancient programming gets left in and causes memory corrupting. A new function its_clear_vpend_valid() is added to reuse the code in its_vpe_deschedule().
--- drivers/irqchip/irq-gic-v3-its.c | 66 ++++++++++++++++++++++++-------- 1 file changed, 49 insertions(+), 17 deletions(-)
drivers/irqchip/irq-gic-v3-its.c +49 -17
@@ -1951,6 +1951,29 @@ static void its_free_pending_table(struct page *pt) get_order(max_t(u32, LPI_PENDBASE_SZ, SZ_64K))); } +static u64 its_clear_vpend_valid (void __iomem *vlpi_base) +{ +u32 count =1000000 ;/* 1s! */ +bool clean; +u64 val; + + val =gits_read_vpendbaser (vlpi_base +GICR_VPENDBASER ); + val &= ~GICR_VPENDBASER_Valid; +gits_write_vpendbaser (val, vlpi_base +GICR_VPENDBASER ); + +do { + val =gits_read_vpendbaser (vlpi_base +GICR_VPENDBASER ); + clean = !(val & GICR_VPENDBASER_Dirty); +if (!clean) { + count--; +cpu_relax (); +udelay (1 ); + } + }while (!clean && count); + +return val; +} +static void its_cpu_init_lpis (void ) {void __iomem *rbase =gic_data_rdist_rd_base ();
@@ -2024,6 +2047,30 @@ static void its_cpu_init_lpis(void) val |=GICR_CTLR_ENABLE_LPIS ;writel_relaxed (val, rbase +GICR_CTLR ); +if (gic_rdists->has_vlpis) { +void __iomem *vlpi_base =gic_data_rdist_vlpi_base (); + +/* +* It's possible for CPU to receive VLPIs before it is +* sheduled as a vPE, especially for the first CPU, and the +* VLPI with INTID larger than 2^(IDbits+1) will be considered +* as out of range and dropped by GIC. +* So we initialize IDbits to known value to avoid VLPI drop. +*/ + val = (LPI_NRBITS -1 ) &GICR_VPROPBASER_IDBITS_MASK ; +pr_debug ("GICv4: CPU%d: Init IDbits to 0x%llx for GICR_VPROPBASER\n" , +smp_processor_id (), val); +gits_write_vpropbaser (val, vlpi_base +GICR_VPROPBASER ); + +/* +* Also clear Valid bit of GICR_VPENDBASER, in case some +* ancient programming gets left in and has possibility of +* corrupting memory. +*/ + val =its_clear_vpend_valid (vlpi_base); +WARN_ON (val & GICR_VPENDBASER_Dirty); + } +/* Make sure the GIC has seen the above */ dsb (sy); }
@@ -2644,26 +2691,11 @@ static void its_vpe_schedule(struct its_vpe *vpe)static void its_vpe_deschedule (struct its_vpe *vpe) {void __iomem *vlpi_base =gic_data_rdist_vlpi_base (); -u32 count =1000000 ;/* 1s! */ -bool clean;u64 val; -/* We're being scheduled out */ - val =gits_read_vpendbaser (vlpi_base +GICR_VPENDBASER ); - val &= ~GICR_VPENDBASER_Valid; -gits_write_vpendbaser (val, vlpi_base +GICR_VPENDBASER ); - -do { - val =gits_read_vpendbaser (vlpi_base +GICR_VPENDBASER ); - clean = !(val & GICR_VPENDBASER_Dirty); -if (!clean) { - count--; -cpu_relax (); -udelay (1 ); - } - }while (!clean && count); + val =its_clear_vpend_valid (vlpi_base); -if (unlikely (!clean && !count)) { +if (unlikely (val & GICR_VPENDBASER_Dirty)) {pr_err_ratelimited ("ITS virtual pending table not cleaning\n" ); vpe->idai = false; vpe->pending_last = true;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 83/149 irqchip/gic-v3-its: Gracefully fail on LPI exhaustion
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 45725e0fc3e7fe52fedb94f59806ec50e9618682 ]
In the unlikely event that we cannot find any available LPI in the system, we should gracefully return an error instead of carrying on with no LPI allocated at all.
--- drivers/irqchip/irq-gic-v3-its.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/irqchip/irq-gic-v3-its.c +3 -0
@@ -1581,6 +1581,9 @@ static unsigned long *its_lpi_alloc(int nr_irqs, u32 *base, int *nr_ids) nr_irqs /=2 ; }while (nr_irqs >0 ); +if (!nr_irqs) + err = -ENOSPC ; +if (err) goto out;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 84/149 irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2380a22b60ce6f995eac806e69c66e397b59d045 ]
Resetting bit 4 disables the interrupt delivery to the "secure processor" core. This breaks the keyboard on a OLPC XO 1.75 laptop, where the firmware running on the "secure processor" bit-bangs the PS/2 protocol over the GPIO lines.
It is not clear what the rest of the bits are and Marvell was unhelpful when asked for documentation. Aside from the SP bit, there are probably priority bits.
Leaving the unknown bits as the firmware set them up seems to be a wiser course of action compared to just turning them off.
--- drivers/irqchip/irq-mmp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/irqchip/irq-mmp.c +5 -1
@@ -34,6 +34,9 @@#define SEL_INT_PENDING (1 << 6)#define SEL_INT_NUM_MASK 0x3f +#define MMP2_ICU_INT_ROUTE_PJ4_IRQ (1 << 5) +#define MMP2_ICU_INT_ROUTE_PJ4_FIQ (1 << 6) +struct icu_chip_data {int nr_irqs;unsigned int virq_base;
@@ -190,7 +193,8 @@ static const struct mmp_intc_conf mmp_conf = {static const struct mmp_intc_conf mmp2_conf = { .conf_enable =0x20 , .conf_disable =0x0 , - .conf_mask =0x7f , + .conf_mask =MMP2_ICU_INT_ROUTE_PJ4_IRQ | +MMP2_ICU_INT_ROUTE_PJ4_FIQ , }; static void __exception_irq_entry mmp_handle_irq(struct pt_regs *regs)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 85/149 drm/amdgpu: Add missing power attribute to APU check
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit dc14eb12f6bb3e779c5461429c1889a339c67aab ]
Add missing power_average to visible check for power attributes for APUs. Was missed before.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +2 -1
@@ -1443,7 +1443,8 @@ static umode_t hwmon_attributes_visible(struct kobject *kobj, effective_mode &= ~S_IWUSR ;if ((adev->flags &AMD_IS_APU ) && - (attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr || + (attr == &sensor_dev_attr_power1_average.dev_attr.attr || + attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr || attr == &sensor_dev_attr_power1_cap_min.dev_attr.attr|| attr == &sensor_dev_attr_power1_cap.dev_attr.attr))return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 86/149 drm/radeon: check if device is root before getting pci speed caps
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit afeff4c16edaa6275b903f82b0561406259aa3a3 ]
Check if the device is root rather before attempting to see what speeds the pcie port supports. Fixes a crash with pci passthrough in a VM.
--- drivers/gpu/drm/radeon/ci_dpm.c | 5 +++-- drivers/gpu/drm/radeon/si_dpm.c | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/radeon/ci_dpm.c +3 -2
@@ -5676,7 +5676,7 @@ int ci_dpm_init(struct radeon_device *rdev)u16 data_offset, size;u8 frev, crev;struct ci_power_info *pi; -enum pci_bus_speed speed_cap; +enum pci_bus_speed speed_cap =PCI_SPEED_UNKNOWN ;struct pci_dev *root = rdev->pdev->bus->self;int ret;
@@ -5685,7 +5685,8 @@ int ci_dpm_init(struct radeon_device *rdev)return -ENOMEM ; rdev->pm.dpm.priv = pi; - speed_cap =pcie_get_speed_cap (root); +if (!pci_is_root_bus (rdev->pdev->bus)) + speed_cap =pcie_get_speed_cap (root);if (speed_cap ==PCI_SPEED_UNKNOWN ) { pi->sys_pcie_mask =0 ; }else {
drivers/gpu/drm/radeon/si_dpm.c +3 -2
@@ -6899,7 +6899,7 @@ int si_dpm_init(struct radeon_device *rdev)struct ni_power_info *ni_pi;struct si_power_info *si_pi;struct atom_clock_dividers dividers; -enum pci_bus_speed speed_cap; +enum pci_bus_speed speed_cap =PCI_SPEED_UNKNOWN ;struct pci_dev *root = rdev->pdev->bus->self;int ret;
@@ -6911,7 +6911,8 @@ int si_dpm_init(struct radeon_device *rdev) eg_pi = &ni_pi->eg; pi = &eg_pi->rv7xx; - speed_cap =pcie_get_speed_cap (root); +if (!pci_is_root_bus (rdev->pdev->bus)) + speed_cap =pcie_get_speed_cap (root);if (speed_cap ==PCI_SPEED_UNKNOWN ) { si_pi->sys_pcie_mask =0 ; }else {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 87/149 drm/amdgpu: Transfer fences to dmabuf importer
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6e11ea9de9576a644045ffdc2067c09bc2012eda ]
amdgpu only uses shared-fences internally, but dmabuf importers rely on implicit write hazard tracking via the reservation_object.fence_excl. For example, the importer use the write hazard for timing a page flip to only occur after the exporter has finished flushing its write into the surface. As such, on exporting a dmabuf, we must either flush all outstanding fences (for we do not know which are writes and should have been exclusive) or alternatively create a new exclusive fence that is the composite of all the existing shared fences, and so will only be signaled when all earlier fences are signaled (ensuring that we can not be signaled before the completion of any earlier write).
v2: reservation_object is already locked by amdgpu_bo_reserve()
v3: Replace looping with get_fences_rcu and special case the promotion of a single shared fence directly to an exclusive fence, bypassing the fence array.
v4: Drop the fence array ref after assigning to reservation_object
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107341
Testcase: igt/amd_prime/amd-to-i915
References: 8e94a46c1770 ("drm/amdgpu: Attach exclusive fence to prime exported bo's. (v5)")
--- drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c | 59 ++++++++++++++++++++--- 1 file changed, 51 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c +51 -8
@@ -37,6 +37,7 @@#include "amdgpu_display.h" #include <drm/amdgpu_drm.h> #include <linux/dma-buf.h> +#include <linux/dma-fence-array.h> static const struct dma_buf_ops amdgpu_dmabuf_ops;
@@ -188,6 +189,48 @@ amdgpu_gem_prime_import_sg_table(struct drm_device *dev,return ERR_PTR (ret); } +static int +__reservation_object_make_exclusive (struct reservation_object *obj) +{ +struct dma_fence **fences; +unsigned int count; +int r; + +if (!reservation_object_get_list (obj))/* no shared fences to convert */ +return 0 ; + + r =reservation_object_get_fences_rcu (obj,NULL , &count, &fences); +if (r) +return r; + +if (count ==0 ) { +/* Now that was unexpected. */ + }else if (count ==1 ) { +reservation_object_add_excl_fence (obj, fences[0 ]); +dma_fence_put (fences[0 ]); +kfree (fences); + }else { +struct dma_fence_array *array; + + array =dma_fence_array_create (count, fences, +dma_fence_context_alloc (1 ),0 , + false); +if (!array) + goto err_fences_put; + +reservation_object_add_excl_fence (obj, &array->base); +dma_fence_put (&array->base); + } + +return 0 ; + +err_fences_put: +while (count--) +dma_fence_put (fences[count]); +kfree (fences); +return -ENOMEM ; +} +/** * amdgpu_gem_map_attach - &dma_buf_ops.attach implementation * @dma_buf: shared DMA buffer
@@ -219,16 +262,16 @@ static int amdgpu_gem_map_attach(struct dma_buf *dma_buf,if (attach->dev->driver != adev->dev->driver) {/* -* Wait for all shared fences to complete before we switch to future -* use of exclusive fence on this prime shared bo. +* We only create shared fences for internal use, but importers +* of the dmabuf rely on exclusive fences for implicitly +* tracking write hazards. As any of the current fences may +* correspond to a write, we need to convert all existing +* fences on the reservation object into a single exclusive +* fence. */ - r =reservation_object_wait_timeout_rcu (bo->tbo.resv, - true, false, -MAX_SCHEDULE_TIMEOUT ); -if (unlikely (r <0 )) { -DRM_DEBUG_PRIME ("Fence wait failed: %li\n" , r); + r =__reservation_object_make_exclusive (bo->tbo.resv); +if (r) goto error_unreserve; - } }/* pin buffer into GTT */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 88/149 net: stmmac: Fallback to Platform Data clock in Watchdog conversion
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4ec5302fa906ec9d86597b236f62315bacdb9622 ]
If we don't have DT then stmmac_clk will not be available. Let's add a new Platform Data field so that we can specify the refclk by this mean.
This way we can still use the coalesce command in PCI based setups.
--- .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 14 ++++++++++---- include/linux/stmmac.h | 1 + 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +10 -4
@@ -719,8 +719,11 @@ static u32 stmmac_usec2riwt(u32 usec, struct stmmac_priv *priv) {unsigned long clk =clk_get_rate (priv->plat->stmmac_clk); -if (!clk) -return 0 ; +if (!clk) { + clk = priv->plat->clk_ref_rate; +if (!clk) +return 0 ; + }return (usec * (clk /1000000 )) /256 ; }
@@ -729,8 +732,11 @@ static u32 stmmac_riwt2usec(u32 riwt, struct stmmac_priv *priv) {unsigned long clk =clk_get_rate (priv->plat->stmmac_clk); -if (!clk) -return 0 ; +if (!clk) { + clk = priv->plat->clk_ref_rate; +if (!clk) +return 0 ; + }return (riwt *256 ) / (clk /1000000 ); }
include/linux/stmmac.h +1 -0
@@ -184,6 +184,7 @@ struct plat_stmmacenet_data {struct clk *pclk;struct clk *clk_ptp_ref;unsigned int clk_ptp_rate; +unsigned int clk_ref_rate;struct reset_control *stmmac_rst;struct stmmac_axi *axi;int has_gmac4;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 89/149 net: stmmac: Send TSO packets always from Queue 0
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c5acdbee22a1b200dde07effd26fd1f649e9ab8a ]
The number of TSO enabled channels in HW can be different than the number of total channels. There is no way to determined, at runtime, the number of TSO capable channels and its safe to assume that if TSO is enabled then at least channel 0 will be TSO capable.
Lets always send TSO packets from Queue 0.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +10 -1
@@ -3030,8 +3030,17 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)/* Manage oversized TCP frames for GMAC4 device */ if (skb_is_gso (skb) && priv->tso) { -if (skb_shinfo (skb)->gso_type & (SKB_GSO_TCPV4 |SKB_GSO_TCPV6 )) +if (skb_shinfo (skb)->gso_type & (SKB_GSO_TCPV4 |SKB_GSO_TCPV6 )) { +/* +* There is no way to determine the number of TSO +* capable Queues. Let's use always the Queue 0 +* because if TSO is supported then at least this +* one will be capable. +*/ +skb_set_queue_mapping (skb,0 ); +return stmmac_tso_xmit (skb, dev); + } }if (unlikely (stmmac_tx_avail (priv, queue) < nfrags +1 )) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 90/149 net: stmmac: Disable EEE mode earlier in XMIT callback
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e2cd682deb231ba6f80524bb84e57e7138261149 ]
In stmmac xmit callback we use a different flow for TSO packets but TSO xmit callback is not disabling the EEE mode.
Fix this by disabling earlier the EEE mode, i.e. before calling the TSO xmit callback.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +3 -3
@@ -3028,6 +3028,9 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) tx_q = &priv->tx_queue[queue]; +if (priv->tx_path_in_lpi_mode) +stmmac_disable_eee_mode (priv); +/* Manage oversized TCP frames for GMAC4 device */ if (skb_is_gso (skb) && priv->tso) {if (skb_shinfo (skb)->gso_type & (SKB_GSO_TCPV4 |SKB_GSO_TCPV6 )) {
@@ -3055,9 +3058,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)return NETDEV_TX_BUSY ; } -if (priv->tx_path_in_lpi_mode) -stmmac_disable_eee_mode (priv); - entry = tx_q->cur_tx; first_entry = entry;WARN_ON (tx_q->tx_skbuff[first_entry]);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 91/149 irqchip/gic-v3-its: Fix ITT_entry_size accessor
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 56841070ccc87b463ac037d2d1f2beb8e5e35f0c ]
According to ARM IHI 0069C (ID070116), we should use GITS_TYPER's bits [7:4] as ITT_entry_size instead of [8:4]. Although this is pretty annoying, it only results in a potential over-allocation of memory, and nothing bad happens.
--- include/linux/irqchip/arm-gic-v3.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/irqchip/arm-gic-v3.h +1 -1
@@ -319,7 +319,7 @@#define GITS_TYPER_PLPIS (1UL << 0)#define GITS_TYPER_VLPIS (1UL << 1)#define GITS_TYPER_ITT_ENTRY_SIZE_SHIFT 4 -#define GITS_TYPER_ITT_ENTRY_SIZE (r) ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0x1f) + 1) +#define GITS_TYPER_ITT_ENTRY_SIZE (r) ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0xf) + 1)#define GITS_TYPER_IDBITS_SHIFT 8#define GITS_TYPER_DEVBITS_SHIFT 13#define GITS_TYPER_DEVBITS (r) ((((r) >> GITS_TYPER_DEVBITS_SHIFT) & 0x1f) + 1)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 92/149 relay: check return of create_buf_file() properly
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2c1cf00eeacb784781cf1c9896b8af001246d339 ]
If create_buf_file() returns an error, don't try to reference it later as a valid dentry pointer.
This problem was exposed when debugfs started to return errors instead of just NULL for some calls when they do not succeed properly.
Also, the check for WARN_ON(dentry) was just wrong :)
--- kernel/relay.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/relay.c +3 -1
@@ -428,6 +428,8 @@ static struct dentry *relay_create_buf_file(struct rchan *chan, dentry = chan->cb->create_buf_file (tmpname, chan->parent,S_IRUSR , buf, &chan->is_global); +if (IS_ERR (dentry)) + dentry =NULL ;kfree (tmpname);
@@ -461,7 +463,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, unsigned int cpu) dentry = chan->cb->create_buf_file (NULL ,NULL ,S_IRUSR , buf, &chan->is_global); -if (WARN_ON (dentry)) +if (IS_ERR_OR_NULL (dentry)) goto free_buf; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 93/149 bpf, selftests: fix handling of sparse CPU allocations
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1bb54c4071f585ebef56ce8fdfe6026fa2cbcddd ]
Previously, bpf_num_possible_cpus() had a bug when calculating a number of possible CPUs in the case of sparse CPU allocations, as it was considering only the first range or element of /sys/devices/system/cpu/possible.
E.g. in the case of "0,2-3" (CPU 1 is not available), the function returned 1 instead of 3.
This patch fixes the function by making it parse all CPU ranges and elements.
--- tools/testing/selftests/bpf/bpf_util.h | 30 +++++++++++++++++--------- 1 file changed, 20 insertions(+), 10 deletions(-)
tools/testing/selftests/bpf/bpf_util.h +20 -10
@@ -13,7 +13,7 @@ static inline unsigned int bpf_num_possible_cpus(void)unsigned int start, end, possible_cpus =0 ;char buff[128 ];FILE *fp; -int n; +int len, n, i, j =0 ; fp =fopen (fcpu,"r" );if (!fp) {
@@ -21,17 +21,27 @@ static inline unsigned int bpf_num_possible_cpus(void)exit (1 ); } -while (fgets (buff,sizeof (buff), fp)) { - n =sscanf (buff,"%u-%u" , &start, &end); -if (n ==0 ) { -printf ("Failed to retrieve # possible CPUs!\n" ); -exit (1 ); - }else if (n ==1 ) { - end = start; +if (!fgets (buff,sizeof (buff), fp)) { +printf ("Failed to read %s!\n" , fcpu); +exit (1 ); + } + + len =strlen (buff); +for (i =0 ; i <= len; i++) { +if (buff[i] ==',' || buff[i] =='\0' ) { + buff[i] ='\0' ; + n =sscanf (&buff[j],"%u-%u" , &start, &end); +if (n <=0 ) { +printf ("Failed to retrieve # possible CPUs!\n" ); +exit (1 ); + }else if (n ==1 ) { + end = start; + } + possible_cpus += end - start +1 ; + j = i +1 ; } - possible_cpus = start ==0 ? end +1 :0 ; -break ; } +fclose (fp);return possible_cpus;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 94/149 bpf: fix lockdep false positive in percpu_freelist
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a89fac57b5d080771efd4d71feaae19877cf68f0 ]
Lockdep warns about false positive:
[ 12.492084] 00000000e6b28347 (&head->lock){+...}, at: pcpu_freelist_push+0x2a/0x40
[ 12.492696] but this lock was taken by another, HARDIRQ-safe lock in the past:
[ 12.493275] (&rq->lock){-.-.}
[ 12.493276]
[ 12.493276]
[ 12.493276] and interrupts could create inverse lock ordering between them.
[ 12.493276]
[ 12.494435]
[ 12.494435] other info that might help us debug this:
[ 12.494979] Possible interrupt unsafe locking scenario:
[ 12.494979]
[ 12.495518] CPU0 CPU1
[ 12.495879] ---- ----
[ 12.496243] lock(&head->lock);
[ 12.496502] local_irq_disable();
[ 12.496969] lock(&rq->lock);
[ 12.497431] lock(&head->lock);
[ 12.497890] <Interrupt>
[ 12.498104] lock(&rq->lock);
[ 12.498368]
[ 12.498368] *** DEADLOCK ***
[ 12.498368]
[ 12.498837] 1 lock held by dd/276:
[ 12.499110] #0: 00000000c58cb2ee (rcu_read_lock){....}, at: trace_call_bpf+0x5e/0x240
[ 12.499747]
[ 12.499747] the shortest dependencies between 2nd lock and 1st lock:
[ 12.500389] -> (&rq->lock){-.-.} {
[ 12.500669] IN-HARDIRQ-W at:
[ 12.500934] _raw_spin_lock+0x2f/0x40
[ 12.501373] scheduler_tick+0x4c/0xf0
[ 12.501812] update_process_times+0x40/0x50
[ 12.502294] tick_periodic+0x27/0xb0
[ 12.502723] tick_handle_periodic+0x1f/0x60
[ 12.503203] timer_interrupt+0x11/0x20
[ 12.503651] __handle_irq_event_percpu+0x43/0x2c0
[ 12.504167] handle_irq_event_percpu+0x20/0x50
[ 12.504674] handle_irq_event+0x37/0x60
[ 12.505139] handle_level_irq+0xa7/0x120
[ 12.505601] handle_irq+0xa1/0x150
[ 12.506018] do_IRQ+0x77/0x140
[ 12.506411] ret_from_intr+0x0/0x1d
[ 12.506834] _raw_spin_unlock_irqrestore+0x53/0x60
[ 12.507362] __setup_irq+0x481/0x730
[ 12.507789] setup_irq+0x49/0x80
[ 12.508195] hpet_time_init+0x21/0x32
[ 12.508644] x86_late_time_init+0xb/0x16
[ 12.509106] start_kernel+0x390/0x42a
[ 12.509554] secondary_startup_64+0xa4/0xb0
[ 12.510034] IN-SOFTIRQ-W at:
[ 12.510305] _raw_spin_lock+0x2f/0x40
[ 12.510772] try_to_wake_up+0x1c7/0x4e0
[ 12.511220] swake_up_locked+0x20/0x40
[ 12.511657] swake_up_one+0x1a/0x30
[ 12.512070] rcu_process_callbacks+0xc5/0x650
[ 12.512553] __do_softirq+0xe6/0x47b
[ 12.512978] irq_exit+0xc3/0xd0
[ 12.513372] smp_apic_timer_interrupt+0xa9/0x250
[ 12.513876] apic_timer_interrupt+0xf/0x20
[ 12.514343] default_idle+0x1c/0x170
[ 12.514765] do_idle+0x199/0x240
[ 12.515159] cpu_startup_entry+0x19/0x20
[ 12.515614] start_kernel+0x422/0x42a
[ 12.516045] secondary_startup_64+0xa4/0xb0
[ 12.516521] INITIAL USE at:
[ 12.516774] _raw_spin_lock_irqsave+0x38/0x50
[ 12.517258] rq_attach_root+0x16/0xd0
[ 12.517685] sched_init+0x2f2/0x3eb
[ 12.518096] start_kernel+0x1fb/0x42a
[ 12.518525] secondary_startup_64+0xa4/0xb0
[ 12.518986] }
[ 12.519132] ... key at: [<ffffffff82b7bc28>] __key.71384+0x0/0x8
[ 12.519649] ... acquired at:
[ 12.519892] pcpu_freelist_pop+0x7b/0xd0
[ 12.520221] bpf_get_stackid+0x1d2/0x4d0
[ 12.520563] ___bpf_prog_run+0x8b4/0x11a0
[ 12.520887]
[ 12.521008] -> (&head->lock){+...} {
[ 12.521292] HARDIRQ-ON-W at:
[ 12.521539] _raw_spin_lock+0x2f/0x40
[ 12.521950] pcpu_freelist_push+0x2a/0x40
[ 12.522396] bpf_get_stackid+0x494/0x4d0
[ 12.522828] ___bpf_prog_run+0x8b4/0x11a0
[ 12.523296] INITIAL USE at:
[ 12.523537] _raw_spin_lock+0x2f/0x40
[ 12.523944] pcpu_freelist_populate+0xc0/0x120
[ 12.524417] htab_map_alloc+0x405/0x500
[ 12.524835] __do_sys_bpf+0x1a3/0x1a90
[ 12.525253] do_syscall_64+0x4a/0x180
[ 12.525659] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 12.526167] }
[ 12.526311] ... key at: [<ffffffff838f7668>] __key.13130+0x0/0x8
[ 12.526812] ... acquired at:
[ 12.527047] __lock_acquire+0x521/0x1350
[ 12.527371] lock_acquire+0x98/0x190
[ 12.527680] _raw_spin_lock+0x2f/0x40
[ 12.527994] pcpu_freelist_push+0x2a/0x40
[ 12.528325] bpf_get_stackid+0x494/0x4d0
[ 12.528645] ___bpf_prog_run+0x8b4/0x11a0
[ 12.528970]
[ 12.529092]
[ 12.529092] stack backtrace:
[ 12.529444] CPU: 0 PID: 276 Comm: dd Not tainted 5.0.0-rc3-00018-g2fa53f892422 #475
[ 12.530043] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
[ 12.530750] Call Trace:
[ 12.530948] dump_stack+0x5f/0x8b
[ 12.531248] check_usage_backwards+0x10c/0x120
[ 12.531598] ? ___bpf_prog_run+0x8b4/0x11a0
[ 12.531935] ? mark_lock+0x382/0x560
[ 12.532229] mark_lock+0x382/0x560
[ 12.532496] ? print_shortest_lock_dependencies+0x180/0x180
[ 12.532928] __lock_acquire+0x521/0x1350
[ 12.533271] ? find_get_entry+0x17f/0x2e0
[ 12.533586] ? find_get_entry+0x19c/0x2e0
[ 12.533902] ? lock_acquire+0x98/0x190
[ 12.534196] lock_acquire+0x98/0x190
[ 12.534482] ? pcpu_freelist_push+0x2a/0x40
[ 12.534810] _raw_spin_lock+0x2f/0x40
[ 12.535099] ? pcpu_freelist_push+0x2a/0x40
[ 12.535432] pcpu_freelist_push+0x2a/0x40
[ 12.535750] bpf_get_stackid+0x494/0x4d0
[ 12.536062] ___bpf_prog_run+0x8b4/0x11a0It has been explained that is a false positive here:
https://lkml.org/lkml/2018/7/25/756
Recap:
- stackmap uses pcpu_freelist
- The lock in pcpu_freelist is a percpu lock
- stackmap is only used by tracing bpf_prog
- A tracing bpf_prog cannot be run if another bpf_prog
has already been running (ensured by the percpu bpf_prog_active counter).
Eric pointed out that this lockdep splats stops other legit lockdep splats in selftests/bpf/test_progs.c.
Fix this by calling local_irq_save/restore for stackmap.
Another false positive had also been worked around by calling local_irq_save in commit 89ad2fa3f043 ("bpf: fix lockdep splat"). That commit added unnecessary irq_save/restore to fast path of bpf hash map. irqs are already disabled at that point, since htab is holding per bucket spin_lock with irqsave.
Let's reduce overhead for htab by introducing __pcpu_freelist_push/pop function w/o irqsave and convert pcpu_freelist_push/pop to irqsave to be used elsewhere (right now only in stackmap).
It stops lockdep false positive in stackmap with a bit of acceptable overhead.
--- kernel/bpf/hashtab.c | 4 ++-- kernel/bpf/percpu_freelist.c | 41 +++++++++++++++++++++++++----------- kernel/bpf/percpu_freelist.h | 4 ++++ 3 files changed, 35 insertions(+), 14 deletions(-)
kernel/bpf/hashtab.c +2 -2
@@ -677,7 +677,7 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l) }if (htab_is_prealloc (htab)) { -pcpu_freelist_push (&htab->freelist, &l->fnode); +__pcpu_freelist_push (&htab->freelist, &l->fnode); }else {atomic_dec (&htab->count); l->htab = htab;
@@ -739,7 +739,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, }else {struct pcpu_freelist_node *l; - l =pcpu_freelist_pop (&htab->freelist); + l =__pcpu_freelist_pop (&htab->freelist);if (!l)return ERR_PTR (-E2BIG ); l_new = container_of(l, struct htab_elem, fnode);
kernel/bpf/percpu_freelist.c +29 -12
86 lines not on this page · raw message
kernel/bpf/percpu_freelist.h +4 -0
@@ -22,8 +22,12 @@ struct pcpu_freelist_node {struct pcpu_freelist_node *next; }; +/* pcpu_freelist_* do spin_lock_irqsave. */ void pcpu_freelist_push (struct pcpu_freelist *,struct pcpu_freelist_node *);struct pcpu_freelist_node *pcpu_freelist_pop (struct pcpu_freelist *); +/* __pcpu_freelist_* do spin_lock only. caller must disable irqs. */ +void __pcpu_freelist_push (struct pcpu_freelist *,struct pcpu_freelist_node *); +struct pcpu_freelist_node *__pcpu_freelist_pop (struct pcpu_freelist *);void pcpu_freelist_populate (struct pcpu_freelist *s,void *buf,u32 elem_size,u32 nr_elems);int pcpu_freelist_init (struct pcpu_freelist *);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 95/149 bpf: fix potential deadlock in bpf_prog_register
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e16ec34039c701594d55d08a5aa49ee3e1abc821 ]
Lockdep found a potential deadlock between cpu_hotplug_lock, bpf_event_mutex, and cpuctx_mutex:
[ 13.007000] WARNING: possible circular locking dependency detected
[ 13.007587] 5.0.0-rc3-00018-g2fa53f892422-dirty #477 Not tainted
[ 13.008124] ------------------------------------------------------
[ 13.008624] test_progs/246 is trying to acquire lock:
[ 13.009030] 0000000094160d1d (tracepoints_mutex){+.+.}, at: tracepoint_probe_register_prio+0x2d/0x300
[ 13.009770]
[ 13.009770] but task is already holding lock:
[ 13.010239] 00000000d663ef86 (bpf_event_mutex){+.+.}, at: bpf_probe_register+0x1d/0x60
[ 13.010877]
[ 13.010877] which lock already depends on the new lock.
[ 13.010877]
[ 13.011532]
[ 13.011532] the existing dependency chain (in reverse order) is:
[ 13.012129]
[ 13.012129] -> #4 (bpf_event_mutex){+.+.}:
[ 13.012582] perf_event_query_prog_array+0x9b/0x130
[ 13.013016] _perf_ioctl+0x3aa/0x830
[ 13.013354] perf_ioctl+0x2e/0x50
[ 13.013668] do_vfs_ioctl+0x8f/0x6a0
[ 13.014003] ksys_ioctl+0x70/0x80
[ 13.014320] __x64_sys_ioctl+0x16/0x20
[ 13.014668] do_syscall_64+0x4a/0x180
[ 13.015007] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 13.015469]
[ 13.015469] -> #3 (&cpuctx_mutex){+.+.}:
[ 13.015910] perf_event_init_cpu+0x5a/0x90
[ 13.016291] perf_event_init+0x1b2/0x1de
[ 13.016654] start_kernel+0x2b8/0x42a
[ 13.016995] secondary_startup_64+0xa4/0xb0
[ 13.017382]
[ 13.017382] -> #2 (pmus_lock){+.+.}:
[ 13.017794] perf_event_init_cpu+0x21/0x90
[ 13.018172] cpuhp_invoke_callback+0xb3/0x960
[ 13.018573] _cpu_up+0xa7/0x140
[ 13.018871] do_cpu_up+0xa4/0xc0
[ 13.019178] smp_init+0xcd/0xd2
[ 13.019483] kernel_init_freeable+0x123/0x24f
[ 13.019878] kernel_init+0xa/0x110
[ 13.020201] ret_from_fork+0x24/0x30
[ 13.020541]
[ 13.020541] -> #1 (cpu_hotplug_lock.rw_sem){++++}:
[ 13.021051] static_key_slow_inc+0xe/0x20
[ 13.021424] tracepoint_probe_register_prio+0x28c/0x300
[ 13.021891] perf_trace_event_init+0x11f/0x250
[ 13.022297] perf_trace_init+0x6b/0xa0
[ 13.022644] perf_tp_event_init+0x25/0x40
[ 13.023011] perf_try_init_event+0x6b/0x90
[ 13.023386] perf_event_alloc+0x9a8/0xc40
[ 13.023754] __do_sys_perf_event_open+0x1dd/0xd30
[ 13.024173] do_syscall_64+0x4a/0x180
[ 13.024519] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 13.024968]
[ 13.024968] -> #0 (tracepoints_mutex){+.+.}:
[ 13.025434] __mutex_lock+0x86/0x970
[ 13.025764] tracepoint_probe_register_prio+0x2d/0x300
[ 13.026215] bpf_probe_register+0x40/0x60
[ 13.026584] bpf_raw_tracepoint_open.isra.34+0xa4/0x130
[ 13.027042] __do_sys_bpf+0x94f/0x1a90
[ 13.027389] do_syscall_64+0x4a/0x180
[ 13.027727] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 13.028171]
[ 13.028171] other info that might help us debug this:
[ 13.028171]
[ 13.028807] Chain exists of:
[ 13.028807] tracepoints_mutex --> &cpuctx_mutex --> bpf_event_mutex
[ 13.028807]
[ 13.029666] Possible unsafe locking scenario:
[ 13.029666]
[ 13.030140] CPU0 CPU1
[ 13.030510] ---- ----
[ 13.030875] lock(bpf_event_mutex);
[ 13.031166] lock(&cpuctx_mutex);
[ 13.031645] lock(bpf_event_mutex);
[ 13.032135] lock(tracepoints_mutex);
[ 13.032441]
[ 13.032441] *** DEADLOCK ***
[ 13.032441]
[ 13.032911] 1 lock held by test_progs/246:
[ 13.033239] #0: 00000000d663ef86 (bpf_event_mutex){+.+.}, at: bpf_probe_register+0x1d/0x60
[ 13.033909]
[ 13.033909] stack backtrace:
[ 13.034258] CPU: 1 PID: 246 Comm: test_progs Not tainted 5.0.0-rc3-00018-g2fa53f892422-dirty #477
[ 13.034964] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
[ 13.035657] Call Trace:
[ 13.035859] dump_stack+0x5f/0x8b
[ 13.036130] print_circular_bug.isra.37+0x1ce/0x1db
[ 13.036526] __lock_acquire+0x1158/0x1350
[ 13.036852] ? lock_acquire+0x98/0x190
[ 13.037154] lock_acquire+0x98/0x190
[ 13.037447] ? tracepoint_probe_register_prio+0x2d/0x300
[ 13.037876] __mutex_lock+0x86/0x970
[ 13.038167] ? tracepoint_probe_register_prio+0x2d/0x300
[ 13.038600] ? tracepoint_probe_register_prio+0x2d/0x300
[ 13.039028] ? __mutex_lock+0x86/0x970
[ 13.039337] ? __mutex_lock+0x24a/0x970
[ 13.039649] ? bpf_probe_register+0x1d/0x60
[ 13.039992] ? __bpf_trace_sched_wake_idle_without_ipi+0x10/0x10
[ 13.040478] ? tracepoint_probe_register_prio+0x2d/0x300
[ 13.040906] tracepoint_probe_register_prio+0x2d/0x300
[ 13.041325] bpf_probe_register+0x40/0x60
[ 13.041649] bpf_raw_tracepoint_open.isra.34+0xa4/0x130
[ 13.042068] ? __might_fault+0x3e/0x90
[ 13.042374] __do_sys_bpf+0x94f/0x1a90
[ 13.042678] do_syscall_64+0x4a/0x180
[ 13.042975] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 13.043382] RIP: 0033:0x7f23b10a07f9
[ 13.045155] RSP: 002b:00007ffdef42fdd8 EFLAGS: 00000202 ORIG_RAX: 0000000000000141
[ 13.045759] RAX: ffffffffffffffda RBX: 00007ffdef42ff70 RCX: 00007f23b10a07f9
[ 13.046326] RDX: 0000000000000070 RSI: 00007ffdef42fe10 RDI: 0000000000000011
[ 13.046893] RBP: 00007ffdef42fdf0 R08: 0000000000000038 R09: 00007ffdef42fe10
[ 13.047462] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
[ 13.048029] R13: 0000000000000016 R14: 00007f23b1db4690 R15: 0000000000000000Since tracepoints_mutex will be taken in tracepoint_probe_register/unregister() there is no need to take bpf_event_mutex too.bpf_event_mutex is protecting modifications to prog array used in kprobe/perf bpf progs. bpf_raw_tracepoints don't need to take this mutex.
--- kernel/trace/bpf_trace.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-)
kernel/trace/bpf_trace.c +2 -12
@@ -1158,22 +1158,12 @@ static int __bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *int bpf_probe_register (struct bpf_raw_event_map *btp,struct bpf_prog *prog) { -int err; - -mutex_lock (&bpf_event_mutex); - err =__bpf_probe_register (btp, prog); -mutex_unlock (&bpf_event_mutex); -return err; +return __bpf_probe_register (btp, prog); }int bpf_probe_unregister (struct bpf_raw_event_map *btp,struct bpf_prog *prog) { -int err; - -mutex_lock (&bpf_event_mutex); - err =tracepoint_probe_unregister (btp->tp, (void *)btp->bpf_func, prog); -mutex_unlock (&bpf_event_mutex); -return err; +return tracepoint_probe_unregister (btp->tp, (void *)btp->bpf_func, prog); } int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 96/149 bpf: Fix syscalls stackmap lookup potential deadlock
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7c4cd051add3d00bbff008a133c936c515eaa8fe ]
The map_lookup_elem used to not acquiring spinlock in order to optimize the reader.
It was true until commit 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation") The syscall's map_lookup_elem(stackmap) calls bpf_stackmap_copy(). bpf_stackmap_copy() may find the elem no longer needed after the copy is done. If that is the case, pcpu_freelist_push() saves this elem for reuse later. This push requires a spinlock.
If a tracing bpf_prog got run in the middle of the syscall's map_lookup_elem(stackmap) and this tracing bpf_prog is calling bpf_get_stackid(stackmap) which also requires the same pcpu_freelist's spinlock, it may end up with a dead lock situation as reported by Eric Dumazet in https://patchwork.ozlabs.org/patch/1030266/
The situation is the same as the syscall's map_update_elem() which needs to acquire the pcpu_freelist's spinlock and could race with tracing bpf_prog. Hence, this patch fixes it by protecting bpf_stackmap_copy() with this_cpu_inc(bpf_prog_active) to prevent tracing bpf_prog from running.
A later syscall's map_lookup_elem commit f1a2e44a3aec ("bpf: add queue and stack maps") also acquires a spinlock and races with tracing bpf_prog similarly. Hence, this patch is forward looking and protects the majority
of the map lookups. bpf_map_offload_lookup_elem() is the exception
since it is for network bpf_prog only (i.e. never called by tracing bpf_prog).
--- kernel/bpf/syscall.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
kernel/bpf/syscall.c +10 -2
@@ -701,8 +701,13 @@ static int map_lookup_elem(union bpf_attr *attr)if (bpf_map_is_dev_bound (map)) { err =bpf_map_offload_lookup_elem (map, key, value); - }else if (map->map_type ==BPF_MAP_TYPE_PERCPU_HASH || - map->map_type ==BPF_MAP_TYPE_LRU_PERCPU_HASH ) { + goto done; + } + +preempt_disable (); +this_cpu_inc (bpf_prog_active); +if (map->map_type ==BPF_MAP_TYPE_PERCPU_HASH || + map->map_type ==BPF_MAP_TYPE_LRU_PERCPU_HASH ) { err =bpf_percpu_hash_copy (map, key, value); }else if (map->map_type ==BPF_MAP_TYPE_PERCPU_ARRAY ) { err =bpf_percpu_array_copy (map, key, value);
@@ -722,7 +727,10 @@ static int map_lookup_elem(union bpf_attr *attr)rcu_read_unlock (); err = ptr ?0 : -ENOENT ; } +this_cpu_dec (bpf_prog_active); +preempt_enable (); +done:if (err) goto free_value;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 97/149 drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b14e945bda8ae227d1bf2b1837c0c4a61721cd1a ]
When initializing clocks, a reference to the TCON channel 0 clock is obtained. However, the clock is never prepared and enabled later. Switching from simplefb to DRM actually disables the clock (that was usually configured by U-Boot) because of that.
On the V3s, this results in a hang when writing to some mixer registers when switching over to DRM from simplefb.
Fix this by preparing and enabling the clock when initializing other clocks. Waiting for sun4i_tcon_channel_enable to enable the clock is apparently too late and results in the same mixer register access hang.
--- drivers/gpu/drm/sun4i/sun4i_tcon.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/sun4i/sun4i_tcon.c +2 -0
@@ -672,6 +672,7 @@ static int sun4i_tcon_init_clocks(struct device *dev,return PTR_ERR (tcon->sclk0); } } +clk_prepare_enable (tcon->sclk0);if (tcon->quirks->has_channel_1) { tcon->sclk1 =devm_clk_get (dev,"tcon-ch1" );
@@ -686,6 +687,7 @@ static int sun4i_tcon_init_clocks(struct device *dev,static void sun4i_tcon_free_clocks (struct sun4i_tcon *tcon) { +clk_disable_unprepare (tcon->sclk0);clk_disable_unprepare (tcon->clk); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 98/149 dmaengine: at_xdmac: Fix wrongfull report of a channel as in use
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit dc3f595b6617ebc0307e0ce151e8f2f2b2489b95 ]
atchan->status variable is used to store two different information:
- pass channel interrupts status from interrupt handler to tasklet;
- channel information like whether it is cyclic or paused;
This causes a bug when device_terminate_all() is called, (AT_XDMAC_CHAN_IS_CYCLIC cleared on atchan->status) and then a late End of Block interrupt arrives (AT_XDMAC_CIS_BIS), which sets bit 0 of atchan->status. Bit 0 is also used for AT_XDMAC_CHAN_IS_CYCLIC, so when a new descriptor for a cyclic transfer is created, the driver reports the channel as in use:
if (test_and_set_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status)) {
dev_err(chan2dev(chan), "channel currently used\n");
return NULL;
}This patch fixes the bug by adding a different struct member to keep the interrupts status separated from the channel status bits.
--- drivers/dma/at_xdmac.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/dma/at_xdmac.c +10 -9
@@ -203,6 +203,7 @@ struct at_xdmac_chan {u32 save_cim;u32 save_cnda;u32 save_cndc; +u32 irq_status;unsigned long status;struct tasklet_struct tasklet;struct dma_slave_config sconfig;
@@ -1580,8 +1581,8 @@ static void at_xdmac_tasklet(unsigned long data)struct at_xdmac_desc *desc;u32 error_mask; -dev_dbg (chan2dev (&atchan->chan),"%s: status=0x%08lx\n" , - __func__, atchan->status); +dev_dbg (chan2dev (&atchan->chan),"%s: status=0x%08x\n" , + __func__, atchan->irq_status); error_mask =AT_XDMAC_CIS_RBEIS |AT_XDMAC_CIS_WBEIS
@@ -1589,15 +1590,15 @@ static void at_xdmac_tasklet(unsigned long data)if (at_xdmac_chan_is_cyclic (atchan)) {at_xdmac_handle_cyclic (atchan); - }else if ((atchan->status &AT_XDMAC_CIS_LIS ) - || (atchan->status & error_mask)) { + }else if ((atchan->irq_status &AT_XDMAC_CIS_LIS ) + || (atchan->irq_status & error_mask)) {struct dma_async_tx_descriptor *txd; -if (atchan->status &AT_XDMAC_CIS_RBEIS ) +if (atchan->irq_status &AT_XDMAC_CIS_RBEIS )dev_err (chan2dev (&atchan->chan),"read bus error!!!" ); -if (atchan->status &AT_XDMAC_CIS_WBEIS ) +if (atchan->irq_status &AT_XDMAC_CIS_WBEIS )dev_err (chan2dev (&atchan->chan),"write bus error!!!" ); -if (atchan->status &AT_XDMAC_CIS_ROIS ) +if (atchan->irq_status &AT_XDMAC_CIS_ROIS )dev_err (chan2dev (&atchan->chan),"request overflow error!!!" );spin_lock_bh (&atchan->lock);
@@ -1652,7 +1653,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id) atchan = &atxdmac->chan[i]; chan_imr =at_xdmac_chan_read (atchan,AT_XDMAC_CIM ); chan_status =at_xdmac_chan_read (atchan,AT_XDMAC_CIS ); - atchan->status = chan_status & chan_imr; + atchan->irq_status = chan_status & chan_imr;dev_vdbg (atxdmac->dma.dev,"%s: chan%d: imr=0x%x, status=0x%x\n" , __func__, i, chan_imr, chan_status);
@@ -1666,7 +1667,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id)at_xdmac_chan_read (atchan,AT_XDMAC_CDA ), at_xdmac_chan_read(atchan, AT_XDMAC_CUBC)); -if (atchan->status & (AT_XDMAC_CIS_RBEIS |AT_XDMAC_CIS_WBEIS )) +if (atchan->irq_status & (AT_XDMAC_CIS_RBEIS |AT_XDMAC_CIS_WBEIS ))at_xdmac_write (atxdmac,AT_XDMAC_GD , atchan->mask);tasklet_schedule (&atchan->tasklet);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 99/149 vsock/virtio: fix kernel panic after device hot-unplug
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 22b5c0b63f32568e130fa2df4ba23efce3eb495b ]
virtio_vsock_remove() invokes the vsock_core_exit() also if there are opened sockets for the AF_VSOCK protocol family. In this way the vsock "transport" pointer is set to NULL, triggering the kernel panic at the first socket activity.
This patch move the vsock_core_init()/vsock_core_exit() in the virtio_vsock respectively in module_init and module_exit functions, that cannot be invoked until there are open sockets.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1609699
--- net/vmw_vsock/virtio_transport.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
net/vmw_vsock/virtio_transport.c +18 -8
@@ -75,6 +75,9 @@ static u32 virtio_transport_get_local_cid(void) {struct virtio_vsock *vsock =virtio_vsock_get (); +if (!vsock) +return VMADDR_CID_ANY ; +return vsock->guest_cid; }
@@ -584,10 +587,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)virtio_vsock_update_guest_cid (vsock); - ret =vsock_core_init (&virtio_transport.transport); -if (ret <0 ) - goto out_vqs; - vsock->rx_buf_nr =0 ; vsock->rx_buf_max_nr =0 ;atomic_set (&vsock->queued_replies,0 );
@@ -618,8 +617,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)mutex_unlock (&the_virtio_vsock_mutex);return 0 ; -out_vqs: - vsock->vdev->config->del_vqs (vsock->vdev); out:kfree (vsock);mutex_unlock (&the_virtio_vsock_mutex);
@@ -669,7 +666,6 @@ static void virtio_vsock_remove(struct virtio_device *vdev)mutex_lock (&the_virtio_vsock_mutex); the_virtio_vsock =NULL ; -vsock_core_exit ();mutex_unlock (&the_virtio_vsock_mutex); vdev->config->del_vqs (vdev);
@@ -702,14 +698,28 @@ static int __init virtio_vsock_init(void) virtio_vsock_workqueue =alloc_workqueue ("virtio_vsock" ,0 ,0 );if (!virtio_vsock_workqueue)return -ENOMEM ; + ret =register_virtio_driver (&virtio_vsock_driver);if (ret) -destroy_workqueue (virtio_vsock_workqueue); + goto out_wq; + + ret =vsock_core_init (&virtio_transport.transport); +if (ret) + goto out_vdr; + +return 0 ; + +out_vdr: +unregister_virtio_driver (&virtio_vsock_driver); +out_wq: +destroy_workqueue (virtio_vsock_workqueue);return ret; + } static void __exit virtio_vsock_exit(void) { +vsock_core_exit ();unregister_virtio_driver (&virtio_vsock_driver);destroy_workqueue (virtio_vsock_workqueue); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 100/149 vsock/virtio: reset connected sockets on device removal
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 85965487abc540368393a15491e6e7fcd230039d ]
When the virtio transport device disappear, we should reset all connected sockets in order to inform the users.
--- net/vmw_vsock/virtio_transport.c | 3 +++ 1 file changed, 3 insertions(+)
net/vmw_vsock/virtio_transport.c +3 -0
@@ -634,6 +634,9 @@ static void virtio_vsock_remove(struct virtio_device *vdev)flush_work (&vsock->event_work);flush_work (&vsock->send_pkt_work); +/* Reset all connected sockets when the device disappear */ +vsock_for_each_connected_socket (virtio_vsock_reset_sock); + vdev->config->reset (vdev);mutex_lock (&vsock->rx_lock);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 101/149 dmaengine: dmatest: Abort test in case of mapping error
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6454368a804c4955ccd116236037536f81e5b1f1 ]
In case of mapping error the DMA addresses are invalid and continuing will screw system memory or potentially something else.
[ 222.480310] dmatest: dma0chan7-copy0: summary 1 tests, 3 failures 6 iops 349 KB/s (0) ... [ 240.912725] check: Corrupted low memory at 00000000c7c75ac9 (2940 phys) = 5656000000000000 [ 240.921998] check: Corrupted low memory at 000000005715a1cd (2948 phys) = 279f2aca5595ab2b [ 240.931280] check: Corrupted low memory at 000000002f4024c0 (2950 phys) = 5e5624f349e793cf
...
Abort any test if mapping failed.
--- drivers/dma/dmatest.c | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-)
drivers/dma/dmatest.c +12 -16
@@ -642,11 +642,9 @@ static int dmatest_func(void *data) srcs[i] = um->addr[i] + src_off; ret =dma_mapping_error (dev->dev, um->addr[i]);if (ret) { -dmaengine_unmap_put (um);result ("src mapping error" , total_tests, src_off, dst_off, len, ret); - failed_tests++; -continue ; + goto error_unmap_continue; } um->to_cnt++; }
@@ -661,11 +659,9 @@ static int dmatest_func(void *data) DMA_BIDIRECTIONAL); ret =dma_mapping_error (dev->dev, dsts[i]);if (ret) { -dmaengine_unmap_put (um);result ("dst mapping error" , total_tests, src_off, dst_off, len, ret); - failed_tests++; -continue ; + goto error_unmap_continue; } um->bidi_cnt++; }
@@ -693,12 +689,10 @@ static int dmatest_func(void *data) }if (!tx) { -dmaengine_unmap_put (um);result ("prep error" , total_tests, src_off, dst_off, len, ret);msleep (100 ); - failed_tests++; -continue ; + goto error_unmap_continue; } done->done = false;
@@ -707,12 +701,10 @@ static int dmatest_func(void *data) cookie = tx->tx_submit (tx);if (dma_submit_error (cookie)) { -dmaengine_unmap_put (um);result ("submit error" , total_tests, src_off, dst_off, len, ret);msleep (100 ); - failed_tests++; -continue ; + goto error_unmap_continue; }dma_async_issue_pending (chan);
@@ -725,16 +717,14 @@ static int dmatest_func(void *data)dmaengine_unmap_put (um);result ("test timed out" , total_tests, src_off, dst_off, len,0 ); - failed_tests++; -continue ; + goto error_unmap_continue; }else if (status !=DMA_COMPLETE ) {dmaengine_unmap_put (um);result (status ==DMA_ERROR ?"completion error status" :"completion busy status" , total_tests, src_off, dst_off, len, ret); - failed_tests++; -continue ; + goto error_unmap_continue; }dmaengine_unmap_put (um);
@@ -779,6 +769,12 @@ static int dmatest_func(void *data)verbose_result ("test passed" , total_tests, src_off, dst_off, len,0 ); } + +continue ; + +error_unmap_continue: +dmaengine_unmap_put (um); + failed_tests++; } ktime =ktime_sub (ktime_get (), ktime); ktime =ktime_sub (ktime, comparetime);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 102/149 selftests: netfilter: fix config fragment CONFIG_NF_TABLES_INET
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 952b72f89ae23b316da8c1021b18d0c388ad6cc4 ]
In selftests the config fragment for netfilter was added as NF_TABLES_INET=y and this patch correct it as CONFIG_NF_TABLES_INET=y
--- tools/testing/selftests/netfilter/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/netfilter/config +1 -1
@@ -1,2 +1,2 @@ CONFIG_NET_NS=y -NF_TABLES_INET=y +CONFIG_NF_TABLES_INET=y
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 103/149 selftests: netfilter: add simple masq/redirect test cases
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 98bfc3414bda335dbd7fec58bde6266f991801d7 ]
Check basic nat/redirect/masquerade for ipv4 and ipv6.
--- tools/testing/selftests/netfilter/Makefile | 2 +- tools/testing/selftests/netfilter/nft_nat.sh | 762 +++++++++++++++++++ 2 files changed, 763 insertions(+), 1 deletion(-) create mode 100755 tools/testing/selftests/netfilter/nft_nat.sh
tools/testing/selftests/netfilter/Makefile +1 -1
@@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 # Makefile for netfilter selftests -TEST_PROGS := nft_trans_stress.sh +TEST_PROGS := nft_trans_stress.sh nft_nat.sh include ../lib.mk
tools/testing/selftests/netfilter/nft_nat.sh new file +762 -0
762 lines not on this page · raw message
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 104/149 netfilter: nf_nat: skip nat clash resolution for same-origin entries
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4e35c1cb9460240e983a01745b5f29fe3a4d8e39 ]
It is possible that two concurrent packets originating from the same socket of a connection-less protocol (e.g. UDP) can end up having different IP_CT_DIR_REPLY tuples which results in one of the packets being dropped.
To illustrate this, consider the following simplified scenario:
1. Packet A and B are sent at the same time from two different threads by same UDP socket. No matching conntrack entry exists yet. Both packets cause allocation of a new conntrack entry.
2. get_unique_tuple gets called for A. No clashing entry found. conntrack entry for A is added to main conntrack table.
3. get_unique_tuple is called for B and will find that the reply tuple of B is already taken by A.
It will allocate a new UDP source port for B to resolve the clash.
4. conntrack entry for B cannot be added to main conntrack table because its ORIGINAL direction is clashing with A and the REPLY directions of A and B are not the same anymore due to UDP source port reallocation done in step 3.
This patch modifies nf_conntrack_tuple_taken so it doesn't consider colliding reply tuples if the IP_CT_DIR_ORIGINAL tuples are equal.
[ Florian: simplify patch to not use .allow_clash setting
and always ignore identical flows ]
--- net/netfilter/nf_conntrack_core.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
net/netfilter/nf_conntrack_core.c +16 -0
@@ -1007,6 +1007,22 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, }if (nf_ct_key_equal (h, tuple, zone, net)) { +/* Tuple is taken already, so caller will need to find +* a new source port to use. +* +* Only exception: +* If the *original tuples* are identical, then both +* conntracks refer to the same flow. +* This is a rare situation, it can occur e.g. when +* more than one UDP packet is sent from same socket +* in different threads. +* +* Let nf_ct_resolve_clash() deal with this later. +*/ +if (nf_ct_tuple_equal (&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL ].tuple, + &ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple)) +continue ; +NF_CT_STAT_INC_ATOMIC (net, found);rcu_read_unlock ();return 1 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 105/149 s390/qeth: release cmd buffer in error paths
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5065b2dd3e5f9247a6c9d67974bc0472bf561b9d ]
Whenever we fail before/while starting an IO, make sure to release the IO buffer. Usually qeth_irq() would do this for us, but if the IO doesn't even start we obviously won't get an interrupt for it either.
--- drivers/s390/net/qeth_core_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/s390/net/qeth_core_main.c +6 -0
@@ -565,6 +565,7 @@ static int __qeth_issue_next_read(struct qeth_card *card)QETH_DBF_MESSAGE (2 ,"%s error in starting next read ccw! " "rc=%i\n" ,dev_name (&card->gdev->dev), rc);atomic_set (&channel->irq_pending,0 ); +qeth_release_buffer (channel, iob); card->read_or_write_problem =1 ;qeth_schedule_recovery (card);wake_up (&card->wait_q);
@@ -1187,6 +1188,8 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, rc =qeth_get_problem (cdev, irb);if (rc) { card->read_or_write_problem =1 ; +if (iob) +qeth_release_buffer (iob->channel, iob);qeth_clear_ipacmd_list (card);qeth_schedule_recovery (card); goto out;
@@ -1852,6 +1855,7 @@ static int qeth_idx_activate_get_answer(struct qeth_channel *channel,QETH_DBF_MESSAGE (2 ,"Error2 in activating channel rc=%d\n" , rc);QETH_DBF_TEXT_ (SETUP ,2 ,"2err%d" , rc);atomic_set (&channel->irq_pending,0 ); +qeth_release_buffer (channel, iob);wake_up (&card->wait_q);return rc; }
@@ -1923,6 +1927,7 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel, rc);QETH_DBF_TEXT_ (SETUP ,2 ,"1err%d" , rc);atomic_set (&channel->irq_pending,0 ); +qeth_release_buffer (channel, iob);wake_up (&card->wait_q);return rc; }
@@ -2110,6 +2115,7 @@ int qeth_send_control_data(struct qeth_card *card, int len, } reply =qeth_alloc_reply (card);if (!reply) { +qeth_release_buffer (channel, iob);return -ENOMEM ; } reply->callback = reply_cb;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 106/149 s390/qeth: fix use-after-free in error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit afa0c5904ba16d59b0454f7ee4c807dae350f432 ]
The error path in qeth_alloc_qdio_buffers() that takes care of cleaning up the Output Queues is buggy. It first frees the queue, but then calls qeth_clear_outq_buffers() with that very queue struct.
Make the call to qeth_clear_outq_buffers() part of the free action (in the correct order), and while at it fix the naming of the helper.
--- drivers/s390/net/qeth_core_main.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/s390/net/qeth_core_main.c +6 -9
@@ -2454,11 +2454,12 @@ static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *q, int bidx)return 0 ; } -static void qeth_free_qdio_out_buf (struct qeth_qdio_out_q *q) +static void qeth_free_output_queue (struct qeth_qdio_out_q *q) {if (!q)return ; +qeth_clear_outq_buffers (q,1 );qdio_free_buffers (q->qdio_bufs,QDIO_MAX_BUFFERS_PER_Q );kfree (q); }
@@ -2532,10 +2533,8 @@ static int qeth_alloc_qdio_buffers(struct qeth_card *card) card->qdio.out_qs[i]->bufs[j] =NULL ; } out_freeoutq: -while (i >0 ) { -qeth_free_qdio_out_buf (card->qdio.out_qs[--i]); -qeth_clear_outq_buffers (card->qdio.out_qs[i],1 ); - } +while (i >0 ) +qeth_free_output_queue (card->qdio.out_qs[--i]);kfree (card->qdio.out_qs); card->qdio.out_qs =NULL ; out_freepool:
@@ -2568,10 +2567,8 @@ static void qeth_free_qdio_buffers(struct qeth_card *card)qeth_free_buffer_pool (card);/* free outbound qdio_qs */ if (card->qdio.out_qs) { -for (i =0 ; i < card->qdio.no_out_queues; ++i) { -qeth_clear_outq_buffers (card->qdio.out_qs[i],1 ); -qeth_free_qdio_out_buf (card->qdio.out_qs[i]); - } +for (i =0 ; i < card->qdio.no_out_queues; i++) +qeth_free_output_queue (card->qdio.out_qs[i]);kfree (card->qdio.out_qs); card->qdio.out_qs =NULL ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 107/149 s390/qeth: cancel close_dev work before removing a card
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c2780c1a3fb724560b1d44f7976e0de17bf153c7 ]
A card's close_dev work is scheduled on a driver-wide workqueue. If the card is removed and freed while the work is still active, this causes a use-after-free.
So make sure that the work is completed before freeing the card.
--- drivers/s390/net/qeth_core.h | 1 + drivers/s390/net/qeth_l2_main.c | 2 ++ drivers/s390/net/qeth_l3_main.c | 1 + 3 files changed, 4 insertions(+)
drivers/s390/net/qeth_core.h +1 -0
@@ -22,6 +22,7 @@#include <linux/hashtable.h> #include <linux/ip.h> #include <linux/refcount.h> +#include <linux/workqueue.h> #include <net/ipv6.h> #include <net/if_inet6.h>
drivers/s390/net/qeth_l2_main.c +2 -0
@@ -854,6 +854,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)if (cgdev->state ==CCWGROUP_ONLINE )qeth_l2_set_offline (cgdev); + +cancel_work_sync (&card->close_dev_work);if (qeth_netdev_is_registered (card->dev))unregister_netdev (card->dev); }
drivers/s390/net/qeth_l3_main.c +1 -0
@@ -2611,6 +2611,7 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)if (cgdev->state ==CCWGROUP_ONLINE )qeth_l3_set_offline (cgdev); +cancel_work_sync (&card->close_dev_work);if (qeth_netdev_is_registered (card->dev))unregister_netdev (card->dev);qeth_l3_clear_ip_htable (card,0 );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 108/149 perf symbols: Filter out hidden symbols from labels
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 59a17706915fe5ea6f711e1f92d4fb706bce07fe ]
When perf is built with the annobin plugin (RHEL8 build) extra symbols are added to its binary:
# nm perf | grep annobin | head -10 0000000000241100 t .annobin_annotate.c 0000000000326490 t .annobin_annotate.c 0000000000249255 t .annobin_annotate.c_end 00000000003283a8 t .annobin_annotate.c_end 00000000001bce18 t .annobin_annotate.c_end.hot 00000000001bce18 t .annobin_annotate.c_end.hot 00000000001bc3e2 t .annobin_annotate.c_end.unlikely 00000000001bc400 t .annobin_annotate.c_end.unlikely 00000000001bce18 t .annobin_annotate.c.hot 00000000001bce18 t .annobin_annotate.c.hot ...
Those symbols have no use for report or annotation and should be skipped. Moreover they interfere with the DWARF unwind test on the PPC arch, where they are mixed with checked symbols and then the test fails:
# perf test dwarf -v 59: Test dwarf unwind : --- start --- test child forked, pid 8515 unwind: .annobin_dwarf_unwind.c:ip = 0x10dba40dc (0x2740dc) ... got: .annobin_dwarf_unwind.c 0x10dba40dc, expecting test__arch_unwind_sample unwind: failed with 'no error'
The annobin symbols are defined as NOTYPE/LOCAL/HIDDEN:
# readelf -s ./perf | grep annobin | head -1
40: 00000000001bce4f 0 NOTYPE LOCAL HIDDEN 13 .annobin_init.cThey can still pass the check for the label symbol. Adding check for HIDDEN and INTERNAL (as suggested by Nick below) visibility and filter out such symbols.
Quoted 4 lines
Just to be awkward, if you are going to ignore
STV_HIDDENsymbols then you should probably also ignoreSTV_INTERNALones as well... Annobin does not generate them, but you never know, one day some other tool might create some.
--- tools/perf/util/symbol-elf.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
tools/perf/util/symbol-elf.c +8 -1
@@ -87,6 +87,11 @@ static inline uint8_t elf_sym__type(const GElf_Sym *sym)return GELF_ST_TYPE (sym->st_info); } +static inline uint8_t elf_sym__visibility (const GElf_Sym *sym) +{ +return GELF_ST_VISIBILITY (sym->st_other); +} +#ifndef STT_GNU_IFUNC #define STT_GNU_IFUNC 10#endif
@@ -111,7 +116,9 @@ static inline int elf_sym__is_label(const GElf_Sym *sym)return elf_sym__type (sym) ==STT_NOTYPE && sym->st_name !=0 && sym->st_shndx !=SHN_UNDEF && - sym->st_shndx !=SHN_ABS ; + sym->st_shndx !=SHN_ABS && +elf_sym__visibility (sym) !=STV_HIDDEN && +elf_sym__visibility (sym) !=STV_INTERNAL ; }static bool elf_sym__filter (GElf_Sym *sym)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 109/149 perf trace: Support multiple "vfs_getname" probes
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6ab3bc240ade47a0f52bc16d97edd9accbe0024e ]
With a suitably defined "probe:vfs_getname" probe, 'perf trace' can "beautify" its output, so syscalls like open() or openat() can print the "filename" argument instead of just its hex address, like:
$ perf trace -e open -- touch /dev/null
[...]
0.590 ( 0.014 ms): touch/18063 open(filename: /dev/null, flags: CREAT|NOCTTY|NONBLOCK|WRONLY, mode: IRUGO|IWUGO) = 3
[...]The output without such beautifier looks like:
0.529 ( 0.011 ms): touch/18075 open(filename: 0xc78cf288, flags: CREAT|NOCTTY|NONBLOCK|WRONLY, mode: IRUGO|IWUGO) = 3
However, when the vfs_getname probe expands to multiple probes and it is not the first one that is hit, the beautifier fails, as following:
0.326 ( 0.010 ms): touch/18072 open(filename: , flags: CREAT|NOCTTY|NONBLOCK|WRONLY, mode: IRUGO|IWUGO) = 3
Fix it by hooking into all the expanded probes (inlines), now, for instance:
[root@quaco ~]# perf probe -l
probe:vfs_getname (on getname_flags:73@fs/namei.c with pathname)
probe:vfs_getname_1 (on getname_flags:73@fs/namei.c with pathname)
[root@quaco ~]# perf trace -e open* sleep 1
0.010 ( 0.005 ms): sleep/5588 openat(dfd: CWD, filename: /etc/ld.so.cache, flags: RDONLY|CLOEXEC) = 3
0.029 ( 0.006 ms): sleep/5588 openat(dfd: CWD, filename: /lib64/libc.so.6, flags: RDONLY|CLOEXEC) = 3
0.194 ( 0.008 ms): sleep/5588 openat(dfd: CWD, filename: /usr/lib/locale/locale-archive, flags: RDONLY|CLOEXEC) = 3[root@quaco ~]#
Works, further verified with:
[root@quaco ~]# perf test vfs
65: Use vfs_getname probe to get syscall args filenames : Ok
66: Add vfs_getname probe to get syscall args filenames : Ok
67: Check open filename arg using perf trace + vfs_getname: Ok [root@quaco ~]#
--- tools/perf/builtin-trace.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-)
tools/perf/builtin-trace.c +18 -7
@@ -2263,19 +2263,30 @@ static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp);static bool perf_evlist__add_vfs_getname (struct perf_evlist *evlist) { -struct perf_evsel *evsel =perf_evsel__newtp ("probe" ,"vfs_getname" ); +bool found = false; +struct perf_evsel *evsel, *tmp; +struct parse_events_error err = { .idx =0 , }; +int ret =parse_events (evlist,"probe:vfs_getname*" , &err); -if (IS_ERR (evsel)) +if (ret)return false; -if (perf_evsel__field (evsel,"pathname" ) ==NULL ) { +evlist__for_each_entry_safe (evlist, evsel, tmp) { +if (!strstarts (perf_evsel__name (evsel),"probe:vfs_getname" )) +continue ; + +if (perf_evsel__field (evsel,"pathname" )) { + evsel->handler = trace__vfs_getname; + found = true; +continue ; + } + +list_del_init (&evsel->node); + evsel->evlist =NULL ;perf_evsel__delete (evsel); -return false; } - evsel->handler = trace__vfs_getname; -perf_evlist__add (evlist, evsel); -return true; +return found; }static struct perf_evsel *perf_evsel__new_pgfault (u64 config)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 110/149 MIPS: Loongson: Introduce and use loongson_llsc_mb()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e02e07e3127d8aec1f4bcdfb2fc52a2d99b4859e ]
On the Loongson-2G/2H/3A/3B there is a hardware flaw that ll/sc and lld/scd is very weak ordering. We should add sync instructions "before each ll/lld" and "at the branch-target between ll/sc" to workaround. Otherwise, this flaw will cause deadlock occasionally (e.g. when doing heavy load test with LTP).
Below is the explaination of CPU designer:
"For Loongson 3 family, when a memory access instruction (load, store, or prefetch)'s executing occurs between the execution of LL and SC, the success or failure of SC is not predictable. Although programmer would not insert memory access instructions between LL and SC, the memory instructions before LL in program-order, may dynamically executed between the execution of LL/SC, so a memory fence (SYNC) is needed before LL/LLD to avoid this situation.
Since Loongson-3A R2 (3A2000), we have improved our hardware design to handle this case. But we later deduce a rarely circumstance that some speculatively executed memory instructions due to branch misprediction between LL/SC still fall into the above case, so a memory fence (SYNC) at branch-target (if its target is not between LL/SC) is needed for Loongson 3A1000, 3B1500, 3A2000 and 3A3000.
Our processor is continually evolving and we aim to to remove all these workaround-SYNCs around LL/SC for new-come processor."
Here is an example:
Both cpu1 and cpu2 simutaneously run atomic_add by 1 on same atomic var, this bug cause both 'sc' run by two cpus (in atomic_add) succeed at same time('sc' return 1), and the variable is only *added by 1*, sometimes, which is wrong and unacceptable(it should be added by 2).
Why disable fix-loongson3-llsc in compiler?
Because compiler fix will cause problems in kernel's __ex_table section.
This patch fix all the cases in kernel, but:
+. the fix at the end of futex_atomic_cmpxchg_inatomic is for branch-target of 'bne', there other cases which smp_mb__before_llsc() and smp_llsc_mb() fix the ll and branch-target coincidently such as atomic_sub_if_positive/ cmpxchg/xchg, just like this one.
+. Loongson 3 does support CONFIG_EDAC_ATOMIC_SCRUB, so no need to touch edac.h
+. local_ops and cmpxchg_local should not be affected by this bug since only the owner can write.
+. mips_atomic_set for syscall.c is deprecated and rarely used, just let it go
[[email protected]:
- Simplify the addition of -mno-fix-loongson3-llsc to cflags, and add a comment describing why it's there.
- Make loongson_llsc_mb() a no-op when CONFIG_CPU_LOONGSON3_WORKAROUNDS=n, rather than a compiler memory barrier.
- Add a comment describing the bug & how loongson_llsc_mb() helps in asm/barrier.h.]
--- arch/mips/Kconfig | 15 ++++++++++++++ arch/mips/include/asm/atomic.h | 6 ++++++ arch/mips/include/asm/barrier.h | 36 +++++++++++++++++++++++++++++++++ arch/mips/include/asm/bitops.h | 5 +++++ arch/mips/include/asm/futex.h | 3 +++ arch/mips/include/asm/pgtable.h | 2 ++ arch/mips/loongson64/Platform | 23 +++++++++++++++++++++ arch/mips/mm/tlbex.c | 10 +++++++++ 8 files changed, 100 insertions(+)
arch/mips/Kconfig +15 -0
@@ -1397,6 +1397,21 @@ config LOONGSON3_ENHANCEMENT please say 'N' here. If you want a high-performance kernel to run on new Loongson 3 machines only, please say 'Y' here. +config CPU_LOONGSON3_WORKAROUNDS + bool "Old Loongson 3 LLSC Workarounds" + default y if SMP + depends on CPU_LOONGSON3 + help + Loongson 3 processors have the llsc issues which require workarounds. + Without workarounds the system may hang unexpectedly. + + Newer Loongson 3 will fix these issues and no workarounds are needed. + The workarounds have no significant side effect on them but may + decrease the performance of the system so this option should be + disabled unless the kernel is intended to be run on old systems. + + If unsure, please say Y. + config CPU_LOONGSON2E bool "Loongson 2E" depends on SYS_HAS_CPU_LOONGSON2E
arch/mips/include/asm/atomic.h +6 -0
@@ -58,6 +58,7 @@ static __inline__ void atomic_##op(int i, atomic_t * v) \if (kernel_uses_llsc) { \int temp; \ \ +loongson_llsc_mb (); \ __asm__ __volatile__( \ " .set "MIPS_ISA_LEVEL" \n" \ "1: ll %0, %1 # atomic_" #op " \n" \
@@ -84,6 +85,7 @@ static __inline__ int atomic_##op##_return_relaxed(int i, atomic_t * v) \if (kernel_uses_llsc) { \int temp; \ \ +loongson_llsc_mb (); \ __asm__ __volatile__( \ " .set "MIPS_ISA_LEVEL" \n" \ "1: ll %1, %2 # atomic_" #op "_return \n" \
@@ -116,6 +118,7 @@ static __inline__ int atomic_fetch_##op##_relaxed(int i, atomic_t * v) \if (kernel_uses_llsc) { \int temp; \ \ +loongson_llsc_mb (); \ __asm__ __volatile__( \ " .set "MIPS_ISA_LEVEL" \n" \ "1: ll %1, %2 # atomic_fetch_" #op " \n" \
@@ -251,6 +254,7 @@ static __inline__ void atomic64_##op(long i, atomic64_t * v) \if (kernel_uses_llsc) { \long temp; \ \ +loongson_llsc_mb (); \ __asm__ __volatile__( \ " .set "MIPS_ISA_LEVEL" \n" \ "1: lld %0, %1 # atomic64_" #op " \n" \
@@ -277,6 +281,7 @@ static __inline__ long atomic64_##op##_return_relaxed(long i, atomic64_t * v) \if (kernel_uses_llsc) { \long temp; \ \ +loongson_llsc_mb (); \ __asm__ __volatile__( \ " .set "MIPS_ISA_LEVEL" \n" \ "1: lld %1, %2 # atomic64_" #op "_return\n" \
@@ -309,6 +314,7 @@ static __inline__ long atomic64_fetch_##op##_relaxed(long i, atomic64_t * v) \if (kernel_uses_llsc) { \long temp; \ \ +loongson_llsc_mb (); \ __asm__ __volatile__( \ " .set "MIPS_ISA_LEVEL" \n" \ "1: lld %1, %2 # atomic64_fetch_" #op "\n" \
arch/mips/include/asm/barrier.h +36 -0
@@ -222,6 +222,42 @@#define __smp_mb__before_atomic () __smp_mb__before_llsc()#define __smp_mb__after_atomic () smp_llsc_mb() +/* +* Some Loongson 3 CPUs have a bug wherein execution of a memory access (load, +* store or pref) in between an ll & sc can cause the sc instruction to +* erroneously succeed, breaking atomicity. Whilst it's unusual to write code +* containing such sequences, this bug bites harder than we might otherwise +* expect due to reordering & speculation: +* +* 1) A memory access appearing prior to the ll in program order may actually +* be executed after the ll - this is the reordering case. +* +* In order to avoid this we need to place a memory barrier (ie. a sync +* instruction) prior to every ll instruction, in between it & any earlier +* memory access instructions. Many of these cases are already covered by +* smp_mb__before_llsc() but for the remaining cases, typically ones in +* which multiple CPUs may operate on a memory location but ordering is not +* usually guaranteed, we use loongson_llsc_mb() below. +* +* This reordering case is fixed by 3A R2 CPUs, ie. 3A2000 models and later. +* +* 2) If a conditional branch exists between an ll & sc with a target outside +* of the ll-sc loop, for example an exit upon value mismatch in cmpxchg() +* or similar, then misprediction of the branch may allow speculative +* execution of memory accesses from outside of the ll-sc loop. +* +* In order to avoid this we need a memory barrier (ie. a sync instruction) +* at each affected branch target, for which we also use loongson_llsc_mb() +* defined below. +* +* This case affects all current Loongson 3 CPUs. +*/ +#ifdef CONFIG_CPU_LOONGSON3_WORKAROUNDS /* Loongson-3's LLSC workaround */ +#define loongson_llsc_mb () __asm__ __volatile__(__WEAK_LLSC_MB : : :"memory") +#else +#define loongson_llsc_mb () do { } while (0) +#endif +#include <asm-generic/barrier.h> #endif /* __ASM_BARRIER_H */
arch/mips/include/asm/bitops.h +5 -0
@@ -68,6 +68,7 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr) : "ir" (1UL << bit), GCC_OFF_SMALL_ASM() (*m)); #if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6) }else if (kernel_uses_llsc &&__builtin_constant_p (bit)) { +loongson_llsc_mb (); do { __asm__ __volatile__( " " __LL "%0, %1 # set_bit \n"
@@ -78,6 +79,7 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr) } while (unlikely(!temp));#endif /* CONFIG_CPU_MIPSR2 || CONFIG_CPU_MIPSR6 */ }else if (kernel_uses_llsc) { +loongson_llsc_mb (); do { __asm__ __volatile__( " .set "MIPS_ISA_ARCH_LEVEL" \n"
@@ -120,6 +122,7 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr) : "ir" (~(1UL << bit))); #if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6) }else if (kernel_uses_llsc &&__builtin_constant_p (bit)) { +loongson_llsc_mb (); do { __asm__ __volatile__( " " __LL "%0, %1 # clear_bit \n"
@@ -130,6 +133,7 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr) } while (unlikely(!temp));#endif /* CONFIG_CPU_MIPSR2 || CONFIG_CPU_MIPSR6 */ }else if (kernel_uses_llsc) { +loongson_llsc_mb (); do { __asm__ __volatile__( " .set "MIPS_ISA_ARCH_LEVEL" \n"
@@ -188,6 +192,7 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr)unsigned long *m = ((unsigned long *) addr) + (nr >>SZLONG_LOG );unsigned long temp; +loongson_llsc_mb (); do { __asm__ __volatile__( " .set "MIPS_ISA_ARCH_LEVEL" \n"
arch/mips/include/asm/futex.h +3 -0
@@ -50,6 +50,7 @@ "i" (-EFAULT) \ : "memory"); \ } else if (cpu_has_llsc) { \ + loongson_llsc_mb(); \ __asm__ __volatile__( \ " .set push \n" \ " .set noat \n" \
@@ -162,6 +163,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, "i" (-EFAULT) : "memory"); }else if (cpu_has_llsc) { +loongson_llsc_mb (); __asm__ __volatile__("# futex_atomic_cmpxchg_inatomic \n" " .set push \n"
@@ -190,6 +192,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, : GCC_OFF_SMALL_ASM() (*uaddr), "Jr" (oldval), "Jr" (newval), "i" (-EFAULT) : "memory"); +loongson_llsc_mb (); }else return -ENOSYS ;
arch/mips/include/asm/pgtable.h +2 -0
@@ -229,6 +229,7 @@ static inline void set_pte(pte_t *ptep, pte_t pteval) : [buddy] "+m" (buddy->pte), [tmp] "=&r" (tmp) : [global] "r" (page_global)); } else if (kernel_uses_llsc) { +loongson_llsc_mb (); __asm__ __volatile__ (" .set " MIPS_ISA_ARCH_LEVEL " \n" " .set push \n"
@@ -244,6 +245,7 @@ static inline void set_pte(pte_t *ptep, pte_t pteval)" .set mips0 \n" : [buddy] "+m" (buddy->pte), [tmp] "=&r" (tmp) : [global] "r" (page_global)); + loongson_llsc_mb(); }#else /* !CONFIG_SMP */ if (pte_none (*buddy))
arch/mips/loongson64/Platform +23 -0
@@ -23,6 +23,29 @@ ifdef CONFIG_CPU_LOONGSON2F_WORKAROUNDS endif cflags-$(CONFIG_CPU_LOONGSON3) += -Wa,--trap + +# +# Some versions of binutils, not currently mainline as of 2019/02/04, support +# an -mfix-loongson3-llsc flag which emits a sync prior to each ll instruction +# to work around a CPU bug (see loongson_llsc_mb() in asm/barrier.h for a +# description). +# +# We disable this in order to prevent the assembler meddling with the +# instruction that labels refer to, ie. if we label an ll instruction: +# +# 1: ll v0, 0(a0) +# +# ...then with the assembler fix applied the label may actually point at a sync +# instruction inserted by the assembler, and if we were using the label in an +# exception table the table would no longer contain the address of the ll +# instruction. +# +# Avoid this by explicitly disabling that assembler behaviour. If upstream +# binutils does not merge support for the flag then we can revisit & remove +# this later - for now it ensures vendor toolchains don't cause problems. +# +cflags-$(CONFIG_CPU_LOONGSON3) += $(call as-option,-Wa$(comma)-mno-fix-loongson3-llsc,) + # # binutils from v2.25 on and gcc starting from v4.9.0 treat -march=loongson3a # as MIPS64 R2; older versions as just R1. This leaves the possibility open
arch/mips/mm/tlbex.c +10 -0
@@ -931,6 +931,8 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,* to mimic that here by taking a load/istream page * fault. */ +if (IS_ENABLED (CONFIG_CPU_LOONGSON3_WORKAROUNDS )) +uasm_i_sync (p,0 );UASM_i_LA (p, ptr, (unsigned long )tlb_do_page_fault_0);uasm_i_jr (p, ptr);
@@ -1645,6 +1647,8 @@ static void iPTE_LW(u32 **p, unsigned int pte, unsigned int ptr) {#ifdef CONFIG_SMP +if (IS_ENABLED (CONFIG_CPU_LOONGSON3_WORKAROUNDS )) +uasm_i_sync (p,0 );# ifdef CONFIG_PHYS_ADDR_T_64BIT if (cpu_has_64bits)uasm_i_lld (p, pte,0 , ptr);
@@ -2258,6 +2262,8 @@ static void build_r4000_tlb_load_handler(void)#endif uasm_l_nopage_tlbl (&l, p); +if (IS_ENABLED (CONFIG_CPU_LOONGSON3_WORKAROUNDS )) +uasm_i_sync (&p,0 );build_restore_work_registers (&p);#ifdef CONFIG_CPU_MICROMIPS if ((unsigned long )tlb_do_page_fault_0 &1 ) {
@@ -2312,6 +2318,8 @@ static void build_r4000_tlb_store_handler(void)#endif uasm_l_nopage_tlbs (&l, p); +if (IS_ENABLED (CONFIG_CPU_LOONGSON3_WORKAROUNDS )) +uasm_i_sync (&p,0 );build_restore_work_registers (&p);#ifdef CONFIG_CPU_MICROMIPS if ((unsigned long )tlb_do_page_fault_1 &1 ) {
@@ -2367,6 +2375,8 @@ static void build_r4000_tlb_modify_handler(void)#endif uasm_l_nopage_tlbm (&l, p); +if (IS_ENABLED (CONFIG_CPU_LOONGSON3_WORKAROUNDS )) +uasm_i_sync (&p,0 );build_restore_work_registers (&p);#ifdef CONFIG_CPU_MICROMIPS if ((unsigned long )tlb_do_page_fault_1 &1 ) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 111/149 MIPS: Remove function size check in get_frame_info()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2b424cfc69728224fcb5fad138ea7260728e0901 ]
Patch (b6c7a324df37b "MIPS: Fix get_frame_info() handling of microMIPS function size.") introduces additional function size check for microMIPS by only checking insn between ip and ip + func_size. However, func_size in get_frame_info() is always 0 if KALLSYMS is not enabled. This causes get_frame_info() to return immediately without calculating correct frame_size, which in turn causes "Can't analyze schedule() prologue" warning messages at boot time.
This patch removes func_size check, and let the frame_size check run up to 128 insns for both MIPS and microMIPS.
--- arch/mips/kernel/process.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
arch/mips/kernel/process.c +3 -4
@@ -371,7 +371,7 @@ static inline int is_sp_move_ins(union mips_instruction *ip, int *frame_size)static int get_frame_info (struct mips_frame_info *info) {bool is_mmips =IS_ENABLED (CONFIG_CPU_MICROMIPS ); -union mips_instruction insn, *ip, *ip_end; +union mips_instruction insn, *ip;const unsigned int max_insns =128 ;unsigned int last_insn_size =0 ;unsigned int i;
@@ -384,10 +384,9 @@ static int get_frame_info(struct mips_frame_info *info)if (!ip) goto err; - ip_end = (void *)ip + info->func_size; - -for (i =0 ; i < max_insns && ip < ip_end; i++) { +for (i =0 ; i < max_insns; i++) { ip = (void *)ip + last_insn_size; +if (is_mmips &&mm_insn_16bit (ip->halfword[0 ])) { insn.word = ip->halfword[0 ] <<16 ; last_insn_size =2 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 112/149 Revert "scsi: libfc: Add WARN_ON() when deleting rports"
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d8f6382a7d026989029e2e50c515df954488459b ]
This reverts commit bbc0f8bd88abefb0f27998f40a073634a3a2db89.
It added a warning whose intent was to check whether the rport was still linked into the peer list. It doesn't work as intended and gives false positive warnings for two reasons:
1) If the rport is never linked into the peer list it will not be considered empty since the list_head is never initialized.
2) If the rport is deleted from the peer list using list_del_rcu(), then the list_head is in an undefined state and it is not considered empty.
--- drivers/scsi/libfc/fc_rport.c | 1 - 1 file changed, 1 deletion(-)
drivers/scsi/libfc/fc_rport.c +0 -1
@@ -184,7 +184,6 @@ void fc_rport_destroy(struct kref *kref)struct fc_rport_priv *rdata; rdata = container_of(kref, struct fc_rport_priv, kref); -WARN_ON (!list_empty (&rdata->peers));kfree_rcu (rdata, rcu); }EXPORT_SYMBOL (fc_rport_destroy);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 113/149 i2c: omap: Use noirq system sleep pm ops to idle device for suspend
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c6e2bd956936d925748581e4d0294f10f1d92f2c ]
We currently get the following error with pixcir_ts driver during a suspend resume cycle:
omap_i2c 4802a000.i2c: controller timed outpixcir_ts 1-005c: pixcir_int_enable: can't read reg 0x34 : -110 pixcir_ts 1-005c: Failed to disable interrupt generation: -110 pixcir_ts 1-005c: Failed to stopdpm_run_callback(): pixcir_i2c_ts_resume+0x0/0x98 [pixcir_i2c_ts] returns -110
PM: Device 1-005c failed to resume: error -110
And at least am437x based devices with pixcir_ts will fail to resume to a touchscreen that is configured as the wakeup-source in device tree for these devices.
This is because pixcir_ts tries to reconfigure it's registers for noirq suspend which fails. This also leaves i2c-omap in enabled state for suspend.
Let's fix the pixcir_ts issue and make sure i2c-omap is suspended by adding SET_NOIRQ_SYSTEM_SLEEP_PM_OPS.
Let's also get rid of some ifdefs while at it and replace them with __maybe_unused as SET_RUNTIME_PM_OPS and SET_NOIRQ_SYSTEM_SLEEP_PM_OPS already deal with the various PM Kconfig options.
--- drivers/i2c/busses/i2c-omap.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
drivers/i2c/busses/i2c-omap.c +5 -8
@@ -1498,8 +1498,7 @@ static int omap_i2c_remove(struct platform_device *pdev)return 0 ; } -#ifdef CONFIG_PM -static int omap_i2c_runtime_suspend (struct device *dev) +static int __maybe_unused omap_i2c_runtime_suspend (struct device *dev) {struct omap_i2c_dev *omap =dev_get_drvdata (dev);
@@ -1525,7 +1524,7 @@ static int omap_i2c_runtime_suspend(struct device *dev)return 0 ; } -static int omap_i2c_runtime_resume (struct device *dev) +static int __maybe_unused omap_i2c_runtime_resume (struct device *dev) {struct omap_i2c_dev *omap =dev_get_drvdata (dev);
@@ -1540,20 +1539,18 @@ static int omap_i2c_runtime_resume(struct device *dev) }static const struct dev_pm_ops omap_i2c_pm_ops = { + SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, + pm_runtime_force_resume)SET_RUNTIME_PM_OPS (omap_i2c_runtime_suspend, omap_i2c_runtime_resume,NULL ) }; -#define OMAP_I2C_PM_OPS (&omap_i2c_pm_ops) -#else -#define OMAP_I2C_PM_OPS NULL -#endif /* CONFIG_PM */ static struct platform_driver omap_i2c_driver = { .probe = omap_i2c_probe, .remove = omap_i2c_remove, .driver = { .name ="omap_i2c" , - .pm =OMAP_I2C_PM_OPS , + .pm = &omap_i2c_pm_ops, .of_match_table =of_match_ptr (omap_i2c_of_match), }, };
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 114/149 drm/amdgpu: use spin_lock_irqsave to protect vm_manager.pasid_idr
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0a5f49cbf9d6ad3721c16f8a6d823363ea7a160f ]
amdgpu_vm_get_task_info is called from interrupt handler and sched timeout workqueue, we should use irq version spin_lock to avoid deadlock.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +3 -2
@@ -3011,14 +3011,15 @@ void amdgpu_vm_get_task_info(struct amdgpu_device *adev, unsigned int pasid, struct amdgpu_task_info *task_info) {struct amdgpu_vm *vm; +unsigned long flags; -spin_lock (&adev->vm_manager.pasid_lock); +spin_lock_irqsave (&adev->vm_manager.pasid_lock, flags); vm =idr_find (&adev->vm_manager.pasid_idr, pasid);if (vm) *task_info = vm->task_info; -spin_unlock (&adev->vm_manager.pasid_lock); +spin_unlock_irqrestore (&adev->vm_manager.pasid_lock, flags); }/**
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 115/149 nvme: lock NS list changes while handling command effects
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e7ad43c3eda6a1690c4c3c341f95dc1c6898da83 ]
If a controller supports the NS Change Notification, the namespace scan_work is automatically triggered after attaching a new namespace.
Occasionally the namespace scan_work may append the new namespace to the list before the admin command effects handling is completed. The effects handling unfreezes namespaces, but if it unfreezes the newly attached namespace, its request_queue freeze depth will be off and we'll hit the warning in blk_mq_unfreeze_queue().
On the next namespace add, we will fail to freeze that queue due to the previous bad accounting and deadlock waiting for frozen.
Fix that by preventing scan work from altering the namespace list while command effects handling needs to pair freeze with unfreeze.
--- drivers/nvme/host/core.c | 8 +++++++- drivers/nvme/host/nvme.h | 1 + 2 files changed, 8 insertions(+), 1 deletion(-)
drivers/nvme/host/core.c +7 -1
@@ -1182,6 +1182,7 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,* effects say only one namespace is affected. */ if (effects & (NVME_CMD_EFFECTS_LBCC |NVME_CMD_EFFECTS_CSE_MASK )) { +mutex_lock (&ctrl->scan_lock);nvme_start_freeze (ctrl);nvme_wait_freeze (ctrl); }
@@ -1210,8 +1211,10 @@ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)*/ if (effects &NVME_CMD_EFFECTS_LBCC )nvme_update_formats (ctrl); -if (effects & (NVME_CMD_EFFECTS_LBCC |NVME_CMD_EFFECTS_CSE_MASK )) +if (effects & (NVME_CMD_EFFECTS_LBCC |NVME_CMD_EFFECTS_CSE_MASK )) {nvme_unfreeze (ctrl); +mutex_unlock (&ctrl->scan_lock); + }if (effects &NVME_CMD_EFFECTS_CCC )nvme_init_identify (ctrl);if (effects & (NVME_CMD_EFFECTS_NIC |NVME_CMD_EFFECTS_NCC ))
@@ -3292,6 +3295,7 @@ static void nvme_scan_work(struct work_struct *work)if (nvme_identify_ctrl (ctrl, &id))return ; +mutex_lock (&ctrl->scan_lock); nn =le32_to_cpu (id->nn);if (ctrl->vs >=NVME_VS (1 ,1 ,0 ) && !(ctrl->quirks &NVME_QUIRK_IDENTIFY_CNS )) {
@@ -3300,6 +3304,7 @@ static void nvme_scan_work(struct work_struct *work) }nvme_scan_ns_sequential (ctrl, nn); out_free_id: +mutex_unlock (&ctrl->scan_lock);kfree (id);down_write (&ctrl->namespaces_rwsem);list_sort (NULL , &ctrl->namespaces, ns_cmp);
@@ -3535,6 +3540,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, ctrl->state =NVME_CTRL_NEW ;spin_lock_init (&ctrl->lock); +mutex_init (&ctrl->scan_lock);INIT_LIST_HEAD (&ctrl->namespaces);init_rwsem (&ctrl->namespaces_rwsem); ctrl->dev = dev;
drivers/nvme/host/nvme.h +1 -0
@@ -148,6 +148,7 @@ struct nvme_ctrl {enum nvme_ctrl_state state;bool identified;spinlock_t lock; +struct mutex scan_lock;const struct nvme_ctrl_ops *ops;struct request_queue *admin_q;struct request_queue *connect_q;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 116/149 nvme-pci: fix rapid add remove sequence
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5c959d73dba6495ec01d04c206ee679d61ccb2b0 ]
A surprise removal may fail to tear down request queues if it is racing with the initial asynchronous probe. If that happens, the remove path won't see the queue resources to tear down, and the controller reset path may create a new request queue on a removed device, but will not be able to make forward progress, deadlocking the pci removal.
Protect setting up non-blocking resources from a shutdown by holding the same mutex, and transition to the CONNECTING state after these resources are initialized so the probe path may see the dead controller state before dispatching new IO.
--- drivers/nvme/host/pci.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
drivers/nvme/host/pci.c +12 -10
@@ -2260,16 +2260,7 @@ static void nvme_reset_work(struct work_struct *work)if (dev->ctrl.ctrl_config &NVME_CC_ENABLE )nvme_dev_disable (dev, false); -/* -* Introduce CONNECTING state from nvme-fc/rdma transports to mark the -* initializing procedure here. -*/ -if (!nvme_change_ctrl_state (&dev->ctrl,NVME_CTRL_CONNECTING )) { -dev_warn (dev->ctrl.device, -"failed to mark controller CONNECTING\n" ); - goto out; - } - +mutex_lock (&dev->shutdown_lock); result =nvme_pci_enable (dev);if (result) goto out;
@@ -2288,6 +2279,17 @@ static void nvme_reset_work(struct work_struct *work)*/ dev->ctrl.max_hw_sectors =NVME_MAX_KB_SZ <<1 ; dev->ctrl.max_segments =NVME_MAX_SEGS ; +mutex_unlock (&dev->shutdown_lock); + +/* +* Introduce CONNECTING state from nvme-fc/rdma transports to mark the +* initializing procedure here. +*/ +if (!nvme_change_ctrl_state (&dev->ctrl,NVME_CTRL_CONNECTING )) { +dev_warn (dev->ctrl.device, +"failed to mark controller CONNECTING\n" ); + goto out; + } result =nvme_init_identify (&dev->ctrl);if (result)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 117/149 fs: ratelimit __find_get_block_slow() failure message.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 43636c804df0126da669c261fc820fb22f62bfc2 ]
When something let __find_get_block_slow() hit all_mapped path, it calls printk() for 100+ times per a second. But there is no need to print same message with such high frequency; it is just asking for stall warning, or at least bloating log files.
[ 399.866302][T15342] __find_get_block_slow() failed. block=1, b_blocknr=8 [ 399.873324][T15342] b_state=0x00000029, b_size=512 [ 399.878403][T15342] device loop0 blocksize: 4096 [ 399.883296][T15342] __find_get_block_slow() failed. block=1, b_blocknr=8 [ 399.890400][T15342] b_state=0x00000029, b_size=512 [ 399.895595][T15342] device loop0 blocksize: 4096 [ 399.900556][T15342] __find_get_block_slow() failed. block=1, b_blocknr=8 [ 399.907471][T15342] b_state=0x00000029, b_size=512 [ 399.912506][T15342] device loop0 blocksize: 4096
This patch reduces frequency to up to once per a second, in addition to concatenating three lines into one.
[ 399.866302][T15342] __find_get_block_slow() failed. block=1, b_blocknr=8, b_state=0x00000029, b_size=512, device loop0 blocksize: 4096
--- fs/buffer.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
fs/buffer.c +10 -9
@@ -200,6 +200,7 @@ __find_get_block_slow(struct block_device *bdev, sector_t block)struct buffer_head *head;struct page *page;int all_mapped =1 ; + static DEFINE_RATELIMIT_STATE(last_warned, HZ, 1); index = block >> (PAGE_SHIFT - bd_inode->i_blkbits); page =find_get_page_flags (bd_mapping, index,FGP_ACCESSED );
@@ -227,15 +228,15 @@ __find_get_block_slow(struct block_device *bdev, sector_t block)* file io on the block device and getblk. It gets dealt with * elsewhere, don't buffer_error if we had some unmapped buffers */ -if (all_mapped) { -printk ("__find_get_block_slow() failed. " -"block=%llu, b_blocknr=%llu\n" , - (unsigned long long )block, - (unsigned long long )bh->b_blocknr); -printk ("b_state=0x%08lx, b_size=%zu\n" , - bh->b_state, bh->b_size); -printk ("device %pg blocksize: %d\n" , bdev, -1 << bd_inode->i_blkbits); +ratelimit_set_flags (&last_warned,RATELIMIT_MSG_ON_RELEASE ); +if (all_mapped &&__ratelimit (&last_warned)) { +printk ("__find_get_block_slow() failed. block=%llu, " +"b_blocknr=%llu, b_state=0x%08lx, b_size=%zu, " +"device %pg blocksize: %d\n" , + (unsigned long long )block, + (unsigned long long )bh->b_blocknr, + bh->b_state, bh->b_size, bdev, +1 << bd_inode->i_blkbits); } out_unlock:spin_unlock (&bd_mapping->private_lock);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 118/149 qed: Fix EQ full firmware assert.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 660492bcf4a7561b5fdc13be0ae0b0c0a8c120be ]
When slowpath messages are sent with high rate, the resulting events can lead to a FW assert in case they are not handled fast enough (Event Queue Full assert). Attempt to send queued slowpath messages only after the newly evacuated entries in the EQ ring are indicated to FW.
--- drivers/net/ethernet/qlogic/qed/qed_sp.h | 1 + drivers/net/ethernet/qlogic/qed/qed_spq.c | 15 +++++++-------- 2 files changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_sp.h +1 -0
@@ -380,6 +380,7 @@ void qed_consq_setup(struct qed_hwfn *p_hwfn);* @param p_hwfn */ void qed_consq_free (struct qed_hwfn *p_hwfn); +int qed_spq_pend_post (struct qed_hwfn *p_hwfn);/** * @file
drivers/net/ethernet/qlogic/qed/qed_spq.c +7 -8
@@ -402,6 +402,11 @@ int qed_eq_completion(struct qed_hwfn *p_hwfn, void *cookie)qed_eq_prod_update (p_hwfn,qed_chain_get_prod_idx (p_chain)); +/* Attempt to post pending requests */ +spin_lock_bh (&p_hwfn->p_spq->lock); + rc =qed_spq_pend_post (p_hwfn); +spin_unlock_bh (&p_hwfn->p_spq->lock); +return rc; }
@@ -745,7 +750,7 @@ static int qed_spq_post_list(struct qed_hwfn *p_hwfn,return 0 ; } -static int qed_spq_pend_post (struct qed_hwfn *p_hwfn) +int qed_spq_pend_post (struct qed_hwfn *p_hwfn) {struct qed_spq *p_spq = p_hwfn->p_spq;struct qed_spq_entry *p_ent =NULL ;
@@ -883,7 +888,6 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,struct qed_spq_entry *p_ent =NULL ;struct qed_spq_entry *tmp;struct qed_spq_entry *found =NULL ; -int rc;if (!p_hwfn)return -EINVAL ;
@@ -941,12 +945,7 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,*/ qed_spq_return_entry (p_hwfn, found); -/* Attempt to post pending requests */ -spin_lock_bh (&p_spq->lock); - rc =qed_spq_pend_post (p_hwfn); -spin_unlock_bh (&p_spq->lock); - -return rc; +return 0 ; }int qed_consq_alloc (struct qed_hwfn *p_hwfn)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 119/149 qed: Consider TX tcs while deriving the max num_queues for PF.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit fb1faab74ddef9ec2d841d54e5d0912a097b3abe ]
Max supported queues is derived incorrectly in the case of multi-CoS. Need to consider TCs while calculating num_queues for PF.
--- drivers/net/ethernet/qlogic/qed/qed_l2.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_l2.c +3 -2
@@ -2216,7 +2216,7 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev,u16 num_queues =0 ;/* Since the feature controls only queue-zones, -* make sure we have the contexts [rx, tx, xdp] to +* make sure we have the contexts [rx, xdp, tcs] to * match. */ for_each_hwfn (cdev, i) {
@@ -2226,7 +2226,8 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev,u16 cids; cids = hwfn->pf_params.eth_pf_params.num_cons; - num_queues +=min_t (u16, l2_queues, cids /3 ); + cids /= (2 + info->num_tc); + num_queues +=min_t (u16, l2_queues, cids); }/* queues might theoretically be >256, but interrupts'
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 120/149 qede: Fix system crash on configuring channels.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0aa4febb420d91df5b56b1864a2465765da85f4b ]
Under heavy traffic load, when changing number of channels via ethtool (ethtool -L) which will cause interface to be reloaded, it was observed that some packets gets transmitted on old TX channel/queue id which doesn't really exist after the channel configuration leads to system crash.
Add a safeguard in the driver by validating queue id through ndo_select_queue() which is called before the ndo_start_xmit().
--- drivers/net/ethernet/qlogic/qede/qede.h | 3 +++ drivers/net/ethernet/qlogic/qede/qede_fp.c | 13 +++++++++++++ drivers/net/ethernet/qlogic/qede/qede_main.c | 3 +++ 3 files changed, 19 insertions(+)
drivers/net/ethernet/qlogic/qede/qede.h +3 -0
@@ -489,6 +489,9 @@ struct qede_reload_args {/* Datapath functions definition */ netdev_tx_t qede_start_xmit (struct sk_buff *skb,struct net_device *ndev); +u16 qede_select_queue (struct net_device *dev,struct sk_buff *skb, +struct net_device *sb_dev, +select_queue_fallback_t fallback);netdev_features_t qede_features_check (struct sk_buff *skb,struct net_device *dev,netdev_features_t features);
drivers/net/ethernet/qlogic/qede/qede_fp.c +13 -0
@@ -1695,6 +1695,19 @@ netdev_tx_t qede_start_xmit(struct sk_buff *skb, struct net_device *ndev)return NETDEV_TX_OK ; } +u16 qede_select_queue (struct net_device *dev,struct sk_buff *skb, +struct net_device *sb_dev, +select_queue_fallback_t fallback) +{ +struct qede_dev *edev =netdev_priv (dev); +int total_txq; + + total_txq =QEDE_TSS_COUNT (edev) * edev->dev_info.num_tc; + +return QEDE_TSS_COUNT (edev) ? +fallback (dev, skb,NULL ) % total_txq :0 ; +} +/* 8B udp header + 8B base tunnel header + 32B option length */ #define QEDE_MAX_TUN_HDR_LEN 48
drivers/net/ethernet/qlogic/qede/qede_main.c +3 -0
@@ -631,6 +631,7 @@ static const struct net_device_ops qede_netdev_ops = { .ndo_open = qede_open, .ndo_stop = qede_close, .ndo_start_xmit = qede_start_xmit, + .ndo_select_queue = qede_select_queue, .ndo_set_rx_mode = qede_set_rx_mode, .ndo_set_mac_address = qede_set_mac_addr, .ndo_validate_addr = eth_validate_addr,
@@ -666,6 +667,7 @@ static const struct net_device_ops qede_netdev_vf_ops = { .ndo_open = qede_open, .ndo_stop = qede_close, .ndo_start_xmit = qede_start_xmit, + .ndo_select_queue = qede_select_queue, .ndo_set_rx_mode = qede_set_rx_mode, .ndo_set_mac_address = qede_set_mac_addr, .ndo_validate_addr = eth_validate_addr,
@@ -684,6 +686,7 @@ static const struct net_device_ops qede_netdev_vf_xdp_ops = { .ndo_open = qede_open, .ndo_stop = qede_close, .ndo_start_xmit = qede_start_xmit, + .ndo_select_queue = qede_select_queue, .ndo_set_rx_mode = qede_set_rx_mode, .ndo_set_mac_address = qede_set_mac_addr, .ndo_validate_addr = eth_validate_addr,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 121/149 blk-iolatency: fix IO hang due to negative inflight counter
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8c772a9bfc7c07c76f4a58b58910452fbb20843b ]
Our test reported the following stack, and vmcore showed that ->inflight counter is -1.
[ffffc9003fcc38d0] __schedule at ffffffff8173d95d [ffffc9003fcc3958] schedule at ffffffff8173de26 [ffffc9003fcc3970] io_schedule at ffffffff810bb6b6 [ffffc9003fcc3988] blkcg_iolatency_throttle at ffffffff813911cb [ffffc9003fcc3a20] rq_qos_throttle at ffffffff813847f3 [ffffc9003fcc3a48] blk_mq_make_request at ffffffff8137468a [ffffc9003fcc3b08] generic_make_request at ffffffff81368b49 [ffffc9003fcc3b68] submit_bio at ffffffff81368d7d [ffffc9003fcc3bb8] ext4_io_submit at ffffffffa031be00 [ext4] [ffffc9003fcc3c00] ext4_writepages at ffffffffa03163de [ext4] [ffffc9003fcc3d68] do_writepages at ffffffff811c49ae [ffffc9003fcc3d78] __filemap_fdatawrite_range at ffffffff811b6188 [ffffc9003fcc3e30] filemap_write_and_wait_range at ffffffff811b6301 [ffffc9003fcc3e60] ext4_sync_file at ffffffffa030cee8 [ext4] [ffffc9003fcc3ea8] vfs_fsync_range at ffffffff8128594b [ffffc9003fcc3ee8] do_fsync at ffffffff81285abd [ffffc9003fcc3f18] sys_fsync at ffffffff81285d50 [ffffc9003fcc3f28] do_syscall_64 at ffffffff81003c04 [ffffc9003fcc3f50] entry_SYSCALL_64_after_swapgs at ffffffff81742b8e
The ->inflight counter may be negative (-1) if
1) blk-iolatency was disabled when the IO was issued,
2) blk-iolatency was enabled before this IO reached its endio,
3) the ->inflight counter is decreased from 0 to -1 in endio()
In fact the hang can be easily reproduced by the below script,
H=/sys/fs/cgroup/unified/
P=/sys/fs/cgroup/unified/test
echo "+io" > $H/cgroup.subtree_control
mkdir -p $P
echo $$ > $P/cgroup.procs
xfs_io -f -d -c "pwrite 0 4k" /dev/sdg
echo "cat /sys/block/sdg/dev target=1000000" > $P/io.latency
xfs_io -f -d -c "pwrite 0 4k" /dev/sdg
This fixes the problem by freezing the queue so that while enabling/disabling iolatency, there is no inflight rq running.
Note that quiesce_queue is not needed as this only updating iolatency configuration about which dispatching request_queue doesn't care.
--- block/blk-iolatency.c | 52 +++++++++++++++++++++++++++++++++++++------ 1 file changed, 45 insertions(+), 7 deletions(-)
block/blk-iolatency.c +45 -7
@@ -72,6 +72,7 @@#include <linux/sched/loadavg.h> #include <linux/sched/signal.h> #include <trace/events/block.h> +#include <linux/blk-mq.h> #include "blk-rq-qos.h" #include "blk-stat.h"
@@ -568,6 +569,9 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)return ; enabled =blk_iolatency_enabled (iolat->blkiolat); +if (!enabled) +return ; +while (blkg && blkg->parent) { iolat =blkg_to_lat (blkg);if (!iolat) {
@@ -577,7 +581,7 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio) rqw = &iolat->rq_wait;atomic_dec (&rqw->inflight); -if (!enabled || iolat->min_lat_nsec ==0 ) +if (iolat->min_lat_nsec ==0 ) goto next;iolatency_record_time (iolat, &bio->bi_issue, now, issue_as_root);
@@ -721,10 +725,13 @@ int blk_iolatency_init(struct request_queue *q)return 0 ; } -static void iolatency_set_min_lat_nsec (struct blkcg_gq *blkg,u64 val) +/* +* return 1 for enabling iolatency, return -1 for disabling iolatency, otherwise +* return 0. +*/ +static int iolatency_set_min_lat_nsec (struct blkcg_gq *blkg,u64 val) {struct iolatency_grp *iolat =blkg_to_lat (blkg); -struct blk_iolatency *blkiolat = iolat->blkiolat;u64 oldval = iolat->min_lat_nsec; iolat->min_lat_nsec = val;
@@ -733,9 +740,10 @@ static void iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val) BLKIOLATENCY_MAX_WIN_SIZE);if (!oldval && val) -atomic_inc (&blkiolat->enabled); +return 1 ;if (oldval && !val) -atomic_dec (&blkiolat->enabled); +return -1 ; +return 0 ; }static void iolatency_clear_scaling (struct blkcg_gq *blkg)
@@ -768,6 +776,7 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf,u64 lat_val =0 ;u64 oldval;int ret; +int enable =0 ; ret =blkg_conf_prep (blkcg, &blkcg_policy_iolatency, buf, &ctx);if (ret)
@@ -803,7 +812,12 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf, blkg = ctx.blkg; oldval = iolat->min_lat_nsec; -iolatency_set_min_lat_nsec (blkg, lat_val); + enable =iolatency_set_min_lat_nsec (blkg, lat_val); +if (enable) { +WARN_ON_ONCE (!blk_get_queue (blkg->q)); +blkg_get (blkg); + } +if (oldval != iolat->min_lat_nsec) {iolatency_clear_scaling (blkg); }
@@ -811,6 +825,24 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf, ret =0 ; out:blkg_conf_finish (&ctx); +if (ret ==0 && enable) { +struct iolatency_grp *tmp =blkg_to_lat (blkg); +struct blk_iolatency *blkiolat = tmp->blkiolat; + +blk_mq_freeze_queue (blkg->q); + +if (enable ==1 ) +atomic_inc (&blkiolat->enabled); +else if (enable ==-1 ) +atomic_dec (&blkiolat->enabled); +else +WARN_ON_ONCE (1 ); + +blk_mq_unfreeze_queue (blkg->q); + +blkg_put (blkg); +blk_put_queue (blkg->q); + }return ret ?: nbytes; }
@@ -910,8 +942,14 @@ static void iolatency_pd_offline(struct blkg_policy_data *pd) {struct iolatency_grp *iolat =pd_to_lat (pd);struct blkcg_gq *blkg =lat_to_blkg (iolat); +struct blk_iolatency *blkiolat = iolat->blkiolat; +int ret; -iolatency_set_min_lat_nsec (blkg,0 ); + ret =iolatency_set_min_lat_nsec (blkg,0 ); +if (ret ==1 ) +atomic_inc (&blkiolat->enabled); +if (ret ==-1 ) +atomic_dec (&blkiolat->enabled);iolatency_clear_scaling (blkg); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 122/149 nvme-pci: add missing unlock for reset error
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4726bcf30fad37cc555cd9dcd6c73f2b2668c879 ]
The reset work holds a mutex to prevent races with removal modifying the same resources, but was unlocking only on success. Unlock on failure too.
--- drivers/nvme/host/pci.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/nvme/host/pci.c +5 -3
@@ -2263,15 +2263,15 @@ static void nvme_reset_work(struct work_struct *work)mutex_lock (&dev->shutdown_lock); result =nvme_pci_enable (dev);if (result) - goto out; + goto out_unlock; result =nvme_pci_configure_admin_queue (dev);if (result) - goto out; + goto out_unlock; result =nvme_alloc_admin_tags (dev);if (result) - goto out; + goto out_unlock;/* * Limit the max command size to prevent iod->sg allocations going
@@ -2354,6 +2354,8 @@ static void nvme_reset_work(struct work_struct *work)nvme_start_ctrl (&dev->ctrl);return ; + out_unlock: +mutex_unlock (&dev->shutdown_lock); out:nvme_remove_dead_ctrl (dev, result); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 123/149 Input: wacom_serial4 - add support for Wacom ArtPad II tablet
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gerecke <[email protected]>
commit 44fc95e218a09d7966a9d448941fdb003f6bb69f upstream.
Tablet initially begins communicating at 9600 baud, so this command should be used to connect to the device:
$ inputattach --daemon --baud 9600 --wacom_iv /dev/ttyS0
https://github.com/linuxwacom/xf86-input-wacom/issues/40
--- drivers/input/tablet/wacom_serial4.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/input/tablet/wacom_serial4.c +2 -0
@@ -187,6 +187,7 @@ enum {MODEL_DIGITIZER_II =0x5544 ,/* UD */ MODEL_GRAPHIRE =0x4554 ,/* ET */ MODEL_PENPARTNER =0x4354 ,/* CT */ + MODEL_ARTPAD_II = 0x4B54, /* KT */ };static void wacom_handle_model_response (struct wacom *wacom)
@@ -245,6 +246,7 @@ static void wacom_handle_model_response( wacom->flags =F_HAS_STYLUS2 |F_HAS_SCROLLWHEEL ;break ; +case MODEL_ARTPAD_II :case MODEL_DIGITIZER_II : wacom->dev->name ="Wacom Digitizer II" ; wacom->dev->id.version =MODEL_DIGITIZER_II ;
Greg Kroah-Hartman
maintainerPATCH 124/149 Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Batts <[email protected]>
commit e154ab69321ce2c54f19863d75c77b4e2dc9d365 upstream.
Lenovo s21e-20 uses ELAN0601 in its ACPI tables for the Elan touchpad.
--- drivers/input/mouse/elan_i2c_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/elan_i2c_core.c +1 -0
@@ -1337,6 +1337,7 @@ static const struct acpi_device_id elan_ { "ELAN0000", 0 }, { "ELAN0100", 0 }, { "ELAN0600", 0 }, + { "ELAN0601", 0 }, { "ELAN0602", 0 }, { "ELAN0605", 0 }, { "ELAN0608", 0 },
Greg Kroah-Hartman
maintainerPATCH 125/149 iscsi_ibft: Fix missing break in switch statement
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit df997abeebadaa4824271009e2d2b526a70a11cb upstream.
Add missing break statement in order to prevent the code from falling through to case ISCSI_BOOT_TGT_NAME, which is unnecessary.
This bug was found thanks to the ongoing efforts to enable -Wimplicit-fallthrough.
--- drivers/firmware/iscsi_ibft.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/iscsi_ibft.c +1 -0
@@ -542,6 +542,7 @@ static umode_t __init ibft_check_tgt_forcase ISCSI_BOOT_TGT_NIC_ASSOC :case ISCSI_BOOT_TGT_CHAP_TYPE : rc =S_IRUGO ; +break ;case ISCSI_BOOT_TGT_NAME :if (tgt->tgt_name_len) rc =S_IRUGO ;
Greg Kroah-Hartman
maintainerPATCH 126/149 scsi: aacraid: Fix missing break in switch statement
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit 5e420fe635813e5746b296cfc8fff4853ae205a2 upstream.
Add missing break statement and fix identation issue.
This bug was found thanks to the ongoing efforts to enable -Wimplicit-fallthrough.
--- drivers/scsi/aacraid/commsup.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/aacraid/commsup.c +3 -2
@@ -1304,8 +1304,9 @@ static void aac_handle_aif(struct aac_de ADD :DELETE ;break ; } -case AifBuManagerEvent: -aac_handle_aif_bu (dev, aifcmd); +break ; +case AifBuManagerEvent: +aac_handle_aif_bu (dev, aifcmd);break ; }
Greg Kroah-Hartman
maintainerPATCH 127/149 x86/PCI: Fixup RTIT_BAR of Intel Denverton Trace Hub
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shishkin <[email protected]>
commit 2e095ce7b6ecce2f3e2ff330527f12056ed1e1a1 upstream.
On Denverton's integration of the Intel(R) Trace Hub (for a reference and overview see Documentation/trace/intel_th.rst) the reported size of one of its resources (RTIT_BAR) doesn't match its actual size, which leads to overlaps with other devices' resources.
In practice, it overlaps with XHCI MMIO space, which results in the xhci driver bailing out after seeing its registers as 0xffffffff, and perceived disappearance of all USB devices:
intel_th_pci 0000:00:1f.7: enabling device (0004 -> 0006)
xhci_hcd 0000:00:15.0: xHCI host controller not responding, assume dead xhci_hcd 0000:00:15.0: xHC not responding in xhci_irq, assume controller is dead xhci_hcd 0000:00:15.0: HC died; cleaning up
usb 1-1: USB disconnect, device number 2
For this reason, we need to resize the RTIT_BAR on Denverton to its actual size, which in this case is 4MB. The corresponding erratum is DNV36 at the link below:
DNV36. Processor Host Root Complex May Incorrectly Route Memory
Accesses to Intel® Trace Hub
Problem: The Intel® Trace Hub RTIT_BAR (B0:D31:F7 offset 20h) is
reported as a 2KB memory range. Due to this erratum, the processor Host Root Complex will forward addresses from RTIT_BAR to RTIT_BAR + 4MB -1 to Intel® Trace Hub.
Implication: Devices assigned within the RTIT_BAR to RTIT_BAR + 4MB -1
space may not function correctly.
Workaround: A BIOS code change has been identified and may be
implemented as a workaround for this erratum.
Status: No Fix.
Note that 5118ccd34780 ("intel_th: pci: Add Denverton SOC support") updates the Trace Hub driver so it claims the Denverton device, but the resource overlap exists regardless of whether that driver is loaded or that commit is included.
--- arch/x86/pci/fixup.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
arch/x86/pci/fixup.c +16 -0
@@ -641,6 +641,22 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INDECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x334c , quirk_no_aersid);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x334d , quirk_no_aersid); +static void quirk_intel_th_dnv (struct pci_dev *dev) +{ +struct resource *r = &dev->resource[4 ]; + +/* +* Denverton reports 2k of RTIT_BAR (intel_th resource 4), which +* appears to be 4 MB in reality. +*/ +if (r->end == r->start +0x7ff ) { + r->start =0 ; + r->end =0x3fffff ; + r->flags |=IORESOURCE_UNSET ; + } +} +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x19e1 , quirk_intel_th_dnv); +#ifdef CONFIG_PHYS_ADDR_T_64BIT #define AMD_141b_MMIO_BASE (x) (0x80 + (x) * 0x8)
Greg Kroah-Hartman
maintainerPATCH 128/149 arm64: dts: zcu100-revC: Give wifi some time after power-on
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <[email protected]>
commit 35a4f89cd4731ac6ec985cd29ddc1630903006b7 upstream.
Somewhere along recent changes to power control of the wl1831, power-on became very unreliable on the Ultra96, failing like this:
wl1271_sdio: probe of mmc2:0001:1 failed with error -16wl1271_sdio: probe of mmc2:0001:2 failed with error -16
After playing with some dt parameters and comparing to other users of this chip, it turned out we need some power-on delay to make things stable again. In contrast to those other users which define 200 ms, Ultra96 is already happy with 10 ms.
--- arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts +1 -0
@@ -101,6 +101,7 @@ sdio_pwrseq: sdio_pwrseq { compatible = "mmc-pwrseq-simple"; reset-gpios = <&gpio 7 GPIO_ACTIVE_LOW>; /* WIFI_EN */ + post-power-on-delay-ms = <10>; }; };
Greg Kroah-Hartman
maintainerPATCH 129/149 arm64: dts: hikey: Give wifi some time after power-on
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <[email protected]>
commit 83b944174ad79825ae84a47af1a0354485b24602 upstream.
Somewhere along recent changes to power control of the wl1835, power-on became very unreliable on the hikey, failing like this:
wl1271_sdio: probe of mmc2:0001:1 failed with error -16wl1271_sdio: probe of mmc2:0001:2 failed with error -16
After playing with some dt parameters and comparing to other users of this chip, it turned out we need some power-on delay to make things stable again. In contrast to those other users which define 200 ms, the hikey would already be happy with 1 ms. Still, we use the safer 10 ms, like on the Ultra96.
--- arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts +1 -0
@@ -118,6 +118,7 @@ reset-gpios = <&gpio0 5 GPIO_ACTIVE_LOW>; clocks = <&pmic>; clock-names = "ext_clock"; + post-power-on-delay-ms = <10>; power-off-delay-us = <10>; };
Greg Kroah-Hartman
maintainerPATCH 130/149 arm64: dts: hikey: Revert "Enable HS200 mode on eMMC"
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Strachan <[email protected]>
commit 8d26c1390aec795d492b8de5e4437751e8805a1d upstream.
This reverts commit abd7d0972a192ee653efc7b151a6af69db58f2bb. This change was already partially reverted by John Stultz in
commit 9c6d26df1fae ("arm64: dts: hikey: Fix eMMC corruption regression").
This change appears to cause controller resets and block read failures which prevents successful booting on some hikey boards.
--- arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts +0 -1
@@ -301,7 +301,6 @@ dwmmc_0: dwmmc0@f723d000 { cap-mmc-highspeed; - mmc-hs200-1_8v; non-removable; bus-width = <0x8>; vmmc-supply = <&ldo19>;
Greg Kroah-Hartman
maintainerPATCH 131/149 ARM: dts: exynos: Fix pinctrl definition for eMMC RTSN line on Odroid X2/U3
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit ec33745bccc8f336957c751f4153421cc9ef5a54 upstream.
Commit 225da7e65a03 ("ARM: dts: add eMMC reset line for exynos4412-odroid-common") added MMC power sequence for eMMC card of Odroid X2/U3. It reused generic sd1_cd pin control configuration node and only disabled pull-up. However that time the pinctrl configuration was not applied during MMC power sequence driver initialization. This has been changed later by commit d97a1e5d7cd2 ("mmc: pwrseq: convert to proper platform device").
It turned out then, that the provided pinctrl configuration is not correct, because the eMMC_RTSN line is being re-configured as 'special function/card detect function for mmc1 controller' not the simple 'output', thus the power sequence driver doesn't really set the pin value. This in effect broke the reboot of Odroid X2/U3 boards. Fix this by providing separate node with eMMC_RTSN pin configuration.
--- arch/arm/boot/dts/exynos4412-odroid-common.dtsi | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
arch/arm/boot/dts/exynos4412-odroid-common.dtsi +6 -7
@@ -49,7 +49,7 @@ }; emmc_pwrseq: pwrseq { - pinctrl-0 = <&sd1_cd>; + pinctrl-0 = <&emmc_rstn>; pinctrl-names = "default"; compatible = "mmc-pwrseq-emmc"; reset-gpios = <&gpk1 2 GPIO_ACTIVE_LOW>;
@@ -161,12 +161,6 @@ cpu0-supply = <&buck2_reg>; }; -/* RSTN signal for eMMC */ -&sd1_cd { - samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>; - samsung,pin-drv = <EXYNOS4_PIN_DRV_LV1>; -}; - &pinctrl_1 { gpio_power_key: power_key { samsung,pins = "gpx1-3";
@@ -184,6 +178,11 @@ samsung,pins = "gpx3-7"; samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>; }; + + emmc_rstn: emmc-rstn { + samsung,pins = "gpk1-2"; + samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>; + }; }; &ehci {
Greg Kroah-Hartman
maintainerPATCH 132/149 ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit a66352e005488ecb4b534ba1af58a9f671eba9b8 upstream.
Add minimal parameters needed by the Exynos CLKOUT driver to Exynos3250 PMU node. This fixes the following warning on boot:
exynos_clkout_init: failed to register clkout clock
--- arch/arm/boot/dts/exynos3250.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/boot/dts/exynos3250.dtsi +3 -0
@@ -168,6 +168,9 @@ interrupt-controller; #interrupt-cells = <3>; interrupt-parent = <&gic>; + clock-names = "clkout8"; + clocks = <&cmu CLK_FIN_PLL>; + #clock-cells = <1>; }; mipi_phy: video-phy {
Greg Kroah-Hartman
maintainerPATCH 133/149 ARM: dts: exynos: Fix max voltage for buck8 regulator on Odroid XU3/XU4
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit a3238924a820c1d7c977b632b769f3b5690cba09 upstream.
The maximum voltage value for buck8 regulator on Odroid XU3/XU4 boards is set too low. Increase it to the 2000mV as specified on the board schematic. So far the board worked fine, because of the bug in the PMIC driver, which used incorrect step value for that regulator. It interpreted the voltage value set by the bootloader as 1225mV and kept it unchanged. The regulator driver has been however fixed recently in the commit 56b5d4ea778c ("regulator: s2mps11: Fix steps for buck7, buck8 and LDO35"), what results in reading the proper buck8 value and forcing it to 1500mV on boot. This is not enough for proper board operation and results in eMMC errors during heavy IO traffic. Increasing maximum voltage value for buck8 restores original driver behavior and fixes eMMC issues.
--- arch/arm/boot/dts/exynos5422-odroid-core.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos5422-odroid-core.dtsi +1 -1
@@ -334,7 +334,7 @@ buck8_reg: BUCK8 { regulator-name = "vdd_1.8v_ldo"; regulator-min-microvolt = <800000>; - regulator-max-microvolt = <1500000>; + regulator-max-microvolt = <2000000>; regulator-always-on; regulator-boot-on; };
Greg Kroah-Hartman
maintainerPATCH 134/149 drm: disable uncached DMA optimization for ARM and arm64
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e02f5c1bb2283cfcee68f2f0feddcc06150f13aa ]
The DRM driver stack is designed to work with cache coherent devices only, but permits an optimization to be enabled in some cases, where for some buffers, both the CPU and the GPU use uncached mappings, removing the need for DMA snooping and allocation in the CPU caches.
The use of uncached GPU mappings relies on the correct implementation of the PCIe NoSnoop TLP attribute by the platform, otherwise the GPU will use cached mappings nonetheless. On x86 platforms, this does not seem to matter, as uncached CPU mappings will snoop the caches in any case. However, on ARM and arm64, enabling this optimization on a platform where NoSnoop is ignored results in loss of coherency, which breaks correct operation of the device. Since we have no way of detecting whether NoSnoop works or not, just disable this optimization entirely for ARM and arm64.
--- include/drm/drm_cache.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
include/drm/drm_cache.h +18 -0
@@ -47,6 +47,24 @@ static inline bool drm_arch_can_wc_memory(void)return false;#elif defined(CONFIG_MIPS ) && defined(CONFIG_CPU_LOONGSON3 )return false; +#elif defined(CONFIG_ARM ) || defined(CONFIG_ARM64 ) +/* +* The DRM driver stack is designed to work with cache coherent devices +* only, but permits an optimization to be enabled in some cases, where +* for some buffers, both the CPU and the GPU use uncached mappings, +* removing the need for DMA snooping and allocation in the CPU caches. +* +* The use of uncached GPU mappings relies on the correct implementation +* of the PCIe NoSnoop TLP attribute by the platform, otherwise the GPU +* will use cached mappings nonetheless. On x86 platforms, this does not +* seem to matter, as uncached CPU mappings will snoop the caches in any +* case. However, on ARM and arm64, enabling this optimization on a +* platform where NoSnoop is ignored results in loss of coherency, which +* breaks correct operation of the device. Since we have no way of +* detecting whether NoSnoop works or not, just disable this +* optimization entirely for ARM and arm64. +*/ +return false;#else return true;#endif
Signature · 8 lines
2.19.1 _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
Greg Kroah-Hartman
maintainerPATCH 135/149 netfilter: xt_TEE: fix wrong interface selection
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f24d2d4f9586985509320f90308723d3d0c4e47f ]
TEE netdevice notifier handler checks only interface name. however each netns can have same interface name. hence other netns's interface could be selected.
test commands:
%ip netns add vm1
%iptables -I INPUT -p icmp -j TEE --gateway 192.168.1.1 --oif enp2s0 %ip link set enp2s0 netns vm1
Above rule is in the root netns. but that rule could get enp2s0 ifindex of vm1 by notifier handler.
After this patch, TEE rule is added to the per-netns list.
--- net/netfilter/xt_TEE.c | 69 +++++++++++++++++++++++++++++++----------- 1 file changed, 52 insertions(+), 17 deletions(-)
net/netfilter/xt_TEE.c +52 -17
@@ -14,6 +14,8 @@#include <linux/skbuff.h> #include <linux/route.h> #include <linux/netfilter/x_tables.h> +#include <net/net_namespace.h> +#include <net/netns/generic.h> #include <net/route.h> #include <net/netfilter/ipv4/nf_dup_ipv4.h> #include <net/netfilter/ipv6/nf_dup_ipv6.h>
@@ -25,8 +27,15 @@ struct xt_tee_priv {int oif; }; +static unsigned int tee_net_id__read_mostly ;static const union nf_inet_addr tee_zero_address; +struct tee_net { +struct list_head priv_list; +/* lock protects the priv_list */ +struct mutex lock; +}; +static unsigned int tee_tg4 (struct sk_buff *skb,const struct xt_action_param *par) {
@@ -51,17 +60,16 @@ tee_tg6(struct sk_buff *skb, const struct xt_action_param *par) }#endif -static DEFINE_MUTEX (priv_list_mutex); -static LIST_HEAD (priv_list); -static int tee_netdev_event (struct notifier_block *this,unsigned long event,void *ptr) {struct net_device *dev =netdev_notifier_info_to_dev (ptr); +struct net *net =dev_net (dev); +struct tee_net *tn =net_generic (net, tee_net_id);struct xt_tee_priv *priv; -mutex_lock (&priv_list_mutex); -list_for_each_entry (priv, &priv_list, list) { +mutex_lock (&tn->lock); +list_for_each_entry (priv, &tn->priv_list, list) {switch (event) {case NETDEV_REGISTER :if (!strcmp (dev->name, priv->tginfo->oif))
@@ -79,13 +87,14 @@ static int tee_netdev_event(struct notifier_block *this, unsigned long event,break ; } } -mutex_unlock (&priv_list_mutex); +mutex_unlock (&tn->lock);return NOTIFY_DONE ; }static int tee_tg_check (const struct xt_tgchk_param *par) { +struct tee_net *tn =net_generic (par->net, tee_net_id);struct xt_tee_tginfo *info = par->targinfo;struct xt_tee_priv *priv;
@@ -106,9 +115,9 @@ static int tee_tg_check(const struct xt_tgchk_param *par) priv->oif =-1 ; info->priv = priv; -mutex_lock (&priv_list_mutex); -list_add (&priv->list, &priv_list); -mutex_unlock (&priv_list_mutex); +mutex_lock (&tn->lock); +list_add (&priv->list, &tn->priv_list); +mutex_unlock (&tn->lock); }else info->priv =NULL ;
@@ -118,12 +127,13 @@ static int tee_tg_check(const struct xt_tgchk_param *par)static void tee_tg_destroy (const struct xt_tgdtor_param *par) { +struct tee_net *tn =net_generic (par->net, tee_net_id);struct xt_tee_tginfo *info = par->targinfo;if (info->priv) { -mutex_lock (&priv_list_mutex); +mutex_lock (&tn->lock);list_del (&info->priv->list); -mutex_unlock (&priv_list_mutex); +mutex_unlock (&tn->lock);kfree (info->priv); }static_key_slow_dec (&xt_tee_enabled);
@@ -156,6 +166,21 @@ static struct xt_target tee_tg_reg[] __read_mostly = {#endif }; +static int __net_init tee_net_init (struct net *net) +{ +struct tee_net *tn =net_generic (net, tee_net_id); + +INIT_LIST_HEAD (&tn->priv_list); +mutex_init (&tn->lock); +return 0 ; +} + +static struct pernet_operations tee_net_ops = { + .init = tee_net_init, + .id = &tee_net_id, + .size =sizeof (struct tee_net ), +}; +static struct notifier_block tee_netdev_notifier = { .notifier_call = tee_netdev_event, };
@@ -164,22 +189,32 @@ static int __init tee_tg_init(void) {int ret; - ret =xt_register_targets (tee_tg_reg,ARRAY_SIZE (tee_tg_reg)); -if (ret) + ret =register_pernet_subsys (&tee_net_ops); +if (ret <0 )return ret; + + ret =xt_register_targets (tee_tg_reg,ARRAY_SIZE (tee_tg_reg)); +if (ret <0 ) + goto cleanup_subsys; + ret =register_netdevice_notifier (&tee_netdev_notifier); -if (ret) { -xt_unregister_targets (tee_tg_reg,ARRAY_SIZE (tee_tg_reg)); -return ret; - } +if (ret <0 ) + goto unregister_targets;return 0 ; + +unregister_targets: +xt_unregister_targets (tee_tg_reg,ARRAY_SIZE (tee_tg_reg)); +cleanup_subsys: +unregister_pernet_subsys (&tee_net_ops); +return ret; } static void __exit tee_tg_exit(void) {unregister_netdevice_notifier (&tee_netdev_notifier);xt_unregister_targets (tee_tg_reg,ARRAY_SIZE (tee_tg_reg)); +unregister_pernet_subsys (&tee_net_ops); }module_init (tee_tg_init);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 136/149 netfilter: xt_TEE: add missing code to get interface index in checkentry.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 18c0ab87364ac5128a152055fdcb1d27e01caf01 ]
checkentry(tee_tg_check) should initialize priv->oif from dev if possible. But only netdevice notifier handler can set that.
Hence priv->oif is always -1 until notifier handler is called.
--- net/netfilter/xt_TEE.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/netfilter/xt_TEE.c +7 -0
@@ -104,6 +104,8 @@ static int tee_tg_check(const struct xt_tgchk_param *par)return -EINVAL ;if (info->oif[0 ]) { +struct net_device *dev; +if (info->oif[sizeof (info->oif)-1 ] !='\0' )return -EINVAL ;
@@ -115,6 +117,11 @@ static int tee_tg_check(const struct xt_tgchk_param *par) priv->oif =-1 ; info->priv = priv; + dev =dev_get_by_name (par->net, info->oif); +if (dev) { + priv->oif = dev->ifindex; +dev_put (dev); + }mutex_lock (&tn->lock);list_add (&priv->list, &tn->priv_list);mutex_unlock (&tn->lock);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 137/149 gfs2: Fix missed wakeups in find_insert_glock
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
commit 605b0487f0bc1ae9963bf52ece0f5c8055186f81 upstream.
Mark Syms has reported seeing tasks that are stuck waiting in find_insert_glock. It turns out that struct lm_lockname contains four padding bytes on 64-bit architectures that function glock_waitqueue doesn't skip when hashing the glock name. As a result, we can end up waking up the wrong waitqueue, and the waiting tasks may be stuck forever.
Fix that by using ht_parms.key_len instead of sizeof(struct lm_lockname) for the key length.
--- fs/gfs2/glock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/gfs2/glock.c +1 -1
@@ -107,7 +107,7 @@ static int glock_wake_function(wait_queustatic wait_queue_head_t *glock_waitqueue (struct lm_lockname *name) { -u32 hash =jhash2 ((u32 *)name,sizeof (*name) /4 ,0 ); +u32 hash =jhash2 ((u32 *)name, ht_parms.key_len /4 ,0 );return glock_wait_table +hash_32 (hash,GLOCK_WAIT_TABLE_BITS ); }
Greg Kroah-Hartman
maintainerPATCH 138/149 staging: erofs: add error handling for xattr submodule
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
commit cadf1ccf1b0021d0b7a9347e102ac5258f9f98c8 upstream.
This patch enhances the missing error handling code for xattr submodule, which improves the stability for the rare cases.
--- drivers/staging/erofs/internal.h | 5 + drivers/staging/erofs/xattr.c | 112 +++++++++++++++++++++++++++------------ 2 files changed, 81 insertions(+), 36 deletions(-)
drivers/staging/erofs/internal.h +3 -2
@@ -485,8 +485,9 @@ struct erofs_map_blocks_iter { }; -static inline struct page *erofs_get_inline_page (struct inode *inode, -erofs_blk_t blkaddr) +static inline struct page * +erofs_get_inline_page (struct inode *inode, +erofs_blk_t blkaddr) {return erofs_get_meta_page (inode->i_sb, blkaddr,S_ISDIR (inode->i_mode));
drivers/staging/erofs/xattr.c +78 -34
258 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 139/149 staging: erofs: fix fast symlink w/o xattr when fs xattr is on
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
commit 7077fffcb0b0b65dc75e341306aeef4d0e7f2ec6 upstream.
Currently, this will hit a BUG_ON for these symlinks as follows:
- kernel message
------------[ cut here ]------------ kernel BUG at drivers/staging/erofs/xattr.c:59! SMP PTI CPU: 1 PID: 1170 Comm: getllxattr Not tainted 4.20.0-rc6+ #92 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014 RIP: 0010:init_inode_xattrs+0x22b/0x270 Code: 48 0f 45 ea f0 ff 4d 34 74 0d 41 83 4c 24 e0 01 31 c0 e9 00 fe ff ff 48 89 ef e8 e0 31 9e ff eb e9 89 e8 e9 ef fd ff ff 0f 0$ <0f> 0b 48 89 ef e8 fb f6 9c ff 48 8b 45 08 a8 01 75 24 f0 ff 4d 34 RSP: 0018:ffffa03ac026bdf8 EFLAGS: 00010246 ------------[ cut here ]------------ ... Call Trace: erofs_listxattr+0x30/0x2c0 ? selinux_inode_listxattr+0x5a/0x80 ? kmem_cache_alloc+0x33/0x170 ? security_inode_listxattr+0x27/0x40 listxattr+0xaf/0xc0 path_listxattr+0x5a/0xa0 do_syscall_64+0x43/0xf0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ... ---[ end trace 3c24b49408dc0c72 ]---
Fix it by checking ->xattr_isize in init_inode_xattrs(), and it also fixes improper return value -ENOTSUPP (it should be -ENODATA if xattr is enabled) for those inodes.
--- drivers/staging/erofs/inode.c | 8 ++++---- drivers/staging/erofs/xattr.c | 25 ++++++++++++++++++++----- 2 files changed, 24 insertions(+), 9 deletions(-)
drivers/staging/erofs/inode.c +4 -4
@@ -184,16 +184,16 @@ static int fill_inode(struct inode *inod/* setup the new inode */ if (S_ISREG (inode->i_mode)) {#ifdef CONFIG_EROFS_FS_XATTR -if (vi->xattr_isize) - inode->i_op = &erofs_generic_xattr_iops; + inode->i_op = &erofs_generic_xattr_iops;#endif inode->i_fop = &generic_ro_fops; }else if (S_ISDIR (inode->i_mode)) { inode->i_op = #ifdef CONFIG_EROFS_FS_XATTR - vi->xattr_isize ? &erofs_dir_xattr_iops : -#endif + &erofs_dir_xattr_iops; +#else &erofs_dir_iops; +#endif inode->i_fop = &erofs_dir_fops; }else if (S_ISLNK (inode->i_mode)) {/* by default, page_get_link is used for symlink */
drivers/staging/erofs/xattr.c +20 -5
@@ -55,7 +55,26 @@ static int init_inode_xattrs(struct inodreturn 0 ; vi =EROFS_V (inode); -BUG_ON (!vi->xattr_isize); + +/* +* bypass all xattr operations if ->xattr_isize is not greater than +* sizeof(struct erofs_xattr_ibody_header), in detail: +* 1) it is not enough to contain erofs_xattr_ibody_header then +* ->xattr_isize should be 0 (it means no xattr); +* 2) it is just to contain erofs_xattr_ibody_header, which is on-disk +* undefined right now (maybe use later with some new sb feature). +*/ +if (vi->xattr_isize ==sizeof (struct erofs_xattr_ibody_header )) { +errln ("xattr_isize %d of nid %llu is not supported yet" , + vi->xattr_isize, vi->nid); +return -ENOTSUPP ; + }else if (vi->xattr_isize <sizeof (struct erofs_xattr_ibody_header )) { +if (unlikely (vi->xattr_isize)) { +DBG_BUGON (1 ); +return -EIO ;/* xattr ondisk layout error */ + } +return -ENOATTR ; + } sbi =EROFS_I_SB (inode); it.blkaddr =erofs_blknr (iloc (sbi, vi->nid) + vi->inode_isize);
@@ -414,7 +433,6 @@ static int erofs_xattr_generic_get(const struct dentry *unused, struct inode *inode, const char *name, void *buffer, size_t size) { - struct erofs_vnode *const vi = EROFS_V(inode); struct erofs_sb_info *const sbi = EROFS_I_SB(inode);switch (handler->flags) {
@@ -432,9 +450,6 @@ static int erofs_xattr_generic_get(constreturn -EINVAL ; } -if (!vi->xattr_isize) -return -ENOATTR ; -return erofs_getxattr (inode, handler->flags, name, buffer, size); }
Greg Kroah-Hartman
maintainerPATCH 140/149 staging: erofs: fix memleak of inodes shared xattr array
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
From: Sheng Yong <[email protected]>
commit 3b1b5291f79d040d549d7c746669fc30e8045b9b upstream.
If it fails to read a shared xattr page, the inode's shared xattr array is not freed. The next time the inode's xattr is accessed, the previously allocated array is leaked.
--- drivers/staging/erofs/xattr.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/staging/erofs/xattr.c +4 -1
@@ -109,8 +109,11 @@ static int init_inode_xattrs(struct inod it.page =erofs_get_meta_page (inode->i_sb, ++it.blkaddr,S_ISDIR (inode->i_mode)); -if (IS_ERR (it.page)) +if (IS_ERR (it.page)) { +kfree (vi->xattr_shared_xattrs); + vi->xattr_shared_xattrs =NULL ;return PTR_ERR (it.page); + } it.kaddr =kmap_atomic (it.page); atomic_map = true;
Greg Kroah-Hartman
maintainerPATCH 141/149 staging: erofs: fix race of initializing xattrs of a inode at the same time
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
commit 62dc45979f3f8cb0ea67302a93bff686f0c46c5a upstream.
In real scenario, there could be several threads accessing xattrs of the same xattr-uninitialized inode, and init_inode_xattrs() almost at the same time.
That's actually an unexpected behavior, this patch closes the race.
--- drivers/staging/erofs/internal.h | 11 +++++++--- drivers/staging/erofs/xattr.c | 41 +++++++++++++++++++++++++++------------ 2 files changed, 37 insertions(+), 15 deletions(-)
drivers/staging/erofs/internal.h +8 -3
@@ -327,12 +327,17 @@ static inline erofs_off_t iloc(struct erreturn blknr_to_addr (sbi->meta_blkaddr) + (nid << sbi->islotbits); } -#define inode_set_inited_xattr (inode) (EROFS_V(inode)->flags |= 1) -#define inode_has_inited_xattr (inode) (EROFS_V(inode)->flags & 1) +/* atomic flag definitions */ +#define EROFS_V_EA_INITED_BIT 0 + +/* bitlock definitions (arranged in reverse order) */ +#define EROFS_V_BL_XATTR_BIT (BITS_PER_LONG - 1)struct erofs_vnode {erofs_nid_t nid; -unsigned int flags; + +/* atomic flags (including bitlocks) */ +unsigned long flags;unsigned char data_mapping_mode;/* inline size in bytes */
drivers/staging/erofs/xattr.c +29 -12
89 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 142/149 staging: erofs: keep corrupted fs from crashing kernel in erofs_namei()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
commit 419d6efc50e94bcf5d6b35cd8c71f79edadec564 upstream.
As Al pointed out, "
... and while we are at it, what happens to
unsigned int nameoff = le16_to_cpu(de[mid].nameoff); unsigned int matched = min(startprfx, endprfx); struct qstr dname = QSTR_INIT(data + nameoff, unlikely(mid >= ndirents - 1) ? maxsize - nameoff : le16_to_cpu(de[mid + 1].nameoff) - nameoff); /* string comparison without already matched prefix */ int ret = dirnamecmp(name, &dname, &matched);
if le16_to_cpu(de[...].nameoff) is not monotonically increasing? I.e. what's to prevent e.g. (unsigned)-1 ending up in dname.len?
Corrupted fs image shouldn't oops the kernel.. "
Revisit the related lookup flow to address the issue.
--- drivers/staging/erofs/namei.c | 189 ++++++++++++++++++++++-------------------- 1 file changed, 100 insertions(+), 89 deletions(-)
drivers/staging/erofs/namei.c +100 -89
@@ -15,74 +15,77 @@#include <trace/events/erofs.h> -/* based on the value of qn->len is accurate */ -static inline int dirnamecmp (struct qstr *qn, -struct qstr *qd,unsigned *matched) +struct erofs_qstr { +const unsigned char *name; +const unsigned char *end; +}; + +/* based on the end of qn is accurate and it must have the trailing '\0' */ +static inline int dirnamecmp (const struct erofs_qstr *qn, +const struct erofs_qstr *qd, +unsigned int *matched) { -unsigned i = *matched, len =min (qn->len, qd->len); -loop: -if (unlikely (i >= len)) { - *matched = i; -if (qn->len < qd->len) { -/* -* actually (qn->len == qd->len) -* when qd->name[i] == '\0' -*/ -return qd->name[i] =='\0' ?0 :-1 ; - } -return (qn->len > qd->len); - } +unsigned int i = *matched; -if (qn->name[i] != qd->name[i]) { - *matched = i; -return qn->name[i] > qd->name[i] ?1 :-1 ; +/* +* on-disk error, let's only BUG_ON in the debugging mode. +* otherwise, it will return 1 to just skip the invalid name +* and go on (in consideration of the lookup performance). +*/ +DBG_BUGON (qd->name > qd->end); + +/* qd could not have trailing '\0' */ +/* However it is absolutely safe if < qd->end */ +while (qd->name + i < qd->end && qd->name[i] !='\0' ) { +if (qn->name[i] != qd->name[i]) { + *matched = i; +return qn->name[i] > qd->name[i] ?1 :-1 ; + } + ++i; } - - ++i; - goto loop; + *matched = i; +/* See comments in __d_alloc on the terminating NUL character */ +return qn->name[i] =='\0' ?0 :1 ; } -static struct erofs_dirent *find_target_dirent ( -struct qstr *name, -u8 *data,int maxsize) +#define nameoff_from_disk (off, sz) (le16_to_cpu(off) & ((sz) - 1)) + +static struct erofs_dirent *find_target_dirent (struct erofs_qstr *name, +u8 *data, +unsigned int dirblksize, +const int ndirents) { -unsigned ndirents, head, back; -unsigned startprfx, endprfx; +int head, back; +unsigned int startprfx, endprfx;struct erofs_dirent *const de = (struct erofs_dirent *)data; -/* make sure that maxsize is valid */ -BUG_ON (maxsize <sizeof (struct erofs_dirent )); - - ndirents =le16_to_cpu (de->nameoff) /sizeof (*de); - -/* corrupted dir (may be unnecessary...) */ -BUG_ON (!ndirents); - - head =0 ; +/* since the 1st dirent has been evaluated previously */ + head =1 ; back = ndirents -1 ; startprfx = endprfx =0 ;while (head <= back) { -unsigned mid = head + (back - head) /2 ; -unsigned nameoff =le16_to_cpu (de[mid].nameoff); -unsigned matched =min (startprfx, endprfx); - -struct qstr dname =QSTR_INIT (data + nameoff, -unlikely (mid >= ndirents -1 ) ? - maxsize - nameoff : -le16_to_cpu (de[mid +1 ].nameoff) - nameoff); +const int mid = head + (back - head) /2 ; +const int nameoff =nameoff_from_disk (de[mid].nameoff, + dirblksize); +unsigned int matched =min (startprfx, endprfx); +struct erofs_qstr dname = { + .name = data + nameoff, + .end =unlikely (mid >= ndirents -1 ) ? + data + dirblksize : + data +nameoff_from_disk (de[mid +1 ].nameoff, + dirblksize) + };/* string comparison without already matched prefix */ int ret =dirnamecmp (name, &dname, &matched); -if (unlikely (!ret)) +if (unlikely (!ret)) {return de + mid; -else if (ret >0 ) { + }else if (ret >0 ) { head = mid +1 ; startprfx = matched; - }else if (unlikely (mid <1 ))/* fix "mid" overflow */ -break ; -else { + }else { back = mid -1 ; endprfx = matched; }
@@ -91,12 +94,12 @@ static struct erofs_dirent *find_target_return ERR_PTR (-ENOENT ); } -static struct page *find_target_block_classic ( -struct inode *dir, -struct qstr *name,int *_diff) +static struct page *find_target_block_classic (struct inode *dir, +struct erofs_qstr *name, +int *_ndirents) { -unsigned startprfx, endprfx; -unsigned head, back; +unsigned int startprfx, endprfx; +int head, back;struct address_space *const mapping = dir->i_mapping;struct page *candidate =ERR_PTR (-ENOENT );
@@ -105,41 +108,43 @@ static struct page *find_target_block_cl back =inode_datablocks (dir) -1 ;while (head <= back) { -unsigned mid = head + (back - head) /2 ; +const int mid = head + (back - head) /2 ;struct page *page =read_mapping_page (mapping, mid,NULL ); -if (IS_ERR (page)) { -exact_out: -if (!IS_ERR (candidate))/* valid candidate */ -put_page (candidate); -return page; - }else { -int diff; -unsigned ndirents, matched; -struct qstr dname; +if (!IS_ERR (page)) {struct erofs_dirent *de =kmap_atomic (page); -unsigned nameoff =le16_to_cpu (de->nameoff); - - ndirents = nameoff /sizeof (*de); +const int nameoff =nameoff_from_disk (de->nameoff, +EROFS_BLKSIZ ); +const int ndirents = nameoff /sizeof (*de); +int diff; +unsigned int matched; +struct erofs_qstr dname; -/* corrupted dir (should have one entry at least) */ -BUG_ON (!ndirents || nameoff >PAGE_SIZE ); +if (unlikely (!ndirents)) { +DBG_BUGON (1 ); +kunmap_atomic (de); +put_page (page); + page =ERR_PTR (-EIO ); + goto out; + } matched =min (startprfx, endprfx); dname.name = (u8 *)de + nameoff; - dname.len = ndirents ==1 ? -/* since the rest of the last page is 0 */ -EROFS_BLKSIZ - nameoff - :le16_to_cpu (de[1 ].nameoff) - nameoff; +if (ndirents ==1 ) + dname.end = (u8 *)de +EROFS_BLKSIZ ; +else + dname.end = (u8 *)de + +nameoff_from_disk (de[1 ].nameoff, +EROFS_BLKSIZ );/* string comparison without already matched prefix */ diff =dirnamecmp (name, &dname, &matched);kunmap_atomic (de);if (unlikely (!diff)) { - *_diff =0 ; - goto exact_out; + *_ndirents =0 ; + goto out; }else if (diff >0 ) { head = mid +1 ; startprfx = matched;
@@ -147,45 +152,51 @@ exact_out:if (likely (!IS_ERR (candidate)))put_page (candidate); candidate = page; + *_ndirents = ndirents; }else {put_page (page); -if (unlikely (mid <1 ))/* fix "mid" overflow */ -break ; - back = mid -1 ; endprfx = matched; } +continue ; } +out:/* free if the candidate is valid */ +if (!IS_ERR (candidate)) +put_page (candidate); +return page; } - *_diff =1 ;return candidate; }int erofs_namei (struct inode *dir, -struct qstr *name, -erofs_nid_t *nid,unsigned *d_type) +struct qstr *name, +erofs_nid_t *nid,unsigned int *d_type) { -int diff; +int ndirents;struct page *page; -u8 *data; +void *data;struct erofs_dirent *de; +struct erofs_qstr qn;if (unlikely (!dir->i_size))return -ENOENT ; - diff =1 ; - page =find_target_block_classic (dir, name, &diff); + qn.name = name->name; + qn.end = name->name + name->len; + + ndirents =0 ; + page =find_target_block_classic (dir, &qn, &ndirents);if (unlikely (IS_ERR (page)))return PTR_ERR (page); data =kmap_atomic (page);/* the target page has been mapped */ - de =likely (diff) ? -/* since the rest of the last page is 0 */ -find_target_dirent (name, data,EROFS_BLKSIZ ) : - (struct erofs_dirent *)data; +if (ndirents) + de =find_target_dirent (&qn, data,EROFS_BLKSIZ , ndirents); +else + de = (struct erofs_dirent *)data;if (likely (!IS_ERR (de))) { *nid =le64_to_cpu (de->nid);
Greg Kroah-Hartman
maintainerPATCH 143/149 cifs: allow calling SMB2_xxx_free(NULL)
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronnie Sahlberg <[email protected]>
commit 32a1fb36f6e50183871c2c1fcf5493c633e84732 upstream.
Change these free functions to allow passing NULL as the argument and treat it as a no-op just like free(NULL) would.
Or, if rqst->rq_iov is NULL.
The second scenario could happen for smb2_queryfs() if the call to SMB2_query_info_init() fails and we go to qfs_exit to clean up and free all resources.
In that case we have not yet assigned rqst[2].rq_iov and thus the rq_iov dereference in SMB2_close_free() will cause a NULL pointer dereference.
[ bp: upstream patch also fixes SMB2_set_info_free which was introduced in 4.20 ]
--- fs/cifs/smb2pdu.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
fs/cifs/smb2pdu.c +10 -6
@@ -2243,10 +2243,12 @@ SMB2_open_free(struct smb_rqst *rqst) {int i; -cifs_small_buf_release (rqst->rq_iov[0 ].iov_base); -for (i =1 ; i < rqst->rq_nvec; i++) -if (rqst->rq_iov[i].iov_base != smb2_padding) -kfree (rqst->rq_iov[i].iov_base); +if (rqst && rqst->rq_iov) { +cifs_small_buf_release (rqst->rq_iov[0 ].iov_base); +for (i =1 ; i < rqst->rq_nvec; i++) +if (rqst->rq_iov[i].iov_base != smb2_padding) +kfree (rqst->rq_iov[i].iov_base); + } }int
@@ -2535,7 +2537,8 @@ SMB2_close_init(struct cifs_tcon *tcon,void SMB2_close_free (struct smb_rqst *rqst) { -cifs_small_buf_release (rqst->rq_iov[0 ].iov_base);/* request */ +if (rqst && rqst->rq_iov) +cifs_small_buf_release (rqst->rq_iov[0 ].iov_base);/* request */ }int
@@ -2685,7 +2688,8 @@ SMB2_query_info_init(struct cifs_tcon *tvoid SMB2_query_info_free (struct smb_rqst *rqst) { -cifs_small_buf_release (rqst->rq_iov[0 ].iov_base);/* request */ +if (rqst && rqst->rq_iov) +cifs_small_buf_release (rqst->rq_iov[0 ].iov_base);/* request */ } static int
Greg Kroah-Hartman
maintainerPATCH 144/149 ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel F. Dickinson <[email protected]>
commit ce938231bd3b1d7af3cbd8836f084801090470e1 upstream.
ath9k_of_init() function[0] was initially written on the assumption that if someone had an explicit ath9k OF node that "there must be something wrong, why would someone add an OF node if everything is fine"[1] (Quoting Martin Blumenstingl <[email protected]>)
"it turns out it's not that simple. with your requirements I'm now aware of two use-cases where the current code in ath9k_of_init() doesn't work without modifications"[1]
The "your requirements" Martin speaks of is the result of the fact that I have a device (PowerCloud Systems CR5000) has some kind of default - not unique mac address - set and requires to set the correct MAC address via mac-address devicetree property, however:
"some cards come with a physical EEPROM chip [or OTP] so "qca,no-eeprom" should not be set (your use-case). in this case AH_USE_EEPROM should be set (which is the default when there is no OF node)"[1]
The other use case is:
the firmware on some PowerMac G5 seems to add a OF node for the ath9k card automatically. depending on the EEPROM on the card AH_NO_EEP_SWAP should be unset (which is the default when there is no OF node). see [3]
After this patch to ath9k_of_init() the new behavior will be:
if there's no OF node then everything is the same as before if there's an empty OF node then ath9k will use the hardware EEPROM
(before ath9k would fail to initialize because no EEPROM data was provided by userspace)
if there's an OF node with only a MAC address then ath9k will use
the MAC address and the hardware EEPROM (see the case above)
with "qca,no-eeprom" EEPROM data from userspace will be requested.
the behavior here will not change
[1]
Martin provides additional background on EEPROM swapping[1].
Thanks to Christian Lamparter <[email protected]> for all his help on troubleshooting this issue and the basis for this patch.
[0]https://elixir.bootlin.com/linux/v4.20-rc7/source/drivers/net/wireless/ath/ath9k/init.c#L615 [1]https://github.com/openwrt/openwrt/pull/1645#issuecomment-448027058 [2]https://github.com/openwrt/openwrt/pull/1613 [3]https://patchwork.kernel.org/patch/10241731/
--- drivers/net/wireless/ath/ath9k/init.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath9k/init.c +3 -3
@@ -636,15 +636,15 @@ static int ath9k_of_init(struct ath_soft ret =ath9k_eeprom_request (sc, eeprom_name);if (ret)return ret; + + ah->ah_flags &= ~AH_USE_EEPROM ; + ah->ah_flags |=AH_NO_EEP_SWAP ; } mac =of_get_mac_address (np);if (mac)ether_addr_copy (common->macaddr, mac); - ah->ah_flags &= ~AH_USE_EEPROM ; - ah->ah_flags |=AH_NO_EEP_SWAP ; -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 145/149 driver core: Postpone DMA tear-down until after devres release
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
commit 376991db4b6464e906d699ef07681e2ffa8ab08c upstream.
When unbinding the (IOMMU-enabled) R-Car SATA device on Salvator-XS (R-Car H3 ES2.0), in preparation of rebinding against vfio-platform for device pass-through for virtualization:
echo ee300000.sata > /sys/bus/platform/drivers/sata_rcar/unbind
the kernel crashes with:
Unable to handle kernel paging request at virtual address ffffffbf029ffffc
Mem abort info:
ESR = 0x96000006
Exception class = DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
swapper pgtable: 4k pages, 39-bit VAs, pgdp = 000000007e8c586c [ffffffbf029ffffc] pgd=000000073bfc6003, pud=000000073bfc6003, pmd=0000000000000000
Internal error: Oops: 96000006 [#1] SMP Modules linked in: CPU: 0 PID: 1098 Comm: bash Not tainted 5.0.0-rc5-salvator-x-00452-g37596f884f4318ef #287 Hardware name: Renesas Salvator-X 2nd version board based on r8a7795 ES2.0+ (DT) pstate: 60400005 (nZCv daif +PAN -UAO) pc : __free_pages+0x8/0x58 lr : __dma_direct_free_pages+0x50/0x5c
sp : ffffff801268baa0
x29: ffffff801268baa0 x28: 0000000000000000
x27: ffffffc6f9c60bf0 x26: ffffffc6f9c60bf0
x25: ffffffc6f9c60810 x24: 0000000000000000
x23: 00000000fffff000 x22: ffffff8012145000
x21: 0000000000000800 x20: ffffffbf029fffc8
x19: 0000000000000000 x18: ffffffc6f86c42c8
x17: 0000000000000000 x16: 0000000000000070
x15: 0000000000000003 x14: 0000000000000000
x13: ffffff801103d7f8 x12: 0000000000000028
x11: ffffff8011117604 x10: 0000000000009ad8
x9 : ffffff80110126d0 x8 : ffffffc6f7563000
x7 : 6b6b6b6b6b6b6b6b x6 : 0000000000000018
x5 : ffffff8011cf3cc8 x4 : 0000000000004000
x3 : 0000000000080000 x2 : 0000000000000001
x1 : 0000000000000000 x0 : ffffffbf029fffc8 Process bash (pid: 1098, stack limit = 0x00000000c38e3e32)
Call trace: __free_pages+0x8/0x58 __dma_direct_free_pages+0x50/0x5c arch_dma_free+0x1c/0x98 dma_direct_free+0x14/0x24 dma_free_attrs+0x9c/0xdc dmam_release+0x18/0x20 release_nodes+0x25c/0x28c devres_release_all+0x48/0x4c device_release_driver_internal+0x184/0x1f0 device_release_driver+0x14/0x1c unbind_store+0x70/0xb8 drv_attr_store+0x24/0x34 sysfs_kf_write+0x4c/0x64 kernfs_fop_write+0x154/0x1c4 __vfs_write+0x34/0x164 vfs_write+0xb4/0x16c ksys_write+0x5c/0xbc __arm64_sys_write+0x14/0x1c el0_svc_common+0x98/0x114 el0_svc_handler+0x1c/0x24 el0_svc+0x8/0xc Code: d51b4234 17fffffa a9bf7bfd 910003fd (b9403404) ---[ end trace 8c564cdd3a1a840f ]---
While I've bisected this to commit e8e683ae9a736407 ("iommu/of: Fix probe-deferral"), and reverting that commit on post-v5.0-rc4 kernels does fix the problem, this turned out to be a red herring.
On arm64, arch_teardown_dma_ops() resets dev->dma_ops to NULL. Hence if a driver has used a managed DMA allocation API, the allocated DMA memory will be freed using the direct DMA ops, while it may have been allocated using a custom DMA ops (iommu_dma_ops in this case).
Fix this by reversing the order of the calls to devres_release_all() and arch_teardown_dma_ops().
[rm: backport for 4.12-4.19 - kernels before 5.0 will not see
the crash above, but may get silent memory corruption instead]
--- drivers/base/dd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/dd.c +1 -1
@@ -963,9 +963,9 @@ static void __device_release_driver(stru drv->remove (dev);device_links_driver_cleanup (dev); -dma_deconfigure (dev);devres_release_all (dev); +dma_deconfigure (dev); dev->driver =NULL ;dev_set_drvdata (dev,NULL );if (dev->pm_domain && dev->pm_domain->dismiss)
Greg Kroah-Hartman
maintainerPATCH 146/149 perf/x86/intel: Make cpuc allocations consistent
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Peter Zijlstra (Intel)" <[email protected]>
commit d01b1f96a82e5dd7841a1d39db3abfdaf95f70ab upstream
The cpuc data structure allocation is different between fake and real cpuc's; use the same code to init/free both.
--- arch/x86/events/core.c | 13 +++++-------- arch/x86/events/intel/core.c | 29 ++++++++++++++++++----------- arch/x86/events/perf_event.h | 11 ++++++++--- 3 files changed, 31 insertions(+), 22 deletions(-)
arch/x86/events/core.c +5 -8
@@ -1970,7 +1970,7 @@ static int x86_pmu_commit_txn(struct pmu*/ static void free_fake_cpuc (struct cpu_hw_events *cpuc) { -kfree (cpuc->shared_regs); +intel_cpuc_finish (cpuc);kfree (cpuc); }
@@ -1982,14 +1982,11 @@ static struct cpu_hw_events *allocate_fa cpuc =kzalloc (sizeof (*cpuc),GFP_KERNEL );if (!cpuc)return ERR_PTR (-ENOMEM ); - -/* only needed, if we have extra_regs */ -if (x86_pmu.extra_regs) { - cpuc->shared_regs =allocate_shared_regs (cpu); -if (!cpuc->shared_regs) - goto error; - } cpuc->is_fake =1 ; + +if (intel_cpuc_prepare (cpuc, cpu)) + goto error; +return cpuc; error:free_fake_cpuc (cpuc);
arch/x86/events/intel/core.c +18 -11
@@ -3282,7 +3282,7 @@ ssize_t intel_event_sysfs_show(char *pagreturn x86_event_sysfs_show (page, config, event); } -struct intel_shared_regs *allocate_shared_regs (int cpu) +static struct intel_shared_regs *allocate_shared_regs (int cpu) {struct intel_shared_regs *regs;int i;
@@ -3314,10 +3314,9 @@ static struct intel_excl_cntrs *allocatereturn c; } -static int intel_pmu_cpu_prepare (int cpu) -{ -struct cpu_hw_events *cpuc = &per_cpu (cpu_hw_events, cpu); +int intel_cpuc_prepare (struct cpu_hw_events *cpuc,int cpu) +{if (x86_pmu.extra_regs || x86_pmu.lbr_sel_map) { cpuc->shared_regs =allocate_shared_regs (cpu);if (!cpuc->shared_regs)
@@ -3327,7 +3326,7 @@ static int intel_pmu_cpu_prepare(int cpuif (x86_pmu.flags &PMU_FL_EXCL_CNTRS ) {size_t sz =X86_PMC_IDX_MAX *sizeof (struct event_constraint ); - cpuc->constraint_list =kzalloc (sz,GFP_KERNEL ); + cpuc->constraint_list =kzalloc_node (sz,GFP_KERNEL ,cpu_to_node (cpu));if (!cpuc->constraint_list) goto err_shared_regs;
@@ -3352,6 +3351,11 @@ err:return -ENOMEM ; } +static int intel_pmu_cpu_prepare (int cpu) +{ +return intel_cpuc_prepare (&per_cpu (cpu_hw_events, cpu), cpu); +} +static void flip_smm_bit (void *data) {unsigned long set = *(unsigned long *)data;
@@ -3423,9 +3427,8 @@ static void intel_pmu_cpu_starting(int c } } -static void free_excl_cntrs (int cpu) +static void free_excl_cntrs (struct cpu_hw_events *cpuc) { -struct cpu_hw_events *cpuc = &per_cpu (cpu_hw_events, cpu);struct intel_excl_cntrs *c; c = cpuc->excl_cntrs;
@@ -3443,9 +3446,8 @@ static void intel_pmu_cpu_dying(int cpu)fini_debug_store_on_cpu (cpu); } -static void intel_pmu_cpu_dead (int cpu) +void intel_cpuc_finish (struct cpu_hw_events *cpuc) { -struct cpu_hw_events *cpuc = &per_cpu (cpu_hw_events, cpu);struct intel_shared_regs *pc; pc = cpuc->shared_regs;
@@ -3455,7 +3457,12 @@ static void intel_pmu_cpu_dead(int cpu) cpuc->shared_regs =NULL ; } -free_excl_cntrs (cpu); +free_excl_cntrs (cpuc); +} + +static void intel_pmu_cpu_dead (int cpu) +{ +intel_cpuc_finish (&per_cpu (cpu_hw_events, cpu)); } static void intel_pmu_sched_task(struct perf_event_context *ctx,
@@ -4515,7 +4522,7 @@ static __init int fixup_ht_bug(void)hardlockup_detector_perf_restart ();for_each_online_cpu (c) -free_excl_cntrs (c); +free_excl_cntrs (&per_cpu (cpu_hw_events, c));cpus_read_unlock ();pr_info ("PMU erratum BJ122, BV98, HSD29 workaround disabled, HT off\n" );
arch/x86/events/perf_event.h +8 -3
@@ -887,7 +887,8 @@ struct event_constraint * x86_get_event_constraints(struct cpu_hw_events *cpuc, int idx, struct perf_event *event); -struct intel_shared_regs *allocate_shared_regs (int cpu); +extern int intel_cpuc_prepare (struct cpu_hw_events *cpuc,int cpu); +extern void intel_cpuc_finish (struct cpu_hw_events *cpuc);int intel_pmu_init (void );
@@ -1023,9 +1024,13 @@ static inline int intel_pmu_init(void)return 0 ; } -static inline struct intel_shared_regs *allocate_shared_regs (int cpu) +static inline int intel_cpuc_prepare (struct cpu_hw_event *cpuc,int cpu) +{ +return 0 ; +} + +static inline void intel_cpuc_finish (struct cpu_hw_event *cpuc) { -return NULL ; }static inline int is_ht_workaround_enabled (void )
Greg Kroah-Hartman
maintainerPATCH 147/149 perf/x86/intel: Generalize dynamic constraint creation
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Peter Zijlstra (Intel)" <[email protected]>
commit 11f8b2d65ca9029591c8df26bb6bd063c312b7fe upstream
Such that we can re-use it.
--- arch/x86/events/intel/core.c | 51 +++++++++++++++++++++++++------------------ 1 file changed, 30 insertions(+), 21 deletions(-)
arch/x86/events/intel/core.c +30 -21
@@ -2653,6 +2653,35 @@ intel_stop_scheduling(struct cpu_hw_even }static struct event_constraint * +dyn_constraint (struct cpu_hw_events *cpuc,struct event_constraint *c,int idx) +{ +WARN_ON_ONCE (!cpuc->constraint_list); + +if (!(c->flags &PERF_X86_EVENT_DYNAMIC )) { +struct event_constraint *cx; + +/* +* grab pre-allocated constraint entry +*/ + cx = &cpuc->constraint_list[idx]; + +/* +* initialize dynamic constraint +* with static constraint +*/ + *cx = *c; + +/* +* mark constraint as dynamic +*/ + cx->flags |=PERF_X86_EVENT_DYNAMIC ; + c = cx; + } + +return c; +} + +static struct event_constraint *intel_get_excl_constraints (struct cpu_hw_events *cpuc,struct perf_event *event,int idx,struct event_constraint *c) {
@@ -2682,27 +2711,7 @@ intel_get_excl_constraints(struct cpu_hw* only needed when constraint has not yet * been cloned (marked dynamic) */ -if (!(c->flags &PERF_X86_EVENT_DYNAMIC )) { -struct event_constraint *cx; - -/* -* grab pre-allocated constraint entry -*/ - cx = &cpuc->constraint_list[idx]; - -/* -* initialize dynamic constraint -* with static constraint -*/ - *cx = *c; - -/* -* mark constraint as dynamic, so we -* can free it later on -*/ - cx->flags |=PERF_X86_EVENT_DYNAMIC ; - c = cx; - } + c =dyn_constraint (cpuc, c, idx);/* * From here on, the constraint is dynamic.
Greg Kroah-Hartman
maintainerPATCH 148/149 x86: Add TSX Force Abort CPUID/MSR
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Peter Zijlstra (Intel)" <[email protected]>
commit 52f64909409c17adf54fcf5f9751e0544ca3a6b4 upstream
Skylake systems will receive a microcode update to address a TSX errata. This microcode will (by default) clobber PMC3 when TSX instructions are (speculatively or not) executed.
It also provides an MSR to cause all TSX transaction to abort and preserve PMC3.
Add the CPUID enumeration and MSR definition.
--- arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/msr-index.h | 6 ++++++ 2 files changed, 7 insertions(+)
arch/x86/include/asm/cpufeatures.h +1 -0
@@ -340,6 +340,7 @@/* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */ #define X86_FEATURE_AVX512_4VNNIW (18*32+ 2)/* AVX-512 Neural Network Instructions */ #define X86_FEATURE_AVX512_4FMAPS (18*32+ 3)/* AVX-512 Multiply Accumulation Single precision */ +#define X86_FEATURE_TSX_FORCE_ABORT (18*32+13)/* "" TSX_FORCE_ABORT */ #define X86_FEATURE_PCONFIG (18*32+18)/* Intel PCONFIG */ #define X86_FEATURE_SPEC_CTRL (18*32+26)/* "" Speculation Control (IBRS + IBPB) */ #define X86_FEATURE_INTEL_STIBP (18*32+27)/* "" Single Thread Indirect Branch Predictors */
arch/x86/include/asm/msr-index.h +6 -0
@@ -629,6 +629,12 @@#define MSR_IA32_TSC_DEADLINE 0x000006E0 + +#define MSR_TSX_FORCE_ABORT 0x0000010F + +#define MSR_TFA_RTM_FORCE_ABORT_BIT 0 +#define MSR_TFA_RTM_FORCE_ABORT BIT_ULL(MSR_TFA_RTM_FORCE_ABORT_BIT) +/* P4/Xeon+ specific */ #define MSR_IA32_MCG_EAX 0x00000180#define MSR_IA32_MCG_EBX 0x00000181
Greg Kroah-Hartman
maintainerPATCH 149/149 perf/x86/intel: Implement support for TSX Force Abort
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Peter Zijlstra (Intel)" <[email protected]>
commit 400816f60c543153656ac74eaf7f36f6b7202378 upstream
Skylake (and later) will receive a microcode update to address a TSX errata. This microcode will, on execution of a TSX instruction (speculative or not) use (clobber) PMC3. This update will also provide a new MSR to change this behaviour along with a CPUID bit to enumerate the presence of this new MSR.
When the MSR gets set; the microcode will no longer use PMC3 but will Force Abort every TSX transaction (upon executing COMMIT).
When TSX Force Abort (TFA) is allowed (default); the MSR gets set when PMC3 gets scheduled and cleared when, after scheduling, PMC3 is unused.
When TFA is not allowed; clear PMC3 from all constraints such that it will not get used.
--- arch/x86/events/intel/core.c | 74 +++++++++++++++++++++++++++++++++++++++++-- arch/x86/events/perf_event.h | 6 +++ 2 files changed, 77 insertions(+), 3 deletions(-)
arch/x86/events/intel/core.c +71 -3
@@ -1995,6 +1995,39 @@ static void intel_pmu_nhm_enable_all(intintel_pmu_enable_all (added); } +static void intel_set_tfa (struct cpu_hw_events *cpuc,bool on) +{ +u64 val = on ?MSR_TFA_RTM_FORCE_ABORT :0 ; + +if (cpuc->tfa_shadow != val) { + cpuc->tfa_shadow = val; +wrmsrl (MSR_TSX_FORCE_ABORT , val); + } +} + +static void intel_tfa_commit_scheduling (struct cpu_hw_events *cpuc,int idx,int cntr) +{ +/* +* We're going to use PMC3, make sure TFA is set before we touch it. +*/ +if (cntr ==3 && !cpuc->is_fake) +intel_set_tfa (cpuc, true); +} + +static void intel_tfa_pmu_enable_all (int added) +{ +struct cpu_hw_events *cpuc =this_cpu_ptr (&cpu_hw_events); + +/* +* If we find PMC3 is no longer used when we enable the PMU, we can +* clear TFA. +*/ +if (!test_bit (3 , cpuc->active_mask)) +intel_set_tfa (cpuc, false); + +intel_pmu_enable_all (added); +} +static inline u64 intel_pmu_get_status (void ) {u64 status;
@@ -3238,6 +3271,26 @@ glp_get_event_constraints(struct cpu_hw_return c; } +static bool allow_tsx_force_abort = true; + +static struct event_constraint * +tfa_get_event_constraints (struct cpu_hw_events *cpuc,int idx, +struct perf_event *event) +{ +struct event_constraint *c =hsw_get_event_constraints (cpuc, idx, event); + +/* +* Without TFA we must not use PMC3. +*/ +if (!allow_tsx_force_abort &&test_bit (3 , c->idxmsk)) { + c =dyn_constraint (cpuc, c, idx); + c->idxmsk64 &= ~(1ULL <<3 ); + c->weight--; + } + +return c; +} +/* * Broadwell: *
@@ -3332,13 +3385,15 @@ int intel_cpuc_prepare(struct cpu_hw_eve goto err; } -if (x86_pmu.flags &PMU_FL_EXCL_CNTRS ) { +if (x86_pmu.flags & (PMU_FL_EXCL_CNTRS |PMU_FL_TFA )) {size_t sz =X86_PMC_IDX_MAX *sizeof (struct event_constraint ); cpuc->constraint_list =kzalloc_node (sz,GFP_KERNEL ,cpu_to_node (cpu));if (!cpuc->constraint_list) goto err_shared_regs; + } +if (x86_pmu.flags &PMU_FL_EXCL_CNTRS ) { cpuc->excl_cntrs =allocate_excl_cntrs (cpu);if (!cpuc->excl_cntrs) goto err_constraint_list;
@@ -3445,9 +3500,10 @@ static void free_excl_cntrs(struct cpu_hif (c->core_id ==-1 || --c->refcnt ==0 )kfree (c); cpuc->excl_cntrs =NULL ; -kfree (cpuc->constraint_list); - cpuc->constraint_list =NULL ; } + +kfree (cpuc->constraint_list); + cpuc->constraint_list =NULL ; }static void intel_pmu_cpu_dying (int cpu)
@@ -3933,8 +3989,11 @@ static struct attribute *intel_pmu_caps_ NULL }; +DEVICE_BOOL_ATTR (allow_tsx_force_abort,0644 , allow_tsx_force_abort); +static struct attribute *intel_pmu_attrs[] = { &dev_attr_freeze_on_smi.attr, +NULL ,/* &dev_attr_allow_tsx_force_abort.attr.attr */ NULL , };
@@ -4390,6 +4449,15 @@ __init int intel_pmu_init(void) x86_pmu.cpu_events =get_hsw_events_attrs ();intel_pmu_pebs_data_source_skl ( boot_cpu_data.x86_model ==INTEL_FAM6_SKYLAKE_X ); + +if (boot_cpu_has (X86_FEATURE_TSX_FORCE_ABORT )) { + x86_pmu.flags |=PMU_FL_TFA ; + x86_pmu.get_event_constraints = tfa_get_event_constraints; + x86_pmu.enable_all = intel_tfa_pmu_enable_all; + x86_pmu.commit_scheduling = intel_tfa_commit_scheduling; + intel_pmu_attrs[1 ] = &dev_attr_allow_tsx_force_abort.attr.attr; + } +pr_cont ("Skylake events, " ); name ="skylake" ;break ;
arch/x86/events/perf_event.h +6 -0
@@ -243,6 +243,11 @@ struct cpu_hw_events {int excl_thread_id;/* 0 or 1 */ /* +* SKL TSX_FORCE_ABORT shadow +*/ +u64 tfa_shadow; + +/* * AMD specific bits */ struct amd_nb *amd_nb;
@@ -679,6 +684,7 @@ do { \#define PMU_FL_EXCL_CNTRS 0x4/* has exclusive counter requirements */ #define PMU_FL_EXCL_ENABLED 0x8/* exclusive counter active */ #define PMU_FL_PEBS_ALL 0x10/* all events are valid PEBS events */ +#define PMU_FL_TFA 0x20/* deal with TSX force abort */ #define EVENT_VAR (_id) event_attr_##_id#define EVENT_PTR (_id) &event_attr_##_id.attr.attr
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.29 release. There are 149 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Mar 14 17:02:30 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.29-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.19.29-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.19.y
git commit: 6d884178544e4eca1bd21c4626e16346f7e5aa9e
git describe: v4.19.28-150-g6d884178544e
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.19-oe/build/v4.19.28-150-g6d884178544e
No regressions (compared to build v4.19.28)
No fixes (compared to build v4.19.28)
Ran 23131 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
Test Suites
-----------
* boot
* install-android-platform-tools-r2600
* kselftest
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-timers-tests
* spectre-meltdown-checker-test
* ltp-open-posix-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.29 release. There are 149 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Mar 14 17:02:30 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.29-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.19:
11 builds: 11 pass, 0 fail
22 boots: 22 pass, 0 fail
28 tests: 28 pass, 0 failLinux version: 4.19.29-rc1-g6d88417
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04Cheers
Jon
Signature · 1 line
nvpublic
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.29 release. There are 149 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Mar 14 17:02:30 UTC 2019. Anything received after that time might be too late.
Build results:
total: 156 pass: 156 fail: 0 Qemu test results: total: 345 pass: 345 fail: 0
Guenter