5.5.3-stable review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 272/367 drm/amdgpu/navi10: add OD_RANGE for navi overclocking
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
commit ee23a518fdc2c1dd1aaaf3a2c7ffdd6c83b396ec upstream.
So users can see the range of valid values.
--- drivers/gpu/drm/amd/powerplay/navi10_ppt.c | 59 +++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+)
drivers/gpu/drm/amd/powerplay/navi10_ppt.c +59 -0
@@ -710,6 +710,15 @@ static inline bool navi10_od_feature_is_return od_table->cap[feature]; } +static void navi10_od_setting_get_range (struct smu_11_0_overdrive_table *od_table, +enum SMU_11_0_ODSETTING_ID setting, +uint32_t *min,uint32_t *max) +{ +if (min) + *min = od_table->min[setting]; +if (max) + *max = od_table->max[setting]; +}static int navi10_print_clk_levels (struct smu_context *smu,enum smu_clk_type clk_type,char *buf)
@@ -728,6 +737,7 @@ static int navi10_print_clk_levels(strucOverDriveTable_t *od_table = (OverDriveTable_t *)table_context->overdrive_table;struct smu_11_0_overdrive_table *od_settings = smu->od_settings; +uint32_t min_value, max_value;switch (clk_type) {case SMU_GFXCLK :
@@ -841,6 +851,55 @@ static int navi10_print_clk_levels(struc size +=sprintf (buf + size,"%d: %uMHz @ %umV\n" , i, curve_settings[0 ], curve_settings[1 ] /NAVI10_VOLTAGE_SCALE ); }break ; +case SMU_OD_RANGE : +if (!smu->od_enabled || !od_table || !od_settings) +break ; + size =sprintf (buf,"%s:\n" ,"OD_RANGE" ); + +if (navi10_od_feature_is_supported (od_settings,SMU_11_0_ODFEATURE_GFXCLK_LIMITS )) { +navi10_od_setting_get_range (od_settings,SMU_11_0_ODSETTING_GFXCLKFMIN , + &min_value,NULL ); +navi10_od_setting_get_range (od_settings,SMU_11_0_ODSETTING_GFXCLKFMAX , +NULL , &max_value); + size +=sprintf (buf + size,"SCLK: %7uMhz %10uMhz\n" , + min_value, max_value); + } + +if (navi10_od_feature_is_supported (od_settings,SMU_11_0_ODFEATURE_UCLK_MAX )) { +navi10_od_setting_get_range (od_settings,SMU_11_0_ODSETTING_UCLKFMAX , + &min_value, &max_value); + size +=sprintf (buf + size,"MCLK: %7uMhz %10uMhz\n" , + min_value, max_value); + } + +if (navi10_od_feature_is_supported (od_settings,SMU_11_0_ODFEATURE_GFXCLK_CURVE )) { +navi10_od_setting_get_range (od_settings,SMU_11_0_ODSETTING_VDDGFXCURVEFREQ_P1 , + &min_value, &max_value); + size +=sprintf (buf + size,"VDDC_CURVE_SCLK[0]: %7uMhz %10uMhz\n" , + min_value, max_value); +navi10_od_setting_get_range (od_settings,SMU_11_0_ODSETTING_VDDGFXCURVEVOLTAGE_P1 , + &min_value, &max_value); + size +=sprintf (buf + size,"VDDC_CURVE_VOLT[0]: %7dmV %11dmV\n" , + min_value, max_value); +navi10_od_setting_get_range (od_settings,SMU_11_0_ODSETTING_VDDGFXCURVEFREQ_P2 , + &min_value, &max_value); + size +=sprintf (buf + size,"VDDC_CURVE_SCLK[1]: %7uMhz %10uMhz\n" , + min_value, max_value); +navi10_od_setting_get_range (od_settings,SMU_11_0_ODSETTING_VDDGFXCURVEVOLTAGE_P2 , + &min_value, &max_value); + size +=sprintf (buf + size,"VDDC_CURVE_VOLT[1]: %7dmV %11dmV\n" , + min_value, max_value); +navi10_od_setting_get_range (od_settings,SMU_11_0_ODSETTING_VDDGFXCURVEFREQ_P3 , + &min_value, &max_value); + size +=sprintf (buf + size,"VDDC_CURVE_SCLK[2]: %7uMhz %10uMhz\n" , + min_value, max_value); +navi10_od_setting_get_range (od_settings,SMU_11_0_ODSETTING_VDDGFXCURVEVOLTAGE_P3 , + &min_value, &max_value); + size +=sprintf (buf + size,"VDDC_CURVE_VOLT[2]: %7dmV %11dmV\n" , + min_value, max_value); + } + +break ;default :break ; }
Greg Kroah-Hartman
maintainerPATCH 273/367 drm/amdgpu/smu_v11_0: Correct behavior of restoring default tables (v2)
In reply to Greg Kroah-HartmanFrom: Matt Coffin <[email protected]>
commit 93c5f1f66c6ad4a3b180c1644f74e1b3b4be7864 upstream.
Previously, the syfs functionality for restoring the default powerplay table was sourcing it's information from the currently-staged powerplay table.
This patch adds a step to cache the first overdrive table that we see on boot, so that it can be used later to "restore" the powerplay table
v2: sqaush my original with Matt's fix
--- drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h | 1 drivers/gpu/drm/amd/powerplay/navi10_ppt.c | 7 ++++++ drivers/gpu/drm/amd/powerplay/smu_v11_0.c | 6 +++++ drivers/gpu/drm/amd/powerplay/vega20_ppt.c | 28 +++++++------------------ 4 files changed, 22 insertions(+), 20 deletions(-)
drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h +1 -0
@@ -263,6 +263,7 @@ struct smu_table_contextuint8_t thermal_controller_type;void *overdrive_table; +void *boot_overdrive_table; };struct smu_dpm_context {
drivers/gpu/drm/amd/powerplay/navi10_ppt.c +7 -0
@@ -2020,6 +2020,13 @@ static int navi10_od_edit_dpm_table(strureturn ret; od_table->UclkFmax = input[1 ];break ; +case PP_OD_RESTORE_DEFAULT_TABLE : +if (!(table_context->overdrive_table && table_context->boot_overdrive_table)) { +pr_err ("Overdrive table was not initialized!\n" ); +return -EINVAL ; + } +memcpy (table_context->overdrive_table, table_context->boot_overdrive_table,sizeof (OverDriveTable_t)); +break ;case PP_OD_COMMIT_DPM_TABLE :navi10_dump_od_table (od_table); ret =smu_update_table (smu,SMU_TABLE_OVERDRIVE ,0 , (void *)od_table, true);
drivers/gpu/drm/amd/powerplay/smu_v11_0.c +6 -0
@@ -1807,6 +1807,12 @@ int smu_v11_0_set_default_od_settings(stpr_err ("Failed to export overdrive table!\n" );return ret; } +if (!table_context->boot_overdrive_table) { + table_context->boot_overdrive_table =kmemdup (table_context->overdrive_table, overdrive_table_size,GFP_KERNEL ); +if (!table_context->boot_overdrive_table) { +return -ENOMEM ; + } + } } ret =smu_update_table (smu,SMU_TABLE_OVERDRIVE ,0 , table_context->overdrive_table, true);if (ret) {
drivers/gpu/drm/amd/powerplay/vega20_ppt.c +8 -20
@@ -1702,22 +1702,11 @@ static int vega20_set_default_od_settingstruct smu_table_context *table_context = &smu->smu_table;int ret; -if (initialize) { -if (table_context->overdrive_table) -return -EINVAL ; - - table_context->overdrive_table =kzalloc (sizeof (OverDriveTable_t),GFP_KERNEL ); - -if (!table_context->overdrive_table) -return -ENOMEM ; - - ret =smu_update_table (smu,SMU_TABLE_OVERDRIVE ,0 , - table_context->overdrive_table, false); -if (ret) { -pr_err ("Failed to export over drive table!\n" ); -return ret; - } + ret =smu_v11_0_set_default_od_settings (smu, initialize,sizeof (OverDriveTable_t)); +if (ret) +return ret; +if (initialize) { ret =vega20_set_default_od8_setttings (smu);if (ret)return ret;
@@ -2774,12 +2763,11 @@ static int vega20_odn_edit_dpm_table(strbreak ;case PP_OD_RESTORE_DEFAULT_TABLE : - ret =smu_update_table (smu,SMU_TABLE_OVERDRIVE ,0 , table_context->overdrive_table, false); -if (ret) { -pr_err ("Failed to export over drive table!\n" ); -return ret; +if (!(table_context->overdrive_table && table_context->boot_overdrive_table)) { +pr_err ("Overdrive table was not initialized!\n" ); +return -EINVAL ; } - +memcpy (table_context->overdrive_table, table_context->boot_overdrive_table,sizeof (OverDriveTable_t));break ;case PP_OD_COMMIT_DPM_TABLE :
Greg Kroah-Hartman
maintainerPATCH 274/367 virtio-balloon: initialize all vq callbacks
In reply to Greg Kroah-HartmanFrom: Daniel Verkamp <[email protected]>
commit 5790b53390e18fdd21e70776e46d058c05eda2f2 upstream.
Ensure that elements of the callbacks array that correspond to unavailable features are set to NULL; previously, they would be left uninitialized.
Since the corresponding names array elements were explicitly set to NULL, the uninitialized callback pointers would not actually be dereferenced; however, the uninitialized callbacks elements would still be read in vp_find_vqs_msix() and used to calculate the number of MSI-X vectors required.
--- drivers/virtio/virtio_balloon.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/virtio/virtio_balloon.c +2 -0
@@ -475,7 +475,9 @@ static int init_vqs(struct virtio_balloo names[VIRTIO_BALLOON_VQ_INFLATE ] ="inflate" ; callbacks[VIRTIO_BALLOON_VQ_DEFLATE ] = balloon_ack; names[VIRTIO_BALLOON_VQ_DEFLATE ] ="deflate" ; + callbacks[VIRTIO_BALLOON_VQ_STATS ] =NULL ; names[VIRTIO_BALLOON_VQ_STATS ] =NULL ; + callbacks[VIRTIO_BALLOON_VQ_FREE_PAGE ] =NULL ; names[VIRTIO_BALLOON_VQ_FREE_PAGE ] =NULL ;if (virtio_has_feature (vb->vdev,VIRTIO_BALLOON_F_STATS_VQ )) {
Greg Kroah-Hartman
maintainerPATCH 275/367 virtio-pci: check name when counting MSI-X vectors
In reply to Greg Kroah-HartmanFrom: Daniel Verkamp <[email protected]>
commit 303090b513fd1ee45aa1536b71a3838dc054bc05 upstream.
VQs without a name specified are not valid; they are skipped in the later loop that assigns MSI-X vectors to queues, but the per_vq_vectors loop above that counts the required number of vectors previously still counted any queue with a non-NULL callback as needing a vector.
Add a check to the per_vq_vectors loop so that vectors with no name are not counted to make the two loops consistent. This prevents over-counting unnecessary vectors (e.g. for features which were not negotiated with the device).
--- drivers/virtio/virtio_pci_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/virtio/virtio_pci_common.c +1 -1
@@ -294,7 +294,7 @@ static int vp_find_vqs_msix(struct virti/* Best option: one for change interrupt, one per vq. */ nvectors =1 ;for (i =0 ; i < nvqs; ++i) -if (callbacks[i]) +if (names[i] && callbacks[i]) ++nvectors; }else {/* Second best: one for change, shared for all vqs. */
Greg Kroah-Hartman
maintainerPATCH 276/367 fix up iter on short count in fuse_direct_io()
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit f658adeea45e430a24c7a157c3d5448925ac2038 upstream.
fuse_direct_io() can end up advancing the iterator by more than the amount of data read or written. This case is handled by the generic code if going through ->direct_IO(), but not in the FOPEN_DIRECT_IO case.
Fix by reverting the extra bytes from the iterator in case of error or a short count.
To test: install lxcfs, then the following testcase
int fd = open("/var/lib/lxcfs/proc/uptime", O_RDONLY); sendfile(1, fd, NULL, 16777216);
sendfile(1, fd, NULL, 16777216);
will spew WARN_ON() in iov_iter_pipe().
--- fs/fuse/file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/fuse/file.c +4 -1
@@ -1465,6 +1465,7 @@ ssize_t fuse_direct_io(struct fuse_io_pr } ia =NULL ;if (nres <0 ) { +iov_iter_revert (iter, nbytes); err = nres;break ; }
@@ -1473,8 +1474,10 @@ ssize_t fuse_direct_io(struct fuse_io_pr count -= nres; res += nres; pos += nres; -if (nres != nbytes) +if (nres != nbytes) { +iov_iter_revert (iter, nbytes - nres);break ; + }if (count) { max_pages =iov_iter_npages (iter, fc->max_pages); ia =fuse_io_alloc (io, max_pages);
Greg Kroah-Hartman
maintainerPATCH 277/367 broken ping to ipv6 linklocal addresses on debian buster
In reply to Greg Kroah-HartmanFrom: Casey Schaufler <[email protected]>
commit 87fbfffcc89b92a4281b0aa53bd06af714087889 upstream.
I am seeing ping failures to IPv6 linklocal addresses with Debian buster. Easiest example to reproduce is:
$ ping -c1 -w1 ff02::1%eth1 connect: Invalid argument
$ ping -c1 -w1 ff02::1%eth1 PING ff02::01%eth1(ff02::1%eth1) 56 data bytes 64 bytes from fe80::e0:f9ff:fe0c:37%eth1: icmp_seq=1 ttl=64 time=0.059 ms
git bisect traced the failure to
commit b9ef5513c99b ("smack: Check address length before reading address family")
Arguably ping is being stupid since the buster version is not setting the address family properly (ping on stretch for example does):
$ strace -e connect ping6 -c1 -w1 ff02::1%eth1
connect(5, {sa_family=AF_UNSPEC,
sa_data="\4\1\0\0\0\0\377\2\0\0\0\0\0\0\0\0\0\0\0\0\0\1\3\0\0\0"}, 28)
= -1 EINVAL (Invalid argument)but the command works fine on kernels prior to this commit, so this is breakage which goes against the Linux paradigm of "don't break userspace"
security/smack/smack_lsm.c | 41 +++++++++++++++++++----------------------
security/smack/smack_lsm.c | 41 +++++++++++++++++++---------------------- 1 file changed, 19 insertions(+), 22 deletions(-)
security/smack/smack_lsm.c +19 -22
@@ -2831,42 +2831,39 @@ static int smack_socket_connect(struct s int addrlen) {int rc =0 ; -#if IS_ENABLED (CONFIG_IPV6 ) -struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap; -#endif -#ifdef SMACK_IPV6_SECMARK_LABELING -struct smack_known *rsp; -struct socket_smack *ssp; -#endif if (sock->sk ==NULL )return 0 ; - +if (sock->sk->sk_family !=PF_INET && + (!IS_ENABLED (CONFIG_IPV6 ) || sock->sk->sk_family !=PF_INET6 )) +return 0 ; + if (addrlen < offsetofend(struct sockaddr, sa_family)) +return 0 ; +if (IS_ENABLED (CONFIG_IPV6 ) && sap->sa_family ==AF_INET6 ) { +struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap;#ifdef SMACK_IPV6_SECMARK_LABELING - ssp = sock->sk->sk_security; +struct smack_known *rsp;#endif -switch (sock->sk->sk_family) { -case PF_INET : -if (addrlen <sizeof (struct sockaddr_in ) || - sap->sa_family !=AF_INET ) -return -EINVAL ; - rc =smack_netlabel_send (sock->sk, (struct sockaddr_in *)sap); -break ; -case PF_INET6 : -if (addrlen <SIN6_LEN_RFC2133 || sap->sa_family !=AF_INET6 ) -return -EINVAL ; +if (addrlen <SIN6_LEN_RFC2133 ) +return 0 ;#ifdef SMACK_IPV6_SECMARK_LABELING rsp =smack_ipv6host_label (sip); -if (rsp !=NULL ) +if (rsp !=NULL ) { +struct socket_smack *ssp = sock->sk->sk_security; + rc =smk_ipv6_check (ssp->smk_out, rsp, sip, -SMK_CONNECTING ); +SMK_CONNECTING ); + }#endif #ifdef SMACK_IPV6_PORT_LABELING rc =smk_ipv6_port_check (sock->sk, sip,SMK_CONNECTING );#endif -break ; +return rc; } +if (sap->sa_family !=AF_INET || addrlen <sizeof (struct sockaddr_in )) +return 0 ; + rc =smack_netlabel_send (sock->sk, (struct sockaddr_in *)sap);return rc; }
Greg Kroah-Hartman
maintainerPATCH 278/367 percpu: Separate decrypted varaibles anytime encryption can be enabled
In reply to Greg Kroah-HartmanFrom: Erdem Aktas <[email protected]>
commit 264b0d2bee148073c117e7bbbde5be7125a53be1 upstream.
CONFIG_VIRTUALIZATION may not be enabled for memory encrypted guests. If disabled, decrypted per-CPU variables may end up sharing the same page with variables that should be left encrypted.
Always separate per-CPU variables that should be decrypted into their own page anytime memory encryption can be enabled in the guest rather than rely on any other config option that may not be enabled.
--- include/linux/percpu-defs.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
include/linux/percpu-defs.h +1 -2
@@ -175,8 +175,7 @@* Declaration/definition used for per-CPU variables that should be accessed * as decrypted when memory encryption is enabled in the guest. */ -#if defined(CONFIG_VIRTUALIZATION ) && defined(CONFIG_AMD_MEM_ENCRYPT ) - +#ifdef CONFIG_AMD_MEM_ENCRYPT #define DECLARE_PER_CPU_DECRYPTED (type, name) \ DECLARE_PER_CPU_SECTION(type, name, "..decrypted")
Greg Kroah-Hartman
maintainerPATCH 279/367 ASoC: meson: axg-fifo: fix fifo threshold setup
In reply to Greg Kroah-HartmanFrom: Jerome Brunet <[email protected]>
commit 864cee90d4bd870e5d5e5a0b1a6f055f4f951350 upstream.
On TODDR sm1, the fifo threshold register field is slightly different compared to the other SoCs. This leads to the fifo A being flushed to memory every 8kB. If the period is smaller than that, several periods are pushed to memory and notified at once. This is not ideal.
Fix the register field update. With this, the fifos are flushed every 128B. We could still do better, like adapt the threshold depending on the period size, but at least it consistent across the different SoC/fifos
--- sound/soc/meson/axg-fifo.c | 27 +++++++++++++++++++++++++-- sound/soc/meson/axg-fifo.h | 6 ++++-- sound/soc/meson/axg-frddr.c | 24 ++++++++++++------------ sound/soc/meson/axg-toddr.c | 21 +++++++++------------ 4 files changed, 50 insertions(+), 28 deletions(-)
sound/soc/meson/axg-fifo.c +25 -2
@@ -113,10 +113,12 @@ int axg_fifo_pcm_hw_params(struct snd_so {struct snd_pcm_runtime *runtime = ss->runtime;struct axg_fifo *fifo =axg_fifo_data (ss); +unsigned int burst_num, period, threshold;dma_addr_t end_ptr; -unsigned int burst_num;int ret; + period =params_period_bytes (params); + ret =snd_pcm_lib_malloc_pages (ss,params_buffer_bytes (params));if (ret <0 )return ret;
@@ -127,9 +129,25 @@ int axg_fifo_pcm_hw_params(struct snd_soregmap_write (fifo->map,FIFO_FINISH_ADDR , end_ptr);/* Setup interrupt periodicity */ - burst_num =params_period_bytes (params) /AXG_FIFO_BURST ; + burst_num = period /AXG_FIFO_BURST ;regmap_write (fifo->map,FIFO_INT_ADDR , burst_num); +/* +* Start the fifo request on the smallest of the following: +* - Half the fifo size +* - Half the period size +*/ + threshold =min (period /2 , + (unsigned int )AXG_FIFO_MIN_DEPTH /2 ); + +/* +* With the threshold in bytes, register value is: +* V = (threshold / burst) - 1 +*/ + threshold /=AXG_FIFO_BURST ; +regmap_field_write (fifo->field_threshold, + threshold ? threshold -1 :0 ); +/* Enable block count irq */ regmap_update_bits(fifo->map, FIFO_CTRL0, CTRL0_INT_EN(FIFO_INT_COUNT_REPEAT),
@@ -352,6 +370,11 @@ int axg_fifo_probe(struct platform_devicreturn fifo->irq; } + fifo->field_threshold = +devm_regmap_field_alloc (dev, fifo->map, data->field_threshold); +if (IS_ERR (fifo->field_threshold)) +return PTR_ERR (fifo->field_threshold); +return devm_snd_soc_register_component (dev, data->component_drv, data->dai_drv,1 ); }
sound/soc/meson/axg-fifo.h +4 -2
@@ -9,7 +9,9 @@struct clk ;struct platform_device ; +struct reg_field ;struct regmap ; +struct regmap_field ;struct reset_control ;struct snd_soc_component_driver ;
@@ -50,8 +52,6 @@ struct snd_soc_pcm_runtime;#define CTRL1_STATUS2_SEL_MASK GENMASK(11, 8)#define CTRL1_STATUS2_SEL (x) ((x) << 8)#define STATUS2_SEL_DDR_READ 0 -#define CTRL1_THRESHOLD_MASK GENMASK(23, 16) -#define CTRL1_THRESHOLD (x) ((x) << 16)#define CTRL1_FRDDR_DEPTH_MASK GENMASK(31, 24)#define CTRL1_FRDDR_DEPTH (x) ((x) << 24)#define FIFO_START_ADDR 0x08
@@ -67,12 +67,14 @@ struct axg_fifo {struct regmap *map;struct clk *pclk;struct reset_control *arb; +struct regmap_field *field_threshold;int irq; };struct axg_fifo_match_data {const struct snd_soc_component_driver *component_drv;struct snd_soc_dai_driver *dai_drv; +struct reg_field field_threshold; }; int axg_fifo_pcm_open(struct snd_soc_component *component,
sound/soc/meson/axg-frddr.c +12 -12
@@ -50,7 +50,7 @@ static int axg_frddr_dai_startup(struct struct snd_soc_dai *dai) {struct axg_fifo *fifo =snd_soc_dai_get_drvdata (dai); -unsigned int fifo_depth, fifo_threshold; +unsigned int fifo_depth;int ret;/* Enable pclk to access registers and clock the fifo ip */
@@ -68,11 +68,8 @@ static int axg_frddr_dai_startup(struct* Depth and threshold are zero based. */ fifo_depth =AXG_FIFO_MIN_CNT -1 ; - fifo_threshold = (AXG_FIFO_MIN_CNT /2 ) -1 ; -regmap_update_bits (fifo->map,FIFO_CTRL1 , -CTRL1_FRDDR_DEPTH_MASK |CTRL1_THRESHOLD_MASK , -CTRL1_FRDDR_DEPTH (fifo_depth) | -CTRL1_THRESHOLD (fifo_threshold)); +regmap_update_bits (fifo->map,FIFO_CTRL1 ,CTRL1_FRDDR_DEPTH_MASK , +CTRL1_FRDDR_DEPTH (fifo_depth));return 0 ; }
@@ -159,8 +156,9 @@ static const struct snd_soc_component_dr };static const struct axg_fifo_match_data axg_frddr_match_data = { - .component_drv = &axg_frddr_component_drv, - .dai_drv = &axg_frddr_dai_drv + .field_threshold =REG_FIELD (FIFO_CTRL1 ,16 ,23 ), + .component_drv = &axg_frddr_component_drv, + .dai_drv = &axg_frddr_dai_drv };static const struct snd_soc_dai_ops g12a_frddr_ops = {
@@ -283,8 +281,9 @@ static const struct snd_soc_component_dr };static const struct axg_fifo_match_data g12a_frddr_match_data = { - .component_drv = &g12a_frddr_component_drv, - .dai_drv = &g12a_frddr_dai_drv + .field_threshold =REG_FIELD (FIFO_CTRL1 ,16 ,23 ), + .component_drv = &g12a_frddr_component_drv, + .dai_drv = &g12a_frddr_dai_drv };/* On SM1, the output selection in on CTRL2 */
@@ -353,8 +352,9 @@ static const struct snd_soc_component_dr };static const struct axg_fifo_match_data sm1_frddr_match_data = { - .component_drv = &sm1_frddr_component_drv, - .dai_drv = &g12a_frddr_dai_drv + .field_threshold =REG_FIELD (FIFO_CTRL1 ,16 ,23 ), + .component_drv = &sm1_frddr_component_drv, + .dai_drv = &g12a_frddr_dai_drv };static const struct of_device_id axg_frddr_of_match[] = {
sound/soc/meson/axg-toddr.c +9 -12
@@ -89,7 +89,6 @@ static int axg_toddr_dai_startup(struct struct snd_soc_dai *dai) {struct axg_fifo *fifo =snd_soc_dai_get_drvdata (dai); -unsigned int fifo_threshold;int ret;/* Enable pclk to access registers and clock the fifo ip */
@@ -107,11 +106,6 @@ static int axg_toddr_dai_startup(struct/* Apply single buffer mode to the interface */ regmap_update_bits (fifo->map,FIFO_CTRL0 ,CTRL0_TODDR_PP_MODE ,0 ); -/* TODDR does not have a configurable fifo depth */ - fifo_threshold =AXG_FIFO_MIN_CNT -1 ; -regmap_update_bits (fifo->map,FIFO_CTRL1 ,CTRL1_THRESHOLD_MASK , -CTRL1_THRESHOLD (fifo_threshold)); -return 0 ; }
@@ -191,8 +185,9 @@ static const struct snd_soc_component_dr };static const struct axg_fifo_match_data axg_toddr_match_data = { - .component_drv = &axg_toddr_component_drv, - .dai_drv = &axg_toddr_dai_drv + .field_threshold =REG_FIELD (FIFO_CTRL1 ,16 ,23 ), + .component_drv = &axg_toddr_component_drv, + .dai_drv = &axg_toddr_dai_drv };static const struct snd_soc_dai_ops g12a_toddr_ops = {
@@ -230,8 +225,9 @@ static const struct snd_soc_component_dr };static const struct axg_fifo_match_data g12a_toddr_match_data = { - .component_drv = &g12a_toddr_component_drv, - .dai_drv = &g12a_toddr_dai_drv + .field_threshold =REG_FIELD (FIFO_CTRL1 ,16 ,23 ), + .component_drv = &g12a_toddr_component_drv, + .dai_drv = &g12a_toddr_dai_drv };static const char *const sm1_toddr_sel_texts[] = {
@@ -300,8 +296,9 @@ static const struct snd_soc_component_dr };static const struct axg_fifo_match_data sm1_toddr_match_data = { - .component_drv = &sm1_toddr_component_drv, - .dai_drv = &g12a_toddr_dai_drv + .field_threshold =REG_FIELD (FIFO_CTRL1 ,12 ,23 ), + .component_drv = &sm1_toddr_component_drv, + .dai_drv = &g12a_toddr_dai_drv };static const struct of_device_id axg_toddr_of_match[] = {
Greg Kroah-Hartman
maintainerPATCH 280/367 scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return type
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
commit 3f5f7335e5e234e340b48ecb24c2aba98a61f934 upstream.
Since qla82xx_get_fw_size() returns a number in CPU-endian format, change its return type from __le32 into u32. This patch does not change any functionality.
--- drivers/scsi/qla2xxx/qla_nx.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/scsi/qla2xxx/qla_nx.c +3 -4
@@ -1612,8 +1612,7 @@ qla82xx_get_bootld_offset(struct qla_hw_return (u8 *)&ha->hablob->fw->data[offset]; } -static __le32 -qla82xx_get_fw_size (struct qla_hw_data *ha) +static u32 qla82xx_get_fw_size (struct qla_hw_data *ha) {struct qla82xx_uri_data_desc *uri_desc =NULL ;
@@ -1624,7 +1623,7 @@ qla82xx_get_fw_size(struct qla_hw_data *return cpu_to_le32 (uri_desc->size); } -return cpu_to_le32 (*(u32 *)&ha->hablob->fw->data[FW_SIZE_OFFSET ]); +return get_unaligned_le32 (&ha->hablob->fw->data[FW_SIZE_OFFSET ]); } static u8 *
@@ -1816,7 +1815,7 @@ qla82xx_fw_load_from_blob(struct qla_hw_ } flashaddr =FLASH_ADDR_START ; - size = (__force u32 )qla82xx_get_fw_size (ha) /8 ; + size =qla82xx_get_fw_size (ha) /8 ; ptr64 = (u64 *)qla82xx_get_fw_offs (ha);for (i =0 ; i < size; i++) {
Greg Kroah-Hartman
maintainerPATCH 281/367 scsi: csiostor: Adjust indentation in csio_device_reset
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit a808a04c861782e31fc30e342a619c144aaee14a upstream.
Clang warns:
../drivers/scsi/csiostor/csio_scsi.c:1386:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
csio_lnodes_exit(hw, 1);
^
../drivers/scsi/csiostor/csio_scsi.c:1382:2: note: previous statement is
here
if (*buf != '1')
^1 warning generated.
This warning occurs because there is a space after the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
--- drivers/scsi/csiostor/csio_scsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/csiostor/csio_scsi.c +1 -1
@@ -1383,7 +1383,7 @@ csio_device_reset(struct device *dev,return -EINVAL ;/* Delete NPIV lnodes */ -csio_lnodes_exit (hw,1 ); +csio_lnodes_exit (hw,1 );/* Block upper IOs */ csio_lnodes_block_request (hw);
Greg Kroah-Hartman
maintainerPATCH 282/367 scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit aa8679736a82386551eb9f3ea0e6ebe2c0e99104 upstream.
Clang warns:
../drivers/scsi/qla4xxx/ql4_os.c:4148:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
if (ha->fw_dump)
^
../drivers/scsi/qla4xxx/ql4_os.c:4144:2: note: previous statement is
here
if (ha->queues)
^1 warning generated.
This warning occurs because there is a space after the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
--- drivers/scsi/qla4xxx/ql4_os.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla4xxx/ql4_os.c +1 -1
@@ -4145,7 +4145,7 @@ static void qla4xxx_mem_free(struct scsidma_free_coherent (&ha->pdev->dev, ha->queues_len, ha->queues, ha->queues_dma); -if (ha->fw_dump) +if (ha->fw_dump)vfree (ha->fw_dump); ha->queues_len =0 ;
Greg Kroah-Hartman
maintainerPATCH 283/367 scsi: ufs: Recheck bkops level if bkops is disabled
In reply to Greg Kroah-HartmanFrom: Asutosh Das <[email protected]>
commit 24366c2afbb0539fb14eff330d4e3a5db5c0a3ef upstream.
bkops level should be rechecked upon receiving an exception. Currently the level is being cached and never updated.
Update bkops each time the level is checked. Also do not use the cached bkops level value if it is disabled and then enabled.
--- drivers/scsi/ufs/ufshcd.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/ufs/ufshcd.c +3 -0
@@ -5053,6 +5053,7 @@ static int ufshcd_disable_auto_bkops(str hba->auto_bkops_enabled = false;trace_ufshcd_auto_bkops_state (dev_name (hba->dev),"Disabled" ); + hba->is_urgent_bkops_lvl_checked = false; out:return err; }
@@ -5077,6 +5078,7 @@ static void ufshcd_force_reset_auto_bkop hba->ee_ctrl_mask &= ~MASK_EE_URGENT_BKOPS ;ufshcd_disable_auto_bkops (hba); } + hba->is_urgent_bkops_lvl_checked = false; }static inline int ufshcd_get_bkops_status (struct ufs_hba *hba,u32 *status)
@@ -5123,6 +5125,7 @@ static int ufshcd_bkops_ctrl(struct ufs_ err =ufshcd_enable_auto_bkops (hba); else err =ufshcd_disable_auto_bkops (hba); + hba->urgent_bkops_lvl = curr_status; out:return err; }
Greg Kroah-Hartman
maintainerPATCH 284/367 compat: scsi: sg: fix v3 compat read/write interface
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 78ed001d9e7106171e0ee761cd854137dd731302 upstream.
In the v5.4 merge window, a cleanup patch from Al Viro conflicted with my rework of the compat handling for sg.c read(). Linus Torvalds did a correct merge but pointed out that the resulting code is still unsatisfactory.
I later noticed that the sg_new_read() function still gets the compat mode wrong, when the 'count' argument is large enough to pass a compat_sg_io_hdr object, but not a nativ sg_io_hdr.
To address both of these, move the definition of compat_sg_io_hdr into a scsi/sg.h to make it visible to sg.c and rewrite the logic for reading req_pack_id as well as the size check to a simpler version that gets the expected results.
--- block/scsi_ioctl.c | 29 ------------ drivers/scsi/sg.c | 126 ++++++++++++++++++++++++----------------------------- include/scsi/sg.h | 30 ++++++++++++ 3 files changed, 90 insertions(+), 95 deletions(-)
block/scsi_ioctl.c +1 -28
@@ -20,6 +20,7 @@#include <scsi/scsi.h> #include <scsi/scsi_ioctl.h> #include <scsi/scsi_cmnd.h> +#include <scsi/sg.h> struct blk_cmd_filter {unsigned long read_ok[BLK_SCSI_CMD_PER_LONG ];
@@ -550,34 +551,6 @@ static inline int blk_send_start_stop(streturn __blk_send_generic (q, bd_disk,GPCMD_START_STOP_UNIT , data); } -#ifdef CONFIG_COMPAT -struct compat_sg_io_hdr { -compat_int_t interface_id;/* [i] 'S' for SCSI generic (required) */ -compat_int_t dxfer_direction;/* [i] data transfer direction */ -unsigned char cmd_len;/* [i] SCSI command length ( <= 16 bytes) */ -unsigned char mx_sb_len;/* [i] max length to write to sbp */ -unsigned short iovec_count;/* [i] 0 implies no scatter gather */ -compat_uint_t dxfer_len;/* [i] byte count of data transfer */ -compat_uint_t dxferp;/* [i], [*io] points to data transfer memory -or scatter gather list */ -compat_uptr_t cmdp;/* [i], [*i] points to command to perform */ -compat_uptr_t sbp;/* [i], [*o] points to sense_buffer memory */ -compat_uint_t timeout;/* [i] MAX_UINT->no timeout (unit: millisec) */ -compat_uint_t flags;/* [i] 0 -> default, see SG_FLAG... */ -compat_int_t pack_id;/* [i->o] unused internally (normally) */ -compat_uptr_t usr_ptr;/* [i->o] unused internally */ -unsigned char status;/* [o] scsi status */ -unsigned char masked_status;/* [o] shifted, masked scsi status */ -unsigned char msg_status;/* [o] messaging level data (optional) */ -unsigned char sb_len_wr;/* [o] byte count actually written to sbp */ -unsigned short host_status;/* [o] errors from host adapter */ -unsigned short driver_status;/* [o] errors from software driver */ -compat_int_t resid;/* [o] dxfer_len - actual_transferred */ -compat_uint_t duration;/* [o] time taken by cmd (unit: millisec) */ -compat_uint_t info;/* [o] auxiliary information */ -}; -#endif -int put_sg_io_hdr (const struct sg_io_hdr *hdr,void __user *argp) {#ifdef CONFIG_COMPAT
drivers/scsi/sg.c +59 -67
159 lines not on this page · raw message
include/scsi/sg.h +30 -0
@@ -68,6 +68,36 @@ typedef struct sg_io_hdrunsigned int info;/* [o] auxiliary information */ } sg_io_hdr_t;/* 64 bytes long (on i386) */ +#if defined(__KERNEL__) +#include <linux/compat.h> + +struct compat_sg_io_hdr { +compat_int_t interface_id;/* [i] 'S' for SCSI generic (required) */ +compat_int_t dxfer_direction;/* [i] data transfer direction */ +unsigned char cmd_len;/* [i] SCSI command length ( <= 16 bytes) */ +unsigned char mx_sb_len;/* [i] max length to write to sbp */ +unsigned short iovec_count;/* [i] 0 implies no scatter gather */ +compat_uint_t dxfer_len;/* [i] byte count of data transfer */ +compat_uint_t dxferp;/* [i], [*io] points to data transfer memory +or scatter gather list */ +compat_uptr_t cmdp;/* [i], [*i] points to command to perform */ +compat_uptr_t sbp;/* [i], [*o] points to sense_buffer memory */ +compat_uint_t timeout;/* [i] MAX_UINT->no timeout (unit: millisec) */ +compat_uint_t flags;/* [i] 0 -> default, see SG_FLAG... */ +compat_int_t pack_id;/* [i->o] unused internally (normally) */ +compat_uptr_t usr_ptr;/* [i->o] unused internally */ +unsigned char status;/* [o] scsi status */ +unsigned char masked_status;/* [o] shifted, masked scsi status */ +unsigned char msg_status;/* [o] messaging level data (optional) */ +unsigned char sb_len_wr;/* [o] byte count actually written to sbp */ +unsigned short host_status;/* [o] errors from host adapter */ +unsigned short driver_status;/* [o] errors from software driver */ +compat_int_t resid;/* [o] dxfer_len - actual_transferred */ +compat_uint_t duration;/* [o] time taken by cmd (unit: millisec) */ +compat_uint_t info;/* [o] auxiliary information */ +}; +#endif +#define SG_INTERFACE_ID_ORIG 'S'/* Use negative values to flag difference from original sg_header structure */
Re: [PATCH 5.5 284/367] compat: scsi: sg: fix v3 compat read/write interface
The arm64 architecture 64k page size enabled build failed on stable rc 5.5 CONFIG_ARM64_64K_PAGES=y
CROSS_COMPILE=aarch64-linux-gnu-
Toolchain gcc-9
In file included from ../block/scsi_ioctl.c:23:
../include/scsi/sg.h:75:2: error: unknown type name ‘compat_int_t’
compat_int_t interface_id; /* [i] 'S' for SCSI generic (required) */ ^~~~~~~~~~~~
../include/scsi/sg.h:76:2: error: unknown type name ‘compat_int_t’
compat_int_t dxfer_direction; /* [i] data transfer direction */ ^~~~~~~~~~~~
...
../include/scsi/sg.h:97:2: error: unknown type name ‘compat_uint_t’
compat_uint_t info; /* [o] auxiliary information */ ^~~~~~~~~~~~~
make[2]: *** [../scripts/Makefile.build:266: block/bsg.o] Error
Ref:
https://gitlab.com/Linaro/lkft/kernel-runs/-/jobs/431659186
Quoted 282 lines · Greg Kroah-Hartman
From: Arnd Bergmann <[email protected]>
commit
78ed001d9e7106171e0ee761cd854137dd731302upstream.In the v5.4 merge window, a cleanup patch from Al Viro conflicted with my rework of the compat handling for
sg.cread(). Linus Torvalds did a correct merge but pointed out that the resulting code is still unsatisfactory.I later noticed that the
sg_new_read()function still gets the compat mode wrong, when the 'count' argument is large enough to pass acompat_sg_io_hdrobject, but not a nativsg_io_hdr.To address both of these, move the definition of
compat_sg_io_hdrinto ascsi/sg.hto make it visible tosg.cand rewrite the logic for readingreq_pack_idas well as the size check to a simpler version that gets the expected results.Fixes c35a5cfb4150 ("scsi: sg: sg_read(): simplify reading ->pack_id of userland sg_io_hdr_t")Fixes 98aaaec4a150 ("compat_ioctl: reimplement SG_IO handling")Reviewed-by Ben Hutchings <[email protected]>Signed-off-by Arnd Bergmann <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- block/scsi_ioctl.c | 29 ------------ drivers/scsi/sg.c | 126 ++++++++++++++++++++++++----------------------------- include/scsi/sg.h | 30 ++++++++++++ 3 files changed, 90 insertions(+), 95 deletions(-)block/scsi_ioctl.c +1
-28@@ -20,6 +20,7 @@#include <scsi/scsi.h> #include <scsi/scsi_ioctl.h> #include <scsi/scsi_cmnd.h> +#include <scsi/sg.h> struct blk_cmd_filter {unsigned long read_ok[BLK_SCSI_CMD_PER_LONG ];@@ -550,34 +551,6 @@ static inline int blk_send_start_stop(streturn __blk_send_generic (q, bd_disk,GPCMD_START_STOP_UNIT , data); } -#ifdef CONFIG_COMPAT -struct compat_sg_io_hdr { -compat_int_t interface_id;/* [i] 'S' for SCSI generic (required) */ -compat_int_t dxfer_direction;/* [i] data transfer direction */ -unsigned char cmd_len;/* [i] SCSI command length ( <= 16 bytes) */ -unsigned char mx_sb_len;/* [i] max length to write to sbp */ -unsigned short iovec_count;/* [i] 0 implies no scatter gather */ -compat_uint_t dxfer_len;/* [i] byte count of data transfer */ -compat_uint_t dxferp;/* [i], [*io] points to data transfer memory -or scatter gather list */ -compat_uptr_t cmdp;/* [i], [*i] points to command to perform */ -compat_uptr_t sbp;/* [i], [*o] points to sense_buffer memory */ -compat_uint_t timeout;/* [i] MAX_UINT->no timeout (unit: millisec) */ -compat_uint_t flags;/* [i] 0 -> default, see SG_FLAG... */ -compat_int_t pack_id;/* [i->o] unused internally (normally) */ -compat_uptr_t usr_ptr;/* [i->o] unused internally */ -unsigned char status;/* [o] scsi status */ -unsigned char masked_status;/* [o] shifted, masked scsi status */ -unsigned char msg_status;/* [o] messaging level data (optional) */ -unsigned char sb_len_wr;/* [o] byte count actually written to sbp */ -unsigned short host_status;/* [o] errors from host adapter */ -unsigned short driver_status;/* [o] errors from software driver */ -compat_int_t resid;/* [o] dxfer_len - actual_transferred */ -compat_uint_t duration;/* [o] time taken by cmd (unit: millisec) */ -compat_uint_t info;/* [o] auxiliary information */ -}; -#endif -int put_sg_io_hdr (const struct sg_io_hdr *hdr,void __user *argp) {#ifdef CONFIG_COMPAT drivers/scsi/sg.c +59
-67@@ -405,6 +405,38 @@ sg_release(struct inode *inode, struct freturn 0 ; } +static int get_sg_io_pack_id (int *pack_id,void __user *buf,size_t count) +{ +struct sg_header __user *old_hdr = buf; +int reply_len; + +if (count >=SZ_SG_HEADER ) { +/* negative reply_len means v3 format, otherwise v1/v2 */ +if (get_user (reply_len, &old_hdr->reply_len)) +return -EFAULT ; + +if (reply_len >=0 ) +return get_user (*pack_id, &old_hdr->pack_id); + +if (in_compat_syscall () && + count >=sizeof (struct compat_sg_io_hdr )) { +struct compat_sg_io_hdr __user *hp = buf; + +return get_user (*pack_id, &hp->pack_id); + } + +if (count >=sizeof (struct sg_io_hdr )) { +struct sg_io_hdr __user *hp = buf; + +return get_user (*pack_id, &hp->pack_id); + } + } + +/* no valid header was passed, so ignore the pack_id */ + *pack_id =-1 ; +return 0 ; +} +static ssize_t sg_read (struct file *filp,char __user *buf,size_t count,loff_t * ppos) {@@ -413,8 +445,8 @@ sg_read(struct file *filp, char __user *Sg_request *srp;int req_pack_id =-1 ;sg_io_hdr_t *hp; -struct sg_header *old_hdr =NULL ; -int retval =0 ; +struct sg_header *old_hdr; +int retval;/* * This could cause a response to be stranded. Close the associated @@ -429,79 +461,34 @@ sg_read(struct file *filp, char __user *SCSI_LOG_TIMEOUT (3 ,sg_printk (KERN_INFO , sdp,"sg_read: count=%d\n" , (int ) count)); -if (sfp->force_packid && (count >=SZ_SG_HEADER )) { - old_hdr =memdup_user (buf,SZ_SG_HEADER ); -if (IS_ERR (old_hdr)) -return PTR_ERR (old_hdr); -if (old_hdr->reply_len <0 ) { -if (count >=SZ_SG_IO_HDR ) { -/* -* This is stupid. -* -* We're copying the whole sg_io_hdr_t from user -* space just to get the 'pack_id' field. But the -* field is at different offsets for the compat -* case, so we'll use "get_sg_io_hdr()" to copy -* the whole thing and convert it. -* -* We could do something like just calculating the -* offset based of 'in_compat_syscall()', but the -* 'compat_sg_io_hdr' definition is in the wrong -* place for that. -*/ -sg_io_hdr_t *new_hdr; - new_hdr =kmalloc (SZ_SG_IO_HDR ,GFP_KERNEL ); -if (!new_hdr) { - retval = -ENOMEM ; - goto free_old_hdr; - } - retval =get_sg_io_hdr (new_hdr, buf); - req_pack_id = new_hdr->pack_id; -kfree (new_hdr); -if (retval) { - retval = -EFAULT ; - goto free_old_hdr; - } - } - }else - req_pack_id = old_hdr->pack_id; - } +if (sfp->force_packid) + retval =get_sg_io_pack_id (&req_pack_id, buf, count); +if (retval) +return retval; + srp =sg_get_rq_mark (sfp, req_pack_id);if (!srp) {/* now wait on packet to arrive */ -if (atomic_read (&sdp->detaching)) { - retval = -ENODEV ; - goto free_old_hdr; - } -if (filp->f_flags &O_NONBLOCK ) { - retval = -EAGAIN ; - goto free_old_hdr; - } +if (atomic_read (&sdp->detaching)) +return -ENODEV ; +if (filp->f_flags &O_NONBLOCK ) +return -EAGAIN ; retval =wait_event_interruptible (sfp->read_wait, (atomic_read (&sdp->detaching) || (srp =sg_get_rq_mark (sfp, req_pack_id)))); -if (atomic_read (&sdp->detaching)) { - retval = -ENODEV ; - goto free_old_hdr; - } -if (retval) { +if (atomic_read (&sdp->detaching)) +return -ENODEV ; +if (retval)/* -ERESTARTSYS as signal hit process */ - goto free_old_hdr; - } - } -if (srp->header.interface_id !='\0' ) { - retval =sg_new_read (sfp, buf, count, srp); - goto free_old_hdr; +return retval; } +if (srp->header.interface_id !='\0' ) +return sg_new_read (sfp, buf, count, srp); hp = &srp->header; -if (old_hdr ==NULL ) { - old_hdr =kmalloc (SZ_SG_HEADER ,GFP_KERNEL ); -if (! old_hdr) { - retval = -ENOMEM ; - goto free_old_hdr; - } - } -memset (old_hdr,0 ,SZ_SG_HEADER ); + old_hdr =kzalloc (SZ_SG_HEADER ,GFP_KERNEL ); +if (!old_hdr) +return -ENOMEM ; + old_hdr->reply_len = (int ) hp->timeout; old_hdr->pack_len = old_hdr->reply_len;/* old, strange behaviour */ old_hdr->pack_id = hp->pack_id;@@ -575,7 +562,12 @@ sg_new_read(Sg_fd * sfp, char __user *buint err =0 , err2;int len; -if (count <SZ_SG_IO_HDR ) { +if (in_compat_syscall ()) { +if (count <sizeof (struct compat_sg_io_hdr )) { + err = -EINVAL ; + goto err_out; + } + }else if (count <SZ_SG_IO_HDR ) { err = -EINVAL ; goto err_out; }include/scsi/sg.h +30
-0@@ -68,6 +68,36 @@ typedef struct sg_io_hdrunsigned int info;/* [o] auxiliary information */ } sg_io_hdr_t;/* 64 bytes long (on i386) */ +#if defined(__KERNEL__) +#include <linux/compat.h> + +struct compat_sg_io_hdr { +compat_int_t interface_id;/* [i] 'S' for SCSI generic (required) */ +compat_int_t dxfer_direction;/* [i] data transfer direction */ +unsigned char cmd_len;/* [i] SCSI command length ( <= 16 bytes) */ +unsigned char mx_sb_len;/* [i] max length to write to sbp */ +unsigned short iovec_count;/* [i] 0 implies no scatter gather */ +compat_uint_t dxfer_len;/* [i] byte count of data transfer */ +compat_uint_t dxferp;/* [i], [*io] points to data transfer memory +or scatter gather list */ +compat_uptr_t cmdp;/* [i], [*i] points to command to perform */ +compat_uptr_t sbp;/* [i], [*o] points to sense_buffer memory */ +compat_uint_t timeout;/* [i] MAX_UINT->no timeout (unit: millisec) */ +compat_uint_t flags;/* [i] 0 -> default, see SG_FLAG... */ +compat_int_t pack_id;/* [i->o] unused internally (normally) */ +compat_uptr_t usr_ptr;/* [i->o] unused internally */ +unsigned char status;/* [o] scsi status */ +unsigned char masked_status;/* [o] shifted, masked scsi status */ +unsigned char msg_status;/* [o] messaging level data (optional) */ +unsigned char sb_len_wr;/* [o] byte count actually written to sbp */ +unsigned short host_status;/* [o] errors from host adapter */ +unsigned short driver_status;/* [o] errors from software driver */ +compat_int_t resid;/* [o] dxfer_len - actual_transferred */ +compat_uint_t duration;/* [o] time taken by cmd (unit: millisec) */ +compat_uint_t info;/* [o] auxiliary information */ +}; +#endif +#define SG_INTERFACE_ID_ORIG 'S'/* Use negative values to flag difference from original sg_header structure */
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Re: [PATCH 5.5 284/367] compat: scsi: sg: fix v3 compat read/write interface
Quoted 14 lines · Naresh Kamboju
The arm64 architecture 64k page size enabled build failed on stable rc 5.5
CONFIG_ARM64_64K_PAGES=y
CROSS_COMPILE=aarch64-linux-gnu-
Toolchain gcc-9In file included from
../block/scsi_ioctl.c:23:
../include/scsi/sg.h:75:2: error: unknown type name ‘compat_int_t’
compat_int_tinterface_id; /* [i] 'S' for SCSI generic (required) */ ^~~~~~~~~~~~
../include/scsi/sg.h:76:2: error: unknown type name ‘compat_int_t’
compat_int_tdxfer_direction; /* [i] data transfer direction */ ^~~~~~~~~~~~
Quoted 3 lines
...
../include/scsi/sg.h:97:2: error: unknown type name ‘compat_uint_t’
compat_uint_tinfo; /* [o] auxiliary information */
Hi Naresh,
Does it work if you backport 071aaa43513a ("compat: ARM64: always include asm-generic/compat.h")?
Arnd
Re: [PATCH 5.5 284/367] compat: scsi: sg: fix v3 compat read/write interface
Helo!
Quoted 16 lines · Arnd Bergmann
Quoted 14 lines · Naresh Kamboju
The arm64 architecture 64k page size enabled build failed on stable rc 5.5
CONFIG_ARM64_64K_PAGES=y
CROSS_COMPILE=aarch64-linux-gnu-
Toolchain gcc-9In file included from
../block/scsi_ioctl.c:23:
../include/scsi/sg.h:75:2: error: unknown type name ‘compat_int_t’
compat_int_tinterface_id; /* [i] 'S' for SCSI generic (required) */ ^~~~~~~~~~~~
../include/scsi/sg.h:76:2: error: unknown type name ‘compat_int_t’
compat_int_tdxfer_direction; /* [i] data transfer direction */ ^~~~~~~~~~~~
Quoted 8 lines
Quoted 3 lines
...
../include/scsi/sg.h:97:2: error: unknown type name ‘compat_uint_t’
compat_uint_tinfo; /* [o] auxiliary information */Hi Naresh,
Does it work if you backport
071aaa43513a("compat: ARM64: always includeasm-generic/compat.h")?
Yes, cherry-picking 556d687a4ccd ("compat: ARM64: always include asm-generic/compat.h") gets it back on track.
Thanks and greetings!
Daniel Díaz
[email protected]
Greg Kroah-Hartman
maintainerRe: [PATCH 5.5 284/367] compat: scsi: sg: fix v3 compat read/write interface
Quoted 23 lines · Daniel Díaz
Helo!
Quoted 20 lines · Arnd Bergmann
Quoted 17 lines · Naresh Kamboju
The arm64 architecture 64k page size enabled build failed on stable rc 5.5
CONFIG_ARM64_64K_PAGES=y
CROSS_COMPILE=aarch64-linux-gnu-
Toolchain gcc-9In file included from
../block/scsi_ioctl.c:23:
../include/scsi/sg.h:75:2: error: unknown type name ‘compat_int_t’
compat_int_tinterface_id; /* [i] 'S' for SCSI generic (required) */ ^~~~~~~~~~~~
../include/scsi/sg.h:76:2: error: unknown type name ‘compat_int_t’
compat_int_tdxfer_direction; /* [i] data transfer direction */ ^~~~~~~~~~~~...
../include/scsi/sg.h:97:2: error: unknown type name ‘compat_uint_t’
compat_uint_tinfo; /* [o] auxiliary information */
Quoted 7 lines
Quoted 4 lines
Hi Naresh,
Does it work if you backport
071aaa43513a("compat: ARM64: always includeasm-generic/compat.h")?Yes, cherry-picking
556d687a4ccd("compat: ARM64: always includeasm-generic/compat.h") gets it back on track.
Great, I'll go add that now and push out a -rc2. Thanks for finding this so quickly.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 285/367 mtd: spi-nor: Split mt25qu512a (n25q512a) entry into two
In reply to Greg Kroah-HartmanFrom: Vignesh Raghavendra <[email protected]>
commit bd8a6e31b87b39a03ab11820776363640440dbe0 upstream.
mt25q family is different from n25q family of devices, even though manf ID and device IDs are same. mt25q flash has bit 6 set in 5th byte of READ ID response which can be used to distinguish it from n25q variant. mt25q flashes support stateless 4 Byte addressing opcodes where as n25q flashes don't. Therefore, have two separate entries for mt25qu512a and n25q512a.
--- drivers/mtd/spi-nor/spi-nor.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/mtd/spi-nor/spi-nor.c +5 -4
@@ -2461,15 +2461,16 @@ static const struct flash_info spi_nor_i { "n25q256a", INFO(0x20ba19, 0, 64 * 1024, 512, SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) }, { "n25q256ax1", INFO(0x20bb19, 0, 64 * 1024, 512, SECT_4K | SPI_NOR_QUAD_READ) }, { "n25q512ax3", INFO(0x20ba20, 0, 64 * 1024, 1024, SECT_4K | USE_FSR | SPI_NOR_QUAD_READ) }, + { "mt25qu512a", INFO6(0x20bb20, 0x104400, 64 * 1024, 1024, +SECT_4K |USE_FSR |SPI_NOR_DUAL_READ | + SPI_NOR_QUAD_READ | SPI_NOR_4B_OPCODES) }, + { "n25q512a", INFO(0x20bb20, 0, 64 * 1024, 1024, SECT_4K | + SPI_NOR_QUAD_READ) }, { "n25q00", INFO(0x20ba21, 0, 64 * 1024, 2048, SECT_4K | USE_FSR | SPI_NOR_QUAD_READ | NO_CHIP_ERASE) }, { "n25q00a", INFO(0x20bb21, 0, 64 * 1024, 2048, SECT_4K | USE_FSR | SPI_NOR_QUAD_READ | NO_CHIP_ERASE) }, { "mt25ql02g", INFO(0x20ba22, 0, 64 * 1024, 4096,SECT_4K |USE_FSR |SPI_NOR_QUAD_READ | NO_CHIP_ERASE) }, - { "mt25qu512a (n25q512a)", INFO(0x20bb20, 0, 64 * 1024, 1024, -SECT_4K |USE_FSR |SPI_NOR_DUAL_READ | -SPI_NOR_QUAD_READ | - SPI_NOR_4B_OPCODES) }, { "mt25qu02g", INFO(0x20bb22, 0, 64 * 1024, 4096, SECT_4K | USE_FSR | SPI_NOR_QUAD_READ | NO_CHIP_ERASE) }, /* Micron */
Greg Kroah-Hartman
maintainerPATCH 286/367 phy: qualcomm: Adjust indentation in read_poll_timeout
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit a89806c998ee123bb9c0f18526e55afd12c0c0ab upstream.
Clang warns:
../drivers/phy/qualcomm/phy-qcom-apq8064-sata.c:83:4: warning:
misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
usleep_range(DELAY_INTERVAL_US, DELAY_INTERVAL_US + 50);
^../drivers/phy/qualcomm/phy-qcom-apq8064-sata.c:80:3: note: previous statement is here
if (readl_relaxed(addr) & mask)
^
1 warning generated.
This warning occurs because there is a space after the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
--- drivers/phy/qualcomm/phy-qcom-apq8064-sata.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/qualcomm/phy-qcom-apq8064-sata.c +1 -1
@@ -80,7 +80,7 @@ static int read_poll_timeout(void __iomeif (readl_relaxed (addr) & mask)return 0 ; -usleep_range (DELAY_INTERVAL_US ,DELAY_INTERVAL_US +50 ); +usleep_range (DELAY_INTERVAL_US ,DELAY_INTERVAL_US +50 ); }while (!time_after (jiffies, timeout));return (readl_relaxed (addr) & mask) ?0 : -ETIMEDOUT ;
Greg Kroah-Hartman
maintainerPATCH 287/367 ext2: Adjust indentation in ext2_fill_super
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit d9e9866803f7b6c3fdd35d345e97fb0b2908bbbc upstream.
Clang warns:
../fs/ext2/super.c:1076:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) -
^
../fs/ext2/super.c:1074:2: note: previous statement is here
if (EXT2_BLOCKS_PER_GROUP(sb) == 0)
^1 warning generated.
This warning occurs because there is a space before the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
--- fs/ext2/super.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/ext2/super.c +3 -3
@@ -1073,9 +1073,9 @@ static int ext2_fill_super(struct super_if (EXT2_BLOCKS_PER_GROUP (sb) ==0 ) goto cantfind_ext2; - sbi->s_groups_count = ((le32_to_cpu (es->s_blocks_count) - -le32_to_cpu (es->s_first_data_block) -1 ) - /EXT2_BLOCKS_PER_GROUP (sb)) +1 ; + sbi->s_groups_count = ((le32_to_cpu (es->s_blocks_count) - +le32_to_cpu (es->s_first_data_block) -1 ) + /EXT2_BLOCKS_PER_GROUP (sb)) +1 ; db_count = (sbi->s_groups_count +EXT2_DESC_PER_BLOCK (sb) -1 ) /EXT2_DESC_PER_BLOCK (sb); sbi->s_group_desc = kmalloc_array (db_count,
Greg Kroah-Hartman
maintainerPATCH 288/367 powerpc/44x: Adjust indentation in ibm4xx_denali_fixup_memsize
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit c3aae14e5d468d18dbb5d7c0c8c7e2968cc14aad upstream.
Clang warns:
../arch/powerpc/boot/4xx.c:231:3: warning: misleading indentation; statement is not part of the previous 'else' [-Wmisleading-indentation]
val = SDRAM0_READ(DDR0_42);
^
../arch/powerpc/boot/4xx.c:227:2: note: previous statement is here
else
^This is because there is a space at the beginning of this line; remove it so that the indentation is consistent according to the Linux kernel coding style and clang no longer warns.
--- arch/powerpc/boot/4xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/boot/4xx.c +1 -1
@@ -228,7 +228,7 @@ void ibm4xx_denali_fixup_memsize(void) dpath =8 ;/* 64 bits */ /* get address pins (rows) */ - val =SDRAM0_READ (DDR0_42 ); + val =SDRAM0_READ (DDR0_42 ); row =DDR_GET_VAL (val,DDR_APIN ,DDR_APIN_SHIFT );if (row > max_row)
Greg Kroah-Hartman
maintainerPATCH 289/367 drm: msm: mdp4: Adjust indentation in mdp4_dsi_encoder_enable
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 251e3cb1418ff3f5061ee31335e346e852b16573 upstream.
Clang warns:
../drivers/gpu/drm/msm/disp/mdp4/mdp4_dsi_encoder.c:124:3: warning:
misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
mdp4_crtc_set_config(encoder->crtc,
^
../drivers/gpu/drm/msm/disp/mdp4/mdp4_dsi_encoder.c:121:2: note:
previous statement is here
if (mdp4_dsi_encoder->enabled)
^This warning occurs because there is a space after the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
--- drivers/gpu/drm/msm/disp/mdp4/mdp4_dsi_encoder.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/mdp4/mdp4_dsi_encoder.c +1 -1
@@ -121,7 +121,7 @@ static void mdp4_dsi_encoder_enable(struif (mdp4_dsi_encoder->enabled)return ; - mdp4_crtc_set_config(encoder->crtc, + mdp4_crtc_set_config(encoder->crtc, MDP4_DMA_CONFIG_PACK_ALIGN_MSB | MDP4_DMA_CONFIG_DEFLKR_EN | MDP4_DMA_CONFIG_DITHER_EN |
Greg Kroah-Hartman
maintainerPATCH 290/367 NFC: pn544: Adjust indentation in pn544_hci_check_presence
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 5080832627b65e3772a35d1dced68c64e2b24442 upstream.
Clang warns
../drivers/nfc/pn544/pn544.c:696:4: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
return nfc_hci_send_cmd(hdev, NFC_HCI_RF_READER_A_GATE, ^../drivers/nfc/pn544/pn544.c:692:3: note: previous statement is here
if (target->nfcid1_len != 4 && target->nfcid1_len != 7 &&
^1 warning generated.
This warning occurs because there is a space after the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
--- drivers/nfc/pn544/pn544.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nfc/pn544/pn544.c +1 -1
@@ -693,7 +693,7 @@ static int pn544_hci_check_presence(stru target->nfcid1_len != 10)return -EOPNOTSUPP ; -return nfc_hci_send_cmd (hdev,NFC_HCI_RF_READER_A_GATE , +return nfc_hci_send_cmd (hdev,NFC_HCI_RF_READER_A_GATE ,PN544_RF_READER_CMD_ACTIVATE_NEXT , target->nfcid1, target->nfcid1_len,NULL ); } else if (target->supported_protocols & (NFC_PROTO_JEWEL_MASK |
Greg Kroah-Hartman
maintainerPATCH 291/367 ppp: Adjust indentation into ppp_async_input
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 08cbc75f96029d3092664213a844a5e25523aa35 upstream.
Clang warns:
../drivers/net/ppp/ppp_async.c:877:6: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
ap->rpkt = skb;
^
../drivers/net/ppp/ppp_async.c:875:5: note: previous statement is here
if (!skb)
^1 warning generated.
This warning occurs because there is a space before the tab on this line. Clean up this entire block's indentation so that it is consistent with the Linux kernel coding style and clang no longer warns.
--- drivers/net/ppp/ppp_async.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/net/ppp/ppp_async.c +9 -9
@@ -874,15 +874,15 @@ ppp_async_input(struct asyncppp *ap, con skb =dev_alloc_skb (ap->mru +PPP_HDRLEN +2 );if (!skb) goto nomem; - ap->rpkt = skb; - } -if (skb->len ==0 ) { -/* Try to get the payload 4-byte aligned. -* This should match the -* PPP_ALLSTATIONS/PPP_UI/compressed tests in -* process_input_packet, but we do not have -* enough chars here to test buf[1] and buf[2]. -*/ + ap->rpkt = skb; + } +if (skb->len ==0 ) { +/* Try to get the payload 4-byte aligned. +* This should match the +* PPP_ALLSTATIONS/PPP_UI/compressed tests in +* process_input_packet, but we do not have +* enough chars here to test buf[1] and buf[2]. +*/ if (buf[0 ] !=PPP_ALLSTATIONS )skb_reserve (skb,2 + (buf[0 ] &1 )); }
Greg Kroah-Hartman
maintainerPATCH 292/367 net: smc911x: Adjust indentation in smc911x_phy_configure
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 5c61e223004b3b5c3f1dd25718e979bc17a3b12d upstream.
Clang warns:
../drivers/net/ethernet/smsc/smc911x.c:939:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
if (!lp->ctl_rfduplx)
^
../drivers/net/ethernet/smsc/smc911x.c:936:2: note: previous statement
is here
if (lp->ctl_rspeed != 100)
^1 warning generated.
This warning occurs because there is a space after the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
--- drivers/net/ethernet/smsc/smc911x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/smsc/smc911x.c +1 -1
@@ -936,7 +936,7 @@ static void smc911x_phy_configure(structif (lp->ctl_rspeed !=100 ) my_ad_caps &= ~(ADVERTISE_100BASE4 |ADVERTISE_100FULL |ADVERTISE_100HALF ); -if (!lp->ctl_rfduplx) +if (!lp->ctl_rfduplx) my_ad_caps &= ~(ADVERTISE_100FULL |ADVERTISE_10FULL );/* Update our Auto-Neg Advertisement Register */
Greg Kroah-Hartman
maintainerPATCH 293/367 net: tulip: Adjust indentation in {dmfe, uli526x}_init_module
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit fe06bf3d83ef0d92f35a24e03297172e92ce9ce3 upstream.
Clang warns:
../drivers/net/ethernet/dec/tulip/uli526x.c:1812:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
switch (mode) {
^
../drivers/net/ethernet/dec/tulip/uli526x.c:1809:2: note: previous
statement is here
if (cr6set)
^1 warning generated.
../drivers/net/ethernet/dec/tulip/dmfe.c:2217:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
switch(mode) {
^
../drivers/net/ethernet/dec/tulip/dmfe.c:2214:2: note: previous
statement is here
if (cr6set)
^1 warning generated.
This warning occurs because there is a space before the tab on these lines. Remove them so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
While we are here, adjust the default block in dmfe_init_module to have a proper break between the label and assignment and add a space between the switch and opening parentheses to avoid a checkpatch warning.
--- drivers/net/ethernet/dec/tulip/dmfe.c | 7 ++++--- drivers/net/ethernet/dec/tulip/uli526x.c | 4 ++-- 2 files changed, 6 insertions(+), 5 deletions(-)
drivers/net/ethernet/dec/tulip/dmfe.c +4 -3
@@ -2214,15 +2214,16 @@ static int __init dmfe_init_module(void)if (cr6set) dmfe_cr6_user_set = cr6set; -switch (mode) { -case DMFE_10MHF : +switch (mode) { +case DMFE_10MHF :case DMFE_100MHF :case DMFE_10MFD :case DMFE_100MFD :case DMFE_1M_HPNA : dmfe_media_mode = mode;break ; -default :dmfe_media_mode =DMFE_AUTO ; +default : + dmfe_media_mode =DMFE_AUTO ;break ; }
drivers/net/ethernet/dec/tulip/uli526x.c +2 -2
@@ -1809,8 +1809,8 @@ static int __init uli526x_init_module(voif (cr6set) uli526x_cr6_user_set = cr6set; -switch (mode) { -case ULI526X_10MHF : +switch (mode) { +case ULI526X_10MHF :case ULI526X_100MHF :case ULI526X_10MFD :case ULI526X_100MFD :
Greg Kroah-Hartman
maintainerPATCH 294/367 IB/mlx5: Fix outstanding_pi index for GSI qps
In reply to Greg Kroah-HartmanFrom: Prabhath Sajeepa <[email protected]>
commit b5671afe5e39ed71e94eae788bacdcceec69db09 upstream.
Commit b0ffeb537f3a ("IB/mlx5: Fix iteration overrun in GSI qps") changed the way outstanding WRs are tracked for the GSI QP. But the fix did not cover the case when a call to ib_post_send() fails and updates index to track outstanding.
Since the prior commmit outstanding_pi should not be bounded otherwise the loop generate_completions() will fail.
--- drivers/infiniband/hw/mlx5/gsi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/infiniband/hw/mlx5/gsi.c +1 -2
@@ -507,8 +507,7 @@ int mlx5_ib_gsi_post_send(struct ib_qp * ret =ib_post_send (tx_qp, &cur_wr.wr, bad_wr);if (ret) {/* Undo the effect of adding the outstanding wr */ - gsi->outstanding_pi = (gsi->outstanding_pi -1 ) % - gsi->cap.max_send_wr; + gsi->outstanding_pi--; goto err; }spin_unlock_irqrestore (&gsi->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 295/367 IB/core: Fix ODP get user pages flow
In reply to Greg Kroah-HartmanFrom: Yishai Hadas <[email protected]>
commit d07de8bd1709a80a282963ad7b2535148678a9e4 upstream.
The nr_pages argument of get_user_pages_remote() should always be in terms of the system page size, not the MR page size. Use PAGE_SIZE instead of umem_odp->page_shift.
--- drivers/infiniband/core/umem_odp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/umem_odp.c +1 -1
@@ -440,7 +440,7 @@ int ib_umem_odp_map_dma_pages(struct ib_while (bcnt >0 ) {const size_t gup_num_pages =min_t (size_t, - (bcnt +BIT (page_shift) -1 ) >> page_shift, +ALIGN (bcnt,PAGE_SIZE ) /PAGE_SIZE ,PAGE_SIZE /sizeof (struct page *));down_read (&owning_mm->mmap_sem);
Greg Kroah-Hartman
maintainerPATCH 296/367 IB/core: Fix ODP with IB_ACCESS_HUGETLB handling
In reply to Greg Kroah-HartmanFrom: Yishai Hadas <[email protected]>
commit 9ff1b6466a291a33389c4a9c7f3f9b64d62df40a upstream.
As VMAs for a given range might not be available as part of the registration phase in ODP.
ib_init_umem_odp() considered the expected page shift value that was previously set and initializes its internals accordingly.
If memory isn't backed by physical contiguous pages aligned to a hugepage boundary an error will be set as part of the page fault flow and come back to the user as some failed RDMA operation.
--- drivers/infiniband/core/umem_odp.c | 21 ++++----------------- 1 file changed, 4 insertions(+), 17 deletions(-)
drivers/infiniband/core/umem_odp.c +4 -17
@@ -241,22 +241,10 @@ struct ib_umem_odp *ib_umem_odp_get(stru umem_odp->umem.owning_mm = mm = current->mm; umem_odp->notifier.ops = ops; - umem_odp->page_shift =PAGE_SHIFT ; -if (access &IB_ACCESS_HUGETLB ) { -struct vm_area_struct *vma; -struct hstate *h; - -down_read (&mm->mmap_sem); - vma =find_vma (mm,ib_umem_start (umem_odp)); -if (!vma || !is_vm_hugetlb_page (vma)) { -up_read (&mm->mmap_sem); - ret = -EINVAL ; - goto err_free; - } - h =hstate_vma (vma); - umem_odp->page_shift =huge_page_shift (h); -up_read (&mm->mmap_sem); - } +if (access &IB_ACCESS_HUGETLB ) + umem_odp->page_shift =HPAGE_SHIFT ; +else + umem_odp->page_shift =PAGE_SHIFT ; umem_odp->tgid =get_task_pid (current->group_leader,PIDTYPE_PID ); ret =ib_init_umem_odp (umem_odp, ops);
@@ -266,7 +254,6 @@ struct ib_umem_odp *ib_umem_odp_get(stru err_put_pid:put_pid (umem_odp->tgid); -err_free:kfree (umem_odp);return ERR_PTR (ret); }
Greg Kroah-Hartman
maintainerPATCH 297/367 staging: wfx: revert unexpected change in debugfs output
In reply to Greg Kroah-HartmanFrom: Jérôme Pouiller <[email protected]>
commit 8b08b6a8c31f18c3657405410e4c3f6bc4fa75f1 upstream.
It appears that commit 8c7128c4cf4e ("staging: align to fix warnings of line over 80 characters") do slightly more than what is explained in commit log.
Especially, it changes the output of the file rx_stats from debugfs.
Quoted 1 line
From some point of view, this file can be considered as a part of the
API. Any change on it should be clearly announced.
Since the change introduced does not seems to have any justification, revert it.
--- drivers/staging/wfx/debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/wfx/debug.c +1 -1
@@ -145,7 +145,7 @@ static int wfx_rx_stats_show(struct seq_ st->pwr_clk_freq, st->is_ext_pwr_clk ? "yes" : "no");seq_printf (seq, -"N. of frames: %d, PER (x10e4): %d, Throughput: %dKbps/s\n" , +"Num. of frames: %d, PER (x10e4): %d, Throughput: %dKbps/s\n" , st->nb_rx_frame, st->per_total, st->throughput);seq_puts (seq," Num. of PER RSSI SNR CFO\n" );seq_puts (seq," frames (x10e4) (dBm) (dB) (kHz)\n" );
Greg Kroah-Hartman
maintainerPATCH 298/367 nfsd: fix delay timer on 32-bit architectures
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 2561c92b12f4f4e386d453556685f75775c0938b upstream.
The nfsd4_cb_layout_done() function takes a 'time_t' value, multiplied by NSEC_PER_SEC*2 to get a nanosecond value.
This works fine on 64-bit architectures, but on 32-bit, any value over 1 second results in a signed integer overflow with unexpected results.
Cast one input to a 64-bit type in order to produce the same result that we have on 64-bit architectures, regarless of the type of nfsd4_lease.
--- fs/nfsd/nfs4layouts.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4layouts.c +1 -1
@@ -675,7 +675,7 @@ nfsd4_cb_layout_done(struct nfsd4_callba/* Client gets 2 lease periods to return it */ cutoff =ktime_add_ns (task->tk_start, - nn->nfsd4_lease *NSEC_PER_SEC *2 ); + (u64 )nn->nfsd4_lease *NSEC_PER_SEC *2 );if (ktime_before (now, cutoff)) {rpc_delay (task,HZ /100 );/* 10 mili-seconds */
Greg Kroah-Hartman
maintainerPATCH 299/367 nfsd: fix jiffies/time_t mixup in LRU list
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 9594497f2c78993cb66b696122f7c65528ace985 upstream.
The nfsd4_blocked_lock->nbl_time timestamp is recorded in jiffies, but then compared to a CLOCK_REALTIME timestamp later on, which makes no sense.
For consistency with the other timestamps, change this to use a time_t.
This is a change in behavior, which may cause regressions, but the current code is not sensible. On a system with CONFIG_HZ=1000, the 'time_after((unsigned long)nbl->nbl_time, (unsigned long)cutoff))' check is false for roughly the first 18 days of uptime and then true for the next 49 days.
--- fs/nfsd/nfs4state.c | 2 +- fs/nfsd/state.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
fs/nfsd/nfs4state.c +1 -1
@@ -6550,7 +6550,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struc }if (fl_flags &FL_SLEEP ) { - nbl->nbl_time = jiffies; + nbl->nbl_time =get_seconds ();spin_lock (&nn->blocked_locks_lock);list_add_tail (&nbl->nbl_list, &lock_sop->lo_blocked);list_add_tail (&nbl->nbl_lru, &nn->blocked_locks_lru);
fs/nfsd/state.h +1 -1
@@ -606,7 +606,7 @@ static inline bool nfsd4_stateid_generatstruct nfsd4_blocked_lock {struct list_head nbl_list;struct list_head nbl_lru; -unsigned long nbl_time; +time_t nbl_time;struct file_lock nbl_lock;struct knfsd_fh nbl_fh;struct nfsd4_callback nbl_cb;
Greg Kroah-Hartman
maintainerPATCH 300/367 nfsd: Return the correct number of bytes written to the file
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit 09a80f2aef06b7c86143f5c14efd3485e0d2c139 upstream.
We must allow for the fact that iov_iter_write() could have returned a short write (e.g. if there was an ENOSPC issue).
--- fs/nfsd/vfs.c | 1 + 1 file changed, 1 insertion(+)
fs/nfsd/vfs.c +1 -0
@@ -975,6 +975,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s host_err =vfs_iter_write (file, &iter, &pos, flags);if (host_err <0 ) goto out_nfserr; + *cnt = host_err; nfsdstats.io_write += *cnt;fsnotify_modify (file);
Greg Kroah-Hartman
maintainerPATCH 301/367 virtio-balloon: Fix memory leak when unloading while hinting is in progress
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit 6c22dc61c76b7e7d355f1697ba0ecf26d1334ba6 upstream.
When unloading the driver while hinting is in progress, we will not release the free page blocks back to MM, resulting in a memory leak.
--- drivers/virtio/virtio_balloon.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/virtio/virtio_balloon.c +4 -0
@@ -968,6 +968,10 @@ static void remove_common(struct virtio_leak_balloon (vb, vb->num_pages);update_balloon_size (vb); +/* There might be free pages that are being reported: release them. */ +if (virtio_has_feature (vb->vdev,VIRTIO_BALLOON_F_FREE_PAGE_HINT )) +return_free_pages_to_mm (vb,ULONG_MAX ); +/* Now we reset the device so we can clean up the queues. */ vb->vdev->config->reset (vb->vdev);
Greg Kroah-Hartman
maintainerPATCH 302/367 virtio_balloon: Fix memory leaks on errors in virtballoon_probe()
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit 1ad6f58ea9364b0a5d8ae06249653ac9304a8578 upstream.
We forget to put the inode and unmount the kernfs used for compaction.
--- drivers/virtio/virtio_balloon.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/virtio/virtio_balloon.c +9 -4
@@ -901,8 +901,7 @@ static int virtballoon_probe(struct virt vb->vb_dev_info.inode =alloc_anon_inode (balloon_mnt->mnt_sb);if (IS_ERR (vb->vb_dev_info.inode)) { err =PTR_ERR (vb->vb_dev_info.inode); -kern_unmount (balloon_mnt); - goto out_del_vqs; + goto out_kern_unmount; } vb->vb_dev_info.inode->i_mapping->a_ops = &balloon_aops;#endif
@@ -913,13 +912,13 @@ static int virtballoon_probe(struct virt*/ if (virtqueue_get_vring_size (vb->free_page_vq) <2 ) { err = -ENOSPC ; - goto out_del_vqs; + goto out_iput; } vb->balloon_wq =alloc_workqueue ("balloon-wq" ,WQ_FREEZABLE |WQ_CPU_INTENSIVE ,0 );if (!vb->balloon_wq) { err = -ENOMEM ; - goto out_del_vqs; + goto out_iput; }INIT_WORK (&vb->report_free_page_work, report_free_page_func); vb->cmd_id_received_cache =VIRTIO_BALLOON_CMD_ID_STOP ;
@@ -953,6 +952,12 @@ static int virtballoon_probe(struct virt out_del_balloon_wq:if (virtio_has_feature (vdev,VIRTIO_BALLOON_F_FREE_PAGE_HINT ))destroy_workqueue (vb->balloon_wq); +out_iput: +#ifdef CONFIG_BALLOON_COMPACTION +iput (vb->vb_dev_info.inode); +out_kern_unmount: +kern_unmount (balloon_mnt); +#endif out_del_vqs: vdev->config->del_vqs (vdev); out_free_vb:
Greg Kroah-Hartman
maintainerPATCH 303/367 ubi: fastmap: Fix inverted logic in seen selfcheck
In reply to Greg Kroah-HartmanFrom: Sascha Hauer <[email protected]>
commit ef5aafb6e4e9942a28cd300bdcda21ce6cbaf045 upstream.
set_seen() sets the bit corresponding to the PEB number in the bitmap, so when self_check_seen() wants to find PEBs that haven't been seen we have to print the PEBs that have their bit cleared, not the ones which have it set.
--- drivers/mtd/ubi/fastmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/ubi/fastmap.c +1 -1
@@ -64,7 +64,7 @@ static int self_check_seen(struct ubi_dereturn 0 ;for (pnum =0 ; pnum < ubi->peb_count; pnum++) { -if (test_bit (pnum, seen) && ubi->lookuptbl[pnum]) { +if (!test_bit (pnum, seen) && ubi->lookuptbl[pnum]) {ubi_err (ubi,"self-check failed for PEB %d, fastmap didn't see it" , pnum); ret = -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 304/367 ubi: Fix an error pointer dereference in error handling code
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 5d3805af279c93ef49a64701f35254676d709622 upstream.
If "seen_pebs = init_seen(ubi);" fails then "seen_pebs" is an error pointer and we try to kfree() it which results in an Oops.
This patch re-arranges the error handling so now it only frees things which have been allocated successfully.
--- drivers/mtd/ubi/fastmap.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
drivers/mtd/ubi/fastmap.c +12 -9
@@ -1137,7 +1137,7 @@ static int ubi_write_fastmap(struct ubi_struct rb_node *tmp_rb;int ret, i, j, free_peb_count, used_peb_count, vol_count;int scrub_peb_count, erase_peb_count; -unsigned long *seen_pebs =NULL ; +unsigned long *seen_pebs; fm_raw = ubi->fm_buf;memset (ubi->fm_buf,0 , ubi->fm_size);
@@ -1151,7 +1151,7 @@ static int ubi_write_fastmap(struct ubi_ dvbuf =new_fm_vbuf (ubi,UBI_FM_DATA_VOLUME_ID );if (!dvbuf) { ret = -ENOMEM ; - goto out_kfree; + goto out_free_avbuf; } avhdr =ubi_get_vid_hdr (avbuf);
@@ -1160,7 +1160,7 @@ static int ubi_write_fastmap(struct ubi_ seen_pebs =init_seen (ubi);if (IS_ERR (seen_pebs)) { ret =PTR_ERR (seen_pebs); - goto out_kfree; + goto out_free_dvbuf; }spin_lock (&ubi->volumes_lock);
@@ -1328,7 +1328,7 @@ static int ubi_write_fastmap(struct ubi_ ret =ubi_io_write_vid_hdr (ubi, new_fm->e[0 ]->pnum, avbuf);if (ret) {ubi_err (ubi,"unable to write vid_hdr to fastmap SB!" ); - goto out_kfree; + goto out_free_seen; }for (i =0 ; i < new_fm->used_blocks; i++) {
@@ -1350,7 +1350,7 @@ static int ubi_write_fastmap(struct ubi_if (ret) {ubi_err (ubi,"unable to write vid_hdr to PEB %i!" , new_fm->e[i]->pnum); - goto out_kfree; + goto out_free_seen; } }
@@ -1360,7 +1360,7 @@ static int ubi_write_fastmap(struct ubi_if (ret) {ubi_err (ubi,"unable to write fastmap to PEB %i!" , new_fm->e[i]->pnum); - goto out_kfree; + goto out_free_seen; } }
@@ -1370,10 +1370,13 @@ static int ubi_write_fastmap(struct ubi_ ret =self_check_seen (ubi, seen_pebs);dbg_bld ("fastmap written!" ); -out_kfree: -ubi_free_vid_buf (avbuf); -ubi_free_vid_buf (dvbuf); +out_free_seen:free_seen (seen_pebs); +out_free_dvbuf: +ubi_free_vid_buf (dvbuf); +out_free_avbuf: +ubi_free_vid_buf (avbuf); + out:return ret; }
Greg Kroah-Hartman
maintainerPATCH 305/367 ubifs: Fix memory leak from c->sup_node
In reply to Greg Kroah-HartmanFrom: Quanyang Wang <[email protected]>
commit ff90bdfb206e49c8b418811efbdd0c77380fa8c2 upstream.
The c->sup_node is allocated in function ubifs_read_sb_node but is not freed. This will cause memory leak as below:
unreferenced object 0xbc9ce000 (size 4096):
comm "mount", pid 500, jiffies 4294952946 (age 315.820s) hex dump (first 32 bytes):
31 18 10 06 06 7b f1 11 02 00 00 00 00 00 00 00 1....{..........
00 10 00 00 06 00 00 00 00 00 00 00 08 00 00 00 ................
backtrace:
[<d1c503cd>] ubifs_read_superblock+0x48/0xebc
[<a20e14bd>] ubifs_mount+0x974/0x1420
[<8589ecc3>] legacy_get_tree+0x2c/0x50
[<5f1fb889>] vfs_get_tree+0x28/0xfc
[<bbfc7939>] do_mount+0x4f8/0x748
[<4151f538>] ksys_mount+0x78/0xa0
[<d59910a9>] ret_fast_syscall+0x0/0x54
[<1cc40005>] 0x7ea02790Free it in ubifs_umount and in the error path of mount_ubifs.
--- fs/ubifs/super.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ubifs/super.c +2 -0
@@ -1599,6 +1599,7 @@ out_free:vfree (c->ileb_buf);vfree (c->sbuf);kfree (c->bottom_up_buf); +kfree (c->sup_node);ubifs_debugging_exit (c);return err; }
@@ -1641,6 +1642,7 @@ static void ubifs_umount(struct ubifs_invfree (c->ileb_buf);vfree (c->sbuf);kfree (c->bottom_up_buf); +kfree (c->sup_node);ubifs_debugging_exit (c); }
Greg Kroah-Hartman
maintainerPATCH 306/367 regulator: core: Add regulator_is_equal() helper
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
commit b059b7e0ec3208ff1e17cff6387d75a9fbab4e02 upstream.
Add regulator_is_equal() helper to compare whether two regulators are the same. This is useful for checking whether two separate regulators in a driver are actually the same supply.
--- drivers/regulator/helpers.c | 14 ++++++++++++++ include/linux/regulator/consumer.h | 7 +++++++ 2 files changed, 21 insertions(+)
drivers/regulator/helpers.c +14 -0
@@ -13,6 +13,8 @@#include <linux/regulator/driver.h> #include <linux/module.h> +#include "internal.h" +/** * regulator_is_enabled_regmap - standard is_enabled() for regmap users *
@@ -881,3 +883,15 @@ void regulator_bulk_set_supply_names(str consumers[i].supply = supply_names[i]; }EXPORT_SYMBOL_GPL (regulator_bulk_set_supply_names); + +/** +* regulator_is_equal - test whether two regulators are the same +* +* @reg1: first regulator to operate on +* @reg2: second regulator to operate on +*/ +bool regulator_is_equal (struct regulator *reg1,struct regulator *reg2) +{ +return reg1->rdev == reg2->rdev; +} +EXPORT_SYMBOL_GPL (regulator_is_equal);
include/linux/regulator/consumer.h +7 -0
@@ -287,6 +287,8 @@ void regulator_bulk_set_supply_names(strconst char *const *supply_names, unsigned int num_supplies); +bool regulator_is_equal (struct regulator *reg1,struct regulator *reg2); +#else /*
@@ -593,6 +595,11 @@ regulator_bulk_set_supply_names(struct r { } +static inline bool +regulator_is_equal (struct regulator *reg1,struct regulator *reg2); +{ +return false; +}#endif static inline int regulator_set_voltage_triplet(struct regulator *regulator,
Greg Kroah-Hartman
maintainerPATCH 307/367 ASoC: sgtl5000: Fix VDDA and VDDIO comparison
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
commit e19ecbf105b236a6334fab64d8fd5437b12ee019 upstream.
Comparing the voltage of VDDA and VDDIO to determine whether or not to enable VDDC manual override is insufficient. This is a problem in case the VDDA is supplied from different regulator than VDDIO, while both report the same voltage to the regulator framework. In that case where VDDA and VDDIO is supplied by different regulators, the VDDC manual override must not be applied.
--- sound/soc/codecs/sgtl5000.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/codecs/sgtl5000.c +2 -1
@@ -1344,7 +1344,8 @@ static int sgtl5000_set_power_regs(struc* if vddio == vdda the source of charge pump should be * assigned manually to VDDIO */ -if (vddio == vdda) { +if (regulator_is_equal (sgtl5000->supplies[VDDA ].consumer, + sgtl5000->supplies[VDDIO ].consumer)) { lreg_ctrl |=SGTL5000_VDDC_ASSN_OVRD ; lreg_ctrl |=SGTL5000_VDDC_MAN_ASSN_VDDIO <<SGTL5000_VDDC_MAN_ASSN_SHIFT ;
Greg Kroah-Hartman
maintainerPATCH 308/367 ASoC: Intel: skl_hda_dsp_common: Fix global-out-of-bounds bug
In reply to Greg Kroah-HartmanFrom: Cezary Rojewski <[email protected]>
commit 15adb20f64c302b31e10ad50f22bb224052ce1df upstream.
Definitions for idisp snd_soc_dai_links within skl_hda_dsp_common are missing platform component. Add it to address following bug reported by KASAN:
[ 10.538502] BUG: KASAN: global-out-of-bounds in skl_hda_audio_probe+0x13a/0x2b0 [snd_soc_skl_hda_dsp] [ 10.538509] Write of size 8 at addr ffffffffc0606840 by task systemd-udevd/299 (...) [ 10.538519] Call Trace: [ 10.538524] dump_stack+0x62/0x95 [ 10.538528] print_address_description+0x2f5/0x3b0 [ 10.538532] ? skl_hda_audio_probe+0x13a/0x2b0 [snd_soc_skl_hda_dsp] [ 10.538535] __kasan_report+0x134/0x191 [ 10.538538] ? skl_hda_audio_probe+0x13a/0x2b0 [snd_soc_skl_hda_dsp] [ 10.538542] ? skl_hda_audio_probe+0x13a/0x2b0 [snd_soc_skl_hda_dsp] [ 10.538544] kasan_report+0x12/0x20 [ 10.538546] __asan_store8+0x57/0x90 [ 10.538550] skl_hda_audio_probe+0x13a/0x2b0 [snd_soc_skl_hda_dsp] [ 10.538553] platform_drv_probe+0x51/0xb0 [ 10.538556] really_probe+0x311/0x600 [ 10.538559] driver_probe_device+0x87/0x1b0 [ 10.538562] device_driver_attach+0x8f/0xa0 [ 10.538565] ? device_driver_attach+0xa0/0xa0 [ 10.538567] __driver_attach+0x102/0x1a0 [ 10.538569] ? device_driver_attach+0xa0/0xa0 [ 10.538572] bus_for_each_dev+0xe8/0x160 [ 10.538574] ? subsys_dev_iter_exit+0x10/0x10 [ 10.538577] ? preempt_count_sub+0x18/0xc0 [ 10.538580] ? _raw_write_unlock+0x1f/0x40 [ 10.538582] driver_attach+0x2b/0x30 [ 10.538585] bus_add_driver+0x251/0x340 [ 10.538588] driver_register+0xd3/0x1c0 [ 10.538590] __platform_driver_register+0x6c/0x80 [ 10.538592] ? 0xffffffffc03e8000 [ 10.538595] skl_hda_audio_init+0x1c/0x1000 [snd_soc_skl_hda_dsp] [ 10.538598] do_one_initcall+0xd0/0x36a [ 10.538600] ? trace_event_raw_event_initcall_finish+0x160/0x160 [ 10.538602] ? kasan_unpoison_shadow+0x36/0x50 [ 10.538605] ? __kasan_kmalloc+0xcc/0xe0 [ 10.538607] ? kasan_unpoison_shadow+0x36/0x50 [ 10.538609] ? kasan_poison_shadow+0x2f/0x40 [ 10.538612] ? __asan_register_globals+0x65/0x80 [ 10.538615] do_init_module+0xf9/0x36f [ 10.538619] load_module+0x398e/0x4590 [ 10.538625] ? module_frob_arch_sections+0x20/0x20 [ 10.538628] ? __kasan_check_write+0x14/0x20 [ 10.538630] ? kernel_read+0x9a/0xc0 [ 10.538632] ? __kasan_check_write+0x14/0x20 [ 10.538634] ? kernel_read_file+0x1d3/0x3c0 [ 10.538638] ? cap_capable+0xca/0x110 [ 10.538642] __do_sys_finit_module+0x190/0x1d0 [ 10.538644] ? __do_sys_finit_module+0x190/0x1d0 [ 10.538646] ? __x64_sys_init_module+0x50/0x50 [ 10.538649] ? expand_files+0x380/0x380 [ 10.538652] ? __kasan_check_write+0x14/0x20 [ 10.538654] ? fput_many+0x20/0xc0 [ 10.538658] __x64_sys_finit_module+0x43/0x50 [ 10.538660] do_syscall_64+0xce/0x700 [ 10.538662] ? syscall_return_slowpath+0x230/0x230 [ 10.538665] ? __do_page_fault+0x51e/0x640 [ 10.538668] ? __kasan_check_read+0x11/0x20 [ 10.538670] ? prepare_exit_to_usermode+0xc7/0x200 [ 10.538673] entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- sound/soc/intel/boards/skl_hda_dsp_common.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
sound/soc/intel/boards/skl_hda_dsp_common.c +12 -9
@@ -41,16 +41,19 @@ int skl_hda_hdmi_add_pcm(struct snd_soc_return 0 ; } -SND_SOC_DAILINK_DEFS (idisp1, -DAILINK_COMP_ARRAY (COMP_CPU ("iDisp1 Pin" )), +SND_SOC_DAILINK_DEF (idisp1_cpu, +DAILINK_COMP_ARRAY (COMP_CPU ("iDisp1 Pin" ))); +SND_SOC_DAILINK_DEF (idisp1_codec,DAILINK_COMP_ARRAY (COMP_CODEC ("ehdaudio0D2" ,"intel-hdmi-hifi1" ))); -SND_SOC_DAILINK_DEFS (idisp2, -DAILINK_COMP_ARRAY (COMP_CPU ("iDisp2 Pin" )), +SND_SOC_DAILINK_DEF (idisp2_cpu, +DAILINK_COMP_ARRAY (COMP_CPU ("iDisp2 Pin" ))); +SND_SOC_DAILINK_DEF (idisp2_codec,DAILINK_COMP_ARRAY (COMP_CODEC ("ehdaudio0D2" ,"intel-hdmi-hifi2" ))); -SND_SOC_DAILINK_DEFS (idisp3, -DAILINK_COMP_ARRAY (COMP_CPU ("iDisp3 Pin" )), +SND_SOC_DAILINK_DEF (idisp3_cpu, +DAILINK_COMP_ARRAY (COMP_CPU ("iDisp3 Pin" ))); +SND_SOC_DAILINK_DEF (idisp3_codec,DAILINK_COMP_ARRAY (COMP_CODEC ("ehdaudio0D2" ,"intel-hdmi-hifi3" ))); SND_SOC_DAILINK_DEF(analog_cpu,
@@ -83,21 +86,21 @@ struct snd_soc_dai_link skl_hda_be_dai_l .id = 1, .dpcm_playback = 1, .no_pcm = 1, - SND_SOC_DAILINK_REG(idisp1), + SND_SOC_DAILINK_REG(idisp1_cpu, idisp1_codec, platform), }, { .name = "iDisp2", .id = 2, .dpcm_playback = 1, .no_pcm =1 , - SND_SOC_DAILINK_REG(idisp2), + SND_SOC_DAILINK_REG(idisp2_cpu, idisp2_codec, platform), }, { .name ="iDisp3" , .id = 3, .dpcm_playback = 1, .no_pcm = 1, - SND_SOC_DAILINK_REG(idisp3), + SND_SOC_DAILINK_REG(idisp3_cpu, idisp3_codec, platform), }, { .name = "Analog Playback and Capture",
Greg Kroah-Hartman
maintainerPATCH 309/367 mfd: da9062: Fix watchdog compatible string
In reply to Greg Kroah-HartmanFrom: Marco Felsch <[email protected]>
commit 1112ba02ff1190ca9c15a912f9269e54b46d2d82 upstream.
The watchdog driver compatible is "dlg,da9062-watchdog" and not "dlg,da9062-wdt". Therefore the mfd-core can't populate the of_node and fwnode. As result the watchdog driver can't parse the devicetree.
--- drivers/mfd/da9062-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/da9062-core.c +1 -1
@@ -248,7 +248,7 @@ static const struct mfd_cell da9062_devs .name = "da9062-watchdog", .num_resources = ARRAY_SIZE(da9062_wdt_resources), .resources = da9062_wdt_resources, - .of_compatible = "dlg,da9062-wdt", + .of_compatible = "dlg,da9062-watchdog", }, { .name = "da9062-thermal",
Greg Kroah-Hartman
maintainerPATCH 310/367 mfd: rn5t618: Mark ADC control register volatile
In reply to Greg Kroah-HartmanFrom: Andreas Kemnade <[email protected]>
commit 2f3dc25c0118de03a00ddc88b61f7216854f534d upstream.
There is a bit which gets cleared after conversion.
--- drivers/mfd/rn5t618.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/rn5t618.c +1 -0
@@ -26,6 +26,7 @@ static bool rn5t618_volatile_reg(structcase RN5T618_WATCHDOGCNT :case RN5T618_DCIRQ : case RN5T618_ILIMDATAH ... RN5T618_AIN0DATAL: +case RN5T618_ADCCNT3 : case RN5T618_IR_ADC1 ... RN5T618_IR_ADC3:case RN5T618_IR_GPR :case RN5T618_IR_GPF :
Greg Kroah-Hartman
maintainerPATCH 311/367 mfd: bd70528: Fix hour register mask
In reply to Greg Kroah-HartmanFrom: Matti Vaittinen <[email protected]>
commit 6c883472e1c11cb05561b6dd0c28bb037c2bf2de upstream.
When RTC is used in 24H mode (and it is by this driver) the maximum hour value is 24 in BCD. This occupies bits [5:0] - which means correct mask for HOUR register is 0x3f not 0x1f. Fix the mask
--- include/linux/mfd/rohm-bd70528.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/mfd/rohm-bd70528.h +1 -1
@@ -317,7 +317,7 @@ enum {#define BD70528_MASK_RTC_MINUTE 0x7f#define BD70528_MASK_RTC_HOUR_24H 0x80#define BD70528_MASK_RTC_HOUR_PM 0x20 -#define BD70528_MASK_RTC_HOUR 0x1f +#define BD70528_MASK_RTC_HOUR 0x3f#define BD70528_MASK_RTC_DAY 0x3f#define BD70528_MASK_RTC_WEEK 0x07#define BD70528_MASK_RTC_MONTH 0x1f
Greg Kroah-Hartman
maintainerPATCH 312/367 mfd: ab8500: Fix ab8500-clk typo
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
commit 702204c22c53f94b2e25a3bdcda759cce7b26305 upstream.
Commit f4d41ad84433 ("mfd: ab8500: Example using new OF_MFD_CELL MACRO") has a typo error renaming "ab8500-clk" to "abx500-clk"
with the result att ALSA SoC audio broke as the clock
driver was not probing anymore. Fixed it up.
--- drivers/mfd/ab8500-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mfd/ab8500-core.c +2 -2
@@ -631,8 +631,8 @@ static const struct mfd_cell ab8500_devs NULL, NULL, 0, 0, "stericsson,ab8500-ext-regulator"),OF_MFD_CELL ("ab8500-regulator" ,NULL ,NULL ,0 ,0 ,"stericsson,ab8500-regulator" ), -OF_MFD_CELL ("abx500-clk" , -NULL ,NULL ,0 ,0 ,"stericsson,abx500-clk" ), +OF_MFD_CELL ("ab8500-clk" , +NULL ,NULL ,0 ,0 ,"stericsson,ab8500-clk" ),OF_MFD_CELL ("ab8500-gpadc" ,NULL ,NULL ,0 ,0 ,"stericsson,ab8500-gpadc" ), OF_MFD_CELL("ab8500-rtc",
Greg Kroah-Hartman
maintainerPATCH 313/367 bpf: Fix trampoline usage in preempt
In reply to Greg Kroah-HartmanFrom: Alexei Starovoitov <[email protected]>
commit 05d57f1793fb250c85028c9952c3720010baa853 upstream.
Though the second half of trampoline page is unused a task could be preempted in the middle of the first half of trampoline and two updates to trampoline would change the code from underneath the preempted task. Hence wait for tasks to voluntarily schedule or go to userspace. Add similar wait before freeing the trampoline.
--- kernel/bpf/trampoline.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
kernel/bpf/trampoline.c +10 -0
@@ -150,6 +150,14 @@ static int bpf_trampoline_update(structif (fexit_cnt) flags =BPF_TRAMP_F_CALL_ORIG |BPF_TRAMP_F_SKIP_FRAME ; +/* Though the second half of trampoline page is unused a task could be +* preempted in the middle of the first half of trampoline and two +* updates to trampoline would change the code from underneath the +* preempted task. Hence wait for tasks to voluntarily schedule or go +* to userspace. +*/ +synchronize_rcu_tasks (); + err = arch_prepare_bpf_trampoline(new_image, &tr->func.model, flags, fentry, fentry_cnt, fexit, fexit_cnt,
@@ -240,6 +248,8 @@ void bpf_trampoline_put(struct bpf_tramp goto out;if (WARN_ON_ONCE (!hlist_empty (&tr->progs_hlist[BPF_TRAMP_FEXIT ]))) goto out; +/* wait for tasks to get out of trampoline before freeing it */ +synchronize_rcu_tasks ();bpf_jit_free_exec (tr->image);hlist_del (&tr->hlist);kfree (tr);
Greg Kroah-Hartman
maintainerPATCH 314/367 libbpf: Extract and generalize CPU mask parsing logic
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
commit 6803ee25f0ead1e836808acb14396bb9a9849113 upstream.
This logic is re-used for parsing a set of online CPUs. Having it as an isolated piece of code working with input string makes it conveninent to test this logic as well. While refactoring, also improve the robustness of original implementation.
--- tools/lib/bpf/libbpf.c | 127 ++++++++++++++++++++++++++-------------- tools/lib/bpf/libbpf_internal.h | 2 2 files changed, 87 insertions(+), 42 deletions(-)
tools/lib/bpf/libbpf.c +85 -42
@@ -6542,61 +6542,104 @@ void bpf_program__bpil_offs_to_addr(stru } } -int libbpf_num_possible_cpus (void ) +int parse_cpu_mask_str (const char *s,bool **mask,int *mask_sz) { -static const char *fcpu ="/sys/devices/system/cpu/possible" ; -int len =0 , n =0 , il =0 , ir =0 ; -unsigned int start =0 , end =0 ; -int tmp_cpus =0 ; -static int cpus; -char buf[128 ]; -int error =0 ; -int fd =-1 ; +int err =0 , n, len, start, end =-1 ; +bool *tmp; - tmp_cpus =READ_ONCE (cpus); -if (tmp_cpus >0 ) -return tmp_cpus; + *mask =NULL ; + *mask_sz =0 ; + +/* Each sub string separated by ',' has format \d+-\d+ or \d+ */ +while (*s) { +if (*s ==',' || *s =='\n' ) { + s++; +continue ; + } + n =sscanf (s,"%d%n-%d%n" , &start, &len, &end, &len); +if (n <=0 || n >2 ) { +pr_warn ("Failed to get CPU range %s: %d\n" , s, n); + err = -EINVAL ; + goto cleanup; + }else if (n ==1 ) { + end = start; + } +if (start <0 || start > end) { +pr_warn ("Invalid CPU range [%d,%d] in %s\n" , + start, end, s); + err = -EINVAL ; + goto cleanup; + } + tmp =realloc (*mask, end +1 ); +if (!tmp) { + err = -ENOMEM ; + goto cleanup; + } + *mask = tmp; +memset (tmp + *mask_sz,0 , start - *mask_sz); +memset (tmp + start,1 , end - start +1 ); + *mask_sz = end +1 ; + s += len; + } +if (!*mask_sz) { +pr_warn ("Empty CPU range\n" ); +return -EINVAL ; + } +return 0 ; +cleanup: +free (*mask); + *mask =NULL ; +return err; +} + +int parse_cpu_mask_file (const char *fcpu,bool **mask,int *mask_sz) +{ +int fd, err =0 , len; +char buf[128 ]; fd =open (fcpu,O_RDONLY );if (fd <0 ) { - error = errno; -pr_warn ("Failed to open file %s: %s\n" , fcpu,strerror (error)); -return -error; + err = -errno; +pr_warn ("Failed to open cpu mask file %s: %d\n" , fcpu, err); +return err; } len =read (fd, buf,sizeof (buf));close (fd);if (len <=0 ) { - error = len ? errno :EINVAL ; -pr_warn ("Failed to read # of possible cpus from %s: %s\n" , - fcpu,strerror (error)); -return -error; - } -if (len ==sizeof (buf)) { -pr_warn ("File %s size overflow\n" , fcpu); -return -EOVERFLOW ; + err = len ? -errno : -EINVAL ; +pr_warn ("Failed to read cpu mask from %s: %d\n" , fcpu, err); +return err; + } +if (len >=sizeof (buf)) { +pr_warn ("CPU mask is too big in file %s\n" , fcpu); +return -E2BIG ; } buf[len] ='\0' ; -for (ir =0 , tmp_cpus =0 ; ir <= len; ir++) { -/* Each sub string separated by ',' has format \d+-\d+ or \d+ */ -if (buf[ir] ==',' || buf[ir] =='\0' ) { - buf[ir] ='\0' ; - n =sscanf (&buf[il],"%u-%u" , &start, &end); -if (n <=0 ) { -pr_warn ("Failed to get # CPUs from %s\n" , - &buf[il]); -return -EINVAL ; - }else if (n ==1 ) { - end = start; - } - tmp_cpus += end - start +1 ; - il = ir +1 ; - } - } -if (tmp_cpus <=0 ) { -pr_warn ("Invalid #CPUs %d from %s\n" , tmp_cpus, fcpu); -return -EINVAL ; +return parse_cpu_mask_str (buf, mask, mask_sz); +} + +int libbpf_num_possible_cpus (void ) +{ +static const char *fcpu ="/sys/devices/system/cpu/possible" ; +static int cpus; +int err, n, i, tmp_cpus; +bool *mask; + + tmp_cpus =READ_ONCE (cpus); +if (tmp_cpus >0 ) +return tmp_cpus; + + err =parse_cpu_mask_file (fcpu, &mask, &n); +if (err) +return err; + + tmp_cpus =0 ; +for (i =0 ; i < n; i++) { +if (mask[i]) + tmp_cpus++; } +free (mask);WRITE_ONCE (cpus, tmp_cpus);return tmp_cpus;
tools/lib/bpf/libbpf_internal.h +2 -0
@@ -95,6 +95,8 @@ static inline bool libbpf_validate_opts(#define OPTS_GET (opts, field, fallback_value) \ (OPTS_HAS(opts, field) ? (opts)->field : fallback_value) +int parse_cpu_mask_str (const char *s,bool **mask,int *mask_sz); +int parse_cpu_mask_file (const char *fcpu,bool **mask,int *mask_sz);int libbpf__load_raw_btf (const char *raw_types,size_t types_len,const char *str_sec,size_t str_len);
Greg Kroah-Hartman
maintainerPATCH 315/367 x86/timer: Dont skip PIT setup when APIC is disabled or in legacy mode
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 979923871f69a4dc926658f9f9a1a4c1bde57552 upstream.
Tony reported a boot regression caused by the recent workaround for systems which have a disabled (clock gate off) PIT.
On his machine the kernel fails to initialize the PIT because apic_needs_pit() does not take into account whether the local APIC interrupt delivery mode will actually allow to setup and use the local APIC timer. This should be easy to reproduce with acpi=off on the command line which also disables HPET.
Due to the way the PIT/HPET and APIC setup ordering works (APIC setup can require working PIT/HPET) the information is not available at the point where apic_needs_pit() makes this decision.
To address this, split out the interrupt mode selection from apic_intr_mode_init(), invoke the selection before making the decision whether PIT is required or not, and add the missing checks into apic_needs_pit().
--- arch/x86/include/asm/apic.h | 2 ++ arch/x86/include/asm/x86_init.h | 2 ++ arch/x86/kernel/apic/apic.c | 23 ++++++++++++++++++----- arch/x86/kernel/time.c | 12 ++++++++++-- arch/x86/kernel/x86_init.c | 1 + arch/x86/xen/enlighten_pv.c | 1 + 6 files changed, 34 insertions(+), 7 deletions(-)
arch/x86/include/asm/apic.h +2 -0
@@ -140,6 +140,7 @@ extern void apic_soft_disable(void);extern void lapic_shutdown (void );extern void sync_Arb_IDs (void );extern void init_bsp_APIC (void ); +extern void apic_intr_mode_select (void );extern void apic_intr_mode_init (void );extern void init_apic_mappings (void );void register_lapic_address (unsigned long address);
@@ -188,6 +189,7 @@ static inline void disable_local_APIC(vo# define setup_secondary_APIC_clock x86_init_noopstatic inline void lapic_update_tsc_freq (void ) { }static inline void init_bsp_APIC (void ) { } +static inline void apic_intr_mode_select (void ) { }static inline void apic_intr_mode_init (void ) { }static inline void lapic_assign_system_vectors (void ) { }static inline void lapic_assign_legacy_vector (unsigned int i,bool r) { }
arch/x86/include/asm/x86_init.h +2 -0
@@ -51,12 +51,14 @@ struct x86_init_resources {* are set up. * @intr_init: interrupt init code * @trap_init: platform specific trap setup +* @intr_mode_select: interrupt delivery mode selection * @intr_mode_init: interrupt delivery mode setup */ struct x86_init_irqs {void (*pre_vector_init)(void );void (*intr_init)(void );void (*trap_init)(void ); +void (*intr_mode_select)(void );void (*intr_mode_init)(void ); };
arch/x86/kernel/apic/apic.c +18 -5
@@ -830,8 +830,17 @@ bool __init apic_needs_pit(void)if (!tsc_khz || !cpu_khz)return true; -/* Is there an APIC at all? */ -if (!boot_cpu_has (X86_FEATURE_APIC )) +/* Is there an APIC at all or is it disabled? */ +if (!boot_cpu_has (X86_FEATURE_APIC ) || disable_apic) +return true; + +/* +* If interrupt delivery mode is legacy PIC or virtual wire without +* configuration, the local APIC timer wont be set up. Make sure +* that the PIT is initialized. +*/ +if (apic_intr_mode ==APIC_PIC || + apic_intr_mode ==APIC_VIRTUAL_WIRE_NO_CONFIG )return true;/* Virt guests may lack ARAT, but still have DEADLINE */
@@ -1322,7 +1331,7 @@ void __init sync_Arb_IDs(void)enum apic_intr_mode_id apic_intr_mode__ro_after_init ; -static int __init apic_intr_mode_select (void ) +static int __init __apic_intr_mode_select (void ) {/* Check kernel option */ if (disable_apic) {
@@ -1384,6 +1393,12 @@ static int __init apic_intr_mode_select(return APIC_SYMMETRIC_IO ; } +/* Select the interrupt delivery mode for the BSP */ +void __init apic_intr_mode_select (void ) +{ + apic_intr_mode =__apic_intr_mode_select (); +} +/* * An initial setup of the virtual wire mode. */
@@ -1440,8 +1455,6 @@ void __init apic_intr_mode_init(void) {bool upmode =IS_ENABLED (CONFIG_UP_LATE_INIT ); - apic_intr_mode =apic_intr_mode_select (); -switch (apic_intr_mode) {case APIC_PIC :pr_info ("APIC: Keep in PIC mode(8259)\n" );
arch/x86/kernel/time.c +10 -2
@@ -91,10 +91,18 @@ void __init hpet_time_init(void)static __init void x86_late_time_init (void ) { +/* +* Before PIT/HPET init, select the interrupt mode. This is required +* to make the decision whether PIT should be initialized correct. +*/ + x86_init.irqs.intr_mode_select (); + +/* Setup the legacy timers */ x86_init.timers.timer_init (); +/* -* After PIT/HPET timers init, select and setup -* the final interrupt mode for delivering IRQs. +* After PIT/HPET timers init, set up the final interrupt mode for +* delivering IRQs. */ x86_init.irqs.intr_mode_init ();tsc_init ();
arch/x86/kernel/x86_init.c +1 -0
@@ -80,6 +80,7 @@ struct x86_init_ops x86_init __initdata .pre_vector_init = init_ISA_irqs, .intr_init = native_init_IRQ, .trap_init = x86_init_noop, + .intr_mode_select = apic_intr_mode_select, .intr_mode_init = apic_intr_mode_init },
arch/x86/xen/enlighten_pv.c +1 -0
@@ -1205,6 +1205,7 @@ asmlinkage __visible void __init xen_sta x86_platform.get_nmi_reason = xen_get_nmi_reason; x86_init.resources.memory_setup = xen_memory_setup; + x86_init.irqs.intr_mode_select = x86_init_noop; x86_init.irqs.intr_mode_init = x86_init_noop; x86_init.oem.arch_setup = xen_arch_setup; x86_init.oem.banner = xen_banner;
Greg Kroah-Hartman
maintainerPATCH 316/367 bonding/alb: properly access headers in bond_alb_xmit()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 38f88c45404293bbc027b956def6c10cbd45c616 ]
syzbot managed to send an IPX packet through bond_alb_xmit() and af_packet and triggered a use-after-free.
First, bond_alb_xmit() was using ipx_hdr() helper to reach the IPX header, but ipx_hdr() was using the transport offset instead of the network offset. In the particular syzbot report transport offset was 0xFFFF
This patch removes ipx_hdr() since it was only (mis)used from bonding.
Then we need to make sure IPv4/IPv6/IPX headers are pulled in skb->head before dereferencing anything.
BUG: KASAN: use-after-free in bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452 Read of size 2 at addr ffff8801ce56dfff by task syz-executor.2/18108 (if (ipx_hdr(skb)->ipx_checksum != IPX_NO_CHECKSUM) ...) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: [<ffffffff8441fc42>] __dump_stack lib/dump_stack.c:17 [inline] [<ffffffff8441fc42>] dump_stack+0x14d/0x20b lib/dump_stack.c:53 [<ffffffff81a7dec4>] print_address_description+0x6f/0x20b mm/kasan/report.c:282 [<ffffffff81a7e0ec>] kasan_report_error mm/kasan/report.c:380 [inline] [<ffffffff81a7e0ec>] kasan_report mm/kasan/report.c:438 [inline] [<ffffffff81a7e0ec>] kasan_report.cold+0x8c/0x2a0 mm/kasan/report.c:422 [<ffffffff81a7dc4f>] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:469 [<ffffffff82c8c00a>] bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452 [<ffffffff82c60c74>] __bond_start_xmit drivers/net/bonding/bond_main.c:4199 [inline] [<ffffffff82c60c74>] bond_start_xmit+0x4f4/0x1570 drivers/net/bonding/bond_main.c:4224 [<ffffffff83baa558>] __netdev_start_xmit include/linux/netdevice.h:4525 [inline] [<ffffffff83baa558>] netdev_start_xmit include/linux/netdevice.h:4539 [inline] [<ffffffff83baa558>] xmit_one net/core/dev.c:3611 [inline] [<ffffffff83baa558>] dev_hard_start_xmit+0x168/0x910 net/core/dev.c:3627 [<ffffffff83bacf35>] __dev_queue_xmit+0x1f55/0x33b0 net/core/dev.c:4238 [<ffffffff83bae3a8>] dev_queue_xmit+0x18/0x20 net/core/dev.c:4278 [<ffffffff84339189>] packet_snd net/packet/af_packet.c:3226 [inline] [<ffffffff84339189>] packet_sendmsg+0x4919/0x70b0 net/packet/af_packet.c:3252 [<ffffffff83b1ac0c>] sock_sendmsg_nosec net/socket.c:673 [inline] [<ffffffff83b1ac0c>] sock_sendmsg+0x12c/0x160 net/socket.c:684 [<ffffffff83b1f5a2>] __sys_sendto+0x262/0x380 net/socket.c:1996 [<ffffffff83b1f700>] SYSC_sendto net/socket.c:2008 [inline] [<ffffffff83b1f700>] SyS_sendto+0x40/0x60 net/socket.c:2004
--- drivers/net/bonding/bond_alb.c | 44 +++++++++++++++++++++++++++++------------ include/net/ipx.h | 5 ---- 2 files changed, 32 insertions(+), 17 deletions(-)
drivers/net/bonding/bond_alb.c +32 -12
@@ -1383,26 +1383,31 @@ netdev_tx_t bond_alb_xmit(struct sk_buffbool do_tx_balance = true;u32 hash_index =0 ;const u8 *hash_start =NULL ; -struct ipv6hdr *ip6hdr;skb_reset_mac_header (skb); eth_data =eth_hdr (skb);switch (ntohs (skb->protocol)) {case ETH_P_IP : { -const struct iphdr *iph =ip_hdr (skb); +const struct iphdr *iph;if (is_broadcast_ether_addr (eth_data->h_dest) || - iph->daddr == ip_bcast || - iph->protocol ==IPPROTO_IGMP ) { + !pskb_network_may_pull (skb,sizeof (*iph))) { + do_tx_balance = false; +break ; + } + iph =ip_hdr (skb); +if (iph->daddr == ip_bcast || iph->protocol ==IPPROTO_IGMP ) { do_tx_balance = false;break ; } hash_start = (char *)&(iph->daddr); hash_size =sizeof (iph->daddr); - }break ; -case ETH_P_IPV6 : + } +case ETH_P_IPV6 : { +const struct ipv6hdr *ip6hdr; +/* IPv6 doesn't really use broadcast mac address, but leave * that here just in case. */
@@ -1419,7 +1424,11 @@ netdev_tx_t bond_alb_xmit(struct sk_buffbreak ; } -/* Additianally, DAD probes should not be tx-balanced as that +if (!pskb_network_may_pull (skb,sizeof (*ip6hdr))) { + do_tx_balance = false; +break ; + } +/* Additionally, DAD probes should not be tx-balanced as that * will lead to false positives for duplicate addresses and * prevent address configuration from working. */
@@ -1429,17 +1438,26 @@ netdev_tx_t bond_alb_xmit(struct sk_buffbreak ; } - hash_start = (char *)&(ipv6_hdr (skb)->daddr); - hash_size =sizeof (ipv6_hdr (skb)->daddr); + hash_start = (char *)&ip6hdr->daddr; + hash_size =sizeof (ip6hdr->daddr);break ; -case ETH_P_IPX : -if (ipx_hdr (skb)->ipx_checksum !=IPX_NO_CHECKSUM ) { + } +case ETH_P_IPX : { +const struct ipxhdr *ipxhdr; + +if (pskb_network_may_pull (skb,sizeof (*ipxhdr))) { + do_tx_balance = false; +break ; + } + ipxhdr = (struct ipxhdr *)skb_network_header (skb); + +if (ipxhdr->ipx_checksum !=IPX_NO_CHECKSUM ) {/* something is wrong with this packet */ do_tx_balance = false;break ; } -if (ipx_hdr (skb)->ipx_type !=IPX_TYPE_NCP ) { +if (ipxhdr->ipx_type !=IPX_TYPE_NCP ) {/* The only protocol worth balancing in * this family since it has an "ARP" like * mechanism
@@ -1448,9 +1466,11 @@ netdev_tx_t bond_alb_xmit(struct sk_buffbreak ; } + eth_data =eth_hdr (skb); hash_start = (char *)eth_data->h_dest; hash_size =ETH_ALEN ;break ; + }case ETH_P_ARP : do_tx_balance = false;if (bond_info->rlb_enabled)
include/net/ipx.h +0 -5
@@ -47,11 +47,6 @@ struct ipxhdr {/* From af_ipx.c */ extern int sysctl_ipx_pprop_broadcasting; -static __inline__struct ipxhdr *ipx_hdr (struct sk_buff *skb) -{ -return (struct ipxhdr *)skb_transport_header (skb); -} -struct ipx_interface {/* IPX address */ __be32 if_netnum;
Greg Kroah-Hartman
maintainerPATCH 317/367 devlink: report 0 after hitting end in region read
In reply to Greg Kroah-HartmanFrom: Jacob Keller <[email protected]>
[ Upstream commit d5b90e99e1d51b7b5d2b74fbc4c2db236a510913 ]
commit fdd41ec21e15 ("devlink: Return right error code in case of errors for region read") modified the region read code to report errors properly in unexpected cases.
In the case where the start_offset and ret_offset match, it unilaterally converted this into an error. This causes an issue for the "dump" version of the command. In this case, the devlink region dump will always report an invalid argument:
000000000000ffd0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 000000000000ffe0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff devlink answers: Invalid argument000000000000fff0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
This occurs because the expected flow for the dump is to return 0 after there is no further data.
The simplest fix would be to stop converting the error code to -EINVAL if start_offset == ret_offset. However, avoid unnecessary work by checking for when start_offset is larger than the region size and returning 0 upfront.
--- net/core/devlink.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/core/devlink.c +6 -0
@@ -3986,6 +3986,12 @@ static int devlink_nl_cmd_region_read_du goto out_unlock; } +/* return 0 if there is no further data to read */ +if (start_offset >= region->size) { + err =0 ; + goto out_unlock; + } + hdr =genlmsg_put (skb,NETLINK_CB (cb->skb).portid, cb->nlh->nlmsg_seq, &devlink_nl_family,NLM_F_ACK |NLM_F_MULTI ,DEVLINK_CMD_REGION_READ );
Greg Kroah-Hartman
maintainerPATCH 318/367 dpaa_eth: support all modes with rate adapting PHYs
In reply to Greg Kroah-HartmanFrom: Madalin Bucur <[email protected]>
[ Upstream commit 73a21fa817f0cc8022dc6226250a86bca727a56d ]
Stop removing modes that are not supported on the system interface when the connected PHY is capable of rate adaptation. This addresses an issue with the LS1046ARDB board 10G interface no longer working with an 1G link partner after autonegotiation support was added for the Aquantia PHY on board in
commit 09c4c57f7bc4 ("net: phy: aquantia: add support for auto-negotiation configuration")
Before this commit the values advertised by the PHY were not influenced by the dpaa_eth driver removal of system-side unsupported modes as the aqr_config_aneg() was basically a no-op. After this commit, the modes removed by the dpaa_eth driver were no longer advertised thus autonegotiation with 1G link partners failed.
--- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +11 -3
@@ -2453,6 +2453,9 @@ static void dpaa_adjust_link(struct net_ mac_dev->adjust_link (mac_dev); } +/* The Aquantia PHYs are capable of performing rate adaptation */ +#define PHY_VEND_AQUANTIA 0x03a1b400 +static int dpaa_phy_init (struct net_device *net_dev) {__ETHTOOL_DECLARE_LINK_MODE_MASK (mask) = {0 , };
@@ -2471,9 +2474,14 @@ static int dpaa_phy_init(struct net_devireturn -ENODEV ; } -/* Remove any features not supported by the controller */ -ethtool_convert_legacy_u32_to_link_mode (mask, mac_dev->if_support); -linkmode_and (phy_dev->supported, phy_dev->supported, mask); +/* Unless the PHY is capable of rate adaptation */ +if (mac_dev->phy_if !=PHY_INTERFACE_MODE_XGMII || + ((phy_dev->drv->phy_id &GENMASK (31 ,10 )) !=PHY_VEND_AQUANTIA )) { +/* remove any features not supported by the controller */ +ethtool_convert_legacy_u32_to_link_mode (mask, + mac_dev->if_support); +linkmode_and (phy_dev->supported, phy_dev->supported, mask); + }phy_support_asym_pause (phy_dev);
Greg Kroah-Hartman
maintainerPATCH 319/367 net: dsa: b53: Always use dev->vlan_enabled in b53_configure_vlan()
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit df373702bc0f8f2d83980ea441e71639fc1efcf8 ]
b53_configure_vlan() is called by the bcm_sf2 driver upon setup and indirectly through resume as well. During the initial setup, we are guaranteed that dev->vlan_enabled is false, so there is no change in behavior, however during suspend, we may have enabled VLANs before, so we do want to restore that setting.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -680,7 +680,7 @@ int b53_configure_vlan(struct dsa_switchb53_do_vlan_op (dev,VTA_CMD_CLEAR ); } -b53_enable_vlan (dev, false, ds->vlan_filtering); +b53_enable_vlan (dev, dev->vlan_enabled, ds->vlan_filtering);b53_for_each_port (dev, i) b53_write16(dev, B53_VLAN_PAGE,
Greg Kroah-Hartman
maintainerPATCH 320/367 net: dsa: bcm_sf2: Only 7278 supports 2Gb/sec IMP port
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit de34d7084edd069dac5aa010cfe32bd8c4619fa6 ]
The 7445 switch clocking profiles do not allow us to run the IMP port at 2Gb/sec in a way that it is reliable and consistent. Make sure that the setting is only applied to the 7278 family.
--- drivers/net/dsa/bcm_sf2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/dsa/bcm_sf2.c +3 -1
@@ -68,7 +68,9 @@ static void bcm_sf2_imp_setup(struct dsa/* Force link status for IMP port */ reg =core_readl (priv, offset); - reg |= (MII_SW_OR |LINK_STS |GMII_SPEED_UP_2G ); + reg |= (MII_SW_OR |LINK_STS ); +if (priv->type ==BCM7278_DEVICE_ID ) + reg |=GMII_SPEED_UP_2G ;core_writel (priv, reg, offset);/* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
Greg Kroah-Hartman
maintainerPATCH 321/367 net: dsa: microchip: enable module autoprobe
In reply to Greg Kroah-HartmanFrom: Razvan Stefanescu <[email protected]>
[ Upstream commit f8c2afa66d5397b0b9293c4347dac6dabb327685 ]
This matches /sys/devices/.../spi1.0/modalias content.
--- drivers/net/dsa/microchip/ksz9477_spi.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/dsa/microchip/ksz9477_spi.c +6 -0
@@ -101,6 +101,12 @@ static struct spi_driver ksz9477_spi_drimodule_spi_driver (ksz9477_spi_driver); +MODULE_ALIAS ("spi:ksz9477" ); +MODULE_ALIAS ("spi:ksz9897" ); +MODULE_ALIAS ("spi:ksz9893" ); +MODULE_ALIAS ("spi:ksz9563" ); +MODULE_ALIAS ("spi:ksz8563" ); +MODULE_ALIAS ("spi:ksz9567" );MODULE_AUTHOR ("Woojung Huh <[email protected]>" );MODULE_DESCRIPTION ("Microchip KSZ9477 Series Switch SPI access Driver" );MODULE_LICENSE ("GPL" );
Greg Kroah-Hartman
maintainerPATCH 322/367 net: mvneta: move rx_dropped and rx_errors in per-cpu stats
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit c35947b8ff8acca33134ee39c31708233765c31a ]
Move rx_dropped and rx_errors counters in mvneta_pcpu_stats in order to avoid possible races updating statistics
--- drivers/net/ethernet/marvell/mvneta.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-)
drivers/net/ethernet/marvell/mvneta.c +22 -9
@@ -401,6 +401,8 @@ struct mvneta_pcpu_stats {struct u64_stats_sync syncp;u64 rx_packets;u64 rx_bytes; +u64 rx_dropped; +u64 rx_errors;u64 tx_packets;u64 tx_bytes; };
@@ -738,6 +740,8 @@ mvneta_get_stats64(struct net_device *destruct mvneta_pcpu_stats *cpu_stats;u64 rx_packets;u64 rx_bytes; +u64 rx_dropped; +u64 rx_errors;u64 tx_packets;u64 tx_bytes;
@@ -746,19 +750,20 @@ mvneta_get_stats64(struct net_device *de start =u64_stats_fetch_begin_irq (&cpu_stats->syncp); rx_packets = cpu_stats->rx_packets; rx_bytes = cpu_stats->rx_bytes; + rx_dropped = cpu_stats->rx_dropped; + rx_errors = cpu_stats->rx_errors; tx_packets = cpu_stats->tx_packets; tx_bytes = cpu_stats->tx_bytes; }while (u64_stats_fetch_retry_irq (&cpu_stats->syncp, start)); stats->rx_packets += rx_packets; stats->rx_bytes += rx_bytes; + stats->rx_dropped += rx_dropped; + stats->rx_errors += rx_errors; stats->tx_packets += tx_packets; stats->tx_bytes += tx_bytes; } - stats->rx_errors = dev->stats.rx_errors; - stats->rx_dropped = dev->stats.rx_dropped; - stats->tx_dropped = dev->stats.tx_dropped; }
@@ -1736,8 +1741,14 @@ static u32 mvneta_txq_desc_csum(int l3_ostatic void mvneta_rx_error (struct mvneta_port *pp,struct mvneta_rx_desc *rx_desc) { +struct mvneta_pcpu_stats *stats =this_cpu_ptr (pp->stats);u32 status = rx_desc->status; +/* update per-cpu counter */ +u64_stats_update_begin (&stats->syncp); + stats->rx_errors++; +u64_stats_update_end (&stats->syncp); +switch (status &MVNETA_RXD_ERR_CODE_MASK ) {case MVNETA_RXD_ERR_CRC : netdev_err(pp->dev, "bad rx status %08x (crc error), size=%d\n",
@@ -2179,11 +2190,15 @@ mvneta_swbm_rx_frame(struct mvneta_port rxq->skb =build_skb (xdp->data_hard_start,PAGE_SIZE );if (unlikely (!rxq->skb)) { -netdev_err (dev, -"Can't allocate skb on queue %d\n" , - rxq->id); - dev->stats.rx_dropped++; +struct mvneta_pcpu_stats *stats =this_cpu_ptr (pp->stats); + +netdev_err (dev,"Can't allocate skb on queue %d\n" , rxq->id); rxq->skb_alloc_err++; + +u64_stats_update_begin (&stats->syncp); + stats->rx_dropped++; +u64_stats_update_end (&stats->syncp); +return -ENOMEM ; }page_pool_release_page (rxq->page_pool, page);
@@ -2270,7 +2285,6 @@ static int mvneta_rx_swbm(struct napi_st/* Check errors only for FIRST descriptor */ if (rx_status &MVNETA_RXD_ERR_SUMMARY ) {mvneta_rx_error (pp, rx_desc); - dev->stats.rx_errors++;/* leave the descriptor untouched */ continue ; }
@@ -2372,7 +2386,6 @@ err_drop_frame_ret_pool:mvneta_bm_pool_put_bp (pp->bm_priv, bm_pool, rx_desc->buf_phys_addr); err_drop_frame: - dev->stats.rx_errors++;mvneta_rx_error (pp, rx_desc);/* leave the descriptor untouched */ continue ;
Greg Kroah-Hartman
maintainerPATCH 323/367 net_sched: fix a resource leak in tcindex_set_parms()
In reply to Greg Kroah-HartmanFrom: Cong Wang <[email protected]>
[ Upstream commit 52b5ae501c045010aeeb1d5ac0373ff161a88291 ]
Jakub noticed there is a potential resource leak in tcindex_set_parms(): when tcindex_filter_result_init() fails and it jumps to 'errout1' which doesn't release the memory and resources allocated by tcindex_alloc_perfect_hash().
We should just jump to 'errout_alloc' which callstcindex_free_perfect_hash().
--- net/sched/cls_tcindex.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/sched/cls_tcindex.c +1 -2
@@ -365,7 +365,7 @@ tcindex_set_parms(struct net *net, struc err =tcindex_filter_result_init (&new_filter_result, net);if (err <0 ) - goto errout1; + goto errout_alloc;if (old_r) cr = r->res;
@@ -484,7 +484,6 @@ errout_alloc:tcindex_free_perfect_hash (cp); else if (balloc == 2) kfree(cp->h); -errout1:tcf_exts_destroy (&new_filter_result.exts); errout:kfree (cp);
Greg Kroah-Hartman
maintainerPATCH 324/367 net: stmmac: fix a possible endless loop
In reply to Greg Kroah-HartmanFrom: Dejin Zheng <[email protected]>
[ Upstream commit 7d10f0774f9e32aa2f2e012f7fcb312a2ce422b9 ]
It forgot to reduce the value of the variable retry in a while loop in the ethqos_configure() function. It may cause an endless loop and without timeout.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c +1 -0
@@ -413,6 +413,7 @@ static int ethqos_configure(struct qcom_ dll_lock =rgmii_readl (ethqos,SDC4_STATUS );if (dll_lock &SDC4_STATUS_DLL_LOCK )break ; + retry--; }while (retry >0 );if (!retry) dev_err(ðqos->pdev->dev,
Greg Kroah-Hartman
maintainerPATCH 325/367 net: systemport: Avoid RBUF stuck in Wake-on-LAN mode
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 263a425a482fc495d6d3f9a29b9103a664c38b69 ]
After a number of suspend and resume cycles, it is possible for the RBUF to be stuck in Wake-on-LAN mode, despite the MPD enable bit being cleared which instructed the RBUF to exit that mode.
Avoid creating that problematic condition by clearing the RX_EN and TX_EN bits in the UniMAC prior to disable the Magic Packet Detector logic which is guaranteed to make the RBUF exit Wake-on-LAN mode.
--- drivers/net/ethernet/broadcom/bcmsysport.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/broadcom/bcmsysport.c +3 -0
@@ -2728,6 +2728,9 @@ static int __maybe_unused bcm_sysport_reumac_reset (priv); +/* Disable the UniMAC RX/TX */ +umac_enable_set (priv,CMD_RX_EN |CMD_TX_EN ,0 ); +/* We may have been suspended and never received a WOL event that * would turn off MPD detection, take care of that now */
Greg Kroah-Hartman
maintainerPATCH 326/367 net/mlx5: IPsec, Fix esp modify function attribute
In reply to Greg Kroah-HartmanFrom: Raed Salem <[email protected]>
[ Upstream commit 0dc2c534f17c05bed0622b37a744bc38b48ca88a ]
The function mlx5_fpga_esp_validate_xfrm_attrs is wrongly used with negative negation as zero value indicates success but it used as failure return value instead.
Fix by remove the unary not negation operator.
--- drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c +1 -1
@@ -1478,7 +1478,7 @@ int mlx5_fpga_esp_modify_xfrm(struct mlxif (!memcmp (&xfrm->attrs, attrs,sizeof (xfrm->attrs)))return 0 ; -if (!mlx5_fpga_esp_validate_xfrm_attrs (mdev, attrs)) { +if (mlx5_fpga_esp_validate_xfrm_attrs (mdev, attrs)) {mlx5_core_warn (mdev,"Tried to create an esp with unsupported attrs\n" );return -EOPNOTSUPP ; }
Greg Kroah-Hartman
maintainerPATCH 327/367 net/mlx5: IPsec, fix memory leak at mlx5_fpga_ipsec_delete_sa_ctx
In reply to Greg Kroah-HartmanFrom: Raed Salem <[email protected]>
[ Upstream commit 08db2cf577487f5123aebcc2f913e0b8a2c14b43 ]
SA context is allocated at mlx5_fpga_ipsec_create_sa_ctx, however the counterpart mlx5_fpga_ipsec_delete_sa_ctx function nullifies sa_ctx pointer without freeing the memory allocated, hence the memory leak.
Fix by free SA context when the SA is released.
--- drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c +1 -0
@@ -850,6 +850,7 @@ void mlx5_fpga_ipsec_delete_sa_ctx(voidmutex_lock (&fpga_xfrm->lock);if (!--fpga_xfrm->num_rules) {mlx5_fpga_ipsec_release_sa_ctx (fpga_xfrm->sa_ctx); +kfree (fpga_xfrm->sa_ctx); fpga_xfrm->sa_ctx =NULL ; }mutex_unlock (&fpga_xfrm->lock);
Greg Kroah-Hartman
maintainerPATCH 328/367 net: macb: Remove unnecessary alignment check for TSO
In reply to Greg Kroah-HartmanFrom: Harini Katakam <[email protected]>
[ Upstream commit 41c1ef978c8d0259c6636e6d2d854777e92650eb ]
The IP TSO implementation does NOT require the length to be a multiple of 8. That is only a requirement for UFO as per IP documentation. Hence, exit macb_features_check function in the beginning if the protocol is not UDP. Only when it is UDP, proceed further to the alignment checks. Update comments to reflect the same. Also remove dead code checking for protocol TCP when calculating header length.
--- drivers/net/ethernet/cadence/macb_main.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/net/ethernet/cadence/macb_main.c +3 -5
@@ -1752,16 +1752,14 @@ static netdev_features_t macb_features_c/* Validate LSO compatibility */ -/* there is only one buffer */ -if (!skb_is_nonlinear (skb)) +/* there is only one buffer or protocol is not UDP */ +if (!skb_is_nonlinear (skb) || (ip_hdr (skb)->protocol !=IPPROTO_UDP ))return features;/* length of header */ hdrlen =skb_transport_offset (skb); -if (ip_hdr (skb)->protocol ==IPPROTO_TCP ) - hdrlen +=tcp_hdrlen (skb); -/* For LSO: +/* For UFO only: * When software supplies two or more payload buffers all payload buffers * apart from the last must be a multiple of 8 bytes in size. */
Greg Kroah-Hartman
maintainerPATCH 329/367 net: macb: Limit maximum GEM TX length in TSO
In reply to Greg Kroah-HartmanFrom: Harini Katakam <[email protected]>
[ Upstream commit f822e9c4ffa511a5c681cf866287d9383a3b6f1b ]
GEM_MAX_TX_LEN currently resolves to 0x3FF8 for any IP version supporting TSO with full 14bits of length field in payload descriptor. But an IP errata causes false amba_error (bit 6 of ISR) when length in payload descriptors is specified above 16387. The error occurs because the DMA falsely concludes that there is not enough space in SRAM for incoming payload. These errors were observed continuously under stress of large packets using iperf on a version where SRAM was 16K for each queue. This errata will be documented shortly and affects all versions since TSO functionality was added. Hence limit the max length to 0x3FC0 (rounded).
--- drivers/net/ethernet/cadence/macb_main.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_main.c +5 -1
@@ -73,7 +73,11 @@ struct sifive_fu540_macb_mgmt {/* Max length of transmit frame must be a multiple of 8 bytes */ #define MACB_TX_LEN_ALIGN 8#define MACB_MAX_TX_LEN ((unsigned int)((1 << MACB_TX_FRMLEN_SIZE) - 1) & ~((unsigned int)(MACB_TX_LEN_ALIGN - 1))) -#define GEM_MAX_TX_LEN ((unsigned int)((1 << GEM_TX_FRMLEN_SIZE) - 1) & ~((unsigned int)(MACB_TX_LEN_ALIGN - 1))) +/* Limit maximum TX length as per Cadence TSO errata. This is to avoid a +* false amba_error in TX path from the DMA assuming there is not enough +* space in the SRAM (16KB) even when there is. +*/ +#define GEM_MAX_TX_LEN (unsigned int)(0x3FC0)#define GEM_MTU_MIN_SIZE ETH_MIN_MTU#define MACB_NETIF_LSO NETIF_F_TSO
Greg Kroah-Hartman
maintainerPATCH 330/367 net: stmmac: fix incorrect GMAC_VLAN_TAG register writting in GMAC4+
In reply to Greg Kroah-HartmanFrom: "Tan, Tee Min" <[email protected]>
[ Upstream commit 9eeeb3c9de4e3aeaa2bec097162f09305dd9f4c3 ]
It should always do a read of current value of GMAC_VLAN_TAG instead of directly overwriting the register value.
--- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +4 -3
@@ -736,11 +736,14 @@ static void dwmac4_update_vlan_hash(stru __le16 perfect_match, bool is_double) { void __iomem *ioaddr = hw->pcsr; +u32 value;writel (hash, ioaddr +GMAC_VLAN_HASH_TABLE ); + value =readl (ioaddr +GMAC_VLAN_TAG ); +if (hash) { -u32 value =GMAC_VLAN_VTHM |GMAC_VLAN_ETV ; + value |=GMAC_VLAN_VTHM |GMAC_VLAN_ETV ;if (is_double) { value |=GMAC_VLAN_EDVLP ; value |=GMAC_VLAN_ESVL ;
@@ -759,8 +762,6 @@ static void dwmac4_update_vlan_hash(struwritel (value | perfect_match, ioaddr +GMAC_VLAN_TAG ); }else { -u32 value =readl (ioaddr +GMAC_VLAN_TAG ); - value &= ~(GMAC_VLAN_VTHM |GMAC_VLAN_ETV ); value &= ~(GMAC_VLAN_EDVLP |GMAC_VLAN_ESVL ); value &= ~GMAC_VLAN_DOVLTC ;
Greg Kroah-Hartman
maintainerPATCH 331/367 net: stmmac: xgmac: fix incorrect XGMAC_VLAN_TAG register writting
In reply to Greg Kroah-HartmanFrom: Ong Boon Leong <[email protected]>
[ Upstream commit 907a076881f171254219faad05f46ac5baabedfb ]
We should always do a read of current value of XGMAC_VLAN_TAG instead of directly overwriting the register value.
--- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +6 -2
@@ -569,7 +569,9 @@ static void dwxgmac2_update_vlan_hash(stwritel (value, ioaddr +XGMAC_PACKET_FILTER ); - value =XGMAC_VLAN_VTHM |XGMAC_VLAN_ETV ; + value =readl (ioaddr +XGMAC_VLAN_TAG ); + + value |=XGMAC_VLAN_VTHM |XGMAC_VLAN_ETV ;if (is_double) { value |=XGMAC_VLAN_EDVLP ; value |=XGMAC_VLAN_ESVL ;
@@ -584,7 +586,9 @@ static void dwxgmac2_update_vlan_hash(stwritel (value, ioaddr +XGMAC_PACKET_FILTER ); - value =XGMAC_VLAN_ETV ; + value =readl (ioaddr +XGMAC_VLAN_TAG ); + + value |=XGMAC_VLAN_ETV ;if (is_double) { value |=XGMAC_VLAN_EDVLP ; value |=XGMAC_VLAN_ESVL ;
Greg Kroah-Hartman
maintainerPATCH 332/367 net: stmmac: fix missing IFF_MULTICAST check in dwmac4_set_filter
In reply to Greg Kroah-HartmanFrom: "Verma, Aashish" <[email protected]>
[ Upstream commit 2ba31cd93784b61813226d259fd94a221ecd9d61 ]
Without checking for IFF_MULTICAST flag, it is wrong to assume multicast filtering is always enabled. By checking against IFF_MULTICAST, now the driver behaves correctly when the multicast support is toggled by below command:-
ip link set <devname> multicast off|on
--- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +1 -1
@@ -420,7 +420,7 @@ static void dwmac4_set_filter(struct mac value |=GMAC_PACKET_FILTER_PM ;/* Set all the bits of the HASH tab */ memset (mc_filter,0xff ,sizeof (mc_filter)); - }else if (!netdev_mc_empty (dev)) { + }else if (!netdev_mc_empty (dev) && (dev->flags &IFF_MULTICAST )) {struct netdev_hw_addr *ha;/* Hash filter for multicast */
Greg Kroah-Hartman
maintainerPATCH 333/367 net: stmmac: xgmac: fix missing IFF_MULTICAST checki in dwxgmac2_set_filter
In reply to Greg Kroah-HartmanFrom: "Tan, Tee Min" <[email protected]>
[ Upstream commit 2f633d5820e4ed870f408957322acb9263bce2f4 ]
Without checking for IFF_MULTICAST flag, it is wrong to assume multicast filtering is always enabled. By checking against IFF_MULTICAST, now the driver behaves correctly when the multicast support is toggled by below command:-
ip link set <devname> multicast off|on
--- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +1 -1
@@ -458,7 +458,7 @@ static void dwxgmac2_set_filter(struct mfor (i =0 ; i <XGMAC_MAX_HASH_TABLE ; i++)writel (~0x0 , ioaddr +XGMAC_HASH_TABLE (i)); - }else if (!netdev_mc_empty (dev)) { + }else if (!netdev_mc_empty (dev) && (dev->flags &IFF_MULTICAST )) {struct netdev_hw_addr *ha; value |=XGMAC_FILTER_HMC ;
Greg Kroah-Hartman
maintainerPATCH 334/367 net: stmmac: update pci platform data to use phy_interface
In reply to Greg Kroah-HartmanFrom: Voon Weifeng <[email protected]>
[ Upstream commit 909c1dde67c433f1e4122f2619cbd8ac370fcf0a ]
The recent patch to support passive mode converter did not take care the phy interface configuration in PCI platform data. Hence, converting all the PCI platform data from plat->interface to plat->phy_interface as the default mode is meant for PHY.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +8 -6
@@ -96,7 +96,7 @@ static int stmmac_default_data(struct pc plat->bus_id =1 ; plat->phy_addr =0 ; - plat->interface =PHY_INTERFACE_MODE_GMII ; + plat->phy_interface =PHY_INTERFACE_MODE_GMII ; plat->dma_cfg->pbl =32 ; plat->dma_cfg->pblx8 = true;
@@ -220,7 +220,8 @@ static int ehl_sgmii_data(struct pci_dev { plat->bus_id =1 ; plat->phy_addr =0 ; - plat->interface =PHY_INTERFACE_MODE_SGMII ; + plat->phy_interface =PHY_INTERFACE_MODE_SGMII ; +return ehl_common_data (pdev, plat); }
@@ -233,7 +234,8 @@ static int ehl_rgmii_data(struct pci_dev { plat->bus_id =1 ; plat->phy_addr =0 ; - plat->interface =PHY_INTERFACE_MODE_RGMII ; + plat->phy_interface =PHY_INTERFACE_MODE_RGMII ; +return ehl_common_data (pdev, plat); }
@@ -261,7 +263,7 @@ static int tgl_sgmii_data(struct pci_dev { plat->bus_id =1 ; plat->phy_addr =0 ; - plat->interface =PHY_INTERFACE_MODE_SGMII ; + plat->phy_interface =PHY_INTERFACE_MODE_SGMII ;return tgl_common_data (pdev, plat); }
@@ -361,7 +363,7 @@ static int quark_default_data(struct pci plat->bus_id =pci_dev_id (pdev); plat->phy_addr = ret; - plat->interface =PHY_INTERFACE_MODE_RMII ; + plat->phy_interface =PHY_INTERFACE_MODE_RMII ; plat->dma_cfg->pbl =16 ; plat->dma_cfg->pblx8 = true;
@@ -418,7 +420,7 @@ static int snps_gmac5_default_data(struc plat->bus_id =1 ; plat->phy_addr =-1 ; - plat->interface =PHY_INTERFACE_MODE_GMII ; + plat->phy_interface =PHY_INTERFACE_MODE_GMII ; plat->dma_cfg->pbl =32 ; plat->dma_cfg->pblx8 = true;
Greg Kroah-Hartman
maintainerPATCH 335/367 taprio: Fix enabling offload with wrong number of traffic classes
In reply to Greg Kroah-HartmanFrom: Vinicius Costa Gomes <[email protected]>
[ Upstream commit 5652e63df3303c2a702bac25fbf710b9cb64dfba ]
If the driver implementing taprio offloading depends on the value of the network device number of traffic classes (dev->num_tc) for whatever reason, it was going to receive the value zero. The value was only set after the offloading function is called.
So, moving setting the number of traffic classes to before the offloading function is called fixes this issue. This is safe because this only happens when taprio is instantiated (we don't allow this configuration to be changed without first removing taprio).
--- net/sched/sch_taprio.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
net/sched/sch_taprio.c +13 -13
@@ -1444,6 +1444,19 @@ static int taprio_change(struct Qdisc *staprio_set_picos_per_byte (dev, q); +if (mqprio) { +netdev_set_num_tc (dev, mqprio->num_tc); +for (i =0 ; i < mqprio->num_tc; i++) +netdev_set_tc_queue (dev, i, + mqprio->count[i], + mqprio->offset[i]); + +/* Always use supplied priority mappings */ +for (i =0 ; i <=TC_BITMASK ; i++) +netdev_set_prio_tc_map (dev, i, + mqprio->prio_tc_map[i]); + } +if (FULL_OFFLOAD_IS_ENABLED (taprio_flags)) err =taprio_enable_offload (dev, mqprio, q, new_admin, extack);else
@@ -1471,19 +1484,6 @@ static int taprio_change(struct Qdisc *s q->advance_timer.function = advance_sched; } -if (mqprio) { -netdev_set_num_tc (dev, mqprio->num_tc); -for (i =0 ; i < mqprio->num_tc; i++) -netdev_set_tc_queue (dev, i, - mqprio->count[i], - mqprio->offset[i]); - -/* Always use supplied priority mappings */ -for (i =0 ; i <=TC_BITMASK ; i++) -netdev_set_prio_tc_map (dev, i, - mqprio->prio_tc_map[i]); - } -if (FULL_OFFLOAD_IS_ENABLED (taprio_flags)) { q->dequeue = taprio_dequeue_offload; q->peek = taprio_peek_offload;
Greg Kroah-Hartman
maintainerPATCH 336/367 taprio: Fix still allowing changing the flags during runtime
In reply to Greg Kroah-HartmanFrom: Vinicius Costa Gomes <[email protected]>
[ Upstream commit a9d6227436f32142209f4428f2dc616761485112 ]
Because 'q->flags' starts as zero, and zero is a valid value, we aren't able to detect the transition from zero to something else during "runtime".
The solution is to initialize 'q->flags' with an invalid value, so we can detect if 'q->flags' was set by the user or not.
To better solidify the behavior, 'flags' handling is moved to a separate function. The behavior is:
- 'flags' if unspecified by the user, is assumed to be zero;
- 'flags' cannot change during "runtime" (i.e. a change() request cannot modify it);
With this new function we can remove taprio_flags, which should reduce the risk of future accidents.
Allowing flags to be changed was causing the following RCU stall:
[ 1730.558249] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1730.558258] rcu: 6-...0: (190 ticks this GP) idle=922/0/0x1 softirq=25580/25582 fqs=16250 [ 1730.558264] (detected by 2, t=65002 jiffies, g=33017, q=81) [ 1730.558269] Sending NMI from CPU 2 to CPUs 6: [ 1730.559277] NMI backtrace for cpu 6 [ 1730.559277] CPU: 6 PID: 0 Comm: swapper/6 Tainted: G E 5.5.0-rc6+ #35 [ 1730.559278] Hardware name: Gigabyte Technology Co., Ltd. Z390 AORUS ULTRA/Z390 AORUS ULTRA-CF, BIOS F7 03/14/2019 [ 1730.559278] RIP: 0010:__hrtimer_run_queues+0xe2/0x440 [ 1730.559278] Code: 48 8b 43 28 4c 89 ff 48 8b 75 c0 48 89 45 c8 e8 f4 bb 7c 00 0f 1f 44 00 00 65 8b 05 40 31 f0 68 89 c0 48 0f a3 05 3e 5c 25 01 <0f> 82 fc 01 00 00 48 8b 45 c8 48 89 df ff d0 89 45 c8 0f 1f 44 00 [ 1730.559279] RSP: 0018:ffff9970802d8f10 EFLAGS: 00000083 [ 1730.559279] RAX: 0000000000000006 RBX: ffff8b31645bff38 RCX: 0000000000000000 [ 1730.559280] RDX: 0000000000000000 RSI: ffffffff9710f2ec RDI: ffffffff978daf0e [ 1730.559280] RBP: ffff9970802d8f68 R08: 0000000000000000 R09: 0000000000000000 [ 1730.559280] R10: 0000018336d7944e R11: 0000000000000001 R12: ffff8b316e39f9c0 [ 1730.559281] R13: ffff8b316e39f940 R14: ffff8b316e39f998 R15: ffff8b316e39f7c0 [ 1730.559281] FS: 0000000000000000(0000) GS:ffff8b316e380000(0000) knlGS:0000000000000000 [ 1730.559281] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1730.559281] CR2: 00007f1105303760 CR3: 0000000227210005 CR4: 00000000003606e0 [ 1730.559282] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1730.559282] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1730.559282] Call Trace: [ 1730.559282] <IRQ> [ 1730.559283] ? taprio_dequeue_soft+0x2d0/0x2d0 [sch_taprio] [ 1730.559283] hrtimer_interrupt+0x104/0x220 [ 1730.559283] ? irqtime_account_irq+0x34/0xa0 [ 1730.559283] smp_apic_timer_interrupt+0x6d/0x230 [ 1730.559284] apic_timer_interrupt+0xf/0x20 [ 1730.559284] </IRQ> [ 1730.559284] RIP: 0010:cpu_idle_poll+0x35/0x1a0 [ 1730.559285] Code: 88 82 ff 65 44 8b 25 12 7d 73 68 0f 1f 44 00 00 e8 90 c3 89 ff fb 65 48 8b 1c 25 c0 7e 01 00 48 8b 03 a8 08 74 0b eb 1c f3 90 <48> 8b 03 a8 08 75 13 8b 05 be a8 a8 00 85 c0 75 ed e8 75 48 84 ff [ 1730.559285] RSP: 0018:ffff997080137ea8 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13 [ 1730.559285] RAX: 0000000000000001 RBX: ffff8b316bc3c580 RCX: 0000000000000000 [ 1730.559286] RDX: 0000000000000001 RSI: 000000002819aad9 RDI: ffffffff978da730 [ 1730.559286] RBP: ffff997080137ec0 R08: 0000018324a6d387 R09: 0000000000000000 [ 1730.559286] R10: 0000000000000400 R11: 0000000000000001 R12: 0000000000000006 [ 1730.559286] R13: ffff8b316bc3c580 R14: 0000000000000000 R15: 0000000000000000 [ 1730.559287] ? cpu_idle_poll+0x20/0x1a0 [ 1730.559287] ? cpu_idle_poll+0x20/0x1a0 [ 1730.559287] do_idle+0x4d/0x1f0 [ 1730.559287] ? complete+0x44/0x50 [ 1730.559288] cpu_startup_entry+0x1b/0x20 [ 1730.559288] start_secondary+0x142/0x180 [ 1730.559288] secondary_startup_64+0xb6/0xc0 [ 1776.686313] nvme nvme0: I/O 96 QID 1 timeout, completion polled
--- net/sched/sch_taprio.c | 61 ++++++++++++++++++++++++++++++++----------------- 1 file changed, 41 insertions(+), 20 deletions(-)
net/sched/sch_taprio.c +41 -20
@@ -31,6 +31,7 @@ static DEFINE_SPINLOCK(taprio_list_lock)#define TXTIME_ASSIST_IS_ENABLED (flags) ((flags) & TCA_TAPRIO_ATTR_FLAG_TXTIME_ASSIST)#define FULL_OFFLOAD_IS_ENABLED (flags) ((flags) & TCA_TAPRIO_ATTR_FLAG_FULL_OFFLOAD) +#define TAPRIO_FLAGS_INVALID U32_MAXstruct sched_entry {struct list_head list;
@@ -1367,6 +1368,33 @@ static int taprio_mqprio_cmp(const strucreturn 0 ; } +/* The semantics of the 'flags' argument in relation to 'change()' +* requests, are interpreted following two rules (which are applied in +* this order): (1) an omitted 'flags' argument is interpreted as +* zero; (2) the 'flags' of a "running" taprio instance cannot be +* changed. +*/ +static int taprio_new_flags (const struct nlattr *attr,u32 old, +struct netlink_ext_ack *extack) +{ +u32 new =0 ; + +if (attr) + new =nla_get_u32 (attr); + +if (old !=TAPRIO_FLAGS_INVALID && old != new) { +NL_SET_ERR_MSG_MOD (extack,"Changing 'flags' of a running schedule is not supported" ); +return -EOPNOTSUPP ; + } + +if (!taprio_flags_valid (new)) { +NL_SET_ERR_MSG_MOD (extack,"Specified 'flags' are not valid" ); +return -EINVAL ; + } + +return new; +} +static int taprio_change (struct Qdisc *sch,struct nlattr *opt,struct netlink_ext_ack *extack) {
@@ -1375,7 +1403,6 @@ static int taprio_change(struct Qdisc *sstruct taprio_sched *q =qdisc_priv (sch);struct net_device *dev =qdisc_dev (sch);struct tc_mqprio_qopt *mqprio =NULL ; -u32 taprio_flags =0 ;unsigned long flags;ktime_t start;int i, err;
@@ -1388,21 +1415,14 @@ static int taprio_change(struct Qdisc *sif (tb[TCA_TAPRIO_ATTR_PRIOMAP ]) mqprio =nla_data (tb[TCA_TAPRIO_ATTR_PRIOMAP ]); -if (tb[TCA_TAPRIO_ATTR_FLAGS ]) { - taprio_flags =nla_get_u32 (tb[TCA_TAPRIO_ATTR_FLAGS ]); - -if (q->flags !=0 && q->flags != taprio_flags) { -NL_SET_ERR_MSG_MOD (extack,"Changing 'flags' of a running schedule is not supported" ); -return -EOPNOTSUPP ; - }else if (!taprio_flags_valid (taprio_flags)) { -NL_SET_ERR_MSG_MOD (extack,"Specified 'flags' are not valid" ); -return -EINVAL ; - } + err =taprio_new_flags (tb[TCA_TAPRIO_ATTR_FLAGS ], + q->flags, extack); +if (err <0 ) +return err; - q->flags = taprio_flags; - } + q->flags = err; - err =taprio_parse_mqprio_opt (dev, mqprio, extack, taprio_flags); + err =taprio_parse_mqprio_opt (dev, mqprio, extack, q->flags);if (err <0 )return err;
@@ -1457,7 +1477,7 @@ static int taprio_change(struct Qdisc *s mqprio->prio_tc_map[i]); } -if (FULL_OFFLOAD_IS_ENABLED (taprio_flags)) +if (FULL_OFFLOAD_IS_ENABLED (q->flags)) err =taprio_enable_offload (dev, mqprio, q, new_admin, extack);else err =taprio_disable_offload (dev, q, extack);
@@ -1477,14 +1497,14 @@ static int taprio_change(struct Qdisc *s q->txtime_delay =nla_get_u32 (tb[TCA_TAPRIO_ATTR_TXTIME_DELAY ]); } -if (!TXTIME_ASSIST_IS_ENABLED (taprio_flags) && - !FULL_OFFLOAD_IS_ENABLED (taprio_flags) && +if (!TXTIME_ASSIST_IS_ENABLED (q->flags) && + !FULL_OFFLOAD_IS_ENABLED (q->flags) && !hrtimer_active (&q->advance_timer)) {hrtimer_init (&q->advance_timer, q->clockid,HRTIMER_MODE_ABS ); q->advance_timer.function = advance_sched; } -if (FULL_OFFLOAD_IS_ENABLED (taprio_flags)) { +if (FULL_OFFLOAD_IS_ENABLED (q->flags)) { q->dequeue = taprio_dequeue_offload; q->peek = taprio_peek_offload; }else {
@@ -1501,7 +1521,7 @@ static int taprio_change(struct Qdisc *s goto unlock; } -if (TXTIME_ASSIST_IS_ENABLED (taprio_flags)) { +if (TXTIME_ASSIST_IS_ENABLED (q->flags)) {setup_txtime (q, new_admin, start);if (!oper) {
@@ -1528,7 +1548,7 @@ static int taprio_change(struct Qdisc *sspin_unlock_irqrestore (&q->current_entry_lock, flags); -if (FULL_OFFLOAD_IS_ENABLED (taprio_flags)) +if (FULL_OFFLOAD_IS_ENABLED (q->flags))taprio_offload_config_changed (q); }
@@ -1597,6 +1617,7 @@ static int taprio_init(struct Qdisc *sch* and get the valid one on taprio_change(). */ q->clockid =-1 ; + q->flags =TAPRIO_FLAGS_INVALID ;spin_lock (&taprio_list_lock);list_add (&q->taprio_list, &taprio_list);
Greg Kroah-Hartman
maintainerPATCH 337/367 taprio: Add missing policy validation for flags
In reply to Greg Kroah-HartmanFrom: Vinicius Costa Gomes <[email protected]>
[ Upstream commit 49c684d79cfdc3032344bf6f3deeea81c4efedbf ]
netlink policy validation for the 'flags' argument was missing.
--- net/sched/sch_taprio.c | 1 + 1 file changed, 1 insertion(+)
net/sched/sch_taprio.c +1 -0
@@ -767,6 +767,7 @@ static const struct nla_policy taprio_po [TCA_TAPRIO_ATTR_SCHED_CLOCKID] = { .type = NLA_S32 }, [TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME] = { .type = NLA_S64 }, [TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME_EXTENSION] = { .type = NLA_S64 }, + [TCA_TAPRIO_ATTR_FLAGS] = { .type = NLA_U32 }, }; static int fill_sched_entry(struct nlattr **tb, struct sched_entry *entry,
Greg Kroah-Hartman
maintainerPATCH 338/367 taprio: Use taprio_reset_tc() to reset Traffic Classes configuration
In reply to Greg Kroah-HartmanFrom: Vinicius Costa Gomes <[email protected]>
[ Upstream commit 7c16680a08ee1e444a67d232c679ccf5b30fad16 ]
When destroying the current taprio instance, which can happen when the creation of one fails, we should reset the traffic class configuration back to the default state.
netdev_reset_tc() is a better way because in addition to setting the number of traffic classes to zero, it also resets the priority to traffic classes mapping to the default value.
--- net/sched/sch_taprio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_taprio.c +1 -1
@@ -1588,7 +1588,7 @@ static void taprio_destroy(struct Qdisc } q->qdiscs =NULL ; -netdev_set_num_tc (dev,0 ); +netdev_reset_tc (dev);if (q->oper_sched)call_rcu (&q->oper_sched->rcu, taprio_free_sched_cb);
Greg Kroah-Hartman
maintainerPATCH 339/367 taprio: Fix dropping packets when using taprio + ETF offloading
In reply to Greg Kroah-HartmanFrom: Vinicius Costa Gomes <[email protected]>
[ Upstream commit bfabd41da34180d05382312533a3adc2e012dee0 ]
When using taprio offloading together with ETF offloading, configured like this, for example:
$ tc qdisc replace dev $IFACE parent root handle 100 taprio \
num_tc 4 \
map 2 2 1 0 3 2 2 2 2 2 2 2 2 2 2 2 \
queues 1@0 1@1 1@2 1@3 \
base-time $BASE_TIME \
sched-entry S 01 1000000 \
sched-entry S 0e 1000000 \
flags 0x2$ tc qdisc replace dev $IFACE parent 100:1 etf \
offload delta 300000 clockid CLOCK_TAIDuring enqueue, it works out that the verification added for the "txtime" assisted mode is run when using taprio + ETF offloading, the only thing missing is initializing the 'next_txtime' of all the cycle entries. (if we don't set 'next_txtime' all packets from SO_TXTIME sockets are dropped)
--- net/sched/sch_taprio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sched/sch_taprio.c +2 -2
@@ -1522,9 +1522,9 @@ static int taprio_change(struct Qdisc *s goto unlock; } -if (TXTIME_ASSIST_IS_ENABLED (q->flags)) { -setup_txtime (q, new_admin, start); +setup_txtime (q, new_admin, start); +if (TXTIME_ASSIST_IS_ENABLED (q->flags)) {if (!oper) {rcu_assign_pointer (q->oper_sched, new_admin); err =0 ;
Greg Kroah-Hartman
maintainerPATCH 340/367 ipv6/addrconf: fix potential NULL deref in inet6_set_link_af()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit db3fa271022dacb9f741b96ea4714461a8911bb9 ]
__in6_dev_get(dev) called from inet6_set_link_af() can return NULL.
The needed check has been recently removed, let's add it back.
While do_setlink() does call validate_linkmsg() :
...
err = validate_linkmsg(dev, tb); /* OK at this point */
...
It is possible that the following call happening before the ->set_link_af() removes IPv6 if MTU is less than 1280 :
if (tb[IFLA_MTU]) {
err = dev_set_mtu_ext(dev, nla_get_u32(tb[IFLA_MTU]), extack);
if (err < 0)
goto errout;
status |= DO_SETLINK_MODIFIED;
}...
if (tb[IFLA_AF_SPEC]) {
...
err = af_ops->set_link_af(dev, af);
->inet6_set_link_af() // CRASH because idev is NULLPlease note that IPv4 is immune to the bug since inet_set_link_af() does :
struct in_device *in_dev = __in_dev_get_rcu(dev);
if (!in_dev)
return -EAFNOSUPPORT;
This problem has been mentioned in commit cf7afbfeb8ce ("rtnl: make link af-specific updates atomic") changelog :
This method is not fail proof, while it is currently sufficient to make set_link_af() inerrable and thus 100% atomic, the validation function method will not be able to detect all error scenarios in the future, there will likely always be errors depending on states which are f.e. not protected by rtnl_mutex and thus may change between validation and setting.
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7] CPU: 0 PID: 9698 Comm: syz-executor712 Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:inet6_set_link_af+0x66e/0xae0 net/ipv6/addrconf.c:5733 Code: 38 d0 7f 08 84 c0 0f 85 20 03 00 00 48 8d bb b0 02 00 00 45 0f b6 64 24 04 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1a 03 00 00 44 89 a3 b0 02 00 RSP: 0018:ffffc90005b06d40 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff86df39a6 RDX: 0000000000000056 RSI: ffffffff86df3e74 RDI: 00000000000002b0 RBP: ffffc90005b06e70 R08: ffff8880a2ac0380 R09: ffffc90005b06db0 R10: fffff52000b60dbe R11: ffffc90005b06df7 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8880a1fcc424 R15: dffffc0000000000 FS: 0000000000c46880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f0494ca0d0 CR3: 000000009e4ac000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: do_setlink+0x2a9f/0x3720 net/core/rtnetlink.c:2754 rtnl_group_changelink net/core/rtnetlink.c:3103 [inline] __rtnl_newlink+0xdd1/0x1790 net/core/rtnetlink.c:3257 rtnl_newlink+0x69/0xa0 net/core/rtnetlink.c:3377 rtnetlink_rcv_msg+0x45e/0xaf0 net/core/rtnetlink.c:5438 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5456 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:672 ____sys_sendmsg+0x753/0x880 net/socket.c:2343 ___sys_sendmsg+0x100/0x170 net/socket.c:2397 __sys_sendmsg+0x105/0x1d0 net/socket.c:2430 __do_sys_sendmsg net/socket.c:2439 [inline] __se_sys_sendmsg net/socket.c:2437 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4402e9 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fffd62fbcf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004402e9 RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 0000000000000008 R09: 00000000004002c8 R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000401b70 R13: 0000000000401c00 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: ---[ end trace cfa7664b8fdcdff3 ]--- RIP: 0010:inet6_set_link_af+0x66e/0xae0 net/ipv6/addrconf.c:5733 Code: 38 d0 7f 08 84 c0 0f 85 20 03 00 00 48 8d bb b0 02 00 00 45 0f b6 64 24 04 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1a 03 00 00 44 89 a3 b0 02 00 RSP: 0018:ffffc90005b06d40 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff86df39a6 RDX: 0000000000000056 RSI: ffffffff86df3e74 RDI: 00000000000002b0 RBP: ffffc90005b06e70 R08: ffff8880a2ac0380 R09: ffffc90005b06db0 R10: fffff52000b60dbe R11: ffffc90005b06df7 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8880a1fcc424 R15: dffffc0000000000 FS: 0000000000c46880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000004 CR3: 000000009e4ac000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
--- net/ipv6/addrconf.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv6/addrconf.c +3 -0
@@ -5718,6 +5718,9 @@ static int inet6_set_link_af(struct net_struct nlattr *tb[IFLA_INET6_MAX +1 ];int err; +if (!idev) +return -EAFNOSUPPORT ; +if (nla_parse_nested_deprecated (tb,IFLA_INET6_MAX , nla,NULL ,NULL ) <0 )BUG ();
Greg Kroah-Hartman
maintainerPATCH 341/367 qed: Fix timestamping issue for L2 unicast ptp packets.
In reply to Greg Kroah-HartmanFrom: Sudarsana Reddy Kalluru <[email protected]>
[ Upstream commit 0202d293c2faecba791ba4afc5aec086249c393d ]
commit cedeac9df4b8 ("qed: Add support for Timestamping the unicast PTP packets.") handles the timestamping of L4 ptp packets only. This patch adds driver changes to detect/timestamp both L2/L4 unicast PTP packets.
--- drivers/net/ethernet/qlogic/qed/qed_ptp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_ptp.c +2 -2
@@ -44,8 +44,8 @@/* Add/subtract the Adjustment_Value when making a Drift adjustment */ #define QED_DRIFT_CNTR_DIRECTION_SHIFT 31#define QED_TIMESTAMP_MASK BIT(16) -/* Param mask for Hardware to detect/timestamp the unicast PTP packets */ -#define QED_PTP_UCAST_PARAM_MASK 0xF +/* Param mask for Hardware to detect/timestamp the L2/L4 unicast PTP packets */ +#define QED_PTP_UCAST_PARAM_MASK 0x70Fstatic enum qed_resc_lock qed_ptcdev_to_resc (struct qed_hwfn *p_hwfn) {
Greg Kroah-Hartman
maintainerPATCH 342/367 drop_monitor: Do not cancel uninitialized work item
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
[ Upstream commit dfa7f709596be5ca46c070d4f8acbb344322056a ]
Drop monitor uses a work item that takes care of constructing and sending netlink notifications to user space. In case drop monitor never started to monitor, then the work item is uninitialized and not associated with a function.
Therefore, a stop command from user space results in canceling an uninitialized work item which leads to the following warning [1].
Fix this by not processing a stop command if drop monitor is not currently monitoring.
[1]
[ 31.735402] ------------[ cut here ]------------ [ 31.736470] WARNING: CPU: 0 PID: 143 at kernel/workqueue.c:3032 __flush_work+0x89f/0x9f0 ... [ 31.738120] CPU: 0 PID: 143 Comm: dwdump Not tainted 5.5.0-custom-09491-g16d4077796b8 #727 [ 31.741968] RIP: 0010:__flush_work+0x89f/0x9f0 ... [ 31.760526] Call Trace: [ 31.771689] __cancel_work_timer+0x2a6/0x3b0 [ 31.776809] net_dm_cmd_trace+0x300/0xef0 [ 31.777549] genl_rcv_msg+0x5c6/0xd50 [ 31.781005] netlink_rcv_skb+0x13b/0x3a0 [ 31.784114] genl_rcv+0x29/0x40 [ 31.784720] netlink_unicast+0x49f/0x6a0 [ 31.787148] netlink_sendmsg+0x7cf/0xc80 [ 31.790426] ____sys_sendmsg+0x620/0x770 [ 31.793458] ___sys_sendmsg+0xfd/0x170 [ 31.802216] __sys_sendmsg+0xdf/0x1a0 [ 31.806195] do_syscall_64+0xa0/0x540 [ 31.806885] entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- net/core/drop_monitor.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/core/drop_monitor.c +3 -1
@@ -1004,8 +1004,10 @@ static void net_dm_hw_monitor_stop(struc {int cpu; -if (!monitor_hw) +if (!monitor_hw) {NL_SET_ERR_MSG_MOD (extack,"Hardware monitoring already disabled" ); +return ; + } monitor_hw = false;
Greg Kroah-Hartman
maintainerPATCH 343/367 net/mlx5: Fix deadlock in fs_core
In reply to Greg Kroah-HartmanFrom: Maor Gottlieb <[email protected]>
[ Upstream commit c1948390d78b5183ee9b7dd831efd7f6ac496ab0 ]
free_match_list could be called when the flow table is already locked. We need to pass this notation to tree_put_node.
It fixes the following lockdep warnning:
[ 1797.268537] ============================================
[ 1797.276837] WARNING: possible recursive locking detected
[ 1797.285101] 5.5.0-rc5+ #10 Not tainted
[ 1797.291641] --------------------------------------------
[ 1797.299917] handler10/9296 is trying to acquire lock:
[ 1797.307885] ffff889ad399a0a0 (&node->lock){++++}, at:
tree_put_node+0x1d5/0x210 [mlx5_core]
[ 1797.319694]
[ 1797.319694] but task is already holding lock:
[ 1797.330904] ffff889ad399a0a0 (&node->lock){++++}, at:
nested_down_write_ref_node.part.33+0x1a/0x60 [mlx5_core]
[ 1797.344707]
[ 1797.344707] other info that might help us debug this:
[ 1797.356952] Possible unsafe locking scenario:
[ 1797.356952]
[ 1797.368333] CPU0
[ 1797.373357] ----
[ 1797.378364] lock(&node->lock);
[ 1797.384222] lock(&node->lock);
[ 1797.390031]
[ 1797.390031] *** DEADLOCK ***
[ 1797.390031]
[ 1797.403003] May be due to missing lock nesting notation
[ 1797.403003]
[ 1797.414691] 3 locks held by handler10/9296:
[ 1797.421465] #0: ffff889cf2c5a110 (&block->cb_lock){++++}, at:
tc_setup_cb_add+0x70/0x250
[ 1797.432810] #1: ffff88a030081490 (&comp->sem){++++}, at:
mlx5_devcom_get_peer_data+0x4c/0xb0 [mlx5_core]
[ 1797.445829] #2: ffff889ad399a0a0 (&node->lock){++++}, at:
nested_down_write_ref_node.part.33+0x1a/0x60 [mlx5_core]
[ 1797.459913]
[ 1797.459913] stack backtrace:
[ 1797.469436] CPU: 1 PID: 9296 Comm: handler10 Kdump: loaded Not
tainted 5.5.0-rc5+ #10
[ 1797.480643] Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS
2.4.3 01/17/2017
[ 1797.491480] Call Trace:
[ 1797.496701] dump_stack+0x96/0xe0
[ 1797.502864] __lock_acquire.cold.63+0xf8/0x212
[ 1797.510301] ? lockdep_hardirqs_on+0x250/0x250
[ 1797.517701] ? mark_held_locks+0x55/0xa0
[ 1797.524547] ? quarantine_put+0xb7/0x160
[ 1797.531422] ? lockdep_hardirqs_on+0x17d/0x250
[ 1797.538913] lock_acquire+0xd6/0x1f0
[ 1797.545529] ? tree_put_node+0x1d5/0x210 [mlx5_core]
[ 1797.553701] down_write+0x94/0x140
[ 1797.560206] ? tree_put_node+0x1d5/0x210 [mlx5_core]
[ 1797.568464] ? down_write_killable_nested+0x170/0x170
[ 1797.576925] ? del_hw_flow_group+0xde/0x1f0 [mlx5_core]
[ 1797.585629] tree_put_node+0x1d5/0x210 [mlx5_core]
[ 1797.593891] ? free_match_list.part.25+0x147/0x170 [mlx5_core]
[ 1797.603389] free_match_list.part.25+0xe0/0x170 [mlx5_core]
[ 1797.612654] _mlx5_add_flow_rules+0x17e2/0x20b0 [mlx5_core]
[ 1797.621838] ? lock_acquire+0xd6/0x1f0
[ 1797.629028] ? esw_get_prio_table+0xb0/0x3e0 [mlx5_core]
[ 1797.637981] ? alloc_insert_flow_group+0x420/0x420 [mlx5_core]
[ 1797.647459] ? try_to_wake_up+0x4c7/0xc70
[ 1797.654881] ? lock_downgrade+0x350/0x350
[ 1797.662271] ? __mutex_unlock_slowpath+0xb1/0x3f0
[ 1797.670396] ? find_held_lock+0xac/0xd0
[ 1797.677540] ? mlx5_add_flow_rules+0xdc/0x360 [mlx5_core]
[ 1797.686467] mlx5_add_flow_rules+0xdc/0x360 [mlx5_core]
[ 1797.695134] ? _mlx5_add_flow_rules+0x20b0/0x20b0 [mlx5_core]
[ 1797.704270] ? irq_exit+0xa5/0x170
[ 1797.710764] ? retint_kernel+0x10/0x10
[ 1797.717698] ? mlx5_eswitch_set_rule_source_port.isra.9+0x122/0x230
[mlx5_core]
[ 1797.728708] mlx5_eswitch_add_offloaded_rule+0x465/0x6d0 [mlx5_core]
[ 1797.738713] ? mlx5_eswitch_get_prio_range+0x30/0x30 [mlx5_core]
[ 1797.748384] ? mlx5_fc_stats_work+0x670/0x670 [mlx5_core]
[ 1797.757400] mlx5e_tc_offload_fdb_rules.isra.27+0x24/0x90 [mlx5_core]
[ 1797.767665] mlx5e_tc_add_fdb_flow+0xaf8/0xd40 [mlx5_core]
[ 1797.776886] ? mlx5e_encap_put+0xd0/0xd0 [mlx5_core]
[ 1797.785562] ? mlx5e_alloc_flow.isra.43+0x18c/0x1c0 [mlx5_core]
[ 1797.795353] __mlx5e_add_fdb_flow+0x2e2/0x440 [mlx5_core]
[ 1797.804558] ? mlx5e_tc_update_neigh_used_value+0x8c0/0x8c0
[mlx5_core]
[ 1797.815093] ? wait_for_completion+0x260/0x260
[ 1797.823272] mlx5e_configure_flower+0xe94/0x1620 [mlx5_core]
[ 1797.832792] ? __mlx5e_add_fdb_flow+0x440/0x440 [mlx5_core]
[ 1797.842096] ? down_read+0x11a/0x2e0
[ 1797.849090] ? down_write+0x140/0x140
[ 1797.856142] ? mlx5e_rep_indr_setup_block_cb+0xc0/0xc0 [mlx5_core]
[ 1797.866027] tc_setup_cb_add+0x11a/0x250
[ 1797.873339] fl_hw_replace_filter+0x25e/0x320 [cls_flower]
[ 1797.882385] ? fl_hw_destroy_filter+0x1c0/0x1c0 [cls_flower]
[ 1797.891607] fl_change+0x1d54/0x1fb6 [cls_flower]
[ 1797.899772] ? __rhashtable_insert_fast.constprop.50+0x9f0/0x9f0
[cls_flower]
[ 1797.910728] ? lock_downgrade+0x350/0x350
[ 1797.918187] ? __radix_tree_lookup+0xa5/0x130
[ 1797.926046] ? fl_set_key+0x1590/0x1590 [cls_flower]
[ 1797.934611] ? __rhashtable_insert_fast.constprop.50+0x9f0/0x9f0
[cls_flower]
[ 1797.945673] tc_new_tfilter+0xcd1/0x1240
[ 1797.953138] ? tc_del_tfilter+0xb10/0xb10
[ 1797.960688] ? avc_has_perm_noaudit+0x92/0x320
[ 1797.968721] ? avc_has_perm_noaudit+0x1df/0x320
[ 1797.976816] ? avc_has_extended_perms+0x990/0x990
[ 1797.985090] ? mark_lock+0xaa/0x9e0
[ 1797.991988] ? match_held_lock+0x1b/0x240
[ 1797.999457] ? match_held_lock+0x1b/0x240
[ 1798.006859] ? find_held_lock+0xac/0xd0
[ 1798.014045] ? symbol_put_addr+0x40/0x40
[ 1798.021317] ? rcu_read_lock_sched_held+0xd0/0xd0
[ 1798.029460] ? tc_del_tfilter+0xb10/0xb10
[ 1798.036810] rtnetlink_rcv_msg+0x4d5/0x620
[ 1798.044236] ? rtnl_bridge_getlink+0x460/0x460
[ 1798.052034] ? lockdep_hardirqs_on+0x250/0x250
[ 1798.059837] ? match_held_lock+0x1b/0x240
[ 1798.067146] ? find_held_lock+0xac/0xd0
[ 1798.074246] netlink_rcv_skb+0xc6/0x1f0
[ 1798.081339] ? rtnl_bridge_getlink+0x460/0x460
[ 1798.089104] ? netlink_ack+0x440/0x440
[ 1798.096061] netlink_unicast+0x2d4/0x3b0
[ 1798.103189] ? netlink_attachskb+0x3f0/0x3f0
[ 1798.110724] ? _copy_from_iter_full+0xda/0x370
[ 1798.118415] netlink_sendmsg+0x3ba/0x6a0
[ 1798.125478] ? netlink_unicast+0x3b0/0x3b0
[ 1798.132705] ? netlink_unicast+0x3b0/0x3b0
[ 1798.139880] sock_sendmsg+0x94/0xa0
[ 1798.146332] ____sys_sendmsg+0x36c/0x3f0
[ 1798.153251] ? copy_msghdr_from_user+0x165/0x230
[ 1798.160941] ? kernel_sendmsg+0x30/0x30
[ 1798.167738] ___sys_sendmsg+0xeb/0x150
[ 1798.174411] ? sendmsg_copy_msghdr+0x30/0x30
[ 1798.181649] ? lock_downgrade+0x350/0x350
[ 1798.188559] ? rcu_read_lock_sched_held+0xd0/0xd0
[ 1798.196239] ? __fget+0x21d/0x320
[ 1798.202335] ? do_dup2+0x2a0/0x2a0
[ 1798.208499] ? lock_downgrade+0x350/0x350
[ 1798.215366] ? __fget_light+0xd6/0xf0
[ 1798.221808] ? syscall_trace_enter+0x369/0x5d0
[ 1798.229112] __sys_sendmsg+0xd3/0x160
[ 1798.235511] ? __sys_sendmsg_sock+0x60/0x60
[ 1798.242478] ? syscall_trace_enter+0x233/0x5d0
[ 1798.249721] ? syscall_slow_exit_work+0x280/0x280
[ 1798.257211] ? do_syscall_64+0x1e/0x2e0
[ 1798.263680] do_syscall_64+0x72/0x2e0
[ 1798.269950] entry_SYSCALL_64_after_hwframe+0x49/0xbe--- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +8 -7
@@ -1555,16 +1555,16 @@ struct match_list_head {struct match_list first; }; -static void free_match_list (struct match_list_head *head) +static void free_match_list (struct match_list_head *head,bool ft_locked) {if (!list_empty (&head->list)) {struct match_list *iter, *match_tmp;list_del (&head->first.list); -tree_put_node (&head->first.g->node, false); +tree_put_node (&head->first.g->node, ft_locked);list_for_each_entry_safe (iter, match_tmp, &head->list, list) { -tree_put_node (&iter->g->node, false); +tree_put_node (&iter->g->node, ft_locked);list_del (&iter->list);kfree (iter); }
@@ -1573,7 +1573,8 @@ static void free_match_list(struct matchstatic int build_match_list (struct match_list_head *match_head,struct mlx5_flow_table *ft, -const struct mlx5_flow_spec *spec) +const struct mlx5_flow_spec *spec, +bool ft_locked) {struct rhlist_head *tmp, *list;struct mlx5_flow_group *g;
@@ -1598,7 +1599,7 @@ static int build_match_list(struct match curr_match =kmalloc (sizeof (*curr_match),GFP_ATOMIC );if (!curr_match) { -free_match_list (match_head); +free_match_list (match_head, ft_locked); err = -ENOMEM ; goto out; }
@@ -1778,7 +1779,7 @@ search_again_locked: version =atomic_read (&ft->node.version);/* Collect all fgs which has a matching match_criteria */ - err =build_match_list (&match_head, ft, spec); + err =build_match_list (&match_head, ft, spec, take_write);if (err) {if (take_write)up_write_ref_node (&ft->node, false);
@@ -1792,7 +1793,7 @@ search_again_locked: rule =try_add_to_existing_fg (ft, &match_head.list, spec, flow_act, dest, dest_num, version); -free_match_list (&match_head); +free_match_list (&match_head, take_write);if (!IS_ERR (rule) || (PTR_ERR (rule) != -ENOENT &&PTR_ERR (rule) != -EAGAIN )) {if (take_write)
Greg Kroah-Hartman
maintainerPATCH 344/367 net/mlx5: Deprecate usage of generic TLS HW capability bit
In reply to Greg Kroah-HartmanFrom: Tariq Toukan <[email protected]>
[ Upstream commit 61c00cca41aeeaa8e5263c2f81f28534bc1efafb ]
Deprecate the generic TLS cap bit, use the new TX-specific TLS cap bit instead.
--- drivers/net/ethernet/mellanox/mlx5/core/accel/tls.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_rxtx.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/fw.c | 2 +- include/linux/mlx5/mlx5_ifc.h | 7 ++++--- 4 files changed, 7 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/accel/tls.h +1 -1
@@ -45,7 +45,7 @@ void mlx5_ktls_destroy_key(struct mlx5_cstatic inline bool mlx5_accel_is_ktls_device (struct mlx5_core_dev *mdev) { -if (!MLX5_CAP_GEN (mdev, tls)) +if (!MLX5_CAP_GEN (mdev, tls_tx))return false;if (!MLX5_CAP_GEN (mdev, log_max_dek))
drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_rxtx.c +1 -1
@@ -269,7 +269,7 @@ struct sk_buff *mlx5e_tls_handle_tx_skb(int datalen;u32 skb_seq; -if (MLX5_CAP_GEN (sq->channel->mdev, tls)) { +if (MLX5_CAP_GEN (sq->channel->mdev, tls_tx)) { skb =mlx5e_ktls_handle_tx_skb (netdev, sq, skb, wqe, pi); goto out; }
drivers/net/ethernet/mellanox/mlx5/core/fw.c +1 -1
@@ -239,7 +239,7 @@ int mlx5_query_hca_caps(struct mlx5_corereturn err; } -if (MLX5_CAP_GEN (dev, tls)) { +if (MLX5_CAP_GEN (dev, tls_tx)) { err =mlx5_core_get_caps (dev,MLX5_CAP_TLS );if (err)return err;
include/linux/mlx5/mlx5_ifc.h +4 -3
@@ -1418,14 +1418,15 @@ struct mlx5_ifc_cmd_hca_cap_bits {u8 reserved_at_440[0x20 ]; -u8 tls[0x1 ]; -u8 reserved_at_461[0x2 ]; +u8 reserved_at_460[0x3 ];u8 log_max_uctx[0x5 ];u8 reserved_at_468[0x3 ];u8 log_max_umem[0x5 ];u8 max_num_eqs[0x10 ]; -u8 reserved_at_480[0x3 ]; +u8 reserved_at_480[0x1 ]; +u8 tls_tx[0x1 ]; +u8 reserved_at_482[0x1 ];u8 log_max_l2_table[0x5 ];u8 reserved_at_488[0x8 ];u8 log_uar_page_sz[0x10 ];
Greg Kroah-Hartman
maintainerPATCH 345/367 r8169: fix performance regression related to PCIe max read request size
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit 21b5f672fb2eb1366dedc4ac9d32431146b378d3 ]
It turned out that on low performance systems the original change can cause lower tx performance. On a N3450-based mini-PC tx performance in iperf3 was reduced from 950Mbps to ~900Mbps. Therefore effectively revert the original change, just use pcie_set_readrq() now instead of changing the PCIe capability register directly.
--- drivers/net/ethernet/realtek/r8169_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/realtek/r8169_main.c +6 -0
@@ -3865,15 +3865,18 @@ static void rtl_hw_jumbo_enable(struct rswitch (tp->mac_version) {case RTL_GIGA_MAC_VER_12 :case RTL_GIGA_MAC_VER_17 : +pcie_set_readrq (tp->pci_dev,512 );r8168b_1_hw_jumbo_enable (tp);break ; case RTL_GIGA_MAC_VER_18 ... RTL_GIGA_MAC_VER_26: +pcie_set_readrq (tp->pci_dev,512 );r8168c_hw_jumbo_enable (tp);break ; case RTL_GIGA_MAC_VER_27 ... RTL_GIGA_MAC_VER_28:r8168dp_hw_jumbo_enable (tp);break ; case RTL_GIGA_MAC_VER_31 ... RTL_GIGA_MAC_VER_33: +pcie_set_readrq (tp->pci_dev,512 );r8168e_hw_jumbo_enable (tp);break ;default :
@@ -3903,6 +3906,9 @@ static void rtl_hw_jumbo_disable(structbreak ; }rtl_lock_config_regs (tp); + +if (pci_is_pcie (tp->pci_dev) && tp->supports_gmii) +pcie_set_readrq (tp->pci_dev,4096 ); }static void rtl_jumbo_config (struct rtl8169_private *tp,int mtu)
Greg Kroah-Hartman
maintainerPATCH 346/367 net/mlx5e: TX, Error completion is for last WQE in batch
In reply to Greg Kroah-HartmanFrom: Tariq Toukan <[email protected]>
[ Upstream commit b57e66ad42d051ed31319c28ed1b62b191299a29 ]
For a cyclic work queue, when not requesting a completion per WQE, a single CQE might indicate the completion of several WQEs. However, in case some WQE in the batch causes an error, then an error completion is issued, breaking the batch, and pointing to the offending WQE in the wqe_counter field.
Hence, WQE-specific error CQE handling (like printing, breaking, etc...) should be performed only for the last WQE in batch.
--- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 16 ++++++----- drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 33 ++++++++++-------------- 2 files changed, 23 insertions(+), 26 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +9 -7
@@ -613,13 +613,6 @@ void mlx5e_poll_ico_cq(struct mlx5e_cq * wqe_counter =be16_to_cpu (cqe->wqe_counter); -if (unlikely (get_cqe_opcode (cqe) !=MLX5_CQE_REQ )) { -netdev_WARN_ONCE (cq->channel->netdev, -"Bad OP in ICOSQ CQE: 0x%x\n" ,get_cqe_opcode (cqe)); -if (!test_and_set_bit (MLX5E_SQ_STATE_RECOVERING , &sq->state)) -queue_work (cq->channel->priv->wq, &sq->recover_work); -break ; - } do { struct mlx5e_sq_wqe_info *wi; u16 ci;
@@ -629,6 +622,15 @@ void mlx5e_poll_ico_cq(struct mlx5e_cq * ci =mlx5_wq_cyc_ctr2ix (&sq->wq, sqcc); wi = &sq->db.ico_wqe[ci]; +if (last_wqe &&unlikely (get_cqe_opcode (cqe) !=MLX5_CQE_REQ )) { +netdev_WARN_ONCE (cq->channel->netdev, +"Bad OP in ICOSQ CQE: 0x%x\n" , +get_cqe_opcode (cqe)); +if (!test_and_set_bit (MLX5E_SQ_STATE_RECOVERING , &sq->state)) +queue_work (cq->channel->priv->wq, &sq->recover_work); +break ; + } +if (likely (wi->opcode ==MLX5_OPCODE_UMR )) { sqcc +=MLX5E_UMR_WQEBBS ; wi->umr.rq->mpwqe.umr_completed++;
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +14 -19
@@ -451,34 +451,17 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *c i =0 ; do { + struct mlx5e_tx_wqe_info *wi; u16 wqe_counter; bool last_wqe; + u16 ci; mlx5_cqwq_pop(&cq->wq); wqe_counter = be16_to_cpu(cqe->wqe_counter); - if (unlikely(get_cqe_opcode(cqe) == MLX5_CQE_REQ_ERR)) { - if (!test_and_set_bit(MLX5E_SQ_STATE_RECOVERING, - &sq->state)) { - struct mlx5e_tx_wqe_info *wi; - u16 ci; - - ci = mlx5_wq_cyc_ctr2ix(&sq->wq, sqcc); - wi = &sq->db.wqe_info[ci]; - mlx5e_dump_error_cqe(sq, - (struct mlx5_err_cqe *)cqe); - mlx5_wq_cyc_wqe_dump(&sq->wq, ci, wi->num_wqebbs); - queue_work(cq->channel->priv->wq, - &sq->recover_work); - } - stats->cqe_err++; - } - do { - struct mlx5e_tx_wqe_info *wi; struct sk_buff *skb; - u16 ci; int j; last_wqe = (sqcc == wqe_counter);
@@ -516,6 +499,18 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cnapi_consume_skb (skb, napi_budget); }while (!last_wqe); +if (unlikely (get_cqe_opcode (cqe) ==MLX5_CQE_REQ_ERR )) { +if (!test_and_set_bit (MLX5E_SQ_STATE_RECOVERING , + &sq->state)) { +mlx5e_dump_error_cqe (sq, + (struct mlx5_err_cqe *)cqe); +mlx5_wq_cyc_wqe_dump (&sq->wq, ci, wi->num_wqebbs); +queue_work (cq->channel->priv->wq, + &sq->recover_work); + } + stats->cqe_err++; + } + }while ((++i <MLX5E_TX_CQ_POLL_BUDGET ) && (cqe =mlx5_cqwq_get_cqe (&cq->wq))); stats->cqes += i;
Greg Kroah-Hartman
maintainerPATCH 347/367 cifs: fail i/o on soft mounts if sessionsetup errors out
In reply to Greg Kroah-HartmanFrom: Ronnie Sahlberg <[email protected]>
commit b0dd940e582b6a60296b9847a54012a4b080dc72 upstream.
RHBZ: 1579050
If we have a soft mount we should fail commands for session-setup failures (such as the password having changed/ account being deleted/ ...) and return an error back to the application.
--- fs/cifs/smb2pdu.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/cifs/smb2pdu.c +8 -2
@@ -350,9 +350,14 @@ smb2_reconnect(__le16 smb2_command, stru } rc =cifs_negotiate_protocol (0 , tcon->ses); -if (!rc && tcon->ses->need_reconnect) +if (!rc && tcon->ses->need_reconnect) { rc =cifs_setup_session (0 , tcon->ses, nls_codepage); - +if ((rc == -EACCES ) && !tcon->retry) { + rc = -EHOSTDOWN ; +mutex_unlock (&tcon->ses->session_mutex); + goto failed; + } + }if (rc || !tcon->need_reconnect) {mutex_unlock (&tcon->ses->session_mutex); goto out;
@@ -397,6 +402,7 @@ out:case SMB2_SET_INFO : rc = -EAGAIN ; } +failed:unload_nls (nls_codepage);return rc; }
Greg Kroah-Hartman
maintainerPATCH 348/367 cifs: fix mode bits from dir listing when mounted with modefromsid
In reply to Greg Kroah-HartmanFrom: Aurelien Aptel <[email protected]>
commit e3e056c35108661e418c803adfc054bf683426e7 upstream.
When mounting with -o modefromsid, the mode bits are stored in an ACE. Directory enumeration (e.g. ls -l /mnt) triggers an SMB Query Dir which does not include ACEs in its response. The mode bits in this case are silently set to a default value of 755 instead.
This patch marks the dentry created during the directory enumeration as needing re-evaluation (i.e. additional Query Info with ACEs) so that the mode bits can be properly extracted.
Quick repro:
$ mount.cifs //win19.test/data /mnt -o ...,modefromsid $ touch /mnt/foo && chmod 751 /mnt/foo $ stat /mnt/foo # reports 751 (OK) $ sleep 2 # dentry older than 1s by default get invalidated $ ls -l /mnt # since dentry invalid, ls does a Query Dir # and reports foo as 755 (WRONG)
--- fs/cifs/readdir.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/cifs/readdir.c +2 -1
@@ -196,7 +196,8 @@ cifs_fill_common_info(struct cifs_fattr* may look wrong since the inodes may not have timed out by the time * "ls" does a stat() call on them. */ -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_CIFS_ACL ) +if ((cifs_sb->mnt_cifs_flags &CIFS_MOUNT_CIFS_ACL ) || + (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_MODE_FROM_SID )) fattr->cf_flags |=CIFS_FATTR_NEED_REVAL ; if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL &&
Greg Kroah-Hartman
maintainerPATCH 349/367 x86/apic/msi: Plug non-maskable MSI affinity race
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 6f1a4891a5928a5969c87fa5a584844c983ec823 upstream.
Evan tracked down a subtle race between the update of the MSI message and the device raising an interrupt internally on PCI devices which do not support MSI masking. The update of the MSI message is non-atomic and consists of either 2 or 3 sequential 32bit wide writes to the PCI config space.
- Write address low 32bits
- Write address high 32bits (If supported by device)
- Write data
When an interrupt is migrated then both address and data might change, so the kernel attempts to mask the MSI interrupt first. But for MSI masking is optional, so there exist devices which do not provide it. That means that if the device raises an interrupt internally between the writes then a MSI message is sent built from half updated state.
On x86 this can lead to spurious interrupts on the wrong interrupt vector when the affinity setting changes both address and data. As a consequence the device interrupt can be lost causing the device to become stuck or malfunctioning.
Evan tried to handle that by disabling MSI accross an MSI message update. That's not feasible because disabling MSI has issues on its own:
If MSI is disabled the PCI device is routing an interrupt to the legacy INTx mechanism. The INTx delivery can be disabled, but the disablement is not working on all devices.
Some devices lose interrupts when both MSI and INTx delivery are disabled.
Another way to solve this would be to enforce the allocation of the same vector on all CPUs in the system for this kind of screwed devices. That could be done, but it would bring back the vector space exhaustion problems which got solved a few years ago.
Fortunately the high address (if supported by the device) is only relevant when X2APIC is enabled which implies interrupt remapping. In the interrupt remapping case the affinity setting is happening at the interrupt remapping unit and the PCI MSI message is programmed only once when the PCI device is initialized.
That makes it possible to solve it with a two step update:
1) Target the MSI msg to the new vector on the current target CPU
2) Target the MSI msg to the new vector on the new target CPU
In both cases writing the MSI message is only changing a single 32bit word which prevents the issue of inconsistency.
After writing the final destination it is necessary to check whether the device issued an interrupt while the intermediate state #1 (new vector, current CPU) was in effect.
This is possible because the affinity change is always happening on the current target CPU. The code runs with interrupts disabled, so the interrupt can be detected by checking the IRR of the local APIC. If the vector is pending in the IRR then the interrupt is retriggered on the new target CPU by sending an IPI for the associated vector on the target CPU.
This can cause spurious interrupts on both the local and the new target CPU.
1) If the new vector is not in use on the local CPU and the device affected by the affinity change raised an interrupt during the transitional state (step #1 above) then interrupt entry code will ignore that spurious interrupt. The vector is marked so that the 'No irq handler for vector' warning is supressed once.
2) If the new vector is in use already on the local CPU then the IRR check might see an pending interrupt from the device which is using this vector. The IPI to the new target CPU will then invoke the handler of the device, which got the affinity change, even if that device did not issue an interrupt
3) If the new vector is in use already on the local CPU and the device affected by the affinity change raised an interrupt during the transitional state (step #1 above) then the handler of the device which uses that vector on the local CPU will be invoked.
expose issues in device driver interrupt handlers which are not prepared to handle a spurious interrupt correctly. This not a regression, it's just exposing something which was already broken as spurious interrupts can happen for a lot of reasons and all driver handlers need to be able to deal with them.
--- arch/x86/include/asm/apic.h | 8 ++ arch/x86/kernel/apic/msi.c | 128 ++++++++++++++++++++++++++++++++++++++++++-- include/linux/irq.h | 18 ++++++ include/linux/irqdomain.h | 7 ++ kernel/irq/debugfs.c | 1 kernel/irq/msi.c | 5 + 6 files changed, 163 insertions(+), 4 deletions(-)
arch/x86/include/asm/apic.h +8 -0
@@ -454,6 +454,14 @@ static inline void ack_APIC_irq(void)apic_eoi (); } + +static inline bool lapic_vector_set_in_irr (unsigned int vector) +{ +u32 irr =apic_read (APIC_IRR + (vector /32 *0x10 )); + +return !!(irr & (1U << (vector %32 ))); +} +static inline unsigned default_get_apic_id (unsigned long x) {unsigned int ver =GET_APIC_VERSION (apic_read (APIC_LVR ));
arch/x86/kernel/apic/msi.c +125 -3
153 lines not on this page · raw message
include/linux/irq.h +18 -0
@@ -209,6 +209,8 @@ struct irq_data {* IRQD_SINGLE_TARGET - IRQ allows only a single affinity target * IRQD_DEFAULT_TRIGGER_SET - Expected trigger already been set * IRQD_CAN_RESERVE - Can use reservation mode +* IRQD_MSI_NOMASK_QUIRK - Non-maskable MSI quirk for affinity change +* required */ enum {IRQD_TRIGGER_MASK =0xf ,
@@ -231,6 +233,7 @@ enum {IRQD_SINGLE_TARGET = (1 <<24 ),IRQD_DEFAULT_TRIGGER_SET = (1 <<25 ),IRQD_CAN_RESERVE = (1 <<26 ), + IRQD_MSI_NOMASK_QUIRK = (1 << 27), };#define __irqd_to_state (d) ACCESS_PRIVATE((d)->common, state_use_accessors)
@@ -390,6 +393,21 @@ static inline bool irqd_can_reserve(strureturn __irqd_to_state (d) &IRQD_CAN_RESERVE ; } +static inline void irqd_set_msi_nomask_quirk (struct irq_data *d) +{ +__irqd_to_state (d) |=IRQD_MSI_NOMASK_QUIRK ; +} + +static inline void irqd_clr_msi_nomask_quirk (struct irq_data *d) +{ +__irqd_to_state (d) &= ~IRQD_MSI_NOMASK_QUIRK ; +} + +static inline bool irqd_msi_nomask_quirk (struct irq_data *d) +{ +return __irqd_to_state (d) &IRQD_MSI_NOMASK_QUIRK ; +} +#undef __irqd_to_statestatic inline irq_hw_number_t irqd_to_hwirq (struct irq_data *d)
include/linux/irqdomain.h +7 -0
@@ -207,6 +207,13 @@ enum {IRQ_DOMAIN_FLAG_MSI_REMAP = (1 <<5 ),/* +* Quirk to handle MSI implementations which do not provide +* masking. Currently known to affect x86, but partially +* handled in core code. +*/ + IRQ_DOMAIN_MSI_NOMASK_QUIRK = (1 << 6), + +/* * Flags starting from IRQ_DOMAIN_FLAG_NONCORE are reserved * for implementation specific purposes and ignored by the * core code.
kernel/irq/debugfs.c +1 -0
@@ -114,6 +114,7 @@ static const struct irq_bit_descr irqdatBIT_MASK_DESCR (IRQD_AFFINITY_MANAGED ),BIT_MASK_DESCR (IRQD_MANAGED_SHUTDOWN ),BIT_MASK_DESCR (IRQD_CAN_RESERVE ), +BIT_MASK_DESCR (IRQD_MSI_NOMASK_QUIRK ), BIT_MASK_DESCR(IRQD_FORWARDED_TO_VCPU),
kernel/irq/msi.c +4 -1
@@ -453,8 +453,11 @@ int msi_domain_alloc_irqs(struct irq_domcontinue ; irq_data =irq_domain_get_irq_data (domain, desc->irq); -if (!can_reserve) +if (!can_reserve) {irqd_clr_can_reserve (irq_data); +if (domain->flags &IRQ_DOMAIN_MSI_NOMASK_QUIRK ) +irqd_set_msi_nomask_quirk (irq_data); + } ret =irq_domain_activate_irq (irq_data, can_reserve);if (ret) goto cleanup;
Greg Kroah-Hartman
maintainerPATCH 350/367 clocksource: Prevent double add_timer_on() for watchdog_timer
In reply to Greg Kroah-HartmanFrom: Konstantin Khlebnikov <[email protected]>
commit febac332a819f0e764aa4da62757ba21d18c182b upstream.
Kernel crashes inside QEMU/KVM are observed:
kernel BUG at kernel/time/timer.c:1154! BUG_ON(timer_pending(timer) || !timer->function) in add_timer_on().
At the same time another cpu got:
general protection fault: 0000 [#1] SMP PTI of poinson pointer 0xdead000000000200 in:
__hlist_del at include/linux/list.h:681
(inlined by) detach_timer at kernel/time/timer.c:818 (inlined by) expire_timers at kernel/time/timer.c:1355 (inlined by) __run_timers at kernel/time/timer.c:1686 (inlined by) run_timer_softirq at kernel/time/timer.c:1699
Unfortunately kernel logs are badly scrambled, stacktraces are lost.
Printing the timer->function before the BUG_ON() pointed to clocksource_watchdog().
The execution of clocksource_watchdog() can race with a sequence of clocksource_stop_watchdog() .. clocksource_start_watchdog():
expire_timers()
detach_timer(timer, true);
timer->entry.pprev = NULL;
raw_spin_unlock_irq(&base->lock);
call_timer_fn
clocksource_watchdog()
clocksource_watchdog_kthread() or clocksource_unbind() spin_lock_irqsave(&watchdog_lock, flags); clocksource_stop_watchdog(); del_timer(&watchdog_timer); watchdog_running = 0; spin_unlock_irqrestore(&watchdog_lock, flags); spin_lock_irqsave(&watchdog_lock, flags); clocksource_start_watchdog(); add_timer_on(&watchdog_timer, ...); watchdog_running = 1; spin_unlock_irqrestore(&watchdog_lock, flags);
spin_lock(&watchdog_lock);
add_timer_on(&watchdog_timer, ...);
BUG_ON(timer_pending(timer) || !timer->function);
timer_pending() -> true
BUG()I.e. inside clocksource_watchdog() watchdog_timer could be already armed.
Check timer_pending() before calling add_timer_on(). This is sufficient as all operations are synchronized by watchdog_lock.
--- kernel/time/clocksource.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
kernel/time/clocksource.c +9 -2
@@ -293,8 +293,15 @@ static void clocksource_watchdog(struct next_cpu =cpumask_next (raw_smp_processor_id (), cpu_online_mask);if (next_cpu >= nr_cpu_ids) next_cpu =cpumask_first (cpu_online_mask); - watchdog_timer.expires +=WATCHDOG_INTERVAL ; -add_timer_on (&watchdog_timer, next_cpu); + +/* +* Arm timer if not already pending: could race with concurrent +* pair clocksource_stop_watchdog() clocksource_start_watchdog(). +*/ +if (!timer_pending (&watchdog_timer)) { + watchdog_timer.expires +=WATCHDOG_INTERVAL ; +add_timer_on (&watchdog_timer, next_cpu); + } out:spin_unlock (&watchdog_lock); }
Greg Kroah-Hartman
maintainerPATCH 351/367 perf/core: Fix mlock accounting in perf_mmap()
In reply to Greg Kroah-HartmanFrom: Song Liu <[email protected]>
commit 003461559ef7a9bd0239bae35a22ad8924d6e9ad upstream.
Decreasing sysctl_perf_event_mlock between two consecutive perf_mmap()s of a perf ring buffer may lead to an integer underflow in locked memory accounting. This may lead to the undesired behaviors, such as failures in BPF map creation.
Address this by adjusting the accounting logic to take into account the possibility that the amount of already locked memory may exceed the current limit.
--- kernel/events/core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
kernel/events/core.c +9 -1
@@ -5916,7 +5916,15 @@ accounting:*/ user_lock_limit *=num_online_cpus (); - user_locked =atomic_long_read (&user->locked_vm) + user_extra; + user_locked =atomic_long_read (&user->locked_vm); + +/* +* sysctl_perf_event_mlock may have changed, so that +* user->locked_vm > user_lock_limit +*/ +if (user_locked > user_lock_limit) + user_locked = user_lock_limit; + user_locked += user_extra;if (user_locked > user_lock_limit) {/*
Greg Kroah-Hartman
maintainerPATCH 352/367 perf/cgroups: Install cgroup events to correct cpuctx
In reply to Greg Kroah-HartmanFrom: Song Liu <[email protected]>
commit 07c5972951f088094776038006a0592a46d14bbc upstream.
cgroup events are always installed in the cpuctx. However, when it is not installed via IPI, list_update_cgroup_event() adds it to cpuctx of current CPU, which triggers list corruption:
[] list_add double add: new=ffff888ff7cf0db0, prev=ffff888ff7ce82f0, next=ffff888ff7cf0db0.
To reproduce this, we can simply run:
# perf stat -e cs -a & # perf stat -e cs -G anycgroup
Fix this by installing it to cpuctx that contains event->ctx, and the proper cgrp_cpuctx_list.
--- kernel/events/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
kernel/events/core.c +4 -3
@@ -951,9 +951,9 @@ list_update_cgroup_event(struct perf_eve/* * Because cgroup events are always per-cpu events, -* this will always be called from the right CPU. +* @ctx == &cpuctx->ctx. */ - cpuctx =__get_cpu_context (ctx); + cpuctx = container_of(ctx, struct perf_cpu_context, ctx);/* * Since setting cpuctx->cgrp is conditional on the current @cgrp
@@ -979,7 +979,8 @@ list_update_cgroup_event(struct perf_eve cpuctx_entry = &cpuctx->cgrp_cpuctx_entry;if (add) -list_add (cpuctx_entry,this_cpu_ptr (&cgrp_cpuctx_list)); +list_add (cpuctx_entry, +per_cpu_ptr (&cgrp_cpuctx_list, event->cpu));else list_del (cpuctx_entry); }
Greg Kroah-Hartman
maintainerPATCH 353/367 drm/dp_mst: Remove VCPI while disabling topology mgr
In reply to Greg Kroah-HartmanFrom: Wayne Lin <[email protected]>
[ Upstream commit 64e62bdf04ab8529f45ed0a85122c703035dec3a ]
[Why]
This patch is trying to address the issue observed when hotplug DP daisy chain monitors.
e.g.
src-mstb-mstb-sst -> src (unplug) mstb-mstb-sst -> src-mstb-mstb-sst (plug in again)
Once unplug a DP MST capable device, driver will call drm_dp_mst_topology_mgr_set_mst() to disable MST. In this function, it cleans data of topology manager while disabling mst_state. However, it doesn't clean up the proposed_vcpis of topology manager. If proposed_vcpi is not reset, once plug in MST daisy chain monitors later, code will fail at checking port validation while trying to allocate payloads.
When MST capable device is plugged in again and try to allocate payloads by calling drm_dp_update_payload_part1(), this function will iterate over all proposed virtual channels to see if any proposed VCPI's num_slots is greater than 0. If any proposed VCPI's num_slots is greater than 0 and the port which the specific virtual channel directed to is not in the topology, code then fails at the port validation. Since there are stale VCPI allocations from the previous topology enablement in proposed_vcpi[], code will fail at port validation and reurn EINVAL.
[How]
Clean up the data of stale proposed_vcpi[] and reset mgr->proposed_vcpis to NULL while disabling mst in drm_dp_mst_topology_mgr_set_mst().
Changes since v1:
*Add on more details in commit message to describe the issue which the patch is trying to fix
--- drivers/gpu/drm/drm_dp_mst_topology.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/gpu/drm/drm_dp_mst_topology.c +12 -0
@@ -3435,6 +3435,7 @@ static int drm_dp_get_vc_payload_bw(u8 dp_link_bw, u8 dp_link_count)int drm_dp_mst_topology_mgr_set_mst (struct drm_dp_mst_topology_mgr *mgr,bool mst_state) {int ret =0 ; +int i =0 ;struct drm_dp_mst_branch *mstb =NULL ;mutex_lock (&mgr->lock);
@@ -3495,10 +3496,21 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms/* this can fail if the device is gone */ drm_dp_dpcd_writeb (mgr->aux,DP_MSTM_CTRL ,0 ); ret =0 ; +mutex_lock (&mgr->payload_lock);memset (mgr->payloads,0 , mgr->max_payloads *sizeof (struct drm_dp_payload )); mgr->payload_mask =0 ;set_bit (0 , &mgr->payload_mask); +for (i =0 ; i < mgr->max_payloads; i++) { +struct drm_dp_vcpi *vcpi = mgr->proposed_vcpis[i]; + +if (vcpi) { + vcpi->vcpi =0 ; + vcpi->num_slots =0 ; + } + mgr->proposed_vcpis[i] =NULL ; + } mgr->vcpi_mask =0 ; +mutex_unlock (&mgr->payload_lock); } out_unlock:
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 354/367 io_uring: enable option to only trigger eventfd for async completions
In reply to Greg Kroah-Hartman[ Upstream commit f2842ab5b72d7ee5f7f8385c2d4f32c133f5837b ]
If an application is using eventfd notifications with poll to know when new SQEs can be issued, it's expecting the following read/writes to complete inline. And with that, it knows that there are events available, and don't want spurious wakeups on the eventfd for those requests.
This adds IORING_REGISTER_EVENTFD_ASYNC, which works just like IORING_REGISTER_EVENTFD, except it only triggers notifications for events that happen from async completions (IRQ, or io-wq worker completions). Any completions inline from the submission itself will not trigger notifications.
--- fs/io_uring.c | 17 ++++++++++++++++- include/uapi/linux/io_uring.h | 1 + 2 files changed, 17 insertions(+), 1 deletion(-)
fs/io_uring.c +16 -1
@@ -188,6 +188,7 @@ struct io_ring_ctx {bool account_mem;bool cq_overflow_flushed;bool drain_next; +bool eventfd_async;/* * Ring buffer of indices into array of io_uring_sqe, which is
@@ -735,13 +736,20 @@ static struct io_uring_cqe *io_get_cqring(struct io_ring_ctx *ctx)return &rings->cqes[tail & ctx->cq_mask]; } +static inline bool io_should_trigger_evfd (struct io_ring_ctx *ctx) +{ +if (!ctx->eventfd_async) +return true; +return io_wq_current_is_worker () ||in_interrupt (); +} +static void io_cqring_ev_posted (struct io_ring_ctx *ctx) {if (waitqueue_active (&ctx->wait))wake_up (&ctx->wait);if (waitqueue_active (&ctx->sqo_wait))wake_up (&ctx->sqo_wait); -if (ctx->cq_ev_fd) +if (ctx->cq_ev_fd &&io_should_trigger_evfd (ctx))eventfd_signal (ctx->cq_ev_fd,1 ); }
@@ -5486,10 +5494,17 @@ static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode, ret =io_sqe_files_update (ctx, arg, nr_args);break ;case IORING_REGISTER_EVENTFD : +case IORING_REGISTER_EVENTFD_ASYNC : ret = -EINVAL ;if (nr_args !=1 )break ; ret =io_eventfd_register (ctx, arg); +if (ret) +break ; +if (opcode ==IORING_REGISTER_EVENTFD_ASYNC ) + ctx->eventfd_async =1 ; +else + ctx->eventfd_async =0 ;break ;case IORING_UNREGISTER_EVENTFD : ret = -EINVAL ;
include/uapi/linux/io_uring.h +1 -0
@@ -175,6 +175,7 @@ struct io_uring_params {#define IORING_REGISTER_EVENTFD 4#define IORING_UNREGISTER_EVENTFD 5#define IORING_REGISTER_FILES_UPDATE 6 +#define IORING_REGISTER_EVENTFD_ASYNC 7struct io_uring_files_update {__u32 offset;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 355/367 io_uring: prevent potential eventfd recursion on poll
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
[ Upstream commit f0b493e6b9a8959356983f57112229e69c2f7b8c ]
If we have nested or circular eventfd wakeups, then we can deadlock if we run them inline from our poll waitqueue wakeup handler. It's also possible to have very long chains of notifications, to the extent where we could risk blowing the stack.
Check the eventfd recursion count before calling eventfd_signal(). If it's non-zero, then punt the signaling to async context. This is always safe, as it takes us out-of-line in terms of stack and locking context.
--- fs/io_uring.c | 35 +++++++++++++++++++++++++++++------ 1 file changed, 29 insertions(+), 6 deletions(-)
fs/io_uring.c +29 -6
@@ -738,21 +738,28 @@ static struct io_uring_cqe *io_get_cqring(struct io_ring_ctx *ctx)static inline bool io_should_trigger_evfd (struct io_ring_ctx *ctx) { +if (!ctx->cq_ev_fd) +return false;if (!ctx->eventfd_async)return true;return io_wq_current_is_worker () ||in_interrupt (); } -static void io_cqring_ev_posted (struct io_ring_ctx *ctx) +static void __io_cqring_ev_posted (struct io_ring_ctx *ctx,bool trigger_ev) {if (waitqueue_active (&ctx->wait))wake_up (&ctx->wait);if (waitqueue_active (&ctx->sqo_wait))wake_up (&ctx->sqo_wait); -if (ctx->cq_ev_fd &&io_should_trigger_evfd (ctx)) +if (trigger_ev)eventfd_signal (ctx->cq_ev_fd,1 ); } +static void io_cqring_ev_posted (struct io_ring_ctx *ctx) +{ +__io_cqring_ev_posted (ctx,io_should_trigger_evfd (ctx)); +} +/* Returns true if there are no backlogged entries after the flush */ static bool io_cqring_overflow_flush (struct io_ring_ctx *ctx,bool force) {
@@ -2645,6 +2652,14 @@ static void io_poll_complete_work(struct io_wq_work **workptr)io_wq_assign_next (workptr, nxt); } +static void io_poll_trigger_evfd (struct io_wq_work **workptr) +{ + struct io_kiocb *req = container_of(*workptr, struct io_kiocb, work); + +eventfd_signal (req->ctx->cq_ev_fd,1 ); +io_put_req (req); +} +static int io_poll_wake (struct wait_queue_entry *wait,unsigned mode,int sync,void *key) {
@@ -2667,13 +2682,21 @@ static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,* for finalizing the request, mark us as having grabbed that already. */ if (mask &&spin_trylock_irqsave (&ctx->completion_lock, flags)) { +bool trigger_ev; +hash_del (&req->hash_node);io_poll_complete (req, mask,0 ); - req->flags |=REQ_F_COMP_LOCKED ; -io_put_req (req); + trigger_ev =io_should_trigger_evfd (ctx); +if (trigger_ev &&eventfd_signal_count ()) { + trigger_ev = false; + req->work.func = io_poll_trigger_evfd; + }else { + req->flags |=REQ_F_COMP_LOCKED ; +io_put_req (req); + req =NULL ; + }spin_unlock_irqrestore (&ctx->completion_lock, flags); - -io_cqring_ev_posted (ctx); +__io_cqring_ev_posted (ctx, trigger_ev); }else {io_queue_async_work (req); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 356/367 KVM: x86: Protect exit_reason from being used in Spectre-v1/L1TF attacks
In reply to Greg Kroah-HartmanFrom: Marios Pomonis <[email protected]>
[ Upstream commit c926f2f7230b1a29e31914b51db680f8cbf3103f ]
This fixes a Spectre-v1/L1TF vulnerability in vmx_handle_exit(). While exit_reason is set by the hardware and therefore should not be attacker-influenced, an unknown exit_reason could potentially be used to perform such an attack.
--- arch/x86/kvm/vmx/vmx.c | 55 +++++++++++++++++++++++------------------- 1 file changed, 30 insertions(+), 25 deletions(-)
arch/x86/kvm/vmx/vmx.c +30 -25
@@ -5904,34 +5904,39 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu) } } -if (exit_reason < kvm_vmx_max_exit_handlers - && kvm_vmx_exit_handlers[exit_reason]) { +if (exit_reason >= kvm_vmx_max_exit_handlers) + goto unexpected_vmexit;#ifdef CONFIG_RETPOLINE -if (exit_reason ==EXIT_REASON_MSR_WRITE ) -return kvm_emulate_wrmsr (vcpu); -else if (exit_reason ==EXIT_REASON_PREEMPTION_TIMER ) -return handle_preemption_timer (vcpu); -else if (exit_reason ==EXIT_REASON_PENDING_INTERRUPT ) -return handle_interrupt_window (vcpu); -else if (exit_reason ==EXIT_REASON_EXTERNAL_INTERRUPT ) -return handle_external_interrupt (vcpu); -else if (exit_reason ==EXIT_REASON_HLT ) -return kvm_emulate_halt (vcpu); -else if (exit_reason ==EXIT_REASON_EPT_MISCONFIG ) -return handle_ept_misconfig (vcpu); +if (exit_reason ==EXIT_REASON_MSR_WRITE ) +return kvm_emulate_wrmsr (vcpu); +else if (exit_reason ==EXIT_REASON_PREEMPTION_TIMER ) +return handle_preemption_timer (vcpu); +else if (exit_reason ==EXIT_REASON_PENDING_INTERRUPT ) +return handle_interrupt_window (vcpu); +else if (exit_reason ==EXIT_REASON_EXTERNAL_INTERRUPT ) +return handle_external_interrupt (vcpu); +else if (exit_reason ==EXIT_REASON_HLT ) +return kvm_emulate_halt (vcpu); +else if (exit_reason ==EXIT_REASON_EPT_MISCONFIG ) +return handle_ept_misconfig (vcpu);#endif -return kvm_vmx_exit_handlers[exit_reason](vcpu); - }else { -vcpu_unimpl (vcpu,"vmx: unexpected exit reason 0x%x\n" , - exit_reason); -dump_vmcs (); - vcpu->run->exit_reason =KVM_EXIT_INTERNAL_ERROR ; - vcpu->run->internal.suberror = + + exit_reason =array_index_nospec (exit_reason, + kvm_vmx_max_exit_handlers); +if (!kvm_vmx_exit_handlers[exit_reason]) + goto unexpected_vmexit; + +return kvm_vmx_exit_handlers[exit_reason](vcpu); + +unexpected_vmexit: +vcpu_unimpl (vcpu,"vmx: unexpected exit reason 0x%x\n" , exit_reason); +dump_vmcs (); + vcpu->run->exit_reason =KVM_EXIT_INTERNAL_ERROR ; + vcpu->run->internal.suberror =KVM_INTERNAL_ERROR_UNEXPECTED_EXIT_REASON ; - vcpu->run->internal.ndata =1 ; - vcpu->run->internal.data[0 ] = exit_reason; -return 0 ; - } + vcpu->run->internal.ndata =1 ; + vcpu->run->internal.data[0 ] = exit_reason; +return 0 ; }/*
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 357/367 KVM: nVMX: vmread should not set rflags to specify success in case of #PF
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
[ Upstream commit a4d956b9390418623ae5d07933e2679c68b6f83c ]
In case writing to vmread destination operand result in a #PF, vmread should not call nested_vmx_succeed() to set rflags to specify success. Similar to as done in VMPTRST (See handle_vmptrst()).
--- arch/x86/kvm/vmx/nested.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/kvm/vmx/nested.c +3 -1
@@ -4807,8 +4807,10 @@ static int handle_vmread(struct kvm_vcpu *vcpu) vmx_instruction_info, true, len, &gva))return 1 ;/* _system ok, nested_vmx_check_permission has verified cpl=0 */ -if (kvm_write_guest_virt_system (vcpu, gva, &field_value, len, &e)) +if (kvm_write_guest_virt_system (vcpu, gva, &field_value, len, &e)) {kvm_inject_page_fault (vcpu, &e); +return 1 ; + } }return nested_vmx_succeed (vcpu);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 358/367 KVM: Use vcpu-specific gva->hva translation when querying host page size
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit f9b84e19221efc5f493156ee0329df3142085f28 ]
Use kvm_vcpu_gfn_to_hva() when retrieving the host page size so that the correct set of memslots is used when handling x86 page faults in SMM.
--- arch/powerpc/kvm/book3s_xive_native.c | 2 +- arch/x86/kvm/mmu/mmu.c | 6 +++--- include/linux/kvm_host.h | 2 +- virt/kvm/kvm_main.c | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-)
arch/powerpc/kvm/book3s_xive_native.c +1 -1
@@ -631,7 +631,7 @@ static int kvmppc_xive_native_set_queue_config(struct kvmppc_xive *xive, srcu_idx =srcu_read_lock (&kvm->srcu); gfn =gpa_to_gfn (kvm_eq.qaddr); - page_size =kvm_host_page_size (kvm, gfn); + page_size =kvm_host_page_size (vcpu, gfn);if (1ull << kvm_eq.qshift > page_size) {srcu_read_unlock (&kvm->srcu, srcu_idx);pr_warn ("Incompatible host page size %lx!\n" , page_size);
arch/x86/kvm/mmu/mmu.c +3 -3
@@ -1286,12 +1286,12 @@ static bool mmu_gfn_lpage_is_disallowed(struct kvm_vcpu *vcpu, gfn_t gfn,return __mmu_gfn_lpage_is_disallowed (gfn, level, slot); } -static int host_mapping_level (struct kvm *kvm,gfn_t gfn) +static int host_mapping_level (struct kvm_vcpu *vcpu,gfn_t gfn) {unsigned long page_size;int i, ret =0 ; - page_size =kvm_host_page_size (kvm, gfn); + page_size =kvm_host_page_size (vcpu, gfn);for (i =PT_PAGE_TABLE_LEVEL ; i <=PT_MAX_HUGEPAGE_LEVEL ; ++i) {if (page_size >=KVM_HPAGE_SIZE (i))
@@ -1341,7 +1341,7 @@ static int mapping_level(struct kvm_vcpu *vcpu, gfn_t large_gfn,if (unlikely (*force_pt_level))return PT_PAGE_TABLE_LEVEL ; - host_level =host_mapping_level (vcpu->kvm, large_gfn); + host_level =host_mapping_level (vcpu, large_gfn);if (host_level ==PT_PAGE_TABLE_LEVEL )return host_level;
include/linux/kvm_host.h +1 -1
@@ -768,7 +768,7 @@ int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len);int kvm_clear_guest (struct kvm *kvm,gpa_t gpa,unsigned long len);struct kvm_memory_slot *gfn_to_memslot (struct kvm *kvm,gfn_t gfn);bool kvm_is_visible_gfn (struct kvm *kvm,gfn_t gfn); -unsigned long kvm_host_page_size (struct kvm *kvm,gfn_t gfn); +unsigned long kvm_host_page_size (struct kvm_vcpu *vcpu,gfn_t gfn);void mark_page_dirty (struct kvm *kvm,gfn_t gfn);struct kvm_memslots *kvm_vcpu_memslots (struct kvm_vcpu *vcpu);
virt/kvm/kvm_main.c +2 -2
@@ -1406,14 +1406,14 @@ bool kvm_is_visible_gfn(struct kvm *kvm, gfn_t gfn) }EXPORT_SYMBOL_GPL (kvm_is_visible_gfn); -unsigned long kvm_host_page_size (struct kvm *kvm,gfn_t gfn) +unsigned long kvm_host_page_size (struct kvm_vcpu *vcpu,gfn_t gfn) {struct vm_area_struct *vma;unsigned long addr, size; size =PAGE_SIZE ; - addr =gfn_to_hva (kvm, gfn); + addr =kvm_vcpu_gfn_to_hva (vcpu, gfn);if (kvm_is_error_hva (addr))return PAGE_SIZE ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 359/367 KVM: Play nice with read-only memslots when querying host page size
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 42cde48b2d39772dba47e680781a32a6c4b7dc33 ]
Avoid the "writable" check in __gfn_to_hva_many(), which will always fail on read-only memslots due to gfn_to_hva() assuming writes. Functionally, this allows x86 to create large mappings for read-only memslots that are backed by HugeTLB mappings.
Note, the changelog for commit 05da45583de9 ("KVM: MMU: large page support") states "If the largepage contains write-protected pages, a large pte is not used.", but "write-protected" refers to pages that are temporarily read-only, e.g. read-only memslots didn't even exist at the time.
--- virt/kvm/kvm_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
virt/kvm/kvm_main.c +1 -1
@@ -1413,7 +1413,7 @@ unsigned long kvm_host_page_size(struct kvm_vcpu *vcpu, gfn_t gfn) size =PAGE_SIZE ; - addr =kvm_vcpu_gfn_to_hva (vcpu, gfn); + addr =kvm_vcpu_gfn_to_hva_prot (vcpu, gfn,NULL );if (kvm_is_error_hva (addr))return PAGE_SIZE ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 360/367 rxrpc: Fix service call disconnection
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit b39a934ec72fa2b5a74123891f25273a38378b90 ]
The recent patch that substituted a flag on an rxrpc_call for the connection pointer being NULL as an indication that a call was disconnected puts the set_bit in the wrong place for service calls. This is only a problem if a call is implicitly terminated by a new call coming in on the same connection channel instead of a terminating ACK packet.
In such a case, rxrpc_input_implicit_end_call() calls __rxrpc_disconnect_call(), which is now (incorrectly) setting the disconnection bit, meaning that when rxrpc_release_call() is later called, it doesn't call rxrpc_disconnect_call() and so the call isn't removed from the peer's error distribution list and the list gets corrupted.
KASAN finds the issue as an access after release on a call, but the position at which it occurs is confusing as it appears to be related to a different call (the call site is where the latter call is being removed from the error distribution list and either the next or pprev pointer points to a previously released call).
Fix this by moving the setting of the flag from __rxrpc_disconnect_call() to rxrpc_disconnect_call() in the same place that the connection pointer was being cleared.
--- net/rxrpc/conn_object.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/rxrpc/conn_object.c +1 -2
@@ -171,8 +171,6 @@ void __rxrpc_disconnect_call(struct rxrpc_connection *conn,_enter ("%d,%x" , conn->debug_id, call->cid); -set_bit (RXRPC_CALL_DISCONNECTED , &call->flags); -if (rcu_access_pointer (chan->call) == call) {/* Save the result of the call so that we can repeat it if necessary * through the channel, whilst disposing of the actual call record.
@@ -225,6 +223,7 @@ void rxrpc_disconnect_call(struct rxrpc_call *call)__rxrpc_disconnect_call (conn, call);spin_unlock (&conn->channel_lock); +set_bit (RXRPC_CALL_DISCONNECTED , &call->flags); conn->idle_timestamp = jiffies; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 361/367 IB/core: Fix build failure without hugepages
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 74f75cda754eb69a77f910ceb5bc85f8e9ba56a5 ]
HPAGE_SHIFT is only defined on architectures that support hugepages:
drivers/infiniband/core/umem_odp.c: In function 'ib_umem_odp_get':drivers/infiniband/core/umem_odp.c:245:26: error: 'HPAGE_SHIFT' undeclared (first use in this function); did you mean 'PAGE_SHIFT'?
Enclose this in an #ifdef.
--- drivers/infiniband/core/umem_odp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/infiniband/core/umem_odp.c +3 -2
@@ -241,10 +241,11 @@ struct ib_umem_odp *ib_umem_odp_get(struct ib_udata *udata, unsigned long addr, umem_odp->umem.owning_mm = mm = current->mm; umem_odp->notifier.ops = ops; + umem_odp->page_shift =PAGE_SHIFT ; +#ifdef CONFIG_HUGETLB_PAGE if (access &IB_ACCESS_HUGETLB ) umem_odp->page_shift =HPAGE_SHIFT ; -else - umem_odp->page_shift =PAGE_SHIFT ; +#endif umem_odp->tgid =get_task_pid (current->group_leader,PIDTYPE_PID ); ret =ib_init_umem_odp (umem_odp, ops);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 362/367 crypto: atmel-{aes,tdes} - Do not save IV for ECB mode
In reply to Greg Kroah-HartmanFrom: Tudor Ambarus <[email protected]>
[ Upstream commit c65d123742a7bf2a5bc9fa8398e1fd2376eb4c43 ]
ECB mode does not use IV.
--- drivers/crypto/atmel-aes.c | 9 +++++++-- drivers/crypto/atmel-tdes.c | 7 +++++-- 2 files changed, 12 insertions(+), 4 deletions(-)
drivers/crypto/atmel-aes.c +7 -2
@@ -515,6 +515,9 @@ static void atmel_aes_set_iv_as_last_ciphertext_block(struct atmel_aes_dev *dd)static inline int atmel_aes_complete (struct atmel_aes_dev *dd,int err) { +struct skcipher_request *req =skcipher_request_cast (dd->areq); +struct atmel_aes_reqctx *rctx =skcipher_request_ctx (req); +#if IS_ENABLED (CONFIG_CRYPTO_DEV_ATMEL_AUTHENC )if (dd->ctx->is_aead)atmel_aes_authenc_complete (dd, err);
@@ -523,7 +526,8 @@ static inline int atmel_aes_complete(struct atmel_aes_dev *dd, int err)clk_disable (dd->iclk); dd->flags &= ~AES_FLAGS_BUSY ; -if (!dd->ctx->is_aead) +if (!dd->ctx->is_aead && + (rctx->mode &AES_FLAGS_OPMODE_MASK ) !=AES_FLAGS_ECB )atmel_aes_set_iv_as_last_ciphertext_block (dd);if (dd->is_async)
@@ -1121,7 +1125,8 @@ static int atmel_aes_crypt(struct skcipher_request *req, unsigned long mode) rctx =skcipher_request_ctx (req); rctx->mode = mode; -if (!(mode &AES_FLAGS_ENCRYPT ) && (req->src == req->dst)) { +if ((mode &AES_FLAGS_OPMODE_MASK ) !=AES_FLAGS_ECB && + !(mode &AES_FLAGS_ENCRYPT ) && req->src == req->dst) {unsigned int ivsize =crypto_skcipher_ivsize (skcipher);if (req->cryptlen >= ivsize)
drivers/crypto/atmel-tdes.c +5 -2
@@ -600,12 +600,14 @@ atmel_tdes_set_iv_as_last_ciphertext_block(struct atmel_tdes_dev *dd)static void atmel_tdes_finish_req (struct atmel_tdes_dev *dd,int err) {struct skcipher_request *req = dd->req; +struct atmel_tdes_reqctx *rctx =skcipher_request_ctx (req);clk_disable_unprepare (dd->iclk); dd->flags &= ~TDES_FLAGS_BUSY ; -atmel_tdes_set_iv_as_last_ciphertext_block (dd); +if ((rctx->mode &TDES_FLAGS_OPMODE_MASK ) !=TDES_FLAGS_ECB ) +atmel_tdes_set_iv_as_last_ciphertext_block (dd); req->base.complete (&req->base, err); }
@@ -727,7 +729,8 @@ static int atmel_tdes_crypt(struct skcipher_request *req, unsigned long mode) rctx->mode = mode; -if (!(mode &TDES_FLAGS_ENCRYPT ) && req->src == req->dst) { +if ((mode &TDES_FLAGS_OPMODE_MASK ) !=TDES_FLAGS_ECB && + !(mode &TDES_FLAGS_ENCRYPT ) && req->src == req->dst) {unsigned int ivsize =crypto_skcipher_ivsize (skcipher);if (req->cryptlen >= ivsize)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 363/367 crypto: atmel-aes - Fix saving of IV for CTR mode
In reply to Greg Kroah-HartmanFrom: Tudor Ambarus <[email protected]>
[ Upstream commit 371731ec2179d5810683406e7fc284b41b127df7 ]
The req->iv of the skcipher_request is expected to contain the last used IV. Update the req->iv for CTR mode.
--- drivers/crypto/atmel-aes.c | 43 +++++++++++++++++++++++++++----------- 1 file changed, 31 insertions(+), 12 deletions(-)
drivers/crypto/atmel-aes.c +31 -12
@@ -121,6 +121,7 @@ struct atmel_aes_ctr_ctx {size_t offset;struct scatterlist src[2 ];struct scatterlist dst[2 ]; +u16 blocks; };struct atmel_aes_gcm_ctx {
@@ -513,6 +514,26 @@ static void atmel_aes_set_iv_as_last_ciphertext_block(struct atmel_aes_dev *dd) } } +static inline struct atmel_aes_ctr_ctx * +atmel_aes_ctr_ctx_cast (struct atmel_aes_base_ctx *ctx) +{ + return container_of(ctx, struct atmel_aes_ctr_ctx, base); +} + +static void atmel_aes_ctr_update_req_iv (struct atmel_aes_dev *dd) +{ +struct atmel_aes_ctr_ctx *ctx =atmel_aes_ctr_ctx_cast (dd->ctx); +struct skcipher_request *req =skcipher_request_cast (dd->areq); +struct crypto_skcipher *skcipher =crypto_skcipher_reqtfm (req); +unsigned int ivsize =crypto_skcipher_ivsize (skcipher); +int i; + +for (i =0 ; i < ctx->blocks; i++) +crypto_inc ((u8 *)ctx->iv,AES_BLOCK_SIZE ); + +memcpy (req->iv, ctx->iv, ivsize); +} +static inline int atmel_aes_complete (struct atmel_aes_dev *dd,int err) {struct skcipher_request *req =skcipher_request_cast (dd->areq);
@@ -527,8 +548,12 @@ static inline int atmel_aes_complete(struct atmel_aes_dev *dd, int err) dd->flags &= ~AES_FLAGS_BUSY ;if (!dd->ctx->is_aead && - (rctx->mode &AES_FLAGS_OPMODE_MASK ) !=AES_FLAGS_ECB ) -atmel_aes_set_iv_as_last_ciphertext_block (dd); + (rctx->mode &AES_FLAGS_OPMODE_MASK ) !=AES_FLAGS_ECB ) { +if ((rctx->mode &AES_FLAGS_OPMODE_MASK ) !=AES_FLAGS_CTR ) +atmel_aes_set_iv_as_last_ciphertext_block (dd); +else +atmel_aes_ctr_update_req_iv (dd); + }if (dd->is_async) dd->areq->complete (dd->areq, err);
@@ -1007,12 +1032,6 @@ static int atmel_aes_start(struct atmel_aes_dev *dd) atmel_aes_transfer_complete); } -static inline struct atmel_aes_ctr_ctx * -atmel_aes_ctr_ctx_cast (struct atmel_aes_base_ctx *ctx) -{ - return container_of(ctx, struct atmel_aes_ctr_ctx, base); -} -static int atmel_aes_ctr_transfer (struct atmel_aes_dev *dd) {struct atmel_aes_ctr_ctx *ctx =atmel_aes_ctr_ctx_cast (dd->ctx);
@@ -1020,7 +1039,7 @@ static int atmel_aes_ctr_transfer(struct atmel_aes_dev *dd)struct scatterlist *src, *dst;size_t datalen;u32 ctr; -u16 blocks, start, end; +u16 start, end;bool use_dma, fragmented = false;/* Check for transfer completion. */
@@ -1030,14 +1049,14 @@ static int atmel_aes_ctr_transfer(struct atmel_aes_dev *dd)/* Compute data length. */ datalen = req->cryptlen - ctx->offset; - blocks =DIV_ROUND_UP (datalen,AES_BLOCK_SIZE ); + ctx->blocks =DIV_ROUND_UP (datalen,AES_BLOCK_SIZE ); ctr =be32_to_cpu (ctx->iv[3 ]);/* Check 16bit counter overflow. */ start = ctr &0xffff ; - end = start + blocks -1 ; + end = start + ctx->blocks -1 ; -if (blocks >>16 || end < start) { +if (ctx->blocks >>16 || end < start) { ctr |=0xffff ; datalen =AES_BLOCK_SIZE * (0x10000 - start); fragmented = true;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 364/367 crypto: atmel-aes - Fix CTR counter overflow when multiple fragments
In reply to Greg Kroah-HartmanFrom: Tudor Ambarus <[email protected]>
[ Upstream commit 3907ccfaec5d9965e306729936fc732c94d2c1e7 ]
The CTR transfer works in fragments of data of maximum 1 MByte because of the 16 bit CTR counter embedded in the IP. Fix the CTR counter overflow handling for messages larger than 1 MByte.
--- drivers/crypto/atmel-aes.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/crypto/atmel-aes.c +7 -1
@@ -121,7 +121,7 @@ struct atmel_aes_ctr_ctx {size_t offset;struct scatterlist src[2 ];struct scatterlist dst[2 ]; -u16 blocks; +u32 blocks; };struct atmel_aes_gcm_ctx {
@@ -528,6 +528,12 @@ static void atmel_aes_ctr_update_req_iv(struct atmel_aes_dev *dd)unsigned int ivsize =crypto_skcipher_ivsize (skcipher);int i; +/* +* The CTR transfer works in fragments of data of maximum 1 MByte +* because of the 16 bit CTR counter embedded in the IP. When reaching +* here, ctx->blocks contains the number of blocks of the last fragment +* processed, there is no need to explicit cast it to u16. +*/ for (i =0 ; i < ctx->blocks; i++)crypto_inc ((u8 *)ctx->iv,AES_BLOCK_SIZE );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 365/367 crypto: atmel-tdes - Map driver data flags to Mode Register
In reply to Greg Kroah-HartmanFrom: Tudor Ambarus <[email protected]>
[ Upstream commit 848572f817721499c05b66553afc7ce0c08b1723 ]
Simplifies the configuration of the TDES IP.
--- drivers/crypto/atmel-tdes.c | 144 ++++++++++++++++++------------------ 1 file changed, 71 insertions(+), 73 deletions(-)
drivers/crypto/atmel-tdes.c +71 -73
@@ -41,20 +41,23 @@#include "atmel-tdes-regs.h" /* TDES flags */ -#define TDES_FLAGS_MODE_MASK 0x00ff -#define TDES_FLAGS_ENCRYPT BIT(0) -#define TDES_FLAGS_CBC BIT(1) -#define TDES_FLAGS_CFB BIT(2) -#define TDES_FLAGS_CFB8 BIT(3) -#define TDES_FLAGS_CFB16 BIT(4) -#define TDES_FLAGS_CFB32 BIT(5) -#define TDES_FLAGS_CFB64 BIT(6) -#define TDES_FLAGS_OFB BIT(7) - -#define TDES_FLAGS_INIT BIT(16) -#define TDES_FLAGS_FAST BIT(17) -#define TDES_FLAGS_BUSY BIT(18) -#define TDES_FLAGS_DMA BIT(19) +/* Reserve bits [17:16], [13:12], [2:0] for AES Mode Register */ +#define TDES_FLAGS_ENCRYPT TDES_MR_CYPHER_ENC +#define TDES_FLAGS_OPMODE_MASK (TDES_MR_OPMOD_MASK | TDES_MR_CFBS_MASK) +#define TDES_FLAGS_ECB TDES_MR_OPMOD_ECB +#define TDES_FLAGS_CBC TDES_MR_OPMOD_CBC +#define TDES_FLAGS_OFB TDES_MR_OPMOD_OFB +#define TDES_FLAGS_CFB64 (TDES_MR_OPMOD_CFB | TDES_MR_CFBS_64b) +#define TDES_FLAGS_CFB32 (TDES_MR_OPMOD_CFB | TDES_MR_CFBS_32b) +#define TDES_FLAGS_CFB16 (TDES_MR_OPMOD_CFB | TDES_MR_CFBS_16b) +#define TDES_FLAGS_CFB8 (TDES_MR_OPMOD_CFB | TDES_MR_CFBS_8b) + +#define TDES_FLAGS_MODE_MASK (TDES_FLAGS_OPMODE_MASK | TDES_FLAGS_ENCRYPT) + +#define TDES_FLAGS_INIT BIT(3) +#define TDES_FLAGS_FAST BIT(4) +#define TDES_FLAGS_BUSY BIT(5) +#define TDES_FLAGS_DMA BIT(6)#define ATMEL_TDES_QUEUE_LENGTH 50
@@ -282,25 +285,7 @@ static int atmel_tdes_write_ctrl(struct atmel_tdes_dev *dd) valmr |=TDES_MR_TDESMOD_DES ; } -if (dd->flags &TDES_FLAGS_CBC ) { - valmr |=TDES_MR_OPMOD_CBC ; - }else if (dd->flags &TDES_FLAGS_CFB ) { - valmr |=TDES_MR_OPMOD_CFB ; - -if (dd->flags &TDES_FLAGS_CFB8 ) - valmr |= TDES_MR_CFBS_8b; -else if (dd->flags &TDES_FLAGS_CFB16 ) - valmr |= TDES_MR_CFBS_16b; -else if (dd->flags &TDES_FLAGS_CFB32 ) - valmr |= TDES_MR_CFBS_32b; -else if (dd->flags &TDES_FLAGS_CFB64 ) - valmr |= TDES_MR_CFBS_64b; - }else if (dd->flags &TDES_FLAGS_OFB ) { - valmr |=TDES_MR_OPMOD_OFB ; - } - -if ((dd->flags &TDES_FLAGS_ENCRYPT ) || (dd->flags &TDES_FLAGS_OFB )) - valmr |=TDES_MR_CYPHER_ENC ; + valmr |= dd->flags &TDES_FLAGS_MODE_MASK ;atmel_tdes_write (dd,TDES_CR , valcr);atmel_tdes_write (dd,TDES_MR , valmr);
@@ -308,10 +293,8 @@ static int atmel_tdes_write_ctrl(struct atmel_tdes_dev *dd)atmel_tdes_write_n (dd,TDES_KEY1W1R , dd->ctx->key, dd->ctx->keylen >>2 ); -if (((dd->flags &TDES_FLAGS_CBC ) || (dd->flags &TDES_FLAGS_CFB ) || - (dd->flags &TDES_FLAGS_OFB )) && dd->req->iv) { +if (dd->req->iv && (valmr &TDES_MR_OPMOD_MASK ) !=TDES_MR_OPMOD_ECB )atmel_tdes_write_n (dd,TDES_IV1R , (void *)dd->req->iv,2 ); - }return 0 ; }
@@ -402,6 +385,7 @@ static int atmel_tdes_crypt_pdc(struct crypto_tfm *tfm, dma_addr_t dma_addr_in, {struct atmel_tdes_ctx *ctx =crypto_tfm_ctx (tfm);struct atmel_tdes_dev *dd = ctx->dd; +struct atmel_tdes_reqctx *rctx =skcipher_request_ctx (dd->req);int len32; dd->dma_size = length;
@@ -411,12 +395,19 @@ static int atmel_tdes_crypt_pdc(struct crypto_tfm *tfm, dma_addr_t dma_addr_in, DMA_TO_DEVICE); } -if ((dd->flags &TDES_FLAGS_CFB ) && (dd->flags &TDES_FLAGS_CFB8 )) +switch (rctx->mode &TDES_FLAGS_OPMODE_MASK ) { +case TDES_FLAGS_CFB8 : len32 =DIV_ROUND_UP (length,sizeof (u8)); -else if ((dd->flags &TDES_FLAGS_CFB ) && (dd->flags &TDES_FLAGS_CFB16 )) +break ; + +case TDES_FLAGS_CFB16 : len32 =DIV_ROUND_UP (length,sizeof (u16)); -else +break ; + +default : len32 =DIV_ROUND_UP (length,sizeof (u32)); +break ; + }atmel_tdes_write (dd,TDES_PTCR ,TDES_PTCR_TXTDIS |TDES_PTCR_RXTDIS );atmel_tdes_write (dd,TDES_TPR , dma_addr_in);
@@ -438,8 +429,10 @@ static int atmel_tdes_crypt_dma(struct crypto_tfm *tfm, dma_addr_t dma_addr_in, {struct atmel_tdes_ctx *ctx =crypto_tfm_ctx (tfm);struct atmel_tdes_dev *dd = ctx->dd; +struct atmel_tdes_reqctx *rctx =skcipher_request_ctx (dd->req);struct scatterlist sg[2 ];struct dma_async_tx_descriptor *in_desc, *out_desc; +enum dma_slave_buswidth addr_width; dd->dma_size = length;
@@ -448,23 +441,23 @@ static int atmel_tdes_crypt_dma(struct crypto_tfm *tfm, dma_addr_t dma_addr_in, DMA_TO_DEVICE); } -if (dd->flags &TDES_FLAGS_CFB8 ) { - dd->dma_lch_in.dma_conf.dst_addr_width = -DMA_SLAVE_BUSWIDTH_1_BYTE ; - dd->dma_lch_out.dma_conf.src_addr_width = -DMA_SLAVE_BUSWIDTH_1_BYTE ; - }else if (dd->flags &TDES_FLAGS_CFB16 ) { - dd->dma_lch_in.dma_conf.dst_addr_width = -DMA_SLAVE_BUSWIDTH_2_BYTES ; - dd->dma_lch_out.dma_conf.src_addr_width = -DMA_SLAVE_BUSWIDTH_2_BYTES ; - }else { - dd->dma_lch_in.dma_conf.dst_addr_width = -DMA_SLAVE_BUSWIDTH_4_BYTES ; - dd->dma_lch_out.dma_conf.src_addr_width = -DMA_SLAVE_BUSWIDTH_4_BYTES ; +switch (rctx->mode &TDES_FLAGS_OPMODE_MASK ) { +case TDES_FLAGS_CFB8 : + addr_width =DMA_SLAVE_BUSWIDTH_1_BYTE ; +break ; + +case TDES_FLAGS_CFB16 : + addr_width =DMA_SLAVE_BUSWIDTH_2_BYTES ; +break ; + +default : + addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ; +break ; } + dd->dma_lch_in.dma_conf.dst_addr_width = addr_width; + dd->dma_lch_out.dma_conf.src_addr_width = addr_width; +dmaengine_slave_config (dd->dma_lch_in.chan, &dd->dma_lch_in.dma_conf);dmaengine_slave_config (dd->dma_lch_out.chan, &dd->dma_lch_out.dma_conf);
@@ -701,30 +694,38 @@ static int atmel_tdes_crypt(struct skcipher_request *req, unsigned long mode)struct atmel_tdes_ctx *ctx =crypto_skcipher_ctx (skcipher);struct atmel_tdes_reqctx *rctx =skcipher_request_ctx (req); -if (mode &TDES_FLAGS_CFB8 ) { +switch (mode &TDES_FLAGS_OPMODE_MASK ) { +case TDES_FLAGS_CFB8 :if (!IS_ALIGNED (req->cryptlen,CFB8_BLOCK_SIZE )) {pr_err ("request size is not exact amount of CFB8 blocks\n" );return -EINVAL ; } ctx->block_size =CFB8_BLOCK_SIZE ; - }else if (mode &TDES_FLAGS_CFB16 ) { +break ; + +case TDES_FLAGS_CFB16 :if (!IS_ALIGNED (req->cryptlen,CFB16_BLOCK_SIZE )) {pr_err ("request size is not exact amount of CFB16 blocks\n" );return -EINVAL ; } ctx->block_size =CFB16_BLOCK_SIZE ; - }else if (mode &TDES_FLAGS_CFB32 ) { +break ; + +case TDES_FLAGS_CFB32 :if (!IS_ALIGNED (req->cryptlen,CFB32_BLOCK_SIZE )) {pr_err ("request size is not exact amount of CFB32 blocks\n" );return -EINVAL ; } ctx->block_size =CFB32_BLOCK_SIZE ; - }else { +break ; + +default :if (!IS_ALIGNED (req->cryptlen,DES_BLOCK_SIZE )) {pr_err ("request size is not exact amount of DES blocks\n" );return -EINVAL ; } ctx->block_size =DES_BLOCK_SIZE ; +break ; } rctx->mode = mode;
@@ -844,17 +845,17 @@ static int atmel_tdes_setkey(struct crypto_skcipher *tfm, const u8 *key,static int atmel_tdes_ecb_encrypt (struct skcipher_request *req) { -return atmel_tdes_crypt (req,TDES_FLAGS_ENCRYPT ); +return atmel_tdes_crypt (req,TDES_FLAGS_ECB |TDES_FLAGS_ENCRYPT ); }static int atmel_tdes_ecb_decrypt (struct skcipher_request *req) { -return atmel_tdes_crypt (req,0 ); +return atmel_tdes_crypt (req,TDES_FLAGS_ECB ); }static int atmel_tdes_cbc_encrypt (struct skcipher_request *req) { -return atmel_tdes_crypt (req,TDES_FLAGS_ENCRYPT |TDES_FLAGS_CBC ); +return atmel_tdes_crypt (req,TDES_FLAGS_CBC |TDES_FLAGS_ENCRYPT ); }static int atmel_tdes_cbc_decrypt (struct skcipher_request *req)
@@ -863,50 +864,47 @@ static int atmel_tdes_cbc_decrypt(struct skcipher_request *req) }static int atmel_tdes_cfb_encrypt (struct skcipher_request *req) { -return atmel_tdes_crypt (req,TDES_FLAGS_ENCRYPT |TDES_FLAGS_CFB ); +return atmel_tdes_crypt (req,TDES_FLAGS_CFB64 |TDES_FLAGS_ENCRYPT ); }static int atmel_tdes_cfb_decrypt (struct skcipher_request *req) { -return atmel_tdes_crypt (req,TDES_FLAGS_CFB ); +return atmel_tdes_crypt (req,TDES_FLAGS_CFB64 ); }static int atmel_tdes_cfb8_encrypt (struct skcipher_request *req) { -return atmel_tdes_crypt (req,TDES_FLAGS_ENCRYPT |TDES_FLAGS_CFB | -TDES_FLAGS_CFB8 ); +return atmel_tdes_crypt (req,TDES_FLAGS_CFB8 |TDES_FLAGS_ENCRYPT ); }static int atmel_tdes_cfb8_decrypt (struct skcipher_request *req) { -return atmel_tdes_crypt (req,TDES_FLAGS_CFB |TDES_FLAGS_CFB8 ); +return atmel_tdes_crypt (req,TDES_FLAGS_CFB8 ); }static int atmel_tdes_cfb16_encrypt (struct skcipher_request *req) { -return atmel_tdes_crypt (req,TDES_FLAGS_ENCRYPT |TDES_FLAGS_CFB | -TDES_FLAGS_CFB16 ); +return atmel_tdes_crypt (req,TDES_FLAGS_CFB16 |TDES_FLAGS_ENCRYPT ); }static int atmel_tdes_cfb16_decrypt (struct skcipher_request *req) { -return atmel_tdes_crypt (req,TDES_FLAGS_CFB |TDES_FLAGS_CFB16 ); +return atmel_tdes_crypt (req,TDES_FLAGS_CFB16 ); }static int atmel_tdes_cfb32_encrypt (struct skcipher_request *req) { -return atmel_tdes_crypt (req,TDES_FLAGS_ENCRYPT |TDES_FLAGS_CFB | -TDES_FLAGS_CFB32 ); +return atmel_tdes_crypt (req,TDES_FLAGS_CFB32 |TDES_FLAGS_ENCRYPT ); }static int atmel_tdes_cfb32_decrypt (struct skcipher_request *req) { -return atmel_tdes_crypt (req,TDES_FLAGS_CFB |TDES_FLAGS_CFB32 ); +return atmel_tdes_crypt (req,TDES_FLAGS_CFB32 ); }static int atmel_tdes_ofb_encrypt (struct skcipher_request *req) { -return atmel_tdes_crypt (req,TDES_FLAGS_ENCRYPT |TDES_FLAGS_OFB ); +return atmel_tdes_crypt (req,TDES_FLAGS_OFB |TDES_FLAGS_ENCRYPT ); }static int atmel_tdes_ofb_decrypt (struct skcipher_request *req)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 366/367 regulator fix for "regulator: core: Add regulator_is_equal() helper"
In reply to Greg Kroah-HartmanFrom: Stephen Rothwell <[email protected]>
[ Upstream commit 0468e667a5bead9c1b7ded92861b5a98d8d78745 ]
--- include/linux/regulator/consumer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/regulator/consumer.h +1 -1
@@ -596,7 +596,7 @@ regulator_bulk_set_supply_names(struct regulator_bulk_data *consumers, }static inline bool -regulator_is_equal (struct regulator *reg1,struct regulator *reg2); +regulator_is_equal (struct regulator *reg1,struct regulator *reg2) {return false; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 367/367 powerpc/kuap: Fix set direction in allow/prevent_user_access()
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit 1d8f739b07bd538f272f60bf53f10e7e6248d295 ]
__builtin_constant_p() always return 0 for pointers, so on RADIX we always end up opening both direction (by writing 0 in SPR29):
0000000000000170 <._copy_to_user>:
...
1b0: 4c 00 01 2c isync
1b4: 39 20 00 00 li r9,0
1b8: 7d 3d 03 a6 mtspr 29,r9
1bc: 4c 00 01 2c isync
1c0: 48 00 00 01 bl 1c0 <._copy_to_user+0x50>
1c0: R_PPC64_REL24 .__copy_tofrom_user
...
0000000000000220 <._copy_from_user>:
...
2ac: 4c 00 01 2c isync
2b0: 39 20 00 00 li r9,0
2b4: 7d 3d 03 a6 mtspr 29,r9
2b8: 4c 00 01 2c isync
2bc: 7f c5 f3 78 mr r5,r30 2c0: 7f 83 e3 78 mr r3,r28 2c4: 48 00 00 01 bl 2c4 <._copy_from_user+0xa4>
2c4: R_PPC64_REL24 .__copy_tofrom_user
...
Use an explicit parameter for direction selection, so that GCC is able to see it is a constant:
00000000000001b0 <._copy_to_user>:
...
1f0: 4c 00 01 2c isync
1f4: 3d 20 40 00 lis r9,16384 1f8: 79 29 07 c6 rldicr r9,r9,32,31 1fc: 7d 3d 03 a6 mtspr 29,r9 200: 4c 00 01 2c isync 204: 48 00 00 01 bl 204 <._copy_to_user+0x54> 204: R_PPC64_REL24 .__copy_tofrom_user ... 0000000000000260 <._copy_from_user>: ... 2ec: 4c 00 01 2c isync 2f0: 39 20 ff ff li r9,-1 2f4: 79 29 00 04 rldicr r9,r9,0,0 2f8: 7d 3d 03 a6 mtspr 29,r9 2fc: 4c 00 01 2c isync 300: 7f c5 f3 78 mr r5,r30 304: 7f 83 e3 78 mr r3,r28 308: 48 00 00 01 bl 308 <._copy_from_user+0xa8>
308: R_PPC64_REL24 .__copy_tofrom_user
...
--- arch/powerpc/include/asm/book3s/32/kup.h | 13 ++++++-- .../powerpc/include/asm/book3s/64/kup-radix.h | 11 +++---- arch/powerpc/include/asm/kup.h | 30 ++++++++++++++----- arch/powerpc/include/asm/nohash/32/kup-8xx.h | 4 +-- arch/powerpc/include/asm/uaccess.h | 4 +-- 5 files changed, 43 insertions(+), 19 deletions(-)
arch/powerpc/include/asm/book3s/32/kup.h +10 -3
@@ -102,11 +102,13 @@ static inline void kuap_update_sr(u32 sr, u32 addr, u32 end)isync ();/* Context sync required after mtsrin() */ } -static inline void allow_user_access (void __user *to,const void __user *from,u32 size) +static __always_inline void allow_user_access(void __user *to, const void __user *from, +u32 size,unsigned long dir) {u32 addr, end; -if (__builtin_constant_p (to) && to ==NULL ) +BUILD_BUG_ON (!__builtin_constant_p (dir)); +if (!(dir &KUAP_WRITE ))return ; addr = (__force u32 )to;
@@ -119,11 +121,16 @@ static inline void allow_user_access(void __user *to, const void __user *from, ukuap_update_sr (mfsrin (addr) & ~SR_KS , addr, end);/* Clear Ks */ } -static inline void prevent_user_access (void __user *to,const void __user *from,u32 size) +static __always_inline void prevent_user_access(void __user *to, const void __user *from, +u32 size,unsigned long dir) {u32 addr = (__force u32 )to;u32 end =min (addr + size,TASK_SIZE ); +BUILD_BUG_ON (!__builtin_constant_p (dir)); +if (!(dir &KUAP_WRITE )) +return ; +if (!addr || addr >=TASK_SIZE || !size)return ;
arch/powerpc/include/asm/book3s/64/kup-radix.h +6 -5
@@ -77,20 +77,21 @@ static inline void set_kuap(unsigned long value)isync (); } -static inline void allow_user_access (void __user *to,const void __user *from, -unsigned long size) +static __always_inline void allow_user_access(void __user *to, const void __user *from, +unsigned long size,unsigned long dir) {// This is written so we can resolve to a single case at build time -if (__builtin_constant_p (to) && to ==NULL ) +BUILD_BUG_ON (!__builtin_constant_p (dir)); +if (dir ==KUAP_READ )set_kuap (AMR_KUAP_BLOCK_WRITE ); -else if (__builtin_constant_p (from) && from ==NULL ) +else if (dir ==KUAP_WRITE )set_kuap (AMR_KUAP_BLOCK_READ );else set_kuap (0 ); }static inline void prevent_user_access (void __user *to,const void __user *from, -unsigned long size) +unsigned long size,unsigned long dir) {set_kuap (AMR_KUAP_BLOCKED ); }
arch/powerpc/include/asm/kup.h +23 -7
@@ -2,6 +2,10 @@#ifndef _ASM_POWERPC_KUP_H_#define _ASM_POWERPC_KUP_H_ +#define KUAP_READ 1 +#define KUAP_WRITE 2 +#define KUAP_READ_WRITE (KUAP_READ | KUAP_WRITE) +#ifdef CONFIG_PPC64 #include <asm/book3s/64/kup-radix.h> #endif
@@ -42,9 +46,9 @@ void setup_kuap(bool disabled);#else static inline void setup_kuap (bool disabled) { }static inline void allow_user_access (void __user *to,const void __user *from, -unsigned long size) { } +unsigned long size,unsigned long dir) { }static inline void prevent_user_access (void __user *to,const void __user *from, -unsigned long size) { } +unsigned long size,unsigned long dir) { }static inline bool bad_kuap_fault (struct pt_regs *regs,unsigned long address,bool is_write) {
@@ -54,24 +58,36 @@ bad_kuap_fault(struct pt_regs *regs, unsigned long address, bool is_write)static inline void allow_read_from_user (const void __user *from,unsigned long size) { -allow_user_access (NULL , from, size); +allow_user_access (NULL , from, size,KUAP_READ ); }static inline void allow_write_to_user (void __user *to,unsigned long size) { -allow_user_access (to,NULL , size); +allow_user_access (to,NULL , size,KUAP_WRITE ); +} + +static inline void allow_read_write_user (void __user *to,const void __user *from, +unsigned long size) +{ +allow_user_access (to, from, size,KUAP_READ_WRITE ); }static inline void prevent_read_from_user (const void __user *from,unsigned long size) { -prevent_user_access (NULL , from, size); +prevent_user_access (NULL , from, size,KUAP_READ ); }static inline void prevent_write_to_user (void __user *to,unsigned long size) { -prevent_user_access (to,NULL , size); +prevent_user_access (to,NULL , size,KUAP_WRITE ); +} + +static inline void prevent_read_write_user (void __user *to,const void __user *from, +unsigned long size) +{ +prevent_user_access (to, from, size,KUAP_READ_WRITE ); }#endif /* !__ASSEMBLY__ */ -#endif /* _ASM_POWERPC_KUP_H_ */ +#endif /* _ASM_POWERPC_KUAP_H_ */
arch/powerpc/include/asm/nohash/32/kup-8xx.h +2 -2
@@ -35,13 +35,13 @@#include <asm/reg.h> static inline void allow_user_access (void __user *to,const void __user *from, -unsigned long size) +unsigned long size,unsigned long dir) {mtspr (SPRN_MD_AP ,MD_APG_INIT ); }static inline void prevent_user_access (void __user *to,const void __user *from, -unsigned long size) +unsigned long size,unsigned long dir) {mtspr (SPRN_MD_AP ,MD_APG_KUAP ); }
arch/powerpc/include/asm/uaccess.h +2 -2
@@ -313,9 +313,9 @@ raw_copy_in_user(void __user *to, const void __user *from, unsigned long n)unsigned long ret;barrier_nospec (); -allow_user_access (to, from, n); +allow_read_write_user (to, from, n); ret =__copy_tofrom_user (to, from, n); -prevent_user_access (to, from, n); +prevent_read_write_user (to, from, n); return ret; }#endif /* __powerpc64__ */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerQuoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.3 release. There are 367 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Feb 2020 12:18:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.3-rc1.gz
-rc2 is out to fix an arm64 build issue:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.3-rc2.gz
Quoted 7 lines · Greg Kroah-Hartman
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.3 release. There are 367 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Quoted 5 lines
Responses should be made by Wed, 12 Feb 2020 12:18:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.3-rc1.gz-rc2 is out to fix an arm64 build issue:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.3-rc2.gz
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 5.5.3-rc2
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-5.5.y
git commit: d9c695759fb3d975f591901ff86e5ed0c6b99a34
git describe: v5.5.2-369-gd9c695759fb3
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-5.5-oe/build/v5.5.2-369-gd9c695759fb3
No regressions (compared to build v5.5.2)
No fixes (compared to build v5.5.2)
Ran 25348 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c
- hi6220-hikey
- i386
- juno-r2
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15
- x86
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* libhugetlbfs
* linux-log-parser
* ltp-commands-tests
* ltp-containers-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance
* kselftest
* ltp-fs-tests
* libgpiod
* ltp-cap_bounds-tests
* ltp-cpuhotplug-tests
* ltp-fcntl-locktests-tests
* ltp-ipc-tests
* ltp-open-posix-tests
* network-basic-tests
* kvm-unit-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
* ssuite
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Greg Kroah-Hartman
maintainerQuoted 12 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.3 release. There are 367 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Feb 2020 12:18:57 +0000. Anything received after that time might be too late.
Quoted 8 lines
Quoted 5 lines
Quoted 2 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.3-rc1.gz-rc2 is out to fix an arm64 build issue:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.3-rc2.gzResults from Linaro’s test farm.
No regressions on arm64, arm,x86_64, and i386.
THanks for testing this and the others and letting me know.
greg k-h
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.3 release. There are 367 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Feb 2020 12:18:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.3-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.5.y
and the diffstat can be found below.thanks,
greg k-h
All tests are passing for Tegra ...
Test results for stable-v5.5:
13 builds: 13 pass, 0 fail
22 boots: 22 pass, 0 fail
40 tests: 40 pass, 0 failLinux version: 5.5.3-rc1-g1d9d90e88c9f
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Cheers
Jon
Signature · 1 line
nvpublic
Greg Kroah-Hartman
maintainerQuoted 27 lines · Jon Hunter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.3 release. There are 367 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Feb 2020 12:18:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.3-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.5.y
and the diffstat can be found below.thanks,
greg k-h
All tests are passing for Tegra ...
Test results for stable-v5.5:
13 builds: 13 pass, 0 fail 22 boots: 22 pass, 0 fail 40 tests: 40 pass, 0 fail
Quoted 5 lines
Linux version: 5.5.3-rc1-g1d9d90e88c9f
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,tegra194-p2972-0000, tegra20-ventana, tegra210-p2371-2180, tegra210-p3450-0000, tegra30-cardhu-a04
Wonderful, thanks for testing all of these and letting me know.
greg k-h
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.3 release. There are 367 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Feb 2020 12:18:57 +0000. Anything received after that time might be too late.
For v5.5.2-369-gd9c695759fb3:
Build results:
total: 157 pass: 157 fail: 0 Qemu test results: total: 397 pass: 397 fail: 0
Guenter
Greg Kroah-Hartman
maintainerQuoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.3 release. There are 367 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Feb 2020 12:18:57 +0000. Anything received after that time might be too late.
Quoted 6 lines
For v5.5.2-369-gd9c695759fb3:
Build results:
total: 157 pass: 157 fail: 0 Qemu test results: total: 397 pass: 397 fail: 0
Great, thanks for testing and letting me know.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.3 release. There are 367 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Feb 2020 12:18:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.3-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.5.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Greg Kroah-Hartman
maintainerQuoted 15 lines · shuah
Quoted 14 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.3 release. There are 367 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Feb 2020 12:18:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.3-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.5.y
and the diffstat can be found below.
Quoted 6 lines
Quoted 4 lines
thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
Great, thanks for testing and letting me know so quickly.
greg k-h
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.3 release. There are 367 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Wed, 12 Feb 2020 12:18:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.3-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.5.y
and the diffstat can be found below.
hello,
compiled and booted 5.5.3-rc2+ . No new error according to "sudo dmesg -l err"