5.5.18-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.5.18-rc1 review
This is the start of the stable review cycle for the 5.5.18 release. There are 257 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 18 Apr 2020 13:11:20 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.18-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.5.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.5.18-rc1
Faiz Abbas <[email protected]>
mmc: sdhci: Refactor sdhci_set_timeout()
Faiz Abbas <[email protected]>
mmc: sdhci: Convert sdhci_set_timeout_irq() to non-static
Christophe Leroy <[email protected]>
powerpc/kasan: Fix kasan_remap_early_shadow_ro()
Peter Zijlstra <[email protected]>
perf/core: Remove 'struct sched_in_data'
Peter Zijlstra <[email protected]>
perf/core: Fix event cgroup tracking
Peter Zijlstra <[email protected]>
perf/core: Unify {pinned,flexible}_sched_in()
Trond Myklebust <[email protected]>
NFS: finish_automount() requires us to hold 2 refs to the mount record
Imre Deak <[email protected]>
drm/i915/icl+: Don't enable DDI IO power on a TypeC port in TBT mode
Prike Liang <[email protected]>
drm/amdgpu: fix gfx hang during suspend with video playback (v2)
Lyude Paul <[email protected]>
drm/dp_mst: Fix clearing payload state on topology disable
Sasha Levin <[email protected]>
Revert "drm/dp_mst: Remove VCPI while disabling topology mgr"
Torsten Duwe <[email protected]>
drm/bridge: analogix-anx78xx: Fix drm_dp_link helper removal
Mark Brown <[email protected]>
arm64: Always force a branch protection mode when the compiler has one
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Fix kernel panic observed on soft HBA unplug
Michael Ellerman <[email protected]>
powerpc/64: Prevent stack protection in early boot
Christophe Leroy <[email protected]>
powerpc/kprobes: Ignore traps that happened in real mode
Cédric Le Goater <[email protected]>
powerpc/xive: Fix xmon support on the PowerNV platform
Daniel Axtens <[email protected]>
powerpc/64: Setup a paca before parsing device tree etc.
Cédric Le Goater <[email protected]>
powerpc/xive: Use XIVE_BAD_IRQ instead of zero to catch non configured IPIs
Aneesh Kumar K.V <[email protected]>
powerpc/hash64/devmap: Use H_PAGE_THP_HUGE when setting up huge devmap PTE entries
Laurentiu Tudor <[email protected]>
powerpc/fsl_booke: Avoid creating duplicate tlb1 entry
Michael Ellerman <[email protected]>
powerpc/64/tm: Don't let userspace set regs->trap via sigreturn
Clement Courbet <[email protected]>
powerpc: Make setjmp/longjmp signature standard
Juergen Gross <[email protected]>
xen/blkfront: fix memory allocation flags in blkfront_setup_indirect()
Wen Yang <[email protected]>
ipmi: fix hung processes in __get_guid()
Kai-Heng Feng <[email protected]>
libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set
Simon Gander <[email protected]>
hfsplus: fix crash and filesystem corruption when deleting files
Oliver O'Halloran <[email protected]>
cpufreq: powernv: Fix use-after-free
Eric Biggers <[email protected]>
kmod: make request_module() return an error when autoloading is disabled
Paul Cercueil <[email protected]>
clk: ingenic/TCU: Fix round_rate returning error
Paul Cercueil <[email protected]>
clk: ingenic/jz4770: Exit with error if CGU init failed
Masami Hiramatsu <[email protected]>
ftrace/kprobe: Show the maxactive number on kprobe_events
Hans de Goede <[email protected]>
Input: i8042 - add Acer Aspire 5738z to nomux list
Michael Mueller <[email protected]>
s390/diag: fix display of diagnose call statistics
Sam Lunt <[email protected]>
perf tools: Support Python 3.8+ in Makefile
Changwei Ge <[email protected]>
ocfs2: no need try to truncate file beyond i_size
Eric Biggers <[email protected]>
fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()
Chris Wilson <[email protected]>
drm/i915/gt: Treat idling as a RPS downclock event
Qian Cai <[email protected]>
ext4: fix a data race at inode->i_blocks
Trond Myklebust <[email protected]>
NFS: Fix a page leak in nfs_destroy_unlinked_subrequests()
Trond Myklebust <[email protected]>
NFS: Fix use-after-free issues in nfs_pageio_add_request()
J. Bruce Fields <[email protected]>
nfsd: fsnotify on rmdir under nfsd/clients/
Hans de Goede <[email protected]>
drm/vboxvideo: Add missing remove_conflicting_pci_framebuffers call, v2
Libor Pechacek <[email protected]>
powerpc/pseries: Avoid NULL pointer dereference when drmem is unavailable
Marek Szyprowski <[email protected]>
drm/prime: fix extracting of the DMA addresses from a scatterlist
Michael Strauss <[email protected]>
drm/amd/display: Check for null fclk voltage when parsing clock table
Aaron Liu <[email protected]>
drm/amdgpu: unify fw_write_wait for new gfx9 asics
Yuxian Dai <[email protected]>
drm/amdgpu/powerplay: using the FCLK DPM table to set the MCLK
Chris Wilson <[email protected]>
drm: Remove PageReserved manipulation from drm_pci_alloc
Christian Gmeiner <[email protected]>
drm/etnaviv: rework perfmon query infrastructure
Chris Wilson <[email protected]>
drm/i915/gem: Flush all the reloc_gpu batch
Eric Auger <[email protected]>
vfio: platform: Switch to platform_get_irq_optional()
Michael Ellerman <[email protected]>
selftests/powerpc: Fix try-run when source tree is not writable
Christophe Leroy <[email protected]>
selftests/powerpc: Add tlbie_test in .gitignore
Christophe Leroy <[email protected]>
selftests/vm: fix map_hugetlb length used for testing read and write
Michal Hocko <[email protected]>
selftests: vm: drop dependencies on page flags from mlock2 tests
Fredrik Strupe <[email protected]>
arm64: armv8_deprecated: Fix undef_hook mask for thumb setend
Dave Gerlach <[email protected]>
arm64: dts: ti: k3-am65: Add clocks to dwc3 nodes
Marek Szyprowski <[email protected]>
ARM: dts: exynos: Fix polarity of the LCD SPI bus on UniversalC210 board
James Smart <[email protected]>
scsi: lpfc: Fix broken Credit Recovery after driver load
James Smart <[email protected]>
scsi: lpfc: Fix lpfc_io_buf resource leak in lpfc_get_scsi_buf_s4 error path
Stanley Chu <[email protected]>
scsi: ufs: fix Auto-Hibern8 error detection
Steffen Maier <[email protected]>
scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point
Gilad Ben-Yossef <[email protected]>
crypto: ccree - dec auth tag size from cryptlen map
Gilad Ben-Yossef <[email protected]>
crypto: ccree - only try to map auth tag if needed
Gilad Ben-Yossef <[email protected]>
crypto: ccree - protect against empty or NULL scatterlists
Andrei Botila <[email protected]>
crypto: caam - update xts sector size for large input length
Horia Geantă <[email protected]>
crypto: caam/qi2 - fix chacha20 data size error
Matthew Wilcox (Oracle) <[email protected]>
xarray: Fix early termination of xas_for_each_marked
Matthew Wilcox (Oracle) <[email protected]>
XArray: Fix xas_pause for large multi-index entries
Nikos Tsironis <[email protected]>
dm clone metadata: Fix return type of dm_clone_nr_of_hydrated_regions()
Nikos Tsironis <[email protected]>
dm clone: Add missing casts to prevent overflows and data corruption
Nikos Tsironis <[email protected]>
dm clone: Add overflow check for number of regions
Nikos Tsironis <[email protected]>
dm clone: Fix handling of partial region discards
Bob Liu <[email protected]>
dm zoned: remove duplicate nr_rnd_zones increase in dmz_init_zone()
Shetty, Harshini X (EXT-Sony Mobile) <[email protected]>
dm verity fec: fix memory leak in verity_fec_dtr
Mikulas Patocka <[email protected]>
dm integrity: fix a crash with unusually large tag size
Mikulas Patocka <[email protected]>
dm writecache: add cond_resched to avoid CPU hangs
Jakub Kicinski <[email protected]>
mm, memcg: do not high throttle allocators based on wraparound
Maxime Ripard <[email protected]>
arm64: dts: allwinner: h5: Fix PMU compatible
Scott Wood <[email protected]>
sched/core: Remove duplicate assignment in sched_tick_remote()
Maxime Ripard <[email protected]>
arm64: dts: allwinner: h6: Fix PMU compatible
Subash Abhinov Kasiviswanathan <[email protected]>
net: qualcomm: rmnet: Allow configuration updates to existing devices
Anssi Hannula <[email protected]>
tools: gpio: Fix out-of-tree build regression
Yangbo Lu <[email protected]>
mmc: sdhci-of-esdhc: fix esdhc_reset() for different controller versions
Jens Axboe <[email protected]>
io_uring: honor original task RLIMIT_FSIZE
Rosioru Dragos <[email protected]>
crypto: mxs-dcp - fix scatterlist linearization for hash
Dan Carpenter <[email protected]>
crypto: rng - Fix a refcounting bug in crypto_rng_reset()
Nikita Shubin <[email protected]>
remoteproc: Fix NULL pointer dereference in rproc_virtio_notify
Sibi Sankar <[email protected]>
remoteproc: qcom_q6v5_mss: Reload the mba region on coredump
Bjorn Andersson <[email protected]>
remoteproc: qcom_q6v5_mss: Don't reassign mpss region on shutdown
Josef Bacik <[email protected]>
btrfs: use nofs allocations for running delayed items
Robbie Ko <[email protected]>
btrfs: fix missing semaphore unlock in btrfs_sync_file
Josef Bacik <[email protected]>
btrfs: unset reloc control if we fail to recover
Filipe Manana <[email protected]>
btrfs: fix missing file extent item for hole after ranged fsync
Josef Bacik <[email protected]>
btrfs: drop block from cache on error in relocation
Josef Bacik <[email protected]>
btrfs: set update the uuid generation as soon as possible
Josef Bacik <[email protected]>
btrfs: reloc: clean dirty subvols if we fail to start a transaction
Filipe Manana <[email protected]>
Btrfs: fix crash during unmount due to race with delayed inode workers
Qu Wenruo <[email protected]>
btrfs: Don't submit any btree write bio if the fs has errors
Piotr Sroka <[email protected]>
mtd: rawnand: cadence: reinit completion before executing a new command
Piotr Sroka <[email protected]>
mtd: rawnand: cadence: change bad block marker size
Piotr Sroka <[email protected]>
mtd: rawnand: cadence: fix the calculation of the avaialble OOB size
Frieder Schrempf <[email protected]>
mtd: spinand: Do not erase the block before writing a bad block marker
Frieder Schrempf <[email protected]>
mtd: spinand: Stop using spinand->oobbuf for buffering bad block markers
Yilu Lin <[email protected]>
CIFS: Fix bug which the return value by asynchronous read is error
Steve French <[email protected]>
smb3: fix performance regression with setting mtime
Vitaly Kuznetsov <[email protected]>
KVM: VMX: fix crash cleanup when KVM wasn't used
Sean Christopherson <[email protected]>
KVM: VMX: Add a trampoline to fix VMREAD error handling
Sean Christopherson <[email protected]>
KVM: x86: Gracefully handle __vmalloc() failure during VM allocation
Sean Christopherson <[email protected]>
KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support
Sean Christopherson <[email protected]>
KVM: x86: Allocate new rmap and large page tracking when moving memslot
David Hildenbrand <[email protected]>
KVM: s390: vsie: Fix delivery of addressing exceptions
David Hildenbrand <[email protected]>
KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks
Sean Christopherson <[email protected]>
KVM: nVMX: Properly handle userspace interrupt window request
Fabiano Rosas <[email protected]>
KVM: PPC: Book3S HV: Skip kvmppc_uvmem_free if Ultravisor is not supported
Kristian Klausen <[email protected]>
platform/x86: asus-wmi: Support laptops where the first battery is named BATT
Thomas Gleixner <[email protected]>
x86/entry/32: Add missing ASM_CLAC to general_protection entry
Hans de Goede <[email protected]>
x86/tsc_msr: Make MSR derived TSC frequency more accurate
Hans de Goede <[email protected]>
x86/tsc_msr: Fix MSR_FSB_FREQ mask for Cherry Trail devices
Hans de Goede <[email protected]>
x86/tsc_msr: Use named struct initializers
Eric W. Biederman <[email protected]>
signal: Extend exec_id to 64bits
Remi Pommarel <[email protected]>
ath9k: Handle txpower changes even when TPC is disabled
Neeraj Upadhyay <[email protected]>
PM: sleep: wakeup: Skip wakeup_source_sysfs_remove() if device is not there
Ulf Hansson <[email protected]>
PM / Domains: Allow no domain-idle-states DT property in genpd when parsing
Gustavo A. R. Silva <[email protected]>
MIPS: OCTEON: irq: Fix potential NULL pointer dereference
Huacai Chen <[email protected]>
MIPS/tlbex: Fix LDDIR usage in setup_pw() for Loongson-3
Vasily Averin <[email protected]>
pstore: pstore_ftrace_seq_next should increase position index
Jens Axboe <[email protected]>
io_uring: remove bogus RLIMIT_NOFILE check in file registration
Sungbo Eo <[email protected]>
irqchip/versatile-fpga: Apply clear-mask earlier
Thomas Gleixner <[email protected]>
genirq/debugfs: Add missing sanity checks to interrupt injection
Thomas Gleixner <[email protected]>
cpu/hotplug: Ignore pm_wakeup_pending() for disable_nonboot_cpus()
Paul E. McKenney <[email protected]>
rcu: Make rcu_barrier() account for offline no-CBs CPUs
Ludovic Barre <[email protected]>
mmc: mmci_sdmmc: Fix clear busyd0end irq flag
Yang Xu <[email protected]>
KEYS: reaching the keys quotas correctly
Vasily Averin <[email protected]>
tpm: tpm2_bios_measurements_next should increase position index
Vasily Averin <[email protected]>
tpm: tpm1_bios_measurements_next should increase position index
Matthew Garrett <[email protected]>
tpm: Don't make log failures fatal
Vincent Guittot <[email protected]>
sched/fair: Fix enqueue_task_fair warning
Gao Xiang <[email protected]>
erofs: correct the remaining shrink objects
Kishon Vijay Abraham I <[email protected]>
PCI: endpoint: Fix for concurrent memory allocation in OB address region
Bjorn Andersson <[email protected]>
PCI: qcom: Fix the fixup of PCI_VENDOR_ID_QCOM
Sean V Kelley <[email protected]>
PCI: Add boot interrupt quirk mechanism for Xeon chipsets
Yicong Yang <[email protected]>
PCI/ASPM: Clear the correct bits when enabling L1 substates
Lukas Wunner <[email protected]>
PCI: pciehp: Fix indefinite wait on sysfs requests
Tom Lendacky <[email protected]>
efi/x86: Add TPM related EFI tables to unencrypted mapping checks
James Smart <[email protected]>
nvme-fc: Revert "add module to ops template to allow module references"
Sagi Grimberg <[email protected]>
nvmet-tcp: fix maxh2cdata icresp parameter
Martin Blumenstingl <[email protected]>
thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
Rafael J. Wysocki <[email protected]>
ACPI: PM: s2idle: Refine active GPEs check
Rafael J. Wysocki <[email protected]>
ACPICA: Allow acpi_any_gpe_status_set() to skip one GPE
Jan Engelhardt <[email protected]>
acpi/x86: ignore unspecified bit positions in the ACPI global lock field
Rafael J. Wysocki <[email protected]>
ACPI: EC: Avoid printing confusing messages in acpi_ec_setup()
Sven Schnelle <[email protected]>
seccomp: Add missing compat_ioctl for notify
Benoit Parrot <[email protected]>
media: ti-vpe: cal: fix a kernel oops when unloading module
Benoit Parrot <[email protected]>
media: ti-vpe: cal: fix disable_irqs to only the intended target
Andrzej Pietrasiewicz <[email protected]>
media: hantro: Read be32 words starting at every fourth byte
Stanimir Varbanov <[email protected]>
media: venus: firmware: Ignore secure call error on first resume
Stanimir Varbanov <[email protected]>
media: venus: cache vb payload to be used by clock scaling
Takashi Iwai <[email protected]>
ALSA: hda/realtek - Add quirk for MSI GL63
Hans de Goede <[email protected]>
ALSA: hda/realtek - Add quirk for Lenovo Carbon X1 8th gen
Thomas Hebb <[email protected]>
ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups
Thomas Hebb <[email protected]>
ALSA: hda/realtek - Set principled PC Beep configuration for ALC256
Thomas Hebb <[email protected]>
ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256
Hui Wang <[email protected]>
ALSA: hda/realtek - a fake key event is triggered by running shutup
Kai-Heng Feng <[email protected]>
ALSA: hda/realtek: Enable mute LED on an HP system
Takashi Iwai <[email protected]>
ALSA: pcm: oss: Fix regression by buffer overflow fix
Takashi Iwai <[email protected]>
ALSA: ice1724: Fix invalid access for enumerated ctl items
Takashi Iwai <[email protected]>
ALSA: hda: Fix potential access overflow in beep helper
Takashi Iwai <[email protected]>
ALSA: hda: Add driver blacklist
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add mixer workaround for TRX40 and co
Thinh Nguyen <[email protected]>
usb: gadget: composite: Inform controller driver of self-powered
Sriharsha Allenki <[email protected]>
usb: gadget: f_fs: Fix use after free issue as part of queue failure
이경택 <[email protected]>
ASoC: topology: use name_prefix for new kcontrol
이경택 <[email protected]>
ASoC: dpcm: allow start or stop during pause for backend
이경택 <[email protected]>
ASoC: dapm: connect virtual mux with default value
이경택 <[email protected]>
ASoC: fix regwmask
Josef Bacik <[email protected]>
btrfs: track reloc roots based on their commit root bytenr
Josef Bacik <[email protected]>
btrfs: restart relocate_tree_blocks properly
Josef Bacik <[email protected]>
btrfs: remove a BUG_ON() from merge_reloc_roots()
Qu Wenruo <[email protected]>
btrfs: qgroup: ensure qgroup_rescan_running is only set when the worker is at least queued
Zhiqiang Liu <[email protected]>
block, bfq: fix use-after-free in bfq_idle_slice_timer_body
Boqun Feng <[email protected]>
locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
Vladimir Oltean <[email protected]>
spi: spi-fsl-dspi: Replace interruptible wait queue with a simple completion
Junyong Sun <[email protected]>
firmware: fix a double abort case with fw_load_sysfs_fallback
Guoqing Jiang <[email protected]>
md: check arrays is suspended in mddev_detach before call quiesce operations
Marc Zyngier <[email protected]>
irqchip/gic-v4: Provide irq_retrigger to avoid circular locking dependency
Neil Armstrong <[email protected]>
usb: dwc3: core: add support for disabling SS instances in park mode
Dongchun Zhu <[email protected]>
media: i2c: ov5695: Fix power on and off sequences
Hsin-Yi Wang <[email protected]>
media: mtk-vpu: avoid unaligned access to DTCM buffer.
Alexey Dobriyan <[email protected]>
block, zoned: fix integer overflow with BLKRESETZONE et al
Sahitya Tummala <[email protected]>
block: Fix use-after-free issue accessing struct io_cq
Alexander Sverdlin <[email protected]>
genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy()
Ard Biesheuvel <[email protected]>
efi/x86: Ignore the memory attributes table on i386
Arvind Sankar <[email protected]>
x86/boot: Use unsigned comparison for addresses
Peng Fan <[email protected]>
cpufreq: imx6q: fix error handling
Bob Peterson <[email protected]>
gfs2: Don't demote a glock until its revokes are written
Bob Peterson <[email protected]>
gfs2: Do log_flush in gfs2_ail_empty_gl even if ail list is empty
chenqiwu <[email protected]>
pstore/platform: fix potential mem leak if pstore_init_fs failed
John Garry <[email protected]>
libata: Remove extra scsi_host_put() in ata_scsi_add_hosts()
Matt Ranostay <[email protected]>
media: i2c: video-i2c: fix build errors due to 'imply hwmon'
Paolo Valente <[email protected]>
block, bfq: move forward the getting of an extra ref in bfq_bfqq_move
Logan Gunthorpe <[email protected]>
PCI/switchtec: Fix init_completion race condition with poll_wait()
Andy Lutomirski <[email protected]>
selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault
Tao Zhou <[email protected]>
sched/fair: Fix condition of avg_load calculation
Michael Wang <[email protected]>
sched: Avoid scale real weight down to zero
Michael Tretter <[email protected]>
media: allegro: fix type of gop_length in channel_create message
Ahmed S. Darwish <[email protected]>
time/sched_clock: Expire timer in hardirq context
Sungbo Eo <[email protected]>
irqchip/versatile-fpga: Handle chained IRQs properly
Vladimir Oltean <[email protected]>
spi: spi-fsl-dspi: Avoid NULL pointer in dspi_slave_abort for non-DMA mode
Taehee Yoo <[email protected]>
debugfs: Check module state before warning in {full/open}_proxy_open()
Konstantin Khlebnikov <[email protected]>
block: keep bdi->io_pages in sync with max_sectors_kb for stacked devices
Thomas Hellstrom <[email protected]>
dma-mapping: Fix dma_pgprot() for unencrypted coherent pages
Thomas Hellstrom <[email protected]>
x86: Don't let pgprot_modify() change the page encryption bit
Rafael J. Wysocki <[email protected]>
ACPI: EC: Do not clear boot_ec_is_ecdt in acpi_ec_add()
Mathias Nyman <[email protected]>
xhci: bail out early if driver can't accress host in resume
Laurent Pinchart <[email protected]>
media: imx: imx7-media-csi: Fix video field handling
Laurent Pinchart <[email protected]>
media: imx: imx7_mipi_csis: Power off the source when stopping streaming
Alexey Dobriyan <[email protected]>
null_blk: fix spurious IO errors after failed past-wp access
Bart Van Assche <[email protected]>
null_blk: Handle null_add_dev() failures properly
Bart Van Assche <[email protected]>
blk-mq: Fix a recently introduced regression in blk_mq_realloc_hw_ctxs()
Bart Van Assche <[email protected]>
null_blk: Fix the null_add_dev() error path
Chris Wilson <[email protected]>
sched/vtime: Prevent unstable evaluation of WARN(vtime->state)
James Morse <[email protected]>
firmware: arm_sdei: fix double-lock on hibernate with shared events
Stephan Gerhold <[email protected]>
media: venus: hfi_parser: Ignore HEVC encoding for V1
Dafna Hirschfeld <[email protected]>
media: vimc: streamer: fix memory leak in vimc subdevs if kthread_run fails
Ajay Singh <[email protected]>
staging: wilc1000: avoid double unlocking of 'wilc->hif_cs' mutex
Ajay Gupta <[email protected]>
usb: ucsi: ccg: disable runtime pm during fw flashing
Robert Richter <[email protected]>
EDAC/mc: Report "unknown memory" on too many DIMM labels found
Christoph Niedermaier <[email protected]>
cpufreq: imx6q: Fixes unwanted cpu overclocking on i.MX6ULL
Mohammad Rasim <[email protected]>
media: rc: add keymap for Videostrong KII Pro
Chris Packham <[email protected]>
i2c: pca-platform: Use platform_irq_get_optional
Alain Volmat <[email protected]>
i2c: st: fix missing struct parameter description
Xu Wang <[email protected]>
qlcnic: Fix bad kzalloc null test
Ilan Peer <[email protected]>
cfg80211: Do not warn on same channel at the end of CSA
Yintian Tao <[email protected]>
drm/scheduler: fix rare NULL ptr race
Raju Rangoju <[email protected]>
cxgb4/ptp: pass the sign of offset delta in FW CMD
Alan Maguire <[email protected]>
selftests/net: add definition for SOL_DCCP to fix compilation errors for old libc
Luo bin <[email protected]>
hinic: fix wrong value of MIN_SKB_LEN
Luo bin <[email protected]>
hinic: fix wrong para of wait_for_completion_timeout
Luo bin <[email protected]>
hinic: fix out-of-order excution in arm cpu
Luo bin <[email protected]>
hinic: fix the bug of clearing event queue
Luo bin <[email protected]>
hinic: fix a bug of waitting for IO stopped
Greentime Hu <[email protected]>
riscv: uaccess should be used in nommu mode
Tony Lindgren <[email protected]>
ARM: dts: omap4-droid4: Fix lost touchscreen interrupts
Zheng Wei <[email protected]>
net: vxge: fix wrong __VA_ARGS__ usage
Markus Fuchs <[email protected]>
net: stmmac: platform: Fix misleading interrupt error msg
David Howells <[email protected]>
rxrpc: Fix call interruptibility handling
David Howells <[email protected]>
rxrpc: Abstract out the calculation of whether there's Tx space
Grigore Popescu <[email protected]>
soc: fsl: dpio: register dpio irq handlers after dpio create
Nick Reitemeyer <[email protected]>
Input: tm2-touchkey - add support for Coreriver TC360 variant
Ilan Peer <[email protected]>
iwlwifi: mvm: Fix rate scale NSS configuration
Avraham Stern <[email protected]>
iwlwifi: mvm: take the required lock when clearing time event data
Yonghong Song <[email protected]>
bpf: Fix deadlock with rq_lock in bpf_send_signal()
Tony Lindgren <[email protected]>
ARM: dts: Fix dm814x Ethernet by changing to use rgmii-id mode
Ondrej Jirman <[email protected]>
bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
Ondrej Jirman <[email protected]>
ARM: dts: sun8i-a83t-tbs-a711: HM5065 doesn't like such a high voltage
-------------
Diffstat:
Documentation/sound/hd-audio/index.rst | 1 + Documentation/sound/hd-audio/models.rst | 2 - Documentation/sound/hd-audio/realtek-pc-beep.rst | 129 ++++++++++++ Makefile | 4 +- arch/arm/boot/dts/dm8148-evm.dts | 4 +- arch/arm/boot/dts/dm8148-t410.dts | 4 +- arch/arm/boot/dts/dra62x-j5eco-evm.dts | 4 +- arch/arm/boot/dts/exynos4210-universal_c210.dts | 4 +- arch/arm/boot/dts/motorola-mapphone-common.dtsi | 2 +- arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts | 4 +- arch/arm64/Makefile | 4 + arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi | 3 +- arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 3 +- arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 2 + arch/arm64/kernel/armv8_deprecated.c | 2 +- arch/mips/cavium-octeon/octeon-irq.c | 3 + arch/mips/mm/tlbex.c | 5 +- arch/powerpc/include/asm/book3s/64/hash-4k.h | 6 + arch/powerpc/include/asm/book3s/64/hash-64k.h | 8 +- arch/powerpc/include/asm/book3s/64/pgtable.h | 4 +- arch/powerpc/include/asm/book3s/64/radix.h | 5 + arch/powerpc/include/asm/drmem.h | 4 +- arch/powerpc/include/asm/setjmp.h | 6 +- arch/powerpc/kernel/dt_cpu_ftrs.c | 1 - arch/powerpc/kernel/kprobes.c | 3 + arch/powerpc/kernel/paca.c | 14 +- arch/powerpc/kernel/setup.h | 6 + arch/powerpc/kernel/setup_64.c | 32 ++- arch/powerpc/kernel/signal_64.c | 4 +- arch/powerpc/kexec/Makefile | 3 - arch/powerpc/kvm/book3s_hv_uvmem.c | 3 + arch/powerpc/mm/kasan/kasan_init_32.c | 2 +- arch/powerpc/mm/nohash/tlb_low.S | 12 +- arch/powerpc/platforms/pseries/hotplug-memory.c | 8 +- arch/powerpc/sysdev/xive/common.c | 16 +- arch/powerpc/sysdev/xive/native.c | 4 +- arch/powerpc/sysdev/xive/spapr.c | 4 +- arch/powerpc/sysdev/xive/xive-internal.h | 7 + arch/powerpc/xmon/Makefile | 3 - arch/riscv/Kconfig | 1 - arch/riscv/include/asm/uaccess.h | 36 ++-- arch/riscv/lib/Makefile | 2 +- arch/s390/kernel/diag.c | 2 +- arch/s390/kvm/vsie.c | 1 + arch/s390/mm/gmap.c | 6 +- arch/x86/boot/compressed/head_32.S | 2 +- arch/x86/boot/compressed/head_64.S | 4 +- arch/x86/entry/entry_32.S | 1 + arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/include/asm/pgtable.h | 7 +- arch/x86/include/asm/pgtable_types.h | 2 +- arch/x86/kernel/acpi/boot.c | 2 +- arch/x86/kernel/tsc_msr.c | 128 +++++++++-- arch/x86/kvm/svm.c | 4 + arch/x86/kvm/vmx/nested.c | 18 +- arch/x86/kvm/vmx/ops.h | 28 ++- arch/x86/kvm/vmx/vmenter.S | 58 +++++ arch/x86/kvm/vmx/vmx.c | 92 +++----- arch/x86/kvm/x86.c | 21 +- arch/x86/platform/efi/efi.c | 2 + block/bfq-cgroup.c | 14 +- block/bfq-iosched.c | 16 +- block/blk-ioc.c | 7 + block/blk-mq.c | 1 - block/blk-settings.c | 3 + block/blk-zoned.c | 2 +- crypto/rng.c | 8 +- drivers/acpi/acpica/achware.h | 2 +- drivers/acpi/acpica/evxfgpe.c | 17 +- drivers/acpi/acpica/hwgpe.c | 47 ++++- drivers/acpi/ec.c | 26 ++- drivers/acpi/internal.h | 1 + drivers/acpi/sleep.c | 19 +- drivers/ata/libata-pmp.c | 1 + drivers/ata/libata-scsi.c | 9 +- drivers/base/firmware_loader/fallback.c | 2 +- drivers/base/power/domain.c | 2 +- drivers/base/power/wakeup.c | 4 +- drivers/block/null_blk_main.c | 10 +- drivers/block/xen-blkfront.c | 17 +- drivers/bus/sunxi-rsb.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 4 +- drivers/char/tpm/eventlog/common.c | 12 +- drivers/char/tpm/eventlog/tpm1.c | 2 +- drivers/char/tpm/eventlog/tpm2.c | 2 +- drivers/char/tpm/tpm-chip.c | 4 +- drivers/char/tpm/tpm.h | 2 +- drivers/clk/ingenic/jz4770-cgu.c | 4 +- drivers/clk/ingenic/tcu.c | 2 +- drivers/cpufreq/imx6q-cpufreq.c | 12 +- drivers/cpufreq/powernv-cpufreq.c | 6 + drivers/crypto/caam/caamalg_desc.c | 30 ++- drivers/crypto/ccree/cc_buffer_mgr.c | 76 ++++--- drivers/crypto/ccree/cc_buffer_mgr.h | 1 + drivers/crypto/mxs-dcp.c | 58 +++-- drivers/edac/edac_mc.c | 21 +- drivers/firmware/arm_sdei.c | 32 ++- drivers/firmware/efi/efi.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 + .../drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 2 +- drivers/gpu/drm/amd/powerplay/renoir_ppt.c | 6 + drivers/gpu/drm/amd/powerplay/renoir_ppt.h | 2 +- drivers/gpu/drm/bridge/analogix-anx78xx.c | 5 +- drivers/gpu/drm/drm_dp_mst_topology.c | 19 +- drivers/gpu/drm/drm_pci.c | 23 +- drivers/gpu/drm/drm_prime.c | 37 ++-- drivers/gpu/drm/etnaviv/etnaviv_perfmon.c | 59 +++++- drivers/gpu/drm/i915/display/intel_ddi.c | 6 +- drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 8 +- drivers/gpu/drm/i915/gt/intel_rps.c | 13 ++ drivers/gpu/drm/scheduler/sched_main.c | 2 + drivers/gpu/drm/vboxvideo/vbox_drv.c | 4 + drivers/i2c/busses/i2c-pca-platform.c | 2 +- drivers/i2c/busses/i2c-st.c | 1 + drivers/input/keyboard/tm2-touchkey.c | 11 + drivers/input/serio/i8042-x86ia64io.h | 11 + drivers/irqchip/irq-gic-v3-its.c | 6 + drivers/irqchip/irq-versatile-fpga.c | 18 +- drivers/md/dm-clone-metadata.c | 15 +- drivers/md/dm-clone-metadata.h | 2 +- drivers/md/dm-clone-target.c | 66 ++++-- drivers/md/dm-integrity.c | 4 +- drivers/md/dm-verity-fec.c | 1 + drivers/md/dm-writecache.c | 6 +- drivers/md/dm-zoned-metadata.c | 1 - drivers/md/md.c | 2 +- drivers/media/i2c/ov5695.c | 49 +++-- drivers/media/i2c/video-i2c.c | 2 +- drivers/media/platform/mtk-mdp/mtk_mdp_vpu.c | 9 +- drivers/media/platform/mtk-vcodec/vdec_vpu_if.c | 6 +- drivers/media/platform/mtk-vcodec/venc_vpu_if.c | 12 +- drivers/media/platform/mtk-vpu/mtk_vpu.c | 45 ++-- drivers/media/platform/mtk-vpu/mtk_vpu.h | 2 +- drivers/media/platform/qcom/venus/core.h | 1 + drivers/media/platform/qcom/venus/firmware.c | 10 +- drivers/media/platform/qcom/venus/helpers.c | 20 +- drivers/media/platform/qcom/venus/hfi_parser.c | 1 + drivers/media/platform/ti-vpe/cal.c | 29 +-- drivers/media/platform/vimc/vimc-streamer.c | 9 +- drivers/media/rc/keymaps/Makefile | 1 + drivers/media/rc/keymaps/rc-videostrong-kii-pro.c | 83 ++++++++ drivers/mmc/host/mmci_stm32_sdmmc.c | 4 +- drivers/mmc/host/sdhci-of-esdhc.c | 43 +++- drivers/mmc/host/sdhci.c | 41 ++-- drivers/mmc/host/sdhci.h | 2 + drivers/mtd/nand/raw/cadence-nand-controller.c | 13 +- drivers/mtd/nand/spi/core.c | 17 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c | 3 + drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 5 +- drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c | 51 +---- drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c | 26 ++- drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 5 +- drivers/net/ethernet/huawei/hinic/hinic_rx.c | 3 + drivers/net/ethernet/huawei/hinic/hinic_tx.c | 4 +- drivers/net/ethernet/neterion/vxge/vxge-config.h | 2 +- drivers/net/ethernet/neterion/vxge/vxge-main.h | 14 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 2 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 31 +-- .../net/ethernet/stmicro/stmmac/stmmac_platform.c | 14 +- drivers/net/wireless/ath/ath9k/main.c | 3 + drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 29 ++- .../net/wireless/intel/iwlwifi/mvm/time-event.c | 4 + drivers/nvme/host/fc.c | 14 +- drivers/nvme/target/fcloop.c | 1 - drivers/nvme/target/tcp.c | 2 +- drivers/pci/controller/dwc/pcie-qcom.c | 8 +- drivers/pci/endpoint/pci-epc-mem.c | 10 +- drivers/pci/hotplug/pciehp_hpc.c | 14 +- drivers/pci/pcie/aspm.c | 4 +- drivers/pci/quirks.c | 80 ++++++- drivers/pci/switch/switchtec.c | 2 +- drivers/platform/x86/asus-wmi.c | 5 +- drivers/remoteproc/qcom_q6v5_mss.c | 54 +++-- drivers/remoteproc/remoteproc_virtio.c | 7 + drivers/s390/scsi/zfcp_erp.c | 2 +- drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_hbadisc.c | 59 ++++-- drivers/scsi/lpfc/lpfc_nvme.c | 2 - drivers/scsi/lpfc/lpfc_scsi.c | 4 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 8 +- drivers/scsi/qla2xxx/qla_nvme.c | 1 - drivers/scsi/ufs/ufshcd.c | 3 +- drivers/scsi/ufs/ufshcd.h | 6 + drivers/soc/fsl/dpio/dpio-driver.c | 8 +- drivers/spi/spi-fsl-dspi.c | 25 +-- drivers/staging/media/allegro-dvt/allegro-core.c | 5 +- drivers/staging/media/hantro/hantro_h1_jpeg_enc.c | 9 +- .../staging/media/hantro/rk3399_vpu_hw_jpeg_enc.c | 9 +- drivers/staging/media/imx/imx7-media-csi.c | 4 + drivers/staging/media/imx/imx7-mipi-csis.c | 2 +- drivers/staging/wilc1000/wlan.c | 1 - drivers/usb/dwc3/core.c | 5 + drivers/usb/dwc3/core.h | 4 + drivers/usb/gadget/composite.c | 9 + drivers/usb/gadget/function/f_fs.c | 1 + drivers/usb/host/xhci.c | 4 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 + drivers/vfio/platform/vfio_platform.c | 2 +- fs/afs/rxrpc.c | 3 +- fs/btrfs/async-thread.c | 8 + fs/btrfs/async-thread.h | 1 + fs/btrfs/delayed-inode.c | 13 ++ fs/btrfs/disk-io.c | 27 ++- fs/btrfs/extent_io.c | 35 +++- fs/btrfs/file.c | 11 + fs/btrfs/qgroup.c | 11 +- fs/btrfs/relocation.c | 62 +++--- fs/cifs/file.c | 2 +- fs/cifs/inode.c | 23 +- fs/debugfs/file.c | 18 +- fs/erofs/utils.c | 2 +- fs/exec.c | 2 +- fs/ext4/inode.c | 2 +- fs/filesystems.c | 4 +- fs/gfs2/glock.c | 3 + fs/gfs2/glops.c | 27 ++- fs/gfs2/log.c | 2 +- fs/gfs2/log.h | 1 + fs/hfsplus/attributes.c | 4 + fs/io_uring.c | 17 +- fs/nfs/namespace.c | 12 +- fs/nfs/pagelist.c | 48 ++--- fs/nfs/write.c | 1 + fs/nfsd/nfsctl.c | 1 + fs/ocfs2/alloc.c | 4 + fs/pstore/inode.c | 5 +- fs/pstore/platform.c | 4 +- include/acpi/acpixf.h | 2 +- include/linux/cpu.h | 12 +- include/linux/devfreq_cooling.h | 2 +- include/linux/iocontext.h | 1 + include/linux/nvme-fc-driver.h | 4 - include/linux/pci-epc.h | 3 + include/linux/sched.h | 4 +- include/linux/xarray.h | 6 +- include/media/rc-map.h | 1 + include/net/af_rxrpc.h | 8 +- include/trace/events/rcu.h | 1 + kernel/cpu.c | 4 +- kernel/dma/mapping.c | 2 + kernel/events/core.c | 150 ++++++------- kernel/irq/debugfs.c | 11 +- kernel/irq/irqdomain.c | 10 +- kernel/kmod.c | 4 +- kernel/locking/lockdep.c | 4 + kernel/rcu/tree.c | 36 ++-- kernel/sched/core.c | 1 - kernel/sched/cputime.c | 41 ++-- kernel/sched/fair.c | 29 ++- kernel/sched/sched.h | 8 +- kernel/seccomp.c | 1 + kernel/signal.c | 2 +- kernel/time/sched_clock.c | 9 +- kernel/trace/bpf_trace.c | 2 +- kernel/trace/trace_kprobe.c | 2 + lib/test_xarray.c | 37 ++++ lib/xarray.c | 4 +- mm/memcontrol.c | 3 + net/rxrpc/af_rxrpc.c | 4 +- net/rxrpc/ar-internal.h | 4 +- net/rxrpc/call_object.c | 3 +- net/rxrpc/conn_client.c | 13 +- net/rxrpc/sendmsg.c | 71 +++++-- net/wireless/scan.c | 6 +- security/keys/key.c | 2 +- security/keys/keyctl.c | 4 +- sound/core/oss/pcm_plugin.c | 32 ++- sound/pci/hda/hda_beep.c | 6 +- sound/pci/hda/hda_intel.c | 16 ++ sound/pci/hda/patch_realtek.c | 233 ++++++++++++--------- sound/pci/ice1712/prodigy_hifi.c | 4 +- sound/soc/soc-dapm.c | 8 +- sound/soc/soc-ops.c | 4 +- sound/soc/soc-pcm.c | 6 +- sound/soc/soc-topology.c | 2 +- sound/usb/mixer_maps.c | 28 +++ tools/gpio/Makefile | 2 +- tools/perf/Makefile.config | 11 +- tools/testing/radix-tree/Makefile | 4 +- tools/testing/radix-tree/iteration_check_2.c | 87 ++++++++ tools/testing/radix-tree/main.c | 1 + tools/testing/radix-tree/test.h | 1 + tools/testing/selftests/net/reuseport_addr_any.c | 4 + tools/testing/selftests/powerpc/mm/.gitignore | 1 + tools/testing/selftests/powerpc/pmu/ebb/Makefile | 1 + tools/testing/selftests/vm/map_hugetlb.c | 14 +- tools/testing/selftests/vm/mlock2-tests.c | 233 ++++----------------- tools/testing/selftests/x86/ptrace_syscall.c | 8 +- 289 files changed, 2710 insertions(+), 1405 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/257 ARM: dts: sun8i-a83t-tbs-a711: HM5065 doesnt like such a high voltage
From: Ondrej Jirman <[email protected]>
[ Upstream commit a40550952c000667b20082d58077bc647da6c890 ]
Lowering the voltage solves the quick image degradation over time (minutes), that was probably caused by overheating.
--- arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts +2 -2
@@ -374,8 +374,8 @@ }; ®_dldo3 { - regulator-min-microvolt = <2800000>; - regulator-max-microvolt = <2800000>; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; regulator-name = "vdd-csi"; };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 2/257 bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
In reply to Greg Kroah-HartmanFrom: Ondrej Jirman <[email protected]>
[ Upstream commit a43ab30dcd4a1abcdd0d2461bf1cf7c0817f6cd3 ]
When doing a 16-bit read that returns data in the MSB byte, the RSB_DATA register will keep the MSB byte unchanged when doing the following 8-bit read. sunxi_rsb_read() will then return a result that contains high byte from 16-bit read mixed with the 8-bit result.
The consequence is that after this happens the PMIC's regmap will look like this: (0x33 is the high byte from the 16-bit read)
% cat /sys/kernel/debug/regmap/sunxi-rsb-3a3/registers 00: 33
01: 33
02: 33
03: 33
04: 33
05: 33
06: 33
07: 33
08: 33
09: 33
0a: 33
0b: 33
0c: 33
0d: 33
0e: 33
[snip]
Fix this by masking the result of the read with the correct mask based on the size of the read. There are no 16-bit users in the mainline kernel, so this doesn't need to get into the stable tree.
--- drivers/bus/sunxi-rsb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bus/sunxi-rsb.c +1 -1
@@ -345,7 +345,7 @@ static int sunxi_rsb_read(struct sunxi_rsb *rsb, u8 rtaddr, u8 addr,if (ret) goto unlock; - *buf =readl (rsb->regs +RSB_DATA ); + *buf =readl (rsb->regs +RSB_DATA ) &GENMASK (len *8 -1 ,0 ); unlock:mutex_unlock (&rsb->lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 3/257 ARM: dts: Fix dm814x Ethernet by changing to use rgmii-id mode
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit b46b2b7ba6e104d265ab705914859ec0db7a98c5 ]
Commit cd28d1d6e52e ("net: phy: at803x: Disable phy delay for RGMII mode") caused a regression for dm814x boards where NFSroot would no longer work.
Let's fix the issue by configuring "rgmii-id" mode as internal delays are needed that is no longer the case with "rgmii" mode.
--- arch/arm/boot/dts/dm8148-evm.dts | 4 ++-- arch/arm/boot/dts/dm8148-t410.dts | 4 ++-- arch/arm/boot/dts/dra62x-j5eco-evm.dts | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-)
arch/arm/boot/dts/dm8148-evm.dts +2 -2
@@ -24,12 +24,12 @@ &cpsw_emac0 { phy-handle = <ðphy0>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; }; &cpsw_emac1 { phy-handle = <ðphy1>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; }; &davinci_mdio {
arch/arm/boot/dts/dm8148-t410.dts +2 -2
@@ -33,12 +33,12 @@ &cpsw_emac0 { phy-handle = <ðphy0>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; }; &cpsw_emac1 { phy-handle = <ðphy1>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; }; &davinci_mdio {
arch/arm/boot/dts/dra62x-j5eco-evm.dts +2 -2
@@ -24,12 +24,12 @@ &cpsw_emac0 { phy-handle = <ðphy0>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; }; &cpsw_emac1 { phy-handle = <ðphy1>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; }; &davinci_mdio {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 4/257 bpf: Fix deadlock with rq_lock in bpf_send_signal()
In reply to Greg Kroah-HartmanFrom: Yonghong Song <[email protected]>
[ Upstream commit 1bc7896e9ef44fd77858b3ef0b8a6840be3a4494 ]
When experimenting with bpf_send_signal() helper in our production environment (5.2 based), we experienced a deadlock in NMI mode:
#5 [ffffc9002219f770] queued_spin_lock_slowpath at ffffffff8110be24 #6 [ffffc9002219f770] _raw_spin_lock_irqsave at ffffffff81a43012 #7 [ffffc9002219f780] try_to_wake_up at ffffffff810e7ecd
#8 [ffffc9002219f7e0] signal_wake_up_state at ffffffff810c7b55 #9 [ffffc9002219f7f0] __send_signal at ffffffff810c8602
#10 [ffffc9002219f830] do_send_sig_info at ffffffff810ca31a #11 [ffffc9002219f868] bpf_send_signal at ffffffff8119d227 #12 [ffffc9002219f988] bpf_overflow_handler at ffffffff811d4140 #13 [ffffc9002219f9e0] __perf_event_overflow at ffffffff811d68cf #14 [ffffc9002219fa10] perf_swevent_overflow at ffffffff811d6a09 #15 [ffffc9002219fa38] ___perf_sw_event at ffffffff811e0f47 #16 [ffffc9002219fc30] __schedule at ffffffff81a3e04d
#17 [ffffc9002219fc90] schedule at ffffffff81a3e219
#18 [ffffc9002219fca0] futex_wait_queue_me at ffffffff8113d1b9 #19 [ffffc9002219fcd8] futex_wait at ffffffff8113e529
#20 [ffffc9002219fdf0] do_futex at ffffffff8113ffbc
#21 [ffffc9002219fec0] __x64_sys_futex at ffffffff81140d1c #22 [ffffc9002219ff38] do_syscall_64 at ffffffff81002602
#23 [ffffc9002219ff50] entry_SYSCALL_64_after_hwframe at ffffffff81c00068
The above call stack is actually very similar to an issue reported by Commit eac9153f2b58 ("bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack()") by Song Liu. The only difference is bpf_send_signal() helper instead of bpf_get_stack() helper.
The above deadlock is triggered with a perf_sw_event.
Similar to Commit eac9153f2b58, the below almost identical reproducer used tracepoint point sched/sched_switch so the issue can be easily caught.
/* stress_test.c */
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <pthread.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#define THREAD_COUNT 1000
char *filename;
void *worker(void *p)
{
void *ptr;
int fd;
char *pptr; fd = open(filename, O_RDONLY);
if (fd < 0)
return NULL;
while (1) {
struct timespec ts = {0, 1000 + rand() % 2000};
ptr = mmap(NULL, 4096 * 64, PROT_READ, MAP_PRIVATE, fd, 0);
usleep(1);
if (ptr == MAP_FAILED) {
printf("failed to mmap\n");
break;
}
munmap(ptr, 4096 * 64);
usleep(1);
pptr = malloc(1);
usleep(1);
pptr[0] = 1;
usleep(1);
free(pptr);
usleep(1);
nanosleep(&ts, NULL);
}
close(fd);
return NULL;}
int main(int argc, char *argv[])
{
void *ptr;
int i;
pthread_t threads[THREAD_COUNT]; if (argc < 2)
return 0;
filename = argv[1];
for (i = 0; i < THREAD_COUNT; i++) {
if (pthread_create(threads + i, NULL, worker, NULL)) {
fprintf(stderr, "Error creating thread\n");
return 0;
}
}
for (i = 0; i < THREAD_COUNT; i++)
pthread_join(threads[i], NULL);
return 0; }
and the following command:
1. run stress_test /bin/ls in one windown
2. hack bcc trace.py with the following change:
# --- a/tools/trace.py
# +++ b/tools/trace.py
@@ -513,6 +513,7 @@ BPF_PERF_OUTPUT(%s);
__data.tgid = __tgid;
__data.pid = __pid;
bpf_get_current_comm(&__data.comm, sizeof(__data.comm));
+ bpf_send_signal(10);
%s
%s
%s.perf_submit(%s, &__data, sizeof(__data));
3. in a different window run
./trace.py -p $(pidof stress_test) t:sched:sched_switchThe deadlock can be reproduced in our production system.
Similar to Song's fix, the fix is to delay sending signal if irqs is disabled to avoid deadlocks involving with rq_lock. With this change, my above stress-test in our production system won't cause deadlock any more.
I also implemented a scale-down version of reproducer in the selftest (a subsequent commit). With latest bpf-next, it complains for the following potential deadlock.
[ 32.832450] -> #1 (&p->pi_lock){-.-.}:
[ 32.833100] _raw_spin_lock_irqsave+0x44/0x80
[ 32.833696] task_rq_lock+0x2c/0xa0
[ 32.834182] task_sched_runtime+0x59/0xd0
[ 32.834721] thread_group_cputime+0x250/0x270
[ 32.835304] thread_group_cputime_adjusted+0x2e/0x70
[ 32.835959] do_task_stat+0x8a7/0xb80
[ 32.836461] proc_single_show+0x51/0xb0
...
[ 32.839512] -> #0 (&(&sighand->siglock)->rlock){....}:
[ 32.840275] __lock_acquire+0x1358/0x1a20
[ 32.840826] lock_acquire+0xc7/0x1d0
[ 32.841309] _raw_spin_lock_irqsave+0x44/0x80
[ 32.841916] __lock_task_sighand+0x79/0x160
[ 32.842465] do_send_sig_info+0x35/0x90
[ 32.842977] bpf_send_signal+0xa/0x10
[ 32.843464] bpf_prog_bc13ed9e4d3163e3_send_signal_tp_sched+0x465/0x1000
[ 32.844301] trace_call_bpf+0x115/0x270
[ 32.844809] perf_trace_run_bpf_submit+0x4a/0xc0
[ 32.845411] perf_trace_sched_switch+0x10f/0x180
[ 32.846014] __schedule+0x45d/0x880
[ 32.846483] schedule+0x5f/0xd0
...[ 32.853148] Chain exists of: [ 32.853148] &(&sighand->siglock)->rlock --> &p->pi_lock --> &rq->lock [ 32.853148] [ 32.854451] Possible unsafe locking scenario: [ 32.854451] [ 32.855173] CPU0 CPU1 [ 32.855745] ---- ---- [ 32.856278] lock(&rq->lock); [ 32.856671] lock(&p->pi_lock); [ 32.857332] lock(&rq->lock); [ 32.857999] lock(&(&sighand->siglock)->rlock);
Deadlock happens on CPU0 when it tries to acquire &sighand->siglock but it has been held by CPU1 and CPU1 tries to grab &rq->lock and cannot get it.
This is not exactly the callstack in our production environment, but sympotom is similar and both locks are using spin_lock_irqsave() to acquire the lock, and both involves rq_lock. The fix to delay sending signal when irq is disabled also fixed this issue.
--- kernel/trace/bpf_trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/bpf_trace.c +1 -1
@@ -731,7 +731,7 @@ BPF_CALL_1(bpf_send_signal, u32, sig)if (unlikely (!nmi_uaccess_okay ()))return -EPERM ; -if (in_nmi ()) { +if (irqs_disabled ()) {/* Do an early check on signal validity. Otherwise, * the error is lost in deferred irq_work. */
Greg Kroah-Hartman
maintainerPATCH 5/257 iwlwifi: mvm: take the required lock when clearing time event data
In reply to Greg Kroah-HartmanFrom: Avraham Stern <[email protected]>
[ Upstream commit 089e5016d7eb063712063670e6da7c1a4de1a5c1 ]
When receiving a session protection end notification, the time event data is cleared without holding the required lock. Fix it.
--- drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +4 -0
@@ -785,7 +785,9 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,if (!le32_to_cpu (notif->status)) {iwl_mvm_te_check_disconnect (mvm, vif,"Session protection failure" ); +spin_lock_bh (&mvm->time_event_lock);iwl_mvm_te_clear_data (mvm, te_data); +spin_unlock_bh (&mvm->time_event_lock); }if (le32_to_cpu (notif->start)) {
@@ -801,7 +803,9 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,*/ iwl_mvm_te_check_disconnect (mvm, vif,"No beacon heard and the session protection is over already..." ); +spin_lock_bh (&mvm->time_event_lock);iwl_mvm_te_clear_data (mvm, te_data); +spin_unlock_bh (&mvm->time_event_lock); } goto out_unlock;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 6/257 iwlwifi: mvm: Fix rate scale NSS configuration
In reply to Greg Kroah-HartmanFrom: Ilan Peer <[email protected]>
[ Upstream commit ce19801ba75a902ab515dda03b57738c708d0781 ]
The TLC configuration did not take into consideration the station's SMPS configuration, and thus configured rates for 2 NSS even if static SMPS was reported by the station. Fix this.
--- .../net/wireless/intel/iwlwifi/mvm/rs-fw.c | 29 ++++++++++++++----- 1 file changed, 21 insertions(+), 8 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c +21 -8
@@ -6,7 +6,7 @@* GPL LICENSE SUMMARY * * Copyright(c) 2017 Intel Deutschland GmbH -* Copyright(c) 2018 - 2019 Intel Corporation +* Copyright(c) 2018 - 2020 Intel Corporation * * This program is free software; you can redistribute it and/or modify * it under the terms of version 2 of the GNU General Public License as
@@ -27,7 +27,7 @@* BSD LICENSE * * Copyright(c) 2017 Intel Deutschland GmbH -* Copyright(c) 2018 - 2019 Intel Corporation +* Copyright(c) 2018 - 2020 Intel Corporation * All rights reserved. * * Redistribution and use in source and binary forms, with or without
@@ -195,11 +195,13 @@ rs_fw_vht_set_enabled_rates(const struct ieee80211_sta *sta, {u16 supp;int i, highest_mcs; +u8 nss = sta->rx_nss; -for (i =0 ; i < sta->rx_nss; i++) { -if (i ==IWL_TLC_NSS_MAX ) -break ; +/* the station support only a single receive chain */ +if (sta->smps_mode ==IEEE80211_SMPS_STATIC ) + nss =1 ; +for (i =0 ; i < nss && i <IWL_TLC_NSS_MAX ; i++) { highest_mcs =rs_fw_vht_highest_rx_mcs_index (vht_cap, i +1 );if (!highest_mcs)continue ;
@@ -245,8 +247,13 @@ rs_fw_he_set_enabled_rates(const struct ieee80211_sta *sta,u16 tx_mcs_160 =le16_to_cpu (sband->iftype_data->he_cap.he_mcs_nss_supp.tx_mcs_160);int i; +u8 nss = sta->rx_nss; -for (i =0 ; i < sta->rx_nss && i <IWL_TLC_NSS_MAX ; i++) { +/* the station support only a single receive chain */ +if (sta->smps_mode ==IEEE80211_SMPS_STATIC ) + nss =1 ; + +for (i =0 ; i < nss && i <IWL_TLC_NSS_MAX ; i++) {u16 _mcs_160 = (mcs_160 >> (2 * i)) &0x3 ;u16 _mcs_80 = (mcs_80 >> (2 * i)) &0x3 ;u16 _tx_mcs_160 = (tx_mcs_160 >> (2 * i)) &0x3 ;
@@ -307,8 +314,14 @@ static void rs_fw_set_supp_rates(struct ieee80211_sta *sta, cmd->mode =IWL_TLC_MNG_MODE_HT ; cmd->ht_rates[IWL_TLC_NSS_1 ][IWL_TLC_HT_BW_NONE_160 ] =cpu_to_le16 (ht_cap->mcs.rx_mask[0 ]); - cmd->ht_rates[IWL_TLC_NSS_2 ][IWL_TLC_HT_BW_NONE_160 ] = -cpu_to_le16 (ht_cap->mcs.rx_mask[1 ]); + +/* the station support only a single receive chain */ +if (sta->smps_mode ==IEEE80211_SMPS_STATIC ) + cmd->ht_rates[IWL_TLC_NSS_2 ][IWL_TLC_HT_BW_NONE_160 ] = +0 ; +else + cmd->ht_rates[IWL_TLC_NSS_2 ][IWL_TLC_HT_BW_NONE_160 ] = +cpu_to_le16 (ht_cap->mcs.rx_mask[1 ]); } }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 7/257 Input: tm2-touchkey - add support for Coreriver TC360 variant
In reply to Greg Kroah-HartmanFrom: Nick Reitemeyer <[email protected]>
[ Upstream commit da3289044833769188c0da945d2cec90af35e87e ]
The Coreriver TouchCore 360 is like the midas board touchkey, but it is using a fixed regulator.
--- drivers/input/keyboard/tm2-touchkey.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/input/keyboard/tm2-touchkey.c +11 -0
@@ -75,6 +75,14 @@ static struct touchkey_variant aries_touchkey_variant = { .cmd_led_off = ARIES_TOUCHKEY_CMD_LED_OFF, }; +static const struct touchkey_variant tc360_touchkey_variant = { + .keycode_reg =0x00 , + .base_reg =0x00 , + .fixed_regulator = true, + .cmd_led_on =TM2_TOUCHKEY_CMD_LED_ON , + .cmd_led_off =TM2_TOUCHKEY_CMD_LED_OFF , +}; +static int tm2_touchkey_led_brightness_set (struct led_classdev *led_dev,enum led_brightness brightness) {
@@ -327,6 +335,9 @@ static const struct of_device_id tm2_touchkey_of_match[] = { }, { .compatible = "cypress,aries-touchkey", .data = &aries_touchkey_variant, + }, { + .compatible = "coreriver,tc360-touchkey", + .data = &tc360_touchkey_variant, }, { }, };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 8/257 soc: fsl: dpio: register dpio irq handlers after dpio create
In reply to Greg Kroah-HartmanFrom: Grigore Popescu <[email protected]>
[ Upstream commit fe8fe7723a3a824790bda681b40efd767e2251a7 ]
The dpio irqs must be registered when you can actually receive interrupts, ie when the dpios are created. Kernel goes through NULL pointer dereference errors followed by kernel panic [1] because the dpio irqs are enabled before the dpio is created.
[1]
Unable to handle kernel NULL pointer dereference at virtual address 0040 fsl_mc_dpio dpio.14: probed fsl_mc_dpio dpio.13: Adding to iommu group 11 ISV = 0, ISS = 0x00000004 Unable to handle kernel NULL pointer dereference at virtual address 0040
Mem abort info:
ESR = 0x96000004
EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
[0000000000000040] user address but active_mm is swapper
Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 151 Comm: kworker/2:1 Not tainted 5.6.0-rc4-next-20200304 #1 Hardware name: NXP Layerscape LX2160ARDB (DT) Workqueue: events deferred_probe_work_func pstate: 00000085 (nzcv daIf -PAN -UAO) pc : dpaa2_io_irq+0x18/0xe0 lr : dpio_irq_handler+0x1c/0x28
sp : ffff800010013e20
x29: ffff800010013e20 x28: ffff0026d9b4c140
x27: ffffa1d38a142018 x26: ffff0026d2953400
x25: ffffa1d38a142018 x24: ffffa1d38a7ba1d8
x23: ffff800010013f24 x22: 0000000000000000
x21: 0000000000000072 x20: ffff0026d2953400
x19: ffff0026d2a68b80 x18: 0000000000000001
x17: 000000002fb37f3d x16: 0000000035eafadd
x15: ffff0026d9b4c5b8 x14: ffffffffffffffff
x13: ff00000000000000 x12: 0000000000000038
x11: 0101010101010101 x10: 0000000000000040
x9 : ffffa1d388db11e4 x8 : ffffa1d38a7e40f0
x7 : ffff0026da414f38 x6 : 0000000000000000
x5 : ffff0026da414d80 x4 : ffff5e5353d0c000
x3 : ffff800010013f60 x2 : ffffa1d388db11c8
x1 : ffff0026d2a67c00 x0 : 0000000000000000
Call trace: dpaa2_io_irq+0x18/0xe0 dpio_irq_handler+0x1c/0x28 __handle_irq_event_percpu+0x78/0x2c0 handle_irq_event_percpu+0x38/0x90 handle_irq_event+0x4c/0xd0 handle_fasteoi_irq+0xbc/0x168 generic_handle_irq+0x2c/0x40 __handle_domain_irq+0x68/0xc0 gic_handle_irq+0x64/0x150 el1_irq+0xb8/0x180 _raw_spin_unlock_irqrestore+0x14/0x48 irq_set_affinity_hint+0x6c/0xa0 dpaa2_dpio_probe+0x2a4/0x518 fsl_mc_driver_probe+0x28/0x70 really_probe+0xdc/0x320 driver_probe_device+0x5c/0xf0 __device_attach_driver+0x88/0xc0 bus_for_each_drv+0x7c/0xc8 __device_attach+0xe4/0x140 device_initial_probe+0x18/0x20 bus_probe_device+0x98/0xa0 device_add+0x41c/0x758 fsl_mc_device_add+0x184/0x530 dprc_scan_objects+0x280/0x370 dprc_probe+0x124/0x3b0 fsl_mc_driver_probe+0x28/0x70 really_probe+0xdc/0x320 driver_probe_device+0x5c/0xf0 __device_attach_driver+0x88/0xc0 bus_for_each_drv+0x7c/0xc8 __device_attach+0xe4/0x140 device_initial_probe+0x18/0x20 bus_probe_device+0x98/0xa0 deferred_probe_work_func+0x74/0xa8 process_one_work+0x1c8/0x470 worker_thread+0x1f8/0x428 kthread+0x124/0x128 ret_from_fork+0x10/0x18 Code: a9bc7bfd 910003fd a9025bf5 a90363f7 (f9402015) ---[ end trace 38298e1a29e7a570 ]--- Kernel panic - not syncing: Fatal exception in interrupt
SMP: stopping secondary CPUs
Mem abort info:
ESR = 0x96000004
CM = 0, WnR = 0
EC = 0x25: DABT (current EL), IL = 32 bits
[0000000000000040] user address but active_mm is swapper
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
[0000000000000040] user address but active_mm is swapper
SMP: failed to stop secondary CPUs 0-2
Kernel Offset: 0x21d378600000 from 0xffff800010000000PHYS_OFFSET: 0xffffe92180000000
CPU features: 0x10002,21806008
Memory Limit: none
---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
--- drivers/soc/fsl/dpio/dpio-driver.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/soc/fsl/dpio/dpio-driver.c +4 -4
@@ -233,10 +233,6 @@ static int dpaa2_dpio_probe(struct fsl_mc_device *dpio_dev) goto err_allocate_irqs; } - err =register_dpio_irq_handlers (dpio_dev, desc.cpu); -if (err) - goto err_register_dpio_irq; - priv->io =dpaa2_io_create (&desc, dev);if (!priv->io) {dev_err (dev,"dpaa2_io_create failed\n" );
@@ -244,6 +240,10 @@ static int dpaa2_dpio_probe(struct fsl_mc_device *dpio_dev) goto err_dpaa2_io_create; } + err =register_dpio_irq_handlers (dpio_dev, desc.cpu); +if (err) + goto err_register_dpio_irq; +dev_info (dev,"probed\n" );dev_dbg (dev," receives_notifications = %d\n" , desc.receives_notifications);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 9/257 rxrpc: Abstract out the calculation of whether theres Tx space
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 158fe6665389964a1de212818b4a5c52b7f7aff4 ]
Abstract out the calculation of there being sufficient Tx buffer space. This is reproduced several times in the rxrpc sendmsg code.
--- net/rxrpc/sendmsg.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-)
net/rxrpc/sendmsg.c +18 -9
@@ -17,6 +17,21 @@#include <net/af_rxrpc.h> #include "ar-internal.h" +/* +* Return true if there's sufficient Tx queue space. +*/ +static bool rxrpc_check_tx_space (struct rxrpc_call *call,rxrpc_seq_t *_tx_win) +{ +unsigned int win_size = + min_t(unsigned int, call->tx_winsize, + call->cong_cwnd + call->cong_extra); +rxrpc_seq_t tx_win =READ_ONCE (call->tx_hard_ack); + +if (_tx_win) + *_tx_win = tx_win; +return call->tx_top - tx_win < win_size; +} +/* * Wait for space to appear in the Tx queue or a signal to occur. */
@@ -26,9 +41,7 @@ static int rxrpc_wait_for_tx_window_intr(struct rxrpc_sock *rx, {for (;;) {set_current_state (TASK_INTERRUPTIBLE ); -if (call->tx_top - call->tx_hard_ack < - min_t(unsigned int, call->tx_winsize, - call->cong_cwnd + call->cong_extra)) +if (rxrpc_check_tx_space (call,NULL ))return 0 ;if (call->state >=RXRPC_CALL_COMPLETE )
@@ -68,9 +81,7 @@ static int rxrpc_wait_for_tx_window_nonintr(struct rxrpc_sock *rx,set_current_state (TASK_UNINTERRUPTIBLE ); tx_win =READ_ONCE (call->tx_hard_ack); -if (call->tx_top - tx_win < - min_t(unsigned int, call->tx_winsize, - call->cong_cwnd + call->cong_extra)) +if (rxrpc_check_tx_space (call, &tx_win))return 0 ;if (call->state >=RXRPC_CALL_COMPLETE )
@@ -302,9 +313,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,_debug ("alloc" ); -if (call->tx_top - call->tx_hard_ack >= - min_t(unsigned int, call->tx_winsize, - call->cong_cwnd + call->cong_extra)) { +if (!rxrpc_check_tx_space (call,NULL )) { ret = -EAGAIN ;if (msg->msg_flags &MSG_DONTWAIT ) goto maybe_error;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 10/257 rxrpc: Fix call interruptibility handling
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit e138aa7d3271ac1b0690ae2c9b04d51468dce1d6 ]
Fix the interruptibility of kernel-initiated client calls so that they're either only interruptible when they're waiting for a call slot to come available or they're not interruptible at all. Either way, they're not interruptible during transmission.
This should help prevent StoreData calls from being interrupted when writeback is in progress. It doesn't, however, handle interruption during the receive phase.
Userspace-initiated calls are still interruptable. After the signal has been handled, sendmsg() will return the amount of data copied out of the buffer and userspace can perform another sendmsg() call to continue transmission.
--- fs/afs/rxrpc.c | 3 ++- include/net/af_rxrpc.h | 8 +++++++- net/rxrpc/af_rxrpc.c | 4 ++-- net/rxrpc/ar-internal.h | 4 ++-- net/rxrpc/call_object.c | 3 +-- net/rxrpc/conn_client.c | 13 +++++++++--- net/rxrpc/sendmsg.c | 44 +++++++++++++++++++++++++++++++++-------- 7 files changed, 60 insertions(+), 19 deletions(-)
fs/afs/rxrpc.c +2 -1
@@ -414,7 +414,8 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) afs_wake_up_async_call : afs_wake_up_call_waiter), call->upgrade, - call->intr, + (call->intr ?RXRPC_PREINTERRUPTIBLE : +RXRPC_UNINTERRUPTIBLE ), call->debug_id);if (IS_ERR (rxcall)) { ret =PTR_ERR (rxcall);
include/net/af_rxrpc.h +7 -1
@@ -16,6 +16,12 @@ struct sock;struct socket ;struct rxrpc_call ; +enum rxrpc_interruptibility { +RXRPC_INTERRUPTIBLE ,/* Call is interruptible */ +RXRPC_PREINTERRUPTIBLE ,/* Call can be cancelled whilst waiting for a slot */ +RXRPC_UNINTERRUPTIBLE ,/* Call should not be interruptible at all */ +}; +/* * Debug ID counter for tracing. */
@@ -41,7 +47,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *, gfp_t, rxrpc_notify_rx_t, bool, - bool, + enum rxrpc_interruptibility, unsigned int); int rxrpc_kernel_send_data(struct socket *, struct rxrpc_call *, struct msghdr *, size_t,
net/rxrpc/af_rxrpc.c +2 -2
@@ -285,7 +285,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,gfp_t gfp, rxrpc_notify_rx_t notify_rx, bool upgrade, - bool intr, + enum rxrpc_interruptibility interruptibility, unsigned int debug_id) { struct rxrpc_conn_parameters cp;
@@ -310,7 +310,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,memset (&p,0 ,sizeof (p)); p.user_call_ID = user_call_ID; p.tx_total_len = tx_total_len; - p.intr = intr; + p.interruptibility = interruptibility;memset (&cp,0 ,sizeof (cp)); cp.local = rx->local;
net/rxrpc/ar-internal.h +2 -2
@@ -489,7 +489,6 @@ enum rxrpc_call_flag {RXRPC_CALL_BEGAN_RX_TIMER ,/* We began the expect_rx_by timer */ RXRPC_CALL_RX_HEARD ,/* The peer responded at least once to this call */ RXRPC_CALL_RX_UNDERRUN ,/* Got data underrun */ -RXRPC_CALL_IS_INTR ,/* The call is interruptible */ RXRPC_CALL_DISCONNECTED, /* The call has been disconnected */ };
@@ -598,6 +597,7 @@ struct rxrpc_call {atomic_t usage;u16 service_id;/* service ID */ u8 security_ix;/* Security type */ +enum rxrpc_interruptibility interruptibility;/* At what point call may be interrupted */ u32 call_id;/* call ID on connection */ u32 cid;/* connection ID plus channel index */ int debug_id;/* debug ID for printks */
@@ -720,7 +720,7 @@ struct rxrpc_call_params {u32 normal;/* Max time since last call packet (msec) */ } timeouts;u8 nr_timeouts;/* Number of timeouts specified */ -bool intr;/* The call is interruptible */ +enum rxrpc_interruptibility interruptibility;/* How is interruptible is the call? */ };struct rxrpc_send_params {
net/rxrpc/call_object.c +1 -2
@@ -237,8 +237,7 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx,return call; } -if (p->intr) -__set_bit (RXRPC_CALL_IS_INTR , &call->flags); + call->interruptibility = p->interruptibility; call->tx_total_len = p->tx_total_len; trace_rxrpc_call(call->debug_id, rxrpc_call_new_client, atomic_read(&call->usage),
net/rxrpc/conn_client.c +10 -3
@@ -655,13 +655,20 @@ static int rxrpc_wait_for_channel(struct rxrpc_call *call, gfp_t gfp)add_wait_queue_exclusive (&call->waitq, &myself);for (;;) { -if (test_bit (RXRPC_CALL_IS_INTR , &call->flags)) +switch (call->interruptibility) { +case RXRPC_INTERRUPTIBLE : +case RXRPC_PREINTERRUPTIBLE :set_current_state (TASK_INTERRUPTIBLE ); -else +break ; +case RXRPC_UNINTERRUPTIBLE : +default :set_current_state (TASK_UNINTERRUPTIBLE ); +break ; + }if (call->call_id)break ; -if (test_bit (RXRPC_CALL_IS_INTR , &call->flags) && +if ((call->interruptibility ==RXRPC_INTERRUPTIBLE || + call->interruptibility ==RXRPC_PREINTERRUPTIBLE ) &&signal_pending (current)) { ret = -ERESTARTSYS ;break ;
net/rxrpc/sendmsg.c +36 -8
74 lines not on this page · raw message
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 11/257 net: stmmac: platform: Fix misleading interrupt error msg
In reply to Greg Kroah-HartmanFrom: Markus Fuchs <[email protected]>
[ Upstream commit fc191af1bb0d069dc7e981076e8b80af21f1e61d ]
Not every stmmac based platform makes use of the eth_wake_irq or eth_lpi interrupts. Use the platform_get_irq_byname_optional variant for these interrupts, so no error message is displayed, if they can't be found. Rather print an information to hint something might be wrong to assist debugging on platforms which use these interrupts.
--- .../net/ethernet/stmicro/stmmac/stmmac_platform.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +10 -4
@@ -663,16 +663,22 @@ int stmmac_get_platform_resources(struct platform_device *pdev,* In case the wake up interrupt is not passed from the platform * so the driver will continue to use the mac irq (ndev->irq) */ - stmmac_res->wol_irq =platform_get_irq_byname (pdev,"eth_wake_irq" ); + stmmac_res->wol_irq = +platform_get_irq_byname_optional (pdev,"eth_wake_irq" );if (stmmac_res->wol_irq <0 ) {if (stmmac_res->wol_irq == -EPROBE_DEFER )return -EPROBE_DEFER ; +dev_info (&pdev->dev,"IRQ eth_wake_irq not found\n" ); stmmac_res->wol_irq = stmmac_res->irq; } - stmmac_res->lpi_irq =platform_get_irq_byname (pdev,"eth_lpi" ); -if (stmmac_res->lpi_irq == -EPROBE_DEFER ) -return -EPROBE_DEFER ; + stmmac_res->lpi_irq = +platform_get_irq_byname_optional (pdev,"eth_lpi" ); +if (stmmac_res->lpi_irq <0 ) { +if (stmmac_res->lpi_irq == -EPROBE_DEFER ) +return -EPROBE_DEFER ; +dev_info (&pdev->dev,"IRQ eth_lpi not found\n" ); + } res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); stmmac_res->addr =devm_ioremap_resource (&pdev->dev, res);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 12/257 net: vxge: fix wrong __VA_ARGS__ usage
In reply to Greg Kroah-HartmanFrom: Zheng Wei <[email protected]>
[ Upstream commit b317538c47943f9903860d83cc0060409e12d2ff ]
printk in macro vxge_debug_ll uses __VA_ARGS__ without "##" prefix, it causes a build error when there is no variable arguments(e.g. only fmt is specified.).
--- drivers/net/ethernet/neterion/vxge/vxge-config.h | 2 +- drivers/net/ethernet/neterion/vxge/vxge-main.h | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/neterion/vxge/vxge-config.h +1 -1
@@ -2045,7 +2045,7 @@ vxge_hw_vpath_strip_fcs_check(struct __vxge_hw_device *hldev, u64 vpath_mask);if ((level >=VXGE_ERR &&VXGE_COMPONENT_LL &VXGE_DEBUG_ERR_MASK ) || \ (level >=VXGE_TRACE &&VXGE_COMPONENT_LL &VXGE_DEBUG_TRACE_MASK ))\if ((mask &VXGE_DEBUG_MASK ) == mask) \ -printk (fmt"\n" , __VA_ARGS__); \ + printk(fmt "\n", ##__VA_ARGS__); \ } while (0) #else#define vxge_debug_ll (level, mask, fmt, ...)
drivers/net/ethernet/neterion/vxge/vxge-main.h +7 -7
@@ -452,49 +452,49 @@ int vxge_fw_upgrade(struct vxgedev *vdev, char *fw_name, int override);#if (VXGE_DEBUG_LL_CONFIG &VXGE_DEBUG_MASK )#define vxge_debug_ll_config (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_LL_CONFIG, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_LL_CONFIG, fmt, ##__VA_ARGS__)#else #define vxge_debug_ll_config (level, fmt, ...)#endif #if (VXGE_DEBUG_INIT &VXGE_DEBUG_MASK )#define vxge_debug_init (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_INIT, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_INIT, fmt, ##__VA_ARGS__)#else #define vxge_debug_init (level, fmt, ...)#endif #if (VXGE_DEBUG_TX &VXGE_DEBUG_MASK )#define vxge_debug_tx (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_TX, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_TX, fmt, ##__VA_ARGS__)#else #define vxge_debug_tx (level, fmt, ...)#endif #if (VXGE_DEBUG_RX &VXGE_DEBUG_MASK )#define vxge_debug_rx (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_RX, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_RX, fmt, ##__VA_ARGS__)#else #define vxge_debug_rx (level, fmt, ...)#endif #if (VXGE_DEBUG_MEM &VXGE_DEBUG_MASK )#define vxge_debug_mem (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_MEM, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_MEM, fmt, ##__VA_ARGS__)#else #define vxge_debug_mem (level, fmt, ...)#endif #if (VXGE_DEBUG_ENTRYEXIT &VXGE_DEBUG_MASK )#define vxge_debug_entryexit (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_ENTRYEXIT, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_ENTRYEXIT, fmt, ##__VA_ARGS__)#else #define vxge_debug_entryexit (level, fmt, ...)#endif #if (VXGE_DEBUG_INTR &VXGE_DEBUG_MASK )#define vxge_debug_intr (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_INTR, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_INTR, fmt, ##__VA_ARGS__)#else #define vxge_debug_intr (level, fmt, ...)#endif
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 13/257 ARM: dts: omap4-droid4: Fix lost touchscreen interrupts
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit 4abd9930d189dedaa59097144c6d8f623342fa72 ]
Looks like we can have the maxtouch touchscreen stop producing interrupts if an edge interrupt is lost. This can happen easily when the SoC idles as the gpio controller may not see any state for an edge interrupt if it is briefly triggered when the system is idle.
Also it looks like maxtouch stops sending any further interrupts if the interrupt is not handled. And we do have several cases of maxtouch already configured with a level interrupt, so let's do that.
With level interrupt the gpio controller has the interrupt state visible after idle. Note that eventually we will probably also be using the Linux generic wakeirq configured for the controller, but that cannot be done until the maxtouch driver supports runtime PM.
--- arch/arm/boot/dts/motorola-mapphone-common.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/motorola-mapphone-common.dtsi +1 -1
@@ -413,7 +413,7 @@ reset-gpios = <&gpio6 13 GPIO_ACTIVE_HIGH>; /* gpio173 */ /* gpio_183 with sys_nirq2 pad as wakeup */ - interrupts-extended = <&gpio6 23 IRQ_TYPE_EDGE_FALLING>, + interrupts-extended = <&gpio6 23 IRQ_TYPE_LEVEL_LOW>, <&omap4_pmx_core 0x160>; interrupt-names = "irq", "wakeup"; wakeup-source;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 14/257 riscv: uaccess should be used in nommu mode
In reply to Greg Kroah-HartmanFrom: Greentime Hu <[email protected]>
[ Upstream commit adccfb1a805ea84d2db38eb53032533279bdaa97 ]
It might have the unaligned access exception when trying to exchange data with user space program. In this case, it failed in tty_ioctl(). Therefore we should enable uaccess.S for NOMMU mode since the generic code doesn't handle the unaligned access cases.
0x8013a212 <tty_ioctl+462>: ld a5,460(s1)
[ 0.115279] Oops - load address misaligned [#1] [ 0.115284] CPU: 0 PID: 29 Comm: sh Not tainted 5.4.0-rc5-00020-gb4c27160d562-dirty #36 [ 0.115294] epc: 000000008013a212 ra : 000000008013a212 sp : 000000008f48dd50 [ 0.115303] gp : 00000000801cac28 tp : 000000008fb80000 t0 : 00000000000000e8 [ 0.115312] t1 : 000000008f58f108 t2 : 0000000000000009 s0 : 000000008f48ddf0 [ 0.115321] s1 : 000000008f8c6220 a0 : 0000000000000001 a1 : 000000008f48dd28 [ 0.115330] a2 : 000000008fb80000 a3 : 00000000801a7398 a4 : 0000000000000000 [ 0.115339] a5 : 0000000000000000 a6 : 000000008f58f0c6 a7 : 000000000000001d [ 0.115348] s2 : 000000008f8c6308 s3 : 000000008f78b7c8 s4 : 000000008fb834c0 [ 0.115357] s5 : 0000000000005413 s6 : 0000000000000000 s7 : 000000008f58f2b0 [ 0.115366] s8 : 000000008f858008 s9 : 000000008f776818 s10: 000000008f776830 [ 0.115375] s11: 000000008fb840a8 t3 : 1999999999999999 t4 : 000000008f78704c [ 0.115384] t5 : 0000000000000005 t6 : 0000000000000002 [ 0.115391] status: 0000000200001880 badaddr: 000000008f8c63ec cause: 0000000000000004 [ 0.115401] ---[ end trace 00d490c6a8b6c9ac ]---
This failure could be fixed after this patch applied.
[ 0.002282] Run /init as init process
Initializing random number generator... [ 0.005573] random: dd: uninitialized urandom read (512 bytes read)
done.
Welcome to Buildroot
buildroot login: root
Password:
Jan 1 00:00:00 login[62]: root login on 'ttySIF0'
~ #
--- arch/riscv/Kconfig | 1 - arch/riscv/include/asm/uaccess.h | 36 ++++++++++++++++---------------- arch/riscv/lib/Makefile | 2 +- 3 files changed, 19 insertions(+), 20 deletions(-)
arch/riscv/Kconfig +0 -1
@@ -52,7 +52,6 @@ config RISCV select PCI_DOMAINS_GENERIC if PCI select PCI_MSI if PCI select RISCV_TIMER - select UACCESS_MEMCPY if !MMU select GENERIC_IRQ_MULTI_HANDLER select GENERIC_ARCH_TOPOLOGY if SMP select ARCH_HAS_PTE_SPECIAL
arch/riscv/include/asm/uaccess.h +18 -18
@@ -11,6 +11,24 @@/* * User space memory access functions */ + +extern unsigned long __must_check __asm_copy_to_user (void __user *to, +const void *from,unsigned long n); +extern unsigned long __must_check __asm_copy_from_user (void *to, +const void __user *from,unsigned long n); + +static inline unsigned long +raw_copy_from_user (void *to,const void __user *from,unsigned long n) +{ +return __asm_copy_from_user (to, from, n); +} + +static inline unsigned long +raw_copy_to_user (void __user *to,const void *from,unsigned long n) +{ +return __asm_copy_to_user (to, from, n); +} +#ifdef CONFIG_MMU #include <linux/errno.h> #include <linux/compiler.h>
@@ -367,24 +385,6 @@ do { \ -EFAULT ; \ }) - -extern unsigned long __must_check __asm_copy_to_user (void __user *to, -const void *from,unsigned long n); -extern unsigned long __must_check __asm_copy_from_user (void *to, -const void __user *from,unsigned long n); - -static inline unsigned long -raw_copy_from_user (void *to,const void __user *from,unsigned long n) -{ -return __asm_copy_from_user (to, from, n); -} - -static inline unsigned long -raw_copy_to_user (void __user *to,const void *from,unsigned long n) -{ -return __asm_copy_to_user (to, from, n); -} -extern long strncpy_from_user (char *dest,const char __user *src,long count);extern long __must_check strlen_user (const char __user *str);
arch/riscv/lib/Makefile +1 -1
@@ -2,5 +2,5 @@ lib-y += delay.o lib-y += memcpy.o lib-y += memset.o -lib-$(CONFIG_MMU) += uaccess.o +lib-y += uaccess.o lib-$(CONFIG_64BIT) += tishift.o
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 15/257 hinic: fix a bug of waitting for IO stopped
In reply to Greg Kroah-HartmanFrom: Luo bin <[email protected]>
[ Upstream commit 96758117dc528e6d84bd23d205e8cf7f31eda029 ]
it's unreliable for fw to check whether IO is stopped, so driver wait for enough time to ensure IO process is done in hw before freeing resources
--- .../net/ethernet/huawei/hinic/hinic_hw_dev.c | 51 +------------------ 1 file changed, 2 insertions(+), 49 deletions(-)
drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c +2 -49
@@ -360,50 +360,6 @@ static int wait_for_db_state(struct hinic_hwdev *hwdev)return -EFAULT ; } -static int wait_for_io_stopped (struct hinic_hwdev *hwdev) -{ -struct hinic_cmd_io_status cmd_io_status; -struct hinic_hwif *hwif = hwdev->hwif; -struct pci_dev *pdev = hwif->pdev; -struct hinic_pfhwdev *pfhwdev; -unsigned long end; -u16 out_size; -int err; - -if (!HINIC_IS_PF (hwif) && !HINIC_IS_PPF (hwif)) { -dev_err (&pdev->dev,"Unsupported PCI Function type\n" ); -return -EINVAL ; - } - - pfhwdev = container_of(hwdev, struct hinic_pfhwdev, hwdev); - - cmd_io_status.func_idx =HINIC_HWIF_FUNC_IDX (hwif); - - end = jiffies +msecs_to_jiffies (IO_STATUS_TIMEOUT ); -do { - err =hinic_msg_to_mgmt (&pfhwdev->pf_to_mgmt,HINIC_MOD_COMM , -HINIC_COMM_CMD_IO_STATUS_GET , - &cmd_io_status,sizeof (cmd_io_status), - &cmd_io_status, &out_size, -HINIC_MGMT_MSG_SYNC ); -if ((err) || (out_size !=sizeof (cmd_io_status))) { -dev_err (&pdev->dev,"Failed to get IO status, ret = %d\n" , - err); -return err; - } - -if (cmd_io_status.status ==IO_STOPPED ) { -dev_info (&pdev->dev,"IO stopped\n" ); -return 0 ; - } - -msleep (20 ); - }while (time_before (jiffies, end)); - -dev_err (&pdev->dev,"Wait for IO stopped - Timeout\n" ); -return -ETIMEDOUT ; -} -/** * clear_io_resource - set the IO resources as not active in the NIC * @hwdev: the NIC HW device
@@ -423,11 +379,8 @@ static int clear_io_resources(struct hinic_hwdev *hwdev)return -EINVAL ; } - err =wait_for_io_stopped (hwdev); -if (err) { -dev_err (&pdev->dev,"IO has not stopped yet\n" ); -return err; - } +/* sleep 100ms to wait for firmware stopping I/O */ +msleep (100 ); cmd_clear_io_res.func_idx =HINIC_HWIF_FUNC_IDX (hwif);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 16/257 hinic: fix the bug of clearing event queue
In reply to Greg Kroah-HartmanFrom: Luo bin <[email protected]>
[ Upstream commit 614eaa943e9fc3fcdbd4aa0692ae84973d363333 ]
should disable eq irq before freeing it, must clear event queue depth in hw before freeing relevant memory to avoid illegal memory access and update consumer idx to avoid invalid interrupt
--- .../net/ethernet/huawei/hinic/hinic_hw_eqs.c | 24 +++++++++++++------ 1 file changed, 17 insertions(+), 7 deletions(-)
drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c +17 -7
@@ -188,7 +188,7 @@ static u8 eq_cons_idx_checksum_set(u32 val)* eq_update_ci - update the HW cons idx of event queue * @eq: the event queue to update the cons idx for **/ -static void eq_update_ci (struct hinic_eq *eq) +static void eq_update_ci (struct hinic_eq *eq,u32 arm_state) {u32 val, addr =EQ_CONS_IDX_REG_ADDR (eq);
@@ -202,7 +202,7 @@ static void eq_update_ci(struct hinic_eq *eq) val |=HINIC_EQ_CI_SET (eq->cons_idx,IDX ) |HINIC_EQ_CI_SET (eq->wrapped,WRAPPED ) | -HINIC_EQ_CI_SET (EQ_ARMED ,INT_ARMED ); +HINIC_EQ_CI_SET (arm_state,INT_ARMED ); val |=HINIC_EQ_CI_SET (eq_cons_idx_checksum_set (val),XOR_CHKSUM );
@@ -347,7 +347,7 @@ static void eq_irq_handler(void *data)else if (eq->type ==HINIC_CEQ )ceq_irq_handler (eq); -eq_update_ci (eq); +eq_update_ci (eq,EQ_ARMED ); }/**
@@ -702,7 +702,7 @@ static int init_eq(struct hinic_eq *eq, struct hinic_hwif *hwif, }set_eq_ctrls (eq); -eq_update_ci (eq); +eq_update_ci (eq,EQ_ARMED ); err =alloc_eq_pages (eq);if (err) {
@@ -752,18 +752,28 @@ err_req_irq:**/ static void remove_eq (struct hinic_eq *eq) { -struct msix_entry *entry = &eq->msix_entry; - -free_irq (entry->vector, eq); +hinic_set_msix_state (eq->hwif, eq->msix_entry.entry, +HINIC_MSIX_DISABLE ); +free_irq (eq->msix_entry.vector, eq);if (eq->type ==HINIC_AEQ ) {struct hinic_eq_work *aeq_work = &eq->aeq_work;cancel_work_sync (&aeq_work->work); +/* clear aeq_len to avoid hw access host memory */ +hinic_hwif_write_reg (eq->hwif, +HINIC_CSR_AEQ_CTRL_1_ADDR (eq->q_id),0 ); }else if (eq->type ==HINIC_CEQ ) {tasklet_kill (&eq->ceq_tasklet); +/* clear ceq_len to avoid hw access host memory */ +hinic_hwif_write_reg (eq->hwif, +HINIC_CSR_CEQ_CTRL_1_ADDR (eq->q_id),0 ); } +/* update cons_idx to avoid invalid interrupt */ + eq->cons_idx =hinic_hwif_read_reg (eq->hwif,EQ_PROD_IDX_REG_ADDR (eq)); +eq_update_ci (eq,EQ_NOT_ARMED ); +free_eq_pages (eq); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 17/257 hinic: fix out-of-order excution in arm cpu
In reply to Greg Kroah-HartmanFrom: Luo bin <[email protected]>
[ Upstream commit 33f15da216a1f4566b4ec880942556ace30615df ]
add read barrier in driver code to keep from reading other fileds in dma memory which is writable for hw until we have verified the memory is valid for driver
--- drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 2 ++ drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c | 2 ++ drivers/net/ethernet/huawei/hinic/hinic_rx.c | 3 +++ drivers/net/ethernet/huawei/hinic/hinic_tx.c | 2 ++ 4 files changed, 9 insertions(+)
drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c +2 -0
@@ -623,6 +623,8 @@ static int cmdq_cmd_ceq_handler(struct hinic_cmdq *cmdq, u16 ci,if (!CMDQ_WQE_COMPLETED (be32_to_cpu (ctrl->ctrl_info)))return -EBUSY ; +dma_rmb (); + errcode =CMDQ_WQE_ERRCODE_GET (be32_to_cpu (status->status_info),VAL );cmdq_sync_cmd_handler (cmdq, ci, errcode);
drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c +2 -0
@@ -235,6 +235,8 @@ static void aeq_irq_handler(struct hinic_eq *eq)if (HINIC_EQ_ELEM_DESC_GET (aeqe_desc,WRAPPED ) == eq->wrapped)break ; +dma_rmb (); + event =HINIC_EQ_ELEM_DESC_GET (aeqe_desc,TYPE );if (event >=HINIC_MAX_AEQ_EVENTS ) {dev_err (&pdev->dev,"Unknown AEQ Event %d\n" , event);
drivers/net/ethernet/huawei/hinic/hinic_rx.c +3 -0
@@ -350,6 +350,9 @@ static int rxq_recv(struct hinic_rxq *rxq, int budget)if (!rq_wqe)break ; +/* make sure we read rx_done before packet length */ +dma_rmb (); + cqe = rq->cqe[ci]; status =be32_to_cpu (cqe->status);hinic_rq_get_sge (rxq->rq, rq_wqe, ci, &sge);
drivers/net/ethernet/huawei/hinic/hinic_tx.c +2 -0
@@ -622,6 +622,8 @@ static int free_tx_poll(struct napi_struct *napi, int budget) do { hw_ci = HW_CONS_IDX(sq) & wq->mask; + dma_rmb(); + /* Reading a WQEBB to get real WQE size and consumer index. */ sq_wqe = hinic_sq_read_wqebb(sq, &skb, &wqe_size, &sw_ci); if ((!sq_wqe) ||
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 18/257 hinic: fix wrong para of wait_for_completion_timeout
In reply to Greg Kroah-HartmanFrom: Luo bin <[email protected]>
[ Upstream commit 0da7c322f116210ebfdda59c7da663a6fc5e9cc8 ]
the second input parameter of wait_for_completion_timeout should be jiffies instead of millisecond
--- drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 3 ++- drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c +2 -1
@@ -389,7 +389,8 @@ static int cmdq_sync_cmd_direct_resp(struct hinic_cmdq *cmdq,spin_unlock_bh (&cmdq->cmdq_lock); -if (!wait_for_completion_timeout (&done,CMDQ_TIMEOUT )) { +if (!wait_for_completion_timeout (&done, +msecs_to_jiffies (CMDQ_TIMEOUT ))) {spin_lock_bh (&cmdq->cmdq_lock);if (cmdq->errcode[curr_prod_idx] == &errcode)
drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c +3 -2
@@ -43,7 +43,7 @@#define MSG_NOT_RESP 0xFFFF -#define MGMT_MSG_TIMEOUT 1000 +#define MGMT_MSG_TIMEOUT 5000#define mgmt_to_pfhwdev (pf_mgmt) \ container_of(pf_mgmt, struct hinic_pfhwdev, pf_to_mgmt)
@@ -267,7 +267,8 @@ static int msg_to_mgmt_sync(struct hinic_pf_to_mgmt *pf_to_mgmt, goto unlock_sync_msg; } -if (!wait_for_completion_timeout (recv_done,MGMT_MSG_TIMEOUT )) { +if (!wait_for_completion_timeout (recv_done, +msecs_to_jiffies (MGMT_MSG_TIMEOUT ))) {dev_err (&pdev->dev,"MGMT timeout, MSG id = %d\n" , msg_id); err = -ETIMEDOUT ; goto unlock_sync_msg;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 19/257 hinic: fix wrong value of MIN_SKB_LEN
In reply to Greg Kroah-HartmanFrom: Luo bin <[email protected]>
[ Upstream commit 7296695fc16dd1761dbba8b68a9181c71cef0633 ]
the minimum value of skb len that hw supports is 32 rather than 17
--- drivers/net/ethernet/huawei/hinic/hinic_tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/huawei/hinic/hinic_tx.c +1 -1
@@ -45,7 +45,7 @@#define HW_CONS_IDX (sq) be16_to_cpu(*(u16 *)((sq)->hw_ci_addr)) -#define MIN_SKB_LEN 17 +#define MIN_SKB_LEN 32#define MAX_PAYLOAD_OFFSET 221#define TRANSPORT_OFFSET (l4_hdr, skb) ((u32)((l4_hdr) - (skb)->data))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 20/257 selftests/net: add definition for SOL_DCCP to fix compilation errors for old libc
In reply to Greg Kroah-HartmanFrom: Alan Maguire <[email protected]>
[ Upstream commit 83a9b6f639e9f6b632337f9776de17d51d969c77 ]
Many systems build/test up-to-date kernels with older libcs, and an older glibc (2.17) lacks the definition of SOL_DCCP in /usr/include/bits/socket.h (it was added in the 4.6 timeframe).
Adding the definition to the test program avoids a compilation failure that gets in the way of building tools/testing/selftests/net. The test itself will work once the definition is added; either skipping due to DCCP not being configured in the kernel under test or passing, so there are no other more up-to-date glibc dependencies here it seems beyond that missing definition.
--- tools/testing/selftests/net/reuseport_addr_any.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/net/reuseport_addr_any.c +4 -0
@@ -21,6 +21,10 @@#include <sys/socket.h> #include <unistd.h> +#ifndef SOL_DCCP +#define SOL_DCCP 269 +#endif +static const char *IP4_ADDR ="127.0.0.1" ;static const char *IP6_ADDR ="::1" ;static const char *IP4_MAPPED6 ="::ffff:127.0.0.1" ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 21/257 cxgb4/ptp: pass the sign of offset delta in FW CMD
In reply to Greg Kroah-HartmanFrom: Raju Rangoju <[email protected]>
[ Upstream commit 50e0d28d3808146cc19b0d5564ef4ba9e5bf3846 ]
cxgb4_ptp_fineadjtime() doesn't pass the signedness of offset delta in FW_PTP_CMD. Fix it by passing correct sign.
--- drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c +3 -0
@@ -246,6 +246,9 @@ static int cxgb4_ptp_fineadjtime(struct adapter *adapter, s64 delta) FW_PTP_CMD_PORTID_V(0)); c.retval_len16 =cpu_to_be32 (FW_CMD_LEN16_V (sizeof (c) /16 )); c.u.ts.sc =FW_PTP_SC_ADJ_FTIME ; + c.u.ts.sign = (delta <0 ) ?1 :0 ; +if (delta <0 ) + delta = -delta; c.u.ts.tm =cpu_to_be64 (delta); err =t4_wr_mbox (adapter, adapter->mbox, &c,sizeof (c),NULL );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 22/257 drm/scheduler: fix rare NULL ptr race
In reply to Greg Kroah-HartmanFrom: Yintian Tao <[email protected]>
[ Upstream commit 3c0fdf3302cb4f186c871684eac5c407a107e480 ]
There is one one corner case at dma_fence_signal_locked which will raise the NULL pointer problem just like below. ->dma_fence_signal
->dma_fence_signal_locked ->test_and_set_bit
here trigger dma_fence_release happen due to the zero of fence refcount.
->dma_fence_put
->dma_fence_release ->drm_sched_fence_release_scheduled ->call_rcu
here make the union fled “cb_list” at finished fence to NULL because struct rcu_head contains two pointer which is same as struct list_head cb_list
Therefore, to hold the reference of finished fence at drm_sched_process_job to prevent the null pointer during finished fence dma_fence_signal
[ 732.912867] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 732.914815] #PF: supervisor write access in kernel mode [ 732.915731] #PF: error_code(0x0002) - not-present page [ 732.916621] PGD 0 P4D 0 [ 732.917072] Oops: 0002 [#1] SMP PTI [ 732.917682] CPU: 7 PID: 0 Comm: swapper/7 Tainted: G OE 5.4.0-rc7 #1 [ 732.918980] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 [ 732.920906] RIP: 0010:dma_fence_signal_locked+0x3e/0x100 [ 732.938569] Call Trace: [ 732.939003] <IRQ> [ 732.939364] dma_fence_signal+0x29/0x50 [ 732.940036] drm_sched_fence_finished+0x12/0x20 [gpu_sched] [ 732.940996] drm_sched_process_job+0x34/0xa0 [gpu_sched] [ 732.941910] dma_fence_signal_locked+0x85/0x100 [ 732.942692] dma_fence_signal+0x29/0x50 [ 732.943457] amdgpu_fence_process+0x99/0x120 [amdgpu] [ 732.944393] sdma_v4_0_process_trap_irq+0x81/0xa0 [amdgpu]
v2: hold the finished fence at drm_sched_process_job instead of
amdgpu_fence_process
v3: resume the blank line
--- drivers/gpu/drm/scheduler/sched_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/scheduler/sched_main.c +2 -0
@@ -632,7 +632,9 @@ static void drm_sched_process_job(struct dma_fence *f, struct dma_fence_cb *cb)trace_drm_sched_process_job (s_fence); +dma_fence_get (&s_fence->finished);drm_sched_fence_finished (s_fence); +dma_fence_put (&s_fence->finished);wake_up_interruptible (&sched->wake_up_worker); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 23/257 cfg80211: Do not warn on same channel at the end of CSA
In reply to Greg Kroah-HartmanFrom: Ilan Peer <[email protected]>
[ Upstream commit 05dcb8bb258575a8dd3499d0d78bd2db633c2b23 ]
When cfg80211_update_assoc_bss_entry() is called, there is a verification that the BSS channel actually changed. As some APs use CSA also for bandwidth changes, this would result with a kernel warning.
Fix this by removing the WARN_ON().
--- net/wireless/scan.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/wireless/scan.c +5 -1
@@ -2022,7 +2022,11 @@ void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev,spin_lock_bh (&rdev->bss_lock); -if (WARN_ON (cbss->pub.channel == chan)) +/* +* Some APs use CSA also for bandwidth changes, i.e., without actually +* changing the control channel, so no need to update in such a case. +*/ +if (cbss->pub.channel == chan) goto done;/* use transmitting bss */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 24/257 qlcnic: Fix bad kzalloc null test
In reply to Greg Kroah-HartmanFrom: Xu Wang <[email protected]>
[ Upstream commit bcaeb886ade124331a6f3a5cef34a3f1484c0a03 ]
In qlcnic_83xx_get_reset_instruction_template, the variable of null test is bad, so correct it.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c +1 -1
@@ -1720,7 +1720,7 @@ static int qlcnic_83xx_get_reset_instruction_template(struct qlcnic_adapter *p_d ahw->reset.seq_error =0 ; ahw->reset.buff =kzalloc (QLC_83XX_RESTART_TEMPLATE_SIZE ,GFP_KERNEL ); -if (p_dev->ahw->reset.buff ==NULL ) +if (ahw->reset.buff ==NULL )return -ENOMEM ; p_buff = p_dev->ahw->reset.buff;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 25/257 i2c: st: fix missing struct parameter description
In reply to Greg Kroah-HartmanFrom: Alain Volmat <[email protected]>
[ Upstream commit f491c6687332920e296d0209e366fe2ca7eab1c6 ]
Fix a missing struct parameter description to allow warning free W=1 compilation.
--- drivers/i2c/busses/i2c-st.c | 1 + 1 file changed, 1 insertion(+)
drivers/i2c/busses/i2c-st.c +1 -0
@@ -434,6 +434,7 @@ static void st_i2c_wr_fill_tx_fifo(struct st_i2c_dev *i2c_dev)/** * st_i2c_rd_fill_tx_fifo() - Fill the Tx FIFO in read mode * @i2c_dev: Controller's private data +* @max: Maximum amount of data to fill into the Tx FIFO * * This functions fills the Tx FIFO with fixed pattern when * in read mode to trigger clock.
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 26/257 i2c: pca-platform: Use platform_irq_get_optional
In reply to Greg Kroah-HartmanFrom: Chris Packham <[email protected]>
[ Upstream commit 14c1fe699cad9cb0acda4559c584f136d18fea50 ]
The interrupt is not required so use platform_irq_get_optional() to avoid error messages like
i2c-pca-platform 22080000.i2c: IRQ index 0 not found
--- drivers/i2c/busses/i2c-pca-platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-pca-platform.c +1 -1
@@ -140,7 +140,7 @@ static int i2c_pca_pf_probe(struct platform_device *pdev)int ret =0 ;int irq; - irq =platform_get_irq (pdev,0 ); + irq =platform_get_irq_optional (pdev,0 );/* If irq is 0, we do polling. */ if (irq <0 ) irq =0 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 27/257 media: rc: add keymap for Videostrong KII Pro
In reply to Greg Kroah-HartmanFrom: Mohammad Rasim <[email protected]>
[ Upstream commit 30defecb98400575349a7d32f0526e1dc42ea83e ]
This is an NEC remote control device shipped with the Videostrong KII Pro tv box as well as other devices from videostrong.
--- drivers/media/rc/keymaps/Makefile | 1 + .../media/rc/keymaps/rc-videostrong-kii-pro.c | 83 +++++++++++++++++++ include/media/rc-map.h | 1 + 3 files changed, 85 insertions(+) create mode 100644 drivers/media/rc/keymaps/rc-videostrong-kii-pro.c
drivers/media/rc/keymaps/Makefile +1 -0
@@ -119,6 +119,7 @@ obj-$(CONFIG_RC_MAP) += rc-adstech-dvb-t-pci.o \ rc-videomate-m1f.o \ rc-videomate-s350.o \ rc-videomate-tv-pvr.o \ + rc-videostrong-kii-pro.o \ rc-wetek-hub.o \ rc-wetek-play2.o \ rc-winfast.o \
drivers/media/rc/keymaps/rc-videostrong-kii-pro.c new file +83 -0
83 lines not on this page · raw message
include/media/rc-map.h +1 -0
@@ -274,6 +274,7 @@ struct rc_map *rc_map_get(const char *name);#define RC_MAP_VIDEOMATE_K100 "rc-videomate-k100"#define RC_MAP_VIDEOMATE_S350 "rc-videomate-s350"#define RC_MAP_VIDEOMATE_TV_PVR "rc-videomate-tv-pvr" +#define RC_MAP_KII_PRO "rc-videostrong-kii-pro"#define RC_MAP_WETEK_HUB "rc-wetek-hub"#define RC_MAP_WETEK_PLAY2 "rc-wetek-play2"#define RC_MAP_WINFAST "rc-winfast"
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 28/257 cpufreq: imx6q: Fixes unwanted cpu overclocking on i.MX6ULL
In reply to Greg Kroah-HartmanFrom: Christoph Niedermaier <[email protected]>
[ Upstream commit 36eb7dc1bd42fe5f850329c893768ff89b696fba ]
imx6ul_opp_check_speed_grading is called for both i.MX6UL and i.MX6ULL. Since the i.MX6ULL was introduced to a separate ocotp compatible node later, it is possible that the i.MX6ULL has also dtbs with "fsl,imx6ull-ocotp". On a system without nvmem-cell speed grade a missing check on this node causes a driver fail without considering the cpu speed grade.
This patch prevents unwanted cpu overclocking on i.MX6ULL with compatible node "fsl,imx6ull-ocotp" in old dtbs without nvmem-cell speed grade.
--- drivers/cpufreq/imx6q-cpufreq.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/cpufreq/imx6q-cpufreq.c +3 -0
@@ -280,6 +280,9 @@ static int imx6ul_opp_check_speed_grading(struct device *dev)void __iomem *base; np =of_find_compatible_node (NULL ,NULL ,"fsl,imx6ul-ocotp" ); +if (!np) + np =of_find_compatible_node (NULL ,NULL , +"fsl,imx6ull-ocotp" );if (!np)return -ENOENT ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 29/257 EDAC/mc: Report "unknown memory" on too many DIMM labels found
In reply to Greg Kroah-HartmanFrom: Robert Richter <[email protected]>
[ Upstream commit 65bb4d1af92cf007adc0a0c59dadcc393c5cada6 ]
There is a limitation to report only EDAC_MAX_LABELS in e->label of the error descriptor. This is to prevent a potential string overflow.
The current implementation falls back to "any memory" in this case and also stops all further processing to find a unique row and channel of the possible error location.
Reporting "any memory" is wrong as the memory controller reported an error location for one of the layers. Instead, report "unknown memory" and also do not break early in the loop to further check row and channel for uniqueness.
[ bp: Massage commit message. ]
--- drivers/edac/edac_mc.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
drivers/edac/edac_mc.c +11 -10
@@ -1180,20 +1180,21 @@ void edac_mc_handle_error(const enum hw_event_mc_err_type type,* channel/memory controller/... may be affected. * Also, don't show errors for empty DIMM slots. */ -if (!e->enable_per_layer_report || !dimm->nr_pages) +if (!dimm->nr_pages)continue ; -if (n_labels >=EDAC_MAX_LABELS ) { - e->enable_per_layer_report = false; -break ; - } n_labels++; -if (p != e->label) { -strcpy (p,OTHER_LABEL ); - p +=strlen (OTHER_LABEL ); +if (n_labels >EDAC_MAX_LABELS ) { + p = e->label; + *p ='\0' ; + }else { +if (p != e->label) { +strcpy (p,OTHER_LABEL ); + p +=strlen (OTHER_LABEL ); + } +strcpy (p, dimm->label); + p +=strlen (p); } -strcpy (p, dimm->label); - p +=strlen (p);/* * get csrow/channel of the DIMM, in order to allow
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 30/257 usb: ucsi: ccg: disable runtime pm during fw flashing
In reply to Greg Kroah-HartmanFrom: Ajay Gupta <[email protected]>
[ Upstream commit 57a5e5f936be583d2c6cef3661c169e3ea4bf922 ]
Ucsi ppm is unregistered during fw flashing so disable runtime pm also and reenable after fw flashing is completed and ppm is re-registered.
--- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/typec/ucsi/ucsi_ccg.c +2 -0
@@ -1032,6 +1032,7 @@ static int ccg_restart(struct ucsi_ccg *uc)return status; } +pm_runtime_enable (uc->dev);return 0 ; }
@@ -1047,6 +1048,7 @@ static void ccg_update_firmware(struct work_struct *work)if (flash_mode !=FLASH_NOT_NEEDED ) {ucsi_unregister (uc->ucsi); +pm_runtime_disable (uc->dev);free_irq (uc->irq, uc);ccg_fw_update (uc, flash_mode);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 31/257 staging: wilc1000: avoid double unlocking of wilc->hif_cs mutex
In reply to Greg Kroah-HartmanFrom: Ajay Singh <[email protected]>
[ Upstream commit 6c411581caef6e3b2c286871641018364c6db50a ]
Possible double unlocking of 'wilc->hif_cs' mutex was identified by smatch [1]. Removed the extra call to release_bus() in wilc_wlan_handle_txq() which was missed in earlier commit fdc2ac1aafc6 ("staging: wilc1000: support suspend/resume functionality").
[1]. https://lists.01.org/hyperkitty/list/[email protected]/thread/NOEVW7C3GV74EWXJO3XX6VT2NKVB2HMT/
--- drivers/staging/wilc1000/wlan.c | 1 - 1 file changed, 1 deletion(-)
drivers/staging/wilc1000/wlan.c +0 -1
@@ -578,7 +578,6 @@ int wilc_wlan_handle_txq(struct wilc *wilc, u32 *txq_count) entries = ((reg >>3 ) &0x3f );break ; } -release_bus (wilc,WILC_BUS_RELEASE_ALLOW_SLEEP ); }while (--timeout);if (timeout <=0 ) { ret = func->hif_write_reg (wilc,WILC_HOST_VMM_CTL ,0x0 );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 32/257 media: vimc: streamer: fix memory leak in vimc subdevs if kthread_run fails
In reply to Greg Kroah-HartmanFrom: Dafna Hirschfeld <[email protected]>
[ Upstream commit ceeb2e6166dddf3c9757abbbf84032027e2fa2d2 ]
In case kthread_run fails, the vimc subdevices should be notified that streaming stopped so they can release the memory for the streaming. Also, kthread should be set to NULL.
--- drivers/media/platform/vimc/vimc-streamer.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/media/platform/vimc/vimc-streamer.c +7 -2
@@ -207,8 +207,13 @@ int vimc_streamer_s_stream(struct vimc_stream *stream, stream->kthread =kthread_run (vimc_streamer_thread, stream,"vimc-streamer thread" ); -if (IS_ERR (stream->kthread)) -return PTR_ERR (stream->kthread); +if (IS_ERR (stream->kthread)) { + ret =PTR_ERR (stream->kthread); +dev_err (ved->dev,"kthread_run failed with %d\n" , ret); +vimc_streamer_pipeline_terminate (stream); + stream->kthread =NULL ; +return ret; + } }else {if (!stream->kthread)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 33/257 media: venus: hfi_parser: Ignore HEVC encoding for V1
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
[ Upstream commit c50cc6dc6c48300af63a6fbc71b647053c15fc80 ]
Some older MSM8916 Venus firmware versions also seem to indicate support for encoding HEVC, even though they really can't. This will lead to errors later because hfi_session_init() fails in this case.
HEVC is already ignored for "dec_codecs", so add the same for "enc_codecs" to make these old firmware versions work correctly.
--- drivers/media/platform/qcom/venus/hfi_parser.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/qcom/venus/hfi_parser.c +1 -0
@@ -181,6 +181,7 @@ static void parse_codecs(struct venus_core *core, void *data)if (IS_V1 (core)) { core->dec_codecs &= ~HFI_VIDEO_CODEC_HEVC ; core->dec_codecs &= ~HFI_VIDEO_CODEC_SPARK ; + core->enc_codecs &= ~HFI_VIDEO_CODEC_HEVC ; } }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 34/257 firmware: arm_sdei: fix double-lock on hibernate with shared events
In reply to Greg Kroah-HartmanFrom: James Morse <[email protected]>
[ Upstream commit 6ded0b61cf638bf9f8efe60ab8ba23db60ea9763 ]
SDEI has private events that must be registered on each CPU. When CPUs come and go they must re-register and re-enable their private events. Each event has flags to indicate whether this should happen to protect against an event being registered on a CPU coming online, while all the others are unregistering the event.
These flags are protected by the sdei_list_lock spinlock, because the cpuhp callbacks can't take the mutex.
Hibernate needs to unregister all events, but keep the in-memory re-register and re-enable as they are. sdei_unregister_shared() takes the spinlock to walk the list, then calls _sdei_event_unregister() on each shared event. _sdei_event_unregister() tries to take the same spinlock to update re-register and re-enable. This doesn't go so well.
Push the re-register and re-enable updates out to their callers. sdei_unregister_shared() doesn't want these values updated, so doesn't need to do anything.
This also fixes shared events getting lost over hibernate as this path made them look unregistered.
--- drivers/firmware/arm_sdei.c | 32 +++++++++++++++----------------- 1 file changed, 15 insertions(+), 17 deletions(-)
drivers/firmware/arm_sdei.c +15 -17
@@ -491,11 +491,6 @@ static int _sdei_event_unregister(struct sdei_event *event) {lockdep_assert_held (&sdei_events_lock); -spin_lock (&sdei_list_lock); - event->reregister = false; - event->reenable = false; -spin_unlock (&sdei_list_lock); -if (event->type ==SDEI_EVENT_TYPE_SHARED )return sdei_api_event_unregister (event->event_num);
@@ -518,6 +513,11 @@ int sdei_event_unregister(u32 event_num)break ; } +spin_lock (&sdei_list_lock); + event->reregister = false; + event->reenable = false; +spin_unlock (&sdei_list_lock); + err =_sdei_event_unregister (event);if (err)break ;
@@ -585,26 +585,15 @@ static int _sdei_event_register(struct sdei_event *event)lockdep_assert_held (&sdei_events_lock); -spin_lock (&sdei_list_lock); - event->reregister = true; -spin_unlock (&sdei_list_lock); -if (event->type ==SDEI_EVENT_TYPE_SHARED )return sdei_api_event_register (event->event_num, sdei_entry_point, event->registered,SDEI_EVENT_REGISTER_RM_ANY ,0 ); - err =sdei_do_cross_call (_local_event_register, event); -if (err) { -spin_lock (&sdei_list_lock); - event->reregister = false; - event->reenable = false; -spin_unlock (&sdei_list_lock); - +if (err)sdei_do_cross_call (_local_event_unregister, event); - }return err; }
@@ -632,8 +621,17 @@ int sdei_event_register(u32 event_num, sdei_event_callback *cb, void *arg)break ; } +spin_lock (&sdei_list_lock); + event->reregister = true; +spin_unlock (&sdei_list_lock); + err =_sdei_event_register (event);if (err) { +spin_lock (&sdei_list_lock); + event->reregister = false; + event->reenable = false; +spin_unlock (&sdei_list_lock); +sdei_event_destroy (event);pr_warn ("Failed to register event %u: %d\n" , event_num, err);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 35/257 sched/vtime: Prevent unstable evaluation of WARN(vtime->state)
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
[ Upstream commit f1dfdab694eb3838ac26f4b73695929c07d92a33 ]
As the vtime is sampled under loose seqcount protection by kcpustat, the vtime fields may change as the code flows. Where logic dictates a field has a static value, use a READ_ONCE.
--- kernel/sched/cputime.c | 41 ++++++++++++++++++++++------------------- 1 file changed, 22 insertions(+), 19 deletions(-)
kernel/sched/cputime.c +22 -19
@@ -912,8 +912,10 @@ void task_cputime(struct task_struct *t, u64 *utime, u64 *stime) }while (read_seqcount_retry (&vtime->seqcount, seq)); } -static int vtime_state_check (struct vtime *vtime,int cpu) +static int vtime_state_fetch (struct vtime *vtime,int cpu) { +int state =READ_ONCE (vtime->state); +/* * We raced against a context switch, fetch the * kcpustat task again.
@@ -930,10 +932,10 @@ static int vtime_state_check(struct vtime *vtime, int cpu)* * Case 1) is ok but 2) is not. So wait for a safe VTIME state. */ -if (vtime->state ==VTIME_INACTIVE ) +if (state ==VTIME_INACTIVE )return -EAGAIN ; -return 0 ; +return state; }static u64 kcpustat_user_vtime (struct vtime *vtime)
@@ -952,14 +954,15 @@ static int kcpustat_field_vtime(u64 *cpustat, {struct vtime *vtime = &tsk->vtime;unsigned int seq; -int err; do { + int state; + seq = read_seqcount_begin(&vtime->seqcount); - err = vtime_state_check(vtime, cpu); - if (err < 0) - return err; + state = vtime_state_fetch(vtime, cpu); + if (state < 0) + return state; *val = cpustat[usage];
@@ -972,7 +975,7 @@ static int kcpustat_field_vtime(u64 *cpustat,*/ switch (usage) {case CPUTIME_SYSTEM : -if (vtime->state ==VTIME_SYS ) +if (state ==VTIME_SYS ) *val += vtime->stime +vtime_delta (vtime);break ;case CPUTIME_USER :
@@ -984,11 +987,11 @@ static int kcpustat_field_vtime(u64 *cpustat, *val +=kcpustat_user_vtime (vtime);break ;case CPUTIME_GUEST : -if (vtime->state ==VTIME_GUEST &&task_nice (tsk) <=0 ) +if (state ==VTIME_GUEST &&task_nice (tsk) <=0 ) *val += vtime->gtime +vtime_delta (vtime);break ;case CPUTIME_GUEST_NICE : -if (vtime->state ==VTIME_GUEST &&task_nice (tsk) >0 ) +if (state ==VTIME_GUEST &&task_nice (tsk) >0 ) *val += vtime->gtime +vtime_delta (vtime);break ;default :
@@ -1039,23 +1042,23 @@ static int kcpustat_cpu_fetch_vtime(struct kernel_cpustat *dst, {struct vtime *vtime = &tsk->vtime;unsigned int seq; -int err; do { u64 *cpustat; u64 delta; + int state; seq = read_seqcount_begin(&vtime->seqcount); - err = vtime_state_check(vtime, cpu); - if (err < 0) - return err; + state = vtime_state_fetch(vtime, cpu); + if (state < 0) + return state; *dst = *src; cpustat = dst->cpustat; /* Task is sleeping, dead or idle, nothing to add */ - if (vtime->state < VTIME_SYS) + if (state < VTIME_SYS) continue; delta = vtime_delta(vtime);
@@ -1064,15 +1067,15 @@ static int kcpustat_cpu_fetch_vtime(struct kernel_cpustat *dst,* Task runs either in user (including guest) or kernel space, * add pending nohz time to the right place. */ -if (vtime->state ==VTIME_SYS ) { +if (state ==VTIME_SYS ) { cpustat[CPUTIME_SYSTEM ] += vtime->stime + delta; - }else if (vtime->state ==VTIME_USER ) { + }else if (state ==VTIME_USER ) {if (task_nice (tsk) >0 ) cpustat[CPUTIME_NICE ] += vtime->utime + delta;else cpustat[CPUTIME_USER ] += vtime->utime + delta; }else { -WARN_ON_ONCE (vtime->state !=VTIME_GUEST ); +WARN_ON_ONCE (state !=VTIME_GUEST );if (task_nice (tsk) >0 ) { cpustat[CPUTIME_GUEST_NICE ] += vtime->gtime + delta; cpustat[CPUTIME_NICE ] += vtime->gtime + delta;
@@ -1083,7 +1086,7 @@ static int kcpustat_cpu_fetch_vtime(struct kernel_cpustat *dst, } }while (read_seqcount_retry (&vtime->seqcount, seq)); -return err; +return 0 ; }void kcpustat_cpu_fetch (struct kernel_cpustat *dst,int cpu)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 36/257 null_blk: Fix the null_add_dev() error path
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 2004bfdef945fe55196db6b9cdf321fbc75bb0de ]
If null_add_dev() fails, clear dev->nullb.
This patch fixes the following KASAN complaint:
BUG: KASAN: use-after-free in nullb_device_submit_queues_store+0xcf/0x160 [null_blk] Read of size 8 at addr ffff88803280fc30 by task check/8409 Call Trace: dump_stack+0xa5/0xe6 print_address_description.constprop.0+0x26/0x260 __kasan_report.cold+0x7b/0x99 kasan_report+0x16/0x20 __asan_load8+0x58/0x90 nullb_device_submit_queues_store+0xcf/0x160 [null_blk] configfs_write_file+0x1c4/0x250 [configfs] __vfs_write+0x4c/0x90 vfs_write+0x145/0x2c0 ksys_write+0xd7/0x180 __x64_sys_write+0x47/0x50 do_syscall_64+0x6f/0x2f0 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7ff370926317 Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007fff2dd2da48 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007ff370926317 RDX: 0000000000000002 RSI: 0000559437ef23f0 RDI: 0000000000000001 RBP: 0000559437ef23f0 R08: 000000000000000a R09: 0000000000000001 R10: 0000559436703471 R11: 0000000000000246 R12: 0000000000000002 R13: 00007ff370a006a0 R14: 00007ff370a014a0 R15: 00007ff370a008a0 Allocated by task 8409: save_stack+0x23/0x90 __kasan_kmalloc.constprop.0+0xcf/0xe0 kasan_kmalloc+0xd/0x10 kmem_cache_alloc_node_trace+0x129/0x4c0 null_add_dev+0x24a/0xe90 [null_blk] nullb_device_power_store+0x1b6/0x270 [null_blk] configfs_write_file+0x1c4/0x250 [configfs] __vfs_write+0x4c/0x90 vfs_write+0x145/0x2c0 ksys_write+0xd7/0x180 __x64_sys_write+0x47/0x50 do_syscall_64+0x6f/0x2f0 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 8409: save_stack+0x23/0x90 __kasan_slab_free+0x112/0x160 kasan_slab_free+0x12/0x20 kfree+0xdf/0x250 null_add_dev+0xaf3/0xe90 [null_blk] nullb_device_power_store+0x1b6/0x270 [null_blk] configfs_write_file+0x1c4/0x250 [configfs] __vfs_write+0x4c/0x90 vfs_write+0x145/0x2c0 ksys_write+0xd7/0x180 __x64_sys_write+0x47/0x50 do_syscall_64+0x6f/0x2f0 entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- drivers/block/null_blk_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/block/null_blk_main.c +1 -0
@@ -1790,6 +1790,7 @@ out_cleanup_queues:cleanup_queues (nullb); out_free_nullb:kfree (nullb); + dev->nullb =NULL ; out:return rv; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 37/257 blk-mq: Fix a recently introduced regression in blk_mq_realloc_hw_ctxs()
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit d0930bb8f46b8fb4a7d429c0bf1c91b3ed00a7cf ]
q->nr_hw_queues must only be updated once it is known that blk_mq_realloc_hw_ctxs() has succeeded. Otherwise it can happen that reallocation fails and that q->nr_hw_queues is larger than the number of allocated hardware queues. This patch fixes the following crash if increasing the number of hardware queues fails:
BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0x775/0x810 Write of size 8 at addr 0000000000000118 by task check/977 CPU: 3 PID: 977 Comm: check Not tainted 5.6.0-rc1-dbg+ #8 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack+0xa5/0xe6 __kasan_report.cold+0x65/0x99 kasan_report+0x16/0x20 check_memory_region+0x140/0x1b0 memset+0x28/0x40 blk_mq_map_swqueue+0x775/0x810 blk_mq_update_nr_hw_queues+0x468/0x710 nullb_device_submit_queues_store+0xf7/0x1a0 [null_blk] configfs_write_file+0x1c4/0x250 [configfs] __vfs_write+0x4c/0x90 vfs_write+0x145/0x2c0 ksys_write+0xd7/0x180 __x64_sys_write+0x47/0x50 do_syscall_64+0x6f/0x2f0 entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- block/blk-mq.c | 1 - 1 file changed, 1 deletion(-)
block/blk-mq.c +0 -1
@@ -2766,7 +2766,6 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,memcpy (new_hctxs, hctxs, q->nr_hw_queues *sizeof (*hctxs)); q->queue_hw_ctx = new_hctxs; - q->nr_hw_queues = set->nr_hw_queues;kfree (hctxs); hctxs = new_hctxs; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 38/257 null_blk: Handle null_add_dev() failures properly
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 9b03b713082a31a5b90e0a893c72aa620e255c26 ]
If null_add_dev() fails then null_del_dev() is called with a NULL argument. Make null_del_dev() handle this scenario correctly. This patch fixes the following KASAN complaint:
null-ptr-deref in null_del_dev+0x28/0x280 [null_blk]
Read of size 8 at addr 0000000000000000 by task find/1062 Call Trace: dump_stack+0xa5/0xe6 __kasan_report.cold+0x65/0x99 kasan_report+0x16/0x20 __asan_load8+0x58/0x90 null_del_dev+0x28/0x280 [null_blk] nullb_group_drop_item+0x7e/0xa0 [null_blk] client_drop_item+0x53/0x80 [configfs] configfs_rmdir+0x395/0x4e0 [configfs] vfs_rmdir+0xb6/0x220 do_rmdir+0x238/0x2c0 __x64_sys_unlinkat+0x75/0x90 do_syscall_64+0x6f/0x2f0 entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- drivers/block/null_blk_main.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/block/null_blk_main.c +6 -1
@@ -1432,7 +1432,12 @@ static void cleanup_queues(struct nullb *nullb)static void null_del_dev (struct nullb *nullb) { -struct nullb_device *dev = nullb->dev; +struct nullb_device *dev; + +if (!nullb) +return ; + + dev = nullb->dev;ida_simple_remove (&nullb_indexes, nullb->index);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 39/257 null_blk: fix spurious IO errors after failed past-wp access
In reply to Greg Kroah-HartmanFrom: Alexey Dobriyan <[email protected]>
[ Upstream commit ff77042296d0a54535ddf74412c5ae92cb4ec76a ]
Steps to reproduce:
BLKRESETZONE zone 0 // force EIO pwrite(fd, buf, 4096, 4096); [issue more IO including zone ioctls]
It will start failing randomly including IO to unrelated zones because of ->error "reuse". Trigger can be partition detection as well if test is not run immediately which is even more entertaining.
The fix is of course to clear ->error where necessary.
--- drivers/block/null_blk_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/block/null_blk_main.c +2 -0
@@ -605,6 +605,7 @@ static struct nullb_cmd *__alloc_cmd(struct nullb_queue *nq)if (tag !=-1U ) { cmd = &nq->cmds[tag]; cmd->tag = tag; + cmd->error =BLK_STS_OK ; cmd->nq = nq;if (nq->dev->irqmode ==NULL_IRQ_TIMER ) { hrtimer_init(&cmd->timer, CLOCK_MONOTONIC,
@@ -1385,6 +1386,7 @@ static blk_status_t null_queue_rq(struct blk_mq_hw_ctx *hctx, cmd->timer.function = null_cmd_timer_expired; } cmd->rq = bd->rq; + cmd->error =BLK_STS_OK ; cmd->nq = nq;blk_mq_start_request (bd->rq);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 40/257 media: imx: imx7_mipi_csis: Power off the source when stopping streaming
In reply to Greg Kroah-HartmanFrom: Laurent Pinchart <[email protected]>
[ Upstream commit 770cbf89f90b0663499dbb3f03aa81b3322757ec ]
The .s_stream() implementation incorrectly powers on the source when stopping the stream. Power it off instead.
--- drivers/staging/media/imx/imx7-mipi-csis.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/media/imx/imx7-mipi-csis.c +1 -1
@@ -579,7 +579,7 @@ static int mipi_csis_s_stream(struct v4l2_subdev *mipi_sd, int enable) state->flags |=ST_STREAMING ; }else {v4l2_subdev_call (state->src_sd, video, s_stream,0 ); - ret =v4l2_subdev_call (state->src_sd, core, s_power,1 ); + ret =v4l2_subdev_call (state->src_sd, core, s_power,0 );mipi_csis_stop_stream (state); state->flags &= ~ST_STREAMING ;if (state->debug)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 41/257 media: imx: imx7-media-csi: Fix video field handling
In reply to Greg Kroah-HartmanFrom: Laurent Pinchart <[email protected]>
[ Upstream commit f7b8488bd39ae8feced4dfbb41cf1431277b893f ]
Commit 4791bd7d6adc ("media: imx: Try colorimetry at both sink and source pads") reworked the way that formats are set on the sink pad of the CSI subdevice, and accidentally removed video field handling. Restore it by defaulting to V4L2_FIELD_NONE if the field value isn't supported, with the only two supported value being V4L2_FIELD_NONE and V4L2_FIELD_INTERLACED.
--- drivers/staging/media/imx/imx7-media-csi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/staging/media/imx/imx7-media-csi.c +4 -0
@@ -1009,6 +1009,7 @@ static int imx7_csi_try_fmt(struct imx7_csi *csi, sdformat->format.width = in_fmt->width; sdformat->format.height = in_fmt->height; sdformat->format.code = in_fmt->code; + sdformat->format.field = in_fmt->field; *cc = in_cc; sdformat->format.colorspace = in_fmt->colorspace;
@@ -1023,6 +1024,9 @@ static int imx7_csi_try_fmt(struct imx7_csi *csi, false); sdformat->format.code = (*cc)->codes[0 ]; } + +if (sdformat->format.field !=V4L2_FIELD_INTERLACED ) + sdformat->format.field =V4L2_FIELD_NONE ;break ;default :return -EINVAL ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 42/257 xhci: bail out early if driver cant accress host in resume
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
[ Upstream commit 72ae194704da212e2ec312ab182a96799d070755 ]
Bail out early if the xHC host needs to be reset at resume but driver can't access xHC PCI registers.
If xhci driver already fails to reset the controller then there is no point in attempting to free, re-initialize, re-allocate and re-start the host. If failure to access the host is detected later, failing the resume, xhci interrupts will be double freed when remove is called.
--- drivers/usb/host/xhci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/xhci.c +3 -1
@@ -1157,8 +1157,10 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)xhci_dbg (xhci,"Stop HCD\n" );xhci_halt (xhci);xhci_zero_64b_regs (xhci); -xhci_reset (xhci); + retval =xhci_reset (xhci);spin_unlock_irq (&xhci->lock); +if (retval) +return retval;xhci_cleanup_msix (xhci);xhci_dbg (xhci,"// Disabling event ring interrupts\n" );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 43/257 ACPI: EC: Do not clear boot_ec_is_ecdt in acpi_ec_add()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit 65a691f5f8f0bb63d6a82eec7b0ffd193d8d8a5f ]
The reason for clearing boot_ec_is_ecdt in acpi_ec_add() (if a PNP0C09 device object matching the ECDT boot EC had been found in the namespace) was to cause acpi_ec_ecdt_start() to return early, but since the latter does not look at boot_ec_is_ecdt any more, acpi_ec_add() need not clear it.
Moreover, doing that may be confusing as it may cause "DSDT" to be printed instead of "ECDT" in the EC initialization completion message, so stop doing it.
While at it, split the EC initialization completion message into two messages, one regarding the boot EC and another one printed regardless of whether or not the EC at hand is the boot one.
--- drivers/acpi/ec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/acpi/ec.c +4 -2
@@ -1649,7 +1649,6 @@ static int acpi_ec_add(struct acpi_device *device)if (boot_ec && ec->command_addr == boot_ec->command_addr && ec->data_addr == boot_ec->data_addr) { - boot_ec_is_ecdt = false;/* * Trust PNP0C09 namespace location rather than * ECDT ID. But trust ECDT GPE rather than _GPE
@@ -1669,9 +1668,12 @@ static int acpi_ec_add(struct acpi_device *device)if (ec == boot_ec)acpi_handle_info (boot_ec->handle, -"Boot %s EC used to handle transactions and events\n" , +"Boot %s EC initialization complete\n" , boot_ec_is_ecdt ?"ECDT" :"DSDT" ); +acpi_handle_info (ec->handle, +"EC: Used to handle transactions and events\n" ); + device->driver_data = ec; ret = !!request_region (ec->data_addr,1 ,"EC data" );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 44/257 x86: Dont let pgprot_modify() change the page encryption bit
In reply to Greg Kroah-HartmanFrom: Thomas Hellstrom <[email protected]>
[ Upstream commit 6db73f17c5f155dbcfd5e48e621c706270b84df0 ]
When SEV or SME is enabled and active, vm_get_page_prot() typically returns with the encryption bit set. This means that users of pgprot_modify(, vm_get_page_prot()) (mprotect_fixup(), do_mmap()) end up with a value of vma->vm_pg_prot that is not consistent with the intended protection of the PTEs.
This is also important for fault handlers that rely on the VMA vm_page_prot to set the page protection. Fix this by not allowing pgprot_modify() to change the encryption bit, similar to how it's done for PAT bits.
--- arch/x86/include/asm/pgtable.h | 7 +++++-- arch/x86/include/asm/pgtable_types.h | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-)
arch/x86/include/asm/pgtable.h +5 -2
@@ -624,12 +624,15 @@ static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)return __pmd (val); } -/* mprotect needs to preserve PAT bits when updating vm_page_prot */ +/* +* mprotect needs to preserve PAT and encryption bits when updating +* vm_page_prot +*/ #define pgprot_modify pgprot_modifystatic inline pgprot_t pgprot_modify (pgprot_t oldprot,pgprot_t newprot) {pgprotval_t preservebits =pgprot_val (oldprot) & _PAGE_CHG_MASK; -pgprotval_t addbits =pgprot_val (newprot); +pgprotval_t addbits =pgprot_val (newprot) & ~_PAGE_CHG_MASK;return __pgprot (preservebits | addbits); }
arch/x86/include/asm/pgtable_types.h +1 -1
@@ -123,7 +123,7 @@*/ #define _PAGE_CHG_MASK (PTE_PFN_MASK | _PAGE_PCD | _PAGE_PWT | \ _PAGE_SPECIAL | _PAGE_ACCESSED | _PAGE_DIRTY | \ - _PAGE_SOFT_DIRTY | _PAGE_DEVMAP) + _PAGE_SOFT_DIRTY | _PAGE_DEVMAP | _PAGE_ENC)#define _HPAGE_CHG_MASK (_PAGE_CHG_MASK | _PAGE_PSE)/*
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 45/257 dma-mapping: Fix dma_pgprot() for unencrypted coherent pages
In reply to Greg Kroah-HartmanFrom: Thomas Hellstrom <[email protected]>
[ Upstream commit 17c4a2ae15a7aaefe84bdb271952678c5c9cd8e1 ]
When dma_mmap_coherent() sets up a mapping to unencrypted coherent memory under SEV encryption and sometimes under SME encryption, it will actually set up an encrypted mapping rather than an unencrypted, causing devices that DMAs from that memory to read encrypted contents. Fix this.
When force_dma_unencrypted() returns true, the linear kernel map of the coherent pages have had the encryption bit explicitly cleared and the page content is unencrypted. Make sure that any additional PTEs we set up to these pages also have the encryption bit cleared by having dma_pgprot() return a protection with the encryption bit cleared in this case.
--- kernel/dma/mapping.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/dma/mapping.c +2 -0
@@ -154,6 +154,8 @@ EXPORT_SYMBOL(dma_get_sgtable_attrs);*/ pgprot_t dma_pgprot (struct device *dev,pgprot_t prot,unsigned long attrs) { +if (force_dma_unencrypted (dev)) + prot =pgprot_decrypted (prot);if (dev_is_dma_coherent (dev) || (IS_ENABLED (CONFIG_DMA_NONCOHERENT_CACHE_SYNC ) && (attrs &DMA_ATTR_NON_CONSISTENT )))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 46/257 block: keep bdi->io_pages in sync with max_sectors_kb for stacked devices
In reply to Greg Kroah-HartmanFrom: Konstantin Khlebnikov <[email protected]>
[ Upstream commit e74d93e96d721c4297f2a900ad0191890d2fc2b0 ]
Field bdi->io_pages added in commit 9491ae4aade6 ("mm: don't cap request size based on read-ahead setting") removes unneeded split of read requests.
Stacked drivers do not call blk_queue_max_hw_sectors(). Instead they set limits of their devices by blk_set_stacking_limits() + disk_stack_limits(). Field bio->io_pages stays zero until user set max_sectors_kb via sysfs.
This patch updates io_pages after merging limits in disk_stack_limits().
Commit c6d6e9b0f6b4 ("dm: do not allow readahead to limit IO size") fixed the same problem for device-mapper devices, this one fixes MD RAIDs.
--- block/blk-settings.c | 3 +++ 1 file changed, 3 insertions(+)
block/blk-settings.c +3 -0
@@ -664,6 +664,9 @@ void disk_stack_limits(struct gendisk *disk, struct block_device *bdev,printk (KERN_NOTICE "%s: Warning: Device %s is misaligned\n" , top, bottom); } + + t->backing_dev_info->io_pages = + t->limits.max_sectors >> (PAGE_SHIFT -9 ); }EXPORT_SYMBOL (disk_stack_limits);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 47/257 debugfs: Check module state before warning in {full/open}_proxy_open()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 275678e7a9be6a0ea9c1bb493e48abf2f4a01be5 ]
When the module is being removed, the module state is set to MODULE_STATE_GOING. At this point, try_module_get() fails. And when {full/open}_proxy_open() is being called,
it calls try_module_get() to try to hold module reference count. If it fails, it warns about the possibility of debugfs file leak.
If {full/open}_proxy_open() is called while the module is being removed, it fails to hold the module.
So, It warns about debugfs file leak. But it is not the debugfs file leak case. So, this patch just adds module state checking routine in the {full/open}_proxy_open().
Test commands:
#SHELL1
while :
do
modprobe netdevsim
echo 1 > /sys/bus/netdevsim/new_device
modprobe -rv netdevsim
done
#SHELL2
while :
do
cat /sys/kernel/debug/netdevsim/netdevsim1/ports/0/ipsec
done
Splat looks like:
[ 298.766738][T14664] debugfs file owner did not clean up at exit: ipsec [ 298.766766][T14664] WARNING: CPU: 2 PID: 14664 at fs/debugfs/file.c:312 full_proxy_open+0x10f/0x650 [ 298.768595][T14664] Modules linked in: netdevsim(-) openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 n][ 298.771343][T14664] CPU: 2 PID: 14664 Comm: cat Tainted: G W 5.5.0+ #1 [ 298.772373][T14664] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 298.773545][T14664] RIP: 0010:full_proxy_open+0x10f/0x650 [ 298.774247][T14664] Code: 48 c1 ea 03 80 3c 02 00 0f 85 c1 04 00 00 49 8b 3c 24 e8 e4 b5 78 ff 84 c0 75 2d 4c 89 ee 48 [ 298.776782][T14664] RSP: 0018:ffff88805b7df9b8 EFLAGS: 00010282[ 298.777583][T14664] RAX: dffffc0000000008 RBX: ffff8880511725c0 RCX: 0000000000000000 [ 298.778610][T14664] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffff8880540c5c14 [ 298.779637][T14664] RBP: 0000000000000000 R08: fffffbfff15235ad R09: 0000000000000000 [ 298.780664][T14664] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffffc06b5000 [ 298.781702][T14664] R13: ffff88804c234a88 R14: ffff88804c22dd00 R15: ffffffff8a1b5660 [ 298.782722][T14664] FS: 00007fafa13a8540(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000 [ 298.783845][T14664] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 298.784672][T14664] CR2: 00007fafa0e9cd10 CR3: 000000004b286005 CR4: 00000000000606e0 [ 298.785739][T14664] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 298.786769][T14664] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 298.787785][T14664] Call Trace: [ 298.788237][T14664] do_dentry_open+0x63c/0xf50 [ 298.788872][T14664] ? open_proxy_open+0x270/0x270 [ 298.789524][T14664] ? __x64_sys_fchdir+0x180/0x180 [ 298.790169][T14664] ? inode_permission+0x65/0x390 [ 298.790832][T14664] path_openat+0xc45/0x2680 [ 298.791425][T14664] ? save_stack+0x69/0x80 [ 298.791988][T14664] ? save_stack+0x19/0x80 [ 298.792544][T14664] ? path_mountpoint+0x2e0/0x2e0 [ 298.793233][T14664] ? check_chain_key+0x236/0x5d0 [ 298.793910][T14664] ? sched_clock_cpu+0x18/0x170 [ 298.794527][T14664] ? find_held_lock+0x39/0x1d0 [ 298.795153][T14664] do_filp_open+0x16a/0x260
[ ... ]
--- fs/debugfs/file.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
fs/debugfs/file.c +14 -4
@@ -175,8 +175,13 @@ static int open_proxy_open(struct inode *inode, struct file *filp)if (r) goto out; - real_fops =fops_get (real_fops); -if (!real_fops) { +if (!fops_get (real_fops)) { +#ifdef MODULE +if (real_fops->owner && + real_fops->owner->state ==MODULE_STATE_GOING ) + goto out; +#endif +/* Huh? Module did not clean up after itself at exit? */ WARN (1 ,"debugfs file owner did not clean up at exit: %pd" , dentry);
@@ -305,8 +310,13 @@ static int full_proxy_open(struct inode *inode, struct file *filp)if (r) goto out; - real_fops =fops_get (real_fops); -if (!real_fops) { +if (!fops_get (real_fops)) { +#ifdef MODULE +if (real_fops->owner && + real_fops->owner->state ==MODULE_STATE_GOING ) + goto out; +#endif +/* Huh? Module did not cleanup after itself at exit? */ WARN (1 ,"debugfs file owner did not clean up at exit: %pd" , dentry);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 48/257 spi: spi-fsl-dspi: Avoid NULL pointer in dspi_slave_abort for non-DMA mode
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 3d6224e63be39ff26cf416492cb3923cd3d07dd0 ]
The driver does not create the dspi->dma structure unless operating in DSPI_DMA_MODE, so it makes sense to check for that.
--- drivers/spi/spi-fsl-dspi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/spi/spi-fsl-dspi.c +4 -2
@@ -1021,8 +1021,10 @@ static int dspi_slave_abort(struct spi_master *master)* Terminate all pending DMA transactions for the SPI working * in SLAVE mode. */ -dmaengine_terminate_sync (dspi->dma->chan_rx); -dmaengine_terminate_sync (dspi->dma->chan_tx); +if (dspi->devtype_data->trans_mode ==DSPI_DMA_MODE ) { +dmaengine_terminate_sync (dspi->dma->chan_rx); +dmaengine_terminate_sync (dspi->dma->chan_tx); + }/* Clear the internal DSPI RX and TX FIFO buffers */ regmap_update_bits(dspi->regmap, SPI_MCR,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 49/257 irqchip/versatile-fpga: Handle chained IRQs properly
In reply to Greg Kroah-HartmanFrom: Sungbo Eo <[email protected]>
[ Upstream commit 486562da598c59e9f835b551d7cf19507de2d681 ]
Enclose the chained handler with chained_irq_{enter,exit}(), so that the muxed interrupts get properly acked.
This patch also fixes a reboot bug on OX820 SoC, where the jiffies timer interrupt is never acked. The kernel waits a clock tick forever in calibrate_delay_converge(), which leads to a boot hang.
--- drivers/irqchip/irq-versatile-fpga.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/irqchip/irq-versatile-fpga.c +10 -2
@@ -6,6 +6,7 @@#include <linux/irq.h> #include <linux/io.h> #include <linux/irqchip.h> +#include <linux/irqchip/chained_irq.h> #include <linux/irqchip/versatile-fpga.h> #include <linux/irqdomain.h> #include <linux/module.h>
@@ -68,12 +69,16 @@ static void fpga_irq_unmask(struct irq_data *d)static void fpga_irq_handle (struct irq_desc *desc) { +struct irq_chip *chip =irq_desc_get_chip (desc);struct fpga_irq_data *f =irq_desc_get_handler_data (desc); -u32 status =readl (f->base +IRQ_STATUS ); +u32 status; + +chained_irq_enter (chip, desc); + status =readl (f->base +IRQ_STATUS );if (status ==0 ) {do_bad_IRQ (desc); -return ; + goto out; } do {
@@ -82,6 +87,9 @@ static void fpga_irq_handle(struct irq_desc *desc) status &= ~(1 << irq);generic_handle_irq (irq_find_mapping (f->domain, irq)); }while (status); + +out: +chained_irq_exit (chip, desc); }/*
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 50/257 time/sched_clock: Expire timer in hardirq context
In reply to Greg Kroah-HartmanFrom: Ahmed S. Darwish <[email protected]>
[ Upstream commit 2c8bd58812ee3dbf0d78b566822f7eacd34bdd7b ]
To minimize latency, PREEMPT_RT kernels expires hrtimers in preemptible softirq context by default. This can be overriden by marking the timer's expiry with HRTIMER_MODE_HARD.
sched_clock_timer is missing this annotation: if its callback is preempted and the duration of the preemption exceeds the wrap around time of the underlying clocksource, sched clock will get out of sync.
Mark the sched_clock_timer for expiry in hard interrupt context.
--- kernel/time/sched_clock.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
kernel/time/sched_clock.c +5 -4
@@ -207,7 +207,8 @@ sched_clock_register(u64 (*read)(void), int bits, unsigned long rate)if (sched_clock_timer.function !=NULL ) {/* update timeout for clock wrap */ -hrtimer_start (&sched_clock_timer, cd.wrap_kt,HRTIMER_MODE_REL ); +hrtimer_start (&sched_clock_timer, cd.wrap_kt, +HRTIMER_MODE_REL_HARD ); } r = rate;
@@ -251,9 +252,9 @@ void __init generic_sched_clock_init(void)* Start the timer to keep sched_clock() properly updated and * sets the initial epoch. */ -hrtimer_init (&sched_clock_timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL ); +hrtimer_init (&sched_clock_timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_HARD ); sched_clock_timer.function = sched_clock_poll; -hrtimer_start (&sched_clock_timer, cd.wrap_kt,HRTIMER_MODE_REL ); +hrtimer_start (&sched_clock_timer, cd.wrap_kt,HRTIMER_MODE_REL_HARD ); }/*
@@ -290,7 +291,7 @@ void sched_clock_resume(void)struct clock_read_data *rd = &cd.read_data[0 ]; rd->epoch_cyc = cd.actual_read_sched_clock (); -hrtimer_start (&sched_clock_timer, cd.wrap_kt,HRTIMER_MODE_REL ); +hrtimer_start (&sched_clock_timer, cd.wrap_kt,HRTIMER_MODE_REL_HARD ); rd->read_sched_clock = cd.actual_read_sched_clock; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 51/257 media: allegro: fix type of gop_length in channel_create message
In reply to Greg Kroah-HartmanFrom: Michael Tretter <[email protected]>
[ Upstream commit 8277815349327b8e65226eb58ddb680f90c2c0c0 ]
The gop_length field is actually only u16 and there are two more u8 fields in the message:
- the number of consecutive b-frames
- frequency of golden frames
Fix the message and thus fix the configuration of the GOP length.
--- drivers/staging/media/allegro-dvt/allegro-core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/staging/media/allegro-dvt/allegro-core.c +4 -1
@@ -393,7 +393,10 @@ struct mcu_msg_create_channel {u32 freq_ird;u32 freq_lt;u32 gdr_mode; -u32 gop_length; +u16 gop_length; +u8 num_b; +u8 freq_golden_ref; +u32 unknown39;u32 subframe_latency;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 52/257 sched: Avoid scale real weight down to zero
In reply to Greg Kroah-HartmanFrom: Michael Wang <[email protected]>
[ Upstream commit 26cf52229efc87e2effa9d788f9b33c40fb3358a ]
During our testing, we found a case that shares no longer working correctly, the cgroup topology is like:
/sys/fs/cgroup/cpu/A (shares=102400)
/sys/fs/cgroup/cpu/A/B (shares=2)
/sys/fs/cgroup/cpu/A/B/C (shares=1024)
/sys/fs/cgroup/cpu/D (shares=1024)
/sys/fs/cgroup/cpu/D/E (shares=1024)
/sys/fs/cgroup/cpu/D/E/F (shares=1024)
The same benchmark is running in group C & F, no other tasks are running, the benchmark is capable to consumed all the CPUs.
We suppose the group C will win more CPU resources since it could enjoy all the shares of group A, but it's F who wins much more.
The reason is because we have group B with shares as 2, since A->cfs_rq.load.weight == B->se.load.weight == B->shares/nr_cpus, so A->cfs_rq.load.weight become very small.
And in calc_group_shares() we calculate shares as:
load = max(scale_load_down(cfs_rq->load.weight), cfs_rq->avg.load_avg); shares = (tg_shares * load) / tg_weight;
Since the 'cfs_rq->load.weight' is too small, the load become 0 after scale down, although 'tg_shares' is 102400, shares of the se which stand for group A on root cfs_rq become 2.
While the se of D on root cfs_rq is far more bigger than 2, so it wins the battle.
Thus when scale_load_down() scale real weight down to 0, it's no longer telling the real story, the caller will have the wrong information and the calculation will be buggy.
This patch add check in scale_load_down(), so the real weight will be >= MIN_SHARES after scale, after applied the group C wins as expected.
--- kernel/sched/sched.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
kernel/sched/sched.h +7 -1
@@ -118,7 +118,13 @@ extern long calc_load_fold_active(struct rq *this_rq, long adjust);#ifdef CONFIG_64BIT # define NICE_0_LOAD_SHIFT (SCHED_FIXEDPOINT_SHIFT + SCHED_FIXEDPOINT_SHIFT)# define scale_load (w) ((w) << SCHED_FIXEDPOINT_SHIFT) -# define scale_load_down (w) ((w) >> SCHED_FIXEDPOINT_SHIFT) +# define scale_load_down (w) \ +({ \ + unsigned long __w = (w); \ + if (__w) \ + __w = max(2UL, __w >> SCHED_FIXEDPOINT_SHIFT); \ + __w; \ +})#else # define NICE_0_LOAD_SHIFT (SCHED_FIXEDPOINT_SHIFT)# define scale_load (w) (w)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 53/257 sched/fair: Fix condition of avg_load calculation
In reply to Greg Kroah-HartmanFrom: Tao Zhou <[email protected]>
[ Upstream commit 6c8116c914b65be5e4d6f66d69c8142eb0648c22 ]
In update_sg_wakeup_stats(), the comment says:
Computing avg_load makes sense only when group is fully busy or overloaded.
But, the code below this comment does not check like this.
Quoted 1 line
From reading the code about
avg_loadin other functions, I
confirm that avg_load should be calculated in fully busy or overloaded case. The comment is correct and the checking condition is wrong. So, change that condition.
--- kernel/sched/fair.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/sched/fair.c +2 -1
@@ -8323,7 +8323,8 @@ static inline void update_sg_wakeup_stats(struct sched_domain *sd,* Computing avg_load makes sense only when group is fully busy or * overloaded */ -if (sgs->group_type < group_fully_busy) +if (sgs->group_type == group_fully_busy || + sgs->group_type == group_overloaded) sgs->avg_load = (sgs->group_load *SCHED_CAPACITY_SCALE ) / sgs->group_capacity; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 54/257 selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault
In reply to Greg Kroah-HartmanFrom: Andy Lutomirski <[email protected]>
[ Upstream commit 630b99ab60aa972052a4202a1ff96c7e45eb0054 ]
If AT_SYSINFO is not present, don't try to call a NULL pointer.
--- tools/testing/selftests/x86/ptrace_syscall.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
tools/testing/selftests/x86/ptrace_syscall.c +6 -2
@@ -414,8 +414,12 @@ int main()#if defined(__i386__) && (!defined(__GLIBC__) || __GLIBC__ >2 || __GLIBC_MINOR__ >=16 ) vsyscall32 = (void *)getauxval (AT_SYSINFO ); -printf ("[RUN]\tCheck AT_SYSINFO return regs\n" ); -test_sys32_regs (do_full_vsyscall32); +if (vsyscall32) { +printf ("[RUN]\tCheck AT_SYSINFO return regs\n" ); +test_sys32_regs (do_full_vsyscall32); + }else { +printf ("[SKIP]\tAT_SYSINFO is not available\n" ); + }#endif test_ptrace_syscall_restart ();
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 55/257 PCI/switchtec: Fix init_completion race condition with poll_wait()
In reply to Greg Kroah-HartmanFrom: Logan Gunthorpe <[email protected]>
[ Upstream commit efbdc769601f4d50018bf7ca50fc9f7c67392ece ]
The call to init_completion() in mrpc_queue_cmd() can theoretically race with the call to poll_wait() in switchtec_dev_poll().
poll() write()
switchtec_dev_poll() switchtec_dev_write()
poll_wait(&s->comp.wait); mrpc_queue_cmd()
init_completion(&s->comp)
init_waitqueue_head(&s->comp.wait)To my knowledge, no one has hit this bug.
Fix this by using reinit_completion() instead of init_completion() in mrpc_queue_cmd().
--- drivers/pci/switch/switchtec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/switch/switchtec.c +1 -1
@@ -175,7 +175,7 @@ static int mrpc_queue_cmd(struct switchtec_user *stuser)kref_get (&stuser->kref); stuser->read_len =sizeof (stuser->data);stuser_set_state (stuser,MRPC_QUEUED ); -init_completion (&stuser->comp); +reinit_completion (&stuser->comp);list_add_tail (&stuser->list, &stdev->mrpc_queue);mrpc_cmd_submit (stdev);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 56/257 block, bfq: move forward the getting of an extra ref in bfq_bfqq_move
In reply to Greg Kroah-HartmanFrom: Paolo Valente <[email protected]>
[ Upstream commit fd1bb3ae54a9a2e0c42709de861c69aa146b8955 ]
Commit ecedd3d7e199 ("block, bfq: get extra ref to prevent a queue from being freed during a group move") gets an extra reference to a bfq_queue before possibly deactivating it (temporarily), in bfq_bfqq_move(). This prevents the bfq_queue from disappearing before being reactivated in its new group.
Yet, the bfq_queue may also be expired (i.e., its service may be stopped) before the bfq_queue is deactivated. And also an expiration may lead to a premature freeing. This commit fixes this issue by simply moving forward the getting of the extra reference already introduced by commit ecedd3d7e199 ("block, bfq: get extra ref to prevent a queue from being freed during a group move").
--- block/bfq-cgroup.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
block/bfq-cgroup.c +7 -7
@@ -641,6 +641,12 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq, {struct bfq_entity *entity = &bfqq->entity; +/* +* Get extra reference to prevent bfqq from being freed in +* next possible expire or deactivate. +*/ + bfqq->ref++; +/* If bfqq is empty, then bfq_bfqq_expire also invokes * bfq_del_bfqq_busy, thereby removing bfqq and its entity * from data structures related to current group. Otherwise we
@@ -651,12 +657,6 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,bfq_bfqq_expire (bfqd, bfqd->in_service_queue, false,BFQQE_PREEMPTED ); -/* -* get extra reference to prevent bfqq from being freed in -* next possible deactivate -*/ - bfqq->ref++; -if (bfq_bfqq_busy (bfqq))bfq_deactivate_bfqq (bfqd, bfqq, false, false);else if (entity->on_st)
@@ -676,7 +676,7 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,if (!bfqd->in_service_queue && !bfqd->rq_in_driver)bfq_schedule_dispatch (bfqd); -/* release extra ref taken above */ +/* release extra ref taken above, bfqq may happen to be freed now */ bfq_put_queue (bfqq); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 57/257 media: i2c: video-i2c: fix build errors due to imply hwmon
In reply to Greg Kroah-HartmanFrom: Matt Ranostay <[email protected]>
[ Upstream commit 64d4fc9926f09861a35d8f0f7d81f056e6d5af7b ]
Fix build fault when CONFIG_HWMON is a module, and CONFIG_VIDEO_I2C as builtin. This is due to 'imply hwmon' in the respective Kconfig.
Issue build log:
ld: drivers/media/i2c/video-i2c.o: in function `amg88xx_hwmon_init':
video-i2c.c:(.text+0x2e1): undefined reference to `devm_hwmon_device_register_with_info
--- drivers/media/i2c/video-i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/video-i2c.c +1 -1
@@ -255,7 +255,7 @@ static int amg88xx_set_power(struct video_i2c_data *data, bool on)return amg88xx_set_power_off (data); } -#if IS_ENABLED (CONFIG_HWMON ) +#if IS_REACHABLE (CONFIG_HWMON )static const u32 amg88xx_temp_config[] = { HWMON_T_INPUT,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 58/257 libata: Remove extra scsi_host_put() in ata_scsi_add_hosts()
In reply to Greg Kroah-HartmanFrom: John Garry <[email protected]>
[ Upstream commit 1d72f7aec3595249dbb83291ccac041a2d676c57 ]
If the call to scsi_add_host_with_dma() in ata_scsi_add_hosts() fails, then we may get use-after-free KASAN warns:
==================================================================
BUG: KASAN: use-after-free in kobject_put+0x24/0x180 Read of size 1 at addr ffff0026b8c80364 by task swapper/0/1 CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 5.6.0-rc3-00004-g5a71b206ea82-dirty #1765 Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDD, BIOS 2280-V2 CS V3.B160.01 02/24/2020 Call trace: dump_backtrace+0x0/0x298 show_stack+0x14/0x20 dump_stack+0x118/0x190 print_address_description.isra.9+0x6c/0x3b8 __kasan_report+0x134/0x23c kasan_report+0xc/0x18 __asan_load1+0x5c/0x68 kobject_put+0x24/0x180 put_device+0x10/0x20 scsi_host_put+0x10/0x18 ata_devres_release+0x74/0xb0 release_nodes+0x2d0/0x470 devres_release_all+0x50/0x78 really_probe+0x2d4/0x560 driver_probe_device+0x7c/0x148 device_driver_attach+0x94/0xa0 __driver_attach+0xa8/0x110 bus_for_each_dev+0xe8/0x158 driver_attach+0x30/0x40 bus_add_driver+0x220/0x2e0 driver_register+0xbc/0x1d0 __pci_register_driver+0xbc/0xd0 ahci_pci_driver_init+0x20/0x28 do_one_initcall+0xf0/0x608 kernel_init_freeable+0x31c/0x384 kernel_init+0x10/0x118 ret_from_fork+0x10/0x18 Allocated by task 5: save_stack+0x28/0xc8 __kasan_kmalloc.isra.8+0xbc/0xd8 kasan_kmalloc+0xc/0x18 __kmalloc+0x1a8/0x280 scsi_host_alloc+0x44/0x678 ata_scsi_add_hosts+0x74/0x268 ata_host_register+0x228/0x488 ahci_host_activate+0x1c4/0x2a8 ahci_init_one+0xd18/0x1298 local_pci_probe+0x74/0xf0 work_for_cpu_fn+0x2c/0x48 process_one_work+0x488/0xc08 worker_thread+0x330/0x5d0 kthread+0x1c8/0x1d0 ret_from_fork+0x10/0x18 Freed by task 5: save_stack+0x28/0xc8 __kasan_slab_free+0x118/0x180 kasan_slab_free+0x10/0x18 slab_free_freelist_hook+0xa4/0x1a0 kfree+0xd4/0x3a0 scsi_host_dev_release+0x100/0x148 device_release+0x7c/0xe0 kobject_put+0xb0/0x180 put_device+0x10/0x20 scsi_host_put+0x10/0x18 ata_scsi_add_hosts+0x210/0x268 ata_host_register+0x228/0x488 ahci_host_activate+0x1c4/0x2a8 ahci_init_one+0xd18/0x1298 local_pci_probe+0x74/0xf0 work_for_cpu_fn+0x2c/0x48 process_one_work+0x488/0xc08 worker_thread+0x330/0x5d0 kthread+0x1c8/0x1d0 ret_from_fork+0x10/0x18
There is also refcount issue, as well:
WARNING: CPU: 1 PID: 1 at lib/refcount.c:28 refcount_warn_saturate+0xf8/0x170
The issue is that we make an erroneous extra call to scsi_host_put() for that host:
So in ahci_init_one()->ata_host_alloc_pinfo()->ata_host_alloc(), we setup a device release method - ata_devres_release() - which intends to release the SCSI hosts:
static void ata_devres_release(struct device *gendev, void *res)
{
...
for (i = 0; i < host->n_ports; i++) {
struct ata_port *ap = host->ports[i];
if (!ap)
continue;
if (ap->scsi_host)
scsi_host_put(ap->scsi_host);
}
...
}However in the ata_scsi_add_hosts() error path, we also call scsi_host_put() for the SCSI hosts.
Fix by removing the the scsi_host_put() calls in ata_scsi_add_hosts() and leave this to ata_devres_release().
--- drivers/ata/libata-scsi.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/ata/libata-scsi.c +3 -6
@@ -4553,22 +4553,19 @@ int ata_scsi_add_hosts(struct ata_host *host, struct scsi_host_template *sht)*/ shost->max_host_blocked =1 ; - rc =scsi_add_host_with_dma (ap->scsi_host, - &ap->tdev, ap->host->dev); + rc =scsi_add_host_with_dma (shost, &ap->tdev, ap->host->dev);if (rc) - goto err_add; + goto err_alloc; }return 0 ; - err_add: -scsi_host_put (host->ports[i]->scsi_host); err_alloc:while (--i >=0 ) {struct Scsi_Host *shost = host->ports[i]->scsi_host; +/* scsi_host_put() is in ata_devres_release() */ scsi_remove_host (shost); -scsi_host_put (shost); }return rc; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 59/257 pstore/platform: fix potential mem leak if pstore_init_fs failed
In reply to Greg Kroah-HartmanFrom: chenqiwu <[email protected]>
[ Upstream commit 8a57d6d4ddfa41c49014e20493152c41a38fcbf8 ]
There is a potential mem leak when pstore_init_fs failed, since the pstore compression maybe unlikey to initialized successfully. We must clean up the allocation once this unlikey issue happens.
--- fs/pstore/platform.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/pstore/platform.c +2 -2
@@ -823,9 +823,9 @@ static int __init pstore_init(void) ret =pstore_init_fs ();if (ret) -return ret; +free_buf_for_compression (); -return 0 ; +return ret; }late_initcall (pstore_init);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 60/257 gfs2: Do log_flush in gfs2_ail_empty_gl even if ail list is empty
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit 9ff78289356af640941bbb0dd3f46af2063f0046 ]
Before this patch, if gfs2_ail_empty_gl saw there was nothing on the ail list, it would return and not flush the log. The problem is that there could still be a revoke for the rgrp sitting on the sd_log_le_revoke list that's been recently taken off the ail list. But that revoke still needs to be written, and the rgrp_go_inval still needs to call log_flush_wait to ensure the revokes are all properly written to the journal before we relinquish control of the glock to another node. If we give the glock to another node before we have this knowledge, the node might crash and its journal replayed, in which case the missing revoke would allow the journal replay to replay the rgrp over top of the rgrp we already gave to another node, thus overwriting its changes and corrupting the file system.
This patch makes gfs2_ail_empty_gl still call gfs2_log_flush rather than returning.
--- fs/gfs2/glops.c | 27 ++++++++++++++++++++++++++- fs/gfs2/log.c | 2 +- fs/gfs2/log.h | 1 + 3 files changed, 28 insertions(+), 2 deletions(-)
fs/gfs2/glops.c +26 -1
@@ -89,8 +89,32 @@ static void gfs2_ail_empty_gl(struct gfs2_glock *gl)INIT_LIST_HEAD (&tr.tr_databuf); tr.tr_revokes =atomic_read (&gl->gl_ail_count); -if (!tr.tr_revokes) +if (!tr.tr_revokes) { +bool have_revokes; +bool log_in_flight; + +/* +* We have nothing on the ail, but there could be revokes on +* the sdp revoke queue, in which case, we still want to flush +* the log and wait for it to finish. +* +* If the sdp revoke list is empty too, we might still have an +* io outstanding for writing revokes, so we should wait for +* it before returning. +* +* If none of these conditions are true, our revokes are all +* flushed and we can return. +*/ +gfs2_log_lock (sdp); + have_revokes = !list_empty (&sdp->sd_log_revokes); + log_in_flight =atomic_read (&sdp->sd_log_in_flight); +gfs2_log_unlock (sdp); +if (have_revokes) + goto flush; +if (log_in_flight) +log_flush_wait (sdp);return ; + }/* A shortened, inline version of gfs2_trans_begin() * tr->alloced is not set since the transaction structure is
@@ -105,6 +129,7 @@ static void gfs2_ail_empty_gl(struct gfs2_glock *gl)__gfs2_ail_flush (gl,0 , tr.tr_revokes);gfs2_trans_end (sdp); +flush:gfs2_log_flush (sdp,NULL ,GFS2_LOG_HEAD_FLUSH_NORMAL |GFS2_LFC_AIL_EMPTY_GL ); }
fs/gfs2/log.c +1 -1
@@ -516,7 +516,7 @@ static void log_pull_tail(struct gfs2_sbd *sdp, unsigned int new_tail) } -static void log_flush_wait (struct gfs2_sbd *sdp) +void log_flush_wait (struct gfs2_sbd *sdp) {DEFINE_WAIT (wait);
fs/gfs2/log.h +1 -0
@@ -73,6 +73,7 @@ extern void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 type);extern void gfs2_log_commit (struct gfs2_sbd *sdp,struct gfs2_trans *trans);extern void gfs2_ail1_flush (struct gfs2_sbd *sdp,struct writeback_control *wbc); +extern void log_flush_wait (struct gfs2_sbd *sdp);extern int gfs2_logd (void *data);extern void gfs2_add_revoke (struct gfs2_sbd *sdp,struct gfs2_bufdata *bd);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 61/257 gfs2: Dont demote a glock until its revokes are written
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit df5db5f9ee112e76b5202fbc331f990a0fc316d6 ]
Before this patch, run_queue would demote glocks based on whether there are any more holders. But if the glock has pending revokes that haven't been written to the media, giving up the glock might end in file system corruption if the revokes never get written due to io errors, node crashes and fences, etc. In that case, another node will replay the metadata blocks associated with the glock, but because the revoke was never written, it could replay that block even though the glock had since been granted to another node who might have made changes.
This patch changes the logic in run_queue so that it never demotes a glock until its count of pending revokes reaches zero.
--- fs/gfs2/glock.c | 3 +++ 1 file changed, 3 insertions(+)
fs/gfs2/glock.c +3 -0
@@ -645,6 +645,9 @@ __acquires(&gl->gl_lockref.lock) goto out_unlock;if (nonblock) goto out_sched; +smp_mb (); +if (atomic_read (&gl->gl_revokes) !=0 ) + goto out_sched;set_bit (GLF_DEMOTE_IN_PROGRESS , &gl->gl_flags);GLOCK_BUG_ON (gl, gl->gl_demote_state ==LM_ST_EXCLUSIVE ); gl->gl_target = gl->gl_demote_state;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 62/257 cpufreq: imx6q: fix error handling
In reply to Greg Kroah-HartmanFrom: Peng Fan <[email protected]>
[ Upstream commit 3646f50a3838c5949a89ecbdb868497cdc05b8fd ]
When speed checking failed, direclty jumping to put_node label is not correct. Need jump to out_free_opp to avoid resources leak.
--- drivers/cpufreq/imx6q-cpufreq.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/cpufreq/imx6q-cpufreq.c +5 -4
@@ -381,23 +381,24 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev) goto put_reg; } +/* Because we have added the OPPs here, we must free them */ + free_opp = true; +if (of_machine_is_compatible ("fsl,imx6ul" ) ||of_machine_is_compatible ("fsl,imx6ull" )) { ret =imx6ul_opp_check_speed_grading (cpu_dev);if (ret) {if (ret == -EPROBE_DEFER ) - goto put_node; + goto out_free_opp;dev_err (cpu_dev,"failed to read ocotp: %d\n" , ret); - goto put_node; + goto out_free_opp; } }else {imx6q_opp_check_speed_grading (cpu_dev); } -/* Because we have added the OPPs here, we must free them */ - free_opp = true; num =dev_pm_opp_get_opp_count (cpu_dev);if (num <0 ) { ret = num;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 63/257 x86/boot: Use unsigned comparison for addresses
In reply to Greg Kroah-HartmanFrom: Arvind Sankar <[email protected]>
[ Upstream commit 81a34892c2c7c809f9c4e22c5ac936ae673fb9a2 ]
The load address is compared with LOAD_PHYSICAL_ADDR using a signed comparison currently (using jge instruction).
When loading a 64-bit kernel using the new efi32_pe_entry() point added by:
97aa276579b2 ("efi/x86: Add true mixed mode entry point into .compat section")
using Qemu with -m 3072, the firmware actually loads us above 2Gb, resulting in a very early crash.
Use the JAE instruction to perform a unsigned comparison instead, as physical addresses should be considered unsigned.
--- arch/x86/boot/compressed/head_32.S | 2 +- arch/x86/boot/compressed/head_64.S | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/x86/boot/compressed/head_32.S +1 -1
@@ -106,7 +106,7 @@ SYM_FUNC_START(startup_32) notl %eax andl %eax, %ebx cmpl $LOAD_PHYSICAL_ADDR, %ebx - jge 1f + jae 1f #endif movl $LOAD_PHYSICAL_ADDR, %ebx 1:
arch/x86/boot/compressed/head_64.S +2 -2
@@ -106,7 +106,7 @@ SYM_FUNC_START(startup_32) notl %eax andl %eax, %ebx cmpl $LOAD_PHYSICAL_ADDR, %ebx - jge 1f + jae 1f #endif movl $LOAD_PHYSICAL_ADDR, %ebx 1:
@@ -297,7 +297,7 @@ SYM_CODE_START(startup_64) notq %rax andq %rax, %rbp cmpq $LOAD_PHYSICAL_ADDR, %rbp - jge 1f + jae 1f #endif movq $LOAD_PHYSICAL_ADDR, %rbp 1:
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 64/257 efi/x86: Ignore the memory attributes table on i386
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
[ Upstream commit dd09fad9d2caad2325a39b766ce9e79cfc690184 ]
Commit:
3a6b6c6fb23667fa ("efi: Make EFI_MEMORY_ATTRIBUTES_TABLE initialization common across all architectures")
moved the call to efi_memattr_init() from ARM specific to the generic EFI init code, in order to be able to apply the restricted permissions described in that table on x86 as well.
We never enabled this feature fully on i386, and so mapping and reserving this table is pointless. However, due to the early call to memblock_reserve(), the memory bookkeeping gets confused to the point where it produces the splat below when we try to map the memory later on:
------------[ cut here ]------------ ioremap on RAM at 0x3f251000 - 0x3fa1afff WARNING: CPU: 0 PID: 0 at arch/x86/mm/ioremap.c:166 __ioremap_caller ... Modules linked in: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.20.0 #48 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 EIP: __ioremap_caller.constprop.0+0x249/0x260 Code: 90 0f b7 05 4e 38 40 de 09 45 e0 e9 09 ff ff ff 90 8d 45 ec c6 05 ... EAX: 00000029 EBX: 00000000 ECX: de59c228 EDX: 00000001 ESI: 3f250fff EDI: 00000000 EBP: de3edf20 ESP: de3edee0 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00200296 CR0: 80050033 CR2: ffd17000 CR3: 1e58c000 CR4: 00040690 Call Trace: ioremap_cache+0xd/0x10 ? old_map_region+0x72/0x9d old_map_region+0x72/0x9d efi_map_region+0x8/0xa efi_enter_virtual_mode+0x260/0x43b start_kernel+0x329/0x3aa i386_start_kernel+0xa7/0xab startup_32_smp+0x164/0x168 ---[ end trace e15ccf6b9f356833 ]---
Let's work around this by disregarding the memory attributes table altogether on i386, which does not result in a loss of functionality or protection, given that we never consumed the contents.
--- drivers/firmware/efi/efi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/efi/efi.c +1 -1
@@ -570,7 +570,7 @@ int __init efi_config_parse_tables(void *config_tables, int count, int sz, } } -if (efi_enabled (EFI_MEMMAP )) +if (!IS_ENABLED (CONFIG_X86_32 ) &&efi_enabled (EFI_MEMMAP ))efi_memattr_init ();efi_tpm_eventlog_init ();
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 65/257 genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy()
In reply to Greg Kroah-HartmanFrom: Alexander Sverdlin <[email protected]>
[ Upstream commit 87f2d1c662fa1761359fdf558246f97e484d177a ]
irq_domain_alloc_irqs_hierarchy() has 3 call sites in the compilation unit but only one of them checks for the pointer which is being dereferenced inside the called function. Move the check into the function. This allows for catching the error instead of the following crash:
Unable to handle kernel NULL pointer dereference at virtual address 00000000
PC is at 0x0
LR is at gpiochip_hierarchy_irq_domain_alloc+0x11f/0x140
...
[<c06c23ff>] (gpiochip_hierarchy_irq_domain_alloc) [<c0462a89>] (__irq_domain_alloc_irqs) [<c0462dad>] (irq_create_fwspec_mapping) [<c06c2251>] (gpiochip_to_irq)
[<c06c1c9b>] (gpiod_to_irq)
[<bf973073>] (gpio_irqs_init [gpio_irqs]) [<bf974048>] (gpio_irqs_exit+0xecc/0xe84 [gpio_irqs])
Code: bad PC value
--- kernel/irq/irqdomain.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
kernel/irq/irqdomain.c +5 -5
@@ -1293,6 +1293,11 @@ int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain, unsigned int irq_base, unsigned int nr_irqs, void *arg) { + if (!domain->ops->alloc) { + pr_debug("domain->ops->alloc() is NULL\n"); +return -ENOSYS ; + } +return domain->ops->alloc (domain, irq_base, nr_irqs, arg); }
@@ -1330,11 +1335,6 @@ int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base,return -EINVAL ; } -if (!domain->ops->alloc) { -pr_debug ("domain->ops->alloc() is NULL\n" ); -return -ENOSYS ; - } -if (realloc && irq_base >=0 ) { virq = irq_base; }else {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 66/257 block: Fix use-after-free issue accessing struct io_cq
In reply to Greg Kroah-HartmanFrom: Sahitya Tummala <[email protected]>
[ Upstream commit 30a2da7b7e225ef6c87a660419ea04d3cef3f6a7 ]
There is a potential race between ioc_release_fn() and ioc_clear_queue() as shown below, due to which below kernel crash is observed. It also can result into use-after-free issue.
context#1: context#2:ioc_release_fn() __ioc_clear_queue() gets the same icq
->spin_lock(&ioc->lock); ->spin_lock(&ioc->lock);
->ioc_destroy_icq(icq);
->list_del_init(&icq->q_node);
->call_rcu(&icq->__rcu_head,
icq_free_icq_rcu);
->spin_unlock(&ioc->lock); ->ioc_destroy_icq(icq); ->hlist_del_init(&icq->ioc_node); This results into below crash as this memory is now used by icq->__rcu_head in context#1. There is a chance that icq could be free'd as well.
22150.386550: <6> Unable to handle kernel write to read-only memory
at virtual address ffffffaa8d31ca50
...
Call trace: 22150.607350: <2> ioc_destroy_icq+0x44/0x110 22150.611202: <2> ioc_clear_queue+0xac/0x148 22150.615056: <2> blk_cleanup_queue+0x11c/0x1a0 22150.619174: <2> __scsi_remove_device+0xdc/0x128 22150.623465: <2> scsi_forget_host+0x2c/0x78 22150.627315: <2> scsi_remove_host+0x7c/0x2a0 22150.631257: <2> usb_stor_disconnect+0x74/0xc8 22150.635371: <2> usb_unbind_interface+0xc8/0x278 22150.639665: <2> device_release_driver_internal+0x198/0x250 22150.644897: <2> device_release_driver+0x24/0x30 22150.649176: <2> bus_remove_device+0xec/0x140 22150.653204: <2> device_del+0x270/0x460 22150.656712: <2> usb_disable_device+0x120/0x390 22150.660918: <2> usb_disconnect+0xf4/0x2e0 22150.664684: <2> hub_event+0xd70/0x17e8 22150.668197: <2> process_one_work+0x210/0x480 22150.672222: <2> worker_thread+0x32c/0x4c8
Fix this by adding a new ICQ_DESTROYED flag in ioc_destroy_icq() to indicate this icq is once marked as destroyed. Also, ensure __ioc_clear_queue() is accessing icq within rcu_read_lock/unlock so that icq doesn't get free'd up while it is still using it.
--- block/blk-ioc.c | 7 +++++++ include/linux/iocontext.h | 1 + 2 files changed, 8 insertions(+)
block/blk-ioc.c +7 -0
@@ -84,6 +84,7 @@ static void ioc_destroy_icq(struct io_cq *icq)* making it impossible to determine icq_cache. Record it in @icq. */ icq->__rcu_icq_cache = et->icq_cache; + icq->flags |=ICQ_DESTROYED ;call_rcu (&icq->__rcu_head, icq_free_icq_rcu); }
@@ -212,15 +213,21 @@ static void __ioc_clear_queue(struct list_head *icq_list) {unsigned long flags; +rcu_read_lock ();while (!list_empty (icq_list)) {struct io_cq *icq =list_entry (icq_list->next, struct io_cq, q_node);struct io_context *ioc = icq->ioc;spin_lock_irqsave (&ioc->lock, flags); +if (icq->flags &ICQ_DESTROYED ) { +spin_unlock_irqrestore (&ioc->lock, flags); +continue ; + }ioc_destroy_icq (icq);spin_unlock_irqrestore (&ioc->lock, flags); } +rcu_read_unlock (); }/**
include/linux/iocontext.h +1 -0
@@ -8,6 +8,7 @@enum {ICQ_EXITED =1 <<2 , +ICQ_DESTROYED =1 <<3 , };/*
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 67/257 block, zoned: fix integer overflow with BLKRESETZONE et al
In reply to Greg Kroah-HartmanFrom: Alexey Dobriyan <[email protected]>
[ Upstream commit 11bde986002c0af67eb92d73321d06baefae7128 ]
Check for overflow in addition before checking for end-of-block-device.
Steps to reproduce:
#define _GNU_SOURCE 1
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
typedef unsigned long long __u64;
struct blk_zone_range {
__u64 sector;
__u64 nr_sectors;
};
#define BLKRESETZONE _IOW(0x12, 131, struct blk_zone_range)
int main(void)
{
int fd = open("/dev/nullb0", O_RDWR|O_DIRECT);
struct blk_zone_range zr = {4096, 0xfffffffffffff000ULL};
ioctl(fd, BLKRESETZONE, &zr);
return 0;
}BUG: KASAN: null-ptr-deref in submit_bio_wait+0x74/0xe0 Write of size 8 at addr 0000000000000040 by task a.out/1590 CPU: 8 PID: 1590 Comm: a.out Not tainted 5.6.0-rc1-00019-g359c92c02bfa #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190711_202441-buildvm-armv7-10.arm.fedoraproject.org-2.fc31 04/01/2014 Call Trace: dump_stack+0x76/0xa0 __kasan_report.cold+0x5/0x3e kasan_report+0xe/0x20 submit_bio_wait+0x74/0xe0 blkdev_zone_mgmt+0x26f/0x2a0 blkdev_zone_mgmt_ioctl+0x14b/0x1b0 blkdev_ioctl+0xb28/0xe60 block_ioctl+0x69/0x80 ksys_ioctl+0x3af/0xa50
--- block/blk-zoned.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/blk-zoned.c +1 -1
@@ -173,7 +173,7 @@ int blkdev_zone_mgmt(struct block_device *bdev, enum req_opf op,if (!op_is_zone_mgmt (op))return -EOPNOTSUPP ; -if (!nr_sectors || end_sector > capacity) +if (end_sector <= sector || end_sector > capacity)/* Out of range */ return -EINVAL ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 68/257 media: mtk-vpu: avoid unaligned access to DTCM buffer.
In reply to Greg Kroah-HartmanFrom: Hsin-Yi Wang <[email protected]>
[ Upstream commit e6599adfad30c340d06574e49a86afa7015c5c60 ]
Previously, vpu->recv_buf and send_buf are forced cast from void __iomem *tcm. vpu->recv_buf->share_buf is passed to vpu_ipi_desc.handler(). It's not able to do unaligned access. Otherwise kernel would crash due to unable to handle kernel paging request.
struct vpu_run {
u32 signaled;
char fw_ver[VPU_FW_VER_LEN];
unsigned int dec_capability;
unsigned int enc_capability;
wait_queue_head_t wq;
};fw_ver starts at 4 byte boundary. If system enables CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, strscpy() will do read_word_at_a_time(), which tries to read 8-byte: *(unsigned long *)addr
vpu_init_ipi_handler() calls strscpy(), which would lead to crash.
vpu_init_ipi_handler() and several other handlers (eg. vpu_dec_ipi_handler) only do read access to this data, so they can be const, and we can use memcpy_fromio() to copy the buf to another non iomem buffer then pass to handler.
--- drivers/media/platform/mtk-mdp/mtk_mdp_vpu.c | 9 ++-- .../media/platform/mtk-vcodec/vdec_vpu_if.c | 6 +-- .../media/platform/mtk-vcodec/venc_vpu_if.c | 12 ++--- drivers/media/platform/mtk-vpu/mtk_vpu.c | 45 ++++++++++--------- drivers/media/platform/mtk-vpu/mtk_vpu.h | 2 +- 5 files changed, 38 insertions(+), 36 deletions(-)
drivers/media/platform/mtk-mdp/mtk_mdp_vpu.c +5 -4
@@ -15,7 +15,7 @@ static inline struct mtk_mdp_ctx *vpu_to_ctx(struct mtk_mdp_vpu *vpu) return container_of(vpu, struct mtk_mdp_ctx, vpu); } -static void mtk_mdp_vpu_handle_init_ack (struct mdp_ipi_comm_ack *msg) +static void mtk_mdp_vpu_handle_init_ack (const struct mdp_ipi_comm_ack *msg) {struct mtk_mdp_vpu *vpu = (struct mtk_mdp_vpu *) (unsigned long )msg->ap_inst;
@@ -26,10 +26,11 @@ static void mtk_mdp_vpu_handle_init_ack(struct mdp_ipi_comm_ack *msg) vpu->inst_addr = msg->vpu_inst_addr; } -static void mtk_mdp_vpu_ipi_handler (void *data,unsigned int len,void *priv) +static void mtk_mdp_vpu_ipi_handler (const void *data,unsigned int len, +void *priv) { -unsigned int msg_id = *(unsigned int *)data; -struct mdp_ipi_comm_ack *msg = (struct mdp_ipi_comm_ack *)data; +const struct mdp_ipi_comm_ack *msg = data; +unsigned int msg_id = msg->msg_id;struct mtk_mdp_vpu *vpu = (struct mtk_mdp_vpu *) (unsigned long )msg->ap_inst;struct mtk_mdp_ctx *ctx;
drivers/media/platform/mtk-vcodec/vdec_vpu_if.c +3 -3
@@ -9,7 +9,7 @@#include "vdec_ipi_msg.h" #include "vdec_vpu_if.h" -static void handle_init_ack_msg (struct vdec_vpu_ipi_init_ack *msg) +static void handle_init_ack_msg (const struct vdec_vpu_ipi_init_ack *msg) {struct vdec_vpu_inst *vpu = (struct vdec_vpu_inst *) (unsigned long )msg->ap_inst_addr;
@@ -34,9 +34,9 @@ static void handle_init_ack_msg(struct vdec_vpu_ipi_init_ack *msg)* This function runs in interrupt context and it means there's an IPI MSG * from VPU. */ -static void vpu_dec_ipi_handler (void *data,unsigned int len,void *priv) +static void vpu_dec_ipi_handler (const void *data,unsigned int len,void *priv) { -struct vdec_vpu_ipi_ack *msg = data; +const struct vdec_vpu_ipi_ack *msg = data;struct vdec_vpu_inst *vpu = (struct vdec_vpu_inst *) (unsigned long )msg->ap_inst_addr;
drivers/media/platform/mtk-vcodec/venc_vpu_if.c +6 -6
@@ -8,26 +8,26 @@#include "venc_ipi_msg.h" #include "venc_vpu_if.h" -static void handle_enc_init_msg (struct venc_vpu_inst *vpu,void *data) +static void handle_enc_init_msg (struct venc_vpu_inst *vpu,const void *data) { -struct venc_vpu_ipi_msg_init *msg = data; +const struct venc_vpu_ipi_msg_init *msg = data; vpu->inst_addr = msg->vpu_inst_addr; vpu->vsi =vpu_mapping_dm_addr (vpu->dev, msg->vpu_inst_addr); } -static void handle_enc_encode_msg (struct venc_vpu_inst *vpu,void *data) +static void handle_enc_encode_msg (struct venc_vpu_inst *vpu,const void *data) { -struct venc_vpu_ipi_msg_enc *msg = data; +const struct venc_vpu_ipi_msg_enc *msg = data; vpu->state = msg->state; vpu->bs_size = msg->bs_size; vpu->is_key_frm = msg->is_key_frm; } -static void vpu_enc_ipi_handler (void *data,unsigned int len,void *priv) +static void vpu_enc_ipi_handler (const void *data,unsigned int len,void *priv) { -struct venc_vpu_ipi_msg_common *msg = data; +const struct venc_vpu_ipi_msg_common *msg = data;struct venc_vpu_inst *vpu = (struct venc_vpu_inst *)(unsigned long )msg->venc_inst;
drivers/media/platform/mtk-vpu/mtk_vpu.c +23 -22
87 lines not on this page · raw message
drivers/media/platform/mtk-vpu/mtk_vpu.h +1 -1
@@ -15,7 +15,7 @@* VPU interfaces with other blocks by share memory and interrupt. **/ -typedef void (*ipi_handler_t ) (void *data, +typedef void (*ipi_handler_t ) (const void *data,unsigned int len,void *priv);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 69/257 media: i2c: ov5695: Fix power on and off sequences
In reply to Greg Kroah-HartmanFrom: Dongchun Zhu <[email protected]>
[ Upstream commit f1a64f56663e9d03e509439016dcbddd0166b2da ]
Quoted 1 line
From the measured hardware signal, OV5695 reset pin goes high for a
short period of time during boot-up. From the sensor specification, the reset pin is active low and the DT binding defines the pin as active low, which means that the values set by the driver are inverted and thus the value requested in probe ends up high.
Fix it by changing probe to request the reset GPIO initialized to high, which makes the initial state of the physical signal low.
In addition, DOVDD rising must occur before DVDD rising from spec., but regulator_bulk_enable() API enables all the regulators asynchronously. Use an explicit loops of regulator_enable() instead.
For power off sequence, it is required that DVDD falls first. Given the bulk API does not give any guarantee about the order of regulators, change the driver to use regulator_disable() instead.
The sensor also requires a delay between reset high and first I2C transaction, which was assumed to be 8192 XVCLK cycles, but 1ms is recommended by the vendor. Fix this as well.
--- drivers/media/i2c/ov5695.c | 49 ++++++++++++++++++++++++-------------- 1 file changed, 31 insertions(+), 18 deletions(-)
drivers/media/i2c/ov5695.c +31 -18
@@ -971,16 +971,9 @@ unlock_and_return:return ret; } -/* Calculate the delay in us by clock rate and clock cycles */ -static inline u32 ov5695_cal_delay (u32 cycles) -{ -return DIV_ROUND_UP (cycles,OV5695_XVCLK_FREQ /1000 /1000 ); -} -static int __ov5695_power_on (struct ov5695 *ov5695) { -int ret; -u32 delay_us; +int i, ret;struct device *dev = &ov5695->client->dev; ret =clk_prepare_enable (ov5695->xvclk);
@@ -991,21 +984,28 @@ static int __ov5695_power_on(struct ov5695 *ov5695)gpiod_set_value_cansleep (ov5695->reset_gpio,1 ); - ret =regulator_bulk_enable (OV5695_NUM_SUPPLIES , ov5695->supplies); -if (ret <0 ) { -dev_err (dev,"Failed to enable regulators\n" ); - goto disable_clk; +/* +* The hardware requires the regulators to be powered on in order, +* so enable them one by one. +*/ +for (i =0 ; i <OV5695_NUM_SUPPLIES ; i++) { + ret =regulator_enable (ov5695->supplies[i].consumer); +if (ret) { +dev_err (dev,"Failed to enable %s: %d\n" , + ov5695->supplies[i].supply, ret); + goto disable_reg_clk; + } }gpiod_set_value_cansleep (ov5695->reset_gpio,0 ); -/* 8192 cycles prior to first SCCB transaction */ - delay_us =ov5695_cal_delay (8192 ); -usleep_range (delay_us, delay_us *2 ); +usleep_range (1000 ,1200 );return 0 ; -disable_clk: +disable_reg_clk: +for (--i; i >=0 ; i--) +regulator_disable (ov5695->supplies[i].consumer);clk_disable_unprepare (ov5695->xvclk);return ret;
@@ -1013,9 +1013,22 @@ disable_clk:static void __ov5695_power_off (struct ov5695 *ov5695) { +struct device *dev = &ov5695->client->dev; +int i, ret; +clk_disable_unprepare (ov5695->xvclk);gpiod_set_value_cansleep (ov5695->reset_gpio,1 ); -regulator_bulk_disable (OV5695_NUM_SUPPLIES , ov5695->supplies); + +/* +* The hardware requires the regulators to be powered off in order, +* so disable them one by one. +*/ +for (i =OV5695_NUM_SUPPLIES -1 ; i >=0 ; i--) { + ret =regulator_disable (ov5695->supplies[i].consumer); +if (ret) +dev_err (dev,"Failed to disable %s: %d\n" , + ov5695->supplies[i].supply, ret); + } }static int __maybe_unused ov5695_runtime_resume (struct device *dev)
@@ -1285,7 +1298,7 @@ static int ov5695_probe(struct i2c_client *client,if (clk_get_rate (ov5695->xvclk) !=OV5695_XVCLK_FREQ )dev_warn (dev,"xvclk mismatched, modes are based on 24MHz\n" ); - ov5695->reset_gpio =devm_gpiod_get (dev,"reset" ,GPIOD_OUT_LOW ); + ov5695->reset_gpio =devm_gpiod_get (dev,"reset" ,GPIOD_OUT_HIGH );if (IS_ERR (ov5695->reset_gpio)) {dev_err (dev,"Failed to get reset-gpios\n" );return -EINVAL ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 70/257 usb: dwc3: core: add support for disabling SS instances in park mode
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 7ba6b09fda5e0cb741ee56f3264665e0edc64822 ]
In certain circumstances, the XHCI SuperSpeed instance in park mode can fail to recover, thus on Amlogic G12A/G12B/SM1 SoCs when there is high load on the single XHCI SuperSpeed instance, the controller can crash like:
xhci-hcd xhci-hcd.0.auto: xHCI host not responding to stop endpoint command. xhci-hcd xhci-hcd.0.auto: Host halt failed, -110
xhci-hcd xhci-hcd.0.auto: xHCI host controller not responding, assume dead xhci-hcd xhci-hcd.0.auto: xHCI host not responding to stop endpoint command. hub 2-1.1:1.0: hub_ext_port_status failed (err = -22)
xhci-hcd xhci-hcd.0.auto: HC died; cleaning up
usb 2-1.1-port1: cannot reset (err = -22)
Setting the PARKMODE_DISABLE_SS bit in the DWC3_USB3_GUCTL1 mitigates the issue. The bit is described as :
"When this bit is set to '1' all SS bus instances in park mode are disabled"
Synopsys explains:
The GUCTL1.PARKMODE_DISABLE_SS is only available in dwc_usb3 controller running in host mode.
This should not be set for other IPs.
This can be disabled by default based on IP, but I recommend to have a property to enable this feature for devices that need this.
--- drivers/usb/dwc3/core.c | 5 +++++ drivers/usb/dwc3/core.h | 4 ++++ 2 files changed, 9 insertions(+)
drivers/usb/dwc3/core.c +5 -0
@@ -1029,6 +1029,9 @@ static int dwc3_core_init(struct dwc3 *dwc)if (dwc->dis_tx_ipgap_linecheck_quirk) reg |=DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS ; +if (dwc->parkmode_disable_ss_quirk) + reg |=DWC3_GUCTL1_PARKMODE_DISABLE_SS ; +dwc3_writel (dwc->regs,DWC3_GUCTL1 , reg); }
@@ -1342,6 +1345,8 @@ static void dwc3_get_properties(struct dwc3 *dwc) "snps,dis-del-phy-power-chg-quirk"); dwc->dis_tx_ipgap_linecheck_quirk =device_property_read_bool (dev,"snps,dis-tx-ipgap-linecheck-quirk" ); + dwc->parkmode_disable_ss_quirk =device_property_read_bool (dev, +"snps,parkmode-disable-ss-quirk" ); dwc->tx_de_emphasis_quirk =device_property_read_bool (dev,"snps,tx_de_emphasis_quirk" );
drivers/usb/dwc3/core.h +4 -0
@@ -249,6 +249,7 @@#define DWC3_GUCTL_HSTINAUTORETRY BIT(14)/* Global User Control 1 Register */ +#define DWC3_GUCTL1_PARKMODE_DISABLE_SS BIT(17)#define DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS BIT(28)#define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW BIT(24)
@@ -1024,6 +1025,8 @@ struct dwc3_scratchpad_array {* change quirk. * @dis_tx_ipgap_linecheck_quirk: set if we disable u2mac linestate * check during HS transmit. +* @parkmode_disable_ss_quirk: set if we need to disable all SuperSpeed +* instances in park mode. * @tx_de_emphasis_quirk: set if we enable Tx de-emphasis quirk * @tx_de_emphasis: Tx de-emphasis value * 0 - -6dB de-emphasis
@@ -1215,6 +1218,7 @@ struct dwc3 { unsigned dis_u2_freeclk_exists_quirk:1; unsigned dis_del_phy_power_chg_quirk:1; unsigned dis_tx_ipgap_linecheck_quirk:1; + unsigned parkmode_disable_ss_quirk:1; unsigned tx_de_emphasis_quirk:1; unsigned tx_de_emphasis:2;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 71/257 irqchip/gic-v4: Provide irq_retrigger to avoid circular locking dependency
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
[ Upstream commit 7809f7011c3bce650e502a98afeb05961470d865 ]
On a very heavily loaded D05 with GICv4, I managed to trigger the following lockdep splat:
[ 6022.598864] ======================================================
[ 6022.605031] WARNING: possible circular locking dependency detected
[ 6022.611200] 5.6.0-rc4-00026-geee7c7b0f498 #680 Tainted: G E
[ 6022.618061] ------------------------------------------------------
[ 6022.624227] qemu-system-aar/7569 is trying to acquire lock:
[ 6022.629789] ffff042f97606808 (&p->pi_lock){-.-.}, at: try_to_wake_up+0x54/0x7a0
[ 6022.637102]
[ 6022.637102] but task is already holding lock:
[ 6022.642921] ffff002fae424cf0 (&irq_desc_lock_class){-.-.}, at: __irq_get_desc_lock+0x5c/0x98
[ 6022.651350]
[ 6022.651350] which lock already depends on the new lock.
[ 6022.651350]
[ 6022.659512]
[ 6022.659512] the existing dependency chain (in reverse order) is:
[ 6022.666980]
[ 6022.666980] -> #2 (&irq_desc_lock_class){-.-.}:
[ 6022.672983] _raw_spin_lock_irqsave+0x50/0x78
[ 6022.677848] __irq_get_desc_lock+0x5c/0x98
[ 6022.682453] irq_set_vcpu_affinity+0x40/0xc0
[ 6022.687236] its_make_vpe_non_resident+0x6c/0xb8
[ 6022.692364] vgic_v4_put+0x54/0x70
[ 6022.696273] vgic_v3_put+0x20/0xd8
[ 6022.700183] kvm_vgic_put+0x30/0x48
[ 6022.704182] kvm_arch_vcpu_put+0x34/0x50
[ 6022.708614] kvm_sched_out+0x34/0x50
[ 6022.712700] __schedule+0x4bc/0x7f8
[ 6022.716697] schedule+0x50/0xd8
[ 6022.720347] kvm_arch_vcpu_ioctl_run+0x5f0/0x978
[ 6022.725473] kvm_vcpu_ioctl+0x3d4/0x8f8
[ 6022.729820] ksys_ioctl+0x90/0xd0
[ 6022.733642] __arm64_sys_ioctl+0x24/0x30
[ 6022.738074] el0_svc_common.constprop.3+0xa8/0x1e8
[ 6022.743373] do_el0_svc+0x28/0x88
[ 6022.747198] el0_svc+0x14/0x40
[ 6022.750761] el0_sync_handler+0x124/0x2b8
[ 6022.755278] el0_sync+0x140/0x180
[ 6022.759100]
[ 6022.759100] -> #1 (&rq->lock){-.-.}:
[ 6022.764143] _raw_spin_lock+0x38/0x50
[ 6022.768314] task_fork_fair+0x40/0x128
[ 6022.772572] sched_fork+0xe0/0x210
[ 6022.776484] copy_process+0x8c4/0x18d8
[ 6022.780742] _do_fork+0x88/0x6d8
[ 6022.784478] kernel_thread+0x64/0x88
[ 6022.788563] rest_init+0x30/0x270
[ 6022.792390] arch_call_rest_init+0x14/0x1c
[ 6022.796995] start_kernel+0x498/0x4c4
[ 6022.801164]
[ 6022.801164] -> #0 (&p->pi_lock){-.-.}:
[ 6022.806382] __lock_acquire+0xdd8/0x15c8
[ 6022.810813] lock_acquire+0xd0/0x218
[ 6022.814896] _raw_spin_lock_irqsave+0x50/0x78
[ 6022.819761] try_to_wake_up+0x54/0x7a0
[ 6022.824018] wake_up_process+0x1c/0x28
[ 6022.828276] wakeup_softirqd+0x38/0x40
[ 6022.832533] __tasklet_schedule_common+0xc4/0xf0
[ 6022.837658] __tasklet_schedule+0x24/0x30
[ 6022.842176] check_irq_resend+0xc8/0x158
[ 6022.846609] irq_startup+0x74/0x128
[ 6022.850606] __enable_irq+0x6c/0x78
[ 6022.854602] enable_irq+0x54/0xa0
[ 6022.858431] its_make_vpe_non_resident+0xa4/0xb8
[ 6022.863557] vgic_v4_put+0x54/0x70
[ 6022.867469] kvm_arch_vcpu_blocking+0x28/0x38
[ 6022.872336] kvm_vcpu_block+0x48/0x490
[ 6022.876594] kvm_handle_wfx+0x18c/0x310
[ 6022.880938] handle_exit+0x138/0x198
[ 6022.885022] kvm_arch_vcpu_ioctl_run+0x4d4/0x978
[ 6022.890148] kvm_vcpu_ioctl+0x3d4/0x8f8
[ 6022.894494] ksys_ioctl+0x90/0xd0
[ 6022.898317] __arm64_sys_ioctl+0x24/0x30
[ 6022.902748] el0_svc_common.constprop.3+0xa8/0x1e8
[ 6022.908046] do_el0_svc+0x28/0x88
[ 6022.911871] el0_svc+0x14/0x40
[ 6022.915434] el0_sync_handler+0x124/0x2b8
[ 6022.919951] el0_sync+0x140/0x180
[ 6022.923773]
[ 6022.923773] other info that might help us debug this:
[ 6022.923773]
[ 6022.931762] Chain exists of:
[ 6022.931762] &p->pi_lock --> &rq->lock --> &irq_desc_lock_class
[ 6022.931762]
[ 6022.942101] Possible unsafe locking scenario:
[ 6022.942101]
[ 6022.948007] CPU0 CPU1
[ 6022.952523] ---- ----
[ 6022.957039] lock(&irq_desc_lock_class);
[ 6022.961036] lock(&rq->lock);
[ 6022.966595] lock(&irq_desc_lock_class);
[ 6022.973109] lock(&p->pi_lock);
[ 6022.976324]
[ 6022.976324] *** DEADLOCK ***This is happening because we have a pending doorbell that requires retrigger. As SW retriggering is done in a tasklet, we trigger the circular dependency above.
The easy cop-out is to provide a retrigger callback that doesn't require acquiring any extra lock.
--- drivers/irqchip/irq-gic-v3-its.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/irqchip/irq-gic-v3-its.c +6 -0
@@ -3142,12 +3142,18 @@ static int its_vpe_set_irqchip_state(struct irq_data *d,return 0 ; } +static int its_vpe_retrigger (struct irq_data *d) +{ +return !its_vpe_set_irqchip_state (d,IRQCHIP_STATE_PENDING , true); +} +static struct irq_chip its_vpe_irq_chip = { .name ="GICv4-vpe" , .irq_mask = its_vpe_mask_irq, .irq_unmask = its_vpe_unmask_irq, .irq_eoi = irq_chip_eoi_parent, .irq_set_affinity = its_vpe_set_affinity, + .irq_retrigger = its_vpe_retrigger, .irq_set_irqchip_state = its_vpe_set_irqchip_state, .irq_set_vcpu_affinity = its_vpe_set_vcpu_affinity, };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 72/257 md: check arrays is suspended in mddev_detach before call quiesce operations
In reply to Greg Kroah-HartmanFrom: Guoqing Jiang <[email protected]>
[ Upstream commit 6b40bec3b13278d21fa6c1ae7a0bdf2e550eed5f ]
Don't call quiesce(1) and quiesce(0) if array is already suspended, otherwise in level_store, the array is writable after mddev_detach in below part though the intention is to make array writable after resume.
mddev_suspend(mddev); mddev_detach(mddev); ... mddev_resume(mddev);
And it also causes calltrace as follows in [1].
[48005.653834] WARNING: CPU: 1 PID: 45380 at kernel/kthread.c:510 kthread_park+0x77/0x90 [...] [48005.653976] CPU: 1 PID: 45380 Comm: mdadm Tainted: G OE 5.4.10-arch1-1 #1 [48005.653979] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./J4105-ITX, BIOS P1.40 08/06/2018 [48005.653984] RIP: 0010:kthread_park+0x77/0x90 [48005.654015] Call Trace: [48005.654039] r5l_quiesce+0x3c/0x70 [raid456] [48005.654052] raid5_quiesce+0x228/0x2e0 [raid456] [48005.654073] mddev_detach+0x30/0x70 [md_mod] [48005.654090] level_store+0x202/0x670 [md_mod] [48005.654099] ? security_capable+0x40/0x60 [48005.654114] md_attr_store+0x7b/0xc0 [md_mod] [48005.654123] kernfs_fop_write+0xce/0x1b0 [48005.654132] vfs_write+0xb6/0x1a0 [48005.654138] ksys_write+0x67/0xe0 [48005.654146] do_syscall_64+0x4e/0x140 [48005.654155] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [48005.654161] RIP: 0033:0x7fa0c8737497
[1]: https://bugzilla.kernel.org/show_bug.cgi?id=206161
--- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/md.c +1 -1
@@ -6040,7 +6040,7 @@ EXPORT_SYMBOL_GPL(md_stop_writes);static void mddev_detach (struct mddev *mddev) {md_bitmap_wait_behind_writes (mddev); -if (mddev->pers && mddev->pers->quiesce) { +if (mddev->pers && mddev->pers->quiesce && !mddev->suspended) { mddev->pers->quiesce (mddev,1 ); mddev->pers->quiesce (mddev,0 ); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 73/257 firmware: fix a double abort case with fw_load_sysfs_fallback
In reply to Greg Kroah-HartmanFrom: Junyong Sun <[email protected]>
[ Upstream commit bcfbd3523f3c6eea51a74d217a8ebc5463bcb7f4 ]
fw_sysfs_wait_timeout may return err with -ENOENT at fw_load_sysfs_fallback and firmware is already in abort status, no need to abort again, so skip it.
This issue is caused by concurrent situation like below:
when thread 1# wait firmware loading, thread 2# may write -1 to abort loading and wakeup thread 1# before it timeout. so wait_for_completion_killable_timeout of thread 1# would return remaining time which is != 0 with fw_st->status FW_STATUS_ABORTED.And the results would be converted into err -ENOENT in __fw_state_wait_common and transfered to fw_load_sysfs_fallback in thread 1#.
The -ENOENT means firmware status is already at ABORTED, so fw_load_sysfs_fallback no need to get mutex to abort again.
-----------------------------
thread 1#,wait for loadingfw_load_sysfs_fallback
->fw_sysfs_wait_timeout
->__fw_state_wait_common
->wait_for_completion_killable_timeoutin __fw_state_wait_common,
...
93 ret = wait_for_completion_killable_timeout(&fw_st->completion, timeout);
94 if (ret != 0 && fw_st->status == FW_STATUS_ABORTED)
95 return -ENOENT;
96 if (!ret)
97 return -ETIMEDOUT;
98
99 return ret < 0 ? ret : 0;
-----------------------------
thread 2#, write -1 to abort loadingfirmware_loading_store
->fw_load_abort
->__fw_load_abort
->fw_state_aborted
->__fw_state_set
->complete_allin __fw_state_set,
...
111 if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)
112 complete_all(&fw_st->completion);
-------------------------------------------
BTW,the double abort issue would not cause kernel panic or create an issue, but slow down it sometimes.The change is just a minor optimization.
--- drivers/base/firmware_loader/fallback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/firmware_loader/fallback.c +1 -1
@@ -525,7 +525,7 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, } retval =fw_sysfs_wait_timeout (fw_priv, timeout); -if (retval <0 ) { +if (retval <0 && retval != -ENOENT ) {mutex_lock (&fw_lock);fw_load_abort (fw_sysfs);mutex_unlock (&fw_lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 74/257 spi: spi-fsl-dspi: Replace interruptible wait queue with a simple completion
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 4f5ee75ea1718a09149460b3df993f389a67b56a ]
Currently the driver puts the process in interruptible sleep waiting for the interrupt train to finish transfer to/from the tx_buf and rx_buf.
But exiting the process with ctrl-c may make the kernel panic: the wait_event_interruptible call will return -ERESTARTSYS, which a proper driver implementation is perhaps supposed to handle, but nonetheless this one doesn't, and aborts the transfer altogether.
Actually when the task is interrupted, there is still a high chance that the dspi_interrupt is still triggering. And if dspi_transfer_one_message returns execution all the way to the spi_device driver, that can free the spi_message and spi_transfer structures, leaving the interrupts to access a freed tx_buf and rx_buf.
hexdump -C /dev/mtd0
00000000 00 75 68 75 0a ff ff ff ff ff ff ff ff ff ff ff
|.uhu............| 00000010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * ^C[ 38.495955] fsl-dspi 2120000.spi: Waiting for transfer to complete failed! [ 38.503097] spi_master spi2: failed to transfer one message from queue [ 38.509729] Unable to handle kernel paging request at virtual address ffff800095ab3377 [ 38.517676] Mem abort info: [ 38.520474] ESR = 0x96000045 [ 38.523533] EC = 0x25: DABT (current EL), IL = 32 bits [ 38.528861] SET = 0, FnV = 0 [ 38.531921] EA = 0, S1PTW = 0 [ 38.535067] Data abort info: [ 38.537952] ISV = 0, ISS = 0x00000045 [ 38.541797] CM = 0, WnR = 1 [ 38.544771] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000082621000 [ 38.551494] [ffff800095ab3377] pgd=00000020fffff003, p4d=00000020fffff003, pud=0000000000000000 [ 38.560229] Internal error: Oops: 96000045 [#1] PREEMPT SMP [ 38.565819] Modules linked in: [ 38.568882] CPU: 0 PID: 2729 Comm: hexdump Not tainted 5.6.0-rc4-next-20200306-00052-gd8730cdc8a0b-dirty #193 [ 38.578834] Hardware name: Kontron SMARC-sAL28 (Single PHY) on SMARC Eval 2.0 carrier (DT) [ 38.587129] pstate: 20000085 (nzCv daIf -PAN -UAO) [ 38.591941] pc : ktime_get_real_ts64+0x3c/0x110 [ 38.596487] lr : spi_take_timestamp_pre+0x40/0x90 [ 38.601203] sp : ffff800010003d90 [ 38.604525] x29: ffff800010003d90 x28: ffff80001200e000 [ 38.609854] x27: ffff800011da9000 x26: ffff002079c40400 [ 38.615184] x25: ffff8000117fe018 x24: ffff800011daa1a0 [ 38.620513] x23: ffff800015ab3860 x22: ffff800095ab3377 [ 38.625841] x21: 000000000000146e x20: ffff8000120c3000 [ 38.631170] x19: ffff0020795f6e80 x18: ffff800011da9948 [ 38.636498] x17: 0000000000000000 x16: 0000000000000000 [ 38.641826] x15: ffff800095ab3377 x14: 0720072007200720 [ 38.647155] x13: 0720072007200765 x12: 0775076507750771 [ 38.652483] x11: 0720076d076f0772 x10: 0000000000000040 [ 38.657812] x9 : ffff8000108e2100 x8 : ffff800011dcabe8 [ 38.663139] x7 : 0000000000000000 x6 : ffff800015ab3a60 [ 38.668468] x5 : 0000000007200720 x4 : ffff800095ab3377 [ 38.673796] x3 : 0000000000000000 x2 : 0000000000000ab0 [ 38.679125] x1 : ffff800011daa000 x0 : 0000000000000026 [ 38.684454] Call trace: [ 38.686905] ktime_get_real_ts64+0x3c/0x110 [ 38.691100] spi_take_timestamp_pre+0x40/0x90 [ 38.695470] dspi_fifo_write+0x58/0x2c0 [ 38.699315] dspi_interrupt+0xbc/0xd0 [ 38.702987] __handle_irq_event_percpu+0x78/0x2c0 [ 38.707706] handle_irq_event_percpu+0x3c/0x90 [ 38.712161] handle_irq_event+0x4c/0xd0 [ 38.716008] handle_fasteoi_irq+0xbc/0x170 [ 38.720115] generic_handle_irq+0x2c/0x40 [ 38.724135] __handle_domain_irq+0x68/0xc0 [ 38.728243] gic_handle_irq+0xc8/0x160 [ 38.732000] el1_irq+0xb8/0x180 [ 38.735149] spi_nor_spimem_read_data+0xe0/0x140 [ 38.739779] spi_nor_read+0xc4/0x120 [ 38.743364] mtd_read_oob+0xa8/0xc0 [ 38.746860] mtd_read+0x4c/0x80 [ 38.750007] mtdchar_read+0x108/0x2a0 [ 38.753679] __vfs_read+0x20/0x50 [ 38.757002] vfs_read+0xa4/0x190 [ 38.760237] ksys_read+0x6c/0xf0 [ 38.763471] __arm64_sys_read+0x20/0x30 [ 38.767319] el0_svc_common.constprop.3+0x90/0x160 [ 38.772125] do_el0_svc+0x28/0x90 [ 38.775449] el0_sync_handler+0x118/0x190 [ 38.779468] el0_sync+0x140/0x180 [ 38.782793] Code: 91000294 1400000f d50339bf f9405e80 (f90002c0) [ 38.788910] ---[ end trace 55da560db4d6bef7 ]--- [ 38.793540] Kernel panic - not syncing: Fatal exception in interrupt [ 38.799914] SMP: stopping secondary CPUs [ 38.803849] Kernel Offset: disabled [ 38.807344] CPU features: 0x10002,20006008 [ 38.811451] Memory Limit: none [ 38.814513] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
So it is clear that the "interruptible" part isn't handled correctly. When the process receives a signal, one could either attempt a clean abort (which appears to be difficult with this hardware) or just keep restarting the sleep until the wait queue really completes. But checking in a loop for -ERESTARTSYS is a bit too complicated for this driver, so just make the sleep uninterruptible, to avoid all that nonsense.
The wait queue was actually restructured as a completion, after polling other drivers for the most "popular" approach.
--- drivers/spi/spi-fsl-dspi.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-)
drivers/spi/spi-fsl-dspi.c +6 -13
@@ -196,8 +196,7 @@ struct fsl_dspi {u8 bytes_per_word;const struct fsl_dspi_devtype_data *devtype_data; -wait_queue_head_t waitq; -u32 waitflags; +struct completion xfer_done;struct fsl_dspi_dma *dma; };
@@ -714,10 +713,8 @@ static irqreturn_t dspi_interrupt(int irq, void *dev_id)if (!(spi_sr &SPI_SR_EOQF ))return IRQ_NONE ; -if (dspi_rxtx (dspi) ==0 ) { - dspi->waitflags =1 ; -wake_up_interruptible (&dspi->waitq); - } +if (dspi_rxtx (dspi) ==0 ) +complete (&dspi->xfer_done);return IRQ_HANDLED ; }
@@ -815,13 +812,9 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, status =dspi_poll (dspi); }while (status == -EINPROGRESS ); }else if (trans_mode !=DSPI_DMA_MODE ) { - status =wait_event_interruptible (dspi->waitq, - dspi->waitflags); - dspi->waitflags =0 ; +wait_for_completion (&dspi->xfer_done); +reinit_completion (&dspi->xfer_done); } -if (status) -dev_err (&dspi->pdev->dev, -"Waiting for transfer to complete failed!\n" );spi_transfer_delay_exec (transfer); }
@@ -1161,7 +1154,7 @@ static int dspi_probe(struct platform_device *pdev) goto out_clk_put; } -init_waitqueue_head (&dspi->waitq); +init_completion (&dspi->xfer_done); poll_mode:
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 75/257 locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
In reply to Greg Kroah-HartmanFrom: Boqun Feng <[email protected]>
[ Upstream commit 25016bd7f4caf5fc983bbab7403d08e64cba3004 ]
Qian Cai reported a bug when PROVE_RCU_LIST=y, and read on /proc/lockdep triggered a warning:
[ ] DEBUG_LOCKS_WARN_ON(current->hardirqs_enabled)
...
[ ] Call Trace:
[ ] lock_is_held_type+0x5d/0x150 [ ] ? rcu_lockdep_current_cpu_online+0x64/0x80 [ ] rcu_read_lock_any_held+0xac/0x100 [ ] ? rcu_read_lock_held+0xc0/0xc0 [ ] ? __slab_free+0x421/0x540 [ ] ? kasan_kmalloc+0x9/0x10 [ ] ? __kmalloc_node+0x1d7/0x320 [ ] ? kvmalloc_node+0x6f/0x80 [ ] __bfs+0x28a/0x3c0 [ ] ? class_equal+0x30/0x30 [ ] lockdep_count_forward_deps+0x11a/0x1a0
The warning got triggered because lockdep_count_forward_deps() call __bfs() without current->lockdep_recursion being set, as a result a lockdep internal function (__bfs()) is checked by lockdep, which is unexpected, and the inconsistency between the irq-off state and the state traced by lockdep caused the warning.
Apart from this warning, lockdep internal functions like __bfs() should always be protected by current->lockdep_recursion to avoid potential deadlocks and data inconsistency, therefore add the current->lockdep_recursion on-and-off section to protect __bfs() in both lockdep_count_forward_deps() and lockdep_count_backward_deps()
--- kernel/locking/lockdep.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/locking/lockdep.c +4 -0
@@ -1719,9 +1719,11 @@ unsigned long lockdep_count_forward_deps(struct lock_class *class) this.class = class;raw_local_irq_save (flags); + current->lockdep_recursion =1 ;arch_spin_lock (&lockdep_lock); ret =__lockdep_count_forward_deps (&this);arch_spin_unlock (&lockdep_lock); + current->lockdep_recursion =0 ;raw_local_irq_restore (flags);return ret;
@@ -1746,9 +1748,11 @@ unsigned long lockdep_count_backward_deps(struct lock_class *class) this.class = class;raw_local_irq_save (flags); + current->lockdep_recursion =1 ;arch_spin_lock (&lockdep_lock); ret =__lockdep_count_backward_deps (&this);arch_spin_unlock (&lockdep_lock); + current->lockdep_recursion =0 ;raw_local_irq_restore (flags);return ret;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 76/257 block, bfq: fix use-after-free in bfq_idle_slice_timer_body
In reply to Greg Kroah-HartmanFrom: Zhiqiang Liu <[email protected]>
[ Upstream commit 2f95fa5c955d0a9987ffdc3a095e2f4e62c5f2a9 ]
In bfq_idle_slice_timer func, bfqq = bfqd->in_service_queue is not in bfqd-lock critical section. The bfqq, which is not equal to NULL in bfq_idle_slice_timer, may be freed after passing to bfq_idle_slice_timer_body. So we will access the freed memory.
In addition, considering the bfqq may be in race, we should firstly check whether bfqq is in service before doing something on it in bfq_idle_slice_timer_body func. If the bfqq in race is not in service, it means the bfqq has been expired through __bfq_bfqq_expire func, and wait_request flags has been cleared in __bfq_bfqd_reset_in_service func. So we do not need to re-clear the wait_request of bfqq which is not in service.
KASAN log is given as follows:
[13058.354613] ================================================================== [13058.354640] BUG: KASAN: use-after-free in bfq_idle_slice_timer+0xac/0x290 [13058.354644] Read of size 8 at addr ffffa02cf3e63f78 by task fork13/19767 [13058.354646] [13058.354655] CPU: 96 PID: 19767 Comm: fork13 [13058.354661] Call trace: [13058.354667] dump_backtrace+0x0/0x310 [13058.354672] show_stack+0x28/0x38 [13058.354681] dump_stack+0xd8/0x108 [13058.354687] print_address_description+0x68/0x2d0 [13058.354690] kasan_report+0x124/0x2e0 [13058.354697] __asan_load8+0x88/0xb0 [13058.354702] bfq_idle_slice_timer+0xac/0x290 [13058.354707] __hrtimer_run_queues+0x298/0x8b8 [13058.354710] hrtimer_interrupt+0x1b8/0x678 [13058.354716] arch_timer_handler_phys+0x4c/0x78 [13058.354722] handle_percpu_devid_irq+0xf0/0x558 [13058.354731] generic_handle_irq+0x50/0x70 [13058.354735] __handle_domain_irq+0x94/0x110 [13058.354739] gic_handle_irq+0x8c/0x1b0 [13058.354742] el1_irq+0xb8/0x140 [13058.354748] do_wp_page+0x260/0xe28 [13058.354752] __handle_mm_fault+0x8ec/0x9b0 [13058.354756] handle_mm_fault+0x280/0x460 [13058.354762] do_page_fault+0x3ec/0x890 [13058.354765] do_mem_abort+0xc0/0x1b0 [13058.354768] el0_da+0x24/0x28 [13058.354770] [13058.354773] Allocated by task 19731: [13058.354780] kasan_kmalloc+0xe0/0x190 [13058.354784] kasan_slab_alloc+0x14/0x20 [13058.354788] kmem_cache_alloc_node+0x130/0x440 [13058.354793] bfq_get_queue+0x138/0x858 [13058.354797] bfq_get_bfqq_handle_split+0xd4/0x328 [13058.354801] bfq_init_rq+0x1f4/0x1180 [13058.354806] bfq_insert_requests+0x264/0x1c98 [13058.354811] blk_mq_sched_insert_requests+0x1c4/0x488 [13058.354818] blk_mq_flush_plug_list+0x2d4/0x6e0 [13058.354826] blk_flush_plug_list+0x230/0x548 [13058.354830] blk_finish_plug+0x60/0x80 [13058.354838] read_pages+0xec/0x2c0 [13058.354842] __do_page_cache_readahead+0x374/0x438 [13058.354846] ondemand_readahead+0x24c/0x6b0 [13058.354851] page_cache_sync_readahead+0x17c/0x2f8 [13058.354858] generic_file_buffered_read+0x588/0xc58 [13058.354862] generic_file_read_iter+0x1b4/0x278 [13058.354965] ext4_file_read_iter+0xa8/0x1d8 [ext4] [13058.354972] __vfs_read+0x238/0x320 [13058.354976] vfs_read+0xbc/0x1c0 [13058.354980] ksys_read+0xdc/0x1b8 [13058.354984] __arm64_sys_read+0x50/0x60 [13058.354990] el0_svc_common+0xb4/0x1d8 [13058.354994] el0_svc_handler+0x50/0xa8 [13058.354998] el0_svc+0x8/0xc [13058.354999] [13058.355001] Freed by task 19731: [13058.355007] __kasan_slab_free+0x120/0x228 [13058.355010] kasan_slab_free+0x10/0x18 [13058.355014] kmem_cache_free+0x288/0x3f0 [13058.355018] bfq_put_queue+0x134/0x208 [13058.355022] bfq_exit_icq_bfqq+0x164/0x348 [13058.355026] bfq_exit_icq+0x28/0x40 [13058.355030] ioc_exit_icq+0xa0/0x150 [13058.355035] put_io_context_active+0x250/0x438 [13058.355038] exit_io_context+0xd0/0x138 [13058.355045] do_exit+0x734/0xc58 [13058.355050] do_group_exit+0x78/0x220 [13058.355054] __wake_up_parent+0x0/0x50 [13058.355058] el0_svc_common+0xb4/0x1d8 [13058.355062] el0_svc_handler+0x50/0xa8 [13058.355066] el0_svc+0x8/0xc [13058.355067] [13058.355071] The buggy address belongs to the object at ffffa02cf3e63e70#012 which belongs to the cache bfq_queue of size 464 [13058.355075] The buggy address is located 264 bytes inside of#012 464-byte region [ffffa02cf3e63e70, ffffa02cf3e64040) [13058.355077] The buggy address belongs to the page: [13058.355083] page:ffff7e80b3cf9800 count:1 mapcount:0 mapping:ffff802db5c90780 index:0xffffa02cf3e606f0 compound_mapcount: 0 [13058.366175] flags: 0x2ffffe0000008100(slab|head) [13058.370781] raw: 2ffffe0000008100 ffff7e80b53b1408 ffffa02d730c1c90 ffff802db5c90780 [13058.370787] raw: ffffa02cf3e606f0 0000000000370023 00000001ffffffff 0000000000000000 [13058.370789] page dumped because: kasan: bad access detected [13058.370791] [13058.370792] Memory state around the buggy address: [13058.370797] ffffa02cf3e63e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fb fb [13058.370801] ffffa02cf3e63e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [13058.370805] >ffffa02cf3e63f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [13058.370808] ^ [13058.370811] ffffa02cf3e63f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [13058.370815] ffffa02cf3e64000: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [13058.370817] ================================================================== [13058.370820] Disabling lock debugging due to kernel taint
Here, we directly pass the bfqd to bfq_idle_slice_timer_body func. --V2->V3: rewrite the comment as suggested by Paolo Valente V1->V2: add one comment, and add Fixes and Reported-by tag.
--- block/bfq-iosched.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
block/bfq-iosched.c +12 -4
@@ -6214,20 +6214,28 @@ static struct bfq_queue *bfq_init_rq(struct request *rq)return bfqq; } -static void bfq_idle_slice_timer_body (struct bfq_queue *bfqq) +static void +bfq_idle_slice_timer_body (struct bfq_data *bfqd,struct bfq_queue *bfqq) { -struct bfq_data *bfqd = bfqq->bfqd;enum bfqq_expiration reason;unsigned long flags;spin_lock_irqsave (&bfqd->lock, flags); -bfq_clear_bfqq_wait_request (bfqq); +/* +* Considering that bfqq may be in race, we should firstly check +* whether bfqq is in service before doing something on it. If +* the bfqq in race is not in service, it has already been expired +* through __bfq_bfqq_expire func and its wait_request flags has +* been cleared in __bfq_bfqd_reset_in_service func. +*/ if (bfqq != bfqd->in_service_queue) {spin_unlock_irqrestore (&bfqd->lock, flags);return ; } +bfq_clear_bfqq_wait_request (bfqq); +if (bfq_bfqq_budget_timeout (bfqq))/* * Also here the queue can be safely expired
@@ -6272,7 +6280,7 @@ static enum hrtimer_restart bfq_idle_slice_timer(struct hrtimer *timer)* early. */ if (bfqq) -bfq_idle_slice_timer_body (bfqq); +bfq_idle_slice_timer_body (bfqd, bfqq);return HRTIMER_NORESTART ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 77/257 btrfs: qgroup: ensure qgroup_rescan_running is only set when the worker is at least queued
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
[ Upstream commit d61acbbf54c612ea9bf67eed609494cda0857b3a ]
[BUG]
There are some reports about btrfs wait forever to unmount itself, with the following call trace:
INFO: task umount:4631 blocked for more than 491 seconds.
Tainted: G X 5.3.8-2-default #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
umount D 0 4631 3337 0x00000000
Call Trace:
([<00000000174adf7a>] __schedule+0x342/0x748)
[<00000000174ae3ca>] schedule+0x4a/0xd8
[<00000000174b1f08>] schedule_timeout+0x218/0x420
[<00000000174af10c>] wait_for_common+0x104/0x1d8
[<000003ff804d6994>] btrfs_qgroup_wait_for_completion+0x84/0xb0 [btrfs]
[<000003ff8044a616>] close_ctree+0x4e/0x380 [btrfs]
[<0000000016fa3136>] generic_shutdown_super+0x8e/0x158
[<0000000016fa34d6>] kill_anon_super+0x26/0x40
[<000003ff8041ba88>] btrfs_kill_super+0x28/0xc8 [btrfs]
[<0000000016fa39f8>] deactivate_locked_super+0x68/0x98
[<0000000016fcb198>] cleanup_mnt+0xc0/0x140
[<0000000016d6a846>] task_work_run+0xc6/0x110
[<0000000016d04f76>] do_notify_resume+0xae/0xb8
[<00000000174b30ae>] system_call+0xe2/0x2c8[CAUSE]
The problem happens when we have called qgroup_rescan_init(), but not queued the worker. It can be caused mostly by error handling.
Qgroup ioctl thread | Unmount thread
----------------------------------------+-----------------------------------
| btrfs_qgroup_rescan() | |- qgroup_rescan_init() | | |- qgroup_rescan_running = true; | | | |- trans = btrfs_join_transaction() | | Some error happened | | | |- btrfs_qgroup_rescan() returns error | But qgroup_rescan_running == true; | | close_ctree() | |- btrfs_qgroup_wait_for_completion() | |- running == true; | |- wait_for_completion();
btrfs_qgroup_rescan_worker is never queued, thus no one is going to wake up close_ctree() and we get a deadlock.
All involved qgroup_rescan_init() callers are:
- btrfs_qgroup_rescan()
The example above. It's possible to trigger the deadlock when error happened.
- btrfs_quota_enable()
Not possible. Just after qgroup_rescan_init() we queue the work.
- btrfs_read_qgroup_config()
It's possible to trigger the deadlock. It only init the work, the work queueing happens in btrfs_qgroup_rescan_resume(). Thus if error happened in between, deadlock is possible.
We shouldn't set fs_info->qgroup_rescan_running just in qgroup_rescan_init(), as at that stage we haven't yet queued qgroup rescan worker to run.
[FIX]
Set qgroup_rescan_running before queueing the work, so that we ensure the rescan work is queued when we wait for it.
--- fs/btrfs/qgroup.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
fs/btrfs/qgroup.c +9 -2
@@ -1030,6 +1030,7 @@ out_add_root: ret =qgroup_rescan_init (fs_info,0 ,1 );if (!ret) {qgroup_rescan_zero_tracking (fs_info); + fs_info->qgroup_rescan_running = true;btrfs_queue_work (fs_info->qgroup_rescan_workers, &fs_info->qgroup_rescan_work); }
@@ -3276,7 +3277,6 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid, sizeof(fs_info->qgroup_rescan_progress)); fs_info->qgroup_rescan_progress.objectid = progress_objectid;init_completion (&fs_info->qgroup_rescan_completion); - fs_info->qgroup_rescan_running = true;spin_unlock (&fs_info->qgroup_lock);mutex_unlock (&fs_info->qgroup_rescan_lock);
@@ -3339,8 +3339,11 @@ btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info)qgroup_rescan_zero_tracking (fs_info); +mutex_lock (&fs_info->qgroup_rescan_lock); + fs_info->qgroup_rescan_running = true;btrfs_queue_work (fs_info->qgroup_rescan_workers, &fs_info->qgroup_rescan_work); +mutex_unlock (&fs_info->qgroup_rescan_lock);return 0 ; }
@@ -3376,9 +3379,13 @@ int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info,void btrfs_qgroup_rescan_resume (struct btrfs_fs_info *fs_info) { -if (fs_info->qgroup_flags &BTRFS_QGROUP_STATUS_FLAG_RESCAN ) +if (fs_info->qgroup_flags &BTRFS_QGROUP_STATUS_FLAG_RESCAN ) { +mutex_lock (&fs_info->qgroup_rescan_lock); + fs_info->qgroup_rescan_running = true;btrfs_queue_work (fs_info->qgroup_rescan_workers, &fs_info->qgroup_rescan_work); +mutex_unlock (&fs_info->qgroup_rescan_lock); + } }/*
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 78/257 btrfs: remove a BUG_ON() from merge_reloc_roots()
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit 7b7b74315b24dc064bc1c683659061c3d48f8668 ]
This was pretty subtle, we default to reloc roots having 0 root refs, so if we crash in the middle of the relocation they can just be deleted. If we successfully complete the relocation operations we'll set our root refs to 1 in prepare_to_merge() and then go on to merge_reloc_roots().
At prepare_to_merge() time if any of the reloc roots have a 0 reference still, we will remove that reloc root from our reloc root rb tree, and then clean it up later.
However this only happens if we successfully start a transaction. If we've aborted previously we will skip this step completely, and only have reloc roots with a reference count of 0, but were never properly removed from the reloc control's rb tree.
This isn't a problem per-se, our references are held by the list the reloc roots are on, and by the original root the reloc root belongs to. If we end up in this situation all the reloc roots will be added to the dirty_reloc_list, and then properly dropped at that point. The reloc control will be free'd and the rb tree is no longer used.
There were two options when fixing this, one was to remove the BUG_ON(), the other was to make prepare_to_merge() handle the case where we couldn't start a trans handle.
IMO this is the cleaner solution. I started with handling the error in prepare_to_merge(), but it turned out super ugly. And in the end this BUG_ON() simply doesn't matter, the cleanup was happening properly, we were just panicing because this BUG_ON() only matters in the success case. So I've opted to just remove it and add a comment where it was.
--- fs/btrfs/relocation.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
fs/btrfs/relocation.c +15 -1
@@ -2561,7 +2561,21 @@ out:free_reloc_roots (&reloc_roots); } -BUG_ON (!RB_EMPTY_ROOT (&rc->reloc_root_tree.rb_root)); +/* +* We used to have +* +* BUG_ON(!RB_EMPTY_ROOT(&rc->reloc_root_tree.rb_root)); +* +* here, but it's wrong. If we fail to start the transaction in +* prepare_to_merge() we will have only 0 ref reloc roots, none of which +* have actually been removed from the reloc_root_tree rb tree. This is +* fine because we're bailing here, and we hold a reference on the root +* for the list that holds it, so these roots will be cleaned up when we +* do the reloc_dirty_list afterwards. Meanwhile the root->reloc_root +* will be cleaned up on unmount. +* +* The remaining nodes will be cleaned up by free_reloc_control. +*/ }static void free_block_list (struct rb_root *blocks)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 79/257 btrfs: restart relocate_tree_blocks properly
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit 50dbbb71c79df89532ec41d118d59386e5a877e3 ]
There are two bugs here, but fixing them independently would just result in pain if you happened to bisect between the two patches.
First is how we handle the -EAGAIN from relocate_tree_block(). We don't set error, unless we happen to be the first node, which makes no sense, I have no idea what the code was trying to accomplish here.
We in fact _do_ want err set here so that we know we need to restart in relocate_block_group(). Also we need finish_pending_nodes() to not actually call link_to_upper(), because we didn't actually relocate the block.
And then if we do get -EAGAIN we do not want to set our backref cache last_trans to the one before ours. This would force us to update our backref cache if we didn't cross transaction ids, which would mean we'd have some nodes updated to their new_bytenr, but still able to find their old bytenr because we're searching the same commit root as the last time we went through relocate_tree_blocks.
Fixing these two things keeps us from panicing when we start breaking out of relocate_tree_blocks() either for delayed ref flushing or enospc.
--- fs/btrfs/relocation.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
fs/btrfs/relocation.c +2 -9
@@ -3175,9 +3175,8 @@ int relocate_tree_blocks(struct btrfs_trans_handle *trans, ret =relocate_tree_block (trans, rc, node, &block->key, path);if (ret <0 ) { -if (ret != -EAGAIN || &block->rb_node ==rb_first (blocks)) - err = ret; - goto out; + err = ret; +break ; } } out:
@@ -4151,12 +4150,6 @@ restart:if (!RB_EMPTY_ROOT (&blocks)) { ret =relocate_tree_blocks (trans, rc, &blocks);if (ret <0 ) { -/* -* if we fail to relocate tree blocks, force to update -* backref cache when committing transaction. -*/ - rc->backref_cache.last_trans = trans->transid -1 ; -if (ret != -EAGAIN ) { err = ret;break ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 80/257 btrfs: track reloc roots based on their commit root bytenr
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit ea287ab157c2816bf12aad4cece41372f9d146b4 ]
We always search the commit root of the extent tree for looking up back references, however we track the reloc roots based on their current bytenr.
This is wrong, if we commit the transaction between relocating tree blocks we could end up in this code in build_backref_tree
if (key.objectid == key.offset) {
/*
* Only root blocks of reloc trees use backref
* pointing to itself.
*/
root = find_reloc_root(rc, cur->bytenr);
ASSERT(root);
cur->root = root;
break;}
find_reloc_root() is looking based on the bytenr we had in the commit root, but if we've COWed this reloc root we will not find that bytenr, and we will trip over the ASSERT(root).
Fix this by using the commit_root->start bytenr for indexing the commit root. Then we change the __update_reloc_root() caller to be used when we switch the commit root for the reloc root during commit.
This fixes the panic I was seeing when we started throttling relocation for delayed refs.
--- fs/btrfs/relocation.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-)
fs/btrfs/relocation.c +7 -10
@@ -1298,7 +1298,7 @@ static int __must_check __add_reloc_root(struct btrfs_root *root)if (!node)return -ENOMEM ; - node->bytenr = root->node->start; + node->bytenr = root->commit_root->start; node->data = root;spin_lock (&rc->reloc_root_tree.lock);
@@ -1329,10 +1329,11 @@ static void __del_reloc_root(struct btrfs_root *root)if (rc && root->node) {spin_lock (&rc->reloc_root_tree.lock); rb_node =tree_search (&rc->reloc_root_tree.rb_root, - root->node->start); + root->commit_root->start);if (rb_node) { node = rb_entry(rb_node, struct mapping_node, rb_node);rb_erase (&node->rb_node, &rc->reloc_root_tree.rb_root); +RB_CLEAR_NODE (&node->rb_node); }spin_unlock (&rc->reloc_root_tree.lock);if (!node)
@@ -1350,7 +1351,7 @@ static void __del_reloc_root(struct btrfs_root *root)* helper to update the 'address of tree root -> reloc tree' * mapping */ -static int __update_reloc_root (struct btrfs_root *root,u64 new_bytenr) +static int __update_reloc_root (struct btrfs_root *root) {struct btrfs_fs_info *fs_info = root->fs_info;struct rb_node *rb_node;
@@ -1359,7 +1360,7 @@ static int __update_reloc_root(struct btrfs_root *root, u64 new_bytenr)spin_lock (&rc->reloc_root_tree.lock); rb_node =tree_search (&rc->reloc_root_tree.rb_root, - root->node->start); + root->commit_root->start);if (rb_node) { node = rb_entry(rb_node, struct mapping_node, rb_node);rb_erase (&node->rb_node, &rc->reloc_root_tree.rb_root);
@@ -1371,7 +1372,7 @@ static int __update_reloc_root(struct btrfs_root *root, u64 new_bytenr)BUG_ON ((struct btrfs_root *)node->data != root);spin_lock (&rc->reloc_root_tree.lock); - node->bytenr = new_bytenr; + node->bytenr = root->node->start; rb_node =tree_insert (&rc->reloc_root_tree.rb_root, node->bytenr, &node->rb_node);spin_unlock (&rc->reloc_root_tree.lock);
@@ -1529,6 +1530,7 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans, }if (reloc_root->commit_root != reloc_root->node) { +__update_reloc_root (reloc_root);btrfs_set_root_node (root_item, reloc_root->node);free_extent_buffer (reloc_root->commit_root); reloc_root->commit_root =btrfs_root_node (reloc_root);
@@ -4715,11 +4717,6 @@ int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,BUG_ON (rc->stage ==UPDATE_DATA_PTRS && root->root_key.objectid ==BTRFS_DATA_RELOC_TREE_OBJECTID ); -if (root->root_key.objectid ==BTRFS_TREE_RELOC_OBJECTID ) { -if (buf == root->node) -__update_reloc_root (root, cow->start); - } - level =btrfs_header_level (buf);if (btrfs_header_generation (buf) <=btrfs_root_last_snapshot (&root->root_item))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 81/257 ASoC: fix regwmask
In reply to Greg Kroah-HartmanFrom: 이경택 <[email protected]>
commit 0ab070917afdc93670c2d0ea02ab6defb6246a7c upstream.
If regwshift is 32 and the selected architecture compiles '<<' operator for signed int literal into rotating shift, '1<<regwshift' became 1 and it makes regwmask to 0x0.
The literal is set to unsigned long to get intended regwmask.
--- sound/soc/soc-ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/soc-ops.c +2 -2
@@ -825,7 +825,7 @@ int snd_soc_get_xr_sx(struct snd_kcontrounsigned int regbase = mc->regbase;unsigned int regcount = mc->regcount;unsigned int regwshift = component->val_bytes *BITS_PER_BYTE ; -unsigned int regwmask = (1 <<regwshift)-1 ; +unsigned int regwmask = (1UL <<regwshift)-1 ;unsigned int invert = mc->invert;unsigned long mask = (1UL <<mc->nbits)-1 ;long min = mc->min;
@@ -874,7 +874,7 @@ int snd_soc_put_xr_sx(struct snd_kcontrounsigned int regbase = mc->regbase;unsigned int regcount = mc->regcount;unsigned int regwshift = component->val_bytes *BITS_PER_BYTE ; -unsigned int regwmask = (1 <<regwshift)-1 ; +unsigned int regwmask = (1UL <<regwshift)-1 ;unsigned int invert = mc->invert;unsigned long mask = (1UL <<mc->nbits)-1 ;long max = mc->max;
Greg Kroah-Hartman
maintainerPATCH 82/257 ASoC: dapm: connect virtual mux with default value
In reply to Greg Kroah-HartmanFrom: 이경택 <[email protected]>
commit 3bbbb7728fc853d71dbce4073fef9f281fbfb4dd upstream.
Since a virtual mixer has no backing registers
to decide which path to connect,
it will try to match with initial state.
This is to ensure that the default mixer choice will be correctly powered up during initialization.
Invert flag is used to select initial state of the virtual switch. Since actual hardware can't be disconnected by virtual switch, connected is better choice as initial state in many cases.
--- sound/soc/soc-dapm.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/soc/soc-dapm.c +7 -1
@@ -802,7 +802,13 @@ static void dapm_set_mixer_path_status(s val = max - val; p->connect = !!val; }else { - p->connect =0 ; +/* since a virtual mixer has no backing registers to +* decide which path to connect, it will try to match +* with initial state. This is to ensure +* that the default mixer choice will be +* correctly powered up during initialization. +*/ + p->connect = invert; } }
Greg Kroah-Hartman
maintainerPATCH 83/257 ASoC: dpcm: allow start or stop during pause for backend
In reply to Greg Kroah-HartmanFrom: 이경택 <[email protected]>
commit 21fca8bdbb64df1297e8c65a746c4c9f4a689751 upstream.
soc_compr_trigger_fe() allows start or stop after pause_push. In dpcm_be_dai_trigger(), however, only pause_release is allowed command after pause_push.
So, start or stop after pause in compress offload is always returned as error if the compress offload is used with dpcm. To fix the problem, SND_SOC_DPCM_STATE_PAUSED should be allowed for start or stop command.
--- sound/soc/soc-pcm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/soc/soc-pcm.c +4 -2
@@ -2256,7 +2256,8 @@ int dpcm_be_dai_trigger(struct snd_soc_pswitch (cmd) {case SNDRV_PCM_TRIGGER_START :if ((be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PREPARE ) && - (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_STOP )) + (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_STOP ) && + (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PAUSED ))continue ; ret =dpcm_do_trigger (dpcm, be_substream, cmd);
@@ -2286,7 +2287,8 @@ int dpcm_be_dai_trigger(struct snd_soc_p be->dpcm[stream].state =SND_SOC_DPCM_STATE_START ;break ;case SNDRV_PCM_TRIGGER_STOP : -if (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_START ) +if ((be->dpcm[stream].state !=SND_SOC_DPCM_STATE_START ) && + (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PAUSED ))continue ;if (!snd_soc_dpcm_can_be_free_stop (fe, be, stream))
Greg Kroah-Hartman
maintainerPATCH 84/257 ASoC: topology: use name_prefix for new kcontrol
In reply to Greg Kroah-HartmanFrom: 이경택 <[email protected]>
commit abca9e4a04fbe9c6df4d48ca7517e1611812af25 upstream.
Current topology doesn't add prefix of component to new kcontrol.
--- sound/soc/soc-topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-topology.c +1 -1
@@ -362,7 +362,7 @@ static int soc_tplg_add_kcontrol(structstruct snd_soc_component *comp = tplg->comp;return soc_tplg_add_dcontrol (comp->card->snd_card, - comp->dev, k,NULL , comp, kcontrol); + comp->dev, k, comp->name_prefix, comp, kcontrol); }/* remove a mixer kcontrol */
Greg Kroah-Hartman
maintainerPATCH 85/257 usb: gadget: f_fs: Fix use after free issue as part of queue failure
In reply to Greg Kroah-HartmanFrom: Sriharsha Allenki <[email protected]>
commit f63ec55ff904b2f2e126884fcad93175f16ab4bb upstream.
In AIO case, the request is freed up if ep_queue fails. However, io_data->req still has the reference to this freed request. In the case of this failure if there is aio_cancel call on this io_data it will lead to an invalid dequeue operation and a potential use after free issue.
Fix this by setting the io_data->req to NULL when the request is freed as part of queue failure.
--- drivers/usb/gadget/function/f_fs.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/gadget/function/f_fs.c +1 -0
@@ -1120,6 +1120,7 @@ static ssize_t ffs_epfile_io(struct file ret =usb_ep_queue (ep->ep, req,GFP_ATOMIC );if (unlikely (ret)) { + io_data->req =NULL ;usb_ep_free_request (ep->ep, req); goto error_lock; }
Greg Kroah-Hartman
maintainerPATCH 86/257 usb: gadget: composite: Inform controller driver of self-powered
In reply to Greg Kroah-HartmanFrom: Thinh Nguyen <[email protected]>
commit 5e5caf4fa8d3039140b4548b6ab23dd17fce9b2c upstream.
Different configuration/condition may draw different power. Inform the controller driver of the change so it can respond properly (e.g. GET_STATUS request). This fixes an issue with setting MaxPower from configfs. The composite driver doesn't check this value when setting self-powered.
--- drivers/usb/gadget/composite.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/gadget/composite.c +9 -0
@@ -861,6 +861,11 @@ static int set_config(struct usb_composielse power =min (power,900U ); done: +if (power <=USB_SELF_POWER_VBUS_MAX_DRAW ) +usb_gadget_set_selfpowered (gadget); +else +usb_gadget_clear_selfpowered (gadget); +usb_gadget_vbus_draw (gadget, power);if (result >=0 && cdev->delayed_status) result =USB_GADGET_DELAYED_STATUS ;
@@ -2279,6 +2284,7 @@ void composite_suspend(struct usb_gadget cdev->suspended =1 ; +usb_gadget_set_selfpowered (gadget);usb_gadget_vbus_draw (gadget,2 ); }
@@ -2307,6 +2313,9 @@ void composite_resume(struct usb_gadgetelse maxpower =min (maxpower,900U ); +if (maxpower >USB_SELF_POWER_VBUS_MAX_DRAW ) +usb_gadget_clear_selfpowered (gadget); +usb_gadget_vbus_draw (gadget, maxpower); }
Greg Kroah-Hartman
maintainerPATCH 87/257 ALSA: usb-audio: Add mixer workaround for TRX40 and co
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 2a48218f8e23d47bd3e23cfdfb8aa9066f7dc3e6 upstream.
Some recent boards (supposedly with a new AMD platform) contain the USB audio class 2 device that is often tied with HD-audio. The device exposes an Input Gain Pad control (id=19, control=12) but this node doesn't behave correctly, returning an error for each inquiry of GET_MIN and GET_MAX that should have been mandatory.
As a workaround, simply ignore this node by adding a usbmix_name_map table entry. The currently known devices are:
* 0414:a002 - Gigabyte TRX40 Aorus Pro WiFi
* 0b05:1916 - ASUS ROG Zenith II
* 0b05:1917 - ASUS ROG Strix
* 0db0:0d64 - MSI TRX40 Creator
* 0db0:543d - MSI TRX40
--- sound/usb/mixer_maps.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
sound/usb/mixer_maps.c +28 -0
@@ -349,6 +349,14 @@ static const struct usbmix_name_map dell { 0 } }; +/* Some mobos shipped with a dummy HD-audio show the invalid GET_MIN/GET_MAX +* response for Input Gain Pad (id=19, control=12). Skip it. +*/ +static const struct usbmix_name_map asus_rog_map[] = { + {19 ,NULL ,12 },/* FU, Input Gain Pad */ + {} +}; +/* * Control map entries */
@@ -468,6 +476,26 @@ static struct usbmix_ctl_map usbmix_ctl_ .id = USB_ID(0x05a7, 0x1020), .map = bose_companion5_map, }, + { /* Gigabyte TRX40 Aorus Pro WiFi */ + .id = USB_ID(0x0414, 0xa002), + .map = asus_rog_map, + }, + { /* ASUS ROG Zenith II */ + .id = USB_ID(0x0b05, 0x1916), + .map = asus_rog_map, + }, + { /* ASUS ROG Strix */ + .id = USB_ID(0x0b05, 0x1917), + .map = asus_rog_map, + }, + { /* MSI TRX40 Creator */ + .id = USB_ID(0x0db0, 0x0d64), + .map = asus_rog_map, + }, + { /* MSI TRX40 */ + .id = USB_ID(0x0db0, 0x543d), + .map = asus_rog_map, + }, { 0 } /* terminator */ };
Greg Kroah-Hartman
maintainerPATCH 88/257 ALSA: hda: Add driver blacklist
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 3c6fd1f07ed03a04debbb9a9d782205f1ef5e2ab upstream.
The recent AMD platform exposes an HD-audio bus but without any actual codecs, which is internally tied with a USB-audio device, supposedly. It results in "no codecs" error of HD-audio bus driver, and it's nothing but a waste of resources.
This patch introduces a static blacklist table for skipping such a known bogus PCI SSID entry. As of writing this patch, the known SSIDs are:
* 1043:874f - ASUS ROG Zenith II / Strix
* 1462:cb59 - MSI TRX40 Creator
* 1462:cb60 - MSI TRX40
--- sound/pci/hda/hda_intel.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
sound/pci/hda/hda_intel.c +16 -0
@@ -2074,6 +2074,17 @@ static void pcm_mmap_prepare(struct snd_#endif } +/* Blacklist for skipping the whole probe: +* some HD-audio PCI entries are exposed without any codecs, and such devices +* should be ignored from the beginning. +*/ +static const struct snd_pci_quirk driver_blacklist[] = { +SND_PCI_QUIRK (0x1043 ,0x874f ,"ASUS ROG Zenith II / Strix" ,0 ), +SND_PCI_QUIRK (0x1462 ,0xcb59 ,"MSI TRX40 Creator" ,0 ), +SND_PCI_QUIRK (0x1462 ,0xcb60 ,"MSI TRX40" ,0 ), + {} +}; +static const struct hda_controller_ops pci_hda_ops = { .disable_msi_reset_irq = disable_msi_reset_irq, .pcm_mmap_prepare = pcm_mmap_prepare,
@@ -2090,6 +2101,11 @@ static int azx_probe(struct pci_dev *pcibool schedule_probe;int err; +if (snd_pci_quirk_lookup (pci, driver_blacklist)) { +dev_info (&pci->dev,"Skipping the blacklisted device\n" ); +return -ENODEV ; + } +if (dev >=SNDRV_CARDS )return -ENODEV ;if (!enable[dev]) {
Greg Kroah-Hartman
maintainerPATCH 89/257 ALSA: hda: Fix potential access overflow in beep helper
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 0ad3f0b384d58f3bd1f4fb87d0af5b8f6866f41a upstream.
The beep control helper function blindly stores the values in two stereo channels no matter whether the actual control is mono or stereo. This is practically harmless, but it annoys the recently introduced sanity check, resulting in an error when the checker is enabled.
This patch corrects the behavior to store only on the defined array member.
--- sound/pci/hda/hda_beep.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/pci/hda/hda_beep.c +5 -1
@@ -290,8 +290,12 @@ int snd_hda_mixer_amp_switch_get_beep(st {struct hda_codec *codec =snd_kcontrol_chip (kcontrol);struct hda_beep *beep = codec->beep; +int chs =get_amp_channels (kcontrol); +if (beep && (!beep->enabled || !ctl_has_mute (kcontrol))) { - ucontrol->value.integer.value[0 ] = +if (chs &1 ) + ucontrol->value.integer.value[0 ] = beep->enabled; +if (chs &2 ) ucontrol->value.integer.value[1 ] = beep->enabled;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 90/257 ALSA: ice1724: Fix invalid access for enumerated ctl items
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit c47914c00be346bc5b48c48de7b0da5c2d1a296c upstream.
The access to Analog Capture Source control value implemented in prodigy_hifi.c is wrong, as caught by the recently introduced sanity check; it should be accessing value.enumerated.item[] instead of value.integer.value[]. This patch corrects the wrong access pattern.
--- sound/pci/ice1712/prodigy_hifi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/ice1712/prodigy_hifi.c +2 -2
@@ -536,7 +536,7 @@ static int wm_adc_mux_enum_get(struct snstruct snd_ice1712 *ice =snd_kcontrol_chip (kcontrol);mutex_lock (&ice->gpio_mutex); - ucontrol->value.integer.value[0 ] =wm_get (ice,WM_ADC_MUX ) &0x1f ; + ucontrol->value.enumerated.item[0 ] =wm_get (ice,WM_ADC_MUX ) &0x1f ;mutex_unlock (&ice->gpio_mutex);return 0 ; }
@@ -550,7 +550,7 @@ static int wm_adc_mux_enum_put(struct snmutex_lock (&ice->gpio_mutex); oval =wm_get (ice,WM_ADC_MUX ); - nval = (oval &0xe0 ) | ucontrol->value.integer.value[0 ]; + nval = (oval &0xe0 ) | ucontrol->value.enumerated.item[0 ];if (nval != oval) {wm_put (ice,WM_ADC_MUX , nval); change =1 ;
Greg Kroah-Hartman
maintainerPATCH 91/257 ALSA: pcm: oss: Fix regression by buffer overflow fix
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit ae769d3556644888c964635179ef192995f40793 upstream.
The recent fix for the OOB access in PCM OSS plugins (commitf2ecf903ef06: "ALSA: pcm: oss: Avoid plugin buffer overflow") caused a regression on OSS applications. The patch introduced the size check in client and slave size calculations to limit to each plugin's buffer size, but I overlooked that some code paths call those without allocating the buffer but just for estimation.
This patch fixes the bug by skipping the size check for those code paths while keeping checking in the actual transfer calls.
--- sound/core/oss/pcm_plugin.c | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-)
sound/core/oss/pcm_plugin.c +24 -8
@@ -196,7 +196,9 @@ int snd_pcm_plugin_free(struct snd_pcm_preturn 0 ; } -snd_pcm_sframes_t snd_pcm_plug_client_size (struct snd_pcm_substream *plug,snd_pcm_uframes_t drv_frames) +static snd_pcm_sframes_t plug_client_size (struct snd_pcm_substream *plug, +snd_pcm_uframes_t drv_frames, +bool check_size) {struct snd_pcm_plugin *plugin, *plugin_prev, *plugin_next;int stream;
@@ -209,7 +211,7 @@ snd_pcm_sframes_t snd_pcm_plug_client_siif (stream ==SNDRV_PCM_STREAM_PLAYBACK ) { plugin =snd_pcm_plug_last (plug);while (plugin && drv_frames >0 ) { -if (drv_frames > plugin->buf_frames) +if (check_size && drv_frames > plugin->buf_frames) drv_frames = plugin->buf_frames; plugin_prev = plugin->prev;if (plugin->src_frames)
@@ -222,7 +224,7 @@ snd_pcm_sframes_t snd_pcm_plug_client_si plugin_next = plugin->next;if (plugin->dst_frames) drv_frames = plugin->dst_frames (plugin, drv_frames); -if (drv_frames > plugin->buf_frames) +if (check_size && drv_frames > plugin->buf_frames) drv_frames = plugin->buf_frames; plugin = plugin_next; }
@@ -231,7 +233,9 @@ snd_pcm_sframes_t snd_pcm_plug_client_sireturn drv_frames; } -snd_pcm_sframes_t snd_pcm_plug_slave_size (struct snd_pcm_substream *plug,snd_pcm_uframes_t clt_frames) +static snd_pcm_sframes_t plug_slave_size (struct snd_pcm_substream *plug, +snd_pcm_uframes_t clt_frames, +bool check_size) {struct snd_pcm_plugin *plugin, *plugin_prev, *plugin_next;snd_pcm_sframes_t frames;
@@ -252,14 +256,14 @@ snd_pcm_sframes_t snd_pcm_plug_slave_sizif (frames <0 )return frames; } -if (frames > plugin->buf_frames) +if (check_size && frames > plugin->buf_frames) frames = plugin->buf_frames; plugin = plugin_next; } }else if (stream ==SNDRV_PCM_STREAM_CAPTURE ) { plugin =snd_pcm_plug_last (plug);while (plugin) { -if (frames > plugin->buf_frames) +if (check_size && frames > plugin->buf_frames) frames = plugin->buf_frames; plugin_prev = plugin->prev;if (plugin->src_frames) {
@@ -274,6 +278,18 @@ snd_pcm_sframes_t snd_pcm_plug_slave_sizreturn frames; } +snd_pcm_sframes_t snd_pcm_plug_client_size (struct snd_pcm_substream *plug, +snd_pcm_uframes_t drv_frames) +{ +return plug_client_size (plug, drv_frames, false); +} + +snd_pcm_sframes_t snd_pcm_plug_slave_size (struct snd_pcm_substream *plug, +snd_pcm_uframes_t clt_frames) +{ +return plug_slave_size (plug, clt_frames, false); +} +static int snd_pcm_plug_formats (const struct snd_mask *mask,snd_pcm_format_t format) {
@@ -630,7 +646,7 @@ snd_pcm_sframes_t snd_pcm_plug_write_tra src_channels = dst_channels; plugin = next; } -return snd_pcm_plug_client_size (plug, frames); +return plug_client_size (plug, frames, true); }snd_pcm_sframes_t snd_pcm_plug_read_transfer (struct snd_pcm_substream *plug,struct snd_pcm_plugin_channel *dst_channels_final,snd_pcm_uframes_t size)
@@ -640,7 +656,7 @@ snd_pcm_sframes_t snd_pcm_plug_read_transnd_pcm_sframes_t frames = size;int err; - frames =snd_pcm_plug_slave_size (plug, frames); + frames =plug_slave_size (plug, frames, true);if (frames <0 )return frames;
Greg Kroah-Hartman
maintainerPATCH 92/257 ALSA: hda/realtek: Enable mute LED on an HP system
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
commit f5a88b0accc24c4a9021247d7a3124f90aa4c586 upstream.
The system in question uses ALC285, and it uses GPIO 0x04 to control its mute LED.
The mic mute LED can be controlled by GPIO 0x01, however the system uses DMIC so we should use that to control mic mute LED.
--- sound/pci/hda/patch_realtek.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/pci/hda/patch_realtek.c +12 -0
@@ -4008,6 +4008,12 @@ static void alc269_fixup_hp_gpio_led(stralc_fixup_hp_gpio_led (codec, action,0x08 ,0x10 ); } +static void alc285_fixup_hp_gpio_led (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +alc_fixup_hp_gpio_led (codec, action,0x04 ,0x00 ); +} +static void alc286_fixup_hp_gpio_led (struct hda_codec *codec,const struct hda_fixup *fix,int action) {
@@ -5923,6 +5929,7 @@ enum {ALC294_FIXUP_ASUS_DUAL_SPK ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ,ALC294_FIXUP_ASUS_HPE , + ALC285_FIXUP_HP_GPIO_LED, }; static const struct hda_fixup alc269_fixups[] = {
@@ -7061,6 +7068,10 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id =ALC294_FIXUP_ASUS_HEADSET_MIC }, + [ALC285_FIXUP_HP_GPIO_LED] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_gpio_led, + }, };static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -7208,6 +7219,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x83b9 ,"HP Spectre x360" ,ALC269_FIXUP_HP_MUTE_LED_MIC3 ),SND_PCI_QUIRK (0x103c ,0x8497 ,"HP Envy x360" ,ALC269_FIXUP_HP_MUTE_LED_MIC3 ),SND_PCI_QUIRK (0x103c ,0x84e7 ,"HP Pavilion 15" ,ALC269_FIXUP_HP_MUTE_LED_MIC3 ), +SND_PCI_QUIRK (0x103c ,0x8736 ,"HP" ,ALC285_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x1043 ,0x103e ,"ASUS X540SA" ,ALC256_FIXUP_ASUS_MIC ),SND_PCI_QUIRK (0x1043 ,0x103f ,"ASUS TX300" ,ALC282_FIXUP_ASUS_TX300 ), SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
Greg Kroah-Hartman
maintainerPATCH 93/257 ALSA: hda/realtek - a fake key event is triggered by running shutup
In reply to Greg Kroah-HartmanFrom: Hui Wang <[email protected]>
commit 476c02e0b4fd9071d158f6a1a1dfea1d36ee0ffd upstream.
On the Lenovo X1C7 machines, after we plug the headset, the rt_resume() and rt_suspend() of the codec driver will be called periodically, the driver can't stay in the rt_suspend state even users doen't use the sound card.
Through debugging, I found when running rt_suspend(), it will call alc225_shutup(), in this function, it will change 3k pull down control by alc_update_coef_idx(codec, 0x4a, 0, 3 << 10), this will trigger a fake key event and that event will resume the codec, when codec suspend agin, it will trigger the fake key event one more time, this process will repeat.
If disable the key event before changing the pull down control, it will not trigger fake key event. It also needs to restore the pull down control and re-enable the key event, otherwise the system can't get key event when codec is in rt_suspend state.
Also move some functions ahead of alc225_shutup(), this can save the function declaration.
--- sound/pci/hda/patch_realtek.c | 170 ++++++++++++++++++++++++++---------------- 1 file changed, 107 insertions(+), 63 deletions(-)
sound/pci/hda/patch_realtek.c +107 -63
@@ -107,6 +107,7 @@ struct alc_spec { unsigned int done_hp_init:1; unsigned int no_shutup_pins:1; unsigned int ultra_low_power:1; + unsigned int has_hs_key:1;/* for PLL fix */ hda_nid_t pll_nid;
@@ -2982,6 +2983,107 @@ static int alc269_parse_auto_config(strureturn alc_parse_auto_config (codec, alc269_ignore, ssids); } +static const struct hda_jack_keymap alc_headset_btn_keymap[] = { + {SND_JACK_BTN_0 ,KEY_PLAYPAUSE }, + {SND_JACK_BTN_1 ,KEY_VOICECOMMAND }, + {SND_JACK_BTN_2 ,KEY_VOLUMEUP }, + {SND_JACK_BTN_3 ,KEY_VOLUMEDOWN }, + {} +}; + +static void alc_headset_btn_callback (struct hda_codec *codec, +struct hda_jack_callback *jack) +{ +int report =0 ; + +if (jack->unsol_res & (7 <<13 )) + report |=SND_JACK_BTN_0 ; + +if (jack->unsol_res & (1 <<16 |3 <<8 )) + report |=SND_JACK_BTN_1 ; + +/* Volume up key */ +if (jack->unsol_res & (7 <<23 )) + report |=SND_JACK_BTN_2 ; + +/* Volume down key */ +if (jack->unsol_res & (7 <<10 )) + report |=SND_JACK_BTN_3 ; + + jack->jack->button_state = report; +} + +static void alc_disable_headset_jack_key (struct hda_codec *codec) +{ +struct alc_spec *spec = codec->spec; + +if (!spec->has_hs_key) +return ; + +switch (codec->core.vendor_id) { +case 0x10ec0215 : +case 0x10ec0225 : +case 0x10ec0285 : +case 0x10ec0295 : +case 0x10ec0289 : +case 0x10ec0299 : +alc_write_coef_idx (codec,0x48 ,0x0 ); +alc_update_coef_idx (codec,0x49 ,0x0045 ,0x0 ); +alc_update_coef_idx (codec,0x44 ,0x0045 <<8 ,0x0 ); +break ; +case 0x10ec0236 : +case 0x10ec0256 : +alc_write_coef_idx (codec,0x48 ,0x0 ); +alc_update_coef_idx (codec,0x49 ,0x0045 ,0x0 ); +break ; + } +} + +static void alc_enable_headset_jack_key (struct hda_codec *codec) +{ +struct alc_spec *spec = codec->spec; + +if (!spec->has_hs_key) +return ; + +switch (codec->core.vendor_id) { +case 0x10ec0215 : +case 0x10ec0225 : +case 0x10ec0285 : +case 0x10ec0295 : +case 0x10ec0289 : +case 0x10ec0299 : +alc_write_coef_idx (codec,0x48 ,0xd011 ); +alc_update_coef_idx (codec,0x49 ,0x007f ,0x0045 ); +alc_update_coef_idx (codec,0x44 ,0x007f <<8 ,0x0045 <<8 ); +break ; +case 0x10ec0236 : +case 0x10ec0256 : +alc_write_coef_idx (codec,0x48 ,0xd011 ); +alc_update_coef_idx (codec,0x49 ,0x007f ,0x0045 ); +break ; + } +} + +static void alc_fixup_headset_jack (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +struct alc_spec *spec = codec->spec; + +switch (action) { +case HDA_FIXUP_ACT_PRE_PROBE : + spec->has_hs_key =1 ; +snd_hda_jack_detect_enable_callback (codec,0x55 , + alc_headset_btn_callback); +snd_hda_jack_add_kctl (codec,0x55 ,"Headset Jack" , false, +SND_JACK_HEADSET , alc_headset_btn_keymap); +break ; +case HDA_FIXUP_ACT_INIT : +alc_enable_headset_jack_key (codec); +break ; + } +} +static void alc269vb_toggle_power_output (struct hda_codec *codec,int power_up) {alc_update_coef_idx (codec,0x04 ,1 <<11 , power_up ? (1 <<11 ) :0 );
@@ -3372,6 +3474,8 @@ static void alc225_shutup(struct hda_codif (!hp_pin) hp_pin =0x21 ; + +alc_disable_headset_jack_key (codec);/* 3k pull low control for Headset jack. */ alc_update_coef_idx (codec,0x4a ,0 ,3 <<10 );
@@ -3411,6 +3515,9 @@ static void alc225_shutup(struct hda_codalc_update_coef_idx (codec,0x4a ,3 <<4 ,2 <<4 );msleep (30 ); } + +alc_update_coef_idx (codec,0x4a ,3 <<10 ,0 ); +alc_enable_headset_jack_key (codec); }static void alc_default_init (struct hda_codec *codec)
@@ -5668,69 +5775,6 @@ static void alc285_fixup_invalidate_dacssnd_hda_override_wcaps (codec,0x03 ,0 ); } -static const struct hda_jack_keymap alc_headset_btn_keymap[] = { - {SND_JACK_BTN_0 ,KEY_PLAYPAUSE }, - {SND_JACK_BTN_1 ,KEY_VOICECOMMAND }, - {SND_JACK_BTN_2 ,KEY_VOLUMEUP }, - {SND_JACK_BTN_3 ,KEY_VOLUMEDOWN }, - {} -}; - -static void alc_headset_btn_callback (struct hda_codec *codec, -struct hda_jack_callback *jack) -{ -int report =0 ; - -if (jack->unsol_res & (7 <<13 )) - report |=SND_JACK_BTN_0 ; - -if (jack->unsol_res & (1 <<16 |3 <<8 )) - report |=SND_JACK_BTN_1 ; - -/* Volume up key */ -if (jack->unsol_res & (7 <<23 )) - report |=SND_JACK_BTN_2 ; - -/* Volume down key */ -if (jack->unsol_res & (7 <<10 )) - report |=SND_JACK_BTN_3 ; - - jack->jack->button_state = report; -} - -static void alc_fixup_headset_jack (struct hda_codec *codec, -const struct hda_fixup *fix,int action) -{ - -switch (action) { -case HDA_FIXUP_ACT_PRE_PROBE : -snd_hda_jack_detect_enable_callback (codec,0x55 , - alc_headset_btn_callback); -snd_hda_jack_add_kctl (codec,0x55 ,"Headset Jack" , false, -SND_JACK_HEADSET , alc_headset_btn_keymap); -break ; -case HDA_FIXUP_ACT_INIT : -switch (codec->core.vendor_id) { -case 0x10ec0215 : -case 0x10ec0225 : -case 0x10ec0285 : -case 0x10ec0295 : -case 0x10ec0289 : -case 0x10ec0299 : -alc_write_coef_idx (codec,0x48 ,0xd011 ); -alc_update_coef_idx (codec,0x49 ,0x007f ,0x0045 ); -alc_update_coef_idx (codec,0x44 ,0x007f <<8 ,0x0045 <<8 ); -break ; -case 0x10ec0236 : -case 0x10ec0256 : -alc_write_coef_idx (codec,0x48 ,0xd011 ); -alc_update_coef_idx (codec,0x49 ,0x007f ,0x0045 ); -break ; - } -break ; - } -} -static void alc295_fixup_chromebook (struct hda_codec *codec,const struct hda_fixup *fix,int action) {
Greg Kroah-Hartman
maintainerPATCH 94/257 ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256
In reply to Greg Kroah-HartmanFrom: Thomas Hebb <[email protected]>
commit f128090491c3f5aacef91a863f8c52abf869c436 upstream.
This codec (among others) has a hidden set of audio routes, apparently designed to allow PC Beep output without a mixer widget on the output path, which are controlled by an undocumented Realtek vendor register. The default configuration of these routes means that certain inputs aren't accessible, necessitating driver control of the register. However, Realtek has provided no documentation of the register, instead opting to fix issues by providing magic numbers, most of which have been at least somewhat erroneous. These magic numbers then get copied by others into model-specific fixups, leading to a fragmented and buggy set of configurations.
To get out of this situation, I've reverse engineered the register by flipping bits and observing how the codec's behavior changes. This commit documents my findings. It does not change any code.
--- Documentation/sound/hd-audio/index.rst | 1 Documentation/sound/hd-audio/realtek-pc-beep.rst | 129 +++++++++++++++++++++++ 2 files changed, 130 insertions(+)
Documentation/sound/hd-audio/index.rst +1 -0
@@ -8,3 +8,4 @@ HD-Audio models controls dp-mst + realtek-pc-beep
Documentation/sound/hd-audio/realtek-pc-beep.rst new file +129 -0
129 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 95/257 ALSA: hda/realtek - Set principled PC Beep configuration for ALC256
In reply to Greg Kroah-HartmanFrom: Thomas Hebb <[email protected]>
commit c44737449468a0bdc50e09ec75e530f208391561 upstream.
The Realtek PC Beep Hidden Register[1] is currently set by patch_realtek.c in two different places:
In alc_fill_eapd_coef(), it's set to the value 0x5757, corresponding to non-beep input on 1Ah and no 1Ah loopback to either headphones or speakers. (Although, curiously, the loopback amp is still enabled.) This write was added fairly recently by commit e3743f431143 ("ALSA:
hda/realtek - Dell headphone has noise on unmute for ALC236") and is a safe default. However, it happens in the wrong place:alc_fill_eapd_coef() runs on module load and cold boot but not on S3 resume, meaning the register loses its value after suspend.
Conversely, in alc256_init(), the register is updated to unset bit 13 (disable speaker loopback) and set bit 5 (set non-beep input on 1Ah). Although this write does run on S3 resume, it's not quite enough to fix up the register's default value of 0x3717. What's missing is a set of bit 14 to disable headphone loopback. Without that, we end up with a feedback loop where the headphone jack is being driven by amplified samples of itself[2].
This change eliminates the update in alc256_init() and replaces it with the 0x5757 write from alc_fill_eapd_coef(). Kailang says that 0x5757 is supposed to be the codec's default value, so using it will make debugging easier for Realtek.
Affects the ALC255, ALC256, ALC257, ALC235, and ALC236 codecs.
[1] Newly documented in Documentation/sound/hd-audio/realtek-pc-beep.rst
[2] Setting the "Headphone Mic Boost" control from userspace changes this feedback loop and has been a widely-shared workaround for headphone noise on laptops like the Dell XPS 13 9350. This commit eliminates the feedback loop and makes the workaround unnecessary.
--- sound/pci/hda/patch_realtek.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
sound/pci/hda/patch_realtek.c +9 -6
@@ -368,7 +368,9 @@ static void alc_fill_eapd_coef(struct hdcase 0x10ec0215 :case 0x10ec0233 :case 0x10ec0235 : +case 0x10ec0236 :case 0x10ec0255 : +case 0x10ec0256 :case 0x10ec0257 :case 0x10ec0282 :case 0x10ec0283 :
@@ -380,11 +382,6 @@ static void alc_fill_eapd_coef(struct hdcase 0x10ec0300 :alc_update_coef_idx (codec,0x10 ,1 <<9 ,0 );break ; -case 0x10ec0236 : -case 0x10ec0256 : -alc_write_coef_idx (codec,0x36 ,0x5757 ); -alc_update_coef_idx (codec,0x10 ,1 <<9 ,0 ); -break ;case 0x10ec0275 :alc_update_coef_idx (codec,0xe ,0 ,1 <<0 );break ;
@@ -3371,7 +3368,13 @@ static void alc256_init(struct hda_codecalc_update_coefex_idx (codec,0x57 ,0x04 ,0x0007 ,0x4 );/* Hight power */ alc_update_coefex_idx (codec,0x53 ,0x02 ,0x8000 ,1 <<15 );/* Clear bit */ alc_update_coefex_idx (codec,0x53 ,0x02 ,0x8000 ,0 <<15 ); -alc_update_coef_idx (codec,0x36 ,1 <<13 ,1 <<5 );/* Switch pcbeep path to Line in path*/ +/* +* Expose headphone mic (or possibly Line In on some machines) instead +* of PC Beep on 1Ah, and disable 1Ah loopback for all outputs. See +* Documentation/sound/hd-audio/realtek-pc-beep.rst for details of +* this register. +*/ +alc_write_coef_idx (codec,0x36 ,0x5757 ); }static void alc256_shutup (struct hda_codec *codec)
Greg Kroah-Hartman
maintainerPATCH 96/257 ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups
In reply to Greg Kroah-HartmanFrom: Thomas Hebb <[email protected]>
commit f36938aa7440f46a0a365f1cfde5f5985af2bef3 upstream.
patch_realtek.c has historically failed to properly configure the PC Beep Hidden Register for the ALC256 codec (among others). Depending on your kernel version, symptoms of this misconfiguration can range from chassis noise, picked up by a poorly-shielded PCBEEP trace, getting amplified and played on your internal speaker and/or headphones to loud feedback, which responds to the "Headphone Mic Boost" ALSA control, getting played through your headphones. For details of the problem, see the patch in this series titled "ALSA: hda/realtek - Set principled PC Beep configuration for ALC256", which fixes the configuration.
These symptoms have been most noticed on the Dell XPS 13 9350 and 9360, popular laptops that use the ALC256. As a result, several model-specific fixups have been introduced to try and fix the problem, the most egregious of which locks the "Headphone Mic Boost" control as a hack to minimize noise from a feedback loop that shouldn't have been there in the first place.
Now that the underlying issue has been fixed, remove all these fixups. Remaining fixups needed by the XPS 13 are all picked up by existing pin quirks.
This change should, for the XPS 13 9350/9360
- Significantly increase volume and audio quality on headphones
- Eliminate headphone popping on suspend/resume
- Allow "Headphone Mic Boost" to be set again, making the headphone jack fully usable as a microphone jack too.
--- Documentation/sound/hd-audio/models.rst | 2 - sound/pci/hda/patch_realtek.c | 34 -------------------------------- 2 files changed, 36 deletions(-)
Documentation/sound/hd-audio/models.rst +0 -2
@@ -216,8 +216,6 @@ alc298-dell-aio ALC298 fixups on Dell AIO machines alc275-dell-xps ALC275 fixups on Dell XPS models -alc256-dell-xps13 - ALC256 fixups on Dell XPS13 lenovo-spk-noise Workaround for speaker noise on Lenovo machines lenovo-hotkey
sound/pci/hda/patch_realtek.c +0 -34
@@ -5491,17 +5491,6 @@ static void alc271_hp_gate_mic_jack(stru } } -static void alc256_fixup_dell_xps_13_headphone_noise2 (struct hda_codec *codec, -const struct hda_fixup *fix, -int action) -{ -if (action !=HDA_FIXUP_ACT_PRE_PROBE ) -return ; - -snd_hda_codec_amp_stereo (codec,0x1a ,HDA_INPUT ,0 ,HDA_AMP_VOLMASK ,1 ); -snd_hda_override_wcaps (codec,0x1a ,get_wcaps (codec,0x1a ) & ~AC_WCAP_IN_AMP ); -} -static void alc269_fixup_limit_int_mic_boost (struct hda_codec *codec,const struct hda_fixup *fix,int action)
@@ -5916,8 +5905,6 @@ enum {ALC298_FIXUP_DELL1_MIC_NO_PRESENCE ,ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE ,ALC275_FIXUP_DELL_XPS , -ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE , -ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2 ,ALC293_FIXUP_LENOVO_SPK_NOISE ,ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY , ALC255_FIXUP_DELL_SPK_NOISE,
@@ -6658,23 +6645,6 @@ static const struct hda_fixup alc269_fix {} } }, - [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE] = { - .type = HDA_FIXUP_VERBS, - .v.verbs = (const struct hda_verb []) { -/* Disable pass-through path for FRONT 14h */ - {0x20 ,AC_VERB_SET_COEF_INDEX ,0x36 }, - {0x20 ,AC_VERB_SET_PROC_COEF ,0x1737 }, - {} - }, - .chained = true, - .chain_id =ALC255_FIXUP_DELL1_MIC_NO_PRESENCE - }, - [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc256_fixup_dell_xps_13_headphone_noise2, - .chained = true, - .chain_id =ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE - }, [ALC293_FIXUP_LENOVO_SPK_NOISE] = { .type = HDA_FIXUP_FUNC, .v.func = alc_fixup_disable_aamix,
@@ -7172,17 +7142,14 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1028 ,0x06de ,"Dell" ,ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK ),SND_PCI_QUIRK (0x1028 ,0x06df ,"Dell" ,ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK ),SND_PCI_QUIRK (0x1028 ,0x06e0 ,"Dell" ,ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK ), -SND_PCI_QUIRK (0x1028 ,0x0704 ,"Dell XPS 13 9350" ,ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2 ),SND_PCI_QUIRK (0x1028 ,0x0706 ,"Dell Inspiron 7559" ,ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER ),SND_PCI_QUIRK (0x1028 ,0x0725 ,"Dell Inspiron 3162" ,ALC255_FIXUP_DELL_SPK_NOISE ),SND_PCI_QUIRK (0x1028 ,0x0738 ,"Dell Precision 5820" ,ALC269_FIXUP_NO_SHUTUP ), -SND_PCI_QUIRK (0x1028 ,0x075b ,"Dell XPS 13 9360" ,ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2 ),SND_PCI_QUIRK (0x1028 ,0x075c ,"Dell XPS 27 7760" ,ALC298_FIXUP_SPK_VOLUME ),SND_PCI_QUIRK (0x1028 ,0x075d ,"Dell AIO" ,ALC298_FIXUP_SPK_VOLUME ),SND_PCI_QUIRK (0x1028 ,0x07b0 ,"Dell Precision 7520" ,ALC295_FIXUP_DISABLE_DAC3 ),SND_PCI_QUIRK (0x1028 ,0x0798 ,"Dell Inspiron 17 7000 Gaming" ,ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER ),SND_PCI_QUIRK (0x1028 ,0x080c ,"Dell WYSE" ,ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE ), -SND_PCI_QUIRK (0x1028 ,0x082a ,"Dell XPS 13 9360" ,ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2 ),SND_PCI_QUIRK (0x1028 ,0x084b ,"Dell" ,ALC274_FIXUP_DELL_AIO_LINEOUT_VERB ),SND_PCI_QUIRK (0x1028 ,0x084e ,"Dell" ,ALC274_FIXUP_DELL_AIO_LINEOUT_VERB ), SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
@@ -7536,7 +7503,6 @@ static const struct hda_model_fixup alc2 {.id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc298-dell1"}, {.id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, .name = "alc298-dell-aio"}, {.id = ALC275_FIXUP_DELL_XPS, .name = "alc275-dell-xps"}, - {.id = ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE, .name = "alc256-dell-xps13"}, {.id = ALC293_FIXUP_LENOVO_SPK_NOISE, .name = "lenovo-spk-noise"}, {.id = ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, .name = "lenovo-hotkey"}, {.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"},
Greg Kroah-Hartman
maintainerPATCH 97/257 ALSA: hda/realtek - Add quirk for Lenovo Carbon X1 8th gen
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit ca707b3f00b4f31a6e1eb37e8ae99f15f2bb1fe5 upstream.
The audio setup on the Lenovo Carbon X1 8th gen is the same as that on the Lenovo Carbon X1 7th gen, as such it needs the same ALC285_FIXUP_THINKPAD_HEADSET_JACK quirk.
This fixes volume control of the speaker not working among other things.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -7325,6 +7325,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x225d ,"Thinkpad T480" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x17aa ,0x2292 ,"Thinkpad X1 Yoga 7th" ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ),SND_PCI_QUIRK (0x17aa ,0x2293 ,"Thinkpad X1 Carbon 7th" ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ), +SND_PCI_QUIRK (0x17aa ,0x22be ,"Thinkpad X1 Carbon 8th" ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ),SND_PCI_QUIRK (0x17aa ,0x30bb ,"ThinkCentre AIO" ,ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY ),SND_PCI_QUIRK (0x17aa ,0x30e2 ,"ThinkCentre AIO" ,ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY ), SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
Greg Kroah-Hartman
maintainerPATCH 98/257 ALSA: hda/realtek - Add quirk for MSI GL63
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 1d3aa4a5516d2e4933fe3cca11d3349ef63bc547 upstream.
MSI GL63 laptop requires the similar quirk like other MSI models, ALC1220_FIXUP_CLEVO_P950. The board BIOS doesn't provide a PCI SSID for the device, hence we need to take the codec SSID (1462:1275) instead.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -2447,6 +2447,7 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x1458 ,0xa0b8 ,"Gigabyte AZ370-Gaming" ,ALC1220_FIXUP_GB_DUAL_CODECS ),SND_PCI_QUIRK (0x1458 ,0xa0cd ,"Gigabyte X570 Aorus Master" ,ALC1220_FIXUP_CLEVO_P950 ),SND_PCI_QUIRK (0x1462 ,0x1228 ,"MSI-GP63" ,ALC1220_FIXUP_CLEVO_P950 ), +SND_PCI_QUIRK (0x1462 ,0x1275 ,"MSI-GL63" ,ALC1220_FIXUP_CLEVO_P950 ),SND_PCI_QUIRK (0x1462 ,0x1276 ,"MSI-GL73" ,ALC1220_FIXUP_CLEVO_P950 ),SND_PCI_QUIRK (0x1462 ,0x1293 ,"MSI-GP65" ,ALC1220_FIXUP_CLEVO_P950 ), SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
Greg Kroah-Hartman
maintainerPATCH 99/257 media: venus: cache vb payload to be used by clock scaling
In reply to Greg Kroah-HartmanFrom: Stanimir Varbanov <[email protected]>
commit fd1ee315dcd4a0f913a74939eb88f6d9b0bd9250 upstream.
Instead of iterate over previously queued buffers in clock scaling code do cache the payload in instance context structure for later use when calculating new clock rate.
This will avoid to use spin locks during buffer list iteration in clock_scaling.
This fixes following kernel Oops:
Unable to handle kernel paging request at virtual address deacfffffffffd6c Mem abort info: ESR = 0x96000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 [deacfffffffffd6c] address between user and kernel address ranges Internal error: Oops: 96000004 [#1] PREEMPT SMP CPU: 7 PID: 5763 Comm: V4L2DecoderThre Tainted: G S W 5.4.11 #8 pstate: 20400009 (nzCv daif +PAN -UAO) pc : load_scale_v4+0x4c/0x2bc [venus_core] lr : session_process_buf+0x18c/0x1c0 [venus_core] sp : ffffffc01376b8d0 x29: ffffffc01376b8d0 x28: ffffff80cf1b0220 x27: ffffffc01376bba0 x26: ffffffd8f562b2d8 x25: ffffff80cf1b0220 x24: 0000000000000005 x23: ffffffd8f5620d98 x22: ffffff80ca01c800 x21: ffffff80cf1b0000 x20: ffffff8149490080 x19: ffffff8174b2c010 x18: 0000000000000000 x17: 0000000000000000 x16: ffffffd96ee3a0dc x15: 0000000000000026 x14: 0000000000000026 x13: 00000000000055ac x12: 0000000000000001 x11: deacfffffffffd6c x10: dead000000000100 x9 : ffffff80ca01cf28 x8 : 0000000000000026 x7 : 0000000000000000 x6 : ffffff80cdd899c0 x5 : ffffff80cdd899c0 x4 : 0000000000000008 x3 : ffffff80ca01cf28 x2 : ffffff80ca01cf28 x1 : ffffff80d47ffc00 x0 : ffffff80cf1b0000 Call trace: load_scale_v4+0x4c/0x2bc [venus_core] session_process_buf+0x18c/0x1c0 [venus_core] venus_helper_vb2_buf_queue+0x7c/0xf0 [venus_core] __enqueue_in_driver+0xe4/0xfc [videobuf2_common] vb2_core_qbuf+0x15c/0x338 [videobuf2_common] vb2_qbuf+0x78/0xb8 [videobuf2_v4l2] v4l2_m2m_qbuf+0x80/0xf8 [v4l2_mem2mem] v4l2_m2m_ioctl_qbuf+0x2c/0x38 [v4l2_mem2mem] v4l_qbuf+0x48/0x58 __video_do_ioctl+0x2b0/0x39c video_usercopy+0x394/0x710 video_ioctl2+0x38/0x48 v4l2_ioctl+0x6c/0x80 do_video_ioctl+0xb00/0x2874 v4l2_compat_ioctl32+0x5c/0xcc __se_compat_sys_ioctl+0x100/0x2074 __arm64_compat_sys_ioctl+0x20/0x2c el0_svc_common+0xa4/0x154 el0_svc_compat_handler+0x2c/0x38 el0_svc_compat+0x8/0x10 Code: eb0a013f 54000200 aa1f03e8 d10e514b (b940016c) ---[ end trace e11304b46552e0b9 ]---
--- drivers/media/platform/qcom/venus/core.h | 1 + drivers/media/platform/qcom/venus/helpers.c | 20 +++++++++++++------- 2 files changed, 14 insertions(+), 7 deletions(-)
drivers/media/platform/qcom/venus/core.h +1 -0
@@ -344,6 +344,7 @@ struct venus_inst {unsigned int subscriptions;int buf_count;struct venus_ts_metadata tss[VIDEO_MAX_FRAME ]; +unsigned long payloads[VIDEO_MAX_FRAME ];u64 fps;struct v4l2_fract timeperframe;const struct venus_format *fmt_out;
drivers/media/platform/qcom/venus/helpers.c +13 -7
@@ -544,18 +544,13 @@ static int scale_clocks_v4(struct venus_struct venus_core *core = inst->core;const struct freq_tbl *table = core->res->freq_tbl;unsigned int num_rows = core->res->freq_tbl_size; -struct v4l2_m2m_ctx *m2m_ctx = inst->m2m_ctx;struct device *dev = core->dev;unsigned long freq =0 , freq_core1 =0 , freq_core2 =0 ;unsigned long filled_len =0 ; -struct venus_buffer *buf, *n; -struct vb2_buffer *vb;int i, ret; -v4l2_m2m_for_each_src_buf_safe (m2m_ctx, buf, n) { - vb = &buf->vb.vb2_buf; - filled_len =max (filled_len,vb2_get_plane_payload (vb,0 )); - } +for (i =0 ; i < inst->num_input_bufs; i++) + filled_len =max (filled_len, inst->payloads[i]);if (inst->session_type ==VIDC_SESSION_TYPE_DEC && !filled_len)return 0 ;
@@ -1289,6 +1284,15 @@ int venus_helper_vb2_buf_prepare(struct }EXPORT_SYMBOL_GPL (venus_helper_vb2_buf_prepare); +static void cache_payload (struct venus_inst *inst,struct vb2_buffer *vb) +{ +struct vb2_v4l2_buffer *vbuf =to_vb2_v4l2_buffer (vb); +unsigned int idx = vbuf->vb2_buf.index; + +if (vbuf->vb2_buf.type ==V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE ) + inst->payloads[idx] =vb2_get_plane_payload (vb,0 ); +} +void venus_helper_vb2_buf_queue (struct vb2_buffer *vb) {struct vb2_v4l2_buffer *vbuf =to_vb2_v4l2_buffer (vb);
@@ -1300,6 +1304,8 @@ void venus_helper_vb2_buf_queue(struct vv4l2_m2m_buf_queue (m2m_ctx, vbuf); +cache_payload (inst, vb); +if (inst->session_type ==VIDC_SESSION_TYPE_ENC && !(inst->streamon_out && inst->streamon_cap)) goto unlock;
Greg Kroah-Hartman
maintainerPATCH 100/257 media: venus: firmware: Ignore secure call error on first resume
In reply to Greg Kroah-HartmanFrom: Stanimir Varbanov <[email protected]>
commit 2632e7b618a7730969f9782593c29ca53553aa22 upstream.
With the latest cleanup in qcom scm driver the secure monitor call for setting the remote processor state returns EINVAL when it is called for the first time and after another scm call auth_and_reset. The error returned from scm call could be ignored because the state transition is already done in auth_and_reset.
--- drivers/media/platform/qcom/venus/firmware.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/media/platform/qcom/venus/firmware.c +8 -2
@@ -44,8 +44,14 @@ static void venus_reset_cpu(struct venusint venus_set_hw_state (struct venus_core *core,bool resume) { -if (core->use_tz) -return qcom_scm_set_remote_state (resume,0 ); +int ret; + +if (core->use_tz) { + ret =qcom_scm_set_remote_state (resume,0 ); +if (resume && ret == -EINVAL ) + ret =0 ; +return ret; + }if (resume)venus_reset_cpu (core);
Greg Kroah-Hartman
maintainerPATCH 101/257 media: hantro: Read be32 words starting at every fourth byte
In reply to Greg Kroah-HartmanFrom: Andrzej Pietrasiewicz <[email protected]>
commit e34bca49e4953e5c2afc0425303199a5fd515f82 upstream.
Since (luma/chroma)_qtable is an array of unsigned char, indexing it returns consecutive byte locations, but we are supposed to read the arrays in four-byte words. Consequently, we should be pointing get_unaligned_be32() at consecutive word locations instead.
--- drivers/staging/media/hantro/hantro_h1_jpeg_enc.c | 9 +++++++-- drivers/staging/media/hantro/rk3399_vpu_hw_jpeg_enc.c | 9 +++++++-- 2 files changed, 14 insertions(+), 4 deletions(-)
drivers/staging/media/hantro/hantro_h1_jpeg_enc.c +7 -2
@@ -67,12 +67,17 @@ hantro_h1_jpeg_enc_set_qtable(struct han unsigned char *chroma_qtable) {u32 reg, i; +__be32 *luma_qtable_p; +__be32 *chroma_qtable_p; + + luma_qtable_p = (__be32 *)luma_qtable; + chroma_qtable_p = (__be32 *)chroma_qtable;for (i =0 ; i <H1_JPEG_QUANT_TABLE_COUNT ; i++) { - reg =get_unaligned_be32 (&luma_qtable[i]); + reg =get_unaligned_be32 (&luma_qtable_p[i]);vepu_write_relaxed (vpu, reg,H1_REG_JPEG_LUMA_QUAT (i)); - reg =get_unaligned_be32 (&chroma_qtable[i]); + reg =get_unaligned_be32 (&chroma_qtable_p[i]);vepu_write_relaxed (vpu, reg,H1_REG_JPEG_CHROMA_QUAT (i)); } }
drivers/staging/media/hantro/rk3399_vpu_hw_jpeg_enc.c +7 -2
@@ -98,12 +98,17 @@ rk3399_vpu_jpeg_enc_set_qtable(struct ha unsigned char *chroma_qtable) {u32 reg, i; +__be32 *luma_qtable_p; +__be32 *chroma_qtable_p; + + luma_qtable_p = (__be32 *)luma_qtable; + chroma_qtable_p = (__be32 *)chroma_qtable;for (i =0 ; i <VEPU_JPEG_QUANT_TABLE_COUNT ; i++) { - reg =get_unaligned_be32 (&luma_qtable[i]); + reg =get_unaligned_be32 (&luma_qtable_p[i]);vepu_write_relaxed (vpu, reg,VEPU_REG_JPEG_LUMA_QUAT (i)); - reg =get_unaligned_be32 (&chroma_qtable[i]); + reg =get_unaligned_be32 (&chroma_qtable_p[i]);vepu_write_relaxed (vpu, reg,VEPU_REG_JPEG_CHROMA_QUAT (i)); } }
Greg Kroah-Hartman
maintainerPATCH 102/257 media: ti-vpe: cal: fix disable_irqs to only the intended target
In reply to Greg Kroah-HartmanFrom: Benoit Parrot <[email protected]>
commit 1db56284b9da9056093681f28db48a09a243274b upstream.
disable_irqs() was mistakenly disabling all interrupts when called. This cause all port stream to stop even if only stopping one of them.
--- drivers/media/platform/ti-vpe/cal.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/media/platform/ti-vpe/cal.c +8 -8
@@ -537,16 +537,16 @@ static void enable_irqs(struct cal_ctx *static void disable_irqs (struct cal_ctx *ctx) { +u32 val; +/* Disable IRQ_WDMA_END 0/1 */ -reg_write_field (ctx->dev, -CAL_HL_IRQENABLE_CLR (2 ), -CAL_HL_IRQ_CLEAR , -CAL_HL_IRQ_MASK (ctx->csi2_port)); + val =0 ; +set_field (&val,CAL_HL_IRQ_CLEAR ,CAL_HL_IRQ_MASK (ctx->csi2_port)); +reg_write (ctx->dev,CAL_HL_IRQENABLE_CLR (2 ), val);/* Disable IRQ_WDMA_START 0/1 */ -reg_write_field (ctx->dev, -CAL_HL_IRQENABLE_CLR (3 ), -CAL_HL_IRQ_CLEAR , -CAL_HL_IRQ_MASK (ctx->csi2_port)); + val =0 ; +set_field (&val,CAL_HL_IRQ_CLEAR ,CAL_HL_IRQ_MASK (ctx->csi2_port)); +reg_write (ctx->dev,CAL_HL_IRQENABLE_CLR (3 ), val);/* Todo: Add VC_IRQ and CSI2_COMPLEXIO_IRQ handling */ reg_write (ctx->dev,CAL_CSI2_VC_IRQENABLE (1 ),0 ); }
Greg Kroah-Hartman
maintainerPATCH 103/257 media: ti-vpe: cal: fix a kernel oops when unloading module
In reply to Greg Kroah-HartmanFrom: Benoit Parrot <[email protected]>
commit 80264809ea0a3fd2ee8251f31a9eb85d2c3fc77e upstream.
After the switch to use v4l2_async_notifier_add_subdev() and v4l2_async_notifier_cleanup(), unloading the ti_cal module would cause a kernel oops.
This was root cause to the fact that v4l2_async_notifier_cleanup() tries to kfree the asd pointer passed into v4l2_async_notifier_add_subdev().
In our case the asd reference was from a statically allocated struct. So in effect v4l2_async_notifier_cleanup() was trying to free a pointer that was not kalloc.
So here we switch to using a kzalloc struct instead of a static one. To achieve this we re-order some of the calls to prevent asd allocation from leaking.
--- drivers/media/platform/ti-vpe/cal.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/media/platform/ti-vpe/cal.c +8 -5
@@ -266,8 +266,6 @@ struct cal_ctx {struct v4l2_subdev *sensor;struct v4l2_fwnode_endpoint endpoint; -struct v4l2_async_subdev asd; -struct v4l2_fh fh;struct cal_dev *dev;struct cc_data *cc;
@@ -1648,7 +1646,6 @@ static int of_cal_create_instance(struct parent = pdev->dev.of_node; - asd = &ctx->asd; endpoint = &ctx->endpoint; ep_node =NULL ;
@@ -1695,8 +1692,6 @@ static int of_cal_create_instance(structctx_dbg (3 , ctx,"can't get remote parent\n" ); goto cleanup_exit; } - asd->match_type =V4L2_ASYNC_MATCH_FWNODE ; - asd->match.fwnode =of_fwnode_handle (sensor_node);v4l2_fwnode_endpoint_parse (of_fwnode_handle (ep_node), endpoint);
@@ -1726,9 +1721,17 @@ static int of_cal_create_instance(structv4l2_async_notifier_init (&ctx->notifier); + asd =kzalloc (sizeof (*asd),GFP_KERNEL ); +if (!asd) + goto cleanup_exit; + + asd->match_type =V4L2_ASYNC_MATCH_FWNODE ; + asd->match.fwnode =of_fwnode_handle (sensor_node); + ret =v4l2_async_notifier_add_subdev (&ctx->notifier, asd);if (ret) {ctx_err (ctx,"Error adding asd\n" ); +kfree (asd); goto cleanup_exit; }
Greg Kroah-Hartman
maintainerPATCH 104/257 seccomp: Add missing compat_ioctl for notify
In reply to Greg Kroah-HartmanFrom: Sven Schnelle <[email protected]>
commit 3db81afd99494a33f1c3839103f0429c8f30cb9d upstream.
Executing the seccomp_bpf testsuite under a 64-bit kernel with 32-bit userland (both s390 and x86) doesn't work because there's no compat_ioctl handler defined. Add the handler.
--- kernel/seccomp.c | 1 + 1 file changed, 1 insertion(+)
kernel/seccomp.c +1 -0
@@ -1221,6 +1221,7 @@ static const struct file_operations secc .poll = seccomp_notify_poll, .release = seccomp_notify_release, .unlocked_ioctl = seccomp_notify_ioctl, + .compat_ioctl = seccomp_notify_ioctl, };static struct file *init_listener (struct seccomp_filter *filter)
Greg Kroah-Hartman
maintainerPATCH 105/257 ACPI: EC: Avoid printing confusing messages in acpi_ec_setup()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit c823c17a8ea4db4943152388a0beb9a556715716 upstream.
It doesn't really make sense to pass ec->handle of the ECDT EC to acpi_handle_info(), because it is set to ACPI_ROOT_OBJECT in acpi_ec_ecdt_probe(), so rework acpi_ec_setup() to avoid using acpi_handle_info() for printing messages.
First, notice that the "Used as first EC" message is not really useful, because it is immediately followed by a more meaningful one from either acpi_ec_ecdt_probe() or acpi_ec_dsdt_probe() (the latter also includes the EC object path), so drop it altogether.
Second, use pr_info() for printing the EC configuration information.
While at it, make the code in question avoid printing invalid GPE or IRQ numbers and make it print the GPE/IRQ information only when the driver is ready to handle events.
--- drivers/acpi/ec.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/acpi/ec.c +10 -5
@@ -1592,14 +1592,19 @@ static int acpi_ec_setup(struct acpi_ecreturn ret;/* First EC capable of handling transactions */ -if (!first_ec) { +if (!first_ec) first_ec = ec; -acpi_handle_info (first_ec->handle,"Used as first EC\n" ); + +pr_info ("EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n" , ec->command_addr, + ec->data_addr); + +if (test_bit (EC_FLAGS_EVENT_HANDLER_INSTALLED , &ec->flags)) { +if (ec->gpe >=0 ) +pr_info ("GPE=0x%x\n" , ec->gpe); +else +pr_info ("IRQ=%d\n" , ec->irq); } -acpi_handle_info (ec->handle, -"GPE=0x%x, IRQ=%d, EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n" , - ec->gpe, ec->irq, ec->command_addr, ec->data_addr);return ret; }
Greg Kroah-Hartman
maintainerPATCH 106/257 acpi/x86: ignore unspecified bit positions in the ACPI global lock field
In reply to Greg Kroah-HartmanFrom: Jan Engelhardt <[email protected]>
commit ecb9c790999fd6c5af0f44783bd0217f0b89ec2b upstream.
The value in "new" is constructed from "old" such that all bits defined as reserved by the ACPI spec[1] are left untouched. But if those bits do not happen to be all zero, "new < 3" will not evaluate to true.
The firmware of the laptop(s) Medion MD63490 / Akoya P15648 comes with garbage inside the "FACS" ACPI table. The starting value is old=0x4944454d, therefore new=0x4944454e, which is >= 3. Mask off the reserved bits.
[1] https://uefi.org/sites/default/files/resources/ACPI_6_2.pdf
--- arch/x86/kernel/acpi/boot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/acpi/boot.c +1 -1
@@ -1740,7 +1740,7 @@ int __acpi_acquire_global_lock(unsigned new = (((old & ~0x3 ) +2 ) + ((old >>1 ) &0x1 )); val =cmpxchg (lock, old, new); }while (unlikely (val != old)); -return (new <3 ) ?-1 :0 ; +return ((new &0x3 ) <3 ) ?-1 :0 ; }int __acpi_release_global_lock (unsigned int *lock)
Greg Kroah-Hartman
maintainerPATCH 107/257 ACPICA: Allow acpi_any_gpe_status_set() to skip one GPE
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit 0ce792d660bda990c675eaf14ce09594a9b85cbf upstream.
The check carried out by acpi_any_gpe_status_set() is not precise enough for the suspend-to-idle implementation in Linux and in some cases it is necessary make it skip one GPE (specifically, the EC GPE) from the check to prevent a race condition leading to a premature system resume from occurring.
For this reason, redefine acpi_any_gpe_status_set() to take the number of a GPE to skip as an argument.
--- drivers/acpi/acpica/achware.h | 2 - drivers/acpi/acpica/evxfgpe.c | 17 ++++++++++----- drivers/acpi/acpica/hwgpe.c | 47 +++++++++++++++++++++++++++++++++--------- drivers/acpi/sleep.c | 2 - include/acpi/acpixf.h | 2 - 5 files changed, 53 insertions(+), 17 deletions(-)
drivers/acpi/acpica/achware.h +1 -1
@@ -101,7 +101,7 @@ acpi_status acpi_hw_enable_all_runtime_gacpi_status acpi_hw_enable_all_wakeup_gpes (void ); -u8 acpi_hw_check_all_gpes (void ); +u8 acpi_hw_check_all_gpes (acpi_handle gpe_skip_device,u32 gpe_skip_number); acpi_status acpi_hw_enable_runtime_gpe_block(struct acpi_gpe_xrupt_info *gpe_xrupt_info,
drivers/acpi/acpica/evxfgpe.c +12 -5
@@ -799,17 +799,19 @@ ACPI_EXPORT_SYMBOL(acpi_enable_all_wakeu* * FUNCTION: acpi_any_gpe_status_set * -* PARAMETERS: None +* PARAMETERS: gpe_skip_number - Number of the GPE to skip * * RETURN: Whether or not the status bit is set for any GPE * -* DESCRIPTION: Check the status bits of all enabled GPEs and return TRUE if any -* of them is set or FALSE otherwise. +* DESCRIPTION: Check the status bits of all enabled GPEs, except for the one +* represented by the "skip" argument, and return TRUE if any of +* them is set or FALSE otherwise. * ******************************************************************************/ -u32 acpi_any_gpe_status_set (void ) +u32 acpi_any_gpe_status_set (u32 gpe_skip_number) {acpi_status status; +acpi_handle gpe_device;u8 ret;ACPI_FUNCTION_TRACE (acpi_any_gpe_status_set);
@@ -819,7 +821,12 @@ u32 acpi_any_gpe_status_set(void)return (FALSE); } - ret =acpi_hw_check_all_gpes (); + status =acpi_get_gpe_device (gpe_skip_number, &gpe_device); +if (ACPI_FAILURE (status)) { + gpe_device =NULL ; + } + + ret =acpi_hw_check_all_gpes (gpe_device, gpe_skip_number); (void )acpi_ut_release_mutex (ACPI_MTX_EVENTS );return (ret);
drivers/acpi/acpica/hwgpe.c +38 -9
93 lines not on this page · raw message
drivers/acpi/sleep.c +1 -1
@@ -1023,7 +1023,7 @@ static bool acpi_s2idle_wake(void)* status bit from unset to set between the checks with the * status bits of all the other GPEs unset. */ -if (acpi_any_gpe_status_set () && !acpi_ec_dispatch_gpe ()) +if (acpi_any_gpe_status_set (U32_MAX ) && !acpi_ec_dispatch_gpe ())return true;/*
include/acpi/acpixf.h +1 -1
@@ -752,7 +752,7 @@ ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_disable_all_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_runtime_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_wakeup_gpes(void)) -ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_any_gpe_status_set(void)) +ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_any_gpe_status_set(u32 gpe_skip_number)) ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_any_fixed_event_status_set(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
Greg Kroah-Hartman
maintainerPATCH 108/257 ACPI: PM: s2idle: Refine active GPEs check
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit d5406284ff803a578ca503373624312770319054 upstream.
The check for any active GPEs added by commit fdde0ff8590b ("ACPI:
PM: s2idle: Prevent spurious SCIs from waking up the system") turns out to be insufficiently precise to prevent some systems from resuming prematurely due to a spurious EC wakeup, so refine it by first checking if any GPEs other than the EC GPE are active and skipping all of the SCIs coming from the EC that do not produce any genuine wakeup events after processing.
--- drivers/acpi/ec.c | 5 +++++ drivers/acpi/internal.h | 1 + drivers/acpi/sleep.c | 19 ++++++++++--------- 3 files changed, 16 insertions(+), 9 deletions(-)
drivers/acpi/ec.c +5 -0
@@ -2052,6 +2052,11 @@ void acpi_ec_set_gpe_wake_mask(u8 actionacpi_set_gpe_wake_mask (NULL , first_ec->gpe, action); } +bool acpi_ec_other_gpes_active (void ) +{ +return acpi_any_gpe_status_set (first_ec ? first_ec->gpe :U32_MAX ); +} +bool acpi_ec_dispatch_gpe (void ) {u32 ret;
drivers/acpi/internal.h +1 -0
@@ -202,6 +202,7 @@ void acpi_ec_remove_query_handler(struct#ifdef CONFIG_PM_SLEEP void acpi_ec_flush_work (void ); +bool acpi_ec_other_gpes_active (void );bool acpi_ec_dispatch_gpe (void );#endif
drivers/acpi/sleep.c +10 -9
@@ -1014,19 +1014,20 @@ static bool acpi_s2idle_wake(void)return true;/* -* If there are no EC events to process and at least one of the -* other enabled GPEs is active, the wakeup is regarded as a -* genuine one. -* -* Note that the checks below must be carried out in this order -* to avoid returning prematurely due to a change of the EC GPE -* status bit from unset to set between the checks with the -* status bits of all the other GPEs unset. +* If the status bit is set for any enabled GPE other than the +* EC one, the wakeup is regarded as a genuine one. */ -if (acpi_any_gpe_status_set (U32_MAX ) && !acpi_ec_dispatch_gpe ()) +if (acpi_ec_other_gpes_active ())return true;/* +* If the EC GPE status bit has not been set, the wakeup is +* regarded as a spurious one. +*/ +if (!acpi_ec_dispatch_gpe ()) +return false; + +/* * Cancel the wakeup and process all pending events in case * there are any wakeup ones in there. *
Greg Kroah-Hartman
maintainerPATCH 109/257 thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
commit 3f5b9959041e0db6dacbea80bb833bff5900999f upstream.
When CONFIG_DEVFREQ_THERMAL is disabled all functions except of_devfreq_cooling_register_power() were already inlined. Also inline the last function to avoid compile errors when multiple drivers call of_devfreq_cooling_register_power() when CONFIG_DEVFREQ_THERMAL is not set. Compilation failed with the following message:
multiple definition of `of_devfreq_cooling_register_power'
(which then lists all usages of of_devfreq_cooling_register_power())
Thomas Zimmermann reported this problem [0] on a kernel config with CONFIG_DRM_LIMA={m,y}, CONFIG_DRM_PANFROST={m,y} and CONFIG_DEVFREQ_THERMAL=n after both, the lima and panfrost drivers gained devfreq cooling support.
[0] https://www.spinics.net/lists/dri-devel/msg252825.html
--- include/linux/devfreq_cooling.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/devfreq_cooling.h +1 -1
@@ -75,7 +75,7 @@ void devfreq_cooling_unregister(struct t#else /* !CONFIG_DEVFREQ_THERMAL */ -struct thermal_cooling_device * +static inline struct thermal_cooling_device *of_devfreq_cooling_register_power (struct device_node *np,struct devfreq *df,struct devfreq_cooling_power *dfc_power) {
Greg Kroah-Hartman
maintainerPATCH 110/257 nvmet-tcp: fix maxh2cdata icresp parameter
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
commit 9cda34e37489244a8c8628617e24b2dbc8a8edad upstream.
MAXH2CDATA is not zero based. Also no reason to limit ourselves to 1M transfers as we can do more easily. Make this an arbitrary limit of 16M.
--- drivers/nvme/target/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/target/tcp.c +1 -1
@@ -794,7 +794,7 @@ static int nvmet_tcp_handle_icreq(struct icresp->hdr.pdo =0 ; icresp->hdr.plen =cpu_to_le32 (icresp->hdr.hlen); icresp->pfv =cpu_to_le16 (NVME_TCP_PFV_1_0 ); - icresp->maxdata =cpu_to_le32 (0xffff );/* FIXME: support r2t */ + icresp->maxdata =cpu_to_le32 (0x400000 );/* 16M arbitrary limit */ icresp->cpda =0 ;if (queue->hdr_digest) icresp->digest |=NVME_TCP_HDR_DIGEST_ENABLE ;
Greg Kroah-Hartman
maintainerPATCH 111/257 nvme-fc: Revert "add module to ops template to allow module references"
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
commit 8c5c660529209a0e324c1c1a35ce3f83d67a2aa5 upstream.
The original patch was to resolve the lldd being able to be unloaded while being used to talk to the boot device of the system. However, the end result of the original patch is that any driver unload while a nvme controller is live via the lldd is now being prohibited. Given the module reference, the module teardown routine can't be called, thus there's no way, other than manual actions to terminate the controllers.
--- drivers/nvme/host/fc.c | 14 ++------------ drivers/nvme/target/fcloop.c | 1 - drivers/scsi/lpfc/lpfc_nvme.c | 2 -- drivers/scsi/qla2xxx/qla_nvme.c | 1 - include/linux/nvme-fc-driver.h | 4 ---- 5 files changed, 2 insertions(+), 20 deletions(-)
drivers/nvme/host/fc.c +2 -12
@@ -342,8 +342,7 @@ nvme_fc_register_localport(struct nvme_f !template->ls_req || !template->fcp_io || !template->ls_abort || !template->fcp_abort || !template->max_hw_queues || !template->max_sgl_segments || - !template->max_dif_sgl_segments || !template->dma_boundary || - !template->module) { + !template->max_dif_sgl_segments || !template->dma_boundary) { ret = -EINVAL ; goto out_reghost_failed; }
@@ -2016,7 +2015,6 @@ nvme_fc_ctrl_free(struct kref *ref) {struct nvme_fc_ctrl *ctrl = container_of(ref, struct nvme_fc_ctrl, ref); -struct nvme_fc_lport *lport = ctrl->lport;unsigned long flags;if (ctrl->ctrl.tagset) {
@@ -2043,7 +2041,6 @@ nvme_fc_ctrl_free(struct kref *ref)if (ctrl->ctrl.opts)nvmf_free_options (ctrl->ctrl.opts);kfree (ctrl); -module_put (lport->ops->module); } static void
@@ -3074,15 +3071,10 @@ nvme_fc_init_ctrl(struct device *dev, st goto out_fail; } -if (!try_module_get (lport->ops->module)) { - ret = -EUNATCH ; - goto out_free_ctrl; - } - idx =ida_simple_get (&nvme_fc_ctrl_cnt,0 ,0 ,GFP_KERNEL );if (idx <0 ) { ret = -ENOSPC ; - goto out_mod_put; + goto out_free_ctrl; } ctrl->ctrl.opts = opts;
@@ -3235,8 +3227,6 @@ out_free_queues: out_free_ida:put_device (ctrl->dev);ida_simple_remove (&nvme_fc_ctrl_cnt, ctrl->cnum); -out_mod_put: -module_put (lport->ops->module); out_free_ctrl:kfree (ctrl); out_fail:
drivers/nvme/target/fcloop.c +0 -1
@@ -850,7 +850,6 @@ fcloop_targetport_delete(struct nvmet_fc#define FCLOOP_DMABOUND_4G 0xFFFFFFFFstatic struct nvme_fc_port_template fctemplate = { - .module =THIS_MODULE , .localport_delete = fcloop_localport_delete, .remoteport_delete = fcloop_remoteport_delete, .create_queue = fcloop_create_queue,
drivers/scsi/lpfc/lpfc_nvme.c +0 -2
@@ -1985,8 +1985,6 @@ out_unlock:/* Declare and initialization an instance of the FC NVME template. */ static struct nvme_fc_port_template lpfc_nvme_template = { - .module =THIS_MODULE , -/* initiator-based functions */ .localport_delete = lpfc_nvme_localport_delete, .remoteport_delete = lpfc_nvme_remoteport_delete,
drivers/scsi/qla2xxx/qla_nvme.c +0 -1
@@ -610,7 +610,6 @@ static void qla_nvme_remoteport_delete(s }static struct nvme_fc_port_template qla_nvme_fc_transport = { - .module =THIS_MODULE , .localport_delete = qla_nvme_localport_delete, .remoteport_delete = qla_nvme_remoteport_delete, .create_queue = qla_nvme_alloc_queue,
include/linux/nvme-fc-driver.h +0 -4
@@ -270,8 +270,6 @@ struct nvme_fc_remote_port {* * Host/Initiator Transport Entrypoints/Parameters: * -* @module: The LLDD module using the interface -* * @localport_delete: The LLDD initiates deletion of a localport via * nvme_fc_deregister_localport(). However, the teardown is * asynchronous. This routine is called upon the completion of the
@@ -385,8 +383,6 @@ struct nvme_fc_remote_port {* Value is Mandatory. Allowed to be zero. */ struct nvme_fc_port_template { -struct module *module; -/* initiator-based functions */ void (*localport_delete)(struct nvme_fc_local_port *);void (*remoteport_delete)(struct nvme_fc_remote_port *);
Greg Kroah-Hartman
maintainerPATCH 112/257 efi/x86: Add TPM related EFI tables to unencrypted mapping checks
In reply to Greg Kroah-HartmanFrom: Tom Lendacky <[email protected]>
commit f10e80a19b07b58fc2adad7945f8313b01503bae upstream.
When booting with SME active, EFI tables must be mapped unencrypted since they were built by UEFI in unencrypted memory. Update the list of tables to be checked during early_memremap() processing to account for the EFI TPM tables.
This fixes a bug where an EFI TPM log table has been created by UEFI, but it lives in memory that has been marked as usable rather than reserved.
--- arch/x86/platform/efi/efi.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/platform/efi/efi.c +2 -0
@@ -85,6 +85,8 @@ static const unsigned long * const efi_t#ifdef CONFIG_EFI_RCI2_TABLE &rci2_table_phys, #endif + &efi.tpm_log, + &efi.tpm_final_log, };u64 efi_setup;/* efi setup_data physical address */
Greg Kroah-Hartman
maintainerPATCH 113/257 PCI: pciehp: Fix indefinite wait on sysfs requests
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit 3e487d2e4aa466decd226353755c9d423e8fbacc upstream.
David Hoyer reports that powering pciehp slots up or down via sysfs may
hang: The call to wait_event() in pciehp_sysfs_enable_slot() and _disable_slot() does not return because ctrl->ist_running remains true.
This flag, which was introduced by commit 157c1062fcd8 ("PCI: pciehp: Avoid returning prematurely from sysfs requests"), signifies that the IRQ thread pciehp_ist() is running. It is set to true at the top of pciehp_ist() and reset to false at the end. However there are two additional return statements in pciehp_ist() before which the commit neglected to reset the flag to false and wake up waiters for the flag.
That omission opens up the following race when powering up the slot:
* pciehp_ist() runs because a PCI_EXP_SLTSTA_PDC event was requested by pciehp_sysfs_enable_slot()
* pciehp_ist() turns on slot power via the following call stack:
pciehp_handle_presence_or_link_change() -> pciehp_enable_slot() -> __pciehp_enable_slot() -> board_added() -> pciehp_power_on_slot()
* after slot power is turned on, the link comes up, resulting in a PCI_EXP_SLTSTA_DLLSC event
* the IRQ handler pciehp_isr() stores the event in ctrl->pending_events and returns IRQ_WAKE_THREAD
* the IRQ thread is already woken (it's bringing up the slot), but the genirq code remembers to re-run the IRQ thread after it has finished (such that it can deal with the new event) by setting IRQTF_RUNTHREAD via __handle_irq_event_percpu() -> __irq_wake_thread()
* the IRQ thread removes PCI_EXP_SLTSTA_DLLSC from ctrl->pending_events via board_added() -> pciehp_check_link_status() in order to deal with presence and link flaps per commit 6c35a1ac3da6 ("PCI: pciehp:
Tolerate initially unstable link")
* after pciehp_ist() has successfully brought up the slot, it resets ctrl->ist_running to false and wakes up the sysfs requester
* the genirq code re-runs pciehp_ist(), which sets ctrl->ist_running to true but then returns with IRQ_NONE because ctrl->pending_events is empty
* pciehp_sysfs_enable_slot() is finally woken but notices that ctrl->ist_running is true, hence continues waiting
The only way to get the hung task going again is to trigger a hotplug event which brings down the slot, e.g. by yanking out the card.
The same race exists when powering down the slot because remove_board() likewise clears link or presence changes in ctrl->pending_events per commit 3943af9d01e9 ("PCI: pciehp: Ignore Link State Changes after powering off a slot") and thereby may cause a re-run of pciehp_ist() which returns with IRQ_NONE without resetting ctrl->ist_running to false.
Fix by adding a goto label before the teardown steps at the end of pciehp_ist() and jumping to that label from the two return statements which currently neglect to reset the ctrl->ist_running flag.
--- drivers/pci/hotplug/pciehp_hpc.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/pci/hotplug/pciehp_hpc.c +7 -7
@@ -625,17 +625,15 @@ static irqreturn_t pciehp_ist(int irq, vif (atomic_fetch_and (~RERUN_ISR , &ctrl->pending_events) &RERUN_ISR ) { ret =pciehp_isr (irq, dev_id);enable_irq (irq); -if (ret !=IRQ_WAKE_THREAD ) { -pci_config_pm_runtime_put (pdev); -return ret; - } +if (ret !=IRQ_WAKE_THREAD ) + goto out; }synchronize_hardirq (irq); events =atomic_xchg (&ctrl->pending_events,0 );if (!events) { -pci_config_pm_runtime_put (pdev); -return IRQ_NONE ; + ret =IRQ_NONE ; + goto out; }/* Check Attention Button Pressed */
@@ -664,10 +662,12 @@ static irqreturn_t pciehp_ist(int irq, vpciehp_handle_presence_or_link_change (ctrl, events);up_read (&ctrl->reset_lock); + ret =IRQ_HANDLED ; +out:pci_config_pm_runtime_put (pdev); ctrl->ist_running = false;wake_up (&ctrl->requester); -return IRQ_HANDLED ; +return ret; }static int pciehp_poll (void *data)
Greg Kroah-Hartman
maintainerPATCH 114/257 PCI/ASPM: Clear the correct bits when enabling L1 substates
In reply to Greg Kroah-HartmanFrom: Yicong Yang <[email protected]>
commit 58a3862a10a317a81097ab0c78aecebabb1704f5 upstream.
In pcie_config_aspm_l1ss(), we cleared the wrong bits when enabling ASPM L1 Substates. Instead of the L1.x enable bits (PCI_L1SS_CTL1_L1SS_MASK, 0xf), we cleared the Link Activation Interrupt Enable bit (PCI_L1SS_CAP_L1_PM_SS, 0x10).
Clear the L1.x enable bits before writing the new L1.x configuration.
--- drivers/pci/pcie/aspm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/pcie/aspm.c +2 -2
@@ -747,9 +747,9 @@ static void pcie_config_aspm_l1ss(struct/* Enable what we need to enable */ pci_clear_and_set_dword (parent, up_cap_ptr +PCI_L1SS_CTL1 , -PCI_L1SS_CAP_L1_PM_SS , val); +PCI_L1SS_CTL1_L1SS_MASK , val);pci_clear_and_set_dword (child, dw_cap_ptr +PCI_L1SS_CTL1 , -PCI_L1SS_CAP_L1_PM_SS , val); +PCI_L1SS_CTL1_L1SS_MASK , val); }static void pcie_config_aspm_dev (struct pci_dev *pdev,u32 val)
Greg Kroah-Hartman
maintainerPATCH 115/257 PCI: Add boot interrupt quirk mechanism for Xeon chipsets
In reply to Greg Kroah-HartmanFrom: Sean V Kelley <[email protected]>
commit b88bf6c3b6ff77948c153cac4e564642b0b90632 upstream.
The following was observed by Kar Hin Ong with RT patchset:
Backtrace:
irq 19: nobody cared (try booting with the "irqpoll" option)
CPU: 0 PID: 3329 Comm: irq/34-nipalk Tainted:4.14.87-rt49 #1
Hardware name: National Instruments NI PXIe-8880/NI PXIe-8880,
BIOS 2.1.5f1 01/09/2020
Call Trace:
<IRQ>
? dump_stack+0x46/0x5e
? __report_bad_irq+0x2e/0xb0
? note_interrupt+0x242/0x290
? nNIKAL100_memoryRead16+0x8/0x10 [nikal]
? handle_irq_event_percpu+0x55/0x70
? handle_irq_event+0x4f/0x80
? handle_fasteoi_irq+0x81/0x180
? handle_irq+0x1c/0x30
? do_IRQ+0x41/0xd0
? common_interrupt+0x84/0x84
</IRQ>
...
handlers:
[<ffffffffb3297200>] irq_default_primary_handler threaded
[<ffffffffb3669180>] usb_hcd_irq
Disabling IRQ #19The problem being that this device is triggering boot interrupts due to threaded interrupt handling and masking of the IO-APIC. These boot interrupts are then forwarded on to the legacy PCH's PIRQ lines where there is no handler present for the device.
Whenever a PCI device fires interrupt (INTx) to Pin 20 of IOAPIC 2 (GSI 44), the kernel receives two interrupts:
1. Interrupt from Pin 20 of IOAPIC 2 -> Expected
2. Interrupt from Pin 19 of IOAPIC 1 -> UNEXPECTED
Quirks for disabling boot interrupts (preferred) or rerouting the handler exist but do not address these Xeon chipsets' mechanism:
https://lore.kernel.org/lkml/[email protected]/
Add a new mechanism via PCI CFG for those chipsets supporting CIPINTRC register's dis_intx_rout2ich bit.
--- drivers/pci/quirks.c | 80 ++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 73 insertions(+), 7 deletions(-)
drivers/pci/quirks.c +73 -7
@@ -1970,26 +1970,92 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_I/* * IO-APIC1 on 6300ESB generates boot interrupts, see Intel order no * 300641-004US, section 5.7.3. +* +* Core IO on Xeon E5 1600/2600/4600, see Intel order no 326509-003. +* Core IO on Xeon E5 v2, see Intel order no 329188-003. +* Core IO on Xeon E7 v2, see Intel order no 329595-002. +* Core IO on Xeon E5 v3, see Intel order no 330784-003. +* Core IO on Xeon E7 v3, see Intel order no 332315-001US. +* Core IO on Xeon E5 v4, see Intel order no 333810-002US. +* Core IO on Xeon E7 v4, see Intel order no 332315-001US. +* Core IO on Xeon D-1500, see Intel order no 332051-001. +* Core IO on Xeon Scalable, see Intel order no 610950. */ -#define INTEL_6300_IOAPIC_ABAR 0x40 +#define INTEL_6300_IOAPIC_ABAR 0x40/* Bus 0, Dev 29, Func 5 */ #define INTEL_6300_DISABLE_BOOT_IRQ (1<<14) +#define INTEL_CIPINTRC_CFG_OFFSET 0x14C/* Bus 0, Dev 5, Func 0 */ +#define INTEL_CIPINTRC_DIS_INTX_ICH (1<<25) +static void quirk_disable_intel_boot_interrupt (struct pci_dev *dev) {u16 pci_config_word; +u32 pci_config_dword;if (noioapicquirk)return ; -pci_read_config_word (dev,INTEL_6300_IOAPIC_ABAR , &pci_config_word); - pci_config_word |=INTEL_6300_DISABLE_BOOT_IRQ ; -pci_write_config_word (dev,INTEL_6300_IOAPIC_ABAR , pci_config_word); - +switch (dev->device) { +case PCI_DEVICE_ID_INTEL_ESB_10 : +pci_read_config_word (dev,INTEL_6300_IOAPIC_ABAR , + &pci_config_word); + pci_config_word |=INTEL_6300_DISABLE_BOOT_IRQ ; +pci_write_config_word (dev,INTEL_6300_IOAPIC_ABAR , + pci_config_word); +break ; +case 0x3c28 :/* Xeon E5 1600/2600/4600 */ +case 0x0e28 :/* Xeon E5/E7 V2 */ +case 0x2f28 :/* Xeon E5/E7 V3,V4 */ +case 0x6f28 :/* Xeon D-1500 */ +case 0x2034 :/* Xeon Scalable Family */ +pci_read_config_dword (dev,INTEL_CIPINTRC_CFG_OFFSET , + &pci_config_dword); + pci_config_dword |=INTEL_CIPINTRC_DIS_INTX_ICH ; +pci_write_config_dword (dev,INTEL_CIPINTRC_CFG_OFFSET , + pci_config_dword); +break ; +default : +return ; + }pci_info (dev,"disabled boot interrupts on device [%04x:%04x]\n" , dev->vendor, dev->device); } -DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_ESB_10 , quirk_disable_intel_boot_interrupt); -DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_ESB_10 , quirk_disable_intel_boot_interrupt); +/* +* Device 29 Func 5 Device IDs of IO-APIC +* containing ABAR—APIC1 Alternate Base Address Register +*/ +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_ESB_10 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_ESB_10 , + quirk_disable_intel_boot_interrupt); + +/* +* Device 5 Func 0 Device IDs of Core IO modules/hubs +* containing Coherent Interface Protocol Interrupt Control +* +* Device IDs obtained from volume 2 datasheets of commented +* families above. +*/ +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x3c28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x0e28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x2f28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x6f28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x2034 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,0x3c28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,0x0e28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,0x2f28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,0x6f28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,0x2034 , + quirk_disable_intel_boot_interrupt);/* Disable boot interrupts on HT-1000 */ #define BC_HT1000_FEATURE_REG 0x64
Greg Kroah-Hartman
maintainerPATCH 116/257 PCI: qcom: Fix the fixup of PCI_VENDOR_ID_QCOM
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
commit 604f3956524a6a53c1e3dd27b4b685b664d181ec upstream.
There exists non-bridge PCIe devices with PCI_VENDOR_ID_QCOM, so limit the fixup to only affect the relevant PCIe bridges.
--- drivers/pci/controller/dwc/pcie-qcom.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-qcom.c +7 -1
@@ -1289,7 +1289,13 @@ static void qcom_fixup_class(struct pci_ { dev->class =PCI_CLASS_BRIDGE_PCI <<8 ; } -DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,PCI_ANY_ID , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x0101 , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x0104 , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x0106 , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x0107 , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x0302 , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x1000 , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x1001 , qcom_fixup_class);static struct platform_driver qcom_pcie_driver = { .probe = qcom_pcie_probe,
Greg Kroah-Hartman
maintainerPATCH 117/257 PCI: endpoint: Fix for concurrent memory allocation in OB address region
In reply to Greg Kroah-HartmanFrom: Kishon Vijay Abraham I <[email protected]>
commit 04e046ca57ebed3943422dee10eec9e73aec081e upstream.
pci-epc-mem uses a bitmap to manage the Endpoint outbound (OB) address region. This address region will be shared by multiple endpoint functions (in the case of multi function endpoint) and it has to be protected from concurrent access to avoid updating an inconsistent state.
Use a mutex to protect bitmap updates to prevent the memory allocation API from returning incorrect addresses.
--- drivers/pci/endpoint/pci-epc-mem.c | 10 ++++++++-- include/linux/pci-epc.h | 3 +++ 2 files changed, 11 insertions(+), 2 deletions(-)
drivers/pci/endpoint/pci-epc-mem.c +8 -2
@@ -79,6 +79,7 @@ int __pci_epc_mem_init(struct pci_epc *e mem->page_size = page_size; mem->pages = pages; mem->size = size; +mutex_init (&mem->lock); epc->mem = mem;
@@ -122,7 +123,7 @@ void __iomem *pci_epc_mem_alloc_addr(str phys_addr_t *phys_addr, size_t size) { int pageno; -void __iomem *virt_addr; +void __iomem *virt_addr =NULL ;struct pci_epc_mem *mem = epc->mem;unsigned int page_shift =ilog2 (mem->page_size);int order;
@@ -130,15 +131,18 @@ void __iomem *pci_epc_mem_alloc_addr(str size =ALIGN (size, mem->page_size); order =pci_epc_mem_get_order (mem, size); +mutex_lock (&mem->lock); pageno =bitmap_find_free_region (mem->bitmap, mem->pages, order);if (pageno <0 ) -return NULL ; + goto ret; *phys_addr = mem->phys_base + ((phys_addr_t )pageno << page_shift); virt_addr =ioremap (*phys_addr, size);if (!virt_addr)bitmap_release_region (mem->bitmap, pageno, order); +ret: +mutex_unlock (&mem->lock);return virt_addr; }EXPORT_SYMBOL_GPL (pci_epc_mem_alloc_addr);
@@ -164,7 +168,9 @@ void pci_epc_mem_free_addr(struct pci_ep pageno = (phys_addr - mem->phys_base) >> page_shift; size =ALIGN (size, mem->page_size); order =pci_epc_mem_get_order (mem, size); +mutex_lock (&mem->lock);bitmap_release_region (mem->bitmap, pageno, order); +mutex_unlock (&mem->lock); }EXPORT_SYMBOL_GPL (pci_epc_mem_free_addr);
include/linux/pci-epc.h +3 -0
@@ -71,6 +71,7 @@ struct pci_epc_ops {* @bitmap: bitmap to manage the PCI address space * @pages: number of bits representing the address region * @page_size: size of each page +* @lock: mutex to protect bitmap */ struct pci_epc_mem {phys_addr_t phys_base;
@@ -78,6 +79,8 @@ struct pci_epc_mem {unsigned long *bitmap;size_t page_size;int pages; +/* mutex to protect against concurrent access for memory allocation*/ +struct mutex lock; };/**
Greg Kroah-Hartman
maintainerPATCH 118/257 erofs: correct the remaining shrink objects
In reply to Greg Kroah-HartmanFrom: Gao Xiang <[email protected]>
commit 9d5a09c6f3b5fb85af20e3a34827b5d27d152b34 upstream.
The remaining count should not include successful
shrink attempts.
--- fs/erofs/utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/erofs/utils.c +1 -1
@@ -293,7 +293,7 @@ static unsigned long erofs_shrink_scan(sspin_unlock (&erofs_sb_list_lock); sbi->shrinker_run_no = run_no; - freed +=erofs_shrink_workstation (sbi, nr); + freed +=erofs_shrink_workstation (sbi, nr - freed);spin_lock (&erofs_sb_list_lock);/* Get the next list element before we move this one */
Greg Kroah-Hartman
maintainerPATCH 119/257 sched/fair: Fix enqueue_task_fair warning
In reply to Greg Kroah-HartmanFrom: Vincent Guittot <[email protected]>
commit fe61468b2cbc2b7ce5f8d3bf32ae5001d4c434e9 upstream.
When a cfs rq is throttled, the latter and its child are removed from the leaf list but their nr_running is not changed which includes staying higher than 1. When a task is enqueued in this throttled branch, the cfs rqs must be added back in order to ensure correct ordering in the list but this can only happens if nr_running == 1.
When cfs bandwidth is used, we call unconditionnaly list_add_leaf_cfs_rq() when enqueuing an entity to make sure that the complete branch will be added.
Similarly unthrottle_cfs_rq() can stop adding cfs in the list when a parent is throttled. Iterate the remaining entity to ensure that the complete branch will be added in the list.
--- kernel/sched/fair.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-)
kernel/sched/fair.c +22 -4
@@ -3943,6 +3943,7 @@ static inline void check_schedstat_requi#endif } +static inline bool cfs_bandwidth_used (void );/* * MIGRATION
@@ -4021,10 +4022,16 @@ enqueue_entity(struct cfs_rq *cfs_rq, st__enqueue_entity (cfs_rq, se); se->on_rq =1 ; -if (cfs_rq->nr_running ==1 ) { +/* +* When bandwidth control is enabled, cfs might have been removed +* because of a parent been throttled but cfs->nr_running > 1. Try to +* add it unconditionnally. +*/ +if (cfs_rq->nr_running ==1 ||cfs_bandwidth_used ())list_add_leaf_cfs_rq (cfs_rq); + +if (cfs_rq->nr_running ==1 )check_enqueue_throttle (cfs_rq); - } }static void __clear_buddies_last (struct sched_entity *se)
@@ -4605,11 +4612,22 @@ void unthrottle_cfs_rq(struct cfs_rq *cfbreak ; } -assert_list_leaf_cfs_rq (rq); -if (!se)add_nr_running (rq, task_delta); +/* +* The cfs_rq_throttled() breaks in the above iteration can result in +* incomplete leaf list maintenance, resulting in triggering the +* assertion below. +*/ +for_each_sched_entity (se) { + cfs_rq =cfs_rq_of (se); + +list_add_leaf_cfs_rq (cfs_rq); + } + +assert_list_leaf_cfs_rq (rq); +/* Determine whether we need to wake up potentially idle CPU: */ if (rq->curr == rq->idle && rq->cfs.nr_running)resched_curr (rq);
Greg Kroah-Hartman
maintainerPATCH 120/257 tpm: Dont make log failures fatal
In reply to Greg Kroah-HartmanFrom: Matthew Garrett <[email protected]>
commit 805fa88e0780b7ce1cc9b649dd91a0a7164c6eb4 upstream.
If a TPM is in disabled state, it's reasonable for it to have an empty log. Bailing out of probe in this case means that the PPI interface isn't available, so there's no way to then enable the TPM from the OS. In general it seems reasonable to ignore log errors - they shouldn't interfere with any other TPM functionality.
--- drivers/char/tpm/eventlog/common.c | 12 ++++-------- drivers/char/tpm/tpm-chip.c | 4 +--- drivers/char/tpm/tpm.h | 2 +- 3 files changed, 6 insertions(+), 12 deletions(-)
drivers/char/tpm/eventlog/common.c +4 -8
@@ -99,11 +99,8 @@ static int tpm_read_log(struct tpm_chip* * If an event log is found then the securityfs files are setup to * export it to userspace, otherwise nothing is done. -* -* Returns -ENODEV if the firmware has no event log or securityfs is not -* supported. */ -int tpm_bios_log_setup (struct tpm_chip *chip) +void tpm_bios_log_setup (struct tpm_chip *chip) {const char *name =dev_name (&chip->dev);unsigned int cnt;
@@ -112,7 +109,7 @@ int tpm_bios_log_setup(struct tpm_chip * rc =tpm_read_log (chip);if (rc <0 ) -return rc; +return ; log_version = rc; cnt =0 ;
@@ -158,13 +155,12 @@ int tpm_bios_log_setup(struct tpm_chip * cnt++; } -return 0 ; +return ; err: - rc =PTR_ERR (chip->bios_dir[cnt]); chip->bios_dir[cnt] =NULL ;tpm_bios_log_teardown (chip); -return rc; +return ; }void tpm_bios_log_teardown (struct tpm_chip *chip)
drivers/char/tpm/tpm-chip.c +1 -3
@@ -596,9 +596,7 @@ int tpm_chip_register(struct tpm_chip *ctpm_sysfs_add_device (chip); - rc =tpm_bios_log_setup (chip); -if (rc !=0 && rc != -ENODEV ) -return rc; +tpm_bios_log_setup (chip);tpm_add_ppi (chip);
drivers/char/tpm/tpm.h +1 -1
@@ -235,7 +235,7 @@ int tpm2_prepare_space(struct tpm_chip *int tpm2_commit_space (struct tpm_chip *chip,struct tpm_space *space,void *buf,size_t *bufsiz); -int tpm_bios_log_setup (struct tpm_chip *chip); +void tpm_bios_log_setup (struct tpm_chip *chip);void tpm_bios_log_teardown (struct tpm_chip *chip);int tpm_dev_common_init (void );void tpm_dev_common_exit (void );
Greg Kroah-Hartman
maintainerPATCH 121/257 tpm: tpm1_bios_measurements_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
commit d7a47b96ed1102551eb7325f97937e276fb91045 upstream.
If .next function does not change position index, following .show function will repeat output related to current position index.
In case of /sys/kernel/security/tpm0/ascii_bios_measurements and binary_bios_measurements:
1) read after lseek beyound end of file generates whole last line.
2) read after lseek to middle of last line generates expected end of last line and unexpected whole last line once again.
--- drivers/char/tpm/eventlog/tpm1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/tpm/eventlog/tpm1.c +1 -1
@@ -115,6 +115,7 @@ static void *tpm1_bios_measurements_nextu32 converted_event_size;u32 converted_event_type; + (*pos)++; converted_event_size =do_endian_conversion (event->event_size); v +=sizeof (struct tcpa_event ) + converted_event_size;
@@ -132,7 +133,6 @@ static void *tpm1_bios_measurements_next ((v + sizeof(struct tcpa_event) + converted_event_size) > limit))return NULL ; - (*pos)++;return v; }
Greg Kroah-Hartman
maintainerPATCH 122/257 tpm: tpm2_bios_measurements_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
commit f9bf8adb55cd5a357b247a16aafddf8c97b276e0 upstream.
If .next function does not change position index, following .show function will repeat output related to current position index.
For /sys/kernel/security/tpm0/binary_bios_measurements:
1) read after lseek beyound end of file generates whole last line.
2) read after lseek to middle of last line generates expected end of last line and unexpected whole last line once again.
--- drivers/char/tpm/eventlog/tpm2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/tpm/eventlog/tpm2.c +1 -1
@@ -94,6 +94,7 @@ static void *tpm2_bios_measurements_nextsize_t event_size;void *marker; + (*pos)++; event_header = log->bios_event_log;if (v ==SEQ_START_TOKEN ) {
@@ -118,7 +119,6 @@ static void *tpm2_bios_measurements_nextif (((v + event_size) >= limit) || (event_size ==0 ))return NULL ; - (*pos)++;return v; }
Greg Kroah-Hartman
maintainerPATCH 123/257 KEYS: reaching the keys quotas correctly
In reply to Greg Kroah-HartmanFrom: Yang Xu <[email protected]>
commit 2e356101e72ab1361821b3af024d64877d9a798d upstream.
Currently, when we add a new user key, the calltrace as below:
add_key()
key_create_or_update()
key_alloc()
__key_instantiate_and_link
generic_key_instantiate
key_payload_reserve
......Since commit a08bf91ce28e ("KEYS: allow reaching the keys quotas exactly"), we can reach max bytes/keys in key_alloc, but we forget to remove this limit when we reserver space for payload in key_payload_reserve. So we can only reach max keys but not max bytes when having delta between plen and type->def_datalen. Remove this limit when instantiating the key, so we can keep consistent with key_alloc.
Also, fix the similar problem in keyctl_chown_key().
--- security/keys/key.c | 2 +- security/keys/keyctl.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
security/keys/key.c +1 -1
@@ -381,7 +381,7 @@ int key_payload_reserve(struct key *key,spin_lock (&key->user->lock);if (delta >0 && - (key->user->qnbytes + delta >= maxbytes || + (key->user->qnbytes + delta > maxbytes || key->user->qnbytes + delta < key->user->qnbytes)) { ret = -EDQUOT ; }
security/keys/keyctl.c +2 -2
@@ -937,8 +937,8 @@ long keyctl_chown_key(key_serial_t id, u key_quota_root_maxbytes : key_quota_maxbytes;spin_lock (&newowner->lock); -if (newowner->qnkeys +1 >= maxkeys || - newowner->qnbytes + key->quotalen >= maxbytes || +if (newowner->qnkeys +1 > maxkeys || + newowner->qnbytes + key->quotalen > maxbytes || newowner->qnbytes + key->quotalen < newowner->qnbytes) goto quota_overrun;
Greg Kroah-Hartman
maintainerPATCH 124/257 mmc: mmci_sdmmc: Fix clear busyd0end irq flag
In reply to Greg Kroah-HartmanFrom: Ludovic Barre <[email protected]>
commit d4a384cb563e555ce00255f5f496b503e6cc6358 upstream.
The busyd0 line transition can be very fast. The busy request may be completed by busy_d0end, without waiting for the busy_d0 steps. Therefore, clear the busyd0end irq flag, even if no busy_status.
--- drivers/mmc/host/mmci_stm32_sdmmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/mmci_stm32_sdmmc.c +2 -2
@@ -315,11 +315,11 @@ complete:if (host->busy_status) {writel_relaxed (mask & ~host->variant->busy_detect_mask, base +MMCIMASK0 ); -writel_relaxed (host->variant->busy_detect_mask, - base +MMCICLEAR ); host->busy_status =0 ; } +writel_relaxed (host->variant->busy_detect_mask, base +MMCICLEAR ); +return true; }
Greg Kroah-Hartman
maintainerPATCH 125/257 rcu: Make rcu_barrier() account for offline no-CBs CPUs
In reply to Greg Kroah-HartmanFrom: Paul E. McKenney <[email protected]>
commit 127e29815b4b2206c0a97ac1d83f92ffc0e25c34 upstream.
Currently, rcu_barrier() ignores offline CPUs, However, it is possible for an offline no-CBs CPU to have callbacks queued, and rcu_barrier() must wait for those callbacks. This commit therefore makes rcu_barrier() directly invoke the rcu_barrier_func() with interrupts disabled for such CPUs. This requires passing the CPU number into this function so that it can entrain the rcu_barrier() callback onto the correct CPU's callback list, given that the code must instead execute on the current CPU.
While in the area, this commit fixes a bug where the first CPU's callback might have been invoked before rcu_segcblist_entrain() returned, which would also result in an early wakeup.
--- include/trace/events/rcu.h | 1 + kernel/rcu/tree.c | 36 ++++++++++++++++++++++++------------ 2 files changed, 25 insertions(+), 12 deletions(-)
include/trace/events/rcu.h +1 -0
@@ -720,6 +720,7 @@ TRACE_EVENT_RCU(rcu_torture_read,* "Begin": rcu_barrier() started. * "EarlyExit": rcu_barrier() piggybacked, thus early exit. * "Inc1": rcu_barrier() piggyback check counter incremented. +* "OfflineNoCBQ": rcu_barrier() found offline no-CBs CPU with callbacks. * "OnlineQ": rcu_barrier() found online CPU with callbacks. * "OnlineNQ": rcu_barrier() found online CPU, no callbacks. * "IRQ": An rcu_barrier_callback() callback posted on remote CPU.
kernel/rcu/tree.c +24 -12
@@ -2888,9 +2888,10 @@ static void rcu_barrier_callback(struct/* * Called with preemption disabled, and from cross-cpu IRQ context. */ -static void rcu_barrier_func (void *unused) +static void rcu_barrier_func (void *cpu_in) { -struct rcu_data *rdp =raw_cpu_ptr (&rcu_data); +uintptr_t cpu = (uintptr_t )cpu_in; +struct rcu_data *rdp =per_cpu_ptr (&rcu_data, cpu);rcu_barrier_trace (TPS ("IRQ" ),-1 , rcu_state.barrier_sequence); rdp->barrier_head.func = rcu_barrier_callback;
@@ -2917,7 +2918,7 @@ static void rcu_barrier_func(void *unuse*/ void rcu_barrier (void ) { -int cpu; +uintptr_t cpu;struct rcu_data *rdp;unsigned long s =rcu_seq_snap (&rcu_state.barrier_sequence);
@@ -2940,13 +2941,14 @@ void rcu_barrier(void)rcu_barrier_trace (TPS ("Inc1" ),-1 , rcu_state.barrier_sequence);/* -* Initialize the count to one rather than to zero in order to -* avoid a too-soon return to zero in case of a short grace period -* (or preemption of this task). Exclude CPU-hotplug operations -* to ensure that no offline CPU has callbacks queued. +* Initialize the count to two rather than to zero in order +* to avoid a too-soon return to zero in case of an immediate +* invocation of the just-enqueued callback (or preemption of +* this task). Exclude CPU-hotplug operations to ensure that no +* offline non-offloaded CPU has callbacks queued. */ init_completion (&rcu_state.barrier_completion); -atomic_set (&rcu_state.barrier_cpu_count,1 ); +atomic_set (&rcu_state.barrier_cpu_count,2 );get_online_cpus ();/*
@@ -2956,13 +2958,23 @@ void rcu_barrier(void)*/ for_each_possible_cpu (cpu) { rdp =per_cpu_ptr (&rcu_data, cpu); -if (!cpu_online (cpu) && +if (cpu_is_offline (cpu) && !rcu_segcblist_is_offloaded (&rdp->cblist))continue ; -if (rcu_segcblist_n_cbs (&rdp->cblist)) { +if (rcu_segcblist_n_cbs (&rdp->cblist) &&cpu_online (cpu)) {rcu_barrier_trace (TPS ("OnlineQ" ), cpu, rcu_state.barrier_sequence); -smp_call_function_single (cpu, rcu_barrier_func,NULL ,1 ); +smp_call_function_single (cpu, rcu_barrier_func, (void *)cpu,1 ); + }else if (rcu_segcblist_n_cbs (&rdp->cblist) && +cpu_is_offline (cpu)) { +rcu_barrier_trace (TPS ("OfflineNoCBQ" ), cpu, + rcu_state.barrier_sequence); +local_irq_disable (); +rcu_barrier_func ((void *)cpu); +local_irq_enable (); + }else if (cpu_is_offline (cpu)) { +rcu_barrier_trace (TPS ("OfflineNoCBNoQ" ), cpu, + rcu_state.barrier_sequence); }else {rcu_barrier_trace (TPS ("OnlineNQ" ), cpu, rcu_state.barrier_sequence);
@@ -2974,7 +2986,7 @@ void rcu_barrier(void)* Now that we have an rcu_barrier_callback() callback on each * CPU, and thus each counted, remove the initial count. */ -if (atomic_dec_and_test (&rcu_state.barrier_cpu_count)) +if (atomic_sub_and_test (2 , &rcu_state.barrier_cpu_count))complete (&rcu_state.barrier_completion);/* Wait for all rcu_barrier_callback() callbacks to be invoked. */
Greg Kroah-Hartman
maintainerPATCH 126/257 cpu/hotplug: Ignore pm_wakeup_pending() for disable_nonboot_cpus()
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit e98eac6ff1b45e4e73f2e6031b37c256ccb5d36b upstream.
A recent change to freeze_secondary_cpus() which added an early abort if a wakeup is pending missed the fact that the function is also invoked for shutdown, reboot and kexec via disable_nonboot_cpus().
In case of disable_nonboot_cpus() the wakeup event needs to be ignored as the purpose is to terminate the currently running kernel.
Add a 'suspend' argument which is only set when the freeze is in context of a suspend operation. If not set then an eventually pending wakeup event is ignored.
--- include/linux/cpu.h | 12 +++++++++--- kernel/cpu.c | 4 ++-- 2 files changed, 11 insertions(+), 5 deletions(-)
include/linux/cpu.h +9 -3
@@ -138,12 +138,18 @@ static inline void get_online_cpus(void)static inline void put_online_cpus (void ) {cpus_read_unlock (); }#ifdef CONFIG_PM_SLEEP_SMP -extern int freeze_secondary_cpus (int primary); +int __freeze_secondary_cpus (int primary,bool suspend); +static inline int freeze_secondary_cpus (int primary) +{ +return __freeze_secondary_cpus (primary, true); +} +static inline int disable_nonboot_cpus (void ) { -return freeze_secondary_cpus (0 ); +return __freeze_secondary_cpus (0 , false); } -extern void enable_nonboot_cpus (void ); + +void enable_nonboot_cpus (void );static inline int suspend_disable_secondary_cpus (void ) {
kernel/cpu.c +2 -2
@@ -1212,7 +1212,7 @@ EXPORT_SYMBOL_GPL(cpu_up);#ifdef CONFIG_PM_SLEEP_SMP static cpumask_var_t frozen_cpus; -int freeze_secondary_cpus (int primary) +int __freeze_secondary_cpus (int primary,bool suspend) {int cpu, error =0 ;
@@ -1237,7 +1237,7 @@ int freeze_secondary_cpus(int primary)if (cpu == primary)continue ; -if (pm_wakeup_pending ()) { +if (suspend &&pm_wakeup_pending ()) {pr_info ("Wakeup pending. Abort CPU freeze\n" ); error = -EBUSY ;break ;
Greg Kroah-Hartman
maintainerPATCH 127/257 genirq/debugfs: Add missing sanity checks to interrupt injection
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit a740a423c36932695b01a3e920f697bc55b05fec upstream.
Interrupts cannot be injected when the interrupt is not activated and when a replay is already in progress.
--- kernel/irq/debugfs.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
kernel/irq/debugfs.c +9 -2
@@ -206,8 +206,15 @@ static ssize_t irq_debug_write(struct fichip_bus_lock (desc);raw_spin_lock_irqsave (&desc->lock, flags); -if (irq_settings_is_level (desc) || desc->istate &IRQS_NMI ) { -/* Can't do level nor NMIs, sorry */ +/* +* Don't allow injection when the interrupt is: +* - Level or NMI type +* - not activated +* - replaying already +*/ +if (irq_settings_is_level (desc) || + !irqd_is_activated (&desc->irq_data) || + (desc->istate & (IRQS_NMI |IRQS_REPLAY ))) { err = -EINVAL ; }else { desc->istate |=IRQS_PENDING ;
Greg Kroah-Hartman
maintainerPATCH 128/257 irqchip/versatile-fpga: Apply clear-mask earlier
In reply to Greg Kroah-HartmanFrom: Sungbo Eo <[email protected]>
commit 6a214a28132f19ace3d835a6d8f6422ec80ad200 upstream.
Clear its own IRQs before the parent IRQ get enabled, so that the remaining IRQs do not accidentally interrupt the parent IRQ controller.
This patch also fixes a reboot bug on OX820 SoC, where the remaining rps-timer IRQ raises a GIC interrupt that is left pending. After that, the rps-timer IRQ is cleared during driver initialization, and there's no IRQ left in rps-irq when local_irq_enable() is called, which evokes an error message "unexpected IRQ trap".
--- drivers/irqchip/irq-versatile-fpga.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/irqchip/irq-versatile-fpga.c +3 -3
@@ -212,6 +212,9 @@ int __init fpga_irq_of_init(struct devicif (of_property_read_u32 (node,"valid-mask" , &valid_mask)) valid_mask =0 ; +writel (clear_mask, base +IRQ_ENABLE_CLEAR ); +writel (clear_mask, base +FIQ_ENABLE_CLEAR ); +/* Some chips are cascaded from a parent IRQ */ parent_irq =irq_of_parse_and_map (node,0 );if (!parent_irq) {
@@ -221,9 +224,6 @@ int __init fpga_irq_of_init(struct devicfpga_irq_init (base, node->name,0 , parent_irq, valid_mask, node); -writel (clear_mask, base +IRQ_ENABLE_CLEAR ); -writel (clear_mask, base +FIQ_ENABLE_CLEAR ); -/* * On Versatile AB/PB, some secondary interrupts have a direct * pass-thru to the primary controller for IRQs 20 and 22-31 which need
Greg Kroah-Hartman
maintainerPATCH 129/257 io_uring: remove bogus RLIMIT_NOFILE check in file registration
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit c336e992cb1cb1db9ee608dfb30342ae781057ab upstream.
We already checked this limit when the file was opened, and we keep it open in the file table. Hence when we added unit_inflight to the count we want to register, we're doubly accounting these files. This results in -EMFILE for file registration, if we're at half the limit.
--- fs/io_uring.c | 7 ------- 1 file changed, 7 deletions(-)
fs/io_uring.c +0 -7
@@ -4162,13 +4162,6 @@ static int __io_sqe_files_scm(struct io_struct sk_buff *skb;int i, nr_files; -if (!capable (CAP_SYS_RESOURCE ) && !capable (CAP_SYS_ADMIN )) { -unsigned long inflight = ctx->user->unix_inflight + nr; - -if (inflight >task_rlimit (current,RLIMIT_NOFILE )) -return -EMFILE ; - } - fpl =kzalloc (sizeof (*fpl),GFP_KERNEL );if (!fpl)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 130/257 pstore: pstore_ftrace_seq_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
commit 6c871b7314dde9ab64f20de8f5aa3d01be4518e8 upstream.
In Aug 2018 NeilBrown noticed
commit 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code and interface") "Some ->next functions do not increment *pos when they return NULL... Note that such ->next functions are buggy and should be fixed.
A simple demonstration is
dd if=/proc/swaps bs=1000 skip=1
Choose any block size larger than the size of /proc/swaps. This will always show the whole last line of /proc/swaps"
/proc/swaps output was fixed recently, however there are lot of other affected files, and one of them is related to pstore subsystem.
If .next function does not change position index, following .show function will repeat output related to current position index.
There are at least 2 related problems:
- read after lseek beyond end of file, described above by NeilBrown "dd if=<AFFECTED_FILE> bs=1000 skip=1" will generate whole last list
- read after lseek on in middle of last line will output expected rest of last line but then repeat whole last line once again.
If .show() function generates multy-line output (like pstore_ftrace_seq_show() does ?) following bash script cycles endlessly
$ q=;while read -r r;do echo "$((++q)) $r";done < AFFECTED_FILE
Unfortunately I'm not familiar enough to pstore subsystem and was unable to find affected pstore-related file on my test node.
If .next function does not change position index, following .show function will repeat output related to current position index.
--- fs/pstore/inode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/pstore/inode.c +4 -1
@@ -87,11 +87,11 @@ static void *pstore_ftrace_seq_next(strustruct pstore_private *ps = s->private;struct pstore_ftrace_seq_data *data = v; + (*pos)++; data->off +=REC_SIZE ;if (data->off +REC_SIZE > ps->total_size)return NULL ; - (*pos)++;return data; }
@@ -101,6 +101,9 @@ static int pstore_ftrace_seq_show(structstruct pstore_ftrace_seq_data *data = v;struct pstore_ftrace_record *rec; +if (!data) +return 0 ; + rec = (struct pstore_ftrace_record *)(ps->record->buf + data->off); seq_printf(s, "CPU:%d ts:%llu %08lx %08lx %ps <- %pS\n",
Greg Kroah-Hartman
maintainerPATCH 131/257 MIPS/tlbex: Fix LDDIR usage in setup_pw() for Loongson-3
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
commit d191aaffe3687d1e73e644c185f5f0550ec242b5 upstream.
LDDIR/LDPTE is Loongson-3's acceleration for Page Table Walking. If BD (Base Directory, the 4th page directory) is not enabled, then GDOffset is biased by BadVAddr[63:62]. So, if GDOffset (aka. BadVAddr[47:36] for Loongson-3) is big enough, "0b11(BadVAddr[63:62])|BadVAddr[47:36]|...." can far beyond pg_swapper_dir. This means the pg_swapper_dir may NOT be accessed by LDDIR correctly, so fix it by set PWDirExt in CP0_PWCtl.
--- arch/mips/mm/tlbex.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/mips/mm/tlbex.c +4 -1
@@ -1480,6 +1480,7 @@ static void build_r4000_tlb_refill_handlstatic void setup_pw (void ) { +unsigned int pwctl;unsigned long pgd_i, pgd_w;#ifndef __PAGETABLE_PMD_FOLDEDunsigned long pmd_i, pmd_w;
@@ -1506,6 +1507,7 @@ static void setup_pw(void) pte_i =ilog2 (_PAGE_GLOBAL); pte_w =0 ; + pwctl =1 <<30 ;/* Set PWDirExt */ #ifndef __PAGETABLE_PMD_FOLDEDwrite_c0_pwfield (pgd_i <<24 | pmd_i <<12 | pt_i <<6 | pte_i);
@@ -1516,8 +1518,9 @@ static void setup_pw(void)#endif #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT -write_c0_pwctl (1 <<6 | psn); + pwctl |= (1 <<6 | psn);#endif +write_c0_pwctl (pwctl);write_c0_kpgd ((long )swapper_pg_dir); kscratch_used_mask |= (1 <<7 );/* KScratch6 is used for KPGD */ }
Greg Kroah-Hartman
maintainerPATCH 132/257 MIPS: OCTEON: irq: Fix potential NULL pointer dereference
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
commit 792a402c2840054533ef56279c212ef6da87d811 upstream.
There is a potential NULL pointer dereference in case kzalloc() fails and returns NULL.
Fix this by adding a NULL check on *cd*
This bug was detected with the help of Coccinelle.
--- arch/mips/cavium-octeon/octeon-irq.c | 3 +++ 1 file changed, 3 insertions(+)
arch/mips/cavium-octeon/octeon-irq.c +3 -0
@@ -2199,6 +2199,9 @@ static int octeon_irq_cib_map(struct irq } cd =kzalloc (sizeof (*cd),GFP_KERNEL ); +if (!cd) +return -ENOMEM ; + cd->host_data = host_data; cd->bit = hw;
Greg Kroah-Hartman
maintainerPATCH 133/257 PM / Domains: Allow no domain-idle-states DT property in genpd when parsing
In reply to Greg Kroah-HartmanFrom: Ulf Hansson <[email protected]>
commit 56cb26891ea4180121265dc6b596015772c4a4b8 upstream.
Commit 2c361684803e ("PM / Domains: Don't treat zero found compatible idle states as an error"), moved of_genpd_parse_idle_states() towards allowing none compatible idle state to be found for the device node, rather than returning an error code.
However, it didn't consider that the "domain-idle-states" DT property may be missing as it's optional, which makes of_count_phandle_with_args() to return -ENOENT. Let's fix this to make the behaviour consistent.
--- drivers/base/power/domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/power/domain.c +1 -1
@@ -2615,7 +2615,7 @@ static int genpd_iterate_idle_states(str ret =of_count_phandle_with_args (dn,"domain-idle-states" ,NULL );if (ret <=0 ) -return ret; +return ret == -ENOENT ?0 : ret;/* Loop over the phandles until all the requested entry is found */ of_for_each_phandle (&it, ret, dn,"domain-idle-states" ,NULL ,0 ) {
Greg Kroah-Hartman
maintainerPATCH 134/257 PM: sleep: wakeup: Skip wakeup_source_sysfs_remove() if device is not there
In reply to Greg Kroah-HartmanFrom: Neeraj Upadhyay <[email protected]>
commit 87de6594dc45dbf6819f3e0ef92f9331c5a9444c upstream.
Skip wakeup_source_sysfs_remove() to fix a NULL pinter dereference via ws->dev, if the wakeup source is unregistered before registering the wakeup class from device_add().
--- drivers/base/power/wakeup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/base/power/wakeup.c +3 -1
@@ -241,7 +241,9 @@ void wakeup_source_unregister(struct wak {if (ws) {wakeup_source_remove (ws); -wakeup_source_sysfs_remove (ws); +if (ws->dev) +wakeup_source_sysfs_remove (ws); +wakeup_source_destroy (ws); } }
Greg Kroah-Hartman
maintainerPATCH 135/257 ath9k: Handle txpower changes even when TPC is disabled
In reply to Greg Kroah-HartmanFrom: Remi Pommarel <[email protected]>
commit 968ae2caad0782db5dbbabb560d3cdefd2945d38 upstream.
When TPC is disabled IEEE80211_CONF_CHANGE_POWER event can be handled to reconfigure HW's maximum txpower.
This fixes 0dBm txpower setting when user attaches to an interface for the first time with the following scenario:
ieee80211_do_open()
ath9k_add_interface()
ath9k_set_txpower() /* Set TX power with not yet initialized
sc->hw->conf.power_level */
ieee80211_hw_config() /* Iniatilize sc->hw->conf.power_level and
raise IEEE80211_CONF_CHANGE_POWER */
ath9k_config() /* IEEE80211_CONF_CHANGE_POWER is ignored */This issue can be reproduced with the following:
$ modprobe -r ath9k
$ modprobe ath9k
$ wpa_supplicant -i wlan0 -c /tmp/wpa.conf &
$ iw dev /* Here TX power is either 0 or 3 depending on RF chain */
$ killall wpa_supplicant
$ iw dev /* TX power goes back to calibrated value and subsequent
calls will be fine */--- drivers/net/wireless/ath/ath9k/main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath9k/main.c +3 -0
@@ -1457,6 +1457,9 @@ static int ath9k_config(struct ieee80211ath_chanctx_set_channel (sc, ctx, &hw->conf.chandef); } +if (changed &IEEE80211_CONF_CHANGE_POWER ) +ath9k_set_txpower (sc,NULL ); +mutex_unlock (&sc->mutex);ath9k_ps_restore (sc);
Greg Kroah-Hartman
maintainerPATCH 136/257 signal: Extend exec_id to 64bits
In reply to Greg Kroah-HartmanFrom: Eric W. Biederman <[email protected]>
commit d1e7fd6462ca9fc76650fbe6ca800e35b24267da upstream.
Replace the 32bit exec_id with a 64bit exec_id to make it impossible to wrap the exec_id counter. With care an attacker can cause exec_id wrap and send arbitrary signals to a newly exec'd parent. This bypasses the signal sending checks if the parent changes their credentials during exec.
The severity of this problem can been seen that in my limited testing of a 32bit exec_id it can take as little as 19s to exec 65536 times. Which means that it can take as little as 14 days to wrap a 32bit exec_id. Adam Zabrocki has succeeded wrapping the self_exe_id in 7 days. Even my slower timing is in the uptime of a typical server. Which means self_exec_id is simply a speed bump today, and if exec gets noticably faster self_exec_id won't even be a speed bump.
Extending self_exec_id to 64bits introduces a problem on 32bit architectures where reading self_exec_id is no longer atomic and can take two read instructions. Which means that is is possible to hit a window where the read value of exec_id does not match the written value. So with very lucky timing after this change this still remains expoiltable.
I have updated the update of exec_id on exec to use WRITE_ONCE and the read of exec_id in do_notify_parent to use READ_ONCE to make it clear that there is no locking between these two locations.
--- fs/exec.c | 2 +- include/linux/sched.h | 4 ++-- kernel/signal.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)
fs/exec.c +1 -1
@@ -1382,7 +1382,7 @@ void setup_new_exec(struct linux_binprm/* An exec changes our domain. We are no longer part of the thread group */ - current->self_exec_id++; +WRITE_ONCE (current->self_exec_id, current->self_exec_id +1 );flush_signal_handlers (current,0 ); }EXPORT_SYMBOL (setup_new_exec);
include/linux/sched.h +2 -2
@@ -939,8 +939,8 @@ struct task_struct {struct seccomp seccomp;/* Thread group tracking: */ -u32 parent_exec_id; -u32 self_exec_id; +u64 parent_exec_id; +u64 self_exec_id;/* Protection against (de-)allocation: mm, files, fs, tty, keyrings, mems_allowed, mempolicy: */ spinlock_t alloc_lock;
kernel/signal.c +1 -1
@@ -1931,7 +1931,7 @@ bool do_notify_parent(struct task_struct* This is only possible if parent == real_parent. * Check if it has changed security domain. */ -if (tsk->parent_exec_id != tsk->parent->self_exec_id) +if (tsk->parent_exec_id !=READ_ONCE (tsk->parent->self_exec_id)) sig =SIGCHLD ; }
Greg Kroah-Hartman
maintainerPATCH 137/257 x86/tsc_msr: Use named struct initializers
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 812c2d7506fde7cdf83cb2532810a65782b51741 upstream.
Use named struct initializers for the freq_desc struct-s initialization and change the "u8 msr_plat" to a "bool use_msr_plat" to make its meaning more clear instead of relying on a comment to explain it.
--- arch/x86/kernel/tsc_msr.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-)
arch/x86/kernel/tsc_msr.c +18 -10
@@ -22,10 +22,10 @@* read in MSR_PLATFORM_ID[12:8], otherwise in MSR_PERF_STAT[44:40]. * Unfortunately some Intel Atom SoCs aren't quite compliant to this, * so we need manually differentiate SoC families. This is what the -* field msr_plat does. +* field use_msr_plat does. */ struct freq_desc { -u8 msr_plat;/* 1: use MSR_PLATFORM_INFO, 0: MSR_IA32_PERF_STATUS */ +bool use_msr_plat;u32 freqs[MAX_NUM_FREQS ]; };
@@ -35,31 +35,39 @@ struct freq_desc {* by MSR based on SDM. */ static const struct freq_desc freq_desc_pnw = { -0 , {0 ,0 ,0 ,0 ,0 ,99840 ,0 ,83200 } + .use_msr_plat = false, + .freqs = {0 ,0 ,0 ,0 ,0 ,99840 ,0 ,83200 }, };static const struct freq_desc freq_desc_clv = { -0 , {0 ,133200 ,0 ,0 ,0 ,99840 ,0 ,83200 } + .use_msr_plat = false, + .freqs = {0 ,133200 ,0 ,0 ,0 ,99840 ,0 ,83200 }, };static const struct freq_desc freq_desc_byt = { -1 , {83300 ,100000 ,133300 ,116700 ,80000 ,0 ,0 ,0 } + .use_msr_plat = true, + .freqs = {83300 ,100000 ,133300 ,116700 ,80000 ,0 ,0 ,0 }, };static const struct freq_desc freq_desc_cht = { -1 , {83300 ,100000 ,133300 ,116700 ,80000 ,93300 ,90000 ,88900 ,87500 } + .use_msr_plat = true, + .freqs = {83300 ,100000 ,133300 ,116700 ,80000 ,93300 ,90000 , +88900 ,87500 }, };static const struct freq_desc freq_desc_tng = { -1 , {0 ,100000 ,133300 ,0 ,0 ,0 ,0 ,0 } + .use_msr_plat = true, + .freqs = {0 ,100000 ,133300 ,0 ,0 ,0 ,0 ,0 }, };static const struct freq_desc freq_desc_ann = { -1 , {83300 ,100000 ,133300 ,100000 ,0 ,0 ,0 ,0 } + .use_msr_plat = true, + .freqs = {83300 ,100000 ,133300 ,100000 ,0 ,0 ,0 ,0 }, };static const struct freq_desc freq_desc_lgm = { -1 , {78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 } + .use_msr_plat = true, + .freqs = {78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 }, };static const struct x86_cpu_id tsc_msr_cpu_ids[] = {
@@ -91,7 +99,7 @@ unsigned long cpu_khz_from_msr(void)return 0 ; freq_desc = (struct freq_desc *)id->driver_data; -if (freq_desc->msr_plat) { +if (freq_desc->use_msr_plat) {rdmsr (MSR_PLATFORM_INFO , lo, hi); ratio = (lo >>8 ) &0xff ; }else {
Greg Kroah-Hartman
maintainerPATCH 138/257 x86/tsc_msr: Fix MSR_FSB_FREQ mask for Cherry Trail devices
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit c8810e2ffc30c7e1577f9c057c4b85d984bbc35a upstream.
According to the "Intel 64 and IA-32 Architectures Software Developer's Manual Volume 4: Model-Specific Registers" on Cherry Trail (Airmont) devices the 4 lowest bits of the MSR_FSB_FREQ mask indicate the bus freq unlike on e.g. Bay Trail where only the lowest 3 bits are used.
This is also the reason why MAX_NUM_FREQS is defined as 9, since Cherry Trail SoCs have 9 possible frequencies, so the lo value from the MSR needs to be masked with 0x0f, not with 0x07 otherwise the 9th frequency will get interpreted as the 1st.
Bump MAX_NUM_FREQS to 16 to avoid any possibility of addressing the array out of bounds and makes the mask part of the cpufreq struct so it can be set it per model.
While at it also log an error when the index points to an uninitialized part of the freqs lookup-table.
--- arch/x86/kernel/tsc_msr.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
arch/x86/kernel/tsc_msr.c +15 -2
@@ -15,7 +15,7 @@#include <asm/param.h> #include <asm/tsc.h> -#define MAX_NUM_FREQS 9 +#define MAX_NUM_FREQS 16/* 4 bits to select the frequency */ /* * If MSR_PERF_STAT[31] is set, the maximum resolved bus ratio can be
@@ -27,6 +27,7 @@struct freq_desc {bool use_msr_plat;u32 freqs[MAX_NUM_FREQS ]; +u32 mask; };/*
@@ -37,37 +38,44 @@ struct freq_desc {static const struct freq_desc freq_desc_pnw = { .use_msr_plat = false, .freqs = {0 ,0 ,0 ,0 ,0 ,99840 ,0 ,83200 }, + .mask =0x07 , };static const struct freq_desc freq_desc_clv = { .use_msr_plat = false, .freqs = {0 ,133200 ,0 ,0 ,0 ,99840 ,0 ,83200 }, + .mask =0x07 , };static const struct freq_desc freq_desc_byt = { .use_msr_plat = true, .freqs = {83300 ,100000 ,133300 ,116700 ,80000 ,0 ,0 ,0 }, + .mask =0x07 , };static const struct freq_desc freq_desc_cht = { .use_msr_plat = true, .freqs = {83300 ,100000 ,133300 ,116700 ,80000 ,93300 ,90000 ,88900 ,87500 }, + .mask =0x0f , };static const struct freq_desc freq_desc_tng = { .use_msr_plat = true, .freqs = {0 ,100000 ,133300 ,0 ,0 ,0 ,0 ,0 }, + .mask =0x07 , };static const struct freq_desc freq_desc_ann = { .use_msr_plat = true, .freqs = {83300 ,100000 ,133300 ,100000 ,0 ,0 ,0 ,0 }, + .mask =0x0f , };static const struct freq_desc freq_desc_lgm = { .use_msr_plat = true, .freqs = {78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 }, + .mask =0x0f , };static const struct x86_cpu_id tsc_msr_cpu_ids[] = {
@@ -93,6 +101,7 @@ unsigned long cpu_khz_from_msr(void)const struct freq_desc *freq_desc;const struct x86_cpu_id *id;unsigned long res; +int index; id =x86_match_cpu (tsc_msr_cpu_ids);if (!id)
@@ -109,13 +118,17 @@ unsigned long cpu_khz_from_msr(void)/* Get FSB FREQ ID */ rdmsr (MSR_FSB_FREQ , lo, hi); + index = lo & freq_desc->mask;/* Map CPU reference clock freq ID(0-7) to CPU reference clock freq(KHz) */ - freq = freq_desc->freqs[lo &0x7 ]; + freq = freq_desc->freqs[index];/* TSC frequency = maximum resolved freq * maximum resolved bus ratio */ res = freq * ratio; +if (freq ==0 ) +pr_err ("Error MSR_FSB_FREQ index %d is unknown\n" , index); +#ifdef CONFIG_X86_LOCAL_APIC lapic_timer_period = (freq *1000 ) /HZ ;#endif
Greg Kroah-Hartman
maintainerPATCH 139/257 x86/tsc_msr: Make MSR derived TSC frequency more accurate
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit fac01d11722c92a186b27ee26cd429a8066adfb5 upstream.
The "Intel 64 and IA-32 Architectures Software Developer’s Manual Volume 4:
Model-Specific Registers" has the following table for the values from freq_desc_byt:
000B: 083.3 MHz
001B: 100.0 MHz
010B: 133.3 MHz
011B: 116.7 MHz
100B: 080.0 MHz
Notice how for e.g the 83.3 MHz value there are 3 significant digits, which translates to an accuracy of a 1000 ppm, where as a typical crystal oscillator is 20 - 100 ppm, so the accuracy of the frequency format used in the Software Developer’s Manual is not really helpful.
As far as we know Bay Trail SoCs use a 25 MHz crystal and Cherry Trail uses a 19.2 MHz crystal, the crystal is the source clock for a root PLL which outputs 1600 and 100 MHz. It is unclear if the root PLL outputs are used directly by the CPU clock PLL or if there is another PLL in between.
This does not matter though, we can model the chain of PLLs as a single PLL with a quotient equal to the quotients of all PLLs in the chain multiplied.
So we can create a simplified model of the CPU clock setup using a reference clock of 100 MHz plus a quotient which gets us as close to the frequency from the SDM as possible.
For the 83.3 MHz example from above this would give 100 MHz * 5 / 6 = 83 and 1/3 MHz, which matches exactly what has been measured on actual hardware.
Use a simplified PLL model with a reference clock of 100 MHz for all Bay and Cherry Trail models.
This has been tested on the following models:
CPU freq before: CPU freq after: Intel N2840 2165.800 MHz 2166.667 MHz Intel Z3736 1332.800 MHz 1333.333 MHz Intel Z3775 1466.300 MHz 1466.667 MHz Intel Z8350 1440.000 MHz 1440.000 MHz Intel Z8750 1600.000 MHz 1600.000 MHz
This fixes the time drifting by about 1 second per hour (20 - 30 seconds per day) on (some) devices which rely on the tsc_msr.c code to determine the TSC frequency.
--- arch/x86/kernel/tsc_msr.c | 97 ++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 86 insertions(+), 11 deletions(-)
arch/x86/kernel/tsc_msr.c +86 -11
@@ -18,6 +18,28 @@#define MAX_NUM_FREQS 16/* 4 bits to select the frequency */ /* +* The frequency numbers in the SDM are e.g. 83.3 MHz, which does not contain a +* lot of accuracy which leads to clock drift. As far as we know Bay Trail SoCs +* use a 25 MHz crystal and Cherry Trail uses a 19.2 MHz crystal, the crystal +* is the source clk for a root PLL which outputs 1600 and 100 MHz. It is +* unclear if the root PLL outputs are used directly by the CPU clock PLL or +* if there is another PLL in between. +* This does not matter though, we can model the chain of PLLs as a single PLL +* with a quotient equal to the quotients of all PLLs in the chain multiplied. +* So we can create a simplified model of the CPU clock setup using a reference +* clock of 100 MHz plus a quotient which gets us as close to the frequency +* from the SDM as possible. +* For the 83.3 MHz example from above this would give us 100 MHz * 5 / 6 = +* 83 and 1/3 MHz, which matches exactly what has been measured on actual hw. +*/ +#define TSC_REFERENCE_KHZ 100000 + +struct muldiv { +u32 multiplier; +u32 divider; +}; + +/* * If MSR_PERF_STAT[31] is set, the maximum resolved bus ratio can be * read in MSR_PLATFORM_ID[12:8], otherwise in MSR_PERF_STAT[44:40]. * Unfortunately some Intel Atom SoCs aren't quite compliant to this,
@@ -26,6 +48,11 @@*/ struct freq_desc {bool use_msr_plat; +struct muldiv muldiv[MAX_NUM_FREQS ]; +/* +* Some CPU frequencies in the SDM do not map to known PLL freqs, in +* that case the muldiv array is empty and the freqs array is used. +*/ u32 freqs[MAX_NUM_FREQS ];u32 mask; };
@@ -47,31 +74,66 @@ static const struct freq_desc freq_desc_ .mask = 0x07, }; +/* +* Bay Trail SDM MSR_FSB_FREQ frequencies simplified PLL model: +* 000: 100 * 5 / 6 = 83.3333 MHz +* 001: 100 * 1 / 1 = 100.0000 MHz +* 010: 100 * 4 / 3 = 133.3333 MHz +* 011: 100 * 7 / 6 = 116.6667 MHz +* 100: 100 * 4 / 5 = 80.0000 MHz +*/ static const struct freq_desc freq_desc_byt = { .use_msr_plat = true, - .freqs = {83300 ,100000 ,133300 ,116700 ,80000 ,0 ,0 ,0 }, + .muldiv = { {5 ,6 }, {1 ,1 }, {4 ,3 }, {7 ,6 }, + {4 ,5 } }, .mask =0x07 , }; +/* +* Cherry Trail SDM MSR_FSB_FREQ frequencies simplified PLL model: +* 0000: 100 * 5 / 6 = 83.3333 MHz +* 0001: 100 * 1 / 1 = 100.0000 MHz +* 0010: 100 * 4 / 3 = 133.3333 MHz +* 0011: 100 * 7 / 6 = 116.6667 MHz +* 0100: 100 * 4 / 5 = 80.0000 MHz +* 0101: 100 * 14 / 15 = 93.3333 MHz +* 0110: 100 * 9 / 10 = 90.0000 MHz +* 0111: 100 * 8 / 9 = 88.8889 MHz +* 1000: 100 * 7 / 8 = 87.5000 MHz +*/ static const struct freq_desc freq_desc_cht = { .use_msr_plat = true, - .freqs = {83300 ,100000 ,133300 ,116700 ,80000 ,93300 ,90000 , -88900 ,87500 }, + .muldiv = { {5 ,6 }, {1 ,1 }, {4 ,3 }, {7 ,6 }, + {4 ,5 }, {14 ,15 }, {9 ,10 }, {8 ,9 }, + {7 ,8 } }, .mask =0x0f , }; +/* +* Merriefield SDM MSR_FSB_FREQ frequencies simplified PLL model: +* 0001: 100 * 1 / 1 = 100.0000 MHz +* 0010: 100 * 4 / 3 = 133.3333 MHz +*/ static const struct freq_desc freq_desc_tng = { .use_msr_plat = true, - .freqs = {0 ,100000 ,133300 ,0 ,0 ,0 ,0 ,0 }, + .muldiv = { {0 ,0 }, {1 ,1 }, {4 ,3 } }, .mask =0x07 , }; +/* +* Moorefield SDM MSR_FSB_FREQ frequencies simplified PLL model: +* 0000: 100 * 5 / 6 = 83.3333 MHz +* 0001: 100 * 1 / 1 = 100.0000 MHz +* 0010: 100 * 4 / 3 = 133.3333 MHz +* 0011: 100 * 1 / 1 = 100.0000 MHz +*/ static const struct freq_desc freq_desc_ann = { .use_msr_plat = true, - .freqs = {83300 ,100000 ,133300 ,100000 ,0 ,0 ,0 ,0 }, + .muldiv = { {5 ,6 }, {1 ,1 }, {4 ,3 }, {1 ,1 } }, .mask =0x0f , }; +/* 24 MHz crystal? : 24 * 13 / 4 = 78 MHz */ static const struct freq_desc freq_desc_lgm = { .use_msr_plat = true, .freqs = {78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 },
@@ -97,9 +159,10 @@ static const struct x86_cpu_id tsc_msr_c*/ unsigned long cpu_khz_from_msr (void ) { -u32 lo, hi, ratio, freq; +u32 lo, hi, ratio, freq, tscref;const struct freq_desc *freq_desc;const struct x86_cpu_id *id; +const struct muldiv *md;unsigned long res;int index;
@@ -119,12 +182,24 @@ unsigned long cpu_khz_from_msr(void)/* Get FSB FREQ ID */ rdmsr (MSR_FSB_FREQ , lo, hi); index = lo & freq_desc->mask; + md = &freq_desc->muldiv[index]; -/* Map CPU reference clock freq ID(0-7) to CPU reference clock freq(KHz) */ - freq = freq_desc->freqs[index]; - -/* TSC frequency = maximum resolved freq * maximum resolved bus ratio */ - res = freq * ratio; +/* +* Note this also catches cases where the index points to an unpopulated +* part of muldiv, in that case the else will set freq and res to 0. +*/ +if (md->divider) { + tscref =TSC_REFERENCE_KHZ * md->multiplier; + freq =DIV_ROUND_CLOSEST (tscref, md->divider); +/* +* Multiplying by ratio before the division has better +* accuracy than just calculating freq * ratio. +*/ + res =DIV_ROUND_CLOSEST (tscref * ratio, md->divider); + }else { + freq = freq_desc->freqs[index]; + res = freq * ratio; + }if (freq ==0 )pr_err ("Error MSR_FSB_FREQ index %d is unknown\n" , index);
Greg Kroah-Hartman
maintainerPATCH 140/257 x86/entry/32: Add missing ASM_CLAC to general_protection entry
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 3d51507f29f2153a658df4a0674ec5b592b62085 upstream.
All exception entry points must have ASM_CLAC right at the beginning. The general_protection entry is missing one.
--- arch/x86/entry/entry_32.S | 1 + 1 file changed, 1 insertion(+)
arch/x86/entry/entry_32.S +1 -0
@@ -1694,6 +1694,7 @@ SYM_CODE_START(int3) SYM_CODE_END(int3) SYM_CODE_START(general_protection) + ASM_CLAC pushl $do_general_protection jmp common_exception SYM_CODE_END(general_protection)
Greg Kroah-Hartman
maintainerPATCH 141/257 platform/x86: asus-wmi: Support laptops where the first battery is named BATT
In reply to Greg Kroah-HartmanFrom: Kristian Klausen <[email protected]>
commit 6b3586d45bba14f6912f37488090c37a3710e7b4 upstream.
The WMI method to set the charge threshold does not provide a way to specific a battery, so we assume it is the first/primary battery (by checking if the name is BAT0).
On some newer ASUS laptops (Zenbook UM431DA) though, the primary/first battery isn't named BAT0 but BATT, so we need to support that case.
--- drivers/platform/x86/asus-wmi.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/platform/x86/asus-wmi.c +4 -1
@@ -418,8 +418,11 @@ static int asus_wmi_battery_add(struct p {/* The WMI method does not provide a way to specific a battery, so we * just assume it is the first battery. +* Note: On some newer ASUS laptops (Zenbook UM431DA), the primary/first +* battery is named BATT. */ -if (strcmp (battery->desc->name,"BAT0" ) !=0 ) +if (strcmp (battery->desc->name,"BAT0" ) !=0 && +strcmp (battery->desc->name,"BATT" ) !=0 )return -ENODEV ; if (device_create_file(&battery->dev,
Greg Kroah-Hartman
maintainerPATCH 142/257 KVM: PPC: Book3S HV: Skip kvmppc_uvmem_free if Ultravisor is not supported
In reply to Greg Kroah-HartmanFrom: Fabiano Rosas <[email protected]>
commit 9bee484b280a059c1faa10ae174af4f4af02c805 upstream.
kvmppc_uvmem_init checks for Ultravisor support and returns early if it is not present. Calling kvmppc_uvmem_free at module exit will cause an Oops:
$ modprobe -r kvm-hv
Oops: Kernel access of bad area, sig: 11 [#1] <snip> NIP: c000000000789e90 LR: c000000000789e8c CTR: c000000000401030 REGS: c000003fa7bab9a0 TRAP: 0300 Not tainted (5.6.0-rc6-00033-g6c90b86a745a-dirty) MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 24002282 XER: 00000000 CFAR: c000000000dae880 DAR: 0000000000000008 DSISR: 40000000 IRQMASK: 1 GPR00: c000000000789e8c c000003fa7babc30 c0000000016fe500 0000000000000000 GPR04: 0000000000000000 0000000000000006 0000000000000000 c000003faf205c00 GPR08: 0000000000000000 0000000000000001 000000008000002d c00800000ddde140 GPR12: c000000000401030 c000003ffffd9080 0000000000000001 0000000000000000 GPR16: 0000000000000000 0000000000000000 000000013aad0074 000000013aaac978 GPR20: 000000013aad0070 0000000000000000 00007fffd1b37158 0000000000000000 GPR24: 000000014fef0d58 0000000000000000 000000014fef0cf0 0000000000000001 GPR28: 0000000000000000 0000000000000000 c0000000018b2a60 0000000000000000 NIP [c000000000789e90] percpu_ref_kill_and_confirm+0x40/0x170 LR [c000000000789e8c] percpu_ref_kill_and_confirm+0x3c/0x170 Call Trace: [c000003fa7babc30] [c000003faf2064d4] 0xc000003faf2064d4 (unreliable) [c000003fa7babcb0] [c000000000400e8c] dev_pagemap_kill+0x6c/0x80 [c000003fa7babcd0] [c000000000401064] memunmap_pages+0x34/0x2f0 [c000003fa7babd50] [c00800000dddd548] kvmppc_uvmem_free+0x30/0x80 [kvm_hv] [c000003fa7babd80] [c00800000ddcef18] kvmppc_book3s_exit_hv+0x20/0x78 [kvm_hv] [c000003fa7babda0] [c0000000002084d0] sys_delete_module+0x1d0/0x2c0 [c000003fa7babe20] [c00000000000b9d0] system_call+0x5c/0x68 Instruction dump: 3fc2001b fb81ffe0 fba1ffe8 fbe1fff8 7c7f1b78 7c9c2378 3bde4560 7fc3f378 f8010010 f821ff81 486249a1 60000000 <e93f0008> 7c7d1b78 712a0002 40820084 ---[ end trace 5774ef4dc2c98279 ]---
So this patch checks if kvmppc_uvmem_init actually allocated anything before running kvmppc_uvmem_free.
--- arch/powerpc/kvm/book3s_hv_uvmem.c | 3 +++ 1 file changed, 3 insertions(+)
arch/powerpc/kvm/book3s_hv_uvmem.c +3 -0
@@ -778,6 +778,9 @@ out:void kvmppc_uvmem_free (void ) { +if (!kvmppc_uvmem_bitmap) +return ; +memunmap_pages (&kvmppc_uvmem_pgmap);release_mem_region (kvmppc_uvmem_pgmap.res.start,resource_size (&kvmppc_uvmem_pgmap.res));
Greg Kroah-Hartman
maintainerPATCH 143/257 KVM: nVMX: Properly handle userspace interrupt window request
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit a1c77abb8d93381e25a8d2df3a917388244ba776 upstream.
Return true for vmx_interrupt_allowed() if the vCPU is in L2 and L1 has external interrupt exiting enabled. IRQs are never blocked in hardware if the CPU is in the guest (L2 from L1's perspective) when IRQs trigger VM-Exit.
The new check percolates up to kvm_vcpu_ready_for_interrupt_injection() and thus vcpu_run(), and so KVM will exit to userspace if userspace has requested an interrupt window (to inject an IRQ into L1).
Remove the @external_intr param from vmx_check_nested_events(), which is actually an indicator that userspace wants an interrupt window, e.g. it's named @req_int_win further up the stack. Injecting a VM-Exit into L1 to try and bounce out to L0 userspace is all kinds of broken and is no longer necessary.
Remove the hack in nested_vmx_vmexit() that attempted to workaround the breakage in vmx_check_nested_events() by only filling interrupt info if there's an actual interrupt pending. The hack actually made things worse because it caused KVM to _never_ fill interrupt info when the LAPIC resides in userspace (kvm_cpu_has_interrupt() queries interrupt.injected, which is always cleared by prepare_vmcs12() before reaching the hack in nested_vmx_vmexit()).
--- arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/kvm/vmx/nested.c | 18 ++++-------------- arch/x86/kvm/vmx/vmx.c | 9 +++++++-- arch/x86/kvm/x86.c | 10 +++++----- 4 files changed, 17 insertions(+), 22 deletions(-)
arch/x86/include/asm/kvm_host.h +1 -1
@@ -1147,7 +1147,7 @@ struct kvm_x86_ops {bool (*pt_supported)(void );bool (*pku_supported)(void ); -int (*check_nested_events)(struct kvm_vcpu *vcpu,bool external_intr); +int (*check_nested_events)(struct kvm_vcpu *vcpu);void (*request_immediate_exit)(struct kvm_vcpu *vcpu);void (*sched_in)(struct kvm_vcpu *kvm,int cpu);
arch/x86/kvm/vmx/nested.c +4 -14
@@ -3611,7 +3611,7 @@ static void nested_vmx_update_pending_db vcpu->arch.exception.payload); } -static int vmx_check_nested_events (struct kvm_vcpu *vcpu,bool external_intr) +static int vmx_check_nested_events (struct kvm_vcpu *vcpu) {struct vcpu_vmx *vmx =to_vmx (vcpu);unsigned long exit_qual;
@@ -3660,8 +3660,7 @@ static int vmx_check_nested_events(strucreturn 0 ; } -if ((kvm_cpu_has_interrupt (vcpu) || external_intr) && -nested_exit_on_intr (vcpu)) { +if (kvm_cpu_has_interrupt (vcpu) &&nested_exit_on_intr (vcpu)) {if (block_nested_events)return -EBUSY ;nested_vmx_vmexit (vcpu,EXIT_REASON_EXTERNAL_INTERRUPT ,0 ,0 );
@@ -4309,17 +4308,8 @@ void nested_vmx_vmexit(struct kvm_vcpu * vcpu->arch.mp_state =KVM_MP_STATE_RUNNABLE ;if (likely (!vmx->fail)) { -/* -* TODO: SDM says that with acknowledge interrupt on -* exit, bit 31 of the VM-exit interrupt information -* (valid interrupt) is always set to 1 on -* EXIT_REASON_EXTERNAL_INTERRUPT, so we shouldn't -* need kvm_cpu_has_interrupt(). See the commit -* message for details. -*/ -if (nested_exit_intr_ack_set (vcpu) && - exit_reason ==EXIT_REASON_EXTERNAL_INTERRUPT && -kvm_cpu_has_interrupt (vcpu)) { +if (exit_reason ==EXIT_REASON_EXTERNAL_INTERRUPT && +nested_exit_intr_ack_set (vcpu)) {int irq =kvm_cpu_get_interrupt (vcpu);WARN_ON (irq <0 ); vmcs12->vm_exit_intr_info = irq |
arch/x86/kvm/vmx/vmx.c +7 -2
@@ -4485,8 +4485,13 @@ static int vmx_nmi_allowed(struct kvm_vcstatic int vmx_interrupt_allowed (struct kvm_vcpu *vcpu) { -return (!to_vmx (vcpu)->nested.nested_run_pending && -vmcs_readl (GUEST_RFLAGS ) &X86_EFLAGS_IF ) && +if (to_vmx (vcpu)->nested.nested_run_pending) +return false; + +if (is_guest_mode (vcpu) &&nested_exit_on_intr (vcpu)) +return true; + +return (vmcs_readl (GUEST_RFLAGS ) &X86_EFLAGS_IF ) && !(vmcs_read32 (GUEST_INTERRUPTIBILITY_INFO ) & (GUEST_INTR_STATE_STI |GUEST_INTR_STATE_MOV_SS )); }
arch/x86/kvm/x86.c +5 -5
@@ -7572,7 +7572,7 @@ static void update_cr8_intercept(struct kvm_x86_ops->update_cr8_intercept (vcpu, tpr, max_irr); } -static int inject_pending_event (struct kvm_vcpu *vcpu,bool req_int_win) +static int inject_pending_event (struct kvm_vcpu *vcpu) {int r;
@@ -7608,7 +7608,7 @@ static int inject_pending_event(struct k* from L2 to L1. */ if (is_guest_mode (vcpu) && kvm_x86_ops->check_nested_events) { - r = kvm_x86_ops->check_nested_events (vcpu, req_int_win); + r = kvm_x86_ops->check_nested_events (vcpu);if (r !=0 )return r; }
@@ -7670,7 +7670,7 @@ static int inject_pending_event(struct k* KVM_REQ_EVENT only on certain events and not unconditionally? */ if (is_guest_mode (vcpu) && kvm_x86_ops->check_nested_events) { - r = kvm_x86_ops->check_nested_events (vcpu, req_int_win); + r = kvm_x86_ops->check_nested_events (vcpu);if (r !=0 )return r; }
@@ -8159,7 +8159,7 @@ static int vcpu_enter_guest(struct kvm_v goto out; } -if (inject_pending_event (vcpu, req_int_win) !=0 ) +if (inject_pending_event (vcpu) !=0 ) req_immediate_exit = true;else {/* Enable SMI/NMI/IRQ window open exits if needed.
@@ -8389,7 +8389,7 @@ static inline int vcpu_block(struct kvmstatic inline bool kvm_vcpu_running (struct kvm_vcpu *vcpu) {if (is_guest_mode (vcpu) && kvm_x86_ops->check_nested_events) - kvm_x86_ops->check_nested_events (vcpu, false); + kvm_x86_ops->check_nested_events (vcpu);return (vcpu->arch.mp_state ==KVM_MP_STATE_RUNNABLE && !vcpu->arch.apf.halted);
Greg Kroah-Hartman
maintainerPATCH 144/257 KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit a1d032a49522cb5368e5dfb945a85899b4c74f65 upstream.
In case we have a region 1 the following calculation
(31 + ((gmap->asce & _ASCE_TYPE_MASK) >> 2)*11)
results in 64. As shifts beyond the size are undefined the compiler is free to use instructions like sllg. sllg will only use 6 bits of the shift value (here 64) resulting in no shift at all. That means that ALL addresses will be rejected.
The can result in endless loops, e.g. when prefix cannot get mapped.
--- arch/s390/mm/gmap.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/s390/mm/gmap.c +5 -1
@@ -787,14 +787,18 @@ static void gmap_call_notifier(struct gmstatic inline unsigned long *gmap_table_walk (struct gmap *gmap,unsigned long gaddr,int level) { +const int asce_type = gmap->asce & _ASCE_TYPE_MASK;unsigned long *table;if ((gmap->asce & _ASCE_TYPE_MASK) +4 < (level *4 ))return NULL ;if (gmap_is_shadow (gmap) && gmap->removed)return NULL ; -if (gaddr & (-1UL << (31 + ((gmap->asce & _ASCE_TYPE_MASK) >>2 )*11 ))) + +if (asce_type != _ASCE_TYPE_REGION1 && + gaddr & (-1UL << (31 + (asce_type >>2 ) *11 )))return NULL ; + table = gmap->table;switch (gmap->asce & _ASCE_TYPE_MASK) {case _ASCE_TYPE_REGION1:
Greg Kroah-Hartman
maintainerPATCH 145/257 KVM: s390: vsie: Fix delivery of addressing exceptions
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit 4d4cee96fb7a3cc53702a9be8299bf525be4ee98 upstream.
Whenever we get an -EFAULT, we failed to read in guest 2 physical address space. Such addressing exceptions are reported via a program intercept to the nested hypervisor.
We faked the intercept, we have to return to guest 2. Instead, right now we would be returning -EFAULT from the intercept handler, eventually crashing the VM.
the correct thing to do is to return 1 as rc == 1 is the internal representation of "we have to go back into g2".
Addressing exceptions can only happen if the g2->g3 page tables reference invalid g2 addresses (say, either a table or the final page is not accessible - so something that basically never happens in sane environments.
Identified by manual code inspection.
--- arch/s390/kvm/vsie.c | 1 + 1 file changed, 1 insertion(+)
arch/s390/kvm/vsie.c +1 -0
@@ -1202,6 +1202,7 @@ static int vsie_run(struct kvm_vcpu *vcp scb_s->iprcc =PGM_ADDRESSING ; scb_s->pgmilc =4 ; scb_s->gpsw.addr =__rewind_psw (scb_s->gpsw,4 ); + rc =1 ; }return rc; }
Greg Kroah-Hartman
maintainerPATCH 146/257 KVM: x86: Allocate new rmap and large page tracking when moving memslot
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit edd4fa37baa6ee8e44dc65523b27bd6fe44c94de upstream.
Reallocate a rmap array and recalcuate large page compatibility when moving an existing memslot to correctly handle the alignment properties of the new memslot. The number of rmap entries required at each level is dependent on the alignment of the memslot's base gfn with respect to that level, e.g. moving a large-page aligned memslot so that it becomes unaligned will increase the number of rmap entries needed at the now unaligned level.
Not updating the rmap array is the most obvious bug, as KVM accesses garbage data beyond the end of the rmap. KVM interprets the bad data as pointers, leading to non-canonical #GPs, unexpected #PFs, etc...
general protection fault: 0000 [#1] SMP CPU: 0 PID: 1909 Comm: move_memory_reg Not tainted 5.4.0-rc7+ #139 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:rmap_get_first+0x37/0x50 [kvm] Code: <48> 8b 3b 48 85 ff 74 ec e8 6c f4 ff ff 85 c0 74 e3 48 89 d8 5b c3 RSP: 0018:ffffc9000021bbc8 EFLAGS: 00010246 RAX: ffff00617461642e RBX: ffff00617461642e RCX: 0000000000000012 RDX: ffff88827400f568 RSI: ffffc9000021bbe0 RDI: ffff88827400f570 RBP: 0010000000000000 R08: ffffc9000021bd00 R09: ffffc9000021bda8 R10: ffffc9000021bc48 R11: 0000000000000000 R12: 0030000000000000 R13: 0000000000000000 R14: ffff88827427d700 R15: ffffc9000021bce8 FS: 00007f7eda014700(0000) GS:ffff888277a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7ed9216ff8 CR3: 0000000274391003 CR4: 0000000000162eb0 Call Trace: kvm_mmu_slot_set_dirty+0xa1/0x150 [kvm] __kvm_set_memory_region.part.64+0x559/0x960 [kvm] kvm_set_memory_region+0x45/0x60 [kvm] kvm_vm_ioctl+0x30f/0x920 [kvm] do_vfs_ioctl+0xa1/0x620 ksys_ioctl+0x66/0x70 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x4c/0x170 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f7ed9911f47 Code: <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 21 6f 2c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffc00937498 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000001ab0010 RCX: 00007f7ed9911f47 RDX: 0000000001ab1350 RSI: 000000004020ae46 RDI: 0000000000000004 RBP: 000000000000000a R08: 0000000000000000 R09: 00007f7ed9214700 R10: 00007f7ed92149d0 R11: 0000000000000246 R12: 00000000bffff000 R13: 0000000000000003 R14: 00007f7ed9215000 R15: 0000000000000000 Modules linked in: kvm_intel kvm irqbypass ---[ end trace 0c5f570b3358ca89 ]---
The disallow_lpage tracking is more subtle. Failure to update results in KVM creating large pages when it shouldn't, either due to stale data or again due to indexing beyond the end of the metadata arrays, which can lead to memory corruption and/or leaking data to guest/userspace.
Note, the arrays for the old memslot are freed by the unconditional call to kvm_free_memslot() in __kvm_set_memory_region().
--- arch/x86/kvm/x86.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/x86/kvm/x86.c +11 -0
@@ -9768,6 +9768,13 @@ int kvm_arch_create_memslot(struct kvm * {int i; +/* +* Clear out the previous array pointers for the KVM_MR_MOVE case. The +* old arrays will be freed by __kvm_set_memory_region() if installing +* the new memslot is successful. +*/ +memset (&slot->arch,0 ,sizeof (slot->arch)); +for (i =0 ; i <KVM_NR_PAGE_SIZES ; ++i) {struct kvm_lpage_info *linfo;unsigned long ugfn;
@@ -9849,6 +9856,10 @@ int kvm_arch_prepare_memory_region(struc const struct kvm_userspace_memory_region *mem, enum kvm_mr_change change) { + if (change == KVM_MR_MOVE) + return kvm_arch_create_memslot(kvm, memslot, + mem->memory_size >> PAGE_SHIFT); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 147/257 KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 31603d4fc2bb4f0815245d496cb970b27b4f636a upstream.
VMCLEAR all in-use VMCSes during a crash, even if kdump's NMI shootdown interrupted a KVM update of the percpu in-use VMCS list.
Because NMIs are not blocked by disabling IRQs, it's possible that crash_vmclear_local_loaded_vmcss() could be called while the percpu list of VMCSes is being modified, e.g. in the middle of list_add() in vmx_vcpu_load_vmcs(). This potential corner case was called out in the original commit[*], but the analysis of its impact was wrong.
Skipping the VMCLEARs is wrong because it all but guarantees that a loaded, and therefore cached, VMCS will live across kexec and corrupt memory in the new kernel. Corruption will occur because the CPU's VMCS cache is non-coherent, i.e. not snooped, and so the writeback of VMCS memory on its eviction will overwrite random memory in the new kernel. The VMCS will live because the NMI shootdown also disables VMX, i.e. the in-progress VMCLEAR will #UD, and existing Intel CPUs do not flush the VMCS cache on VMXOFF.
Furthermore, interrupting list_add() and list_del() is safe due to crash_vmclear_local_loaded_vmcss() using forward iteration. list_add() ensures the new entry is not visible to forward iteration unless the entire add completes, via WRITE_ONCE(prev->next, new). A bad "prev" pointer could be observed if the NMI shootdown interrupted list_del() or list_add(), but list_for_each_entry() does not consume ->prev.
In addition to removing the temporary disabling of VMCLEAR, open code loaded_vmcs_init() in __loaded_vmcs_clear() and reorder VMCLEAR so that the VMCS is deleted from the list only after it's been VMCLEAR'd. Deleting the VMCS before VMCLEAR would allow a race where the NMI shootdown could arrive between list_del() and vmcs_clear() and thus neither flow would execute a successful VMCLEAR. Alternatively, more code could be moved into loaded_vmcs_init(), but that gets rather silly as the only other user, alloc_loaded_vmcs(), doesn't need the smp_wmb() and would need to work around the list_del().
Update the smp_*() comments related to the list manipulation, and opportunistically reword them to improve clarity.
[*] https://patchwork.kernel.org/patch/1675731/#3720461
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 67 +++++++++++-------------------------------------- 1 file changed, 16 insertions(+), 51 deletions(-)
arch/x86/kvm/vmx/vmx.c +16 -51
@@ -664,43 +664,15 @@ void loaded_vmcs_init(struct loaded_vmcs }#ifdef CONFIG_KEXEC_CORE -/* -* This bitmap is used to indicate whether the vmclear -* operation is enabled on all cpus. All disabled by -* default. -*/ -static cpumask_t crash_vmclear_enabled_bitmap =CPU_MASK_NONE ; - -static inline void crash_enable_local_vmclear (int cpu) -{ -cpumask_set_cpu (cpu, &crash_vmclear_enabled_bitmap); -} - -static inline void crash_disable_local_vmclear (int cpu) -{ -cpumask_clear_cpu (cpu, &crash_vmclear_enabled_bitmap); -} - -static inline int crash_local_vmclear_enabled (int cpu) -{ -return cpumask_test_cpu (cpu, &crash_vmclear_enabled_bitmap); -} -static void crash_vmclear_local_loaded_vmcss (void ) {int cpu =raw_smp_processor_id ();struct loaded_vmcs *v; -if (!crash_local_vmclear_enabled (cpu)) -return ; -list_for_each_entry (v, &per_cpu (loaded_vmcss_on_cpu, cpu), loaded_vmcss_on_cpu_link)vmcs_clear (v->vmcs); } -#else -static inline void crash_enable_local_vmclear (int cpu) { } -static inline void crash_disable_local_vmclear (int cpu) { }#endif /* CONFIG_KEXEC_CORE */ static void __loaded_vmcs_clear (void *arg)
@@ -712,19 +684,24 @@ static void __loaded_vmcs_clear(void *arreturn ;/* vcpu migration can race with cpu offline */ if (per_cpu (current_vmcs, cpu) == loaded_vmcs->vmcs)per_cpu (current_vmcs, cpu) =NULL ; -crash_disable_local_vmclear (cpu); + +vmcs_clear (loaded_vmcs->vmcs); +if (loaded_vmcs->shadow_vmcs && loaded_vmcs->launched) +vmcs_clear (loaded_vmcs->shadow_vmcs); +list_del (&loaded_vmcs->loaded_vmcss_on_cpu_link);/* -* we should ensure updating loaded_vmcs->loaded_vmcss_on_cpu_link -* is before setting loaded_vmcs->vcpu to -1 which is done in -* loaded_vmcs_init. Otherwise, other cpu can see vcpu = -1 fist -* then adds the vmcs into percpu list before it is deleted. +* Ensure all writes to loaded_vmcs, including deleting it from its +* current percpu list, complete before setting loaded_vmcs->vcpu to +* -1, otherwise a different cpu can see vcpu == -1 first and add +* loaded_vmcs to its percpu list before it's deleted from this cpu's +* list. Pairs with the smp_rmb() in vmx_vcpu_load_vmcs(). */ smp_wmb (); -loaded_vmcs_init (loaded_vmcs); -crash_enable_local_vmclear (cpu); + loaded_vmcs->cpu =-1 ; + loaded_vmcs->launched =0 ; }void loaded_vmcs_clear (struct loaded_vmcs *loaded_vmcs)
@@ -1333,18 +1310,17 @@ void vmx_vcpu_load_vmcs(struct kvm_vcpuif (!already_loaded) {loaded_vmcs_clear (vmx->loaded_vmcs);local_irq_disable (); -crash_disable_local_vmclear (cpu);/* -* Read loaded_vmcs->cpu should be before fetching -* loaded_vmcs->loaded_vmcss_on_cpu_link. -* See the comments in __loaded_vmcs_clear(). +* Ensure loaded_vmcs->cpu is read before adding loaded_vmcs to +* this cpu's percpu list, otherwise it may not yet be deleted +* from its previous cpu's percpu list. Pairs with the +* smb_wmb() in __loaded_vmcs_clear(). */ smp_rmb ();list_add (&vmx->loaded_vmcs->loaded_vmcss_on_cpu_link, &per_cpu (loaded_vmcss_on_cpu, cpu)); -crash_enable_local_vmclear (cpu);local_irq_enable (); }
@@ -2260,17 +2236,6 @@ static int hardware_enable(void)INIT_LIST_HEAD (&per_cpu (blocked_vcpu_on_cpu, cpu));spin_lock_init (&per_cpu (blocked_vcpu_on_cpu_lock, cpu)); -/* -* Now we can enable the vmclear operation in kdump -* since the loaded_vmcss_on_cpu list on this cpu -* has been initialized. -* -* Though the cpu is not in VMX operation now, there -* is no problem to enable the vmclear operation -* for the loaded_vmcss_on_cpu list is empty! -*/ -crash_enable_local_vmclear (cpu); -rdmsrl (MSR_IA32_FEATURE_CONTROL , old); test_bits =FEATURE_CONTROL_LOCKED ;
Greg Kroah-Hartman
maintainerPATCH 148/257 KVM: x86: Gracefully handle __vmalloc() failure during VM allocation
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit d18b2f43b9147c8005ae0844fb445d8cc6a87e31 upstream.
Check the result of __vmalloc() to avoid dereferencing a NULL pointer in the event that allocation failres.
--- arch/x86/kvm/svm.c | 4 ++++ arch/x86/kvm/vmx/vmx.c | 4 ++++ 2 files changed, 8 insertions(+)
arch/x86/kvm/svm.c +4 -0
@@ -1930,6 +1930,10 @@ static struct kvm *svm_vm_alloc(void)struct kvm_svm *kvm_svm =__vmalloc (sizeof (struct kvm_svm ),GFP_KERNEL_ACCOUNT | __GFP_ZERO,PAGE_KERNEL ); + +if (!kvm_svm) +return NULL ; +return &kvm_svm->kvm; }
arch/x86/kvm/vmx/vmx.c +4 -0
@@ -6633,6 +6633,10 @@ static struct kvm *vmx_vm_alloc(void)struct kvm_vmx *kvm_vmx =__vmalloc (sizeof (struct kvm_vmx ),GFP_KERNEL_ACCOUNT | __GFP_ZERO,PAGE_KERNEL ); + +if (!kvm_vmx) +return NULL ; +return &kvm_vmx->kvm; }
Greg Kroah-Hartman
maintainerPATCH 149/257 KVM: VMX: Add a trampoline to fix VMREAD error handling
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 842f4be95899df22b5843ba1a7c8cf37e831a6e8 upstream.
Add a hand coded assembly trampoline to preserve volatile registers across vmread_error(), and to handle the calling convention differences between 64-bit and 32-bit due to asmlinkage on vmread_error(). Pass @field and @fault on the stack when invoking the trampoline to avoid clobbering volatile registers in the context of the inline assembly.
Calling vmread_error() directly from inline assembly is partially broken on 64-bit, and completely broken on 32-bit. On 64-bit, it will clobber %rdi and %rsi (used to pass @field and @fault) and any volatile regs written by vmread_error(). On 32-bit, asmlinkage means vmread_error() expects the parameters to be passed on the stack, not via regs.
Opportunistically zero out the result in the trampoline to save a few bytes of code for every VMREAD. A happy side effect of the trampoline is that the inline code footprint is reduced by three bytes on 64-bit due to PUSH/POP being more efficent (in terms of opcode bytes) than MOV.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/ops.h | 28 ++++++++++++++++----- arch/x86/kvm/vmx/vmenter.S | 58 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 79 insertions(+), 7 deletions(-)
arch/x86/kvm/vmx/ops.h +21 -7
@@ -12,7 +12,8 @@#define __ex (x) __kvm_handle_fault_on_reboot(x) -asmlinkage void vmread_error(unsigned long field, bool fault); +__attribute__((regparm (0 )))void vmread_error_trampoline (unsigned long field, +bool fault);void vmwrite_error (unsigned long field,unsigned long value);void vmclear_error (struct vmcs *vmcs,u64 phys_addr);void vmptrld_error (struct vmcs *vmcs,u64 phys_addr);
@@ -70,15 +71,28 @@ static __always_inline unsigned long __v asmvolatile ("1: vmread %2, %1\n\t" ".byte 0x3e\n\t" /* branch taken hint */ "ja 3f\n\t" -"mov %2, %%" _ASM_ARG1"\n\t" -"xor %%" _ASM_ARG2", %%" _ASM_ARG2"\n\t" -"2: call vmread_error\n\t" -"xor %k1, %k1\n\t" + +/* +* VMREAD failed. Push '0' for @fault, push the failing +* @field, and bounce through the trampoline to preserve +* volatile registers. +*/ +"push $0\n\t" +"push %2\n\t" +"2:call vmread_error_trampoline\n\t" + +/* +* Unwind the stack. Note, the trampoline zeros out the +* memory for @fault so that the result is '0' on error. +*/ +"pop %2\n\t" +"pop %1\n\t" "3:\n\t" +/* VMREAD faulted. As above, except push '1' for @fault. */ ".pushsection .fixup, \"ax\"\n\t" -"4: mov %2, %%" _ASM_ARG1"\n\t" -"mov $1, %%" _ASM_ARG2"\n\t" +"4: push $1\n\t" +"push %2\n\t" "jmp 2b\n\t" ".popsection\n\t" _ASM_EXTABLE(1b, 4b)
arch/x86/kvm/vmx/vmenter.S +58 -0
61 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 150/257 KVM: VMX: fix crash cleanup when KVM wasnt used
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
commit dbef2808af6c594922fe32833b30f55f35e9da6d upstream.
If KVM wasn't used at all before we crash the cleanup procedure fails with
BUG: unable to handle page fault for address: ffffffffffffffc8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 23215067 P4D 23215067 PUD 23217067 PMD 0 Oops: 0000 [#8] SMP PTI CPU: 0 PID: 3542 Comm: bash Kdump: loaded Tainted: G D 5.6.0-rc2+ #823 RIP: 0010:crash_vmclear_local_loaded_vmcss.cold+0x19/0x51 [kvm_intel]
The root cause is that loaded_vmcss_on_cpu list is not yet initialized, we initialize it in hardware_enable() but this only happens when we start a VM.
Previously, we used to have a bitmap with enabled CPUs and that was preventing [masking] the issue.
Initialized loaded_vmcss_on_cpu list earlier, right before we assign crash_vmclear_loaded_vmcss pointer. blocked_vcpu_on_cpu list and blocked_vcpu_on_cpu_lock are moved altogether for consistency.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
arch/x86/kvm/vmx/vmx.c +7 -5
@@ -2232,10 +2232,6 @@ static int hardware_enable(void) !hv_get_vp_assist_page(cpu))return -EFAULT ; -INIT_LIST_HEAD (&per_cpu (loaded_vmcss_on_cpu, cpu)); -INIT_LIST_HEAD (&per_cpu (blocked_vcpu_on_cpu, cpu)); -spin_lock_init (&per_cpu (blocked_vcpu_on_cpu_lock, cpu)); -rdmsrl (MSR_IA32_FEATURE_CONTROL , old); test_bits =FEATURE_CONTROL_LOCKED ;
@@ -8006,7 +8002,7 @@ module_exit(vmx_exit);static int __init vmx_init (void ) { -int r; +int r, cpu;#if IS_ENABLED (CONFIG_HYPERV )/*
@@ -8060,6 +8056,12 @@ static int __init vmx_init(void)return r; } +for_each_possible_cpu (cpu) { +INIT_LIST_HEAD (&per_cpu (loaded_vmcss_on_cpu, cpu)); +INIT_LIST_HEAD (&per_cpu (blocked_vcpu_on_cpu, cpu)); +spin_lock_init (&per_cpu (blocked_vcpu_on_cpu_lock, cpu)); + } +#ifdef CONFIG_KEXEC_CORE rcu_assign_pointer (crash_vmclear_loaded_vmcss, crash_vmclear_local_loaded_vmcss);
Greg Kroah-Hartman
maintainerPATCH 151/257 smb3: fix performance regression with setting mtime
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
commit cf5371ae460eb8e484e4884747af270c86c3c469 upstream.
There are cases when we don't want to send the SMB2 flush operation (e.g. when user specifies mount parm "nostrictsync") and it can be a very expensive operation on the server. In most cases in order to set mtime, we simply need to flush (write) the dirtry pages from the client and send the writes to the server not also send a flush protocol operation to the server.
--- fs/cifs/inode.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-)
fs/cifs/inode.c +12 -11
@@ -2517,25 +2517,26 @@ cifs_setattr_nounix(struct dentry *diren/* * Attempt to flush data before changing attributes. We need to do -* this for ATTR_SIZE and ATTR_MTIME for sure, and if we change the -* ownership or mode then we may also need to do this. Here, we take -* the safe way out and just do the flush on all setattr requests. If -* the flush returns error, store it to report later and continue. +* this for ATTR_SIZE and ATTR_MTIME. If the flush of the data +* returns error, store it to report later and continue. * * BB: This should be smarter. Why bother flushing pages that * will be truncated anyway? Also, should we error out here if -* the flush returns error? +* the flush returns error? Do we need to check for ATTR_MTIME_SET flag? */ - rc =filemap_write_and_wait (inode->i_mapping); -if (is_interrupt_error (rc)) { - rc = -ERESTARTSYS ; - goto cifs_setattr_exit; +if (attrs->ia_valid & (ATTR_MTIME |ATTR_SIZE |ATTR_CTIME )) { + rc =filemap_write_and_wait (inode->i_mapping); +if (is_interrupt_error (rc)) { + rc = -ERESTARTSYS ; + goto cifs_setattr_exit; + } +mapping_set_error (inode->i_mapping, rc); } -mapping_set_error (inode->i_mapping, rc); rc =0 ; -if (attrs->ia_valid &ATTR_MTIME ) { +if ((attrs->ia_valid &ATTR_MTIME ) && + !(cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NOSSYNC )) { rc =cifs_get_writable_file (cifsInode,FIND_WR_ANY , &wfile);if (!rc) { tcon =tlink_tcon (wfile->tlink);
Greg Kroah-Hartman
maintainerPATCH 152/257 CIFS: Fix bug which the return value by asynchronous read is error
In reply to Greg Kroah-HartmanFrom: Yilu Lin <[email protected]>
commit 97adda8b3ab703de8e4c8d27646ddd54fe22879c upstream.
This patch is used to fix the bug in collect_uncached_read_data() that rc is automatically converted from a signed number to an unsigned number when the CIFS asynchronous read fails. It will cause ctx->rc is error.
Example:
Share a directory and create a file on the Windows OS. Mount the directory to the Linux OS using CIFS.
On the CIFS client of the Linux OS, invoke the pread interface to deliver the read request.
The size of the read length plus offset of the read request is greater than the maximum file size.
In this case, the CIFS server on the Windows OS returns a failure message (for example, the return value of smb2.nt_status is STATUS_INVALID_PARAMETER).
After receiving the response message, the CIFS client parses smb2.nt_status to STATUS_INVALID_PARAMETER
and converts it to the Linux error code (rdata->result=-22).
Then the CIFS client invokes the collect_uncached_read_data function to assign the value of rdata->result to rc, that is, rc=rdata->result=-22.
The type of the ctx->total_len variable is unsigned integer, the type of the rc variable is integer, and the type of the ctx->rc variable is ssize_t.
Therefore, during the ternary operation, the value of rc is automatically converted to an unsigned number. The final result is ctx->rc=4294967274. However, the expected result is ctx->rc=-22.
--- fs/cifs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/file.c +1 -1
@@ -3842,7 +3842,7 @@ again:if (rc == -ENODATA ) rc =0 ; - ctx->rc = (rc ==0 ) ? ctx->total_len : rc; + ctx->rc = (rc ==0 ) ? (ssize_t )ctx->total_len : rc;mutex_unlock (&ctx->aio_mutex);