5.6.5-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.6.5-rc1 review
This is the start of the stable review cycle for the 5.6.5 release. There are 254 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 18 Apr 2020 13:11:20 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.5-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.6.5-rc1
Christophe Leroy <[email protected]>
powerpc/kasan: Fix kasan_remap_early_shadow_ro()
Peter Zijlstra <[email protected]>
perf/core: Remove 'struct sched_in_data'
Peter Zijlstra <[email protected]>
perf/core: Fix event cgroup tracking
Peter Zijlstra <[email protected]>
perf/core: Unify {pinned,flexible}_sched_in()
Chris Wilson <[email protected]>
drm/i915/gt: Fill all the unused space in the GGTT
Daniele Ceraolo Spurio <[email protected]>
drm/i915/ggtt: do not set bits 1-11 in gen12 ptes
Prike Liang <[email protected]>
drm/amdgpu: fix gfx hang during suspend with video playback (v2)
Lyude Paul <[email protected]>
drm/dp_mst: Fix clearing payload state on topology disable
Lyude Paul <[email protected]>
Revert "drm/dp_mst: Remove VCPI while disabling topology mgr"
Mark Brown <[email protected]>
arm64: Always force a branch protection mode when the compiler has one
Michael Ellerman <[email protected]>
powerpc/64: Prevent stack protection in early boot
Christophe Leroy <[email protected]>
powerpc/kprobes: Ignore traps that happened in real mode
Cédric Le Goater <[email protected]>
powerpc/xive: Fix xmon support on the PowerNV platform
Daniel Axtens <[email protected]>
powerpc/64: Setup a paca before parsing device tree etc.
Cédric Le Goater <[email protected]>
powerpc/xive: Use XIVE_BAD_IRQ instead of zero to catch non configured IPIs
Aneesh Kumar K.V <[email protected]>
powerpc/hash64/devmap: Use H_PAGE_THP_HUGE when setting up huge devmap PTE entries
Laurentiu Tudor <[email protected]>
powerpc/fsl_booke: Avoid creating duplicate tlb1 entry
Michael Ellerman <[email protected]>
powerpc/64/tm: Don't let userspace set regs->trap via sigreturn
Clement Courbet <[email protected]>
powerpc: Make setjmp/longjmp signature standard
Bart Van Assche <[email protected]>
scsi: sr: Fix sr_block_release()
Merlijn Wajer <[email protected]>
scsi: sr: get rid of sr global mutex
Juergen Gross <[email protected]>
xen/blkfront: fix memory allocation flags in blkfront_setup_indirect()
Wen Yang <[email protected]>
ipmi: fix hung processes in __get_guid()
Kai-Heng Feng <[email protected]>
libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set
Simon Gander <[email protected]>
hfsplus: fix crash and filesystem corruption when deleting files
Oliver O'Halloran <[email protected]>
cpufreq: powernv: Fix use-after-free
Eric Biggers <[email protected]>
kmod: make request_module() return an error when autoloading is disabled
Paul Cercueil <[email protected]>
clk: ingenic/TCU: Fix round_rate returning error
Paul Cercueil <[email protected]>
clk: ingenic/jz4770: Exit with error if CGU init failed
Masami Hiramatsu <[email protected]>
ftrace/kprobe: Show the maxactive number on kprobe_events
Hans de Goede <[email protected]>
Input: i8042 - add Acer Aspire 5738z to nomux list
Michael Mueller <[email protected]>
s390/diag: fix display of diagnose call statistics
Sam Lunt <[email protected]>
perf tools: Support Python 3.8+ in Makefile
Changwei Ge <[email protected]>
ocfs2: no need try to truncate file beyond i_size
Eric Biggers <[email protected]>
fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()
Mike Willard <[email protected]>
ASoC: cs4270: pull reset GPIO low then high
Chris Wilson <[email protected]>
drm/i915/gt: Treat idling as a RPS downclock event
Qian Cai <[email protected]>
ext4: fix a data race at inode->i_blocks
Scott Mayhew <[email protected]>
NFS: Fix a few constant_table array definitions
Trond Myklebust <[email protected]>
NFS: finish_automount() requires us to hold 2 refs to the mount record
Trond Myklebust <[email protected]>
NFS: Fix a page leak in nfs_destroy_unlinked_subrequests()
Trond Myklebust <[email protected]>
NFS: Fix use-after-free issues in nfs_pageio_add_request()
J. Bruce Fields <[email protected]>
nfsd: fsnotify on rmdir under nfsd/clients/
Hans de Goede <[email protected]>
drm/vboxvideo: Add missing remove_conflicting_pci_framebuffers call, v2
Libor Pechacek <[email protected]>
powerpc/pseries: Avoid NULL pointer dereference when drmem is unavailable
Imre Deak <[email protected]>
drm/i915/icl+: Don't enable DDI IO power on a TypeC port in TBT mode
Marek Szyprowski <[email protected]>
drm/prime: fix extracting of the DMA addresses from a scatterlist
Michael Strauss <[email protected]>
drm/amd/display: Check for null fclk voltage when parsing clock table
Aaron Liu <[email protected]>
drm/amdgpu: unify fw_write_wait for new gfx9 asics
Prike Liang <[email protected]>
drm/amd/powerplay: implement the is_dpm_running()
Yuxian Dai <[email protected]>
drm/amdgpu/powerplay: using the FCLK DPM table to set the MCLK
Chris Wilson <[email protected]>
drm: Remove PageReserved manipulation from drm_pci_alloc
Christian Gmeiner <[email protected]>
drm/etnaviv: rework perfmon query infrastructure
Torsten Duwe <[email protected]>
drm/bridge: analogix-anx78xx: Fix drm_dp_link helper removal
Chris Wilson <[email protected]>
drm/i915/gem: Flush all the reloc_gpu batch
Eric Auger <[email protected]>
vfio: platform: Switch to platform_get_irq_optional()
Michael Ellerman <[email protected]>
selftests/powerpc: Fix try-run when source tree is not writable
Christophe Leroy <[email protected]>
selftests/powerpc: Add tlbie_test in .gitignore
Christophe Leroy <[email protected]>
selftests/vm: fix map_hugetlb length used for testing read and write
Michal Hocko <[email protected]>
selftests: vm: drop dependencies on page flags from mlock2 tests
Fredrik Strupe <[email protected]>
arm64: armv8_deprecated: Fix undef_hook mask for thumb setend
Dave Gerlach <[email protected]>
arm64: dts: ti: k3-am65: Add clocks to dwc3 nodes
Marek Szyprowski <[email protected]>
ARM: dts: exynos: Fix polarity of the LCD SPI bus on UniversalC210 board
James Smart <[email protected]>
scsi: lpfc: Fix broken Credit Recovery after driver load
James Smart <[email protected]>
scsi: lpfc: Fix lpfc_io_buf resource leak in lpfc_get_scsi_buf_s4 error path
Stanley Chu <[email protected]>
scsi: ufs: fix Auto-Hibern8 error detection
Steffen Maier <[email protected]>
scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point
Gilad Ben-Yossef <[email protected]>
crypto: ccree - dec auth tag size from cryptlen map
Gilad Ben-Yossef <[email protected]>
crypto: ccree - only try to map auth tag if needed
Gilad Ben-Yossef <[email protected]>
crypto: ccree - protect against empty or NULL scatterlists
Andrei Botila <[email protected]>
crypto: caam - update xts sector size for large input length
Horia Geantă <[email protected]>
crypto: caam/qi2 - fix chacha20 data size error
Matthew Wilcox (Oracle) <[email protected]>
xarray: Fix early termination of xas_for_each_marked
Matthew Wilcox (Oracle) <[email protected]>
XArray: Fix xas_pause for large multi-index entries
Nikos Tsironis <[email protected]>
dm clone metadata: Fix return type of dm_clone_nr_of_hydrated_regions()
Nikos Tsironis <[email protected]>
dm clone: Add missing casts to prevent overflows and data corruption
Nikos Tsironis <[email protected]>
dm clone: Add overflow check for number of regions
Nikos Tsironis <[email protected]>
dm clone: Fix handling of partial region discards
Bob Liu <[email protected]>
dm zoned: remove duplicate nr_rnd_zones increase in dmz_init_zone()
Shetty, Harshini X (EXT-Sony Mobile) <[email protected]>
dm verity fec: fix memory leak in verity_fec_dtr
Mikulas Patocka <[email protected]>
dm integrity: fix a crash with unusually large tag size
Mikulas Patocka <[email protected]>
dm writecache: add cond_resched to avoid CPU hangs
Jakub Kicinski <[email protected]>
mm, memcg: do not high throttle allocators based on wraparound
Maxime Ripard <[email protected]>
arm64: dts: allwinner: h5: Fix PMU compatible
Scott Wood <[email protected]>
sched/core: Remove duplicate assignment in sched_tick_remote()
Maxime Ripard <[email protected]>
arm64: dts: allwinner: h6: Fix PMU compatible
Subash Abhinov Kasiviswanathan <[email protected]>
net: qualcomm: rmnet: Allow configuration updates to existing devices
Anssi Hannula <[email protected]>
tools: gpio: Fix out-of-tree build regression
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Fix kernel panic observed on soft HBA unplug
Jens Axboe <[email protected]>
io_uring: honor original task RLIMIT_FSIZE
Rosioru Dragos <[email protected]>
crypto: mxs-dcp - fix scatterlist linearization for hash
Dan Carpenter <[email protected]>
crypto: rng - Fix a refcounting bug in crypto_rng_reset()
Dmitry Safonov <[email protected]>
time/namespace: Add max_time_namespaces ucount
Michael Kerrisk (man-pages) <[email protected]>
time/namespace: Fix time_for_children symlink
Nikita Shubin <[email protected]>
remoteproc: Fix NULL pointer dereference in rproc_virtio_notify
Sibi Sankar <[email protected]>
remoteproc: qcom_q6v5_mss: Reload the mba region on coredump
Bjorn Andersson <[email protected]>
remoteproc: qcom_q6v5_mss: Don't reassign mpss region on shutdown
Josef Bacik <[email protected]>
btrfs: use nofs allocations for running delayed items
Robbie Ko <[email protected]>
btrfs: fix missing semaphore unlock in btrfs_sync_file
Josef Bacik <[email protected]>
btrfs: unset reloc control if we fail to recover
Filipe Manana <[email protected]>
btrfs: fix missing file extent item for hole after ranged fsync
Josef Bacik <[email protected]>
btrfs: drop block from cache on error in relocation
Josef Bacik <[email protected]>
btrfs: set update the uuid generation as soon as possible
Josef Bacik <[email protected]>
btrfs: reloc: clean dirty subvols if we fail to start a transaction
Filipe Manana <[email protected]>
Btrfs: fix crash during unmount due to race with delayed inode workers
Josef Bacik <[email protected]>
btrfs: fix btrfs_calc_reclaim_metadata_size calculation
Qu Wenruo <[email protected]>
btrfs: Don't submit any btree write bio if the fs has errors
Tvrtko Ursulin <[email protected]>
drm/i915/gen12: Disable preemption timeout
Piotr Sroka <[email protected]>
mtd: rawnand: cadence: reinit completion before executing a new command
Piotr Sroka <[email protected]>
mtd: rawnand: cadence: change bad block marker size
Piotr Sroka <[email protected]>
mtd: rawnand: cadence: fix the calculation of the avaialble OOB size
Frieder Schrempf <[email protected]>
mtd: spinand: Do not erase the block before writing a bad block marker
Frieder Schrempf <[email protected]>
mtd: spinand: Stop using spinand->oobbuf for buffering bad block markers
Murphy Zhou <[email protected]>
CIFS: check new file size when extending file by fallocate
Yilu Lin <[email protected]>
CIFS: Fix bug which the return value by asynchronous read is error
Steve French <[email protected]>
smb3: fix performance regression with setting mtime
Vitaly Kuznetsov <[email protected]>
KVM: VMX: fix crash cleanup when KVM wasn't used
Sean Christopherson <[email protected]>
KVM: VMX: Add a trampoline to fix VMREAD error handling
Sean Christopherson <[email protected]>
KVM: x86: Gracefully handle __vmalloc() failure during VM allocation
Sean Christopherson <[email protected]>
KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support
Sean Christopherson <[email protected]>
KVM: x86: Allocate new rmap and large page tracking when moving memslot
David Hildenbrand <[email protected]>
KVM: s390: vsie: Fix delivery of addressing exceptions
David Hildenbrand <[email protected]>
KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks
Sean Christopherson <[email protected]>
KVM: nVMX: Properly handle userspace interrupt window request
Fabiano Rosas <[email protected]>
KVM: PPC: Book3S HV: Skip kvmppc_uvmem_free if Ultravisor is not supported
Kristian Klausen <[email protected]>
platform/x86: asus-wmi: Support laptops where the first battery is named BATT
Thomas Gleixner <[email protected]>
x86/entry/32: Add missing ASM_CLAC to general_protection entry
Hans de Goede <[email protected]>
x86/tsc_msr: Make MSR derived TSC frequency more accurate
Hans de Goede <[email protected]>
x86/tsc_msr: Fix MSR_FSB_FREQ mask for Cherry Trail devices
Hans de Goede <[email protected]>
x86/tsc_msr: Use named struct initializers
Eric W. Biederman <[email protected]>
signal: Extend exec_id to 64bits
Remi Pommarel <[email protected]>
ath9k: Handle txpower changes even when TPC is disabled
Neeraj Upadhyay <[email protected]>
PM: sleep: wakeup: Skip wakeup_source_sysfs_remove() if device is not there
Ulf Hansson <[email protected]>
PM / Domains: Allow no domain-idle-states DT property in genpd when parsing
Gustavo A. R. Silva <[email protected]>
MIPS: OCTEON: irq: Fix potential NULL pointer dereference
Huacai Chen <[email protected]>
MIPS/tlbex: Fix LDDIR usage in setup_pw() for Loongson-3
Vasily Averin <[email protected]>
pstore: pstore_ftrace_seq_next should increase position index
Pavel Begunkov <[email protected]>
io_uring: fix ctx refcounting in io_submit_sqes()
Jens Axboe <[email protected]>
io_uring: remove bogus RLIMIT_NOFILE check in file registration
Jens Axboe <[email protected]>
io_uring: ensure openat sets O_LARGEFILE if needed
Sungbo Eo <[email protected]>
irqchip/versatile-fpga: Apply clear-mask earlier
Thomas Gleixner <[email protected]>
genirq/debugfs: Add missing sanity checks to interrupt injection
Thomas Gleixner <[email protected]>
cpu/hotplug: Ignore pm_wakeup_pending() for disable_nonboot_cpus()
Paul E. McKenney <[email protected]>
rcu: Make rcu_barrier() account for offline no-CBs CPUs
Ludovic Barre <[email protected]>
mmc: mmci_sdmmc: Fix clear busyd0end irq flag
Yang Xu <[email protected]>
KEYS: reaching the keys quotas correctly
Vasily Averin <[email protected]>
tpm: tpm2_bios_measurements_next should increase position index
Vasily Averin <[email protected]>
tpm: tpm1_bios_measurements_next should increase position index
Matthew Garrett <[email protected]>
tpm: Don't make log failures fatal
Vincent Guittot <[email protected]>
sched/fair: Fix enqueue_task_fair warning
Gao Xiang <[email protected]>
erofs: correct the remaining shrink objects
Kishon Vijay Abraham I <[email protected]>
PCI: endpoint: Fix for concurrent memory allocation in OB address region
Bjorn Andersson <[email protected]>
PCI: qcom: Fix the fixup of PCI_VENDOR_ID_QCOM
Sean V Kelley <[email protected]>
PCI: Add boot interrupt quirk mechanism for Xeon chipsets
Yicong Yang <[email protected]>
PCI/ASPM: Clear the correct bits when enabling L1 substates
Lukas Wunner <[email protected]>
PCI: pciehp: Fix indefinite wait on sysfs requests
Tom Lendacky <[email protected]>
efi/x86: Add TPM related EFI tables to unencrypted mapping checks
James Smart <[email protected]>
nvme-fc: Revert "add module to ops template to allow module references"
Sagi Grimberg <[email protected]>
nvmet-tcp: fix maxh2cdata icresp parameter
Martin Blumenstingl <[email protected]>
thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
Gayatri Kammela <[email protected]>
thermal: int340x_thermal: fix: Update Tiger Lake ACPI device IDs
Rafael J. Wysocki <[email protected]>
ACPI: PM: s2idle: Refine active GPEs check
Rafael J. Wysocki <[email protected]>
ACPICA: Allow acpi_any_gpe_status_set() to skip one GPE
Jan Engelhardt <[email protected]>
acpi/x86: ignore unspecified bit positions in the ACPI global lock field
Rafael J. Wysocki <[email protected]>
ACPI: EC: Avoid printing confusing messages in acpi_ec_setup()
Sven Schnelle <[email protected]>
seccomp: Add missing compat_ioctl for notify
Benoit Parrot <[email protected]>
media: ti-vpe: cal: fix a kernel oops when unloading module
Benoit Parrot <[email protected]>
media: ti-vpe: cal: fix disable_irqs to only the intended target
Andrzej Pietrasiewicz <[email protected]>
media: hantro: Read be32 words starting at every fourth byte
Stanimir Varbanov <[email protected]>
media: venus: firmware: Ignore secure call error on first resume
Stanimir Varbanov <[email protected]>
media: venus: cache vb payload to be used by clock scaling
Takashi Iwai <[email protected]>
ALSA: hda/realtek - Add quirk for MSI GL63
Hans de Goede <[email protected]>
ALSA: hda/realtek - Add quirk for Lenovo Carbon X1 8th gen
Thomas Hebb <[email protected]>
ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups
Thomas Hebb <[email protected]>
ALSA: hda/realtek - Set principled PC Beep configuration for ALC256
Thomas Hebb <[email protected]>
ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256
Hui Wang <[email protected]>
ALSA: hda/realtek - a fake key event is triggered by running shutup
Kai-Heng Feng <[email protected]>
ALSA: hda/realtek: Enable mute LED on an HP system
Takashi Iwai <[email protected]>
ALSA: pcm: oss: Fix regression by buffer overflow fix
Takashi Iwai <[email protected]>
ALSA: ice1724: Fix invalid access for enumerated ctl items
Takashi Iwai <[email protected]>
ALSA: hda: Fix potential access overflow in beep helper
Takashi Iwai <[email protected]>
ALSA: hda: Add driver blacklist
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add mixer workaround for TRX40 and co
Thinh Nguyen <[email protected]>
usb: gadget: composite: Inform controller driver of self-powered
Sriharsha Allenki <[email protected]>
usb: gadget: f_fs: Fix use after free issue as part of queue failure
이경택 <[email protected]>
ASoC: topology: use name_prefix for new kcontrol
이경택 <[email protected]>
ASoC: dpcm: allow start or stop during pause for backend
이경택 <[email protected]>
ASoC: dapm: connect virtual mux with default value
이경택 <[email protected]>
ASoC: fix regwmask
Josef Bacik <[email protected]>
btrfs: track reloc roots based on their commit root bytenr
Josef Bacik <[email protected]>
btrfs: restart relocate_tree_blocks properly
Josef Bacik <[email protected]>
btrfs: remove a BUG_ON() from merge_reloc_roots()
Qu Wenruo <[email protected]>
btrfs: qgroup: ensure qgroup_rescan_running is only set when the worker is at least queued
Zhiqiang Liu <[email protected]>
block, bfq: fix use-after-free in bfq_idle_slice_timer_body
Sergio Paracuellos <[email protected]>
staging: mt7621-pci: avoid to poweroff the phy for slot one
Boqun Feng <[email protected]>
locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
Vladimir Oltean <[email protected]>
spi: spi-fsl-dspi: Replace interruptible wait queue with a simple completion
Junyong Sun <[email protected]>
firmware: fix a double abort case with fw_load_sysfs_fallback
Guoqing Jiang <[email protected]>
md: check arrays is suspended in mddev_detach before call quiesce operations
Marc Zyngier <[email protected]>
irqchip/gic-v4: Provide irq_retrigger to avoid circular locking dependency
Neil Armstrong <[email protected]>
usb: dwc3: core: add support for disabling SS instances in park mode
Dongchun Zhu <[email protected]>
media: i2c: ov5695: Fix power on and off sequences
Hsin-Yi Wang <[email protected]>
media: mtk-vpu: avoid unaligned access to DTCM buffer.
Alexey Dobriyan <[email protected]>
block, zoned: fix integer overflow with BLKRESETZONE et al
Sahitya Tummala <[email protected]>
block: Fix use-after-free issue accessing struct io_cq
Alexander Sverdlin <[email protected]>
genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy()
Ard Biesheuvel <[email protected]>
efi/x86: Ignore the memory attributes table on i386
Arvind Sankar <[email protected]>
x86/boot: Use unsigned comparison for addresses
Peng Fan <[email protected]>
cpufreq: imx6q: fix error handling
Bob Peterson <[email protected]>
gfs2: Don't demote a glock until its revokes are written
Bob Peterson <[email protected]>
gfs2: Do log_flush in gfs2_ail_empty_gl even if ail list is empty
chenqiwu <[email protected]>
pstore/platform: fix potential mem leak if pstore_init_fs failed
John Garry <[email protected]>
libata: Remove extra scsi_host_put() in ata_scsi_add_hosts()
Matt Ranostay <[email protected]>
media: i2c: video-i2c: fix build errors due to 'imply hwmon'
Paolo Valente <[email protected]>
block, bfq: move forward the getting of an extra ref in bfq_bfqq_move
Logan Gunthorpe <[email protected]>
PCI/switchtec: Fix init_completion race condition with poll_wait()
Andy Lutomirski <[email protected]>
selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault
Tao Zhou <[email protected]>
sched/fair: Fix condition of avg_load calculation
Michael Wang <[email protected]>
sched: Avoid scale real weight down to zero
Michael Tretter <[email protected]>
media: allegro: fix type of gop_length in channel_create message
Marc Zyngier <[email protected]>
irqchip/gic-v4.1: Skip absent CPUs while iterating over redistributors
Ahmed S. Darwish <[email protected]>
time/sched_clock: Expire timer in hardirq context
Sungbo Eo <[email protected]>
irqchip/versatile-fpga: Handle chained IRQs properly
Vladimir Oltean <[email protected]>
spi: spi-fsl-dspi: Avoid NULL pointer in dspi_slave_abort for non-DMA mode
Taehee Yoo <[email protected]>
debugfs: Check module state before warning in {full/open}_proxy_open()
Konstantin Khlebnikov <[email protected]>
block: keep bdi->io_pages in sync with max_sectors_kb for stacked devices
Thomas Hellstrom <[email protected]>
dma-mapping: Fix dma_pgprot() for unencrypted coherent pages
Thomas Hellstrom <[email protected]>
x86: Don't let pgprot_modify() change the page encryption bit
Claudiu Beznea <[email protected]>
clocksource/drivers/timer-microchip-pit64b: Fix rate for gck
Rafael J. Wysocki <[email protected]>
ACPI: EC: Do not clear boot_ec_is_ecdt in acpi_ec_add()
Mathias Nyman <[email protected]>
xhci: bail out early if driver can't accress host in resume
Laurent Pinchart <[email protected]>
media: imx: imx7-media-csi: Fix video field handling
Laurent Pinchart <[email protected]>
media: imx: imx7_mipi_csis: Power off the source when stopping streaming
Alexey Dobriyan <[email protected]>
null_blk: fix spurious IO errors after failed past-wp access
Bart Van Assche <[email protected]>
null_blk: Suppress an UBSAN complaint triggered when setting 'memory_backed'
Bart Van Assche <[email protected]>
null_blk: Handle null_add_dev() failures properly
Bart Van Assche <[email protected]>
blk-mq: Fix a recently introduced regression in blk_mq_realloc_hw_ctxs()
Bart Van Assche <[email protected]>
null_blk: Fix the null_add_dev() error path
Lorenzo Bianconi <[email protected]>
iio: imu: st_lsm6dsx: check return value from st_lsm6dsx_sensor_set_enable
Chris Wilson <[email protected]>
sched/vtime: Prevent unstable evaluation of WARN(vtime->state)
Anshuman Khandual <[email protected]>
arm64/mm: Hold memory hotplug lock while walking for kernel page table dump
Krzysztof Kozlowski <[email protected]>
usb: phy: tegra: Include proper GPIO consumer header to fix compile testing
Mohammad Rasim <[email protected]>
media: arm64: dts: amlogic: add rc-videostrong-kii-pro keymap
James Morse <[email protected]>
firmware: arm_sdei: fix double-lock on hibernate with shared events
Stephan Gerhold <[email protected]>
media: venus: hfi_parser: Ignore HEVC encoding for V1
Helen Koike <[email protected]>
media: staging: rkisp1: isp: do not set invalid mbus code for pad
Helen Koike <[email protected]>
media: staging: rkisp1: use consistent bus_info string for media_dev
Philipp Zabel <[email protected]>
media: hantro: fix extra MV/MC sync space calculation
Dafna Hirschfeld <[email protected]>
media: vimc: streamer: fix memory leak in vimc subdevs if kthread_run fails
Ajay Singh <[email protected]>
staging: wilc1000: avoid double unlocking of 'wilc->hif_cs' mutex
Ajay Gupta <[email protected]>
usb: ucsi: ccg: disable runtime pm during fw flashing
Robert Richter <[email protected]>
EDAC/mc: Report "unknown memory" on too many DIMM labels found
Christoph Niedermaier <[email protected]>
cpufreq: imx6q: Fixes unwanted cpu overclocking on i.MX6ULL
Mohammad Rasim <[email protected]>
media: rc: add keymap for Videostrong KII Pro
-------------
Diffstat:
Documentation/admin-guide/sysctl/user.rst | 6 + Documentation/sound/hd-audio/index.rst | 1 + Documentation/sound/hd-audio/models.rst | 2 - Documentation/sound/hd-audio/realtek-pc-beep.rst | 129 ++++++++++++ Makefile | 4 +- arch/arm/boot/dts/exynos4210-universal_c210.dts | 4 +- arch/arm64/Makefile | 4 + arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi | 3 +- arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 3 +- arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts | 4 + arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 2 + arch/arm64/kernel/armv8_deprecated.c | 2 +- arch/arm64/mm/ptdump_debugfs.c | 4 + arch/mips/cavium-octeon/octeon-irq.c | 3 + arch/mips/mm/tlbex.c | 5 +- arch/powerpc/include/asm/book3s/64/hash-4k.h | 6 + arch/powerpc/include/asm/book3s/64/hash-64k.h | 8 +- arch/powerpc/include/asm/book3s/64/pgtable.h | 4 +- arch/powerpc/include/asm/book3s/64/radix.h | 5 + arch/powerpc/include/asm/drmem.h | 4 +- arch/powerpc/include/asm/setjmp.h | 6 +- arch/powerpc/kernel/dt_cpu_ftrs.c | 1 - arch/powerpc/kernel/kprobes.c | 3 + arch/powerpc/kernel/paca.c | 14 +- arch/powerpc/kernel/setup.h | 6 + arch/powerpc/kernel/setup_64.c | 32 ++- arch/powerpc/kernel/signal_64.c | 4 +- arch/powerpc/kexec/Makefile | 3 - arch/powerpc/kvm/book3s_hv_uvmem.c | 3 + arch/powerpc/mm/kasan/kasan_init_32.c | 2 +- arch/powerpc/mm/nohash/tlb_low.S | 12 +- arch/powerpc/platforms/pseries/hotplug-memory.c | 8 +- arch/powerpc/sysdev/xive/common.c | 16 +- arch/powerpc/sysdev/xive/native.c | 4 +- arch/powerpc/sysdev/xive/spapr.c | 4 +- arch/powerpc/sysdev/xive/xive-internal.h | 7 + arch/powerpc/xmon/Makefile | 3 - arch/s390/kernel/diag.c | 2 +- arch/s390/kvm/vsie.c | 1 + arch/s390/mm/gmap.c | 6 +- arch/x86/boot/compressed/head_32.S | 2 +- arch/x86/boot/compressed/head_64.S | 4 +- arch/x86/entry/entry_32.S | 1 + arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/include/asm/pgtable.h | 7 +- arch/x86/include/asm/pgtable_types.h | 2 +- arch/x86/kernel/acpi/boot.c | 2 +- arch/x86/kernel/tsc_msr.c | 128 +++++++++-- arch/x86/kvm/svm.c | 4 + arch/x86/kvm/vmx/nested.c | 18 +- arch/x86/kvm/vmx/ops.h | 28 ++- arch/x86/kvm/vmx/vmenter.S | 58 +++++ arch/x86/kvm/vmx/vmx.c | 92 +++----- arch/x86/kvm/x86.c | 21 +- arch/x86/platform/efi/efi.c | 2 + block/bfq-cgroup.c | 14 +- block/bfq-iosched.c | 16 +- block/blk-ioc.c | 7 + block/blk-mq.c | 1 - block/blk-settings.c | 3 + block/blk-zoned.c | 2 +- crypto/rng.c | 8 +- drivers/acpi/acpica/achware.h | 2 +- drivers/acpi/acpica/evxfgpe.c | 17 +- drivers/acpi/acpica/hwgpe.c | 47 ++++- drivers/acpi/ec.c | 26 ++- drivers/acpi/internal.h | 1 + drivers/acpi/sleep.c | 19 +- drivers/ata/libata-pmp.c | 1 + drivers/ata/libata-scsi.c | 9 +- drivers/base/firmware_loader/fallback.c | 2 +- drivers/base/power/domain.c | 2 +- drivers/base/power/wakeup.c | 4 +- drivers/block/null_blk_main.c | 12 +- drivers/block/xen-blkfront.c | 17 +- drivers/char/ipmi/ipmi_msghandler.c | 4 +- drivers/char/tpm/eventlog/common.c | 12 +- drivers/char/tpm/eventlog/tpm1.c | 2 +- drivers/char/tpm/eventlog/tpm2.c | 2 +- drivers/char/tpm/tpm-chip.c | 4 +- drivers/char/tpm/tpm.h | 2 +- drivers/clk/ingenic/jz4770-cgu.c | 4 +- drivers/clk/ingenic/tcu.c | 2 +- drivers/clocksource/timer-microchip-pit64b.c | 1 + drivers/cpufreq/imx6q-cpufreq.c | 12 +- drivers/cpufreq/powernv-cpufreq.c | 6 + drivers/crypto/caam/caamalg_desc.c | 30 ++- drivers/crypto/ccree/cc_buffer_mgr.c | 76 ++++--- drivers/crypto/ccree/cc_buffer_mgr.h | 1 + drivers/crypto/mxs-dcp.c | 58 +++-- drivers/edac/edac_mc.c | 21 +- drivers/firmware/arm_sdei.c | 32 ++- drivers/firmware/efi/efi.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 + .../drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 2 +- drivers/gpu/drm/amd/powerplay/renoir_ppt.c | 18 ++ drivers/gpu/drm/amd/powerplay/renoir_ppt.h | 2 +- drivers/gpu/drm/bridge/analogix/analogix-anx78xx.c | 5 +- drivers/gpu/drm/drm_dp_mst_topology.c | 20 +- drivers/gpu/drm/drm_pci.c | 23 +- drivers/gpu/drm/drm_prime.c | 37 ++-- drivers/gpu/drm/etnaviv/etnaviv_perfmon.c | 59 +++++- drivers/gpu/drm/i915/Kconfig.profile | 4 + drivers/gpu/drm/i915/display/intel_ddi.c | 6 +- drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 8 +- drivers/gpu/drm/i915/gt/gen8_ppgtt.c | 26 +++ drivers/gpu/drm/i915/gt/intel_engine_cs.c | 13 +- drivers/gpu/drm/i915/gt/intel_ggtt.c | 48 +++-- drivers/gpu/drm/i915/gt/intel_gtt.c | 24 --- drivers/gpu/drm/i915/gt/intel_gtt.h | 4 - drivers/gpu/drm/i915/gt/intel_rps.c | 13 ++ drivers/gpu/drm/vboxvideo/vbox_drv.c | 4 + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.c | 5 +- drivers/input/serio/i8042-x86ia64io.h | 11 + drivers/irqchip/irq-gic-v3-its.c | 10 + drivers/irqchip/irq-versatile-fpga.c | 18 +- drivers/md/dm-clone-metadata.c | 15 +- drivers/md/dm-clone-metadata.h | 2 +- drivers/md/dm-clone-target.c | 66 ++++-- drivers/md/dm-integrity.c | 4 +- drivers/md/dm-verity-fec.c | 1 + drivers/md/dm-writecache.c | 6 +- drivers/md/dm-zoned-metadata.c | 1 - drivers/md/md.c | 2 +- drivers/media/i2c/ov5695.c | 49 +++-- drivers/media/i2c/video-i2c.c | 2 +- drivers/media/platform/mtk-mdp/mtk_mdp_vpu.c | 9 +- drivers/media/platform/mtk-vcodec/vdec_vpu_if.c | 6 +- drivers/media/platform/mtk-vcodec/venc_vpu_if.c | 12 +- drivers/media/platform/mtk-vpu/mtk_vpu.c | 45 ++-- drivers/media/platform/mtk-vpu/mtk_vpu.h | 2 +- drivers/media/platform/qcom/venus/core.h | 1 + drivers/media/platform/qcom/venus/firmware.c | 10 +- drivers/media/platform/qcom/venus/helpers.c | 20 +- drivers/media/platform/qcom/venus/hfi_parser.c | 1 + drivers/media/platform/ti-vpe/cal.c | 29 +-- drivers/media/platform/vimc/vimc-streamer.c | 9 +- drivers/media/rc/keymaps/Makefile | 1 + drivers/media/rc/keymaps/rc-videostrong-kii-pro.c | 83 ++++++++ drivers/mmc/host/mmci_stm32_sdmmc.c | 4 +- drivers/mtd/nand/raw/cadence-nand-controller.c | 13 +- drivers/mtd/nand/spi/core.c | 17 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 31 +-- drivers/net/wireless/ath/ath9k/main.c | 3 + drivers/nvme/host/fc.c | 14 +- drivers/nvme/target/fcloop.c | 1 - drivers/nvme/target/tcp.c | 2 +- drivers/pci/controller/dwc/pcie-qcom.c | 8 +- drivers/pci/endpoint/pci-epc-mem.c | 10 +- drivers/pci/hotplug/pciehp_hpc.c | 14 +- drivers/pci/pcie/aspm.c | 4 +- drivers/pci/quirks.c | 80 ++++++- drivers/pci/switch/switchtec.c | 2 +- drivers/platform/x86/asus-wmi.c | 5 +- drivers/remoteproc/qcom_q6v5_mss.c | 54 +++-- drivers/remoteproc/remoteproc_virtio.c | 7 + drivers/s390/scsi/zfcp_erp.c | 2 +- drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_hbadisc.c | 59 ++++-- drivers/scsi/lpfc/lpfc_nvme.c | 2 - drivers/scsi/lpfc/lpfc_scsi.c | 4 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 8 +- drivers/scsi/qla2xxx/qla_nvme.c | 1 - drivers/scsi/sr.c | 22 +- drivers/scsi/sr.h | 2 + drivers/scsi/ufs/ufshcd.c | 3 +- drivers/scsi/ufs/ufshcd.h | 6 + drivers/spi/spi-fsl-dspi.c | 25 +-- drivers/staging/media/allegro-dvt/allegro-core.c | 5 +- drivers/staging/media/hantro/hantro_h1_jpeg_enc.c | 9 +- drivers/staging/media/hantro/hantro_v4l2.c | 2 +- .../staging/media/hantro/rk3399_vpu_hw_jpeg_enc.c | 9 +- drivers/staging/media/imx/imx7-media-csi.c | 4 + drivers/staging/media/imx/imx7-mipi-csis.c | 2 +- drivers/staging/media/rkisp1/rkisp1-dev.c | 3 +- drivers/staging/media/rkisp1/rkisp1-isp.c | 4 +- drivers/staging/mt7621-pci/pci-mt7621.c | 3 +- drivers/staging/wilc1000/wlan.c | 1 - .../intel/int340x_thermal/int3400_thermal.c | 2 +- .../intel/int340x_thermal/int3403_thermal.c | 2 +- drivers/usb/dwc3/core.c | 5 + drivers/usb/dwc3/core.h | 4 + drivers/usb/gadget/composite.c | 9 + drivers/usb/gadget/function/f_fs.c | 1 + drivers/usb/host/xhci.c | 4 +- drivers/usb/phy/phy-tegra-usb.c | 3 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 + drivers/vfio/platform/vfio_platform.c | 2 +- fs/btrfs/async-thread.c | 8 + fs/btrfs/async-thread.h | 1 + fs/btrfs/delayed-inode.c | 13 ++ fs/btrfs/disk-io.c | 27 ++- fs/btrfs/extent_io.c | 35 +++- fs/btrfs/file.c | 11 + fs/btrfs/qgroup.c | 11 +- fs/btrfs/relocation.c | 62 +++--- fs/btrfs/space-info.c | 43 +++- fs/cifs/file.c | 2 +- fs/cifs/inode.c | 23 +- fs/cifs/smb2ops.c | 4 + fs/debugfs/file.c | 18 +- fs/erofs/utils.c | 2 +- fs/exec.c | 2 +- fs/ext4/inode.c | 2 +- fs/filesystems.c | 4 +- fs/gfs2/glock.c | 3 + fs/gfs2/glops.c | 27 ++- fs/gfs2/log.c | 2 +- fs/gfs2/log.h | 1 + fs/hfsplus/attributes.c | 4 + fs/io_uring.c | 23 +- fs/nfs/fs_context.c | 5 +- fs/nfs/namespace.c | 12 +- fs/nfs/pagelist.c | 48 ++--- fs/nfs/write.c | 1 + fs/nfsd/nfsctl.c | 1 + fs/ocfs2/alloc.c | 4 + fs/pstore/inode.c | 5 +- fs/pstore/platform.c | 4 +- include/acpi/acpixf.h | 2 +- include/linux/cpu.h | 12 +- include/linux/devfreq_cooling.h | 2 +- include/linux/iocontext.h | 1 + include/linux/nvme-fc-driver.h | 4 - include/linux/pci-epc.h | 3 + include/linux/sched.h | 4 +- include/linux/xarray.h | 6 +- include/media/rc-map.h | 1 + include/trace/events/rcu.h | 1 + kernel/cpu.c | 4 +- kernel/dma/mapping.c | 2 + kernel/events/core.c | 150 ++++++------- kernel/irq/debugfs.c | 11 +- kernel/irq/irqdomain.c | 10 +- kernel/kmod.c | 4 +- kernel/locking/lockdep.c | 4 + kernel/rcu/tree.c | 36 ++-- kernel/sched/core.c | 1 - kernel/sched/cputime.c | 41 ++-- kernel/sched/fair.c | 29 ++- kernel/sched/sched.h | 8 +- kernel/seccomp.c | 1 + kernel/signal.c | 2 +- kernel/time/namespace.c | 1 + kernel/time/sched_clock.c | 9 +- kernel/trace/trace_kprobe.c | 2 + kernel/ucount.c | 1 + lib/test_xarray.c | 37 ++++ lib/xarray.c | 4 +- mm/memcontrol.c | 3 + security/keys/key.c | 2 +- security/keys/keyctl.c | 4 +- sound/core/oss/pcm_plugin.c | 32 ++- sound/pci/hda/hda_beep.c | 6 +- sound/pci/hda/hda_intel.c | 16 ++ sound/pci/hda/patch_realtek.c | 233 ++++++++++++--------- sound/pci/ice1712/prodigy_hifi.c | 4 +- sound/soc/codecs/cs4270.c | 40 +++- sound/soc/soc-dapm.c | 8 +- sound/soc/soc-ops.c | 4 +- sound/soc/soc-pcm.c | 6 +- sound/soc/soc-topology.c | 2 +- sound/usb/mixer_maps.c | 28 +++ tools/gpio/Makefile | 2 +- tools/perf/Makefile.config | 11 +- tools/testing/radix-tree/Makefile | 4 +- tools/testing/radix-tree/iteration_check_2.c | 87 ++++++++ tools/testing/radix-tree/main.c | 1 + tools/testing/radix-tree/test.h | 1 + tools/testing/selftests/powerpc/mm/.gitignore | 1 + tools/testing/selftests/powerpc/pmu/ebb/Makefile | 1 + tools/testing/selftests/vm/map_hugetlb.c | 14 +- tools/testing/selftests/vm/mlock2-tests.c | 233 ++++----------------- tools/testing/selftests/x86/ptrace_syscall.c | 8 +- 275 files changed, 2648 insertions(+), 1319 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/254 media: rc: add keymap for Videostrong KII Pro
From: Mohammad Rasim <[email protected]>
[ Upstream commit 30defecb98400575349a7d32f0526e1dc42ea83e ]
This is an NEC remote control device shipped with the Videostrong KII Pro tv box as well as other devices from videostrong.
--- drivers/media/rc/keymaps/Makefile | 1 + .../media/rc/keymaps/rc-videostrong-kii-pro.c | 83 +++++++++++++++++++ include/media/rc-map.h | 1 + 3 files changed, 85 insertions(+) create mode 100644 drivers/media/rc/keymaps/rc-videostrong-kii-pro.c
drivers/media/rc/keymaps/Makefile +1 -0
@@ -119,6 +119,7 @@ obj-$(CONFIG_RC_MAP) += rc-adstech-dvb-t-pci.o \ rc-videomate-m1f.o \ rc-videomate-s350.o \ rc-videomate-tv-pvr.o \ + rc-videostrong-kii-pro.o \ rc-wetek-hub.o \ rc-wetek-play2.o \ rc-winfast.o \
drivers/media/rc/keymaps/rc-videostrong-kii-pro.c new file +83 -0
83 lines not on this page · raw message
include/media/rc-map.h +1 -0
@@ -274,6 +274,7 @@ struct rc_map *rc_map_get(const char *name);#define RC_MAP_VIDEOMATE_K100 "rc-videomate-k100"#define RC_MAP_VIDEOMATE_S350 "rc-videomate-s350"#define RC_MAP_VIDEOMATE_TV_PVR "rc-videomate-tv-pvr" +#define RC_MAP_KII_PRO "rc-videostrong-kii-pro"#define RC_MAP_WETEK_HUB "rc-wetek-hub"#define RC_MAP_WETEK_PLAY2 "rc-wetek-play2"#define RC_MAP_WINFAST "rc-winfast"
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 2/254 cpufreq: imx6q: Fixes unwanted cpu overclocking on i.MX6ULL
In reply to Greg Kroah-HartmanFrom: Christoph Niedermaier <[email protected]>
[ Upstream commit 36eb7dc1bd42fe5f850329c893768ff89b696fba ]
imx6ul_opp_check_speed_grading is called for both i.MX6UL and i.MX6ULL. Since the i.MX6ULL was introduced to a separate ocotp compatible node later, it is possible that the i.MX6ULL has also dtbs with "fsl,imx6ull-ocotp". On a system without nvmem-cell speed grade a missing check on this node causes a driver fail without considering the cpu speed grade.
This patch prevents unwanted cpu overclocking on i.MX6ULL with compatible node "fsl,imx6ull-ocotp" in old dtbs without nvmem-cell speed grade.
--- drivers/cpufreq/imx6q-cpufreq.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/cpufreq/imx6q-cpufreq.c +3 -0
@@ -280,6 +280,9 @@ static int imx6ul_opp_check_speed_grading(struct device *dev)void __iomem *base; np =of_find_compatible_node (NULL ,NULL ,"fsl,imx6ul-ocotp" ); +if (!np) + np =of_find_compatible_node (NULL ,NULL , +"fsl,imx6ull-ocotp" );if (!np)return -ENOENT ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 3/254 EDAC/mc: Report "unknown memory" on too many DIMM labels found
In reply to Greg Kroah-HartmanFrom: Robert Richter <[email protected]>
[ Upstream commit 65bb4d1af92cf007adc0a0c59dadcc393c5cada6 ]
There is a limitation to report only EDAC_MAX_LABELS in e->label of the error descriptor. This is to prevent a potential string overflow.
The current implementation falls back to "any memory" in this case and also stops all further processing to find a unique row and channel of the possible error location.
Reporting "any memory" is wrong as the memory controller reported an error location for one of the layers. Instead, report "unknown memory" and also do not break early in the loop to further check row and channel for uniqueness.
[ bp: Massage commit message. ]
--- drivers/edac/edac_mc.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
drivers/edac/edac_mc.c +11 -10
@@ -1180,20 +1180,21 @@ void edac_mc_handle_error(const enum hw_event_mc_err_type type,* channel/memory controller/... may be affected. * Also, don't show errors for empty DIMM slots. */ -if (!e->enable_per_layer_report || !dimm->nr_pages) +if (!dimm->nr_pages)continue ; -if (n_labels >=EDAC_MAX_LABELS ) { - e->enable_per_layer_report = false; -break ; - } n_labels++; -if (p != e->label) { -strcpy (p,OTHER_LABEL ); - p +=strlen (OTHER_LABEL ); +if (n_labels >EDAC_MAX_LABELS ) { + p = e->label; + *p ='\0' ; + }else { +if (p != e->label) { +strcpy (p,OTHER_LABEL ); + p +=strlen (OTHER_LABEL ); + } +strcpy (p, dimm->label); + p +=strlen (p); } -strcpy (p, dimm->label); - p +=strlen (p);/* * get csrow/channel of the DIMM, in order to allow
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 4/254 usb: ucsi: ccg: disable runtime pm during fw flashing
In reply to Greg Kroah-HartmanFrom: Ajay Gupta <[email protected]>
[ Upstream commit 57a5e5f936be583d2c6cef3661c169e3ea4bf922 ]
Ucsi ppm is unregistered during fw flashing so disable runtime pm also and reenable after fw flashing is completed and ppm is re-registered.
--- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/typec/ucsi/ucsi_ccg.c +2 -0
@@ -1219,6 +1219,7 @@ static int ccg_restart(struct ucsi_ccg *uc)return status; } +pm_runtime_enable (uc->dev);return 0 ; }
@@ -1234,6 +1235,7 @@ static void ccg_update_firmware(struct work_struct *work)if (flash_mode !=FLASH_NOT_NEEDED ) {ucsi_unregister (uc->ucsi); +pm_runtime_disable (uc->dev);free_irq (uc->irq, uc);ccg_fw_update (uc, flash_mode);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 5/254 staging: wilc1000: avoid double unlocking of wilc->hif_cs mutex
In reply to Greg Kroah-HartmanFrom: Ajay Singh <[email protected]>
[ Upstream commit 6c411581caef6e3b2c286871641018364c6db50a ]
Possible double unlocking of 'wilc->hif_cs' mutex was identified by smatch [1]. Removed the extra call to release_bus() in wilc_wlan_handle_txq() which was missed in earlier commit fdc2ac1aafc6 ("staging: wilc1000: support suspend/resume functionality").
[1]. https://lists.01.org/hyperkitty/list/[email protected]/thread/NOEVW7C3GV74EWXJO3XX6VT2NKVB2HMT/
--- drivers/staging/wilc1000/wlan.c | 1 - 1 file changed, 1 deletion(-)
drivers/staging/wilc1000/wlan.c +0 -1
@@ -572,7 +572,6 @@ int wilc_wlan_handle_txq(struct wilc *wilc, u32 *txq_count) entries = ((reg >>3 ) &0x3f );break ; } -release_bus (wilc,WILC_BUS_RELEASE_ALLOW_SLEEP ); }while (--timeout);if (timeout <=0 ) { ret = func->hif_write_reg (wilc,WILC_HOST_VMM_CTL ,0x0 );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 6/254 media: vimc: streamer: fix memory leak in vimc subdevs if kthread_run fails
In reply to Greg Kroah-HartmanFrom: Dafna Hirschfeld <[email protected]>
[ Upstream commit ceeb2e6166dddf3c9757abbbf84032027e2fa2d2 ]
In case kthread_run fails, the vimc subdevices should be notified that streaming stopped so they can release the memory for the streaming. Also, kthread should be set to NULL.
--- drivers/media/platform/vimc/vimc-streamer.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/media/platform/vimc/vimc-streamer.c +7 -2
@@ -207,8 +207,13 @@ int vimc_streamer_s_stream(struct vimc_stream *stream, stream->kthread =kthread_run (vimc_streamer_thread, stream,"vimc-streamer thread" ); -if (IS_ERR (stream->kthread)) -return PTR_ERR (stream->kthread); +if (IS_ERR (stream->kthread)) { + ret =PTR_ERR (stream->kthread); +dev_err (ved->dev,"kthread_run failed with %d\n" , ret); +vimc_streamer_pipeline_terminate (stream); + stream->kthread =NULL ; +return ret; + } }else {if (!stream->kthread)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 7/254 media: hantro: fix extra MV/MC sync space calculation
In reply to Greg Kroah-HartmanFrom: Philipp Zabel <[email protected]>
[ Upstream commit 042584e9055b615ac917239884fb0d65690f56ec ]
Add space for MVs and MC sync data to the capture buffers depending on whether the post processor will be enabled for the new capture format passed to TRY_FMT, not the currently set capture format.
--- drivers/staging/media/hantro/hantro_v4l2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/media/hantro/hantro_v4l2.c +1 -1
@@ -295,7 +295,7 @@ static int vidioc_try_fmt(struct file *file, void *priv, struct v4l2_format *f,* +---------------------------+ */ if (ctx->vpu_src_fmt->fourcc ==V4L2_PIX_FMT_H264_SLICE && - !hantro_needs_postproc (ctx, ctx->vpu_dst_fmt)) + !hantro_needs_postproc (ctx, fmt)) pix_mp->plane_fmt[0 ].sizeimage +=64 *MB_WIDTH (pix_mp->width) *MB_WIDTH (pix_mp->height) +32 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 8/254 media: staging: rkisp1: use consistent bus_info string for media_dev
In reply to Greg Kroah-HartmanFrom: Helen Koike <[email protected]>
[ Upstream commit 12d3d8090bc5e8cdda2f56caed2a2a0d70009456 ]
Media device is using a slightly different bus_info string "platform: rkisp1" (with a space) instead of "platform:rkisp1" used by the rest of rkisp1 code.
This causes errors when using v4l2-util tools that uses the bus_info string to identify the device.
--- drivers/staging/media/rkisp1/rkisp1-dev.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/staging/media/rkisp1/rkisp1-dev.c +1 -2
@@ -502,8 +502,7 @@ static int rkisp1_probe(struct platform_device *pdev)strscpy (rkisp1->media_dev.model,RKISP1_DRIVER_NAME ,sizeof (rkisp1->media_dev.model)); rkisp1->media_dev.dev = &pdev->dev; -strscpy (rkisp1->media_dev.bus_info, -"platform: " RKISP1_DRIVER_NAME , +strscpy (rkisp1->media_dev.bus_info,RKISP1_BUS_INFO ,sizeof (rkisp1->media_dev.bus_info));media_device_init (&rkisp1->media_dev);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 9/254 media: staging: rkisp1: isp: do not set invalid mbus code for pad
In reply to Greg Kroah-HartmanFrom: Helen Koike <[email protected]>
[ Upstream commit 100f720aabab3d5f58f67c508186041b3c797a9b ]
When setting source pad, check if the given mbus code is indeed valid for source pad, if not, then set the default code.
Same for sink pad.
--- drivers/staging/media/rkisp1/rkisp1-isp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/media/rkisp1/rkisp1-isp.c +2 -2
@@ -683,7 +683,7 @@ static void rkisp1_isp_set_src_fmt(struct rkisp1_isp *isp, src_fmt->code = format->code; mbus_info =rkisp1_isp_mbus_info_get (src_fmt->code); -if (!mbus_info) { +if (!mbus_info || !(mbus_info->direction &RKISP1_DIR_SRC )) { src_fmt->code =RKISP1_DEF_SRC_PAD_FMT ; mbus_info =rkisp1_isp_mbus_info_get (src_fmt->code); }
@@ -767,7 +767,7 @@ static void rkisp1_isp_set_sink_fmt(struct rkisp1_isp *isp, which); sink_fmt->code = format->code; mbus_info =rkisp1_isp_mbus_info_get (sink_fmt->code); -if (!mbus_info) { +if (!mbus_info || !(mbus_info->direction &RKISP1_DIR_SINK )) { sink_fmt->code =RKISP1_DEF_SINK_PAD_FMT ; mbus_info =rkisp1_isp_mbus_info_get (sink_fmt->code); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 10/254 media: venus: hfi_parser: Ignore HEVC encoding for V1
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
[ Upstream commit c50cc6dc6c48300af63a6fbc71b647053c15fc80 ]
Some older MSM8916 Venus firmware versions also seem to indicate support for encoding HEVC, even though they really can't. This will lead to errors later because hfi_session_init() fails in this case.
HEVC is already ignored for "dec_codecs", so add the same for "enc_codecs" to make these old firmware versions work correctly.
--- drivers/media/platform/qcom/venus/hfi_parser.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/qcom/venus/hfi_parser.c +1 -0
@@ -181,6 +181,7 @@ static void parse_codecs(struct venus_core *core, void *data)if (IS_V1 (core)) { core->dec_codecs &= ~HFI_VIDEO_CODEC_HEVC ; core->dec_codecs &= ~HFI_VIDEO_CODEC_SPARK ; + core->enc_codecs &= ~HFI_VIDEO_CODEC_HEVC ; } }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 11/254 firmware: arm_sdei: fix double-lock on hibernate with shared events
In reply to Greg Kroah-HartmanFrom: James Morse <[email protected]>
[ Upstream commit 6ded0b61cf638bf9f8efe60ab8ba23db60ea9763 ]
SDEI has private events that must be registered on each CPU. When CPUs come and go they must re-register and re-enable their private events. Each event has flags to indicate whether this should happen to protect against an event being registered on a CPU coming online, while all the others are unregistering the event.
These flags are protected by the sdei_list_lock spinlock, because the cpuhp callbacks can't take the mutex.
Hibernate needs to unregister all events, but keep the in-memory re-register and re-enable as they are. sdei_unregister_shared() takes the spinlock to walk the list, then calls _sdei_event_unregister() on each shared event. _sdei_event_unregister() tries to take the same spinlock to update re-register and re-enable. This doesn't go so well.
Push the re-register and re-enable updates out to their callers. sdei_unregister_shared() doesn't want these values updated, so doesn't need to do anything.
This also fixes shared events getting lost over hibernate as this path made them look unregistered.
--- drivers/firmware/arm_sdei.c | 32 +++++++++++++++----------------- 1 file changed, 15 insertions(+), 17 deletions(-)
drivers/firmware/arm_sdei.c +15 -17
@@ -491,11 +491,6 @@ static int _sdei_event_unregister(struct sdei_event *event) {lockdep_assert_held (&sdei_events_lock); -spin_lock (&sdei_list_lock); - event->reregister = false; - event->reenable = false; -spin_unlock (&sdei_list_lock); -if (event->type ==SDEI_EVENT_TYPE_SHARED )return sdei_api_event_unregister (event->event_num);
@@ -518,6 +513,11 @@ int sdei_event_unregister(u32 event_num)break ; } +spin_lock (&sdei_list_lock); + event->reregister = false; + event->reenable = false; +spin_unlock (&sdei_list_lock); + err =_sdei_event_unregister (event);if (err)break ;
@@ -585,26 +585,15 @@ static int _sdei_event_register(struct sdei_event *event)lockdep_assert_held (&sdei_events_lock); -spin_lock (&sdei_list_lock); - event->reregister = true; -spin_unlock (&sdei_list_lock); -if (event->type ==SDEI_EVENT_TYPE_SHARED )return sdei_api_event_register (event->event_num, sdei_entry_point, event->registered,SDEI_EVENT_REGISTER_RM_ANY ,0 ); - err =sdei_do_cross_call (_local_event_register, event); -if (err) { -spin_lock (&sdei_list_lock); - event->reregister = false; - event->reenable = false; -spin_unlock (&sdei_list_lock); - +if (err)sdei_do_cross_call (_local_event_unregister, event); - }return err; }
@@ -632,8 +621,17 @@ int sdei_event_register(u32 event_num, sdei_event_callback *cb, void *arg)break ; } +spin_lock (&sdei_list_lock); + event->reregister = true; +spin_unlock (&sdei_list_lock); + err =_sdei_event_register (event);if (err) { +spin_lock (&sdei_list_lock); + event->reregister = false; + event->reenable = false; +spin_unlock (&sdei_list_lock); +sdei_event_destroy (event);pr_warn ("Failed to register event %u: %d\n" , event_num, err);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 12/254 media: arm64: dts: amlogic: add rc-videostrong-kii-pro keymap
In reply to Greg Kroah-HartmanFrom: Mohammad Rasim <[email protected]>
[ Upstream commit 806d06161af045dba29f3c7747550c93b2ea3ca9 ]
videostrong kii pro comes with a nec rc, add the keymap to the dts
--- arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts +4 -0
@@ -76,3 +76,7 @@ }; }; }; + +&ir { + linux,rc-map-name = "rc-videostrong-kii-pro"; +};
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 13/254 usb: phy: tegra: Include proper GPIO consumer header to fix compile testing
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 9cb9322a26ae84424c3e16e58617b3d8962fdbbb ]
The driver uses only GPIO Descriptor Consumer Interface so include proper header. This fixes compile test failures (e.g. on i386):
drivers/usb/phy/phy-tegra-usb.c: In function ‘ulpi_phy_power_on’:
drivers/usb/phy/phy-tegra-usb.c:695:2: error:
implicit declaration of function ‘gpiod_set_value_cansleep’ [-Werror=implicit-function-declaration]
drivers/usb/phy/phy-tegra-usb.c: In function ‘tegra_usb_phy_probe’:
drivers/usb/phy/phy-tegra-usb.c:1167:11: error:
implicit declaration of function ‘devm_gpiod_get_from_of_node’ [-Werror=implicit-function-declaration]
--- drivers/usb/phy/phy-tegra-usb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/phy/phy-tegra-usb.c +1 -2
@@ -12,12 +12,11 @@#include <linux/delay.h> #include <linux/err.h> #include <linux/export.h> -#include <linux/gpio.h> +#include <linux/gpio/consumer.h> #include <linux/iopoll.h> #include <linux/module.h> #include <linux/of.h> #include <linux/of_device.h> -#include <linux/of_gpio.h> #include <linux/platform_device.h> #include <linux/resource.h> #include <linux/slab.h>
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 14/254 arm64/mm: Hold memory hotplug lock while walking for kernel page table dump
In reply to Greg Kroah-HartmanFrom: Anshuman Khandual <[email protected]>
[ Upstream commit bf2b59f60ee1fefa768d62ec6e8f4b4d9e04c691 ]
The arm64 page table dump code can race with concurrent modification of the kernel page tables. When a leaf entries are modified concurrently, the dump code may log stale or inconsistent information for a VA range, but this is otherwise not harmful.
When intermediate levels of table are freed, the dump code will continue to use memory which has been freed and potentially reallocated for another purpose. In such cases, the dump code may dereference bogus addresses, leading to a number of potential problems.
Intermediate levels of table may by freed during memory hot-remove, which will be enabled by a subsequent patch. To avoid racing with this, take the memory hotplug lock when walking the kernel page table.
--- arch/arm64/mm/ptdump_debugfs.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/mm/ptdump_debugfs.c +4 -0
@@ -1,5 +1,6 @@// SPDX-License-Identifier: GPL-2.0 #include <linux/debugfs.h> +#include <linux/memory_hotplug.h> #include <linux/seq_file.h> #include <asm/ptdump.h>
@@ -7,7 +8,10 @@static int ptdump_show (struct seq_file *m,void *v) {struct ptdump_info *info = m->private; + +get_online_mems ();ptdump_walk (m, info); +put_online_mems ();return 0 ; }DEFINE_SHOW_ATTRIBUTE (ptdump);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 15/254 sched/vtime: Prevent unstable evaluation of WARN(vtime->state)
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
[ Upstream commit f1dfdab694eb3838ac26f4b73695929c07d92a33 ]
As the vtime is sampled under loose seqcount protection by kcpustat, the vtime fields may change as the code flows. Where logic dictates a field has a static value, use a READ_ONCE.
--- kernel/sched/cputime.c | 41 ++++++++++++++++++++++------------------- 1 file changed, 22 insertions(+), 19 deletions(-)
kernel/sched/cputime.c +22 -19
@@ -909,8 +909,10 @@ void task_cputime(struct task_struct *t, u64 *utime, u64 *stime) }while (read_seqcount_retry (&vtime->seqcount, seq)); } -static int vtime_state_check (struct vtime *vtime,int cpu) +static int vtime_state_fetch (struct vtime *vtime,int cpu) { +int state =READ_ONCE (vtime->state); +/* * We raced against a context switch, fetch the * kcpustat task again.
@@ -927,10 +929,10 @@ static int vtime_state_check(struct vtime *vtime, int cpu)* * Case 1) is ok but 2) is not. So wait for a safe VTIME state. */ -if (vtime->state ==VTIME_INACTIVE ) +if (state ==VTIME_INACTIVE )return -EAGAIN ; -return 0 ; +return state; }static u64 kcpustat_user_vtime (struct vtime *vtime)
@@ -949,14 +951,15 @@ static int kcpustat_field_vtime(u64 *cpustat, {struct vtime *vtime = &tsk->vtime;unsigned int seq; -int err; do { + int state; + seq = read_seqcount_begin(&vtime->seqcount); - err = vtime_state_check(vtime, cpu); - if (err < 0) - return err; + state = vtime_state_fetch(vtime, cpu); + if (state < 0) + return state; *val = cpustat[usage];
@@ -969,7 +972,7 @@ static int kcpustat_field_vtime(u64 *cpustat,*/ switch (usage) {case CPUTIME_SYSTEM : -if (vtime->state ==VTIME_SYS ) +if (state ==VTIME_SYS ) *val += vtime->stime +vtime_delta (vtime);break ;case CPUTIME_USER :
@@ -981,11 +984,11 @@ static int kcpustat_field_vtime(u64 *cpustat, *val +=kcpustat_user_vtime (vtime);break ;case CPUTIME_GUEST : -if (vtime->state ==VTIME_GUEST &&task_nice (tsk) <=0 ) +if (state ==VTIME_GUEST &&task_nice (tsk) <=0 ) *val += vtime->gtime +vtime_delta (vtime);break ;case CPUTIME_GUEST_NICE : -if (vtime->state ==VTIME_GUEST &&task_nice (tsk) >0 ) +if (state ==VTIME_GUEST &&task_nice (tsk) >0 ) *val += vtime->gtime +vtime_delta (vtime);break ;default :
@@ -1036,23 +1039,23 @@ static int kcpustat_cpu_fetch_vtime(struct kernel_cpustat *dst, {struct vtime *vtime = &tsk->vtime;unsigned int seq; -int err; do { u64 *cpustat; u64 delta; + int state; seq = read_seqcount_begin(&vtime->seqcount); - err = vtime_state_check(vtime, cpu); - if (err < 0) - return err; + state = vtime_state_fetch(vtime, cpu); + if (state < 0) + return state; *dst = *src; cpustat = dst->cpustat; /* Task is sleeping, dead or idle, nothing to add */ - if (vtime->state < VTIME_SYS) + if (state < VTIME_SYS) continue; delta = vtime_delta(vtime);
@@ -1061,15 +1064,15 @@ static int kcpustat_cpu_fetch_vtime(struct kernel_cpustat *dst,* Task runs either in user (including guest) or kernel space, * add pending nohz time to the right place. */ -if (vtime->state ==VTIME_SYS ) { +if (state ==VTIME_SYS ) { cpustat[CPUTIME_SYSTEM ] += vtime->stime + delta; - }else if (vtime->state ==VTIME_USER ) { + }else if (state ==VTIME_USER ) {if (task_nice (tsk) >0 ) cpustat[CPUTIME_NICE ] += vtime->utime + delta;else cpustat[CPUTIME_USER ] += vtime->utime + delta; }else { -WARN_ON_ONCE (vtime->state !=VTIME_GUEST ); +WARN_ON_ONCE (state !=VTIME_GUEST );if (task_nice (tsk) >0 ) { cpustat[CPUTIME_GUEST_NICE ] += vtime->gtime + delta; cpustat[CPUTIME_NICE ] += vtime->gtime + delta;
@@ -1080,7 +1083,7 @@ static int kcpustat_cpu_fetch_vtime(struct kernel_cpustat *dst, } }while (read_seqcount_retry (&vtime->seqcount, seq)); -return err; +return 0 ; }void kcpustat_cpu_fetch (struct kernel_cpustat *dst,int cpu)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 16/254 iio: imu: st_lsm6dsx: check return value from st_lsm6dsx_sensor_set_enable
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit f20dbe11e2e904547597ae7371c1f635e3be9cad ]
Add missing return value check in st_lsm6dsx_shub_read_oneshot disabling the slave device connected to the st_lsm6dsx i2c controller. The issue is reported by coverity with the following error:
Unchecked return value:
If the function returns an error value, the error value may be mistaken for a normal value.
Addresses-Coverity-ID: 1456767 ("Unchecked return value")
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.c +3 -2
@@ -464,9 +464,10 @@ st_lsm6dsx_shub_read_oneshot(struct st_lsm6dsx_sensor *sensor, len =min_t (int,sizeof (data), ch->scan_type.realbits >>3 ); err =st_lsm6dsx_shub_read (sensor, ch->address, data, len); +if (err <0 ) +return err; -st_lsm6dsx_shub_set_enable (sensor, false); - + err =st_lsm6dsx_shub_set_enable (sensor, false);if (err <0 )return err;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 17/254 null_blk: Fix the null_add_dev() error path
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 2004bfdef945fe55196db6b9cdf321fbc75bb0de ]
If null_add_dev() fails, clear dev->nullb.
This patch fixes the following KASAN complaint:
BUG: KASAN: use-after-free in nullb_device_submit_queues_store+0xcf/0x160 [null_blk] Read of size 8 at addr ffff88803280fc30 by task check/8409 Call Trace: dump_stack+0xa5/0xe6 print_address_description.constprop.0+0x26/0x260 __kasan_report.cold+0x7b/0x99 kasan_report+0x16/0x20 __asan_load8+0x58/0x90 nullb_device_submit_queues_store+0xcf/0x160 [null_blk] configfs_write_file+0x1c4/0x250 [configfs] __vfs_write+0x4c/0x90 vfs_write+0x145/0x2c0 ksys_write+0xd7/0x180 __x64_sys_write+0x47/0x50 do_syscall_64+0x6f/0x2f0 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7ff370926317 Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007fff2dd2da48 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007ff370926317 RDX: 0000000000000002 RSI: 0000559437ef23f0 RDI: 0000000000000001 RBP: 0000559437ef23f0 R08: 000000000000000a R09: 0000000000000001 R10: 0000559436703471 R11: 0000000000000246 R12: 0000000000000002 R13: 00007ff370a006a0 R14: 00007ff370a014a0 R15: 00007ff370a008a0 Allocated by task 8409: save_stack+0x23/0x90 __kasan_kmalloc.constprop.0+0xcf/0xe0 kasan_kmalloc+0xd/0x10 kmem_cache_alloc_node_trace+0x129/0x4c0 null_add_dev+0x24a/0xe90 [null_blk] nullb_device_power_store+0x1b6/0x270 [null_blk] configfs_write_file+0x1c4/0x250 [configfs] __vfs_write+0x4c/0x90 vfs_write+0x145/0x2c0 ksys_write+0xd7/0x180 __x64_sys_write+0x47/0x50 do_syscall_64+0x6f/0x2f0 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 8409: save_stack+0x23/0x90 __kasan_slab_free+0x112/0x160 kasan_slab_free+0x12/0x20 kfree+0xdf/0x250 null_add_dev+0xaf3/0xe90 [null_blk] nullb_device_power_store+0x1b6/0x270 [null_blk] configfs_write_file+0x1c4/0x250 [configfs] __vfs_write+0x4c/0x90 vfs_write+0x145/0x2c0 ksys_write+0xd7/0x180 __x64_sys_write+0x47/0x50 do_syscall_64+0x6f/0x2f0 entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- drivers/block/null_blk_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/block/null_blk_main.c +1 -0
@@ -1788,6 +1788,7 @@ out_cleanup_queues:cleanup_queues (nullb); out_free_nullb:kfree (nullb); + dev->nullb =NULL ; out:return rv; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 18/254 blk-mq: Fix a recently introduced regression in blk_mq_realloc_hw_ctxs()
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit d0930bb8f46b8fb4a7d429c0bf1c91b3ed00a7cf ]
q->nr_hw_queues must only be updated once it is known that blk_mq_realloc_hw_ctxs() has succeeded. Otherwise it can happen that reallocation fails and that q->nr_hw_queues is larger than the number of allocated hardware queues. This patch fixes the following crash if increasing the number of hardware queues fails:
BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0x775/0x810 Write of size 8 at addr 0000000000000118 by task check/977 CPU: 3 PID: 977 Comm: check Not tainted 5.6.0-rc1-dbg+ #8 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack+0xa5/0xe6 __kasan_report.cold+0x65/0x99 kasan_report+0x16/0x20 check_memory_region+0x140/0x1b0 memset+0x28/0x40 blk_mq_map_swqueue+0x775/0x810 blk_mq_update_nr_hw_queues+0x468/0x710 nullb_device_submit_queues_store+0xf7/0x1a0 [null_blk] configfs_write_file+0x1c4/0x250 [configfs] __vfs_write+0x4c/0x90 vfs_write+0x145/0x2c0 ksys_write+0xd7/0x180 __x64_sys_write+0x47/0x50 do_syscall_64+0x6f/0x2f0 entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- block/blk-mq.c | 1 - 1 file changed, 1 deletion(-)
block/blk-mq.c +0 -1
@@ -2824,7 +2824,6 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,memcpy (new_hctxs, hctxs, q->nr_hw_queues *sizeof (*hctxs)); q->queue_hw_ctx = new_hctxs; - q->nr_hw_queues = set->nr_hw_queues;kfree (hctxs); hctxs = new_hctxs; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 19/254 null_blk: Handle null_add_dev() failures properly
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 9b03b713082a31a5b90e0a893c72aa620e255c26 ]
If null_add_dev() fails then null_del_dev() is called with a NULL argument. Make null_del_dev() handle this scenario correctly. This patch fixes the following KASAN complaint:
null-ptr-deref in null_del_dev+0x28/0x280 [null_blk]
Read of size 8 at addr 0000000000000000 by task find/1062 Call Trace: dump_stack+0xa5/0xe6 __kasan_report.cold+0x65/0x99 kasan_report+0x16/0x20 __asan_load8+0x58/0x90 null_del_dev+0x28/0x280 [null_blk] nullb_group_drop_item+0x7e/0xa0 [null_blk] client_drop_item+0x53/0x80 [configfs] configfs_rmdir+0x395/0x4e0 [configfs] vfs_rmdir+0xb6/0x220 do_rmdir+0x238/0x2c0 __x64_sys_unlinkat+0x75/0x90 do_syscall_64+0x6f/0x2f0 entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- drivers/block/null_blk_main.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/block/null_blk_main.c +6 -1
@@ -1432,7 +1432,12 @@ static void cleanup_queues(struct nullb *nullb)static void null_del_dev (struct nullb *nullb) { -struct nullb_device *dev = nullb->dev; +struct nullb_device *dev; + +if (!nullb) +return ; + + dev = nullb->dev;ida_simple_remove (&nullb_indexes, nullb->index);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 20/254 null_blk: Suppress an UBSAN complaint triggered when setting memory_backed
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit b9853b4d6fb403ccb1d4d82e2d39fc17fc07519c ]
Although it is not clear to me why UBSAN complains when 'memory_backed' is set, this patch suppresses the UBSAN complaint that is triggered when setting that configfs attribute.
UBSAN: Undefined behaviour in drivers/block/null_blk_main.c:327:1 load of value 16 is not a valid value for type '_Bool' CPU: 2 PID: 8396 Comm: check Not tainted 5.6.0-rc1-dbg+ #14 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack+0xa5/0xe6 ubsan_epilogue+0x9/0x26 __ubsan_handle_load_invalid_value+0x6d/0x76 nullb_device_memory_backed_store.cold+0x2c/0x38 [null_blk] configfs_write_file+0x1c4/0x250 [configfs] __vfs_write+0x4c/0x90 vfs_write+0x145/0x2c0 ksys_write+0xd7/0x180 __x64_sys_write+0x47/0x50 do_syscall_64+0x6f/0x2f0 entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- drivers/block/null_blk_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/null_blk_main.c +1 -1
@@ -276,7 +276,7 @@ nullb_device_##NAME##_store(struct config_item *item, const char *page, \ { \int (*apply_fn)(struct nullb_device *dev,TYPE new_value) =APPLY ;\struct nullb_device *dev =to_nullb_device (item); \ -TYPE uninitialized_var (new_value ); \ +TYPE new_value =0 ; \int ret; \ \ ret = nullb_device_##TYPE##_attr_store(&new_value, page, count);\
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 21/254 null_blk: fix spurious IO errors after failed past-wp access
In reply to Greg Kroah-HartmanFrom: Alexey Dobriyan <[email protected]>
[ Upstream commit ff77042296d0a54535ddf74412c5ae92cb4ec76a ]
Steps to reproduce:
BLKRESETZONE zone 0 // force EIO pwrite(fd, buf, 4096, 4096); [issue more IO including zone ioctls]
It will start failing randomly including IO to unrelated zones because of ->error "reuse". Trigger can be partition detection as well if test is not run immediately which is even more entertaining.
The fix is of course to clear ->error where necessary.
--- drivers/block/null_blk_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/block/null_blk_main.c +2 -0
@@ -605,6 +605,7 @@ static struct nullb_cmd *__alloc_cmd(struct nullb_queue *nq)if (tag !=-1U ) { cmd = &nq->cmds[tag]; cmd->tag = tag; + cmd->error =BLK_STS_OK ; cmd->nq = nq;if (nq->dev->irqmode ==NULL_IRQ_TIMER ) { hrtimer_init(&cmd->timer, CLOCK_MONOTONIC,
@@ -1385,6 +1386,7 @@ static blk_status_t null_queue_rq(struct blk_mq_hw_ctx *hctx, cmd->timer.function = null_cmd_timer_expired; } cmd->rq = bd->rq; + cmd->error =BLK_STS_OK ; cmd->nq = nq;blk_mq_start_request (bd->rq);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 22/254 media: imx: imx7_mipi_csis: Power off the source when stopping streaming
In reply to Greg Kroah-HartmanFrom: Laurent Pinchart <[email protected]>
[ Upstream commit 770cbf89f90b0663499dbb3f03aa81b3322757ec ]
The .s_stream() implementation incorrectly powers on the source when stopping the stream. Power it off instead.
--- drivers/staging/media/imx/imx7-mipi-csis.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/media/imx/imx7-mipi-csis.c +1 -1
@@ -577,7 +577,7 @@ static int mipi_csis_s_stream(struct v4l2_subdev *mipi_sd, int enable) state->flags |=ST_STREAMING ; }else {v4l2_subdev_call (state->src_sd, video, s_stream,0 ); - ret =v4l2_subdev_call (state->src_sd, core, s_power,1 ); + ret =v4l2_subdev_call (state->src_sd, core, s_power,0 );mipi_csis_stop_stream (state); state->flags &= ~ST_STREAMING ;if (state->debug)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 23/254 media: imx: imx7-media-csi: Fix video field handling
In reply to Greg Kroah-HartmanFrom: Laurent Pinchart <[email protected]>
[ Upstream commit f7b8488bd39ae8feced4dfbb41cf1431277b893f ]
Commit 4791bd7d6adc ("media: imx: Try colorimetry at both sink and source pads") reworked the way that formats are set on the sink pad of the CSI subdevice, and accidentally removed video field handling. Restore it by defaulting to V4L2_FIELD_NONE if the field value isn't supported, with the only two supported value being V4L2_FIELD_NONE and V4L2_FIELD_INTERLACED.
--- drivers/staging/media/imx/imx7-media-csi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/staging/media/imx/imx7-media-csi.c +4 -0
@@ -1009,6 +1009,7 @@ static int imx7_csi_try_fmt(struct imx7_csi *csi, sdformat->format.width = in_fmt->width; sdformat->format.height = in_fmt->height; sdformat->format.code = in_fmt->code; + sdformat->format.field = in_fmt->field; *cc = in_cc; sdformat->format.colorspace = in_fmt->colorspace;
@@ -1023,6 +1024,9 @@ static int imx7_csi_try_fmt(struct imx7_csi *csi, false); sdformat->format.code = (*cc)->codes[0 ]; } + +if (sdformat->format.field !=V4L2_FIELD_INTERLACED ) + sdformat->format.field =V4L2_FIELD_NONE ;break ;default :return -EINVAL ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 24/254 xhci: bail out early if driver cant accress host in resume
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
[ Upstream commit 72ae194704da212e2ec312ab182a96799d070755 ]
Bail out early if the xHC host needs to be reset at resume but driver can't access xHC PCI registers.
If xhci driver already fails to reset the controller then there is no point in attempting to free, re-initialize, re-allocate and re-start the host. If failure to access the host is detected later, failing the resume, xhci interrupts will be double freed when remove is called.
--- drivers/usb/host/xhci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/xhci.c +3 -1
@@ -1157,8 +1157,10 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)xhci_dbg (xhci,"Stop HCD\n" );xhci_halt (xhci);xhci_zero_64b_regs (xhci); -xhci_reset (xhci); + retval =xhci_reset (xhci);spin_unlock_irq (&xhci->lock); +if (retval) +return retval;xhci_cleanup_msix (xhci);xhci_dbg (xhci,"// Disabling event ring interrupts\n" );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 25/254 ACPI: EC: Do not clear boot_ec_is_ecdt in acpi_ec_add()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit 65a691f5f8f0bb63d6a82eec7b0ffd193d8d8a5f ]
The reason for clearing boot_ec_is_ecdt in acpi_ec_add() (if a PNP0C09 device object matching the ECDT boot EC had been found in the namespace) was to cause acpi_ec_ecdt_start() to return early, but since the latter does not look at boot_ec_is_ecdt any more, acpi_ec_add() need not clear it.
Moreover, doing that may be confusing as it may cause "DSDT" to be printed instead of "ECDT" in the EC initialization completion message, so stop doing it.
While at it, split the EC initialization completion message into two messages, one regarding the boot EC and another one printed regardless of whether or not the EC at hand is the boot one.
--- drivers/acpi/ec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/acpi/ec.c +4 -2
@@ -1641,7 +1641,6 @@ static int acpi_ec_add(struct acpi_device *device)if (boot_ec && ec->command_addr == boot_ec->command_addr && ec->data_addr == boot_ec->data_addr) { - boot_ec_is_ecdt = false;/* * Trust PNP0C09 namespace location rather than * ECDT ID. But trust ECDT GPE rather than _GPE
@@ -1661,9 +1660,12 @@ static int acpi_ec_add(struct acpi_device *device)if (ec == boot_ec)acpi_handle_info (boot_ec->handle, -"Boot %s EC used to handle transactions and events\n" , +"Boot %s EC initialization complete\n" , boot_ec_is_ecdt ?"ECDT" :"DSDT" ); +acpi_handle_info (ec->handle, +"EC: Used to handle transactions and events\n" ); + device->driver_data = ec; ret = !!request_region (ec->data_addr,1 ,"EC data" );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 26/254 clocksource/drivers/timer-microchip-pit64b: Fix rate for gck
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit 0585244523f0f4de7e4480375e871617a79cab98 ]
Generic clock rate needs to be set in case it was selected as timer clock source in mchp_pit64b_init_mode(). Otherwise it will be enabled with wrong rate.
--- drivers/clocksource/timer-microchip-pit64b.c | 1 + 1 file changed, 1 insertion(+)
drivers/clocksource/timer-microchip-pit64b.c +1 -0
@@ -264,6 +264,7 @@ static int __init mchp_pit64b_init_mode(struct mchp_pit64b_timer *timer,if (!best_diff) { timer->mode |=MCHP_PIT64B_MR_SGCLK ; +clk_set_rate (timer->gclk, gclk_round); goto done; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 27/254 x86: Dont let pgprot_modify() change the page encryption bit
In reply to Greg Kroah-HartmanFrom: Thomas Hellstrom <[email protected]>
[ Upstream commit 6db73f17c5f155dbcfd5e48e621c706270b84df0 ]
When SEV or SME is enabled and active, vm_get_page_prot() typically returns with the encryption bit set. This means that users of pgprot_modify(, vm_get_page_prot()) (mprotect_fixup(), do_mmap()) end up with a value of vma->vm_pg_prot that is not consistent with the intended protection of the PTEs.
This is also important for fault handlers that rely on the VMA vm_page_prot to set the page protection. Fix this by not allowing pgprot_modify() to change the encryption bit, similar to how it's done for PAT bits.
--- arch/x86/include/asm/pgtable.h | 7 +++++-- arch/x86/include/asm/pgtable_types.h | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-)
arch/x86/include/asm/pgtable.h +5 -2
@@ -627,12 +627,15 @@ static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)return __pmd (val); } -/* mprotect needs to preserve PAT bits when updating vm_page_prot */ +/* +* mprotect needs to preserve PAT and encryption bits when updating +* vm_page_prot +*/ #define pgprot_modify pgprot_modifystatic inline pgprot_t pgprot_modify (pgprot_t oldprot,pgprot_t newprot) {pgprotval_t preservebits =pgprot_val (oldprot) & _PAGE_CHG_MASK; -pgprotval_t addbits =pgprot_val (newprot); +pgprotval_t addbits =pgprot_val (newprot) & ~_PAGE_CHG_MASK;return __pgprot (preservebits | addbits); }
arch/x86/include/asm/pgtable_types.h +1 -1
@@ -118,7 +118,7 @@*/ #define _PAGE_CHG_MASK (PTE_PFN_MASK | _PAGE_PCD | _PAGE_PWT | \ _PAGE_SPECIAL | _PAGE_ACCESSED | _PAGE_DIRTY | \ - _PAGE_SOFT_DIRTY | _PAGE_DEVMAP) + _PAGE_SOFT_DIRTY | _PAGE_DEVMAP | _PAGE_ENC)#define _HPAGE_CHG_MASK (_PAGE_CHG_MASK | _PAGE_PSE)/*
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 28/254 dma-mapping: Fix dma_pgprot() for unencrypted coherent pages
In reply to Greg Kroah-HartmanFrom: Thomas Hellstrom <[email protected]>
[ Upstream commit 17c4a2ae15a7aaefe84bdb271952678c5c9cd8e1 ]
When dma_mmap_coherent() sets up a mapping to unencrypted coherent memory under SEV encryption and sometimes under SME encryption, it will actually set up an encrypted mapping rather than an unencrypted, causing devices that DMAs from that memory to read encrypted contents. Fix this.
When force_dma_unencrypted() returns true, the linear kernel map of the coherent pages have had the encryption bit explicitly cleared and the page content is unencrypted. Make sure that any additional PTEs we set up to these pages also have the encryption bit cleared by having dma_pgprot() return a protection with the encryption bit cleared in this case.
--- kernel/dma/mapping.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/dma/mapping.c +2 -0
@@ -154,6 +154,8 @@ EXPORT_SYMBOL(dma_get_sgtable_attrs);*/ pgprot_t dma_pgprot (struct device *dev,pgprot_t prot,unsigned long attrs) { +if (force_dma_unencrypted (dev)) + prot =pgprot_decrypted (prot);if (dev_is_dma_coherent (dev) || (IS_ENABLED (CONFIG_DMA_NONCOHERENT_CACHE_SYNC ) && (attrs &DMA_ATTR_NON_CONSISTENT )))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 29/254 block: keep bdi->io_pages in sync with max_sectors_kb for stacked devices
In reply to Greg Kroah-HartmanFrom: Konstantin Khlebnikov <[email protected]>
[ Upstream commit e74d93e96d721c4297f2a900ad0191890d2fc2b0 ]
Field bdi->io_pages added in commit 9491ae4aade6 ("mm: don't cap request size based on read-ahead setting") removes unneeded split of read requests.
Stacked drivers do not call blk_queue_max_hw_sectors(). Instead they set limits of their devices by blk_set_stacking_limits() + disk_stack_limits(). Field bio->io_pages stays zero until user set max_sectors_kb via sysfs.
This patch updates io_pages after merging limits in disk_stack_limits().
Commit c6d6e9b0f6b4 ("dm: do not allow readahead to limit IO size") fixed the same problem for device-mapper devices, this one fixes MD RAIDs.
--- block/blk-settings.c | 3 +++ 1 file changed, 3 insertions(+)
block/blk-settings.c +3 -0
@@ -664,6 +664,9 @@ void disk_stack_limits(struct gendisk *disk, struct block_device *bdev,printk (KERN_NOTICE "%s: Warning: Device %s is misaligned\n" , top, bottom); } + + t->backing_dev_info->io_pages = + t->limits.max_sectors >> (PAGE_SHIFT -9 ); }EXPORT_SYMBOL (disk_stack_limits);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 30/254 debugfs: Check module state before warning in {full/open}_proxy_open()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 275678e7a9be6a0ea9c1bb493e48abf2f4a01be5 ]
When the module is being removed, the module state is set to MODULE_STATE_GOING. At this point, try_module_get() fails. And when {full/open}_proxy_open() is being called,
it calls try_module_get() to try to hold module reference count. If it fails, it warns about the possibility of debugfs file leak.
If {full/open}_proxy_open() is called while the module is being removed, it fails to hold the module.
So, It warns about debugfs file leak. But it is not the debugfs file leak case. So, this patch just adds module state checking routine in the {full/open}_proxy_open().
Test commands:
#SHELL1
while :
do
modprobe netdevsim
echo 1 > /sys/bus/netdevsim/new_device
modprobe -rv netdevsim
done
#SHELL2
while :
do
cat /sys/kernel/debug/netdevsim/netdevsim1/ports/0/ipsec
done
Splat looks like:
[ 298.766738][T14664] debugfs file owner did not clean up at exit: ipsec [ 298.766766][T14664] WARNING: CPU: 2 PID: 14664 at fs/debugfs/file.c:312 full_proxy_open+0x10f/0x650 [ 298.768595][T14664] Modules linked in: netdevsim(-) openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 n][ 298.771343][T14664] CPU: 2 PID: 14664 Comm: cat Tainted: G W 5.5.0+ #1 [ 298.772373][T14664] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 298.773545][T14664] RIP: 0010:full_proxy_open+0x10f/0x650 [ 298.774247][T14664] Code: 48 c1 ea 03 80 3c 02 00 0f 85 c1 04 00 00 49 8b 3c 24 e8 e4 b5 78 ff 84 c0 75 2d 4c 89 ee 48 [ 298.776782][T14664] RSP: 0018:ffff88805b7df9b8 EFLAGS: 00010282[ 298.777583][T14664] RAX: dffffc0000000008 RBX: ffff8880511725c0 RCX: 0000000000000000 [ 298.778610][T14664] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffff8880540c5c14 [ 298.779637][T14664] RBP: 0000000000000000 R08: fffffbfff15235ad R09: 0000000000000000 [ 298.780664][T14664] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffffc06b5000 [ 298.781702][T14664] R13: ffff88804c234a88 R14: ffff88804c22dd00 R15: ffffffff8a1b5660 [ 298.782722][T14664] FS: 00007fafa13a8540(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000 [ 298.783845][T14664] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 298.784672][T14664] CR2: 00007fafa0e9cd10 CR3: 000000004b286005 CR4: 00000000000606e0 [ 298.785739][T14664] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 298.786769][T14664] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 298.787785][T14664] Call Trace: [ 298.788237][T14664] do_dentry_open+0x63c/0xf50 [ 298.788872][T14664] ? open_proxy_open+0x270/0x270 [ 298.789524][T14664] ? __x64_sys_fchdir+0x180/0x180 [ 298.790169][T14664] ? inode_permission+0x65/0x390 [ 298.790832][T14664] path_openat+0xc45/0x2680 [ 298.791425][T14664] ? save_stack+0x69/0x80 [ 298.791988][T14664] ? save_stack+0x19/0x80 [ 298.792544][T14664] ? path_mountpoint+0x2e0/0x2e0 [ 298.793233][T14664] ? check_chain_key+0x236/0x5d0 [ 298.793910][T14664] ? sched_clock_cpu+0x18/0x170 [ 298.794527][T14664] ? find_held_lock+0x39/0x1d0 [ 298.795153][T14664] do_filp_open+0x16a/0x260
[ ... ]
--- fs/debugfs/file.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
fs/debugfs/file.c +14 -4
@@ -175,8 +175,13 @@ static int open_proxy_open(struct inode *inode, struct file *filp)if (r) goto out; - real_fops =fops_get (real_fops); -if (!real_fops) { +if (!fops_get (real_fops)) { +#ifdef MODULE +if (real_fops->owner && + real_fops->owner->state ==MODULE_STATE_GOING ) + goto out; +#endif +/* Huh? Module did not clean up after itself at exit? */ WARN (1 ,"debugfs file owner did not clean up at exit: %pd" , dentry);
@@ -305,8 +310,13 @@ static int full_proxy_open(struct inode *inode, struct file *filp)if (r) goto out; - real_fops =fops_get (real_fops); -if (!real_fops) { +if (!fops_get (real_fops)) { +#ifdef MODULE +if (real_fops->owner && + real_fops->owner->state ==MODULE_STATE_GOING ) + goto out; +#endif +/* Huh? Module did not cleanup after itself at exit? */ WARN (1 ,"debugfs file owner did not clean up at exit: %pd" , dentry);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 31/254 spi: spi-fsl-dspi: Avoid NULL pointer in dspi_slave_abort for non-DMA mode
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 3d6224e63be39ff26cf416492cb3923cd3d07dd0 ]
The driver does not create the dspi->dma structure unless operating in DSPI_DMA_MODE, so it makes sense to check for that.
--- drivers/spi/spi-fsl-dspi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/spi/spi-fsl-dspi.c +4 -2
@@ -1021,8 +1021,10 @@ static int dspi_slave_abort(struct spi_master *master)* Terminate all pending DMA transactions for the SPI working * in SLAVE mode. */ -dmaengine_terminate_sync (dspi->dma->chan_rx); -dmaengine_terminate_sync (dspi->dma->chan_tx); +if (dspi->devtype_data->trans_mode ==DSPI_DMA_MODE ) { +dmaengine_terminate_sync (dspi->dma->chan_rx); +dmaengine_terminate_sync (dspi->dma->chan_tx); + }/* Clear the internal DSPI RX and TX FIFO buffers */ regmap_update_bits(dspi->regmap, SPI_MCR,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 32/254 irqchip/versatile-fpga: Handle chained IRQs properly
In reply to Greg Kroah-HartmanFrom: Sungbo Eo <[email protected]>
[ Upstream commit 486562da598c59e9f835b551d7cf19507de2d681 ]
Enclose the chained handler with chained_irq_{enter,exit}(), so that the muxed interrupts get properly acked.
This patch also fixes a reboot bug on OX820 SoC, where the jiffies timer interrupt is never acked. The kernel waits a clock tick forever in calibrate_delay_converge(), which leads to a boot hang.
--- drivers/irqchip/irq-versatile-fpga.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/irqchip/irq-versatile-fpga.c +10 -2
@@ -6,6 +6,7 @@#include <linux/irq.h> #include <linux/io.h> #include <linux/irqchip.h> +#include <linux/irqchip/chained_irq.h> #include <linux/irqchip/versatile-fpga.h> #include <linux/irqdomain.h> #include <linux/module.h>
@@ -68,12 +69,16 @@ static void fpga_irq_unmask(struct irq_data *d)static void fpga_irq_handle (struct irq_desc *desc) { +struct irq_chip *chip =irq_desc_get_chip (desc);struct fpga_irq_data *f =irq_desc_get_handler_data (desc); -u32 status =readl (f->base +IRQ_STATUS ); +u32 status; + +chained_irq_enter (chip, desc); + status =readl (f->base +IRQ_STATUS );if (status ==0 ) {do_bad_IRQ (desc); -return ; + goto out; } do {
@@ -82,6 +87,9 @@ static void fpga_irq_handle(struct irq_desc *desc) status &= ~(1 << irq);generic_handle_irq (irq_find_mapping (f->domain, irq)); }while (status); + +out: +chained_irq_exit (chip, desc); }/*
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 33/254 time/sched_clock: Expire timer in hardirq context
In reply to Greg Kroah-HartmanFrom: Ahmed S. Darwish <[email protected]>
[ Upstream commit 2c8bd58812ee3dbf0d78b566822f7eacd34bdd7b ]
To minimize latency, PREEMPT_RT kernels expires hrtimers in preemptible softirq context by default. This can be overriden by marking the timer's expiry with HRTIMER_MODE_HARD.
sched_clock_timer is missing this annotation: if its callback is preempted and the duration of the preemption exceeds the wrap around time of the underlying clocksource, sched clock will get out of sync.
Mark the sched_clock_timer for expiry in hard interrupt context.
--- kernel/time/sched_clock.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
kernel/time/sched_clock.c +5 -4
@@ -208,7 +208,8 @@ sched_clock_register(u64 (*read)(void), int bits, unsigned long rate)if (sched_clock_timer.function !=NULL ) {/* update timeout for clock wrap */ -hrtimer_start (&sched_clock_timer, cd.wrap_kt,HRTIMER_MODE_REL ); +hrtimer_start (&sched_clock_timer, cd.wrap_kt, +HRTIMER_MODE_REL_HARD ); } r = rate;
@@ -254,9 +255,9 @@ void __init generic_sched_clock_init(void)* Start the timer to keep sched_clock() properly updated and * sets the initial epoch. */ -hrtimer_init (&sched_clock_timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL ); +hrtimer_init (&sched_clock_timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_HARD ); sched_clock_timer.function = sched_clock_poll; -hrtimer_start (&sched_clock_timer, cd.wrap_kt,HRTIMER_MODE_REL ); +hrtimer_start (&sched_clock_timer, cd.wrap_kt,HRTIMER_MODE_REL_HARD ); }/*
@@ -293,7 +294,7 @@ void sched_clock_resume(void)struct clock_read_data *rd = &cd.read_data[0 ]; rd->epoch_cyc = cd.actual_read_sched_clock (); -hrtimer_start (&sched_clock_timer, cd.wrap_kt,HRTIMER_MODE_REL ); +hrtimer_start (&sched_clock_timer, cd.wrap_kt,HRTIMER_MODE_REL_HARD ); rd->read_sched_clock = cd.actual_read_sched_clock; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 34/254 irqchip/gic-v4.1: Skip absent CPUs while iterating over redistributors
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
[ Upstream commit 28d160de5194c68ff534443d2a8b6f1d10d57c58 ]
In a system that is only sparsly populated with CPUs, we can end-up with redistributors structures that are not initialized. Let's make sure we don't try and access those when iterating over them (in this case when checking we have a L2 VPE table).
--- drivers/irqchip/irq-gic-v3-its.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/irqchip/irq-gic-v3-its.c +4 -0
@@ -2452,6 +2452,10 @@ static bool allocate_vpe_l2_table(int cpu, u32 id)if (!gic_rdists->has_rvpeid)return true; +/* Skip non-present CPUs */ +if (!base) +return true; + val =gicr_read_vpropbaser (base +SZ_128K +GICR_VPROPBASER ); esz =FIELD_GET (GICR_VPROPBASER_4_1_ENTRY_SIZE , val) +1 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 35/254 media: allegro: fix type of gop_length in channel_create message
In reply to Greg Kroah-HartmanFrom: Michael Tretter <[email protected]>
[ Upstream commit 8277815349327b8e65226eb58ddb680f90c2c0c0 ]
The gop_length field is actually only u16 and there are two more u8 fields in the message:
- the number of consecutive b-frames
- frequency of golden frames
Fix the message and thus fix the configuration of the GOP length.
--- drivers/staging/media/allegro-dvt/allegro-core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/staging/media/allegro-dvt/allegro-core.c +4 -1
@@ -393,7 +393,10 @@ struct mcu_msg_create_channel {u32 freq_ird;u32 freq_lt;u32 gdr_mode; -u32 gop_length; +u16 gop_length; +u8 num_b; +u8 freq_golden_ref; +u32 unknown39;u32 subframe_latency;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 36/254 sched: Avoid scale real weight down to zero
In reply to Greg Kroah-HartmanFrom: Michael Wang <[email protected]>
[ Upstream commit 26cf52229efc87e2effa9d788f9b33c40fb3358a ]
During our testing, we found a case that shares no longer working correctly, the cgroup topology is like:
/sys/fs/cgroup/cpu/A (shares=102400)
/sys/fs/cgroup/cpu/A/B (shares=2)
/sys/fs/cgroup/cpu/A/B/C (shares=1024)
/sys/fs/cgroup/cpu/D (shares=1024)
/sys/fs/cgroup/cpu/D/E (shares=1024)
/sys/fs/cgroup/cpu/D/E/F (shares=1024)
The same benchmark is running in group C & F, no other tasks are running, the benchmark is capable to consumed all the CPUs.
We suppose the group C will win more CPU resources since it could enjoy all the shares of group A, but it's F who wins much more.
The reason is because we have group B with shares as 2, since A->cfs_rq.load.weight == B->se.load.weight == B->shares/nr_cpus, so A->cfs_rq.load.weight become very small.
And in calc_group_shares() we calculate shares as:
load = max(scale_load_down(cfs_rq->load.weight), cfs_rq->avg.load_avg); shares = (tg_shares * load) / tg_weight;
Since the 'cfs_rq->load.weight' is too small, the load become 0 after scale down, although 'tg_shares' is 102400, shares of the se which stand for group A on root cfs_rq become 2.
While the se of D on root cfs_rq is far more bigger than 2, so it wins the battle.
Thus when scale_load_down() scale real weight down to 0, it's no longer telling the real story, the caller will have the wrong information and the calculation will be buggy.
This patch add check in scale_load_down(), so the real weight will be >= MIN_SHARES after scale, after applied the group C wins as expected.
--- kernel/sched/sched.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
kernel/sched/sched.h +7 -1
@@ -118,7 +118,13 @@ extern long calc_load_fold_active(struct rq *this_rq, long adjust);#ifdef CONFIG_64BIT # define NICE_0_LOAD_SHIFT (SCHED_FIXEDPOINT_SHIFT + SCHED_FIXEDPOINT_SHIFT)# define scale_load (w) ((w) << SCHED_FIXEDPOINT_SHIFT) -# define scale_load_down (w) ((w) >> SCHED_FIXEDPOINT_SHIFT) +# define scale_load_down (w) \ +({ \ + unsigned long __w = (w); \ + if (__w) \ + __w = max(2UL, __w >> SCHED_FIXEDPOINT_SHIFT); \ + __w; \ +})#else # define NICE_0_LOAD_SHIFT (SCHED_FIXEDPOINT_SHIFT)# define scale_load (w) (w)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 37/254 sched/fair: Fix condition of avg_load calculation
In reply to Greg Kroah-HartmanFrom: Tao Zhou <[email protected]>
[ Upstream commit 6c8116c914b65be5e4d6f66d69c8142eb0648c22 ]
In update_sg_wakeup_stats(), the comment says:
Computing avg_load makes sense only when group is fully busy or overloaded.
But, the code below this comment does not check like this.
Quoted 1 line
From reading the code about
avg_loadin other functions, I
confirm that avg_load should be calculated in fully busy or overloaded case. The comment is correct and the checking condition is wrong. So, change that condition.
--- kernel/sched/fair.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/sched/fair.c +2 -1
@@ -8345,7 +8345,8 @@ static inline void update_sg_wakeup_stats(struct sched_domain *sd,* Computing avg_load makes sense only when group is fully busy or * overloaded */ -if (sgs->group_type < group_fully_busy) +if (sgs->group_type == group_fully_busy || + sgs->group_type == group_overloaded) sgs->avg_load = (sgs->group_load *SCHED_CAPACITY_SCALE ) / sgs->group_capacity; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 38/254 selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault
In reply to Greg Kroah-HartmanFrom: Andy Lutomirski <[email protected]>
[ Upstream commit 630b99ab60aa972052a4202a1ff96c7e45eb0054 ]
If AT_SYSINFO is not present, don't try to call a NULL pointer.
--- tools/testing/selftests/x86/ptrace_syscall.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
tools/testing/selftests/x86/ptrace_syscall.c +6 -2
@@ -414,8 +414,12 @@ int main()#if defined(__i386__) && (!defined(__GLIBC__) || __GLIBC__ >2 || __GLIBC_MINOR__ >=16 ) vsyscall32 = (void *)getauxval (AT_SYSINFO ); -printf ("[RUN]\tCheck AT_SYSINFO return regs\n" ); -test_sys32_regs (do_full_vsyscall32); +if (vsyscall32) { +printf ("[RUN]\tCheck AT_SYSINFO return regs\n" ); +test_sys32_regs (do_full_vsyscall32); + }else { +printf ("[SKIP]\tAT_SYSINFO is not available\n" ); + }#endif test_ptrace_syscall_restart ();
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 39/254 PCI/switchtec: Fix init_completion race condition with poll_wait()
In reply to Greg Kroah-HartmanFrom: Logan Gunthorpe <[email protected]>
[ Upstream commit efbdc769601f4d50018bf7ca50fc9f7c67392ece ]
The call to init_completion() in mrpc_queue_cmd() can theoretically race with the call to poll_wait() in switchtec_dev_poll().
poll() write()
switchtec_dev_poll() switchtec_dev_write()
poll_wait(&s->comp.wait); mrpc_queue_cmd()
init_completion(&s->comp)
init_waitqueue_head(&s->comp.wait)To my knowledge, no one has hit this bug.
Fix this by using reinit_completion() instead of init_completion() in mrpc_queue_cmd().
--- drivers/pci/switch/switchtec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/switch/switchtec.c +1 -1
@@ -175,7 +175,7 @@ static int mrpc_queue_cmd(struct switchtec_user *stuser)kref_get (&stuser->kref); stuser->read_len =sizeof (stuser->data);stuser_set_state (stuser,MRPC_QUEUED ); -init_completion (&stuser->comp); +reinit_completion (&stuser->comp);list_add_tail (&stuser->list, &stdev->mrpc_queue);mrpc_cmd_submit (stdev);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 40/254 block, bfq: move forward the getting of an extra ref in bfq_bfqq_move
In reply to Greg Kroah-HartmanFrom: Paolo Valente <[email protected]>
[ Upstream commit fd1bb3ae54a9a2e0c42709de861c69aa146b8955 ]
Commit ecedd3d7e199 ("block, bfq: get extra ref to prevent a queue from being freed during a group move") gets an extra reference to a bfq_queue before possibly deactivating it (temporarily), in bfq_bfqq_move(). This prevents the bfq_queue from disappearing before being reactivated in its new group.
Yet, the bfq_queue may also be expired (i.e., its service may be stopped) before the bfq_queue is deactivated. And also an expiration may lead to a premature freeing. This commit fixes this issue by simply moving forward the getting of the extra reference already introduced by commit ecedd3d7e199 ("block, bfq: get extra ref to prevent a queue from being freed during a group move").
--- block/bfq-cgroup.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
block/bfq-cgroup.c +7 -7
@@ -642,6 +642,12 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq, {struct bfq_entity *entity = &bfqq->entity; +/* +* Get extra reference to prevent bfqq from being freed in +* next possible expire or deactivate. +*/ + bfqq->ref++; +/* If bfqq is empty, then bfq_bfqq_expire also invokes * bfq_del_bfqq_busy, thereby removing bfqq and its entity * from data structures related to current group. Otherwise we
@@ -652,12 +658,6 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,bfq_bfqq_expire (bfqd, bfqd->in_service_queue, false,BFQQE_PREEMPTED ); -/* -* get extra reference to prevent bfqq from being freed in -* next possible deactivate -*/ - bfqq->ref++; -if (bfq_bfqq_busy (bfqq))bfq_deactivate_bfqq (bfqd, bfqq, false, false);else if (entity->on_st_or_in_serv)
@@ -677,7 +677,7 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,if (!bfqd->in_service_queue && !bfqd->rq_in_driver)bfq_schedule_dispatch (bfqd); -/* release extra ref taken above */ +/* release extra ref taken above, bfqq may happen to be freed now */ bfq_put_queue (bfqq); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 41/254 media: i2c: video-i2c: fix build errors due to imply hwmon
In reply to Greg Kroah-HartmanFrom: Matt Ranostay <[email protected]>
[ Upstream commit 64d4fc9926f09861a35d8f0f7d81f056e6d5af7b ]
Fix build fault when CONFIG_HWMON is a module, and CONFIG_VIDEO_I2C as builtin. This is due to 'imply hwmon' in the respective Kconfig.
Issue build log:
ld: drivers/media/i2c/video-i2c.o: in function `amg88xx_hwmon_init':
video-i2c.c:(.text+0x2e1): undefined reference to `devm_hwmon_device_register_with_info
--- drivers/media/i2c/video-i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/video-i2c.c +1 -1
@@ -255,7 +255,7 @@ static int amg88xx_set_power(struct video_i2c_data *data, bool on)return amg88xx_set_power_off (data); } -#if IS_ENABLED (CONFIG_HWMON ) +#if IS_REACHABLE (CONFIG_HWMON )static const u32 amg88xx_temp_config[] = { HWMON_T_INPUT,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 42/254 libata: Remove extra scsi_host_put() in ata_scsi_add_hosts()
In reply to Greg Kroah-HartmanFrom: John Garry <[email protected]>
[ Upstream commit 1d72f7aec3595249dbb83291ccac041a2d676c57 ]
If the call to scsi_add_host_with_dma() in ata_scsi_add_hosts() fails, then we may get use-after-free KASAN warns:
==================================================================
BUG: KASAN: use-after-free in kobject_put+0x24/0x180 Read of size 1 at addr ffff0026b8c80364 by task swapper/0/1 CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 5.6.0-rc3-00004-g5a71b206ea82-dirty #1765 Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDD, BIOS 2280-V2 CS V3.B160.01 02/24/2020 Call trace: dump_backtrace+0x0/0x298 show_stack+0x14/0x20 dump_stack+0x118/0x190 print_address_description.isra.9+0x6c/0x3b8 __kasan_report+0x134/0x23c kasan_report+0xc/0x18 __asan_load1+0x5c/0x68 kobject_put+0x24/0x180 put_device+0x10/0x20 scsi_host_put+0x10/0x18 ata_devres_release+0x74/0xb0 release_nodes+0x2d0/0x470 devres_release_all+0x50/0x78 really_probe+0x2d4/0x560 driver_probe_device+0x7c/0x148 device_driver_attach+0x94/0xa0 __driver_attach+0xa8/0x110 bus_for_each_dev+0xe8/0x158 driver_attach+0x30/0x40 bus_add_driver+0x220/0x2e0 driver_register+0xbc/0x1d0 __pci_register_driver+0xbc/0xd0 ahci_pci_driver_init+0x20/0x28 do_one_initcall+0xf0/0x608 kernel_init_freeable+0x31c/0x384 kernel_init+0x10/0x118 ret_from_fork+0x10/0x18 Allocated by task 5: save_stack+0x28/0xc8 __kasan_kmalloc.isra.8+0xbc/0xd8 kasan_kmalloc+0xc/0x18 __kmalloc+0x1a8/0x280 scsi_host_alloc+0x44/0x678 ata_scsi_add_hosts+0x74/0x268 ata_host_register+0x228/0x488 ahci_host_activate+0x1c4/0x2a8 ahci_init_one+0xd18/0x1298 local_pci_probe+0x74/0xf0 work_for_cpu_fn+0x2c/0x48 process_one_work+0x488/0xc08 worker_thread+0x330/0x5d0 kthread+0x1c8/0x1d0 ret_from_fork+0x10/0x18 Freed by task 5: save_stack+0x28/0xc8 __kasan_slab_free+0x118/0x180 kasan_slab_free+0x10/0x18 slab_free_freelist_hook+0xa4/0x1a0 kfree+0xd4/0x3a0 scsi_host_dev_release+0x100/0x148 device_release+0x7c/0xe0 kobject_put+0xb0/0x180 put_device+0x10/0x20 scsi_host_put+0x10/0x18 ata_scsi_add_hosts+0x210/0x268 ata_host_register+0x228/0x488 ahci_host_activate+0x1c4/0x2a8 ahci_init_one+0xd18/0x1298 local_pci_probe+0x74/0xf0 work_for_cpu_fn+0x2c/0x48 process_one_work+0x488/0xc08 worker_thread+0x330/0x5d0 kthread+0x1c8/0x1d0 ret_from_fork+0x10/0x18
There is also refcount issue, as well:
WARNING: CPU: 1 PID: 1 at lib/refcount.c:28 refcount_warn_saturate+0xf8/0x170
The issue is that we make an erroneous extra call to scsi_host_put() for that host:
So in ahci_init_one()->ata_host_alloc_pinfo()->ata_host_alloc(), we setup a device release method - ata_devres_release() - which intends to release the SCSI hosts:
static void ata_devres_release(struct device *gendev, void *res)
{
...
for (i = 0; i < host->n_ports; i++) {
struct ata_port *ap = host->ports[i];
if (!ap)
continue;
if (ap->scsi_host)
scsi_host_put(ap->scsi_host);
}
...
}However in the ata_scsi_add_hosts() error path, we also call scsi_host_put() for the SCSI hosts.
Fix by removing the the scsi_host_put() calls in ata_scsi_add_hosts() and leave this to ata_devres_release().
--- drivers/ata/libata-scsi.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/ata/libata-scsi.c +3 -6
@@ -4562,22 +4562,19 @@ int ata_scsi_add_hosts(struct ata_host *host, struct scsi_host_template *sht)*/ shost->max_host_blocked =1 ; - rc =scsi_add_host_with_dma (ap->scsi_host, - &ap->tdev, ap->host->dev); + rc =scsi_add_host_with_dma (shost, &ap->tdev, ap->host->dev);if (rc) - goto err_add; + goto err_alloc; }return 0 ; - err_add: -scsi_host_put (host->ports[i]->scsi_host); err_alloc:while (--i >=0 ) {struct Scsi_Host *shost = host->ports[i]->scsi_host; +/* scsi_host_put() is in ata_devres_release() */ scsi_remove_host (shost); -scsi_host_put (shost); }return rc; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 43/254 pstore/platform: fix potential mem leak if pstore_init_fs failed
In reply to Greg Kroah-HartmanFrom: chenqiwu <[email protected]>
[ Upstream commit 8a57d6d4ddfa41c49014e20493152c41a38fcbf8 ]
There is a potential mem leak when pstore_init_fs failed, since the pstore compression maybe unlikey to initialized successfully. We must clean up the allocation once this unlikey issue happens.
--- fs/pstore/platform.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/pstore/platform.c +2 -2
@@ -823,9 +823,9 @@ static int __init pstore_init(void) ret =pstore_init_fs ();if (ret) -return ret; +free_buf_for_compression (); -return 0 ; +return ret; }late_initcall (pstore_init);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 44/254 gfs2: Do log_flush in gfs2_ail_empty_gl even if ail list is empty
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit 9ff78289356af640941bbb0dd3f46af2063f0046 ]
Before this patch, if gfs2_ail_empty_gl saw there was nothing on the ail list, it would return and not flush the log. The problem is that there could still be a revoke for the rgrp sitting on the sd_log_le_revoke list that's been recently taken off the ail list. But that revoke still needs to be written, and the rgrp_go_inval still needs to call log_flush_wait to ensure the revokes are all properly written to the journal before we relinquish control of the glock to another node. If we give the glock to another node before we have this knowledge, the node might crash and its journal replayed, in which case the missing revoke would allow the journal replay to replay the rgrp over top of the rgrp we already gave to another node, thus overwriting its changes and corrupting the file system.
This patch makes gfs2_ail_empty_gl still call gfs2_log_flush rather than returning.
--- fs/gfs2/glops.c | 27 ++++++++++++++++++++++++++- fs/gfs2/log.c | 2 +- fs/gfs2/log.h | 1 + 3 files changed, 28 insertions(+), 2 deletions(-)
fs/gfs2/glops.c +26 -1
@@ -89,8 +89,32 @@ static void gfs2_ail_empty_gl(struct gfs2_glock *gl)INIT_LIST_HEAD (&tr.tr_databuf); tr.tr_revokes =atomic_read (&gl->gl_ail_count); -if (!tr.tr_revokes) +if (!tr.tr_revokes) { +bool have_revokes; +bool log_in_flight; + +/* +* We have nothing on the ail, but there could be revokes on +* the sdp revoke queue, in which case, we still want to flush +* the log and wait for it to finish. +* +* If the sdp revoke list is empty too, we might still have an +* io outstanding for writing revokes, so we should wait for +* it before returning. +* +* If none of these conditions are true, our revokes are all +* flushed and we can return. +*/ +gfs2_log_lock (sdp); + have_revokes = !list_empty (&sdp->sd_log_revokes); + log_in_flight =atomic_read (&sdp->sd_log_in_flight); +gfs2_log_unlock (sdp); +if (have_revokes) + goto flush; +if (log_in_flight) +log_flush_wait (sdp);return ; + }/* A shortened, inline version of gfs2_trans_begin() * tr->alloced is not set since the transaction structure is
@@ -105,6 +129,7 @@ static void gfs2_ail_empty_gl(struct gfs2_glock *gl)__gfs2_ail_flush (gl,0 , tr.tr_revokes);gfs2_trans_end (sdp); +flush:gfs2_log_flush (sdp,NULL ,GFS2_LOG_HEAD_FLUSH_NORMAL |GFS2_LFC_AIL_EMPTY_GL ); }
fs/gfs2/log.c +1 -1
@@ -512,7 +512,7 @@ static void log_pull_tail(struct gfs2_sbd *sdp, unsigned int new_tail) } -static void log_flush_wait (struct gfs2_sbd *sdp) +void log_flush_wait (struct gfs2_sbd *sdp) {DEFINE_WAIT (wait);
fs/gfs2/log.h +1 -0
@@ -73,6 +73,7 @@ extern void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 type);extern void gfs2_log_commit (struct gfs2_sbd *sdp,struct gfs2_trans *trans);extern void gfs2_ail1_flush (struct gfs2_sbd *sdp,struct writeback_control *wbc); +extern void log_flush_wait (struct gfs2_sbd *sdp);extern int gfs2_logd (void *data);extern void gfs2_add_revoke (struct gfs2_sbd *sdp,struct gfs2_bufdata *bd);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 45/254 gfs2: Dont demote a glock until its revokes are written
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit df5db5f9ee112e76b5202fbc331f990a0fc316d6 ]
Before this patch, run_queue would demote glocks based on whether there are any more holders. But if the glock has pending revokes that haven't been written to the media, giving up the glock might end in file system corruption if the revokes never get written due to io errors, node crashes and fences, etc. In that case, another node will replay the metadata blocks associated with the glock, but because the revoke was never written, it could replay that block even though the glock had since been granted to another node who might have made changes.
This patch changes the logic in run_queue so that it never demotes a glock until its count of pending revokes reaches zero.
--- fs/gfs2/glock.c | 3 +++ 1 file changed, 3 insertions(+)
fs/gfs2/glock.c +3 -0
@@ -645,6 +645,9 @@ __acquires(&gl->gl_lockref.lock) goto out_unlock;if (nonblock) goto out_sched; +smp_mb (); +if (atomic_read (&gl->gl_revokes) !=0 ) + goto out_sched;set_bit (GLF_DEMOTE_IN_PROGRESS , &gl->gl_flags);GLOCK_BUG_ON (gl, gl->gl_demote_state ==LM_ST_EXCLUSIVE ); gl->gl_target = gl->gl_demote_state;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 46/254 cpufreq: imx6q: fix error handling
In reply to Greg Kroah-HartmanFrom: Peng Fan <[email protected]>
[ Upstream commit 3646f50a3838c5949a89ecbdb868497cdc05b8fd ]
When speed checking failed, direclty jumping to put_node label is not correct. Need jump to out_free_opp to avoid resources leak.
--- drivers/cpufreq/imx6q-cpufreq.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/cpufreq/imx6q-cpufreq.c +5 -4
@@ -381,23 +381,24 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev) goto put_reg; } +/* Because we have added the OPPs here, we must free them */ + free_opp = true; +if (of_machine_is_compatible ("fsl,imx6ul" ) ||of_machine_is_compatible ("fsl,imx6ull" )) { ret =imx6ul_opp_check_speed_grading (cpu_dev);if (ret) {if (ret == -EPROBE_DEFER ) - goto put_node; + goto out_free_opp;dev_err (cpu_dev,"failed to read ocotp: %d\n" , ret); - goto put_node; + goto out_free_opp; } }else {imx6q_opp_check_speed_grading (cpu_dev); } -/* Because we have added the OPPs here, we must free them */ - free_opp = true; num =dev_pm_opp_get_opp_count (cpu_dev);if (num <0 ) { ret = num;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 47/254 x86/boot: Use unsigned comparison for addresses
In reply to Greg Kroah-HartmanFrom: Arvind Sankar <[email protected]>
[ Upstream commit 81a34892c2c7c809f9c4e22c5ac936ae673fb9a2 ]
The load address is compared with LOAD_PHYSICAL_ADDR using a signed comparison currently (using jge instruction).
When loading a 64-bit kernel using the new efi32_pe_entry() point added by:
97aa276579b2 ("efi/x86: Add true mixed mode entry point into .compat section")
using Qemu with -m 3072, the firmware actually loads us above 2Gb, resulting in a very early crash.
Use the JAE instruction to perform a unsigned comparison instead, as physical addresses should be considered unsigned.
--- arch/x86/boot/compressed/head_32.S | 2 +- arch/x86/boot/compressed/head_64.S | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/x86/boot/compressed/head_32.S +1 -1
@@ -106,7 +106,7 @@ SYM_FUNC_START(startup_32) notl %eax andl %eax, %ebx cmpl $LOAD_PHYSICAL_ADDR, %ebx - jge 1f + jae 1f #endif movl $LOAD_PHYSICAL_ADDR, %ebx 1:
arch/x86/boot/compressed/head_64.S +2 -2
@@ -106,7 +106,7 @@ SYM_FUNC_START(startup_32) notl %eax andl %eax, %ebx cmpl $LOAD_PHYSICAL_ADDR, %ebx - jge 1f + jae 1f #endif movl $LOAD_PHYSICAL_ADDR, %ebx 1:
@@ -296,7 +296,7 @@ SYM_CODE_START(startup_64) notq %rax andq %rax, %rbp cmpq $LOAD_PHYSICAL_ADDR, %rbp - jge 1f + jae 1f #endif movq $LOAD_PHYSICAL_ADDR, %rbp 1:
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 48/254 efi/x86: Ignore the memory attributes table on i386
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
[ Upstream commit dd09fad9d2caad2325a39b766ce9e79cfc690184 ]
Commit:
3a6b6c6fb23667fa ("efi: Make EFI_MEMORY_ATTRIBUTES_TABLE initialization common across all architectures")
moved the call to efi_memattr_init() from ARM specific to the generic EFI init code, in order to be able to apply the restricted permissions described in that table on x86 as well.
We never enabled this feature fully on i386, and so mapping and reserving this table is pointless. However, due to the early call to memblock_reserve(), the memory bookkeeping gets confused to the point where it produces the splat below when we try to map the memory later on:
------------[ cut here ]------------ ioremap on RAM at 0x3f251000 - 0x3fa1afff WARNING: CPU: 0 PID: 0 at arch/x86/mm/ioremap.c:166 __ioremap_caller ... Modules linked in: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.20.0 #48 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 EIP: __ioremap_caller.constprop.0+0x249/0x260 Code: 90 0f b7 05 4e 38 40 de 09 45 e0 e9 09 ff ff ff 90 8d 45 ec c6 05 ... EAX: 00000029 EBX: 00000000 ECX: de59c228 EDX: 00000001 ESI: 3f250fff EDI: 00000000 EBP: de3edf20 ESP: de3edee0 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00200296 CR0: 80050033 CR2: ffd17000 CR3: 1e58c000 CR4: 00040690 Call Trace: ioremap_cache+0xd/0x10 ? old_map_region+0x72/0x9d old_map_region+0x72/0x9d efi_map_region+0x8/0xa efi_enter_virtual_mode+0x260/0x43b start_kernel+0x329/0x3aa i386_start_kernel+0xa7/0xab startup_32_smp+0x164/0x168 ---[ end trace e15ccf6b9f356833 ]---
Let's work around this by disregarding the memory attributes table altogether on i386, which does not result in a loss of functionality or protection, given that we never consumed the contents.
--- drivers/firmware/efi/efi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/efi/efi.c +1 -1
@@ -570,7 +570,7 @@ int __init efi_config_parse_tables(void *config_tables, int count, int sz, } } -if (efi_enabled (EFI_MEMMAP )) +if (!IS_ENABLED (CONFIG_X86_32 ) &&efi_enabled (EFI_MEMMAP ))efi_memattr_init ();efi_tpm_eventlog_init ();
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 49/254 genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy()
In reply to Greg Kroah-HartmanFrom: Alexander Sverdlin <[email protected]>
[ Upstream commit 87f2d1c662fa1761359fdf558246f97e484d177a ]
irq_domain_alloc_irqs_hierarchy() has 3 call sites in the compilation unit but only one of them checks for the pointer which is being dereferenced inside the called function. Move the check into the function. This allows for catching the error instead of the following crash:
Unable to handle kernel NULL pointer dereference at virtual address 00000000
PC is at 0x0
LR is at gpiochip_hierarchy_irq_domain_alloc+0x11f/0x140
...
[<c06c23ff>] (gpiochip_hierarchy_irq_domain_alloc) [<c0462a89>] (__irq_domain_alloc_irqs) [<c0462dad>] (irq_create_fwspec_mapping) [<c06c2251>] (gpiochip_to_irq)
[<c06c1c9b>] (gpiod_to_irq)
[<bf973073>] (gpio_irqs_init [gpio_irqs]) [<bf974048>] (gpio_irqs_exit+0xecc/0xe84 [gpio_irqs])
Code: bad PC value
--- kernel/irq/irqdomain.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
kernel/irq/irqdomain.c +5 -5
@@ -1310,6 +1310,11 @@ int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain, unsigned int irq_base, unsigned int nr_irqs, void *arg) { + if (!domain->ops->alloc) { + pr_debug("domain->ops->alloc() is NULL\n"); +return -ENOSYS ; + } +return domain->ops->alloc (domain, irq_base, nr_irqs, arg); }
@@ -1347,11 +1352,6 @@ int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base,return -EINVAL ; } -if (!domain->ops->alloc) { -pr_debug ("domain->ops->alloc() is NULL\n" ); -return -ENOSYS ; - } -if (realloc && irq_base >=0 ) { virq = irq_base; }else {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 50/254 block: Fix use-after-free issue accessing struct io_cq
In reply to Greg Kroah-HartmanFrom: Sahitya Tummala <[email protected]>
[ Upstream commit 30a2da7b7e225ef6c87a660419ea04d3cef3f6a7 ]
There is a potential race between ioc_release_fn() and ioc_clear_queue() as shown below, due to which below kernel crash is observed. It also can result into use-after-free issue.
context#1: context#2:ioc_release_fn() __ioc_clear_queue() gets the same icq
->spin_lock(&ioc->lock); ->spin_lock(&ioc->lock);
->ioc_destroy_icq(icq);
->list_del_init(&icq->q_node);
->call_rcu(&icq->__rcu_head,
icq_free_icq_rcu);
->spin_unlock(&ioc->lock); ->ioc_destroy_icq(icq); ->hlist_del_init(&icq->ioc_node); This results into below crash as this memory is now used by icq->__rcu_head in context#1. There is a chance that icq could be free'd as well.
22150.386550: <6> Unable to handle kernel write to read-only memory
at virtual address ffffffaa8d31ca50
...
Call trace: 22150.607350: <2> ioc_destroy_icq+0x44/0x110 22150.611202: <2> ioc_clear_queue+0xac/0x148 22150.615056: <2> blk_cleanup_queue+0x11c/0x1a0 22150.619174: <2> __scsi_remove_device+0xdc/0x128 22150.623465: <2> scsi_forget_host+0x2c/0x78 22150.627315: <2> scsi_remove_host+0x7c/0x2a0 22150.631257: <2> usb_stor_disconnect+0x74/0xc8 22150.635371: <2> usb_unbind_interface+0xc8/0x278 22150.639665: <2> device_release_driver_internal+0x198/0x250 22150.644897: <2> device_release_driver+0x24/0x30 22150.649176: <2> bus_remove_device+0xec/0x140 22150.653204: <2> device_del+0x270/0x460 22150.656712: <2> usb_disable_device+0x120/0x390 22150.660918: <2> usb_disconnect+0xf4/0x2e0 22150.664684: <2> hub_event+0xd70/0x17e8 22150.668197: <2> process_one_work+0x210/0x480 22150.672222: <2> worker_thread+0x32c/0x4c8
Fix this by adding a new ICQ_DESTROYED flag in ioc_destroy_icq() to indicate this icq is once marked as destroyed. Also, ensure __ioc_clear_queue() is accessing icq within rcu_read_lock/unlock so that icq doesn't get free'd up while it is still using it.
--- block/blk-ioc.c | 7 +++++++ include/linux/iocontext.h | 1 + 2 files changed, 8 insertions(+)
block/blk-ioc.c +7 -0
@@ -84,6 +84,7 @@ static void ioc_destroy_icq(struct io_cq *icq)* making it impossible to determine icq_cache. Record it in @icq. */ icq->__rcu_icq_cache = et->icq_cache; + icq->flags |=ICQ_DESTROYED ;call_rcu (&icq->__rcu_head, icq_free_icq_rcu); }
@@ -212,15 +213,21 @@ static void __ioc_clear_queue(struct list_head *icq_list) {unsigned long flags; +rcu_read_lock ();while (!list_empty (icq_list)) {struct io_cq *icq =list_entry (icq_list->next, struct io_cq, q_node);struct io_context *ioc = icq->ioc;spin_lock_irqsave (&ioc->lock, flags); +if (icq->flags &ICQ_DESTROYED ) { +spin_unlock_irqrestore (&ioc->lock, flags); +continue ; + }ioc_destroy_icq (icq);spin_unlock_irqrestore (&ioc->lock, flags); } +rcu_read_unlock (); }/**
include/linux/iocontext.h +1 -0
@@ -8,6 +8,7 @@enum {ICQ_EXITED =1 <<2 , +ICQ_DESTROYED =1 <<3 , };/*
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 51/254 block, zoned: fix integer overflow with BLKRESETZONE et al
In reply to Greg Kroah-HartmanFrom: Alexey Dobriyan <[email protected]>
[ Upstream commit 11bde986002c0af67eb92d73321d06baefae7128 ]
Check for overflow in addition before checking for end-of-block-device.
Steps to reproduce:
#define _GNU_SOURCE 1
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
typedef unsigned long long __u64;
struct blk_zone_range {
__u64 sector;
__u64 nr_sectors;
};
#define BLKRESETZONE _IOW(0x12, 131, struct blk_zone_range)
int main(void)
{
int fd = open("/dev/nullb0", O_RDWR|O_DIRECT);
struct blk_zone_range zr = {4096, 0xfffffffffffff000ULL};
ioctl(fd, BLKRESETZONE, &zr);
return 0;
}BUG: KASAN: null-ptr-deref in submit_bio_wait+0x74/0xe0 Write of size 8 at addr 0000000000000040 by task a.out/1590 CPU: 8 PID: 1590 Comm: a.out Not tainted 5.6.0-rc1-00019-g359c92c02bfa #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190711_202441-buildvm-armv7-10.arm.fedoraproject.org-2.fc31 04/01/2014 Call Trace: dump_stack+0x76/0xa0 __kasan_report.cold+0x5/0x3e kasan_report+0xe/0x20 submit_bio_wait+0x74/0xe0 blkdev_zone_mgmt+0x26f/0x2a0 blkdev_zone_mgmt_ioctl+0x14b/0x1b0 blkdev_ioctl+0xb28/0xe60 block_ioctl+0x69/0x80 ksys_ioctl+0x3af/0xa50
--- block/blk-zoned.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/blk-zoned.c +1 -1
@@ -173,7 +173,7 @@ int blkdev_zone_mgmt(struct block_device *bdev, enum req_opf op,if (!op_is_zone_mgmt (op))return -EOPNOTSUPP ; -if (!nr_sectors || end_sector > capacity) +if (end_sector <= sector || end_sector > capacity)/* Out of range */ return -EINVAL ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 52/254 media: mtk-vpu: avoid unaligned access to DTCM buffer.
In reply to Greg Kroah-HartmanFrom: Hsin-Yi Wang <[email protected]>
[ Upstream commit e6599adfad30c340d06574e49a86afa7015c5c60 ]
Previously, vpu->recv_buf and send_buf are forced cast from void __iomem *tcm. vpu->recv_buf->share_buf is passed to vpu_ipi_desc.handler(). It's not able to do unaligned access. Otherwise kernel would crash due to unable to handle kernel paging request.
struct vpu_run {
u32 signaled;
char fw_ver[VPU_FW_VER_LEN];
unsigned int dec_capability;
unsigned int enc_capability;
wait_queue_head_t wq;
};fw_ver starts at 4 byte boundary. If system enables CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, strscpy() will do read_word_at_a_time(), which tries to read 8-byte: *(unsigned long *)addr
vpu_init_ipi_handler() calls strscpy(), which would lead to crash.
vpu_init_ipi_handler() and several other handlers (eg. vpu_dec_ipi_handler) only do read access to this data, so they can be const, and we can use memcpy_fromio() to copy the buf to another non iomem buffer then pass to handler.
--- drivers/media/platform/mtk-mdp/mtk_mdp_vpu.c | 9 ++-- .../media/platform/mtk-vcodec/vdec_vpu_if.c | 6 +-- .../media/platform/mtk-vcodec/venc_vpu_if.c | 12 ++--- drivers/media/platform/mtk-vpu/mtk_vpu.c | 45 ++++++++++--------- drivers/media/platform/mtk-vpu/mtk_vpu.h | 2 +- 5 files changed, 38 insertions(+), 36 deletions(-)
drivers/media/platform/mtk-mdp/mtk_mdp_vpu.c +5 -4
@@ -15,7 +15,7 @@ static inline struct mtk_mdp_ctx *vpu_to_ctx(struct mtk_mdp_vpu *vpu) return container_of(vpu, struct mtk_mdp_ctx, vpu); } -static void mtk_mdp_vpu_handle_init_ack (struct mdp_ipi_comm_ack *msg) +static void mtk_mdp_vpu_handle_init_ack (const struct mdp_ipi_comm_ack *msg) {struct mtk_mdp_vpu *vpu = (struct mtk_mdp_vpu *) (unsigned long )msg->ap_inst;
@@ -26,10 +26,11 @@ static void mtk_mdp_vpu_handle_init_ack(struct mdp_ipi_comm_ack *msg) vpu->inst_addr = msg->vpu_inst_addr; } -static void mtk_mdp_vpu_ipi_handler (void *data,unsigned int len,void *priv) +static void mtk_mdp_vpu_ipi_handler (const void *data,unsigned int len, +void *priv) { -unsigned int msg_id = *(unsigned int *)data; -struct mdp_ipi_comm_ack *msg = (struct mdp_ipi_comm_ack *)data; +const struct mdp_ipi_comm_ack *msg = data; +unsigned int msg_id = msg->msg_id;struct mtk_mdp_vpu *vpu = (struct mtk_mdp_vpu *) (unsigned long )msg->ap_inst;struct mtk_mdp_ctx *ctx;
drivers/media/platform/mtk-vcodec/vdec_vpu_if.c +3 -3
@@ -9,7 +9,7 @@#include "vdec_ipi_msg.h" #include "vdec_vpu_if.h" -static void handle_init_ack_msg (struct vdec_vpu_ipi_init_ack *msg) +static void handle_init_ack_msg (const struct vdec_vpu_ipi_init_ack *msg) {struct vdec_vpu_inst *vpu = (struct vdec_vpu_inst *) (unsigned long )msg->ap_inst_addr;
@@ -34,9 +34,9 @@ static void handle_init_ack_msg(struct vdec_vpu_ipi_init_ack *msg)* This function runs in interrupt context and it means there's an IPI MSG * from VPU. */ -static void vpu_dec_ipi_handler (void *data,unsigned int len,void *priv) +static void vpu_dec_ipi_handler (const void *data,unsigned int len,void *priv) { -struct vdec_vpu_ipi_ack *msg = data; +const struct vdec_vpu_ipi_ack *msg = data;struct vdec_vpu_inst *vpu = (struct vdec_vpu_inst *) (unsigned long )msg->ap_inst_addr;
drivers/media/platform/mtk-vcodec/venc_vpu_if.c +6 -6
@@ -8,26 +8,26 @@#include "venc_ipi_msg.h" #include "venc_vpu_if.h" -static void handle_enc_init_msg (struct venc_vpu_inst *vpu,void *data) +static void handle_enc_init_msg (struct venc_vpu_inst *vpu,const void *data) { -struct venc_vpu_ipi_msg_init *msg = data; +const struct venc_vpu_ipi_msg_init *msg = data; vpu->inst_addr = msg->vpu_inst_addr; vpu->vsi =vpu_mapping_dm_addr (vpu->dev, msg->vpu_inst_addr); } -static void handle_enc_encode_msg (struct venc_vpu_inst *vpu,void *data) +static void handle_enc_encode_msg (struct venc_vpu_inst *vpu,const void *data) { -struct venc_vpu_ipi_msg_enc *msg = data; +const struct venc_vpu_ipi_msg_enc *msg = data; vpu->state = msg->state; vpu->bs_size = msg->bs_size; vpu->is_key_frm = msg->is_key_frm; } -static void vpu_enc_ipi_handler (void *data,unsigned int len,void *priv) +static void vpu_enc_ipi_handler (const void *data,unsigned int len,void *priv) { -struct venc_vpu_ipi_msg_common *msg = data; +const struct venc_vpu_ipi_msg_common *msg = data;struct venc_vpu_inst *vpu = (struct venc_vpu_inst *)(unsigned long )msg->venc_inst;
drivers/media/platform/mtk-vpu/mtk_vpu.c +23 -22
87 lines not on this page · raw message
drivers/media/platform/mtk-vpu/mtk_vpu.h +1 -1
@@ -15,7 +15,7 @@* VPU interfaces with other blocks by share memory and interrupt. **/ -typedef void (*ipi_handler_t ) (void *data, +typedef void (*ipi_handler_t ) (const void *data,unsigned int len,void *priv);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 53/254 media: i2c: ov5695: Fix power on and off sequences
In reply to Greg Kroah-HartmanFrom: Dongchun Zhu <[email protected]>
[ Upstream commit f1a64f56663e9d03e509439016dcbddd0166b2da ]
Quoted 1 line
From the measured hardware signal, OV5695 reset pin goes high for a
short period of time during boot-up. From the sensor specification, the reset pin is active low and the DT binding defines the pin as active low, which means that the values set by the driver are inverted and thus the value requested in probe ends up high.
Fix it by changing probe to request the reset GPIO initialized to high, which makes the initial state of the physical signal low.
In addition, DOVDD rising must occur before DVDD rising from spec., but regulator_bulk_enable() API enables all the regulators asynchronously. Use an explicit loops of regulator_enable() instead.
For power off sequence, it is required that DVDD falls first. Given the bulk API does not give any guarantee about the order of regulators, change the driver to use regulator_disable() instead.
The sensor also requires a delay between reset high and first I2C transaction, which was assumed to be 8192 XVCLK cycles, but 1ms is recommended by the vendor. Fix this as well.
--- drivers/media/i2c/ov5695.c | 49 ++++++++++++++++++++++++-------------- 1 file changed, 31 insertions(+), 18 deletions(-)
drivers/media/i2c/ov5695.c +31 -18
@@ -971,16 +971,9 @@ unlock_and_return:return ret; } -/* Calculate the delay in us by clock rate and clock cycles */ -static inline u32 ov5695_cal_delay (u32 cycles) -{ -return DIV_ROUND_UP (cycles,OV5695_XVCLK_FREQ /1000 /1000 ); -} -static int __ov5695_power_on (struct ov5695 *ov5695) { -int ret; -u32 delay_us; +int i, ret;struct device *dev = &ov5695->client->dev; ret =clk_prepare_enable (ov5695->xvclk);
@@ -991,21 +984,28 @@ static int __ov5695_power_on(struct ov5695 *ov5695)gpiod_set_value_cansleep (ov5695->reset_gpio,1 ); - ret =regulator_bulk_enable (OV5695_NUM_SUPPLIES , ov5695->supplies); -if (ret <0 ) { -dev_err (dev,"Failed to enable regulators\n" ); - goto disable_clk; +/* +* The hardware requires the regulators to be powered on in order, +* so enable them one by one. +*/ +for (i =0 ; i <OV5695_NUM_SUPPLIES ; i++) { + ret =regulator_enable (ov5695->supplies[i].consumer); +if (ret) { +dev_err (dev,"Failed to enable %s: %d\n" , + ov5695->supplies[i].supply, ret); + goto disable_reg_clk; + } }gpiod_set_value_cansleep (ov5695->reset_gpio,0 ); -/* 8192 cycles prior to first SCCB transaction */ - delay_us =ov5695_cal_delay (8192 ); -usleep_range (delay_us, delay_us *2 ); +usleep_range (1000 ,1200 );return 0 ; -disable_clk: +disable_reg_clk: +for (--i; i >=0 ; i--) +regulator_disable (ov5695->supplies[i].consumer);clk_disable_unprepare (ov5695->xvclk);return ret;
@@ -1013,9 +1013,22 @@ disable_clk:static void __ov5695_power_off (struct ov5695 *ov5695) { +struct device *dev = &ov5695->client->dev; +int i, ret; +clk_disable_unprepare (ov5695->xvclk);gpiod_set_value_cansleep (ov5695->reset_gpio,1 ); -regulator_bulk_disable (OV5695_NUM_SUPPLIES , ov5695->supplies); + +/* +* The hardware requires the regulators to be powered off in order, +* so disable them one by one. +*/ +for (i =OV5695_NUM_SUPPLIES -1 ; i >=0 ; i--) { + ret =regulator_disable (ov5695->supplies[i].consumer); +if (ret) +dev_err (dev,"Failed to disable %s: %d\n" , + ov5695->supplies[i].supply, ret); + } }static int __maybe_unused ov5695_runtime_resume (struct device *dev)
@@ -1285,7 +1298,7 @@ static int ov5695_probe(struct i2c_client *client,if (clk_get_rate (ov5695->xvclk) !=OV5695_XVCLK_FREQ )dev_warn (dev,"xvclk mismatched, modes are based on 24MHz\n" ); - ov5695->reset_gpio =devm_gpiod_get (dev,"reset" ,GPIOD_OUT_LOW ); + ov5695->reset_gpio =devm_gpiod_get (dev,"reset" ,GPIOD_OUT_HIGH );if (IS_ERR (ov5695->reset_gpio)) {dev_err (dev,"Failed to get reset-gpios\n" );return -EINVAL ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 54/254 usb: dwc3: core: add support for disabling SS instances in park mode
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 7ba6b09fda5e0cb741ee56f3264665e0edc64822 ]
In certain circumstances, the XHCI SuperSpeed instance in park mode can fail to recover, thus on Amlogic G12A/G12B/SM1 SoCs when there is high load on the single XHCI SuperSpeed instance, the controller can crash like:
xhci-hcd xhci-hcd.0.auto: xHCI host not responding to stop endpoint command. xhci-hcd xhci-hcd.0.auto: Host halt failed, -110
xhci-hcd xhci-hcd.0.auto: xHCI host controller not responding, assume dead xhci-hcd xhci-hcd.0.auto: xHCI host not responding to stop endpoint command. hub 2-1.1:1.0: hub_ext_port_status failed (err = -22)
xhci-hcd xhci-hcd.0.auto: HC died; cleaning up
usb 2-1.1-port1: cannot reset (err = -22)
Setting the PARKMODE_DISABLE_SS bit in the DWC3_USB3_GUCTL1 mitigates the issue. The bit is described as :
"When this bit is set to '1' all SS bus instances in park mode are disabled"
Synopsys explains:
The GUCTL1.PARKMODE_DISABLE_SS is only available in dwc_usb3 controller running in host mode.
This should not be set for other IPs.
This can be disabled by default based on IP, but I recommend to have a property to enable this feature for devices that need this.
--- drivers/usb/dwc3/core.c | 5 +++++ drivers/usb/dwc3/core.h | 4 ++++ 2 files changed, 9 insertions(+)
drivers/usb/dwc3/core.c +5 -0
@@ -1029,6 +1029,9 @@ static int dwc3_core_init(struct dwc3 *dwc)if (dwc->dis_tx_ipgap_linecheck_quirk) reg |=DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS ; +if (dwc->parkmode_disable_ss_quirk) + reg |=DWC3_GUCTL1_PARKMODE_DISABLE_SS ; +dwc3_writel (dwc->regs,DWC3_GUCTL1 , reg); }
@@ -1342,6 +1345,8 @@ static void dwc3_get_properties(struct dwc3 *dwc) "snps,dis-del-phy-power-chg-quirk"); dwc->dis_tx_ipgap_linecheck_quirk =device_property_read_bool (dev,"snps,dis-tx-ipgap-linecheck-quirk" ); + dwc->parkmode_disable_ss_quirk =device_property_read_bool (dev, +"snps,parkmode-disable-ss-quirk" ); dwc->tx_de_emphasis_quirk =device_property_read_bool (dev,"snps,tx_de_emphasis_quirk" );
drivers/usb/dwc3/core.h +4 -0
@@ -249,6 +249,7 @@#define DWC3_GUCTL_HSTINAUTORETRY BIT(14)/* Global User Control 1 Register */ +#define DWC3_GUCTL1_PARKMODE_DISABLE_SS BIT(17)#define DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS BIT(28)#define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW BIT(24)
@@ -1024,6 +1025,8 @@ struct dwc3_scratchpad_array {* change quirk. * @dis_tx_ipgap_linecheck_quirk: set if we disable u2mac linestate * check during HS transmit. +* @parkmode_disable_ss_quirk: set if we need to disable all SuperSpeed +* instances in park mode. * @tx_de_emphasis_quirk: set if we enable Tx de-emphasis quirk * @tx_de_emphasis: Tx de-emphasis value * 0 - -6dB de-emphasis
@@ -1215,6 +1218,7 @@ struct dwc3 { unsigned dis_u2_freeclk_exists_quirk:1; unsigned dis_del_phy_power_chg_quirk:1; unsigned dis_tx_ipgap_linecheck_quirk:1; + unsigned parkmode_disable_ss_quirk:1; unsigned tx_de_emphasis_quirk:1; unsigned tx_de_emphasis:2;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 55/254 irqchip/gic-v4: Provide irq_retrigger to avoid circular locking dependency
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
[ Upstream commit 7809f7011c3bce650e502a98afeb05961470d865 ]
On a very heavily loaded D05 with GICv4, I managed to trigger the following lockdep splat:
[ 6022.598864] ======================================================
[ 6022.605031] WARNING: possible circular locking dependency detected
[ 6022.611200] 5.6.0-rc4-00026-geee7c7b0f498 #680 Tainted: G E
[ 6022.618061] ------------------------------------------------------
[ 6022.624227] qemu-system-aar/7569 is trying to acquire lock:
[ 6022.629789] ffff042f97606808 (&p->pi_lock){-.-.}, at: try_to_wake_up+0x54/0x7a0
[ 6022.637102]
[ 6022.637102] but task is already holding lock:
[ 6022.642921] ffff002fae424cf0 (&irq_desc_lock_class){-.-.}, at: __irq_get_desc_lock+0x5c/0x98
[ 6022.651350]
[ 6022.651350] which lock already depends on the new lock.
[ 6022.651350]
[ 6022.659512]
[ 6022.659512] the existing dependency chain (in reverse order) is:
[ 6022.666980]
[ 6022.666980] -> #2 (&irq_desc_lock_class){-.-.}:
[ 6022.672983] _raw_spin_lock_irqsave+0x50/0x78
[ 6022.677848] __irq_get_desc_lock+0x5c/0x98
[ 6022.682453] irq_set_vcpu_affinity+0x40/0xc0
[ 6022.687236] its_make_vpe_non_resident+0x6c/0xb8
[ 6022.692364] vgic_v4_put+0x54/0x70
[ 6022.696273] vgic_v3_put+0x20/0xd8
[ 6022.700183] kvm_vgic_put+0x30/0x48
[ 6022.704182] kvm_arch_vcpu_put+0x34/0x50
[ 6022.708614] kvm_sched_out+0x34/0x50
[ 6022.712700] __schedule+0x4bc/0x7f8
[ 6022.716697] schedule+0x50/0xd8
[ 6022.720347] kvm_arch_vcpu_ioctl_run+0x5f0/0x978
[ 6022.725473] kvm_vcpu_ioctl+0x3d4/0x8f8
[ 6022.729820] ksys_ioctl+0x90/0xd0
[ 6022.733642] __arm64_sys_ioctl+0x24/0x30
[ 6022.738074] el0_svc_common.constprop.3+0xa8/0x1e8
[ 6022.743373] do_el0_svc+0x28/0x88
[ 6022.747198] el0_svc+0x14/0x40
[ 6022.750761] el0_sync_handler+0x124/0x2b8
[ 6022.755278] el0_sync+0x140/0x180
[ 6022.759100]
[ 6022.759100] -> #1 (&rq->lock){-.-.}:
[ 6022.764143] _raw_spin_lock+0x38/0x50
[ 6022.768314] task_fork_fair+0x40/0x128
[ 6022.772572] sched_fork+0xe0/0x210
[ 6022.776484] copy_process+0x8c4/0x18d8
[ 6022.780742] _do_fork+0x88/0x6d8
[ 6022.784478] kernel_thread+0x64/0x88
[ 6022.788563] rest_init+0x30/0x270
[ 6022.792390] arch_call_rest_init+0x14/0x1c
[ 6022.796995] start_kernel+0x498/0x4c4
[ 6022.801164]
[ 6022.801164] -> #0 (&p->pi_lock){-.-.}:
[ 6022.806382] __lock_acquire+0xdd8/0x15c8
[ 6022.810813] lock_acquire+0xd0/0x218
[ 6022.814896] _raw_spin_lock_irqsave+0x50/0x78
[ 6022.819761] try_to_wake_up+0x54/0x7a0
[ 6022.824018] wake_up_process+0x1c/0x28
[ 6022.828276] wakeup_softirqd+0x38/0x40
[ 6022.832533] __tasklet_schedule_common+0xc4/0xf0
[ 6022.837658] __tasklet_schedule+0x24/0x30
[ 6022.842176] check_irq_resend+0xc8/0x158
[ 6022.846609] irq_startup+0x74/0x128
[ 6022.850606] __enable_irq+0x6c/0x78
[ 6022.854602] enable_irq+0x54/0xa0
[ 6022.858431] its_make_vpe_non_resident+0xa4/0xb8
[ 6022.863557] vgic_v4_put+0x54/0x70
[ 6022.867469] kvm_arch_vcpu_blocking+0x28/0x38
[ 6022.872336] kvm_vcpu_block+0x48/0x490
[ 6022.876594] kvm_handle_wfx+0x18c/0x310
[ 6022.880938] handle_exit+0x138/0x198
[ 6022.885022] kvm_arch_vcpu_ioctl_run+0x4d4/0x978
[ 6022.890148] kvm_vcpu_ioctl+0x3d4/0x8f8
[ 6022.894494] ksys_ioctl+0x90/0xd0
[ 6022.898317] __arm64_sys_ioctl+0x24/0x30
[ 6022.902748] el0_svc_common.constprop.3+0xa8/0x1e8
[ 6022.908046] do_el0_svc+0x28/0x88
[ 6022.911871] el0_svc+0x14/0x40
[ 6022.915434] el0_sync_handler+0x124/0x2b8
[ 6022.919951] el0_sync+0x140/0x180
[ 6022.923773]
[ 6022.923773] other info that might help us debug this:
[ 6022.923773]
[ 6022.931762] Chain exists of:
[ 6022.931762] &p->pi_lock --> &rq->lock --> &irq_desc_lock_class
[ 6022.931762]
[ 6022.942101] Possible unsafe locking scenario:
[ 6022.942101]
[ 6022.948007] CPU0 CPU1
[ 6022.952523] ---- ----
[ 6022.957039] lock(&irq_desc_lock_class);
[ 6022.961036] lock(&rq->lock);
[ 6022.966595] lock(&irq_desc_lock_class);
[ 6022.973109] lock(&p->pi_lock);
[ 6022.976324]
[ 6022.976324] *** DEADLOCK ***This is happening because we have a pending doorbell that requires retrigger. As SW retriggering is done in a tasklet, we trigger the circular dependency above.
The easy cop-out is to provide a retrigger callback that doesn't require acquiring any extra lock.
--- drivers/irqchip/irq-gic-v3-its.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/irqchip/irq-gic-v3-its.c +6 -0
@@ -3679,12 +3679,18 @@ static int its_vpe_set_irqchip_state(struct irq_data *d,return 0 ; } +static int its_vpe_retrigger (struct irq_data *d) +{ +return !its_vpe_set_irqchip_state (d,IRQCHIP_STATE_PENDING , true); +} +static struct irq_chip its_vpe_irq_chip = { .name ="GICv4-vpe" , .irq_mask = its_vpe_mask_irq, .irq_unmask = its_vpe_unmask_irq, .irq_eoi = irq_chip_eoi_parent, .irq_set_affinity = its_vpe_set_affinity, + .irq_retrigger = its_vpe_retrigger, .irq_set_irqchip_state = its_vpe_set_irqchip_state, .irq_set_vcpu_affinity = its_vpe_set_vcpu_affinity, };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 56/254 md: check arrays is suspended in mddev_detach before call quiesce operations
In reply to Greg Kroah-HartmanFrom: Guoqing Jiang <[email protected]>
[ Upstream commit 6b40bec3b13278d21fa6c1ae7a0bdf2e550eed5f ]
Don't call quiesce(1) and quiesce(0) if array is already suspended, otherwise in level_store, the array is writable after mddev_detach in below part though the intention is to make array writable after resume.
mddev_suspend(mddev); mddev_detach(mddev); ... mddev_resume(mddev);
And it also causes calltrace as follows in [1].
[48005.653834] WARNING: CPU: 1 PID: 45380 at kernel/kthread.c:510 kthread_park+0x77/0x90 [...] [48005.653976] CPU: 1 PID: 45380 Comm: mdadm Tainted: G OE 5.4.10-arch1-1 #1 [48005.653979] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./J4105-ITX, BIOS P1.40 08/06/2018 [48005.653984] RIP: 0010:kthread_park+0x77/0x90 [48005.654015] Call Trace: [48005.654039] r5l_quiesce+0x3c/0x70 [raid456] [48005.654052] raid5_quiesce+0x228/0x2e0 [raid456] [48005.654073] mddev_detach+0x30/0x70 [md_mod] [48005.654090] level_store+0x202/0x670 [md_mod] [48005.654099] ? security_capable+0x40/0x60 [48005.654114] md_attr_store+0x7b/0xc0 [md_mod] [48005.654123] kernfs_fop_write+0xce/0x1b0 [48005.654132] vfs_write+0xb6/0x1a0 [48005.654138] ksys_write+0x67/0xe0 [48005.654146] do_syscall_64+0x4e/0x140 [48005.654155] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [48005.654161] RIP: 0033:0x7fa0c8737497
[1]: https://bugzilla.kernel.org/show_bug.cgi?id=206161
--- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/md.c +1 -1
@@ -6184,7 +6184,7 @@ EXPORT_SYMBOL_GPL(md_stop_writes);static void mddev_detach (struct mddev *mddev) {md_bitmap_wait_behind_writes (mddev); -if (mddev->pers && mddev->pers->quiesce) { +if (mddev->pers && mddev->pers->quiesce && !mddev->suspended) { mddev->pers->quiesce (mddev,1 ); mddev->pers->quiesce (mddev,0 ); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 57/254 firmware: fix a double abort case with fw_load_sysfs_fallback
In reply to Greg Kroah-HartmanFrom: Junyong Sun <[email protected]>
[ Upstream commit bcfbd3523f3c6eea51a74d217a8ebc5463bcb7f4 ]
fw_sysfs_wait_timeout may return err with -ENOENT at fw_load_sysfs_fallback and firmware is already in abort status, no need to abort again, so skip it.
This issue is caused by concurrent situation like below:
when thread 1# wait firmware loading, thread 2# may write -1 to abort loading and wakeup thread 1# before it timeout. so wait_for_completion_killable_timeout of thread 1# would return remaining time which is != 0 with fw_st->status FW_STATUS_ABORTED.And the results would be converted into err -ENOENT in __fw_state_wait_common and transfered to fw_load_sysfs_fallback in thread 1#.
The -ENOENT means firmware status is already at ABORTED, so fw_load_sysfs_fallback no need to get mutex to abort again.
-----------------------------
thread 1#,wait for loadingfw_load_sysfs_fallback
->fw_sysfs_wait_timeout
->__fw_state_wait_common
->wait_for_completion_killable_timeoutin __fw_state_wait_common,
...
93 ret = wait_for_completion_killable_timeout(&fw_st->completion, timeout);
94 if (ret != 0 && fw_st->status == FW_STATUS_ABORTED)
95 return -ENOENT;
96 if (!ret)
97 return -ETIMEDOUT;
98
99 return ret < 0 ? ret : 0;
-----------------------------
thread 2#, write -1 to abort loadingfirmware_loading_store
->fw_load_abort
->__fw_load_abort
->fw_state_aborted
->__fw_state_set
->complete_allin __fw_state_set,
...
111 if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)
112 complete_all(&fw_st->completion);
-------------------------------------------
BTW,the double abort issue would not cause kernel panic or create an issue, but slow down it sometimes.The change is just a minor optimization.
--- drivers/base/firmware_loader/fallback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/firmware_loader/fallback.c +1 -1
@@ -525,7 +525,7 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, } retval =fw_sysfs_wait_timeout (fw_priv, timeout); -if (retval <0 ) { +if (retval <0 && retval != -ENOENT ) {mutex_lock (&fw_lock);fw_load_abort (fw_sysfs);mutex_unlock (&fw_lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 58/254 spi: spi-fsl-dspi: Replace interruptible wait queue with a simple completion
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 4f5ee75ea1718a09149460b3df993f389a67b56a ]
Currently the driver puts the process in interruptible sleep waiting for the interrupt train to finish transfer to/from the tx_buf and rx_buf.
But exiting the process with ctrl-c may make the kernel panic: the wait_event_interruptible call will return -ERESTARTSYS, which a proper driver implementation is perhaps supposed to handle, but nonetheless this one doesn't, and aborts the transfer altogether.
Actually when the task is interrupted, there is still a high chance that the dspi_interrupt is still triggering. And if dspi_transfer_one_message returns execution all the way to the spi_device driver, that can free the spi_message and spi_transfer structures, leaving the interrupts to access a freed tx_buf and rx_buf.
hexdump -C /dev/mtd0
00000000 00 75 68 75 0a ff ff ff ff ff ff ff ff ff ff ff
|.uhu............| 00000010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * ^C[ 38.495955] fsl-dspi 2120000.spi: Waiting for transfer to complete failed! [ 38.503097] spi_master spi2: failed to transfer one message from queue [ 38.509729] Unable to handle kernel paging request at virtual address ffff800095ab3377 [ 38.517676] Mem abort info: [ 38.520474] ESR = 0x96000045 [ 38.523533] EC = 0x25: DABT (current EL), IL = 32 bits [ 38.528861] SET = 0, FnV = 0 [ 38.531921] EA = 0, S1PTW = 0 [ 38.535067] Data abort info: [ 38.537952] ISV = 0, ISS = 0x00000045 [ 38.541797] CM = 0, WnR = 1 [ 38.544771] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000082621000 [ 38.551494] [ffff800095ab3377] pgd=00000020fffff003, p4d=00000020fffff003, pud=0000000000000000 [ 38.560229] Internal error: Oops: 96000045 [#1] PREEMPT SMP [ 38.565819] Modules linked in: [ 38.568882] CPU: 0 PID: 2729 Comm: hexdump Not tainted 5.6.0-rc4-next-20200306-00052-gd8730cdc8a0b-dirty #193 [ 38.578834] Hardware name: Kontron SMARC-sAL28 (Single PHY) on SMARC Eval 2.0 carrier (DT) [ 38.587129] pstate: 20000085 (nzCv daIf -PAN -UAO) [ 38.591941] pc : ktime_get_real_ts64+0x3c/0x110 [ 38.596487] lr : spi_take_timestamp_pre+0x40/0x90 [ 38.601203] sp : ffff800010003d90 [ 38.604525] x29: ffff800010003d90 x28: ffff80001200e000 [ 38.609854] x27: ffff800011da9000 x26: ffff002079c40400 [ 38.615184] x25: ffff8000117fe018 x24: ffff800011daa1a0 [ 38.620513] x23: ffff800015ab3860 x22: ffff800095ab3377 [ 38.625841] x21: 000000000000146e x20: ffff8000120c3000 [ 38.631170] x19: ffff0020795f6e80 x18: ffff800011da9948 [ 38.636498] x17: 0000000000000000 x16: 0000000000000000 [ 38.641826] x15: ffff800095ab3377 x14: 0720072007200720 [ 38.647155] x13: 0720072007200765 x12: 0775076507750771 [ 38.652483] x11: 0720076d076f0772 x10: 0000000000000040 [ 38.657812] x9 : ffff8000108e2100 x8 : ffff800011dcabe8 [ 38.663139] x7 : 0000000000000000 x6 : ffff800015ab3a60 [ 38.668468] x5 : 0000000007200720 x4 : ffff800095ab3377 [ 38.673796] x3 : 0000000000000000 x2 : 0000000000000ab0 [ 38.679125] x1 : ffff800011daa000 x0 : 0000000000000026 [ 38.684454] Call trace: [ 38.686905] ktime_get_real_ts64+0x3c/0x110 [ 38.691100] spi_take_timestamp_pre+0x40/0x90 [ 38.695470] dspi_fifo_write+0x58/0x2c0 [ 38.699315] dspi_interrupt+0xbc/0xd0 [ 38.702987] __handle_irq_event_percpu+0x78/0x2c0 [ 38.707706] handle_irq_event_percpu+0x3c/0x90 [ 38.712161] handle_irq_event+0x4c/0xd0 [ 38.716008] handle_fasteoi_irq+0xbc/0x170 [ 38.720115] generic_handle_irq+0x2c/0x40 [ 38.724135] __handle_domain_irq+0x68/0xc0 [ 38.728243] gic_handle_irq+0xc8/0x160 [ 38.732000] el1_irq+0xb8/0x180 [ 38.735149] spi_nor_spimem_read_data+0xe0/0x140 [ 38.739779] spi_nor_read+0xc4/0x120 [ 38.743364] mtd_read_oob+0xa8/0xc0 [ 38.746860] mtd_read+0x4c/0x80 [ 38.750007] mtdchar_read+0x108/0x2a0 [ 38.753679] __vfs_read+0x20/0x50 [ 38.757002] vfs_read+0xa4/0x190 [ 38.760237] ksys_read+0x6c/0xf0 [ 38.763471] __arm64_sys_read+0x20/0x30 [ 38.767319] el0_svc_common.constprop.3+0x90/0x160 [ 38.772125] do_el0_svc+0x28/0x90 [ 38.775449] el0_sync_handler+0x118/0x190 [ 38.779468] el0_sync+0x140/0x180 [ 38.782793] Code: 91000294 1400000f d50339bf f9405e80 (f90002c0) [ 38.788910] ---[ end trace 55da560db4d6bef7 ]--- [ 38.793540] Kernel panic - not syncing: Fatal exception in interrupt [ 38.799914] SMP: stopping secondary CPUs [ 38.803849] Kernel Offset: disabled [ 38.807344] CPU features: 0x10002,20006008 [ 38.811451] Memory Limit: none [ 38.814513] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
So it is clear that the "interruptible" part isn't handled correctly. When the process receives a signal, one could either attempt a clean abort (which appears to be difficult with this hardware) or just keep restarting the sleep until the wait queue really completes. But checking in a loop for -ERESTARTSYS is a bit too complicated for this driver, so just make the sleep uninterruptible, to avoid all that nonsense.
The wait queue was actually restructured as a completion, after polling other drivers for the most "popular" approach.
--- drivers/spi/spi-fsl-dspi.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-)
drivers/spi/spi-fsl-dspi.c +6 -13
@@ -196,8 +196,7 @@ struct fsl_dspi {u8 bytes_per_word;const struct fsl_dspi_devtype_data *devtype_data; -wait_queue_head_t waitq; -u32 waitflags; +struct completion xfer_done;struct fsl_dspi_dma *dma; };
@@ -714,10 +713,8 @@ static irqreturn_t dspi_interrupt(int irq, void *dev_id)if (!(spi_sr &SPI_SR_EOQF ))return IRQ_NONE ; -if (dspi_rxtx (dspi) ==0 ) { - dspi->waitflags =1 ; -wake_up_interruptible (&dspi->waitq); - } +if (dspi_rxtx (dspi) ==0 ) +complete (&dspi->xfer_done);return IRQ_HANDLED ; }
@@ -815,13 +812,9 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, status =dspi_poll (dspi); }while (status == -EINPROGRESS ); }else if (trans_mode !=DSPI_DMA_MODE ) { - status =wait_event_interruptible (dspi->waitq, - dspi->waitflags); - dspi->waitflags =0 ; +wait_for_completion (&dspi->xfer_done); +reinit_completion (&dspi->xfer_done); } -if (status) -dev_err (&dspi->pdev->dev, -"Waiting for transfer to complete failed!\n" );spi_transfer_delay_exec (transfer); }
@@ -1161,7 +1154,7 @@ static int dspi_probe(struct platform_device *pdev) goto out_clk_put; } -init_waitqueue_head (&dspi->waitq); +init_completion (&dspi->xfer_done); poll_mode:
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 59/254 locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
In reply to Greg Kroah-HartmanFrom: Boqun Feng <[email protected]>
[ Upstream commit 25016bd7f4caf5fc983bbab7403d08e64cba3004 ]
Qian Cai reported a bug when PROVE_RCU_LIST=y, and read on /proc/lockdep triggered a warning:
[ ] DEBUG_LOCKS_WARN_ON(current->hardirqs_enabled)
...
[ ] Call Trace:
[ ] lock_is_held_type+0x5d/0x150 [ ] ? rcu_lockdep_current_cpu_online+0x64/0x80 [ ] rcu_read_lock_any_held+0xac/0x100 [ ] ? rcu_read_lock_held+0xc0/0xc0 [ ] ? __slab_free+0x421/0x540 [ ] ? kasan_kmalloc+0x9/0x10 [ ] ? __kmalloc_node+0x1d7/0x320 [ ] ? kvmalloc_node+0x6f/0x80 [ ] __bfs+0x28a/0x3c0 [ ] ? class_equal+0x30/0x30 [ ] lockdep_count_forward_deps+0x11a/0x1a0
The warning got triggered because lockdep_count_forward_deps() call __bfs() without current->lockdep_recursion being set, as a result a lockdep internal function (__bfs()) is checked by lockdep, which is unexpected, and the inconsistency between the irq-off state and the state traced by lockdep caused the warning.
Apart from this warning, lockdep internal functions like __bfs() should always be protected by current->lockdep_recursion to avoid potential deadlocks and data inconsistency, therefore add the current->lockdep_recursion on-and-off section to protect __bfs() in both lockdep_count_forward_deps() and lockdep_count_backward_deps()
--- kernel/locking/lockdep.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/locking/lockdep.c +4 -0
@@ -1719,9 +1719,11 @@ unsigned long lockdep_count_forward_deps(struct lock_class *class) this.class = class;raw_local_irq_save (flags); + current->lockdep_recursion =1 ;arch_spin_lock (&lockdep_lock); ret =__lockdep_count_forward_deps (&this);arch_spin_unlock (&lockdep_lock); + current->lockdep_recursion =0 ;raw_local_irq_restore (flags);return ret;
@@ -1746,9 +1748,11 @@ unsigned long lockdep_count_backward_deps(struct lock_class *class) this.class = class;raw_local_irq_save (flags); + current->lockdep_recursion =1 ;arch_spin_lock (&lockdep_lock); ret =__lockdep_count_backward_deps (&this);arch_spin_unlock (&lockdep_lock); + current->lockdep_recursion =0 ;raw_local_irq_restore (flags);return ret;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 60/254 staging: mt7621-pci: avoid to poweroff the phy for slot one
In reply to Greg Kroah-HartmanFrom: Sergio Paracuellos <[email protected]>
[ Upstream commit 5737cfe87a9c242ad0f60b34b5ac1688770a9236 ]
Phy for slot 0 and 1 is shared and handled properly in slot 0. If there is only one port in use,(slot 0) we shall not call the 'phy_power_off' function with an invalid slot because kernel will crash with an unaligned access fault like the following:
mt7621-pci 1e140000.pcie: Error applying setting, reverse things back mt7621-pci-phy 1e149000.pcie-phy: PHY for 0xbe149000 (dual port = 1) mt7621-pci-phy 1e14a000.pcie-phy: PHY for 0xbe14a000 (dual port = 0) mt7621-pci-phy 1e149000.pcie-phy: Xtal is 40MHz mt7621-pci-phy 1e14a000.pcie-phy: Xtal is 40MHz
mt7621-pci 1e140000.pcie: pcie1 no card, disable it (RST & CLK) Unhandled kernel unaligned access[#1]:
CPU: 3 PID: 111 Comm: kworker/3:2 Not tainted 5.6.0-rc3-00347-g825c6f470c62-dirty #9
Workqueue: events deferred_probe_work_func
$ 0 : 00000000 00000001 5f60d043 8fe1ba80
$ 4 : 0000010d 01eb9000 00000000 00000000
$ 8 : 294b4c00 80940000 00000008 000000ce
$12 : 2e303030 00000000 00000000 65696370
$16 : ffffffed 0000010d 8e373cd0 8214c1e0
$20 : 00000000 82144c80 82144680 8214c250
$24 : 00000018 803ef8f4
$28 : 8e372000 8e373c60 8214c080 803940e8
Hi : 00000125
Lo : 122f2000
epc : 807b3328 mutex_lock+0x8/0x44
ra : 803940e8 phy_power_off+0x28/0xb0
Status: 1100fc03 KERNEL EXL IE
Cause : 00800010 (ExcCode 04)
BadVA : 0000010d
PrId : 0001992f (MIPS 1004Kc)
Modules linked in:
Process kworker/3:2 (pid: 111, threadinfo=(ptrval), task=(ptrval), tls=00000000)
Stack : 8e373cd0 803fe4f4 8e372000 8e373c90 8214c080 804fde1c 8e373c98 808d62f4
8e373c78 00000000 8214c254 804fe648 1e160000 804f27b8 00000001 808d62f4
00000000 00000001 8214c228 808d62f4 80930000 809a0000 8fd47e10 808d63d4
808d62d4 8fd47e10 808d0000 808d0000 8e373cd0 8e373cd0 809e2a74 809db510
809db510 00000006 00000001 00000000 00000000 00000000 01000000 1e1440ff
...
Call Trace:
[<807b3328>] mutex_lock+0x8/0x44
[<803940e8>] phy_power_off+0x28/0xb0
[<804fe648>] mt7621_pci_probe+0xc20/0xd18
[<80402ab8>] platform_drv_probe+0x40/0x94
[<80400a74>] really_probe+0x104/0x364
[<803feb74>] bus_for_each_drv+0x84/0xdc
[<80400924>] __device_attach+0xdc/0x120
[<803ffb5c>] bus_probe_device+0xa0/0xbc
[<80400124>] deferred_probe_work_func+0x7c/0xbc
[<800420e8>] process_one_work+0x230/0x450
[<80042638>] worker_thread+0x330/0x5fc
[<80048eb0>] kthread+0x12c/0x134
[<80007438>] ret_from_kernel_thread+0x14/0x1c
Code: 24050002 27bdfff8 8f830000 <c0850000> 14a00005 00000000 00600825 e0810000 1020fffa--- drivers/staging/mt7621-pci/pci-mt7621.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/mt7621-pci/pci-mt7621.c +2 -1
@@ -485,7 +485,8 @@ static void mt7621_pcie_init_ports(struct mt7621_pcie *pcie)if (!mt7621_pcie_port_is_linkup (port)) {dev_err (dev,"pcie%d no card, disable it (RST & CLK)\n" , slot); -phy_power_off (port->phy); +if (slot !=1 ) +phy_power_off (port->phy);mt7621_control_assert (port);mt7621_pcie_port_clk_disable (port); port->enabled = false;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 61/254 block, bfq: fix use-after-free in bfq_idle_slice_timer_body
In reply to Greg Kroah-HartmanFrom: Zhiqiang Liu <[email protected]>
[ Upstream commit 2f95fa5c955d0a9987ffdc3a095e2f4e62c5f2a9 ]
In bfq_idle_slice_timer func, bfqq = bfqd->in_service_queue is not in bfqd-lock critical section. The bfqq, which is not equal to NULL in bfq_idle_slice_timer, may be freed after passing to bfq_idle_slice_timer_body. So we will access the freed memory.
In addition, considering the bfqq may be in race, we should firstly check whether bfqq is in service before doing something on it in bfq_idle_slice_timer_body func. If the bfqq in race is not in service, it means the bfqq has been expired through __bfq_bfqq_expire func, and wait_request flags has been cleared in __bfq_bfqd_reset_in_service func. So we do not need to re-clear the wait_request of bfqq which is not in service.
KASAN log is given as follows:
[13058.354613] ================================================================== [13058.354640] BUG: KASAN: use-after-free in bfq_idle_slice_timer+0xac/0x290 [13058.354644] Read of size 8 at addr ffffa02cf3e63f78 by task fork13/19767 [13058.354646] [13058.354655] CPU: 96 PID: 19767 Comm: fork13 [13058.354661] Call trace: [13058.354667] dump_backtrace+0x0/0x310 [13058.354672] show_stack+0x28/0x38 [13058.354681] dump_stack+0xd8/0x108 [13058.354687] print_address_description+0x68/0x2d0 [13058.354690] kasan_report+0x124/0x2e0 [13058.354697] __asan_load8+0x88/0xb0 [13058.354702] bfq_idle_slice_timer+0xac/0x290 [13058.354707] __hrtimer_run_queues+0x298/0x8b8 [13058.354710] hrtimer_interrupt+0x1b8/0x678 [13058.354716] arch_timer_handler_phys+0x4c/0x78 [13058.354722] handle_percpu_devid_irq+0xf0/0x558 [13058.354731] generic_handle_irq+0x50/0x70 [13058.354735] __handle_domain_irq+0x94/0x110 [13058.354739] gic_handle_irq+0x8c/0x1b0 [13058.354742] el1_irq+0xb8/0x140 [13058.354748] do_wp_page+0x260/0xe28 [13058.354752] __handle_mm_fault+0x8ec/0x9b0 [13058.354756] handle_mm_fault+0x280/0x460 [13058.354762] do_page_fault+0x3ec/0x890 [13058.354765] do_mem_abort+0xc0/0x1b0 [13058.354768] el0_da+0x24/0x28 [13058.354770] [13058.354773] Allocated by task 19731: [13058.354780] kasan_kmalloc+0xe0/0x190 [13058.354784] kasan_slab_alloc+0x14/0x20 [13058.354788] kmem_cache_alloc_node+0x130/0x440 [13058.354793] bfq_get_queue+0x138/0x858 [13058.354797] bfq_get_bfqq_handle_split+0xd4/0x328 [13058.354801] bfq_init_rq+0x1f4/0x1180 [13058.354806] bfq_insert_requests+0x264/0x1c98 [13058.354811] blk_mq_sched_insert_requests+0x1c4/0x488 [13058.354818] blk_mq_flush_plug_list+0x2d4/0x6e0 [13058.354826] blk_flush_plug_list+0x230/0x548 [13058.354830] blk_finish_plug+0x60/0x80 [13058.354838] read_pages+0xec/0x2c0 [13058.354842] __do_page_cache_readahead+0x374/0x438 [13058.354846] ondemand_readahead+0x24c/0x6b0 [13058.354851] page_cache_sync_readahead+0x17c/0x2f8 [13058.354858] generic_file_buffered_read+0x588/0xc58 [13058.354862] generic_file_read_iter+0x1b4/0x278 [13058.354965] ext4_file_read_iter+0xa8/0x1d8 [ext4] [13058.354972] __vfs_read+0x238/0x320 [13058.354976] vfs_read+0xbc/0x1c0 [13058.354980] ksys_read+0xdc/0x1b8 [13058.354984] __arm64_sys_read+0x50/0x60 [13058.354990] el0_svc_common+0xb4/0x1d8 [13058.354994] el0_svc_handler+0x50/0xa8 [13058.354998] el0_svc+0x8/0xc [13058.354999] [13058.355001] Freed by task 19731: [13058.355007] __kasan_slab_free+0x120/0x228 [13058.355010] kasan_slab_free+0x10/0x18 [13058.355014] kmem_cache_free+0x288/0x3f0 [13058.355018] bfq_put_queue+0x134/0x208 [13058.355022] bfq_exit_icq_bfqq+0x164/0x348 [13058.355026] bfq_exit_icq+0x28/0x40 [13058.355030] ioc_exit_icq+0xa0/0x150 [13058.355035] put_io_context_active+0x250/0x438 [13058.355038] exit_io_context+0xd0/0x138 [13058.355045] do_exit+0x734/0xc58 [13058.355050] do_group_exit+0x78/0x220 [13058.355054] __wake_up_parent+0x0/0x50 [13058.355058] el0_svc_common+0xb4/0x1d8 [13058.355062] el0_svc_handler+0x50/0xa8 [13058.355066] el0_svc+0x8/0xc [13058.355067] [13058.355071] The buggy address belongs to the object at ffffa02cf3e63e70#012 which belongs to the cache bfq_queue of size 464 [13058.355075] The buggy address is located 264 bytes inside of#012 464-byte region [ffffa02cf3e63e70, ffffa02cf3e64040) [13058.355077] The buggy address belongs to the page: [13058.355083] page:ffff7e80b3cf9800 count:1 mapcount:0 mapping:ffff802db5c90780 index:0xffffa02cf3e606f0 compound_mapcount: 0 [13058.366175] flags: 0x2ffffe0000008100(slab|head) [13058.370781] raw: 2ffffe0000008100 ffff7e80b53b1408 ffffa02d730c1c90 ffff802db5c90780 [13058.370787] raw: ffffa02cf3e606f0 0000000000370023 00000001ffffffff 0000000000000000 [13058.370789] page dumped because: kasan: bad access detected [13058.370791] [13058.370792] Memory state around the buggy address: [13058.370797] ffffa02cf3e63e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fb fb [13058.370801] ffffa02cf3e63e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [13058.370805] >ffffa02cf3e63f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [13058.370808] ^ [13058.370811] ffffa02cf3e63f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [13058.370815] ffffa02cf3e64000: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [13058.370817] ================================================================== [13058.370820] Disabling lock debugging due to kernel taint
Here, we directly pass the bfqd to bfq_idle_slice_timer_body func. --V2->V3: rewrite the comment as suggested by Paolo Valente V1->V2: add one comment, and add Fixes and Reported-by tag.
--- block/bfq-iosched.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
block/bfq-iosched.c +12 -4
@@ -6215,20 +6215,28 @@ static struct bfq_queue *bfq_init_rq(struct request *rq)return bfqq; } -static void bfq_idle_slice_timer_body (struct bfq_queue *bfqq) +static void +bfq_idle_slice_timer_body (struct bfq_data *bfqd,struct bfq_queue *bfqq) { -struct bfq_data *bfqd = bfqq->bfqd;enum bfqq_expiration reason;unsigned long flags;spin_lock_irqsave (&bfqd->lock, flags); -bfq_clear_bfqq_wait_request (bfqq); +/* +* Considering that bfqq may be in race, we should firstly check +* whether bfqq is in service before doing something on it. If +* the bfqq in race is not in service, it has already been expired +* through __bfq_bfqq_expire func and its wait_request flags has +* been cleared in __bfq_bfqd_reset_in_service func. +*/ if (bfqq != bfqd->in_service_queue) {spin_unlock_irqrestore (&bfqd->lock, flags);return ; } +bfq_clear_bfqq_wait_request (bfqq); +if (bfq_bfqq_budget_timeout (bfqq))/* * Also here the queue can be safely expired
@@ -6273,7 +6281,7 @@ static enum hrtimer_restart bfq_idle_slice_timer(struct hrtimer *timer)* early. */ if (bfqq) -bfq_idle_slice_timer_body (bfqq); +bfq_idle_slice_timer_body (bfqd, bfqq);return HRTIMER_NORESTART ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 62/254 btrfs: qgroup: ensure qgroup_rescan_running is only set when the worker is at least queued
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
[ Upstream commit d61acbbf54c612ea9bf67eed609494cda0857b3a ]
[BUG]
There are some reports about btrfs wait forever to unmount itself, with the following call trace:
INFO: task umount:4631 blocked for more than 491 seconds.
Tainted: G X 5.3.8-2-default #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
umount D 0 4631 3337 0x00000000
Call Trace:
([<00000000174adf7a>] __schedule+0x342/0x748)
[<00000000174ae3ca>] schedule+0x4a/0xd8
[<00000000174b1f08>] schedule_timeout+0x218/0x420
[<00000000174af10c>] wait_for_common+0x104/0x1d8
[<000003ff804d6994>] btrfs_qgroup_wait_for_completion+0x84/0xb0 [btrfs]
[<000003ff8044a616>] close_ctree+0x4e/0x380 [btrfs]
[<0000000016fa3136>] generic_shutdown_super+0x8e/0x158
[<0000000016fa34d6>] kill_anon_super+0x26/0x40
[<000003ff8041ba88>] btrfs_kill_super+0x28/0xc8 [btrfs]
[<0000000016fa39f8>] deactivate_locked_super+0x68/0x98
[<0000000016fcb198>] cleanup_mnt+0xc0/0x140
[<0000000016d6a846>] task_work_run+0xc6/0x110
[<0000000016d04f76>] do_notify_resume+0xae/0xb8
[<00000000174b30ae>] system_call+0xe2/0x2c8[CAUSE]
The problem happens when we have called qgroup_rescan_init(), but not queued the worker. It can be caused mostly by error handling.
Qgroup ioctl thread | Unmount thread
----------------------------------------+-----------------------------------
| btrfs_qgroup_rescan() | |- qgroup_rescan_init() | | |- qgroup_rescan_running = true; | | | |- trans = btrfs_join_transaction() | | Some error happened | | | |- btrfs_qgroup_rescan() returns error | But qgroup_rescan_running == true; | | close_ctree() | |- btrfs_qgroup_wait_for_completion() | |- running == true; | |- wait_for_completion();
btrfs_qgroup_rescan_worker is never queued, thus no one is going to wake up close_ctree() and we get a deadlock.
All involved qgroup_rescan_init() callers are:
- btrfs_qgroup_rescan()
The example above. It's possible to trigger the deadlock when error happened.
- btrfs_quota_enable()
Not possible. Just after qgroup_rescan_init() we queue the work.
- btrfs_read_qgroup_config()
It's possible to trigger the deadlock. It only init the work, the work queueing happens in btrfs_qgroup_rescan_resume(). Thus if error happened in between, deadlock is possible.
We shouldn't set fs_info->qgroup_rescan_running just in qgroup_rescan_init(), as at that stage we haven't yet queued qgroup rescan worker to run.
[FIX]
Set qgroup_rescan_running before queueing the work, so that we ensure the rescan work is queued when we wait for it.
--- fs/btrfs/qgroup.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
fs/btrfs/qgroup.c +9 -2
@@ -1030,6 +1030,7 @@ out_add_root: ret =qgroup_rescan_init (fs_info,0 ,1 );if (!ret) {qgroup_rescan_zero_tracking (fs_info); + fs_info->qgroup_rescan_running = true;btrfs_queue_work (fs_info->qgroup_rescan_workers, &fs_info->qgroup_rescan_work); }
@@ -3263,7 +3264,6 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid, sizeof(fs_info->qgroup_rescan_progress)); fs_info->qgroup_rescan_progress.objectid = progress_objectid;init_completion (&fs_info->qgroup_rescan_completion); - fs_info->qgroup_rescan_running = true;spin_unlock (&fs_info->qgroup_lock);mutex_unlock (&fs_info->qgroup_rescan_lock);
@@ -3326,8 +3326,11 @@ btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info)qgroup_rescan_zero_tracking (fs_info); +mutex_lock (&fs_info->qgroup_rescan_lock); + fs_info->qgroup_rescan_running = true;btrfs_queue_work (fs_info->qgroup_rescan_workers, &fs_info->qgroup_rescan_work); +mutex_unlock (&fs_info->qgroup_rescan_lock);return 0 ; }
@@ -3363,9 +3366,13 @@ int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info,void btrfs_qgroup_rescan_resume (struct btrfs_fs_info *fs_info) { -if (fs_info->qgroup_flags &BTRFS_QGROUP_STATUS_FLAG_RESCAN ) +if (fs_info->qgroup_flags &BTRFS_QGROUP_STATUS_FLAG_RESCAN ) { +mutex_lock (&fs_info->qgroup_rescan_lock); + fs_info->qgroup_rescan_running = true;btrfs_queue_work (fs_info->qgroup_rescan_workers, &fs_info->qgroup_rescan_work); +mutex_unlock (&fs_info->qgroup_rescan_lock); + } }/*
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 63/254 btrfs: remove a BUG_ON() from merge_reloc_roots()
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit 7b7b74315b24dc064bc1c683659061c3d48f8668 ]
This was pretty subtle, we default to reloc roots having 0 root refs, so if we crash in the middle of the relocation they can just be deleted. If we successfully complete the relocation operations we'll set our root refs to 1 in prepare_to_merge() and then go on to merge_reloc_roots().
At prepare_to_merge() time if any of the reloc roots have a 0 reference still, we will remove that reloc root from our reloc root rb tree, and then clean it up later.
However this only happens if we successfully start a transaction. If we've aborted previously we will skip this step completely, and only have reloc roots with a reference count of 0, but were never properly removed from the reloc control's rb tree.
This isn't a problem per-se, our references are held by the list the reloc roots are on, and by the original root the reloc root belongs to. If we end up in this situation all the reloc roots will be added to the dirty_reloc_list, and then properly dropped at that point. The reloc control will be free'd and the rb tree is no longer used.
There were two options when fixing this, one was to remove the BUG_ON(), the other was to make prepare_to_merge() handle the case where we couldn't start a trans handle.
IMO this is the cleaner solution. I started with handling the error in prepare_to_merge(), but it turned out super ugly. And in the end this BUG_ON() simply doesn't matter, the cleanup was happening properly, we were just panicing because this BUG_ON() only matters in the success case. So I've opted to just remove it and add a comment where it was.
--- fs/btrfs/relocation.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
fs/btrfs/relocation.c +15 -1
@@ -2561,7 +2561,21 @@ out:free_reloc_roots (&reloc_roots); } -BUG_ON (!RB_EMPTY_ROOT (&rc->reloc_root_tree.rb_root)); +/* +* We used to have +* +* BUG_ON(!RB_EMPTY_ROOT(&rc->reloc_root_tree.rb_root)); +* +* here, but it's wrong. If we fail to start the transaction in +* prepare_to_merge() we will have only 0 ref reloc roots, none of which +* have actually been removed from the reloc_root_tree rb tree. This is +* fine because we're bailing here, and we hold a reference on the root +* for the list that holds it, so these roots will be cleaned up when we +* do the reloc_dirty_list afterwards. Meanwhile the root->reloc_root +* will be cleaned up on unmount. +* +* The remaining nodes will be cleaned up by free_reloc_control. +*/ }static void free_block_list (struct rb_root *blocks)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 64/254 btrfs: restart relocate_tree_blocks properly
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit 50dbbb71c79df89532ec41d118d59386e5a877e3 ]
There are two bugs here, but fixing them independently would just result in pain if you happened to bisect between the two patches.
First is how we handle the -EAGAIN from relocate_tree_block(). We don't set error, unless we happen to be the first node, which makes no sense, I have no idea what the code was trying to accomplish here.
We in fact _do_ want err set here so that we know we need to restart in relocate_block_group(). Also we need finish_pending_nodes() to not actually call link_to_upper(), because we didn't actually relocate the block.
And then if we do get -EAGAIN we do not want to set our backref cache last_trans to the one before ours. This would force us to update our backref cache if we didn't cross transaction ids, which would mean we'd have some nodes updated to their new_bytenr, but still able to find their old bytenr because we're searching the same commit root as the last time we went through relocate_tree_blocks.
Fixing these two things keeps us from panicing when we start breaking out of relocate_tree_blocks() either for delayed ref flushing or enospc.
--- fs/btrfs/relocation.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
fs/btrfs/relocation.c +2 -9
@@ -3175,9 +3175,8 @@ int relocate_tree_blocks(struct btrfs_trans_handle *trans, ret =relocate_tree_block (trans, rc, node, &block->key, path);if (ret <0 ) { -if (ret != -EAGAIN || &block->rb_node ==rb_first (blocks)) - err = ret; - goto out; + err = ret; +break ; } } out:
@@ -4151,12 +4150,6 @@ restart:if (!RB_EMPTY_ROOT (&blocks)) { ret =relocate_tree_blocks (trans, rc, &blocks);if (ret <0 ) { -/* -* if we fail to relocate tree blocks, force to update -* backref cache when committing transaction. -*/ - rc->backref_cache.last_trans = trans->transid -1 ; -if (ret != -EAGAIN ) { err = ret;break ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 65/254 btrfs: track reloc roots based on their commit root bytenr
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit ea287ab157c2816bf12aad4cece41372f9d146b4 ]
We always search the commit root of the extent tree for looking up back references, however we track the reloc roots based on their current bytenr.
This is wrong, if we commit the transaction between relocating tree blocks we could end up in this code in build_backref_tree
if (key.objectid == key.offset) {
/*
* Only root blocks of reloc trees use backref
* pointing to itself.
*/
root = find_reloc_root(rc, cur->bytenr);
ASSERT(root);
cur->root = root;
break;}
find_reloc_root() is looking based on the bytenr we had in the commit root, but if we've COWed this reloc root we will not find that bytenr, and we will trip over the ASSERT(root).
Fix this by using the commit_root->start bytenr for indexing the commit root. Then we change the __update_reloc_root() caller to be used when we switch the commit root for the reloc root during commit.
This fixes the panic I was seeing when we started throttling relocation for delayed refs.
--- fs/btrfs/relocation.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-)
fs/btrfs/relocation.c +7 -10
@@ -1298,7 +1298,7 @@ static int __must_check __add_reloc_root(struct btrfs_root *root)if (!node)return -ENOMEM ; - node->bytenr = root->node->start; + node->bytenr = root->commit_root->start; node->data = root;spin_lock (&rc->reloc_root_tree.lock);
@@ -1329,10 +1329,11 @@ static void __del_reloc_root(struct btrfs_root *root)if (rc && root->node) {spin_lock (&rc->reloc_root_tree.lock); rb_node =tree_search (&rc->reloc_root_tree.rb_root, - root->node->start); + root->commit_root->start);if (rb_node) { node = rb_entry(rb_node, struct mapping_node, rb_node);rb_erase (&node->rb_node, &rc->reloc_root_tree.rb_root); +RB_CLEAR_NODE (&node->rb_node); }spin_unlock (&rc->reloc_root_tree.lock);if (!node)
@@ -1350,7 +1351,7 @@ static void __del_reloc_root(struct btrfs_root *root)* helper to update the 'address of tree root -> reloc tree' * mapping */ -static int __update_reloc_root (struct btrfs_root *root,u64 new_bytenr) +static int __update_reloc_root (struct btrfs_root *root) {struct btrfs_fs_info *fs_info = root->fs_info;struct rb_node *rb_node;
@@ -1359,7 +1360,7 @@ static int __update_reloc_root(struct btrfs_root *root, u64 new_bytenr)spin_lock (&rc->reloc_root_tree.lock); rb_node =tree_search (&rc->reloc_root_tree.rb_root, - root->node->start); + root->commit_root->start);if (rb_node) { node = rb_entry(rb_node, struct mapping_node, rb_node);rb_erase (&node->rb_node, &rc->reloc_root_tree.rb_root);
@@ -1371,7 +1372,7 @@ static int __update_reloc_root(struct btrfs_root *root, u64 new_bytenr)BUG_ON ((struct btrfs_root *)node->data != root);spin_lock (&rc->reloc_root_tree.lock); - node->bytenr = new_bytenr; + node->bytenr = root->node->start; rb_node =tree_insert (&rc->reloc_root_tree.rb_root, node->bytenr, &node->rb_node);spin_unlock (&rc->reloc_root_tree.lock);
@@ -1529,6 +1530,7 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans, }if (reloc_root->commit_root != reloc_root->node) { +__update_reloc_root (reloc_root);btrfs_set_root_node (root_item, reloc_root->node);free_extent_buffer (reloc_root->commit_root); reloc_root->commit_root =btrfs_root_node (reloc_root);
@@ -4727,11 +4729,6 @@ int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,BUG_ON (rc->stage ==UPDATE_DATA_PTRS && root->root_key.objectid ==BTRFS_DATA_RELOC_TREE_OBJECTID ); -if (root->root_key.objectid ==BTRFS_TREE_RELOC_OBJECTID ) { -if (buf == root->node) -__update_reloc_root (root, cow->start); - } - level =btrfs_header_level (buf);if (btrfs_header_generation (buf) <=btrfs_root_last_snapshot (&root->root_item))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 66/254 ASoC: fix regwmask
In reply to Greg Kroah-HartmanFrom: 이경택 <[email protected]>
commit 0ab070917afdc93670c2d0ea02ab6defb6246a7c upstream.
If regwshift is 32 and the selected architecture compiles '<<' operator for signed int literal into rotating shift, '1<<regwshift' became 1 and it makes regwmask to 0x0.
The literal is set to unsigned long to get intended regwmask.
--- sound/soc/soc-ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/soc-ops.c +2 -2
@@ -825,7 +825,7 @@ int snd_soc_get_xr_sx(struct snd_kcontrounsigned int regbase = mc->regbase;unsigned int regcount = mc->regcount;unsigned int regwshift = component->val_bytes *BITS_PER_BYTE ; -unsigned int regwmask = (1 <<regwshift)-1 ; +unsigned int regwmask = (1UL <<regwshift)-1 ;unsigned int invert = mc->invert;unsigned long mask = (1UL <<mc->nbits)-1 ;long min = mc->min;
@@ -874,7 +874,7 @@ int snd_soc_put_xr_sx(struct snd_kcontrounsigned int regbase = mc->regbase;unsigned int regcount = mc->regcount;unsigned int regwshift = component->val_bytes *BITS_PER_BYTE ; -unsigned int regwmask = (1 <<regwshift)-1 ; +unsigned int regwmask = (1UL <<regwshift)-1 ;unsigned int invert = mc->invert;unsigned long mask = (1UL <<mc->nbits)-1 ;long max = mc->max;
Greg Kroah-Hartman
maintainerPATCH 67/254 ASoC: dapm: connect virtual mux with default value
In reply to Greg Kroah-HartmanFrom: 이경택 <[email protected]>
commit 3bbbb7728fc853d71dbce4073fef9f281fbfb4dd upstream.
Since a virtual mixer has no backing registers
to decide which path to connect,
it will try to match with initial state.
This is to ensure that the default mixer choice will be correctly powered up during initialization.
Invert flag is used to select initial state of the virtual switch. Since actual hardware can't be disconnected by virtual switch, connected is better choice as initial state in many cases.
--- sound/soc/soc-dapm.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/soc/soc-dapm.c +7 -1
@@ -802,7 +802,13 @@ static void dapm_set_mixer_path_status(s val = max - val; p->connect = !!val; }else { - p->connect =0 ; +/* since a virtual mixer has no backing registers to +* decide which path to connect, it will try to match +* with initial state. This is to ensure +* that the default mixer choice will be +* correctly powered up during initialization. +*/ + p->connect = invert; } }
Greg Kroah-Hartman
maintainerPATCH 68/254 ASoC: dpcm: allow start or stop during pause for backend
In reply to Greg Kroah-HartmanFrom: 이경택 <[email protected]>
commit 21fca8bdbb64df1297e8c65a746c4c9f4a689751 upstream.
soc_compr_trigger_fe() allows start or stop after pause_push. In dpcm_be_dai_trigger(), however, only pause_release is allowed command after pause_push.
So, start or stop after pause in compress offload is always returned as error if the compress offload is used with dpcm. To fix the problem, SND_SOC_DPCM_STATE_PAUSED should be allowed for start or stop command.
--- sound/soc/soc-pcm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/soc/soc-pcm.c +4 -2
@@ -2236,7 +2236,8 @@ int dpcm_be_dai_trigger(struct snd_soc_pswitch (cmd) {case SNDRV_PCM_TRIGGER_START :if ((be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PREPARE ) && - (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_STOP )) + (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_STOP ) && + (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PAUSED ))continue ; ret =dpcm_do_trigger (dpcm, be_substream, cmd);
@@ -2266,7 +2267,8 @@ int dpcm_be_dai_trigger(struct snd_soc_p be->dpcm[stream].state =SND_SOC_DPCM_STATE_START ;break ;case SNDRV_PCM_TRIGGER_STOP : -if (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_START ) +if ((be->dpcm[stream].state !=SND_SOC_DPCM_STATE_START ) && + (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PAUSED ))continue ;if (!snd_soc_dpcm_can_be_free_stop (fe, be, stream))
Greg Kroah-Hartman
maintainerPATCH 69/254 ASoC: topology: use name_prefix for new kcontrol
In reply to Greg Kroah-HartmanFrom: 이경택 <[email protected]>
commit abca9e4a04fbe9c6df4d48ca7517e1611812af25 upstream.
Current topology doesn't add prefix of component to new kcontrol.
--- sound/soc/soc-topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-topology.c +1 -1
@@ -362,7 +362,7 @@ static int soc_tplg_add_kcontrol(structstruct snd_soc_component *comp = tplg->comp;return soc_tplg_add_dcontrol (comp->card->snd_card, - comp->dev, k,NULL , comp, kcontrol); + comp->dev, k, comp->name_prefix, comp, kcontrol); }/* remove a mixer kcontrol */
Greg Kroah-Hartman
maintainerPATCH 70/254 usb: gadget: f_fs: Fix use after free issue as part of queue failure
In reply to Greg Kroah-HartmanFrom: Sriharsha Allenki <[email protected]>
commit f63ec55ff904b2f2e126884fcad93175f16ab4bb upstream.
In AIO case, the request is freed up if ep_queue fails. However, io_data->req still has the reference to this freed request. In the case of this failure if there is aio_cancel call on this io_data it will lead to an invalid dequeue operation and a potential use after free issue.
Fix this by setting the io_data->req to NULL when the request is freed as part of queue failure.
--- drivers/usb/gadget/function/f_fs.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/gadget/function/f_fs.c +1 -0
@@ -1120,6 +1120,7 @@ static ssize_t ffs_epfile_io(struct file ret =usb_ep_queue (ep->ep, req,GFP_ATOMIC );if (unlikely (ret)) { + io_data->req =NULL ;usb_ep_free_request (ep->ep, req); goto error_lock; }
Greg Kroah-Hartman
maintainerPATCH 71/254 usb: gadget: composite: Inform controller driver of self-powered
In reply to Greg Kroah-HartmanFrom: Thinh Nguyen <[email protected]>
commit 5e5caf4fa8d3039140b4548b6ab23dd17fce9b2c upstream.
Different configuration/condition may draw different power. Inform the controller driver of the change so it can respond properly (e.g. GET_STATUS request). This fixes an issue with setting MaxPower from configfs. The composite driver doesn't check this value when setting self-powered.
--- drivers/usb/gadget/composite.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/gadget/composite.c +9 -0
@@ -861,6 +861,11 @@ static int set_config(struct usb_composielse power =min (power,900U ); done: +if (power <=USB_SELF_POWER_VBUS_MAX_DRAW ) +usb_gadget_set_selfpowered (gadget); +else +usb_gadget_clear_selfpowered (gadget); +usb_gadget_vbus_draw (gadget, power);if (result >=0 && cdev->delayed_status) result =USB_GADGET_DELAYED_STATUS ;
@@ -2279,6 +2284,7 @@ void composite_suspend(struct usb_gadget cdev->suspended =1 ; +usb_gadget_set_selfpowered (gadget);usb_gadget_vbus_draw (gadget,2 ); }
@@ -2307,6 +2313,9 @@ void composite_resume(struct usb_gadgetelse maxpower =min (maxpower,900U ); +if (maxpower >USB_SELF_POWER_VBUS_MAX_DRAW ) +usb_gadget_clear_selfpowered (gadget); +usb_gadget_vbus_draw (gadget, maxpower); }
Greg Kroah-Hartman
maintainerPATCH 72/254 ALSA: usb-audio: Add mixer workaround for TRX40 and co
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 2a48218f8e23d47bd3e23cfdfb8aa9066f7dc3e6 upstream.
Some recent boards (supposedly with a new AMD platform) contain the USB audio class 2 device that is often tied with HD-audio. The device exposes an Input Gain Pad control (id=19, control=12) but this node doesn't behave correctly, returning an error for each inquiry of GET_MIN and GET_MAX that should have been mandatory.
As a workaround, simply ignore this node by adding a usbmix_name_map table entry. The currently known devices are:
* 0414:a002 - Gigabyte TRX40 Aorus Pro WiFi
* 0b05:1916 - ASUS ROG Zenith II
* 0b05:1917 - ASUS ROG Strix
* 0db0:0d64 - MSI TRX40 Creator
* 0db0:543d - MSI TRX40
--- sound/usb/mixer_maps.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
sound/usb/mixer_maps.c +28 -0
@@ -359,6 +359,14 @@ static const struct usbmix_name_map cors { 0 } }; +/* Some mobos shipped with a dummy HD-audio show the invalid GET_MIN/GET_MAX +* response for Input Gain Pad (id=19, control=12). Skip it. +*/ +static const struct usbmix_name_map asus_rog_map[] = { + {19 ,NULL ,12 },/* FU, Input Gain Pad */ + {} +}; +/* * Control map entries */
@@ -488,6 +496,26 @@ static const struct usbmix_ctl_map usbmi .id = USB_ID(0x1b1c, 0x0a42), .map = corsair_virtuoso_map, }, + { /* Gigabyte TRX40 Aorus Pro WiFi */ + .id = USB_ID(0x0414, 0xa002), + .map = asus_rog_map, + }, + { /* ASUS ROG Zenith II */ + .id = USB_ID(0x0b05, 0x1916), + .map = asus_rog_map, + }, + { /* ASUS ROG Strix */ + .id = USB_ID(0x0b05, 0x1917), + .map = asus_rog_map, + }, + { /* MSI TRX40 Creator */ + .id = USB_ID(0x0db0, 0x0d64), + .map = asus_rog_map, + }, + { /* MSI TRX40 */ + .id = USB_ID(0x0db0, 0x543d), + .map = asus_rog_map, + }, { 0 } /* terminator */ };
Greg Kroah-Hartman
maintainerPATCH 73/254 ALSA: hda: Add driver blacklist
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 3c6fd1f07ed03a04debbb9a9d782205f1ef5e2ab upstream.
The recent AMD platform exposes an HD-audio bus but without any actual codecs, which is internally tied with a USB-audio device, supposedly. It results in "no codecs" error of HD-audio bus driver, and it's nothing but a waste of resources.
This patch introduces a static blacklist table for skipping such a known bogus PCI SSID entry. As of writing this patch, the known SSIDs are:
* 1043:874f - ASUS ROG Zenith II / Strix
* 1462:cb59 - MSI TRX40 Creator
* 1462:cb60 - MSI TRX40
--- sound/pci/hda/hda_intel.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
sound/pci/hda/hda_intel.c +16 -0
@@ -2076,6 +2076,17 @@ static void pcm_mmap_prepare(struct snd_#endif } +/* Blacklist for skipping the whole probe: +* some HD-audio PCI entries are exposed without any codecs, and such devices +* should be ignored from the beginning. +*/ +static const struct snd_pci_quirk driver_blacklist[] = { +SND_PCI_QUIRK (0x1043 ,0x874f ,"ASUS ROG Zenith II / Strix" ,0 ), +SND_PCI_QUIRK (0x1462 ,0xcb59 ,"MSI TRX40 Creator" ,0 ), +SND_PCI_QUIRK (0x1462 ,0xcb60 ,"MSI TRX40" ,0 ), + {} +}; +static const struct hda_controller_ops pci_hda_ops = { .disable_msi_reset_irq = disable_msi_reset_irq, .pcm_mmap_prepare = pcm_mmap_prepare,
@@ -2092,6 +2103,11 @@ static int azx_probe(struct pci_dev *pcibool schedule_probe;int err; +if (snd_pci_quirk_lookup (pci, driver_blacklist)) { +dev_info (&pci->dev,"Skipping the blacklisted device\n" ); +return -ENODEV ; + } +if (dev >=SNDRV_CARDS )return -ENODEV ;if (!enable[dev]) {
Greg Kroah-Hartman
maintainerPATCH 74/254 ALSA: hda: Fix potential access overflow in beep helper
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 0ad3f0b384d58f3bd1f4fb87d0af5b8f6866f41a upstream.
The beep control helper function blindly stores the values in two stereo channels no matter whether the actual control is mono or stereo. This is practically harmless, but it annoys the recently introduced sanity check, resulting in an error when the checker is enabled.
This patch corrects the behavior to store only on the defined array member.
--- sound/pci/hda/hda_beep.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/pci/hda/hda_beep.c +5 -1
@@ -290,8 +290,12 @@ int snd_hda_mixer_amp_switch_get_beep(st {struct hda_codec *codec =snd_kcontrol_chip (kcontrol);struct hda_beep *beep = codec->beep; +int chs =get_amp_channels (kcontrol); +if (beep && (!beep->enabled || !ctl_has_mute (kcontrol))) { - ucontrol->value.integer.value[0 ] = +if (chs &1 ) + ucontrol->value.integer.value[0 ] = beep->enabled; +if (chs &2 ) ucontrol->value.integer.value[1 ] = beep->enabled;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 75/254 ALSA: ice1724: Fix invalid access for enumerated ctl items
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit c47914c00be346bc5b48c48de7b0da5c2d1a296c upstream.
The access to Analog Capture Source control value implemented in prodigy_hifi.c is wrong, as caught by the recently introduced sanity check; it should be accessing value.enumerated.item[] instead of value.integer.value[]. This patch corrects the wrong access pattern.
--- sound/pci/ice1712/prodigy_hifi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/ice1712/prodigy_hifi.c +2 -2
@@ -536,7 +536,7 @@ static int wm_adc_mux_enum_get(struct snstruct snd_ice1712 *ice =snd_kcontrol_chip (kcontrol);mutex_lock (&ice->gpio_mutex); - ucontrol->value.integer.value[0 ] =wm_get (ice,WM_ADC_MUX ) &0x1f ; + ucontrol->value.enumerated.item[0 ] =wm_get (ice,WM_ADC_MUX ) &0x1f ;mutex_unlock (&ice->gpio_mutex);return 0 ; }
@@ -550,7 +550,7 @@ static int wm_adc_mux_enum_put(struct snmutex_lock (&ice->gpio_mutex); oval =wm_get (ice,WM_ADC_MUX ); - nval = (oval &0xe0 ) | ucontrol->value.integer.value[0 ]; + nval = (oval &0xe0 ) | ucontrol->value.enumerated.item[0 ];if (nval != oval) {wm_put (ice,WM_ADC_MUX , nval); change =1 ;
Greg Kroah-Hartman
maintainerPATCH 76/254 ALSA: pcm: oss: Fix regression by buffer overflow fix
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit ae769d3556644888c964635179ef192995f40793 upstream.
The recent fix for the OOB access in PCM OSS plugins (commitf2ecf903ef06: "ALSA: pcm: oss: Avoid plugin buffer overflow") caused a regression on OSS applications. The patch introduced the size check in client and slave size calculations to limit to each plugin's buffer size, but I overlooked that some code paths call those without allocating the buffer but just for estimation.
This patch fixes the bug by skipping the size check for those code paths while keeping checking in the actual transfer calls.
--- sound/core/oss/pcm_plugin.c | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-)
sound/core/oss/pcm_plugin.c +24 -8
@@ -196,7 +196,9 @@ int snd_pcm_plugin_free(struct snd_pcm_preturn 0 ; } -snd_pcm_sframes_t snd_pcm_plug_client_size (struct snd_pcm_substream *plug,snd_pcm_uframes_t drv_frames) +static snd_pcm_sframes_t plug_client_size (struct snd_pcm_substream *plug, +snd_pcm_uframes_t drv_frames, +bool check_size) {struct snd_pcm_plugin *plugin, *plugin_prev, *plugin_next;int stream;
@@ -209,7 +211,7 @@ snd_pcm_sframes_t snd_pcm_plug_client_siif (stream ==SNDRV_PCM_STREAM_PLAYBACK ) { plugin =snd_pcm_plug_last (plug);while (plugin && drv_frames >0 ) { -if (drv_frames > plugin->buf_frames) +if (check_size && drv_frames > plugin->buf_frames) drv_frames = plugin->buf_frames; plugin_prev = plugin->prev;if (plugin->src_frames)
@@ -222,7 +224,7 @@ snd_pcm_sframes_t snd_pcm_plug_client_si plugin_next = plugin->next;if (plugin->dst_frames) drv_frames = plugin->dst_frames (plugin, drv_frames); -if (drv_frames > plugin->buf_frames) +if (check_size && drv_frames > plugin->buf_frames) drv_frames = plugin->buf_frames; plugin = plugin_next; }
@@ -231,7 +233,9 @@ snd_pcm_sframes_t snd_pcm_plug_client_sireturn drv_frames; } -snd_pcm_sframes_t snd_pcm_plug_slave_size (struct snd_pcm_substream *plug,snd_pcm_uframes_t clt_frames) +static snd_pcm_sframes_t plug_slave_size (struct snd_pcm_substream *plug, +snd_pcm_uframes_t clt_frames, +bool check_size) {struct snd_pcm_plugin *plugin, *plugin_prev, *plugin_next;snd_pcm_sframes_t frames;
@@ -252,14 +256,14 @@ snd_pcm_sframes_t snd_pcm_plug_slave_sizif (frames <0 )return frames; } -if (frames > plugin->buf_frames) +if (check_size && frames > plugin->buf_frames) frames = plugin->buf_frames; plugin = plugin_next; } }else if (stream ==SNDRV_PCM_STREAM_CAPTURE ) { plugin =snd_pcm_plug_last (plug);while (plugin) { -if (frames > plugin->buf_frames) +if (check_size && frames > plugin->buf_frames) frames = plugin->buf_frames; plugin_prev = plugin->prev;if (plugin->src_frames) {
@@ -274,6 +278,18 @@ snd_pcm_sframes_t snd_pcm_plug_slave_sizreturn frames; } +snd_pcm_sframes_t snd_pcm_plug_client_size (struct snd_pcm_substream *plug, +snd_pcm_uframes_t drv_frames) +{ +return plug_client_size (plug, drv_frames, false); +} + +snd_pcm_sframes_t snd_pcm_plug_slave_size (struct snd_pcm_substream *plug, +snd_pcm_uframes_t clt_frames) +{ +return plug_slave_size (plug, clt_frames, false); +} +static int snd_pcm_plug_formats (const struct snd_mask *mask,snd_pcm_format_t format) {
@@ -630,7 +646,7 @@ snd_pcm_sframes_t snd_pcm_plug_write_tra src_channels = dst_channels; plugin = next; } -return snd_pcm_plug_client_size (plug, frames); +return plug_client_size (plug, frames, true); }snd_pcm_sframes_t snd_pcm_plug_read_transfer (struct snd_pcm_substream *plug,struct snd_pcm_plugin_channel *dst_channels_final,snd_pcm_uframes_t size)
@@ -640,7 +656,7 @@ snd_pcm_sframes_t snd_pcm_plug_read_transnd_pcm_sframes_t frames = size;int err; - frames =snd_pcm_plug_slave_size (plug, frames); + frames =plug_slave_size (plug, frames, true);if (frames <0 )return frames;
Greg Kroah-Hartman
maintainerPATCH 77/254 ALSA: hda/realtek: Enable mute LED on an HP system
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
commit f5a88b0accc24c4a9021247d7a3124f90aa4c586 upstream.
The system in question uses ALC285, and it uses GPIO 0x04 to control its mute LED.
The mic mute LED can be controlled by GPIO 0x01, however the system uses DMIC so we should use that to control mic mute LED.
--- sound/pci/hda/patch_realtek.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/pci/hda/patch_realtek.c +12 -0
@@ -4008,6 +4008,12 @@ static void alc269_fixup_hp_gpio_led(stralc_fixup_hp_gpio_led (codec, action,0x08 ,0x10 ); } +static void alc285_fixup_hp_gpio_led (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +alc_fixup_hp_gpio_led (codec, action,0x04 ,0x00 ); +} +static void alc286_fixup_hp_gpio_led (struct hda_codec *codec,const struct hda_fixup *fix,int action) {
@@ -5923,6 +5929,7 @@ enum {ALC294_FIXUP_ASUS_DUAL_SPK ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ,ALC294_FIXUP_ASUS_HPE , + ALC285_FIXUP_HP_GPIO_LED, }; static const struct hda_fixup alc269_fixups[] = {
@@ -7061,6 +7068,10 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id =ALC294_FIXUP_ASUS_HEADSET_MIC }, + [ALC285_FIXUP_HP_GPIO_LED] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_gpio_led, + }, };static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -7208,6 +7219,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x83b9 ,"HP Spectre x360" ,ALC269_FIXUP_HP_MUTE_LED_MIC3 ),SND_PCI_QUIRK (0x103c ,0x8497 ,"HP Envy x360" ,ALC269_FIXUP_HP_MUTE_LED_MIC3 ),SND_PCI_QUIRK (0x103c ,0x84e7 ,"HP Pavilion 15" ,ALC269_FIXUP_HP_MUTE_LED_MIC3 ), +SND_PCI_QUIRK (0x103c ,0x8736 ,"HP" ,ALC285_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x1043 ,0x103e ,"ASUS X540SA" ,ALC256_FIXUP_ASUS_MIC ),SND_PCI_QUIRK (0x1043 ,0x103f ,"ASUS TX300" ,ALC282_FIXUP_ASUS_TX300 ), SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
Greg Kroah-Hartman
maintainerPATCH 78/254 ALSA: hda/realtek - a fake key event is triggered by running shutup
In reply to Greg Kroah-HartmanFrom: Hui Wang <[email protected]>
commit 476c02e0b4fd9071d158f6a1a1dfea1d36ee0ffd upstream.
On the Lenovo X1C7 machines, after we plug the headset, the rt_resume() and rt_suspend() of the codec driver will be called periodically, the driver can't stay in the rt_suspend state even users doen't use the sound card.
Through debugging, I found when running rt_suspend(), it will call alc225_shutup(), in this function, it will change 3k pull down control by alc_update_coef_idx(codec, 0x4a, 0, 3 << 10), this will trigger a fake key event and that event will resume the codec, when codec suspend agin, it will trigger the fake key event one more time, this process will repeat.
If disable the key event before changing the pull down control, it will not trigger fake key event. It also needs to restore the pull down control and re-enable the key event, otherwise the system can't get key event when codec is in rt_suspend state.
Also move some functions ahead of alc225_shutup(), this can save the function declaration.
--- sound/pci/hda/patch_realtek.c | 170 ++++++++++++++++++++++++++---------------- 1 file changed, 107 insertions(+), 63 deletions(-)
sound/pci/hda/patch_realtek.c +107 -63
@@ -107,6 +107,7 @@ struct alc_spec { unsigned int done_hp_init:1; unsigned int no_shutup_pins:1; unsigned int ultra_low_power:1; + unsigned int has_hs_key:1;/* for PLL fix */ hda_nid_t pll_nid;
@@ -2982,6 +2983,107 @@ static int alc269_parse_auto_config(strureturn alc_parse_auto_config (codec, alc269_ignore, ssids); } +static const struct hda_jack_keymap alc_headset_btn_keymap[] = { + {SND_JACK_BTN_0 ,KEY_PLAYPAUSE }, + {SND_JACK_BTN_1 ,KEY_VOICECOMMAND }, + {SND_JACK_BTN_2 ,KEY_VOLUMEUP }, + {SND_JACK_BTN_3 ,KEY_VOLUMEDOWN }, + {} +}; + +static void alc_headset_btn_callback (struct hda_codec *codec, +struct hda_jack_callback *jack) +{ +int report =0 ; + +if (jack->unsol_res & (7 <<13 )) + report |=SND_JACK_BTN_0 ; + +if (jack->unsol_res & (1 <<16 |3 <<8 )) + report |=SND_JACK_BTN_1 ; + +/* Volume up key */ +if (jack->unsol_res & (7 <<23 )) + report |=SND_JACK_BTN_2 ; + +/* Volume down key */ +if (jack->unsol_res & (7 <<10 )) + report |=SND_JACK_BTN_3 ; + + jack->jack->button_state = report; +} + +static void alc_disable_headset_jack_key (struct hda_codec *codec) +{ +struct alc_spec *spec = codec->spec; + +if (!spec->has_hs_key) +return ; + +switch (codec->core.vendor_id) { +case 0x10ec0215 : +case 0x10ec0225 : +case 0x10ec0285 : +case 0x10ec0295 : +case 0x10ec0289 : +case 0x10ec0299 : +alc_write_coef_idx (codec,0x48 ,0x0 ); +alc_update_coef_idx (codec,0x49 ,0x0045 ,0x0 ); +alc_update_coef_idx (codec,0x44 ,0x0045 <<8 ,0x0 ); +break ; +case 0x10ec0236 : +case 0x10ec0256 : +alc_write_coef_idx (codec,0x48 ,0x0 ); +alc_update_coef_idx (codec,0x49 ,0x0045 ,0x0 ); +break ; + } +} + +static void alc_enable_headset_jack_key (struct hda_codec *codec) +{ +struct alc_spec *spec = codec->spec; + +if (!spec->has_hs_key) +return ; + +switch (codec->core.vendor_id) { +case 0x10ec0215 : +case 0x10ec0225 : +case 0x10ec0285 : +case 0x10ec0295 : +case 0x10ec0289 : +case 0x10ec0299 : +alc_write_coef_idx (codec,0x48 ,0xd011 ); +alc_update_coef_idx (codec,0x49 ,0x007f ,0x0045 ); +alc_update_coef_idx (codec,0x44 ,0x007f <<8 ,0x0045 <<8 ); +break ; +case 0x10ec0236 : +case 0x10ec0256 : +alc_write_coef_idx (codec,0x48 ,0xd011 ); +alc_update_coef_idx (codec,0x49 ,0x007f ,0x0045 ); +break ; + } +} + +static void alc_fixup_headset_jack (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +struct alc_spec *spec = codec->spec; + +switch (action) { +case HDA_FIXUP_ACT_PRE_PROBE : + spec->has_hs_key =1 ; +snd_hda_jack_detect_enable_callback (codec,0x55 , + alc_headset_btn_callback); +snd_hda_jack_add_kctl (codec,0x55 ,"Headset Jack" , false, +SND_JACK_HEADSET , alc_headset_btn_keymap); +break ; +case HDA_FIXUP_ACT_INIT : +alc_enable_headset_jack_key (codec); +break ; + } +} +static void alc269vb_toggle_power_output (struct hda_codec *codec,int power_up) {alc_update_coef_idx (codec,0x04 ,1 <<11 , power_up ? (1 <<11 ) :0 );
@@ -3372,6 +3474,8 @@ static void alc225_shutup(struct hda_codif (!hp_pin) hp_pin =0x21 ; + +alc_disable_headset_jack_key (codec);/* 3k pull low control for Headset jack. */ alc_update_coef_idx (codec,0x4a ,0 ,3 <<10 );
@@ -3411,6 +3515,9 @@ static void alc225_shutup(struct hda_codalc_update_coef_idx (codec,0x4a ,3 <<4 ,2 <<4 );msleep (30 ); } + +alc_update_coef_idx (codec,0x4a ,3 <<10 ,0 ); +alc_enable_headset_jack_key (codec); }static void alc_default_init (struct hda_codec *codec)
@@ -5668,69 +5775,6 @@ static void alc285_fixup_invalidate_dacssnd_hda_override_wcaps (codec,0x03 ,0 ); } -static const struct hda_jack_keymap alc_headset_btn_keymap[] = { - {SND_JACK_BTN_0 ,KEY_PLAYPAUSE }, - {SND_JACK_BTN_1 ,KEY_VOICECOMMAND }, - {SND_JACK_BTN_2 ,KEY_VOLUMEUP }, - {SND_JACK_BTN_3 ,KEY_VOLUMEDOWN }, - {} -}; - -static void alc_headset_btn_callback (struct hda_codec *codec, -struct hda_jack_callback *jack) -{ -int report =0 ; - -if (jack->unsol_res & (7 <<13 )) - report |=SND_JACK_BTN_0 ; - -if (jack->unsol_res & (1 <<16 |3 <<8 )) - report |=SND_JACK_BTN_1 ; - -/* Volume up key */ -if (jack->unsol_res & (7 <<23 )) - report |=SND_JACK_BTN_2 ; - -/* Volume down key */ -if (jack->unsol_res & (7 <<10 )) - report |=SND_JACK_BTN_3 ; - - jack->jack->button_state = report; -} - -static void alc_fixup_headset_jack (struct hda_codec *codec, -const struct hda_fixup *fix,int action) -{ - -switch (action) { -case HDA_FIXUP_ACT_PRE_PROBE : -snd_hda_jack_detect_enable_callback (codec,0x55 , - alc_headset_btn_callback); -snd_hda_jack_add_kctl (codec,0x55 ,"Headset Jack" , false, -SND_JACK_HEADSET , alc_headset_btn_keymap); -break ; -case HDA_FIXUP_ACT_INIT : -switch (codec->core.vendor_id) { -case 0x10ec0215 : -case 0x10ec0225 : -case 0x10ec0285 : -case 0x10ec0295 : -case 0x10ec0289 : -case 0x10ec0299 : -alc_write_coef_idx (codec,0x48 ,0xd011 ); -alc_update_coef_idx (codec,0x49 ,0x007f ,0x0045 ); -alc_update_coef_idx (codec,0x44 ,0x007f <<8 ,0x0045 <<8 ); -break ; -case 0x10ec0236 : -case 0x10ec0256 : -alc_write_coef_idx (codec,0x48 ,0xd011 ); -alc_update_coef_idx (codec,0x49 ,0x007f ,0x0045 ); -break ; - } -break ; - } -} -static void alc295_fixup_chromebook (struct hda_codec *codec,const struct hda_fixup *fix,int action) {
Greg Kroah-Hartman
maintainerPATCH 79/254 ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256
In reply to Greg Kroah-HartmanFrom: Thomas Hebb <[email protected]>
commit f128090491c3f5aacef91a863f8c52abf869c436 upstream.
This codec (among others) has a hidden set of audio routes, apparently designed to allow PC Beep output without a mixer widget on the output path, which are controlled by an undocumented Realtek vendor register. The default configuration of these routes means that certain inputs aren't accessible, necessitating driver control of the register. However, Realtek has provided no documentation of the register, instead opting to fix issues by providing magic numbers, most of which have been at least somewhat erroneous. These magic numbers then get copied by others into model-specific fixups, leading to a fragmented and buggy set of configurations.
To get out of this situation, I've reverse engineered the register by flipping bits and observing how the codec's behavior changes. This commit documents my findings. It does not change any code.
--- Documentation/sound/hd-audio/index.rst | 1 Documentation/sound/hd-audio/realtek-pc-beep.rst | 129 +++++++++++++++++++++++ 2 files changed, 130 insertions(+)
Documentation/sound/hd-audio/index.rst +1 -0
@@ -8,3 +8,4 @@ HD-Audio models controls dp-mst + realtek-pc-beep
Documentation/sound/hd-audio/realtek-pc-beep.rst new file +129 -0
129 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 80/254 ALSA: hda/realtek - Set principled PC Beep configuration for ALC256
In reply to Greg Kroah-HartmanFrom: Thomas Hebb <[email protected]>
commit c44737449468a0bdc50e09ec75e530f208391561 upstream.
The Realtek PC Beep Hidden Register[1] is currently set by patch_realtek.c in two different places:
In alc_fill_eapd_coef(), it's set to the value 0x5757, corresponding to non-beep input on 1Ah and no 1Ah loopback to either headphones or speakers. (Although, curiously, the loopback amp is still enabled.) This write was added fairly recently by commit e3743f431143 ("ALSA:
hda/realtek - Dell headphone has noise on unmute for ALC236") and is a safe default. However, it happens in the wrong place:alc_fill_eapd_coef() runs on module load and cold boot but not on S3 resume, meaning the register loses its value after suspend.
Conversely, in alc256_init(), the register is updated to unset bit 13 (disable speaker loopback) and set bit 5 (set non-beep input on 1Ah). Although this write does run on S3 resume, it's not quite enough to fix up the register's default value of 0x3717. What's missing is a set of bit 14 to disable headphone loopback. Without that, we end up with a feedback loop where the headphone jack is being driven by amplified samples of itself[2].
This change eliminates the update in alc256_init() and replaces it with the 0x5757 write from alc_fill_eapd_coef(). Kailang says that 0x5757 is supposed to be the codec's default value, so using it will make debugging easier for Realtek.
Affects the ALC255, ALC256, ALC257, ALC235, and ALC236 codecs.
[1] Newly documented in Documentation/sound/hd-audio/realtek-pc-beep.rst
[2] Setting the "Headphone Mic Boost" control from userspace changes this feedback loop and has been a widely-shared workaround for headphone noise on laptops like the Dell XPS 13 9350. This commit eliminates the feedback loop and makes the workaround unnecessary.
--- sound/pci/hda/patch_realtek.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
sound/pci/hda/patch_realtek.c +9 -6
@@ -368,7 +368,9 @@ static void alc_fill_eapd_coef(struct hdcase 0x10ec0215 :case 0x10ec0233 :case 0x10ec0235 : +case 0x10ec0236 :case 0x10ec0255 : +case 0x10ec0256 :case 0x10ec0257 :case 0x10ec0282 :case 0x10ec0283 :
@@ -380,11 +382,6 @@ static void alc_fill_eapd_coef(struct hdcase 0x10ec0300 :alc_update_coef_idx (codec,0x10 ,1 <<9 ,0 );break ; -case 0x10ec0236 : -case 0x10ec0256 : -alc_write_coef_idx (codec,0x36 ,0x5757 ); -alc_update_coef_idx (codec,0x10 ,1 <<9 ,0 ); -break ;case 0x10ec0275 :alc_update_coef_idx (codec,0xe ,0 ,1 <<0 );break ;
@@ -3371,7 +3368,13 @@ static void alc256_init(struct hda_codecalc_update_coefex_idx (codec,0x57 ,0x04 ,0x0007 ,0x4 );/* Hight power */ alc_update_coefex_idx (codec,0x53 ,0x02 ,0x8000 ,1 <<15 );/* Clear bit */ alc_update_coefex_idx (codec,0x53 ,0x02 ,0x8000 ,0 <<15 ); -alc_update_coef_idx (codec,0x36 ,1 <<13 ,1 <<5 );/* Switch pcbeep path to Line in path*/ +/* +* Expose headphone mic (or possibly Line In on some machines) instead +* of PC Beep on 1Ah, and disable 1Ah loopback for all outputs. See +* Documentation/sound/hd-audio/realtek-pc-beep.rst for details of +* this register. +*/ +alc_write_coef_idx (codec,0x36 ,0x5757 ); }static void alc256_shutup (struct hda_codec *codec)
Greg Kroah-Hartman
maintainerPATCH 81/254 ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups
In reply to Greg Kroah-HartmanFrom: Thomas Hebb <[email protected]>
commit f36938aa7440f46a0a365f1cfde5f5985af2bef3 upstream.
patch_realtek.c has historically failed to properly configure the PC Beep Hidden Register for the ALC256 codec (among others). Depending on your kernel version, symptoms of this misconfiguration can range from chassis noise, picked up by a poorly-shielded PCBEEP trace, getting amplified and played on your internal speaker and/or headphones to loud feedback, which responds to the "Headphone Mic Boost" ALSA control, getting played through your headphones. For details of the problem, see the patch in this series titled "ALSA: hda/realtek - Set principled PC Beep configuration for ALC256", which fixes the configuration.
These symptoms have been most noticed on the Dell XPS 13 9350 and 9360, popular laptops that use the ALC256. As a result, several model-specific fixups have been introduced to try and fix the problem, the most egregious of which locks the "Headphone Mic Boost" control as a hack to minimize noise from a feedback loop that shouldn't have been there in the first place.
Now that the underlying issue has been fixed, remove all these fixups. Remaining fixups needed by the XPS 13 are all picked up by existing pin quirks.
This change should, for the XPS 13 9350/9360
- Significantly increase volume and audio quality on headphones
- Eliminate headphone popping on suspend/resume
- Allow "Headphone Mic Boost" to be set again, making the headphone jack fully usable as a microphone jack too.
--- Documentation/sound/hd-audio/models.rst | 2 - sound/pci/hda/patch_realtek.c | 34 -------------------------------- 2 files changed, 36 deletions(-)
Documentation/sound/hd-audio/models.rst +0 -2
@@ -216,8 +216,6 @@ alc298-dell-aio ALC298 fixups on Dell AIO machines alc275-dell-xps ALC275 fixups on Dell XPS models -alc256-dell-xps13 - ALC256 fixups on Dell XPS13 lenovo-spk-noise Workaround for speaker noise on Lenovo machines lenovo-hotkey
sound/pci/hda/patch_realtek.c +0 -34
@@ -5491,17 +5491,6 @@ static void alc271_hp_gate_mic_jack(stru } } -static void alc256_fixup_dell_xps_13_headphone_noise2 (struct hda_codec *codec, -const struct hda_fixup *fix, -int action) -{ -if (action !=HDA_FIXUP_ACT_PRE_PROBE ) -return ; - -snd_hda_codec_amp_stereo (codec,0x1a ,HDA_INPUT ,0 ,HDA_AMP_VOLMASK ,1 ); -snd_hda_override_wcaps (codec,0x1a ,get_wcaps (codec,0x1a ) & ~AC_WCAP_IN_AMP ); -} -static void alc269_fixup_limit_int_mic_boost (struct hda_codec *codec,const struct hda_fixup *fix,int action)
@@ -5916,8 +5905,6 @@ enum {ALC298_FIXUP_DELL1_MIC_NO_PRESENCE ,ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE ,ALC275_FIXUP_DELL_XPS , -ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE , -ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2 ,ALC293_FIXUP_LENOVO_SPK_NOISE ,ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY , ALC255_FIXUP_DELL_SPK_NOISE,
@@ -6658,23 +6645,6 @@ static const struct hda_fixup alc269_fix {} } }, - [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE] = { - .type = HDA_FIXUP_VERBS, - .v.verbs = (const struct hda_verb []) { -/* Disable pass-through path for FRONT 14h */ - {0x20 ,AC_VERB_SET_COEF_INDEX ,0x36 }, - {0x20 ,AC_VERB_SET_PROC_COEF ,0x1737 }, - {} - }, - .chained = true, - .chain_id =ALC255_FIXUP_DELL1_MIC_NO_PRESENCE - }, - [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc256_fixup_dell_xps_13_headphone_noise2, - .chained = true, - .chain_id =ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE - }, [ALC293_FIXUP_LENOVO_SPK_NOISE] = { .type = HDA_FIXUP_FUNC, .v.func = alc_fixup_disable_aamix,
@@ -7172,17 +7142,14 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1028 ,0x06de ,"Dell" ,ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK ),SND_PCI_QUIRK (0x1028 ,0x06df ,"Dell" ,ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK ),SND_PCI_QUIRK (0x1028 ,0x06e0 ,"Dell" ,ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK ), -SND_PCI_QUIRK (0x1028 ,0x0704 ,"Dell XPS 13 9350" ,ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2 ),SND_PCI_QUIRK (0x1028 ,0x0706 ,"Dell Inspiron 7559" ,ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER ),SND_PCI_QUIRK (0x1028 ,0x0725 ,"Dell Inspiron 3162" ,ALC255_FIXUP_DELL_SPK_NOISE ),SND_PCI_QUIRK (0x1028 ,0x0738 ,"Dell Precision 5820" ,ALC269_FIXUP_NO_SHUTUP ), -SND_PCI_QUIRK (0x1028 ,0x075b ,"Dell XPS 13 9360" ,ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2 ),SND_PCI_QUIRK (0x1028 ,0x075c ,"Dell XPS 27 7760" ,ALC298_FIXUP_SPK_VOLUME ),SND_PCI_QUIRK (0x1028 ,0x075d ,"Dell AIO" ,ALC298_FIXUP_SPK_VOLUME ),SND_PCI_QUIRK (0x1028 ,0x07b0 ,"Dell Precision 7520" ,ALC295_FIXUP_DISABLE_DAC3 ),SND_PCI_QUIRK (0x1028 ,0x0798 ,"Dell Inspiron 17 7000 Gaming" ,ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER ),SND_PCI_QUIRK (0x1028 ,0x080c ,"Dell WYSE" ,ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE ), -SND_PCI_QUIRK (0x1028 ,0x082a ,"Dell XPS 13 9360" ,ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2 ),SND_PCI_QUIRK (0x1028 ,0x084b ,"Dell" ,ALC274_FIXUP_DELL_AIO_LINEOUT_VERB ),SND_PCI_QUIRK (0x1028 ,0x084e ,"Dell" ,ALC274_FIXUP_DELL_AIO_LINEOUT_VERB ), SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
@@ -7536,7 +7503,6 @@ static const struct hda_model_fixup alc2 {.id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc298-dell1"}, {.id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, .name = "alc298-dell-aio"}, {.id = ALC275_FIXUP_DELL_XPS, .name = "alc275-dell-xps"}, - {.id = ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE, .name = "alc256-dell-xps13"}, {.id = ALC293_FIXUP_LENOVO_SPK_NOISE, .name = "lenovo-spk-noise"}, {.id = ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, .name = "lenovo-hotkey"}, {.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"},
Greg Kroah-Hartman
maintainerPATCH 82/254 ALSA: hda/realtek - Add quirk for Lenovo Carbon X1 8th gen
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit ca707b3f00b4f31a6e1eb37e8ae99f15f2bb1fe5 upstream.
The audio setup on the Lenovo Carbon X1 8th gen is the same as that on the Lenovo Carbon X1 7th gen, as such it needs the same ALC285_FIXUP_THINKPAD_HEADSET_JACK quirk.
This fixes volume control of the speaker not working among other things.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -7325,6 +7325,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x225d ,"Thinkpad T480" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x17aa ,0x2292 ,"Thinkpad X1 Yoga 7th" ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ),SND_PCI_QUIRK (0x17aa ,0x2293 ,"Thinkpad X1 Carbon 7th" ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ), +SND_PCI_QUIRK (0x17aa ,0x22be ,"Thinkpad X1 Carbon 8th" ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ),SND_PCI_QUIRK (0x17aa ,0x30bb ,"ThinkCentre AIO" ,ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY ),SND_PCI_QUIRK (0x17aa ,0x30e2 ,"ThinkCentre AIO" ,ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY ), SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
Greg Kroah-Hartman
maintainerPATCH 83/254 ALSA: hda/realtek - Add quirk for MSI GL63
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 1d3aa4a5516d2e4933fe3cca11d3349ef63bc547 upstream.
MSI GL63 laptop requires the similar quirk like other MSI models, ALC1220_FIXUP_CLEVO_P950. The board BIOS doesn't provide a PCI SSID for the device, hence we need to take the codec SSID (1462:1275) instead.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -2447,6 +2447,7 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x1458 ,0xa0b8 ,"Gigabyte AZ370-Gaming" ,ALC1220_FIXUP_GB_DUAL_CODECS ),SND_PCI_QUIRK (0x1458 ,0xa0cd ,"Gigabyte X570 Aorus Master" ,ALC1220_FIXUP_CLEVO_P950 ),SND_PCI_QUIRK (0x1462 ,0x1228 ,"MSI-GP63" ,ALC1220_FIXUP_CLEVO_P950 ), +SND_PCI_QUIRK (0x1462 ,0x1275 ,"MSI-GL63" ,ALC1220_FIXUP_CLEVO_P950 ),SND_PCI_QUIRK (0x1462 ,0x1276 ,"MSI-GL73" ,ALC1220_FIXUP_CLEVO_P950 ),SND_PCI_QUIRK (0x1462 ,0x1293 ,"MSI-GP65" ,ALC1220_FIXUP_CLEVO_P950 ), SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
Greg Kroah-Hartman
maintainerPATCH 84/254 media: venus: cache vb payload to be used by clock scaling
In reply to Greg Kroah-HartmanFrom: Stanimir Varbanov <[email protected]>
commit fd1ee315dcd4a0f913a74939eb88f6d9b0bd9250 upstream.
Instead of iterate over previously queued buffers in clock scaling code do cache the payload in instance context structure for later use when calculating new clock rate.
This will avoid to use spin locks during buffer list iteration in clock_scaling.
This fixes following kernel Oops:
Unable to handle kernel paging request at virtual address deacfffffffffd6c Mem abort info: ESR = 0x96000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 [deacfffffffffd6c] address between user and kernel address ranges Internal error: Oops: 96000004 [#1] PREEMPT SMP CPU: 7 PID: 5763 Comm: V4L2DecoderThre Tainted: G S W 5.4.11 #8 pstate: 20400009 (nzCv daif +PAN -UAO) pc : load_scale_v4+0x4c/0x2bc [venus_core] lr : session_process_buf+0x18c/0x1c0 [venus_core] sp : ffffffc01376b8d0 x29: ffffffc01376b8d0 x28: ffffff80cf1b0220 x27: ffffffc01376bba0 x26: ffffffd8f562b2d8 x25: ffffff80cf1b0220 x24: 0000000000000005 x23: ffffffd8f5620d98 x22: ffffff80ca01c800 x21: ffffff80cf1b0000 x20: ffffff8149490080 x19: ffffff8174b2c010 x18: 0000000000000000 x17: 0000000000000000 x16: ffffffd96ee3a0dc x15: 0000000000000026 x14: 0000000000000026 x13: 00000000000055ac x12: 0000000000000001 x11: deacfffffffffd6c x10: dead000000000100 x9 : ffffff80ca01cf28 x8 : 0000000000000026 x7 : 0000000000000000 x6 : ffffff80cdd899c0 x5 : ffffff80cdd899c0 x4 : 0000000000000008 x3 : ffffff80ca01cf28 x2 : ffffff80ca01cf28 x1 : ffffff80d47ffc00 x0 : ffffff80cf1b0000 Call trace: load_scale_v4+0x4c/0x2bc [venus_core] session_process_buf+0x18c/0x1c0 [venus_core] venus_helper_vb2_buf_queue+0x7c/0xf0 [venus_core] __enqueue_in_driver+0xe4/0xfc [videobuf2_common] vb2_core_qbuf+0x15c/0x338 [videobuf2_common] vb2_qbuf+0x78/0xb8 [videobuf2_v4l2] v4l2_m2m_qbuf+0x80/0xf8 [v4l2_mem2mem] v4l2_m2m_ioctl_qbuf+0x2c/0x38 [v4l2_mem2mem] v4l_qbuf+0x48/0x58 __video_do_ioctl+0x2b0/0x39c video_usercopy+0x394/0x710 video_ioctl2+0x38/0x48 v4l2_ioctl+0x6c/0x80 do_video_ioctl+0xb00/0x2874 v4l2_compat_ioctl32+0x5c/0xcc __se_compat_sys_ioctl+0x100/0x2074 __arm64_compat_sys_ioctl+0x20/0x2c el0_svc_common+0xa4/0x154 el0_svc_compat_handler+0x2c/0x38 el0_svc_compat+0x8/0x10 Code: eb0a013f 54000200 aa1f03e8 d10e514b (b940016c) ---[ end trace e11304b46552e0b9 ]---
--- drivers/media/platform/qcom/venus/core.h | 1 + drivers/media/platform/qcom/venus/helpers.c | 20 +++++++++++++------- 2 files changed, 14 insertions(+), 7 deletions(-)
drivers/media/platform/qcom/venus/core.h +1 -0
@@ -344,6 +344,7 @@ struct venus_inst {unsigned int subscriptions;int buf_count;struct venus_ts_metadata tss[VIDEO_MAX_FRAME ]; +unsigned long payloads[VIDEO_MAX_FRAME ];u64 fps;struct v4l2_fract timeperframe;const struct venus_format *fmt_out;
drivers/media/platform/qcom/venus/helpers.c +13 -7
@@ -544,18 +544,13 @@ static int scale_clocks_v4(struct venus_struct venus_core *core = inst->core;const struct freq_tbl *table = core->res->freq_tbl;unsigned int num_rows = core->res->freq_tbl_size; -struct v4l2_m2m_ctx *m2m_ctx = inst->m2m_ctx;struct device *dev = core->dev;unsigned long freq =0 , freq_core1 =0 , freq_core2 =0 ;unsigned long filled_len =0 ; -struct venus_buffer *buf, *n; -struct vb2_buffer *vb;int i, ret; -v4l2_m2m_for_each_src_buf_safe (m2m_ctx, buf, n) { - vb = &buf->vb.vb2_buf; - filled_len =max (filled_len,vb2_get_plane_payload (vb,0 )); - } +for (i =0 ; i < inst->num_input_bufs; i++) + filled_len =max (filled_len, inst->payloads[i]);if (inst->session_type ==VIDC_SESSION_TYPE_DEC && !filled_len)return 0 ;
@@ -1289,6 +1284,15 @@ int venus_helper_vb2_buf_prepare(struct }EXPORT_SYMBOL_GPL (venus_helper_vb2_buf_prepare); +static void cache_payload (struct venus_inst *inst,struct vb2_buffer *vb) +{ +struct vb2_v4l2_buffer *vbuf =to_vb2_v4l2_buffer (vb); +unsigned int idx = vbuf->vb2_buf.index; + +if (vbuf->vb2_buf.type ==V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE ) + inst->payloads[idx] =vb2_get_plane_payload (vb,0 ); +} +void venus_helper_vb2_buf_queue (struct vb2_buffer *vb) {struct vb2_v4l2_buffer *vbuf =to_vb2_v4l2_buffer (vb);
@@ -1300,6 +1304,8 @@ void venus_helper_vb2_buf_queue(struct vv4l2_m2m_buf_queue (m2m_ctx, vbuf); +cache_payload (inst, vb); +if (inst->session_type ==VIDC_SESSION_TYPE_ENC && !(inst->streamon_out && inst->streamon_cap)) goto unlock;
Greg Kroah-Hartman
maintainerPATCH 85/254 media: venus: firmware: Ignore secure call error on first resume
In reply to Greg Kroah-HartmanFrom: Stanimir Varbanov <[email protected]>
commit 2632e7b618a7730969f9782593c29ca53553aa22 upstream.
With the latest cleanup in qcom scm driver the secure monitor call for setting the remote processor state returns EINVAL when it is called for the first time and after another scm call auth_and_reset. The error returned from scm call could be ignored because the state transition is already done in auth_and_reset.
--- drivers/media/platform/qcom/venus/firmware.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/media/platform/qcom/venus/firmware.c +8 -2
@@ -44,8 +44,14 @@ static void venus_reset_cpu(struct venusint venus_set_hw_state (struct venus_core *core,bool resume) { -if (core->use_tz) -return qcom_scm_set_remote_state (resume,0 ); +int ret; + +if (core->use_tz) { + ret =qcom_scm_set_remote_state (resume,0 ); +if (resume && ret == -EINVAL ) + ret =0 ; +return ret; + }if (resume)venus_reset_cpu (core);
Greg Kroah-Hartman
maintainerPATCH 86/254 media: hantro: Read be32 words starting at every fourth byte
In reply to Greg Kroah-HartmanFrom: Andrzej Pietrasiewicz <[email protected]>
commit e34bca49e4953e5c2afc0425303199a5fd515f82 upstream.
Since (luma/chroma)_qtable is an array of unsigned char, indexing it returns consecutive byte locations, but we are supposed to read the arrays in four-byte words. Consequently, we should be pointing get_unaligned_be32() at consecutive word locations instead.
--- drivers/staging/media/hantro/hantro_h1_jpeg_enc.c | 9 +++++++-- drivers/staging/media/hantro/rk3399_vpu_hw_jpeg_enc.c | 9 +++++++-- 2 files changed, 14 insertions(+), 4 deletions(-)
drivers/staging/media/hantro/hantro_h1_jpeg_enc.c +7 -2
@@ -67,12 +67,17 @@ hantro_h1_jpeg_enc_set_qtable(struct han unsigned char *chroma_qtable) {u32 reg, i; +__be32 *luma_qtable_p; +__be32 *chroma_qtable_p; + + luma_qtable_p = (__be32 *)luma_qtable; + chroma_qtable_p = (__be32 *)chroma_qtable;for (i =0 ; i <H1_JPEG_QUANT_TABLE_COUNT ; i++) { - reg =get_unaligned_be32 (&luma_qtable[i]); + reg =get_unaligned_be32 (&luma_qtable_p[i]);vepu_write_relaxed (vpu, reg,H1_REG_JPEG_LUMA_QUAT (i)); - reg =get_unaligned_be32 (&chroma_qtable[i]); + reg =get_unaligned_be32 (&chroma_qtable_p[i]);vepu_write_relaxed (vpu, reg,H1_REG_JPEG_CHROMA_QUAT (i)); } }
drivers/staging/media/hantro/rk3399_vpu_hw_jpeg_enc.c +7 -2
@@ -98,12 +98,17 @@ rk3399_vpu_jpeg_enc_set_qtable(struct ha unsigned char *chroma_qtable) {u32 reg, i; +__be32 *luma_qtable_p; +__be32 *chroma_qtable_p; + + luma_qtable_p = (__be32 *)luma_qtable; + chroma_qtable_p = (__be32 *)chroma_qtable;for (i =0 ; i <VEPU_JPEG_QUANT_TABLE_COUNT ; i++) { - reg =get_unaligned_be32 (&luma_qtable[i]); + reg =get_unaligned_be32 (&luma_qtable_p[i]);vepu_write_relaxed (vpu, reg,VEPU_REG_JPEG_LUMA_QUAT (i)); - reg =get_unaligned_be32 (&chroma_qtable[i]); + reg =get_unaligned_be32 (&chroma_qtable_p[i]);vepu_write_relaxed (vpu, reg,VEPU_REG_JPEG_CHROMA_QUAT (i)); } }
Greg Kroah-Hartman
maintainerPATCH 87/254 media: ti-vpe: cal: fix disable_irqs to only the intended target
In reply to Greg Kroah-HartmanFrom: Benoit Parrot <[email protected]>
commit 1db56284b9da9056093681f28db48a09a243274b upstream.
disable_irqs() was mistakenly disabling all interrupts when called. This cause all port stream to stop even if only stopping one of them.
--- drivers/media/platform/ti-vpe/cal.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/media/platform/ti-vpe/cal.c +8 -8
@@ -722,16 +722,16 @@ static void enable_irqs(struct cal_ctx *static void disable_irqs (struct cal_ctx *ctx) { +u32 val; +/* Disable IRQ_WDMA_END 0/1 */ -reg_write_field (ctx->dev, -CAL_HL_IRQENABLE_CLR (2 ), -CAL_HL_IRQ_CLEAR , -CAL_HL_IRQ_MASK (ctx->csi2_port)); + val =0 ; +set_field (&val,CAL_HL_IRQ_CLEAR ,CAL_HL_IRQ_MASK (ctx->csi2_port)); +reg_write (ctx->dev,CAL_HL_IRQENABLE_CLR (2 ), val);/* Disable IRQ_WDMA_START 0/1 */ -reg_write_field (ctx->dev, -CAL_HL_IRQENABLE_CLR (3 ), -CAL_HL_IRQ_CLEAR , -CAL_HL_IRQ_MASK (ctx->csi2_port)); + val =0 ; +set_field (&val,CAL_HL_IRQ_CLEAR ,CAL_HL_IRQ_MASK (ctx->csi2_port)); +reg_write (ctx->dev,CAL_HL_IRQENABLE_CLR (3 ), val);/* Todo: Add VC_IRQ and CSI2_COMPLEXIO_IRQ handling */ reg_write (ctx->dev,CAL_CSI2_VC_IRQENABLE (1 ),0 ); }
Greg Kroah-Hartman
maintainerPATCH 88/254 media: ti-vpe: cal: fix a kernel oops when unloading module
In reply to Greg Kroah-HartmanFrom: Benoit Parrot <[email protected]>
commit 80264809ea0a3fd2ee8251f31a9eb85d2c3fc77e upstream.
After the switch to use v4l2_async_notifier_add_subdev() and v4l2_async_notifier_cleanup(), unloading the ti_cal module would cause a kernel oops.
This was root cause to the fact that v4l2_async_notifier_cleanup() tries to kfree the asd pointer passed into v4l2_async_notifier_add_subdev().
In our case the asd reference was from a statically allocated struct. So in effect v4l2_async_notifier_cleanup() was trying to free a pointer that was not kalloc.
So here we switch to using a kzalloc struct instead of a static one. To achieve this we re-order some of the calls to prevent asd allocation from leaking.
--- drivers/media/platform/ti-vpe/cal.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/media/platform/ti-vpe/cal.c +8 -5
@@ -372,8 +372,6 @@ struct cal_ctx {struct v4l2_subdev *sensor;struct v4l2_fwnode_endpoint endpoint; -struct v4l2_async_subdev asd; -struct v4l2_fh fh;struct cal_dev *dev;struct cc_data *cc;
@@ -2032,7 +2030,6 @@ static int of_cal_create_instance(struct parent = pdev->dev.of_node; - asd = &ctx->asd; endpoint = &ctx->endpoint; ep_node =NULL ;
@@ -2079,8 +2076,6 @@ static int of_cal_create_instance(structctx_dbg (3 , ctx,"can't get remote parent\n" ); goto cleanup_exit; } - asd->match_type =V4L2_ASYNC_MATCH_FWNODE ; - asd->match.fwnode =of_fwnode_handle (sensor_node);v4l2_fwnode_endpoint_parse (of_fwnode_handle (ep_node), endpoint);
@@ -2110,9 +2105,17 @@ static int of_cal_create_instance(structv4l2_async_notifier_init (&ctx->notifier); + asd =kzalloc (sizeof (*asd),GFP_KERNEL ); +if (!asd) + goto cleanup_exit; + + asd->match_type =V4L2_ASYNC_MATCH_FWNODE ; + asd->match.fwnode =of_fwnode_handle (sensor_node); + ret =v4l2_async_notifier_add_subdev (&ctx->notifier, asd);if (ret) {ctx_err (ctx,"Error adding asd\n" ); +kfree (asd); goto cleanup_exit; }
Greg Kroah-Hartman
maintainerPATCH 89/254 seccomp: Add missing compat_ioctl for notify
In reply to Greg Kroah-HartmanFrom: Sven Schnelle <[email protected]>
commit 3db81afd99494a33f1c3839103f0429c8f30cb9d upstream.
Executing the seccomp_bpf testsuite under a 64-bit kernel with 32-bit userland (both s390 and x86) doesn't work because there's no compat_ioctl handler defined. Add the handler.
--- kernel/seccomp.c | 1 + 1 file changed, 1 insertion(+)
kernel/seccomp.c +1 -0
@@ -1221,6 +1221,7 @@ static const struct file_operations secc .poll = seccomp_notify_poll, .release = seccomp_notify_release, .unlocked_ioctl = seccomp_notify_ioctl, + .compat_ioctl = seccomp_notify_ioctl, };static struct file *init_listener (struct seccomp_filter *filter)
Greg Kroah-Hartman
maintainerPATCH 90/254 ACPI: EC: Avoid printing confusing messages in acpi_ec_setup()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit c823c17a8ea4db4943152388a0beb9a556715716 upstream.
It doesn't really make sense to pass ec->handle of the ECDT EC to acpi_handle_info(), because it is set to ACPI_ROOT_OBJECT in acpi_ec_ecdt_probe(), so rework acpi_ec_setup() to avoid using acpi_handle_info() for printing messages.
First, notice that the "Used as first EC" message is not really useful, because it is immediately followed by a more meaningful one from either acpi_ec_ecdt_probe() or acpi_ec_dsdt_probe() (the latter also includes the EC object path), so drop it altogether.
Second, use pr_info() for printing the EC configuration information.
While at it, make the code in question avoid printing invalid GPE or IRQ numbers and make it print the GPE/IRQ information only when the driver is ready to handle events.
--- drivers/acpi/ec.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/acpi/ec.c +10 -5
@@ -1584,14 +1584,19 @@ static int acpi_ec_setup(struct acpi_ecreturn ret;/* First EC capable of handling transactions */ -if (!first_ec) { +if (!first_ec) first_ec = ec; -acpi_handle_info (first_ec->handle,"Used as first EC\n" ); + +pr_info ("EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n" , ec->command_addr, + ec->data_addr); + +if (test_bit (EC_FLAGS_EVENT_HANDLER_INSTALLED , &ec->flags)) { +if (ec->gpe >=0 ) +pr_info ("GPE=0x%x\n" , ec->gpe); +else +pr_info ("IRQ=%d\n" , ec->irq); } -acpi_handle_info (ec->handle, -"GPE=0x%x, IRQ=%d, EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n" , - ec->gpe, ec->irq, ec->command_addr, ec->data_addr);return ret; }
Greg Kroah-Hartman
maintainerPATCH 91/254 acpi/x86: ignore unspecified bit positions in the ACPI global lock field
In reply to Greg Kroah-HartmanFrom: Jan Engelhardt <[email protected]>
commit ecb9c790999fd6c5af0f44783bd0217f0b89ec2b upstream.
The value in "new" is constructed from "old" such that all bits defined as reserved by the ACPI spec[1] are left untouched. But if those bits do not happen to be all zero, "new < 3" will not evaluate to true.
The firmware of the laptop(s) Medion MD63490 / Akoya P15648 comes with garbage inside the "FACS" ACPI table. The starting value is old=0x4944454d, therefore new=0x4944454e, which is >= 3. Mask off the reserved bits.
[1] https://uefi.org/sites/default/files/resources/ACPI_6_2.pdf
--- arch/x86/kernel/acpi/boot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/acpi/boot.c +1 -1
@@ -1740,7 +1740,7 @@ int __acpi_acquire_global_lock(unsigned new = (((old & ~0x3 ) +2 ) + ((old >>1 ) &0x1 )); val =cmpxchg (lock, old, new); }while (unlikely (val != old)); -return (new <3 ) ?-1 :0 ; +return ((new &0x3 ) <3 ) ?-1 :0 ; }int __acpi_release_global_lock (unsigned int *lock)
Greg Kroah-Hartman
maintainerPATCH 92/254 ACPICA: Allow acpi_any_gpe_status_set() to skip one GPE
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit 0ce792d660bda990c675eaf14ce09594a9b85cbf upstream.
The check carried out by acpi_any_gpe_status_set() is not precise enough for the suspend-to-idle implementation in Linux and in some cases it is necessary make it skip one GPE (specifically, the EC GPE) from the check to prevent a race condition leading to a premature system resume from occurring.
For this reason, redefine acpi_any_gpe_status_set() to take the number of a GPE to skip as an argument.
--- drivers/acpi/acpica/achware.h | 2 - drivers/acpi/acpica/evxfgpe.c | 17 ++++++++++----- drivers/acpi/acpica/hwgpe.c | 47 +++++++++++++++++++++++++++++++++--------- drivers/acpi/sleep.c | 2 - include/acpi/acpixf.h | 2 - 5 files changed, 53 insertions(+), 17 deletions(-)
drivers/acpi/acpica/achware.h +1 -1
@@ -101,7 +101,7 @@ acpi_status acpi_hw_enable_all_runtime_gacpi_status acpi_hw_enable_all_wakeup_gpes (void ); -u8 acpi_hw_check_all_gpes (void ); +u8 acpi_hw_check_all_gpes (acpi_handle gpe_skip_device,u32 gpe_skip_number); acpi_status acpi_hw_enable_runtime_gpe_block(struct acpi_gpe_xrupt_info *gpe_xrupt_info,
drivers/acpi/acpica/evxfgpe.c +12 -5
@@ -799,17 +799,19 @@ ACPI_EXPORT_SYMBOL(acpi_enable_all_wakeu* * FUNCTION: acpi_any_gpe_status_set * -* PARAMETERS: None +* PARAMETERS: gpe_skip_number - Number of the GPE to skip * * RETURN: Whether or not the status bit is set for any GPE * -* DESCRIPTION: Check the status bits of all enabled GPEs and return TRUE if any -* of them is set or FALSE otherwise. +* DESCRIPTION: Check the status bits of all enabled GPEs, except for the one +* represented by the "skip" argument, and return TRUE if any of +* them is set or FALSE otherwise. * ******************************************************************************/ -u32 acpi_any_gpe_status_set (void ) +u32 acpi_any_gpe_status_set (u32 gpe_skip_number) {acpi_status status; +acpi_handle gpe_device;u8 ret;ACPI_FUNCTION_TRACE (acpi_any_gpe_status_set);
@@ -819,7 +821,12 @@ u32 acpi_any_gpe_status_set(void)return (FALSE); } - ret =acpi_hw_check_all_gpes (); + status =acpi_get_gpe_device (gpe_skip_number, &gpe_device); +if (ACPI_FAILURE (status)) { + gpe_device =NULL ; + } + + ret =acpi_hw_check_all_gpes (gpe_device, gpe_skip_number); (void )acpi_ut_release_mutex (ACPI_MTX_EVENTS );return (ret);
drivers/acpi/acpica/hwgpe.c +38 -9
93 lines not on this page · raw message
drivers/acpi/sleep.c +1 -1
@@ -1026,7 +1026,7 @@ static bool acpi_s2idle_wake(void)* status bit from unset to set between the checks with the * status bits of all the other GPEs unset. */ -if (acpi_any_gpe_status_set () && !acpi_ec_dispatch_gpe ()) +if (acpi_any_gpe_status_set (U32_MAX ) && !acpi_ec_dispatch_gpe ())return true;/*
include/acpi/acpixf.h +1 -1
@@ -752,7 +752,7 @@ ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_disable_all_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_runtime_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_wakeup_gpes(void)) -ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_any_gpe_status_set(void)) +ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_any_gpe_status_set(u32 gpe_skip_number)) ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_any_fixed_event_status_set(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
Greg Kroah-Hartman
maintainerPATCH 93/254 ACPI: PM: s2idle: Refine active GPEs check
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit d5406284ff803a578ca503373624312770319054 upstream.
The check for any active GPEs added by commit fdde0ff8590b ("ACPI:
PM: s2idle: Prevent spurious SCIs from waking up the system") turns out to be insufficiently precise to prevent some systems from resuming prematurely due to a spurious EC wakeup, so refine it by first checking if any GPEs other than the EC GPE are active and skipping all of the SCIs coming from the EC that do not produce any genuine wakeup events after processing.
--- drivers/acpi/ec.c | 5 +++++ drivers/acpi/internal.h | 1 + drivers/acpi/sleep.c | 19 ++++++++++--------- 3 files changed, 16 insertions(+), 9 deletions(-)
drivers/acpi/ec.c +5 -0
@@ -2044,6 +2044,11 @@ void acpi_ec_set_gpe_wake_mask(u8 actionacpi_set_gpe_wake_mask (NULL , first_ec->gpe, action); } +bool acpi_ec_other_gpes_active (void ) +{ +return acpi_any_gpe_status_set (first_ec ? first_ec->gpe :U32_MAX ); +} +bool acpi_ec_dispatch_gpe (void ) {u32 ret;
drivers/acpi/internal.h +1 -0
@@ -202,6 +202,7 @@ void acpi_ec_remove_query_handler(struct#ifdef CONFIG_PM_SLEEP void acpi_ec_flush_work (void ); +bool acpi_ec_other_gpes_active (void );bool acpi_ec_dispatch_gpe (void );#endif
drivers/acpi/sleep.c +10 -9
@@ -1017,19 +1017,20 @@ static bool acpi_s2idle_wake(void)return true;/* -* If there are no EC events to process and at least one of the -* other enabled GPEs is active, the wakeup is regarded as a -* genuine one. -* -* Note that the checks below must be carried out in this order -* to avoid returning prematurely due to a change of the EC GPE -* status bit from unset to set between the checks with the -* status bits of all the other GPEs unset. +* If the status bit is set for any enabled GPE other than the +* EC one, the wakeup is regarded as a genuine one. */ -if (acpi_any_gpe_status_set (U32_MAX ) && !acpi_ec_dispatch_gpe ()) +if (acpi_ec_other_gpes_active ())return true;/* +* If the EC GPE status bit has not been set, the wakeup is +* regarded as a spurious one. +*/ +if (!acpi_ec_dispatch_gpe ()) +return false; + +/* * Cancel the wakeup and process all pending events in case * there are any wakeup ones in there. *
Greg Kroah-Hartman
maintainerPATCH 94/254 thermal: int340x_thermal: fix: Update Tiger Lake ACPI device IDs
In reply to Greg Kroah-HartmanFrom: Gayatri Kammela <[email protected]>
commit 26d8bec1e97ba218b7d82afadca1c049eb75f773 upstream.
Tiger Lake's new unique ACPI device IDs for Intel thermal driver are not valid because of missing 'C' in the IDs. Fix the IDs by updating them.
After the update, the new IDs should now look like INT1040 --> INTC1040
INT1043 --> INTC1043
--- drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 2 +- drivers/thermal/intel/int340x_thermal/int3403_thermal.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/thermal/intel/int340x_thermal/int3400_thermal.c +1 -1
@@ -369,8 +369,8 @@ static int int3400_thermal_remove(struct }static const struct acpi_device_id int3400_thermal_match[] = { - {"INT1040" ,0 }, {"INT3400" ,0 }, + {"INTC1040" ,0 }, {} };
drivers/thermal/intel/int340x_thermal/int3403_thermal.c +1 -1
@@ -282,8 +282,8 @@ static int int3403_remove(struct platfor }static const struct acpi_device_id int3403_device_ids[] = { - {"INT1043" ,0 }, {"INT3403" ,0 }, + {"INTC1043" ,0 }, {"" ,0 }, };MODULE_DEVICE_TABLE (acpi, int3403_device_ids);
Greg Kroah-Hartman
maintainerPATCH 95/254 thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
commit 3f5b9959041e0db6dacbea80bb833bff5900999f upstream.
When CONFIG_DEVFREQ_THERMAL is disabled all functions except of_devfreq_cooling_register_power() were already inlined. Also inline the last function to avoid compile errors when multiple drivers call of_devfreq_cooling_register_power() when CONFIG_DEVFREQ_THERMAL is not set. Compilation failed with the following message:
multiple definition of `of_devfreq_cooling_register_power'
(which then lists all usages of of_devfreq_cooling_register_power())
Thomas Zimmermann reported this problem [0] on a kernel config with CONFIG_DRM_LIMA={m,y}, CONFIG_DRM_PANFROST={m,y} and CONFIG_DEVFREQ_THERMAL=n after both, the lima and panfrost drivers gained devfreq cooling support.
[0] https://www.spinics.net/lists/dri-devel/msg252825.html
--- include/linux/devfreq_cooling.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/devfreq_cooling.h +1 -1
@@ -75,7 +75,7 @@ void devfreq_cooling_unregister(struct t#else /* !CONFIG_DEVFREQ_THERMAL */ -struct thermal_cooling_device * +static inline struct thermal_cooling_device *of_devfreq_cooling_register_power (struct device_node *np,struct devfreq *df,struct devfreq_cooling_power *dfc_power) {
Greg Kroah-Hartman
maintainerPATCH 96/254 nvmet-tcp: fix maxh2cdata icresp parameter
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
commit 9cda34e37489244a8c8628617e24b2dbc8a8edad upstream.
MAXH2CDATA is not zero based. Also no reason to limit ourselves to 1M transfers as we can do more easily. Make this an arbitrary limit of 16M.
--- drivers/nvme/target/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/target/tcp.c +1 -1
@@ -794,7 +794,7 @@ static int nvmet_tcp_handle_icreq(struct icresp->hdr.pdo =0 ; icresp->hdr.plen =cpu_to_le32 (icresp->hdr.hlen); icresp->pfv =cpu_to_le16 (NVME_TCP_PFV_1_0 ); - icresp->maxdata =cpu_to_le32 (0xffff );/* FIXME: support r2t */ + icresp->maxdata =cpu_to_le32 (0x400000 );/* 16M arbitrary limit */ icresp->cpda =0 ;if (queue->hdr_digest) icresp->digest |=NVME_TCP_HDR_DIGEST_ENABLE ;
Greg Kroah-Hartman
maintainerPATCH 97/254 nvme-fc: Revert "add module to ops template to allow module references"
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
commit 8c5c660529209a0e324c1c1a35ce3f83d67a2aa5 upstream.
The original patch was to resolve the lldd being able to be unloaded while being used to talk to the boot device of the system. However, the end result of the original patch is that any driver unload while a nvme controller is live via the lldd is now being prohibited. Given the module reference, the module teardown routine can't be called, thus there's no way, other than manual actions to terminate the controllers.
--- drivers/nvme/host/fc.c | 14 ++------------ drivers/nvme/target/fcloop.c | 1 - drivers/scsi/lpfc/lpfc_nvme.c | 2 -- drivers/scsi/qla2xxx/qla_nvme.c | 1 - include/linux/nvme-fc-driver.h | 4 ---- 5 files changed, 2 insertions(+), 20 deletions(-)
drivers/nvme/host/fc.c +2 -12
@@ -342,8 +342,7 @@ nvme_fc_register_localport(struct nvme_f !template->ls_req || !template->fcp_io || !template->ls_abort || !template->fcp_abort || !template->max_hw_queues || !template->max_sgl_segments || - !template->max_dif_sgl_segments || !template->dma_boundary || - !template->module) { + !template->max_dif_sgl_segments || !template->dma_boundary) { ret = -EINVAL ; goto out_reghost_failed; }
@@ -2016,7 +2015,6 @@ nvme_fc_ctrl_free(struct kref *ref) {struct nvme_fc_ctrl *ctrl = container_of(ref, struct nvme_fc_ctrl, ref); -struct nvme_fc_lport *lport = ctrl->lport;unsigned long flags;if (ctrl->ctrl.tagset) {
@@ -2043,7 +2041,6 @@ nvme_fc_ctrl_free(struct kref *ref)if (ctrl->ctrl.opts)nvmf_free_options (ctrl->ctrl.opts);kfree (ctrl); -module_put (lport->ops->module); } static void
@@ -3074,15 +3071,10 @@ nvme_fc_init_ctrl(struct device *dev, st goto out_fail; } -if (!try_module_get (lport->ops->module)) { - ret = -EUNATCH ; - goto out_free_ctrl; - } - idx =ida_simple_get (&nvme_fc_ctrl_cnt,0 ,0 ,GFP_KERNEL );if (idx <0 ) { ret = -ENOSPC ; - goto out_mod_put; + goto out_free_ctrl; } ctrl->ctrl.opts = opts;
@@ -3235,8 +3227,6 @@ out_free_queues: out_free_ida:put_device (ctrl->dev);ida_simple_remove (&nvme_fc_ctrl_cnt, ctrl->cnum); -out_mod_put: -module_put (lport->ops->module); out_free_ctrl:kfree (ctrl); out_fail:
drivers/nvme/target/fcloop.c +0 -1
@@ -850,7 +850,6 @@ fcloop_targetport_delete(struct nvmet_fc#define FCLOOP_DMABOUND_4G 0xFFFFFFFFstatic struct nvme_fc_port_template fctemplate = { - .module =THIS_MODULE , .localport_delete = fcloop_localport_delete, .remoteport_delete = fcloop_remoteport_delete, .create_queue = fcloop_create_queue,
drivers/scsi/lpfc/lpfc_nvme.c +0 -2
@@ -1985,8 +1985,6 @@ out_unlock:/* Declare and initialization an instance of the FC NVME template. */ static struct nvme_fc_port_template lpfc_nvme_template = { - .module =THIS_MODULE , -/* initiator-based functions */ .localport_delete = lpfc_nvme_localport_delete, .remoteport_delete = lpfc_nvme_remoteport_delete,
drivers/scsi/qla2xxx/qla_nvme.c +0 -1
@@ -610,7 +610,6 @@ static void qla_nvme_remoteport_delete(s }static struct nvme_fc_port_template qla_nvme_fc_transport = { - .module =THIS_MODULE , .localport_delete = qla_nvme_localport_delete, .remoteport_delete = qla_nvme_remoteport_delete, .create_queue = qla_nvme_alloc_queue,
include/linux/nvme-fc-driver.h +0 -4
@@ -270,8 +270,6 @@ struct nvme_fc_remote_port {* * Host/Initiator Transport Entrypoints/Parameters: * -* @module: The LLDD module using the interface -* * @localport_delete: The LLDD initiates deletion of a localport via * nvme_fc_deregister_localport(). However, the teardown is * asynchronous. This routine is called upon the completion of the
@@ -385,8 +383,6 @@ struct nvme_fc_remote_port {* Value is Mandatory. Allowed to be zero. */ struct nvme_fc_port_template { -struct module *module; -/* initiator-based functions */ void (*localport_delete)(struct nvme_fc_local_port *);void (*remoteport_delete)(struct nvme_fc_remote_port *);
Greg Kroah-Hartman
maintainerPATCH 98/254 efi/x86: Add TPM related EFI tables to unencrypted mapping checks
In reply to Greg Kroah-HartmanFrom: Tom Lendacky <[email protected]>
commit f10e80a19b07b58fc2adad7945f8313b01503bae upstream.
When booting with SME active, EFI tables must be mapped unencrypted since they were built by UEFI in unencrypted memory. Update the list of tables to be checked during early_memremap() processing to account for the EFI TPM tables.
This fixes a bug where an EFI TPM log table has been created by UEFI, but it lives in memory that has been marked as usable rather than reserved.
--- arch/x86/platform/efi/efi.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/platform/efi/efi.c +2 -0
@@ -85,6 +85,8 @@ static const unsigned long * const efi_t#ifdef CONFIG_EFI_RCI2_TABLE &rci2_table_phys, #endif + &efi.tpm_log, + &efi.tpm_final_log, };u64 efi_setup;/* efi setup_data physical address */
Greg Kroah-Hartman
maintainerPATCH 99/254 PCI: pciehp: Fix indefinite wait on sysfs requests
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit 3e487d2e4aa466decd226353755c9d423e8fbacc upstream.
David Hoyer reports that powering pciehp slots up or down via sysfs may
hang: The call to wait_event() in pciehp_sysfs_enable_slot() and _disable_slot() does not return because ctrl->ist_running remains true.
This flag, which was introduced by commit 157c1062fcd8 ("PCI: pciehp: Avoid returning prematurely from sysfs requests"), signifies that the IRQ thread pciehp_ist() is running. It is set to true at the top of pciehp_ist() and reset to false at the end. However there are two additional return statements in pciehp_ist() before which the commit neglected to reset the flag to false and wake up waiters for the flag.
That omission opens up the following race when powering up the slot:
* pciehp_ist() runs because a PCI_EXP_SLTSTA_PDC event was requested by pciehp_sysfs_enable_slot()
* pciehp_ist() turns on slot power via the following call stack:
pciehp_handle_presence_or_link_change() -> pciehp_enable_slot() -> __pciehp_enable_slot() -> board_added() -> pciehp_power_on_slot()
* after slot power is turned on, the link comes up, resulting in a PCI_EXP_SLTSTA_DLLSC event
* the IRQ handler pciehp_isr() stores the event in ctrl->pending_events and returns IRQ_WAKE_THREAD
* the IRQ thread is already woken (it's bringing up the slot), but the genirq code remembers to re-run the IRQ thread after it has finished (such that it can deal with the new event) by setting IRQTF_RUNTHREAD via __handle_irq_event_percpu() -> __irq_wake_thread()
* the IRQ thread removes PCI_EXP_SLTSTA_DLLSC from ctrl->pending_events via board_added() -> pciehp_check_link_status() in order to deal with presence and link flaps per commit 6c35a1ac3da6 ("PCI: pciehp:
Tolerate initially unstable link")
* after pciehp_ist() has successfully brought up the slot, it resets ctrl->ist_running to false and wakes up the sysfs requester
* the genirq code re-runs pciehp_ist(), which sets ctrl->ist_running to true but then returns with IRQ_NONE because ctrl->pending_events is empty
* pciehp_sysfs_enable_slot() is finally woken but notices that ctrl->ist_running is true, hence continues waiting
The only way to get the hung task going again is to trigger a hotplug event which brings down the slot, e.g. by yanking out the card.
The same race exists when powering down the slot because remove_board() likewise clears link or presence changes in ctrl->pending_events per commit 3943af9d01e9 ("PCI: pciehp: Ignore Link State Changes after powering off a slot") and thereby may cause a re-run of pciehp_ist() which returns with IRQ_NONE without resetting ctrl->ist_running to false.
Fix by adding a goto label before the teardown steps at the end of pciehp_ist() and jumping to that label from the two return statements which currently neglect to reset the ctrl->ist_running flag.
--- drivers/pci/hotplug/pciehp_hpc.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/pci/hotplug/pciehp_hpc.c +7 -7
@@ -625,17 +625,15 @@ static irqreturn_t pciehp_ist(int irq, vif (atomic_fetch_and (~RERUN_ISR , &ctrl->pending_events) &RERUN_ISR ) { ret =pciehp_isr (irq, dev_id);enable_irq (irq); -if (ret !=IRQ_WAKE_THREAD ) { -pci_config_pm_runtime_put (pdev); -return ret; - } +if (ret !=IRQ_WAKE_THREAD ) + goto out; }synchronize_hardirq (irq); events =atomic_xchg (&ctrl->pending_events,0 );if (!events) { -pci_config_pm_runtime_put (pdev); -return IRQ_NONE ; + ret =IRQ_NONE ; + goto out; }/* Check Attention Button Pressed */
@@ -664,10 +662,12 @@ static irqreturn_t pciehp_ist(int irq, vpciehp_handle_presence_or_link_change (ctrl, events);up_read (&ctrl->reset_lock); + ret =IRQ_HANDLED ; +out:pci_config_pm_runtime_put (pdev); ctrl->ist_running = false;wake_up (&ctrl->requester); -return IRQ_HANDLED ; +return ret; }static int pciehp_poll (void *data)
Greg Kroah-Hartman
maintainerPATCH 100/254 PCI/ASPM: Clear the correct bits when enabling L1 substates
In reply to Greg Kroah-HartmanFrom: Yicong Yang <[email protected]>
commit 58a3862a10a317a81097ab0c78aecebabb1704f5 upstream.
In pcie_config_aspm_l1ss(), we cleared the wrong bits when enabling ASPM L1 Substates. Instead of the L1.x enable bits (PCI_L1SS_CTL1_L1SS_MASK, 0xf), we cleared the Link Activation Interrupt Enable bit (PCI_L1SS_CAP_L1_PM_SS, 0x10).
Clear the L1.x enable bits before writing the new L1.x configuration.
--- drivers/pci/pcie/aspm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/pcie/aspm.c +2 -2
@@ -747,9 +747,9 @@ static void pcie_config_aspm_l1ss(struct/* Enable what we need to enable */ pci_clear_and_set_dword (parent, up_cap_ptr +PCI_L1SS_CTL1 , -PCI_L1SS_CAP_L1_PM_SS , val); +PCI_L1SS_CTL1_L1SS_MASK , val);pci_clear_and_set_dword (child, dw_cap_ptr +PCI_L1SS_CTL1 , -PCI_L1SS_CAP_L1_PM_SS , val); +PCI_L1SS_CTL1_L1SS_MASK , val); }static void pcie_config_aspm_dev (struct pci_dev *pdev,u32 val)
Greg Kroah-Hartman
maintainerPATCH 101/254 PCI: Add boot interrupt quirk mechanism for Xeon chipsets
In reply to Greg Kroah-HartmanFrom: Sean V Kelley <[email protected]>
commit b88bf6c3b6ff77948c153cac4e564642b0b90632 upstream.
The following was observed by Kar Hin Ong with RT patchset:
Backtrace:
irq 19: nobody cared (try booting with the "irqpoll" option)
CPU: 0 PID: 3329 Comm: irq/34-nipalk Tainted:4.14.87-rt49 #1
Hardware name: National Instruments NI PXIe-8880/NI PXIe-8880,
BIOS 2.1.5f1 01/09/2020
Call Trace:
<IRQ>
? dump_stack+0x46/0x5e
? __report_bad_irq+0x2e/0xb0
? note_interrupt+0x242/0x290
? nNIKAL100_memoryRead16+0x8/0x10 [nikal]
? handle_irq_event_percpu+0x55/0x70
? handle_irq_event+0x4f/0x80
? handle_fasteoi_irq+0x81/0x180
? handle_irq+0x1c/0x30
? do_IRQ+0x41/0xd0
? common_interrupt+0x84/0x84
</IRQ>
...
handlers:
[<ffffffffb3297200>] irq_default_primary_handler threaded
[<ffffffffb3669180>] usb_hcd_irq
Disabling IRQ #19The problem being that this device is triggering boot interrupts due to threaded interrupt handling and masking of the IO-APIC. These boot interrupts are then forwarded on to the legacy PCH's PIRQ lines where there is no handler present for the device.
Whenever a PCI device fires interrupt (INTx) to Pin 20 of IOAPIC 2 (GSI 44), the kernel receives two interrupts:
1. Interrupt from Pin 20 of IOAPIC 2 -> Expected
2. Interrupt from Pin 19 of IOAPIC 1 -> UNEXPECTED
Quirks for disabling boot interrupts (preferred) or rerouting the handler exist but do not address these Xeon chipsets' mechanism:
https://lore.kernel.org/lkml/[email protected]/
Add a new mechanism via PCI CFG for those chipsets supporting CIPINTRC register's dis_intx_rout2ich bit.
--- drivers/pci/quirks.c | 80 ++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 73 insertions(+), 7 deletions(-)
drivers/pci/quirks.c +73 -7
@@ -1970,26 +1970,92 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_I/* * IO-APIC1 on 6300ESB generates boot interrupts, see Intel order no * 300641-004US, section 5.7.3. +* +* Core IO on Xeon E5 1600/2600/4600, see Intel order no 326509-003. +* Core IO on Xeon E5 v2, see Intel order no 329188-003. +* Core IO on Xeon E7 v2, see Intel order no 329595-002. +* Core IO on Xeon E5 v3, see Intel order no 330784-003. +* Core IO on Xeon E7 v3, see Intel order no 332315-001US. +* Core IO on Xeon E5 v4, see Intel order no 333810-002US. +* Core IO on Xeon E7 v4, see Intel order no 332315-001US. +* Core IO on Xeon D-1500, see Intel order no 332051-001. +* Core IO on Xeon Scalable, see Intel order no 610950. */ -#define INTEL_6300_IOAPIC_ABAR 0x40 +#define INTEL_6300_IOAPIC_ABAR 0x40/* Bus 0, Dev 29, Func 5 */ #define INTEL_6300_DISABLE_BOOT_IRQ (1<<14) +#define INTEL_CIPINTRC_CFG_OFFSET 0x14C/* Bus 0, Dev 5, Func 0 */ +#define INTEL_CIPINTRC_DIS_INTX_ICH (1<<25) +static void quirk_disable_intel_boot_interrupt (struct pci_dev *dev) {u16 pci_config_word; +u32 pci_config_dword;if (noioapicquirk)return ; -pci_read_config_word (dev,INTEL_6300_IOAPIC_ABAR , &pci_config_word); - pci_config_word |=INTEL_6300_DISABLE_BOOT_IRQ ; -pci_write_config_word (dev,INTEL_6300_IOAPIC_ABAR , pci_config_word); - +switch (dev->device) { +case PCI_DEVICE_ID_INTEL_ESB_10 : +pci_read_config_word (dev,INTEL_6300_IOAPIC_ABAR , + &pci_config_word); + pci_config_word |=INTEL_6300_DISABLE_BOOT_IRQ ; +pci_write_config_word (dev,INTEL_6300_IOAPIC_ABAR , + pci_config_word); +break ; +case 0x3c28 :/* Xeon E5 1600/2600/4600 */ +case 0x0e28 :/* Xeon E5/E7 V2 */ +case 0x2f28 :/* Xeon E5/E7 V3,V4 */ +case 0x6f28 :/* Xeon D-1500 */ +case 0x2034 :/* Xeon Scalable Family */ +pci_read_config_dword (dev,INTEL_CIPINTRC_CFG_OFFSET , + &pci_config_dword); + pci_config_dword |=INTEL_CIPINTRC_DIS_INTX_ICH ; +pci_write_config_dword (dev,INTEL_CIPINTRC_CFG_OFFSET , + pci_config_dword); +break ; +default : +return ; + }pci_info (dev,"disabled boot interrupts on device [%04x:%04x]\n" , dev->vendor, dev->device); } -DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_ESB_10 , quirk_disable_intel_boot_interrupt); -DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_ESB_10 , quirk_disable_intel_boot_interrupt); +/* +* Device 29 Func 5 Device IDs of IO-APIC +* containing ABAR—APIC1 Alternate Base Address Register +*/ +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_ESB_10 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_ESB_10 , + quirk_disable_intel_boot_interrupt); + +/* +* Device 5 Func 0 Device IDs of Core IO modules/hubs +* containing Coherent Interface Protocol Interrupt Control +* +* Device IDs obtained from volume 2 datasheets of commented +* families above. +*/ +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x3c28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x0e28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x2f28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x6f28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x2034 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,0x3c28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,0x0e28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,0x2f28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,0x6f28 , + quirk_disable_intel_boot_interrupt); +DECLARE_PCI_FIXUP_RESUME (PCI_VENDOR_ID_INTEL ,0x2034 , + quirk_disable_intel_boot_interrupt);/* Disable boot interrupts on HT-1000 */ #define BC_HT1000_FEATURE_REG 0x64
Greg Kroah-Hartman
maintainerPATCH 102/254 PCI: qcom: Fix the fixup of PCI_VENDOR_ID_QCOM
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
commit 604f3956524a6a53c1e3dd27b4b685b664d181ec upstream.
There exists non-bridge PCIe devices with PCI_VENDOR_ID_QCOM, so limit the fixup to only affect the relevant PCIe bridges.
--- drivers/pci/controller/dwc/pcie-qcom.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-qcom.c +7 -1
@@ -1439,7 +1439,13 @@ static void qcom_fixup_class(struct pci_ { dev->class =PCI_CLASS_BRIDGE_PCI <<8 ; } -DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,PCI_ANY_ID , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x0101 , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x0104 , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x0106 , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x0107 , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x0302 , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x1000 , qcom_fixup_class); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_QCOM ,0x1001 , qcom_fixup_class);static struct platform_driver qcom_pcie_driver = { .probe = qcom_pcie_probe,
Greg Kroah-Hartman
maintainerPATCH 103/254 PCI: endpoint: Fix for concurrent memory allocation in OB address region
In reply to Greg Kroah-HartmanFrom: Kishon Vijay Abraham I <[email protected]>
commit 04e046ca57ebed3943422dee10eec9e73aec081e upstream.
pci-epc-mem uses a bitmap to manage the Endpoint outbound (OB) address region. This address region will be shared by multiple endpoint functions (in the case of multi function endpoint) and it has to be protected from concurrent access to avoid updating an inconsistent state.
Use a mutex to protect bitmap updates to prevent the memory allocation API from returning incorrect addresses.
--- drivers/pci/endpoint/pci-epc-mem.c | 10 ++++++++-- include/linux/pci-epc.h | 3 +++ 2 files changed, 11 insertions(+), 2 deletions(-)
drivers/pci/endpoint/pci-epc-mem.c +8 -2
@@ -79,6 +79,7 @@ int __pci_epc_mem_init(struct pci_epc *e mem->page_size = page_size; mem->pages = pages; mem->size = size; +mutex_init (&mem->lock); epc->mem = mem;
@@ -122,7 +123,7 @@ void __iomem *pci_epc_mem_alloc_addr(str phys_addr_t *phys_addr, size_t size) { int pageno; -void __iomem *virt_addr; +void __iomem *virt_addr =NULL ;struct pci_epc_mem *mem = epc->mem;unsigned int page_shift =ilog2 (mem->page_size);int order;
@@ -130,15 +131,18 @@ void __iomem *pci_epc_mem_alloc_addr(str size =ALIGN (size, mem->page_size); order =pci_epc_mem_get_order (mem, size); +mutex_lock (&mem->lock); pageno =bitmap_find_free_region (mem->bitmap, mem->pages, order);if (pageno <0 ) -return NULL ; + goto ret; *phys_addr = mem->phys_base + ((phys_addr_t )pageno << page_shift); virt_addr =ioremap (*phys_addr, size);if (!virt_addr)bitmap_release_region (mem->bitmap, pageno, order); +ret: +mutex_unlock (&mem->lock);return virt_addr; }EXPORT_SYMBOL_GPL (pci_epc_mem_alloc_addr);
@@ -164,7 +168,9 @@ void pci_epc_mem_free_addr(struct pci_ep pageno = (phys_addr - mem->phys_base) >> page_shift; size =ALIGN (size, mem->page_size); order =pci_epc_mem_get_order (mem, size); +mutex_lock (&mem->lock);bitmap_release_region (mem->bitmap, pageno, order); +mutex_unlock (&mem->lock); }EXPORT_SYMBOL_GPL (pci_epc_mem_free_addr);
include/linux/pci-epc.h +3 -0
@@ -71,6 +71,7 @@ struct pci_epc_ops {* @bitmap: bitmap to manage the PCI address space * @pages: number of bits representing the address region * @page_size: size of each page +* @lock: mutex to protect bitmap */ struct pci_epc_mem {phys_addr_t phys_base;
@@ -78,6 +79,8 @@ struct pci_epc_mem {unsigned long *bitmap;size_t page_size;int pages; +/* mutex to protect against concurrent access for memory allocation*/ +struct mutex lock; };/**
Greg Kroah-Hartman
maintainerPATCH 104/254 erofs: correct the remaining shrink objects
In reply to Greg Kroah-HartmanFrom: Gao Xiang <[email protected]>
commit 9d5a09c6f3b5fb85af20e3a34827b5d27d152b34 upstream.
The remaining count should not include successful
shrink attempts.
--- fs/erofs/utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/erofs/utils.c +1 -1
@@ -286,7 +286,7 @@ static unsigned long erofs_shrink_scan(sspin_unlock (&erofs_sb_list_lock); sbi->shrinker_run_no = run_no; - freed +=erofs_shrink_workstation (sbi, nr); + freed +=erofs_shrink_workstation (sbi, nr - freed);spin_lock (&erofs_sb_list_lock);/* Get the next list element before we move this one */
Greg Kroah-Hartman
maintainerPATCH 105/254 sched/fair: Fix enqueue_task_fair warning
In reply to Greg Kroah-HartmanFrom: Vincent Guittot <[email protected]>
commit fe61468b2cbc2b7ce5f8d3bf32ae5001d4c434e9 upstream.
When a cfs rq is throttled, the latter and its child are removed from the leaf list but their nr_running is not changed which includes staying higher than 1. When a task is enqueued in this throttled branch, the cfs rqs must be added back in order to ensure correct ordering in the list but this can only happens if nr_running == 1.
When cfs bandwidth is used, we call unconditionnaly list_add_leaf_cfs_rq() when enqueuing an entity to make sure that the complete branch will be added.
Similarly unthrottle_cfs_rq() can stop adding cfs in the list when a parent is throttled. Iterate the remaining entity to ensure that the complete branch will be added in the list.
--- kernel/sched/fair.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-)
kernel/sched/fair.c +22 -4
@@ -3957,6 +3957,7 @@ static inline void check_schedstat_requi#endif } +static inline bool cfs_bandwidth_used (void );/* * MIGRATION
@@ -4035,10 +4036,16 @@ enqueue_entity(struct cfs_rq *cfs_rq, st__enqueue_entity (cfs_rq, se); se->on_rq =1 ; -if (cfs_rq->nr_running ==1 ) { +/* +* When bandwidth control is enabled, cfs might have been removed +* because of a parent been throttled but cfs->nr_running > 1. Try to +* add it unconditionnally. +*/ +if (cfs_rq->nr_running ==1 ||cfs_bandwidth_used ())list_add_leaf_cfs_rq (cfs_rq); + +if (cfs_rq->nr_running ==1 )check_enqueue_throttle (cfs_rq); - } }static void __clear_buddies_last (struct sched_entity *se)
@@ -4619,11 +4626,22 @@ void unthrottle_cfs_rq(struct cfs_rq *cfbreak ; } -assert_list_leaf_cfs_rq (rq); -if (!se)add_nr_running (rq, task_delta); +/* +* The cfs_rq_throttled() breaks in the above iteration can result in +* incomplete leaf list maintenance, resulting in triggering the +* assertion below. +*/ +for_each_sched_entity (se) { + cfs_rq =cfs_rq_of (se); + +list_add_leaf_cfs_rq (cfs_rq); + } + +assert_list_leaf_cfs_rq (rq); +/* Determine whether we need to wake up potentially idle CPU: */ if (rq->curr == rq->idle && rq->cfs.nr_running)resched_curr (rq);
Greg Kroah-Hartman
maintainerPATCH 106/254 tpm: Dont make log failures fatal
In reply to Greg Kroah-HartmanFrom: Matthew Garrett <[email protected]>
commit 805fa88e0780b7ce1cc9b649dd91a0a7164c6eb4 upstream.
If a TPM is in disabled state, it's reasonable for it to have an empty log. Bailing out of probe in this case means that the PPI interface isn't available, so there's no way to then enable the TPM from the OS. In general it seems reasonable to ignore log errors - they shouldn't interfere with any other TPM functionality.
--- drivers/char/tpm/eventlog/common.c | 12 ++++-------- drivers/char/tpm/tpm-chip.c | 4 +--- drivers/char/tpm/tpm.h | 2 +- 3 files changed, 6 insertions(+), 12 deletions(-)
drivers/char/tpm/eventlog/common.c +4 -8
@@ -99,11 +99,8 @@ static int tpm_read_log(struct tpm_chip* * If an event log is found then the securityfs files are setup to * export it to userspace, otherwise nothing is done. -* -* Returns -ENODEV if the firmware has no event log or securityfs is not -* supported. */ -int tpm_bios_log_setup (struct tpm_chip *chip) +void tpm_bios_log_setup (struct tpm_chip *chip) {const char *name =dev_name (&chip->dev);unsigned int cnt;
@@ -112,7 +109,7 @@ int tpm_bios_log_setup(struct tpm_chip * rc =tpm_read_log (chip);if (rc <0 ) -return rc; +return ; log_version = rc; cnt =0 ;
@@ -158,13 +155,12 @@ int tpm_bios_log_setup(struct tpm_chip * cnt++; } -return 0 ; +return ; err: - rc =PTR_ERR (chip->bios_dir[cnt]); chip->bios_dir[cnt] =NULL ;tpm_bios_log_teardown (chip); -return rc; +return ; }void tpm_bios_log_teardown (struct tpm_chip *chip)
drivers/char/tpm/tpm-chip.c +1 -3
@@ -596,9 +596,7 @@ int tpm_chip_register(struct tpm_chip *ctpm_sysfs_add_device (chip); - rc =tpm_bios_log_setup (chip); -if (rc !=0 && rc != -ENODEV ) -return rc; +tpm_bios_log_setup (chip);tpm_add_ppi (chip);
drivers/char/tpm/tpm.h +1 -1
@@ -235,7 +235,7 @@ int tpm2_prepare_space(struct tpm_chip *int tpm2_commit_space (struct tpm_chip *chip,struct tpm_space *space,void *buf,size_t *bufsiz); -int tpm_bios_log_setup (struct tpm_chip *chip); +void tpm_bios_log_setup (struct tpm_chip *chip);void tpm_bios_log_teardown (struct tpm_chip *chip);int tpm_dev_common_init (void );void tpm_dev_common_exit (void );
Greg Kroah-Hartman
maintainerPATCH 107/254 tpm: tpm1_bios_measurements_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
commit d7a47b96ed1102551eb7325f97937e276fb91045 upstream.
If .next function does not change position index, following .show function will repeat output related to current position index.
In case of /sys/kernel/security/tpm0/ascii_bios_measurements and binary_bios_measurements:
1) read after lseek beyound end of file generates whole last line.
2) read after lseek to middle of last line generates expected end of last line and unexpected whole last line once again.
--- drivers/char/tpm/eventlog/tpm1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/tpm/eventlog/tpm1.c +1 -1
@@ -115,6 +115,7 @@ static void *tpm1_bios_measurements_nextu32 converted_event_size;u32 converted_event_type; + (*pos)++; converted_event_size =do_endian_conversion (event->event_size); v +=sizeof (struct tcpa_event ) + converted_event_size;
@@ -132,7 +133,6 @@ static void *tpm1_bios_measurements_next ((v + sizeof(struct tcpa_event) + converted_event_size) > limit))return NULL ; - (*pos)++;return v; }
Greg Kroah-Hartman
maintainerPATCH 108/254 tpm: tpm2_bios_measurements_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
commit f9bf8adb55cd5a357b247a16aafddf8c97b276e0 upstream.
If .next function does not change position index, following .show function will repeat output related to current position index.
For /sys/kernel/security/tpm0/binary_bios_measurements:
1) read after lseek beyound end of file generates whole last line.
2) read after lseek to middle of last line generates expected end of last line and unexpected whole last line once again.
--- drivers/char/tpm/eventlog/tpm2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/tpm/eventlog/tpm2.c +1 -1
@@ -94,6 +94,7 @@ static void *tpm2_bios_measurements_nextsize_t event_size;void *marker; + (*pos)++; event_header = log->bios_event_log;if (v ==SEQ_START_TOKEN ) {
@@ -118,7 +119,6 @@ static void *tpm2_bios_measurements_nextif (((v + event_size) >= limit) || (event_size ==0 ))return NULL ; - (*pos)++;return v; }
Greg Kroah-Hartman
maintainerPATCH 109/254 KEYS: reaching the keys quotas correctly
In reply to Greg Kroah-HartmanFrom: Yang Xu <[email protected]>
commit 2e356101e72ab1361821b3af024d64877d9a798d upstream.
Currently, when we add a new user key, the calltrace as below:
add_key()
key_create_or_update()
key_alloc()
__key_instantiate_and_link
generic_key_instantiate
key_payload_reserve
......Since commit a08bf91ce28e ("KEYS: allow reaching the keys quotas exactly"), we can reach max bytes/keys in key_alloc, but we forget to remove this limit when we reserver space for payload in key_payload_reserve. So we can only reach max keys but not max bytes when having delta between plen and type->def_datalen. Remove this limit when instantiating the key, so we can keep consistent with key_alloc.
Also, fix the similar problem in keyctl_chown_key().
--- security/keys/key.c | 2 +- security/keys/keyctl.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
security/keys/key.c +1 -1
@@ -382,7 +382,7 @@ int key_payload_reserve(struct key *key,spin_lock (&key->user->lock);if (delta >0 && - (key->user->qnbytes + delta >= maxbytes || + (key->user->qnbytes + delta > maxbytes || key->user->qnbytes + delta < key->user->qnbytes)) { ret = -EDQUOT ; }
security/keys/keyctl.c +2 -2
@@ -937,8 +937,8 @@ long keyctl_chown_key(key_serial_t id, u key_quota_root_maxbytes : key_quota_maxbytes;spin_lock (&newowner->lock); -if (newowner->qnkeys +1 >= maxkeys || - newowner->qnbytes + key->quotalen >= maxbytes || +if (newowner->qnkeys +1 > maxkeys || + newowner->qnbytes + key->quotalen > maxbytes || newowner->qnbytes + key->quotalen < newowner->qnbytes) goto quota_overrun;
Greg Kroah-Hartman
maintainerPATCH 110/254 mmc: mmci_sdmmc: Fix clear busyd0end irq flag
In reply to Greg Kroah-HartmanFrom: Ludovic Barre <[email protected]>
commit d4a384cb563e555ce00255f5f496b503e6cc6358 upstream.
The busyd0 line transition can be very fast. The busy request may be completed by busy_d0end, without waiting for the busy_d0 steps. Therefore, clear the busyd0end irq flag, even if no busy_status.
--- drivers/mmc/host/mmci_stm32_sdmmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/mmci_stm32_sdmmc.c +2 -2
@@ -315,11 +315,11 @@ complete:if (host->busy_status) {writel_relaxed (mask & ~host->variant->busy_detect_mask, base +MMCIMASK0 ); -writel_relaxed (host->variant->busy_detect_mask, - base +MMCICLEAR ); host->busy_status =0 ; } +writel_relaxed (host->variant->busy_detect_mask, base +MMCICLEAR ); +return true; }
Greg Kroah-Hartman
maintainerPATCH 111/254 rcu: Make rcu_barrier() account for offline no-CBs CPUs
In reply to Greg Kroah-HartmanFrom: Paul E. McKenney <[email protected]>
commit 127e29815b4b2206c0a97ac1d83f92ffc0e25c34 upstream.
Currently, rcu_barrier() ignores offline CPUs, However, it is possible for an offline no-CBs CPU to have callbacks queued, and rcu_barrier() must wait for those callbacks. This commit therefore makes rcu_barrier() directly invoke the rcu_barrier_func() with interrupts disabled for such CPUs. This requires passing the CPU number into this function so that it can entrain the rcu_barrier() callback onto the correct CPU's callback list, given that the code must instead execute on the current CPU.
While in the area, this commit fixes a bug where the first CPU's callback might have been invoked before rcu_segcblist_entrain() returned, which would also result in an early wakeup.
--- include/trace/events/rcu.h | 1 + kernel/rcu/tree.c | 36 ++++++++++++++++++++++++------------ 2 files changed, 25 insertions(+), 12 deletions(-)
include/trace/events/rcu.h +1 -0
@@ -712,6 +712,7 @@ TRACE_EVENT_RCU(rcu_torture_read,* "Begin": rcu_barrier() started. * "EarlyExit": rcu_barrier() piggybacked, thus early exit. * "Inc1": rcu_barrier() piggyback check counter incremented. +* "OfflineNoCBQ": rcu_barrier() found offline no-CBs CPU with callbacks. * "OnlineQ": rcu_barrier() found online CPU with callbacks. * "OnlineNQ": rcu_barrier() found online CPU, no callbacks. * "IRQ": An rcu_barrier_callback() callback posted on remote CPU.
kernel/rcu/tree.c +24 -12
@@ -3090,9 +3090,10 @@ static void rcu_barrier_callback(struct/* * Called with preemption disabled, and from cross-cpu IRQ context. */ -static void rcu_barrier_func (void *unused) +static void rcu_barrier_func (void *cpu_in) { -struct rcu_data *rdp =raw_cpu_ptr (&rcu_data); +uintptr_t cpu = (uintptr_t )cpu_in; +struct rcu_data *rdp =per_cpu_ptr (&rcu_data, cpu);rcu_barrier_trace (TPS ("IRQ" ),-1 , rcu_state.barrier_sequence); rdp->barrier_head.func = rcu_barrier_callback;
@@ -3119,7 +3120,7 @@ static void rcu_barrier_func(void *unuse*/ void rcu_barrier (void ) { -int cpu; +uintptr_t cpu;struct rcu_data *rdp;unsigned long s =rcu_seq_snap (&rcu_state.barrier_sequence);
@@ -3142,13 +3143,14 @@ void rcu_barrier(void)rcu_barrier_trace (TPS ("Inc1" ),-1 , rcu_state.barrier_sequence);/* -* Initialize the count to one rather than to zero in order to -* avoid a too-soon return to zero in case of a short grace period -* (or preemption of this task). Exclude CPU-hotplug operations -* to ensure that no offline CPU has callbacks queued. +* Initialize the count to two rather than to zero in order +* to avoid a too-soon return to zero in case of an immediate +* invocation of the just-enqueued callback (or preemption of +* this task). Exclude CPU-hotplug operations to ensure that no +* offline non-offloaded CPU has callbacks queued. */ init_completion (&rcu_state.barrier_completion); -atomic_set (&rcu_state.barrier_cpu_count,1 ); +atomic_set (&rcu_state.barrier_cpu_count,2 );get_online_cpus ();/*
@@ -3158,13 +3160,23 @@ void rcu_barrier(void)*/ for_each_possible_cpu (cpu) { rdp =per_cpu_ptr (&rcu_data, cpu); -if (!cpu_online (cpu) && +if (cpu_is_offline (cpu) && !rcu_segcblist_is_offloaded (&rdp->cblist))continue ; -if (rcu_segcblist_n_cbs (&rdp->cblist)) { +if (rcu_segcblist_n_cbs (&rdp->cblist) &&cpu_online (cpu)) {rcu_barrier_trace (TPS ("OnlineQ" ), cpu, rcu_state.barrier_sequence); -smp_call_function_single (cpu, rcu_barrier_func,NULL ,1 ); +smp_call_function_single (cpu, rcu_barrier_func, (void *)cpu,1 ); + }else if (rcu_segcblist_n_cbs (&rdp->cblist) && +cpu_is_offline (cpu)) { +rcu_barrier_trace (TPS ("OfflineNoCBQ" ), cpu, + rcu_state.barrier_sequence); +local_irq_disable (); +rcu_barrier_func ((void *)cpu); +local_irq_enable (); + }else if (cpu_is_offline (cpu)) { +rcu_barrier_trace (TPS ("OfflineNoCBNoQ" ), cpu, + rcu_state.barrier_sequence); }else {rcu_barrier_trace (TPS ("OnlineNQ" ), cpu, rcu_state.barrier_sequence);
@@ -3176,7 +3188,7 @@ void rcu_barrier(void)* Now that we have an rcu_barrier_callback() callback on each * CPU, and thus each counted, remove the initial count. */ -if (atomic_dec_and_test (&rcu_state.barrier_cpu_count)) +if (atomic_sub_and_test (2 , &rcu_state.barrier_cpu_count))complete (&rcu_state.barrier_completion);/* Wait for all rcu_barrier_callback() callbacks to be invoked. */
Greg Kroah-Hartman
maintainerPATCH 112/254 cpu/hotplug: Ignore pm_wakeup_pending() for disable_nonboot_cpus()
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit e98eac6ff1b45e4e73f2e6031b37c256ccb5d36b upstream.
A recent change to freeze_secondary_cpus() which added an early abort if a wakeup is pending missed the fact that the function is also invoked for shutdown, reboot and kexec via disable_nonboot_cpus().
In case of disable_nonboot_cpus() the wakeup event needs to be ignored as the purpose is to terminate the currently running kernel.
Add a 'suspend' argument which is only set when the freeze is in context of a suspend operation. If not set then an eventually pending wakeup event is ignored.
--- include/linux/cpu.h | 12 +++++++++--- kernel/cpu.c | 4 ++-- 2 files changed, 11 insertions(+), 5 deletions(-)
include/linux/cpu.h +9 -3
@@ -138,12 +138,18 @@ static inline void get_online_cpus(void)static inline void put_online_cpus (void ) {cpus_read_unlock (); }#ifdef CONFIG_PM_SLEEP_SMP -extern int freeze_secondary_cpus (int primary); +int __freeze_secondary_cpus (int primary,bool suspend); +static inline int freeze_secondary_cpus (int primary) +{ +return __freeze_secondary_cpus (primary, true); +} +static inline int disable_nonboot_cpus (void ) { -return freeze_secondary_cpus (0 ); +return __freeze_secondary_cpus (0 , false); } -extern void enable_nonboot_cpus (void ); + +void enable_nonboot_cpus (void );static inline int suspend_disable_secondary_cpus (void ) {
kernel/cpu.c +2 -2
@@ -1212,7 +1212,7 @@ EXPORT_SYMBOL_GPL(cpu_up);#ifdef CONFIG_PM_SLEEP_SMP static cpumask_var_t frozen_cpus; -int freeze_secondary_cpus (int primary) +int __freeze_secondary_cpus (int primary,bool suspend) {int cpu, error =0 ;
@@ -1237,7 +1237,7 @@ int freeze_secondary_cpus(int primary)if (cpu == primary)continue ; -if (pm_wakeup_pending ()) { +if (suspend &&pm_wakeup_pending ()) {pr_info ("Wakeup pending. Abort CPU freeze\n" ); error = -EBUSY ;break ;
Greg Kroah-Hartman
maintainerPATCH 113/254 genirq/debugfs: Add missing sanity checks to interrupt injection
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit a740a423c36932695b01a3e920f697bc55b05fec upstream.
Interrupts cannot be injected when the interrupt is not activated and when a replay is already in progress.
--- kernel/irq/debugfs.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
kernel/irq/debugfs.c +9 -2
@@ -206,8 +206,15 @@ static ssize_t irq_debug_write(struct fichip_bus_lock (desc);raw_spin_lock_irqsave (&desc->lock, flags); -if (irq_settings_is_level (desc) || desc->istate &IRQS_NMI ) { -/* Can't do level nor NMIs, sorry */ +/* +* Don't allow injection when the interrupt is: +* - Level or NMI type +* - not activated +* - replaying already +*/ +if (irq_settings_is_level (desc) || + !irqd_is_activated (&desc->irq_data) || + (desc->istate & (IRQS_NMI |IRQS_REPLAY ))) { err = -EINVAL ; }else { desc->istate |=IRQS_PENDING ;
Greg Kroah-Hartman
maintainerPATCH 114/254 irqchip/versatile-fpga: Apply clear-mask earlier
In reply to Greg Kroah-HartmanFrom: Sungbo Eo <[email protected]>
commit 6a214a28132f19ace3d835a6d8f6422ec80ad200 upstream.
Clear its own IRQs before the parent IRQ get enabled, so that the remaining IRQs do not accidentally interrupt the parent IRQ controller.
This patch also fixes a reboot bug on OX820 SoC, where the remaining rps-timer IRQ raises a GIC interrupt that is left pending. After that, the rps-timer IRQ is cleared during driver initialization, and there's no IRQ left in rps-irq when local_irq_enable() is called, which evokes an error message "unexpected IRQ trap".
--- drivers/irqchip/irq-versatile-fpga.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/irqchip/irq-versatile-fpga.c +3 -3
@@ -212,6 +212,9 @@ int __init fpga_irq_of_init(struct devicif (of_property_read_u32 (node,"valid-mask" , &valid_mask)) valid_mask =0 ; +writel (clear_mask, base +IRQ_ENABLE_CLEAR ); +writel (clear_mask, base +FIQ_ENABLE_CLEAR ); +/* Some chips are cascaded from a parent IRQ */ parent_irq =irq_of_parse_and_map (node,0 );if (!parent_irq) {
@@ -221,9 +224,6 @@ int __init fpga_irq_of_init(struct devicfpga_irq_init (base, node->name,0 , parent_irq, valid_mask, node); -writel (clear_mask, base +IRQ_ENABLE_CLEAR ); -writel (clear_mask, base +FIQ_ENABLE_CLEAR ); -/* * On Versatile AB/PB, some secondary interrupts have a direct * pass-thru to the primary controller for IRQs 20 and 22-31 which need
Greg Kroah-Hartman
maintainerPATCH 115/254 io_uring: ensure openat sets O_LARGEFILE if needed
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit 08a1d26eb894a9dcf79f674558a284ad1ffef517 upstream.
OPENAT2 correctly sets O_LARGEFILE if it has to, but that escaped the OPENAT opcode. Dmitry reports that his test case that compares openat() and IORING_OP_OPENAT sees failures on large files:
--- fs/io_uring.c | 2 ++ 1 file changed, 2 insertions(+)
fs/io_uring.c +2 -0
@@ -2571,6 +2571,8 @@ static int io_openat_prep(struct io_kioc req->open.how.mode =READ_ONCE (sqe->len); fname =u64_to_user_ptr (READ_ONCE (sqe->addr)); req->open.how.flags =READ_ONCE (sqe->open_flags); +if (force_o_largefile ()) + req->open.how.flags |=O_LARGEFILE ; req->open.filename =getname (fname);if (IS_ERR (req->open.filename)) {
Greg Kroah-Hartman
maintainerPATCH 116/254 io_uring: remove bogus RLIMIT_NOFILE check in file registration
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit c336e992cb1cb1db9ee608dfb30342ae781057ab upstream.
We already checked this limit when the file was opened, and we keep it open in the file table. Hence when we added unit_inflight to the count we want to register, we're doubly accounting these files. This results in -EMFILE for file registration, if we're at half the limit.
--- fs/io_uring.c | 7 ------- 1 file changed, 7 deletions(-)
fs/io_uring.c +0 -7
@@ -5426,13 +5426,6 @@ static int __io_sqe_files_scm(struct io_struct sk_buff *skb;int i, nr_files; -if (!capable (CAP_SYS_RESOURCE ) && !capable (CAP_SYS_ADMIN )) { -unsigned long inflight = ctx->user->unix_inflight + nr; - -if (inflight >task_rlimit (current,RLIMIT_NOFILE )) -return -EMFILE ; - } - fpl =kzalloc (sizeof (*fpl),GFP_KERNEL );if (!fpl)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 117/254 io_uring: fix ctx refcounting in io_submit_sqes()
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
commit 48bdd849e967f1c573d2b2bc24308e24a83f39c2 upstream.
If io_get_req() fails, it drops a ref. Then, awhile keeping @submitted unmodified, io_submit_sqes() breaks the loop and puts @nr - @submitted refs. For each submitted req a ref is dropped in io_put_req() and friends. So, for @nr taken refs there will be
(@nr - @submitted + @submitted + 1) dropped.
Remove ctx refcounting from io_get_req(), that at the same time makes it clearer.
--- fs/io_uring.c | 1 - 1 file changed, 1 deletion(-)
fs/io_uring.c +0 -1
@@ -1242,7 +1242,6 @@ fallback: req =io_get_fallback_req (ctx);if (req) goto got_it; -percpu_ref_put (&ctx->refs);return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 118/254 pstore: pstore_ftrace_seq_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
commit 6c871b7314dde9ab64f20de8f5aa3d01be4518e8 upstream.
In Aug 2018 NeilBrown noticed
commit 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code and interface") "Some ->next functions do not increment *pos when they return NULL... Note that such ->next functions are buggy and should be fixed.
A simple demonstration is
dd if=/proc/swaps bs=1000 skip=1
Choose any block size larger than the size of /proc/swaps. This will always show the whole last line of /proc/swaps"
/proc/swaps output was fixed recently, however there are lot of other affected files, and one of them is related to pstore subsystem.
If .next function does not change position index, following .show function will repeat output related to current position index.
There are at least 2 related problems:
- read after lseek beyond end of file, described above by NeilBrown "dd if=<AFFECTED_FILE> bs=1000 skip=1" will generate whole last list
- read after lseek on in middle of last line will output expected rest of last line but then repeat whole last line once again.
If .show() function generates multy-line output (like pstore_ftrace_seq_show() does ?) following bash script cycles endlessly
$ q=;while read -r r;do echo "$((++q)) $r";done < AFFECTED_FILE
Unfortunately I'm not familiar enough to pstore subsystem and was unable to find affected pstore-related file on my test node.
If .next function does not change position index, following .show function will repeat output related to current position index.
--- fs/pstore/inode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/pstore/inode.c +4 -1
@@ -87,11 +87,11 @@ static void *pstore_ftrace_seq_next(strustruct pstore_private *ps = s->private;struct pstore_ftrace_seq_data *data = v; + (*pos)++; data->off +=REC_SIZE ;if (data->off +REC_SIZE > ps->total_size)return NULL ; - (*pos)++;return data; }
@@ -101,6 +101,9 @@ static int pstore_ftrace_seq_show(structstruct pstore_ftrace_seq_data *data = v;struct pstore_ftrace_record *rec; +if (!data) +return 0 ; + rec = (struct pstore_ftrace_record *)(ps->record->buf + data->off); seq_printf(s, "CPU:%d ts:%llu %08lx %08lx %ps <- %pS\n",
Greg Kroah-Hartman
maintainerPATCH 119/254 MIPS/tlbex: Fix LDDIR usage in setup_pw() for Loongson-3
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
commit d191aaffe3687d1e73e644c185f5f0550ec242b5 upstream.
LDDIR/LDPTE is Loongson-3's acceleration for Page Table Walking. If BD (Base Directory, the 4th page directory) is not enabled, then GDOffset is biased by BadVAddr[63:62]. So, if GDOffset (aka. BadVAddr[47:36] for Loongson-3) is big enough, "0b11(BadVAddr[63:62])|BadVAddr[47:36]|...." can far beyond pg_swapper_dir. This means the pg_swapper_dir may NOT be accessed by LDDIR correctly, so fix it by set PWDirExt in CP0_PWCtl.
--- arch/mips/mm/tlbex.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/mips/mm/tlbex.c +4 -1
@@ -1480,6 +1480,7 @@ static void build_r4000_tlb_refill_handlstatic void setup_pw (void ) { +unsigned int pwctl;unsigned long pgd_i, pgd_w;#ifndef __PAGETABLE_PMD_FOLDEDunsigned long pmd_i, pmd_w;
@@ -1506,6 +1507,7 @@ static void setup_pw(void) pte_i =ilog2 (_PAGE_GLOBAL); pte_w =0 ; + pwctl =1 <<30 ;/* Set PWDirExt */ #ifndef __PAGETABLE_PMD_FOLDEDwrite_c0_pwfield (pgd_i <<24 | pmd_i <<12 | pt_i <<6 | pte_i);
@@ -1516,8 +1518,9 @@ static void setup_pw(void)#endif #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT -write_c0_pwctl (1 <<6 | psn); + pwctl |= (1 <<6 | psn);#endif +write_c0_pwctl (pwctl);write_c0_kpgd ((long )swapper_pg_dir); kscratch_used_mask |= (1 <<7 );/* KScratch6 is used for KPGD */ }
Greg Kroah-Hartman
maintainerPATCH 120/254 MIPS: OCTEON: irq: Fix potential NULL pointer dereference
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
commit 792a402c2840054533ef56279c212ef6da87d811 upstream.
There is a potential NULL pointer dereference in case kzalloc() fails and returns NULL.
Fix this by adding a NULL check on *cd*
This bug was detected with the help of Coccinelle.
--- arch/mips/cavium-octeon/octeon-irq.c | 3 +++ 1 file changed, 3 insertions(+)
arch/mips/cavium-octeon/octeon-irq.c +3 -0
@@ -2199,6 +2199,9 @@ static int octeon_irq_cib_map(struct irq } cd =kzalloc (sizeof (*cd),GFP_KERNEL ); +if (!cd) +return -ENOMEM ; + cd->host_data = host_data; cd->bit = hw;
Greg Kroah-Hartman
maintainerPATCH 121/254 PM / Domains: Allow no domain-idle-states DT property in genpd when parsing
In reply to Greg Kroah-HartmanFrom: Ulf Hansson <[email protected]>
commit 56cb26891ea4180121265dc6b596015772c4a4b8 upstream.
Commit 2c361684803e ("PM / Domains: Don't treat zero found compatible idle states as an error"), moved of_genpd_parse_idle_states() towards allowing none compatible idle state to be found for the device node, rather than returning an error code.
However, it didn't consider that the "domain-idle-states" DT property may be missing as it's optional, which makes of_count_phandle_with_args() to return -ENOENT. Let's fix this to make the behaviour consistent.
--- drivers/base/power/domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/power/domain.c +1 -1
@@ -2653,7 +2653,7 @@ static int genpd_iterate_idle_states(str ret =of_count_phandle_with_args (dn,"domain-idle-states" ,NULL );if (ret <=0 ) -return ret; +return ret == -ENOENT ?0 : ret;/* Loop over the phandles until all the requested entry is found */ of_for_each_phandle (&it, ret, dn,"domain-idle-states" ,NULL ,0 ) {
Greg Kroah-Hartman
maintainerPATCH 122/254 PM: sleep: wakeup: Skip wakeup_source_sysfs_remove() if device is not there
In reply to Greg Kroah-HartmanFrom: Neeraj Upadhyay <[email protected]>
commit 87de6594dc45dbf6819f3e0ef92f9331c5a9444c upstream.
Skip wakeup_source_sysfs_remove() to fix a NULL pinter dereference via ws->dev, if the wakeup source is unregistered before registering the wakeup class from device_add().
--- drivers/base/power/wakeup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/base/power/wakeup.c +3 -1
@@ -241,7 +241,9 @@ void wakeup_source_unregister(struct wak {if (ws) {wakeup_source_remove (ws); -wakeup_source_sysfs_remove (ws); +if (ws->dev) +wakeup_source_sysfs_remove (ws); +wakeup_source_destroy (ws); } }
Greg Kroah-Hartman
maintainerPATCH 123/254 ath9k: Handle txpower changes even when TPC is disabled
In reply to Greg Kroah-HartmanFrom: Remi Pommarel <[email protected]>
commit 968ae2caad0782db5dbbabb560d3cdefd2945d38 upstream.
When TPC is disabled IEEE80211_CONF_CHANGE_POWER event can be handled to reconfigure HW's maximum txpower.
This fixes 0dBm txpower setting when user attaches to an interface for the first time with the following scenario:
ieee80211_do_open()
ath9k_add_interface()
ath9k_set_txpower() /* Set TX power with not yet initialized
sc->hw->conf.power_level */
ieee80211_hw_config() /* Iniatilize sc->hw->conf.power_level and
raise IEEE80211_CONF_CHANGE_POWER */
ath9k_config() /* IEEE80211_CONF_CHANGE_POWER is ignored */This issue can be reproduced with the following:
$ modprobe -r ath9k
$ modprobe ath9k
$ wpa_supplicant -i wlan0 -c /tmp/wpa.conf &
$ iw dev /* Here TX power is either 0 or 3 depending on RF chain */
$ killall wpa_supplicant
$ iw dev /* TX power goes back to calibrated value and subsequent
calls will be fine */--- drivers/net/wireless/ath/ath9k/main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath9k/main.c +3 -0
@@ -1457,6 +1457,9 @@ static int ath9k_config(struct ieee80211ath_chanctx_set_channel (sc, ctx, &hw->conf.chandef); } +if (changed &IEEE80211_CONF_CHANGE_POWER ) +ath9k_set_txpower (sc,NULL ); +mutex_unlock (&sc->mutex);ath9k_ps_restore (sc);
Greg Kroah-Hartman
maintainerPATCH 124/254 signal: Extend exec_id to 64bits
In reply to Greg Kroah-HartmanFrom: Eric W. Biederman <[email protected]>
commit d1e7fd6462ca9fc76650fbe6ca800e35b24267da upstream.
Replace the 32bit exec_id with a 64bit exec_id to make it impossible to wrap the exec_id counter. With care an attacker can cause exec_id wrap and send arbitrary signals to a newly exec'd parent. This bypasses the signal sending checks if the parent changes their credentials during exec.
The severity of this problem can been seen that in my limited testing of a 32bit exec_id it can take as little as 19s to exec 65536 times. Which means that it can take as little as 14 days to wrap a 32bit exec_id. Adam Zabrocki has succeeded wrapping the self_exe_id in 7 days. Even my slower timing is in the uptime of a typical server. Which means self_exec_id is simply a speed bump today, and if exec gets noticably faster self_exec_id won't even be a speed bump.
Extending self_exec_id to 64bits introduces a problem on 32bit architectures where reading self_exec_id is no longer atomic and can take two read instructions. Which means that is is possible to hit a window where the read value of exec_id does not match the written value. So with very lucky timing after this change this still remains expoiltable.
I have updated the update of exec_id on exec to use WRITE_ONCE and the read of exec_id in do_notify_parent to use READ_ONCE to make it clear that there is no locking between these two locations.
--- fs/exec.c | 2 +- include/linux/sched.h | 4 ++-- kernel/signal.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)
fs/exec.c +1 -1
@@ -1386,7 +1386,7 @@ void setup_new_exec(struct linux_binprm/* An exec changes our domain. We are no longer part of the thread group */ - current->self_exec_id++; +WRITE_ONCE (current->self_exec_id, current->self_exec_id +1 );flush_signal_handlers (current,0 ); }EXPORT_SYMBOL (setup_new_exec);
include/linux/sched.h +2 -2
@@ -939,8 +939,8 @@ struct task_struct {struct seccomp seccomp;/* Thread group tracking: */ -u32 parent_exec_id; -u32 self_exec_id; +u64 parent_exec_id; +u64 self_exec_id;/* Protection against (de-)allocation: mm, files, fs, tty, keyrings, mems_allowed, mempolicy: */ spinlock_t alloc_lock;
kernel/signal.c +1 -1
@@ -1931,7 +1931,7 @@ bool do_notify_parent(struct task_struct* This is only possible if parent == real_parent. * Check if it has changed security domain. */ -if (tsk->parent_exec_id != tsk->parent->self_exec_id) +if (tsk->parent_exec_id !=READ_ONCE (tsk->parent->self_exec_id)) sig =SIGCHLD ; }
Greg Kroah-Hartman
maintainerPATCH 125/254 x86/tsc_msr: Use named struct initializers
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 812c2d7506fde7cdf83cb2532810a65782b51741 upstream.
Use named struct initializers for the freq_desc struct-s initialization and change the "u8 msr_plat" to a "bool use_msr_plat" to make its meaning more clear instead of relying on a comment to explain it.
--- arch/x86/kernel/tsc_msr.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-)
arch/x86/kernel/tsc_msr.c +18 -10
@@ -22,10 +22,10 @@* read in MSR_PLATFORM_ID[12:8], otherwise in MSR_PERF_STAT[44:40]. * Unfortunately some Intel Atom SoCs aren't quite compliant to this, * so we need manually differentiate SoC families. This is what the -* field msr_plat does. +* field use_msr_plat does. */ struct freq_desc { -u8 msr_plat;/* 1: use MSR_PLATFORM_INFO, 0: MSR_IA32_PERF_STATUS */ +bool use_msr_plat;u32 freqs[MAX_NUM_FREQS ]; };
@@ -35,31 +35,39 @@ struct freq_desc {* by MSR based on SDM. */ static const struct freq_desc freq_desc_pnw = { -0 , {0 ,0 ,0 ,0 ,0 ,99840 ,0 ,83200 } + .use_msr_plat = false, + .freqs = {0 ,0 ,0 ,0 ,0 ,99840 ,0 ,83200 }, };static const struct freq_desc freq_desc_clv = { -0 , {0 ,133200 ,0 ,0 ,0 ,99840 ,0 ,83200 } + .use_msr_plat = false, + .freqs = {0 ,133200 ,0 ,0 ,0 ,99840 ,0 ,83200 }, };static const struct freq_desc freq_desc_byt = { -1 , {83300 ,100000 ,133300 ,116700 ,80000 ,0 ,0 ,0 } + .use_msr_plat = true, + .freqs = {83300 ,100000 ,133300 ,116700 ,80000 ,0 ,0 ,0 }, };static const struct freq_desc freq_desc_cht = { -1 , {83300 ,100000 ,133300 ,116700 ,80000 ,93300 ,90000 ,88900 ,87500 } + .use_msr_plat = true, + .freqs = {83300 ,100000 ,133300 ,116700 ,80000 ,93300 ,90000 , +88900 ,87500 }, };static const struct freq_desc freq_desc_tng = { -1 , {0 ,100000 ,133300 ,0 ,0 ,0 ,0 ,0 } + .use_msr_plat = true, + .freqs = {0 ,100000 ,133300 ,0 ,0 ,0 ,0 ,0 }, };static const struct freq_desc freq_desc_ann = { -1 , {83300 ,100000 ,133300 ,100000 ,0 ,0 ,0 ,0 } + .use_msr_plat = true, + .freqs = {83300 ,100000 ,133300 ,100000 ,0 ,0 ,0 ,0 }, };static const struct freq_desc freq_desc_lgm = { -1 , {78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 } + .use_msr_plat = true, + .freqs = {78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 }, };static const struct x86_cpu_id tsc_msr_cpu_ids[] = {
@@ -91,7 +99,7 @@ unsigned long cpu_khz_from_msr(void)return 0 ; freq_desc = (struct freq_desc *)id->driver_data; -if (freq_desc->msr_plat) { +if (freq_desc->use_msr_plat) {rdmsr (MSR_PLATFORM_INFO , lo, hi); ratio = (lo >>8 ) &0xff ; }else {
Greg Kroah-Hartman
maintainerPATCH 126/254 x86/tsc_msr: Fix MSR_FSB_FREQ mask for Cherry Trail devices
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit c8810e2ffc30c7e1577f9c057c4b85d984bbc35a upstream.
According to the "Intel 64 and IA-32 Architectures Software Developer's Manual Volume 4: Model-Specific Registers" on Cherry Trail (Airmont) devices the 4 lowest bits of the MSR_FSB_FREQ mask indicate the bus freq unlike on e.g. Bay Trail where only the lowest 3 bits are used.
This is also the reason why MAX_NUM_FREQS is defined as 9, since Cherry Trail SoCs have 9 possible frequencies, so the lo value from the MSR needs to be masked with 0x0f, not with 0x07 otherwise the 9th frequency will get interpreted as the 1st.
Bump MAX_NUM_FREQS to 16 to avoid any possibility of addressing the array out of bounds and makes the mask part of the cpufreq struct so it can be set it per model.
While at it also log an error when the index points to an uninitialized part of the freqs lookup-table.
--- arch/x86/kernel/tsc_msr.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
arch/x86/kernel/tsc_msr.c +15 -2
@@ -15,7 +15,7 @@#include <asm/param.h> #include <asm/tsc.h> -#define MAX_NUM_FREQS 9 +#define MAX_NUM_FREQS 16/* 4 bits to select the frequency */ /* * If MSR_PERF_STAT[31] is set, the maximum resolved bus ratio can be
@@ -27,6 +27,7 @@struct freq_desc {bool use_msr_plat;u32 freqs[MAX_NUM_FREQS ]; +u32 mask; };/*
@@ -37,37 +38,44 @@ struct freq_desc {static const struct freq_desc freq_desc_pnw = { .use_msr_plat = false, .freqs = {0 ,0 ,0 ,0 ,0 ,99840 ,0 ,83200 }, + .mask =0x07 , };static const struct freq_desc freq_desc_clv = { .use_msr_plat = false, .freqs = {0 ,133200 ,0 ,0 ,0 ,99840 ,0 ,83200 }, + .mask =0x07 , };static const struct freq_desc freq_desc_byt = { .use_msr_plat = true, .freqs = {83300 ,100000 ,133300 ,116700 ,80000 ,0 ,0 ,0 }, + .mask =0x07 , };static const struct freq_desc freq_desc_cht = { .use_msr_plat = true, .freqs = {83300 ,100000 ,133300 ,116700 ,80000 ,93300 ,90000 ,88900 ,87500 }, + .mask =0x0f , };static const struct freq_desc freq_desc_tng = { .use_msr_plat = true, .freqs = {0 ,100000 ,133300 ,0 ,0 ,0 ,0 ,0 }, + .mask =0x07 , };static const struct freq_desc freq_desc_ann = { .use_msr_plat = true, .freqs = {83300 ,100000 ,133300 ,100000 ,0 ,0 ,0 ,0 }, + .mask =0x0f , };static const struct freq_desc freq_desc_lgm = { .use_msr_plat = true, .freqs = {78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 }, + .mask =0x0f , };static const struct x86_cpu_id tsc_msr_cpu_ids[] = {
@@ -93,6 +101,7 @@ unsigned long cpu_khz_from_msr(void)const struct freq_desc *freq_desc;const struct x86_cpu_id *id;unsigned long res; +int index; id =x86_match_cpu (tsc_msr_cpu_ids);if (!id)
@@ -109,13 +118,17 @@ unsigned long cpu_khz_from_msr(void)/* Get FSB FREQ ID */ rdmsr (MSR_FSB_FREQ , lo, hi); + index = lo & freq_desc->mask;/* Map CPU reference clock freq ID(0-7) to CPU reference clock freq(KHz) */ - freq = freq_desc->freqs[lo &0x7 ]; + freq = freq_desc->freqs[index];/* TSC frequency = maximum resolved freq * maximum resolved bus ratio */ res = freq * ratio; +if (freq ==0 ) +pr_err ("Error MSR_FSB_FREQ index %d is unknown\n" , index); +#ifdef CONFIG_X86_LOCAL_APIC lapic_timer_period = (freq *1000 ) /HZ ;#endif
Greg Kroah-Hartman
maintainerPATCH 127/254 x86/tsc_msr: Make MSR derived TSC frequency more accurate
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit fac01d11722c92a186b27ee26cd429a8066adfb5 upstream.
The "Intel 64 and IA-32 Architectures Software Developer’s Manual Volume 4:
Model-Specific Registers" has the following table for the values from freq_desc_byt:
000B: 083.3 MHz
001B: 100.0 MHz
010B: 133.3 MHz
011B: 116.7 MHz
100B: 080.0 MHz
Notice how for e.g the 83.3 MHz value there are 3 significant digits, which translates to an accuracy of a 1000 ppm, where as a typical crystal oscillator is 20 - 100 ppm, so the accuracy of the frequency format used in the Software Developer’s Manual is not really helpful.
As far as we know Bay Trail SoCs use a 25 MHz crystal and Cherry Trail uses a 19.2 MHz crystal, the crystal is the source clock for a root PLL which outputs 1600 and 100 MHz. It is unclear if the root PLL outputs are used directly by the CPU clock PLL or if there is another PLL in between.
This does not matter though, we can model the chain of PLLs as a single PLL with a quotient equal to the quotients of all PLLs in the chain multiplied.
So we can create a simplified model of the CPU clock setup using a reference clock of 100 MHz plus a quotient which gets us as close to the frequency from the SDM as possible.
For the 83.3 MHz example from above this would give 100 MHz * 5 / 6 = 83 and 1/3 MHz, which matches exactly what has been measured on actual hardware.
Use a simplified PLL model with a reference clock of 100 MHz for all Bay and Cherry Trail models.
This has been tested on the following models:
CPU freq before: CPU freq after: Intel N2840 2165.800 MHz 2166.667 MHz Intel Z3736 1332.800 MHz 1333.333 MHz Intel Z3775 1466.300 MHz 1466.667 MHz Intel Z8350 1440.000 MHz 1440.000 MHz Intel Z8750 1600.000 MHz 1600.000 MHz
This fixes the time drifting by about 1 second per hour (20 - 30 seconds per day) on (some) devices which rely on the tsc_msr.c code to determine the TSC frequency.
--- arch/x86/kernel/tsc_msr.c | 97 ++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 86 insertions(+), 11 deletions(-)
arch/x86/kernel/tsc_msr.c +86 -11
@@ -18,6 +18,28 @@#define MAX_NUM_FREQS 16/* 4 bits to select the frequency */ /* +* The frequency numbers in the SDM are e.g. 83.3 MHz, which does not contain a +* lot of accuracy which leads to clock drift. As far as we know Bay Trail SoCs +* use a 25 MHz crystal and Cherry Trail uses a 19.2 MHz crystal, the crystal +* is the source clk for a root PLL which outputs 1600 and 100 MHz. It is +* unclear if the root PLL outputs are used directly by the CPU clock PLL or +* if there is another PLL in between. +* This does not matter though, we can model the chain of PLLs as a single PLL +* with a quotient equal to the quotients of all PLLs in the chain multiplied. +* So we can create a simplified model of the CPU clock setup using a reference +* clock of 100 MHz plus a quotient which gets us as close to the frequency +* from the SDM as possible. +* For the 83.3 MHz example from above this would give us 100 MHz * 5 / 6 = +* 83 and 1/3 MHz, which matches exactly what has been measured on actual hw. +*/ +#define TSC_REFERENCE_KHZ 100000 + +struct muldiv { +u32 multiplier; +u32 divider; +}; + +/* * If MSR_PERF_STAT[31] is set, the maximum resolved bus ratio can be * read in MSR_PLATFORM_ID[12:8], otherwise in MSR_PERF_STAT[44:40]. * Unfortunately some Intel Atom SoCs aren't quite compliant to this,
@@ -26,6 +48,11 @@*/ struct freq_desc {bool use_msr_plat; +struct muldiv muldiv[MAX_NUM_FREQS ]; +/* +* Some CPU frequencies in the SDM do not map to known PLL freqs, in +* that case the muldiv array is empty and the freqs array is used. +*/ u32 freqs[MAX_NUM_FREQS ];u32 mask; };
@@ -47,31 +74,66 @@ static const struct freq_desc freq_desc_ .mask = 0x07, }; +/* +* Bay Trail SDM MSR_FSB_FREQ frequencies simplified PLL model: +* 000: 100 * 5 / 6 = 83.3333 MHz +* 001: 100 * 1 / 1 = 100.0000 MHz +* 010: 100 * 4 / 3 = 133.3333 MHz +* 011: 100 * 7 / 6 = 116.6667 MHz +* 100: 100 * 4 / 5 = 80.0000 MHz +*/ static const struct freq_desc freq_desc_byt = { .use_msr_plat = true, - .freqs = {83300 ,100000 ,133300 ,116700 ,80000 ,0 ,0 ,0 }, + .muldiv = { {5 ,6 }, {1 ,1 }, {4 ,3 }, {7 ,6 }, + {4 ,5 } }, .mask =0x07 , }; +/* +* Cherry Trail SDM MSR_FSB_FREQ frequencies simplified PLL model: +* 0000: 100 * 5 / 6 = 83.3333 MHz +* 0001: 100 * 1 / 1 = 100.0000 MHz +* 0010: 100 * 4 / 3 = 133.3333 MHz +* 0011: 100 * 7 / 6 = 116.6667 MHz +* 0100: 100 * 4 / 5 = 80.0000 MHz +* 0101: 100 * 14 / 15 = 93.3333 MHz +* 0110: 100 * 9 / 10 = 90.0000 MHz +* 0111: 100 * 8 / 9 = 88.8889 MHz +* 1000: 100 * 7 / 8 = 87.5000 MHz +*/ static const struct freq_desc freq_desc_cht = { .use_msr_plat = true, - .freqs = {83300 ,100000 ,133300 ,116700 ,80000 ,93300 ,90000 , -88900 ,87500 }, + .muldiv = { {5 ,6 }, {1 ,1 }, {4 ,3 }, {7 ,6 }, + {4 ,5 }, {14 ,15 }, {9 ,10 }, {8 ,9 }, + {7 ,8 } }, .mask =0x0f , }; +/* +* Merriefield SDM MSR_FSB_FREQ frequencies simplified PLL model: +* 0001: 100 * 1 / 1 = 100.0000 MHz +* 0010: 100 * 4 / 3 = 133.3333 MHz +*/ static const struct freq_desc freq_desc_tng = { .use_msr_plat = true, - .freqs = {0 ,100000 ,133300 ,0 ,0 ,0 ,0 ,0 }, + .muldiv = { {0 ,0 }, {1 ,1 }, {4 ,3 } }, .mask =0x07 , }; +/* +* Moorefield SDM MSR_FSB_FREQ frequencies simplified PLL model: +* 0000: 100 * 5 / 6 = 83.3333 MHz +* 0001: 100 * 1 / 1 = 100.0000 MHz +* 0010: 100 * 4 / 3 = 133.3333 MHz +* 0011: 100 * 1 / 1 = 100.0000 MHz +*/ static const struct freq_desc freq_desc_ann = { .use_msr_plat = true, - .freqs = {83300 ,100000 ,133300 ,100000 ,0 ,0 ,0 ,0 }, + .muldiv = { {5 ,6 }, {1 ,1 }, {4 ,3 }, {1 ,1 } }, .mask =0x0f , }; +/* 24 MHz crystal? : 24 * 13 / 4 = 78 MHz */ static const struct freq_desc freq_desc_lgm = { .use_msr_plat = true, .freqs = {78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 },
@@ -97,9 +159,10 @@ static const struct x86_cpu_id tsc_msr_c*/ unsigned long cpu_khz_from_msr (void ) { -u32 lo, hi, ratio, freq; +u32 lo, hi, ratio, freq, tscref;const struct freq_desc *freq_desc;const struct x86_cpu_id *id; +const struct muldiv *md;unsigned long res;int index;
@@ -119,12 +182,24 @@ unsigned long cpu_khz_from_msr(void)/* Get FSB FREQ ID */ rdmsr (MSR_FSB_FREQ , lo, hi); index = lo & freq_desc->mask; + md = &freq_desc->muldiv[index]; -/* Map CPU reference clock freq ID(0-7) to CPU reference clock freq(KHz) */ - freq = freq_desc->freqs[index]; - -/* TSC frequency = maximum resolved freq * maximum resolved bus ratio */ - res = freq * ratio; +/* +* Note this also catches cases where the index points to an unpopulated +* part of muldiv, in that case the else will set freq and res to 0. +*/ +if (md->divider) { + tscref =TSC_REFERENCE_KHZ * md->multiplier; + freq =DIV_ROUND_CLOSEST (tscref, md->divider); +/* +* Multiplying by ratio before the division has better +* accuracy than just calculating freq * ratio. +*/ + res =DIV_ROUND_CLOSEST (tscref * ratio, md->divider); + }else { + freq = freq_desc->freqs[index]; + res = freq * ratio; + }if (freq ==0 )pr_err ("Error MSR_FSB_FREQ index %d is unknown\n" , index);
Greg Kroah-Hartman
maintainerPATCH 128/254 x86/entry/32: Add missing ASM_CLAC to general_protection entry
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 3d51507f29f2153a658df4a0674ec5b592b62085 upstream.
All exception entry points must have ASM_CLAC right at the beginning. The general_protection entry is missing one.
--- arch/x86/entry/entry_32.S | 1 + 1 file changed, 1 insertion(+)
arch/x86/entry/entry_32.S +1 -0
@@ -1694,6 +1694,7 @@ SYM_CODE_START(int3) SYM_CODE_END(int3) SYM_CODE_START(general_protection) + ASM_CLAC pushl $do_general_protection jmp common_exception SYM_CODE_END(general_protection)
Greg Kroah-Hartman
maintainerPATCH 129/254 platform/x86: asus-wmi: Support laptops where the first battery is named BATT
In reply to Greg Kroah-HartmanFrom: Kristian Klausen <[email protected]>
commit 6b3586d45bba14f6912f37488090c37a3710e7b4 upstream.
The WMI method to set the charge threshold does not provide a way to specific a battery, so we assume it is the first/primary battery (by checking if the name is BAT0).
On some newer ASUS laptops (Zenbook UM431DA) though, the primary/first battery isn't named BAT0 but BATT, so we need to support that case.
--- drivers/platform/x86/asus-wmi.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/platform/x86/asus-wmi.c +4 -1
@@ -426,8 +426,11 @@ static int asus_wmi_battery_add(struct p {/* The WMI method does not provide a way to specific a battery, so we * just assume it is the first battery. +* Note: On some newer ASUS laptops (Zenbook UM431DA), the primary/first +* battery is named BATT. */ -if (strcmp (battery->desc->name,"BAT0" ) !=0 ) +if (strcmp (battery->desc->name,"BAT0" ) !=0 && +strcmp (battery->desc->name,"BATT" ) !=0 )return -ENODEV ; if (device_create_file(&battery->dev,
Greg Kroah-Hartman
maintainerPATCH 130/254 KVM: PPC: Book3S HV: Skip kvmppc_uvmem_free if Ultravisor is not supported
In reply to Greg Kroah-HartmanFrom: Fabiano Rosas <[email protected]>
commit 9bee484b280a059c1faa10ae174af4f4af02c805 upstream.
kvmppc_uvmem_init checks for Ultravisor support and returns early if it is not present. Calling kvmppc_uvmem_free at module exit will cause an Oops:
$ modprobe -r kvm-hv
Oops: Kernel access of bad area, sig: 11 [#1] <snip> NIP: c000000000789e90 LR: c000000000789e8c CTR: c000000000401030 REGS: c000003fa7bab9a0 TRAP: 0300 Not tainted (5.6.0-rc6-00033-g6c90b86a745a-dirty) MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 24002282 XER: 00000000 CFAR: c000000000dae880 DAR: 0000000000000008 DSISR: 40000000 IRQMASK: 1 GPR00: c000000000789e8c c000003fa7babc30 c0000000016fe500 0000000000000000 GPR04: 0000000000000000 0000000000000006 0000000000000000 c000003faf205c00 GPR08: 0000000000000000 0000000000000001 000000008000002d c00800000ddde140 GPR12: c000000000401030 c000003ffffd9080 0000000000000001 0000000000000000 GPR16: 0000000000000000 0000000000000000 000000013aad0074 000000013aaac978 GPR20: 000000013aad0070 0000000000000000 00007fffd1b37158 0000000000000000 GPR24: 000000014fef0d58 0000000000000000 000000014fef0cf0 0000000000000001 GPR28: 0000000000000000 0000000000000000 c0000000018b2a60 0000000000000000 NIP [c000000000789e90] percpu_ref_kill_and_confirm+0x40/0x170 LR [c000000000789e8c] percpu_ref_kill_and_confirm+0x3c/0x170 Call Trace: [c000003fa7babc30] [c000003faf2064d4] 0xc000003faf2064d4 (unreliable) [c000003fa7babcb0] [c000000000400e8c] dev_pagemap_kill+0x6c/0x80 [c000003fa7babcd0] [c000000000401064] memunmap_pages+0x34/0x2f0 [c000003fa7babd50] [c00800000dddd548] kvmppc_uvmem_free+0x30/0x80 [kvm_hv] [c000003fa7babd80] [c00800000ddcef18] kvmppc_book3s_exit_hv+0x20/0x78 [kvm_hv] [c000003fa7babda0] [c0000000002084d0] sys_delete_module+0x1d0/0x2c0 [c000003fa7babe20] [c00000000000b9d0] system_call+0x5c/0x68 Instruction dump: 3fc2001b fb81ffe0 fba1ffe8 fbe1fff8 7c7f1b78 7c9c2378 3bde4560 7fc3f378 f8010010 f821ff81 486249a1 60000000 <e93f0008> 7c7d1b78 712a0002 40820084 ---[ end trace 5774ef4dc2c98279 ]---
So this patch checks if kvmppc_uvmem_init actually allocated anything before running kvmppc_uvmem_free.
--- arch/powerpc/kvm/book3s_hv_uvmem.c | 3 +++ 1 file changed, 3 insertions(+)
arch/powerpc/kvm/book3s_hv_uvmem.c +3 -0
@@ -806,6 +806,9 @@ out:void kvmppc_uvmem_free (void ) { +if (!kvmppc_uvmem_bitmap) +return ; +memunmap_pages (&kvmppc_uvmem_pgmap);release_mem_region (kvmppc_uvmem_pgmap.res.start,resource_size (&kvmppc_uvmem_pgmap.res));
Greg Kroah-Hartman
maintainerPATCH 131/254 KVM: nVMX: Properly handle userspace interrupt window request
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit a1c77abb8d93381e25a8d2df3a917388244ba776 upstream.
Return true for vmx_interrupt_allowed() if the vCPU is in L2 and L1 has external interrupt exiting enabled. IRQs are never blocked in hardware if the CPU is in the guest (L2 from L1's perspective) when IRQs trigger VM-Exit.
The new check percolates up to kvm_vcpu_ready_for_interrupt_injection() and thus vcpu_run(), and so KVM will exit to userspace if userspace has requested an interrupt window (to inject an IRQ into L1).
Remove the @external_intr param from vmx_check_nested_events(), which is actually an indicator that userspace wants an interrupt window, e.g. it's named @req_int_win further up the stack. Injecting a VM-Exit into L1 to try and bounce out to L0 userspace is all kinds of broken and is no longer necessary.
Remove the hack in nested_vmx_vmexit() that attempted to workaround the breakage in vmx_check_nested_events() by only filling interrupt info if there's an actual interrupt pending. The hack actually made things worse because it caused KVM to _never_ fill interrupt info when the LAPIC resides in userspace (kvm_cpu_has_interrupt() queries interrupt.injected, which is always cleared by prepare_vmcs12() before reaching the hack in nested_vmx_vmexit()).
--- arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/kvm/vmx/nested.c | 18 ++++-------------- arch/x86/kvm/vmx/vmx.c | 9 +++++++-- arch/x86/kvm/x86.c | 10 +++++----- 4 files changed, 17 insertions(+), 22 deletions(-)
arch/x86/include/asm/kvm_host.h +1 -1
@@ -1180,7 +1180,7 @@ struct kvm_x86_ops {bool (*pt_supported)(void );bool (*pku_supported)(void ); -int (*check_nested_events)(struct kvm_vcpu *vcpu,bool external_intr); +int (*check_nested_events)(struct kvm_vcpu *vcpu);void (*request_immediate_exit)(struct kvm_vcpu *vcpu);void (*sched_in)(struct kvm_vcpu *kvm,int cpu);
arch/x86/kvm/vmx/nested.c +4 -14
@@ -3604,7 +3604,7 @@ static void nested_vmx_update_pending_db vcpu->arch.exception.payload); } -static int vmx_check_nested_events (struct kvm_vcpu *vcpu,bool external_intr) +static int vmx_check_nested_events (struct kvm_vcpu *vcpu) {struct vcpu_vmx *vmx =to_vmx (vcpu);unsigned long exit_qual;
@@ -3680,8 +3680,7 @@ static int vmx_check_nested_events(strucreturn 0 ; } -if ((kvm_cpu_has_interrupt (vcpu) || external_intr) && -nested_exit_on_intr (vcpu)) { +if (kvm_cpu_has_interrupt (vcpu) &&nested_exit_on_intr (vcpu)) {if (block_nested_events)return -EBUSY ;nested_vmx_vmexit (vcpu,EXIT_REASON_EXTERNAL_INTERRUPT ,0 ,0 );
@@ -4329,17 +4328,8 @@ void nested_vmx_vmexit(struct kvm_vcpu * vcpu->arch.mp_state =KVM_MP_STATE_RUNNABLE ;if (likely (!vmx->fail)) { -/* -* TODO: SDM says that with acknowledge interrupt on -* exit, bit 31 of the VM-exit interrupt information -* (valid interrupt) is always set to 1 on -* EXIT_REASON_EXTERNAL_INTERRUPT, so we shouldn't -* need kvm_cpu_has_interrupt(). See the commit -* message for details. -*/ -if (nested_exit_intr_ack_set (vcpu) && - exit_reason ==EXIT_REASON_EXTERNAL_INTERRUPT && -kvm_cpu_has_interrupt (vcpu)) { +if (exit_reason ==EXIT_REASON_EXTERNAL_INTERRUPT && +nested_exit_intr_ack_set (vcpu)) {int irq =kvm_cpu_get_interrupt (vcpu);WARN_ON (irq <0 ); vmcs12->vm_exit_intr_info = irq |
arch/x86/kvm/vmx/vmx.c +7 -2
@@ -4507,8 +4507,13 @@ static int vmx_nmi_allowed(struct kvm_vcstatic int vmx_interrupt_allowed (struct kvm_vcpu *vcpu) { -return (!to_vmx (vcpu)->nested.nested_run_pending && -vmcs_readl (GUEST_RFLAGS ) &X86_EFLAGS_IF ) && +if (to_vmx (vcpu)->nested.nested_run_pending) +return false; + +if (is_guest_mode (vcpu) &&nested_exit_on_intr (vcpu)) +return true; + +return (vmcs_readl (GUEST_RFLAGS ) &X86_EFLAGS_IF ) && !(vmcs_read32 (GUEST_INTERRUPTIBILITY_INFO ) & (GUEST_INTR_STATE_STI |GUEST_INTR_STATE_MOV_SS )); }
arch/x86/kvm/x86.c +5 -5
@@ -7635,7 +7635,7 @@ static void update_cr8_intercept(struct kvm_x86_ops->update_cr8_intercept (vcpu, tpr, max_irr); } -static int inject_pending_event (struct kvm_vcpu *vcpu,bool req_int_win) +static int inject_pending_event (struct kvm_vcpu *vcpu) {int r;
@@ -7671,7 +7671,7 @@ static int inject_pending_event(struct k* from L2 to L1. */ if (is_guest_mode (vcpu) && kvm_x86_ops->check_nested_events) { - r = kvm_x86_ops->check_nested_events (vcpu, req_int_win); + r = kvm_x86_ops->check_nested_events (vcpu);if (r !=0 )return r; }
@@ -7733,7 +7733,7 @@ static int inject_pending_event(struct k* KVM_REQ_EVENT only on certain events and not unconditionally? */ if (is_guest_mode (vcpu) && kvm_x86_ops->check_nested_events) { - r = kvm_x86_ops->check_nested_events (vcpu, req_int_win); + r = kvm_x86_ops->check_nested_events (vcpu);if (r !=0 )return r; }
@@ -8266,7 +8266,7 @@ static int vcpu_enter_guest(struct kvm_v goto out; } -if (inject_pending_event (vcpu, req_int_win) !=0 ) +if (inject_pending_event (vcpu) !=0 ) req_immediate_exit = true;else {/* Enable SMI/NMI/IRQ window open exits if needed.
@@ -8496,7 +8496,7 @@ static inline int vcpu_block(struct kvmstatic inline bool kvm_vcpu_running (struct kvm_vcpu *vcpu) {if (is_guest_mode (vcpu) && kvm_x86_ops->check_nested_events) - kvm_x86_ops->check_nested_events (vcpu, false); + kvm_x86_ops->check_nested_events (vcpu);return (vcpu->arch.mp_state ==KVM_MP_STATE_RUNNABLE && !vcpu->arch.apf.halted);
Greg Kroah-Hartman
maintainerPATCH 132/254 KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit a1d032a49522cb5368e5dfb945a85899b4c74f65 upstream.
In case we have a region 1 the following calculation
(31 + ((gmap->asce & _ASCE_TYPE_MASK) >> 2)*11)
results in 64. As shifts beyond the size are undefined the compiler is free to use instructions like sllg. sllg will only use 6 bits of the shift value (here 64) resulting in no shift at all. That means that ALL addresses will be rejected.
The can result in endless loops, e.g. when prefix cannot get mapped.
--- arch/s390/mm/gmap.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/s390/mm/gmap.c +5 -1
@@ -787,14 +787,18 @@ static void gmap_call_notifier(struct gmstatic inline unsigned long *gmap_table_walk (struct gmap *gmap,unsigned long gaddr,int level) { +const int asce_type = gmap->asce & _ASCE_TYPE_MASK;unsigned long *table;if ((gmap->asce & _ASCE_TYPE_MASK) +4 < (level *4 ))return NULL ;if (gmap_is_shadow (gmap) && gmap->removed)return NULL ; -if (gaddr & (-1UL << (31 + ((gmap->asce & _ASCE_TYPE_MASK) >>2 )*11 ))) + +if (asce_type != _ASCE_TYPE_REGION1 && + gaddr & (-1UL << (31 + (asce_type >>2 ) *11 )))return NULL ; + table = gmap->table;switch (gmap->asce & _ASCE_TYPE_MASK) {case _ASCE_TYPE_REGION1:
Greg Kroah-Hartman
maintainerPATCH 133/254 KVM: s390: vsie: Fix delivery of addressing exceptions
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit 4d4cee96fb7a3cc53702a9be8299bf525be4ee98 upstream.
Whenever we get an -EFAULT, we failed to read in guest 2 physical address space. Such addressing exceptions are reported via a program intercept to the nested hypervisor.
We faked the intercept, we have to return to guest 2. Instead, right now we would be returning -EFAULT from the intercept handler, eventually crashing the VM.
the correct thing to do is to return 1 as rc == 1 is the internal representation of "we have to go back into g2".
Addressing exceptions can only happen if the g2->g3 page tables reference invalid g2 addresses (say, either a table or the final page is not accessible - so something that basically never happens in sane environments.
Identified by manual code inspection.
--- arch/s390/kvm/vsie.c | 1 + 1 file changed, 1 insertion(+)
arch/s390/kvm/vsie.c +1 -0
@@ -1202,6 +1202,7 @@ static int vsie_run(struct kvm_vcpu *vcp scb_s->iprcc =PGM_ADDRESSING ; scb_s->pgmilc =4 ; scb_s->gpsw.addr =__rewind_psw (scb_s->gpsw,4 ); + rc =1 ; }return rc; }
Greg Kroah-Hartman
maintainerPATCH 134/254 KVM: x86: Allocate new rmap and large page tracking when moving memslot
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit edd4fa37baa6ee8e44dc65523b27bd6fe44c94de upstream.
Reallocate a rmap array and recalcuate large page compatibility when moving an existing memslot to correctly handle the alignment properties of the new memslot. The number of rmap entries required at each level is dependent on the alignment of the memslot's base gfn with respect to that level, e.g. moving a large-page aligned memslot so that it becomes unaligned will increase the number of rmap entries needed at the now unaligned level.
Not updating the rmap array is the most obvious bug, as KVM accesses garbage data beyond the end of the rmap. KVM interprets the bad data as pointers, leading to non-canonical #GPs, unexpected #PFs, etc...
general protection fault: 0000 [#1] SMP CPU: 0 PID: 1909 Comm: move_memory_reg Not tainted 5.4.0-rc7+ #139 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:rmap_get_first+0x37/0x50 [kvm] Code: <48> 8b 3b 48 85 ff 74 ec e8 6c f4 ff ff 85 c0 74 e3 48 89 d8 5b c3 RSP: 0018:ffffc9000021bbc8 EFLAGS: 00010246 RAX: ffff00617461642e RBX: ffff00617461642e RCX: 0000000000000012 RDX: ffff88827400f568 RSI: ffffc9000021bbe0 RDI: ffff88827400f570 RBP: 0010000000000000 R08: ffffc9000021bd00 R09: ffffc9000021bda8 R10: ffffc9000021bc48 R11: 0000000000000000 R12: 0030000000000000 R13: 0000000000000000 R14: ffff88827427d700 R15: ffffc9000021bce8 FS: 00007f7eda014700(0000) GS:ffff888277a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7ed9216ff8 CR3: 0000000274391003 CR4: 0000000000162eb0 Call Trace: kvm_mmu_slot_set_dirty+0xa1/0x150 [kvm] __kvm_set_memory_region.part.64+0x559/0x960 [kvm] kvm_set_memory_region+0x45/0x60 [kvm] kvm_vm_ioctl+0x30f/0x920 [kvm] do_vfs_ioctl+0xa1/0x620 ksys_ioctl+0x66/0x70 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x4c/0x170 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f7ed9911f47 Code: <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 21 6f 2c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffc00937498 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000001ab0010 RCX: 00007f7ed9911f47 RDX: 0000000001ab1350 RSI: 000000004020ae46 RDI: 0000000000000004 RBP: 000000000000000a R08: 0000000000000000 R09: 00007f7ed9214700 R10: 00007f7ed92149d0 R11: 0000000000000246 R12: 00000000bffff000 R13: 0000000000000003 R14: 00007f7ed9215000 R15: 0000000000000000 Modules linked in: kvm_intel kvm irqbypass ---[ end trace 0c5f570b3358ca89 ]---
The disallow_lpage tracking is more subtle. Failure to update results in KVM creating large pages when it shouldn't, either due to stale data or again due to indexing beyond the end of the metadata arrays, which can lead to memory corruption and/or leaking data to guest/userspace.
Note, the arrays for the old memslot are freed by the unconditional call to kvm_free_memslot() in __kvm_set_memory_region().
--- arch/x86/kvm/x86.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/x86/kvm/x86.c +11 -0
@@ -9873,6 +9873,13 @@ int kvm_arch_create_memslot(struct kvm * {int i; +/* +* Clear out the previous array pointers for the KVM_MR_MOVE case. The +* old arrays will be freed by __kvm_set_memory_region() if installing +* the new memslot is successful. +*/ +memset (&slot->arch,0 ,sizeof (slot->arch)); +for (i =0 ; i <KVM_NR_PAGE_SIZES ; ++i) {struct kvm_lpage_info *linfo;unsigned long ugfn;
@@ -9954,6 +9961,10 @@ int kvm_arch_prepare_memory_region(struc const struct kvm_userspace_memory_region *mem, enum kvm_mr_change change) { + if (change == KVM_MR_MOVE) + return kvm_arch_create_memslot(kvm, memslot, + mem->memory_size >> PAGE_SHIFT); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 135/254 KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 31603d4fc2bb4f0815245d496cb970b27b4f636a upstream.
VMCLEAR all in-use VMCSes during a crash, even if kdump's NMI shootdown interrupted a KVM update of the percpu in-use VMCS list.
Because NMIs are not blocked by disabling IRQs, it's possible that crash_vmclear_local_loaded_vmcss() could be called while the percpu list of VMCSes is being modified, e.g. in the middle of list_add() in vmx_vcpu_load_vmcs(). This potential corner case was called out in the original commit[*], but the analysis of its impact was wrong.
Skipping the VMCLEARs is wrong because it all but guarantees that a loaded, and therefore cached, VMCS will live across kexec and corrupt memory in the new kernel. Corruption will occur because the CPU's VMCS cache is non-coherent, i.e. not snooped, and so the writeback of VMCS memory on its eviction will overwrite random memory in the new kernel. The VMCS will live because the NMI shootdown also disables VMX, i.e. the in-progress VMCLEAR will #UD, and existing Intel CPUs do not flush the VMCS cache on VMXOFF.
Furthermore, interrupting list_add() and list_del() is safe due to crash_vmclear_local_loaded_vmcss() using forward iteration. list_add() ensures the new entry is not visible to forward iteration unless the entire add completes, via WRITE_ONCE(prev->next, new). A bad "prev" pointer could be observed if the NMI shootdown interrupted list_del() or list_add(), but list_for_each_entry() does not consume ->prev.
In addition to removing the temporary disabling of VMCLEAR, open code loaded_vmcs_init() in __loaded_vmcs_clear() and reorder VMCLEAR so that the VMCS is deleted from the list only after it's been VMCLEAR'd. Deleting the VMCS before VMCLEAR would allow a race where the NMI shootdown could arrive between list_del() and vmcs_clear() and thus neither flow would execute a successful VMCLEAR. Alternatively, more code could be moved into loaded_vmcs_init(), but that gets rather silly as the only other user, alloc_loaded_vmcs(), doesn't need the smp_wmb() and would need to work around the list_del().
Update the smp_*() comments related to the list manipulation, and opportunistically reword them to improve clarity.
[*] https://patchwork.kernel.org/patch/1675731/#3720461
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 67 +++++++++++-------------------------------------- 1 file changed, 16 insertions(+), 51 deletions(-)
arch/x86/kvm/vmx/vmx.c +16 -51
@@ -666,43 +666,15 @@ void loaded_vmcs_init(struct loaded_vmcs }#ifdef CONFIG_KEXEC_CORE -/* -* This bitmap is used to indicate whether the vmclear -* operation is enabled on all cpus. All disabled by -* default. -*/ -static cpumask_t crash_vmclear_enabled_bitmap =CPU_MASK_NONE ; - -static inline void crash_enable_local_vmclear (int cpu) -{ -cpumask_set_cpu (cpu, &crash_vmclear_enabled_bitmap); -} - -static inline void crash_disable_local_vmclear (int cpu) -{ -cpumask_clear_cpu (cpu, &crash_vmclear_enabled_bitmap); -} - -static inline int crash_local_vmclear_enabled (int cpu) -{ -return cpumask_test_cpu (cpu, &crash_vmclear_enabled_bitmap); -} -static void crash_vmclear_local_loaded_vmcss (void ) {int cpu =raw_smp_processor_id ();struct loaded_vmcs *v; -if (!crash_local_vmclear_enabled (cpu)) -return ; -list_for_each_entry (v, &per_cpu (loaded_vmcss_on_cpu, cpu), loaded_vmcss_on_cpu_link)vmcs_clear (v->vmcs); } -#else -static inline void crash_enable_local_vmclear (int cpu) { } -static inline void crash_disable_local_vmclear (int cpu) { }#endif /* CONFIG_KEXEC_CORE */ static void __loaded_vmcs_clear (void *arg)
@@ -714,19 +686,24 @@ static void __loaded_vmcs_clear(void *arreturn ;/* vcpu migration can race with cpu offline */ if (per_cpu (current_vmcs, cpu) == loaded_vmcs->vmcs)per_cpu (current_vmcs, cpu) =NULL ; -crash_disable_local_vmclear (cpu); + +vmcs_clear (loaded_vmcs->vmcs); +if (loaded_vmcs->shadow_vmcs && loaded_vmcs->launched) +vmcs_clear (loaded_vmcs->shadow_vmcs); +list_del (&loaded_vmcs->loaded_vmcss_on_cpu_link);/* -* we should ensure updating loaded_vmcs->loaded_vmcss_on_cpu_link -* is before setting loaded_vmcs->vcpu to -1 which is done in -* loaded_vmcs_init. Otherwise, other cpu can see vcpu = -1 fist -* then adds the vmcs into percpu list before it is deleted. +* Ensure all writes to loaded_vmcs, including deleting it from its +* current percpu list, complete before setting loaded_vmcs->vcpu to +* -1, otherwise a different cpu can see vcpu == -1 first and add +* loaded_vmcs to its percpu list before it's deleted from this cpu's +* list. Pairs with the smp_rmb() in vmx_vcpu_load_vmcs(). */ smp_wmb (); -loaded_vmcs_init (loaded_vmcs); -crash_enable_local_vmclear (cpu); + loaded_vmcs->cpu =-1 ; + loaded_vmcs->launched =0 ; }void loaded_vmcs_clear (struct loaded_vmcs *loaded_vmcs)
@@ -1345,18 +1322,17 @@ void vmx_vcpu_load_vmcs(struct kvm_vcpuif (!already_loaded) {loaded_vmcs_clear (vmx->loaded_vmcs);local_irq_disable (); -crash_disable_local_vmclear (cpu);/* -* Read loaded_vmcs->cpu should be before fetching -* loaded_vmcs->loaded_vmcss_on_cpu_link. -* See the comments in __loaded_vmcs_clear(). +* Ensure loaded_vmcs->cpu is read before adding loaded_vmcs to +* this cpu's percpu list, otherwise it may not yet be deleted +* from its previous cpu's percpu list. Pairs with the +* smb_wmb() in __loaded_vmcs_clear(). */ smp_rmb ();list_add (&vmx->loaded_vmcs->loaded_vmcss_on_cpu_link, &per_cpu (loaded_vmcss_on_cpu, cpu)); -crash_enable_local_vmclear (cpu);local_irq_enable (); }
@@ -2292,17 +2268,6 @@ static int hardware_enable(void)INIT_LIST_HEAD (&per_cpu (blocked_vcpu_on_cpu, cpu));spin_lock_init (&per_cpu (blocked_vcpu_on_cpu_lock, cpu)); -/* -* Now we can enable the vmclear operation in kdump -* since the loaded_vmcss_on_cpu list on this cpu -* has been initialized. -* -* Though the cpu is not in VMX operation now, there -* is no problem to enable the vmclear operation -* for the loaded_vmcss_on_cpu list is empty! -*/ -crash_enable_local_vmclear (cpu); -kvm_cpu_vmxon (phys_addr);if (enable_ept)ept_sync_global ();
Greg Kroah-Hartman
maintainerPATCH 136/254 KVM: x86: Gracefully handle __vmalloc() failure during VM allocation
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit d18b2f43b9147c8005ae0844fb445d8cc6a87e31 upstream.
Check the result of __vmalloc() to avoid dereferencing a NULL pointer in the event that allocation failres.
--- arch/x86/kvm/svm.c | 4 ++++ arch/x86/kvm/vmx/vmx.c | 4 ++++ 2 files changed, 8 insertions(+)
arch/x86/kvm/svm.c +4 -0
@@ -1943,6 +1943,10 @@ static struct kvm *svm_vm_alloc(void)struct kvm_svm *kvm_svm =__vmalloc (sizeof (struct kvm_svm ),GFP_KERNEL_ACCOUNT | __GFP_ZERO,PAGE_KERNEL ); + +if (!kvm_svm) +return NULL ; +return &kvm_svm->kvm; }
arch/x86/kvm/vmx/vmx.c +4 -0
@@ -6671,6 +6671,10 @@ static struct kvm *vmx_vm_alloc(void)struct kvm_vmx *kvm_vmx =__vmalloc (sizeof (struct kvm_vmx ),GFP_KERNEL_ACCOUNT | __GFP_ZERO,PAGE_KERNEL ); + +if (!kvm_vmx) +return NULL ; +return &kvm_vmx->kvm; }
Greg Kroah-Hartman
maintainerPATCH 137/254 KVM: VMX: Add a trampoline to fix VMREAD error handling
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 842f4be95899df22b5843ba1a7c8cf37e831a6e8 upstream.
Add a hand coded assembly trampoline to preserve volatile registers across vmread_error(), and to handle the calling convention differences between 64-bit and 32-bit due to asmlinkage on vmread_error(). Pass @field and @fault on the stack when invoking the trampoline to avoid clobbering volatile registers in the context of the inline assembly.
Calling vmread_error() directly from inline assembly is partially broken on 64-bit, and completely broken on 32-bit. On 64-bit, it will clobber %rdi and %rsi (used to pass @field and @fault) and any volatile regs written by vmread_error(). On 32-bit, asmlinkage means vmread_error() expects the parameters to be passed on the stack, not via regs.
Opportunistically zero out the result in the trampoline to save a few bytes of code for every VMREAD. A happy side effect of the trampoline is that the inline code footprint is reduced by three bytes on 64-bit due to PUSH/POP being more efficent (in terms of opcode bytes) than MOV.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/ops.h | 28 ++++++++++++++++----- arch/x86/kvm/vmx/vmenter.S | 58 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 79 insertions(+), 7 deletions(-)
arch/x86/kvm/vmx/ops.h +21 -7
@@ -12,7 +12,8 @@#define __ex (x) __kvm_handle_fault_on_reboot(x) -asmlinkage void vmread_error(unsigned long field, bool fault); +__attribute__((regparm (0 )))void vmread_error_trampoline (unsigned long field, +bool fault);void vmwrite_error (unsigned long field,unsigned long value);void vmclear_error (struct vmcs *vmcs,u64 phys_addr);void vmptrld_error (struct vmcs *vmcs,u64 phys_addr);
@@ -70,15 +71,28 @@ static __always_inline unsigned long __v asmvolatile ("1: vmread %2, %1\n\t" ".byte 0x3e\n\t" /* branch taken hint */ "ja 3f\n\t" -"mov %2, %%" _ASM_ARG1"\n\t" -"xor %%" _ASM_ARG2", %%" _ASM_ARG2"\n\t" -"2: call vmread_error\n\t" -"xor %k1, %k1\n\t" + +/* +* VMREAD failed. Push '0' for @fault, push the failing +* @field, and bounce through the trampoline to preserve +* volatile registers. +*/ +"push $0\n\t" +"push %2\n\t" +"2:call vmread_error_trampoline\n\t" + +/* +* Unwind the stack. Note, the trampoline zeros out the +* memory for @fault so that the result is '0' on error. +*/ +"pop %2\n\t" +"pop %1\n\t" "3:\n\t" +/* VMREAD faulted. As above, except push '1' for @fault. */ ".pushsection .fixup, \"ax\"\n\t" -"4: mov %2, %%" _ASM_ARG1"\n\t" -"mov $1, %%" _ASM_ARG2"\n\t" +"4: push $1\n\t" +"push %2\n\t" "jmp 2b\n\t" ".popsection\n\t" _ASM_EXTABLE(1b, 4b)
arch/x86/kvm/vmx/vmenter.S +58 -0
61 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 138/254 KVM: VMX: fix crash cleanup when KVM wasnt used
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
commit dbef2808af6c594922fe32833b30f55f35e9da6d upstream.
If KVM wasn't used at all before we crash the cleanup procedure fails with
BUG: unable to handle page fault for address: ffffffffffffffc8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 23215067 P4D 23215067 PUD 23217067 PMD 0 Oops: 0000 [#8] SMP PTI CPU: 0 PID: 3542 Comm: bash Kdump: loaded Tainted: G D 5.6.0-rc2+ #823 RIP: 0010:crash_vmclear_local_loaded_vmcss.cold+0x19/0x51 [kvm_intel]
The root cause is that loaded_vmcss_on_cpu list is not yet initialized, we initialize it in hardware_enable() but this only happens when we start a VM.
Previously, we used to have a bitmap with enabled CPUs and that was preventing [masking] the issue.
Initialized loaded_vmcss_on_cpu list earlier, right before we assign crash_vmclear_loaded_vmcss pointer. blocked_vcpu_on_cpu list and blocked_vcpu_on_cpu_lock are moved altogether for consistency.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
arch/x86/kvm/vmx/vmx.c +7 -5
@@ -2264,10 +2264,6 @@ static int hardware_enable(void) !hv_get_vp_assist_page(cpu))return -EFAULT ; -INIT_LIST_HEAD (&per_cpu (loaded_vmcss_on_cpu, cpu)); -INIT_LIST_HEAD (&per_cpu (blocked_vcpu_on_cpu, cpu)); -spin_lock_init (&per_cpu (blocked_vcpu_on_cpu_lock, cpu)); -kvm_cpu_vmxon (phys_addr);if (enable_ept)ept_sync_global ();
@@ -8025,7 +8021,7 @@ module_exit(vmx_exit);static int __init vmx_init (void ) { -int r; +int r, cpu;#if IS_ENABLED (CONFIG_HYPERV )/*
@@ -8079,6 +8075,12 @@ static int __init vmx_init(void)return r; } +for_each_possible_cpu (cpu) { +INIT_LIST_HEAD (&per_cpu (loaded_vmcss_on_cpu, cpu)); +INIT_LIST_HEAD (&per_cpu (blocked_vcpu_on_cpu, cpu)); +spin_lock_init (&per_cpu (blocked_vcpu_on_cpu_lock, cpu)); + } +#ifdef CONFIG_KEXEC_CORE rcu_assign_pointer (crash_vmclear_loaded_vmcss, crash_vmclear_local_loaded_vmcss);
Greg Kroah-Hartman
maintainerPATCH 139/254 smb3: fix performance regression with setting mtime
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
commit cf5371ae460eb8e484e4884747af270c86c3c469 upstream.
There are cases when we don't want to send the SMB2 flush operation (e.g. when user specifies mount parm "nostrictsync") and it can be a very expensive operation on the server. In most cases in order to set mtime, we simply need to flush (write) the dirtry pages from the client and send the writes to the server not also send a flush protocol operation to the server.
--- fs/cifs/inode.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-)
fs/cifs/inode.c +12 -11
@@ -2516,25 +2516,26 @@ cifs_setattr_nounix(struct dentry *diren/* * Attempt to flush data before changing attributes. We need to do -* this for ATTR_SIZE and ATTR_MTIME for sure, and if we change the -* ownership or mode then we may also need to do this. Here, we take -* the safe way out and just do the flush on all setattr requests. If -* the flush returns error, store it to report later and continue. +* this for ATTR_SIZE and ATTR_MTIME. If the flush of the data +* returns error, store it to report later and continue. * * BB: This should be smarter. Why bother flushing pages that * will be truncated anyway? Also, should we error out here if -* the flush returns error? +* the flush returns error? Do we need to check for ATTR_MTIME_SET flag? */ - rc =filemap_write_and_wait (inode->i_mapping); -if (is_interrupt_error (rc)) { - rc = -ERESTARTSYS ; - goto cifs_setattr_exit; +if (attrs->ia_valid & (ATTR_MTIME |ATTR_SIZE |ATTR_CTIME )) { + rc =filemap_write_and_wait (inode->i_mapping); +if (is_interrupt_error (rc)) { + rc = -ERESTARTSYS ; + goto cifs_setattr_exit; + } +mapping_set_error (inode->i_mapping, rc); } -mapping_set_error (inode->i_mapping, rc); rc =0 ; -if (attrs->ia_valid &ATTR_MTIME ) { +if ((attrs->ia_valid &ATTR_MTIME ) && + !(cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NOSSYNC )) { rc =cifs_get_writable_file (cifsInode,FIND_WR_ANY , &wfile);if (!rc) { tcon =tlink_tcon (wfile->tlink);
Greg Kroah-Hartman
maintainerPATCH 140/254 CIFS: Fix bug which the return value by asynchronous read is error
In reply to Greg Kroah-HartmanFrom: Yilu Lin <[email protected]>
commit 97adda8b3ab703de8e4c8d27646ddd54fe22879c upstream.
This patch is used to fix the bug in collect_uncached_read_data() that rc is automatically converted from a signed number to an unsigned number when the CIFS asynchronous read fails. It will cause ctx->rc is error.
Example:
Share a directory and create a file on the Windows OS. Mount the directory to the Linux OS using CIFS.
On the CIFS client of the Linux OS, invoke the pread interface to deliver the read request.
The size of the read length plus offset of the read request is greater than the maximum file size.
In this case, the CIFS server on the Windows OS returns a failure message (for example, the return value of smb2.nt_status is STATUS_INVALID_PARAMETER).
After receiving the response message, the CIFS client parses smb2.nt_status to STATUS_INVALID_PARAMETER
and converts it to the Linux error code (rdata->result=-22).
Then the CIFS client invokes the collect_uncached_read_data function to assign the value of rdata->result to rc, that is, rc=rdata->result=-22.
The type of the ctx->total_len variable is unsigned integer, the type of the rc variable is integer, and the type of the ctx->rc variable is ssize_t.
Therefore, during the ternary operation, the value of rc is automatically converted to an unsigned number. The final result is ctx->rc=4294967274. However, the expected result is ctx->rc=-22.
--- fs/cifs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/file.c +1 -1
@@ -3841,7 +3841,7 @@ again:if (rc == -ENODATA ) rc =0 ; - ctx->rc = (rc ==0 ) ? ctx->total_len : rc; + ctx->rc = (rc ==0 ) ? (ssize_t )ctx->total_len : rc;mutex_unlock (&ctx->aio_mutex);
Greg Kroah-Hartman
maintainerPATCH 141/254 CIFS: check new file size when extending file by fallocate
In reply to Greg Kroah-HartmanFrom: Murphy Zhou <[email protected]>
commit ef4a632ccc1c7d3fb71a5baae85b79af08b7f94b upstream.
xfstests generic/228 checks if fallocate respect RLIMIT_FSIZE. After fallocate mode 0 extending enabled, we can hit this failure. Fix this by check the new file size with vfs helper, return error if file size is larger then RLIMIT_FSIZE(ulimit -f).
This patch has been tested by LTP/xfstests aginst samba and Windows server.
--- fs/cifs/smb2ops.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/cifs/smb2ops.c +4 -0
@@ -3248,6 +3248,10 @@ static long smb3_simple_falloc(struct fi* Extending the file */ if ((keep_size == false) &&i_size_read (inode) < off + len) { + rc =inode_newsize_ok (inode, off + len); +if (rc) + goto out; +if ((cifsi->cifsAttrs &FILE_ATTRIBUTE_SPARSE_FILE ) ==0 )smb2_set_sparse (xid, tcon, cfile, inode, false);
Greg Kroah-Hartman
maintainerPATCH 142/254 mtd: spinand: Stop using spinand->oobbuf for buffering bad block markers
In reply to Greg Kroah-HartmanFrom: Frieder Schrempf <[email protected]>
commit 2148937501ee3d663e0010e519a553fea67ad103 upstream.
For reading and writing the bad block markers, spinand->oobbuf is currently used as a buffer for the marker bytes. During the underlying read and write operations to actually get/set the content of the OOB area, the content of spinand->oobbuf is reused and changed by accessing it through spinand->oobbuf and/or spinand->databuf.
This is a flaw in the original design of the SPI NAND core and at the latest from 13c15e07eedf ("mtd: spinand: Handle the case where PROGRAM LOAD does not reset the cache") on, it results in not having the bad block marker written at all, as the spinand->oobbuf is cleared to 0xff after setting the marker bytes to zero.
To fix it, we now just store the two bytes for the marker on the stack and let the read/write operations copy it from/to the page buffer later.
--- drivers/mtd/nand/spi/core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/mtd/nand/spi/core.c +7 -7
@@ -568,18 +568,18 @@ static int spinand_mtd_write(struct mtd_static bool spinand_isbad (struct nand_device *nand,const struct nand_pos *pos) {struct spinand_device *spinand =nand_to_spinand (nand); +u8 marker[2 ] = { };struct nand_page_io_req req = { .pos = *pos, - .ooblen =2 , + .ooblen =sizeof (marker), .ooboffs =0 , - .oobbuf.in = spinand->oobbuf, + .oobbuf.in = marker, .mode =MTD_OPS_RAW , }; -memset (spinand->oobbuf,0 ,2 );spinand_select_target (spinand, pos->target);spinand_read_page (spinand, &req, false); -if (spinand->oobbuf[0 ] !=0xff || spinand->oobbuf[1 ] !=0xff ) +if (marker[0 ] !=0xff || marker[1 ] !=0xff )return true;return false;
@@ -603,11 +603,12 @@ static int spinand_mtd_block_isbad(strucstatic int spinand_markbad (struct nand_device *nand,const struct nand_pos *pos) {struct spinand_device *spinand =nand_to_spinand (nand); +u8 marker[2 ] = { };struct nand_page_io_req req = { .pos = *pos, .ooboffs =0 , - .ooblen =2 , - .oobbuf.out = spinand->oobbuf, + .ooblen =sizeof (marker), + .oobbuf.out = marker, };int ret;
@@ -622,7 +623,6 @@ static int spinand_markbad(struct nand_dspinand_erase_op (spinand, pos); -memset (spinand->oobbuf,0 ,2 );return spinand_write_page (spinand, &req); }
Greg Kroah-Hartman
maintainerPATCH 143/254 mtd: spinand: Do not erase the block before writing a bad block marker
In reply to Greg Kroah-HartmanFrom: Frieder Schrempf <[email protected]>
commit b645ad39d56846618704e463b24bb994c9585c7f upstream.
Currently when marking a block, we use spinand_erase_op() to erase the block before writing the marker to the OOB area. Doing so without waiting for the operation to finish can lead to the marking failing silently and no bad block marker being written to the flash.
In fact we don't need to do an erase at all before writing the BBM. The ECC is disabled for raw accesses to the OOB data and we don't need to work around any issues with chips reporting ECC errors as it is known to be the case for raw NAND.
--- drivers/mtd/nand/spi/core.c | 3 --- 1 file changed, 3 deletions(-)
drivers/mtd/nand/spi/core.c +0 -3
@@ -612,7 +612,6 @@ static int spinand_markbad(struct nand_d };int ret; -/* Erase block before marking it bad. */ ret =spinand_select_target (spinand, pos->target);if (ret)return ret;
@@ -621,8 +620,6 @@ static int spinand_markbad(struct nand_dif (ret)return ret; -spinand_erase_op (spinand, pos); -return spinand_write_page (spinand, &req); }
Greg Kroah-Hartman
maintainerPATCH 144/254 mtd: rawnand: cadence: fix the calculation of the avaialble OOB size
In reply to Greg Kroah-HartmanFrom: Piotr Sroka <[email protected]>
commit e4578af0354176ff6b4ae78b9998b4f479f7c31c upstream.
The value of cdns_chip->sector_count is not known at the moment of the derivation of ecc_size, leading to a zero value. Fix this by assigning ecc_size later in the code.
--- drivers/mtd/nand/raw/cadence-nand-controller.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mtd/nand/raw/cadence-nand-controller.c +2 -1
@@ -2585,7 +2585,7 @@ int cadence_nand_attach_chip(struct nand {struct cdns_nand_ctrl *cdns_ctrl =to_cdns_nand_ctrl (chip->controller);struct cdns_nand_chip *cdns_chip =to_cdns_nand_chip (chip); -u32 ecc_size = cdns_chip->sector_count * chip->ecc.bytes; +u32 ecc_size;struct mtd_info *mtd =nand_to_mtd (chip);u32 max_oob_data_size;int ret;
@@ -2625,6 +2625,7 @@ int cadence_nand_attach_chip(struct nand/* Error correction configuration. */ cdns_chip->sector_size = chip->ecc.size; cdns_chip->sector_count = mtd->writesize / cdns_chip->sector_size; + ecc_size = cdns_chip->sector_count * chip->ecc.bytes; cdns_chip->avail_oob_size = mtd->oobsize - ecc_size;
Greg Kroah-Hartman
maintainerPATCH 145/254 mtd: rawnand: cadence: change bad block marker size
In reply to Greg Kroah-HartmanFrom: Piotr Sroka <[email protected]>
commit 9bf1903bed7a2e84f5a8deedb38f7e0ac5e8bfc6 upstream.
Increase bad block marker size from one byte to two bytes. Bad block marker is handled by skip bytes feature of HPNFC. Controller expects this value to be an even number.
--- drivers/mtd/nand/raw/cadence-nand-controller.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/mtd/nand/raw/cadence-nand-controller.c +3 -6
@@ -2603,12 +2603,9 @@ int cadence_nand_attach_chip(struct nand chip->options |=NAND_NO_SUBPAGE_WRITE ; cdns_chip->bbm_offs = chip->badblockpos; -if (chip->options &NAND_BUSWIDTH_16 ) { - cdns_chip->bbm_offs &= ~0x01 ; - cdns_chip->bbm_len =2 ; - }else { - cdns_chip->bbm_len =1 ; - } + cdns_chip->bbm_offs &= ~0x01 ; +/* this value should be even number */ + cdns_chip->bbm_len =2 ; ret = nand_ecc_choose_conf(chip, &cdns_ctrl->ecc_caps,
Greg Kroah-Hartman
maintainerPATCH 146/254 mtd: rawnand: cadence: reinit completion before executing a new command
In reply to Greg Kroah-HartmanFrom: Piotr Sroka <[email protected]>
commit 0d7d6c8183aadb1dcc13f415941404a7913b46b3 upstream.
Reing the completion object before executing CDMA command to make sure the 'done' flag is OK.
--- drivers/mtd/nand/raw/cadence-nand-controller.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/nand/raw/cadence-nand-controller.c +1 -0
@@ -997,6 +997,7 @@ static int cadence_nand_cdma_send(structreturn status;cadence_nand_reset_irq (cdns_ctrl); +reinit_completion (&cdns_ctrl->complete);writel_relaxed ((u32 )cdns_ctrl->dma_cdma_desc, cdns_ctrl->reg +CMD_REG2 );
Greg Kroah-Hartman
maintainerPATCH 147/254 drm/i915/gen12: Disable preemption timeout
In reply to Greg Kroah-HartmanFrom: Tvrtko Ursulin <[email protected]>
commit 07bcfd1291de77ffa9b627b4442783aba1335229 upstream.
Allow super long OpenCL workloads which cannot be preempted within the default timeout to run out of the box.
v2:
* Make it stick out more and apply only to RCS. (Chris)
v3:
* Mention platform override in kconfig. (Joonas)
--- drivers/gpu/drm/i915/Kconfig.profile | 4 ++++ drivers/gpu/drm/i915/gt/intel_engine_cs.c | 13 +++++++++---- 2 files changed, 13 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/Kconfig.profile +4 -0
@@ -35,6 +35,10 @@ config DRM_I915_PREEMPT_TIMEOUT May be 0 to disable the timeout. + The compiled in default may get overridden at driver probe time on + certain platforms and certain engines which will be reflected in the + sysfs control. + config DRM_I915_SPIN_REQUEST int "Busywait for request completion (us)" default 5 # microseconds
drivers/gpu/drm/i915/gt/intel_engine_cs.c +9 -4
@@ -274,6 +274,7 @@ static void intel_engine_sanitize_mmio(sstatic int intel_engine_setup (struct intel_gt *gt,enum intel_engine_id id) {const struct engine_info *info = &intel_engines[id]; +struct drm_i915_private *i915 = gt->i915;struct intel_engine_cs *engine;BUILD_BUG_ON (MAX_ENGINE_CLASS >=BIT (GEN11_ENGINE_CLASS_WIDTH ));
@@ -300,11 +301,11 @@ static int intel_engine_setup(struct int engine->id = id; engine->legacy_idx =INVALID_ENGINE ; engine->mask =BIT (id); - engine->i915 = gt->i915; + engine->i915 = i915; engine->gt = gt; engine->uncore = gt->uncore; engine->hw_id = engine->guc_id = info->hw_id; - engine->mmio_base =__engine_mmio_base (gt->i915, info->mmio_bases); + engine->mmio_base =__engine_mmio_base (i915, info->mmio_bases); engine->class = info->class; engine->instance = info->instance;
@@ -319,11 +320,15 @@ static int intel_engine_setup(struct int engine->props.timeslice_duration_ms =CONFIG_DRM_I915_TIMESLICE_DURATION ; +/* Override to uninterruptible for OpenCL workloads. */ +if (INTEL_GEN (i915) ==12 && engine->class ==RENDER_CLASS ) + engine->props.preempt_timeout_ms =0 ; + engine->context_size =intel_engine_context_size (gt, engine->class);if (WARN_ON (engine->context_size >BIT (20 ))) engine->context_size =0 ;if (engine->context_size) -DRIVER_CAPS (gt->i915)->has_logical_contexts = true; +DRIVER_CAPS (i915)->has_logical_contexts = true;/* Nothing to do here, execute in order of dependencies */ engine->schedule =NULL ;
@@ -339,7 +344,7 @@ static int intel_engine_setup(struct int gt->engine_class[info->class][info->instance] = engine; gt->engine[id] = engine; - gt->i915->engine[id] = engine; + i915->engine[id] = engine;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 148/254 btrfs: Dont submit any btree write bio if the fs has errors
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit b3ff8f1d380e65dddd772542aa9bff6c86bf715a upstream.
[BUG]
There is a fuzzed image which could cause KASAN report at unmount time.
BUG: KASAN: use-after-free in btrfs_queue_work+0x2c1/0x390 Read of size 8 at addr ffff888067cf6848 by task umount/1922 CPU: 0 PID: 1922 Comm: umount Tainted: G W 5.0.21 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: dump_stack+0x5b/0x8b print_address_description+0x70/0x280 kasan_report+0x13a/0x19b btrfs_queue_work+0x2c1/0x390 btrfs_wq_submit_bio+0x1cd/0x240 btree_submit_bio_hook+0x18c/0x2a0 submit_one_bio+0x1be/0x320 flush_write_bio.isra.41+0x2c/0x70 btree_write_cache_pages+0x3bb/0x7f0 do_writepages+0x5c/0x130 __writeback_single_inode+0xa3/0x9a0 writeback_single_inode+0x23d/0x390 write_inode_now+0x1b5/0x280 iput+0x2ef/0x600 close_ctree+0x341/0x750 generic_shutdown_super+0x126/0x370 kill_anon_super+0x31/0x50 btrfs_kill_super+0x36/0x2b0 deactivate_locked_super+0x80/0xc0 deactivate_super+0x13c/0x150 cleanup_mnt+0x9a/0x130 task_work_run+0x11a/0x1b0 exit_to_usermode_loop+0x107/0x130 do_syscall_64+0x1e5/0x280 entry_SYSCALL_64_after_hwframe+0x44/0xa9
[CAUSE]
The fuzzed image has a completely screwd up extent tree:
leaf 29421568 gen 8 total ptrs 6 free space 3587 owner EXTENT_TREE refs 2 lock (w:0 r:0 bw:0 br:0 sw:0 sr:0) lock_owner 0 current 5938
item 0 key (12587008 168 4096) itemoff 3942 itemsize 53
extent refs 1 gen 9 flags 1
ref#0: extent data backref root 5 objectid 259 offset 0 count 1
item 1 key (12591104 168 8192) itemoff 3889 itemsize 53
extent refs 1 gen 9 flags 1
ref#0: extent data backref root 5 objectid 271 offset 0 count 1
item 2 key (12599296 168 4096) itemoff 3836 itemsize 53
extent refs 1 gen 9 flags 1
ref#0: extent data backref root 5 objectid 259 offset 4096 count 1
item 3 key (29360128 169 0) itemoff 3803 itemsize 33
extent refs 1 gen 9 flags 2
ref#0: tree block backref root 5
item 4 key (29368320 169 1) itemoff 3770 itemsize 33
extent refs 1 gen 9 flags 2
ref#0: tree block backref root 5
item 5 key (29372416 169 0) itemoff 3737 itemsize 33
extent refs 1 gen 9 flags 2
ref#0: tree block backref root 5
Note that leaf 29421568 doesn't have its backref in the extent tree. Thus extent allocator can re-allocate leaf 29421568 for other trees.
In short, the bug is caused by:
- Existing tree block gets allocated to log tree
This got its generation bumped.
- Log tree balance cleaned dirty bit of offending tree block It will not be written back to disk, thus no WRITTEN flag.
- Original owner of the tree block gets COWed
Since the tree block has higher transid, no WRITTEN flag, it's reused, and not traced by transaction::dirty_pages.
- Transaction aborted
Tree blocks get cleaned according to transaction::dirty_pages. But the offending tree block is not recorded at all.
- Filesystem unmount
All pages are assumed to be are clean, destroying all workqueue, then call iput(btree_inode).
But offending tree block is still dirty, which triggers writeback, and causes use-after-free bug.
The detailed sequence looks like this:
- Initial status
eb: 29421568, header=WRITTEN bflags_dirty=0, page_dirty=0, gen=8,
not traced by any dirty extent_iot_tree.
- New tree block is allocated
Since there is no backref for 29421568, it's re-allocated as new tree block.
Keep in mind that tree block 29421568 is still referred by extent tree.
- Tree block 29421568 is filled for log tree
eb: 29421568, header=0 bflags_dirty=1, page_dirty=1, gen=9 << (gen bumped)
traced by btrfs_root::dirty_log_pages
- Some log tree operations
Since the fs is using node size 4096, the log tree can easily go a level higher.
- Log tree needs balance
Tree block 29421568 gets all its content pushed to right, thus now it is empty, and we don't need it. btrfs_clean_tree_block() from __push_leaf_right() get called.
eb: 29421568, header=0 bflags_dirty=0, page_dirty=0, gen=9
traced by btrfs_root::dirty_log_pages
- Log tree write back
btree_write_cache_pages() goes through dirty pages ranges, but since page of tree block 29421568 gets cleaned already, it's not written back to disk. Thus it doesn't have WRITTEN bit set.
But ranges in dirty_log_pages are cleared.
eb: 29421568, header=0 bflags_dirty=0, page_dirty=0, gen=9
not traced by any dirty extent_iot_tree.
- Extent tree update when committing transaction
Since tree block 29421568 has transid equal to running trans, and has no WRITTEN bit, should_cow_block() will use it directly without adding it to btrfs_transaction::dirty_pages.
eb: 29421568, header=0 bflags_dirty=1, page_dirty=1, gen=9
not traced by any dirty extent_iot_tree.
At this stage, we're doomed. We have a dirty eb not tracked by any extent io tree.
- Transaction gets aborted due to corrupted extent tree Btrfs cleans up dirty pages according to transaction::dirty_pages and btrfs_root::dirty_log_pages.
But since tree block 29421568 is not tracked by neither of them, it's still dirty.
eb: 29421568, header=0 bflags_dirty=1, page_dirty=1, gen=9
not traced by any dirty extent_iot_tree.
- Filesystem unmount
Since all cleanup is assumed to be done, all workqueus are destroyed. Then iput(btree_inode) is called, expecting no dirty pages. But tree 29421568 is still dirty, thus triggering writeback. Since all workqueues are already freed, we cause use-after-free.
This shows us that, log tree blocks + bad extent tree can cause wild dirty pages.
[FIX]
To fix the problem, don't submit any btree write bio if the filesytem has any error. This is the last safe net, just in case other cleanup haven't caught catch it.
--- fs/btrfs/extent_io.c | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-)
fs/btrfs/extent_io.c +34 -1
@@ -3905,6 +3905,7 @@ int btree_write_cache_pages(struct addre .extent_locked = 0, .sync_io = wbc->sync_mode == WB_SYNC_ALL, }; +struct btrfs_fs_info *fs_info =BTRFS_I (mapping->host)->root->fs_info;int ret =0 ;int done =0 ;int nr_to_write_done =0 ;
@@ -4018,7 +4019,39 @@ retry:end_write_bio (&epd, ret);return ret; } - ret =flush_write_bio (&epd); +/* +* If something went wrong, don't allow any metadata write bio to be +* submitted. +* +* This would prevent use-after-free if we had dirty pages not +* cleaned up, which can still happen by fuzzed images. +* +* - Bad extent tree +* Allowing existing tree block to be allocated for other trees. +* +* - Log tree operations +* Exiting tree blocks get allocated to log tree, bumps its +* generation, then get cleaned in tree re-balance. +* Such tree block will not be written back, since it's clean, +* thus no WRITTEN flag set. +* And after log writes back, this tree block is not traced by +* any dirty extent_io_tree. +* +* - Offending tree block gets re-dirtied from its original owner +* Since it has bumped generation, no WRITTEN flag, it can be +* reused without COWing. This tree block will not be traced +* by btrfs_transaction::dirty_pages. +* +* Now such dirty tree block will not be cleaned by any dirty +* extent io tree. Thus we don't want to submit such wild eb +* if the fs already has error. +*/ +if (!test_bit (BTRFS_FS_STATE_ERROR , &fs_info->fs_state)) { + ret =flush_write_bio (&epd); + }else { + ret = -EUCLEAN ; +end_write_bio (&epd, ret); + }return ret; }
Greg Kroah-Hartman
maintainerPATCH 149/254 btrfs: fix btrfs_calc_reclaim_metadata_size calculation
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit fa121a26b2ceabce613e0b4cfc7498cfde73fe8d upstream.
I noticed while running my snapshot torture test that we were getting a lot of metadata chunks allocated with very little actually used. Digging into this we would commit the transaction, still not have enough space, and then force a chunk allocation.
I noticed that we were barely flushing any delalloc at all, despite the fact that we had around 13gib of outstanding delalloc reservations. It turns out this is because of our btrfs_calc_reclaim_metadata_size() calculation. It _only_ takes into account the outstanding ticket sizes, which isn't the whole story. In this particular workload we're slowly filling up the disk, which means our overcommit space will suddenly become a lot less, and our outstanding reservations will be well more than what we can handle. However we are only flushing based on our ticket size, which is much less than we need to actually reclaim.
So fix btrfs_calc_reclaim_metadata_size() to take into account the overage in the case that we've gotten less available space suddenly. This makes it so we attempt to reclaim a lot more delalloc space, which allows us to make our reservations and we no longer are allocating a bunch of needless metadata chunks.
--- fs/btrfs/space-info.c | 43 ++++++++++++++++++++++++++++++++++--------- 1 file changed, 34 insertions(+), 9 deletions(-)
fs/btrfs/space-info.c +34 -9
@@ -159,25 +159,19 @@ static inline u64 calc_global_rsv_need_sreturn (global->size <<1 ); } -int btrfs_can_overcommit (struct btrfs_fs_info *fs_info, -struct btrfs_space_info *space_info,u64 bytes, -enum btrfs_reserve_flush_enum flush) +static u64 calc_available_free_space (struct btrfs_fs_info *fs_info, +struct btrfs_space_info *space_info, +enum btrfs_reserve_flush_enum flush) {u64 profile;u64 avail; -u64 used;int factor; -/* Don't overcommit when in mixed mode. */ -if (space_info->flags &BTRFS_BLOCK_GROUP_DATA ) -return 0 ; -if (space_info->flags &BTRFS_BLOCK_GROUP_SYSTEM ) profile =btrfs_system_alloc_profile (fs_info);else profile =btrfs_metadata_alloc_profile (fs_info); - used =btrfs_space_info_used (space_info, true); avail =atomic64_read (&fs_info->free_chunk_space);/*
@@ -198,6 +192,22 @@ int btrfs_can_overcommit(struct btrfs_fs avail >>=3 ; else avail >>= 1; +return avail; +} + +int btrfs_can_overcommit (struct btrfs_fs_info *fs_info, +struct btrfs_space_info *space_info,u64 bytes, +enum btrfs_reserve_flush_enum flush) +{ +u64 avail; +u64 used; + +/* Don't overcommit when in mixed mode */ +if (space_info->flags &BTRFS_BLOCK_GROUP_DATA ) +return 0 ; + + used =btrfs_space_info_used (space_info, true); + avail =calc_available_free_space (fs_info, space_info, flush);if (used + bytes < space_info->total_bytes + avail)return 1 ;
@@ -629,6 +639,7 @@ btrfs_calc_reclaim_metadata_size(struct {struct reserve_ticket *ticket;u64 used; +u64 avail;u64 expected;u64 to_reclaim =0 ;
@@ -636,6 +647,20 @@ btrfs_calc_reclaim_metadata_size(struct to_reclaim += ticket->bytes;list_for_each_entry (ticket, &space_info->priority_tickets, list) to_reclaim += ticket->bytes; + + avail =calc_available_free_space (fs_info, space_info, +BTRFS_RESERVE_FLUSH_ALL ); + used =btrfs_space_info_used (space_info, true); + +/* +* We may be flushing because suddenly we have less space than we had +* before, and now we're well over-committed based on our current free +* space. If that's the case add in our overage so we make sure to put +* appropriate pressure on the flushing state machine. +*/ +if (space_info->total_bytes + avail < used) + to_reclaim += used - (space_info->total_bytes + avail); +if (to_reclaim)return to_reclaim;
Greg Kroah-Hartman
maintainerPATCH 150/254 Btrfs: fix crash during unmount due to race with delayed inode workers
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit f0cc2cd70164efe8f75c5d99560f0f69969c72e4 upstream.
During unmount we can have a job from the delayed inode items work queue still running, that can lead to at least two bad things:
1) A crash, because the worker can try to create a transaction just after the fs roots were freed;
2) A transaction leak, because the worker can create a transaction before the fs roots are freed and just after we committed the last transaction and after we stopped the transaction kthread.
A stack trace example of the crash:
[79011.691214] kernel BUG at lib/radix-tree.c:982! [79011.692056] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [79011.693180] CPU: 3 PID: 1394 Comm: kworker/u8:2 Tainted: G W 5.6.0-rc2-btrfs-next-54 #2 (...) [79011.696789] Workqueue: btrfs-delayed-meta btrfs_work_helper [btrfs] [79011.697904] RIP: 0010:radix_tree_tag_set+0xe7/0x170 (...) [79011.702014] RSP: 0018:ffffb3c84a317ca0 EFLAGS: 00010293 [79011.702949] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [79011.704202] RDX: ffffb3c84a317cb0 RSI: ffffb3c84a317ca8 RDI: ffff8db3931340a0 [79011.705463] RBP: 0000000000000005 R08: 0000000000000005 R09: ffffffff974629d0 [79011.706756] R10: ffffb3c84a317bc0 R11: 0000000000000001 R12: ffff8db393134000 [79011.708010] R13: ffff8db3931340a0 R14: ffff8db393134068 R15: 0000000000000001 [79011.709270] FS: 0000000000000000(0000) GS:ffff8db3b6a00000(0000) knlGS:0000000000000000 [79011.710699] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [79011.711710] CR2: 00007f22c2a0a000 CR3: 0000000232ad4005 CR4: 00000000003606e0 [79011.712958] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [79011.714205] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [79011.715448] Call Trace: [79011.715925] record_root_in_trans+0x72/0xf0 [btrfs] [79011.716819] btrfs_record_root_in_trans+0x4b/0x70 [btrfs] [79011.717925] start_transaction+0xdd/0x5c0 [btrfs] [79011.718829] btrfs_async_run_delayed_root+0x17e/0x2b0 [btrfs] [79011.719915] btrfs_work_helper+0xaa/0x720 [btrfs] [79011.720773] process_one_work+0x26d/0x6a0 [79011.721497] worker_thread+0x4f/0x3e0 [79011.722153] ? process_one_work+0x6a0/0x6a0 [79011.722901] kthread+0x103/0x140 [79011.723481] ? kthread_create_worker_on_cpu+0x70/0x70 [79011.724379] ret_from_fork+0x3a/0x50 (...)
The following diagram shows a sequence of steps that lead to the crash during ummount of the filesystem:
CPU 1 CPU 2 CPU 3
btrfs_punch_hole()
btrfs_btree_balance_dirty()
btrfs_balance_delayed_items()
--> sees
fs_info->delayed_root->items
with value 200, which is greater
than
BTRFS_DELAYED_BACKGROUND (128)
and smaller than
BTRFS_DELAYED_WRITEBACK (512)
btrfs_wq_run_delayed_node()
--> queues a job for
fs_info->delayed_workers to run
btrfs_async_run_delayed_root()
btrfs_async_run_delayed_root()
--> job queued by CPU 1
--> starts picking and running
delayed nodes from the
prepare_list list
close_ctree()
btrfs_delete_unused_bgs()
btrfs_commit_super()
btrfs_join_transaction()
--> gets transaction N
btrfs_commit_transaction(N)
--> set transaction state
to TRANTS_STATE_COMMIT_START
btrfs_first_prepared_delayed_node()
--> picks delayed node X through
the prepared_list list
btrfs_run_delayed_items()
btrfs_first_delayed_node()
--> also picks delayed node X
but through the node_list
list
__btrfs_commit_inode_delayed_items()
--> runs all delayed items from
this node and drops the
node's item count to 0
through call to
btrfs_release_delayed_inode()
--> finishes running any remaining
delayed nodes
--> finishes transaction commit
--> stops cleaner and transaction threads
btrfs_free_fs_roots()
--> frees all roots and removes them
from the radix tree
fs_info->fs_roots_radix
btrfs_join_transaction()
start_transaction()
btrfs_record_root_in_trans()
record_root_in_trans()
radix_tree_tag_set()
--> crashes because
the root is not in
the radix tree
anymoreIf the worker is able to call btrfs_join_transaction() before the unmount task frees the fs roots, we end up leaking a transaction and all its resources, since after the call to btrfs_commit_super() and stopping the transaction kthread, we don't expect to have any transaction open anymore.
When this situation happens the worker has a delayed node that has no more items to run, since the task calling btrfs_run_delayed_items(), which is doing a transaction commit, picks the same node and runs all its items first.
We can not wait for the worker to complete when running delayed items through btrfs_run_delayed_items(), because we call that function in several phases of a transaction commit, and that could cause a deadlock because the worker calls btrfs_join_transaction() and the task doing the transaction commit may have already set the transaction state to TRANS_STATE_COMMIT_DOING.
Also it's not possible to get into a situation where only some of the items of a delayed node are added to the fs/subvolume tree in the current transaction and the remaining ones in the next transaction, because when running the items of a delayed inode we lock its mutex, effectively waiting for the worker if the worker is running the items of the delayed node already.
Since this can only cause issues when unmounting a filesystem, fix it in a simple way by waiting for any jobs on the delayed workers queue before calling btrfs_commit_supper() at close_ctree(). This works because at this point no one can call btrfs_btree_balance_dirty() or btrfs_balance_delayed_items(), and if we end up waiting for any worker to complete, btrfs_commit_super() will commit the transaction created by the worker.
--- fs/btrfs/async-thread.c | 8 ++++++++ fs/btrfs/async-thread.h | 1 + fs/btrfs/disk-io.c | 13 +++++++++++++ 3 files changed, 22 insertions(+)
fs/btrfs/async-thread.c +8 -0
@@ -395,3 +395,11 @@ void btrfs_set_work_high_priority(struct {set_bit (WORK_HIGH_PRIO_BIT , &work->flags); } + +void btrfs_flush_workqueue (struct btrfs_workqueue *wq) +{ +if (wq->high) +flush_workqueue (wq->high->normal_wq); + +flush_workqueue (wq->normal->normal_wq); +}
fs/btrfs/async-thread.h +1 -0
@@ -44,5 +44,6 @@ void btrfs_set_work_high_priority(structstruct btrfs_fs_info *__pure btrfs_work_owner (const struct btrfs_work *work);struct btrfs_fs_info *__pure btrfs_workqueue_owner (const struct __btrfs_workqueue *wq);bool btrfs_workqueue_normal_congested (const struct btrfs_workqueue *wq); +void btrfs_flush_workqueue (struct btrfs_workqueue *wq);#endif
fs/btrfs/disk-io.c +13 -0
@@ -3990,6 +3990,19 @@ void __cold close_ctree(struct btrfs_fs_*/ btrfs_delete_unused_bgs (fs_info); +/* +* There might be existing delayed inode workers still running +* and holding an empty delayed inode item. We must wait for +* them to complete first because they can create a transaction. +* This happens when someone calls btrfs_balance_delayed_items() +* and then a transaction commit runs the same delayed nodes +* before any delayed worker has done something with the nodes. +* We must wait for any worker here and not at transaction +* commit time since that could cause a deadlock. +* This is a very rare case. +*/ +btrfs_flush_workqueue (fs_info->delayed_workers); + ret =btrfs_commit_super (fs_info);if (ret)btrfs_err (fs_info,"commit super ret %d" , ret);
Greg Kroah-Hartman
maintainerPATCH 151/254 btrfs: reloc: clean dirty subvols if we fail to start a transaction
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 6217b0fadd4473a16fabc6aecd7527a9f71af534 upstream.
If we do merge_reloc_roots() we could insert a few roots onto the dirty subvol roots list, where we hold a ref on them. If we fail to start the transaction we need to run clean_dirty_subvols() in order to cleanup the refs.
--- fs/btrfs/relocation.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/btrfs/relocation.c +3 -3
@@ -4221,10 +4221,10 @@ restart: goto out_free; }btrfs_commit_transaction (trans); +out_free: ret =clean_dirty_subvols (rc);if (ret <0 && !err) err = ret; -out_free:btrfs_free_block_rsv (fs_info, rc->block_rsv);btrfs_free_path (path);return err;
@@ -4634,10 +4634,10 @@ int btrfs_recover_relocation(struct btrf trans =btrfs_join_transaction (rc->extent_root);if (IS_ERR (trans)) { err =PTR_ERR (trans); - goto out_free; + goto out_clean; } err =btrfs_commit_transaction (trans); - +out_clean: ret =clean_dirty_subvols (rc);if (ret <0 && !err) err = ret;
Greg Kroah-Hartman
maintainerPATCH 152/254 btrfs: set update the uuid generation as soon as possible
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 75ec1db8717a8f0a9d9c8d033e542fdaa7b73898 upstream.
In my EIO stress testing I noticed I was getting forced to rescan the uuid tree pretty often, which was weird. This is because my error injection stuff would sometimes inject an error after log replay but before we loaded the UUID tree. If log replay committed the transaction it wouldn't have updated the uuid tree generation, but the tree was valid and didn't change, so there's no reason to not update the generation here.
Fix this by setting the BTRFS_FS_UPDATE_UUID_TREE_GEN bit immediately after reading all the fs roots if the uuid tree generation matches the fs generation. Then any transaction commits that happen during mount won't screw up our uuid tree state, forcing us to do needless uuid rescans.
--- fs/btrfs/disk-io.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
fs/btrfs/disk-io.c +12 -2
@@ -3061,6 +3061,18 @@ int __cold open_ctree(struct super_blockif (ret) goto fail_tree_roots; +/* +* If we have a uuid root and we're not being told to rescan we need to +* check the generation here so we can set the +* BTRFS_FS_UPDATE_UUID_TREE_GEN bit. Otherwise we could commit the +* transaction during a balance or the log replay without updating the +* uuid generation, and then if we crash we would rescan the uuid tree, +* even though it was perfectly fine. +*/ +if (fs_info->uuid_root && !btrfs_test_opt (fs_info,RESCAN_UUID_TREE ) && + fs_info->generation ==btrfs_super_uuid_tree_generation (disk_super)) +set_bit (BTRFS_FS_UPDATE_UUID_TREE_GEN , &fs_info->flags); + ret =btrfs_verify_dev_extents (fs_info);if (ret) { btrfs_err(fs_info,
@@ -3285,8 +3297,6 @@ int __cold open_ctree(struct super_blockclose_ctree (fs_info);return ret; } - }else { -set_bit (BTRFS_FS_UPDATE_UUID_TREE_GEN , &fs_info->flags); }set_bit (BTRFS_FS_OPEN , &fs_info->flags);
Greg Kroah-Hartman
maintainerPATCH 153/254 btrfs: drop block from cache on error in relocation
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 8e19c9732ad1d127b5575a10f4fbcacf740500ff upstream.
If we have an error while building the backref tree in relocation we'll process all the pending edges and then free the node. However if we integrated some edges into the cache we'll lose our link to those edges by simply freeing this node, which means we'll leak memory and references to any roots that we've found.
Instead we need to use remove_backref_node(), which walks through all of the edges that are still linked to this node and free's them up and drops any root references we may be holding.
--- fs/btrfs/relocation.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/relocation.c +1 -1
@@ -1186,7 +1186,7 @@ out:free_backref_node (cache, lower); } -free_backref_node (cache, node); +remove_backref_node (cache, node);return ERR_PTR (err); }ASSERT (!node || !node->detached);
Greg Kroah-Hartman
maintainerPATCH 154/254 btrfs: fix missing file extent item for hole after ranged fsync
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 95418ed1d10774cd9a49af6f39e216c1256f1eeb upstream.
When doing a fast fsync for a range that starts at an offset greater than zero, we can end up with a log that when replayed causes the respective inode miss a file extent item representing a hole if we are not using the NO_HOLES feature. This is because for fast fsyncs we don't log any extents that cover a range different from the one requested in the fsync.
Example scenario to trigger it:
$ mkfs.btrfs -O ^no-holes -f /dev/sdd $ mount /dev/sdd /mnt
# Create a file with a single 256K and fsync it to clear to full sync
# bit in the inode - we want the msync below to trigger a fast fsync. $ xfs_io -f -c "pwrite -S 0xab 0 256K" -c "fsync" /mnt/foo
# Force a transaction commit and wipe out the log tree.
$ sync
# Dirty 768K of data, increasing the file size to 1Mb, and flush only
# the range from 256K to 512K without updating the log tree # (sync_file_range() does not trigger fsync, it only starts writeback # and waits for it to finish).
$ xfs_io -c "pwrite -S 0xcd 256K 768K" /mnt/foo $ xfs_io -c "sync_range -abw 256K 256K" /mnt/foo
# Now dirty the range from 768K to 1M again and sync that range.
$ xfs_io -c "mmap -w 768K 256K" \
-c "mwrite -S 0xef 768K 256K" \
-c "msync -s 768K 256K" \
-c "munmap" \
/mnt/foo<power fail>
# Mount to replay the log.
$ mount /dev/sdd /mnt $ umount /mnt
$ btrfs check /dev/sdd
Opening filesystem to check...
Checking filesystem on /dev/sdd
UUID: 482fb574-b288-478e-a190-a9c44a78fca6
[1/7] checking root items
[2/7] checking extents
[3/7] checking free space cache
[4/7] checking fs roots
root 5 inode 257 errors 100, file extent discount
Found file extent holes:
start: 262144, len: 524288
ERROR: errors found in fs roots
found 720896 bytes used, error(s) found
total csum bytes: 512
total tree bytes: 131072
total fs tree bytes: 32768
total extent tree bytes: 16384
btree space waste bytes: 123514
file data blocks allocated: 589824
referenced 589824Fix this issue by setting the range to full (0 to LLONG_MAX) when the NO_HOLES feature is not enabled. This results in extra work being done but it gives the guarantee we don't end up with missing holes after replaying the log.
--- fs/btrfs/file.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/btrfs/file.c +10 -0
@@ -2071,6 +2071,16 @@ int btrfs_sync_file(struct file *file, lbtrfs_init_log_ctx (&ctx, inode);/* +* Set the range to full if the NO_HOLES feature is not enabled. +* This is to avoid missing file extent items representing holes after +* replaying the log. +*/ +if (!btrfs_fs_incompat (fs_info,NO_HOLES )) { + start =0 ; + end =LLONG_MAX ; + } + +/* * We write the dirty pages in the range and wait until they complete * out of the ->i_mutex. If so, we can flush the dirty pages by * multi-task, and make the performance up. See