5.4.36-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.4.36-rc1 review
This is the start of the stable review cycle for the 5.4.36 release. There are 168 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 30 Apr 2020 18:21:07 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.36-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.36-rc1
Christian Borntraeger <[email protected]>
s390/mm: fix page table upgrade vs 2ndary address mode accesses
Arnd Bergmann <[email protected]>
compat: ARM64: always include asm-generic/compat.h
Christophe Leroy <[email protected]>
powerpc/mm: Fix CONFIG_PPC_KUAP_DEBUG on PPC32
Michael Ellerman <[email protected]>
powerpc/kuap: PPC_KUAP_DEBUG should depend on PPC_KUAP
Michal Simek <[email protected]>
Revert "serial: uartps: Register own uart console and driver structures"
Michal Simek <[email protected]>
Revert "serial: uartps: Move Port ID to device data structure"
Michal Simek <[email protected]>
Revert "serial: uartps: Change uart ID port allocation"
Michal Simek <[email protected]>
Revert "serial: uartps: Do not allow use aliases >= MAX_UART_INSTANCES"
Michal Simek <[email protected]>
Revert "serial: uartps: Fix error path when alloc failed"
Michal Simek <[email protected]>
Revert "serial: uartps: Use the same dynamic major number for all ports"
Michal Simek <[email protected]>
Revert "serial: uartps: Fix uartps_major handling"
Kazuhiro Fujita <[email protected]>
serial: sh-sci: Make sure status register SCxSR is read in correct sequence
Mathias Nyman <[email protected]>
xhci: Don't clear hub TT buffer on ep0 protocol stall
Mathias Nyman <[email protected]>
xhci: prevent bus suspend if a roothub port detected a over-current condition
Mathias Nyman <[email protected]>
xhci: Fix handling halted endpoint even if endpoint ring appears empty
Naoki Kiryu <[email protected]>
usb: typec: altmode: Fix typec_altmode_get_partner sometimes returning an invalid pointer
Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Ignore CC and vbus changes in PORT_RESET change
Udipto Goswami <[email protected]>
usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset()
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix request completion check
Xu Yilun <[email protected]>
fpga: dfl: pci: fix return value of cci_pci_sriov_configure
Oliver Neukum <[email protected]>
UAS: fix deadlock in error handling and PM flushing work
Oliver Neukum <[email protected]>
UAS: no use logging any details in case of ENODEV
Oliver Neukum <[email protected]>
cdc-acm: introduce a cool down
Oliver Neukum <[email protected]>
cdc-acm: close race betrween suspend() and acm_softint
Malcolm Priestley <[email protected]>
staging: vt6656: Power save stop wake_up_count wrap around.
Malcolm Priestley <[email protected]>
staging: vt6656: Fix pairwise key entry save.
Malcolm Priestley <[email protected]>
staging: vt6656: Fix drivers TBTT timing counter.
Malcolm Priestley <[email protected]>
staging: vt6656: Fix calling conditions of vnt_set_bss_mode
Malcolm Priestley <[email protected]>
staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by default.
Nicolas Pitre <[email protected]>
vt: don't use kmalloc() for the unicode screen buffer
Nicolas Pitre <[email protected]>
vt: don't hardcode the mem allocation upper bound
Xiyu Yang <[email protected]>
staging: comedi: Fix comedi_device refcnt leak in comedi_open
Ian Abbott <[email protected]>
staging: comedi: dt2815: fix writing hi byte of analog output
Chris Packham <[email protected]>
powerpc/setup_64: Set cache-line-size based on cache-block-size
Ahmad Fatoum <[email protected]>
ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y
Paulo Alcantara <[email protected]>
cifs: fix uninitialised lease_key in open_shroot()
Johannes Berg <[email protected]>
iwlwifi: mvm: fix inactive TID removal return value usage
Ilan Peer <[email protected]>
iwlwifi: mvm: Do not declare support for ACK Enabled Aggregation
Johannes Berg <[email protected]>
iwlwifi: mvm: limit maximum queue appropriately
Mordechay Goodstein <[email protected]>
iwlwifi: mvm: beacon statistics shouldn't go backwards
Johannes Berg <[email protected]>
iwlwifi: pcie: actually release queue memory in TVQM
Chuck Lever <[email protected]>
SUNRPC: Fix backchannel RPC soft lockups
Johannes Berg <[email protected]>
mac80211: populate debugfs only after cfg80211 init
Gyeongtaek Lee <[email protected]>
ASoC: dapm: fixup dapm kcontrol widget
Paul Moore <[email protected]>
audit: check the length of userspace generated audit records
Eric W. Biederman <[email protected]>
signal: Avoid corrupting si_pid and si_uid in do_notify_parent
Alan Stern <[email protected]>
usb-storage: Add unusual_devs entry for JMicron JMS566
Jiri Slaby <[email protected]>
tty: rocket, avoid OOB access
Andrew Melnychenko <[email protected]>
tty: hvc: fix buffer overflow during hvc_alloc().
Uros Bizjak <[email protected]>
KVM: VMX: Enable machine check support for 32bit targets
Sean Christopherson <[email protected]>
KVM: Check validity of resolved slot when searching memslots
Sean Christopherson <[email protected]>
KVM: s390: Return last valid slot if approx index is out-of-bounds
George Wilson <[email protected]>
tpm: ibmvtpm: retry on H_CLOSED in tpm_ibmvtpm_send()
Tianjia Zhang <[email protected]>
tpm: fix wrong return value in tpm_pcr_extend
Jarkko Sakkinen <[email protected]>
tpm/tpm_tis: Free IRQ if probing fails
Alexander Tsoy <[email protected]>
ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices
Xiyu Yang <[email protected]>
ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif
Takashi Iwai <[email protected]>
ALSA: hda/hdmi: Add module option to disable audio component binding
Kailang Yang <[email protected]>
ALSA: hda/realtek - Add new codec supported for ALC245
Takashi Iwai <[email protected]>
ALSA: hda/realtek - Fix unexpected init_amp override
Takashi Iwai <[email protected]>
ALSA: usx2y: Fix potential NULL dereference
Lucas Stach <[email protected]>
tools/vm: fix cross-compile build
Muchun Song <[email protected]>
mm/ksm: fix NULL pointer dereference when KSM zero page is enabled
Longpeng <[email protected]>
mm/hugetlb: fix a addressing exception caused by huge_pte_offset
Sudip Mukherjee <[email protected]>
coredump: fix null pointer dereference on coredump
Luis Mendes <[email protected]>
staging: gasket: Fix incongruency in handling of sysfs entries creation
Jann Horn <[email protected]>
vmalloc: fix remap_vmalloc_range() bounds checks
Amit Singh Tomar <[email protected]>
tty: serial: owl: add "much needed" clk_prepare_enable()
Alan Stern <[email protected]>
USB: hub: Revert commit bd0e6c9614b9 ("usb: hub: try old enumeration scheme first for high speed devices")
Alan Stern <[email protected]>
USB: hub: Fix handling of connect changes during sleep
Alan Stern <[email protected]>
USB: core: Fix free-while-in-use bug in the USB S-Glibrary
Jann Horn <[email protected]>
USB: early: Handle AMD's spec-compliant identifiers, too
Jonathan Cox <[email protected]>
USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE
Changming Liu <[email protected]>
USB: sisusbvga: Change port variable from signed to unsigned
Lars-Peter Clausen <[email protected]>
iio: xilinx-xadc: Make sure not exceed maximum samplerate
Lars-Peter Clausen <[email protected]>
iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode
Lars-Peter Clausen <[email protected]>
iio: xilinx-xadc: Fix clearing interrupt when enabling trigger
Lars-Peter Clausen <[email protected]>
iio: xilinx-xadc: Fix ADC-B powerdown
Alexandre Belloni <[email protected]>
iio: adc: ti-ads8344: properly byte swap value
Olivier Moysan <[email protected]>
iio: adc: stm32-adc: fix sleep in atomic context
Lary Gibaud <[email protected]>
iio: st_sensors: rely on odr mask to know if odr can be set
Lars Engebretsen <[email protected]>
iio: core: remove extra semi-colon from devm_iio_device_register() macro
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add connector notifier delegation
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add static mapping table for ALC1220-VB-based mobos
Takashi Iwai <[email protected]>
ALSA: hda: Remove ASUS ROG Zenith from the blacklist
Waiman Long <[email protected]>
KEYS: Avoid false positive ENOMEM error on key read
David Ahern <[email protected]>
vrf: Check skb for XFRM_TRANSFORMED flag
David Ahern <[email protected]>
xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish
Sabrina Dubroca <[email protected]>
geneve: use the correct nlattr array in NL_SET_ERR_MSG_ATTR
Sabrina Dubroca <[email protected]>
vxlan: use the correct nlattr array in NL_SET_ERR_MSG_ATTR
Florian Fainelli <[email protected]>
net: dsa: b53: b53_arl_rw_op() needs to select IVL or SVL
Florian Fainelli <[email protected]>
net: dsa: b53: Rework ARL bin logic
Florian Fainelli <[email protected]>
net: dsa: b53: Fix ARL register definitions
Florian Fainelli <[email protected]>
net: dsa: b53: Fix valid setting for MDB entries
Florian Fainelli <[email protected]>
net: dsa: b53: Lookup VID in ARL searches when VLAN is enabled
David Ahern <[email protected]>
vrf: Fix IPv6 with qdisc and xfrm
Taehee Yoo <[email protected]>
team: fix hang in team_mode_get()
Eric Dumazet <[email protected]>
tcp: cache line align MAX_TCP_HEADER
David Ahern <[email protected]>
selftests: Fix suppress test in fib_tests.sh
Eric Dumazet <[email protected]>
sched: etf: do not assume all sockets are full blown
Xiyu Yang <[email protected]>
net/x25: Fix x25_neigh refcnt leak when receiving frame
Marc Zyngier <[email protected]>
net: stmmac: dwmac-meson8b: Add missing boundary to RGMII TX clock array
Tonghao Zhang <[email protected]>
net: openvswitch: ovs_ct_exit to be done under ovs_lock
Xiyu Yang <[email protected]>
net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
Eric Dumazet <[email protected]>
net/mlx4_en: avoid indirect call in TX completion
Doug Berger <[email protected]>
net: bcmgenet: correct per TX/RX ring statistics
Dan Carpenter <[email protected]>
mlxsw: Fix some IS_ERR() vs NULL bugs
Taehee Yoo <[email protected]>
macvlan: fix null dereference in macvlan_device_event()
Taehee Yoo <[email protected]>
macsec: avoid to set wrong mtu
John Haxby <[email protected]>
ipv6: fix restrict IPV6_ADDRFORM operation
David Ahern <[email protected]>
ipv4: Update fib_select_default to handle nexthop objects
Rahul Lakkireddy <[email protected]>
cxgb4: fix large delays in PTP synchronization
Vishal Kulkarni <[email protected]>
cxgb4: fix adapter crash due to wrong MC size
Mika Westerberg <[email protected]>
PCI/PM: Add missing link delays required by the PCIe spec
Heiner Kallweit <[email protected]>
PCI/ASPM: Allow re-enabling Clock PM
Kevin Barnett <[email protected]>
scsi: smartpqi: fix problem with unique ID for physical device
Murthy Bhat <[email protected]>
scsi: smartpqi: fix call trace in device discovery
Kevin Barnett <[email protected]>
scsi: smartpqi: fix controller lockup observed during force reboot
Halil Pasic <[email protected]>
virtio-blk: improve virtqueue error to BLK_STS
Steven Rostedt (VMware) <[email protected]>
tracing/selftests: Turn off timeout setting
Kai Vehmanen <[email protected]>
ASoC: SOF: trace: fix unconditional free in trace release
Mika Westerberg <[email protected]>
PCI: pciehp: Prevent deadlock on disconnect
Aurelien Jarno <[email protected]>
libbpf: Fix readelf output parsing on powerpc with recent binutils
Mika Westerberg <[email protected]>
PCI/PM: Add pcie_wait_for_link_delay()
Yongqiang Sun <[email protected]>
drm/amd/display: Not doing optimize bandwidth if flip pending.
Mathias Nyman <[email protected]>
xhci: Finetune host initiated USB3 rootport link suspend and resume
Kai-Heng Feng <[email protected]>
xhci: Wait until link state trainsits to U0 after setting USB_SS_PORT_LS_U0
Kai-Heng Feng <[email protected]>
xhci: Ensure link state is U3 after setting USB_SS_PORT_LS_U3
František Kučera <[email protected]>
ALSA: usb-audio: Add Pioneer DJ DJM-250MK2 quirk
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN MPWIN895CL tablet
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Calculate scaling ratios on every medium/full update
Jiri Olsa <[email protected]>
perf/core: Disable page faults when getting phys address
Florian Fainelli <[email protected]>
pwm: bcm2835: Dynamically allocate base
Geert Uytterhoeven <[email protected]>
pwm: renesas-tpu: Fix late Runtime PM enablement
Nick Bowler <[email protected]>
nvme: fix compat address handling in several ioctls
Ganesh Goudar <[email protected]>
powerpc/pseries: Fix MCE handling on pseries
Nicholas Piggin <[email protected]>
Revert "powerpc/64: irq_work avoid interrupt when called with hardware irqs enabled"
Evan Green <[email protected]>
loop: Better discard support for block devices
Cornelia Huck <[email protected]>
s390/cio: avoid duplicated 'ADD' uevents
Cornelia Huck <[email protected]>
s390/cio: generate delayed uevent for vfio-ccw subchannels
Masahiro Yamada <[email protected]>
lib/raid6/test: fix build on distros whose /bin/sh is not bash
Mauro Carvalho Chehab <[email protected]>
kconfig: qconf: Fix a few alignment issues
Vasily Averin <[email protected]>
ipc/util.c: sysvipc_find_ipc() should increase position index
Eric Biggers <[email protected]>
selftests: kmod: fix handling test numbers above 9
Vasily Averin <[email protected]>
kernel/gcov/fs.c: gcov_seq_next() should increase position index
Kishon Vijay Abraham I <[email protected]>
dma-direct: fix data truncation in dma_direct_get_required_mask()
Isabel Zhang <[email protected]>
drm/amd/display: Update stream adjust in dc_stream_adjust_vmin_vmax
Sagi Grimberg <[email protected]>
nvme: fix deadlock caused by ANA update wrong locking
Hans de Goede <[email protected]>
ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map()
Santosh Sivaraj <[email protected]>
tools/test/nvdimm: Fix out of tree build
Wu Bo <[email protected]>
scsi: iscsi: Report unbind session event when the target has been removed
Sagi Grimberg <[email protected]>
nvme-tcp: fix possible crash in write_zeroes processing
Geert Uytterhoeven <[email protected]>
pwm: rcar: Fix late Runtime PM enablement
Yan, Zheng <[email protected]>
ceph: don't skip updating wanted caps when cap is stale
Qiujun Huang <[email protected]>
ceph: return ceph_mdsc_do_request() errors from __get_parent()
Javed Hasan <[email protected]>
scsi: libfc: If PRLI rejected, move rport to PLOGI state
James Smart <[email protected]>
scsi: lpfc: Fix crash in target side cable pulls hitting WAIT_FOR_UNREG
James Smart <[email protected]>
scsi: lpfc: Fix crash after handling a pci error
James Smart <[email protected]>
scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
Tero Kristo <[email protected]>
watchdog: reset last_hw_keepalive time at start
Jan Kara <[email protected]>
tools/testing/nvdimm: Fix compilation failure without CONFIG_DEV_DAX_PMEM_COMPAT
Catalin Marinas <[email protected]>
arm64: Silence clang warning on mismatched value/register sizes
James Morse <[email protected]>
arm64: compat: Workaround Neoverse-N1 #1542419 for compat user-space
James Morse <[email protected]>
arm64: Fake the IminLine size on systems affected by Neoverse-N1 #1542419
James Morse <[email protected]>
arm64: errata: Hide CTR_EL0.DIC on systems affected by Neoverse-N1 #1542419
William Dauchy <[email protected]>
net, ip_tunnel: fix interface lookup with no key
Randall Huang <[email protected]>
f2fs: fix to avoid memory leakage in f2fs_listxattr
Dmitry Monakhov <[email protected]>
ext4: fix extent_status fragmentation for plain files
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 3 +- Documentation/arm64/silicon-errata.rst | 2 + Makefile | 4 +- arch/arm/mach-imx/Makefile | 2 + arch/arm64/Kconfig | 16 ++ arch/arm64/include/asm/cache.h | 3 +- arch/arm64/include/asm/compat.h | 5 +- arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/kernel/cpu_errata.c | 32 ++- arch/arm64/kernel/sys_compat.c | 11 + arch/arm64/kernel/traps.c | 9 + arch/powerpc/kernel/entry_32.S | 2 +- arch/powerpc/kernel/setup_64.c | 2 + arch/powerpc/kernel/time.c | 44 ++-- arch/powerpc/platforms/Kconfig.cputype | 2 +- arch/powerpc/platforms/pseries/ras.c | 11 + arch/s390/kvm/kvm-s390.c | 3 + arch/s390/lib/uaccess.c | 4 + arch/s390/mm/pgalloc.c | 16 +- arch/x86/kvm/vmx/vmx.c | 2 +- drivers/block/loop.c | 42 +++- drivers/block/virtio_blk.c | 9 +- drivers/char/tpm/tpm-interface.c | 2 +- drivers/char/tpm/tpm_ibmvtpm.c | 136 +++++++------ drivers/char/tpm/tpm_tis_core.c | 8 +- drivers/fpga/dfl-pci.c | 6 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 38 +++- drivers/iio/adc/stm32-adc.c | 31 ++- drivers/iio/adc/ti-ads8344.c | 6 +- drivers/iio/adc/xilinx-xadc-core.c | 95 +++++++-- drivers/iio/common/st_sensors/st_sensors_core.c | 2 +- drivers/net/dsa/b53/b53_common.c | 38 +++- drivers/net/dsa/b53/b53_regs.h | 8 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 3 + drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c | 27 ++- drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c | 27 +-- drivers/net/ethernet/chelsio/cxgb4/t4_regs.h | 3 + drivers/net/ethernet/mellanox/mlx4/en_tx.c | 14 +- .../mellanox/mlxsw/core_acl_flex_actions.c | 4 +- .../ethernet/mellanox/mlxsw/spectrum2_acl_tcam.c | 4 +- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c | 2 +- .../net/ethernet/mellanox/mlxsw/spectrum_mr_tcam.c | 4 +- .../net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 1 + drivers/net/geneve.c | 2 +- drivers/net/macsec.c | 12 +- drivers/net/macvlan.c | 2 +- drivers/net/team/team.c | 4 + drivers/net/vrf.c | 10 +- drivers/net/vxlan.c | 6 +- drivers/net/wireless/intel/iwlegacy/3945-rs.c | 2 +- drivers/net/wireless/intel/iwlegacy/4965-rs.c | 2 +- drivers/net/wireless/intel/iwlwifi/dvm/rs.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/api/txq.h | 6 +- drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 6 +- drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 13 +- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 9 +- drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 3 + drivers/net/wireless/realtek/rtlwifi/rc.c | 2 +- drivers/nvme/host/core.c | 27 ++- drivers/nvme/host/multipath.c | 4 +- drivers/nvme/host/tcp.c | 13 +- drivers/pci/hotplug/pciehp.h | 6 +- drivers/pci/hotplug/pciehp_core.c | 11 +- drivers/pci/hotplug/pciehp_ctrl.c | 4 +- drivers/pci/hotplug/pciehp_hpc.c | 59 +++++- drivers/pci/pci-driver.c | 11 +- drivers/pci/pci.c | 142 ++++++++++++- drivers/pci/pci.h | 1 + drivers/pci/pcie/aspm.c | 18 +- drivers/pwm/pwm-bcm2835.c | 1 + drivers/pwm/pwm-rcar.c | 10 +- drivers/pwm/pwm-renesas-tpu.c | 9 +- drivers/s390/cio/device.c | 13 +- drivers/s390/cio/vfio_ccw_drv.c | 5 + drivers/scsi/libfc/fc_rport.c | 8 +- drivers/scsi/lpfc/lpfc_nvme.c | 14 +- drivers/scsi/lpfc/lpfc_sli.c | 7 + drivers/scsi/scsi_transport_iscsi.c | 4 +- drivers/scsi/smartpqi/smartpqi.h | 10 +- drivers/scsi/smartpqi/smartpqi_init.c | 225 +++++++++++---------- drivers/scsi/smartpqi/smartpqi_sas_transport.c | 2 +- drivers/staging/comedi/comedi_fops.c | 4 +- drivers/staging/comedi/drivers/dt2815.c | 3 + drivers/staging/gasket/gasket_sysfs.c | 3 +- drivers/staging/gasket/gasket_sysfs.h | 4 - drivers/staging/vt6656/int.c | 3 +- drivers/staging/vt6656/key.c | 14 +- drivers/staging/vt6656/main_usb.c | 31 +-- drivers/tty/hvc/hvc_console.c | 23 ++- drivers/tty/rocket.c | 25 ++- drivers/tty/serial/owl-uart.c | 7 + drivers/tty/serial/sh-sci.c | 13 +- drivers/tty/serial/xilinx_uartps.c | 211 +++++-------------- drivers/tty/vt/vt.c | 7 +- drivers/usb/class/cdc-acm.c | 36 +++- drivers/usb/class/cdc-acm.h | 5 +- drivers/usb/core/hub.c | 18 +- drivers/usb/core/message.c | 9 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc3/gadget.c | 12 +- drivers/usb/early/xhci-dbc.c | 8 +- drivers/usb/early/xhci-dbc.h | 18 +- drivers/usb/gadget/function/f_fs.c | 4 + drivers/usb/host/xhci-hub.c | 70 ++++++- drivers/usb/host/xhci-mem.c | 1 + drivers/usb/host/xhci-ring.c | 47 ++++- drivers/usb/host/xhci.c | 14 +- drivers/usb/host/xhci.h | 6 +- drivers/usb/misc/sisusbvga/sisusb.c | 20 +- drivers/usb/misc/sisusbvga/sisusb_init.h | 14 +- drivers/usb/storage/uas.c | 46 ++++- drivers/usb/storage/unusual_devs.h | 7 + drivers/usb/typec/bus.c | 5 +- drivers/usb/typec/tcpm/tcpm.c | 26 +++ drivers/watchdog/watchdog_dev.c | 1 + fs/ceph/caps.c | 8 +- fs/ceph/export.c | 5 + fs/cifs/smb2ops.c | 5 + fs/coredump.c | 2 + fs/ext4/extents.c | 47 +++-- fs/f2fs/xattr.c | 14 +- fs/nfsd/nfs4callback.c | 4 +- fs/proc/vmcore.c | 5 +- include/linux/iio/iio.h | 2 +- include/linux/kvm_host.h | 2 +- include/linux/vmalloc.h | 2 +- include/net/mac80211.h | 4 +- include/net/tcp.h | 2 +- ipc/util.c | 2 +- kernel/audit.c | 3 + kernel/dma/direct.c | 3 +- kernel/events/core.c | 9 +- kernel/gcov/fs.c | 2 +- kernel/signal.c | 6 +- lib/raid6/test/Makefile | 6 +- mm/hugetlb.c | 14 +- mm/ksm.c | 12 +- mm/vmalloc.c | 16 +- net/ipv4/fib_semantics.c | 6 +- net/ipv4/ip_tunnel.c | 6 +- net/ipv4/xfrm4_output.c | 2 - net/ipv6/ipv6_sockglue.c | 13 +- net/ipv6/xfrm6_output.c | 2 - net/mac80211/main.c | 5 +- net/mac80211/rate.c | 15 +- net/mac80211/rate.h | 23 +++ net/mac80211/rc80211_minstrel_ht.c | 19 +- net/netrom/nr_route.c | 1 + net/openvswitch/conntrack.c | 3 +- net/openvswitch/datapath.c | 4 +- net/sched/sch_etf.c | 7 +- net/sunrpc/svc_xprt.c | 2 + net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 2 + net/sunrpc/xprtsock.c | 1 + net/x25/x25_dev.c | 4 +- samples/vfio-mdev/mdpy.c | 2 +- scripts/kconfig/qconf.cc | 13 +- security/keys/internal.h | 12 ++ security/keys/keyctl.c | 58 ++++-- sound/pci/hda/hda_intel.c | 1 - sound/pci/hda/patch_hdmi.c | 9 + sound/pci/hda/patch_realtek.c | 11 +- sound/soc/intel/atom/sst-atom-controls.c | 2 + sound/soc/intel/boards/bytcr_rt5640.c | 11 + sound/soc/soc-dapm.c | 20 +- sound/soc/sof/trace.c | 7 +- sound/usb/format.c | 52 +++++ sound/usb/mixer.c | 37 +++- sound/usb/mixer.h | 10 + sound/usb/mixer_maps.c | 37 +++- sound/usb/mixer_quirks.c | 12 +- sound/usb/quirks-table.h | 56 +++++ sound/usb/usx2y/usbusx2yaudio.c | 2 + tools/lib/bpf/Makefile | 4 +- tools/testing/nvdimm/Kbuild | 4 +- tools/testing/nvdimm/test/Kbuild | 4 +- tools/testing/nvdimm/test/nfit.c | 2 + tools/testing/selftests/ftrace/settings | 1 + tools/testing/selftests/kmod/kmod.sh | 13 +- tools/testing/selftests/net/fib_nexthops.sh | 23 +++ tools/testing/selftests/net/fib_tests.sh | 10 +- tools/vm/Makefile | 2 + 183 files changed, 1953 insertions(+), 844 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/168 ext4: fix extent_status fragmentation for plain files
From: Dmitry Monakhov <[email protected]>
[ Upstream commit 4068664e3cd2312610ceac05b74c4cf1853b8325 ]
Extents are cached in read_extent_tree_block(); as a result, extents are not cached for inodes with depth == 0 when we try to find the extent using ext4_find_extent(). The result of the lookup is cached in ext4_map_blocks() but is only a subset of the extent on disk. As a result, the contents of extents status cache can get very badly fragmented for certain workloads, such as a random 4k read workload.
File size of /mnt/test is 33554432 (8192 blocks of 4096 bytes)
ext: logical_offset: physical_offset: length: expected: flags:
0: 0.. 8191: 40960.. 49151: 8192: last,eof
$ perf record -e 'ext4:ext4_es_*' /root/bin/fio --name=t --direct=0 --rw=randread --bs=4k --filesize=32M --size=32M --filename=/mnt/test
$ perf script | grep ext4_es_insert_extent | head -n 10
fio 131 [000] 13.975421: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [494/1) mapped 41454 status W
fio 131 [000] 13.975939: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [6064/1) mapped 47024 status W
fio 131 [000] 13.976467: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [6907/1) mapped 47867 status W
fio 131 [000] 13.976937: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [3850/1) mapped 44810 status W
fio 131 [000] 13.977440: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [3292/1) mapped 44252 status W
fio 131 [000] 13.977931: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [6882/1) mapped 47842 status W
fio 131 [000] 13.978376: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [3117/1) mapped 44077 status W
fio 131 [000] 13.978957: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [2896/1) mapped 43856 status W
fio 131 [000] 13.979474: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [7479/1) mapped 48439 status WFix this by caching the extents for inodes with depth == 0 in ext4_find_extent().
[ Renamed ext4_es_cache_extents() to ext4_cache_extents() since this
newly added function is not in extents_cache.c, and to avoid potential visual confusion with ext4_es_cache_extent(). -TYT ]
--- fs/ext4/extents.c | 47 +++++++++++++++++++++++++++-------------------- 1 file changed, 27 insertions(+), 20 deletions(-)
fs/ext4/extents.c +27 -20
@@ -498,6 +498,30 @@ int ext4_ext_check_inode(struct inode *inode)return ext4_ext_check (inode,ext_inode_hdr (inode),ext_depth (inode),0 ); } +static void ext4_cache_extents (struct inode *inode, +struct ext4_extent_header *eh) +{ +struct ext4_extent *ex =EXT_FIRST_EXTENT (eh); +ext4_lblk_t prev =0 ; +int i; + +for (i =le16_to_cpu (eh->eh_entries); i >0 ; i--, ex++) { +unsigned int status =EXTENT_STATUS_WRITTEN ; +ext4_lblk_t lblk =le32_to_cpu (ex->ee_block); +int len =ext4_ext_get_actual_len (ex); + +if (prev && (prev != lblk)) +ext4_es_cache_extent (inode, prev, lblk - prev, ~0 , +EXTENT_STATUS_HOLE ); + +if (ext4_ext_is_unwritten (ex)) + status =EXTENT_STATUS_UNWRITTEN ; +ext4_es_cache_extent (inode, lblk, len, +ext4_ext_pblock (ex), status); + prev = lblk + len; + } +} +static struct buffer_head * __read_extent_tree_block(const char *function, unsigned int line, struct inode *inode, ext4_fsblk_t pblk, int depth,
@@ -532,26 +556,7 @@ __read_extent_tree_block(const char *function, unsigned int line,*/ if (!(flags &EXT4_EX_NOCACHE ) && depth ==0 ) {struct ext4_extent_header *eh =ext_block_hdr (bh); -struct ext4_extent *ex =EXT_FIRST_EXTENT (eh); -ext4_lblk_t prev =0 ; -int i; - -for (i =le16_to_cpu (eh->eh_entries); i >0 ; i--, ex++) { -unsigned int status =EXTENT_STATUS_WRITTEN ; -ext4_lblk_t lblk =le32_to_cpu (ex->ee_block); -int len =ext4_ext_get_actual_len (ex); - -if (prev && (prev != lblk)) -ext4_es_cache_extent (inode, prev, - lblk - prev, ~0 , -EXTENT_STATUS_HOLE ); - -if (ext4_ext_is_unwritten (ex)) - status =EXTENT_STATUS_UNWRITTEN ; -ext4_es_cache_extent (inode, lblk, len, -ext4_ext_pblock (ex), status); - prev = lblk + len; - } +ext4_cache_extents (inode, eh); }return bh; errout:
@@ -899,6 +904,8 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block, path[0 ].p_bh =NULL ; i = depth; +if (!(flags &EXT4_EX_NOCACHE ) && depth ==0 ) +ext4_cache_extents (inode, eh);/* walk through the tree */ while (i) { ext_debug("depth %d: num %d, max %d\n",
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 2/168 f2fs: fix to avoid memory leakage in f2fs_listxattr
In reply to Greg Kroah-HartmanFrom: Randall Huang <[email protected]>
commit 688078e7f36c293dae25b338ddc9e0a2790f6e06 upstream.
In f2fs_listxattr, there is no boundary check before memcpy e_name to buffer.
If the e_name_len is corrupted,
unexpected memory contents may be returned to the buffer.
--- fs/f2fs/xattr.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
fs/f2fs/xattr.c +13 -1
@@ -539,8 +539,9 @@ out:ssize_t f2fs_listxattr (struct dentry *dentry,char *buffer,size_t buffer_size) {struct inode *inode =d_inode (dentry); +nid_t xnid =F2FS_I (inode)->i_xattr_nid;struct f2fs_xattr_entry *entry; -void *base_addr; +void *base_addr, *last_base_addr;int error =0 ;size_t rest = buffer_size;
@@ -550,6 +551,8 @@ ssize_t f2fs_listxattr(struct dentry *deif (error)return error; + last_base_addr = (void *)base_addr +XATTR_SIZE (xnid, inode); +list_for_each_xattr (entry, base_addr) {const struct xattr_handler *handler =f2fs_xattr_handler (entry->e_name_index);
@@ -557,6 +560,15 @@ ssize_t f2fs_listxattr(struct dentry *desize_t prefix_len;size_t size; +if ((void *)(entry) +sizeof (__u32) > last_base_addr || + (void *)XATTR_NEXT_ENTRY (entry) > last_base_addr) { +f2fs_err (F2FS_I_SB (inode),"inode (%lu) has corrupted xattr" , + inode->i_ino); +set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_FSCK ); + error = -EFSCORRUPTED ; + goto cleanup; + } +if (!handler || (handler->list && !handler->list (dentry)))continue ;
Greg Kroah-Hartman
maintainerPATCH 3/168 net, ip_tunnel: fix interface lookup with no key
In reply to Greg Kroah-HartmanFrom: William Dauchy <[email protected]>
commit 25629fdaff2ff509dd0b3f5ff93d70a75e79e0a1 upstream.
when creating a new ipip interface with no local/remote configuration, the lookup is done with TUNNEL_NO_KEY flag, making it impossible to match the new interface (only possible match being fallback or metada case interface); e.g: ip link add tunl1 type ipip dev eth0
To fix this case, adding a flag check before the key comparison so we permit to match an interface with no local/remote config; it also avoids breaking possible userland tools relying on TUNNEL_NO_KEY flag and uninitialised key.
context being on my side, I'm creating an extra ipip interface attached to the physical one, and moving it to a dedicated namespace.
--- net/ipv4/ip_tunnel.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/ipv4/ip_tunnel.c +1 -5
@@ -142,11 +142,8 @@ struct ip_tunnel *ip_tunnel_lookup(struc cand = t; } -if (flags &TUNNEL_NO_KEY ) - goto skip_key_lookup; -hlist_for_each_entry_rcu (t, head, hash_node) { -if (t->parms.i_key != key || +if ((!(flags &TUNNEL_NO_KEY ) && t->parms.i_key != key) || t->parms.iph.saddr !=0 || t->parms.iph.daddr !=0 || !(t->dev->flags &IFF_UP ))
@@ -158,7 +155,6 @@ struct ip_tunnel *ip_tunnel_lookup(struc cand = t; } -skip_key_lookup:if (cand)return cand;
Greg Kroah-Hartman
maintainerPATCH 4/168 arm64: errata: Hide CTR_EL0.DIC on systems affected by Neoverse-N1 #1542419
In reply to Greg Kroah-HartmanFrom: James Morse <[email protected]>
[ Upstream commit 05460849c3b51180d5ada3373d0449aea19075e4 ]
Cores affected by Neoverse-N1 #1542419 could execute a stale instruction when a branch is updated to point to freshly generated instructions.
To workaround this issue we need user-space to issue unnecessary icache maintenance that we can trap. Start by hiding CTR_EL0.DIC.
--- Documentation/arm64/silicon-errata.rst | 2 ++ arch/arm64/Kconfig | 16 +++++++++++++ arch/arm64/include/asm/cpucaps.h | 3 ++- arch/arm64/kernel/cpu_errata.c | 32 +++++++++++++++++++++++++- arch/arm64/kernel/traps.c | 3 +++ 5 files changed, 54 insertions(+), 2 deletions(-)
Documentation/arm64/silicon-errata.rst +2 -0
@@ -88,6 +88,8 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | ARM | Neoverse-N1 | #1349291 | N/A | +----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-N1 | #1542419 | ARM64_ERRATUM_1542419 | ++----------------+-----------------+-----------------+-----------------------------+ | ARM | MMU-500 | #841119,826419 | N/A | +----------------+-----------------+-----------------+-----------------------------+ +----------------+-----------------+-----------------+-----------------------------+
arch/arm64/Kconfig +16 -0
@@ -559,6 +559,22 @@ config ARM64_ERRATUM_1463225 If unsure, say Y. +config ARM64_ERRATUM_1542419 + bool "Neoverse-N1: workaround mis-ordering of instruction fetches" + default y + help + This option adds a workaround for ARM Neoverse-N1 erratum + 1542419. + + Affected Neoverse-N1 cores could execute a stale instruction when + modified by another CPU. The workaround depends on a firmware + counterpart. + + Workaround the issue by hiding the DIC feature from EL0. This + forces user-space to perform cache maintenance. + + If unsure, say Y. + config CAVIUM_ERRATUM_22375 bool "Cavium erratum 22375, 24313" default y
arch/arm64/include/asm/cpucaps.h +2 -1
@@ -54,7 +54,8 @@#define ARM64_WORKAROUND_1463225 44#define ARM64_WORKAROUND_CAVIUM_TX2_219_TVM 45#define ARM64_WORKAROUND_CAVIUM_TX2_219_PRFM 46 +#define ARM64_WORKAROUND_1542419 47 -#define ARM64_NCAPS 47 +#define ARM64_NCAPS 48#endif /* __ASM_CPUCAPS_H */
arch/arm64/kernel/cpu_errata.c +31 -1
@@ -88,13 +88,21 @@ has_mismatched_cache_type(const struct arm64_cpu_capabilities *entry, }static void -cpu_enable_trap_ctr_access (const struct arm64_cpu_capabilities *__unused) +cpu_enable_trap_ctr_access (const struct arm64_cpu_capabilities *cap) {u64 mask = arm64_ftr_reg_ctrel0.strict_mask; +bool enable_uct_trap = false;/* Trap CTR_EL0 access on this CPU, only if it has a mismatch */ if ((read_cpuid_cachetype () & mask) != (arm64_ftr_reg_ctrel0.sys_val & mask)) + enable_uct_trap = true; + +/* ... or if the system is affected by an erratum */ +if (cap->capability ==ARM64_WORKAROUND_1542419 ) + enable_uct_trap = true; + +if (enable_uct_trap)sysreg_clear_set (sctlr_el1,SCTLR_EL1_UCT ,0 ); }
@@ -651,6 +659,18 @@ needs_tx2_tvm_workaround(const struct arm64_cpu_capabilities *entry,return false; } +static bool __maybe_unused +has_neoverse_n1_erratum_1542419 (const struct arm64_cpu_capabilities *entry, +int scope) +{ +u32 midr =read_cpuid_id (); +bool has_dic =read_cpuid_cachetype () &BIT (CTR_DIC_SHIFT ); +const struct midr_range range =MIDR_ALL_VERSIONS (MIDR_NEOVERSE_N1 ); + +WARN_ON (scope !=SCOPE_LOCAL_CPU ||preemptible ()); +return is_midr_in_range (midr, &range) && has_dic; +} +#ifdef CONFIG_HARDEN_EL2_VECTORS static const struct midr_range arm64_harden_el2_vectors[] = {
@@ -927,6 +947,16 @@ const struct arm64_cpu_capabilities arm64_errata[] = { .capability = ARM64_WORKAROUND_CAVIUM_TX2_219_PRFM, ERRATA_MIDR_RANGE_LIST(tx2_family_cpus), }, +#endif +#ifdef CONFIG_ARM64_ERRATUM_1542419 + { + /* we depend on the firmware portion for correctness */ + .desc = "ARM erratum 1542419 (kernel portion)", + .capability = ARM64_WORKAROUND_1542419, + .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, + .matches = has_neoverse_n1_erratum_1542419, + .cpu_enable = cpu_enable_trap_ctr_access, + }, #endif { }
arch/arm64/kernel/traps.c +3 -0
@@ -470,6 +470,9 @@ static void ctr_read_handler(unsigned int esr, struct pt_regs *regs)int rt =ESR_ELx_SYS64_ISS_RT (esr);unsigned long val =arm64_ftr_reg_user_value (&arm64_ftr_reg_ctrel0); +if (cpus_have_const_cap (ARM64_WORKAROUND_1542419 )) + val &= ~BIT (CTR_DIC_SHIFT ); +pt_regs_write_reg (regs, rt, val);arm64_skip_faulting_instruction (regs,AARCH64_INSN_SIZE );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 5/168 arm64: Fake the IminLine size on systems affected by Neoverse-N1 #1542419
In reply to Greg Kroah-HartmanFrom: James Morse <[email protected]>
[ Upstream commit ee9d90be9ddace01b7fb126567e4b539fbe1f82f ]
Systems affected by Neoverse-N1 #1542419 support DIC so do not need to perform icache maintenance once new instructions are cleaned to the PoU. For the errata workaround, the kernel hides DIC from user-space, so that the unnecessary cache maintenance can be trapped by firmware.
To reduce the number of traps, produce a fake IminLine value based on PAGE_SIZE.
--- arch/arm64/include/asm/cache.h | 3 ++- arch/arm64/kernel/traps.c | 8 +++++++- 2 files changed, 9 insertions(+), 2 deletions(-)
arch/arm64/include/asm/cache.h +2 -1
@@ -11,6 +11,7 @@#define CTR_L1IP_MASK 3#define CTR_DMINLINE_SHIFT 16#define CTR_IMINLINE_SHIFT 0 +#define CTR_IMINLINE_MASK 0xf#define CTR_ERG_SHIFT 20#define CTR_CWG_SHIFT 24#define CTR_CWG_MASK 15
@@ -18,7 +19,7 @@#define CTR_DIC_SHIFT 29#define CTR_CACHE_MINLINE_MASK \ - (0xf << CTR_DMINLINE_SHIFT | 0xf << CTR_IMINLINE_SHIFT) + (0xf << CTR_DMINLINE_SHIFT | CTR_IMINLINE_MASK << CTR_IMINLINE_SHIFT)#define CTR_L1IP (ctr) (((ctr) >> CTR_L1IP_SHIFT) & CTR_L1IP_MASK)
arch/arm64/kernel/traps.c +7 -1
@@ -470,9 +470,15 @@ static void ctr_read_handler(unsigned int esr, struct pt_regs *regs)int rt =ESR_ELx_SYS64_ISS_RT (esr);unsigned long val =arm64_ftr_reg_user_value (&arm64_ftr_reg_ctrel0); -if (cpus_have_const_cap (ARM64_WORKAROUND_1542419 )) +if (cpus_have_const_cap (ARM64_WORKAROUND_1542419 )) { +/* Hide DIC so that we can trap the unnecessary maintenance...*/ val &= ~BIT (CTR_DIC_SHIFT ); +/* ... and fake IminLine to reduce the number of traps. */ + val &= ~CTR_IMINLINE_MASK ; + val |= (PAGE_SHIFT -2 ) &CTR_IMINLINE_MASK ; + } +pt_regs_write_reg (regs, rt, val);arm64_skip_faulting_instruction (regs,AARCH64_INSN_SIZE );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 6/168 arm64: compat: Workaround Neoverse-N1 #1542419 for compat user-space
In reply to Greg Kroah-HartmanFrom: James Morse <[email protected]>
[ Upstream commit 222fc0c8503d98cec3cb2bac2780cdd21a6e31c0 ]
Compat user-space is unable to perform ICIMVAU instructions from user-space. Instead it uses a compat-syscall. Add the workaround for Neoverse-N1 #1542419 to this code path.
--- arch/arm64/kernel/sys_compat.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/arm64/kernel/sys_compat.c +11 -0
@@ -8,6 +8,7 @@*/ #include <linux/compat.h> +#include <linux/cpufeature.h> #include <linux/personality.h> #include <linux/sched.h> #include <linux/sched/signal.h>
@@ -17,6 +18,7 @@#include <asm/cacheflush.h> #include <asm/system_misc.h> +#include <asm/tlbflush.h> #include <asm/unistd.h> static long
@@ -30,6 +32,15 @@ __do_compat_cache_op(unsigned long start, unsigned long end)if (fatal_signal_pending (current))return 0 ; +if (cpus_have_const_cap (ARM64_WORKAROUND_1542419 )) { +/* +* The workaround requires an inner-shareable tlbi. +* We pick the reserved-ASID to minimise the impact. +*/ +__tlbi (aside1is,0 ); +dsb (ish); + } + ret =__flush_cache_user_range (start, start + chunk);if (ret)return ret;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 7/168 arm64: Silence clang warning on mismatched value/register sizes
In reply to Greg Kroah-HartmanFrom: Catalin Marinas <[email protected]>
[ Upstream commit: 27a22fbdeedd6c5c451cf5f830d51782bf50c3a2 ]
Clang reports a warning on the __tlbi(aside1is, 0) macro expansion since the value size does not match the register size specified in the inline asm. Construct the ASID value using the __TLBI_VADDR() macro.
--- arch/arm64/kernel/sys_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kernel/sys_compat.c +1 -1
@@ -37,7 +37,7 @@ __do_compat_cache_op(unsigned long start, unsigned long end)* The workaround requires an inner-shareable tlbi. * We pick the reserved-ASID to minimise the impact. */ -__tlbi (aside1is,0 ); +__tlbi (aside1is,__TLBI_VADDR (0 ,0 ));dsb (ish); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 8/168 tools/testing/nvdimm: Fix compilation failure without CONFIG_DEV_DAX_PMEM_COMPAT
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit c0e71d602053e4e7637e4bc7d0bc9603ea77a33f ]
When a kernel is configured without CONFIG_DEV_DAX_PMEM_COMPAT, the compilation of tools/testing/nvdimm fails with:
Building modules, stage 2.
MODPOST 11 modules
ERROR: "dax_pmem_compat_test" [tools/testing/nvdimm/test/nfit_test.ko] undefined!
Fix the problem by calling dax_pmem_compat_test() only if the kernel has the required functionality.
--- tools/testing/nvdimm/test/nfit.c | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/nvdimm/test/nfit.c +2 -0
@@ -3164,7 +3164,9 @@ static __init int nfit_test_init(void)mcsafe_test ();dax_pmem_test ();dax_pmem_core_test (); +#ifdef CONFIG_DEV_DAX_PMEM_COMPAT dax_pmem_compat_test (); +#endif nfit_test_setup (nfit_test_lookup, nfit_test_evaluate_dsm);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 9/168 watchdog: reset last_hw_keepalive time at start
In reply to Greg Kroah-HartmanFrom: Tero Kristo <[email protected]>
[ Upstream commit 982bb70517aef2225bad1d802887b733db492cc0 ]
Currently the watchdog core does not initialize the last_hw_keepalive time during watchdog startup. This will cause the watchdog to be pinged immediately if enough time has passed from the system boot-up time, and some types of watchdogs like K3 RTI does not like this.
To avoid the issue, setup the last_hw_keepalive time during watchdog startup.
--- drivers/watchdog/watchdog_dev.c | 1 + 1 file changed, 1 insertion(+)
drivers/watchdog/watchdog_dev.c +1 -0
@@ -282,6 +282,7 @@ static int watchdog_start(struct watchdog_device *wdd)if (err ==0 ) {set_bit (WDOG_ACTIVE , &wdd->status); wd_data->last_keepalive = started_at; + wd_data->last_hw_keepalive = started_at;watchdog_update_worker (wdd); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 10/168 scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 38503943c89f0bafd9e3742f63f872301d44cbea ]
The following kasan bug was called out:
BUG: KASAN: slab-out-of-bounds in lpfc_unreg_login+0x7c/0xc0 [lpfc] Read of size 2 at addr ffff889fc7c50a22 by task lpfc_worker_3/6676 ... Call Trace: dump_stack+0x96/0xe0 ? lpfc_unreg_login+0x7c/0xc0 [lpfc] print_address_description.constprop.6+0x1b/0x220 ? lpfc_unreg_login+0x7c/0xc0 [lpfc] ? lpfc_unreg_login+0x7c/0xc0 [lpfc] __kasan_report.cold.9+0x37/0x7c ? lpfc_unreg_login+0x7c/0xc0 [lpfc] kasan_report+0xe/0x20 lpfc_unreg_login+0x7c/0xc0 [lpfc] lpfc_sli_def_mbox_cmpl+0x334/0x430 [lpfc] ...
When processing the completion of a "Reg Rpi" login mailbox command in lpfc_sli_def_mbox_cmpl, a call may be made to lpfc_unreg_login. The vpi is extracted from the completing mailbox context and passed as an input for the next. However, the vpi stored in the mailbox command context is an absolute vpi, which for SLI4 represents both base + offset. When used with a non-zero base component, (function id > 0) this results in an out-of-range access beyond the allocated phba->vpi_ids array.
Fix by subtracting the function's base value to get an accurate vpi number.
--- drivers/scsi/lpfc/lpfc_sli.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/lpfc/lpfc_sli.c +2 -0
@@ -2481,6 +2481,8 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) !pmb->u.mb.mbxStatus) { rpi = pmb->u.mb.un.varWords[0 ]; vpi = pmb->u.mb.un.varRegLogin.vpi; +if (phba->sli_rev ==LPFC_SLI_REV4 ) + vpi -= phba->sli4_hba.max_cfg_param.vpi_base;lpfc_unreg_login (phba, vpi, rpi, pmb); pmb->vport = vport; pmb->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 11/168 scsi: lpfc: Fix crash after handling a pci error
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 4cd70891308dfb875ef31060c4a4aa8872630a2e ]
Injecting EEH on a 32GB card is causing kernel oops
The pci error handler is doing an IO flush and the offline code is also doing an IO flush. When the 1st flush is complete the hdwq is destroyed (freed), yet the second flush accesses the hdwq and crashes.
Added a check in lpfc_sli4_fush_io_rings to check both the HBA_IOQ_FLUSH flag and the hdwq pointer to see if it is already set and not already freed.
--- drivers/scsi/lpfc/lpfc_sli.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/scsi/lpfc/lpfc_sli.c +5 -0
@@ -4013,6 +4013,11 @@ lpfc_sli_flush_io_rings(struct lpfc_hba *phba)struct lpfc_iocbq *piocb, *next_iocb;spin_lock_irq (&phba->hbalock); +if (phba->hba_flag &HBA_IOQ_FLUSH || + !phba->sli4_hba.hdwq) { +spin_unlock_irq (&phba->hbalock); +return ; + }/* Indicate the I/O queues are flushed */ phba->hba_flag |=HBA_IOQ_FLUSH ;spin_unlock_irq (&phba->hbalock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 12/168 scsi: lpfc: Fix crash in target side cable pulls hitting WAIT_FOR_UNREG
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 807e7353d8a7105ce884d22b0dbc034993c6679c ]
Kernel is crashing with the following stacktrace:
BUG: unable to handle kernel NULL pointer dereference at
00000000000005bc
IP: lpfc_nvme_register_port+0x1a8/0x3a0 [lpfc]
...
Call Trace:
lpfc_nlp_state_cleanup+0x2b2/0x500 [lpfc]
lpfc_nlp_set_state+0xd7/0x1a0 [lpfc]
lpfc_cmpl_prli_prli_issue+0x1f7/0x450 [lpfc]
lpfc_disc_state_machine+0x7a/0x1e0 [lpfc]
lpfc_cmpl_els_prli+0x16f/0x1e0 [lpfc]
lpfc_sli_sp_handle_rspiocb+0x5b2/0x690 [lpfc]
lpfc_sli_handle_slow_ring_event_s4+0x182/0x230 [lpfc]
lpfc_do_work+0x87f/0x1570 [lpfc]
kthread+0x10d/0x130
ret_from_fork+0x35/0x40During target side fault injections, it is possible to hit the NLP_WAIT_FOR_UNREG case in lpfc_nvme_remoteport_delete. A prior commit fixed a rebind and delete race condition, but called lpfc_nlp_put unconditionally. This triggered a deletion and the crash.
Fix by movng nlp_put to inside the NLP_WAIT_FOR_UNREG case, where the nlp will be being unregistered/removed. Leave the reference if the flag isn't set.
--- drivers/scsi/lpfc/lpfc_nvme.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/scsi/lpfc/lpfc_nvme.c +8 -6
@@ -342,13 +342,15 @@ lpfc_nvme_remoteport_delete(struct nvme_fc_remote_port *remoteport)if (ndlp->upcall_flags &NLP_WAIT_FOR_UNREG ) { ndlp->nrport =NULL ; ndlp->upcall_flags &= ~NLP_WAIT_FOR_UNREG ; - } -spin_unlock_irq (&vport->phba->hbalock); +spin_unlock_irq (&vport->phba->hbalock); -/* Remove original register reference. The host transport -* won't reference this rport/remoteport any further. -*/ -lpfc_nlp_put (ndlp); +/* Remove original register reference. The host transport +* won't reference this rport/remoteport any further. +*/ +lpfc_nlp_put (ndlp); + }else { +spin_unlock_irq (&vport->phba->hbalock); + } rport_err:return ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 13/168 scsi: libfc: If PRLI rejected, move rport to PLOGI state
In reply to Greg Kroah-HartmanFrom: Javed Hasan <[email protected]>
[ Upstream commit 45e544bfdab2014d11c7595b8ccc3c4715a09015 ]
If PRLI reject code indicates "rejected status", move rport state machine back to PLOGI state.
--- drivers/scsi/libfc/fc_rport.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/scsi/libfc/fc_rport.c +7 -1
@@ -1208,9 +1208,15 @@ static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp, rjt =fc_frame_payload_get (fp,sizeof (*rjt));if (!rjt)FC_RPORT_DBG (rdata,"PRLI bad response\n" ); -else +else {FC_RPORT_DBG (rdata,"PRLI ELS rejected, reason %x expl %x\n" , rjt->er_reason, rjt->er_explan); +if (rjt->er_reason ==ELS_RJT_UNAB && + rjt->er_explan ==ELS_EXPL_PLOGI_REQD ) { +fc_rport_enter_plogi (rdata); + goto out; + } + }fc_rport_error_retry (rdata,FC_EX_ELS_RJT ); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 14/168 ceph: return ceph_mdsc_do_request() errors from __get_parent()
In reply to Greg Kroah-HartmanFrom: Qiujun Huang <[email protected]>
[ Upstream commit c6d50296032f0b97473eb2e274dc7cc5d0173847 ]
Return the error returned by ceph_mdsc_do_request(). Otherwise, r_target_inode ends up being NULL this ends up returning ENOENT regardless of the error.
--- fs/ceph/export.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/ceph/export.c +5 -0
@@ -315,6 +315,11 @@ static struct dentry *__get_parent(struct super_block *sb, req->r_num_caps =1 ; err =ceph_mdsc_do_request (mdsc,NULL , req); +if (err) { +ceph_mdsc_put_request (req); +return ERR_PTR (err); + } + inode = req->r_target_inode;if (inode)ihold (inode);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 15/168 ceph: dont skip updating wanted caps when cap is stale
In reply to Greg Kroah-HartmanFrom: Yan, Zheng <[email protected]>
[ Upstream commit 0aa971b6fd3f92afef6afe24ef78d9bb14471519 ]
1. try_get_cap_refs() fails to get caps and finds that mds_wanted does not include what it wants. It returns -ESTALE.
2. ceph_get_caps() calls ceph_renew_caps(). ceph_renew_caps() finds that inode has cap, so it calls ceph_check_caps().
3. ceph_check_caps() finds that issued caps (without checking if it's stale) already includes caps wanted by open file, so it skips updating wanted caps.
Above events can cause an infinite loop inside ceph_get_caps().
--- fs/ceph/caps.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/ceph/caps.c +6 -2
@@ -1976,8 +1976,12 @@ retry_locked: }/* want more caps from mds? */ -if (want & ~(cap->mds_wanted | cap->issued)) - goto ack; +if (want & ~cap->mds_wanted) { +if (want & ~(cap->mds_wanted | cap->issued)) + goto ack; +if (!__cap_is_valid (cap)) + goto ack; + }/* things we might delay */ if ((cap->issued & ~retain) ==0 )
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 16/168 pwm: rcar: Fix late Runtime PM enablement
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 1451a3eed24b5fd6a604683f0b6995e0e7e16c79 ]
Runtime PM should be enabled before calling pwmchip_add(), as PWM users can appear immediately after the PWM chip has been added. Likewise, Runtime PM should be disabled after the removal of the PWM chip.
--- drivers/pwm/pwm-rcar.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/pwm/pwm-rcar.c +7 -3
@@ -228,24 +228,28 @@ static int rcar_pwm_probe(struct platform_device *pdev) rcar_pwm->chip.base =-1 ; rcar_pwm->chip.npwm =1 ; +pm_runtime_enable (&pdev->dev); + ret =pwmchip_add (&rcar_pwm->chip);if (ret <0 ) {dev_err (&pdev->dev,"failed to register PWM chip: %d\n" , ret); +pm_runtime_disable (&pdev->dev);return ret; } -pm_runtime_enable (&pdev->dev); -return 0 ; }static int rcar_pwm_remove (struct platform_device *pdev) {struct rcar_pwm_chip *rcar_pwm =platform_get_drvdata (pdev); +int ret; + + ret =pwmchip_remove (&rcar_pwm->chip);pm_runtime_disable (&pdev->dev); -return pwmchip_remove (&rcar_pwm->chip); +return ret; }static const struct of_device_id rcar_pwm_of_table[] = {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 17/168 nvme-tcp: fix possible crash in write_zeroes processing
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit 25e5cb780e62bde432b401f312bb847edc78b432 ]
We cannot look at blk_rq_payload_bytes without first checking that the request has a mappable physical segments first (e.g. blk_rq_nr_phys_segments(rq) != 0) and only then to take the request payload bytes. This caused us to send a wrong sgl to the target or even dereference a non-existing buffer in case we actually got to the data send sequence (if it was in-capsule).
--- drivers/nvme/host/tcp.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/nvme/host/tcp.c +7 -6
@@ -164,16 +164,14 @@ static inline bool nvme_tcp_async_req(struct nvme_tcp_request *req)static inline bool nvme_tcp_has_inline_data (struct nvme_tcp_request *req) {struct request *rq; -unsigned int bytes;if (unlikely (nvme_tcp_async_req (req)))return false;/* async events don't have a request */ rq =blk_mq_rq_from_pdu (req); - bytes =blk_rq_payload_bytes (rq); -return rq_data_dir (rq) ==WRITE && bytes && - bytes <=nvme_tcp_inline_data_size (req->queue); +return rq_data_dir (rq) ==WRITE && req->data_len && + req->data_len <=nvme_tcp_inline_data_size (req->queue); }static inline struct page *nvme_tcp_req_cur_page (struct nvme_tcp_request *req)
@@ -2090,7 +2088,9 @@ static blk_status_t nvme_tcp_map_data(struct nvme_tcp_queue *queue, c->common.flags |=NVME_CMD_SGL_METABUF ; -if (rq_data_dir (rq) ==WRITE && req->data_len && +if (!blk_rq_nr_phys_segments (rq)) +nvme_tcp_set_sg_null (c); +else if (rq_data_dir (rq) ==WRITE && req->data_len <=nvme_tcp_inline_data_size (queue))nvme_tcp_set_sg_inline (queue, c, req->data_len);else
@@ -2117,7 +2117,8 @@ static blk_status_t nvme_tcp_setup_cmd_pdu(struct nvme_ns *ns, req->data_sent =0 ; req->pdu_len =0 ; req->pdu_sent =0 ; - req->data_len =blk_rq_payload_bytes (rq); + req->data_len =blk_rq_nr_phys_segments (rq) ? +blk_rq_payload_bytes (rq) :0 ; req->curr_bio = rq->bio; if (rq_data_dir(rq) == WRITE &&
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 18/168 scsi: iscsi: Report unbind session event when the target has been removed
In reply to Greg Kroah-HartmanFrom: Wu Bo <[email protected]>
[ Upstream commit 13e60d3ba287d96eeaf1deaadba51f71578119a3 ]
If the daemon is restarted or crashes while logging out of a session, the unbind session event sent by the kernel is not processed and is lost. When the daemon starts again, the session can't be unbound because the daemon is waiting for the event message. However, the kernel has already logged out and the event will not be resent.
When iscsid restart is complete, logout session reports error:
Logging out of session [sid: 6, target: iqn.xxxxx, portal: xx.xx.xx.xx,3260]
iscsiadm: Could not logout of [sid: 6, target: iscsiadm -m node iqn.xxxxx, portal: xx.xx.xx.xx,3260].
iscsiadm: initiator reported error (9 - internal error)
iscsiadm: Could not logout of all requested sessions
Make sure the unbind event is emitted.
[mkp: commit desc and applied by hand since patch was mangled]
--- drivers/scsi/scsi_transport_iscsi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/scsi_transport_iscsi.c +3 -1
@@ -2012,7 +2012,7 @@ static void __iscsi_unbind_session(struct work_struct *work)if (session->target_id ==ISCSI_MAX_TARGET ) {spin_unlock_irqrestore (&session->lock, flags);mutex_unlock (&ihost->mutex); -return ; + goto unbind_session_exit; } target_id = session->target_id;
@@ -2024,6 +2024,8 @@ static void __iscsi_unbind_session(struct work_struct *work)ida_simple_remove (&iscsi_sess_ida, target_id);scsi_remove_target (&session->dev); + +unbind_session_exit:iscsi_session_event (session,ISCSI_KEVENT_UNBIND_SESSION );ISCSI_DBG_TRANS_SESSION (session,"Completed target removal\n" ); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 19/168 tools/test/nvdimm: Fix out of tree build
In reply to Greg Kroah-HartmanFrom: Santosh Sivaraj <[email protected]>
[ Upstream commit 1f776799628139d0da47e710ad86eb58d987ff66 ]
Out of tree build using
make M=tools/test/nvdimm O=/tmp/build -C /tmp/build
fails with the following error
make: Entering directory '/tmp/build'
CC [M] tools/testing/nvdimm/test/nfit.olinux/tools/testing/nvdimm/test/nfit.c:19:10: fatal error: nd-core.h: No such file or directory
19 | #include <nd-core.h>
| ^~~~~~~~~~~
compilation terminated.
That is because the kbuild file uses $(src) which points to tools/testing/nvdimm, $(srctree) correctly points to root of the linux source tree.
--- tools/testing/nvdimm/Kbuild | 4 ++-- tools/testing/nvdimm/test/Kbuild | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
tools/testing/nvdimm/Kbuild +2 -2
@@ -21,8 +21,8 @@ DRIVERS := ../../../drivers NVDIMM_SRC := $(DRIVERS)/nvdimm ACPI_SRC := $(DRIVERS)/acpi/nfit DAX_SRC := $(DRIVERS)/dax -ccflags-y := -I$(src)/$(NVDIMM_SRC)/ -ccflags-y += -I$(src)/$(ACPI_SRC)/ +ccflags-y := -I$(srctree)/drivers/nvdimm/ +ccflags-y += -I$(srctree)/drivers/acpi/nfit/ obj-$(CONFIG_LIBNVDIMM) += libnvdimm.o obj-$(CONFIG_BLK_DEV_PMEM) += nd_pmem.o
tools/testing/nvdimm/test/Kbuild +2 -2
@@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 -ccflags-y := -I$(src)/../../../../drivers/nvdimm/ -ccflags-y += -I$(src)/../../../../drivers/acpi/nfit/ +ccflags-y := -I$(srctree)/drivers/nvdimm/ +ccflags-y += -I$(srctree)/drivers/acpi/nfit/ obj-m += nfit_test.o obj-m += nfit_test_iomap.o
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 20/168 ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map()
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 81630dc042af998b9f58cd8e2c29dab9777ea176 ]
sst_send_slot_map() uses sst_fill_and_send_cmd_unlocked() because in some places it is called with the drv->lock mutex already held.
So it must always be called with the mutex locked. This commit adds missing locking in the sst_set_be_modules() code-path.
--- sound/soc/intel/atom/sst-atom-controls.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/intel/atom/sst-atom-controls.c +2 -0
@@ -966,7 +966,9 @@ static int sst_set_be_modules(struct snd_soc_dapm_widget *w,dev_dbg (c->dev,"Enter: widget=%s\n" , w->name);if (SND_SOC_DAPM_EVENT_ON (event)) { +mutex_lock (&drv->lock); ret =sst_send_slot_map (drv); +mutex_unlock (&drv->lock);if (ret)return ret; ret =sst_send_pipe_module_params (w, k);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 21/168 nvme: fix deadlock caused by ANA update wrong locking
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit 657f1975e9d9c880fa13030e88ba6cc84964f1db ]
The deadlock combines 4 flows in parallel:
- ns scanning (triggered from reconnect)
- request timeout
- ANA update (triggered from reconnect)
- I/O coming into the mpath device
(1) ns scanning triggers disk revalidation -> update disk info ->
freeze queue -> but blocked, due to (2)
(2) timeout handler reference the g_usage_counter - > but blocks in the transport .timeout() handler, due to (3)
(3) the transport timeout handler (indirectly) calls nvme_stop_queue() -> which takes the (down_read) namespaces_rwsem - > but blocks, due to (4)
(4) ANA update takes the (down_write) namespaces_rwsem -> calls
nvme_mpath_set_live() -> which synchronize the ns_head srcu
(see commit 504db087aacc) -> but blocks, due to (5)(5) I/O came into nvme_mpath_make_request -> took srcu_read_lock ->
direct_make_request > blk_queue_enter -> but blocked, due to (1)
==> the request queue is under freeze -> deadlock.
The fix is making ANA update take a read lock as the namespaces list is not manipulated, it is just the ns and ns->head that are being updated (which is protected with the ns->head lock).
--- drivers/nvme/host/multipath.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/nvme/host/multipath.c +2 -2
@@ -510,7 +510,7 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,if (!nr_nsids)return 0 ; -down_write (&ctrl->namespaces_rwsem); +down_read (&ctrl->namespaces_rwsem);list_for_each_entry (ns, &ctrl->namespaces, list) {unsigned nsid =le32_to_cpu (desc->nsids[n]);
@@ -521,7 +521,7 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,if (++n == nr_nsids)break ; } -up_write (&ctrl->namespaces_rwsem); +up_read (&ctrl->namespaces_rwsem);return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 22/168 drm/amd/display: Update stream adjust in dc_stream_adjust_vmin_vmax
In reply to Greg Kroah-HartmanFrom: Isabel Zhang <[email protected]>
[ Upstream commit 346d8a0a3c91888a412c2735d69daa09c00f0203 ]
[Why]
After v_total_min and max are updated in vrr structure, the changes are not reflected in stream adjust. When these values are read from stream adjust it does not reflect the actual state of the system.
[How]
Set stream adjust values equal to vrr adjust values after vrr adjust values are updated.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc.c +2 -0
@@ -283,6 +283,8 @@ bool dc_stream_adjust_vmin_vmax(struct dc *dc,int i =0 ;bool ret = false; + stream->adjust = *adjust; +for (i =0 ; i <MAX_PIPES ; i++) {struct pipe_ctx *pipe = &dc->current_state->res_ctx.pipe_ctx[i];
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 23/168 dma-direct: fix data truncation in dma_direct_get_required_mask()
In reply to Greg Kroah-HartmanFrom: Kishon Vijay Abraham I <[email protected]>
[ Upstream commit cdcda0d1f8f4ab84efe7cd9921c98364398aefd7 ]
The upper 32-bit physical address gets truncated inadvertently when dma_direct_get_required_mask() invokes phys_to_dma_direct(). This results in dma_addressing_limited() return incorrect value when used in platforms with LPAE enabled.
Fix it here by explicitly type casting 'max_pfn' to phys_addr_t in order to prevent overflow of intermediate value while evaluating '(max_pfn - 1) << PAGE_SHIFT'.
--- kernel/dma/direct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/dma/direct.c +2 -1
@@ -45,7 +45,8 @@ static inline dma_addr_t phys_to_dma_direct(struct device *dev,u64 dma_direct_get_required_mask (struct device *dev) { -u64 max_dma =phys_to_dma_direct (dev, (max_pfn -1 ) <<PAGE_SHIFT ); +phys_addr_t phys = (phys_addr_t)(max_pfn -1 ) <<PAGE_SHIFT ; +u64 max_dma =phys_to_dma_direct (dev, phys);return (1ULL << (fls64 (max_dma) -1 )) *2 -1 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 24/168 kernel/gcov/fs.c: gcov_seq_next() should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit f4d74ef6220c1eda0875da30457bef5c7111ab06 ]
If seq_file .next function does not change position index, read after some lseek can generate unexpected output.
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- kernel/gcov/fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/gcov/fs.c +1 -1
@@ -108,9 +108,9 @@ static void *gcov_seq_next(struct seq_file *seq, void *data, loff_t *pos) {struct gcov_iterator *iter = data; + (*pos)++;if (gcov_iter_next (iter))return NULL ; - (*pos)++;return iter; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 25/168 selftests: kmod: fix handling test numbers above 9
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit 6d573a07528308eb77ec072c010819c359bebf6e ]
get_test_count() and get_test_enabled() were broken for test numbers above 9 due to awk interpreting a field specification like '$0010' as octal rather than decimal. Fix it by stripping the leading zeroes.
--- tools/testing/selftests/kmod/kmod.sh | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
tools/testing/selftests/kmod/kmod.sh +9 -4
@@ -505,18 +505,23 @@ function test_num() fi } -function get_test_count() +function get_test_data() { test_num $1 - TEST_DATA=$(echo $ALL_TESTS | awk '{print $'$1'}') + local field_num=$(echo $1 | sed 's/^0*//') + echo $ALL_TESTS | awk '{print $'$field_num'}' +} + +function get_test_count() +{ + TEST_DATA=$(get_test_data $1) LAST_TWO=${TEST_DATA#*:*} echo ${LAST_TWO%:*} } function get_test_enabled() { - test_num $1 - TEST_DATA=$(echo $ALL_TESTS | awk '{print $'$1'}') + TEST_DATA=$(get_test_data $1) echo ${TEST_DATA#*:*:} }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 26/168 ipc/util.c: sysvipc_find_ipc() should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 89163f93c6f969da5811af5377cc10173583123b ]
If seq_file .next function does not change position index, read after some lseek can generate unexpected output.
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- ipc/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
ipc/util.c +1 -1
@@ -764,13 +764,13 @@ static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos, total++; } + *new_pos = pos +1 ;if (total >= ids->in_use)return NULL ;for (; pos < ipc_mni; pos++) { ipc =idr_find (&ids->ipcs_idr, pos);if (ipc !=NULL ) { - *new_pos = pos +1 ;rcu_read_lock ();ipc_lock_object (ipc);return ipc;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 27/168 kconfig: qconf: Fix a few alignment issues
In reply to Greg Kroah-HartmanFrom: Mauro Carvalho Chehab <[email protected]>
[ Upstream commit 60969f02f07ae1445730c7b293c421d179da729c ]
There are a few items with wrong alignments. Solve them.
--- scripts/kconfig/qconf.cc | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
scripts/kconfig/qconf.cc +7 -6
@@ -627,7 +627,7 @@ void ConfigList::updateMenuList(ConfigItem *parent, struct menu* menu) last = item; continue; } - hide: +hide: if (item && item->menu == child) { last = parent->firstChild(); if (last == item)
@@ -692,7 +692,7 @@ void ConfigList::updateMenuList(ConfigList *parent, struct menu* menu) last = item; continue; } - hide: +hide: if (item && item->menu == child) { last = (ConfigItem*)parent->topLevelItem(0); if (last == item)
@@ -1225,10 +1225,11 @@ QMenu* ConfigInfoView::createStandardContextMenu(const QPoint & pos) { QMenu* popup = Parent::createStandardContextMenu(pos); QAction* action = new QAction("Show Debug Info", popup); - action->setCheckable(true); - connect(action, SIGNAL(toggled(bool)), SLOT(setShowDebug(bool))); - connect(this, SIGNAL(showDebugChanged(bool)), action, SLOT(setOn(bool))); - action->setChecked(showDebug()); + + action->setCheckable(true); + connect(action, SIGNAL(toggled(bool)), SLOT(setShowDebug(bool))); + connect(this, SIGNAL(showDebugChanged(bool)), action, SLOT(setOn(bool))); + action->setChecked(showDebug()); popup->addSeparator(); popup->addAction(action); return popup;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 28/168 lib/raid6/test: fix build on distros whose /bin/sh is not bash
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
[ Upstream commit 06bd48b6cd97ef3889b68c8e09014d81dbc463f1 ]
You can build a user-space test program for the raid6 library code, like this:
$ cd lib/raid6/test $ make
The command in $(shell ...) function is evaluated by /bin/sh by default. (or, you can specify the shell by passing SHELL=<shell> from command line)
Currently '>&/dev/null' is used to sink both stdout and stderr. Because this code is bash-ism, it only works when /bin/sh is a symbolic link to bash (this is the case on RHEL etc.)
This does not work on Ubuntu where /bin/sh is a symbolic link to dash.
I see lots of
/bin/sh: 1: Syntax error: Bad fd number
and
warning "your version of binutils lacks ... support"
Replace it with portable '>/dev/null 2>&1'.
--- lib/raid6/test/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
lib/raid6/test/Makefile +3 -3
@@ -35,13 +35,13 @@ endif ifeq ($(IS_X86),yes) OBJS += mmx.o sse1.o sse2.o avx2.o recov_ssse3.o recov_avx2.o avx512.o recov_avx512.o CFLAGS += $(shell echo "pshufb %xmm0, %xmm0" | \ - gcc -c -x assembler - >&/dev/null && \ + gcc -c -x assembler - >/dev/null 2>&1 && \ rm ./-.o && echo -DCONFIG_AS_SSSE3=1) CFLAGS += $(shell echo "vpbroadcastb %xmm0, %ymm1" | \ - gcc -c -x assembler - >&/dev/null && \ + gcc -c -x assembler - >/dev/null 2>&1 && \ rm ./-.o && echo -DCONFIG_AS_AVX2=1) CFLAGS += $(shell echo "vpmovm2b %k1, %zmm5" | \ - gcc -c -x assembler - >&/dev/null && \ + gcc -c -x assembler - >/dev/null 2>&1 && \ rm ./-.o && echo -DCONFIG_AS_AVX512=1) else ifeq ($(HAS_NEON),yes) OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 29/168 s390/cio: generate delayed uevent for vfio-ccw subchannels
In reply to Greg Kroah-HartmanFrom: Cornelia Huck <[email protected]>
[ Upstream commit 2bc55eaeb88d30accfc1b6ac2708d4e4b81ca260 ]
The common I/O layer delays the ADD uevent for subchannels and delegates generating this uevent to the individual subchannel drivers. The vfio-ccw I/O subchannel driver, however, did not do that, and will not generate an ADD uevent for subchannels that had not been bound to a different driver (or none at all, which also triggers the uevent).
Generate the ADD uevent at the end of the probe function if uevents were still suppressed for the device.
Message-Id: <[email protected]>
--- drivers/s390/cio/vfio_ccw_drv.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/s390/cio/vfio_ccw_drv.c +5 -0
@@ -167,6 +167,11 @@ static int vfio_ccw_sch_probe(struct subchannel *sch)if (ret) goto out_disable; +if (dev_get_uevent_suppress (&sch->dev)) { +dev_set_uevent_suppress (&sch->dev,0 ); +kobject_uevent (&sch->dev.kobj,KOBJ_ADD ); + } +VFIO_CCW_MSG_EVENT (4 ,"bound to subchannel %x.%x.%04x\n" , sch->schid.cssid, sch->schid.ssid, sch->schid.sch_no);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 30/168 s390/cio: avoid duplicated ADD uevents
In reply to Greg Kroah-HartmanFrom: Cornelia Huck <[email protected]>
[ Upstream commit 05ce3e53f375295c2940390b2b429e506e07655c ]
The common I/O layer delays the ADD uevent for subchannels and delegates generating this uevent to the individual subchannel drivers. The io_subchannel driver will do so when the associated ccw_device has been registered -- but unconditionally, so more ADD uevents will be generated if a subchannel has been unbound from the io_subchannel driver and later rebound.
To fix this, only generate the ADD event if uevents were still suppressed for the device.
Message-Id: <[email protected]>
--- drivers/s390/cio/device.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/s390/cio/device.c +9 -4
@@ -849,8 +849,10 @@ static void io_subchannel_register(struct ccw_device *cdev)* Now we know this subchannel will stay, we can throw * our delayed uevent. */ -dev_set_uevent_suppress (&sch->dev,0 ); -kobject_uevent (&sch->dev.kobj,KOBJ_ADD ); +if (dev_get_uevent_suppress (&sch->dev)) { +dev_set_uevent_suppress (&sch->dev,0 ); +kobject_uevent (&sch->dev.kobj,KOBJ_ADD ); + }/* make it known to the system */ ret =ccw_device_add (cdev);if (ret) {
@@ -1058,8 +1060,11 @@ static int io_subchannel_probe(struct subchannel *sch)* Throw the delayed uevent for the subchannel, register * the ccw_device and exit. */ -dev_set_uevent_suppress (&sch->dev,0 ); -kobject_uevent (&sch->dev.kobj,KOBJ_ADD ); +if (dev_get_uevent_suppress (&sch->dev)) { +/* should always be the case for the console */ +dev_set_uevent_suppress (&sch->dev,0 ); +kobject_uevent (&sch->dev.kobj,KOBJ_ADD ); + } cdev =sch_get_cdev (sch); rc =ccw_device_add (cdev);if (rc) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 31/168 loop: Better discard support for block devices
In reply to Greg Kroah-HartmanFrom: Evan Green <[email protected]>
[ Upstream commit c52abf563049e787c1341cdf15c7dbe1bfbc951b ]
If the backing device for a loop device is itself a block device, then mirror the "write zeroes" capabilities of the underlying block device into the loop device. Copy this capability into both max_write_zeroes_sectors and max_discard_sectors of the loop device.
The reason for this is that REQ_OP_DISCARD on a loop device translates into blkdev_issue_zeroout(), rather than blkdev_issue_discard(). This presents a consistent interface for loop devices (that discarded data is zeroed), regardless of the backing device type of the loop device. There should be no behavior change for loop devices backed by regular files.
This change fixes blktest block/003, and removes an extraneous error print in block/013 when testing on a loop device backed by a block device that does not support discard.
--- drivers/block/loop.c | 42 +++++++++++++++++++++++++++++++----------- 1 file changed, 31 insertions(+), 11 deletions(-)
drivers/block/loop.c +31 -11
@@ -427,11 +427,12 @@ static int lo_fallocate(struct loop_device *lo, struct request *rq, loff_t pos,* information. */ struct file *file = lo->lo_backing_file; +struct request_queue *q = lo->lo_queue;int ret; mode |=FALLOC_FL_KEEP_SIZE ; -if ((!file->f_op->fallocate) || lo->lo_encrypt_key_size) { +if (!blk_queue_discard (q)) { ret = -EOPNOTSUPP ; goto out; }
@@ -863,28 +864,47 @@ static void loop_config_discard(struct loop_device *lo)struct inode *inode = file->f_mapping->host;struct request_queue *q = lo->lo_queue; +/* +* If the backing device is a block device, mirror its zeroing +* capability. Set the discard sectors to the block device's zeroing +* capabilities because loop discards result in blkdev_issue_zeroout(), +* not blkdev_issue_discard(). This maintains consistent behavior with +* file-backed loop devices: discarded regions read back as zero. +*/ +if (S_ISBLK (inode->i_mode) && !lo->lo_encrypt_key_size) { +struct request_queue *backingq; + + backingq =bdev_get_queue (inode->i_bdev); +blk_queue_max_discard_sectors (q, + backingq->limits.max_write_zeroes_sectors); + +blk_queue_max_write_zeroes_sectors (q, + backingq->limits.max_write_zeroes_sectors); +/* * We use punch hole to reclaim the free space used by the * image a.k.a. discard. However we do not support discard if * encryption is enabled, because it may give an attacker * useful information. */ -if ((!file->f_op->fallocate) || - lo->lo_encrypt_key_size) { + }else if (!file->f_op->fallocate || lo->lo_encrypt_key_size) { q->limits.discard_granularity =0 ; q->limits.discard_alignment =0 ;blk_queue_max_discard_sectors (q,0 );blk_queue_max_write_zeroes_sectors (q,0 ); -blk_queue_flag_clear (QUEUE_FLAG_DISCARD , q); -return ; - } - q->limits.discard_granularity = inode->i_sb->s_blocksize; - q->limits.discard_alignment =0 ; + }else { + q->limits.discard_granularity = inode->i_sb->s_blocksize; + q->limits.discard_alignment =0 ; -blk_queue_max_discard_sectors (q,UINT_MAX >>9 ); -blk_queue_max_write_zeroes_sectors (q,UINT_MAX >>9 ); -blk_queue_flag_set (QUEUE_FLAG_DISCARD , q); +blk_queue_max_discard_sectors (q,UINT_MAX >>9 ); +blk_queue_max_write_zeroes_sectors (q,UINT_MAX >>9 ); + } + +if (q->limits.max_write_zeroes_sectors) +blk_queue_flag_set (QUEUE_FLAG_DISCARD , q); +else +blk_queue_flag_clear (QUEUE_FLAG_DISCARD , q); }static void loop_unprepare_queue (struct loop_device *lo)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 32/168 Revert "powerpc/64: irq_work avoid interrupt when called with hardware irqs enabled"
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
[ Upstream commit abc3fce76adbdfa8f87272c784b388cd20b46049 ]
This reverts commit ebb37cf3ffd39fdb6ec5b07111f8bb2f11d92c5f.
That commit does not play well with soft-masked irq state manipulations in idle, interrupt replay, and possibly others due to tracing code sometimes using irq_work_queue (e.g., in trace_hardirqs_on()). That can cause PACA_IRQ_DEC to become set when it is not expected, and be ignored or cleared or cause warnings.
The net result seems to be missing an irq_work until the next timer interrupt in the worst case which is usually not going to be noticed, however it could be a long time if the tick is disabled, which is against the spirit of irq_work and might cause real problems.
The idea is still solid, but it would need more work. It's not really clear if it would be worth added complexity, so revert this for now (not a straight revert, but replace with a comment explaining why we might see interrupts happening, and gives git blame something to find).
--- arch/powerpc/kernel/time.c | 44 +++++++++++--------------------------- 1 file changed, 13 insertions(+), 31 deletions(-)
arch/powerpc/kernel/time.c +13 -31
@@ -522,35 +522,6 @@ static inline void clear_irq_work_pending(void) "i" (offsetof(struct paca_struct, irq_work_pending))); } -void arch_irq_work_raise (void ) -{ -preempt_disable (); -set_irq_work_pending_flag (); -/* -* Non-nmi code running with interrupts disabled will replay -* irq_happened before it re-enables interrupts, so setthe -* decrementer there instead of causing a hardware exception -* which would immediately hit the masked interrupt handler -* and have the net effect of setting the decrementer in -* irq_happened. -* -* NMI interrupts can not check this when they return, so the -* decrementer hardware exception is raised, which will fire -* when interrupts are next enabled. -* -* BookE does not support this yet, it must audit all NMI -* interrupt handlers to ensure they call nmi_enter() so this -* check would be correct. -*/ -if (IS_ENABLED (CONFIG_BOOKE ) || !irqs_disabled () ||in_nmi ()) { -set_dec (1 ); - }else { -hard_irq_disable (); - local_paca->irq_happened |=PACA_IRQ_DEC ; - } -preempt_enable (); -} -#else /* 32-bit */ DEFINE_PER_CPU (u8, irq_work_pending);
@@ -559,16 +530,27 @@ DEFINE_PER_CPU(u8, irq_work_pending);#define test_irq_work_pending () __this_cpu_read(irq_work_pending)#define clear_irq_work_pending () __this_cpu_write(irq_work_pending, 0) +#endif /* 32 vs 64 bit */ +void arch_irq_work_raise (void ) { +/* +* 64-bit code that uses irq soft-mask can just cause an immediate +* interrupt here that gets soft masked, if this is called under +* local_irq_disable(). It might be possible to prevent that happening +* by noticing interrupts are disabled and setting decrementer pending +* to be replayed when irqs are enabled. The problem there is that +* tracing can call irq_work_raise, including in code that does low +* level manipulations of irq soft-mask state (e.g., trace_hardirqs_on) +* which could get tangled up if we're messing with the same state +* here. +*/ preempt_disable ();set_irq_work_pending_flag ();set_dec (1 );preempt_enable (); } -#endif /* 32 vs 64 bit */ -#else /* CONFIG_IRQ_WORK */ #define test_irq_work_pending () 0
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 33/168 powerpc/pseries: Fix MCE handling on pseries
In reply to Greg Kroah-HartmanFrom: Ganesh Goudar <[email protected]>
[ Upstream commit a95a0a1654f16366360399574e10efd87e867b39 ]
MCE handling on pSeries platform fails as recent rework to use common code for pSeries and PowerNV in machine check error handling tries to access per-cpu variables in realmode. The per-cpu variables may be outside the RMO region on pSeries platform and needs translation to be enabled for access. Just moving these per-cpu variable into RMO region did'nt help because we queue some work to workqueues in real mode, which again tries to touch per-cpu variables. Also fwnmi_release_errinfo() cannot be called when translation is not enabled.
This patch fixes this by enabling translation in the exception handler when all required real mode handling is done. This change only affects the pSeries platform.
Without this fix below kernel crash is seen on injecting SLB multihit:
BUG: Unable to handle kernel data access on read at 0xc00000027b205950 Faulting instruction address: 0xc00000000003b7e0 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: mcetest_slb(OE+) af_packet(E) xt_tcpudp(E) ip6t_rpfilter(E) ip6t_REJECT(E) ipt_REJECT(E) xt_conntrack(E) ip_set(E) nfnetlink(E) ebtable_nat(E) ebtable_broute(E) ip6table_nat(E) ip6table_mangle(E) ip6table_raw(E) ip6table_security(E) iptable_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) iptable_mangle(E) iptable_raw(E) iptable_security(E) ebtable_filter(E) ebtables(E) ip6table_filter(E) ip6_tables(E) iptable_filter(E) ip_tables(E) x_tables(E) xfs(E) ibmveth(E) vmx_crypto(E) gf128mul(E) uio_pdrv_genirq(E) uio(E) crct10dif_vpmsum(E) rtc_generic(E) btrfs(E) libcrc32c(E) xor(E) zstd_decompress(E) zstd_compress(E) raid6_pq(E) sr_mod(E) sd_mod(E) cdrom(E) ibmvscsi(E) scsi_transport_srp(E) crc32c_vpmsum(E) dm_mod(E) sg(E) scsi_mod(E) CPU: 34 PID: 8154 Comm: insmod Kdump: loaded Tainted: G OE 5.5.0-mahesh #1 NIP: c00000000003b7e0 LR: c0000000000f2218 CTR: 0000000000000000 REGS: c000000007dcb960 TRAP: 0300 Tainted: G OE (5.5.0-mahesh) MSR: 8000000000001003 <SF,ME,RI,LE> CR: 28002428 XER: 20040000 CFAR: c0000000000f2214 DAR: c00000027b205950 DSISR: 40000000 IRQMASK: 0
GPR00: c0000000000f2218 c000000007dcbbf0 c000000001544800 c000000007dcbd70
GPR04: 0000000000000001 c000000007dcbc98 c008000000d00258 c0080000011c0000
GPR08: 0000000000000000 0000000300000003 c000000001035950 0000000003000048
GPR12: 000000027a1d0000 c000000007f9c000 0000000000000558 0000000000000000
GPR16: 0000000000000540 c008000001110000 c008000001110540 0000000000000000
GPR20: c00000000022af10 c00000025480fd70 c008000001280000 c00000004bfbb300
GPR24: c000000001442330 c00800000800000d c008000008000000 4009287a77000510
GPR28: 0000000000000000 0000000000000002 c000000001033d30 0000000000000001 NIP [c00000000003b7e0] save_mce_event+0x30/0x240
LR [c0000000000f2218] pseries_machine_check_realmode+0x2c8/0x4f0
Call Trace: Instruction dump: 3c4c0151 38429050 7c0802a6 60000000 fbc1fff0 fbe1fff8 f821ffd1 3d42ffaf 3fc2ffaf e98d0030 394a1150 3bdef530 <7d6a62aa> 1d2b0048 2f8b0063 380b0001 ---[ end trace 46fd63f36bbdd940 ]---
--- arch/powerpc/platforms/pseries/ras.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/powerpc/platforms/pseries/ras.c +11 -0
@@ -683,6 +683,17 @@ static int mce_handle_error(struct pt_regs *regs, struct rtas_error_log *errp)#endif out: +/* +* Enable translation as we will be accessing per-cpu variables +* in save_mce_event() which may fall outside RMO region, also +* leave it enabled because subsequently we will be queuing work +* to workqueues where again per-cpu variables accessed, besides +* fwnmi_release_errinfo() crashes when called in realmode on +* pseries. +* Note: All the realmode handling like flushing SLB entries for +* SLB multihit is done by now. +*/ +mtmsr (mfmsr () |MSR_IR |MSR_DR );save_mce_event (regs, disposition ==RTAS_DISP_FULLY_RECOVERED , &mce_err, regs->nip, eaddr, paddr);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 34/168 nvme: fix compat address handling in several ioctls
In reply to Greg Kroah-HartmanFrom: Nick Bowler <[email protected]>
[ Upstream commit c95b708d5fa65b4e51f088ee077d127fd5a57b70 ]
On a 32-bit kernel, the upper bits of userspace addresses passed via various ioctls are silently ignored by the nvme driver.
However on a 64-bit kernel running a compat task, these upper bits are not ignored and are in fact required to be zero for the ioctls to work.
Unfortunately, this difference matters. 32-bit smartctl submits the NVME_IOCTL_ADMIN_CMD ioctl with garbage in these upper bits because it seems the pointer value it puts into the nvme_passthru_cmd structure is sign extended. This works fine on 32-bit kernels but fails on a 64-bit one because (at least on my setup) the addresses smartctl uses are consistently above 2G. For example:
# smartctl -x /dev/nvme0n1 smartctl 7.1 2019-12-30 r5022 [x86_64-linux-5.5.11] (local build) Copyright (C) 2002-19, Bruce Allen, Christian Franke, www.smartmontools.org
Read NVMe Identify Controller failed: NVME_IOCTL_ADMIN_CMD: Bad address
Since changing 32-bit kernels to actually check all of the submitted address bits now would break existing userspace, this patch fixes the compat problem by explicitly zeroing the upper bits in the compat case. This enables 32-bit smartctl to work on a 64-bit kernel.
--- drivers/nvme/host/core.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-)
drivers/nvme/host/core.c +20 -7
@@ -6,6 +6,7 @@#include <linux/blkdev.h> #include <linux/blk-mq.h> +#include <linux/compat.h> #include <linux/delay.h> #include <linux/errno.h> #include <linux/hdreg.h>
@@ -1244,6 +1245,18 @@ static void nvme_enable_aen(struct nvme_ctrl *ctrl)queue_work (nvme_wq, &ctrl->async_event_work); } +/* +* Convert integer values from ioctl structures to user pointers, silently +* ignoring the upper bits in the compat case to match behaviour of 32-bit +* kernels. +*/ +static void __user *nvme_to_user_ptr (uintptr_t ptrval) +{ +if (in_compat_syscall ()) + ptrval = (compat_uptr_t )ptrval; +return (void __user *)ptrval; +} +static int nvme_submit_io (struct nvme_ns *ns,struct nvme_user_io __user *uio) {struct nvme_user_io io;
@@ -1267,7 +1280,7 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio) length = (io.nblocks +1 ) << ns->lba_shift; meta_len = (io.nblocks +1 ) * ns->ms; - metadata = (void __user *)(uintptr_t )io.metadata; + metadata =nvme_to_user_ptr (io.metadata);if (ns->ext) { length += meta_len;
@@ -1290,7 +1303,7 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio) c.rw.appmask =cpu_to_le16 (io.appmask);return nvme_submit_user_cmd (ns->queue, &c, - (void __user *)(uintptr_t )io.addr, length, +nvme_to_user_ptr (io.addr), length, metadata, meta_len,lower_32_bits (io.slba),NULL ,0 ); }
@@ -1410,9 +1423,9 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns, effects =nvme_passthru_start (ctrl, ns, cmd.opcode); status =nvme_submit_user_cmd (ns ? ns->queue : ctrl->admin_q, &c, - (void __user *)(uintptr_t )cmd.addr, cmd.data_len, - (void __user *)(uintptr_t )cmd.metadata, - cmd.metadata_len,0 , &result, timeout); +nvme_to_user_ptr (cmd.addr), cmd.data_len, +nvme_to_user_ptr (cmd.metadata), cmd.metadata_len, +0 , &result, timeout);nvme_passthru_end (ctrl, effects);if (status >=0 ) {
@@ -1457,8 +1470,8 @@ static int nvme_user_cmd64(struct nvme_ctrl *ctrl, struct nvme_ns *ns, effects =nvme_passthru_start (ctrl, ns, cmd.opcode); status =nvme_submit_user_cmd (ns ? ns->queue : ctrl->admin_q, &c, - (void __user *)(uintptr_t )cmd.addr, cmd.data_len, - (void __user *)(uintptr_t )cmd.metadata, cmd.metadata_len, +nvme_to_user_ptr (cmd.addr), cmd.data_len, +nvme_to_user_ptr (cmd.metadata), cmd.metadata_len,0 , &cmd.result, timeout);nvme_passthru_end (ctrl, effects);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 35/168 pwm: renesas-tpu: Fix late Runtime PM enablement
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit d5a3c7a4536e1329a758e14340efd0e65252bd3d ]
Runtime PM should be enabled before calling pwmchip_add(), as PWM users can appear immediately after the PWM chip has been added. Likewise, Runtime PM should always be disabled after the removal of the PWM chip, even if the latter failed.
--- drivers/pwm/pwm-renesas-tpu.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/pwm/pwm-renesas-tpu.c +4 -5
@@ -415,16 +415,17 @@ static int tpu_probe(struct platform_device *pdev) tpu->chip.base =-1 ; tpu->chip.npwm =TPU_CHANNEL_MAX ; +pm_runtime_enable (&pdev->dev); + ret =pwmchip_add (&tpu->chip);if (ret <0 ) {dev_err (&pdev->dev,"failed to register PWM chip\n" ); +pm_runtime_disable (&pdev->dev);return ret; }dev_info (&pdev->dev,"TPU PWM %d registered\n" , tpu->pdev->id); -pm_runtime_enable (&pdev->dev); -return 0 ; }
@@ -434,12 +435,10 @@ static int tpu_remove(struct platform_device *pdev)int ret; ret =pwmchip_remove (&tpu->chip); -if (ret) -return ret;pm_runtime_disable (&pdev->dev); -return 0 ; +return ret; }#ifdef CONFIG_OF
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 36/168 pwm: bcm2835: Dynamically allocate base
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 2c25b07e5ec119cab609e41407a1fb3fa61442f5 ]
The newer 2711 and 7211 chips have two PWM controllers and failure to dynamically allocate the PWM base would prevent the second PWM controller instance being probed for succeeding with an -EEXIST error from alloc_pwms().
--- drivers/pwm/pwm-bcm2835.c | 1 + 1 file changed, 1 insertion(+)
drivers/pwm/pwm-bcm2835.c +1 -0
@@ -166,6 +166,7 @@ static int bcm2835_pwm_probe(struct platform_device *pdev) pc->chip.dev = &pdev->dev; pc->chip.ops = &bcm2835_pwm_ops; + pc->chip.base =-1 ; pc->chip.npwm =2 ; pc->chip.of_xlate = of_pwm_xlate_with_flags; pc->chip.of_pwm_n_cells =3 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 37/168 perf/core: Disable page faults when getting phys address
In reply to Greg Kroah-HartmanFrom: Jiri Olsa <[email protected]>
[ Upstream commit d3296fb372bf7497b0e5d0478c4e7a677ec6f6e9 ]
We hit following warning when running tests on kernel compiled with CONFIG_DEBUG_ATOMIC_SLEEP=y:
WARNING: CPU: 19 PID: 4472 at mm/gup.c:2381 __get_user_pages_fast+0x1a4/0x200 CPU: 19 PID: 4472 Comm: dummy Not tainted 5.6.0-rc6+ #3 RIP: 0010:__get_user_pages_fast+0x1a4/0x200 ... Call Trace: perf_prepare_sample+0xff1/0x1d90 perf_event_output_forward+0xe8/0x210 __perf_event_overflow+0x11a/0x310 __intel_pmu_pebs_event+0x657/0x850 intel_pmu_drain_pebs_nhm+0x7de/0x11d0 handle_pmi_common+0x1b2/0x650 intel_pmu_handle_irq+0x17b/0x370 perf_event_nmi_handler+0x40/0x60 nmi_handle+0x192/0x590 default_do_nmi+0x6d/0x150 do_nmi+0x2f9/0x3c0 nmi+0x8e/0xd7
While __get_user_pages_fast() is IRQ-safe, it calls access_ok(), which warns on:
WARN_ON_ONCE(!in_task() && !pagefault_disabled())
Peter suggested disabling page faults around __get_user_pages_fast(), which gets rid of the warning in access_ok() call.
--- kernel/events/core.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
kernel/events/core.c +6 -3
@@ -6537,9 +6537,12 @@ static u64 perf_virt_to_phys(u64 virt)* Try IRQ-safe __get_user_pages_fast first. * If failed, leave phys_addr as 0. */ -if ((current->mm !=NULL ) && - (__get_user_pages_fast (virt,1 ,0 , &p) ==1 )) - phys_addr =page_to_phys (p) + virt %PAGE_SIZE ; +if (current->mm !=NULL ) { +pagefault_disable (); +if (__get_user_pages_fast (virt,1 ,0 , &p) ==1 ) + phys_addr =page_to_phys (p) + virt %PAGE_SIZE ; +pagefault_enable (); + }if (p)put_page (p);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 38/168 drm/amd/display: Calculate scaling ratios on every medium/full update
In reply to Greg Kroah-HartmanFrom: Nicholas Kazlauskas <[email protected]>
[ Upstream commit 3bae20137cae6c03f58f96c0bc9f3d46f0bc17d4 ]
[Why]
If a plane isn't being actively enabled or disabled then DC won't always recalculate scaling rects and ratios for the primary plane.
This results in only a partial or corrupted rect being displayed on the screen instead of scaling to fit the screen.
[How]
Add back the logic to recalculate the scaling rects into dc_commit_updates_for_stream since this is the expected place to do it in DC.
This was previously removed a few years ago to fix an underscan issue but underscan is still functional now with this change - and it should be, since this is only updating to the latest plane state getting passed in.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +12 -1
@@ -2154,7 +2154,7 @@ void dc_commit_updates_for_stream(struct dc *dc,enum surface_update_type update_type;struct dc_state *context;struct dc_context *dc_ctx = dc->ctx; -int i; +int i, j; stream_status =dc_stream_get_status (stream); context = dc->current_state;
@@ -2192,6 +2192,17 @@ void dc_commit_updates_for_stream(struct dc *dc,copy_surface_update_to_plane (surface, &srf_updates[i]); +if (update_type >=UPDATE_TYPE_MED ) { +for (j =0 ; j < dc->res_pool->pipe_count; j++) { +struct pipe_ctx *pipe_ctx = + &context->res_ctx.pipe_ctx[j]; + +if (pipe_ctx->plane_state != surface) +continue ; + +resource_build_scaling_params (pipe_ctx); + } + } }copy_stream_update_to_stream (dc, context, stream, stream_update);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 39/168 ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN MPWIN895CL tablet
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit c8b78f24c1247b7bd0882885c672d9dec5800bc6 ]
The MPMAN MPWIN895CL tablet almost fully works with out default settings. The only problem is that it has only 1 speaker so any sounds only playing on the right channel get lost.
Add a quirk for this model using the default settings + MONO_SPEAKER.
--- sound/soc/intel/boards/bytcr_rt5640.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
sound/soc/intel/boards/bytcr_rt5640.c +11 -0
@@ -591,6 +591,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {BYT_RT5640_SSP0_AIF1 | BYT_RT5640_MCLK_EN), }, + { +/* MPMAN MPWIN895CL */ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"MPMAN" ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MPWIN8900CL"), + }, + .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | +BYT_RT5640_MONO_SPEAKER | +BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, { /* MSI S100 tablet */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Micro-Star International Co., Ltd."),
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 40/168 ALSA: usb-audio: Add Pioneer DJ DJM-250MK2 quirk
In reply to Greg Kroah-HartmanFrom: František Kučera <[email protected]>
[ Upstream commit 73d8c94084341e2895169a0462dbc18167f01683 ]
Pioneer DJ DJM-250MK2 is a mixer that acts like a USB sound card. The MIDI controller part is standard but the PCM part is "vendor specific". Output is enabled by this quirk: 8 channels, 48 000 Hz, S24_3LE. Input is not working.
--- sound/usb/quirks-table.h | 42 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+)
sound/usb/quirks-table.h +42 -0
@@ -3592,5 +3592,47 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), } } }, +{ +/* +* Pioneer DJ DJM-250MK2 +* PCM is 8 channels out @ 48 fixed (endpoints 0x01). +* The output from computer to the mixer is usable. +* +* The input (phono or line to computer) is not working. +* It should be at endpoint 0x82 and probably also 8 channels, +* but it seems that it works only with Pioneer proprietary software. +* Even on officially supported OS, the Audacity was unable to record +* and Mixxx to recognize the control vinyls. +*/ + USB_DEVICE_VENDOR_SPEC(0x2b73, 0x0017), + .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + .ifnum =QUIRK_ANY_INTERFACE , + .type =QUIRK_COMPOSITE , + .data = (const struct snd_usb_audio_quirk []) { + { + .ifnum =0 , + .type =QUIRK_AUDIO_FIXED_ENDPOINT , + .data = &(const struct audioformat ) { + .formats =SNDRV_PCM_FMTBIT_S24_3LE , + .channels =8 ,// outputs + .iface =0 , + .altsetting =1 , + .altset_idx =1 , + .endpoint =0x01 , + .ep_attr =USB_ENDPOINT_XFER_ISOC | +USB_ENDPOINT_SYNC_ASYNC , + .rates =SNDRV_PCM_RATE_48000 , + .rate_min =48000 , + .rate_max =48000 , + .nr_rates =1 , + .rate_table = (unsigned int []) {48000 } + } + }, + { + .ifnum =-1 + } + } + } +}, #undef USB_DEVICE_VENDOR_SPEC
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 41/168 xhci: Ensure link state is U3 after setting USB_SS_PORT_LS_U3
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit eb002726fac7cefb98ff39ddb89e150a1c24fe85 ]
The xHCI spec doesn't specify the upper bound of U3 transition time. For some devices 20ms is not enough, so we need to make sure the link state is in U3 before further actions.
I've tried to use U3 Entry Capability by setting U3 Entry Enable in config register, however the port change event for U3 transition interrupts the system suspend process.
For now let's use the less ideal method by polling PLS.
--- drivers/usb/host/xhci-hub.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-hub.c +10 -1
@@ -1322,7 +1322,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,xhci_set_link_state (xhci, ports[wIndex], link_state);spin_unlock_irqrestore (&xhci->lock, flags); -msleep (20 );/* wait device to enter */ +if (link_state ==USB_SS_PORT_LS_U3 ) { +int retries =16 ; + +while (retries--) { +usleep_range (4000 ,8000 ); + temp =readl (ports[wIndex]->addr); +if ((temp &PORT_PLS_MASK ) ==XDEV_U3 ) +break ; + } + }spin_lock_irqsave (&xhci->lock, flags); temp =readl (ports[wIndex]->addr);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 42/168 xhci: Wait until link state trainsits to U0 after setting USB_SS_PORT_LS_U0
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit 0200b9f790b0fc9e9a42f685f5ad54b23fe959f4 ]
Like U3 case, xHCI spec doesn't specify the upper bound of U0 transition time. The 20ms is not enough for some devices.
Intead of polling PLS or PLC, we can facilitate the port change event to know that the link transits to U0 is completed.
While at it, also separate U0 and U3 case to make the code cleaner.
--- drivers/usb/host/xhci-hub.c | 44 +++++++++++++++++++++++++----------- drivers/usb/host/xhci-mem.c | 1 + drivers/usb/host/xhci-ring.c | 1 + drivers/usb/host/xhci.h | 1 + 4 files changed, 34 insertions(+), 13 deletions(-)
drivers/usb/host/xhci-hub.c +31 -13
@@ -1306,7 +1306,33 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, wIndex, link_state); goto error; } + +if (link_state ==USB_SS_PORT_LS_U0 ) { +if ((temp &PORT_PLS_MASK ) ==XDEV_U0 ) +break ; + +if (!((temp &PORT_PLS_MASK ) ==XDEV_U1 || + (temp &PORT_PLS_MASK ) ==XDEV_U2 || + (temp &PORT_PLS_MASK ) ==XDEV_U3 )) { +xhci_warn (xhci,"Can only set port %d to U0 from U state\n" , + wIndex); + goto error; + } +reinit_completion (&bus_state->u3exit_done[wIndex]); +xhci_set_link_state (xhci, ports[wIndex], +USB_SS_PORT_LS_U0 ); +spin_unlock_irqrestore (&xhci->lock, flags); +if (!wait_for_completion_timeout (&bus_state->u3exit_done[wIndex], +msecs_to_jiffies (100 ))) +xhci_dbg (xhci,"missing U0 port change event for port %d\n" , + wIndex); +spin_lock_irqsave (&xhci->lock, flags); + temp =readl (ports[wIndex]->addr); +break ; + } +if (link_state ==USB_SS_PORT_LS_U3 ) { +int retries =16 ; slot_id =xhci_find_slot_id_by_port (hcd, xhci, wIndex +1 );if (slot_id) {
@@ -1317,26 +1343,18 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,xhci_stop_device (xhci, slot_id,1 );spin_lock_irqsave (&xhci->lock, flags); } - } - -xhci_set_link_state (xhci, ports[wIndex], link_state); - -spin_unlock_irqrestore (&xhci->lock, flags); -if (link_state ==USB_SS_PORT_LS_U3 ) { -int retries =16 ; - +xhci_set_link_state (xhci, ports[wIndex],USB_SS_PORT_LS_U3 ); +spin_unlock_irqrestore (&xhci->lock, flags);while (retries--) {usleep_range (4000 ,8000 ); temp =readl (ports[wIndex]->addr);if ((temp &PORT_PLS_MASK ) ==XDEV_U3 )break ; } - } -spin_lock_irqsave (&xhci->lock, flags); - - temp =readl (ports[wIndex]->addr); -if (link_state ==USB_SS_PORT_LS_U3 ) +spin_lock_irqsave (&xhci->lock, flags); + temp =readl (ports[wIndex]->addr); bus_state->suspended_ports |=1 << wIndex; + }break ;case USB_PORT_FEAT_POWER :/*
drivers/usb/host/xhci-mem.c +1 -0
@@ -2552,6 +2552,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) xhci->usb3_rhub.bus_state.resume_done[i] =0 ;/* Only the USB 2.0 completions will ever be used. */ init_completion (&xhci->usb2_rhub.bus_state.rexit_done[i]); +init_completion (&xhci->usb3_rhub.bus_state.u3exit_done[i]); }if (scratchpad_alloc (xhci, flags))
drivers/usb/host/xhci-ring.c +1 -0
@@ -1673,6 +1673,7 @@ static void handle_port_status(struct xhci_hcd *xhci, (portsc & PORT_PLS_MASK) == XDEV_U1 || (portsc & PORT_PLS_MASK) == XDEV_U2)) {xhci_dbg (xhci,"resume SS port %d finished\n" , port_id); +complete (&bus_state->u3exit_done[hcd_portnum]);/* We've just brought the device into U0/1/2 through either the * Resume state after a device remote wakeup, or through the * U3Exit state after a host-initiated resume. If it's a device
drivers/usb/host/xhci.h +1 -0
@@ -1694,6 +1694,7 @@ struct xhci_bus_state {/* Which ports are waiting on RExit to U0 transition. */ unsigned long rexit_ports;struct completion rexit_done[USB_MAXCHILDREN ]; +struct completion u3exit_done[USB_MAXCHILDREN ]; };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 43/168 xhci: Finetune host initiated USB3 rootport link suspend and resume
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
[ Upstream commit ceca49382ac20e06ce04c21279c7f2868c4ec1d4 ]
Depending on the current link state the steps to resume the link to U0 varies. The normal case when a port is suspended (U3) we set the link to U0 and wait for a port event when U3exit completed and port moved to U0.
If the port is in U1/U2, then no event is issued, just set link to U0
If port is in Resume or Recovery state then the device has already initiated resume, and this host initiated resume is racing against it. Port event handler for device initiated resume will set link to U0, just wait for the port to reach U0 before returning.
--- drivers/usb/host/xhci-hub.c | 36 +++++++++++++++++++++++++----------- 1 file changed, 25 insertions(+), 11 deletions(-)
drivers/usb/host/xhci-hub.c +25 -11
@@ -1307,20 +1307,34 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, goto error; } +/* +* set link to U0, steps depend on current link state. +* U3: set link to U0 and wait for u3exit completion. +* U1/U2: no PLC complete event, only set link to U0. +* Resume/Recovery: device initiated U0, only wait for +* completion +*/ if (link_state ==USB_SS_PORT_LS_U0 ) { -if ((temp &PORT_PLS_MASK ) ==XDEV_U0 ) -break ; +u32 pls = temp &PORT_PLS_MASK ; +bool wait_u0 = false; -if (!((temp &PORT_PLS_MASK ) ==XDEV_U1 || - (temp &PORT_PLS_MASK ) ==XDEV_U2 || - (temp &PORT_PLS_MASK ) ==XDEV_U3 )) { -xhci_warn (xhci,"Can only set port %d to U0 from U state\n" , - wIndex); - goto error; +/* already in U0 */ +if (pls ==XDEV_U0 ) +break ; +if (pls ==XDEV_U3 || + pls ==XDEV_RESUME || + pls ==XDEV_RECOVERY ) { + wait_u0 = true; +reinit_completion (&bus_state->u3exit_done[wIndex]); + } +if (pls <=XDEV_U3 )/* U1, U2, U3 */ +xhci_set_link_state (xhci, ports[wIndex], +USB_SS_PORT_LS_U0 ); +if (!wait_u0) { +if (pls >XDEV_U3 ) + goto error; +break ; } -reinit_completion (&bus_state->u3exit_done[wIndex]); -xhci_set_link_state (xhci, ports[wIndex], -USB_SS_PORT_LS_U0 );spin_unlock_irqrestore (&xhci->lock, flags);if (!wait_for_completion_timeout (&bus_state->u3exit_done[wIndex],msecs_to_jiffies (100 )))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 44/168 drm/amd/display: Not doing optimize bandwidth if flip pending.
In reply to Greg Kroah-HartmanFrom: Yongqiang Sun <[email protected]>
[ Upstream commit 9941b8129030c9202aaf39114477a0e58c0d6ffc ]
[Why]
In some scenario like 1366x768 VSR enabled connected with a 4K monitor and playing 4K video in clone mode, underflow will be observed due to decrease dppclk when previouse surface scan isn't finished
[How]
In this use case, surface flip is switching between 4K and 1366x768, 1366x768 needs smaller dppclk, and when decrease the clk and previous surface scan is for 4K and scan isn't done, underflow will happen. Not doing optimize bandwidth in case of flip pending.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc.c +23 -0
@@ -1182,6 +1182,26 @@ bool dc_commit_state(struct dc *dc, struct dc_state *context)return (result ==DC_OK ); } +static bool is_flip_pending_in_pipes (struct dc *dc,struct dc_state *context) +{ +int i; +struct pipe_ctx *pipe; + +for (i =0 ; i <MAX_PIPES ; i++) { + pipe = &context->res_ctx.pipe_ctx[i]; + +if (!pipe->plane_state) +continue ; + +/* Must set to false to start with, due to OR in update function */ + pipe->plane_state->status.is_flip_pending = false; + dc->hwss.update_pending_status (pipe); +if (pipe->plane_state->status.is_flip_pending) +return true; + } +return false; +} +bool dc_post_update_surfaces_to_stream (struct dc *dc) {int i;
@@ -1192,6 +1212,9 @@ bool dc_post_update_surfaces_to_stream(struct dc *dc)post_surface_trace (dc); +if (is_flip_pending_in_pipes (dc, context)) +return true; +for (i =0 ; i < dc->res_pool->pipe_count; i++)if (context->res_ctx.pipe_ctx[i].stream ==NULL || context->res_ctx.pipe_ctx[i].plane_state ==NULL ) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 45/168 PCI/PM: Add pcie_wait_for_link_delay()
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
[ Upstream commit 4827d63891b6a839dac49c6ab62e61c4b011c4f2 ]
Add pcie_wait_for_link_delay(). Similar to pcie_wait_for_link() but allows passing custom activation delay in milliseconds.
--- drivers/pci/pci.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
drivers/pci/pci.c +18 -3
@@ -4605,14 +4605,17 @@ static int pci_pm_reset(struct pci_dev *dev, int probe)return pci_dev_wait (dev,"PM D3->D0" ,PCIE_RESET_READY_POLL_MS ); } +/** -* pcie_wait_for_link - Wait until link is active or inactive +* pcie_wait_for_link_delay - Wait until link is active or inactive * @pdev: Bridge device * @active: waiting for active or inactive? +* @delay: Delay to wait after link has become active (in ms) * * Use this to wait till link becomes active or inactive. */ -bool pcie_wait_for_link (struct pci_dev *pdev,bool active) +static bool pcie_wait_for_link_delay (struct pci_dev *pdev,bool active, +int delay) {int timeout =1000 ;bool ret;
@@ -4649,13 +4652,25 @@ bool pcie_wait_for_link(struct pci_dev *pdev, bool active) timeout -=10 ; }if (active && ret) -msleep (100 ); +msleep (delay);else if (ret != active)pci_info (pdev,"Data Link Layer Link Active not %s in 1000 msec\n" , active ?"set" :"cleared" );return ret == active; } +/** +* pcie_wait_for_link - Wait until link is active or inactive +* @pdev: Bridge device +* @active: waiting for active or inactive? +* +* Use this to wait till link becomes active or inactive. +*/ +bool pcie_wait_for_link (struct pci_dev *pdev,bool active) +{ +return pcie_wait_for_link_delay (pdev, active,100 ); +} +void pci_reset_secondary_bus (struct pci_dev *dev) {u16 ctrl;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 46/168 libbpf: Fix readelf output parsing on powerpc with recent binutils
In reply to Greg Kroah-HartmanFrom: Aurelien Jarno <[email protected]>
[ Upstream commit 3464afdf11f9a1e031e7858a05351ceca1792fea ]
On powerpc with recent versions of binutils, readelf outputs an extra field when dumping the symbols of an object file. For example:
35: 0000000000000838 96 FUNC LOCAL DEFAULT [<localentry>: 8] 1 btf_is_struct
The extra "[<localentry>: 8]" prevents the GLOBAL_SYM_COUNT variable to be computed correctly and causes the check_abi target to fail.
Fix that by looking for the symbol name in the last field instead of the 8th one. This way it should also cope with future extra fields.
--- tools/lib/bpf/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/lib/bpf/Makefile +2 -2
@@ -145,7 +145,7 @@ PC_FILE := $(addprefix $(OUTPUT),$(PC_FILE)) GLOBAL_SYM_COUNT = $(shell readelf -s --wide $(BPF_IN_SHARED) | \ cut -d "@" -f1 | sed 's/_v[0-9]_[0-9]_[0-9].*//' | \ - awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$8}' | \ + awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}' | \ sort -u | wc -l) VERSIONED_SYM_COUNT = $(shell readelf -s --wide $(OUTPUT)libbpf.so | \ grep -Eo '[^ ]+@LIBBPF_' | cut -d@ -f1 | sort -u | wc -l)
@@ -217,7 +217,7 @@ check_abi: $(OUTPUT)libbpf.so "versioned in $(VERSION_SCRIPT)." >&2; \ readelf -s --wide $(BPF_IN_SHARED) | \ cut -d "@" -f1 | sed 's/_v[0-9]_[0-9]_[0-9].*//' | \ - awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$8}'| \ + awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}'| \ sort -u > $(OUTPUT)libbpf_global_syms.tmp; \ readelf -s --wide $(OUTPUT)libbpf.so | \ grep -Eo '[^ ]+@LIBBPF_' | cut -d@ -f1 | \
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 47/168 PCI: pciehp: Prevent deadlock on disconnect
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
[ Upstream commit 87d0f2a5536fdf5053a6d341880f96135549a644 ]
This addresses deadlocks in these common cases in hierarchies containing two switches:
- All involved ports are runtime suspended and they are unplugged. This can happen easily if the drivers involved automatically enable runtime PM (xHCI for example does that).
- System is suspended (e.g., closing the lid on a laptop) with a dock + something else connected, and the dock is unplugged while suspended.
These cases lead to the following deadlock:
INFO: task irq/126-pciehp:198 blocked for more than 120 seconds. irq/126-pciehp D 0 198 2 0x80000000 Call Trace: schedule+0x2c/0x80 schedule_timeout+0x246/0x350 wait_for_completion+0xb7/0x140 kthread_stop+0x49/0x110 free_irq+0x32/0x70 pcie_shutdown_notification+0x2f/0x50 pciehp_remove+0x27/0x50 pcie_port_remove_service+0x36/0x50 device_release_driver+0x12/0x20 bus_remove_device+0xec/0x160 device_del+0x13b/0x350 device_unregister+0x1a/0x60 remove_iter+0x1e/0x30 device_for_each_child+0x56/0x90 pcie_port_device_remove+0x22/0x40 pcie_portdrv_remove+0x20/0x60 pci_device_remove+0x3e/0xc0 device_release_driver_internal+0x18c/0x250 device_release_driver+0x12/0x20 pci_stop_bus_device+0x6f/0x90 pci_stop_bus_device+0x31/0x90 pci_stop_and_remove_bus_device+0x12/0x20 pciehp_unconfigure_device+0x88/0x140 pciehp_disable_slot+0x6a/0x110 pciehp_handle_presence_or_link_change+0x263/0x400 pciehp_ist+0x1c9/0x1d0 irq_thread_fn+0x24/0x60 irq_thread+0xeb/0x190 kthread+0x120/0x140 INFO: task irq/190-pciehp:2288 blocked for more than 120 seconds. irq/190-pciehp D 0 2288 2 0x80000000 Call Trace: __schedule+0x2a2/0x880 schedule+0x2c/0x80 schedule_preempt_disabled+0xe/0x10 mutex_lock+0x2c/0x30 pci_lock_rescan_remove+0x15/0x20 pciehp_unconfigure_device+0x4d/0x140 pciehp_disable_slot+0x6a/0x110 pciehp_handle_presence_or_link_change+0x263/0x400 pciehp_ist+0x1c9/0x1d0 irq_thread_fn+0x24/0x60 irq_thread+0xeb/0x190 kthread+0x120/0x140
What happens here is that the whole hierarchy is runtime resumed and the parent PCIe downstream port, which got the hot-remove event, starts removing devices below it, taking pci_lock_rescan_remove() lock. When the child PCIe port is runtime resumed it calls pciehp_check_presence() which ends up calling pciehp_card_present() and pciehp_check_link_active(). Both of these use pcie_capability_read_word(), which notices that the underlying device is already gone and returns PCIBIOS_DEVICE_NOT_FOUND with the capability value set to 0. When pciehp gets this value it thinks that its child device is also hot-removed and schedules its IRQ thread to handle the event.
The deadlock happens when the child's IRQ thread runs and tries to acquire pci_lock_rescan_remove() which is already taken by the parent and the parent waits for the child's IRQ thread to finish.
Prevent this from happening by checking the return value of pcie_capability_read_word() and if it is PCIBIOS_DEVICE_NOT_FOUND stop performing any hot-removal activities.
--- drivers/pci/hotplug/pciehp.h | 6 ++-- drivers/pci/hotplug/pciehp_core.c | 11 ++++-- drivers/pci/hotplug/pciehp_ctrl.c | 4 +-- drivers/pci/hotplug/pciehp_hpc.c | 59 +++++++++++++++++++++++++------ 4 files changed, 61 insertions(+), 19 deletions(-)
drivers/pci/hotplug/pciehp.h +3 -3
@@ -174,10 +174,10 @@ void pciehp_set_indicators(struct controller *ctrl, int pwr, int attn);void pciehp_get_latch_status (struct controller *ctrl,u8 *status);int pciehp_query_power_fault (struct controller *ctrl); -bool pciehp_card_present (struct controller *ctrl); -bool pciehp_card_present_or_link_active (struct controller *ctrl); +int pciehp_card_present (struct controller *ctrl); +int pciehp_card_present_or_link_active (struct controller *ctrl);int pciehp_check_link_status (struct controller *ctrl); -bool pciehp_check_link_active (struct controller *ctrl); +int pciehp_check_link_active (struct controller *ctrl);void pciehp_release_ctrl (struct controller *ctrl);int pciehp_sysfs_enable_slot (struct hotplug_slot *hotplug_slot);
drivers/pci/hotplug/pciehp_core.c +8 -3
@@ -139,10 +139,15 @@ static int get_adapter_status(struct hotplug_slot *hotplug_slot, u8 *value) {struct controller *ctrl =to_ctrl (hotplug_slot);struct pci_dev *pdev = ctrl->pcie->port; +int ret;pci_config_pm_runtime_get (pdev); - *value =pciehp_card_present_or_link_active (ctrl); + ret =pciehp_card_present_or_link_active (ctrl);pci_config_pm_runtime_put (pdev); +if (ret <0 ) +return ret; + + *value = ret;return 0 ; }
@@ -158,13 +163,13 @@ static int get_adapter_status(struct hotplug_slot *hotplug_slot, u8 *value)*/ static void pciehp_check_presence (struct controller *ctrl) { -bool occupied; +int occupied;down_read (&ctrl->reset_lock);mutex_lock (&ctrl->state_lock); occupied =pciehp_card_present_or_link_active (ctrl); -if ((occupied && (ctrl->state ==OFF_STATE || +if ((occupied >0 && (ctrl->state ==OFF_STATE || ctrl->state ==BLINKINGON_STATE )) || (!occupied && (ctrl->state ==ON_STATE || ctrl->state ==BLINKINGOFF_STATE )))
drivers/pci/hotplug/pciehp_ctrl.c +2 -2
@@ -226,7 +226,7 @@ void pciehp_handle_disable_request(struct controller *ctrl)void pciehp_handle_presence_or_link_change (struct controller *ctrl,u32 events) { -bool present, link_active; +int present, link_active;/* * If the slot is on and presence or link has changed, turn it off.
@@ -257,7 +257,7 @@ void pciehp_handle_presence_or_link_change(struct controller *ctrl, u32 events)mutex_lock (&ctrl->state_lock); present =pciehp_card_present (ctrl); link_active =pciehp_check_link_active (ctrl); -if (!present && !link_active) { +if (present <=0 && link_active <=0 ) {mutex_unlock (&ctrl->state_lock);return ; }
drivers/pci/hotplug/pciehp_hpc.c +48 -11
88 lines not on this page · raw message
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 48/168 ASoC: SOF: trace: fix unconditional free in trace release
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
[ Upstream commit e6110114d18d330c05fd6de9f31283fd086a5a3a ]
Check if DMA pages were successfully allocated in initialization before calling free. For many types of memory (like sgbufs) the extra free is harmless, but not all backends track allocation state, so add an explicit check.
--- sound/soc/sof/trace.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
sound/soc/sof/trace.c +5 -2
@@ -328,7 +328,10 @@ void snd_sof_free_trace(struct snd_sof_dev *sdev) {snd_sof_release_trace (sdev); -snd_dma_free_pages (&sdev->dmatb); -snd_dma_free_pages (&sdev->dmatp); +if (sdev->dma_trace_pages) { +snd_dma_free_pages (&sdev->dmatb); +snd_dma_free_pages (&sdev->dmatp); + sdev->dma_trace_pages =0 ; + } }EXPORT_SYMBOL (snd_sof_free_trace);
Signature · 58 lines
2.20.1 ansport.c:937 This bug occurs when cancellation of the S-G transfer races with transfer completion. When that happens, usb_sg_cancel() may continue to access the transfer's URBs after usb_sg_wait() has freed them. The bug is caused by the fact that usb_sg_cancel() does not take any sort of reference to the transfer, and so there is nothing to prevent the URBs from being deallocated while the routine is trying to use them. The fix is to take such a reference by incrementing the transfer's io->count field while the cancellation is in progres and decrementing it afterward. The transfer's URBs are not deallocated until io->complete is triggered, which happens when io->count reaches zero. Signed-off-by: Alan Stern <[email protected]> Reported-and-tested-by: Kyungtae Kim <[email protected]> CC: <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]> --- drivers/usb/core/message.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -588,12 +588,13 @@ void usb_sg_cancel(struct usb_sg_request int i, retval; spin_lock_irqsave(&io->lock, flags); - if (io->status) { + if (io->status || io->count == 0) { spin_unlock_irqrestore(&io->lock, flags); return; } /* shut everything down */ io->status = -ECONNRESET; + io->count++; /* Keep the request alive until we're done */ spin_unlock_irqrestore(&io->lock, flags); for (i = io->entries - 1; i >= 0; --i) { @@ -607,6 +608,12 @@ void usb_sg_cancel(struct usb_sg_request dev_warn(&io->dev->dev, "%s, unlink --> %d\n", __func__, retval); } + + spin_lock_irqsave(&io->lock, flags); + io->count--; + if (!io->count) + complete(&io->complete); + spin_unlock_irqrestore(&io->lock, flags); } EXPORT_SYMBOL_GPL(usb_sg_cancel);
Greg Kroah-Hartman
maintainerPATCH 49/168 tracing/selftests: Turn off timeout setting
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
[ Upstream commit b43e78f65b1d35fd3e13c7b23f9b64ea83c9ad3a ]
As the ftrace selftests can run for a long period of time, disable the timeout that the general selftests have. If a selftest hangs, then it probably means the machine will hang too.
--- tools/testing/selftests/ftrace/settings | 1 + 1 file changed, 1 insertion(+) create mode 100644 tools/testing/selftests/ftrace/settings
tools/testing/selftests/ftrace/settings new file +1 -0
@@ -0,0 +1 @@ +timeout=0
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 50/168 virtio-blk: improve virtqueue error to BLK_STS
In reply to Greg Kroah-HartmanFrom: Halil Pasic <[email protected]>
[ Upstream commit 3d973b2e9a625996ee997c7303cd793b9d197c65 ]
Let's change the mapping between virtqueue_add errors to BLK_STS statuses, so that -ENOSPC, which indicates virtqueue full is still mapped to BLK_STS_DEV_RESOURCE, but -ENOMEM which indicates non-device specific resource outage is mapped to BLK_STS_RESOURCE.
--- drivers/block/virtio_blk.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/block/virtio_blk.c +7 -2
@@ -345,9 +345,14 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx,if (err == -ENOSPC )blk_mq_stop_hw_queue (hctx);spin_unlock_irqrestore (&vblk->vqs[qid].lock, flags); -if (err == -ENOMEM || err == -ENOSPC ) +switch (err) { +case -ENOSPC :return BLK_STS_DEV_RESOURCE ; -return BLK_STS_IOERR ; +case -ENOMEM : +return BLK_STS_RESOURCE ; +default : +return BLK_STS_IOERR ; + } }if (bd->last &&virtqueue_kick_prepare (vblk->vqs[qid].vq))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 51/168 scsi: smartpqi: fix controller lockup observed during force reboot
In reply to Greg Kroah-HartmanFrom: Kevin Barnett <[email protected]>
[ Upstream commit 0530736e40a0695b1ee2762e2684d00549699da4 ]
--- drivers/scsi/smartpqi/smartpqi.h | 9 +- drivers/scsi/smartpqi/smartpqi_init.c | 126 ++++++++++++++++++++++---- 2 files changed, 115 insertions(+), 20 deletions(-)
drivers/scsi/smartpqi/smartpqi.h +8 -1
@@ -1130,8 +1130,9 @@ struct pqi_ctrl_info {struct mutex ofa_mutex;/* serialize ofa */ bool controller_online;bool block_requests; -bool in_shutdown; +bool block_device_reset;bool in_ofa; +bool in_shutdown; u8 inbound_spanning_supported : 1; u8 outbound_spanning_supported : 1; u8 pqi_mode_enabled : 1;
@@ -1173,6 +1174,7 @@ struct pqi_ctrl_info {struct pqi_ofa_memory *pqi_ofa_mem_virt_addr;dma_addr_t pqi_ofa_mem_dma_handle;void **pqi_ofa_chunk_virt_addr; +atomic_t sync_cmds_outstanding; };enum pqi_ctrl_mode {
@@ -1423,6 +1425,11 @@ static inline bool pqi_ctrl_blocked(struct pqi_ctrl_info *ctrl_info)return ctrl_info->block_requests; } +static inline bool pqi_device_reset_blocked (struct pqi_ctrl_info *ctrl_info) +{ +return ctrl_info->block_device_reset; +} +void pqi_sas_smp_handler (struct bsg_job *job,struct Scsi_Host *shost,struct sas_rphy *rphy);
drivers/scsi/smartpqi/smartpqi_init.c +107 -19
229 lines not on this page · raw message
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 52/168 scsi: smartpqi: fix call trace in device discovery
In reply to Greg Kroah-HartmanFrom: Murthy Bhat <[email protected]>
[ Upstream commit b969261134c1b990b96ea98fe5e0fcf8ec937c04 ]
Use sas_phy_delete rather than sas_phy_free which, according to comments, should not be called for PHYs that have been set up successfully.
--- drivers/scsi/smartpqi/smartpqi_sas_transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/smartpqi/smartpqi_sas_transport.c +1 -1
@@ -45,9 +45,9 @@ static void pqi_free_sas_phy(struct pqi_sas_phy *pqi_sas_phy)struct sas_phy *phy = pqi_sas_phy->phy;sas_port_delete_phy (pqi_sas_phy->parent_port->port, phy); -sas_phy_free (phy);if (pqi_sas_phy->added_to_port)list_del (&pqi_sas_phy->phy_list_entry); +sas_phy_delete (phy);kfree (pqi_sas_phy); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 53/168 scsi: smartpqi: fix problem with unique ID for physical device
In reply to Greg Kroah-HartmanFrom: Kevin Barnett <[email protected]>
[ Upstream commit 5b083b305b49f65269b888885455b8c0cf1a52e4 ]
Obtain the unique IDs from the RLL and RPL instead of VPD page 83h.
--- drivers/scsi/smartpqi/smartpqi.h | 1 - drivers/scsi/smartpqi/smartpqi_init.c | 99 ++++----------------------- 2 files changed, 12 insertions(+), 88 deletions(-)
drivers/scsi/smartpqi/smartpqi.h +0 -1
@@ -907,7 +907,6 @@ struct pqi_scsi_dev {u8 scsi3addr[8 ];__be64 wwid;u8 volume_id[16 ]; -u8 unique_id[16 ]; u8 is_physical_device : 1; u8 is_external_raid_device : 1; u8 is_expander_smp_device : 1;
drivers/scsi/smartpqi/smartpqi_init.c +12 -87
128 lines not on this page · raw message
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 54/168 PCI/ASPM: Allow re-enabling Clock PM
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit 35efea32b26f9aacc99bf07e0d2cdfba2028b099 ]
Previously Clock PM could not be re-enabled after being disabled by pci_disable_link_state() because clkpm_capable was reset. Change this by adding a clkpm_disable field similar to aspm_disable.
--- drivers/pci/pcie/aspm.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/pci/pcie/aspm.c +11 -7
@@ -64,6 +64,7 @@ struct pcie_link_state { u32 clkpm_capable:1; /* Clock PM capable? */ u32 clkpm_enabled:1; /* Current Clock PM state */ u32 clkpm_default:1; /* Default Clock PM state by BIOS */ + u32 clkpm_disable:1; /* Clock PM disabled *//* Exit latencies */ struct aspm_latency latency_up;/* Upstream direction exit latency */
@@ -161,8 +162,11 @@ static void pcie_set_clkpm_nocheck(struct pcie_link_state *link, int enable)static void pcie_set_clkpm (struct pcie_link_state *link,int enable) { -/* Don't enable Clock PM if the link is not Clock PM capable */ -if (!link->clkpm_capable) +/* +* Don't enable Clock PM if the link is not Clock PM capable +* or Clock PM is disabled +*/ +if (!link->clkpm_capable || link->clkpm_disable) enable =0 ;/* Need nothing if the specified equals to current state */ if (link->clkpm_enabled == enable)
@@ -192,7 +196,8 @@ static void pcie_clkpm_cap_init(struct pcie_link_state *link, int blacklist) } link->clkpm_enabled = enabled; link->clkpm_default = enabled; - link->clkpm_capable = (blacklist) ?0 : capable; + link->clkpm_capable = capable; + link->clkpm_disable = blacklist ?1 :0 ; }static bool pcie_retrain_link (struct pcie_link_state *link)
@@ -1097,10 +1102,9 @@ static int __pci_disable_link_state(struct pci_dev *pdev, int state, bool sem) link->aspm_disable |=ASPM_STATE_L1 ;pcie_config_aspm_link (link,policy_to_aspm_state (link)); -if (state &PCIE_LINK_STATE_CLKPM ) { - link->clkpm_capable =0 ; -pcie_set_clkpm (link,0 ); - } +if (state &PCIE_LINK_STATE_CLKPM ) + link->clkpm_disable =1 ; +pcie_set_clkpm (link,policy_to_clkpm_state (link));mutex_unlock (&aspm_lock);if (sem)up_read (&pci_bus_sem);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 55/168 PCI/PM: Add missing link delays required by the PCIe spec
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
[ Upstream commit ad9001f2f41198784b0423646450ba2cb24793a3 ]
Currently Linux does not follow PCIe spec regarding the required delays after reset. A concrete example is a Thunderbolt add-in-card that consists of a PCIe switch and two PCIe endpoints:
+-1b.0-[01-6b]----00.0-[02-6b]--+-00.0-[03]----00.0 TBT controller
+-01.0-[04-36]-- DS hotplug port
+-02.0-[37]----00.0 xHCI controller
\-04.0-[38-6b]-- DS hotplug portThe root port (1b.0) and the PCIe switch downstream ports are all PCIe Gen3 so they support 8GT/s link speeds.
We wait for the PCIe hierarchy to enter D3cold (runtime):
pcieport 0000:00:1b.0: power state changed by ACPI to D3cold
When it wakes up from D3cold, according to the PCIe 5.0 section 5.8 the PCIe switch is put to reset and its power is re-applied. This means that we must follow the rules in PCIe 5.0 section 6.6.1.
For the PCIe Gen3 ports we are dealing with here, the following applies:
With a Downstream Port that supports Link speeds greater than 5.0 GT/s, software must wait a minimum of 100 ms after Link training completes before sending a Configuration Request to the device immediately below that Port. Software can determine when Link training completes by polling the Data Link Layer Link Active bit or by setting up an associated interrupt (see Section 6.7.3.3).
Translating this into the above topology we would need to do this (DLLLA stands for Data Link Layer Link Active):
0000:00:1b.0: wait for 100 ms after DLLLA is set before access to 0000:01:00.0 0000:02:00.0: wait for 100 ms after DLLLA is set before access to 0000:03:00.0 0000:02:02.0: wait for 100 ms after DLLLA is set before access to 0000:37:00.0
I've instrumented the kernel with some additional logging so we can see the actual delays performed:
pcieport 0000:00:1b.0: power state changed by ACPI to D0 pcieport 0000:00:1b.0: waiting for D3cold delay of 100 ms pcieport 0000:00:1b.0: waiting for D3hot delay of 10 ms pcieport 0000:02:01.0: waiting for D3hot delay of 10 ms pcieport 0000:02:04.0: waiting for D3hot delay of 10 ms
For the switch upstream port (01:00.0 reachable through 00:1b.0 root port) we wait for 100 ms but not taking into account the DLLLA requirement. We then wait 10 ms for D3hot -> D0 transition of the root port and the two downstream hotplug ports. This means that we deviate from what the spec requires.
Performing the same check for system sleep (s2idle) transitions it turns out to be even worse. None of the mandatory delays are performed. If this would be S3 instead of s2idle then according to PCI FW spec 3.2 section 4.6.8. there is a specific _DSM that allows the OS to skip the delays but this platform does not provide the _DSM and does not go to S3 anyway so no firmware is involved that could already handle these delays.
On this particular platform these delays are not actually needed because there is an additional delay as part of the ACPI power resource that is used to turn on power to the hierarchy but since that additional delay is not required by any of standards (PCIe, ACPI) it is not present in the Intel Ice Lake, for example where missing the mandatory delays causes pciehp to start tearing down the stack too early (links are not yet trained). Below is an example how it looks like when this happens:
pcieport 0000:83:04.0: pciehp: Slot(4): Card not present
pcieport 0000:87:04.0: PME# disabled
pcieport 0000:83:04.0: pciehp: pciehp_unconfigure_device: domain:bus:dev = 0000:86:00 pcieport 0000:86:00.0: Refused to change power state, currently in D3
pcieport 0000:86:00.0: restoring config space at offset 0x3c (was 0xffffffff, writing 0x201ff) pcieport 0000:86:00.0: restoring config space at offset 0x38 (was 0xffffffff, writing 0x0)
...
There is also one reported case (see the bugzilla link below) where the missing delay causes xHCI on a Titan Ridge controller fail to runtime resume when USB-C dock is plugged. This does not involve pciehp but instead the PCI core fails to runtime resume the xHCI device:
pcieport 0000:04:02.0: restoring config space at offset 0xc (was 0x10000, writing 0x10020) pcieport 0000:04:02.0: restoring config space at offset 0x4 (was 0x100000, writing 0x100406) xhci_hcd 0000:39:00.0: Refused to change power state, currently in D3 xhci_hcd 0000:39:00.0: restoring config space at offset 0x3c (was 0xffffffff, writing 0x1ff) xhci_hcd 0000:39:00.0: restoring config space at offset 0x38 (was 0xffffffff, writing 0x0)
...
Add a new function pci_bridge_wait_for_secondary_bus() that is called on PCI core resume and runtime resume paths accordingly if the bridge entered D3cold (and thus went through reset).
This is second attempt to add the missing delays. The previous solution in c2bf1fc212f7 ("PCI: Add missing link delays required by the PCIe spec") was reverted because of two issues it caused:
1. One system become unresponsive after S3 resume due to PME service spinning in pcie_pme_work_fn(). The root port in question reports that the xHCI sent PME but the xHCI device itself does not have PME status set. The PME status bit is never cleared in the root port resulting the indefinite loop in pcie_pme_work_fn().
2. Slows down resume if the root/downstream port does not support Data Link Layer Active Reporting because pcie_wait_for_link_delay() waits 1100 ms in that case.
This version should avoid the above issues because we restrict the delay to happen only if the port went into D3cold.
--- drivers/pci/pci-driver.c | 11 +++- drivers/pci/pci.c | 121 ++++++++++++++++++++++++++++++++++++++- drivers/pci/pci.h | 1 + 3 files changed, 130 insertions(+), 3 deletions(-)
drivers/pci/pci-driver.c +10 -1
@@ -919,6 +919,8 @@ static int pci_pm_resume_noirq(struct device *dev)struct pci_dev *pci_dev =to_pci_dev (dev);struct device_driver *drv = dev->driver;int error =0 ; +pci_power_t prev_state = pci_dev->current_state; +bool skip_bus_pm = pci_dev->skip_bus_pm;if (dev_pm_may_skip_resume (dev))return 0 ;
@@ -937,12 +939,15 @@ static int pci_pm_resume_noirq(struct device *dev)* configuration here and attempting to put them into D0 again is * pointless, so avoid doing that. */ -if (!(pci_dev->skip_bus_pm &&pm_suspend_no_platform ())) +if (!(skip_bus_pm &&pm_suspend_no_platform ()))pci_pm_default_resume_early (pci_dev);pci_fixup_device (pci_fixup_resume_early, pci_dev);pcie_pme_root_status_cleanup (pci_dev); +if (!skip_bus_pm && prev_state == PCI_D3cold) +pci_bridge_wait_for_secondary_bus (pci_dev); +if (pci_has_legacy_pm_support (pci_dev))return pci_legacy_resume_early (dev);
@@ -1333,6 +1338,7 @@ static int pci_pm_runtime_resume(struct device *dev)int rc =0 ;struct pci_dev *pci_dev =to_pci_dev (dev);const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm :NULL ; +pci_power_t prev_state = pci_dev->current_state;/* * Restoring config space is necessary even if the device is not bound
@@ -1348,6 +1354,9 @@ static int pci_pm_runtime_resume(struct device *dev)pci_enable_wake (pci_dev,PCI_D0 , false);pci_fixup_device (pci_fixup_resume, pci_dev); +if (prev_state == PCI_D3cold) +pci_bridge_wait_for_secondary_bus (pci_dev); +if (pm && pm->runtime_resume) rc = pm->runtime_resume (dev);
drivers/pci/pci.c +119 -2
133 lines not on this page · raw message
drivers/pci/pci.h +1 -0
@@ -107,6 +107,7 @@ void pci_allocate_cap_save_buffers(struct pci_dev *dev);void pci_free_cap_save_buffers (struct pci_dev *dev);bool pci_bridge_d3_possible (struct pci_dev *dev);void pci_bridge_d3_update (struct pci_dev *dev); +void pci_bridge_wait_for_secondary_bus (struct pci_dev *dev);static inline void pci_wakeup_event (struct pci_dev *dev) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 56/168 cxgb4: fix adapter crash due to wrong MC size
In reply to Greg Kroah-HartmanFrom: Vishal Kulkarni <[email protected]>
[ Upstream commit ce222748078592afb51b810dc154531aeba4f512 ]
In the absence of MC1, the size calculation function cudbg_mem_region_size() was returing wrong MC size and resulted in adapter crash. This patch adds new argument to cudbg_mem_region_size() which will have actual size and returns error to caller in the absence of MC1.
--- drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c | 27 ++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c +20 -7
@@ -1054,9 +1054,9 @@ static void cudbg_t4_fwcache(struct cudb } } -static unsigned long cudbg_mem_region_size (struct cudbg_init *pdbg_init, -struct cudbg_error *cudbg_err, -u8 mem_type) +static int cudbg_mem_region_size (struct cudbg_init *pdbg_init, +struct cudbg_error *cudbg_err, +u8 mem_type,unsigned long *region_size) {struct adapter *padap = pdbg_init->adap;struct cudbg_meminfo mem_info;
@@ -1065,15 +1065,23 @@ static unsigned long cudbg_mem_region_simemset (&mem_info,0 ,sizeof (struct cudbg_meminfo )); rc =cudbg_fill_meminfo (padap, &mem_info); -if (rc) +if (rc) { + cudbg_err->sys_err = rc;return rc; + }cudbg_t4_fwcache (pdbg_init, cudbg_err); rc =cudbg_meminfo_get_mem_index (padap, &mem_info, mem_type, &mc_idx); -if (rc) +if (rc) { + cudbg_err->sys_err = rc;return rc; + } + +if (region_size) + *region_size = mem_info.avail[mc_idx].limit - + mem_info.avail[mc_idx].base; -return mem_info.avail[mc_idx].limit - mem_info.avail[mc_idx].base; +return 0 ; } static int cudbg_collect_mem_region(struct cudbg_init *pdbg_init,
@@ -1081,7 +1089,12 @@ static int cudbg_collect_mem_region(stru struct cudbg_error *cudbg_err, u8 mem_type) { -unsigned long size =cudbg_mem_region_size (pdbg_init, cudbg_err, mem_type); +unsigned long size =0 ; +int rc; + + rc =cudbg_mem_region_size (pdbg_init, cudbg_err, mem_type, &size); +if (rc) +return rc;return cudbg_read_fw_mem (pdbg_init, dbg_buff, mem_type, size, cudbg_err);
Greg Kroah-Hartman
maintainerPATCH 57/168 cxgb4: fix large delays in PTP synchronization
In reply to Greg Kroah-HartmanFrom: Rahul Lakkireddy <[email protected]>
[ Upstream commit bd019427bf3623ee3c7d2845cf921bbf4c14846c ]
Fetching PTP sync information from mailbox is slow and can take up to 10 milliseconds. Reduce this unnecessary delay by directly reading the information from the corresponding registers.
--- drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c | 27 +++++-------------------- drivers/net/ethernet/chelsio/cxgb4/t4_regs.h | 3 ++ 2 files changed, 9 insertions(+), 21 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c +6 -21
@@ -311,32 +311,17 @@ static int cxgb4_ptp_adjtime(struct ptp_*/ static int cxgb4_ptp_gettime (struct ptp_clock_info *ptp,struct timespec64 *ts) { -struct adapter *adapter = (struct adapter *)container_of (ptp, - struct adapter, ptp_clock_info); -struct fw_ptp_cmd c; + struct adapter *adapter = container_of(ptp, struct adapter, + ptp_clock_info);u64 ns; -int err; -memset (&c,0 ,sizeof (c)); - c.op_to_portid =cpu_to_be32 (FW_CMD_OP_V (FW_PTP_CMD ) | -FW_CMD_REQUEST_F | -FW_CMD_READ_F | -FW_PTP_CMD_PORTID_V (0 )); - c.retval_len16 =cpu_to_be32 (FW_CMD_LEN16_V (sizeof (c) /16 )); - c.u.ts.sc =FW_PTP_SC_GET_TIME ; - - err =t4_wr_mbox (adapter, adapter->mbox, &c,sizeof (c), &c); -if (err <0 ) { -dev_err (adapter->pdev_dev, -"PTP: %s error %d\n" , __func__, -err); -return err; - } + ns =t4_read_reg (adapter,T5_PORT_REG (0 ,MAC_PORT_PTP_SUM_LO_A )); + ns |= (u64 )t4_read_reg (adapter, +T5_PORT_REG (0 ,MAC_PORT_PTP_SUM_HI_A )) <<32 ;/* convert to timespec*/ - ns =be64_to_cpu (c.u.ts.tm); *ts =ns_to_timespec64 (ns); - -return err; +return 0 ; }/**
drivers/net/ethernet/chelsio/cxgb4/t4_regs.h +3 -0
@@ -1900,6 +1900,9 @@#define MAC_PORT_CFG2_A 0x818 +#define MAC_PORT_PTP_SUM_LO_A 0x990 +#define MAC_PORT_PTP_SUM_HI_A 0x994 +#define MPS_CMN_CTL_A 0x9000#define COUNTPAUSEMCRX_S 5
Greg Kroah-Hartman
maintainerPATCH 58/168 ipv4: Update fib_select_default to handle nexthop objects
In reply to Greg Kroah-HartmanFrom: David Ahern <[email protected]>
[ Upstream commit 7c74b0bec918c1e0ca0b4208038c156eacf8f13f ]
A user reported [0] hitting the WARN_ON in fib_info_nh:
[ 8633.839816] ------------[ cut here ]------------
[ 8633.839819] WARNING: CPU: 0 PID: 1719 at include/net/nexthop.h:251 fib_select_path+0x303/0x381
...
[ 8633.839846] RIP: 0010:fib_select_path+0x303/0x381
...
[ 8633.839848] RSP: 0018:ffffb04d407f7d00 EFLAGS: 00010286
[ 8633.839850] RAX: 0000000000000000 RBX: ffff9460b9897ee8 RCX: 00000000000000fe
[ 8633.839851] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 8633.839852] RBP: ffff946076049850 R08: 0000000059263a83 R09: ffff9460840e4000
[ 8633.839853] R10: 0000000000000014 R11: 0000000000000000 R12: ffffb04d407f7dc0
[ 8633.839854] R13: ffffffffa4ce3240 R14: 0000000000000000 R15: ffff9460b7681f60
[ 8633.839857] FS: 00007fcac2e02700(0000) GS:ffff9460bdc00000(0000) knlGS:0000000000000000
[ 8633.839858] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8633.839859] CR2: 00007f27beb77e28 CR3: 0000000077734000 CR4: 00000000000006f0
[ 8633.839867] Call Trace:
[ 8633.839871] ip_route_output_key_hash_rcu+0x421/0x890
[ 8633.839873] ip_route_output_key_hash+0x5e/0x80
[ 8633.839876] ip_route_output_flow+0x1a/0x50
[ 8633.839878] __ip4_datagram_connect+0x154/0x310
[ 8633.839880] ip4_datagram_connect+0x28/0x40
[ 8633.839882] __sys_connect+0xd6/0x100
...The WARN_ON is triggered in fib_select_default which is invoked when there are multiple default routes. Update the function to use fib_info_nhc and convert the nexthop checks to use fib_nh_common.
Add test case that covers the affected code path.
[0] https://github.com/FRRouting/frr/issues/6089
--- net/ipv4/fib_semantics.c | 6 +++--- tools/testing/selftests/net/fib_nexthops.sh | 23 +++++++++++++++++++++++ 2 files changed, 26 insertions(+), 3 deletions(-)
net/ipv4/fib_semantics.c +3 -3
@@ -1999,7 +1999,7 @@ static void fib_select_default(const strhlist_for_each_entry_rcu (fa, fa_head, fa_list) {struct fib_info *next_fi = fa->fa_info; -struct fib_nh *nh; +struct fib_nh_common *nhc;if (fa->fa_slen != slen)continue ;
@@ -2022,8 +2022,8 @@ static void fib_select_default(const str fa->fa_type != RTN_UNICAST)continue ; - nh =fib_info_nh (next_fi,0 ); -if (!nh->fib_nh_gw4 || nh->fib_nh_scope !=RT_SCOPE_LINK ) + nhc =fib_info_nhc (next_fi,0 ); +if (!nhc->nhc_gw_family || nhc->nhc_scope !=RT_SCOPE_LINK )continue ;fib_alias_accessed (fa);
tools/testing/selftests/net/fib_nexthops.sh +23 -0
@@ -749,6 +749,29 @@ ipv4_fcnal_runtime() run_cmd "ip netns exec me ping -c1 -w1 172.16.101.1" log_test $? 0 "Ping - multipath" + run_cmd "$IP ro delete 172.16.101.1/32 nhid 122" + + # + # multiple default routes + # - tests fib_select_default + run_cmd "$IP nexthop add id 501 via 172.16.1.2 dev veth1" + run_cmd "$IP ro add default nhid 501" + run_cmd "$IP ro add default via 172.16.1.3 dev veth1 metric 20" + run_cmd "ip netns exec me ping -c1 -w1 172.16.101.1" + log_test $? 0 "Ping - multiple default routes, nh first" + + # flip the order + run_cmd "$IP ro del default nhid 501" + run_cmd "$IP ro del default via 172.16.1.3 dev veth1 metric 20" + run_cmd "$IP ro add default via 172.16.1.2 dev veth1 metric 20" + run_cmd "$IP nexthop replace id 501 via 172.16.1.3 dev veth1" + run_cmd "$IP ro add default nhid 501 metric 20" + run_cmd "ip netns exec me ping -c1 -w1 172.16.101.1" + log_test $? 0 "Ping - multiple default routes, nh second" + + run_cmd "$IP nexthop delete nhid 501" + run_cmd "$IP ro del default" + # # IPv4 with blackhole nexthops #
Greg Kroah-Hartman
maintainerPATCH 59/168 ipv6: fix restrict IPV6_ADDRFORM operation
In reply to Greg Kroah-HartmanFrom: John Haxby <[email protected]>
[ Upstream commit 82c9ae440857840c56e05d4fb1427ee032531346 ]
Commit b6f6118901d1 ("ipv6: restrict IPV6_ADDRFORM operation") fixed a problem found by syzbot an unfortunate logic error meant that it also broke IPV6_ADDRFORM.
Rearrange the checks so that the earlier test is just one of the series of checks made before moving the socket from IPv6 to IPv4.
--- net/ipv6/ipv6_sockglue.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
net/ipv6/ipv6_sockglue.c +6 -7
@@ -183,15 +183,14 @@ static int do_ipv6_setsockopt(struct soc retv = -EBUSY ;break ; } - }else if (sk->sk_protocol ==IPPROTO_TCP ) { -if (sk->sk_prot != &tcpv6_prot) { - retv = -EBUSY ; -break ; - } -break ; - }else { + } +if (sk->sk_protocol ==IPPROTO_TCP && + sk->sk_prot != &tcpv6_prot) { + retv = -EBUSY ;break ; } +if (sk->sk_protocol !=IPPROTO_TCP ) +break ;if (sk->sk_state !=TCP_ESTABLISHED ) { retv = -ENOTCONN ;break ;
Greg Kroah-Hartman
maintainerPATCH 60/168 macsec: avoid to set wrong mtu
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 7f327080364abccf923fa5a5b24e038eb0ba1407 ]
When a macsec interface is created, the mtu is calculated with the lower interface's mtu value.
If the mtu of lower interface is lower than the length, which is needed by macsec interface, macsec's mtu value will be overflowed. So, if the lower interface's mtu is too low, macsec interface's mtu should be set to 0.
Test commands:
ip link add dummy0 mtu 10 type dummy
ip link add macsec0 link dummy0 type macsec
ip link show macsec0
Before:
11: macsec0@dummy0: <BROADCAST,MULTICAST,M-DOWN> mtu 4294967274
After:
11: macsec0@dummy0: <BROADCAST,MULTICAST,M-DOWN> mtu 0
--- drivers/net/macsec.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/net/macsec.c +8 -4
@@ -3226,11 +3226,11 @@ static int macsec_newlink(struct net *ne struct netlink_ext_ack *extack) {struct macsec_dev *macsec =macsec_priv (dev); +rx_handler_func_t *rx_handler; +u8 icv_len =DEFAULT_ICV_LEN ;struct net_device *real_dev; -int err; +int err, mtu;sci_t sci; -u8 icv_len =DEFAULT_ICV_LEN ; -rx_handler_func_t *rx_handler;if (!tb[IFLA_LINK ])return -EINVAL ;
@@ -3246,7 +3246,11 @@ static int macsec_newlink(struct net *neif (data && data[IFLA_MACSEC_ICV_LEN ]) icv_len =nla_get_u8 (data[IFLA_MACSEC_ICV_LEN ]); - dev->mtu = real_dev->mtu - icv_len -macsec_extra_len (true); + mtu = real_dev->mtu - icv_len -macsec_extra_len (true); +if (mtu <0 ) + dev->mtu =0 ; +else + dev->mtu = mtu; rx_handler =rtnl_dereference (real_dev->rx_handler);if (rx_handler && rx_handler != macsec_handle_frame)
Greg Kroah-Hartman
maintainerPATCH 61/168 macvlan: fix null dereference in macvlan_device_event()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 4dee15b4fd0d61ec6bbd179238191e959d34cf7a ]
In the macvlan_device_event(), the list_first_entry_or_null() is used. This function could return null pointer if there is no node. But, the macvlan module doesn't check the null pointer.
So, null-ptr-deref would occur.
bond0
|
+----+-----+
| |
macvlan0 macvlan1
| |
dummy0 dummy1The problem scenario.
If dummy1 is removed,
1. ->dellink() of dummy1 is called.
2. NETDEV_UNREGISTER of dummy1 notification is sent to macvlan module.
3. ->dellink() of macvlan1 is called.
4. NETDEV_UNREGISTER of macvlan1 notification is sent to bond module.
5. __bond_release_one() is called and it internally calls dev_set_mac_address().
6. dev_set_mac_address() calls the ->ndo_set_mac_address() of macvlan1, which is macvlan_set_mac_address().
7. macvlan_set_mac_address() calls the dev_set_mac_address() with dummy1.
8. NETDEV_CHANGEADDR of dummy1 is sent to macvlan module.
9. In the macvlan_device_event(), it calls list_first_entry_or_null(). At this point, dummy1 and macvlan1 were removed.
So, list_first_entry_or_null() will return NULL.
Test commands:
ip netns add nst
ip netns exec nst ip link add bond0 type bond for i in {0..10}
do
ip netns exec nst ip link add dummy$i type dummy ip netns exec nst ip link add macvlan$i link dummy$i \
type macvlan mode passthru
ip netns exec nst ip link set macvlan$i master bond0
done
ip netns del nst
Splat looks like:
[ 40.585687][ T146] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP DEI [ 40.587249][ T146] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 40.588342][ T146] CPU: 1 PID: 146 Comm: kworker/u8:2 Not tainted 5.7.0-rc1+ #532 [ 40.589299][ T146] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 40.590469][ T146] Workqueue: netns cleanup_net [ 40.591045][ T146] RIP: 0010:macvlan_device_event+0x4e2/0x900 [macvlan] [ 40.591905][ T146] Code: 00 00 00 00 00 fc ff df 80 3c 06 00 0f 85 45 02 00 00 48 89 da 48 b8 00 00 00 00 00 fc ff d2 [ 40.594126][ T146] RSP: 0018:ffff88806116f4a0 EFLAGS: 00010246 [ 40.594783][ T146] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 40.595653][ T146] RDX: 0000000000000000 RSI: ffff88806547ddd8 RDI: ffff8880540f1360 [ 40.596495][ T146] RBP: ffff88804011a808 R08: fffffbfff4fb8421 R09: fffffbfff4fb8421 [ 40.597377][ T146] R10: ffffffffa7dc2107 R11: 0000000000000000 R12: 0000000000000008 [ 40.598186][ T146] R13: ffff88804011a000 R14: ffff8880540f1000 R15: 1ffff1100c22de9a [ 40.599012][ T146] FS: 0000000000000000(0000) GS:ffff888067800000(0000) knlGS:0000000000000000 [ 40.600004][ T146] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.600665][ T146] CR2: 00005572d3a807b8 CR3: 000000005fcf4003 CR4: 00000000000606e0 [ 40.601485][ T146] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 40.602461][ T146] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 40.603443][ T146] Call Trace: [ 40.603871][ T146] ? nf_tables_dump_setelem+0xa0/0xa0 [nf_tables] [ 40.604587][ T146] ? macvlan_uninit+0x100/0x100 [macvlan] [ 40.605212][ T146] ? __module_text_address+0x13/0x140 [ 40.605842][ T146] notifier_call_chain+0x90/0x160 [ 40.606477][ T146] dev_set_mac_address+0x28e/0x3f0 [ 40.607117][ T146] ? netdev_notify_peers+0xc0/0xc0 [ 40.607762][ T146] ? __module_text_address+0x13/0x140 [ 40.608440][ T146] ? notifier_call_chain+0x90/0x160 [ 40.609097][ T146] ? dev_set_mac_address+0x1f0/0x3f0 [ 40.609758][ T146] dev_set_mac_address+0x1f0/0x3f0 [ 40.610402][ T146] ? __local_bh_enable_ip+0xe9/0x1b0 [ 40.611071][ T146] ? bond_hw_addr_flush+0x77/0x100 [bonding] [ 40.611823][ T146] ? netdev_notify_peers+0xc0/0xc0 [ 40.612461][ T146] ? bond_hw_addr_flush+0x77/0x100 [bonding] [ 40.613213][ T146] ? bond_hw_addr_flush+0x77/0x100 [bonding] [ 40.613963][ T146] ? __local_bh_enable_ip+0xe9/0x1b0 [ 40.614631][ T146] ? bond_time_in_interval.isra.31+0x90/0x90 [bonding] [ 40.615484][ T146] ? __bond_release_one+0x9f0/0x12c0 [bonding] [ 40.616230][ T146] __bond_release_one+0x9f0/0x12c0 [bonding] [ 40.616949][ T146] ? bond_enslave+0x47c0/0x47c0 [bonding] [ 40.617642][ T146] ? lock_downgrade+0x730/0x730 [ 40.618218][ T146] ? check_flags.part.42+0x450/0x450 [ 40.618850][ T146] ? __mutex_unlock_slowpath+0xd0/0x670 [ 40.619519][ T146] ? trace_hardirqs_on+0x30/0x180 [ 40.620117][ T146] ? wait_for_completion+0x250/0x250 [ 40.620754][ T146] bond_netdev_event+0x822/0x970 [bonding] [ 40.621460][ T146] ? __module_text_address+0x13/0x140 [ 40.622097][ T146] notifier_call_chain+0x90/0x160 [ 40.622806][ T146] rollback_registered_many+0x660/0xcf0 [ 40.623522][ T146] ? netif_set_real_num_tx_queues+0x780/0x780 [ 40.624290][ T146] ? notifier_call_chain+0x90/0x160 [ 40.624957][ T146] ? netdev_upper_dev_unlink+0x114/0x180 [ 40.625686][ T146] ? __netdev_adjacent_dev_unlink_neighbour+0x30/0x30 [ 40.626421][ T146] ? mutex_is_locked+0x13/0x50 [ 40.627016][ T146] ? unregister_netdevice_queue+0xf2/0x240 [ 40.627663][ T146] unregister_netdevice_many.part.134+0x13/0x1b0 [ 40.628362][ T146] default_device_exit_batch+0x2d9/0x390 [ 40.628987][ T146] ? unregister_netdevice_many+0x40/0x40 [ 40.629615][ T146] ? dev_change_net_namespace+0xcb0/0xcb0 [ 40.630279][ T146] ? prepare_to_wait_exclusive+0x2e0/0x2e0 [ 40.630943][ T146] ? ops_exit_list.isra.9+0x97/0x140 [ 40.631554][ T146] cleanup_net+0x441/0x890
[ ... ]
--- drivers/net/macvlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/macvlan.c +1 -1
@@ -1704,7 +1704,7 @@ static int macvlan_device_event(struct n struct macvlan_dev, list); -if (macvlan_sync_address (vlan->dev, dev->dev_addr)) +if (vlan &&macvlan_sync_address (vlan->dev, dev->dev_addr))return NOTIFY_BAD ;break ;
Greg Kroah-Hartman
maintainerPATCH 62/168 mlxsw: Fix some IS_ERR() vs NULL bugs
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit c391eb8366ae052d571bb2841f1ccb4d39f3ceb8 ]
The mlxsw_sp_acl_rulei_create() function is supposed to return an error pointer from mlxsw_afa_block_create(). The problem is that these functions both return NULL instead of error pointers. Half the callers expect NULL and half expect error pointers so it could lead to a NULL dereference on failure.
This patch changes both of them to return error pointers and changes all the callers which checked for NULL to check for IS_ERR() instead.
--- drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c | 4 ++-- drivers/net/ethernet/mellanox/mlxsw/spectrum2_acl_tcam.c | 4 ++-- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c | 2 +- drivers/net/ethernet/mellanox/mlxsw/spectrum_mr_tcam.c | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c +2 -2
@@ -316,7 +316,7 @@ struct mlxsw_afa_block *mlxsw_afa_block_ block =kzalloc (sizeof (*block),GFP_KERNEL );if (!block) -return NULL ; +return ERR_PTR (-ENOMEM );INIT_LIST_HEAD (&block->resource_list); block->afa = mlxsw_afa;
@@ -344,7 +344,7 @@ err_second_set_create:mlxsw_afa_set_destroy (block->first_set); err_first_set_create:kfree (block); -return NULL ; +return ERR_PTR (-ENOMEM ); }EXPORT_SYMBOL (mlxsw_afa_block_create);
drivers/net/ethernet/mellanox/mlxsw/spectrum2_acl_tcam.c +2 -2
@@ -88,8 +88,8 @@ static int mlxsw_sp2_acl_tcam_init(struc* to be written using PEFA register to all indexes for all regions. */ afa_block =mlxsw_afa_block_create (mlxsw_sp->afa); -if (!afa_block) { - err = -ENOMEM ; +if (IS_ERR (afa_block)) { + err =PTR_ERR (afa_block); goto err_afa_block; } err =mlxsw_afa_block_continue (afa_block);
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c +1 -1
@@ -444,7 +444,7 @@ mlxsw_sp_acl_rulei_create(struct mlxsw_s rulei =kzalloc (sizeof (*rulei),GFP_KERNEL );if (!rulei) -return NULL ; +return ERR_PTR (-ENOMEM );if (afa_block) { rulei->act_block = afa_block;
drivers/net/ethernet/mellanox/mlxsw/spectrum_mr_tcam.c +2 -2
@@ -199,8 +199,8 @@ mlxsw_sp_mr_tcam_afa_block_create(structint err; afa_block =mlxsw_afa_block_create (mlxsw_sp->afa); -if (!afa_block) -return ERR_PTR (-ENOMEM ); +if (IS_ERR (afa_block)) +return afa_block; err =mlxsw_afa_block_append_allocated_counter (afa_block, counter_index);
Greg Kroah-Hartman
maintainerPATCH 63/168 net: bcmgenet: correct per TX/RX ring statistics
In reply to Greg Kroah-HartmanFrom: Doug Berger <[email protected]>
[ Upstream commit a6d0b83f25073bdf08b8547aeff961a62c6ab229 ]
The change to track net_device_stats per ring to better support SMP missed updating the rx_dropped member.
The ndo_get_stats method is also needed to combine the results for ethtool statistics (-S) before filling in the ethtool structure.
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +3 -0
@@ -995,6 +995,8 @@ static void bcmgenet_get_ethtool_stats(sif (netif_running (dev))bcmgenet_update_mib_counters (priv); + dev->netdev_ops->ndo_get_stats (dev); +for (i =0 ; i <BCMGENET_STATS_LEN ; i++) {const struct bcmgenet_stats *s;char *p;
@@ -3204,6 +3206,7 @@ static struct net_device_stats *bcmgenet dev->stats.rx_packets = rx_packets; dev->stats.rx_errors = rx_errors; dev->stats.rx_missed_errors = rx_errors; + dev->stats.rx_dropped = rx_dropped;return &dev->stats; }
Greg Kroah-Hartman
maintainerPATCH 64/168 net/mlx4_en: avoid indirect call in TX completion
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 310660a14b74c380b0ef5c12b66933d6a3d1b59f ]
Commit 9ecc2d86171a ("net/mlx4_en: add xdp forwarding and data write support") brought another indirect call in fast path.
Use INDIRECT_CALL_2() helper to avoid the cost of the indirect call when/if CONFIG_RETPOLINE=y
--- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_tx.c +13 -1
@@ -43,6 +43,7 @@#include <linux/ip.h> #include <linux/ipv6.h> #include <linux/moduleparam.h> +#include <linux/indirect_call_wrapper.h> #include "mlx4_en.h"
@@ -261,6 +262,10 @@ static void mlx4_en_stamp_wqe(struct mlx } } +INDIRECT_CALLABLE_DECLARE(u32 mlx4_en_free_tx_desc(struct mlx4_en_priv *priv, +struct mlx4_en_tx_ring *ring, +int index,u64 timestamp, +int napi_mode)); u32 mlx4_en_free_tx_desc(struct mlx4_en_priv *priv, struct mlx4_en_tx_ring *ring,
@@ -329,6 +334,11 @@ u32 mlx4_en_free_tx_desc(struct mlx4_en_return tx_info->nr_txbb; } +INDIRECT_CALLABLE_DECLARE(u32 mlx4_en_recycle_tx_desc(struct mlx4_en_priv *priv, +struct mlx4_en_tx_ring *ring, +int index,u64 timestamp, +int napi_mode)); + u32 mlx4_en_recycle_tx_desc(struct mlx4_en_priv *priv, struct mlx4_en_tx_ring *ring, int index, u64 timestamp,
@@ -449,7 +459,9 @@ bool mlx4_en_process_tx_cq(struct net_de timestamp =mlx4_en_get_cqe_ts (cqe);/* free next descriptor */ - last_nr_txbb = ring->free_tx_desc ( + last_nr_txbb =INDIRECT_CALL_2 (ring->free_tx_desc, + mlx4_en_free_tx_desc, + mlx4_en_recycle_tx_desc, priv, ring, ring_index, timestamp, napi_budget);
Greg Kroah-Hartman
maintainerPATCH 65/168 net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
In reply to Greg Kroah-HartmanFrom: Xiyu Yang <[email protected]>
[ Upstream commit d03f228470a8c0a22b774d1f8d47071e0de4f6dd ]
nr_add_node() invokes nr_neigh_get_dev(), which returns a local reference of the nr_neigh object to "nr_neigh" with increased refcnt.
When nr_add_node() returns, "nr_neigh" becomes invalid, so the refcount should be decreased to keep refcount balanced.
The issue happens in one normal path of nr_add_node(), which forgets to decrease the refcnt increased by nr_neigh_get_dev() and causes a refcnt leak. It should decrease the refcnt before the function returns like other normal paths do.
Fix this issue by calling nr_neigh_put() before the nr_add_node() returns.
--- net/netrom/nr_route.c | 1 + 1 file changed, 1 insertion(+)
net/netrom/nr_route.c +1 -0
@@ -208,6 +208,7 @@ static int __must_check nr_add_node(ax25/* refcount initialized at 1 */ spin_unlock_bh (&nr_node_list_lock); +nr_neigh_put (nr_neigh);return 0 ; }nr_node_lock (nr_node);
Greg Kroah-Hartman
maintainerPATCH 66/168 net: openvswitch: ovs_ct_exit to be done under ovs_lock
In reply to Greg Kroah-HartmanFrom: Tonghao Zhang <[email protected]>
[ Upstream commit 27de77cec985233bdf6546437b9761853265c505 ]
syzbot wrote:
| ============================= | WARNING: suspicious RCU usage | 5.7.0-rc1+ #45 Not tainted | ----------------------------- | net/openvswitch/conntrack.c:1898 RCU-list traversed in non-reader section!! | | other info that might help us debug this: | rcu_scheduler_active = 2, debug_locks = 1 | ... | | stack backtrace: | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014 | Workqueue: netns cleanup_net | Call Trace: | ... | ovs_ct_exit | ovs_exit_net | ops_exit_list.isra.7 | cleanup_net | process_one_work | worker_thread
To avoid that warning, invoke the ovs_ct_exit under ovs_lock and add lockdep_ovsl_is_held as optional lockdep expression.
--- net/openvswitch/conntrack.c | 3 ++- net/openvswitch/datapath.c | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-)
net/openvswitch/conntrack.c +2 -1
@@ -1890,7 +1890,8 @@ static void ovs_ct_limit_exit(struct netstruct hlist_head *head = &info->limits[i];struct ovs_ct_limit *ct_limit; -hlist_for_each_entry_rcu (ct_limit, head, hlist_node) +hlist_for_each_entry_rcu (ct_limit, head, hlist_node, +lockdep_ovsl_is_held ())kfree_rcu (ct_limit, rcu); }kfree (ovs_net->ct_limit_info->limits);
net/openvswitch/datapath.c +3 -1
@@ -2430,8 +2430,10 @@ static void __net_exit ovs_exit_net(strustruct net *net;LIST_HEAD (head); -ovs_ct_exit (dnet);ovs_lock (); + +ovs_ct_exit (dnet); +list_for_each_entry_safe (dp, dp_next, &ovs_net->dps, list_node)__dp_destroy (dp);
Greg Kroah-Hartman
maintainerPATCH 67/168 net: stmmac: dwmac-meson8b: Add missing boundary to RGMII TX clock array
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
[ Upstream commit f0212a5ebfa6cd789ab47666b9cc169e6e688732 ]
Running with KASAN on a VIM3L systems leads to the following splat when probing the Ethernet device:
==================================================================
BUG: KASAN: global-out-of-bounds in _get_maxdiv+0x74/0xd8
Read of size 4 at addr ffffa000090615f4 by task systemd-udevd/139
CPU: 1 PID: 139 Comm: systemd-udevd Tainted: G E 5.7.0-rc1-00101-g8624b7577b9c #781
Hardware name: amlogic w400/w400, BIOS 2020.01-rc5 03/12/2020
Call trace:
dump_backtrace+0x0/0x2a0
show_stack+0x20/0x30
dump_stack+0xec/0x148
print_address_description.isra.12+0x70/0x35c
__kasan_report+0xfc/0x1d4
kasan_report+0x4c/0x68
__asan_load4+0x9c/0xd8
_get_maxdiv+0x74/0xd8
clk_divider_bestdiv+0x74/0x5e0
clk_divider_round_rate+0x80/0x1a8
clk_core_determine_round_nolock.part.9+0x9c/0xd0
clk_core_round_rate_nolock+0xf0/0x108
clk_hw_round_rate+0xac/0xf0
clk_factor_round_rate+0xb8/0xd0
clk_core_determine_round_nolock.part.9+0x9c/0xd0
clk_core_round_rate_nolock+0xf0/0x108
clk_core_round_rate_nolock+0xbc/0x108
clk_core_set_rate_nolock+0xc4/0x2e8
clk_set_rate+0x58/0xe0
meson8b_dwmac_probe+0x588/0x72c [dwmac_meson8b]
platform_drv_probe+0x78/0xd8
really_probe+0x158/0x610
driver_probe_device+0x140/0x1b0
device_driver_attach+0xa4/0xb0
__driver_attach+0xcc/0x1c8
bus_for_each_dev+0xf4/0x168
driver_attach+0x3c/0x50
bus_add_driver+0x238/0x2e8
driver_register+0xc8/0x1e8
__platform_driver_register+0x88/0x98
meson8b_dwmac_driver_init+0x28/0x1000 [dwmac_meson8b]
do_one_initcall+0xa8/0x328
do_init_module+0xe8/0x368
load_module+0x3300/0x36b0
__do_sys_finit_module+0x120/0x1a8
__arm64_sys_finit_module+0x4c/0x60
el0_svc_common.constprop.2+0xe4/0x268
do_el0_svc+0x98/0xa8
el0_svc+0x24/0x68
el0_sync_handler+0x12c/0x318
el0_sync+0x158/0x180
The buggy address belongs to the variable:
div_table.63646+0x34/0xfffffffffffffa40 [dwmac_meson8b]
Memory state around the buggy address:
ffffa00009061480: fa fa fa fa 00 00 00 01 fa fa fa fa 00 00 00 00
ffffa00009061500: 05 fa fa fa fa fa fa fa 00 04 fa fa fa fa fa fa
>ffffa00009061580: 00 03 fa fa fa fa fa fa 00 00 00 00 00 00 fa fa
^
ffffa00009061600: fa fa fa fa 00 01 fa fa fa fa fa fa 01 fa fa fa
ffffa00009061680: fa fa fa fa 00 01 fa fa fa fa fa fa 04 fa fa fa
==================================================================Digging into this indeed shows that the clock divider array is lacking a final fence, and that the clock subsystems goes in the weeds. Oh well.
Let's add the empty structure that indicates the end of the array.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +1 -0
@@ -119,6 +119,7 @@ static int meson8b_init_rgmii_tx_clk(str { .div = 5, .val = 5, }, { .div = 6, .val = 6, }, { .div = 7, .val = 7, }, + { /* end of array */ } }; clk_configs = devm_kzalloc(dev, sizeof(*clk_configs), GFP_KERNEL);
Greg Kroah-Hartman
maintainerPATCH 68/168 net/x25: Fix x25_neigh refcnt leak when receiving frame
In reply to Greg Kroah-HartmanFrom: Xiyu Yang <[email protected]>
[ Upstream commit f35d12971b4d814cdb2f659d76b42f0c545270b6 ]
x25_lapb_receive_frame() invokes x25_get_neigh(), which returns a reference of the specified x25_neigh object to "nb" with increased refcnt.
When x25_lapb_receive_frame() returns, local variable "nb" becomes invalid, so the refcount should be decreased to keep refcount balanced.
The reference counting issue happens in one path of x25_lapb_receive_frame(). When pskb_may_pull() returns false, the function forgets to decrease the refcnt increased by x25_get_neigh(), causing a refcnt leak.
Fix this issue by calling x25_neigh_put() when pskb_may_pull() returns false.
--- net/x25/x25_dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/x25/x25_dev.c +3 -1
@@ -115,8 +115,10 @@ int x25_lapb_receive_frame(struct sk_buf goto drop; } -if (!pskb_may_pull (skb,1 )) +if (!pskb_may_pull (skb,1 )) { +x25_neigh_put (nb);return 0 ; + }switch (skb->data[0 ]) {
Greg Kroah-Hartman
maintainerPATCH 69/168 sched: etf: do not assume all sockets are full blown
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit a1211bf9a7774706722ba3b18c6157d980319f79 ]
skb->sk does not always point to a full blown socket, we need to use sk_fullsock() before accessing fields which only make sense on full socket.
BUG: KASAN: use-after-free in report_sock_error+0x286/0x300 net/sched/sch_etf.c:141 Read of size 1 at addr ffff88805eb9b245 by task syz-executor.5/9630 CPU: 1 PID: 9630 Comm: syz-executor.5 Not tainted 5.7.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x315 mm/kasan/report.c:382 __kasan_report.cold+0x35/0x4d mm/kasan/report.c:511 kasan_report+0x33/0x50 mm/kasan/common.c:625 report_sock_error+0x286/0x300 net/sched/sch_etf.c:141 etf_enqueue_timesortedlist+0x389/0x740 net/sched/sch_etf.c:170 __dev_xmit_skb net/core/dev.c:3710 [inline] __dev_queue_xmit+0x154a/0x30a0 net/core/dev.c:4021 neigh_hh_output include/net/neighbour.h:499 [inline] neigh_output include/net/neighbour.h:508 [inline] ip6_finish_output2+0xfb5/0x25b0 net/ipv6/ip6_output.c:117 __ip6_finish_output+0x442/0xab0 net/ipv6/ip6_output.c:143 ip6_finish_output+0x34/0x1f0 net/ipv6/ip6_output.c:153 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0x239/0x810 net/ipv6/ip6_output.c:176 dst_output include/net/dst.h:435 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_xmit+0xe1a/0x2090 net/ipv6/ip6_output.c:280 tcp_v6_send_synack+0x4e7/0x960 net/ipv6/tcp_ipv6.c:521 tcp_rtx_synack+0x10d/0x1a0 net/ipv4/tcp_output.c:3916 inet_rtx_syn_ack net/ipv4/inet_connection_sock.c:669 [inline] reqsk_timer_handler+0x4c2/0xb40 net/ipv4/inet_connection_sock.c:763 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1405 expire_timers kernel/time/timer.c:1450 [inline] __run_timers kernel/time/timer.c:1774 [inline] __run_timers kernel/time/timer.c:1741 [inline] run_timer_softirq+0x623/0x1600 kernel/time/timer.c:1787 __do_softirq+0x26c/0x9f7 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x192/0x1d0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:546 [inline] smp_apic_timer_interrupt+0x19e/0x600 arch/x86/kernel/apic/apic.c:1140 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 </IRQ> RIP: 0010:des_encrypt+0x157/0x9c0 lib/crypto/des.c:792 Code: 85 22 06 00 00 41 31 dc 41 8b 4d 04 44 89 e2 41 83 e4 3f 4a 8d 3c a5 60 72 72 88 81 e2 3f 3f 3f 3f 48 89 f8 48 c1 e8 03 31 d9 <0f> b6 34 28 48 89 f8 c1 c9 04 83 e0 07 83 c0 03 40 38 f0 7c 09 40 RSP: 0018:ffffc90003b5f6c0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff10e4e55 RBX: 00000000d2f846d0 RCX: 00000000d2f846d0 RDX: 0000000012380612 RSI: ffffffff839863ca RDI: ffffffff887272a8 RBP: dffffc0000000000 R08: ffff888091d0a380 R09: 0000000000800081 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000012 R13: ffff8880a8ae8078 R14: 00000000c545c93e R15: 0000000000000006 cipher_crypt_one crypto/cipher.c:75 [inline] crypto_cipher_encrypt_one+0x124/0x210 crypto/cipher.c:82 crypto_cbcmac_digest_update+0x1b5/0x250 crypto/ccm.c:830 crypto_shash_update+0xc4/0x120 crypto/shash.c:119 shash_ahash_update+0xa3/0x110 crypto/shash.c:246 crypto_ahash_update include/crypto/hash.h:547 [inline] hash_sendmsg+0x518/0xad0 crypto/algif_hash.c:102 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:672 ____sys_sendmsg+0x308/0x7e0 net/socket.c:2362 ___sys_sendmsg+0x100/0x170 net/socket.c:2416 __sys_sendmmsg+0x195/0x480 net/socket.c:2506 __do_sys_sendmmsg net/socket.c:2535 [inline] __se_sys_sendmmsg net/socket.c:2532 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2532 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 RIP: 0033:0x45c829 Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f6d9528ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00000000004fc080 RCX: 000000000045c829 RDX: 0000000000000001 RSI: 0000000020002640 RDI: 0000000000000004 RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000000008d7 R14: 00000000004cb7aa R15: 00007f6d9528f6d4
--- net/sched/sch_etf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/sched/sch_etf.c +4 -3
@@ -82,7 +82,7 @@ static bool is_packet_valid(struct Qdiscif (q->skip_sock_check) goto skip; -if (!sk) +if (!sk || !sk_fullsock (sk))return false;if (!sock_flag (sk,SOCK_TXTIME ))
@@ -137,8 +137,9 @@ static void report_sock_error(struct sk_struct sock_exterr_skb *serr;struct sk_buff *clone;ktime_t txtime = skb->tstamp; +struct sock *sk = skb->sk; -if (!skb->sk || !(skb->sk->sk_txtime_report_errors)) +if (!sk || !sk_fullsock (sk) || !(sk->sk_txtime_report_errors))return ; clone =skb_clone (skb,GFP_ATOMIC );
@@ -154,7 +155,7 @@ static void report_sock_error(struct sk_ serr->ee.ee_data = (txtime >>32 );/* high part of tstamp */ serr->ee.ee_info = txtime;/* low part of tstamp */ -if (sock_queue_err_skb (skb->sk, clone)) +if (sock_queue_err_skb (sk, clone))kfree_skb (clone); }
Greg Kroah-Hartman
maintainerPATCH 70/168 selftests: Fix suppress test in fib_tests.sh
In reply to Greg Kroah-HartmanFrom: David Ahern <[email protected]>
[ Upstream commit 2c1dd4c110627c2a4f006643f074119205cfcff4 ]
fib_tests is spewing errors:
...
Cannot open network namespace "ns1": No such file or directory Cannot open network namespace "ns1": No such file or directory Cannot open network namespace "ns1": No such file or directory Cannot open network namespace "ns1": No such file or directory
ping: connect: Network is unreachable
Cannot open network namespace "ns1": No such file or directory Cannot open network namespace "ns1": No such file or directory
...
Each test entry in fib_tests is supposed to do its own setup and cleanup. Right now the $IP commands in fib_suppress_test are failing because there is no ns1. Add the setup/cleanup and logging expected for each test.
--- tools/testing/selftests/net/fib_tests.sh | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
tools/testing/selftests/net/fib_tests.sh +8 -2
@@ -618,16 +618,22 @@ fib_nexthop_test() fib_suppress_test() { + echo + echo "FIB rule with suppress_prefixlength" + setup + $IP link add dummy1 type dummy $IP link set dummy1 up $IP -6 route add default dev dummy1 $IP -6 rule add table main suppress_prefixlength 0 - ping -f -c 1000 -W 1 1234::1 || true + ping -f -c 1000 -W 1 1234::1 >/dev/null 2>&1 $IP -6 rule del table main suppress_prefixlength 0 $IP link del dummy1 # If we got here without crashing, we're good. - return 0 + log_test 0 0 "FIB rule suppress test" + + cleanup } ################################################################################
Greg Kroah-Hartman
maintainerPATCH 71/168 tcp: cache line align MAX_TCP_HEADER
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 9bacd256f1354883d3c1402655153367982bba49 ]
TCP stack is dumb in how it cooks its output packets.
Depending on MAX_HEADER value, we might chose a bad ending point for the headers.
If we align the end of TCP headers to cache line boundary, we make sure to always use the smallest number of cache lines, which always help.
--- include/net/tcp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/tcp.h +1 -1
@@ -50,7 +50,7 @@ extern struct inet_hashinfo tcp_hashinfoextern struct percpu_counter tcp_orphan_count;void tcp_time_wait (struct sock *sk,int state,int timeo); -#define MAX_TCP_HEADER (128 + MAX_HEADER) +#define MAX_TCP_HEADER L1_CACHE_ALIGN(128 + MAX_HEADER)#define MAX_TCP_OPTION_SPACE 40#define TCP_MIN_SND_MSS 48#define TCP_MIN_GSO_SIZE (TCP_MIN_SND_MSS - MAX_TCP_OPTION_SPACE)
Greg Kroah-Hartman
maintainerPATCH 72/168 team: fix hang in team_mode_get()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 1c30fbc76b8f0c07c92a8ca4cd7c456612e17eb5 ]
When team mode is changed or set, the team_mode_get() is called to check whether the mode module is inserted or not. If the mode module is not inserted, it calls the request_module().
In the request_module(), it creates a child process, which is the "modprobe" process and waits for the done of the child process. At this point, the following locks were used. down_read(&cb_lock()); by genl_rcv()
genl_lock(); by genl_rcv_msc()
rtnl_lock(); by team_nl_cmd_options_set()
mutex_lock(&team->lock); by team_nl_team_get()Concurrently, the team module could be removed by rmmod or "modprobe -r" The __exit function of team module is team_module_exit(), which calls team_nl_fini() and it tries to acquire following locks.
down_write(&cb_lock);
genl_lock();Because of the genl_lock() and cb_lock, this process can't be finished earlier than request_module() routine.
The problem secenario.
CPU0 CPU1team_mode_get
request_module()
modprobe -r team_mode_roundrobin
team <--(B)
modprobe team <--(A)
team_mode_roundrobin
By request_module(), the "modprobe team_mode_roundrobin" command will be executed. At this point, the modprobe process will decide that the team module should be inserted before team_mode_roundrobin. Because the team module is being removed.
By the module infrastructure, the same module insert/remove operations can't be executed concurrently.
So, (A) waits for (B) but (B) also waits for (A) because of locks. So that the hang occurs at this point.
Test commands:
while :
do
teamd -d &
killall teamd &
modprobe -rv team_mode_roundrobin &
done
The approach of this patch is to hold the reference count of the team module if the team module is compiled as a module. If the reference count of the team module is not zero while request_module() is being called, the team module will not be removed at that moment.
So that the above scenario could not occur.
--- drivers/net/team/team.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/team/team.c +4 -0
@@ -468,6 +468,9 @@ static const struct team_mode *team_modestruct team_mode_item *mitem;const struct team_mode *mode =NULL ; +if (!try_module_get (THIS_MODULE )) +return NULL ; +spin_lock (&mode_list_lock); mitem =__find_mode (kind);if (!mitem) {
@@ -483,6 +486,7 @@ static const struct team_mode *team_mode }spin_unlock (&mode_list_lock); +module_put (THIS_MODULE );return mode; }
Greg Kroah-Hartman
maintainerPATCH 73/168 vrf: Fix IPv6 with qdisc and xfrm
In reply to Greg Kroah-HartmanFrom: David Ahern <[email protected]>
[ Upstream commit a53c102872ad6e34e1518e25899dc9498c27f8b1 ]
When a qdisc is attached to the VRF device, the packet goes down the ndo xmit function which is setup to send the packet back to the VRF driver which does a lookup to send the packet out. The lookup in the VRF driver is not considering xfrm policies. Change it to use ip6_dst_lookup_flow rather than ip6_route_output.
--- drivers/net/vrf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/vrf.c +2 -2
@@ -188,8 +188,8 @@ static netdev_tx_t vrf_process_v6_outbou fl6.flowi6_proto = iph->nexthdr; fl6.flowi6_flags =FLOWI_FLAG_SKIP_NH_OIF ; - dst =ip6_route_output (net,NULL , &fl6); -if (dst == dst_null) + dst =ip6_dst_lookup_flow (net,NULL , &fl6,NULL ); +if (IS_ERR (dst) || dst == dst_null) goto err;skb_dst_drop (skb);
Greg Kroah-Hartman
maintainerPATCH 74/168 net: dsa: b53: Lookup VID in ARL searches when VLAN is enabled
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 2e97b0cd1651a270f3a3fcf42115c51f3284c049 ]
When VLAN is enabled, and an ARL search is issued, we also need to compare the full {MAC,VID} tuple before returning a successful search result.
--- drivers/net/dsa/b53/b53_common.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/dsa/b53/b53_common.c +3 -0
@@ -1472,6 +1472,9 @@ static int b53_arl_read(struct b53_deviccontinue ;if ((mac_vid &ARLTBL_MAC_MASK ) != mac)continue ; +if (dev->vlan_enabled && + ((mac_vid >>ARLTBL_VID_S ) &ARLTBL_VID_MASK ) != vid) +continue ; *idx = i; }
Greg Kroah-Hartman
maintainerPATCH 75/168 net: dsa: b53: Fix valid setting for MDB entries
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit eab167f4851a19c514469dfa81147f77e17b5b20 ]
When support for the MDB entries was added, the valid bit was correctly changed to be assigned depending on the remaining port bitmask, that is, if there were no more ports added to the entry's port bitmask, the entry now becomes invalid. There was another assignment a few lines below that would override this which would invalidate entries even when there were still multiple ports left in the MDB entry.
--- drivers/net/dsa/b53/b53_common.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +0 -1
@@ -1515,7 +1515,6 @@ static int b53_arl_op(struct b53_devicememset (&ent,0 ,sizeof (ent)); ent.port = port; - ent.is_valid = is_valid; ent.vid = vid; ent.is_static = true;memcpy (ent.mac, addr,ETH_ALEN );
Greg Kroah-Hartman
maintainerPATCH 76/168 net: dsa: b53: Fix ARL register definitions
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit c2e77a18a7ed65eb48f6e389b6a59a0fd753646a ]
The ARL {MAC,VID} tuple and the forward entry were off by 0x10 bytes, which means that when we read/wrote from/to ARL bin index 0, we were actually accessing the ARLA_RWCTRL register.
--- drivers/net/dsa/b53/b53_regs.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/dsa/b53/b53_regs.h +2 -2
@@ -304,7 +304,7 @@* * BCM5325 and BCM5365 share most definitions below */ -#define B53_ARLTBL_MAC_VID_ENTRY (n) (0x10 * (n)) +#define B53_ARLTBL_MAC_VID_ENTRY (n) ((0x10 * (n)) + 0x10)#define ARLTBL_MAC_MASK 0xffffffffffffULL#define ARLTBL_VID_S 48#define ARLTBL_VID_MASK_25 0xff
@@ -316,7 +316,7 @@#define ARLTBL_VALID_25 BIT(63)/* ARL Table Data Entry N Registers (32 bit) */ -#define B53_ARLTBL_DATA_ENTRY (n) ((0x10 * (n)) + 0x08) +#define B53_ARLTBL_DATA_ENTRY (n) ((0x10 * (n)) + 0x18)#define ARLTBL_DATA_PORT_ID_MASK 0x1ff#define ARLTBL_TC (tc) ((3 & tc) << 11)#define ARLTBL_AGE BIT(14)
Greg Kroah-Hartman
maintainerPATCH 77/168 net: dsa: b53: Rework ARL bin logic
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 6344dbde6a27d10d16246d734b968f84887841e2 ]
When asking the ARL to read a MAC address, we will get a number of bins returned in a single read. Out of those bins, there can essentially be 3 states:
- all bins are full, we have no space left, and we can either replace an existing address or return that full condition
- the MAC address was found, then we need to return its bin index and modify that one, and only that one
- the MAC address was not found and we have a least one bin free, we use that bin index location then
The code would unfortunately fail on all counts.
--- drivers/net/dsa/b53/b53_common.c | 30 ++++++++++++++++++++++++++---- drivers/net/dsa/b53/b53_regs.h | 3 +++ 2 files changed, 29 insertions(+), 4 deletions(-)
drivers/net/dsa/b53/b53_common.c +26 -4
@@ -1450,6 +1450,7 @@ static int b53_arl_read(struct b53_devic u16 vid, struct b53_arl_entry *ent, u8 *idx, bool is_valid) { +DECLARE_BITMAP (free_bins ,B53_ARLTBL_MAX_BIN_ENTRIES );unsigned int i;int ret;
@@ -1457,6 +1458,8 @@ static int b53_arl_read(struct b53_devicif (ret)return ret; +bitmap_zero (free_bins, dev->num_arl_entries); +/* Read the bins */ for (i =0 ; i < dev->num_arl_entries; i++) {u64 mac_vid;
@@ -1468,16 +1471,24 @@ static int b53_arl_read(struct b53_devic B53_ARLTBL_DATA_ENTRY(i), &fwd_entry);b53_arl_to_entry (ent, mac_vid, fwd_entry); -if (!(fwd_entry &ARLTBL_VALID )) +if (!(fwd_entry &ARLTBL_VALID )) { +set_bit (i, free_bins);continue ; + }if ((mac_vid &ARLTBL_MAC_MASK ) != mac)continue ;if (dev->vlan_enabled && ((mac_vid >>ARLTBL_VID_S ) &ARLTBL_VID_MASK ) != vid)continue ; *idx = i; +return 0 ; } +if (bitmap_weight (free_bins, dev->num_arl_entries) ==0 ) +return -ENOSPC ; + + *idx =find_first_bit (free_bins, dev->num_arl_entries); +return -ENOENT ; }
@@ -1507,10 +1518,21 @@ static int b53_arl_op(struct b53_deviceif (op)return ret; -/* We could not find a matching MAC, so reset to a new entry */ -if (ret) { +switch (ret) { +case -ENOSPC : +dev_dbg (dev->dev,"{%pM,%.4d} no space left in ARL\n" , + addr, vid); +return is_valid ? ret :0 ; +case -ENOENT : +/* We could not find a matching MAC, so reset to a new entry */ +dev_dbg (dev->dev,"{%pM,%.4d} not found, using idx: %d\n" , + addr, vid, idx); fwd_entry =0 ; - idx =1 ; +break ; +default : +dev_dbg (dev->dev,"{%pM,%.4d} found, using idx: %d\n" , + addr, vid, idx); +break ; }memset (&ent,0 ,sizeof (ent));
drivers/net/dsa/b53/b53_regs.h +3 -0
@@ -323,6 +323,9 @@#define ARLTBL_STATIC BIT(15)#define ARLTBL_VALID BIT(16) +/* Maximum number of bin entries in the ARL for all switches */ +#define B53_ARLTBL_MAX_BIN_ENTRIES 4 +/* ARL Search Control Register (8 bit) */ #define B53_ARL_SRCH_CTL 0x50#define B53_ARL_SRCH_CTL_25 0x20
Greg Kroah-Hartman
maintainerPATCH 78/168 net: dsa: b53: b53_arl_rw_op() needs to select IVL or SVL
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 64fec9493f7dc9bdd7233bcfe98985c45bd0e3c1 ]
Flip the IVL_SVL_SELECT bit correctly based on the VLAN enable status, the default is to perform Shared VLAN learning instead of Individual learning.
--- drivers/net/dsa/b53/b53_common.c | 4 ++++ drivers/net/dsa/b53/b53_regs.h | 1 + 2 files changed, 5 insertions(+)
drivers/net/dsa/b53/b53_common.c +4 -0
@@ -1441,6 +1441,10 @@ static int b53_arl_rw_op(struct b53_devi reg |=ARLTBL_RW ; else reg &= ~ARLTBL_RW; +if (dev->vlan_enabled) + reg &= ~ARLTBL_IVL_SVL_SELECT ; +else + reg |=ARLTBL_IVL_SVL_SELECT ;b53_write8 (dev,B53_ARLIO_PAGE ,B53_ARLTBL_RW_CTRL , reg);return b53_arl_op_wait (dev);
drivers/net/dsa/b53/b53_regs.h +1 -0
@@ -292,6 +292,7 @@/* ARL Table Read/Write Register (8 bit) */ #define B53_ARLTBL_RW_CTRL 0x00#define ARLTBL_RW BIT(0) +#define ARLTBL_IVL_SVL_SELECT BIT(6)#define ARLTBL_START_DONE BIT(7)/* MAC Address Index Register (48 bit) */
Greg Kroah-Hartman
maintainerPATCH 79/168 vxlan: use the correct nlattr array in NL_SET_ERR_MSG_ATTR
In reply to Greg Kroah-HartmanFrom: Sabrina Dubroca <[email protected]>
[ Upstream commit cc8e7c69db4dcc565ed3020f97ddd6debab6cbe8 ]
IFLA_VXLAN_* attributes are in the data array, which is correctly used when fetching the value, but not when setting the extended ack. Because IFLA_VXLAN_MAX < IFLA_MAX, we avoid out of bounds array accesses, but we don't provide a pointer to the invalid attribute to userspace.
--- drivers/net/vxlan.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/vxlan.c +3 -3
@@ -3144,7 +3144,7 @@ static int vxlan_validate(struct nlattru32 id =nla_get_u32 (data[IFLA_VXLAN_ID ]);if (id >=VXLAN_N_VID ) { -NL_SET_ERR_MSG_ATTR (extack, tb[IFLA_VXLAN_ID ], +NL_SET_ERR_MSG_ATTR (extack, data[IFLA_VXLAN_ID ],"VXLAN ID must be lower than 16777216" );return -ERANGE ; }
@@ -3155,7 +3155,7 @@ static int vxlan_validate(struct nlattr = nla_data(data[IFLA_VXLAN_PORT_RANGE]);if (ntohs (p->high) <ntohs (p->low)) { -NL_SET_ERR_MSG_ATTR (extack, tb[IFLA_VXLAN_PORT_RANGE ], +NL_SET_ERR_MSG_ATTR (extack, data[IFLA_VXLAN_PORT_RANGE ],"Invalid source port range" );return -EINVAL ; }
@@ -3165,7 +3165,7 @@ static int vxlan_validate(struct nlattrenum ifla_vxlan_df df =nla_get_u8 (data[IFLA_VXLAN_DF ]);if (df <0 || df >VXLAN_DF_MAX ) { -NL_SET_ERR_MSG_ATTR (extack, tb[IFLA_VXLAN_DF ], +NL_SET_ERR_MSG_ATTR (extack, data[IFLA_VXLAN_DF ],"Invalid DF attribute" );return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 80/168 geneve: use the correct nlattr array in NL_SET_ERR_MSG_ATTR
In reply to Greg Kroah-HartmanFrom: Sabrina Dubroca <[email protected]>
[ Upstream commit 9a7b5b50de8a764671ba1800fe4c52d3b7013901 ]
IFLA_GENEVE_* attributes are in the data array, which is correctly used when fetching the value, but not when setting the extended ack. Because IFLA_GENEVE_MAX < IFLA_MAX, we avoid out of bounds array accesses, but we don't provide a pointer to the invalid attribute to userspace.
--- drivers/net/geneve.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/geneve.c +1 -1
@@ -1207,7 +1207,7 @@ static int geneve_validate(struct nlattrenum ifla_geneve_df df =nla_get_u8 (data[IFLA_GENEVE_DF ]);if (df <0 || df >GENEVE_DF_MAX ) { -NL_SET_ERR_MSG_ATTR (extack, tb[IFLA_GENEVE_DF ], +NL_SET_ERR_MSG_ATTR (extack, data[IFLA_GENEVE_DF ],"Invalid DF attribute" );return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 81/168 xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish
In reply to Greg Kroah-HartmanFrom: David Ahern <[email protected]>
[ Upstream commit 0c922a4850eba2e668f73a3f1153196e09abb251 ]
IPSKB_XFRM_TRANSFORMED and IP6SKB_XFRM_TRANSFORMED are skb flags set by xfrm code to tell other skb handlers that the packet has been passed through the xfrm output functions. Simplify the code and just always set them rather than conditionally based on netfilter enabled thus making the flag available for other users.
--- net/ipv4/xfrm4_output.c | 2 -- net/ipv6/xfrm6_output.c | 2 -- 2 files changed, 4 deletions(-)
net/ipv4/xfrm4_output.c +0 -2
@@ -58,9 +58,7 @@ int xfrm4_output_finish(struct sock *sk, {memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); -#ifdef CONFIG_NETFILTER IPCB (skb)->flags |=IPSKB_XFRM_TRANSFORMED ; -#endif return xfrm_output (sk, skb); }
net/ipv6/xfrm6_output.c +0 -2
@@ -111,9 +111,7 @@ int xfrm6_output_finish(struct sock *sk, {memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); -#ifdef CONFIG_NETFILTER IP6CB (skb)->flags |=IP6SKB_XFRM_TRANSFORMED ; -#endif return xfrm_output (sk, skb); }
Greg Kroah-Hartman
maintainerPATCH 82/168 vrf: Check skb for XFRM_TRANSFORMED flag
In reply to Greg Kroah-HartmanFrom: David Ahern <[email protected]>
[ Upstream commit 16b9db1ce34ff00d6c18e82825125cfef0cdfb13 ]
To avoid a loop with qdiscs and xfrms, check if the skb has already gone through the qdisc attached to the VRF device and then to the xfrm layer. If so, no need for a second redirect.
--- drivers/net/vrf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/vrf.c +4 -2
@@ -474,7 +474,8 @@ static struct sk_buff *vrf_ip6_out(strucif (rt6_need_strict (&ipv6_hdr (skb)->daddr))return skb; -if (qdisc_tx_is_default (vrf_dev)) +if (qdisc_tx_is_default (vrf_dev) || +IP6CB (skb)->flags &IP6SKB_XFRM_TRANSFORMED )return vrf_ip6_out_direct (vrf_dev, sk, skb);return vrf_ip6_out_redirect (vrf_dev, skb);
@@ -686,7 +687,8 @@ static struct sk_buff *vrf_ip_out(struct ipv4_is_lbcast(ip_hdr(skb)->daddr))return skb; -if (qdisc_tx_is_default (vrf_dev)) +if (qdisc_tx_is_default (vrf_dev) || +IPCB (skb)->flags &IPSKB_XFRM_TRANSFORMED )return vrf_ip_out_direct (vrf_dev, sk, skb);return vrf_ip_out_redirect (vrf_dev, skb);
Greg Kroah-Hartman
maintainerPATCH 83/168 KEYS: Avoid false positive ENOMEM error on key read
In reply to Greg Kroah-HartmanFrom: Waiman Long <[email protected]>
[ Upstream commit 4f0882491a148059a52480e753b7f07fc550e188 ]
By allocating a kernel buffer with a user-supplied buffer length, it is possible that a false positive ENOMEM error may be returned because the user-supplied length is just too large even if the system do have enough memory to hold the actual key data.
Moreover, if the buffer length is larger than the maximum amount of memory that can be returned by kmalloc() (2^(MAX_ORDER-1) number of pages), a warning message will also be printed.
To reduce this possibility, we set a threshold (PAGE_SIZE) over which we do check the actual key length first before allocating a buffer of the right size to hold it. The threshold is arbitrary, it is just used to trigger a buffer length check. It does not limit the actual key length as long as there is enough memory to satisfy the memory request.
To further avoid large buffer allocation failure due to page fragmentation, kvmalloc() is used to allocate the buffer so that vmapped pages can be used when there is not a large enough contiguous set of pages available for allocation.
In the extremely unlikely scenario that the key keeps on being changed and made longer (still <= buflen) in between 2 __keyctl_read_key() calls, the __keyctl_read_key() calling loop in keyctl_read_key() may have to be iterated a large number of times, but definitely not infinite.
--- security/keys/internal.h | 12 +++++++++ security/keys/keyctl.c | 58 +++++++++++++++++++++++++++++----------- 2 files changed, 55 insertions(+), 15 deletions(-)
security/keys/internal.h +12 -0
@@ -16,6 +16,8 @@#include <linux/keyctl.h> #include <linux/refcount.h> #include <linux/compat.h> +#include <linux/mm.h> +#include <linux/vmalloc.h> struct iovec ;
@@ -349,4 +351,14 @@ static inline void key_check(const struct key *key)#endif +/* +* Helper function to clear and free a kvmalloc'ed memory object. +*/ +static inline void __kvzfree (const void *addr,size_t len) +{ +if (addr) { +memset ((void *)addr,0 , len); +kvfree (addr); + } +}#endif /* _INTERNAL_H */
security/keys/keyctl.c +43 -15
88 lines not on this page · raw message
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 84/168 ALSA: hda: Remove ASUS ROG Zenith from the blacklist
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit a8cf44f085ac12c0b5b8750ebb3b436c7f455419 ]
The commit 3c6fd1f07ed0 ("ALSA: hda: Add driver blacklist") added a new blacklist for the devices that are known to have empty codecs, and one of the entries was ASUS ROG Zenith II (PCI SSID 1043:874f). However, it turned out that the very same PCI SSID is used for the previous model that does have the valid HD-audio codecs and the change broke the sound on it.
This patch reverts the corresponding entry as a temporary solution. Although Zenith II and co will see get the empty HD-audio bus again, it'd be merely resource wastes and won't affect the functionality, so it's no end of the world. We'll need to address this later, e.g. by either switching to DMI string matching or using PCI ID & SSID pairs.
--- sound/pci/hda/hda_intel.c | 1 - 1 file changed, 1 deletion(-)
sound/pci/hda/hda_intel.c +0 -1
@@ -2024,7 +2024,6 @@ static void pcm_mmap_prepare(struct snd_pcm_substream *substream,* should be ignored from the beginning. */ static const struct snd_pci_quirk driver_blacklist[] = { -SND_PCI_QUIRK (0x1043 ,0x874f ,"ASUS ROG Zenith II / Strix" ,0 ),SND_PCI_QUIRK (0x1462 ,0xcb59 ,"MSI TRX40 Creator" ,0 ),SND_PCI_QUIRK (0x1462 ,0xcb60 ,"MSI TRX40" ,0 ), {}
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 85/168 ALSA: usb-audio: Add static mapping table for ALC1220-VB-based mobos
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit a43c1c41bc5145971d06edc42a6b1e8faa0e2bc3 ]
TRX40 mobos from MSI and others with ALC1220-VB USB-audio device need yet more quirks for the proper control names.
This patch provides the mapping table for those boards, correcting the FU names for volume and mute controls as well as the terminal names for jack controls. It also improves build_connector_control() not to add the directional suffix blindly if the string is given from the mapping table.
With this patch applied, the new UCM profiles will be effective.
--- sound/usb/mixer.c | 12 +++++++++--- sound/usb/mixer_maps.c | 24 +++++++++++++++++++++--- sound/usb/quirks-table.h | 14 ++++++++++++++ 3 files changed, 44 insertions(+), 6 deletions(-)
sound/usb/mixer.c +9 -3
@@ -1755,8 +1755,10 @@ static void build_connector_control(struct usb_mixer_interface *mixer, {struct snd_kcontrol *kctl;struct usb_mixer_elem_info *cval; +const struct usbmix_name_map *map; -if (check_ignored_ctl (find_map (imap, term->id,0 ))) + map =find_map (imap, term->id,0 ); +if (check_ignored_ctl (map))return ; cval =kzalloc (sizeof (*cval),GFP_KERNEL );
@@ -1788,8 +1790,12 @@ static void build_connector_control(struct usb_mixer_interface *mixer,usb_mixer_elem_info_free (cval);return ; } -get_connector_control_name (mixer, term, is_input, kctl->id.name, -sizeof (kctl->id.name)); + +if (check_mapped_name (map, kctl->id.name,sizeof (kctl->id.name))) +strlcat (kctl->id.name," Jack" ,sizeof (kctl->id.name)); +else +get_connector_control_name (mixer, term, is_input, kctl->id.name, +sizeof (kctl->id.name)); kctl->private_free = snd_usb_mixer_elem_free;snd_usb_mixer_add_control (&cval->head, kctl); }
sound/usb/mixer_maps.c +21 -3
@@ -359,6 +359,24 @@ static const struct usbmix_name_map asus_rog_map[] = { {} }; +/* TRX40 mobos with Realtek ALC1220-VB */ +static const struct usbmix_name_map trx40_mobo_map[] = { + {18 ,NULL },/* OT, IEC958 - broken response, disabled */ + {19 ,NULL ,12 },/* FU, Input Gain Pad - broken response, disabled */ + {16 ,"Speaker" },/* OT */ + {22 ,"Speaker Playback" },/* FU */ + {7 ,"Line" },/* IT */ + {19 ,"Line Capture" },/* FU */ + {17 ,"Front Headphone" },/* OT */ + {23 ,"Front Headphone Playback" },/* FU */ + {8 ,"Mic" },/* IT */ + {20 ,"Mic Capture" },/* FU */ + {9 ,"Front Mic" },/* IT */ + {21 ,"Front Mic Capture" },/* FU */ + {24 ,"IEC958 Playback" },/* FU */ + {} +}; +/* * Control map entries */
@@ -480,7 +498,7 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { }, {/* Gigabyte TRX40 Aorus Pro WiFi */ .id = USB_ID(0x0414, 0xa002), - .map = asus_rog_map, + .map = trx40_mobo_map, }, {/* ASUS ROG Zenith II */ .id = USB_ID(0x0b05, 0x1916),
@@ -492,11 +510,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { }, {/* MSI TRX40 Creator */ .id = USB_ID(0x0db0, 0x0d64), - .map = asus_rog_map, + .map = trx40_mobo_map, }, {/* MSI TRX40 */ .id = USB_ID(0x0db0, 0x543d), - .map = asus_rog_map, + .map = trx40_mobo_map, }, { 0 } /* terminator */ };
sound/usb/quirks-table.h +14 -0
@@ -3635,4 +3635,18 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), } }, +#define ALC1220_VB_DESKTOP (vend, prod) { \ + USB_DEVICE(vend, prod), \ + .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { \ + .vendor_name = "Realtek", \ + .product_name = "ALC1220-VB-DT", \ + .profile_name = "Realtek-ALC1220-VB-Desktop", \ + .ifnum = QUIRK_NO_INTERFACE \ + } \ +} +ALC1220_VB_DESKTOP (0x0414 ,0xa002 ),/* Gigabyte TRX40 Aorus Pro WiFi */ +ALC1220_VB_DESKTOP (0x0db0 ,0x0d64 ),/* MSI TRX40 Creator */ +ALC1220_VB_DESKTOP (0x0db0 ,0x543d ),/* MSI TRX40 */ +#undef ALC1220_VB_DESKTOP + #undef USB_DEVICE_VENDOR_SPEC
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 86/168 ALSA: usb-audio: Add connector notifier delegation
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit fef66ae73a611e84c8b4b74ff6f805ec5f113477 ]
It turned out that ALC1220-VB USB-audio device gives the interrupt event to some PCM terminals while those don't allow the connector state request but only the actual I/O terminals return the request. The recent commit 7dc3c5a0172e ("ALSA: usb-audio: Don't create jack controls for PCM terminals") excluded those phantom terminals, so those events are ignored, too.
My first thought was that this could be easily deduced from the associated terminals, but some of them have even no associate terminal ID, hence it's not too trivial to figure out.
Since the number of such terminals are small and limited, this patch implements another quirk table for the simple mapping of the connectors. It's not really scalable, but let's hope that there will be not many such funky devices in future.
--- sound/usb/mixer.c | 25 +++++++++++++++++++++++++ sound/usb/mixer.h | 10 ++++++++++ sound/usb/mixer_maps.c | 13 +++++++++++++ 3 files changed, 48 insertions(+)
sound/usb/mixer.c +25 -0
@@ -3096,6 +3096,7 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)if (map->id == state.chip->usb_id) { state.map = map->map; state.selector_map = map->selector_map; + mixer->connector_map = map->connector_map; mixer->ignore_ctl_error |= map->ignore_ctl_error;break ; }
@@ -3177,10 +3178,32 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)return 0 ; } +static int delegate_notify (struct usb_mixer_interface *mixer,int unitid, +u8 *control,u8 *channel) +{ +const struct usbmix_connector_map *map = mixer->connector_map; + +if (!map) +return unitid; + +for (; map->id; map++) { +if (map->id == unitid) { +if (control && map->control) + *control = map->control; +if (channel && map->channel) + *channel = map->channel; +return map->delegated_id; + } + } +return unitid; +} +void snd_usb_mixer_notify_id (struct usb_mixer_interface *mixer,int unitid) {struct usb_mixer_elem_list *list; + unitid =delegate_notify (mixer, unitid,NULL ,NULL ); +for_each_mixer_elem (list, mixer, unitid) {struct usb_mixer_elem_info *info =mixer_elem_list_to_info (list);
@@ -3250,6 +3273,8 @@ static void snd_usb_mixer_interrupt_v2(struct usb_mixer_interface *mixer,return ; } + unitid =delegate_notify (mixer, unitid, &control, &channel); +for_each_mixer_elem (list, mixer, unitid) count++;
sound/usb/mixer.h +10 -0
@@ -6,6 +6,13 @@struct media_mixer_ctl ; +struct usbmix_connector_map { +u8 id; +u8 delegated_id; +u8 control; +u8 channel; +}; +struct usb_mixer_interface {struct snd_usb_audio *chip;struct usb_host_interface *hostif;
@@ -18,6 +25,9 @@ struct usb_mixer_interface {/* the usb audio specification version this interface complies to */ int protocol; +/* optional connector delegation map */ +const struct usbmix_connector_map *connector_map; +/* Sound Blaster remote control stuff */ const struct rc_config *rc_cfg;u32 rc_code;
sound/usb/mixer_maps.c +13 -0
@@ -27,6 +27,7 @@ struct usbmix_ctl_map {u32 id;const struct usbmix_name_map *map;const struct usbmix_selector_map *selector_map; +const struct usbmix_connector_map *connector_map;int ignore_ctl_error; };
@@ -377,6 +378,15 @@ static const struct usbmix_name_map trx40_mobo_map[] = { {} }; +static const struct usbmix_connector_map trx40_mobo_connector_map[] = { + {10 ,16 },/* (Back) Speaker */ + {11 ,17 },/* Front Headphone */ + {13 ,7 },/* Line */ + {14 ,8 },/* Mic */ + {15 ,9 },/* Front Mic */ + {} +}; +/* * Control map entries */
@@ -499,6 +509,7 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { {/* Gigabyte TRX40 Aorus Pro WiFi */ .id = USB_ID(0x0414, 0xa002), .map = trx40_mobo_map, + .connector_map = trx40_mobo_connector_map, }, {/* ASUS ROG Zenith II */ .id = USB_ID(0x0b05, 0x1916),
@@ -511,10 +522,12 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { {/* MSI TRX40 Creator */ .id = USB_ID(0x0db0, 0x0d64), .map = trx40_mobo_map, + .connector_map = trx40_mobo_connector_map, }, {/* MSI TRX40 */ .id = USB_ID(0x0db0, 0x543d), .map = trx40_mobo_map, + .connector_map = trx40_mobo_connector_map, }, { 0 } /* terminator */ };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 87/168 iio: core: remove extra semi-colon from devm_iio_device_register() macro
In reply to Greg Kroah-HartmanFrom: Lars Engebretsen <[email protected]>
commit a07479147be03d2450376ebaff9ea1a0682f25d6 upstream.
This change removes the semi-colon from the devm_iio_device_register() macro which seems to have been added by accident.
--- include/linux/iio/iio.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/iio/iio.h +1 -1
@@ -596,7 +596,7 @@ void iio_device_unregister(struct iio_de* 0 on success, negative error number on failure. */ #define devm_iio_device_register (dev, indio_dev) \ - __devm_iio_device_register((dev), (indio_dev), THIS_MODULE); + __devm_iio_device_register((dev), (indio_dev), THIS_MODULE)int __devm_iio_device_register (struct device *dev,struct iio_dev *indio_dev,struct module *this_mod);void devm_iio_device_unregister (struct device *dev,struct iio_dev *indio_dev);
Greg Kroah-Hartman
maintainerPATCH 88/168 iio: st_sensors: rely on odr mask to know if odr can be set
In reply to Greg Kroah-HartmanFrom: Lary Gibaud <[email protected]>
commit e450e07c14abae563ad13b064cbce9fdccc6bc8d upstream.
Indeed, relying on addr being not 0 cannot work because some device have their register to set odr at address 0. As a matter of fact, if the odr can be set, then there is a mask.
Sensors with ODR register at address 0 are: lsm303dlh, lsm303dlhc, lsm303dlm
--- drivers/iio/common/st_sensors/st_sensors_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/common/st_sensors/st_sensors_core.c +1 -1
@@ -80,7 +80,7 @@ int st_sensors_set_odr(struct iio_dev *istruct st_sensor_odr_avl odr_out = {0 ,0 };struct st_sensor_data *sdata =iio_priv (indio_dev); -if (!sdata->sensor_settings->odr.addr) +if (!sdata->sensor_settings->odr.mask)return 0 ; err =st_sensors_match_odr (sdata->sensor_settings, odr, &odr_out);
Greg Kroah-Hartman
maintainerPATCH 89/168 iio: adc: stm32-adc: fix sleep in atomic context
In reply to Greg Kroah-HartmanFrom: Olivier Moysan <[email protected]>
commit e2042d2936dfc84e9c600fe9b9d0039ca0e54b7d upstream.
This commit fixes the following error:
"BUG: sleeping function called from invalid context at kernel/irq/chip.c"
In DMA mode suppress the trigger irq handler, and make the buffer transfers directly in DMA callback, instead.
--- drivers/iio/adc/stm32-adc.c | 31 ++++++++++++++++++++++++++++--- 1 file changed, 28 insertions(+), 3 deletions(-)
drivers/iio/adc/stm32-adc.c +28 -3
@@ -1367,8 +1367,30 @@ static unsigned int stm32_adc_dma_residustatic void stm32_adc_dma_buffer_done (void *data) {struct iio_dev *indio_dev = data; +struct stm32_adc *adc =iio_priv (indio_dev); +int residue =stm32_adc_dma_residue (adc); + +/* +* In DMA mode the trigger services of IIO are not used +* (e.g. no call to iio_trigger_poll). +* Calling irq handler associated to the hardware trigger is not +* relevant as the conversions have already been done. Data +* transfers are performed directly in DMA callback instead. +* This implementation avoids to call trigger irq handler that +* may sleep, in an atomic context (DMA irq handler context). +*/ +dev_dbg (&indio_dev->dev,"%s bufi=%d\n" , __func__, adc->bufi); + +while (residue >= indio_dev->scan_bytes) { +u16 *buffer = (u16 *)&adc->rx_buf[adc->bufi]; -iio_trigger_poll_chained (indio_dev->trig); +iio_push_to_buffers (indio_dev, buffer); + + residue -= indio_dev->scan_bytes; + adc->bufi += indio_dev->scan_bytes; +if (adc->bufi >= adc->rx_buf_sz) + adc->bufi =0 ; + } }static int stm32_adc_dma_start (struct iio_dev *indio_dev)
@@ -1778,6 +1800,7 @@ static int stm32_adc_probe(struct platfo {struct iio_dev *indio_dev;struct device *dev = &pdev->dev; +irqreturn_t (*handler)(int irq,void *p) =NULL ;struct stm32_adc *adc;int ret;
@@ -1843,9 +1866,11 @@ static int stm32_adc_probe(struct platfoif (ret <0 )return ret; +if (!adc->dma_chan) + handler = &stm32_adc_trigger_handler; + ret =iio_triggered_buffer_setup (indio_dev, - &iio_pollfunc_store_time, - &stm32_adc_trigger_handler, + &iio_pollfunc_store_time, handler, &stm32_adc_buffer_setup_ops);if (ret) {dev_err (&pdev->dev,"buffer setup failed\n" );
Greg Kroah-Hartman
maintainerPATCH 90/168 iio: adc: ti-ads8344: properly byte swap value
In reply to Greg Kroah-HartmanFrom: Alexandre Belloni <[email protected]>
commit dd7de4c0023e7564cabe39d64b2822a522890792 upstream.
The first received byte is the MSB, followed by the LSB so the value needs to be byte swapped.
Also, the ADC actually has a delay of one clock on the SPI bus. Read three bytes to get the last bit.
--- drivers/iio/adc/ti-ads8344.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/iio/adc/ti-ads8344.c +3 -3
@@ -29,7 +29,7 @@ struct ads8344 {struct mutex lock;u8 tx_buf____cacheline_aligned ; -u16 rx_buf; +u8 rx_buf[3 ]; };#define ADS8344_VOLTAGE_CHANNEL (chan, si) \
@@ -89,11 +89,11 @@ static int ads8344_adc_conversion(structudelay (9 ); - ret =spi_read (spi, &adc->rx_buf,2 ); + ret =spi_read (spi, adc->rx_buf,sizeof (adc->rx_buf));if (ret)return ret; -return adc->rx_buf; +return adc->rx_buf[0 ] <<9 | adc->rx_buf[1 ] <<1 | adc->rx_buf[2 ] >>7 ; } static int ads8344_read_raw(struct iio_dev *iio,
Greg Kroah-Hartman
maintainerPATCH 91/168 iio: xilinx-xadc: Fix ADC-B powerdown
In reply to Greg Kroah-HartmanFrom: Lars-Peter Clausen <[email protected]>
commit e44ec7794d88f918805d700240211a9ec05ed89d upstream.
The check for shutting down the second ADC is inverted. This causes it to be powered down when it should be enabled. As a result channels that are supposed to be handled by the second ADC return invalid conversion results.
--- drivers/iio/adc/xilinx-xadc-core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/iio/adc/xilinx-xadc-core.c +3 -2
@@ -722,13 +722,14 @@ static int xadc_power_adc_b(struct xadc {uint16_t val; +/* Powerdown the ADC-B when it is not needed. */ switch (seq_mode) {case XADC_CONF1_SEQ_SIMULTANEOUS :case XADC_CONF1_SEQ_INDEPENDENT : - val =XADC_CONF2_PD_ADC_B ; + val =0 ;break ;default : - val =0 ; + val =XADC_CONF2_PD_ADC_B ;break ; }
Greg Kroah-Hartman
maintainerPATCH 92/168 iio: xilinx-xadc: Fix clearing interrupt when enabling trigger
In reply to Greg Kroah-HartmanFrom: Lars-Peter Clausen <[email protected]>
commit f954b098fbac4d183219ce5b42d76d6df2aed50a upstream.
When enabling the trigger and unmasking the end-of-sequence (EOS) interrupt the EOS interrupt should be cleared from the status register. Otherwise it is possible that it was still set from a previous capture. If that is the case the interrupt would fire immediately even though no conversion has been done yet and stale data is being read from the device.
The old code only clears the interrupt if the interrupt was previously unmasked. Which does not make much sense since the interrupt is always masked at this point and in addition masking the interrupt does not clear the interrupt from the status register. So the clearing needs to be done unconditionally.
--- drivers/iio/adc/xilinx-xadc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/xilinx-xadc-core.c +1 -1
@@ -674,7 +674,7 @@ static int xadc_trigger_set_state(structspin_lock_irqsave (&xadc->lock, flags);xadc_read_reg (xadc,XADC_AXI_REG_IPIER , &val); -xadc_write_reg (xadc,XADC_AXI_REG_IPISR , val &XADC_AXI_INT_EOS ); +xadc_write_reg (xadc,XADC_AXI_REG_IPISR ,XADC_AXI_INT_EOS );if (state) val |=XADC_AXI_INT_EOS ;else
Greg Kroah-Hartman
maintainerPATCH 93/168 iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode
In reply to Greg Kroah-HartmanFrom: Lars-Peter Clausen <[email protected]>
commit 8bef455c8b1694547ee59e8b1939205ed9d901a6 upstream.
The XADC has two internal ADCs. Depending on the mode it is operating in either one or both of them are used. The device manual calls this continuous (one ADC) and simultaneous (both ADCs) mode.
The meaning of the sequencing register for the aux channels changes depending on the mode.
In continuous mode each bit corresponds to one of the 16 aux channels. And the single ADC will convert them one by one in order.
In simultaneous mode the aux channels are split into two groups the first 8 channels are assigned to the first ADC and the other 8 channels to the second ADC. The upper 8 bits of the sequencing register are unused and the lower 8 bits control both ADCs. This means a bit needs to be set if either the corresponding channel from the first group or the second group (or both) are set.
Currently the driver does not have the special handling required for simultaneous mode. Add it.
--- drivers/iio/adc/xilinx-xadc-core.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/iio/adc/xilinx-xadc-core.c +10 -0
@@ -798,6 +798,16 @@ static int xadc_preenable(struct iio_devif (ret) goto err; +/* +* In simultaneous mode the upper and lower aux channels are samples at +* the same time. In this mode the upper 8 bits in the sequencer +* register are don't care and the lower 8 bits control two channels +* each. As such we must set the bit if either the channel in the lower +* group or the upper group is enabled. +*/ +if (seq_mode ==XADC_CONF1_SEQ_SIMULTANEOUS ) + scan_mask = ((scan_mask >>8 ) | scan_mask) &0xff0000 ; + ret =xadc_write_adc_reg (xadc,XADC_REG_SEQ (1 ), scan_mask >>16 );if (ret) goto err;
Greg Kroah-Hartman
maintainerPATCH 94/168 iio: xilinx-xadc: Make sure not exceed maximum samplerate
In reply to Greg Kroah-HartmanFrom: Lars-Peter Clausen <[email protected]>
commit 3b7f9dbb827ce8680b98490215e698b6079a9ec5 upstream.
The XADC supports a samplerate of up to 1MSPS. Unfortunately the hardware does not have a FIFO, which means it generates an interrupt for each conversion sequence. At one 1MSPS this creates an interrupt storm that causes the system to soft-lock.
For this reason the driver limits the maximum samplerate to 150kSPS. Currently this check is only done when setting a new samplerate. But it is also possible that the initial samplerate configured in the FPGA bitstream exceeds the limit.
In this case when starting to capture data without first changing the samplerate the system can overload.
To prevent this check the currently configured samplerate in the probe function and reduce it to the maximum if necessary.
--- drivers/iio/adc/xilinx-xadc-core.c | 78 ++++++++++++++++++++++++++++--------- 1 file changed, 60 insertions(+), 18 deletions(-)
drivers/iio/adc/xilinx-xadc-core.c +60 -18
@@ -102,6 +102,16 @@ static const unsigned int XADC_ZYNQ_UNMA#define XADC_FLAGS_BUFFERED BIT(0) +/* +* The XADC hardware supports a samplerate of up to 1MSPS. Unfortunately it does +* not have a hardware FIFO. Which means an interrupt is generated for each +* conversion sequence. At 1MSPS sample rate the CPU in ZYNQ7000 is completely +* overloaded by the interrupts that it soft-lockups. For this reason the driver +* limits the maximum samplerate 150kSPS. At this rate the CPU is fairly busy, +* but still responsive. +*/ +#define XADC_MAX_SAMPLERATE 150000 +static void xadc_write_reg (struct xadc *xadc,unsigned int reg,uint32_t val) {
@@ -834,11 +844,27 @@ static const struct iio_buffer_setup_ops .postdisable = &xadc_postdisable, }; +static int xadc_read_samplerate (struct xadc *xadc) +{ +unsigned int div; +uint16_t val16; +int ret; + + ret =xadc_read_adc_reg (xadc,XADC_REG_CONF2 , &val16); +if (ret) +return ret; + + div = (val16 &XADC_CONF2_DIV_MASK ) >>XADC_CONF2_DIV_OFFSET ; +if (div <2 ) + div =2 ; + +return xadc_get_dclk_rate (xadc) / div /26 ; +} +static int xadc_read_raw (struct iio_dev *indio_dev,struct iio_chan_spec const *chan,int *val,int *val2,long info) {struct xadc *xadc =iio_priv (indio_dev); -unsigned int div;uint16_t val16;int ret;
@@ -891,41 +917,31 @@ static int xadc_read_raw(struct iio_dev *val = -((273150 <<12 ) /503975 );return IIO_VAL_INT ;case IIO_CHAN_INFO_SAMP_FREQ : - ret =xadc_read_adc_reg (xadc,XADC_REG_CONF2 , &val16); -if (ret) + ret =xadc_read_samplerate (xadc); +if (ret <0 )return ret; - div = (val16 &XADC_CONF2_DIV_MASK ) >>XADC_CONF2_DIV_OFFSET ; -if (div <2 ) - div =2 ; - - *val =xadc_get_dclk_rate (xadc) / div /26 ; - + *val = ret;return IIO_VAL_INT ;default :return -EINVAL ; } } -static int xadc_write_raw (struct iio_dev *indio_dev, -struct iio_chan_spec const *chan,int val,int val2,long info) +static int xadc_write_samplerate (struct xadc *xadc,int val) { -struct xadc *xadc =iio_priv (indio_dev);unsigned long clk_rate =xadc_get_dclk_rate (xadc);unsigned int div;if (!clk_rate)return -EINVAL ; -if (info !=IIO_CHAN_INFO_SAMP_FREQ ) -return -EINVAL ; -if (val <=0 )return -EINVAL ;/* Max. 150 kSPS */ -if (val >150000 ) - val =150000 ; +if (val >XADC_MAX_SAMPLERATE ) + val =XADC_MAX_SAMPLERATE ; val *=26 ;
@@ -938,7 +954,7 @@ static int xadc_write_raw(struct iio_dev* limit. */ div = clk_rate / val; -if (clk_rate / div /26 >150000 ) +if (clk_rate / div /26 >XADC_MAX_SAMPLERATE ) div++;if (div <2 ) div =2 ;
@@ -949,6 +965,17 @@ static int xadc_write_raw(struct iio_dev div << XADC_CONF2_DIV_OFFSET); } +static int xadc_write_raw (struct iio_dev *indio_dev, +struct iio_chan_spec const *chan,int val,int val2,long info) +{ +struct xadc *xadc =iio_priv (indio_dev); + +if (info !=IIO_CHAN_INFO_SAMP_FREQ ) +return -EINVAL ; + +return xadc_write_samplerate (xadc, val); +} +static const struct iio_event_spec xadc_temp_events[] = { { .type =IIO_EV_TYPE_THRESH ,
@@ -1236,6 +1263,21 @@ static int xadc_probe(struct platform_deif (ret) goto err_free_samplerate_trigger; +/* +* Make sure not to exceed the maximum samplerate since otherwise the +* resulting interrupt storm will soft-lock the system. +*/ +if (xadc->ops->flags &XADC_FLAGS_BUFFERED ) { + ret =xadc_read_samplerate (xadc); +if (ret <0 ) + goto err_free_samplerate_trigger; +if (ret >XADC_MAX_SAMPLERATE ) { + ret =xadc_write_samplerate (xadc,XADC_MAX_SAMPLERATE ); +if (ret <0 ) + goto err_free_samplerate_trigger; + } + } + ret =request_irq (xadc->irq, xadc->ops->interrupt_handler,0 ,dev_name (&pdev->dev), indio_dev);if (ret)
Greg Kroah-Hartman
maintainerPATCH 95/168 USB: sisusbvga: Change port variable from signed to unsigned
In reply to Greg Kroah-HartmanFrom: Changming Liu <[email protected]>
commit 2df7405f79ce1674d73c2786fe1a8727c905d65b upstream.
Change a bunch of arguments of wrapper functions which pass signed integer to an unsigned integer which might cause undefined behaviors when sign integer overflow.
--- drivers/usb/misc/sisusbvga/sisusb.c | 20 ++++++++++---------- drivers/usb/misc/sisusbvga/sisusb_init.h | 14 +++++++------- 2 files changed, 17 insertions(+), 17 deletions(-)
drivers/usb/misc/sisusbvga/sisusb.c +10 -10
@@ -1199,18 +1199,18 @@ static int sisusb_read_mem_bulk(struct s/* High level: Gfx (indexed) register access */ #ifdef CONFIG_USB_SISUSBVGA_CON -int sisusb_setreg (struct sisusb_usb_data *sisusb,int port,u8 data) +int sisusb_setreg (struct sisusb_usb_data *sisusb,u32 port,u8 data) {return sisusb_write_memio_byte (sisusb,SISUSB_TYPE_IO , port, data); } -int sisusb_getreg (struct sisusb_usb_data *sisusb,int port,u8 *data) +int sisusb_getreg (struct sisusb_usb_data *sisusb,u32 port,u8 *data) {return sisusb_read_memio_byte (sisusb,SISUSB_TYPE_IO , port, data); }#endif -int sisusb_setidxreg (struct sisusb_usb_data *sisusb,int port, +int sisusb_setidxreg (struct sisusb_usb_data *sisusb,u32 port,u8 index,u8 data) {int ret;
@@ -1220,7 +1220,7 @@ int sisusb_setidxreg(struct sisusb_usb_dreturn ret; } -int sisusb_getidxreg (struct sisusb_usb_data *sisusb,int port, +int sisusb_getidxreg (struct sisusb_usb_data *sisusb,u32 port,u8 index,u8 *data) {int ret;
@@ -1230,7 +1230,7 @@ int sisusb_getidxreg(struct sisusb_usb_dreturn ret; } -int sisusb_setidxregandor (struct sisusb_usb_data *sisusb,int port,u8 idx, +int sisusb_setidxregandor (struct sisusb_usb_data *sisusb,u32 port,u8 idx,u8 myand,u8 myor) {int ret;
@@ -1245,7 +1245,7 @@ int sisusb_setidxregandor(struct sisusb_ }static int sisusb_setidxregmask (struct sisusb_usb_data *sisusb, -int port,u8 idx,u8 data,u8 mask) +u32 port,u8 idx,u8 data,u8 mask) {int ret;u8 tmp;
@@ -1258,13 +1258,13 @@ static int sisusb_setidxregmask(struct sreturn ret; } -int sisusb_setidxregor (struct sisusb_usb_data *sisusb,int port, +int sisusb_setidxregor (struct sisusb_usb_data *sisusb,u32 port,u8 index,u8 myor) {return sisusb_setidxregandor (sisusb, port, index,0xff , myor); } -int sisusb_setidxregand (struct sisusb_usb_data *sisusb,int port, +int sisusb_setidxregand (struct sisusb_usb_data *sisusb,u32 port,u8 idx,u8 myand) {return sisusb_setidxregandor (sisusb, port, idx, myand,0x00 );
@@ -2785,8 +2785,8 @@ static loff_t sisusb_lseek(struct file *static int sisusb_handle_command (struct sisusb_usb_data *sisusb,struct sisusb_command *y,unsigned long arg) { -int retval, port, length; -u32 address; +int retval, length; +u32 port, address;/* All our commands require the device * to be initialized.
drivers/usb/misc/sisusbvga/sisusb_init.h +7 -7
@@ -812,17 +812,17 @@ static const struct SiS_VCLKData SiSUSB_int SiSUSBSetMode (struct SiS_Private *SiS_Pr,unsigned short ModeNo);int SiSUSBSetVESAMode (struct SiS_Private *SiS_Pr,unsigned short VModeNo); -extern int sisusb_setreg (struct sisusb_usb_data *sisusb,int port,u8 data); -extern int sisusb_getreg (struct sisusb_usb_data *sisusb,int port,u8 * data); -extern int sisusb_setidxreg (struct sisusb_usb_data *sisusb,int port, +extern int sisusb_setreg (struct sisusb_usb_data *sisusb,u32 port,u8 data); +extern int sisusb_getreg (struct sisusb_usb_data *sisusb,u32 port,u8 * data); +extern int sisusb_setidxreg (struct sisusb_usb_data *sisusb,u32 port,u8 index,u8 data); -extern int sisusb_getidxreg (struct sisusb_usb_data *sisusb,int port, +extern int sisusb_getidxreg (struct sisusb_usb_data *sisusb,u32 port,u8 index,u8 * data); -extern int sisusb_setidxregandor (struct sisusb_usb_data *sisusb,int port, +extern int sisusb_setidxregandor (struct sisusb_usb_data *sisusb,u32 port,u8 idx,u8 myand,u8 myor); -extern int sisusb_setidxregor (struct sisusb_usb_data *sisusb,int port, +extern int sisusb_setidxregor (struct sisusb_usb_data *sisusb,u32 port,u8 index,u8 myor); -extern int sisusb_setidxregand (struct sisusb_usb_data *sisusb,int port, +extern int sisusb_setidxregand (struct sisusb_usb_data *sisusb,u32 port,u8 idx,u8 myand);void sisusb_delete (struct kref *kref);
Greg Kroah-Hartman
maintainerPATCH 96/168 USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE
In reply to Greg Kroah-HartmanFrom: Jonathan Cox <[email protected]>
commit be34a5854b4606bd7a160ad3cb43415d623596c7 upstream.
The Corsair K70 RGB RAPIDFIRE needs the USB_QUIRK_DELAY_INIT and USB_QUIRK_DELAY_CTRL_MSG to function or it will randomly not respond on boot, just like other Corsair keyboards
--- drivers/usb/core/quirks.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/core/quirks.c +4 -0
@@ -430,6 +430,10 @@ static const struct usb_device_id usb_qu/* Corsair K70 LUX */ { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT }, + /* Corsair K70 RGB RAPDIFIRE */ + { USB_DEVICE(0x1b1c, 0x1b38), .driver_info = USB_QUIRK_DELAY_INIT | + USB_QUIRK_DELAY_CTRL_MSG }, + /* MIDI keyboard WORLDE MINI */ { USB_DEVICE(0x1c75, 0x0204), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
Greg Kroah-Hartman
maintainerPATCH 97/168 USB: early: Handle AMDs spec-compliant identifiers, too
In reply to Greg Kroah-HartmanFrom: Jann Horn <[email protected]>
commit 7dbdb53d72a51cea9b921d9dbba54be00752212a upstream.
This fixes a bug that causes the USB3 early console to freeze after printing a single line on AMD machines because it can't parse the Transfer TRB properly.
The spec at
https://www.intel.com/content/dam/www/public/us/en/documents/technical-specifications/extensible-host-controler-interface-usb-xhci.pdf
says in section "4.5.1 Device Context Index" that the Context Index, also known as Endpoint ID according to
section "1.6 Terms and Abbreviations", is normally computed as DCI = (Endpoint Number * 2) + Direction, which matches the current definitions of XDBC_EPID_OUT and XDBC_EPID_IN.
However, the numbering in a Debug Capability Context data structure is supposed to be different:
Section "7.6.3.2 Endpoint Contexts and Transfer Rings" explains that a Debug Capability Context data structure has the endpoints mapped to indices 0 and 1.
Change XDBC_EPID_OUT/XDBC_EPID_IN to the spec-compliant values, add XDBC_EPID_OUT_INTEL/XDBC_EPID_IN_INTEL with Intel's incorrect values, and let xdbc_handle_tx_event() handle both.
I have verified that with this patch applied, the USB3 early console works on both an Intel and an AMD machine.
--- drivers/usb/early/xhci-dbc.c | 8 ++++---- drivers/usb/early/xhci-dbc.h | 18 ++++++++++++++++-- 2 files changed, 20 insertions(+), 6 deletions(-)
drivers/usb/early/xhci-dbc.c +4 -4
@@ -728,19 +728,19 @@ static void xdbc_handle_tx_event(structcase COMP_USB_TRANSACTION_ERROR :case COMP_STALL_ERROR :default : -if (ep_id ==XDBC_EPID_OUT ) +if (ep_id ==XDBC_EPID_OUT || ep_id ==XDBC_EPID_OUT_INTEL ) xdbc.flags |=XDBC_FLAGS_OUT_STALL ; -if (ep_id ==XDBC_EPID_IN ) +if (ep_id ==XDBC_EPID_IN || ep_id ==XDBC_EPID_IN_INTEL ) xdbc.flags |=XDBC_FLAGS_IN_STALL ;xdbc_trace ("endpoint %d stalled\n" , ep_id);break ; } -if (ep_id ==XDBC_EPID_IN ) { +if (ep_id ==XDBC_EPID_IN || ep_id ==XDBC_EPID_IN_INTEL ) { xdbc.flags &= ~XDBC_FLAGS_IN_PROCESS ;xdbc_bulk_transfer (NULL ,XDBC_MAX_PACKET , true); - }else if (ep_id ==XDBC_EPID_OUT ) { + }else if (ep_id ==XDBC_EPID_OUT || ep_id ==XDBC_EPID_OUT_INTEL ) { xdbc.flags &= ~XDBC_FLAGS_OUT_PROCESS ; }else {xdbc_trace ("invalid endpoint id %d\n" , ep_id);
drivers/usb/early/xhci-dbc.h +16 -2
@@ -120,8 +120,22 @@ struct xdbc_ring {u32 cycle_state; }; -#define XDBC_EPID_OUT 2 -#define XDBC_EPID_IN 3 +/* +* These are the "Endpoint ID" (also known as "Context Index") values for the +* OUT Transfer Ring and the IN Transfer Ring of a Debug Capability Context data +* structure. +* According to the "eXtensible Host Controller Interface for Universal Serial +* Bus (xHCI)" specification, section "7.6.3.2 Endpoint Contexts and Transfer +* Rings", these should be 0 and 1, and those are the values AMD machines give +* you; but Intel machines seem to use the formula from section "4.5.1 Device +* Context Index", which is supposed to be used for the Device Context only. +* Luckily the values from Intel don't overlap with those from AMD, so we can +* just test for both. +*/ +#define XDBC_EPID_OUT 0 +#define XDBC_EPID_IN 1 +#define XDBC_EPID_OUT_INTEL 2 +#define XDBC_EPID_IN_INTEL 3struct xdbc_state {u16 vendor;
Greg Kroah-Hartman
maintainerPATCH 98/168 USB: core: Fix free-while-in-use bug in the USB S-Glibrary
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit 056ad39ee9253873522f6469c3364964a322912b upstream.
FuzzUSB (a variant of syzkaller) found a free-while-still-in-use bug in the USB scatter-gather library:
BUG: KASAN: use-after-free in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline] BUG: KASAN: use-after-free in usb_hcd_unlink_urb+0x5f/0x170 drivers/usb/core/hcd.c:1607 Read of size 4 at addr ffff888065379610 by task kworker/u4:1/27 CPU: 1 PID: 27 Comm: kworker/u4:1 Not tainted 5.5.11 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Workqueue: scsi_tmf_2 scmd_eh_abort_handler Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xce/0x128 lib/dump_stack.c:118 print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374 __kasan_report+0x153/0x1cb mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:639 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x152/0x1b0 mm/kasan/generic.c:192 __kasan_check_read+0x11/0x20 mm/kasan/common.c:95 atomic_read include/asm-generic/atomic-instrumented.h:26 [inline] usb_hcd_unlink_urb+0x5f/0x170 drivers/usb/core/hcd.c:1607 usb_unlink_urb+0x72/0xb0 drivers/usb/core/urb.c:657 usb_sg_cancel+0x14e/0x290 drivers/usb/core/message.c:602 usb_stor_stop_transport+0x5e/0xa0 drivers/usb/storage/transport.c:937
This bug occurs when cancellation of the S-G transfer races with transfer completion. When that happens, usb_sg_cancel() may continue to access the transfer's URBs after usb_sg_wait() has freed them.
The bug is caused by the fact that usb_sg_cancel() does not take any sort of reference to the transfer, and so there is nothing to prevent the URBs from being deallocated while the routine is trying to use them. The fix is to take such a reference by incrementing the transfer's io->count field while the cancellation is in progres and decrementing it afterward. The transfer's URBs are not deallocated until io->complete is triggered, which happens when io->count reaches zero.
--- drivers/usb/core/message.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/usb/core/message.c +8 -1
@@ -588,12 +588,13 @@ void usb_sg_cancel(struct usb_sg_requestint i, retval;spin_lock_irqsave (&io->lock, flags); -if (io->status) { +if (io->status || io->count ==0 ) {spin_unlock_irqrestore (&io->lock, flags);return ; }/* shut everything down */ io->status = -ECONNRESET ; + io->count++;/* Keep the request alive until we're done */ spin_unlock_irqrestore (&io->lock, flags);for (i = io->entries -1 ; i >=0 ; --i) {
@@ -607,6 +608,12 @@ void usb_sg_cancel(struct usb_sg_requestdev_warn (&io->dev->dev,"%s, unlink --> %d\n" , __func__, retval); } + +spin_lock_irqsave (&io->lock, flags); + io->count--; +if (!io->count) +complete (&io->complete); +spin_unlock_irqrestore (&io->lock, flags); }EXPORT_SYMBOL_GPL (usb_sg_cancel);
Greg Kroah-Hartman
maintainerPATCH 99/168 USB: hub: Fix handling of connect changes during sleep
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit 9f952e26295d977dbfc6fedeaf8c4f112c818d37 upstream.
Commit 8099f58f1ecd ("USB: hub: Don't record a connect-change event during reset-resume") wasn't very well conceived. The problem it tried to fix was that if a connect-change event occurred while the system was asleep (such as a device disconnecting itself from the bus when it is suspended and then reconnecting when it resumes) requiring a reset-resume during the system wakeup transition, the hub port's change_bit entry would remain set afterward. This would cause the hub driver to believe another connect-change event had occurred after the reset-resume, which was wrong and would lead the driver to send unnecessary requests to the device (which could interfere with a firmware update).
The commit tried to fix this by not setting the change_bit during the wakeup. But this was the wrong thing to do; it means that when a device is unplugged while the system is asleep, the hub driver doesn't realize anything has happened: The change_bit flag which would tell it to handle the disconnect event is clear.
The commit needs to be reverted and the problem fixed in a different way. Fortunately an alternative solution was noted in the commit's
Changelog: We can continue to set the change_bit entry in hub_activate() but then clear it when a reset-resume occurs. That way the the hub driver will see the change_bit when a device is disconnected but won't see it when the device is still present.
That's what this patch does.
--- drivers/usb/core/hub.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/usb/core/hub.c +14 -0
@@ -1222,6 +1222,11 @@ static void hub_activate(struct usb_hub#ifdef CONFIG_PM udev->reset_resume =1 ;#endif +/* Don't set the change_bits when the device +* was powered off. +*/ +if (test_bit (port1, hub->power_bits)) +set_bit (port1, hub->change_bits); }else {/* The power session is gone; tell hub_wq */
@@ -3087,6 +3092,15 @@ static int check_port_resume_type(structif (portchange &USB_PORT_STAT_C_ENABLE )usb_clear_port_feature (hub->hdev, port1,USB_PORT_FEAT_C_ENABLE ); + +/* +* Whatever made this reset-resume necessary may have +* turned on the port1 bit in hub->change_bits. But after +* a successful reset-resume we want the bit to be clear; +* if it was on it would indicate that something happened +* following the reset-resume. +*/ +clear_bit (port1, hub->change_bits); }return status;
Greg Kroah-Hartman
maintainerPATCH 100/168 USB: hub: Revert commit bd0e6c9614b9 ("usb: hub: try old enumeration scheme first for high speed devices")
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit 3155f4f40811c5d7e3c686215051acf504e05565 upstream.
Commit bd0e6c9614b9 ("usb: hub: try old enumeration scheme first for high speed devices") changed the way the hub driver enumerates high-speed devices. Instead of using the "new" enumeration scheme first and switching to the "old" scheme if that doesn't work, we start with the "old" scheme. In theory this is better because the "old" scheme is slightly faster -- it involves resetting the device only once instead of twice.
However, for a long time Windows used only the "new" scheme. Zeng Tao said that Windows 8 and later use the "old" scheme for high-speed devices, but apparently there are some devices that don't like it. William Bader reports that the Ricoh webcam built into his Sony Vaio laptop not only doesn't enumerate under the "old" scheme, it gets hung up so badly that it won't then enumerate under the "new" scheme! Only a cold reset will fix it.
Therefore we will revert the commit and go back to trying the "new" scheme first for high-speed devices.
Ref: https://bugzilla.kernel.org/show_bug.cgi?id=207219
--- Documentation/admin-guide/kernel-parameters.txt | 3 +-- drivers/usb/core/hub.c | 4 +--- 2 files changed, 2 insertions(+), 5 deletions(-)
Documentation/admin-guide/kernel-parameters.txt +1 -2
@@ -5005,8 +5005,7 @@ usbcore.old_scheme_first= [USB] Start with the old device initialization - scheme, applies only to low and full-speed devices - (default 0 = off). + scheme (default 0 = off). usbcore.usbfs_memory_mb= [USB] Memory limit (in MB) for buffers allocated by
drivers/usb/core/hub.c +1 -3
@@ -2727,13 +2727,11 @@ static bool use_new_scheme(struct usb_de {int old_scheme_first_port = port_dev->quirks &USB_PORT_QUIRK_OLD_SCHEME ; -int quick_enumeration = (udev->speed ==USB_SPEED_HIGH );if (udev->speed >=USB_SPEED_SUPER )return false; -return USE_NEW_SCHEME (retry, old_scheme_first_port || old_scheme_first - || quick_enumeration); +return USE_NEW_SCHEME (retry, old_scheme_first_port || old_scheme_first); }/* Is a USB 3.0 port in the Inactive or Compliance Mode state?
Greg Kroah-Hartman
maintainerPATCH 101/168 tty: serial: owl: add "much needed" clk_prepare_enable()
In reply to Greg Kroah-HartmanFrom: Amit Singh Tomar <[email protected]>
commit abf42d2f333b21bf8d33b2fbb8a85fa62037ac01 upstream.
commit 8ba92cf59335 ("arm64: dts: actions: s700: Add Clock Management Unit") breaks the UART on Cubieboard7-lite (based on S700 SoC), This is due to the fact that generic clk routine clk_disable_unused() disables the gate clks, and that in turns disables OWL UART (but UART driver never enables it). To prove this theory, Andre suggested to use "clk_ignore_unused" in kernel commnd line and it worked (Kernel happily lands into RAMFS world :)).
This commit fix this up by adding clk_prepare_enable().
--- drivers/tty/serial/owl-uart.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/tty/serial/owl-uart.c +7 -0
@@ -680,6 +680,12 @@ static int owl_uart_probe(struct platforreturn PTR_ERR (owl_port->clk); } + ret =clk_prepare_enable (owl_port->clk); +if (ret) { +dev_err (&pdev->dev,"could not enable clk\n" ); +return ret; + } + owl_port->port.dev = &pdev->dev; owl_port->port.line = pdev->id; owl_port->port.type =PORT_OWL ;
@@ -712,6 +718,7 @@ static int owl_uart_remove(struct platfouart_remove_one_port (&owl_uart_driver, &owl_port->port); owl_uart_ports[pdev->id] =NULL ; +clk_disable_unprepare (owl_port->clk);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 102/168 vmalloc: fix remap_vmalloc_range() bounds checks
In reply to Greg Kroah-HartmanFrom: Jann Horn <[email protected]>
commit bdebd6a2831b6fab69eb85cee74a8ba77f1a1cc2 upstream.
remap_vmalloc_range() has had various issues with the bounds checks it promises to perform ("This function checks that addr is a valid vmalloc'ed area, and that it is big enough to cover the vma") over time, e.g.:
- not detecting pgoff<<PAGE_SHIFT overflow
- not detecting (pgoff<<PAGE_SHIFT)+usize overflow
- not checking whether addr and addr+(pgoff<<PAGE_SHIFT) are the same vmalloc allocation
- comparing a potentially wildly out-of-bounds pointer with the end of the vmalloc region
In particular, since commit fc9702273e2e ("bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY"), unprivileged users can cause kernel null pointer dereferences by calling mmap() on a BPF map with a size that is bigger than the distance from the start of the BPF map to the end of the address space.
This could theoretically be used as a kernel ASLR bypass, by using whether mmap() with a given offset oopses or returns an error code to perform a binary search over the possible address range.
To allow remap_vmalloc_range_partial() to verify that addr and addr+(pgoff<<PAGE_SHIFT) are in the same vmalloc region, pass the offset to remap_vmalloc_range_partial() instead of adding it to the pointer in remap_vmalloc_range().
In remap_vmalloc_range_partial(), fix the check against get_vm_area_size() by using size comparisons instead of pointer comparisons, and add checks for pgoff.
--- fs/proc/vmcore.c | 5 +++-- include/linux/vmalloc.h | 2 +- mm/vmalloc.c | 16 +++++++++++++--- samples/vfio-mdev/mdpy.c | 2 +- 4 files changed, 18 insertions(+), 7 deletions(-)
fs/proc/vmcore.c +3 -2
@@ -266,7 +266,8 @@ static int vmcoredd_mmap_dumps(struct vmif (start < offset + dump->size) { tsz =min (offset + (u64 )dump->size - start, (u64 )size); buf = dump->buf + start - offset; -if (remap_vmalloc_range_partial (vma, dst, buf, tsz)) { +if (remap_vmalloc_range_partial (vma, dst, buf,0 , + tsz)) { ret = -EFAULT ; goto out_unlock; }
@@ -624,7 +625,7 @@ static int mmap_vmcore(struct file *file tsz =min (elfcorebuf_sz + elfnotes_sz - (size_t )start, size); kaddr = elfnotes_buf + start - elfcorebuf_sz - vmcoredd_orig_sz;if (remap_vmalloc_range_partial (vma, vma->vm_start + len, - kaddr, tsz)) + kaddr,0 , tsz)) goto fail; size -= tsz;
include/linux/vmalloc.h +1 -1
@@ -122,7 +122,7 @@ extern void vunmap(const void *addr);extern int remap_vmalloc_range_partial (struct vm_area_struct *vma,unsigned long uaddr,void *kaddr, -unsigned long size); +unsigned long pgoff,unsigned long size);extern int remap_vmalloc_range (struct vm_area_struct *vma,void *addr,unsigned long pgoff);
mm/vmalloc.c +13 -3
@@ -34,6 +34,7 @@#include <linux/llist.h> #include <linux/bitops.h> #include <linux/rbtree_augmented.h> +#include <linux/overflow.h> #include <linux/uaccess.h> #include <asm/tlbflush.h>
@@ -2976,6 +2977,7 @@ finished:* @vma: vma to cover * @uaddr: target user address to start at * @kaddr: virtual address of vmalloc kernel memory +* @pgoff: offset from @kaddr to start at * @size: size of map area * * Returns: 0 for success, -Exxx on failure
@@ -2988,9 +2990,15 @@ finished:* Similar to remap_pfn_range() (see mm/memory.c) */ int remap_vmalloc_range_partial (struct vm_area_struct *vma,unsigned long uaddr, -void *kaddr,unsigned long size) +void *kaddr,unsigned long pgoff, +unsigned long size) {struct vm_struct *area; +unsigned long off; +unsigned long end_index; + +if (check_shl_overflow (pgoff,PAGE_SHIFT , &off)) +return -EINVAL ; size =PAGE_ALIGN (size);
@@ -3004,8 +3012,10 @@ int remap_vmalloc_range_partial(struct vif (!(area->flags & (VM_USERMAP |VM_DMA_COHERENT )))return -EINVAL ; -if (kaddr + size > area->addr +get_vm_area_size (area)) +if (check_add_overflow (size, off, &end_index) || + end_index >get_vm_area_size (area))return -EINVAL ; + kaddr += off; do { struct page *page = vmalloc_to_page(kaddr);
@@ -3044,7 +3054,7 @@ int remap_vmalloc_range(struct vm_area_s unsigned long pgoff) {return remap_vmalloc_range_partial (vma, vma->vm_start, - addr + (pgoff <<PAGE_SHIFT ), + addr, pgoff, vma->vm_end - vma->vm_start); }EXPORT_SYMBOL (remap_vmalloc_range);
samples/vfio-mdev/mdpy.c +1 -1
@@ -418,7 +418,7 @@ static int mdpy_mmap(struct mdev_devicereturn -EINVAL ;return remap_vmalloc_range_partial (vma, vma->vm_start, - mdev_state->memblk, + mdev_state->memblk,0 , vma->vm_end - vma->vm_start); }
Greg Kroah-Hartman
maintainerPATCH 103/168 staging: gasket: Fix incongruency in handling of sysfs entries creation
In reply to Greg Kroah-HartmanFrom: Luis Mendes <[email protected]>
commit 9195d762042b0e5e4ded63606b4b30a93cba4400 upstream.
Fix incongruency in handling of sysfs entries creation. This issue could cause invalid memory accesses, by not properly detecting the end of the sysfs attributes array.
--- drivers/staging/gasket/gasket_sysfs.c | 3 +-- drivers/staging/gasket/gasket_sysfs.h | 4 ---- 2 files changed, 1 insertion(+), 6 deletions(-)
drivers/staging/gasket/gasket_sysfs.c +1 -2
@@ -228,8 +228,7 @@ int gasket_sysfs_create_entries(struct d }mutex_lock (&mapping->mutex); -for (i =0 ;strcmp (attrs[i].attr.attr.name,GASKET_ARRAY_END_MARKER ); - i++) { +for (i =0 ; attrs[i].attr.attr.name !=NULL ; i++) {if (mapping->attribute_count ==GASKET_SYSFS_MAX_NODES ) {dev_err (device,"Maximum number of sysfs nodes reached for device\n" );
drivers/staging/gasket/gasket_sysfs.h +0 -4
@@ -30,10 +30,6 @@*/ #define GASKET_SYSFS_MAX_NODES 196 -/* End markers for sysfs struct arrays. */ -#define GASKET_ARRAY_END_TOKEN GASKET_RESERVED_ARRAY_END -#define GASKET_ARRAY_END_MARKER __stringify(GASKET_ARRAY_END_TOKEN) -/* * Terminator struct for a gasket_sysfs_attr array. Must be at the end of * all gasket_sysfs_attribute arrays.
Greg Kroah-Hartman
maintainerPATCH 104/168 coredump: fix null pointer dereference on coredump
In reply to Greg Kroah-HartmanFrom: Sudip Mukherjee <[email protected]>
commit db973a7289dad24e6c017dcedc6aee886579dc3a upstream.
If the core_pattern is set to "|" and any process segfaults then we get a null pointer derefernce while trying to coredump. The call stack shows:
RIP: do_coredump+0x628/0x11c0
When the core_pattern has only "|" there is no use of trying the coredump and we can check that while formating the corename and exit with an error.
After this change I get:
format_corename failed
Aborting core
--- fs/coredump.c | 2 ++ 1 file changed, 2 insertions(+)
fs/coredump.c +2 -0
@@ -211,6 +211,8 @@ static int format_corename(struct core_nreturn -ENOMEM ; (*argv)[(*argc)++] =0 ; ++pat_ptr; +if (!(*pat_ptr)) +return -ENOMEM ; }/* Repeat as long as we have more pattern to process and more output
Greg Kroah-Hartman
maintainerPATCH 105/168 mm/hugetlb: fix a addressing exception caused by huge_pte_offset
In reply to Greg Kroah-HartmanFrom: Longpeng <[email protected]>
commit 3c1d7e6ccb644d517a12f73a7ff200870926f865 upstream.
Our machine encountered a panic(addressing exception) after run for a long time and the calltrace is:
RIP: hugetlb_fault+0x307/0xbe0
RSP: 0018:ffff9567fc27f808 EFLAGS: 00010286
RAX: e800c03ff1258d48 RBX: ffffd3bb003b69c0 RCX: e800c03ff1258d48
RDX: 17ff3fc00eda72b7 RSI: 00003ffffffff000 RDI: e800c03ff1258d48
RBP: ffff9567fc27f8c8 R08: e800c03ff1258d48 R09: 0000000000000080
R10: ffffaba0704c22a8 R11: 0000000000000001 R12: ffff95c87b4b60d8
R13: 00005fff00000000 R14: 0000000000000000 R15: ffff9567face8074
FS: 00007fe2d9ffb700(0000) GS:ffff956900e40000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffd3bb003b69c0 CR3: 000000be67374000 CR4: 00000000003627e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
follow_hugetlb_page+0x175/0x540
__get_user_pages+0x2a0/0x7e0
__get_user_pages_unlocked+0x15d/0x210
__gfn_to_pfn_memslot+0x3c5/0x460 [kvm]
try_async_pf+0x6e/0x2a0 [kvm]
tdp_page_fault+0x151/0x2d0 [kvm]
...
kvm_arch_vcpu_ioctl_run+0x330/0x490 [kvm]
kvm_vcpu_ioctl+0x309/0x6d0 [kvm]
do_vfs_ioctl+0x3f0/0x540
SyS_ioctl+0xa1/0xc0
system_call_fastpath+0x22/0x27For 1G hugepages, huge_pte_offset() wants to return NULL or pudp, but it may return a wrong 'pmdp' if there is a race. Please look at the following code snippet:
...
pud = pud_offset(p4d, addr);
if (sz != PUD_SIZE && pud_none(*pud))
return NULL;
/* hugepage or swap? */
if (pud_huge(*pud) || !pud_present(*pud))
return (pte_t *)pud;
pmd = pmd_offset(pud, addr);
if (sz != PMD_SIZE && pmd_none(*pmd))
return NULL;
/* hugepage or swap? */
if (pmd_huge(*pmd) || !pmd_present(*pmd))
return (pte_t *)pmd;
...The following sequence would trigger this bug:
- CPU0: sz = PUD_SIZE and *pud = 0 , continue
- CPU0: "pud_huge(*pud)" is false
- CPU1: calling hugetlb_no_page and set *pud to xxxx8e7(PRESENT)
- CPU0: "!pud_present(*pud)" is false, continue
- CPU0: pmd = pmd_offset(pud, addr) and maybe return a wrong pmdp
However, we want CPU0 to return NULL or pudp in this case.
We must make sure there is exactly one dereference of pud and pmd.
--- mm/hugetlb.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
mm/hugetlb.c +8 -6
@@ -5016,8 +5016,8 @@ pte_t *huge_pte_offset(struct mm_struct {pgd_t *pgd;p4d_t *p4d; -pud_t *pud; -pmd_t *pmd; +pud_t *pud, pud_entry; +pmd_t *pmd, pmd_entry; pgd =pgd_offset (mm, addr);if (!pgd_present (*pgd))
@@ -5027,17 +5027,19 @@ pte_t *huge_pte_offset(struct mm_structreturn NULL ; pud =pud_offset (p4d, addr); -if (sz !=PUD_SIZE &&pud_none (*pud)) + pud_entry =READ_ONCE (*pud); +if (sz !=PUD_SIZE &&pud_none (pud_entry))return NULL ;/* hugepage or swap? */ -if (pud_huge (*pud) || !pud_present (*pud)) +if (pud_huge (pud_entry) || !pud_present (pud_entry))return (pte_t *)pud; pmd =pmd_offset (pud, addr); -if (sz !=PMD_SIZE &&pmd_none (*pmd)) + pmd_entry =READ_ONCE (*pmd); +if (sz !=PMD_SIZE &&pmd_none (pmd_entry))return NULL ;/* hugepage or swap? */ -if (pmd_huge (*pmd) || !pmd_present (*pmd)) +if (pmd_huge (pmd_entry) || !pmd_present (pmd_entry))return (pte_t *)pmd;return NULL ;
Greg Kroah-Hartman
maintainerPATCH 106/168 mm/ksm: fix NULL pointer dereference when KSM zero page is enabled
In reply to Greg Kroah-HartmanFrom: Muchun Song <[email protected]>
commit 56df70a63ed5d989c1d36deee94cae14342be6e9 upstream.
find_mergeable_vma() can return NULL. In this case, it leads to a crash when we access vm_mm(its offset is 0x40) later in write_protect_page. And this case did happen on our server. The following call trace is captured in kernel 4.19 with the following patch applied and KSM zero page enabled on our server.
commit e86c59b1b12d ("mm/ksm: improve deduplication of zero pages with colouring")
So add a vma check to fix it.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000040
Oops: 0000 [#1] SMP NOPTI
CPU: 9 PID: 510 Comm: ksmd Kdump: loaded Tainted: G OE 4.19.36.bsk.9-amd64 #4.19.36.bsk.9
RIP: try_to_merge_one_page+0xc7/0x760
Code: 24 58 65 48 33 34 25 28 00 00 00 89 e8 0f 85 a3 06 00 00 48 83 c4
60 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 8b 46 08 a8 01 75 b8 <49>
8b 44 24 40 4c 8d 7c 24 20 b9 07 00 00 00 4c 89 e6 4c 89 ff 48
RSP: 0018:ffffadbdd9fffdb0 EFLAGS: 00010246
RAX: ffffda83ffd4be08 RBX: ffffda83ffd4be40 RCX: 0000002c6e800000
RDX: 0000000000000000 RSI: ffffda83ffd4be40 RDI: 0000000000000000
RBP: ffffa11939f02ec0 R08: 0000000094e1a447 R09: 00000000abe76577
R10: 0000000000000962 R11: 0000000000004e6a R12: 0000000000000000
R13: ffffda83b1e06380 R14: ffffa18f31f072c0 R15: ffffda83ffd4be40
FS: 0000000000000000(0000) GS:ffffa0da43b80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000040 CR3: 0000002c77c0a003 CR4: 00000000007626e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
ksm_scan_thread+0x115e/0x1960
kthread+0xf5/0x130
ret_from_fork+0x1f/0x30--- mm/ksm.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
mm/ksm.c +10 -2
@@ -2112,8 +2112,16 @@ static void cmp_and_merge_page(struct padown_read (&mm->mmap_sem); vma =find_mergeable_vma (mm, rmap_item->address); - err =try_to_merge_one_page (vma, page, -ZERO_PAGE (rmap_item->address)); +if (vma) { + err =try_to_merge_one_page (vma, page, +ZERO_PAGE (rmap_item->address)); + }else { +/* +* If the vma is out of date, we do not need to +* continue. +*/ + err =0 ; + }up_read (&mm->mmap_sem);/* * In case of failure, the page was not really empty, so we
Greg Kroah-Hartman
maintainerPATCH 107/168 tools/vm: fix cross-compile build
In reply to Greg Kroah-HartmanFrom: Lucas Stach <[email protected]>
commit cf01699ee220c38099eb3e43ce3d10690c8b7060 upstream.
Commit 7ed1c1901fe5 ("tools: fix cross-compile var clobbering") moved the setup of the CC variable to tools/scripts/Makefile.include to make the behavior consistent across all the tools Makefiles.
As the vm tools missed the include we end up with the wrong CC in a cross-compiling evironment.
--- tools/vm/Makefile | 2 ++ 1 file changed, 2 insertions(+)
tools/vm/Makefile +2 -0
@@ -1,6 +1,8 @@ # SPDX-License-Identifier: GPL-2.0 # Makefile for vm tools # +include ../scripts/Makefile.include + TARGETS=page-types slabinfo page_owner_sort LIB_DIR = ../lib/api
Greg Kroah-Hartman
maintainerPATCH 108/168 ALSA: usx2y: Fix potential NULL dereference
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 7686e3485253635c529cdd5f416fc640abaf076f upstream.
The error handling code in usX2Y_rate_set() may hit a potential NULL dereference when an error occurs before allocating all us->urb[]. Add a proper NULL check for fixing the corner case.
--- sound/usb/usx2y/usbusx2yaudio.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/usx2y/usbusx2yaudio.c +2 -0
@@ -681,6 +681,8 @@ static int usX2Y_rate_set(struct usX2Yde us->submitted =2 *NOOF_SETRATE_URBS ;for (i =0 ; i <NOOF_SETRATE_URBS ; ++i) {struct urb *urb = us->urb[i]; +if (!urb) +continue ;if (urb->status) {if (!err) err = -ENODEV ;
Greg Kroah-Hartman
maintainerPATCH 109/168 ALSA: hda/realtek - Fix unexpected init_amp override
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 67791202c5e069cf2ba51db0718d56c634709e78 upstream.
The commit 1c76aa5fb48d ("ALSA: hda/realtek - Allow skipping spec->init_amp detection") changed the way to assign spec->init_amp field that specifies the way to initialize the amp. Along with the change, the commit also replaced a few fixups that set spec->init_amp in HDA_FIXUP_ACT_PROBE with HDA_FIXUP_ACT_PRE_PROBE. This was rather aligning to the other fixups, and not supposed to change the actual behavior.
However, this change turned out to cause a regression on FSC S7020, which hit exactly the above. The reason was that there is still one place that overrides spec->init_amp after HDA_FIXUP_ACT_PRE_PROBE call, namely in alc_ssid_check().
This patch fixes the regression by adding the proper spec->init_amp override check, i.e. verifying whether it's still ALC_INIT_UNDEFINED.
--- sound/pci/hda/patch_realtek.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/pci/hda/patch_realtek.c +5 -3
@@ -789,9 +789,11 @@ static void alc_ssid_check(struct hda_co {if (!alc_subsystem_id (codec, ports)) {struct alc_spec *spec = codec->spec; -codec_dbg (codec, -"realtek: Enable default setup for auto mode as fallback\n" ); - spec->init_amp =ALC_INIT_DEFAULT ; +if (spec->init_amp ==ALC_INIT_UNDEFINED ) { +codec_dbg (codec, +"realtek: Enable default setup for auto mode as fallback\n" ); + spec->init_amp =ALC_INIT_DEFAULT ; + } } }
Greg Kroah-Hartman
maintainerPATCH 110/168 ALSA: hda/realtek - Add new codec supported for ALC245
In reply to Greg Kroah-HartmanFrom: Kailang Yang <[email protected]>
commit 7fbdcd8301a84c09cebfa64f1317a6dafeec9188 upstream.
Enable new codec supported for ALC245.
--- sound/pci/hda/patch_realtek.c | 3 +++ 1 file changed, 3 insertions(+)
sound/pci/hda/patch_realtek.c +3 -0
@@ -369,6 +369,7 @@ static void alc_fill_eapd_coef(struct hdcase 0x10ec0233 :case 0x10ec0235 :case 0x10ec0236 : +case 0x10ec0245 :case 0x10ec0255 :case 0x10ec0256 :case 0x10ec0257 :
@@ -8102,6 +8103,7 @@ static int patch_alc269(struct hda_codec spec->gen.mixer_nid =0 ;break ;case 0x10ec0215 : +case 0x10ec0245 :case 0x10ec0285 :case 0x10ec0289 : spec->codec_variant =ALC269_TYPE_ALC215 ;
@@ -9363,6 +9365,7 @@ static const struct hda_device_id snd_hdHDA_CODEC_ENTRY (0x10ec0234 ,"ALC234" , patch_alc269),HDA_CODEC_ENTRY (0x10ec0235 ,"ALC233" , patch_alc269),HDA_CODEC_ENTRY (0x10ec0236 ,"ALC236" , patch_alc269), +HDA_CODEC_ENTRY (0x10ec0245 ,"ALC245" , patch_alc269),HDA_CODEC_ENTRY (0x10ec0255 ,"ALC255" , patch_alc269),HDA_CODEC_ENTRY (0x10ec0256 ,"ALC256" , patch_alc269), HDA_CODEC_ENTRY(0x10ec0257, "ALC257", patch_alc269),
Greg Kroah-Hartman
maintainerPATCH 111/168 ALSA: hda/hdmi: Add module option to disable audio component binding
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit b392350ec3f229ad9603d3816f753479e441d99a upstream.
As the recent regression showed, we want sometimes to turn off the audio component binding just for debugging. This patch adds the module option to control it easily without compilation.
--- sound/pci/hda/patch_hdmi.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/pci/hda/patch_hdmi.c +9 -0
@@ -57,6 +57,10 @@ MODULE_PARM_DESC(static_hdmi_pcm, "Don't#define is_cherryview (codec) ((codec)->core.vendor_id == 0x80862883)#define is_valleyview_plus (codec) (is_valleyview(codec) || is_cherryview(codec)) +static bool enable_acomp = true; +module_param (enable_acomp, bool,0444 ); +MODULE_PARM_DESC (enable_acomp,"Enable audio component binding (default=yes)" ); +struct hdmi_spec_per_cvt {hda_nid_t cvt_nid;int assigned;
@@ -2550,6 +2554,11 @@ static void generic_acomp_init(struct hd { struct hdmi_spec *spec = codec->spec; + if (!enable_acomp) { + codec_info(codec, "audio component disabled by module option\n"); + return; + } + spec->port2pin = port2pin; setup_drm_audio_ops(codec, ops); if (!snd_hdac_acomp_init(&codec->bus->core, &spec->drm_audio_ops,
Greg Kroah-Hartman
maintainerPATCH 112/168 ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif
In reply to Greg Kroah-HartmanFrom: Xiyu Yang <[email protected]>
commit 59e1947ca09ebd1cae147c08c7c41f3141233c84 upstream.
snd_microii_spdif_default_get() invokes snd_usb_lock_shutdown(), which increases the refcount of the snd_usb_audio object "chip".
When snd_microii_spdif_default_get() returns, local variable "chip" becomes invalid, so the refcount should be decreased to keep refcount balanced.
The reference counting issue happens in several exception handling paths of snd_microii_spdif_default_get(). When those error scenarios occur such as usb_ifnum_to_if() returns NULL, the function forgets to decrease the refcnt increased by snd_usb_lock_shutdown(), causing a refcnt leak.
Fix this issue by jumping to "end" label when those error scenarios occur.
--- sound/usb/mixer_quirks.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
sound/usb/mixer_quirks.c +8 -4
@@ -1508,11 +1508,15 @@ static int snd_microii_spdif_default_get/* use known values for that card: interface#1 altsetting#1 */ iface =usb_ifnum_to_if (chip->dev,1 ); -if (!iface || iface->num_altsetting <2 ) -return -EINVAL ; +if (!iface || iface->num_altsetting <2 ) { + err = -EINVAL ; + goto end; + } alts = &iface->altsetting[1 ]; -if (get_iface_desc (alts)->bNumEndpoints <1 ) -return -EINVAL ; +if (get_iface_desc (alts)->bNumEndpoints <1 ) { + err = -EINVAL ; + goto end; + } ep =get_endpoint (alts,0 )->bEndpointAddress; err = snd_usb_ctl_msg(chip->dev,
Greg Kroah-Hartman
maintainerPATCH 113/168 ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices
In reply to Greg Kroah-HartmanFrom: Alexander Tsoy <[email protected]>
commit 1c826792586f526a5a5cd21d55aad388f5bb0b23 upstream.
Many Focusrite devices supports a limited set of sample rates per altsetting. These includes audio interfaces with ADAT ports:
- Scarlett 18i6, 18i8 1st gen, 18i20 1st gen;
- Scarlett 18i8 2nd gen, 18i20 2nd gen;
- Scarlett 18i8 3rd gen, 18i20 3rd gen;
- Clarett 2Pre USB, 4Pre USB, 8Pre USB.
Maximum rate is exposed in the last 4 bytes of Format Type descriptor which has a non-standard bLength = 10.
--- sound/usb/format.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+)
sound/usb/format.c +52 -0
@@ -227,6 +227,52 @@ static int parse_audio_format_rates_v1(s }/* +* Many Focusrite devices supports a limited set of sampling rates per +* altsetting. Maximum rate is exposed in the last 4 bytes of Format Type +* descriptor which has a non-standard bLength = 10. +*/ +static bool focusrite_valid_sample_rate (struct snd_usb_audio *chip, +struct audioformat *fp, +unsigned int rate) +{ +struct usb_interface *iface; +struct usb_host_interface *alts; +unsigned char *fmt; +unsigned int max_rate; + + iface =usb_ifnum_to_if (chip->dev, fp->iface); +if (!iface) +return true; + + alts = &iface->altsetting[fp->altset_idx]; + fmt =snd_usb_find_csint_desc (alts->extra, alts->extralen, +NULL ,UAC_FORMAT_TYPE ); +if (!fmt) +return true; + +if (fmt[0 ] ==10 ) {/* bLength */ + max_rate =combine_quad (&fmt[6 ]); + +/* Validate max rate */ +if (max_rate !=48000 && + max_rate !=96000 && + max_rate !=192000 && + max_rate !=384000 ) { + +usb_audio_info (chip, +"%u:%d : unexpected max rate: %u\n" , + fp->iface, fp->altsetting, max_rate); + +return true; + } + +return rate <= max_rate; + } + +return true; +} + +/* * Helper function to walk the array of sample rate triplets reported by * the device. The problem is that we need to parse whole array first to * get to know how many sample rates we have to expect.
@@ -262,6 +308,11 @@ static int parse_uac2_sample_rate_range( }for (rate = min; rate <= max; rate += res) { +/* Filter out invalid rates on Focusrite devices */ +if (USB_ID_VENDOR (chip->usb_id) ==0x1235 && + !focusrite_valid_sample_rate (chip, fp, rate)) + goto skip_rate; +if (fp->rate_table) fp->rate_table[nr_rates] = rate;if (!fp->rate_min || rate < fp->rate_min)
@@ -276,6 +327,7 @@ static int parse_uac2_sample_rate_range(break ; } +skip_rate:/* avoid endless loop */ if (res ==0 )break ;
Greg Kroah-Hartman
maintainerPATCH 114/168 tpm/tpm_tis: Free IRQ if probing fails
In reply to Greg Kroah-HartmanFrom: Jarkko Sakkinen <[email protected]>
commit b160c94be5d2816b62c8ac338605668304242959 upstream.
Call disable_interrupts() if we have to revert to polling in order not to unnecessarily reserve the IRQ for the life-cycle of the driver.
--- drivers/char/tpm/tpm_tis_core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/char/tpm/tpm_tis_core.c +7 -1
@@ -433,6 +433,9 @@ static void disable_interrupts(struct tpu32 intmask;int rc; +if (priv->irq ==0 ) +return ; + rc =tpm_tis_read32 (priv,TPM_INT_ENABLE (priv->locality), &intmask);if (rc <0 ) intmask =0 ;
@@ -983,9 +986,12 @@ int tpm_tis_core_init(struct device *devif (irq) {tpm_tis_probe_irq_single (chip, intmask,IRQF_SHARED , irq); -if (!(chip->flags &TPM_CHIP_FLAG_IRQ )) +if (!(chip->flags &TPM_CHIP_FLAG_IRQ )) {dev_err (&chip->dev,FW_BUG "TPM interrupt not working, polling instead\n" ); + +disable_interrupts (chip); + } }else {tpm_tis_probe_irq (chip, intmask); }
Greg Kroah-Hartman
maintainerPATCH 115/168 tpm: fix wrong return value in tpm_pcr_extend
In reply to Greg Kroah-HartmanFrom: Tianjia Zhang <[email protected]>
commit 29cb79795e324a8b65e7891d76f8f6ca911ba440 upstream.
For the algorithm that does not match the bank, a positive value EINVAL is returned here. I think this is a typo error. It is necessary to return an error value.
--- drivers/char/tpm/tpm-interface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/tpm/tpm-interface.c +1 -1
@@ -322,7 +322,7 @@ int tpm_pcr_extend(struct tpm_chip *chipfor (i =0 ; i < chip->nr_allocated_banks; i++) {if (digests[i].alg_id != chip->allocated_banks[i].alg_id) { - rc =EINVAL ; + rc = -EINVAL ; goto out; } }
Greg Kroah-Hartman
maintainerPATCH 116/168 tpm: ibmvtpm: retry on H_CLOSED in tpm_ibmvtpm_send()
In reply to Greg Kroah-HartmanFrom: George Wilson <[email protected]>
commit eba5cf3dcb844c82f54d4a857e124824e252206d upstream.
tpm_ibmvtpm_send() can fail during PowerVM Live Partition Mobility resume with an H_CLOSED return from ibmvtpm_send_crq(). The PAPR says, 'The "partner partition suspended" transport event disables the associated CRQ such that any H_SEND_CRQ hcall() to the associated CRQ returns H_Closed until the CRQ has been explicitly enabled using the H_ENABLE_CRQ hcall.' This patch adds a check in tpm_ibmvtpm_send() for an H_CLOSED return from ibmvtpm_send_crq() and in that case calls tpm_ibmvtpm_resume() and retries the ibmvtpm_send_crq() once.
--- drivers/char/tpm/tpm_ibmvtpm.c | 136 ++++++++++++++++++++++------------------- 1 file changed, 73 insertions(+), 63 deletions(-)
drivers/char/tpm/tpm_ibmvtpm.c +73 -63
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0-only /* -* Copyright (C) 2012 IBM Corporation +* Copyright (C) 2012-2020 IBM Corporation * * Author: Ashley Lai <[email protected]> *
@@ -134,6 +134,64 @@ static int tpm_ibmvtpm_recv(struct tpm_c }/** +* ibmvtpm_crq_send_init - Send a CRQ initialize message +* @ibmvtpm: vtpm device struct +* +* Return: +* 0 on success. +* Non-zero on failure. +*/ +static int ibmvtpm_crq_send_init (struct ibmvtpm_dev *ibmvtpm) +{ +int rc; + + rc =ibmvtpm_send_crq_word (ibmvtpm->vdev,INIT_CRQ_CMD ); +if (rc !=H_SUCCESS ) +dev_err (ibmvtpm->dev, +"%s failed rc=%d\n" , __func__, rc); + +return rc; +} + +/** +* tpm_ibmvtpm_resume - Resume from suspend +* +* @dev: device struct +* +* Return: Always 0. +*/ +static int tpm_ibmvtpm_resume (struct device *dev) +{ +struct tpm_chip *chip =dev_get_drvdata (dev); +struct ibmvtpm_dev *ibmvtpm =dev_get_drvdata (&chip->dev); +int rc =0 ; + +do { +if (rc) +msleep (100 ); + rc =plpar_hcall_norets (H_ENABLE_CRQ , + ibmvtpm->vdev->unit_address); + }while (rc ==H_IN_PROGRESS || rc ==H_BUSY ||H_IS_LONG_BUSY (rc)); + +if (rc) { +dev_err (dev,"Error enabling ibmvtpm rc=%d\n" , rc); +return rc; + } + + rc =vio_enable_interrupts (ibmvtpm->vdev); +if (rc) { +dev_err (dev,"Error vio_enable_interrupts rc=%d\n" , rc); +return rc; + } + + rc =ibmvtpm_crq_send_init (ibmvtpm); +if (rc) +dev_err (dev,"Error send_init rc=%d\n" , rc); + +return rc; +} + +/** * tpm_ibmvtpm_send() - Send a TPM command * @chip: tpm chip struct * @buf: buffer contains data to send
@@ -146,6 +204,7 @@ static int tpm_ibmvtpm_recv(struct tpm_cstatic int tpm_ibmvtpm_send (struct tpm_chip *chip,u8 *buf,size_t count) {struct ibmvtpm_dev *ibmvtpm =dev_get_drvdata (&chip->dev); +bool retry = true;int rc, sig;if (!ibmvtpm->rtce_buf) {
@@ -179,18 +238,27 @@ static int tpm_ibmvtpm_send(struct tpm_c*/ ibmvtpm->tpm_processing_cmd = true; +again: rc =ibmvtpm_send_crq (ibmvtpm->vdev,IBMVTPM_VALID_CMD ,VTPM_TPM_COMMAND , count, ibmvtpm->rtce_dma_handle);if (rc !=H_SUCCESS ) { +/* +* H_CLOSED can be returned after LPM resume. Call +* tpm_ibmvtpm_resume() to re-enable the CRQ then retry +* ibmvtpm_send_crq() once before failing. +*/ +if (rc ==H_CLOSED && retry) { +tpm_ibmvtpm_resume (ibmvtpm->dev); + retry = false; + goto again; + }dev_err (ibmvtpm->dev,"tpm_ibmvtpm_send failed rc=%d\n" , rc); - rc =0 ; ibmvtpm->tpm_processing_cmd = false; - }else - rc =0 ; + }spin_unlock (&ibmvtpm->rtce_lock); -return rc; +return 0 ; }static void tpm_ibmvtpm_cancel (struct tpm_chip *chip)
@@ -269,26 +337,6 @@ static int ibmvtpm_crq_send_init_complet }/** -* ibmvtpm_crq_send_init - Send a CRQ initialize message -* @ibmvtpm: vtpm device struct -* -* Return: -* 0 on success. -* Non-zero on failure. -*/ -static int ibmvtpm_crq_send_init (struct ibmvtpm_dev *ibmvtpm) -{ -int rc; - - rc =ibmvtpm_send_crq_word (ibmvtpm->vdev,INIT_CRQ_CMD ); -if (rc !=H_SUCCESS ) -dev_err (ibmvtpm->dev, -"ibmvtpm_crq_send_init failed rc=%d\n" , rc); - -return rc; -} - -/** * tpm_ibmvtpm_remove - ibm vtpm remove entry point * @vdev: vio device struct *
@@ -400,44 +448,6 @@ static int ibmvtpm_reset_crq(struct ibmv ibmvtpm->crq_dma_handle, CRQ_RES_BUF_SIZE); } -/** -* tpm_ibmvtpm_resume - Resume from suspend -* -* @dev: device struct -* -* Return: Always 0. -*/ -static int tpm_ibmvtpm_resume (struct device *dev) -{ -struct tpm_chip *chip =dev_get_drvdata (dev); -struct ibmvtpm_dev *ibmvtpm =dev_get_drvdata (&chip->dev); -int rc =0 ; - -do { -if (rc) -msleep (100 ); - rc =plpar_hcall_norets (H_ENABLE_CRQ , - ibmvtpm->vdev->unit_address); - }while (rc ==H_IN_PROGRESS || rc ==H_BUSY ||H_IS_LONG_BUSY (rc)); - -if (rc) { -dev_err (dev,"Error enabling ibmvtpm rc=%d\n" , rc); -return rc; - } - - rc =vio_enable_interrupts (ibmvtpm->vdev); -if (rc) { -dev_err (dev,"Error vio_enable_interrupts rc=%d\n" , rc); -return rc; - } - - rc =ibmvtpm_crq_send_init (ibmvtpm); -if (rc) -dev_err (dev,"Error send_init rc=%d\n" , rc); - -return rc; -} -static bool tpm_ibmvtpm_req_canceled (struct tpm_chip *chip,u8 status) {return (status ==0 );
Greg Kroah-Hartman
maintainerPATCH 117/168 KVM: s390: Return last valid slot if approx index is out-of-bounds
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 97daa028f3f621adff2c4f7b15fe0874e5b5bd6c upstream.
Return the index of the last valid slot from gfn_to_memslot_approx() if its binary search loop yielded an out-of-bounds index. The index can be out-of-bounds if the specified gfn is less than the base of the lowest memslot (which is also the last valid memslot).
Note, the sole caller, kvm_s390_get_cmma(), ensures used_slots is non-zero.
Message-Id: <[email protected]>
--- arch/s390/kvm/kvm-s390.c | 3 +++ 1 file changed, 3 insertions(+)
arch/s390/kvm/kvm-s390.c +3 -0
@@ -1932,6 +1932,9 @@ static int gfn_to_memslot_approx(struct start = slot +1 ; } +if (start >= slots->used_slots) +return slots->used_slots -1 ; +if (gfn >= memslots[start].base_gfn && gfn < memslots[start].base_gfn + memslots[start].npages) {atomic_set (&slots->lru_slot, start);
Greg Kroah-Hartman
maintainerPATCH 118/168 KVM: Check validity of resolved slot when searching memslots
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit b6467ab142b708dd076f6186ca274f14af379c72 upstream.
Check that the resolved slot (somewhat confusingly named 'start') is a valid/allocated slot before doing the final comparison to see if the specified gfn resides in the associated slot. The resolved slot can be invalid if the binary search loop terminated because the search index was incremented beyond the number of used slots.
This bug has existed since the binary search algorithm was introduced, but went unnoticed because KVM statically allocated memory for the max number of slots, i.e. the access would only be truly out-of-bounds if all possible slots were allocated and the specified gfn was less than the base of the lowest memslot. Commit 36947254e5f98 ("KVM: Dynamically size memslot array based on number of used slots") eliminated the "all possible slots allocated" condition and made the bug embarrasingly easy to hit.
Message-Id: <[email protected]>
--- include/linux/kvm_host.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/kvm_host.h +1 -1
@@ -1027,7 +1027,7 @@ search_memslots(struct kvm_memslots *slo start = slot +1 ; } -if (gfn >= memslots[start].base_gfn && +if (start < slots->used_slots && gfn >= memslots[start].base_gfn && gfn < memslots[start].base_gfn + memslots[start].npages) {atomic_set (&slots->lru_slot, start);return &memslots[start];
Greg Kroah-Hartman
maintainerPATCH 119/168 KVM: VMX: Enable machine check support for 32bit targets
In reply to Greg Kroah-HartmanFrom: Uros Bizjak <[email protected]>
commit fb56baae5ea509e63c2a068d66a4d8ea91969fca upstream.
There is no reason to limit the use of do_machine_check to 64bit targets. MCE handling works for both target familes.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/vmx/vmx.c +1 -1
@@ -4566,7 +4566,7 @@ static int handle_rmode_exception(struct*/ static void kvm_machine_check (void ) { -#if defined(CONFIG_X86_MCE ) && defined(CONFIG_X86_64 ) +#if defined(CONFIG_X86_MCE )struct pt_regs regs = { .cs =3 ,/* Fake ring 3 no matter what the guest ran on */ .flags = X86_EFLAGS_IF,
Greg Kroah-Hartman
maintainerPATCH 120/168 tty: hvc: fix buffer overflow during hvc_alloc().
In reply to Greg Kroah-HartmanFrom: Andrew Melnychenko <[email protected]>
commit 9a9fc42b86c06120744555fea43fdcabe297c656 upstream.
If there is a lot(more then 16) of virtio-console devices or virtio_console module is reloaded
- buffers 'vtermnos' and 'cons_ops' are overflowed.
In older kernels it overruns spinlock which leads to kernel freezing:
https://bugzilla.redhat.com/show_bug.cgi?id=1786239
To reproduce the issue, you can try simple script that loads/unloads module. Something like this:
while [ 1 ]
do
modprobe virtio_console
sleep 2
modprobe -r virtio_console
sleep 2
done
Description of problem:
Guest get 'Call Trace' when loading module "virtio_console" and unloading it frequently - clearly reproduced on kernel-4.18.0:
[ 81.498208] ------------[ cut here ]------------ [ 81.499263] pvqspinlock: lock 0xffffffff92080020 has corrupted value 0xc0774ca0! [ 81.501000] WARNING: CPU: 0 PID: 785 at kernel/locking/qspinlock_paravirt.h:500 __pv_queued_spin_unlock_slowpath+0xc0/0xd0 [ 81.503173] Modules linked in: virtio_console fuse xt_CHECKSUM ipt_MASQUERADE xt_conntrack ipt_REJECT nft_counter nf_nat_tftp nft_objref nf_conntrack_tftp tun bridge stp llc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nf_tables_set nft_chain_nat_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 nft_chain_route_ipv6 nft_chain_nat_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack nft_chain_route_ipv4 ip6_tables nft_compat ip_set nf_tables nfnetlink sunrpc bochs_drm drm_vram_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm i2c_piix4 pcspkr crct10dif_pclmul crc32_pclmul joydev ghash_clmulni_intel ip_tables xfs libcrc32c sd_mod sg ata_generic ata_piix virtio_net libata crc32c_intel net_failover failover serio_raw virtio_scsi dm_mirror dm_region_hash dm_log dm_mod [last unloaded: virtio_console] [ 81.517019] CPU: 0 PID: 785 Comm: kworker/0:2 Kdump: loaded Not tainted 4.18.0-167.el8.x86_64 #1 [ 81.518639] Hardware name: Red Hat KVM, BIOS 1.12.0-5.scrmod+el8.2.0+5159+d8aa4d83 04/01/2014 [ 81.520205] Workqueue: events control_work_handler [virtio_console] [ 81.521354] RIP: 0010:__pv_queued_spin_unlock_slowpath+0xc0/0xd0 [ 81.522450] Code: 07 00 48 63 7a 10 e8 bf 64 f5 ff 66 90 c3 8b 05 e6 cf d6 01 85 c0 74 01 c3 8b 17 48 89 fe 48 c7 c7 38 4b 29 91 e8 3a 6c fa ff <0f> 0b c3 0f 0b 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 [ 81.525830] RSP: 0018:ffffb51a01ffbd70 EFLAGS: 00010282 [ 81.526798] RAX: 0000000000000000 RBX: 0000000000000010 RCX: 0000000000000000 [ 81.528110] RDX: ffff9e66f1826480 RSI: ffff9e66f1816a08 RDI: ffff9e66f1816a08 [ 81.529437] RBP: ffffffff9153ff10 R08: 000000000000026c R09: 0000000000000053 [ 81.530732] R10: 0000000000000000 R11: ffffb51a01ffbc18 R12: ffff9e66cd682200 [ 81.532133] R13: ffffffff9153ff10 R14: ffff9e6685569500 R15: ffff9e66cd682000 [ 81.533442] FS: 0000000000000000(0000) GS:ffff9e66f1800000(0000) knlGS:0000000000000000 [ 81.534914] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 81.535971] CR2: 00005624c55b14d0 CR3: 00000003a023c000 CR4: 00000000003406f0 [ 81.537283] Call Trace: [ 81.537763] __raw_callee_save___pv_queued_spin_unlock_slowpath+0x11/0x20 [ 81.539011] .slowpath+0x9/0xe [ 81.539585] hvc_alloc+0x25e/0x300 [ 81.540237] init_port_console+0x28/0x100 [virtio_console] [ 81.541251] handle_control_message.constprop.27+0x1c4/0x310 [virtio_console] [ 81.542546] control_work_handler+0x70/0x10c [virtio_console] [ 81.543601] process_one_work+0x1a7/0x3b0 [ 81.544356] worker_thread+0x30/0x390 [ 81.545025] ? create_worker+0x1a0/0x1a0 [ 81.545749] kthread+0x112/0x130 [ 81.546358] ? kthread_flush_work_fn+0x10/0x10 [ 81.547183] ret_from_fork+0x22/0x40 [ 81.547842] ---[ end trace aa97649bd16c8655 ]--- [ 83.546539] general protection fault: 0000 [#1] SMP NOPTI [ 83.547422] CPU: 5 PID: 3225 Comm: modprobe Kdump: loaded Tainted: G W --------- - - 4.18.0-167.el8.x86_64 #1 [ 83.549191] Hardware name: Red Hat KVM, BIOS 1.12.0-5.scrmod+el8.2.0+5159+d8aa4d83 04/01/2014 [ 83.550544] RIP: 0010:__pv_queued_spin_lock_slowpath+0x19a/0x2a0 [ 83.551504] Code: c4 c1 ea 12 41 be 01 00 00 00 4c 8d 6d 14 41 83 e4 03 8d 42 ff 49 c1 e4 05 48 98 49 81 c4 40 a5 02 00 4c 03 24 c5 60 48 34 91 <49> 89 2c 24 b8 00 80 00 00 eb 15 84 c0 75 0a 41 0f b6 54 24 14 84 [ 83.554449] RSP: 0018:ffffb51a0323fdb0 EFLAGS: 00010202 [ 83.555290] RAX: 000000000000301c RBX: ffffffff92080020 RCX: 0000000000000001 [ 83.556426] RDX: 000000000000301d RSI: 0000000000000000 RDI: 0000000000000000 [ 83.557556] RBP: ffff9e66f196a540 R08: 000000000000028a R09: ffff9e66d2757788 [ 83.558688] R10: 0000000000000000 R11: 0000000000000000 R12: 646e61725f770b07 [ 83.559821] R13: ffff9e66f196a554 R14: 0000000000000001 R15: 0000000000180000 [ 83.560958] FS: 00007fd5032e8740(0000) GS:ffff9e66f1940000(0000) knlGS:0000000000000000 [ 83.562233] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.563149] CR2: 00007fd5022b0da0 CR3: 000000038c334000 CR4: 00000000003406e0
--- drivers/tty/hvc/hvc_console.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
drivers/tty/hvc/hvc_console.c +14 -9
@@ -302,10 +302,6 @@ int hvc_instantiate(uint32_t vtermno, in vtermnos[index] = vtermno; cons_ops[index] = ops; -/* reserve all indices up to and including this index */ -if (last_hvc < index) - last_hvc = index; -/* check if we need to re-register the kernel console */ hvc_check_console (index);
@@ -960,13 +956,22 @@ struct hvc_struct *hvc_alloc(uint32_t vt cons_ops[i] == hp->ops)break ; -/* no matching slot, just use a counter */ -if (i >=MAX_NR_HVC_CONSOLES ) - i = ++last_hvc; +if (i >=MAX_NR_HVC_CONSOLES ) { + +/* find 'empty' slot for console */ +for (i =0 ; i <MAX_NR_HVC_CONSOLES && vtermnos[i] !=-1 ; i++) { + } + +/* no matching slot, just use a counter */ +if (i ==MAX_NR_HVC_CONSOLES ) + i = ++last_hvc +MAX_NR_HVC_CONSOLES ; + } hp->index = i; - cons_ops[i] = ops; - vtermnos[i] = vtermno; +if (i <MAX_NR_HVC_CONSOLES ) { + cons_ops[i] = ops; + vtermnos[i] = vtermno; + }list_add_tail (&(hp->next), &hvc_structs);mutex_unlock (&hvc_structs_mutex);
Greg Kroah-Hartman
maintainerPATCH 121/168 tty: rocket, avoid OOB access
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
commit 7127d24372bf23675a36edc64d092dc7fd92ebe8 upstream.
init_r_port can access pc104 array out of bounds. pc104 is a 2D array defined to have 4 members. Each member has 8 submembers.
* we can have more than 4 (PCI) boards, i.e. [board] can be OOB
* line is not modulo-ed by anything, so the first line on the second board can be 4, on the 3rd 12 or alike (depending on previously registered boards). It's zero only on the first line of the first board. So even [line] can be OOB, quite soon (with the 2nd registered board already).
This code is broken for ages, so just avoid the OOB accesses and don't try to fix it as we would need to find out the correct line number. Use the default: RS232, if we are out.
Generally, if anyone needs to set the interface types, a module parameter is past the last thing that should be used for this purpose. The parameters' description says it's for ISA cards anyway.
--- drivers/tty/rocket.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
drivers/tty/rocket.c +14 -11
@@ -632,18 +632,21 @@ init_r_port(int board, int aiop, int chatty_port_init (&info->port); info->port.ops = &rocket_port_ops; info->flags &= ~ROCKET_MODE_MASK ; -switch (pc104[board][line]) { -case 422 : - info->flags |=ROCKET_MODE_RS422 ; -break ; -case 485 : - info->flags |=ROCKET_MODE_RS485 ; -break ; -case 232 : -default : +if (board <ARRAY_SIZE (pc104) && line <ARRAY_SIZE (pc104_1)) +switch (pc104[board][line]) { +case 422 : + info->flags |=ROCKET_MODE_RS422 ; +break ; +case 485 : + info->flags |=ROCKET_MODE_RS485 ; +break ; +case 232 : +default : + info->flags |=ROCKET_MODE_RS232 ; +break ; + } +else info->flags |=ROCKET_MODE_RS232 ; -break ; - } info->intmask =RXF_TRIG |TXFIFO_MT |SRC_INT |DELTA_CD |DELTA_CTS |DELTA_DSR ;if (sInitChan (ctlp, &info->channel, aiop, chan) ==0 ) {
Greg Kroah-Hartman
maintainerPATCH 122/168 usb-storage: Add unusual_devs entry for JMicron JMS566
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit 94f9c8c3c404ee1f7aaff81ad4f24aec4e34a78b upstream.
Cyril Roelandt reports that his JMicron JMS566 USB-SATA bridge fails to handle WRITE commands with the FUA bit set, even though it claims to support FUA. (Oddly enough, a later version of the same bridge, version 2.03 as opposed to 1.14, doesn't claim to support FUA. Also oddly, the bridge _does_ support FUA when using the UAS transport instead of the Bulk-Only transport -- but this device was blacklisted for uas in commit bc3bdb12bbb3 ("usb-storage: Disable UAS on JMicron SATA enclosure") for apparently unrelated reasons.)
This patch adds a usb-storage unusual_devs entry with the BROKEN_FUA flag. This allows the bridge to work properly with usb-storage.
--- drivers/usb/storage/unusual_devs.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_devs.h +7 -0
@@ -2323,6 +2323,13 @@ UNUSUAL_DEV( 0x3340, 0xffff, 0x0000, 0x USB_SC_DEVICE,USB_PR_DEVICE,NULL, US_FL_MAX_SECTORS_64 ), +/* Reported by Cyril Roelandt <[email protected]> */ +UNUSUAL_DEV (0x357d ,0x7788 ,0x0114 ,0x0114 , +"JMicron" , +"USB to ATA/ATAPI Bridge" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , +US_FL_BROKEN_FUA ), +/* Reported by Andrey Rahmatullin <[email protected]> */ UNUSUAL_DEV( 0x4102, 0x1020, 0x0100, 0x0100, "iRiver",
Greg Kroah-Hartman
maintainerPATCH 123/168 signal: Avoid corrupting si_pid and si_uid in do_notify_parent
In reply to Greg Kroah-HartmanFrom: Eric W. Biederman <[email protected]>
commit 61e713bdca3678e84815f2427f7a063fc353a1fc upstream.
Quoted 83 lines · Christof Meerwald
Hi,
this is probably related to commit
7a0cf094944e2540758b7f957eb6846d5126f535(signal: Correct namespace fixups ofsi_pidandsi_uid).With a 5.6.5 kernel I am seeing SIGCHLD signals that don't include a properly set
si_pidfield - this seems to happen for multi-threaded child processes.A simple test program (based on the sample from the signalfd man page):
#include <
sys/signalfd.h>
#include <signal.h>
#include <unistd.h>
#include <spawn.h>
#include <stdlib.h>
#include <stdio.h>#define
handle_error(msg)\
do { perror(msg);exit(EXIT_FAILURE); } while (0)int
main(int argc, char *argv[])
{
sigset_tmask;
int sfd;
structsignalfd_siginfofdsi;
ssize_ts;sigemptyset(&mask); sigaddset(&mask, SIGCHLD); if (sigprocmask(SIG_BLOCK, &mask, NULL) == -1) handle_error("sigprocmask"); pid_t chldpid; char *chldargv[] = { "./sfdclient", NULL }; posix_spawn(&chldpid, "./sfdclient", NULL, NULL, chldargv, NULL); sfd = signalfd(-1, &mask, 0); if (sfd == -1) handle_error("signalfd"); for (;;) { s = read(sfd, &fdsi, sizeof(struct signalfd_siginfo)); if (s != sizeof(struct signalfd_siginfo)) handle_error("read");if (fdsi.ssi_signo == SIGCHLD) { printf("Got SIGCHLD %d %d %d %d\n", fdsi.ssi_status, fdsi.ssi_code, fdsi.ssi_uid, fdsi.ssi_pid); return 0; } else { printf("Read unexpected signal\n"); }}
}and a multi-threaded client to test with:
#include <
unistd.h>
#include <pthread.h>void *f(void *arg)
{
sleep(100);
}int
main()
{
pthread_tt[8];for (int i = 0; i != 8; ++i)
{ pthread_create(&t[i], NULL, f, NULL);}
}I tried to do a bit of debugging and what seems to be happening is that
Quoted 8 lines
/* From an ancestor pid namespace? */
if (!task_pid_nr_ns(current,task_active_pid_ns(t))) {fails inside
task_pid_nr_nsbecause the check for "pid_alive" fails.This code seems to be called from
do_notify_parentand there we actually have "tsk != current" (I am assuming both are threads of the current process?)
I instrumented the code with a warning and received the following backtrace:
Quoted 21 lines
WARNING: CPU: 0 PID: 777 at kernel/pid.c:501 __task_pid_nr_ns.cold.6+0xc/0x15 Modules linked in: CPU: 0 PID: 777 Comm: sfdclient Not tainted 5.7.0-rc1userns+ #2924 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 RIP: 0010:__task_pid_nr_ns.cold.6+0xc/0x15 Code: ff 66 90 48 83 ec 08 89 7c 24 04 48 8d 7e 08 48 8d 74 24 04 e8 9a b6 44 00 48 83 c4 08 c3 48 c7 c7 59 9f ac 82 e8 c2 c4 04 00 <0f> 0b e9 3fd RSP: 0018:ffffc9000042fbf8 EFLAGS: 00010046 RAX: 000000000000000c RBX: 0000000000000000 RCX: ffffc9000042faf4 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff81193d29 RBP: ffffc9000042fc18 R08: 0000000000000000 R09: 0000000000000001 R10: 000000100f938416 R11: 0000000000000309 R12: ffff8880b941c140 R13: 0000000000000000 R14: 0000000000000000 R15: ffff8880b941c140 FS: 0000000000000000(0000) GS:ffff8880bca00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2e8c0a32e0 CR3: 0000000002e10000 CR4: 00000000000006f0 Call Trace: send_signal+0x1c8/0x310 do_notify_parent+0x50f/0x550 release_task.part.21+0x4fd/0x620 do_exit+0x6f6/0xaf0 do_group_exit+0x42/0xb0
Quoted 8 lines
get_signal+0x13b/0xbb0 do_signal+0x2b/0x670 ? __audit_syscall_exit+0x24d/0x2b0 ? rcu_read_lock_sched_held+0x4d/0x60 ? kfree+0x24c/0x2b0 do_syscall_64+0x176/0x640 ? trace_hardirqs_off_thunk+0x1a/0x1c entry_SYSCALL_64_after_hwframe+0x49/0xb3
The immediate problem is as Christof noticed that "pid_alive(current) == false". This happens because do_notify_parent is called from the last thread to exit in a process after that thread has been reaped.
The bigger issue is that do_notify_parent can be called from any process that manages to wait on a thread of a multi-threaded process from wait_task_zombie. So any logic based upon current for do_notify_parent is just nonsense, as current can be pretty much anything.
So change do_notify_parent to call __send_signal directly.
Inspecting the code it appears this problem has existed since the pid namespace support started handling this case in 2.6.30. This fix only backports to 7a0cf094944e ("signal: Correct namespace fixups of si_pid and si_uid") where the problem logic was moved out of __send_signal and into send_signal.
Ref: 921cf9f63089 ("signals: protect cinit from unblocked SIG_DFL signals")
--- kernel/signal.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/signal.c +5 -1
@@ -1993,8 +1993,12 @@ bool do_notify_parent(struct task_structif (psig->action[SIGCHLD -1 ].sa.sa_handler ==SIG_IGN ) sig =0 ; } +/* +* Send with __send_signal as si_pid and si_uid are in the +* parent's namespaces. +*/ if (valid_signal (sig) && sig) -__group_send_sig_info (sig, &info, tsk->parent); +__send_signal (sig, &info, tsk->parent,PIDTYPE_TGID , false);__wake_up_parent (tsk, tsk->parent);spin_unlock_irqrestore (&psig->siglock, flags);
Greg Kroah-Hartman
maintainerPATCH 124/168 audit: check the length of userspace generated audit records
In reply to Greg Kroah-HartmanFrom: Paul Moore <[email protected]>
commit 763dafc520add02a1f4639b500c509acc0ea8e5b upstream.
Commit 756125289285 ("audit: always check the netlink payload length in audit_receive_msg()") fixed a number of missing message length checks, but forgot to check the length of userspace generated audit records. The good news is that you need CAP_AUDIT_WRITE to submit userspace audit records, which is generally only given to trusted processes, so the impact should be limited.
--- kernel/audit.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/audit.c +3 -0
@@ -1325,6 +1325,9 @@ static int audit_receive_msg(struct sk_b case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:if (!audit_enabled && msg_type !=AUDIT_USER_AVC )return 0 ; +/* exit early if there isn't at least one character to print */ +if (data_len <2 ) +return -EINVAL ; err =audit_filter (msg_type,AUDIT_FILTER_USER );if (err ==1 ) {/* match or error */
Greg Kroah-Hartman
maintainerPATCH 125/168 ASoC: dapm: fixup dapm kcontrol widget
In reply to Greg Kroah-HartmanFrom: Gyeongtaek Lee <[email protected]>
commit ebf1474745b4373fdde0fcf32d9d1f369b50b212 upstream.
snd_soc_dapm_kcontrol widget which is created by autodisable control should contain correct on_val, mask and shift because it is set when the widget is powered and changed value is applied on registers by following code in dapm_seq_run_coalesced().
mask |= w->mask << w->shift; if (w->power) value |= w->on_val << w->shift; else value |= w->off_val << w->shift;
Shift on the mask in dapm_kcontrol_data_alloc() is removed to prevent double shift.
And, on_val in dapm_kcontrol_set_value() is modified to get correct value in the dapm_seq_run_coalesced().
--- sound/soc/soc-dapm.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
sound/soc/soc-dapm.c +17 -3
@@ -423,7 +423,7 @@ static int dapm_kcontrol_data_alloc(strumemset (&template,0 ,sizeof (template)); template.reg = e->reg; - template.mask = e->mask << e->shift_l; + template.mask = e->mask; template.shift = e->shift_l; template.off_val =snd_soc_enum_item_to_val (e,0 ); template.on_val = template.off_val;
@@ -546,8 +546,22 @@ static bool dapm_kcontrol_set_value(consif (data->value == value)return false; -if (data->widget) - data->widget->on_val = value; +if (data->widget) { +switch (dapm_kcontrol_get_wlist (kcontrol)->widgets[0 ]->id) { +case snd_soc_dapm_switch: +case snd_soc_dapm_mixer: +case snd_soc_dapm_mixer_named_ctl: + data->widget->on_val = value & data->widget->mask; +break ; +case snd_soc_dapm_demux: +case snd_soc_dapm_mux: + data->widget->on_val = value >> data->widget->shift; +break ; +default : + data->widget->on_val = value; +break ; + } + } data->value = value;
Greg Kroah-Hartman
maintainerPATCH 126/168 mac80211: populate debugfs only after cfg80211 init
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit 6cb5f3ea4654faf8c28b901266e960b1a4787b26 upstream.
When fixing the initialization race, we neglected to account for the fact that debugfs is initialized in wiphy_register(), and some debugfs things went missing (or rather were rerooted to the global debugfs root).
Fix this by adding debugfs entries only after wiphy_register(). This requires some changes in the rate control code since it currently adds debugfs at alloc time, which can no longer be done after the reordering.
--- drivers/net/wireless/intel/iwlegacy/3945-rs.c | 2 +- drivers/net/wireless/intel/iwlegacy/4965-rs.c | 2 +- drivers/net/wireless/intel/iwlwifi/dvm/rs.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 2 +- drivers/net/wireless/realtek/rtlwifi/rc.c | 2 +- include/net/mac80211.h | 4 +++- net/mac80211/main.c | 5 +++-- net/mac80211/rate.c | 15 ++++----------- net/mac80211/rate.h | 23 +++++++++++++++++++++++ net/mac80211/rc80211_minstrel_ht.c | 19 +++++++++++++------ 10 files changed, 51 insertions(+), 25 deletions(-)
drivers/net/wireless/intel/iwlegacy/3945-rs.c +1 -1
@@ -374,7 +374,7 @@ out: }static void * -il3945_rs_alloc (struct ieee80211_hw *hw,struct dentry *debugfsdir) +il3945_rs_alloc (struct ieee80211_hw *hw) {return hw->priv; }
drivers/net/wireless/intel/iwlegacy/4965-rs.c +1 -1
@@ -2474,7 +2474,7 @@ il4965_rs_fill_link_cmd(struct il_priv * }static void * -il4965_rs_alloc (struct ieee80211_hw *hw,struct dentry *debugfsdir) +il4965_rs_alloc (struct ieee80211_hw *hw) {return hw->priv; }
drivers/net/wireless/intel/iwlwifi/dvm/rs.c +1 -1
@@ -3019,7 +3019,7 @@ static void rs_fill_link_cmd(struct iwl_cpu_to_le16 (priv->lib->bt_params->agg_time_limit); } -static void *rs_alloc (struct ieee80211_hw *hw,struct dentry *debugfsdir) +static void *rs_alloc (struct ieee80211_hw *hw) {return hw->priv; }
drivers/net/wireless/intel/iwlwifi/mvm/rs.c +1 -1
@@ -3663,7 +3663,7 @@ static void rs_fill_lq_cmd(struct iwl_mvcpu_to_le16 (iwl_mvm_coex_agg_time_limit (mvm, sta)); } -static void *rs_alloc (struct ieee80211_hw *hw,struct dentry *debugfsdir) +static void *rs_alloc (struct ieee80211_hw *hw) {return hw->priv; }
drivers/net/wireless/realtek/rtlwifi/rc.c +1 -1
@@ -261,7 +261,7 @@ static void rtl_rate_update(void *ppriv, { } -static void *rtl_rate_alloc (struct ieee80211_hw *hw,struct dentry *debugfsdir) +static void *rtl_rate_alloc (struct ieee80211_hw *hw) {struct rtl_priv *rtlpriv =rtl_priv (hw);return rtlpriv;
include/net/mac80211.h +3 -1
@@ -5933,7 +5933,9 @@ enum rate_control_capabilities {struct rate_control_ops {unsigned long capa;const char *name; -void *(*alloc)(struct ieee80211_hw *hw,struct dentry *debugfsdir); +void *(*alloc)(struct ieee80211_hw *hw); +void (*add_debugfs)(struct ieee80211_hw *hw,void *priv, +struct dentry *debugfsdir);void (*free)(void *priv);void *(*alloc_sta)(void *priv,struct ieee80211_sta *sta,gfp_t gfp);
net/mac80211/main.c +3 -2
@@ -1155,8 +1155,6 @@ int ieee80211_register_hw(struct ieee802 local->tx_headroom = max_t(unsigned int , local->hw.extra_tx_headroom,IEEE80211_TX_STATUS_HEADROOM ); -debugfs_hw_add (local); -/* * if the driver doesn't specify a max listen interval we * use 5 which should be a safe default
@@ -1248,6 +1246,9 @@ int ieee80211_register_hw(struct ieee802if (result <0 ) goto fail_wiphy_register; +debugfs_hw_add (local); +rate_control_add_debugfs (local); +rtnl_lock ();/* add one default STA interface if supported */
net/mac80211/rate.c +4 -11
@@ -214,17 +214,16 @@ static ssize_t rcname_read(struct file * ref->ops->name, len); } -static const struct file_operations rcname_ops = { +const struct file_operations rcname_ops = { .read = rcname_read, .open = simple_open, .llseek = default_llseek, };#endif -static struct rate_control_ref *rate_control_alloc (const char *name, -struct ieee80211_local *local) +static struct rate_control_ref * +rate_control_alloc (const char *name,struct ieee80211_local *local) { -struct dentry *debugfsdir =NULL ;struct rate_control_ref *ref; ref =kmalloc (sizeof (struct rate_control_ref ),GFP_KERNEL );
@@ -234,13 +233,7 @@ static struct rate_control_ref *rate_conif (!ref->ops) goto free; -#ifdef CONFIG_MAC80211_DEBUGFS - debugfsdir =debugfs_create_dir ("rc" , local->hw.wiphy->debugfsdir); - local->debugfs.rcdir = debugfsdir; -debugfs_create_file ("name" ,0400 , debugfsdir, ref, &rcname_ops); -#endif - - ref->priv = ref->ops->alloc (&local->hw, debugfsdir); + ref->priv = ref->ops->alloc (&local->hw);if (!ref->priv) goto free;return ref;
net/mac80211/rate.h +23 -0
@@ -60,6 +60,29 @@ static inline void rate_control_add_sta_#endif } +extern const struct file_operations rcname_ops; + +static inline void rate_control_add_debugfs (struct ieee80211_local *local) +{ +#ifdef CONFIG_MAC80211_DEBUGFS +struct dentry *debugfsdir; + +if (!local->rate_ctrl) +return ; + +if (!local->rate_ctrl->ops->add_debugfs) +return ; + + debugfsdir =debugfs_create_dir ("rc" , local->hw.wiphy->debugfsdir); + local->debugfs.rcdir = debugfsdir; +debugfs_create_file ("name" ,0400 , debugfsdir, + local->rate_ctrl, &rcname_ops); + + local->rate_ctrl->ops->add_debugfs (&local->hw, local->rate_ctrl->priv, + debugfsdir); +#endif +} +void ieee80211_check_rate_mask (struct ieee80211_sub_if_data *sdata);/* Get a reference to the rate control algorithm. If `name' is NULL, get the
net/mac80211/rc80211_minstrel_ht.c +13 -6
@@ -1631,7 +1631,7 @@ minstrel_ht_init_cck_rates(struct minstr }static void * -minstrel_ht_alloc (struct ieee80211_hw *hw,struct dentry *debugfsdir) +minstrel_ht_alloc (struct ieee80211_hw *hw) {struct minstrel_priv *mp;
@@ -1668,18 +1668,24 @@ minstrel_ht_alloc(struct ieee80211_hw *h mp->hw = hw; mp->update_interval =100 ; +minstrel_ht_init_cck_rates (mp); + +return mp; +} +#ifdef CONFIG_MAC80211_DEBUGFS +static void minstrel_ht_add_debugfs (struct ieee80211_hw *hw,void *priv, +struct dentry *debugfsdir) +{ +struct minstrel_priv *mp = priv; + mp->fixed_rate_idx = (u32) -1 ;debugfs_create_u32 ("fixed_rate_idx" ,S_IRUGO |S_IWUGO , debugfsdir, &mp->fixed_rate_idx);debugfs_create_u32 ("sample_switch" ,S_IRUGO |S_IWUSR , debugfsdir, &mp->sample_switch); -#endif - -minstrel_ht_init_cck_rates (mp); - -return mp; } +#endif static void minstrel_ht_free (void *priv)
@@ -1718,6 +1724,7 @@ static const struct rate_control_ops mac .alloc = minstrel_ht_alloc, .free = minstrel_ht_free, #ifdef CONFIG_MAC80211_DEBUGFS + .add_debugfs = minstrel_ht_add_debugfs, .add_sta_debugfs = minstrel_ht_add_sta_debugfs, #endif .get_expected_throughput = minstrel_ht_get_expected_throughput,
Greg Kroah-Hartman
maintainerPATCH 127/168 SUNRPC: Fix backchannel RPC soft lockups
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
commit 6221f1d9b63fed6260273e59a2b89ab30537a811 upstream.
Currently, after the forward channel connection goes away, backchannel operations are causing soft lockups on the server because call_transmit_status's SOFTCONN logic ignores ENOTCONN. Such backchannel Calls are aggressively retried until the client reconnects.
Backchannel Calls should use RPC_TASK_NOCONNECT rather than RPC_TASK_SOFTCONN. If there is no forward connection, the server is not capable of establishing a connection back to the client, thus that backchannel request should fail before the server attempts to send it. Commit 58255a4e3ce5 ("NFSD: NFSv4 callback client should use RPC_TASK_SOFTCONN") was merged several years before RPC_TASK_NOCONNECT was available.
Because setup_callback_client() explicitly sets NOPING, the NFSv4.0 callback connection depends on the first callback RPC to initiate a connection to the client. Thus NFSv4.0 needs to continue to use RPC_TASK_SOFTCONN.
--- fs/nfsd/nfs4callback.c | 4 +++- net/sunrpc/svc_xprt.c | 2 ++ net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 2 ++ net/sunrpc/xprtsock.c | 1 + 4 files changed, 8 insertions(+), 1 deletion(-)
fs/nfsd/nfs4callback.c +3 -1
@@ -1241,6 +1241,7 @@ nfsd4_run_cb_work(struct work_struct *wo container_of(work, struct nfsd4_callback, cb_work);struct nfs4_client *clp = cb->cb_clp;struct rpc_clnt *clnt; +int flags;if (cb->cb_need_restart) { cb->cb_need_restart = false;
@@ -1269,7 +1270,8 @@ nfsd4_run_cb_work(struct work_struct *wo } cb->cb_msg.rpc_cred = clp->cl_cb_cred; -rpc_call_async (clnt, &cb->cb_msg,RPC_TASK_SOFT |RPC_TASK_SOFTCONN , + flags = clp->cl_minorversion ?RPC_TASK_NOCONNECT :RPC_TASK_SOFTCONN ; +rpc_call_async (clnt, &cb->cb_msg,RPC_TASK_SOFT | flags, cb->cb_ops ? &nfsd4_cb_ops : &nfsd4_cb_probe_ops, cb); }
net/sunrpc/svc_xprt.c +2 -0
@@ -1028,6 +1028,8 @@ static void svc_delete_xprt(struct svc_xdprintk ("svc: svc_delete_xprt(%p)\n" , xprt); xprt->xpt_ops->xpo_detach (xprt); +if (xprt->xpt_bc_xprt) + xprt->xpt_bc_xprt->ops->close (xprt->xpt_bc_xprt);spin_lock_bh (&serv->sv_lock);list_del_init (&xprt->xpt_list);
net/sunrpc/xprtrdma/svc_rdma_backchannel.c +2 -0
@@ -242,6 +242,8 @@ static void xprt_rdma_bc_close(struct rpc_xprt *xprt) {dprintk ("svcrdma: %s: xprt %p\n" , __func__, xprt); + +xprt_disconnect_done (xprt); xprt->cwnd =RPC_CWNDSHIFT ; }
net/sunrpc/xprtsock.c +1 -0
@@ -2714,6 +2714,7 @@ static int bc_send_request(struct rpc_rqstatic void bc_close (struct rpc_xprt *xprt) { +xprt_disconnect_done (xprt); }/*
Greg Kroah-Hartman
maintainerPATCH 128/168 iwlwifi: pcie: actually release queue memory in TVQM
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit b98b33d5560a2d940f3b80f6768a6177bf3dfbc0 upstream.
The iwl_trans_pcie_dyn_txq_free() function only releases the frames that may be left on the queue by calling iwl_pcie_gen2_txq_unmap(), but doesn't actually free the DMA ring or byte-count tables for the queue. This leads to pretty large memory leaks (at least before my queue size improvements), in particular in monitor/sniffer mode on channel hopping since this happens on every channel change.
This was also now more evident after the move to a DMA pool for the byte count tables, showing messages such as
BUG iwlwifi:bc (...): Objects remaining in iwlwifi:bc on __kmem_cache_shutdown()
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=206811.
--- drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +3 -0
@@ -1283,6 +1283,9 @@ void iwl_trans_pcie_dyn_txq_free(structiwl_pcie_gen2_txq_unmap (trans, queue); +iwl_pcie_gen2_txq_free_memory (trans, trans_pcie->txq[queue]); + trans_pcie->txq[queue] =NULL ; +IWL_DEBUG_TX_QUEUES (trans,"Deactivate queue %d\n" , queue); }
Greg Kroah-Hartman
maintainerPATCH 129/168 iwlwifi: mvm: beacon statistics shouldnt go backwards
In reply to Greg Kroah-HartmanFrom: Mordechay Goodstein <[email protected]>
commit 290d5e4951832e39d10f4184610dbf09038f8483 upstream.
We reset statistics also in case that we didn't reassoc so in this cases keep last beacon counter.
--- drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/rx.c +11 -2
@@ -8,7 +8,7 @@* Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH * Copyright(c) 2016 - 2017 Intel Deutschland GmbH -* Copyright(c) 2018 - 2019 Intel Corporation +* Copyright(c) 2018 - 2020 Intel Corporation * * This program is free software; you can redistribute it and/or modify * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@* Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH * Copyright(c) 2016 - 2017 Intel Deutschland GmbH -* Copyright(c) 2018 - 2019 Intel Corporation +* Copyright(c) 2018 - 2020 Intel Corporation * All rights reserved. * * Redistribution and use in source and binary forms, with or without
@@ -566,6 +566,7 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *struct iwl_mvm_stat_data {struct iwl_mvm *mvm; +__le32 flags;__le32 mac_id;u8 beacon_filter_average_energy;void *general;
@@ -606,6 +607,13 @@ static void iwl_mvm_stat_iterator(void * -general->beacon_average_energy[vif_id]; } +/* make sure that beacon statistics don't go backwards with TCM +* request to clear statistics +*/ +if (le32_to_cpu (data->flags) &IWL_STATISTICS_REPLY_FLG_CLEAR ) + mvmvif->beacon_stats.accu_num_beacons += + mvmvif->beacon_stats.num_beacons; +if (mvmvif->id != id)return ;
@@ -763,6 +771,7 @@ void iwl_mvm_handle_rx_statistics(struct flags = stats->flag; } + data.flags = flags;iwl_mvm_rx_stats_check_trigger (mvm, pkt);
Greg Kroah-Hartman
maintainerPATCH 130/168 iwlwifi: mvm: limit maximum queue appropriately
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit e5b72e3bc4763152e24bf4b8333bae21cc526c56 upstream.
Due to some hardware issues, queue 31 isn't usable on devices that have 32 queues (7000, 8000, 9000 families), which is correctly reflected in the configuration and TX queue initialization.
However, the firmware API and queue allocation code assumes that there are 32 queues, and if something actually attempts to use #31 this leads to a NULL-pointer dereference since it's not allocated.
Fix this by limiting to 31 in the IWL_MVM_DQA_MAX_DATA_QUEUE, and also add some code to catch this earlier in the future, if the configuration changes perhaps.
--- drivers/net/wireless/intel/iwlwifi/fw/api/txq.h | 6 +++--- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 5 +++++ 2 files changed, 8 insertions(+), 3 deletions(-)
drivers/net/wireless/intel/iwlwifi/fw/api/txq.h +3 -3
@@ -8,7 +8,7 @@* Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved. * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH * Copyright(c) 2016 - 2017 Intel Deutschland GmbH -* Copyright(c) 2019 Intel Corporation +* Copyright(c) 2019 - 2020 Intel Corporation * * This program is free software; you can redistribute it and/or modify * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@* Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved. * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH * Copyright(c) 2016 - 2017 Intel Deutschland GmbH -* Copyright(c) 2019 Intel Corporation +* Copyright(c) 2019 - 2020 Intel Corporation * All rights reserved. * * Redistribution and use in source and binary forms, with or without
@@ -99,7 +99,7 @@ enum iwl_mvm_dqa_txq {IWL_MVM_DQA_MAX_MGMT_QUEUE =8 ,IWL_MVM_DQA_AP_PROBE_RESP_QUEUE =9 ,IWL_MVM_DQA_MIN_DATA_QUEUE =10 , - IWL_MVM_DQA_MAX_DATA_QUEUE = 31, + IWL_MVM_DQA_MAX_DATA_QUEUE = 30, }; enum iwl_mvm_tx_fifo {
drivers/net/wireless/intel/iwlwifi/mvm/sta.c +5 -0
@@ -722,6 +722,11 @@ static int iwl_mvm_find_free_queue(struclockdep_assert_held (&mvm->mutex); +if (WARN (maxq >= mvm->trans->trans_cfg->base_params->num_of_queues, +"max queue %d >= num_of_queues (%d)" , maxq, + mvm->trans->trans_cfg->base_params->num_of_queues)) + maxq = mvm->trans->trans_cfg->base_params->num_of_queues -1 ; +/* This should not be hit with new TX path */ if (WARN_ON (iwl_mvm_has_new_tx_api (mvm)))return -ENOSPC ;
Greg Kroah-Hartman
maintainerPATCH 131/168 iwlwifi: mvm: Do not declare support for ACK Enabled Aggregation
In reply to Greg Kroah-HartmanFrom: Ilan Peer <[email protected]>
commit 38af8d5a90a8c3b41ff0484855e24bd55b43ce9d upstream.
As this was not supposed to be enabled to begin with.
--- drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c +2 -4
@@ -525,8 +525,7 @@ static struct ieee80211_sband_iftype_datIEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US | IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8, .mac_cap_info[2 ] = -IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP | - IEEE80211_HE_MAC_CAP2_ACK_EN, + IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP, .mac_cap_info[3 ] =IEEE80211_HE_MAC_CAP3_OMI_CONTROL | IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
@@ -610,8 +609,7 @@ static struct ieee80211_sband_iftype_datIEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US | IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8, .mac_cap_info[2 ] = -IEEE80211_HE_MAC_CAP2_BSR | - IEEE80211_HE_MAC_CAP2_ACK_EN, + IEEE80211_HE_MAC_CAP2_BSR, .mac_cap_info[3 ] =IEEE80211_HE_MAC_CAP3_OMI_CONTROL | IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
Greg Kroah-Hartman
maintainerPATCH 132/168 iwlwifi: mvm: fix inactive TID removal return value usage
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit e6d419f943318e2b903e380dfd52a8dda6db3021 upstream.
The function iwl_mvm_remove_inactive_tids() returns bool, so we should just check "if (ret)", not "if (ret >= 0)" (which would do nothing useful here). We obviously therefore cannot use the return value of the function for the free_queue, we need to use the queue (i) we're currently dealing with instead.
--- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/sta.c +2 -2
@@ -1169,9 +1169,9 @@ static int iwl_mvm_inactivity_check(stru inactive_tid_bitmap, &unshare_queues, &changetid_queues); -if (ret >=0 && free_queue <0 ) { +if (ret && free_queue <0 ) { queue_owner = sta; - free_queue = ret; + free_queue = i; }/* only unlock sta lock - we still need the queue info lock */ spin_unlock_bh (&mvmsta->lock);
Greg Kroah-Hartman
maintainerPATCH 133/168 cifs: fix uninitialised lease_key in open_shroot()
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
commit 0fe0781f29dd8ab618999e6bda33c782ebbdb109 upstream.
SMB2_open_init() expects a pre-initialised lease_key when opening a file with a lease, so set pfid->lease_key prior to calling it in open_shroot().
This issue was observed when performing some DFS failover tests and the lease key was never randomly generated.
--- fs/cifs/smb2ops.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/cifs/smb2ops.c +5 -0
@@ -664,6 +664,11 @@ int open_shroot(unsigned int xid, structif (smb3_encryption_required (tcon)) flags |=CIFS_TRANSFORM_REQ ; +if (!server->ops->new_lease_key) +return -EIO ; + + server->ops->new_lease_key (pfid); +memset (rqst,0 ,sizeof (rqst)); resp_buftype[0 ] = resp_buftype[1 ] =CIFS_NO_BUFFER ;memset (rsp_iov,0 ,sizeof (rsp_iov));
Greg Kroah-Hartman
maintainerPATCH 134/168 ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y
In reply to Greg Kroah-HartmanFrom: Ahmad Fatoum <[email protected]>
commit f1baca8896ae18e12c45552a4c4ae2086aa7e02c upstream.
512a928affd5 ("ARM: imx: build v7_cpu_resume() unconditionally") introduced an unintended linker error for i.MX6 configurations that have ARM_CPU_SUSPEND=n which can happen if neither CONFIG_PM, CONFIG_CPU_IDLE, nor ARM_PSCI_FW are selected.
Fix this by having v7_cpu_resume() compiled only when cpu_resume() it calls is available as well.
The C declaration for the function remains unguarded to avoid future code inadvertently using a stub and introducing a regression to the bug the original commit fixed.
--- arch/arm/mach-imx/Makefile | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/mach-imx/Makefile +2 -0
@@ -91,8 +91,10 @@ AFLAGS_suspend-imx6.o :=-Wa,-march=armv7 obj-$(CONFIG_SOC_IMX6) += suspend-imx6.o obj-$(CONFIG_SOC_IMX53) += suspend-imx53.o endif +ifeq ($(CONFIG_ARM_CPU_SUSPEND),y) AFLAGS_resume-imx6.o :=-Wa,-march=armv7-a obj-$(CONFIG_SOC_IMX6) += resume-imx6.o +endif obj-$(CONFIG_SOC_IMX6) += pm-imx6.o obj-$(CONFIG_SOC_IMX1) += mach-imx1.o
Greg Kroah-Hartman
maintainerPATCH 135/168 powerpc/setup_64: Set cache-line-size based on cache-block-size
In reply to Greg Kroah-HartmanFrom: Chris Packham <[email protected]>
commit 94c0b013c98583614e1ad911e8795ca36da34a85 upstream.
If {i,d}-cache-block-size is set and {i,d}-cache-line-size is not, use the block-size value for both. Per the devicetree spec cache-line-size is only needed if it differs from the block size.
Originally the code would fallback from block size to line size. An error message was printed if both properties were missing.
Later the code was refactored to use clearer names and logic but it inadvertently made line size a required property, meaning on systems without a line size property we fall back to the default from the cputable.
On powernv (OPAL) platforms, since the introduction of device tree CPU features (5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features")), that has led to the wrong value being used, as the fallback value is incorrect for Power8/Power9 CPUs.
The incorrect values flow through to the VDSO and also to the sysconf values, SC_LEVEL1_ICACHE_LINESIZE etc.
--- arch/powerpc/kernel/setup_64.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/kernel/setup_64.c +2 -0
@@ -541,6 +541,8 @@ static bool __init parse_cache_info(stru lsizep =of_get_property (np, propnames[3 ],NULL );if (bsizep ==NULL ) bsizep = lsizep; +if (lsizep ==NULL ) + lsizep = bsizep;if (lsizep !=NULL ) lsize =be32_to_cpu (*lsizep);if (bsizep !=NULL )
Greg Kroah-Hartman
maintainerPATCH 136/168 staging: comedi: dt2815: fix writing hi byte of analog output
In reply to Greg Kroah-HartmanFrom: Ian Abbott <[email protected]>
commit ed87d33ddbcd9a1c3b5ae87995da34e6f51a862c upstream.
The DT2815 analog output command is 16 bits wide, consisting of the 12-bit sample value in bits 15 to 4, the channel number in bits 3 to 1, and a voltage or current selector in bit 0. Both bytes of the 16-bit command need to be written in turn to a single 8-bit data register. However, the driver currently only writes the low 8-bits. It is broken and appears to have always been broken.
Electronic copies of the DT2815 User's Manual seem impossible to find online, but looking at the source code, a best guess for the sequence the driver intended to use to write the analog output command is as follows:
1. Wait for the status register to read 0x00.
2. Write the low byte of the command to the data register.
3. Wait for the status register to read 0x80.
4. Write the high byte of the command to the data register.
Step 4 is missing from the driver. Add step 4 to (hopefully) fix the driver.
Also add a "FIXME" comment about setting bit 0 of the low byte of the command. Supposedly, it is used to choose between voltage output and current output, but the current driver always sets it to 1.
--- drivers/staging/comedi/drivers/dt2815.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/staging/comedi/drivers/dt2815.c +3 -0
@@ -92,6 +92,7 @@ static int dt2815_ao_insn(struct comedi_int ret;for (i =0 ; i < insn->n; i++) { +/* FIXME: lo bit 0 chooses voltage output or current output */ lo = ((data[i] &0x0f ) <<4 ) | (chan <<1 ) |0x01 ; hi = (data[i] &0xff0 ) >>4 ;
@@ -105,6 +106,8 @@ static int dt2815_ao_insn(struct comedi_if (ret)return ret; +outb (hi, dev->iobase +DT2815_DATA ); + devpriv->ao_readback[chan] = data[i]; }return i;
Greg Kroah-Hartman
maintainerPATCH 137/168 staging: comedi: Fix comedi_device refcnt leak in comedi_open
In reply to Greg Kroah-HartmanFrom: Xiyu Yang <[email protected]>
commit 332e0e17ad49e084b7db670ef43b5eb59abd9e34 upstream.
comedi_open() invokes comedi_dev_get_from_minor(), which returns a reference of the COMEDI device to "dev" with increased refcount.
When comedi_open() returns, "dev" becomes invalid, so the refcount should be decreased to keep refcount balanced.
The reference counting issue happens in one exception handling path of comedi_open(). When "cfp" allocation is failed, the refcnt increased by comedi_dev_get_from_minor() is not decreased, causing a refcnt leak.
Fix this issue by calling comedi_dev_put() on this error path when "cfp" allocation is failed.
--- drivers/staging/comedi/comedi_fops.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/staging/comedi/comedi_fops.c +3 -1
@@ -2725,8 +2725,10 @@ static int comedi_open(struct inode *ino } cfp =kzalloc (sizeof (*cfp),GFP_KERNEL ); -if (!cfp) +if (!cfp) { +comedi_dev_put (dev);return -ENOMEM ; + } cfp->dev = dev;
Greg Kroah-Hartman
maintainerPATCH 138/168 vt: dont hardcode the mem allocation upper bound
In reply to Greg Kroah-HartmanFrom: Nicolas Pitre <[email protected]>
commit 2717769e204e83e65b8819c5e2ef3e5b6639b270 upstream.
The code in vc_do_resize() bounds the memory allocation size to avoid exceeding MAX_ORDER down the kzalloc() call chain and generating a runtime warning triggerable from user space. However, not only is it unwise to use a literal value here, but MAX_ORDER may also be configurable based on CONFIG_FORCE_MAX_ZONEORDER.
Let's use KMALLOC_MAX_SIZE instead.
Note that prior commit bb1107f7c605 ("mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER") the KMALLOC_MAX_SIZE value could not be relied upon.
--- drivers/tty/vt/vt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/vt/vt.c +1 -1
@@ -1206,7 +1206,7 @@ static int vc_do_resize(struct tty_strucif (new_cols == vc->vc_cols && new_rows == vc->vc_rows)return 0 ; -if (new_screen_size > (4 <<20 )) +if (new_screen_size >KMALLOC_MAX_SIZE )return -EINVAL ; newscreen =kzalloc (new_screen_size,GFP_USER );if (!newscreen)
Greg Kroah-Hartman
maintainerPATCH 139/168 vt: dont use kmalloc() for the unicode screen buffer
In reply to Greg Kroah-HartmanFrom: Nicolas Pitre <[email protected]>
commit 9a98e7a80f95378c9ee0c644705e3b5aa54745f1 upstream.
Even if the actual screen size is bounded in vc_do_resize(), the unicode buffer is still a little more than twice the size of the glyph buffer and may exceed MAX_ORDER down the kmalloc() path. This can be triggered from user space.
Since there is no point having a physically contiguous buffer here, let's avoid the above issue as well as reducing pressure on high order allocations by using vmalloc() instead.
--- drivers/tty/vt/vt.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/tty/vt/vt.c +3 -2
@@ -81,6 +81,7 @@#include <linux/errno.h> #include <linux/kd.h> #include <linux/slab.h> +#include <linux/vmalloc.h> #include <linux/major.h> #include <linux/mm.h> #include <linux/console.h>
@@ -350,7 +351,7 @@ static struct uni_screen *vc_uniscr_allo/* allocate everything in one go */ memsize = cols * rows *sizeof (char32_t ); memsize += rows *sizeof (char32_t *); - p =kmalloc (memsize,GFP_KERNEL ); + p =vmalloc (memsize);if (!p)return NULL ;
@@ -366,7 +367,7 @@ static struct uni_screen *vc_uniscr_allostatic void vc_uniscr_set (struct vc_data *vc,struct uni_screen *new_uniscr) { -kfree (vc->vc_uni_screen); +vfree (vc->vc_uni_screen); vc->vc_uni_screen = new_uniscr; }
Greg Kroah-Hartman
maintainerPATCH 140/168 staging: vt6656: Dont set RCR_MULTICAST or RCR_BROADCAST by default.
In reply to Greg Kroah-HartmanFrom: Malcolm Priestley <[email protected]>
commit 0f8240bfc070033a4823b19883efd3d38c7735cc upstream.
mac80211/users control whether multicast is on or off don't enable it by default.
Fixes an issue when multicast/broadcast is always on allowing other beacons through in power save.
--- drivers/staging/vt6656/main_usb.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/staging/vt6656/main_usb.c +2 -6
@@ -818,15 +818,11 @@ static void vnt_configure(struct ieee802 {struct vnt_private *priv = hw->priv;u8 rx_mode =0 ; -int rc; *total_flags &=FIF_ALLMULTI |FIF_OTHER_BSS |FIF_BCN_PRBRESP_PROMISC ; - rc =vnt_control_in (priv,MESSAGE_TYPE_READ ,MAC_REG_RCR , -MESSAGE_REQUEST_MACREG ,sizeof (u8), &rx_mode); - -if (!rc) - rx_mode =RCR_MULTICAST |RCR_BROADCAST ; +vnt_control_in (priv,MESSAGE_TYPE_READ ,MAC_REG_RCR , +MESSAGE_REQUEST_MACREG ,sizeof (u8), &rx_mode);dev_dbg (&priv->usb->dev,"rx mode in = %x\n" , rx_mode);
Greg Kroah-Hartman
maintainerPATCH 141/168 staging: vt6656: Fix calling conditions of vnt_set_bss_mode
In reply to Greg Kroah-HartmanFrom: Malcolm Priestley <[email protected]>
commit 664ba5180234593b4b8517530e8198bf2f7359e2 upstream.
vnt_set_bss_mode needs to be called on all changes to BSS_CHANGED_BASIC_RATES, BSS_CHANGED_ERP_PREAMBLE and BSS_CHANGED_ERP_SLOT
Remove all other calls and vnt_update_ifs which is called in vnt_set_bss_mode.
Fixes an issue that preamble mode is not being updated correctly.
--- drivers/staging/vt6656/main_usb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/staging/vt6656/main_usb.c +4 -4
@@ -633,8 +633,6 @@ static int vnt_add_interface(struct ieee priv->op_mode = vif->type; -vnt_set_bss_mode (priv); -/* LED blink on TX */ vnt_mac_set_led (priv,LEDSTS_STS ,LEDSTS_INTER );
@@ -721,7 +719,6 @@ static void vnt_bss_info_changed(struct priv->basic_rates = conf->basic_rates;vnt_update_top_rates (priv); -vnt_set_bss_mode (priv);dev_dbg (&priv->usb->dev,"basic rates %x\n" , conf->basic_rates); }
@@ -750,11 +747,14 @@ static void vnt_bss_info_changed(struct priv->short_slot_time = false;vnt_set_short_slot_time (priv); -vnt_update_ifs (priv);vnt_set_vga_gain_offset (priv, priv->bb_vga[0 ]);vnt_update_pre_ed_threshold (priv, false); } +if (changed & (BSS_CHANGED_BASIC_RATES |BSS_CHANGED_ERP_PREAMBLE | +BSS_CHANGED_ERP_SLOT )) +vnt_set_bss_mode (priv); +if (changed &BSS_CHANGED_TXPOWER )vnt_rf_setpower (priv, priv->current_rate, conf->chandef.chan->hw_value);
Greg Kroah-Hartman
maintainerPATCH 142/168 staging: vt6656: Fix drivers TBTT timing counter.
In reply to Greg Kroah-HartmanFrom: Malcolm Priestley <[email protected]>
commit 09057742af98a39ebffa27fac4f889dc873132de upstream.
The drivers TBTT counter is not synchronized with mac80211 timestamp.
Reorder the functions and use vnt_update_next_tbtt to do the final synchronize.
--- drivers/staging/vt6656/main_usb.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/staging/vt6656/main_usb.c +6 -3
@@ -778,12 +778,15 @@ static void vnt_bss_info_changed(structvnt_mac_reg_bits_on (priv,MAC_REG_TFTCTL ,TFTCTL_TSFCNTREN ); -vnt_adjust_tsf (priv, conf->beacon_rate->hw_value, - conf->sync_tsf, priv->current_tsf); -vnt_mac_set_beacon_interval (priv, conf->beacon_int);vnt_reset_next_tbtt (priv, conf->beacon_int); + +vnt_adjust_tsf (priv, conf->beacon_rate->hw_value, + conf->sync_tsf, priv->current_tsf); + +vnt_update_next_tbtt (priv, + conf->sync_tsf, conf->beacon_int); }else {vnt_clear_current_tsf (priv);
Greg Kroah-Hartman
maintainerPATCH 143/168 staging: vt6656: Fix pairwise key entry save.
In reply to Greg Kroah-HartmanFrom: Malcolm Priestley <[email protected]>
commit 0b59f10b1d8fe8d50944f21f5d403df9303095a8 upstream.
The problem is that the group key was saved as VNT_KEY_DEFAULTKEY was over written by the VNT_KEY_GROUP_ADDRESS index.
mac80211 could not clear the mac_addr in the default key.
The VNT_KEY_DEFAULTKEY is not necesscary so remove it and set as VNT_KEY_GROUP_ADDRESS.
mac80211 can clear any key using vnt_mac_disable_keyentry.
--- drivers/staging/vt6656/key.c | 14 +++----------- drivers/staging/vt6656/main_usb.c | 6 +++++- 2 files changed, 8 insertions(+), 12 deletions(-)
drivers/staging/vt6656/key.c +3 -11
@@ -83,9 +83,6 @@ static int vnt_set_keymode(struct ieee80case VNT_KEY_PAIRWISE : key_mode |= mode; key_inx =4 ; -/* Don't save entry for pairwise key for station mode */ -if (priv->op_mode ==NL80211_IFTYPE_STATION ) -clear_bit (entry, &priv->key_entry_inuse);break ;default :return -EINVAL ;
@@ -109,7 +106,6 @@ static int vnt_set_keymode(struct ieee80int vnt_set_keys (struct ieee80211_hw *hw,struct ieee80211_sta *sta,struct ieee80211_vif *vif,struct ieee80211_key_conf *key) { -struct ieee80211_bss_conf *conf = &vif->bss_conf;struct vnt_private *priv = hw->priv;u8 *mac_addr =NULL ;u8 key_dec_mode =0 ;
@@ -151,16 +147,12 @@ int vnt_set_keys(struct ieee80211_hw *hw key->flags |=IEEE80211_KEY_FLAG_GENERATE_IV ; } -if (key->flags &IEEE80211_KEY_FLAG_PAIRWISE ) { +if (key->flags &IEEE80211_KEY_FLAG_PAIRWISE )vnt_set_keymode (hw, mac_addr, key,VNT_KEY_PAIRWISE , key_dec_mode, true); - }else { -vnt_set_keymode (hw, mac_addr, key,VNT_KEY_DEFAULTKEY , +else +vnt_set_keymode (hw, mac_addr, key,VNT_KEY_GROUP_ADDRESS , key_dec_mode, true); -vnt_set_keymode (hw, (u8 *)conf->bssid, key, -VNT_KEY_GROUP_ADDRESS , key_dec_mode, true); - } -return 0 ; }
drivers/staging/vt6656/main_usb.c +5 -1
@@ -866,8 +866,12 @@ static int vnt_set_key(struct ieee80211_return -EOPNOTSUPP ;break ;case DISABLE_KEY : -if (test_bit (key->hw_key_idx, &priv->key_entry_inuse)) +if (test_bit (key->hw_key_idx, &priv->key_entry_inuse)) {clear_bit (key->hw_key_idx, &priv->key_entry_inuse); + +vnt_mac_disable_keyentry (priv, key->hw_key_idx); + } +default :break ; }
Greg Kroah-Hartman
maintainerPATCH 144/168 staging: vt6656: Power save stop wake_up_count wrap around.
In reply to Greg Kroah-HartmanFrom: Malcolm Priestley <[email protected]>
commit ea81c3486442f4643fc9825a2bb1b430b829bccd upstream.
conf.listen_interval can sometimes be zero causing wake_up_count to wrap around up to many beacons too late causing CTRL-EVENT-BEACON-LOSS as in.
wpa_supplicant[795]: message repeated 45 times: [..CTRL-EVENT-BEACON-LOSS ]
--- drivers/staging/vt6656/int.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/vt6656/int.c +2 -1
@@ -145,7 +145,8 @@ void vnt_int_process_data(struct vnt_pri priv->wake_up_count = priv->hw->conf.listen_interval; - --priv->wake_up_count; +if (priv->wake_up_count) + --priv->wake_up_count;/* Turn on wake up to listen next beacon */ if (priv->wake_up_count ==1 )
Greg Kroah-Hartman
maintainerPATCH 145/168 cdc-acm: close race betrween suspend() and acm_softint
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
commit 0afccd7601514c4b83d8cc58c740089cc447051d upstream.
Suspend increments a counter, then kills the URBs, then kills the scheduled work. The scheduled work, however, may reschedule the URBs. Fix this by having the work check the counter.
--- drivers/usb/class/cdc-acm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/class/cdc-acm.c +3 -3
@@ -557,14 +557,14 @@ static void acm_softint(struct work_stru struct acm *acm = container_of(work, struct acm, work);if (test_bit (EVENT_RX_STALL , &acm->flags)) { -if (!(usb_autopm_get_interface (acm->data))) { +smp_mb ();/* against acm_suspend() */ +if (!acm->susp_count) {for (i =0 ; i < acm->rx_buflimit; i++)usb_kill_urb (acm->read_urbs[i]);usb_clear_halt (acm->dev, acm->in);acm_submit_read_urbs (acm,GFP_KERNEL ); -usb_autopm_put_interface (acm->data); +clear_bit (EVENT_RX_STALL , &acm->flags); } -clear_bit (EVENT_RX_STALL , &acm->flags); }if (test_and_clear_bit (EVENT_TTY_WAKEUP , &acm->flags))
Greg Kroah-Hartman
maintainerPATCH 146/168 cdc-acm: introduce a cool down
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
commit a4e7279cd1d19f48f0af2a10ed020febaa9ac092 upstream.
Immediate submission in case of a babbling device can lead to a busy loop. Introducing a delayed work.
--- drivers/usb/class/cdc-acm.c | 30 ++++++++++++++++++++++++++++-- drivers/usb/class/cdc-acm.h | 5 ++++- 2 files changed, 32 insertions(+), 3 deletions(-)
drivers/usb/class/cdc-acm.c +28 -2
@@ -412,9 +412,12 @@ static void acm_ctrl_irq(struct urb *urb exit: retval =usb_submit_urb (urb,GFP_ATOMIC ); -if (retval && retval != -EPERM ) +if (retval && retval != -EPERM && retval != -ENODEV )dev_err (&acm->control->dev,"%s - usb_submit_urb failed: %d\n" , __func__, retval); +else +dev_vdbg (&acm->control->dev, +"control resubmission terminated %d\n" , retval); }static int acm_submit_read_urb (struct acm *acm,int index,gfp_t mem_flags)
@@ -430,6 +433,8 @@ static int acm_submit_read_urb(struct acdev_err (&acm->data->dev,"urb %d failed submission with %d\n" , index, res); + }else { +dev_vdbg (&acm->data->dev,"intended failure %d\n" , res); }set_bit (index, &acm->read_urbs_free);return res;
@@ -471,6 +476,7 @@ static void acm_read_bulk_callback(strucint status = urb->status;bool stopped = false;bool stalled = false; +bool cooldown = false;dev_vdbg (&acm->data->dev,"got urb %d, len %d, status %d\n" , rb->index, urb->actual_length, status);
@@ -497,6 +503,14 @@ static void acm_read_bulk_callback(struc __func__, status); stopped = true;break ; +case -EOVERFLOW : +case -EPROTO : +dev_dbg (&acm->data->dev, +"%s - cooling babbling device\n" , __func__); +usb_mark_last_busy (acm->dev); +set_bit (rb->index, &acm->urbs_in_error_delay); + cooldown = true; +break ;default : dev_dbg(&acm->data->dev, "%s - nonzero urb status received: %d\n",
@@ -518,9 +532,11 @@ static void acm_read_bulk_callback(struc*/ smp_mb__after_atomic (); -if (stopped || stalled) { +if (stopped || stalled || cooldown) {if (stalled)schedule_work (&acm->work); +else if (cooldown) +schedule_delayed_work (&acm->dwork,HZ /2 );return ; }
@@ -567,6 +583,12 @@ static void acm_softint(struct work_stru } } +if (test_and_clear_bit (ACM_ERROR_DELAY , &acm->flags)) { +for (i =0 ; i <ACM_NR ; i++) +if (test_and_clear_bit (i, &acm->urbs_in_error_delay)) +acm_submit_read_urb (acm, i,GFP_NOIO ); + } +if (test_and_clear_bit (EVENT_TTY_WAKEUP , &acm->flags))tty_port_tty_wakeup (&acm->port); }
@@ -1333,6 +1355,7 @@ made_compressed_probe: acm->readsize = readsize; acm->rx_buflimit = num_rx_buf;INIT_WORK (&acm->work, acm_softint); +INIT_DELAYED_WORK (&acm->dwork, acm_softint);init_waitqueue_head (&acm->wioctl);spin_lock_init (&acm->write_lock);spin_lock_init (&acm->read_lock);
@@ -1542,6 +1565,7 @@ static void acm_disconnect(struct usb_inacm_kill_urbs (acm);cancel_work_sync (&acm->work); +cancel_delayed_work_sync (&acm->dwork);tty_unregister_device (acm_tty_driver, acm->minor);
@@ -1584,6 +1608,8 @@ static int acm_suspend(struct usb_interfacm_kill_urbs (acm);cancel_work_sync (&acm->work); +cancel_delayed_work_sync (&acm->dwork); + acm->urbs_in_error_delay =0 ;return 0 ; }
drivers/usb/class/cdc-acm.h +4 -1
@@ -109,8 +109,11 @@ struct acm {# define EVENT_TTY_WAKEUP 0# define EVENT_RX_STALL 1# define ACM_THROTTLED 2 +# define ACM_ERROR_DELAY 3 +unsigned long urbs_in_error_delay;/* these need to be restarted after a delay */ struct usb_cdc_line_coding line;/* bits, stop, parity */ -struct work_struct work;/* work queue entry for line discipline waking up */ +struct work_struct work;/* work queue entry for various purposes*/ +struct delayed_work dwork;/* for cool downs needed in error recovery */ unsigned int ctrlin;/* input control lines (DCD, DSR, RI, break, overruns) */ unsigned int ctrlout;/* output control lines (DTR, RTS) */ struct async_icount iocount;/* counters for control line changes */
Greg Kroah-Hartman
maintainerPATCH 147/168 UAS: no use logging any details in case of ENODEV
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
commit 5963dec98dc52d52476390485f07a29c30c6a582 upstream.
Once a device is gone, the internal state does not matter anymore. There is no need to spam the logs.
--- drivers/usb/storage/uas.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/storage/uas.c +3 -0
@@ -190,6 +190,9 @@ static void uas_log_cmd_state(struct scsstruct uas_cmd_info *ci = (void *)&cmnd->SCp;struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp; +if (status == -ENODEV )/* too late */ +return ; + scmd_printk(KERN_INFO, cmnd, "%s %d uas-tag %d inflight:%s%s%s%s%s%s%s%s%s%s%s%s ", prefix, status, cmdinfo->uas_tag,
Greg Kroah-Hartman
maintainerPATCH 148/168 UAS: fix deadlock in error handling and PM flushing work
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
commit f6cc6093a729ede1ff5658b493237c42b82ba107 upstream.
A SCSI error handler and block runtime PM must not allocate memory with GFP_KERNEL. Furthermore they must not wait for tasks allocating memory with GFP_KERNEL.
That means that they cannot share a workqueue with arbitrary tasks.
Fix this for UAS using a private workqueue.
--- drivers/usb/storage/uas.c | 43 ++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 40 insertions(+), 3 deletions(-)
drivers/usb/storage/uas.c +40 -3
@@ -81,6 +81,19 @@ static void uas_free_streams(struct uas_static void uas_log_cmd_state (struct scsi_cmnd *cmnd,const char *prefix,int status); +/* +* This driver needs its own workqueue, as we need to control memory allocation. +* +* In the course of error handling and power management uas_wait_for_pending_cmnds() +* needs to flush pending work items. In these contexts we cannot allocate memory +* by doing block IO as we would deadlock. For the same reason we cannot wait +* for anything allocating memory not heeding these constraints. +* +* So we have to control all work items that can be on the workqueue we flush. +* Hence we cannot share a queue and need our own. +*/ +static struct workqueue_struct *workqueue; +static void uas_do_work (struct work_struct *work) { struct uas_dev_info *devinfo =
@@ -109,7 +122,7 @@ static void uas_do_work(struct work_struif (!err) cmdinfo->state &= ~IS_IN_WORK_LIST ;else -schedule_work (&devinfo->work); +queue_work (workqueue, &devinfo->work); } out:spin_unlock_irqrestore (&devinfo->lock, flags);
@@ -134,7 +147,7 @@ static void uas_add_work(struct uas_cmd_lockdep_assert_held (&devinfo->lock); cmdinfo->state |=IS_IN_WORK_LIST ; -schedule_work (&devinfo->work); +queue_work (workqueue, &devinfo->work); }static void uas_zap_pending (struct uas_dev_info *devinfo,int result)
@@ -1230,7 +1243,31 @@ static struct usb_driver uas_driver = { .id_table = uas_usb_ids, }; -module_usb_driver (uas_driver); +static int __init uas_init (void ) +{ +int rv; + + workqueue =alloc_workqueue ("uas" ,WQ_MEM_RECLAIM ,0 ); +if (!workqueue) +return -ENOMEM ; + + rv =usb_register (&uas_driver); +if (rv) { +destroy_workqueue (workqueue); +return -ENOMEM ; + } + +return 0 ; +} + +static void __exit uas_exit(void) +{ +usb_deregister (&uas_driver); +destroy_workqueue (workqueue); +} + +module_init (uas_init); +module_exit (uas_exit);MODULE_LICENSE ("GPL" );MODULE_IMPORT_NS (USB_STORAGE );
Greg Kroah-Hartman
maintainerPATCH 149/168 fpga: dfl: pci: fix return value of cci_pci_sriov_configure
In reply to Greg Kroah-HartmanFrom: Xu Yilun <[email protected]>
commit 3c2760b78f90db874401d97e3c17829e2e36f400 upstream.
pci_driver.sriov_configure should return negative value on error and number of enabled VFs on success. But now the driver returns 0 on success. The sriov configure still works but will cause a warning message:
XX VFs requested; only 0 enabled
This patch changes the return value accordingly.
--- drivers/fpga/dfl-pci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/fpga/dfl-pci.c +4 -2
@@ -248,11 +248,13 @@ static int cci_pci_sriov_configure(strucreturn ret; ret =pci_enable_sriov (pcidev, num_vfs); -if (ret) +if (ret) {dfl_fpga_cdev_config_ports_pf (cdev); +return ret; + } } -return ret; +return num_vfs; }static void cci_pci_remove (struct pci_dev *pcidev)
Greg Kroah-Hartman
maintainerPATCH 150/168 usb: dwc3: gadget: Fix request completion check
In reply to Greg Kroah-HartmanFrom: Thinh Nguyen <[email protected]>
commit 49e0590e3a60e75b493e5df879e216e5073c7663 upstream.
A request may not be completed because not all the TRBs are prepared for it. This happens when we run out of available TRBs. When some TRBs are completed, the driver needs to prepare the rest of the TRBs for the request. The check dwc3_gadget_ep_request_completed() shouldn't be checking the amount of data received but rather the number of pending TRBs. Revise this request completion check.
--- drivers/usb/dwc3/gadget.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-)
drivers/usb/dwc3/gadget.c +2 -10
@@ -2481,14 +2481,7 @@ static int dwc3_gadget_ep_reclaim_trb_listatic bool dwc3_gadget_ep_request_completed (struct dwc3_request *req) { -/* -* For OUT direction, host may send less than the setup -* length. Return true for all OUT requests. -*/ -if (!req->direction) -return true; - -return req->request.actual == req->request.length; +return req->num_pending_sgs ==0 ; } static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
@@ -2512,8 +2505,7 @@ static int dwc3_gadget_ep_cleanup_comple req->request.actual = req->request.length - req->remaining; -if (!dwc3_gadget_ep_request_completed (req) || - req->num_pending_sgs) { +if (!dwc3_gadget_ep_request_completed (req)) {__dwc3_gadget_kick_transfer (dep); goto out; }
Greg Kroah-Hartman
maintainerPATCH 151/168 usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset()
In reply to Greg Kroah-HartmanFrom: Udipto Goswami <[email protected]>
commit 1c2e54fbf1da5e5445a0ab132c862b02ccd8d230 upstream.
For userspace functions using OS Descriptors, if a function also supplies Extended Property descriptors currently the counts and lengths stored in the ms_os_descs_ext_prop_{count,name_len,data_len} variables are not getting reset to 0 during an unbind or when the epfiles are closed. If the same function is re-bound and the descriptors are re-written, this results in those count/length variables to monotonically increase causing the VLA allocation in _ffs_func_bind() to grow larger and larger at each bind/unbind cycle and eventually fail to allocate.
Fix this by clearing the ms_os_descs_ext_prop count & lengths to 0 in ffs_data_reset().
--- drivers/usb/gadget/function/f_fs.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/gadget/function/f_fs.c +4 -0
@@ -1828,6 +1828,10 @@ static void ffs_data_reset(struct ffs_da ffs->state =FFS_READ_DESCRIPTORS ; ffs->setup_state =FFS_NO_SETUP ; ffs->flags =0 ; + + ffs->ms_os_descs_ext_prop_count =0 ; + ffs->ms_os_descs_ext_prop_name_len =0 ; + ffs->ms_os_descs_ext_prop_data_len =0 ; }
Greg Kroah-Hartman
maintainerPATCH 152/168 usb: typec: tcpm: Ignore CC and vbus changes in PORT_RESET change
In reply to Greg Kroah-HartmanFrom: Badhri Jagan Sridharan <[email protected]>
commit 901789745a053286e0ced37960d44fa60267b940 upstream.
After PORT_RESET, the port is set to the appropriate default_state. Ignore processing CC changes here as this could cause the port to be switched into sink states by default.
echo source > /sys/class/typec/port0/port_type
Before:
[ 154.528547] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [ 154.528560] CC1: 0 -> 0, CC2: 3 -> 0 [state PORT_RESET, polarity 0, disconnected] [ 154.528564] state change PORT_RESET -> SNK_UNATTACHED
After:
[ 151.068814] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev3 NONE_AMS] [ 151.072440] CC1: 3 -> 0, CC2: 0 -> 0 [state PORT_RESET, polarity 0, disconnected] [ 151.172117] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms] [ 151.172136] pending state change PORT_RESET_WAIT_OFF -> SRC_UNATTACHED @ 870 ms [rev3 NONE_AMS] [ 152.060106] state change PORT_RESET_WAIT_OFF -> SRC_UNATTACHED [delayed 870 ms] [ 152.060118] Start toggling
--- drivers/usb/typec/tcpm/tcpm.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
drivers/usb/typec/tcpm/tcpm.c +26 -0
@@ -3768,6 +3768,14 @@ static void _tcpm_cc_change(struct tcpm_*/ break ; +case PORT_RESET : +case PORT_RESET_WAIT_OFF : +/* +* State set back to default mode once the timer completes. +* Ignore CC changes here. +*/ +break ; +default :if (tcpm_port_is_disconnected (port))tcpm_set_state (port,unattached_state (port),0 );
@@ -3829,6 +3837,15 @@ static void _tcpm_pd_vbus_on(struct tcpmcase SRC_TRY_DEBOUNCE :/* Do nothing, waiting for sink detection */ break ; + +case PORT_RESET : +case PORT_RESET_WAIT_OFF : +/* +* State set back to default mode once the timer completes. +* Ignore vbus changes here. +*/ +break ; +default :break ; }
@@ -3882,10 +3899,19 @@ static void _tcpm_pd_vbus_off(struct tcpcase PORT_RESET_WAIT_OFF :tcpm_set_state (port,tcpm_default_state (port),0 );break ; +case SRC_TRY_WAIT :case SRC_TRY_DEBOUNCE :/* Do nothing, waiting for sink detection */ break ; + +case PORT_RESET : +/* +* State set back to default mode once the timer completes. +* Ignore vbus changes here. +*/ +break ; +default :if (port->pwr_role ==TYPEC_SINK && port->attached)
Greg Kroah-Hartman
maintainerPATCH 153/168 usb: typec: altmode: Fix typec_altmode_get_partner sometimes returning an invalid pointer
In reply to Greg Kroah-HartmanFrom: Naoki Kiryu <[email protected]>
commit 0df9433fcae02215c8fd79690c134d535c7bb905 upstream.
Before this commit, typec_altmode_get_partner would return a const struct typec_altmode * pointing to address 0x08 when to_altmode(adev)->partner was NULL.
Add a check for to_altmode(adev)->partner being NULL to fix this.
--- drivers/usb/typec/bus.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/typec/bus.c +4 -1
@@ -192,7 +192,10 @@ EXPORT_SYMBOL_GPL(typec_altmode_vdm);const struct typec_altmode *typec_altmode_get_partner (struct typec_altmode *adev) { -return adev ? &to_altmode (adev)->partner->adev :NULL ; +if (!adev || !to_altmode (adev)->partner) +return NULL ; + +return &to_altmode (adev)->partner->adev; }EXPORT_SYMBOL_GPL (typec_altmode_get_partner);
Greg Kroah-Hartman
maintainerPATCH 154/168 xhci: Fix handling halted endpoint even if endpoint ring appears empty
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 93ceaa808e8defc67ebca1396e2f42f812a2efc0 upstream.
If a class driver cancels its only URB then the endpoint ring buffer will appear empty to the xhci driver. xHC hardware may still process cached TRBs, and complete with a STALL, halting the endpoint.
This halted endpoint was not handled correctly by xhci driver as events on empty rings were all assumed to be spurious events.
xhci driver refused to restart the ring with EP_HALTED flag set, so class driver was never informed the endpoint halted even if it queued new URBs.
The host side of the endpoint needs to be reset, and dequeue pointer should be moved in order to clear the cached TRBs and resetart the endpoint.
Small adjustments in finding the new dequeue pointer are needed to support the case of stall on an empty ring and unknown current TD.
--- drivers/usb/host/xhci-ring.c | 30 +++++++++++++++++++++++++++++- drivers/usb/host/xhci.c | 14 +++++++------- drivers/usb/host/xhci.h | 5 +++-- 3 files changed, 39 insertions(+), 10 deletions(-)
drivers/usb/host/xhci-ring.c +29 -1
@@ -541,6 +541,23 @@ void xhci_find_new_dequeue_state(struct stream_id);return ; } +/* +* A cancelled TD can complete with a stall if HW cached the trb. +* In this case driver can't find cur_td, but if the ring is empty we +* can move the dequeue pointer to the current enqueue position. +*/ +if (!cur_td) { +if (list_empty (&ep_ring->td_list)) { + state->new_deq_seg = ep_ring->enq_seg; + state->new_deq_ptr = ep_ring->enqueue; + state->new_cycle_state = ep_ring->cycle_state; + goto done; + }else { +xhci_warn (xhci,"Can't find new dequeue state, missing cur_td\n" ); +return ; + } + } +/* Dig out the cycle state saved by the xHC during the stop ep cmd */ xhci_dbg_trace (xhci, trace_xhci_dbg_cancel_urb,"Finding endpoint context" );
@@ -586,6 +603,7 @@ void xhci_find_new_dequeue_state(struct state->new_deq_seg = new_seg; state->new_deq_ptr = new_deq; +done:/* Don't update the ring cycle state for the producer (us). */ xhci_dbg_trace (xhci, trace_xhci_dbg_cancel_urb,"Cycle state = 0x%x" , state->new_cycle_state);
@@ -1848,7 +1866,8 @@ static void xhci_cleanup_halted_endpointif (reset_type ==EP_HARD_RESET ) { ep->ep_state |=EP_HARD_CLEAR_TOGGLE ; -xhci_cleanup_stalled_ring (xhci, ep_index, stream_id, td); +xhci_cleanup_stalled_ring (xhci, slot_id, ep_index, stream_id, + td);xhci_clear_hub_tt_buffer (xhci, td, ep); }xhci_ring_cmd_db (xhci);
@@ -2527,6 +2546,15 @@ static int handle_tx_event(struct xhci_hxhci_dbg (xhci,"td_list is empty while skip flag set. Clear skip flag for slot %u ep %u.\n" , slot_id, ep_index); } +if (trb_comp_code ==COMP_STALL_ERROR || +xhci_requires_manual_halt_cleanup (xhci, ep_ctx, + trb_comp_code)) { +xhci_cleanup_halted_endpoint (xhci, slot_id, + ep_index, + ep_ring->stream_id, +NULL , +EP_HARD_RESET ); + } goto cleanup; }
drivers/usb/host/xhci.c +7 -7
@@ -3031,19 +3031,19 @@ static void xhci_setup_input_ctx_for_qui added_ctxs, added_ctxs); } -void xhci_cleanup_stalled_ring (struct xhci_hcd *xhci,unsigned int ep_index, -unsigned int stream_id,struct xhci_td *td) +void xhci_cleanup_stalled_ring (struct xhci_hcd *xhci,unsigned int slot_id, +unsigned int ep_index,unsigned int stream_id, +struct xhci_td *td) {struct xhci_dequeue_state deq_state; -struct usb_device *udev = td->urb->dev;xhci_dbg_trace (xhci, trace_xhci_dbg_reset_ep,"Cleaning up stalled endpoint ring" );/* We need to move the HW's dequeue pointer past this TD, * or it will attempt to resend it on the next doorbell ring. */ -xhci_find_new_dequeue_state (xhci, udev->slot_id, - ep_index, stream_id, td, &deq_state); +xhci_find_new_dequeue_state (xhci, slot_id, ep_index, stream_id, td, + &deq_state);if (!deq_state.new_deq_ptr || !deq_state.new_deq_seg)return ;
@@ -3054,7 +3054,7 @@ void xhci_cleanup_stalled_ring(struct xhif (!(xhci->quirks &XHCI_RESET_EP_QUIRK )) {xhci_dbg_trace (xhci, trace_xhci_dbg_reset_ep,"Queueing new dequeue state" ); -xhci_queue_new_dequeue_state (xhci, udev->slot_id, +xhci_queue_new_dequeue_state (xhci, slot_id, ep_index, &deq_state); }else {/* Better hope no one uses the input context between now and the
@@ -3065,7 +3065,7 @@ void xhci_cleanup_stalled_ring(struct xhxhci_dbg_trace (xhci, trace_xhci_dbg_quirks,"Setting up input context for " "configure endpoint command" ); -xhci_setup_input_ctx_for_quirk (xhci, udev->slot_id, +xhci_setup_input_ctx_for_quirk (xhci, slot_id, ep_index, &deq_state); } }
drivers/usb/host/xhci.h +3 -2
@@ -2116,8 +2116,9 @@ void xhci_find_new_dequeue_state(structvoid xhci_queue_new_dequeue_state (struct xhci_hcd *xhci,unsigned int slot_id,unsigned int ep_index,struct xhci_dequeue_state *deq_state); -void xhci_cleanup_stalled_ring (struct xhci_hcd *xhci,unsigned int ep_index, -unsigned int stream_id,struct xhci_td *td); +void xhci_cleanup_stalled_ring (struct xhci_hcd *xhci,unsigned int slot_id, +unsigned int ep_index,unsigned int stream_id, +struct xhci_td *td);void xhci_stop_endpoint_command_watchdog (struct timer_list *t);void xhci_handle_command_timeout (struct work_struct *work);
Greg Kroah-Hartman
maintainerPATCH 155/168 xhci: prevent bus suspend if a roothub port detected a over-current condition
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit e9fb08d617bfae5471d902112667d0eeb9dee3c4 upstream.
Suspending the bus and host controller while a port is in a over-current condition may halt the host.
Also keep the roothub running if over-current is active.
--- drivers/usb/host/xhci-hub.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/host/xhci-hub.c +9 -0
@@ -1569,6 +1569,8 @@ int xhci_hub_status_data(struct usb_hcd }if ((temp &PORT_RC )) reset_change = true; +if (temp &PORT_OC ) + status =1 ; }if (!status && !reset_change) {xhci_dbg (xhci,"%s: stopping port polling.\n" , __func__);
@@ -1634,6 +1636,13 @@ retry: port_index); goto retry; } +/* bail out if port detected a over-current condition */ +if (t1 &PORT_OC ) { + bus_state->bus_suspended =0 ; +spin_unlock_irqrestore (&xhci->lock, flags); +xhci_dbg (xhci,"Bus suspend bailout, port over-current detected\n" ); +return -EBUSY ; + }/* suspend ports in U0, or bail out for new connect changes */ if ((t1 &PORT_PE ) && (t1 &PORT_PLS_MASK ) ==XDEV_U0 ) {if ((t1 &PORT_CSC ) && wake_enabled) {
Greg Kroah-Hartman
maintainerPATCH 156/168 xhci: Dont clear hub TT buffer on ep0 protocol stall
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 8f97250c21f0cf36434bf5b7ddf4377406534cd1 upstream.
The default control endpoint ep0 can return a STALL indicating the device does not support the control transfer requests. This is called a protocol stall and does not halt the endpoint.
xHC behaves a bit different. Its internal endpoint state will always be halted on any stall, even if the device side of the endpiont is not halted. So we do need to issue the reset endpoint command to clear the xHC host intenal endpoint halt state, but should not request the HS hub to clear the TT buffer unless device side of endpoint is halted.
Clearing the hub TT buffer at protocol stall caused ep0 to become unresponsive for some FS/LS devices behind HS hubs, and class drivers failed to set the interface due to timeout:
usb 1-2.1: 1:1: usb_set_interface failed (-110)
--- drivers/usb/host/xhci-ring.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/usb/host/xhci-ring.c +11 -5
@@ -1868,7 +1868,6 @@ static void xhci_cleanup_halted_endpoint ep->ep_state |=EP_HARD_CLEAR_TOGGLE ;xhci_cleanup_stalled_ring (xhci, slot_id, ep_index, stream_id, td); -xhci_clear_hub_tt_buffer (xhci, td, ep); }xhci_ring_cmd_db (xhci); }
@@ -1989,11 +1988,18 @@ static int finish_td(struct xhci_hcd *xhif (trb_comp_code ==COMP_STALL_ERROR ||xhci_requires_manual_halt_cleanup (xhci, ep_ctx, trb_comp_code)) { -/* Issue a reset endpoint command to clear the host side -* halt, followed by a set dequeue command to move the -* dequeue pointer past the TD. -* The class driver clears the device side halt later. +/* +* xhci internal endpoint state will go to a "halt" state for +* any stall, including default control pipe protocol stall. +* To clear the host side halt we need to issue a reset endpoint +* command, followed by a set dequeue command to move past the +* TD. +* Class drivers clear the device side halt from a functional +* stall later. Hub TT buffer should only be cleared for FS/LS +* devices behind HS hubs for functional stalls. */ +if ((ep_index !=0 ) || (trb_comp_code !=COMP_STALL_ERROR )) +xhci_clear_hub_tt_buffer (xhci, td, ep);xhci_cleanup_halted_endpoint (xhci, slot_id, ep_index, ep_ring->stream_id, td,EP_HARD_RESET ); }else {
Greg Kroah-Hartman
maintainerPATCH 157/168 serial: sh-sci: Make sure status register SCxSR is read in correct sequence
In reply to Greg Kroah-HartmanFrom: Kazuhiro Fujita <[email protected]>
commit 3dc4db3662366306e54ddcbda4804acb1258e4ba upstream.
For SCIF and HSCIF interfaces the SCxSR register holds the status of data that is to be read next from SCxRDR register, But where as for SCIFA and SCIFB interfaces SCxSR register holds status of data that is previously read from SCxRDR register.
This patch makes sure the status register is read depending on the port types so that errors are caught accordingly.
--- drivers/tty/serial/sh-sci.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/tty/serial/sh-sci.c +9 -2
@@ -873,9 +873,16 @@ static void sci_receive_chars(struct uartty_insert_flip_char (tport, c,TTY_NORMAL ); }else {for (i =0 ; i < count; i++) { -char c =serial_port_in (port, SCxRDR); +char c; - status =serial_port_in (port, SCxSR); +if (port->type ==PORT_SCIF || + port->type ==PORT_HSCIF ) { + status =serial_port_in (port, SCxSR); + c =serial_port_in (port, SCxRDR); + }else { + c =serial_port_in (port, SCxRDR); + status =serial_port_in (port, SCxSR); + }if (uart_handle_sysrq_char (port, c)) { count--; i--;continue ;
Greg Kroah-Hartman
maintainerPATCH 158/168 Revert "serial: uartps: Fix uartps_major handling"
In reply to Greg Kroah-HartmanFrom: Michal Simek <[email protected]>
commit 2e01911b7cf7aa07a304a809eca1b11a4bd35859 upstream.
This reverts commit 5e9bd2d70ae7c00a95a22994abf1eef728649e64.
As Johan says, this driver needs a lot more work and these changes are only going in the wrong direction:
https://lkml.kernel.org/r/20190523091839.GC568@localhost
--- drivers/tty/serial/xilinx_uartps.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/tty/serial/xilinx_uartps.c +1 -7
@@ -1550,6 +1550,7 @@ static int cdns_uart_probe(struct platfo goto err_out_id; } + uartps_major = cdns_uart_uart_driver->tty_driver->major; cdns_uart_data->cdns_uart_driver = cdns_uart_uart_driver;/*
@@ -1679,7 +1680,6 @@ static int cdns_uart_probe(struct platfo console_port =NULL ;#endif - uartps_major = cdns_uart_uart_driver->tty_driver->major; cdns_uart_data->cts_override =of_property_read_bool (pdev->dev.of_node,"cts-override" );return 0 ;
@@ -1741,12 +1741,6 @@ static int cdns_uart_remove(struct platf console_port =NULL ;#endif -/* If this is last instance major number should be initialized */ -mutex_lock (&bitmap_lock); -if (bitmap_empty (bitmap,MAX_UART_INSTANCES )) - uartps_major =0 ; -mutex_unlock (&bitmap_lock); -uart_unregister_driver (cdns_uart_data->cdns_uart_driver);return rc; }
Greg Kroah-Hartman
maintainerPATCH 159/168 Revert "serial: uartps: Use the same dynamic major number for all ports"
In reply to Greg Kroah-HartmanFrom: Michal Simek <[email protected]>
commit 8da1a3940da4b0e82848ec29b835486890bc9232 upstream.
This reverts commit ab262666018de6f4e206b021386b93ed0c164316.
As Johan says, this driver needs a lot more work and these changes are only going in the wrong direction:
https://lkml.kernel.org/r/20190523091839.GC568@localhost
--- drivers/tty/serial/xilinx_uartps.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/tty/serial/xilinx_uartps.c +2 -3
@@ -30,13 +30,13 @@#define CDNS_UART_TTY_NAME "ttyPS"#define CDNS_UART_NAME "xuartps" +#define CDNS_UART_MAJOR 0/* use dynamic node allocation */ #define CDNS_UART_FIFO_SIZE 64/* FIFO size */ #define CDNS_UART_REGISTER_SPACE 0x1000#define TX_TIMEOUT 500000/* Rx Trigger level */ static int rx_trigger_level =56 ; -static int uartps_major;module_param (rx_trigger_level, uint,0444 );MODULE_PARM_DESC (rx_trigger_level,"Rx trigger level, 1-63 bytes" );
@@ -1521,7 +1521,7 @@ static int cdns_uart_probe(struct platfo cdns_uart_uart_driver->owner =THIS_MODULE ; cdns_uart_uart_driver->driver_name = driver_name; cdns_uart_uart_driver->dev_name =CDNS_UART_TTY_NAME ; - cdns_uart_uart_driver->major = uartps_major; + cdns_uart_uart_driver->major =CDNS_UART_MAJOR ; cdns_uart_uart_driver->minor = cdns_uart_data->id; cdns_uart_uart_driver->nr =1 ;
@@ -1550,7 +1550,6 @@ static int cdns_uart_probe(struct platfo goto err_out_id; } - uartps_major = cdns_uart_uart_driver->tty_driver->major; cdns_uart_data->cdns_uart_driver = cdns_uart_uart_driver;/*
Greg Kroah-Hartman
maintainerPATCH 160/168 Revert "serial: uartps: Fix error path when alloc failed"
In reply to Greg Kroah-HartmanFrom: Michal Simek <[email protected]>
commit b6fd2dbbd649b89a3998528994665ded1e3fbf7f upstream.
This reverts commit 32cf21ac4edd6c0d5b9614368a83bcdc68acb031.
As Johan says, this driver needs a lot more work and these changes are only going in the wrong direction:
https://lkml.kernel.org/r/20190523091839.GC568@localhost
--- drivers/tty/serial/xilinx_uartps.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/tty/serial/xilinx_uartps.c +2 -4
@@ -1528,10 +1528,8 @@ static int cdns_uart_probe(struct platfo#ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE cdns_uart_console =devm_kzalloc (&pdev->dev,sizeof (*cdns_uart_console),GFP_KERNEL ); -if (!cdns_uart_console) { - rc = -ENOMEM ; - goto err_out_id; - } +if (!cdns_uart_console) +return -ENOMEM ;strncpy (cdns_uart_console->name,CDNS_UART_TTY_NAME ,sizeof (cdns_uart_console->name));
Greg Kroah-Hartman
maintainerPATCH 161/168 Revert "serial: uartps: Do not allow use aliases >= MAX_UART_INSTANCES"
In reply to Greg Kroah-HartmanFrom: Michal Simek <[email protected]>
commit 91c9dfa25c7f95b543c280e0edf1fd8de6e90985 upstream.
This reverts commit 2088cfd882d0403609bdf426e9b24372fe1b8337.
As Johan says, this driver needs a lot more work and these changes are only going in the wrong direction:
https://lkml.kernel.org/r/20190523091839.GC568@localhost
--- drivers/tty/serial/xilinx_uartps.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/tty/serial/xilinx_uartps.c +2 -4
@@ -1697,8 +1697,7 @@ err_out_unregister_driver:uart_unregister_driver (cdns_uart_data->cdns_uart_driver); err_out_id:mutex_lock (&bitmap_lock); -if (cdns_uart_data->id <MAX_UART_INSTANCES ) -clear_bit (cdns_uart_data->id, bitmap); +clear_bit (cdns_uart_data->id, bitmap);mutex_unlock (&bitmap_lock);return rc; }
@@ -1723,8 +1722,7 @@ static int cdns_uart_remove(struct platf rc =uart_remove_one_port (cdns_uart_data->cdns_uart_driver, port); port->mapbase =0 ;mutex_lock (&bitmap_lock); -if (cdns_uart_data->id <MAX_UART_INSTANCES ) -clear_bit (cdns_uart_data->id, bitmap); +clear_bit (cdns_uart_data->id, bitmap);mutex_unlock (&bitmap_lock);clk_disable_unprepare (cdns_uart_data->uartclk);clk_disable_unprepare (cdns_uart_data->pclk);
Greg Kroah-Hartman
maintainerPATCH 162/168 Revert "serial: uartps: Change uart ID port allocation"
In reply to Greg Kroah-HartmanFrom: Michal Simek <[email protected]>
commit 72d68197281e2ad313960504d10b0c41ff87fd55 upstream.
This reverts commit ae1cca3fa3478be92948dbbcd722390272032ade.
With setting up NR_PORTS to 16 to be able to use serial2 and higher aliases and don't loose functionality which was intended by these changes.
As Johan says, this driver needs a lot more work and these changes are only going in the wrong direction:
https://lkml.kernel.org/r/20190523091839.GC568@localhost
--- drivers/tty/serial/xilinx_uartps.c | 111 ++++--------------------------------- 1 file changed, 13 insertions(+), 98 deletions(-)
drivers/tty/serial/xilinx_uartps.c +13 -98
@@ -31,6 +31,7 @@#define CDNS_UART_TTY_NAME "ttyPS"#define CDNS_UART_NAME "xuartps"#define CDNS_UART_MAJOR 0/* use dynamic node allocation */ +#define CDNS_UART_NR_PORTS 16#define CDNS_UART_FIFO_SIZE 64/* FIFO size */ #define CDNS_UART_REGISTER_SPACE 0x1000#define TX_TIMEOUT 500000
@@ -1389,90 +1390,6 @@ static const struct of_device_id cdns_ua };MODULE_DEVICE_TABLE (of, cdns_uart_of_match); -/* -* Maximum number of instances without alias IDs but if there is alias -* which target "< MAX_UART_INSTANCES" range this ID can't be used. -*/ -#define MAX_UART_INSTANCES 32 - -/* Stores static aliases list */ -static DECLARE_BITMAP(alias_bitmap, MAX_UART_INSTANCES); -static int alias_bitmap_initialized; - -/* Stores actual bitmap of allocated IDs with alias IDs together */ -static DECLARE_BITMAP(bitmap, MAX_UART_INSTANCES); -/* Protect bitmap operations to have unique IDs */ -static DEFINE_MUTEX (bitmap_lock); - -static int cdns_get_id (struct platform_device *pdev) -{ -int id, ret; - -mutex_lock (&bitmap_lock); - -/* Alias list is stable that's why get alias bitmap only once */ -if (!alias_bitmap_initialized) { - ret =of_alias_get_alias_list (cdns_uart_of_match,"serial" , - alias_bitmap,MAX_UART_INSTANCES ); -if (ret && ret != -EOVERFLOW ) { -mutex_unlock (&bitmap_lock); -return ret; - } - - alias_bitmap_initialized++; - } - -/* Make sure that alias ID is not taken by instance without alias */ -bitmap_or (bitmap, bitmap, alias_bitmap,MAX_UART_INSTANCES ); - -dev_dbg (&pdev->dev,"Alias bitmap: %*pb\n" , -MAX_UART_INSTANCES , bitmap); - -/* Look for a serialN alias */ - id =of_alias_get_id (pdev->dev.of_node,"serial" ); -if (id <0 ) { -dev_warn (&pdev->dev, -"No serial alias passed. Using the first free id\n" ); - -/* -* Start with id 0 and check if there is no serial0 alias -* which points to device which is compatible with this driver. -* If alias exists then try next free position. -*/ - id =0 ; - -for (;;) { -dev_info (&pdev->dev,"Checking id %d\n" , id); - id =find_next_zero_bit (bitmap,MAX_UART_INSTANCES , id); - -/* No free empty instance */ -if (id ==MAX_UART_INSTANCES ) { -dev_err (&pdev->dev,"No free ID\n" ); -mutex_unlock (&bitmap_lock); -return -EINVAL ; - } - -dev_dbg (&pdev->dev,"The empty id is %d\n" , id); -/* Check if ID is empty */ -if (!test_and_set_bit (id, bitmap)) { -/* Break the loop if bit is taken */ -dev_dbg (&pdev->dev, -"Selected ID %d allocation passed\n" , - id); -break ; - } -dev_dbg (&pdev->dev, -"Selected ID %d allocation failed\n" , id); -/* if taking bit fails then try next one */ - id++; - } - } - -mutex_unlock (&bitmap_lock); - -return id; -} -/** * cdns_uart_probe - Platform driver probe * @pdev: Pointer to the platform device structure
@@ -1506,17 +1423,21 @@ static int cdns_uart_probe(struct platfoif (!cdns_uart_uart_driver)return -ENOMEM ; - cdns_uart_data->id =cdns_get_id (pdev); +/* Look for a serialN alias */ + cdns_uart_data->id =of_alias_get_id (pdev->dev.of_node,"serial" );if (cdns_uart_data->id <0 ) -return cdns_uart_data->id; + cdns_uart_data->id =0 ; + +if (cdns_uart_data->id >=CDNS_UART_NR_PORTS ) { +dev_err (&pdev->dev,"Cannot get uart_port structure\n" ); +return -ENODEV ; + }/* There is a need to use unique driver name */ driver_name =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"%s%d" ,CDNS_UART_NAME , cdns_uart_data->id); -if (!driver_name) { - rc = -ENOMEM ; - goto err_out_id; - } +if (!driver_name) +return -ENOMEM ; cdns_uart_uart_driver->owner =THIS_MODULE ; cdns_uart_uart_driver->driver_name = driver_name;
@@ -1545,7 +1466,7 @@ static int cdns_uart_probe(struct platfo rc =uart_register_driver (cdns_uart_uart_driver);if (rc <0 ) {dev_err (&pdev->dev,"Failed to register driver\n" ); - goto err_out_id; +return rc; } cdns_uart_data->cdns_uart_driver = cdns_uart_uart_driver;
@@ -1695,10 +1616,7 @@ err_out_clk_dis_pclk:clk_disable_unprepare (cdns_uart_data->pclk); err_out_unregister_driver:uart_unregister_driver (cdns_uart_data->cdns_uart_driver); -err_out_id: -mutex_lock (&bitmap_lock); -clear_bit (cdns_uart_data->id, bitmap); -mutex_unlock (&bitmap_lock); +return rc; }
@@ -1721,9 +1639,6 @@ static int cdns_uart_remove(struct platf#endif rc =uart_remove_one_port (cdns_uart_data->cdns_uart_driver, port); port->mapbase =0 ; -mutex_lock (&bitmap_lock); -clear_bit (cdns_uart_data->id, bitmap); -mutex_unlock (&bitmap_lock);clk_disable_unprepare (cdns_uart_data->uartclk);clk_disable_unprepare (cdns_uart_data->pclk);pm_runtime_disable (&pdev->dev);