5.8.2-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainerPATCH 148/464 btmrvl: Fix firmware filename for sd8997 chipset
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit 00eb0cb36fad53315047af12e83c643d3a2c2e49 ]
Firmware for sd8997 chipset is distributed by Marvell package and also as part of the linux-firmware repository in filename sdsd8997_combo_v4.bin.
This patch fixes mwifiex driver to load correct firmware file for sd8997.
--- drivers/bluetooth/btmrvl_sdio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/bluetooth/btmrvl_sdio.c +2 -2
@@ -346,7 +346,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8987 = {static const struct btmrvl_sdio_device btmrvl_sdio_sd8997 = { .helper =NULL , - .firmware ="mrvl/sd8997_uapsta.bin" , + .firmware ="mrvl/sdsd8997_combo_v4.bin" , .reg = &btmrvl_reg_8997, .support_pscan_win_report = true, .sd_blksz_fw_dl =256 ,
@@ -1833,4 +1833,4 @@ MODULE_FIRMWARE("mrvl/sd8887_uapsta.bin");MODULE_FIRMWARE ("mrvl/sd8897_uapsta.bin" );MODULE_FIRMWARE ("mrvl/sdsd8977_combo_v2.bin" );MODULE_FIRMWARE ("mrvl/sd8987_uapsta.bin" ); -MODULE_FIRMWARE ("mrvl/sd8997_uapsta.bin" ); +MODULE_FIRMWARE ("mrvl/sdsd8997_combo_v4.bin" );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 149/464 video: fbdev: sm712fb: fix an issue about iounmap for a wrong address
In reply to Greg Kroah-HartmanFrom: Dejin Zheng <[email protected]>
[ Upstream commit 98bd4f72988646c35569e1e838c0ab80d06c77f6 ]
the sfb->fb->screen_base is not save the value get by iounmap() when the chip id is 0x720. so iounmap() for address sfb->fb->screen_base is not right.
--- drivers/video/fbdev/sm712fb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/sm712fb.c +2 -0
@@ -1429,6 +1429,8 @@ static int smtc_map_smem(struct smtcfb_info *sfb,static void smtc_unmap_smem (struct smtcfb_info *sfb) {if (sfb && sfb->fb->screen_base) { +if (sfb->chip_id ==0x720 ) + sfb->fb->screen_base -=0x00200000 ;iounmap (sfb->fb->screen_base); sfb->fb->screen_base =NULL ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 150/464 console: newport_con: fix an issue about leak related system resources
In reply to Greg Kroah-HartmanFrom: Dejin Zheng <[email protected]>
[ Upstream commit fd4b8243877250c05bb24af7fea5567110c9720b ]
A call of the function do_take_over_console() can fail here. The corresponding system resources were not released then. Thus add a call of iounmap() and release_mem_region() together with the check of a failure predicate. and also add release_mem_region() on device removal.
--- drivers/video/console/newport_con.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/video/console/newport_con.c +10 -2
@@ -31,6 +31,8 @@#include <linux/linux_logo.h> #include <linux/font.h> +#define NEWPORT_LEN 0x10000 +#define FONT_DATA ((unsigned char *)font_vga_8x16.data)/* borrowed from fbcon.c */
@@ -42,6 +44,7 @@static unsigned char *font_data[MAX_NR_CONSOLES ];static struct newport_regs *npregs; +static unsigned long newport_addr;static int logo_active;static int topscan;
@@ -701,7 +704,6 @@ const struct consw newport_con = {static int newport_probe (struct gio_device *dev,const struct gio_device_id *id) { -unsigned long newport_addr;int err;if (!dev->resource.start)
@@ -711,7 +713,7 @@ static int newport_probe(struct gio_device *dev,return -EBUSY ;/* we only support one Newport as console */ newport_addr = dev->resource.start +0xF0000 ; -if (!request_mem_region (newport_addr,0x10000 ,"Newport" )) +if (!request_mem_region (newport_addr,NEWPORT_LEN ,"Newport" ))return -ENODEV ; npregs = (struct newport_regs *)/* ioremap cannot fail */
@@ -719,6 +721,11 @@ static int newport_probe(struct gio_device *dev,console_lock (); err =do_take_over_console (&newport_con,0 ,MAX_NR_CONSOLES -1 ,1 );console_unlock (); + +if (err) { +iounmap ((void *)npregs); +release_mem_region (newport_addr,NEWPORT_LEN ); + }return err; }
@@ -726,6 +733,7 @@ static void newport_remove(struct gio_device *dev) {give_up_console (&newport_con);iounmap ((void *)npregs); +release_mem_region (newport_addr,NEWPORT_LEN ); }static struct gio_device_id newport_ids[] = {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 151/464 video: pxafb: Fix the function used to balance a dma_alloc_coherent() call
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 499a2c41b954518c372873202d5e7714e22010c4 ]
'dma_alloc_coherent()' must be balanced by a call to 'dma_free_coherent()' not 'dma_free_wc()'.
The correct dma_free_ function is already used in the error handling path of the probe function.
--- drivers/video/fbdev/pxafb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/video/fbdev/pxafb.c +2 -2
@@ -2417,8 +2417,8 @@ static int pxafb_remove(struct platform_device *dev)free_pages_exact (fbi->video_mem, fbi->video_mem_size); -dma_free_wc (&dev->dev, fbi->dma_buff_size, fbi->dma_buff, - fbi->dma_buff_phys); +dma_free_coherent (&dev->dev, fbi->dma_buff_size, fbi->dma_buff, + fbi->dma_buff_phys);return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 152/464 Bluetooth: hci_qca: Fix an error pointer dereference
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 4c07a5d7aeb39f559b29aa58ec9a8a5ab4282cb0 ]
When a function like devm_clk_get_optional() function returns both error pointers on error and NULL then the NULL return means that the optional feature is deliberately disabled. It is a special sort of success and should not trigger an error message. The surrounding code should be written to check for NULL and not crash.
On the other hand, if we encounter an error, then the probe from should clean up and return a failure.
In this code, if devm_clk_get_optional() returns an error pointer then the kernel will crash inside the call to:
clk_set_rate(qcadev->susclk, SUSCLK_RATE_32KHZ);
The error handling must be updated to prevent that.
--- drivers/bluetooth/hci_qca.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/bluetooth/hci_qca.c +9 -9
@@ -1994,17 +1994,17 @@ static int qca_serdev_probe(struct serdev_device *serdev) } qcadev->susclk =devm_clk_get_optional (&serdev->dev,NULL ); -if (!qcadev->susclk) { +if (IS_ERR (qcadev->susclk)) {dev_warn (&serdev->dev,"failed to acquire clk\n" ); - }else { - err =clk_set_rate (qcadev->susclk,SUSCLK_RATE_32KHZ ); -if (err) -return err; - - err =clk_prepare_enable (qcadev->susclk); -if (err) -return err; +return PTR_ERR (qcadev->susclk); } + err =clk_set_rate (qcadev->susclk,SUSCLK_RATE_32KHZ ); +if (err) +return err; + + err =clk_prepare_enable (qcadev->susclk); +if (err) +return err; err =hci_uart_register_device (&qcadev->serdev_hu, &qca_proto);if (err) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 153/464 drm/mm: fix hole size comparison
In reply to Greg Kroah-HartmanFrom: Nirmoy Das <[email protected]>
[ Upstream commit 18ece75d7d74eb108f6a7325cf247077a666cba8 ]
--- drivers/gpu/drm/drm_mm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_mm.c +2 -2
@@ -407,7 +407,7 @@ next_hole_high_addr(struct drm_mm_node *entry, u64 size) left_node =rb_entry (left_rb_node, struct drm_mm_node, rb_hole_addr);if ((left_node->subtree_max_hole < size || - entry->size == entry->subtree_max_hole) && +HOLE_SIZE (entry) == entry->subtree_max_hole) && parent_rb_node && parent_rb_node->rb_left != rb_node)return rb_hole_addr_to_node (parent_rb_node); }
@@ -447,7 +447,7 @@ next_hole_low_addr(struct drm_mm_node *entry, u64 size) right_node =rb_entry (right_rb_node, struct drm_mm_node, rb_hole_addr);if ((right_node->subtree_max_hole < size || - entry->size == entry->subtree_max_hole) && +HOLE_SIZE (entry) == entry->subtree_max_hole) && parent_rb_node && parent_rb_node->rb_right != rb_node)return rb_hole_addr_to_node (parent_rb_node); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 154/464 Bluetooth: hci_qca: Only remove TX clock vote after TX is completed
In reply to Greg Kroah-HartmanFrom: Matthias Kaehlcke <[email protected]>
[ Upstream commit eff981f6579d5797d68d27afc0eede529ac8778a ]
qca_suspend() removes the vote for the UART TX clock after writing an IBS sleep request to the serial buffer. This is not a good idea since there is no guarantee that the request has been sent at this point. Instead remove the vote after successfully entering IBS sleep. This also fixes the issue of the vote being removed in case of an aborted suspend due to a failure of entering IBS sleep.
--- drivers/bluetooth/hci_qca.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/bluetooth/hci_qca.c +3 -3
@@ -2115,8 +2115,6 @@ static int __maybe_unused qca_suspend(struct device *dev) qca->tx_ibs_state =HCI_IBS_TX_ASLEEP ; qca->ibs_sent_slps++; - -qca_wq_serial_tx_clock_vote_off (&qca->ws_tx_vote_off);break ;case HCI_IBS_TX_ASLEEP :
@@ -2144,8 +2142,10 @@ static int __maybe_unused qca_suspend(struct device *dev) qca->rx_ibs_state ==HCI_IBS_RX_ASLEEP , msecs_to_jiffies(IBS_BTSOC_TX_IDLE_TIMEOUT_MS)); -if (ret >0 ) +if (ret >0 ) { +qca_wq_serial_tx_clock_vote_off (&qca->ws_tx_vote_off);return 0 ; + }if (ret ==0 ) ret = -ETIMEDOUT ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 155/464 Bluetooth: Allow suspend even when preparation has failed
In reply to Greg Kroah-HartmanFrom: Abhishek Pandit-Subedi <[email protected]>
[ Upstream commit a9ec8423134a54c9f0ae8d4ef59e1e833ca917c2 ]
It is preferable to allow suspend even when Bluetooth has problems preparing for sleep. When Bluetooth fails to finish preparing for suspend, log the error and allow the suspend notifier to continue instead.
To also make it clearer why suspend failed, change bt_dev_dbg to bt_dev_err when handling the suspend timeout.
--- net/bluetooth/hci_core.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
net/bluetooth/hci_core.c +10 -7
@@ -3289,10 +3289,10 @@ static int hci_suspend_wait_event(struct hci_dev *hdev) WAKE_COND, SUSPEND_NOTIFIER_TIMEOUT);if (ret ==0 ) { -bt_dev_dbg (hdev,"Timed out waiting for suspend" ); +bt_dev_err (hdev,"Timed out waiting for suspend events" );for (i =0 ; i < __SUSPEND_NUM_TASKS; ++i) {if (test_bit (i, hdev->suspend_tasks)) -bt_dev_dbg (hdev,"Bit %d is set" , i); +bt_dev_err (hdev,"Suspend timeout bit: %d" , i);clear_bit (i, hdev->suspend_tasks); }
@@ -3360,12 +3360,15 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action, ret =hci_change_suspend_state (hdev,BT_RUNNING ); } -/* If suspend failed, restore it to running */ -if (ret && action ==PM_SUSPEND_PREPARE ) -hci_change_suspend_state (hdev,BT_RUNNING ); - done: -return ret ?notifier_from_errno (-EBUSY ) :NOTIFY_STOP ; +/* We always allow suspend even if suspend preparation failed and +* attempt to recover in resume. +*/ +if (ret) +bt_dev_err (hdev,"Suspend notifier action (%lu) failed: %d" , + action, ret); + +return NOTIFY_STOP ; }/* Alloc HCI device */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 156/464 ath10k: Acquire tx_lock in tx error paths
In reply to Greg Kroah-HartmanFrom: Evan Green <[email protected]>
[ Upstream commit a738e766e3ed92c4ee5ec967777276b5ce11dd2c ]
ath10k_htt_tx_free_msdu_id() has a lockdep assertion that htt->tx_lock is held. Acquire the lock in a couple of error paths when calling that function to ensure this condition is met.
--- drivers/net/wireless/ath/ath10k/htt_tx.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/ath/ath10k/htt_tx.c +4 -0
@@ -1591,7 +1591,9 @@ static int ath10k_htt_tx_32(struct ath10k_htt *htt, err_unmap_msdu:dma_unmap_single (dev, skb_cb->paddr, msdu->len,DMA_TO_DEVICE ); err_free_msdu_id: +spin_lock_bh (&htt->tx_lock);ath10k_htt_tx_free_msdu_id (htt, msdu_id); +spin_unlock_bh (&htt->tx_lock); err:return res; }
@@ -1798,7 +1800,9 @@ static int ath10k_htt_tx_64(struct ath10k_htt *htt, err_unmap_msdu:dma_unmap_single (dev, skb_cb->paddr, msdu->len,DMA_TO_DEVICE ); err_free_msdu_id: +spin_lock_bh (&htt->tx_lock);ath10k_htt_tx_free_msdu_id (htt, msdu_id); +spin_unlock_bh (&htt->tx_lock); err:return res; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 157/464 Bluetooth: hci_qca: Bug fix during SSR timeout
In reply to Greg Kroah-HartmanFrom: Venkata Lakshmi Narayana Gubba <[email protected]>
[ Upstream commit f98aa80ff78c34fe328eb9cd3e2cc3058e42bcfd ]
Due to race conditions between qca_hw_error and qca_controller_memdump during SSR timeout,the same pointer is freed twice. This results in a double free. Now a lock is acquired before checking the stauts of SSR state.
--- drivers/bluetooth/hci_qca.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-)
drivers/bluetooth/hci_qca.c +17 -12
@@ -991,8 +991,11 @@ static void qca_controller_memdump(struct work_struct *work)while ((skb =skb_dequeue (&qca->rx_memdump_q))) {mutex_lock (&qca->hci_memdump_lock); -/* Skip processing the received packets if timeout detected. */ -if (qca->memdump_state ==QCA_MEMDUMP_TIMEOUT ) { +/* Skip processing the received packets if timeout detected +* or memdump collection completed. +*/ +if (qca->memdump_state ==QCA_MEMDUMP_TIMEOUT || + qca->memdump_state ==QCA_MEMDUMP_COLLECTED ) {mutex_unlock (&qca->hci_memdump_lock);return ; }
@@ -1494,8 +1497,6 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code) {struct hci_uart *hu =hci_get_drvdata (hdev);struct qca_data *qca = hu->priv; -struct qca_memdump_data *qca_memdump = qca->qca_memdump; -char *memdump_buf =NULL ;set_bit (QCA_SSR_TRIGGERED , &qca->flags);set_bit (QCA_HW_ERROR_EVENT , &qca->flags);
@@ -1519,19 +1520,23 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code)qca_wait_for_dump_collection (hdev); } +mutex_lock (&qca->hci_memdump_lock);if (qca->memdump_state !=QCA_MEMDUMP_COLLECTED ) {bt_dev_err (hu->hdev,"clearing allocated memory due to memdump timeout" ); -mutex_lock (&qca->hci_memdump_lock); -if (qca_memdump) - memdump_buf = qca_memdump->memdump_buf_head; -vfree (memdump_buf); -kfree (qca_memdump); - qca->qca_memdump =NULL ; +if (qca->qca_memdump) { +vfree (qca->qca_memdump->memdump_buf_head); +kfree (qca->qca_memdump); + qca->qca_memdump =NULL ; + } qca->memdump_state =QCA_MEMDUMP_TIMEOUT ;cancel_delayed_work (&qca->ctrl_memdump_timeout); -skb_queue_purge (&qca->rx_memdump_q); -mutex_unlock (&qca->hci_memdump_lock); + } +mutex_unlock (&qca->hci_memdump_lock); + +if (qca->memdump_state ==QCA_MEMDUMP_TIMEOUT || + qca->memdump_state ==QCA_MEMDUMP_COLLECTED ) {cancel_work_sync (&qca->ctrl_memdump_evt); +skb_queue_purge (&qca->rx_memdump_q); }clear_bit (QCA_HW_ERROR_EVENT , &qca->flags);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 158/464 Bluetooth: hci_qca: Increase SoC idle timeout to 200ms
In reply to Greg Kroah-HartmanFrom: Balakrishna Godavarthi <[email protected]>
[ Upstream commit 2d68476cfc2afa1a1a2d9007a23264ffc6308e77 ]
In some version of WCN399x, SoC idle timeout is configured as 80ms instead of 20ms or 40ms. To honor all the SoC's supported in the driver increasing SoC idle timeout to 200ms.
--- drivers/bluetooth/hci_qca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bluetooth/hci_qca.c +1 -1
@@ -46,7 +46,7 @@#define HCI_MAX_IBS_SIZE 10#define IBS_WAKE_RETRANS_TIMEOUT_MS 100 -#define IBS_BTSOC_TX_IDLE_TIMEOUT_MS 40 +#define IBS_BTSOC_TX_IDLE_TIMEOUT_MS 200#define IBS_HOST_TX_IDLE_TIMEOUT_MS 2000#define CMD_TRANS_TIMEOUT_MS 100#define MEMDUMP_TIMEOUT_MS 8000
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 159/464 iio: improve IIO_CONCENTRATION channel type description
In reply to Greg Kroah-HartmanFrom: Tomasz Duszynski <[email protected]>
[ Upstream commit df16c33a4028159d1ba8a7061c9fa950b58d1a61 ]
IIO_CONCENTRATION together with INFO_RAW specifier is used for reporting raw concentrations of pollutants. Raw value should be meaningless before being properly scaled. Because of that description shouldn't mention raw value unit whatsoever.
Fix this by rephrasing existing description so it follows conventions used throughout IIO ABI docs.
--- Documentation/ABI/testing/sysfs-bus-iio | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
Documentation/ABI/testing/sysfs-bus-iio +2 -1
@@ -1569,7 +1569,8 @@ What: /sys/bus/iio/devices/iio:deviceX/in_concentrationX_voc_raw KernelVersion: 4.3 Contact: [email protected] Description: - Raw (unscaled no offset etc.) percentage reading of a substance. + Raw (unscaled no offset etc.) reading of a substance. Units + after application of scale and offset are percents. What: /sys/bus/iio/devices/iio:deviceX/in_resistance_raw What: /sys/bus/iio/devices/iio:deviceX/in_resistanceX_raw
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 160/464 iio: amplifiers: ad8366: Change devm_gpiod_get() to optional and add the missed check
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
[ Upstream commit 9ca39411f9a9c833727750431da8dfd96ff80005 ]
Since if there is no GPIO, nothing happens, replace devm_gpiod_get() with devm_gpiod_get_optional().
Also add IS_ERR() to fix the missing-check warning.
--- drivers/iio/amplifiers/ad8366.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/iio/amplifiers/ad8366.c +5 -2
@@ -262,8 +262,11 @@ static int ad8366_probe(struct spi_device *spi)case ID_ADA4961 :case ID_ADL5240 :case ID_HMC1119 : - st->reset_gpio =devm_gpiod_get (&spi->dev,"reset" , -GPIOD_OUT_HIGH ); + st->reset_gpio =devm_gpiod_get_optional (&spi->dev,"reset" ,GPIOD_OUT_HIGH ); +if (IS_ERR (st->reset_gpio)) { + ret =PTR_ERR (st->reset_gpio); + goto error_disable_reg; + } indio_dev->channels = ada4961_channels; indio_dev->num_channels =ARRAY_SIZE (ada4961_channels);break ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 161/464 scsi: ufs: Fix imprecise load calculation in devfreq window
In reply to Greg Kroah-HartmanFrom: Stanley Chu <[email protected]>
[ Upstream commit b1bf66d1d5a8fcb54f0e584db5d196ef015b5172 ]
The UFS load calculation is based on "total_time" and "busy_time" in a devfreq window. However, the source of time is different for both
parameters: "busy_time" is assigned from "jiffies" thus has different accuracy from "total_time" which is assigned from ktime_get().
In addition, the time of window boundary is not exactly the same as the starting busy time in this window if UFS is actually busy in the beginning of the window. A similar accuracy error may also happen for the end of busy time in current window.
To guarantee the precision of load calculation, we need to
1. Align time accuracy of both devfreq_dev_status.total_time and devfreq_dev_status.busy_time. For example, use "ktime_get()" directly.
2. Align the following timelines:
- The beginning time of devfreq windows
- The beginning of busy time in a new window
- The end of busy time in the current window
--- drivers/scsi/ufs/ufshcd.c | 18 ++++++++++-------- drivers/scsi/ufs/ufshcd.h | 2 +- 2 files changed, 11 insertions(+), 9 deletions(-)
drivers/scsi/ufs/ufshcd.c +10 -8
@@ -1314,6 +1314,7 @@ static int ufshcd_devfreq_get_dev_status(struct device *dev,unsigned long flags;struct list_head *clk_list = &hba->clk_list_head;struct ufs_clk_info *clki; +ktime_t curr_t;if (!ufshcd_is_clkscaling_supported (hba))return -EINVAL ;
@@ -1321,6 +1322,7 @@ static int ufshcd_devfreq_get_dev_status(struct device *dev,memset (stat,0 ,sizeof (*stat));spin_lock_irqsave (hba->host->host_lock, flags); + curr_t =ktime_get ();if (!scaling->window_start_t) goto start_window;
@@ -1332,18 +1334,17 @@ static int ufshcd_devfreq_get_dev_status(struct device *dev,*/ stat->current_frequency = clki->curr_freq;if (scaling->is_busy_started) - scaling->tot_busy_t +=ktime_to_us (ktime_sub (ktime_get (), - scaling->busy_start_t)); + scaling->tot_busy_t +=ktime_us_delta (curr_t, + scaling->busy_start_t); - stat->total_time =jiffies_to_usecs ((long )jiffies - - (long )scaling->window_start_t); + stat->total_time =ktime_us_delta (curr_t, scaling->window_start_t); stat->busy_time = scaling->tot_busy_t; start_window: - scaling->window_start_t = jiffies; + scaling->window_start_t = curr_t; scaling->tot_busy_t =0 ;if (hba->outstanding_reqs) { - scaling->busy_start_t =ktime_get (); + scaling->busy_start_t = curr_t; scaling->is_busy_started = true; }else { scaling->busy_start_t =0 ;
@@ -1877,6 +1878,7 @@ static void ufshcd_exit_clk_gating(struct ufs_hba *hba)static void ufshcd_clk_scaling_start_busy (struct ufs_hba *hba) {bool queue_resume_work = false; +ktime_t curr_t =ktime_get ();if (!ufshcd_is_clkscaling_supported (hba))return ;
@@ -1892,13 +1894,13 @@ static void ufshcd_clk_scaling_start_busy(struct ufs_hba *hba) &hba->clk_scaling.resume_work);if (!hba->clk_scaling.window_start_t) { - hba->clk_scaling.window_start_t = jiffies; + hba->clk_scaling.window_start_t = curr_t; hba->clk_scaling.tot_busy_t =0 ; hba->clk_scaling.is_busy_started = false; }if (!hba->clk_scaling.is_busy_started) { - hba->clk_scaling.busy_start_t =ktime_get (); + hba->clk_scaling.busy_start_t = curr_t; hba->clk_scaling.is_busy_started = true; } }
drivers/scsi/ufs/ufshcd.h +1 -1
@@ -411,7 +411,7 @@ struct ufs_saved_pwr_info {struct ufs_clk_scaling {int active_reqs;unsigned long tot_busy_t; -unsigned long window_start_t; +ktime_t window_start_t;ktime_t busy_start_t;struct device_attribute enable_attr;struct ufs_saved_pwr_info saved_pwr_info;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 162/464 drm/etnaviv: Fix error path on failure to enable bus clk
In reply to Greg Kroah-HartmanFrom: Lubomir Rintel <[email protected]>
[ Upstream commit f8794feaf65cdc97767604cf864775d20b97f397 ]
Since commit 65f037e8e908 ("drm/etnaviv: add support for slave interface clock") the reg clock is enabled before the bus clock and we need to undo its enablement on error.
--- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/etnaviv/etnaviv_gpu.c +4 -1
@@ -1502,7 +1502,7 @@ static int etnaviv_gpu_clk_enable(struct etnaviv_gpu *gpu)if (gpu->clk_bus) { ret =clk_prepare_enable (gpu->clk_bus);if (ret) -return ret; + goto disable_clk_reg; }if (gpu->clk_core) {
@@ -1525,6 +1525,9 @@ static int etnaviv_gpu_clk_enable(struct etnaviv_gpu *gpu) disable_clk_bus:if (gpu->clk_bus)clk_disable_unprepare (gpu->clk_bus); +disable_clk_reg: +if (gpu->clk_reg) +clk_disable_unprepare (gpu->clk_reg);return ret; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 163/464 drm/panfrost: Fix inbalance of devfreq record_busy/idle()
In reply to Greg Kroah-HartmanFrom: Steven Price <[email protected]>
[ Upstream commit b99773ef258e628bd53cab22d450a755b73b4d55 ]
The calls to panfrost_devfreq_record_busy() and panfrost_devfreq_record_idle() must be balanced to ensure that the devfreq utilisation is correctly reported. But there are two cases where this doesn't work correctly.
In panfrost_job_hw_submit() if pm_runtime_get_sync() fails or the WARN_ON() fires then no call to panfrost_devfreq_record_busy() is made, but when the job times out the corresponding _record_idle() call is still made in panfrost_job_timedout(). Move the call up to ensure that it always happens.
Secondly panfrost_job_timedout() only makes a single call to panfrost_devfreq_record_idle() even if it is cleaning up multiple jobs. Move the call inside the loop to ensure that the number of _record_idle() calls matches the number of _record_busy() calls.
--- drivers/gpu/drm/panfrost/panfrost_job.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/panfrost/panfrost_job.c +3 -2
@@ -145,6 +145,8 @@ static void panfrost_job_hw_submit(struct panfrost_job *job, int js)u64 jc_head = job->jc;int ret; +panfrost_devfreq_record_busy (pfdev); + ret =pm_runtime_get_sync (pfdev->dev);if (ret <0 )return ;
@@ -155,7 +157,6 @@ static void panfrost_job_hw_submit(struct panfrost_job *job, int js) } cfg =panfrost_mmu_as_get (pfdev, &job->file_priv->mmu); -panfrost_devfreq_record_busy (pfdev);job_write (pfdev,JS_HEAD_NEXT_LO (js), jc_head &0xFFFFFFFF );job_write (pfdev,JS_HEAD_NEXT_HI (js), jc_head >>32 );
@@ -410,12 +411,12 @@ static void panfrost_job_timedout(struct drm_sched_job *sched_job)for (i =0 ; i <NUM_JOB_SLOTS ; i++) {if (pfdev->jobs[i]) {pm_runtime_put_noidle (pfdev->dev); +panfrost_devfreq_record_idle (pfdev); pfdev->jobs[i] =NULL ; } }spin_unlock_irqrestore (&pfdev->js->job_lock, flags); -panfrost_devfreq_record_idle (pfdev);panfrost_device_reset (pfdev);for (i =0 ; i <NUM_JOB_SLOTS ; i++)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 164/464 drm/arm: fix unintentional integer overflow on left shift
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 5f368ddea6fec519bdb93b5368f6a844b6ea27a6 ]
Shifting the integer value 1 is evaluated using 32-bit arithmetic and then used in an expression that expects a long value leads to a potential integer overflow. Fix this by using the BIT macro to perform the shift to avoid the overflow.
Addresses-Coverity: ("Unintentional integer overflow")
--- drivers/gpu/drm/arm/malidp_planes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/arm/malidp_planes.c +1 -1
@@ -928,7 +928,7 @@ int malidp_de_planes_init(struct drm_device *drm)const struct malidp_hw_regmap *map = &malidp->dev->hw->map;struct malidp_plane *plane =NULL ;enum drm_plane_type plane_type; -unsigned long crtcs =1 << drm->mode_config.num_crtc; +unsigned long crtcs =BIT (drm->mode_config.num_crtc);unsigned long flags =DRM_MODE_ROTATE_0 |DRM_MODE_ROTATE_90 |DRM_MODE_ROTATE_180 |DRM_MODE_ROTATE_270 |DRM_MODE_REFLECT_X |DRM_MODE_REFLECT_Y ; unsigned int blend_caps = BIT(DRM_MODE_BLEND_PIXEL_NONE) |
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 165/464 clk: bcm63xx-gate: fix last clock availability
In reply to Greg Kroah-HartmanFrom: Álvaro Fernández Rojas <[email protected]>
[ Upstream commit cf8030d7035bd3e89c9e66f7193a7fc8057a9b9a ]
In order to make the last clock available, maxbit has to be set to the highest bit value plus 1.
--- drivers/clk/bcm/clk-bcm63xx-gate.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/bcm/clk-bcm63xx-gate.c +1 -0
@@ -155,6 +155,7 @@ static int clk_bcm63xx_probe(struct platform_device *pdev)for (entry = table; entry->name; entry++) maxbit =max_t (u8, maxbit, entry->bit); + maxbit++; hw =devm_kzalloc (&pdev->dev,struct_size (hw, data.hws, maxbit),GFP_KERNEL );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 166/464 powerpc/mm: Fix typo in IS_ENABLED()
In reply to Greg Kroah-HartmanFrom: Joe Perches <[email protected]>
[ Upstream commit 55bd9ac468397c4f12a33b7ec714b5d0362c3aa2 ]
IS_ENABLED() matches names exactly, so the missing "CONFIG_" prefix means this code would never be built.
Also fixes a missing newline in pr_warn().
--- arch/powerpc/mm/book3s64/hash_utils.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/powerpc/mm/book3s64/hash_utils.c +2 -3
@@ -663,11 +663,10 @@ static void __init htab_init_page_sizes(void)* Pick a size for the linear mapping. Currently, we only * support 16M, 1M and 4K which is the default */ -if (IS_ENABLED (STRICT_KERNEL_RWX ) && +if (IS_ENABLED (CONFIG_STRICT_KERNEL_RWX ) && (unsigned long )_stext %0x1000000 ) {if (mmu_psize_defs[MMU_PAGE_16M ].shift) -pr_warn ("Kernel not 16M aligned, " -"disabling 16M linear map alignment" ); +pr_warn ("Kernel not 16M aligned, disabling 16M linear map alignment\n" ); aligned = false; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 167/464 powerpc/fixmap: Fix FIX_EARLY_DEBUG_BASE when page size is 256k
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit 03fd42d458fb9cb69e712600bd69ff77ff3a45a8 ]
FIX_EARLY_DEBUG_BASE reserves a 128k area for debuging.
When page size is 256k, the calculation results in a 0 number of pages, leading to the following failure:
CC arch/powerpc/kernel/asm-offsets.s
In file included from ./arch/powerpc/include/asm/nohash/32/pgtable.h:77:0,
from ./arch/powerpc/include/asm/nohash/pgtable.h:8,
from ./arch/powerpc/include/asm/pgtable.h:20,
from ./include/linux/pgtable.h:6,
from ./arch/powerpc/include/asm/kup.h:42,
from ./arch/powerpc/include/asm/uaccess.h:9,
from ./include/linux/uaccess.h:11,
from ./include/linux/crypto.h:21,
from ./include/crypto/hash.h:11,
from ./include/linux/uio.h:10,
from ./include/linux/socket.h:8,
from ./include/linux/compat.h:15,
from arch/powerpc/kernel/asm-offsets.c:14:./arch/powerpc/include/asm/fixmap.h:75:2: error: overflow in enumeration values
__end_of_permanent_fixed_addresses,
^
make[2]: *** [arch/powerpc/kernel/asm-offsets.s] Error 1
Ensure the debug area is at least one page.
--- arch/powerpc/include/asm/fixmap.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/include/asm/fixmap.h +1 -1
@@ -52,7 +52,7 @@ enum fixed_addresses {FIX_HOLE ,/* reserve the top 128K for early debugging purposes */ FIX_EARLY_DEBUG_TOP =FIX_HOLE , -FIX_EARLY_DEBUG_BASE =FIX_EARLY_DEBUG_TOP +((128 *1024 )/PAGE_SIZE )-1 , +FIX_EARLY_DEBUG_BASE =FIX_EARLY_DEBUG_TOP +(ALIGN (SZ_128 ,PAGE_SIZE )/PAGE_SIZE )-1 , #ifdef CONFIG_HIGHMEMFIX_KMAP_BEGIN ,/* reserved pte's for temporary kernel mappings */ FIX_KMAP_END = FIX_KMAP_BEGIN+(KM_TYPE_NR*NR_CPUS)-1,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 168/464 leds: lm355x: avoid enum conversion warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 985b1f596f9ed56f42b8c2280005f943e1434c06 ]
clang points out that doing arithmetic between diffent enums is usually a mistake:
drivers/leds/leds-lm355x.c:167:28: warning: bitwise operation between different enumeration types ('enum lm355x_tx2' and 'enum lm355x_ntc') [-Wenum-enum-conversion]
reg_val = pdata->pin_tx2 | pdata->ntc_pin;
~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~
drivers/leds/leds-lm355x.c:178:28: warning: bitwise operation between different enumeration types ('enum lm355x_tx2' and 'enum lm355x_ntc') [-Wenum-enum-conversion]
reg_val = pdata->pin_tx2 | pdata->ntc_pin | pdata->pass_mode;
~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~In this driver, it is intentional, so add a cast to hide the false-positive warning. It appears to be the only instance of this warning at the moment.
--- drivers/leds/leds-lm355x.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/leds/leds-lm355x.c +4 -3
@@ -164,18 +164,19 @@ static int lm355x_chip_init(struct lm355x_chip_data *chip)/* input and output pins configuration */ switch (chip->type) {case CHIP_LM3554 : - reg_val = pdata->pin_tx2 | pdata->ntc_pin; + reg_val = (u32 )pdata->pin_tx2 | (u32 )pdata->ntc_pin; ret =regmap_update_bits (chip->regmap,0xE0 ,0x28 , reg_val);if (ret <0 ) goto out; - reg_val = pdata->pass_mode; + reg_val = (u32 )pdata->pass_mode; ret =regmap_update_bits (chip->regmap,0xA0 ,0x04 , reg_val);if (ret <0 ) goto out;break ;case CHIP_LM3556 : - reg_val = pdata->pin_tx2 | pdata->ntc_pin | pdata->pass_mode; + reg_val = (u32 )pdata->pin_tx2 | (u32 )pdata->ntc_pin | + (u32 )pdata->pass_mode; ret =regmap_update_bits (chip->regmap,0x0A ,0xC4 , reg_val);if (ret <0 ) goto out;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 169/464 ASoC: fsl_easrc: Fix uninitialized scalar variable in fsl_easrc_set_ctx_format
In reply to Greg Kroah-HartmanFrom: Shengjiu Wang <[email protected]>
[ Upstream commit 5748f4eb01a4df7a42024fe8bc7855f05febb7c5 ]
The "ret" in fsl_easrc_set_ctx_format is not initialized, then the unknown value maybe returned by this function.
--- sound/soc/fsl/fsl_easrc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/fsl/fsl_easrc.c +1 -1
@@ -1133,7 +1133,7 @@ int fsl_easrc_set_ctx_format(struct fsl_asrc_pair *ctx,struct fsl_easrc_ctx_priv *ctx_priv = ctx->private;struct fsl_easrc_data_fmt *in_fmt = &ctx_priv->in_params.fmt;struct fsl_easrc_data_fmt *out_fmt = &ctx_priv->out_params.fmt; -int ret; +int ret =0 ;/* Get the bitfield values for input data format */ if (in_raw_format && out_raw_format) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 170/464 Bluetooth: btusb: fix up firmware download sequence
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit f645125711c80f9651e4a57403d799070c6ad13b ]
Data RAM on the device have to be powered on before starting to download the firmware.
--- drivers/bluetooth/btusb.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +15 -1
@@ -2925,7 +2925,7 @@ static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)const u8 *fw_ptr;size_t fw_size;int err, dlen; -u8 flag; +u8 flag, param; err =request_firmware (&fw, fwname, &hdev->dev);if (err <0 ) {
@@ -2933,6 +2933,20 @@ static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)return err; } +/* Power on data RAM the firmware relies on. */ + param =1 ; + wmt_params.op =BTMTK_WMT_FUNC_CTRL ; + wmt_params.flag =3 ; + wmt_params.dlen =sizeof (param); + wmt_params.data = ¶m; + wmt_params.status =NULL ; + + err =btusb_mtk_hci_wmt_sync (hdev, &wmt_params); +if (err <0 ) { +bt_dev_err (hdev,"Failed to power on data RAM (%d)" , err); +return err; + } + fw_ptr = fw->data; fw_size = fw->size;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 171/464 Bluetooth: btmtksdio: fix up firmware download sequence
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit 737cd06072a72e8984e41af8e5919338d0c5bf2b ]
Data RAM on the device have to be powered on before starting to download the firmware.
--- drivers/bluetooth/btmtksdio.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/bluetooth/btmtksdio.c +15 -1
@@ -685,7 +685,7 @@ static int mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)const u8 *fw_ptr;size_t fw_size;int err, dlen; -u8 flag; +u8 flag, param; err =request_firmware (&fw, fwname, &hdev->dev);if (err <0 ) {
@@ -693,6 +693,20 @@ static int mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)return err; } +/* Power on data RAM the firmware relies on. */ + param =1 ; + wmt_params.op =MTK_WMT_FUNC_CTRL ; + wmt_params.flag =3 ; + wmt_params.dlen =sizeof (param); + wmt_params.data = ¶m; + wmt_params.status =NULL ; + + err =mtk_hci_wmt_sync (hdev, &wmt_params); +if (err <0 ) { +bt_dev_err (hdev,"Failed to power on data RAM (%d)" , err); +return err; + } + fw_ptr = fw->data; fw_size = fw->size;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 172/464 media: cxusb-analog: fix V4L2 dependency
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 1a55caf010c46d4f2073f9e92e97ef65358c16bf ]
CONFIG_DVB_USB_CXUSB_ANALOG is a 'bool' symbol with a dependency on the tristate CONFIG_VIDEO_V4L2, which means it can be enabled as =y even when its dependency is =m. This leads to a link failure:
drivers/media/usb/dvb-usb/cxusb-analog.o: In function `cxusb_medion_analog_init':
cxusb-analog.c:(.text+0x92): undefined reference to v4l2_subdev_call_wrappers' drivers/media/usb/dvb-usb/cxusb-analog.o: In function cxusb_medion_register_analog':
cxusb-analog.c:(.text+0x466): undefined reference to v4l2_device_register' cxusb-analog.c:(.text+0x4c3): undefined reference to v4l2_i2c_new_subdev' cxusb-analog.c:(.text+0x4fb): undefined reference to `v4l2_subdev_call_wrappers'
...
Change the dependency only disallow the analog portion of the driver in that configuration.
--- drivers/media/usb/dvb-usb/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/media/usb/dvb-usb/Kconfig +1 -0
@@ -151,6 +151,7 @@ config DVB_USB_CXUSB config DVB_USB_CXUSB_ANALOG bool "Analog support for the Conexant USB2.0 hybrid reference design" depends on DVB_USB_CXUSB && VIDEO_V4L2 + depends on VIDEO_V4L2=y || VIDEO_V4L2=DVB_USB_CXUSB select VIDEO_CX25840 select VIDEOBUF2_VMALLOC help
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 173/464 media: marvell-ccic: Add missed v4l2_async_notifier_cleanup()
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
[ Upstream commit 4603a5b4a87ccd6fb90cbfa10195291cfcf6ba34 ]
mccic_register() forgets to cleanup the notifier in its error handler. mccic_shutdown() also misses calling v4l2_async_notifier_cleanup(). Add the missed calls to fix them.
--- drivers/media/platform/marvell-ccic/mcam-core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/platform/marvell-ccic/mcam-core.c +2 -0
@@ -1940,6 +1940,7 @@ int mccic_register(struct mcam_camera *cam) out:v4l2_async_notifier_unregister (&cam->notifier);v4l2_device_unregister (&cam->v4l2_dev); +v4l2_async_notifier_cleanup (&cam->notifier);return ret; }EXPORT_SYMBOL_GPL (mccic_register);
@@ -1961,6 +1962,7 @@ void mccic_shutdown(struct mcam_camera *cam)v4l2_ctrl_handler_free (&cam->ctrl_handler);v4l2_async_notifier_unregister (&cam->notifier);v4l2_device_unregister (&cam->v4l2_dev); +v4l2_async_notifier_cleanup (&cam->notifier); }EXPORT_SYMBOL_GPL (mccic_shutdown);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 174/464 media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities()
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
[ Upstream commit dc7690a73017e1236202022e26a6aa133f239c8c ]
preview_init_entities() does not call v4l2_ctrl_handler_free() when it fails.
Add the missed function to fix it.
--- drivers/media/platform/omap3isp/isppreview.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/omap3isp/isppreview.c +3 -1
@@ -2287,7 +2287,7 @@ static int preview_init_entities(struct isp_prev_device *prev) me->ops = &preview_media_ops; ret =media_entity_pads_init (me,PREV_PADS_NUM , pads);if (ret <0 ) -return ret; + goto error_handler_free;preview_init_formats (sd,NULL );
@@ -2320,6 +2320,8 @@ static int preview_init_entities(struct isp_prev_device *prev)omap3isp_video_cleanup (&prev->video_in); error_video_in:media_entity_cleanup (&prev->subdev.entity); +error_handler_free: +v4l2_ctrl_handler_free (&prev->ctrls);return ret; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 175/464 staging: most: avoid null pointer dereference when iface is null
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit e4463e49e29f43eecec86e2e2b2e2ab4feb7d867 ]
In the case where the pointer iface is null then the reporting of this error will dereference iface when printing an error message causing which is not ideal. Since the majority of callers to most_register_interface report an error when -EINVAL is returned a simple fix is to just remove the error message, I doubt it will be missed.
Addresses-Coverity: ("Dereference after null check")
--- drivers/most/core.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/most/core.c +1 -3
@@ -1283,10 +1283,8 @@ int most_register_interface(struct most_interface *iface)struct most_channel *c;if (!iface || !iface->enqueue || !iface->configure || - !iface->poison_channel || (iface->num_channels >MAX_CHANNELS )) { -dev_err (iface->dev,"Bad interface or channel overflow\n" ); + !iface->poison_channel || (iface->num_channels >MAX_CHANNELS ))return -EINVAL ; - } id =ida_simple_get (&mdev_id,0 ,0 ,GFP_KERNEL );if (id <0 ) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 176/464 dpaa2-eth: fix condition for number of buffer acquire retries
In reply to Greg Kroah-HartmanFrom: Ioana Ciornei <[email protected]>
[ Upstream commit 0e5ad75b02d9341eb9ca22627247f9a02cc20d6f ]
We should keep retrying to acquire buffers through the software portals as long as the function returns -EBUSY and the number of retries is __below__ DPAA2_ETH_SWP_BUSY_RETRIES.
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +1 -1
@@ -1109,7 +1109,7 @@ static void drain_bufs(struct dpaa2_eth_priv *priv, int count) buf_array, count);if (ret <0 ) {if (ret == -EBUSY && - retries++ >=DPAA2_ETH_SWP_BUSY_RETRIES ) + retries++ <DPAA2_ETH_SWP_BUSY_RETRIES )continue ;netdev_err (priv->net_dev,"dpaa2_io_service_acquire() failed\n" );return ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 177/464 ASoC: SOF: nocodec: add missing .owner field
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 8753889e2720c1ef7ebf03370e384f5bf5ff4fab ]
This field is required for ASoC cards. Not setting it will result in a module->name pointer being NULL and generate problems such as
cat /proc/asound/modules
0 (efault)
--- sound/soc/sof/nocodec.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/sof/nocodec.c +1 -0
@@ -14,6 +14,7 @@static struct snd_soc_card sof_nocodec_card = { .name ="nocodec" ,/* the sof- prefix is added by the core */ + .owner =THIS_MODULE }; static int sof_nocodec_bes_setup(struct device *dev,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 178/464 ASoC: Intel: cml_rt1011_rt5682: add missing .owner field
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 299120928897d6cb893c7165df7cd232d835e259 ]
This field is required for ASoC cards. Not setting it will result in a module->name pointer being NULL and generate problems such as
cat /proc/asound/modules
0 (efault)
--- sound/soc/intel/boards/cml_rt1011_rt5682.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/intel/boards/cml_rt1011_rt5682.c +1 -0
@@ -493,6 +493,7 @@ static struct snd_soc_codec_conf rt1011_conf[] = {/* Cometlake audio machine driver for RT1011 and RT5682 */ static struct snd_soc_card snd_soc_card_cml = { .name ="cml_rt1011_rt5682" , + .owner =THIS_MODULE , .dai_link = cml_rt1011_rt5682_dailink, .num_links =ARRAY_SIZE (cml_rt1011_rt5682_dailink), .codec_conf = rt1011_conf,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 179/464 ASoC: Intel: sof_sdw: add missing .owner field
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit fb4b42f68972d6bc905c8b6e21a43a490dedfca7 ]
This field is required for ASoC cards. Not setting it will result in a module->name pointer being NULL and generate problems such as
cat /proc/asound/modules
0 (efault)
--- sound/soc/intel/boards/sof_sdw.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/intel/boards/sof_sdw.c +1 -0
@@ -893,6 +893,7 @@ static const char sdw_card_long_name[] = "Intel Soundwire SOF";static struct snd_soc_card card_sof_sdw = { .name ="soundwire" , + .owner =THIS_MODULE , .late_probe = sof_sdw_hdmi_card_late_probe, .codec_conf = codec_conf, .num_configs =ARRAY_SIZE (codec_conf),
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 180/464 ASoC: Intel: bxt_rt298: add missing .owner field
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 88cee34b776f80d2da04afb990c2a28c36799c43 ]
This field is required for ASoC cards. Not setting it will result in a module->name pointer being NULL and generate problems such as
cat /proc/asound/modules
0 (efault)
--- sound/soc/intel/boards/bxt_rt298.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/intel/boards/bxt_rt298.c +2 -0
@@ -565,6 +565,7 @@ static int bxt_card_late_probe(struct snd_soc_card *card)/* broxton audio machine driver for SPT + RT298S */ static struct snd_soc_card broxton_rt298 = { .name ="broxton-rt298" , + .owner =THIS_MODULE , .dai_link = broxton_rt298_dais, .num_links =ARRAY_SIZE (broxton_rt298_dais), .controls = broxton_controls,
@@ -580,6 +581,7 @@ static struct snd_soc_card broxton_rt298 = {static struct snd_soc_card geminilake_rt298 = { .name ="geminilake-rt298" , + .owner =THIS_MODULE , .dai_link = broxton_rt298_dais, .num_links =ARRAY_SIZE (broxton_rt298_dais), .controls = broxton_controls,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 181/464 ASoC: Intel: Boards: cml_rt1011_rt5682: use statically define codec config
In reply to Greg Kroah-HartmanFrom: Fred Oh <[email protected]>
[ Upstream commit 8a473c39ae54c27e694a131c34a739d0f8aa5300 ]
When the cml_rt1011_rt5682_dailink[].codecs pointer is overridden by a quirk with a devm allocated structure and the probe is deferred, in the next probe we will see an use-after-free condition (verified with KASAN). This can be avoided by using statically allocated configurations - which simplifies the code quite a bit as well.
KASAN issue fixed.
[ 23.301373] cml_rt1011_rt5682 cml_rt1011_rt5682: sof_rt1011_quirk = f [ 23.301875] ================================================================== [ 23.302018] BUG: KASAN: use-after-free in snd_cml_rt1011_probe+0x23a/0x3d0 [snd_soc_cml_rt1011_rt5682] [ 23.302178] Read of size 8 at addr ffff8881ec6acae0 by task kworker/0:2/105 [ 23.302320] CPU: 0 PID: 105 Comm: kworker/0:2 Not tainted 5.7.0-rc7-test+ #3 [ 23.302322] Hardware name: Google Helios/Helios, BIOS 01/21/2020 [ 23.302329] Workqueue: events deferred_probe_work_func [ 23.302331] Call Trace: [ 23.302339] dump_stack+0x76/0xa0 [ 23.302345] print_address_description.constprop.0.cold+0xd3/0x43e [ 23.302351] ? _raw_spin_lock_irqsave+0x7b/0xd0 [ 23.302355] ? _raw_spin_trylock_bh+0xf0/0xf0 [ 23.302362] ? snd_cml_rt1011_probe+0x23a/0x3d0 [snd_soc_cml_rt1011_rt5682] [ 23.302365] __kasan_report.cold+0x37/0x86 [ 23.302371] ? snd_cml_rt1011_probe+0x23a/0x3d0 [snd_soc_cml_rt1011_rt5682] [ 23.302375] kasan_report+0x38/0x50 [ 23.302382] snd_cml_rt1011_probe+0x23a/0x3d0 [snd_soc_cml_rt1011_rt5682] [ 23.302389] platform_drv_probe+0x66/0xc0
--- sound/soc/intel/boards/cml_rt1011_rt5682.c | 83 ++++++---------------- 1 file changed, 23 insertions(+), 60 deletions(-)
sound/soc/intel/boards/cml_rt1011_rt5682.c +23 -60
@@ -34,7 +34,6 @@#define SOF_RT1011_SPEAKER_WR BIT(1)#define SOF_RT1011_SPEAKER_TL BIT(2)#define SOF_RT1011_SPEAKER_TR BIT(3) -#define SPK_CH 4/* Default: Woofer speakers */ static unsigned long sof_rt1011_quirk = SOF_RT1011_SPEAKER_WL |
@@ -376,10 +375,17 @@ SND_SOC_DAILINK_DEF(ssp0_codec,SND_SOC_DAILINK_DEF (ssp1_pin,DAILINK_COMP_ARRAY (COMP_CPU ("SSP1 Pin" ))); -SND_SOC_DAILINK_DEF (ssp1_codec, +SND_SOC_DAILINK_DEF (ssp1_codec_2spk,DAILINK_COMP_ARRAY (/* WL */ COMP_CODEC ("i2c-10EC1011:00" ,CML_RT1011_CODEC_DAI ),/* WR */ COMP_CODEC ("i2c-10EC1011:01" ,CML_RT1011_CODEC_DAI ))); +SND_SOC_DAILINK_DEF (ssp1_codec_4spk, +DAILINK_COMP_ARRAY ( +/* WL */ COMP_CODEC ("i2c-10EC1011:00" ,CML_RT1011_CODEC_DAI ), +/* WR */ COMP_CODEC ("i2c-10EC1011:01" ,CML_RT1011_CODEC_DAI ), +/* TL */ COMP_CODEC ("i2c-10EC1011:02" ,CML_RT1011_CODEC_DAI ), +/* TR */ COMP_CODEC ("i2c-10EC1011:03" ,CML_RT1011_CODEC_DAI ))); +SND_SOC_DAILINK_DEF (dmic_pin,DAILINK_COMP_ARRAY (COMP_CPU ("DMIC01 Pin" )));
@@ -475,7 +481,7 @@ static struct snd_soc_dai_link cml_rt1011_rt5682_dailink[] = { .no_pcm = 1, .init = cml_rt1011_spk_init, .ops = &cml_rt1011_ops, - SND_SOC_DAILINK_REG(ssp1_pin, ssp1_codec, platform), + SND_SOC_DAILINK_REG(ssp1_pin, ssp1_codec_2spk, platform), }, };
@@ -488,6 +494,15 @@ static struct snd_soc_codec_conf rt1011_conf[] = { .dlc = COMP_CODEC_CONF("i2c-10EC1011:01"), .name_prefix = "WR", }, +/* single configuration structure for 2 and 4 channels */ + { + .dlc = COMP_CODEC_CONF("i2c-10EC1011:02"), + .name_prefix = "TL", + }, + { + .dlc = COMP_CODEC_CONF("i2c-10EC1011:03"), + .name_prefix = "TR", + }, };/* Cometlake audio machine driver for RT1011 and RT5682 */
@@ -510,8 +525,6 @@ static struct snd_soc_card snd_soc_card_cml = {static int snd_cml_rt1011_probe (struct platform_device *pdev) { -struct snd_soc_dai_link_component *rt1011_dais_components; -struct snd_soc_codec_conf *rt1011_dais_confs;struct card_private *ctx;struct snd_soc_acpi_mach *mach;const char *platform_name;
@@ -530,65 +543,15 @@ static int snd_cml_rt1011_probe(struct platform_device *pdev)dev_info (&pdev->dev,"sof_rt1011_quirk = %lx\n" , sof_rt1011_quirk); +/* when 4 speaker is available, update codec config */ if (sof_rt1011_quirk & (SOF_RT1011_SPEAKER_TL |SOF_RT1011_SPEAKER_TR )) { - rt1011_dais_confs =devm_kzalloc (&pdev->dev, -sizeof (struct snd_soc_codec_conf ) * -SPK_CH ,GFP_KERNEL ); - -if (!rt1011_dais_confs) -return -ENOMEM ; - - rt1011_dais_components =devm_kzalloc (&pdev->dev, -sizeof (struct snd_soc_dai_link_component ) * -SPK_CH ,GFP_KERNEL ); - -if (!rt1011_dais_components) -return -ENOMEM ; - -for (i =0 ; i <SPK_CH ; i++) { - rt1011_dais_confs[i].dlc.name =devm_kasprintf (&pdev->dev, -GFP_KERNEL , -"i2c-10EC1011:0%d" , - i); - -if (!rt1011_dais_confs[i].dlc.name) -return -ENOMEM ; - -switch (i) { -case 0 : - rt1011_dais_confs[i].name_prefix ="WL" ; -break ; -case 1 : - rt1011_dais_confs[i].name_prefix ="WR" ; -break ; -case 2 : - rt1011_dais_confs[i].name_prefix ="TL" ; -break ; -case 3 : - rt1011_dais_confs[i].name_prefix ="TR" ; -break ; -default : -return -EINVAL ; - } - rt1011_dais_components[i].name =devm_kasprintf (&pdev->dev, -GFP_KERNEL , -"i2c-10EC1011:0%d" , - i); -if (!rt1011_dais_components[i].name) -return -ENOMEM ; - - rt1011_dais_components[i].dai_name =CML_RT1011_CODEC_DAI ; - } - - snd_soc_card_cml.codec_conf = rt1011_dais_confs; - snd_soc_card_cml.num_configs =SPK_CH ; -for (i =0 ; i <ARRAY_SIZE (cml_rt1011_rt5682_dailink); i++) {if (!strcmp (cml_rt1011_rt5682_dailink[i].codecs->dai_name, -CML_RT1011_CODEC_DAI )) { - cml_rt1011_rt5682_dailink[i].codecs = rt1011_dais_components; - cml_rt1011_rt5682_dailink[i].num_codecs =SPK_CH ; +CML_RT1011_CODEC_DAI )) { + cml_rt1011_rt5682_dailink[i].codecs = ssp1_codec_4spk; + cml_rt1011_rt5682_dailink[i].num_codecs = +ARRAY_SIZE (ssp1_codec_4spk); } } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 182/464 net: atlantic: MACSec offload statistics checkpatch fix
In reply to Greg Kroah-HartmanFrom: Mark Starovoytov <[email protected]>
[ Upstream commit 3a8b44546979cf682324bd2fd61e539f428911b4 ]
This patch fixes a checkpatch warning.
--- drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c +3 -3
@@ -123,21 +123,21 @@ static const char aq_macsec_stat_names[][ETH_GSTRING_LEN] = { "MACSec OutUnctrlHitDropRedir", }; -static const char *aq_macsec_txsc_stat_names[] = { +static const char *const aq_macsec_txsc_stat_names[] = {"MACSecTXSC%d ProtectedPkts" ,"MACSecTXSC%d EncryptedPkts" ,"MACSecTXSC%d ProtectedOctets" ,"MACSecTXSC%d EncryptedOctets" , }; -static const char *aq_macsec_txsa_stat_names[] = { +static const char *const aq_macsec_txsa_stat_names[] = {"MACSecTXSC%dSA%d HitDropRedirect" ,"MACSecTXSC%dSA%d Protected2Pkts" ,"MACSecTXSC%dSA%d ProtectedPkts" ,"MACSecTXSC%dSA%d EncryptedPkts" , }; -static const char *aq_macsec_rxsa_stat_names[] = { +static const char *const aq_macsec_rxsa_stat_names[] = {"MACSecRXSC%dSA%d UntaggedHitPkts" ,"MACSecRXSC%dSA%d CtrlHitDrpRedir" ,"MACSecRXSC%dSA%d NotUsingSa" ,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 183/464 scsi: cumana_2: Fix different dev_id between request_irq() and free_irq()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 040ab9c4fd0070cd5fa71ba3a7b95b8470db9b4d ]
The dev_id used in request_irq() and free_irq() should match. Use 'info' in both cases.
--- drivers/scsi/arm/cumana_2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/arm/cumana_2.c +1 -1
@@ -450,7 +450,7 @@ static int cumanascsi2_probe(struct expansion_card *ec,if (info->info.scsi.dma !=NO_DMA )free_dma (info->info.scsi.dma); -free_irq (ec->irq, host); +free_irq (ec->irq, info); out_release:fas216_release (host);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 184/464 scsi: ufs: Disable WriteBooster capability for non-supported UFS devices
In reply to Greg Kroah-HartmanFrom: Stanley Chu <[email protected]>
[ Upstream commit a7f1e69d4974666ea40886ee4801aebb2729ea81 ]
If a UFS device is not qualified to use WriteBooster, either due to wrong UFS version or device-specific quirks, then the capability in host shall be disabled to prevent any WriteBooster operations in the future.
--- drivers/scsi/ufs/ufshcd.c | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-)
drivers/scsi/ufs/ufshcd.c +19 -16
@@ -6818,20 +6818,30 @@ static int ufshcd_scsi_add_wlus(struct ufs_hba *hba)static void ufshcd_wb_probe (struct ufs_hba *hba,u8 *desc_buf) { +struct ufs_dev_info *dev_info = &hba->dev_info;u8 lun;u32 d_lu_wb_buf_alloc;if (!ufshcd_is_wb_allowed (hba))return ; +/* +* Probe WB only for UFS-2.2 and UFS-3.1 (and later) devices or +* UFS devices with quirk UFS_DEVICE_QUIRK_SUPPORT_EXTENDED_FEATURES +* enabled +*/ +if (!(dev_info->wspecversion >=0x310 || + dev_info->wspecversion ==0x220 || + (hba->dev_quirks &UFS_DEVICE_QUIRK_SUPPORT_EXTENDED_FEATURES ))) + goto wb_disabled;if (hba->desc_size.dev_desc <DEVICE_DESC_PARAM_EXT_UFS_FEATURE_SUP +4 ) goto wb_disabled; - hba->dev_info.d_ext_ufs_feature_sup = + dev_info->d_ext_ufs_feature_sup =get_unaligned_be32 (desc_buf +DEVICE_DESC_PARAM_EXT_UFS_FEATURE_SUP ); -if (!(hba->dev_info.d_ext_ufs_feature_sup &UFS_DEV_WRITE_BOOSTER_SUP )) +if (!(dev_info->d_ext_ufs_feature_sup &UFS_DEV_WRITE_BOOSTER_SUP )) goto wb_disabled;/*
@@ -6840,17 +6850,17 @@ static void ufshcd_wb_probe(struct ufs_hba *hba, u8 *desc_buf)* a max of 1 lun would have wb buffer configured. * Now only shared buffer mode is supported. */ - hba->dev_info.b_wb_buffer_type = + dev_info->b_wb_buffer_type = desc_buf[DEVICE_DESC_PARAM_WB_TYPE ]; - hba->dev_info.b_presrv_uspc_en = + dev_info->b_presrv_uspc_en = desc_buf[DEVICE_DESC_PARAM_WB_PRESRV_USRSPC_EN ]; -if (hba->dev_info.b_wb_buffer_type ==WB_BUF_MODE_SHARED ) { - hba->dev_info.d_wb_alloc_units = +if (dev_info->b_wb_buffer_type ==WB_BUF_MODE_SHARED ) { + dev_info->d_wb_alloc_units =get_unaligned_be32 (desc_buf +DEVICE_DESC_PARAM_WB_SHARED_ALLOC_UNITS ); -if (!hba->dev_info.d_wb_alloc_units) +if (!dev_info->d_wb_alloc_units) goto wb_disabled; }else {for (lun =0 ; lun <UFS_UPIU_MAX_WB_LUN_ID ; lun++) {
@@ -6861,7 +6871,7 @@ static void ufshcd_wb_probe(struct ufs_hba *hba, u8 *desc_buf) (u8 *)&d_lu_wb_buf_alloc, sizeof(d_lu_wb_buf_alloc));if (d_lu_wb_buf_alloc) { - hba->dev_info.wb_dedicated_lu = lun; + dev_info->wb_dedicated_lu = lun;break ; } }
@@ -6950,14 +6960,7 @@ static int ufs_get_device_desc(struct ufs_hba *hba)ufs_fixup_device_setup (hba); -/* -* Probe WB only for UFS-3.1 devices or UFS devices with quirk -* UFS_DEVICE_QUIRK_SUPPORT_EXTENDED_FEATURES enabled -*/ -if (dev_info->wspecversion >=0x310 || - dev_info->wspecversion ==0x220 || - (hba->dev_quirks &UFS_DEVICE_QUIRK_SUPPORT_EXTENDED_FEATURES )) -ufshcd_wb_probe (hba, desc_buf); +ufshcd_wb_probe (hba, desc_buf);/* * ufshcd_read_string_desc returns size of the string
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 185/464 drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline
In reply to Greg Kroah-HartmanFrom: Emil Velikov <[email protected]>
[ Upstream commit 7a05c3b6d24b8460b3cec436cf1d33fac43c8450 ]
The helper uses the MIPI_DCS_SET_TEAR_SCANLINE, although it's currently using the generic write. This does not look right.
Perhaps some platforms don't distinguish between the two writers?
--- drivers/gpu/drm/drm_mipi_dsi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/drm_mipi_dsi.c +3 -3
@@ -1082,11 +1082,11 @@ EXPORT_SYMBOL(mipi_dsi_dcs_set_pixel_format);*/ int mipi_dsi_dcs_set_tear_scanline (struct mipi_dsi_device *dsi,u16 scanline) { -u8 payload[3 ] = {MIPI_DCS_SET_TEAR_SCANLINE , scanline >>8 , - scanline &0xff }; +u8 payload[2 ] = { scanline >>8 , scanline &0xff };ssize_t err; - err =mipi_dsi_generic_write (dsi, payload,sizeof (payload)); + err =mipi_dsi_dcs_write (dsi,MIPI_DCS_SET_TEAR_SCANLINE , payload, +sizeof (payload));if (err <0 )return err;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 186/464 cxl: Fix kobject memleak
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit 85c5cbeba8f4fb28e6b9bfb3e467718385f78f76 ]
Currently the error return path from kobject_init_and_add() is not followed by a call to kobject_put() - which means we are leaking the kobject.
Fix it by adding a call to kobject_put() in the error path of kobject_init_and_add().
--- drivers/misc/cxl/sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/cxl/sysfs.c +1 -1
@@ -624,7 +624,7 @@ static struct afu_config_record *cxl_sysfs_afu_new_cr(struct cxl_afu *afu, int c rc =kobject_init_and_add (&cr->kobj, &afu_config_record_type, &afu->dev.kobj,"cr%i" , cr->cr);if (rc) - goto err; + goto err1; rc =sysfs_create_bin_file (&cr->kobj, &cr->config_attr);if (rc)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 187/464 lkdtm: Avoid more compiler optimizations for bad writes
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit 464e86b4abadfc490f426954b431e2ec6a9d7bd2 ]
It seems at least Clang is able to throw away writes it knows are destined for read-only memory, which makes things like the WRITE_RO test fail, as the write gets elided. Instead, force the variable to be volatile, and make similar changes through-out other tests in an effort to avoid needing to repeat fixing these kinds of problems. Also includes pr_err() calls in failure paths so that kernel logs are more clear in the failure case.
--- drivers/misc/lkdtm/bugs.c | 11 +++++------ drivers/misc/lkdtm/perms.c | 22 +++++++++++++++------- drivers/misc/lkdtm/usercopy.c | 7 +++++-- 3 files changed, 25 insertions(+), 15 deletions(-)
drivers/misc/lkdtm/bugs.c +5 -6
@@ -118,9 +118,8 @@ noinline void lkdtm_CORRUPT_STACK(void)/* Use default char array length that triggers stack protection. */ char data[8 ]__aligned(sizeof(void *)) ; -__lkdtm_CORRUPT_STACK (&data); - -pr_info ("Corrupted stack containing char array ...\n" ); +pr_info ("Corrupting stack containing char array ...\n" ); +__lkdtm_CORRUPT_STACK ((void *)&data); }/* Same as above but will only get a canary with -fstack-protector-strong */
@@ -131,9 +130,8 @@ noinline void lkdtm_CORRUPT_STACK_STRONG(void)unsigned long *ptr; } data__aligned(sizeof(void *)) ; -__lkdtm_CORRUPT_STACK (&data); - -pr_info ("Corrupted stack containing union ...\n" ); +pr_info ("Corrupting stack containing union ...\n" ); +__lkdtm_CORRUPT_STACK ((void *)&data); }void lkdtm_UNALIGNED_LOAD_STORE_WRITE (void )
@@ -248,6 +246,7 @@ void lkdtm_ARRAY_BOUNDS(void)kfree (not_checked);kfree (checked); +pr_err ("FAIL: survived array bounds overflow!\n" ); }void lkdtm_CORRUPT_LIST_ADD (void )
drivers/misc/lkdtm/perms.c +15 -7
@@ -57,6 +57,7 @@ static noinline void execute_location(void *dst, bool write) }pr_info ("attempting bad execution at %px\n" , func);func (); +pr_err ("FAIL: func returned\n" ); }static void execute_user_location (void *dst)
@@ -75,20 +76,22 @@ static void execute_user_location(void *dst)return ;pr_info ("attempting bad execution at %px\n" , func);func (); +pr_err ("FAIL: func returned\n" ); }void lkdtm_WRITE_RO (void ) { -/* Explicitly cast away "const" for the test. */ -unsigned long *ptr = (unsigned long *)&rodata; +/* Explicitly cast away "const" for the test and make volatile. */ +volatile unsigned long *ptr = (unsigned long *)&rodata;pr_info ("attempting bad rodata write at %px\n" , ptr); *ptr ^=0xabcd1234 ; +pr_err ("FAIL: survived bad write\n" ); }void lkdtm_WRITE_RO_AFTER_INIT (void ) { -unsigned long *ptr = &ro_after_init; +volatile unsigned long *ptr = &ro_after_init;/* * Verify we were written to during init. Since an Oops
@@ -102,19 +105,21 @@ void lkdtm_WRITE_RO_AFTER_INIT(void)pr_info ("attempting bad ro_after_init write at %px\n" , ptr); *ptr ^=0xabcd1234 ; +pr_err ("FAIL: survived bad write\n" ); }void lkdtm_WRITE_KERN (void ) {size_t size; -unsigned char *ptr; +volatile unsigned char *ptr; size = (unsigned long )do_overwritten - (unsigned long )do_nothing; ptr = (unsigned char *)do_overwritten;pr_info ("attempting bad %zu byte write at %px\n" , size, ptr); -memcpy (ptr, (unsigned char *)do_nothing, size); +memcpy ((void *)ptr, (unsigned char *)do_nothing, size);flush_icache_range ((unsigned long )ptr, (unsigned long )(ptr + size)); +pr_err ("FAIL: survived bad write\n" );do_overwritten (); }
@@ -193,9 +198,11 @@ void lkdtm_ACCESS_USERSPACE(void)pr_info ("attempting bad read at %px\n" , ptr); tmp = *ptr; tmp +=0xc0dec0de ; +pr_err ("FAIL: survived bad read\n" );pr_info ("attempting bad write at %px\n" , ptr); *ptr = tmp; +pr_err ("FAIL: survived bad write\n" );vm_munmap (user_addr,PAGE_SIZE ); }
@@ -203,19 +210,20 @@ void lkdtm_ACCESS_USERSPACE(void)void lkdtm_ACCESS_NULL (void ) {unsigned long tmp; -unsigned long *ptr = (unsigned long *)NULL ; +volatile unsigned long *ptr = (unsigned long *)NULL ;pr_info ("attempting bad read at %px\n" , ptr); tmp = *ptr; tmp +=0xc0dec0de ; +pr_err ("FAIL: survived bad read\n" );pr_info ("attempting bad write at %px\n" , ptr); *ptr = tmp; +pr_err ("FAIL: survived bad write\n" ); }void __init lkdtm_perms_init (void ) {/* Make sure we can write to __ro_after_init values during __init */ ro_after_init |=0xAA ; - }
drivers/misc/lkdtm/usercopy.c +5 -2
@@ -304,19 +304,22 @@ void lkdtm_USERCOPY_KERNEL(void)return ; } -pr_info ("attempting good copy_to_user from kernel rodata\n" ); +pr_info ("attempting good copy_to_user from kernel rodata: %px\n" , + test_text);if (copy_to_user ((void __user *)user_addr, test_text, unconst +sizeof (test_text))) {pr_warn ("copy_to_user failed unexpectedly?!\n" ); goto free_user; } -pr_info ("attempting bad copy_to_user from kernel text\n" ); +pr_info ("attempting bad copy_to_user from kernel text: %px\n" , + vm_mmap);if (copy_to_user ((void __user *)user_addr, vm_mmap, unconst +PAGE_SIZE )) {pr_warn ("copy_to_user failed, but lacked Oops\n" ); goto free_user; } +pr_err ("FAIL: survived bad copy_to_user()\n" ); free_user:vm_munmap (user_addr,PAGE_SIZE );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 188/464 selftests/lkdtm: Reset WARN_ONCE to avoid false negatives
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit 4fccc8c0ff740e62343b6de38426a48b345b95f4 ]
Since we expect to see warnings every time for many tests, just reset the WARN_ONCE flags each time the script runs.
--- tools/testing/selftests/lkdtm/run.sh | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/lkdtm/run.sh +6 -0
@@ -8,6 +8,7 @@ # set -e TRIGGER=/sys/kernel/debug/provoke-crash/DIRECT +CLEAR_ONCE=/sys/kernel/debug/clear_warn_once KSELFTEST_SKIP_TEST=4 # Verify we have LKDTM available in the kernel.
@@ -67,6 +68,11 @@ cleanup() { } trap cleanup EXIT +# Reset WARN_ONCE counters so we trip it each time this runs. +if [ -w $CLEAR_ONCE ] ; then + echo 1 > $CLEAR_ONCE +fi + # Save existing dmesg so we can detect new content below dmesg > "$DMESG"
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 189/464 lkdtm: Make arch-specific tests always available
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit ae56942c14740c2963222efdc36c667ab19555ef ]
I'd like arch-specific tests to XFAIL when on a mismatched architecture so that we can more easily compare test coverage across all systems. Lacking kernel configs or CPU features count as a FAIL, not an XFAIL.
Additionally fixes a build failure under 32-bit UML.
--- drivers/misc/lkdtm/bugs.c | 38 ++++++++++++++----------- drivers/misc/lkdtm/lkdtm.h | 2 -- tools/testing/selftests/lkdtm/tests.txt | 1 + 3 files changed, 22 insertions(+), 19 deletions(-)
drivers/misc/lkdtm/bugs.c +21 -17
@@ -13,7 +13,7 @@#include <linux/uaccess.h> #include <linux/slab.h> -#ifdef CONFIG_X86_32 +#if IS_ENABLED (CONFIG_X86_32 ) && !IS_ENABLED (CONFIG_UML )#include <asm/desc.h> #endif
@@ -418,7 +418,7 @@ void lkdtm_UNSET_SMEP(void)void lkdtm_DOUBLE_FAULT (void ) { -#ifdef CONFIG_X86_32 +#if IS_ENABLED (CONFIG_X86_32 ) && !IS_ENABLED (CONFIG_UML )/* * Trigger #DF by setting the stack limit to zero. This clobbers * a GDT TLS slot, which is okay because the current task will die
@@ -453,38 +453,42 @@ void lkdtm_DOUBLE_FAULT(void)#endif } -#ifdef CONFIG_ARM64_PTR_AUTH +#ifdef CONFIG_ARM64 static noinline void change_pac_parameters(void) { -/* Reset the keys of current task */ -ptrauth_thread_init_kernel (current); -ptrauth_thread_switch_kernel (current); +if (IS_ENABLED (CONFIG_ARM64_PTR_AUTH )) { +/* Reset the keys of current task */ +ptrauth_thread_init_kernel (current); +ptrauth_thread_switch_kernel (current); + } } +#endif -#define CORRUPT_PAC_ITERATE 10 noinline void lkdtm_CORRUPT_PAC(void) { +#ifdef CONFIG_ARM64 +#define CORRUPT_PAC_ITERATE 10int i; +if (!IS_ENABLED (CONFIG_ARM64_PTR_AUTH )) +pr_err ("FAIL: kernel not built with CONFIG_ARM64_PTR_AUTH\n" ); +if (!system_supports_address_auth ()) { -pr_err ("FAIL: arm64 pointer authentication feature not present\n" ); +pr_err ("FAIL: CPU lacks pointer authentication feature\n" );return ; } -pr_info ("Change the PAC parameters to force function return failure\n" ); +pr_info ("changing PAC parameters to force function return failure...\n" );/* -* Pac is a hash value computed from input keys, return address and +* PAC is a hash value computed from input keys, return address and * stack pointer. As pac has fewer bits so there is a chance of * collision, so iterate few times to reduce the collision probability. */ for (i =0 ; i <CORRUPT_PAC_ITERATE ; i++)change_pac_parameters (); -pr_err ("FAIL: %s test failed. Kernel may be unstable from here\n" , __func__); -} -#else /* !CONFIG_ARM64_PTR_AUTH */ -noinline void lkdtm_CORRUPT_PAC(void) -{ -pr_err ("FAIL: arm64 pointer authentication config disabled\n" ); -} +pr_err ("FAIL: survived PAC changes! Kernel may be unstable from here\n" ); +#else +pr_err ("XFAIL: this test is arm64-only\n" );#endif +}
drivers/misc/lkdtm/lkdtm.h +0 -2
@@ -31,9 +31,7 @@ void lkdtm_CORRUPT_USER_DS(void);void lkdtm_STACK_GUARD_PAGE_LEADING (void );void lkdtm_STACK_GUARD_PAGE_TRAILING (void );void lkdtm_UNSET_SMEP (void ); -#ifdef CONFIG_X86_32 void lkdtm_DOUBLE_FAULT (void ); -#endif void lkdtm_CORRUPT_PAC (void );/* lkdtm_heap.c */
tools/testing/selftests/lkdtm/tests.txt +1 -0
@@ -14,6 +14,7 @@ STACK_GUARD_PAGE_LEADING STACK_GUARD_PAGE_TRAILING UNSET_SMEP CR4 bits went missing DOUBLE_FAULT +CORRUPT_PAC UNALIGNED_LOAD_STORE_WRITE #OVERWRITE_ALLOCATION Corrupts memory on failure #WRITE_AFTER_FREE Corrupts memory on failure
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 190/464 net: ethernet: ti: am65-cpsw-nuss: restore vlan configuration while down/up
In reply to Greg Kroah-HartmanFrom: Grygorii Strashko <[email protected]>
[ Upstream commit 7bcffde02152dd3cb180f6f3aef27e8586b2a905 ]
The vlan configuration is not restored after interface down/up sequence.
Steps to check:
# ip link add link eth0 name eth0.100 type vlan id 100 # ifconfig eth0 down # ifconfig eth0 up
This patch fixes it, restoring vlan ALE entries on .ndo_open().
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +19 -0
@@ -223,6 +223,9 @@ static int am65_cpsw_nuss_ndo_slave_add_vid(struct net_device *ndev,u32 port_mask, unreg_mcast =0 ;int ret; +if (!netif_running (ndev) || !vid) +return 0 ; + ret =pm_runtime_get_sync (common->dev);if (ret <0 ) {pm_runtime_put_noidle (common->dev);
@@ -246,6 +249,9 @@ static int am65_cpsw_nuss_ndo_slave_kill_vid(struct net_device *ndev,struct am65_cpsw_common *common =am65_ndev_to_common (ndev);int ret; +if (!netif_running (ndev) || !vid) +return 0 ; + ret =pm_runtime_get_sync (common->dev);if (ret <0 ) {pm_runtime_put_noidle (common->dev);
@@ -571,6 +577,16 @@ static int am65_cpsw_nuss_ndo_slave_stop(struct net_device *ndev)return 0 ; } +static int cpsw_restore_vlans (struct net_device *vdev,int vid,void *arg) +{ +struct am65_cpsw_port *port = arg; + +if (!vdev) +return 0 ; + +return am65_cpsw_nuss_ndo_slave_add_vid (port->ndev,0 , vid); +} +static int am65_cpsw_nuss_ndo_slave_open (struct net_device *ndev) {struct am65_cpsw_common *common =am65_ndev_to_common (ndev);
@@ -644,6 +660,9 @@ static int am65_cpsw_nuss_ndo_slave_open(struct net_device *ndev) } } +/* restore vlan configurations */ +vlan_for_each (ndev, cpsw_restore_vlans, port); +phy_attached_info (port->slave.phy);phy_start (port->slave.phy);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 191/464 tracing: Move pipe reference to trace array instead of current_tracer
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
[ Upstream commit 7ef282e05132d56b6f6b71e3873f317664bea78b ]
If a process has the trace_pipe open on a trace_array, the current tracer for that trace array should not be changed. This was original enforced by a global lock, but when instances were introduced, it was moved to the current_trace. But this structure is shared by all instances, and a trace_pipe is for a single instance. There's no reason that a process that has trace_pipe open on one instance should prevent another instance from changing its current tracer. Move the reference counter to the trace_array instead.
This is marked as "Fixes" but is more of a clean up than a true fix. Backport if you want, but its not critical.
--- kernel/trace/trace.c | 12 ++++++------ kernel/trace/trace.h | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-)
kernel/trace/trace.c +6 -6
@@ -5887,7 +5887,7 @@ int tracing_set_tracer(struct trace_array *tr, const char *buf) }/* If trace pipe files are being read, we can't change the tracer */ -if (tr->current_trace->ref) { +if (tr->trace_ref) { ret = -EBUSY ; goto out; }
@@ -6103,7 +6103,7 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)nonseekable_open (inode, filp); - tr->current_trace->ref++; + tr->trace_ref++; out:mutex_unlock (&trace_types_lock);return ret;
@@ -6122,7 +6122,7 @@ static int tracing_release_pipe(struct inode *inode, struct file *file)mutex_lock (&trace_types_lock); - tr->current_trace->ref--; + tr->trace_ref--;if (iter->trace->pipe_close) iter->trace->pipe_close (iter);
@@ -7424,7 +7424,7 @@ static int tracing_buffers_open(struct inode *inode, struct file *filp) filp->private_data = info; - tr->current_trace->ref++; + tr->trace_ref++;mutex_unlock (&trace_types_lock);
@@ -7525,7 +7525,7 @@ static int tracing_buffers_release(struct inode *inode, struct file *file)mutex_lock (&trace_types_lock); - iter->tr->current_trace->ref--; + iter->tr->trace_ref--;__trace_array_put (iter->tr);
@@ -8733,7 +8733,7 @@ static int __remove_instance(struct trace_array *tr)int i;/* Reference counter for a newly created trace array = 1. */ -if (tr->ref >1 || (tr->current_trace && tr->current_trace->ref)) +if (tr->ref >1 || (tr->current_trace && tr->trace_ref))return -EBUSY ;list_del (&tr->list);
kernel/trace/trace.h +1 -1
@@ -356,6 +356,7 @@ struct trace_array {struct trace_event_file *trace_marker_file;cpumask_var_t tracing_cpumask;/* only trace on set CPUs */ int ref; +int trace_ref;#ifdef CONFIG_FUNCTION_TRACER struct ftrace_ops *ops;struct trace_pid_list __rcu *function_pids;
@@ -547,7 +548,6 @@ struct tracer {struct tracer *next;struct tracer_flags *flags;int enabled; -int ref;bool print_max;bool allow_instances;#ifdef CONFIG_TRACER_MAX_TRACE
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 192/464 scsi: qla2xxx: Make __qla2x00_alloc_iocbs() initialize 32 bits of request_t.handle
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit f8f12bda53eae87ca2dea42b36d19e48c9851b9f ]
The request_t 'handle' member is 32-bits wide, hence use wrt_reg_dword(). Change the cast in the wrt_reg_byte() call to make it clear that a regular pointer is casted to an __iomem pointer.
Note: 'pkt' points to I/O memory for the qlafx00 adapter family and to coherent memory for all other adapter families.
This patch fixes the following Coverity complaint:
CID 358864 (#1 of 1): Reliance on integer endianness (INCOMPATIBLE_CAST)incompatible_cast: Pointer &pkt->handle points to an object whose effective type is unsigned int (32 bits, unsigned) but is dereferenced as a narrower unsigned short (16 bits, unsigned). This may lead to unexpected results depending on machine endianness.
--- drivers/scsi/qla2xxx/qla_iocb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/qla2xxx/qla_iocb.c +2 -2
@@ -2305,8 +2305,8 @@ __qla2x00_alloc_iocbs(struct qla_qpair *qpair, srb_t *sp) pkt = req->ring_ptr;memset (pkt,0 ,REQUEST_ENTRY_SIZE );if (IS_QLAFX00 (ha)) { -wrt_reg_byte ((void __iomem *)&pkt->entry_count, req_cnt); -wrt_reg_word ((void __iomem *)&pkt->handle, handle); +wrt_reg_byte ((u8 __force __iomem *)&pkt->entry_count, req_cnt); +wrt_reg_dword ((__le32 __force __iomem *)&pkt->handle, handle); }else { pkt->entry_count = req_cnt; pkt->handle = handle;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 193/464 drm/amdgpu/debugfs: fix memory leak when amdgpu_virt_enable_access_debugfs failed
In reply to Greg Kroah-HartmanFrom: Chen Tao <[email protected]>
[ Upstream commit 888e32d71115e26b57bdcbc717c68e9c5026bac3 ]
Fix memory leak in amdgpu_debugfs_gpr_read not freeing data when amdgpu_virt_enable_access_debugfs failed.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +1 -1
@@ -977,7 +977,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf, r =amdgpu_virt_enable_access_debugfs (adev);if (r <0 ) -return r; + goto err;/* switch to the specific se/sh/cu */ mutex_lock (&adev->grbm_idx_mutex);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 194/464 drm/amdgpu: ensure 0 is returned for success in jpeg_v2_5_wait_for_idle
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 57f01856645afe4c3d0f9915ee2bb043e8dd7982 ]
In the cases where adev->jpeg.num_jpeg_inst is zero or the condition adev->jpeg.harvest_config & (1 << i) is always non-zero the variable ret is never set to an error condition and the function returns an uninitialized value in ret. Since the only exit condition at the end if the function is a success then explicitly return 0 rather than a potentially uninitialized value in ret.
Addresses-Coverity: ("Uninitialized scalar variable")
--- drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c +1 -1
@@ -462,7 +462,7 @@ static int jpeg_v2_5_wait_for_idle(void *handle)return ret; } -return ret; +return 0 ; } static int jpeg_v2_5_set_clockgating_state(void *handle,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 195/464 drm/radeon: fix array out-of-bounds read and write issues
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 7ee78aff9de13d5dccba133f4a0de5367194b243 ]
There is an off-by-one bounds check on the index into arrays table->mc_reg_address and table->mc_reg_table_entry[k].mc_data[j] that can lead to reads and writes outside of arrays. Fix the bound checking off-by-one error.
Addresses-Coverity: ("Out-of-bounds read/write")
--- drivers/gpu/drm/radeon/ci_dpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/radeon/ci_dpm.c +1 -1
@@ -4351,7 +4351,7 @@ static int ci_set_mc_special_registers(struct radeon_device *rdev, table->mc_reg_table_entry[k].mc_data[j] |=0x100 ; } j++; -if (j >SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE ) +if (j >=SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE )return -EINVAL ;if (!pi->mem_gddr5) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 196/464 staging: vchiq_arm: Add a matching unregister call
In reply to Greg Kroah-HartmanFrom: Phil Elwell <[email protected]>
[ Upstream commit 5d9272e28a9a6117fb63f5f930991304765caa32 ]
All the registered children of vchiq have a corresponding call to platform_device_unregister except bcm2835_audio. Fix that.
--- drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +1 -0
@@ -2805,6 +2805,7 @@ static int vchiq_probe(struct platform_device *pdev)static int vchiq_remove (struct platform_device *pdev) { +platform_device_unregister (bcm2835_audio);platform_device_unregister (bcm2835_camera);vchiq_debugfs_deinit ();device_destroy (vchiq_class, vchiq_devid);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 197/464 iavf: fix error return code in iavf_init_get_resources()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 753f3884f253de6b6d3a516e6651bda0baf4aede ]
Fix to return negative error code -ENOMEM from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +3 -1
@@ -1863,8 +1863,10 @@ static int iavf_init_get_resources(struct iavf_adapter *adapter) adapter->rss_key =kzalloc (adapter->rss_key_size,GFP_KERNEL ); adapter->rss_lut =kzalloc (adapter->rss_lut_size,GFP_KERNEL ); -if (!adapter->rss_key || !adapter->rss_lut) +if (!adapter->rss_key || !adapter->rss_lut) { + err = -ENOMEM ; goto err_mem; + }if (RSS_AQ (adapter)) adapter->aq_required |=IAVF_FLAG_AQ_CONFIGURE_RSS ;else
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 198/464 iavf: Fix updating statistics
In reply to Greg Kroah-HartmanFrom: Tony Nguyen <[email protected]>
[ Upstream commit 9358076642f14cec8c414850d5a909cafca3a9d6 ]
Commit bac8486116b0 ("iavf: Refactor the watchdog state machine") inverted the logic for when to update statistics. Statistics should be updated when no other commands are pending, instead they were only requested when a command was processed. iavf_request_stats() would see a pending request and not request statistics to be updated. This caused statistics to never be updated; fix the logic.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +4 -1
@@ -1948,7 +1948,10 @@ static void iavf_watchdog_task(struct work_struct *work)iavf_send_api_ver (adapter); } }else { -if (!iavf_process_aq_command (adapter) && +/* An error will be returned if no commands were +* processed; use this opportunity to update stats +*/ +if (iavf_process_aq_command (adapter) && adapter->state == __IAVF_RUNNING)iavf_request_stats (adapter); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 199/464 dma-buf: fix dma-fence-chain out of order test
In reply to Greg Kroah-HartmanFrom: Lionel Landwerlin <[email protected]>
[ Upstream commit 4cca2e641641767593583749dec26bfebd8f6f2d ]
There was probably a misunderstand on how the dma-fence-chain is supposed to work or what dma_fence_chain_find_seqno() is supposed to return.
dma_fence_chain_find_seqno() is here to give us the fence to wait upon for a particular point in the timeline. The timeline progresses only when all the points prior to a given number have completed.
--- drivers/dma-buf/st-dma-fence-chain.c | 43 ++++++++++++++-------------- 1 file changed, 21 insertions(+), 22 deletions(-)
drivers/dma-buf/st-dma-fence-chain.c +21 -22
@@ -318,15 +318,16 @@ static int find_out_of_order(void *arg) goto err; } -if (fence && fence != fc.chains[1 ]) { +/* +* We signaled the middle fence (2) of the 1-2-3 chain. The behavior +* of the dma-fence-chain is to make us wait for all the fences up to +* the point we want. Since fence 1 is still not signaled, this what +* we should get as fence to wait upon (fence 2 being garbage +* collected during the traversal of the chain). +*/ +if (fence != fc.chains[0 ]) {pr_err ("Incorrect chain-fence.seqno:%lld reported for completed seqno:2\n" , - fence->seqno); - -dma_fence_get (fence); - err =dma_fence_chain_find_seqno (&fence,2 ); -dma_fence_put (fence); -if (err) -pr_err ("Reported %d for finding self!\n" , err); + fence ? fence->seqno :0 ); err = -EINVAL ; }
@@ -415,20 +416,18 @@ static int __find_race(void *arg)if (!fence) goto signal; - err =dma_fence_chain_find_seqno (&fence, seqno); -if (err) { -pr_err ("Reported an invalid fence for find-self:%d\n" , - seqno); -dma_fence_put (fence); -break ; - } - -if (fence->seqno < seqno) { -pr_err ("Reported an earlier fence.seqno:%lld for seqno:%d\n" , - fence->seqno, seqno); - err = -EINVAL ; -dma_fence_put (fence); -break ; +/* +* We can only find ourselves if we are on fence we were +* looking for. +*/ +if (fence->seqno == seqno) { + err =dma_fence_chain_find_seqno (&fence, seqno); +if (err) { +pr_err ("Reported an invalid fence for find-self:%d\n" , + seqno); +dma_fence_put (fence); +break ; + } }dma_fence_put (fence);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 200/464 RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued()
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
[ Upstream commit 0cb42c0265837fafa2b4f302c8a7fed2631d7869 ]
ib_unregister_device_queued() can only be used by drivers using the new dealloc_device callback flow, and it has a safety WARN_ON to ensure drivers are using it properly.
However, if unregister and register are raced there is a special destruction path that maintains the uniform error handling semantic of 'caller does ib_dealloc_device() on failure'. This requires disabling the dealloc_device callback which triggers the WARN_ON.
Instead of using NULL to disable the callback use a special function pointer so the WARN_ON does not trigger.
--- drivers/infiniband/core/device.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/infiniband/core/device.c +8 -3
@@ -1339,6 +1339,10 @@ static int enable_device_and_get(struct ib_device *device)return ret; } +static void prevent_dealloc_device (struct ib_device *ib_dev) +{ +} +/** * ib_register_device - Register an IB device with IB core * @device: Device to register
@@ -1409,11 +1413,11 @@ int ib_register_device(struct ib_device *device, const char *name)* possibility for a parallel unregistration along with this * error flow. Since we have a refcount here we know any * parallel flow is stopped in disable_device and will see the -* NULL pointers, causing the responsibility to +* special dealloc_driver pointer, causing the responsibility to * ib_dealloc_device() to revert back to this thread. */ dealloc_fn = device->ops.dealloc_driver; - device->ops.dealloc_driver =NULL ; + device->ops.dealloc_driver = prevent_dealloc_device;ib_device_put (device);__ib_unregister_device (device); device->ops.dealloc_driver = dealloc_fn;
@@ -1462,7 +1466,8 @@ static void __ib_unregister_device(struct ib_device *ib_dev)* Drivers using the new flow may not call ib_dealloc_device except * in error unwind prior to registration success. */ -if (ib_dev->ops.dealloc_driver) { +if (ib_dev->ops.dealloc_driver && + ib_dev->ops.dealloc_driver != prevent_dealloc_device) {WARN_ON (kref_read (&ib_dev->dev.kobj.kref) <=1 );ib_dealloc_device (ib_dev); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 201/464 scsi: powertec: Fix different dev_id between request_irq() and free_irq()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit d179f7c763241c1dc5077fca88ddc3c47d21b763 ]
The dev_id used in request_irq() and free_irq() should match. Use 'info' in both cases.
--- drivers/scsi/arm/powertec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/arm/powertec.c +1 -1
@@ -378,7 +378,7 @@ static int powertecscsi_probe(struct expansion_card *ec,if (info->info.scsi.dma !=NO_DMA )free_dma (info->info.scsi.dma); -free_irq (ec->irq, host); +free_irq (ec->irq, info); out_release:fas216_release (host);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 202/464 scsi: eesox: Fix different dev_id between request_irq() and free_irq()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 86f2da1112ccf744ad9068b1d5d9843faf8ddee6 ]
The dev_id used in request_irq() and free_irq() should match. Use 'info' in both cases.
--- drivers/scsi/arm/eesox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/arm/eesox.c +1 -1
@@ -571,7 +571,7 @@ static int eesoxscsi_probe(struct expansion_card *ec, const struct ecard_id *id)if (info->info.scsi.dma !=NO_DMA )free_dma (info->info.scsi.dma); -free_irq (ec->irq, host); +free_irq (ec->irq, info); out_remove:fas216_remove (host);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 203/464 ipvs: allow connection reuse for unconfirmed conntrack
In reply to Greg Kroah-HartmanFrom: Julian Anastasov <[email protected]>
[ Upstream commit f0a5e4d7a594e0fe237d3dfafb069bb82f80f42f ]
YangYuxi is reporting that connection reuse is causing one-second delay when SYN hits existing connection in TIME_WAIT state. Such delay was added to give time to expire both the IPVS connection and the corresponding conntrack. This was considered a rare case at that time but it is causing problem for some environments such as Kubernetes.
As nf_conntrack_tcp_packet() can decide to release the conntrack in TIME_WAIT state and to replace it with a fresh NEW conntrack, we can use this to allow rescheduling just by tuning our check: if the conntrack is confirmed we can not schedule it to different real server and the one-second delay still applies but if new conntrack was created, we are free to select new real server without any delays.
YangYuxi lists some of the problem reports:
- One second connection delay in masquerading mode:
https://marc.info/?t=151683118100004&r=1&w=2
- IPVS low throughput #70747
https://github.com/kubernetes/kubernetes/issues/70747
- Apache Bench can fill up ipvs service proxy in seconds #544
https://github.com/cloudnativelabs/kube-router/issues/544
- Additional 1s latency in host -> service IP -> pod
https://github.com/kubernetes/kubernetes/issues/90854
--- include/net/ip_vs.h | 10 ++++------ net/netfilter/ipvs/ip_vs_core.c | 12 +++++++----- 2 files changed, 11 insertions(+), 11 deletions(-)
include/net/ip_vs.h +4 -6
@@ -1624,18 +1624,16 @@ static inline void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp) }#endif /* CONFIG_IP_VS_NFCT */ -/* Really using conntrack? */ -static inline bool ip_vs_conn_uses_conntrack (struct ip_vs_conn *cp, -struct sk_buff *skb) +/* Using old conntrack that can not be redirected to another real server? */ +static inline bool ip_vs_conn_uses_old_conntrack (struct ip_vs_conn *cp, +struct sk_buff *skb) {#ifdef CONFIG_IP_VS_NFCT enum ip_conntrack_info ctinfo;struct nf_conn *ct; -if (!(cp->flags &IP_VS_CONN_F_NFCT )) -return false; ct =nf_ct_get (skb, &ctinfo); -if (ct) +if (ct &&nf_ct_is_confirmed (ct))return true;#endif return false;
net/netfilter/ipvs/ip_vs_core.c +7 -5
@@ -2066,14 +2066,14 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int conn_reuse_mode =sysctl_conn_reuse_mode (ipvs);if (conn_reuse_mode && !iph.fragoffs &&is_new_conn (skb, &iph) && cp) { -bool uses_ct = false, resched = false; +bool old_ct = false, resched = false;if (unlikely (sysctl_expire_nodest_conn (ipvs)) && cp->dest &&unlikely (!atomic_read (&cp->dest->weight))) { resched = true; - uses_ct =ip_vs_conn_uses_conntrack (cp, skb); + old_ct =ip_vs_conn_uses_old_conntrack (cp, skb); }else if (is_new_conn_expected (cp, conn_reuse_mode)) { - uses_ct =ip_vs_conn_uses_conntrack (cp, skb); + old_ct =ip_vs_conn_uses_old_conntrack (cp, skb);if (!atomic_read (&cp->n_control)) { resched = true; }else {
@@ -2081,15 +2081,17 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int* that uses conntrack while it is still * referenced by controlled connection(s). */ - resched = !uses_ct; + resched = !old_ct; } }if (resched) { +if (!old_ct) + cp->flags &= ~IP_VS_CONN_F_NFCT ;if (!atomic_read (&cp->n_control))ip_vs_conn_expire_now (cp);__ip_vs_conn_put (cp); -if (uses_ct) +if (old_ct)return NF_DROP ; cp =NULL ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 204/464 media: firewire: Using uninitialized values in node_probe()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 2505a210fc126599013aec2be741df20aaacc490 ]
If fw_csr_string() returns -ENOENT, then "name" is uninitialized. So then the "strlen(model_names[i]) <= name_len" is true because strlen() is unsigned and -ENOENT is type promoted to a very high positive value. Then the "strncmp(name, model_names[i], name_len)" uses uninitialized data because "name" is uninitialized.
--- drivers/media/firewire/firedtv-fw.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/firewire/firedtv-fw.c +2 -0
@@ -272,6 +272,8 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id) name_len =fw_csr_string (unit->directory,CSR_MODEL , name,sizeof (name)); +if (name_len <0 ) +return name_len;for (i =ARRAY_SIZE (model_names); --i; )if (strlen (model_names[i]) <= name_len &&strncmp (name, model_names[i], name_len) ==0 )
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 205/464 media: allegro: Fix some NULL vs IS_ERR() checks in probe
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit d93d45ab716e4107056be54969c8c70e50a8346d ]
The devm_ioremap() function doesn't return error pointers, it returns NULL on error.
--- drivers/staging/media/allegro-dvt/allegro-core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/staging/media/allegro-dvt/allegro-core.c +4 -4
@@ -3065,9 +3065,9 @@ static int allegro_probe(struct platform_device *pdev)return -EINVAL ; } regs =devm_ioremap (&pdev->dev, res->start,resource_size (res)); -if (IS_ERR (regs)) { +if (!regs) {dev_err (&pdev->dev,"failed to map registers\n" ); -return PTR_ERR (regs); +return -ENOMEM ; } dev->regmap =devm_regmap_init_mmio (&pdev->dev, regs, &allegro_regmap_config);
@@ -3085,9 +3085,9 @@ static int allegro_probe(struct platform_device *pdev) sram_regs =devm_ioremap (&pdev->dev, sram_res->start,resource_size (sram_res)); -if (IS_ERR (sram_regs)) { +if (!sram_regs) {dev_err (&pdev->dev,"failed to map sram\n" ); -return PTR_ERR (sram_regs); +return -ENOMEM ; } dev->sram =devm_regmap_init_mmio (&pdev->dev, sram_regs, &allegro_sram_config);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 206/464 media: staging: rkisp1: rsz: supported formats are the isps src formats, not sink formats
In reply to Greg Kroah-HartmanFrom: Dafna Hirschfeld <[email protected]>
[ Upstream commit 7b8ce1f2763b9351a4cb04b802835470e76770a5 ]
The rkisp1_resizer's enum callback 'rkisp1_rsz_enum_mbus_code' calls the enum callback of the 'rkisp1_isp' on it's video sink pad. This is a bug, the resizer should support the same formats supported by the 'rkisp1_isp' on the source pad (not the sink pad).
--- drivers/staging/media/rkisp1/rkisp1-resizer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/media/rkisp1/rkisp1-resizer.c +2 -2
@@ -437,8 +437,8 @@ static int rkisp1_rsz_enum_mbus_code(struct v4l2_subdev *sd,u32 pad = code->pad;int ret; -/* supported mbus codes are the same in isp sink pad */ - code->pad =RKISP1_ISP_PAD_SINK_VIDEO ; +/* supported mbus codes are the same in isp video src pad */ + code->pad =RKISP1_ISP_PAD_SOURCE_VIDEO ; ret =v4l2_subdev_call (&rsz->rkisp1->isp.sd, pad, enum_mbus_code, &dummy_cfg, code);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 207/464 media: staging: rkisp1: rsz: fix resolution limitation on sink pad
In reply to Greg Kroah-HartmanFrom: Helen Koike <[email protected]>
[ Upstream commit 906dceb48dfa1e7c99c32e6b25878d47023e916b ]
Resizer sink pad is limited by what the ISP can generate. The configurations describes what the resizer can produce.
This was tested on a Scarlet device with ChromiumOs, where the selfpath receives 2592x1944 and produces 1600x1200 (which isn't possible without this fix).
--- drivers/staging/media/rkisp1/rkisp1-resizer.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/staging/media/rkisp1/rkisp1-resizer.c +4 -4
@@ -553,11 +553,11 @@ static void rkisp1_rsz_set_sink_fmt(struct rkisp1_resizer *rsz, src_fmt->code = sink_fmt->code; sink_fmt->width =clamp_t (u32, format->width, - rsz->config->min_rsz_width, - rsz->config->max_rsz_width); +RKISP1_ISP_MIN_WIDTH , +RKISP1_ISP_MAX_WIDTH ); sink_fmt->height =clamp_t (u32, format->height, - rsz->config->min_rsz_height, - rsz->config->max_rsz_height); +RKISP1_ISP_MIN_HEIGHT , +RKISP1_ISP_MAX_HEIGHT ); *format = *sink_fmt;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 208/464 media: tvp5150: Add missed media_entity_cleanup()
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
[ Upstream commit d000e9b5e4a23dd700b3f58a4738c94bb5179ff0 ]
This driver does not call media_entity_cleanup() in the error handler of tvp5150_registered() and tvp5150_remove(), while it has called media_entity_pads_init() at first.
Add the missed calls to fix it.
--- drivers/media/i2c/tvp5150.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/media/i2c/tvp5150.c +6 -2
@@ -1664,8 +1664,10 @@ static int tvp5150_registered(struct v4l2_subdev *sd)return 0 ; err: -for (i =0 ; i < decoder->connectors_num; i++) +for (i =0 ; i < decoder->connectors_num; i++) {media_device_unregister_entity (&decoder->connectors[i].ent); +media_entity_cleanup (&decoder->connectors[i].ent); + }return ret;#endif
@@ -2248,8 +2250,10 @@ static int tvp5150_remove(struct i2c_client *c)for (i =0 ; i < decoder->connectors_num; i++)v4l2_fwnode_connector_free (&decoder->connectors[i].base); -for (i =0 ; i < decoder->connectors_num; i++) +for (i =0 ; i < decoder->connectors_num; i++) {media_device_unregister_entity (&decoder->connectors[i].ent); +media_entity_cleanup (&decoder->connectors[i].ent); + }v4l2_async_unregister_subdev (sd);v4l2_ctrl_handler_free (&decoder->hdl);pm_runtime_disable (&c->dev);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 209/464 media: exynos4-is: Add missed check for pinctrl_lookup_state()
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
[ Upstream commit 18ffec750578f7447c288647d7282c7d12b1d969 ]
fimc_md_get_pinctrl() misses a check for pinctrl_lookup_state(). Add the missed check to fix it.
--- drivers/media/platform/exynos4-is/media-dev.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/platform/exynos4-is/media-dev.c +3 -0
@@ -1270,6 +1270,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd) pctl->state_idle =pinctrl_lookup_state (pctl->pinctrl,PINCTRL_STATE_IDLE ); +if (IS_ERR (pctl->state_idle)) +return PTR_ERR (pctl->state_idle); +return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 210/464 media: cros-ec-cec: do not bail on device_init_wakeup failure
In reply to Greg Kroah-HartmanFrom: Dariusz Marcinkiewicz <[email protected]>
[ Upstream commit 6f01dfb760c027d5dd6199d91ee9599f2676b5c6 ]
Do not fail probing when device_init_wakeup fails.
device_init_wakeup fails when the device is already enabled as wakeup device. Hence, the driver fails to probe the device if:
- The device has already been enabled for wakeup (by e.g. sysfs)
- The driver has been unloaded and is being loaded again.
This goal of the patch is to fix the above cases.
Overwhelming majority of the drivers do not check device_init_wakeup return code.
--- drivers/media/cec/platform/cros-ec/cros-ec-cec.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/media/cec/platform/cros-ec/cros-ec-cec.c +1 -5
@@ -277,11 +277,7 @@ static int cros_ec_cec_probe(struct platform_device *pdev)platform_set_drvdata (pdev, cros_ec_cec); cros_ec_cec->cros_ec = cros_ec; - ret =device_init_wakeup (&pdev->dev,1 ); -if (ret) { -dev_err (&pdev->dev,"failed to initialize wakeup\n" ); -return ret; - } +device_init_wakeup (&pdev->dev,1 ); cros_ec_cec->adap = cec_allocate_adapter(&cros_ec_cec_ops, cros_ec_cec, DRV_NAME,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 211/464 xfs: preserve rmapbt swapext block reservation from freed blocks
In reply to Greg Kroah-HartmanFrom: Brian Foster <[email protected]>
[ Upstream commit f74681ba2006434be195402e0b15fc5763cddd7e ]
The rmapbt extent swap algorithm remaps individual extents between the source inode and the target to trigger reverse mapping metadata updates. If either inode straddles a format or other bmap allocation boundary, the individual unmap and map cycles can trigger repeated bmap block allocations and frees as the extent count bounces back and forth across the boundary. While net block usage is bound across the swap operation, this behavior can prematurely exhaust the transaction block reservation because it continuously drains as the transaction rolls. Each allocation accounts against the reservation and each free returns to global free space on transaction roll.
The previous workaround to this problem attempted to detect this boundary condition and provide surplus block reservation to acommodate it. This is insufficient because more remaps can occur than implied by the extent counts; if start offset boundaries are not aligned between the two inodes, for example.
To address this problem more generically and dynamically, add a transaction accounting mode that returns freed blocks to the transaction reservation instead of the superblock counters on transaction roll and use it when the rmapbt based algorithm is active. This allows the chain of remap transactions to preserve the block reservation based own its own frees and prevent premature exhaustion regardless of the remap pattern. Note that this is only safe for superblocks with lazy sb accounting, but the latter is required for v5 supers and the rmap feature depends on v5.
--- fs/xfs/libxfs/xfs_shared.h | 1 + fs/xfs/xfs_bmap_util.c | 18 +++++++++--------- fs/xfs/xfs_trans.c | 19 ++++++++++++++++++- 3 files changed, 28 insertions(+), 10 deletions(-)
fs/xfs/libxfs/xfs_shared.h +1 -0
@@ -65,6 +65,7 @@ void xfs_log_get_max_trans_res(struct xfs_mount *mp,#define XFS_TRANS_DQ_DIRTY 0x10/* at least one dquot in trx dirty */ #define XFS_TRANS_RESERVE 0x20/* OK to use reserved data blocks */ #define XFS_TRANS_NO_WRITECOUNT 0x40/* do not elevate SB writecount */ +#define XFS_TRANS_RES_FDBLKS 0x80/* reserve newly freed blocks */ /* * LOWMODE is used by the allocator to activate the lowspace algorithm - when * free space is running low the extent allocator may choose to allocate an
fs/xfs/xfs_bmap_util.c +9 -9
@@ -1567,6 +1567,7 @@ xfs_swap_extents(int lock_flags;uint64_t f;int resblks =0 ; +unsigned int flags =0 ;/* * Lock the inodes against other IO, page faults and truncate to
@@ -1630,17 +1631,16 @@ xfs_swap_extents( resblks +=XFS_SWAP_RMAP_SPACE_RES (mp, tipnext, w);/* -* Handle the corner case where either inode might straddle the -* btree format boundary. If so, the inode could bounce between -* btree <-> extent format on unmap -> remap cycles, freeing and -* allocating a bmapbt block each time. +* If either inode straddles a bmapbt block allocation boundary, +* the rmapbt algorithm triggers repeated allocs and frees as +* extents are remapped. This can exhaust the block reservation +* prematurely and cause shutdown. Return freed blocks to the +* transaction reservation to counter this behavior. */ -if (ipnext == (XFS_IFORK_MAXEXT (ip, w) +1 )) - resblks +=XFS_IFORK_MAXEXT (ip, w); -if (tipnext == (XFS_IFORK_MAXEXT (tip, w) +1 )) - resblks +=XFS_IFORK_MAXEXT (tip, w); + flags |=XFS_TRANS_RES_FDBLKS ; } - error =xfs_trans_alloc (mp, &M_RES (mp)->tr_write, resblks,0 ,0 , &tp); + error =xfs_trans_alloc (mp, &M_RES (mp)->tr_write, resblks,0 , flags, + &tp);if (error) goto out_unlock;
fs/xfs/xfs_trans.c +18 -1
@@ -107,7 +107,8 @@ xfs_trans_dup( ntp->t_flags =XFS_TRANS_PERM_LOG_RES | (tp->t_flags &XFS_TRANS_RESERVE ) | - (tp->t_flags &XFS_TRANS_NO_WRITECOUNT ); + (tp->t_flags &XFS_TRANS_NO_WRITECOUNT ) | + (tp->t_flags &XFS_TRANS_RES_FDBLKS );/* We gave our writer reference to the new transaction */ tp->t_flags |=XFS_TRANS_NO_WRITECOUNT ; ntp->t_ticket =xfs_log_ticket_get (tp->t_ticket);
@@ -272,6 +273,8 @@ xfs_trans_alloc(*/ WARN_ON (resp->tr_logres >0 && mp->m_super->s_writers.frozen ==SB_FREEZE_COMPLETE ); +ASSERT (!(flags &XFS_TRANS_RES_FDBLKS ) || +xfs_sb_version_haslazysbcount (&mp->m_sb)); tp->t_magic =XFS_TRANS_HEADER_MAGIC ; tp->t_flags = flags;
@@ -365,6 +368,20 @@ xfs_trans_mod_sb( tp->t_blk_res_used += (uint)-delta;if (tp->t_blk_res_used > tp->t_blk_res)xfs_force_shutdown (mp,SHUTDOWN_CORRUPT_INCORE ); + }else if (delta >0 && (tp->t_flags &XFS_TRANS_RES_FDBLKS )) { +int64_t blkres_delta; + +/* +* Return freed blocks directly to the reservation +* instead of the global pool, being careful not to +* overflow the trans counter. This is used to preserve +* reservation across chains of transaction rolls that +* repeatedly free and allocate blocks. +*/ + blkres_delta =min_t (int64_t, delta, +UINT_MAX - tp->t_blk_res); + tp->t_blk_res += blkres_delta; + delta -= blkres_delta; } tp->t_fdblocks_delta += delta;if (xfs_sb_version_haslazysbcount (&mp->m_sb))
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 212/464 xfs: dont eat an EIO/ENOSPC writeback error when scrubbing data fork
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit eb0efe5063bb10bcb653e4f8e92a74719c03a347 ]
The data fork scrubber calls filemap_write_and_wait to flush dirty pages and delalloc reservations out to disk prior to checking the data fork's extent mappings. Unfortunately, this means that scrub can consume the EIO/ENOSPC errors that would otherwise have stayed around in the address space until (we hope) the writer application calls fsync to persist data and collect errors. The end result is that programs that wrote to a file might never see the error code and proceed as if nothing were wrong.
xfs_scrub is not in a position to notify file writers about the writeback failure, and it's only here to check metadata, not file contents. Therefore, if writeback fails, we should stuff the error code back into the address space so that an fsync by the writer application can pick that up.
--- fs/xfs/scrub/bmap.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
fs/xfs/scrub/bmap.c +20 -2
@@ -45,9 +45,27 @@ xchk_setup_inode_bmap(*/ if (S_ISREG (VFS_I (sc->ip)->i_mode) && sc->sm->sm_type ==XFS_SCRUB_TYPE_BMBTD ) { +struct address_space *mapping =VFS_I (sc->ip)->i_mapping; +inode_dio_wait (VFS_I (sc->ip)); - error =filemap_write_and_wait (VFS_I (sc->ip)->i_mapping); -if (error) + +/* +* Try to flush all incore state to disk before we examine the +* space mappings for the data fork. Leave accumulated errors +* in the mapping for the writer threads to consume. +* +* On ENOSPC or EIO writeback errors, we continue into the +* extent mapping checks because write failures do not +* necessarily imply anything about the correctness of the file +* metadata. The metadata and the file data could be on +* completely separate devices; a media failure might only +* affect a subset of the disk, etc. We can handle delalloc +* extents in the scrubber, so leaving them in memory is fine. +*/ + error =filemap_fdatawrite (mapping); +if (!error) + error =filemap_fdatawait_keep_errors (mapping); +if (error && (error != -ENOSPC && error != -EIO )) goto out; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 213/464 xfs: fix reflink quota reservation accounting error
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit 83895227aba1ade33e81f586aa7b6b1e143096a5 ]
Quota reservations are supposed to account for the blocks that might be allocated due to a bmap btree split. Reflink doesn't do this, so fix this to make the quota accounting more accurate before we start rearranging things.
--- fs/xfs/xfs_reflink.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
fs/xfs/xfs_reflink.c +14 -7
@@ -1003,6 +1003,7 @@ xfs_reflink_remap_extent(xfs_filblks_t rlen;xfs_filblks_t unmap_len;xfs_off_t newlen; +int64_t qres;int error; unmap_len = irec->br_startoff + irec->br_blockcount - destoff;
@@ -1025,13 +1026,19 @@ xfs_reflink_remap_extent(xfs_ilock (ip,XFS_ILOCK_EXCL );xfs_trans_ijoin (tp, ip,0 ); -/* If we're not just clearing space, then do we have enough quota? */ -if (real_extent) { - error =xfs_trans_reserve_quota_nblks (tp, ip, - irec->br_blockcount,0 ,XFS_QMOPT_RES_REGBLKS ); -if (error) - goto out_cancel; - } +/* +* Reserve quota for this operation. We don't know if the first unmap +* in the dest file will cause a bmap btree split, so we always reserve +* at least enough blocks for that split. If the extent being mapped +* in is written, we need to reserve quota for that too. +*/ + qres =XFS_EXTENTADD_SPACE_RES (mp,XFS_DATA_FORK ); +if (real_extent) + qres += irec->br_blockcount; + error =xfs_trans_reserve_quota_nblks (tp, ip, qres,0 , +XFS_QMOPT_RES_REGBLKS ); +if (error) + goto out_cancel;trace_xfs_reflink_remap (ip, irec->br_startoff, irec->br_blockcount, irec->br_startblock);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 214/464 iomap: Make sure iomap_end is called after iomap_begin
In reply to Greg Kroah-HartmanFrom: Andreas Gruenbacher <[email protected]>
[ Upstream commit 856473cd5d17dbbf3055710857c67a4af6d9fcc0 ]
Make sure iomap_end is always called when iomap_begin succeeds.
Without this fix, iomap_end won't be called when a filesystem's iomap_begin operation returns an invalid mapping, bypassing any unlocking done in iomap_end. With this fix, the unlocking will still happen.
This bug was found by Bob Peterson during code review. It's unlikely that such iomap_begin bugs will survive to affect users, so backporting this fix seems unnecessary.
--- fs/iomap/apply.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
fs/iomap/apply.c +9 -4
@@ -46,10 +46,14 @@ iomap_apply(struct inode *inode, loff_t pos, loff_t length, unsigned flags, ret = ops->iomap_begin (inode, pos, length, flags, &iomap, &srcmap);if (ret)return ret; -if (WARN_ON (iomap.offset > pos)) -return -EIO ; -if (WARN_ON (iomap.length ==0 )) -return -EIO ; +if (WARN_ON (iomap.offset > pos)) { + written = -EIO ; + goto out; + } +if (WARN_ON (iomap.length ==0 )) { + written = -EIO ; + goto out; + }trace_iomap_apply_dstmap (inode, &iomap);if (srcmap.type !=IOMAP_HOLE )
@@ -80,6 +84,7 @@ iomap_apply(struct inode *inode, loff_t pos, loff_t length, unsigned flags, written =actor (inode, pos, length, data, &iomap, srcmap.type !=IOMAP_HOLE ? &srcmap : &iomap); +out:/* * Now the data has been copied, commit the range we've copied. This * should not fail unless the filesystem has had a fatal error.
Signature · 1 line
2.25.1
Re: [PATCH 5.8 214/464] iomap: Make sure iomap_end is called after iomap_begin
Gerg,
Am Mo., 17. Aug. 2020 um 21:39 Uhr schrieb Greg Kroah-Hartman <[email protected]>:
Quoted 6 lines
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit
856473cd5d17dbbf3055710857c67a4af6d9fcc0]Make sure
iomap_endis always called wheniomap_beginsucceeds.
Quoted 8 lines
Without this fix,
iomap_endwon't be called when a filesystem'siomap_beginoperation returns an invalid mapping, bypassing any unlocking done iniomap_end. With this fix, the unlocking will still happen.This bug was found by Bob Peterson during code review. It's unlikely that such
iomap_beginbugs will survive to affect users, so backporting this fix seems unnecessary.
this doesn't need to be backported.
Thanks,
Andreas
Quoted 46 lines
Fixes ae259a9c8593 ("fs: introduce iomap infrastructure")Signed-off-by Andreas Gruenbacher <[email protected]>Reviewed-by Christoph Hellwig <[email protected]>Reviewed-by Darrick J. Wong <[email protected]>Signed-off-by Darrick J. Wong <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- fs/iomap/apply.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)fs/iomap/apply.c +9
-5@@ -46,10 +46,14 @@ iomap_apply(struct inode *inode, loff_t pos, loff_t length, unsigned flags, ret = ops->iomap_begin (inode, pos, length, flags, &iomap, &srcmap);if (ret)return ret; -if (WARN_ON (iomap.offset > pos)) -return -EIO ; -if (WARN_ON (iomap.length ==0 )) -return -EIO ; +if (WARN_ON (iomap.offset > pos)) { + written = -EIO ; + goto out; + } +if (WARN_ON (iomap.length ==0 )) { + written = -EIO ; + goto out; + }trace_iomap_apply_dstmap (inode, &iomap);if (srcmap.type !=IOMAP_HOLE )@@ -80,6 +84,7 @@ iomap_apply(struct inode *inode, loff_t pos, loff_t length, unsigned flags, written =actor (inode, pos, length, data, &iomap, srcmap.type !=IOMAP_HOLE ? &srcmap : &iomap); +out:/* * Now the data has been copied, commit the range we've copied. This * should not fail unless the filesystem has had a fatal error. -- 2.25.1
Sasha Levin
maintainerRe: [PATCH 5.8 214/464] iomap: Make sure iomap_end is called after iomap_begin
Quoted 15 lines · Andreas Grünbacher
Gerg,
Am Mo., 17. Aug. 2020 um 21:39 Uhr schrieb Greg Kroah-Hartman <[email protected]>:
Quoted 11 lines
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit
856473cd5d17dbbf3055710857c67a4af6d9fcc0]Make sure
iomap_endis always called wheniomap_beginsucceeds.Without this fix,
iomap_endwon't be called when a filesystem'siomap_beginoperation returns an invalid mapping, bypassing any unlocking done iniomap_end. With this fix, the unlocking will still happen.
Quoted 5 lines
Quoted 3 lines
This bug was found by Bob Peterson during code review. It's unlikely that such
iomap_beginbugs will survive to affect users, so backporting this fix seems unnecessary.this doesn't need to be backported.
Now dropped, thanks!
Signature · 2 lines
Thanks, Sasha
Greg Kroah-Hartman
maintainerPATCH 215/464 RDMA/rxe: Skip dgid check in loopback mode
In reply to Greg Kroah-HartmanFrom: Zhu Yanjun <[email protected]>
[ Upstream commit 5c99274be8864519328aa74bc550ba410095bc1c ]
In the loopback tests, the following call trace occurs.
Call Trace: __rxe_do_task+0x1a/0x30 [rdma_rxe] rxe_qp_destroy+0x61/0xa0 [rdma_rxe] rxe_destroy_qp+0x20/0x60 [rdma_rxe] ib_destroy_qp_user+0xcc/0x220 [ib_core] uverbs_free_qp+0x3c/0xc0 [ib_uverbs] destroy_hw_idr_uobject+0x24/0x70 [ib_uverbs] uverbs_destroy_uobject+0x43/0x1b0 [ib_uverbs] uobj_destroy+0x41/0x70 [ib_uverbs] __uobj_get_destroy+0x39/0x70 [ib_uverbs] ib_uverbs_destroy_qp+0x88/0xc0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xb9/0xf0 [ib_uverbs] ib_uverbs_cmd_verbs+0xb16/0xc30 [ib_uverbs]
The root cause is that the actual RDMA connection is not created in the loopback tests and the rxe_match_dgid will fail randomly.
To fix this call trace which appear in the loopback tests, skip check of the dgid.
--- drivers/infiniband/sw/rxe/rxe_recv.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/infiniband/sw/rxe/rxe_recv.c +5 -1
@@ -330,10 +330,14 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb)static int rxe_match_dgid (struct rxe_dev *rxe,struct sk_buff *skb) { +struct rxe_pkt_info *pkt =SKB_TO_PKT (skb);const struct ib_gid_attr *gid_attr;union ib_gid dgid;union ib_gid *pdgid; +if (pkt->mask &RXE_LOOPBACK_MASK ) +return 0 ; +if (skb->protocol ==htons (ETH_P_IP )) {ipv6_addr_set_v4mapped (ip_hdr (skb)->daddr, (struct in6_addr *)&dgid);
@@ -366,7 +370,7 @@ void rxe_rcv(struct sk_buff *skb)if (unlikely (skb->len < pkt->offset +RXE_BTH_BYTES )) goto drop; -if (unlikely (rxe_match_dgid (rxe, skb) <0 )) { +if (rxe_match_dgid (rxe, skb) <0 ) {pr_warn_ratelimited ("failed matching dgid\n" ); goto drop; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 216/464 PCI: Fix pci_cfg_wait queue locking problem
In reply to Greg Kroah-HartmanFrom: Bjorn Helgaas <[email protected]>
[ Upstream commit 2a7e32d0547f41c5ce244f84cf5d6ca7fccee7eb ]
The pci_cfg_wait queue is used to prevent user-space config accesses to devices while they are recovering from reset.
Previously we used these operations on pci_cfg_wait:
__add_wait_queue(&pci_cfg_wait, ...)
__remove_wait_queue(&pci_cfg_wait, ...)
wake_up_all(&pci_cfg_wait)
The wake_up acquires the wait queue lock, but the add and remove do not.
Originally these were all protected by the pci_lock, but cdcb33f98244 ("PCI: Avoid possible deadlock on pci_lock and p->pi_lock"), moved wake_up_all() outside pci_lock, so it could race with add/remove operations, which caused occasional kernel panics, e.g., during vfio-pci hotplug/unplug testing:
Unable to handle kernel read from unreadable memory at virtual address ffff802dac469000
Resolve this by using wait_event() instead of __add_wait_queue() and __remove_wait_queue(). The wait queue lock is held by both wait_event() and wake_up_all(), so it provides mutual exclusion.
Based-on: https://lore.kernel.org/linux-pci/[email protected]/
--- drivers/pci/access.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/pci/access.c +2 -6
@@ -204,17 +204,13 @@ EXPORT_SYMBOL(pci_bus_set_ops);static DECLARE_WAIT_QUEUE_HEAD (pci_cfg_wait); static noinline void pci_wait_cfg(struct pci_dev *dev) + __must_hold(&pci_lock) { -DECLARE_WAITQUEUE (wait, current); - -__add_wait_queue (&pci_cfg_wait, &wait);do { -set_current_state (TASK_UNINTERRUPTIBLE );raw_spin_unlock_irq (&pci_lock); -schedule (); +wait_event (pci_cfg_wait, !dev->block_cfg_access);raw_spin_lock_irq (&pci_lock); }while (dev->block_cfg_access); -__remove_wait_queue (&pci_cfg_wait, &wait); }/* Returns 0 on success, negative values indicate error. */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 217/464 samples: bpf: Fix bpf programs with kprobe/sys_connect event
In reply to Greg Kroah-HartmanFrom: Daniel T. Lee <[email protected]>
[ Upstream commit af9bd3e3331b8af42b6606c75797d041ab39380c ]
Currently, BPF programs with kprobe/sys_connect does not work properly.
Commit 34745aed515c ("samples/bpf: fix kprobe attachment issue on x64") This commit modifies the bpf_load behavior of kprobe events in the x64 architecture. If the current kprobe event target starts with "sys_*", add the prefix "__x64_" to the front of the event.
Appending "__x64_" prefix with kprobe/sys_* event was appropriate as a solution to most of the problems caused by the commit below.
commit d5a00528b58c ("syscalls/core, syscalls/x86: Rename struct pt_regs-based sys_*() to __x64_sys_*()")
However, there is a problem with the sys_connect kprobe event that does not work properly. For __sys_connect event, parameters can be fetched normally, but for __x64_sys_connect, parameters cannot be fetched.
ffffffff818d3520 <__x64_sys_connect>:
ffffffff818d3520: e8 fb df 32 00 callq 0xffffffff81c01520
<__fentry__>
ffffffff818d3525: 48 8b 57 60 movq 96(%rdi), %rdx
ffffffff818d3529: 48 8b 77 68 movq 104(%rdi), %rsi
ffffffff818d352d: 48 8b 7f 70 movq 112(%rdi), %rdi
ffffffff818d3531: e8 1a ff ff ff callq 0xffffffff818d3450
<__sys_connect>
ffffffff818d3536: 48 98 cltq
ffffffff818d3538: c3 retq
ffffffff818d3539: 0f 1f 80 00 00 00 00 nopl (%rax)As the assembly code for __x64_sys_connect shows, parameters should be fetched and set into rdi, rsi, rdx registers prior to calling __sys_connect.
Because of this problem, this commit fixes the sys_connect event by first getting the value of the rdi register and then the value of the rdi, rsi, and rdx register through an offset based on that value.
--- samples/bpf/map_perf_test_kern.c | 9 ++++++--- samples/bpf/test_map_in_map_kern.c | 9 ++++++--- samples/bpf/test_probe_write_user_kern.c | 9 ++++++--- 3 files changed, 18 insertions(+), 9 deletions(-)
samples/bpf/map_perf_test_kern.c +6 -3
@@ -11,6 +11,8 @@#include <bpf/bpf_helpers.h> #include "bpf_legacy.h" #include <bpf/bpf_tracing.h> +#include <bpf/bpf_core_read.h> +#include "trace_common.h" #define MAX_ENTRIES 1000#define MAX_NR_CPUS 1024
@@ -154,9 +156,10 @@ int stress_percpu_hmap_alloc(struct pt_regs *ctx)return 0 ; } -SEC("kprobe/sys_connect") +SEC("kprobe/" SYSCALL(sys_connect))int stress_lru_hmap_alloc (struct pt_regs *ctx) { +struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1_CORE (ctx);char fmt[] ="Failed at stress_lru_hmap_alloc. ret:%dn" ;union {u16 dst6[8 ];
@@ -175,8 +178,8 @@ int stress_lru_hmap_alloc(struct pt_regs *ctx)long val =1 ;u32 key =0 ; - in6 = (struct sockaddr_in6 *)PT_REGS_PARM2 (ctx); - addrlen = (int )PT_REGS_PARM3 (ctx); + in6 = (struct sockaddr_in6 *)PT_REGS_PARM2_CORE (real_regs); + addrlen = (int )PT_REGS_PARM3_CORE (real_regs);if (addrlen !=sizeof (*in6))return 0 ;
samples/bpf/test_map_in_map_kern.c +6 -3
@@ -13,6 +13,8 @@#include <bpf/bpf_helpers.h> #include "bpf_legacy.h" #include <bpf/bpf_tracing.h> +#include <bpf/bpf_core_read.h> +#include "trace_common.h" #define MAX_NR_PORTS 65536
@@ -102,9 +104,10 @@ static __always_inline int do_inline_hash_lookup(void *inner_map, u32 port)return result ? *result : -ENOENT ; } -SEC("kprobe/sys_connect") +SEC("kprobe/" SYSCALL(sys_connect))int trace_sys_connect (struct pt_regs *ctx) { +struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1_CORE (ctx);struct sockaddr_in6 *in6;u16 test_case, port, dst6[8 ];int addrlen, ret, inline_ret, ret_key =0 ;
@@ -112,8 +115,8 @@ int trace_sys_connect(struct pt_regs *ctx)void *outer_map, *inner_map;bool inline_hash = false; - in6 = (struct sockaddr_in6 *)PT_REGS_PARM2 (ctx); - addrlen = (int )PT_REGS_PARM3 (ctx); + in6 = (struct sockaddr_in6 *)PT_REGS_PARM2_CORE (real_regs); + addrlen = (int )PT_REGS_PARM3_CORE (real_regs);if (addrlen !=sizeof (*in6))return 0 ;
samples/bpf/test_probe_write_user_kern.c +6 -3
@@ -10,6 +10,8 @@#include <linux/version.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_tracing.h> +#include <bpf/bpf_core_read.h> +#include "trace_common.h" struct bpf_map_def SEC("maps") dnat_map = { .type = BPF_MAP_TYPE_HASH,
@@ -26,13 +28,14 @@ struct bpf_map_def SEC("maps") dnat_map = {* This example sits on a syscall, and the syscall ABI is relatively stable * of course, across platforms, and over time, the ABI may change. */ -SEC("kprobe/sys_connect") +SEC("kprobe/" SYSCALL(sys_connect))int bpf_prog1 (struct pt_regs *ctx) { +struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1_CORE (ctx); +void *sockaddr_arg = (void *)PT_REGS_PARM2_CORE (real_regs); +int sockaddr_len = (int )PT_REGS_PARM3_CORE (real_regs);struct sockaddr_in new_addr, orig_addr = {};struct sockaddr_in *mapped_addr; -void *sockaddr_arg = (void *)PT_REGS_PARM2 (ctx); -int sockaddr_len = (int )PT_REGS_PARM3 (ctx);if (sockaddr_len >sizeof (orig_addr))return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 218/464 drm/stm: repair runtime power management
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit ebd267b2e3c25d5f93a08528b47c036569eb8744 ]
Add missing pm_runtime_get_sync() into ltdc_crtc_atomic_enable() to match pm_runtime_put_sync() in ltdc_crtc_atomic_disable(), otherwise the LTDC might suspend via runtime PM, disable clock, and then fail to resume later on.
The test which triggers it is roughly -- run qt5 application which uses eglfs platform and etnaviv, stop the application, sleep for 15 minutes, run the application again. This leads to a timeout waiting for vsync, because the LTDC has suspended, but did not resume.
--- drivers/gpu/drm/stm/ltdc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/stm/ltdc.c +3 -0
@@ -423,9 +423,12 @@ static void ltdc_crtc_atomic_enable(struct drm_crtc *crtc, struct drm_crtc_state *old_state) {struct ltdc_device *ldev =crtc_to_ltdc (crtc); +struct drm_device *ddev = crtc->dev;DRM_DEBUG_DRIVER ("\n" ); +pm_runtime_get_sync (ddev->dev); +/* Sets the background color value */ reg_write (ldev->regs,LTDC_BCCR ,BCCR_BCBLACK );
Signature · 8 lines
2.25.1 _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
Greg Kroah-Hartman
maintainerPATCH 219/464 kobject: Avoid premature parent object freeing in kobject_cleanup()
In reply to Greg Kroah-HartmanFrom: Heikki Krogerus <[email protected]>
[ Upstream commit 079ad2fb4bf9eba8a0aaab014b49705cd7f07c66 ]
If kobject_del() is invoked by kobject_cleanup() to delete the target kobject, it may cause its parent kobject to be freed before invoking the target kobject's ->release() method, which effectively means freeing the parent before dealing with the child entirely.
That is confusing at best and it may also lead to functional issues if the callers of kobject_cleanup() are not careful enough about the order in which these calls are made, so avoid the problem by making kobject_cleanup() drop the last reference to the target kobject's parent at the end, after invoking the target kobject's ->release() method.
[ rjw: Rewrite the subject and changelog, make kobject_cleanup()
drop the parent reference only when __kobject_del() has been called. ]
--- lib/kobject.c | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-)
lib/kobject.c +23 -10
@@ -599,14 +599,7 @@ int kobject_move(struct kobject *kobj, struct kobject *new_parent) }EXPORT_SYMBOL_GPL (kobject_move); -/** -* kobject_del() - Unlink kobject from hierarchy. -* @kobj: object. -* -* This is the function that should be called to delete an object -* successfully added via kobject_add(). -*/ -void kobject_del (struct kobject *kobj) +static void __kobject_del (struct kobject *kobj) {struct kernfs_node *sd;const struct kobj_type *ktype;
@@ -632,9 +625,23 @@ void kobject_del(struct kobject *kobj) kobj->state_in_sysfs =0 ;kobj_kset_leave (kobj); -kobject_put (kobj->parent); kobj->parent =NULL ; } + +/** +* kobject_del() - Unlink kobject from hierarchy. +* @kobj: object. +* +* This is the function that should be called to delete an object +* successfully added via kobject_add(). +*/ +void kobject_del (struct kobject *kobj) +{ +struct kobject *parent = kobj->parent; + +__kobject_del (kobj); +kobject_put (parent); +}EXPORT_SYMBOL (kobject_del);/**
@@ -670,6 +677,7 @@ EXPORT_SYMBOL(kobject_get_unless_zero);*/ static void kobject_cleanup (struct kobject *kobj) { +struct kobject *parent = kobj->parent;struct kobj_type *t =get_ktype (kobj);const char *name = kobj->name;
@@ -684,7 +692,10 @@ static void kobject_cleanup(struct kobject *kobj)if (kobj->state_in_sysfs) {pr_debug ("kobject: '%s' (%p): auto cleanup kobject_del\n" ,kobject_name (kobj), kobj); -kobject_del (kobj); +__kobject_del (kobj); + }else { +/* avoid dropping the parent reference unnecessarily */ + parent =NULL ; }if (t && t->release) {
@@ -698,6 +709,8 @@ static void kobject_cleanup(struct kobject *kobj)pr_debug ("kobject: '%s': free name\n" , name);kfree_const (name); } + +kobject_put (parent); }#ifdef CONFIG_DEBUG_KOBJECT_RELEASE
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 220/464 leds: core: Flush scheduled work for system suspend
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit 302a085c20194bfa7df52e0fe684ee0c41da02e6 ]
Sometimes LED won't be turned off by LED_CORE_SUSPENDRESUME flag upon system suspend.
led_set_brightness_nopm() uses schedule_work() to set LED brightness. However, there's no guarantee that the scheduled work gets executed because no one flushes the work.
So flush the scheduled work to make sure LED gets turned off.
--- drivers/leds/led-class.c | 1 + 1 file changed, 1 insertion(+)
drivers/leds/led-class.c +1 -0
@@ -173,6 +173,7 @@ void led_classdev_suspend(struct led_classdev *led_cdev) { led_cdev->flags |=LED_SUSPENDED ;led_set_brightness_nopm (led_cdev,0 ); +flush_work (&led_cdev->set_brightness_work); }EXPORT_SYMBOL_GPL (led_classdev_suspend);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 221/464 drm: panel: simple: Fix bpc for LG LB070WV8 panel
In reply to Greg Kroah-HartmanFrom: Laurent Pinchart <[email protected]>
[ Upstream commit a6ae2fe5c9f9fd355a48fb7d21c863e5b20d6c9c ]
The LG LB070WV8 panel incorrectly reports a 16 bits per component value, while the panel uses 8 bits per component. Fix it.
--- drivers/gpu/drm/panel/panel-simple.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-simple.c +1 -1
@@ -2304,7 +2304,7 @@ static const struct drm_display_mode lg_lb070wv8_mode = {static const struct panel_desc lg_lb070wv8 = { .modes = &lg_lb070wv8_mode, .num_modes =1 , - .bpc =16 , + .bpc =8 , .size = { .width =151 , .height =91 ,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 222/464 phy: cadence: salvo: fix wrong bit definition
In reply to Greg Kroah-HartmanFrom: Peter Chen <[email protected]>
[ Upstream commit 270ff6048f45759d31a7b62d3983b084153837f5 ]
It fixes RX detect wakeup using USB3 device, otherwise, the USB3 device can't wakeup USB PHY when the PHY is in 32Khz clock.
--- drivers/phy/cadence/phy-cadence-salvo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/cadence/phy-cadence-salvo.c +1 -1
@@ -88,7 +88,7 @@#define TB_ADDR_TX_RCVDETSC_CTRL 0x4124/* TB_ADDR_TX_RCVDETSC_CTRL */ -#define RXDET_IN_P3_32KHZ BIT(1) +#define RXDET_IN_P3_32KHZ BIT(0)struct cdns_reg_pairs {u16 val;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 223/464 dt-bindings: phy: uniphier: Fix incorrect clocks and clock-names for PXs3 usb3-hsphy
In reply to Greg Kroah-HartmanFrom: Kunihiko Hayashi <[email protected]>
[ Upstream commit 03815930c162561a5c204494b4160d6ccf631b0b ]
The usb3-hsphy for PXs3 SoC needs to accept 3 clocks like usb3-ssphy.
--- .../bindings/phy/socionext,uniphier-usb3hs-phy.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/phy/socionext,uniphier-usb3hs-phy.yaml +6 -2
@@ -31,12 +31,16 @@ properties: clocks: minItems: 1 - maxItems: 2 + maxItems: 3 clock-names: oneOf: - const: link # for PXs2 - - items: # for PXs3 + - items: # for PXs3 with phy-ext + - const: link + - const: phy + - const: phy-ext + - items: # for others - const: link - const: phy
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 224/464 phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY
In reply to Greg Kroah-HartmanFrom: Marek Szyprowski <[email protected]>
[ Upstream commit dcbabfeb17c3c2fdb6bc92a3031ecd37df1834a8 ]
PHY calibration is needed only for USB2.0 (UTMI) PHY, so skip calling calibration code when phy_calibrate() is called for USB3.0 (PIPE3) PHY.
--- drivers/phy/samsung/phy-exynos5-usbdrd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/phy/samsung/phy-exynos5-usbdrd.c +3 -1
@@ -714,7 +714,9 @@ static int exynos5_usbdrd_phy_calibrate(struct phy *phy)struct phy_usb_instance *inst =phy_get_drvdata (phy);struct exynos5_usbdrd_phy *phy_drd =to_usbdrd_phy (inst); -return exynos5420_usbdrd_phy_calibrate (phy_drd); +if (inst->phy_cfg->id ==EXYNOS5_DRDPHY_UTMI ) +return exynos5420_usbdrd_phy_calibrate (phy_drd); +return 0 ; }static const struct phy_ops exynos5_usbdrd_phy_ops = {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 225/464 mmc: sdhci-of-arasan: Add missed checks for devm_clk_register()
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
[ Upstream commit c99e1d0c91ac8d7db3062ea1af315f21295701d7 ]
These functions do not check the return value of devm_clk_register():
- sdhci_arasan_register_sdcardclk()
- sdhci_arasan_register_sampleclk()
Therefore, add the missed checks to fix them.
--- drivers/mmc/host/sdhci-of-arasan.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/mmc/host/sdhci-of-arasan.c +4 -0
@@ -1299,6 +1299,8 @@ sdhci_arasan_register_sdcardclk(struct sdhci_arasan_data *sdhci_arasan, clk_data->sdcardclk_hw.init = &sdcardclk_init; clk_data->sdcardclk =devm_clk_register (dev, &clk_data->sdcardclk_hw); +if (IS_ERR (clk_data->sdcardclk)) +return PTR_ERR (clk_data->sdcardclk); clk_data->sdcardclk_hw.init =NULL ; ret = of_clk_add_provider(np, of_clk_src_simple_get,
@@ -1349,6 +1351,8 @@ sdhci_arasan_register_sampleclk(struct sdhci_arasan_data *sdhci_arasan, clk_data->sampleclk_hw.init = &sampleclk_init; clk_data->sampleclk =devm_clk_register (dev, &clk_data->sampleclk_hw); +if (IS_ERR (clk_data->sampleclk)) +return PTR_ERR (clk_data->sampleclk); clk_data->sampleclk_hw.init =NULL ; ret = of_clk_add_provider(np, of_clk_src_simple_get,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 226/464 drm/bridge: sil_sii8620: initialize return of sii8620_readb
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
[ Upstream commit 02cd2d3144653e6e2a0c7ccaa73311e48e2dc686 ]
clang static analysis flags this error
sil-sii8620.c:184:2: warning: Undefined or garbage value
returned to caller [core.uninitialized.UndefReturn]
return ret;
^~~~~~~~~~sii8620_readb calls sii8620_read_buf. sii8620_read_buf can return without setting its output pararmeter 'ret'.
So initialize ret.
--- drivers/gpu/drm/bridge/sil-sii8620.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/bridge/sil-sii8620.c +1 -1
@@ -178,7 +178,7 @@ static void sii8620_read_buf(struct sii8620 *ctx, u16 addr, u8 *buf, int len)static u8 sii8620_readb (struct sii8620 *ctx,u16 addr) { -u8 ret; +u8 ret =0 ;sii8620_read_buf (ctx, addr, &ret,1 );return ret;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 227/464 scsi: scsi_debug: Add check for sdebug_max_queue during module init
In reply to Greg Kroah-HartmanFrom: John Garry <[email protected]>
[ Upstream commit c87bf24cfb60bce27b4d2c7e56ebfd86fb9d16bb ]
sdebug_max_queue should not exceed SDEBUG_CANQUEUE, otherwise crashes like this can be triggered by passing an out-of-range value:
Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0 - V1.16.01 03/15/2019 pstate: 20400009 (nzCv daif +PAN -UAO BTYPE=--) pc : schedule_resp+0x2a4/0xa70 [scsi_debug] lr : schedule_resp+0x52c/0xa70 [scsi_debug] sp : ffff800022ab36f0 x29: ffff800022ab36f0 x28: ffff0023a935a610 x27: ffff800008e0a648 x26: 0000000000000003 x25: ffff0023e84f3200 x24: 00000000003d0900 x23: 0000000000000000 x22: 0000000000000000 x21: ffff0023be60a320 x20: ffff0023be60b538 x19: ffff800008e13000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000001 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 00000000000000c1 x5 : 0000020000200000 x4 : dead0000000000ff x3 : 0000000000000200 x2 : 0000000000000200 x1 : ffff800008e13d88 x0 : 0000000000000000 Call trace: schedule_resp+0x2a4/0xa70 [scsi_debug] scsi_debug_queuecommand+0x2c4/0x9e0 [scsi_debug] scsi_queue_rq+0x698/0x840 __blk_mq_try_issue_directly+0x108/0x228 blk_mq_request_issue_directly+0x58/0x98 blk_mq_try_issue_list_directly+0x5c/0xf0 blk_mq_sched_insert_requests+0x18c/0x200 blk_mq_flush_plug_list+0x11c/0x190 blk_flush_plug_list+0xdc/0x110 blk_finish_plug+0x38/0x210 blkdev_direct_IO+0x450/0x4d8 generic_file_read_iter+0x84/0x180 blkdev_read_iter+0x3c/0x50 aio_read+0xc0/0x170 io_submit_one+0x5c8/0xc98 __arm64_sys_io_submit+0x1b0/0x258 el0_svc_common.constprop.3+0x68/0x170 do_el0_svc+0x24/0x90 el0_sync_handler+0x13c/0x1a8 el0_sync+0x158/0x180 Code: 528847e0 72a001e0 6b00003f 540018cd (3941c340)
In addition, it should not be less than 1.
So add checks for these, and fail the module init for those cases.
[mkp: changed if condition to match error message]
--- drivers/scsi/scsi_debug.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/scsi/scsi_debug.c +6 -0
@@ -6610,6 +6610,12 @@ static int __init scsi_debug_init(void)pr_err ("submit_queues must be 1 or more\n" );return -EINVAL ; } + +if ((sdebug_max_queue >SDEBUG_CANQUEUE ) || (sdebug_max_queue <1 )) { +pr_err ("max_queue must be in range [1, %d]\n" ,SDEBUG_CANQUEUE ); +return -EINVAL ; + } + sdebug_q_arr =kcalloc (submit_queues,sizeof (struct sdebug_queue ),GFP_KERNEL );if (sdebug_q_arr ==NULL )
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 228/464 bpfilter: Initialize pos variable
In reply to Greg Kroah-HartmanFrom: Alexei Starovoitov <[email protected]>
[ Upstream commit a4fa458950b40d3849946daa32466392811a3716 ]
Make sure 'pos' is initialized to zero before calling kernel_write().
--- net/bpfilter/bpfilter_kern.c | 1 + 1 file changed, 1 insertion(+)
net/bpfilter/bpfilter_kern.c +1 -0
@@ -50,6 +50,7 @@ static int __bpfilter_process_sockopt(struct sock *sk, int optname, req.len = optlen;if (!bpfilter_ops.info.pid) goto out; + pos =0 ; n =kernel_write (bpfilter_ops.info.pipe_to_umh, &req,sizeof (req), &pos);if (n !=sizeof (req)) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 229/464 mwifiex: Prevent memory corruption handling keys
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit e18696786548244914f36ec3c46ac99c53df99c3 ]
The length of the key comes from the network and it's a 16 bit number. It needs to be capped to prevent a buffer overflow.
--- .../wireless/marvell/mwifiex/sta_cmdresp.c | 22 +++++++++++++------ 1 file changed, 15 insertions(+), 7 deletions(-)
drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c +15 -7
@@ -580,6 +580,11 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv, {struct host_cmd_ds_802_11_key_material *key = &resp->params.key_material; +int len; + + len =le16_to_cpu (key->key_param_set.key_len); +if (len >sizeof (key->key_param_set.key)) +return -EINVAL ;if (le16_to_cpu (key->action) == HostCmd_ACT_GEN_SET) {if ((le16_to_cpu (key->key_param_set.key_info) &KEY_MCAST )) {
@@ -593,9 +598,8 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv,memset (priv->aes_key.key_param_set.key,0 ,sizeof (key->key_param_set.key)); - priv->aes_key.key_param_set.key_len = key->key_param_set.key_len; -memcpy (priv->aes_key.key_param_set.key, key->key_param_set.key, -le16_to_cpu (priv->aes_key.key_param_set.key_len)); + priv->aes_key.key_param_set.key_len =cpu_to_le16 (len); +memcpy (priv->aes_key.key_param_set.key, key->key_param_set.key, len);return 0 ; }
@@ -610,9 +614,14 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, struct host_cmd_ds_command *resp) {struct host_cmd_ds_802_11_key_material_v2 *key_v2; -__le16 len; +int len; key_v2 = &resp->params.key_material_v2; + + len =le16_to_cpu (key_v2->key_param_set.key_params.aes.key_len); +if (len >WLAN_KEY_LEN_CCMP ) +return -EINVAL ; +if (le16_to_cpu (key_v2->action) == HostCmd_ACT_GEN_SET) {if ((le16_to_cpu (key_v2->key_param_set.key_info) &KEY_MCAST )) {mwifiex_dbg (priv->adapter,INFO ,"info: key: GTK is set\n" );
@@ -628,10 +637,9 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,memset (priv->aes_key_v2.key_param_set.key_params.aes.key,0 ,WLAN_KEY_LEN_CCMP ); priv->aes_key_v2.key_param_set.key_params.aes.key_len = - key_v2->key_param_set.key_params.aes.key_len; - len = priv->aes_key_v2.key_param_set.key_params.aes.key_len; +cpu_to_le16 (len);memcpy (priv->aes_key_v2.key_param_set.key_params.aes.key, - key_v2->key_param_set.key_params.aes.key,le16_to_cpu (len)); + key_v2->key_param_set.key_params.aes.key, len);return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 230/464 kernfs: do not call fsnotify() with name without a parent
In reply to Greg Kroah-HartmanFrom: Amir Goldstein <[email protected]>
[ Upstream commit 9991bb84b27a2594187898f261866cfc50255454 ]
When creating an FS_MODIFY event on inode itself (not on parent) the file_name argument should be NULL.
The change to send a non NULL name to inode itself was done on purpuse as part of another commit, as Tejun writes: "...While at it, supply the target file name to fsnotify() from kernfs_node->name.".
But this is wrong practice and inconsistent with inotify behavior when watching a single file. When a child is being watched (as opposed to the parent directory) the inotify event should contain the watch descriptor, but not the file name.
--- fs/kernfs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/kernfs/file.c +1 -1
@@ -912,7 +912,7 @@ static void kernfs_notify_workfn(struct work_struct *work) }fsnotify (inode,FS_MODIFY , inode,FSNOTIFY_EVENT_INODE , - &name,0 ); +NULL ,0 );iput (inode); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 231/464 powerpc/pseries: remove cede offline state for CPUs
In reply to Greg Kroah-HartmanFrom: Nathan Lynch <[email protected]>
[ Upstream commit 48f6e7f6d948b56489da027bc3284c709b939d28 ]
This effectively reverts commit 3aa565f53c39 ("powerpc/pseries: Add hooks to put the CPU into an appropriate offline state"), which added an offline mode for CPUs which uses the H_CEDE hcall instead of the architected stop-self RTAS function in order to facilitate "folding" of dedicated mode processors on PowerVM platforms to achieve energy savings. This has been the default offline mode since its introduction.
There's nothing about stop-self that would prevent the hypervisor from achieving the energy savings available via H_CEDE, so the original premise of this change appears to be flawed.
I also have encountered the claim that the transition to and from ceded state is much faster than stop-self/start-cpu. Certainly we would not want to use stop-self as an *idle* mode. That is what H_CEDE is for. However, this difference is insignificant in the context of Linux CPU hotplug, where the latency of an offline or online operation on current systems is on the order of 100ms, mainly attributable to all the various subsystems' cpuhp callbacks.
The cede offline mode also prevents accurate accounting, as discussed before:
https://lore.kernel.org/linuxppc-dev/[email protected]/
Unconditionally use stop-self to offline processor threads. This is the architected method for offlining CPUs on PAPR systems.
The "cede_offline" boot parameter is rendered obsolete.
Removing this code enables the removal of the partition suspend code which temporarily onlines all present CPUs.
--- Documentation/core-api/cpu_hotplug.rst | 7 - arch/powerpc/platforms/pseries/hotplug-cpu.c | 170 ++---------------- .../platforms/pseries/offline_states.h | 38 ---- arch/powerpc/platforms/pseries/pmem.c | 1 - arch/powerpc/platforms/pseries/smp.c | 28 +-- 5 files changed, 15 insertions(+), 229 deletions(-) delete mode 100644 arch/powerpc/platforms/pseries/offline_states.h
Documentation/core-api/cpu_hotplug.rst +0 -7
@@ -50,13 +50,6 @@ Command Line Switches This option is limited to the X86 and S390 architecture. -``cede_offline={"off","on"}`` - Use this option to disable/enable putting offlined processors to an extended - ``H_CEDE`` state on supported pseries platforms. If nothing is specified, - ``cede_offline`` is set to "on". - - This option is limited to the PowerPC architecture. - ``cpu0_hotplug`` Allow to shutdown CPU0.
arch/powerpc/platforms/pseries/hotplug-cpu.c +14 -156
229 lines not on this page · raw message
arch/powerpc/platforms/pseries/offline_states.h deleted +0 -38
@@ -1,38 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef _OFFLINE_STATES_H_ -#define _OFFLINE_STATES_H_ - -/* Cpu offline states go here */ -enum cpu_state_vals { -CPU_STATE_OFFLINE , -CPU_STATE_INACTIVE , -CPU_STATE_ONLINE , -CPU_MAX_OFFLINE_STATES -}; - -#ifdef CONFIG_HOTPLUG_CPU -extern enum cpu_state_vals get_cpu_current_state (int cpu); -extern void set_cpu_current_state (int cpu,enum cpu_state_vals state); -extern void set_preferred_offline_state (int cpu,enum cpu_state_vals state); -extern void set_default_offline_state (int cpu); -#else -static inline enum cpu_state_vals get_cpu_current_state (int cpu) -{ -return CPU_STATE_ONLINE ; -} - -static inline void set_cpu_current_state (int cpu,enum cpu_state_vals state) -{ -} - -static inline void set_preferred_offline_state (int cpu,enum cpu_state_vals state) -{ -} - -static inline void set_default_offline_state (int cpu) -{ -} -#endif - -extern enum cpu_state_vals get_preferred_offline_state (int cpu); -#endif
arch/powerpc/platforms/pseries/pmem.c +0 -1
@@ -24,7 +24,6 @@#include <asm/topology.h> #include "pseries.h" -#include "offline_states.h" static struct device_node *pmem_node;
arch/powerpc/platforms/pseries/smp.c +1 -27
@@ -44,8 +44,6 @@#include <asm/svm.h> #include "pseries.h" -#include "offline_states.h" -/* * The Primary thread of each non-boot processor was started from the OF client
@@ -108,10 +106,7 @@ static inline int smp_startup_cpu(unsigned int lcpu)/* Fixup atomic count: it exited inside IRQ handler. */ task_thread_info (paca_ptrs[lcpu]->__current)->preempt_count =0 ; -#ifdef CONFIG_HOTPLUG_CPU -if (get_cpu_current_state (lcpu) ==CPU_STATE_INACTIVE ) - goto out; -#endif +/* * If the RTAS start-cpu token does not exist then presume the * cpu is already spinning.
@@ -126,9 +121,6 @@ static inline int smp_startup_cpu(unsigned int lcpu)return 0 ; } -#ifdef CONFIG_HOTPLUG_CPU -out: -#endif return 1 ; }
@@ -143,10 +135,6 @@ static void smp_setup_cpu(int cpu)vpa_init (cpu);cpumask_clear_cpu (cpu, of_spin_mask); -#ifdef CONFIG_HOTPLUG_CPU -set_cpu_current_state (cpu,CPU_STATE_ONLINE ); -set_default_offline_state (cpu); -#endif }static int smp_pSeries_kick_cpu (int nr)
@@ -163,20 +151,6 @@ static int smp_pSeries_kick_cpu(int nr)* the processor will continue on to secondary_start */ paca_ptrs[nr]->cpu_start =1 ; -#ifdef CONFIG_HOTPLUG_CPU -set_preferred_offline_state (nr,CPU_STATE_ONLINE ); - -if (get_cpu_current_state (nr) ==CPU_STATE_INACTIVE ) { -long rc; -unsigned long hcpuid; - - hcpuid =get_hard_smp_processor_id (nr); - rc =plpar_hcall_norets (H_PROD , hcpuid); -if (rc !=H_SUCCESS ) -printk (KERN_ERR "Error: Prod to wake up processor %d " -"Ret= %ld\n" , nr, rc); - } -#endif return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 232/464 powerpc/rtas: dont online CPUs for partition suspend
In reply to Greg Kroah-HartmanFrom: Nathan Lynch <[email protected]>
[ Upstream commit ec2fc2a9e9bbad9023aab65bc472ce7a3ca8608f ]
Partition suspension, used for hibernation and migration, requires that the OS place all but one of the LPAR's processor threads into one of two states prior to calling the ibm,suspend-me RTAS function:
* the architected offline state (via RTAS stop-self); or
* the H_JOIN hcall, which does not return until the partition resumes execution
Using H_CEDE as the offline mode, introduced by
commit 3aa565f53c39 ("powerpc/pseries: Add hooks to put the CPU into an appropriate offline state"), means that any threads which are offline from Linux's point of view must be moved to one of those two states before a partition suspension can proceed.
This was eventually addressed in commit 120496ac2d2d ("powerpc: Bring all threads online prior to migration/hibernation"), which added code to temporarily bring up any offline processor threads so they can call H_JOIN. Conceptually this is fine, but the implementation has had multiple races with cpu hotplug operations initiated from user space[1][2][3], the error handling is fragile, and it generates user-visible cpu hotplug events which is a lot of noise for a platform feature that's supposed to minimize disruption to workloads.
With commit 3aa565f53c39 ("powerpc/pseries: Add hooks to put the CPU into an appropriate offline state") reverted, this code becomes unnecessary, so remove it. Since any offline CPUs now are truly offline from the platform's point of view, it is no longer necessary to bring up CPUs only to have them call H_JOIN and then go offline again upon resuming. Only active threads are required to call H_JOIN; stopped threads can be left alone.
[1] commit a6717c01ddc2 ("powerpc/rtas: use device model APIs and serialization during LPM")
[2] commit 9fb603050ffd ("powerpc/rtas: retry when cpu offline races with suspend/migration")
[3] commit dfd718a2ed1f ("powerpc/rtas: Fix a potential race between CPU-Offline & Migration")
--- arch/powerpc/include/asm/rtas.h | 2 - arch/powerpc/kernel/rtas.c | 122 +---------------------- arch/powerpc/platforms/pseries/suspend.c | 22 +--- 3 files changed, 3 insertions(+), 143 deletions(-)
arch/powerpc/include/asm/rtas.h +0 -2
@@ -253,8 +253,6 @@ extern int rtas_set_indicator_fast(int indicator, int index, int new_value);extern void rtas_progress (char *s,unsigned short hex);extern int rtas_suspend_cpu (struct rtas_suspend_me_data *data);extern int rtas_suspend_last_cpu (struct rtas_suspend_me_data *data); -extern int rtas_online_cpus_mask (cpumask_var_t cpus); -extern int rtas_offline_cpus_mask (cpumask_var_t cpus);extern int rtas_ibm_suspend_me (u64 handle);struct rtc_time ;
arch/powerpc/kernel/rtas.c +2 -120
157 lines not on this page · raw message
arch/powerpc/platforms/pseries/suspend.c +1 -21
@@ -132,15 +132,11 @@ static ssize_t store_hibernate(struct device *dev,struct device_attribute *attr, const char *buf, size_t count) { - cpumask_var_t offline_mask; int rc;if (!capable (CAP_SYS_ADMIN ))return -EPERM ; -if (!alloc_cpumask_var (&offline_mask,GFP_KERNEL )) -return -ENOMEM ; - stream_id =simple_strtoul (buf,NULL ,16 ); do {
@@ -150,32 +146,16 @@ static ssize_t store_hibernate(struct device *dev, }while (rc == -EAGAIN );if (!rc) { -/* All present CPUs must be online */ -cpumask_andnot (offline_mask, cpu_present_mask, - cpu_online_mask); - rc =rtas_online_cpus_mask (offline_mask); -if (rc) { -pr_err ("%s: Could not bring present CPUs online.\n" , - __func__); - goto out; - } -stop_topology_update (); rc =pm_suspend (PM_SUSPEND_MEM );start_topology_update (); - -/* Take down CPUs not online prior to suspend */ -if (!rtas_offline_cpus_mask (offline_mask)) -pr_warn ("%s: Could not restore CPUs to offline " -"state.\n" , __func__); } stream_id =0 ;if (!rc) rc = count; -out: -free_cpumask_var (offline_mask); +return rc; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 233/464 powerpc/vdso: Fix vdso cpu truncation
In reply to Greg Kroah-HartmanFrom: Milton Miller <[email protected]>
[ Upstream commit a9f675f950a07d5c1dbcbb97aabac56f5ed085e3 ]
The code in vdso_cpu_init that exposes the cpu and numa node to userspace via SPRG_VDSO incorrctly masks the cpu to 12 bits. This means that any kernel running on a box with more than 4096 threads (NR_CPUS advertises a limit of of 8192 cpus) would expose userspace to two cpu contexts running at the same time with the same cpu number.
Note: I'm not aware of any distro shipping a kernel with support for more than 4096 threads today, nor of any system image that currently exceeds 4096 threads. Found via code browsing.
--- arch/powerpc/kernel/vdso.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/vdso.c +1 -1
@@ -677,7 +677,7 @@ int vdso_getcpu_init(void) node =cpu_to_node (cpu);WARN_ON_ONCE (node >0xffff ); - val = (cpu &0xfff ) | ((node &0xffff ) <<16 ); + val = (cpu &0xffff ) | ((node &0xffff ) <<16 );mtspr (SPRN_SPRG_VDSO_WRITE , val);get_paca ()->sprg_vdso = val;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 234/464 Bluetooth: Fix update of connection state in `hci_encrypt_cfm`
In reply to Greg Kroah-HartmanFrom: Patrick Steinhardt <[email protected]>
[ Upstream commit 339ddaa626995bc6218972ca241471f3717cc5f4 ]
Starting with the upgrade to v5.8-rc3, I've noticed I wasn't able to connect to my Bluetooth headset properly anymore. While connecting to the device would eventually succeed, bluetoothd seemed to be confused about the current connection state where the state was flapping hence and forth. Bisecting this issue led to commit 3ca44c16b0dc (Bluetooth:
Consolidate encryption handling in hci_encrypt_cfm, 2020-05-19), which refactored hci_encrypt_cfm to also handle updating the connection state.
The commit in question changed the code to call hci_connect_cfm inside hci_encrypt_cfm and to change the connection state. But with the conversion, we now only update the connection state if a status was set already. In fact, the reverse should be true: the status should be updated if no status is yet set. So let's fix the isuse by reversing the condition.
--- include/net/bluetooth/hci_core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/bluetooth/hci_core.h +1 -1
@@ -1387,7 +1387,7 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)__u8 encrypt;if (conn->state ==BT_CONFIG ) { -if (status) +if (!status) conn->state =BT_CONNECTED ;hci_connect_cfm (conn, status);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 235/464 RDMA/qedr: SRQs bug fixes
In reply to Greg Kroah-HartmanFrom: Yuval Basson <[email protected]>
[ Upstream commit acca72e2b031b9fbb4184511072bd246a0abcebc ]
QP's with the same SRQ, working on different CQs and running in parallel on different CPUs could lead to a race when maintaining the SRQ consumer count, and leads to FW running out of SRQs. Update the consumer atomically. Make sure the wqe_prod is updated after the sge_prod due to FW requirements.
--- drivers/infiniband/hw/qedr/qedr.h | 4 ++-- drivers/infiniband/hw/qedr/verbs.c | 22 ++++++++++------------ 2 files changed, 12 insertions(+), 14 deletions(-)
drivers/infiniband/hw/qedr/qedr.h +2 -2
@@ -344,10 +344,10 @@ struct qedr_srq_hwq_info {u32 wqe_prod;u32 sge_prod;u32 wr_prod_cnt; -u32 wr_cons_cnt; +atomic_t wr_cons_cnt;u32 num_elems; -u32 *virt_prod_pair_addr; +struct rdma_srq_producers *virt_prod_pair_addr;dma_addr_t phy_prod_pair_addr; };
drivers/infiniband/hw/qedr/verbs.c +10 -12
@@ -3686,7 +3686,7 @@ static u32 qedr_srq_elem_left(struct qedr_srq_hwq_info *hw_srq)* count and consumer count and subtract it from max * work request supported so that we get elements left. */ - used = hw_srq->wr_prod_cnt - hw_srq->wr_cons_cnt; + used = hw_srq->wr_prod_cnt - (u32 )atomic_read (&hw_srq->wr_cons_cnt);return hw_srq->max_wr - used; }
@@ -3701,7 +3701,6 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr,unsigned long flags;int status =0 ;u32 num_sge; -u32 offset;spin_lock_irqsave (&srq->lock, flags);
@@ -3714,7 +3713,8 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr,if (!qedr_srq_elem_left (hw_srq) || wr->num_sge > srq->hw_srq.max_sges) {DP_ERR (dev,"Can't post WR (%d,%d) || (%d > %d)\n" , - hw_srq->wr_prod_cnt, hw_srq->wr_cons_cnt, + hw_srq->wr_prod_cnt, +atomic_read (&hw_srq->wr_cons_cnt), wr->num_sge, srq->hw_srq.max_sges); status = -ENOMEM ; *bad_wr = wr;
@@ -3748,22 +3748,20 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, hw_srq->sge_prod++; } -/* Flush WQE and SGE information before +/* Update WQE and SGE information before * updating producer. */ -wmb (); +dma_wmb ();/* SRQ producer is 8 bytes. Need to update SGE producer index * in first 4 bytes and need to update WQE producer in * next 4 bytes. */ - *srq->hw_srq.virt_prod_pair_addr = hw_srq->sge_prod; - offset = offsetof(struct rdma_srq_producers , wqe_prod); - *((u8 *)srq->hw_srq.virt_prod_pair_addr + offset) = - hw_srq->wqe_prod; + srq->hw_srq.virt_prod_pair_addr->sge_prod = hw_srq->sge_prod; +/* Make sure sge producer is updated first */ +dma_wmb (); + srq->hw_srq.virt_prod_pair_addr->wqe_prod = hw_srq->wqe_prod; -/* Flush producer after updating it. */ -wmb (); wr = wr->next; }
@@ -4182,7 +4180,7 @@ static int process_resp_one_srq(struct qedr_dev *dev, struct qedr_qp *qp, }else {__process_resp_one (dev, qp, cq, wc, resp, wr_id); } - srq->hw_srq.wr_cons_cnt++; +atomic_inc (&srq->hw_srq.wr_cons_cnt);return 1 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 236/464 RDMA/qedr: Add EDPM mode type for user-fw compatibility
In reply to Greg Kroah-HartmanFrom: Michal Kalderon <[email protected]>
[ Upstream commit bbe4f4245271bd0f21bf826996c0c5d87a3529c9 ]
In older FW versions the completion flag was treated as the ack flag in edpm messages. commit ff937b916eb6 ("qed: Add EDPM mode type for user-fw compatibility") exposed the FW option of setting which mode the QP is in by adding a flag to the qedr <-> qed API.
This patch adds the qedr <-> libqedr interface so that the libqedr can set the flag appropriately and qedr can pass it down to FW. Flag is added for backward compatibility with libqedr.
For older libs, this flag didn't exist and therefore set to zero.
--- drivers/infiniband/hw/qedr/qedr.h | 1 + drivers/infiniband/hw/qedr/verbs.c | 11 ++++++++--- include/uapi/rdma/qedr-abi.h | 4 ++-- 3 files changed, 11 insertions(+), 5 deletions(-)
drivers/infiniband/hw/qedr/qedr.h +1 -0
@@ -235,6 +235,7 @@ struct qedr_ucontext {u32 dpi_size;u16 dpi;bool db_rec; +u8 edpm_mode; };union db_prod32 {
drivers/infiniband/hw/qedr/verbs.c +8 -3
@@ -275,7 +275,8 @@ int qedr_alloc_ucontext(struct ib_ucontext *uctx, struct ib_udata *udata)DP_ERR (dev,"Problem copying data from user space\n" );return -EFAULT ; } - + ctx->edpm_mode = !!(ureq.context_flags & +QEDR_ALLOC_UCTX_EDPM_MODE ); ctx->db_rec = !!(ureq.context_flags &QEDR_ALLOC_UCTX_DB_REC ); }
@@ -316,7 +317,8 @@ int qedr_alloc_ucontext(struct ib_ucontext *uctx, struct ib_udata *udata) uresp.dpm_flags =QEDR_DPM_TYPE_IWARP_LEGACY ; else uresp.dpm_flags = QEDR_DPM_TYPE_ROCE_ENHANCED | -QEDR_DPM_TYPE_ROCE_LEGACY ; +QEDR_DPM_TYPE_ROCE_LEGACY | +QEDR_DPM_TYPE_ROCE_EDPM_MODE ; uresp.dpm_flags |=QEDR_DPM_SIZES_SET ; uresp.ldpm_limit_size =QEDR_LDPM_MAX_SIZE ;
@@ -1750,7 +1752,7 @@ static int qedr_create_user_qp(struct qedr_dev *dev,struct qed_rdma_create_qp_out_params out_params;struct qedr_pd *pd =get_qedr_pd (ibpd);struct qedr_create_qp_uresp uresp; -struct qedr_ucontext *ctx =NULL ; +struct qedr_ucontext *ctx = pd ? pd->uctx :NULL ;struct qedr_create_qp_ureq ureq;int alloc_and_init =rdma_protocol_roce (&dev->ibdev,1 );int rc = -EINVAL ;
@@ -1788,6 +1790,9 @@ static int qedr_create_user_qp(struct qedr_dev *dev, in_params.rq_pbl_ptr = qp->urq.pbl_tbl->pa; } +if (ctx) +SET_FIELD (in_params.flags,QED_ROCE_EDPM_MODE , ctx->edpm_mode); + qp->qed_qp = dev->ops->rdma_create_qp (dev->rdma_ctx, &in_params, &out_params);
include/uapi/rdma/qedr-abi.h +2 -2
@@ -39,7 +39,7 @@/* user kernel communication data structures. */ enum qedr_alloc_ucontext_flags { -QEDR_ALLOC_UCTX_RESERVED =1 <<0 , +QEDR_ALLOC_UCTX_EDPM_MODE =1 <<0 ,QEDR_ALLOC_UCTX_DB_REC =1 <<1 };
@@ -56,7 +56,7 @@ enum qedr_rdma_dpm_type {QEDR_DPM_TYPE_ROCE_ENHANCED =1 <<0 ,QEDR_DPM_TYPE_ROCE_LEGACY =1 <<1 ,QEDR_DPM_TYPE_IWARP_LEGACY =1 <<2 , -QEDR_DPM_TYPE_RESERVED =1 <<3 , +QEDR_DPM_TYPE_ROCE_EDPM_MODE =1 <<3 , QEDR_DPM_SIZES_SET = 1 << 4, };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 237/464 RDMA/qedr: Add EDPM max size to alloc ucontext response
In reply to Greg Kroah-HartmanFrom: Michal Kalderon <[email protected]>
[ Upstream commit eb7f84e379daad69b4c92538baeaf93bbf493c14 ]
User space should receive the maximum edpm size from kernel driver, similar to other edpm/ldpm related limits. Add an additional parameter to the alloc_ucontext_resp structure for the edpm maximum size.
In addition, pass an indication from user-space to kernel (and not just kernel to user) that the DPM sizes are supported.
This is for supporting backward-forward compatibility between driver and lib for everything related to DPM transaction and limit sizes.
This should have been part of commit mentioned in Fixes tag.
--- drivers/infiniband/hw/qedr/verbs.c | 9 ++++++--- include/uapi/rdma/qedr-abi.h | 6 +++++- 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/infiniband/hw/qedr/verbs.c +6 -3
@@ -320,9 +320,12 @@ int qedr_alloc_ucontext(struct ib_ucontext *uctx, struct ib_udata *udata)QEDR_DPM_TYPE_ROCE_LEGACY |QEDR_DPM_TYPE_ROCE_EDPM_MODE ; - uresp.dpm_flags |=QEDR_DPM_SIZES_SET ; - uresp.ldpm_limit_size =QEDR_LDPM_MAX_SIZE ; - uresp.edpm_trans_size =QEDR_EDPM_TRANS_SIZE ; +if (ureq.context_flags &QEDR_SUPPORT_DPM_SIZES ) { + uresp.dpm_flags |=QEDR_DPM_SIZES_SET ; + uresp.ldpm_limit_size =QEDR_LDPM_MAX_SIZE ; + uresp.edpm_trans_size =QEDR_EDPM_TRANS_SIZE ; + uresp.edpm_limit_size =QEDR_EDPM_MAX_SIZE ; + } uresp.wids_enabled =1 ; uresp.wid_count = oparams.wid_count;
include/uapi/rdma/qedr-abi.h +5 -1
@@ -40,7 +40,8 @@/* user kernel communication data structures. */ enum qedr_alloc_ucontext_flags {QEDR_ALLOC_UCTX_EDPM_MODE =1 <<0 , -QEDR_ALLOC_UCTX_DB_REC =1 <<1 +QEDR_ALLOC_UCTX_DB_REC =1 <<1 , +QEDR_SUPPORT_DPM_SIZES =1 <<2 , };struct qedr_alloc_ucontext_req {
@@ -50,6 +51,7 @@ struct qedr_alloc_ucontext_req {#define QEDR_LDPM_MAX_SIZE (8192)#define QEDR_EDPM_TRANS_SIZE (64) +#define QEDR_EDPM_MAX_SIZE (ROCE_REQ_MAX_INLINE_DATA_SIZE)enum qedr_rdma_dpm_type {QEDR_DPM_TYPE_NONE =0 ,
@@ -77,6 +79,8 @@ struct qedr_alloc_ucontext_resp {__u16 ldpm_limit_size;__u8 edpm_trans_size;__u8 reserved; +__u16 edpm_limit_size; +__u8 padding[6 ]; };struct qedr_alloc_pd_ureq {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 238/464 RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue
In reply to Greg Kroah-HartmanFrom: Mikhail Malygin <[email protected]>
[ Upstream commit 5f0b2a6093a4d9aab093964c65083fe801ef1e58 ]
rxe_post_send_kernel() iterates over linked list of wr's, until the wr->next ptr is NULL. However if we've got an interrupt after last wr is posted, control may be returned to the code after send completion callback is executed and wr memory is freed.
As a result, wr->next pointer may contain incorrect value leading to panic. Store the wr->next on the stack before posting it.
--- drivers/infiniband/sw/rxe/rxe_verbs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/infiniband/sw/rxe/rxe_verbs.c +4 -1
@@ -684,6 +684,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr,unsigned int mask;unsigned int length =0 ;int i; +struct ib_send_wr *next;while (wr) { mask =wr_opcode_mask (wr->opcode, qp);
@@ -700,6 +701,8 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr,break ; } + next = wr->next; + length =0 ;for (i =0 ; i < wr->num_sge; i++) length += wr->sg_list[i].length;
@@ -710,7 +713,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, *bad_wr = wr;break ; } - wr = wr->next; + wr = next; }rxe_run_task (&qp->req.task,1 );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 239/464 ima: Have the LSM free its audit rule
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
[ Upstream commit 9ff8a616dfab96a4fa0ddd36190907dc68886d9b ]
Ask the LSM to free its audit rule rather than directly calling kfree(). Both AppArmor and SELinux do additional work in their audit_rule_free() hooks. Fix memory leaks by allowing the LSMs to perform necessary work.
--- security/integrity/ima/ima.h | 5 +++++ security/integrity/ima/ima_policy.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)
security/integrity/ima/ima.h +5 -0
@@ -404,6 +404,7 @@ static inline void ima_free_modsig(struct modsig *modsig)#ifdef CONFIG_IMA_LSM_RULES #define security_filter_rule_init security_audit_rule_init +#define security_filter_rule_free security_audit_rule_free#define security_filter_rule_match security_audit_rule_match#else
@@ -414,6 +415,10 @@ static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr,return -EINVAL ; } +static inline void security_filter_rule_free (void *lsmrule) +{ +} +static inline int security_filter_rule_match (u32 secid,u32 field,u32 op,void *lsmrule) {
security/integrity/ima/ima_policy.c +1 -1
@@ -258,7 +258,7 @@ static void ima_lsm_free_rule(struct ima_rule_entry *entry)int i;for (i =0 ; i <MAX_LSM_RULES ; i++) { -kfree (entry->lsm[i].rule); +security_filter_rule_free (entry->lsm[i].rule);kfree (entry->lsm[i].args_p); }kfree (entry);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 240/464 ima: Free the entire rule when deleting a list of rules
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
[ Upstream commit 465aee77aae857b5fcde56ee192b33dc369fba04 ]
Create a function, ima_free_rule(), to free all memory associated with an ima_rule_entry. Use the new function to fix memory leaks of allocated ima_rule_entry members, such as .fsname and .keyrings, when deleting a list of rules.
Make the existing ima_lsm_free_rule() function specific to the LSM audit rule array of an ima_rule_entry and require that callers make an additional call to kfree to free the ima_rule_entry itself.
This fixes a memory leak seen when loading by a valid rule that contains an additional piece of allocated memory, such as an fsname, followed by an invalid rule that triggers a policy load failure:
# echo -e "dont_measure fsname=securityfs\nbad syntax" > \
/sys/kernel/security/ima/policy
-bash: echo: write error: Invalid argument
# echo scan > /sys/kernel/debug/kmemleak
# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff9bab67ca12c0 (size 16):
comm "bash", pid 684, jiffies 4295212803 (age 252.344s)
hex dump (first 16 bytes):
73 65 63 75 72 69 74 79 66 73 00 6b 6b 6b 6b a5 securityfs.kkkk.
backtrace:
[<00000000adc80b1b>] kstrdup+0x2e/0x60
[<00000000d504cb0d>] ima_parse_add_rule+0x7d4/0x1020
[<00000000444825ac>] ima_write_policy+0xab/0x1d0
[<000000002b7f0d6c>] vfs_write+0xde/0x1d0
[<0000000096feedcf>] ksys_write+0x68/0xe0
[<0000000052b544a2>] do_syscall_64+0x56/0xa0
[<000000007ead1ba7>] entry_SYSCALL_64_after_hwframe+0x44/0xa9--- security/integrity/ima/ima_policy.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-)
security/integrity/ima/ima_policy.c +24 -5
@@ -261,6 +261,21 @@ static void ima_lsm_free_rule(struct ima_rule_entry *entry)security_filter_rule_free (entry->lsm[i].rule);kfree (entry->lsm[i].args_p); } +} + +static void ima_free_rule (struct ima_rule_entry *entry) +{ +if (!entry) +return ; + +/* +* entry->template->fields may be allocated in ima_parse_rule() but that +* reference is owned by the corresponding ima_template_desc element in +* the defined_templates list and cannot be freed here +*/ +kfree (entry->fsname); +kfree (entry->keyrings); +ima_lsm_free_rule (entry);kfree (entry); }
@@ -302,6 +317,7 @@ static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry) out_err:ima_lsm_free_rule (nentry); +kfree (nentry);return NULL ; }
@@ -315,7 +331,14 @@ static int ima_lsm_update_rule(struct ima_rule_entry *entry)list_replace_rcu (&entry->list, &nentry->list);synchronize_rcu (); +/* +* ima_lsm_copy_rule() shallow copied all references, except for the +* LSM references, from entry to nentry so we only want to free the LSM +* references and the entry itself. All other memory refrences will now +* be owned by nentry. +*/ ima_lsm_free_rule (entry); +kfree (entry);return 0 ; }
@@ -1402,15 +1425,11 @@ ssize_t ima_parse_add_rule(char *rule)void ima_delete_rules (void ) {struct ima_rule_entry *entry, *tmp; -int i; temp_ima_appraise =0 ;list_for_each_entry_safe (entry, tmp, &ima_temp_rules, list) { -for (i =0 ; i <MAX_LSM_RULES ; i++) -kfree (entry->lsm[i].args_p); -list_del (&entry->list); -kfree (entry); +ima_free_rule (entry); } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 241/464 ima: Free the entire rule if it fails to parse
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
[ Upstream commit 2bdd737c5687d6dec30e205953146ede8a87dbdd ]
Use ima_free_rule() to fix memory leaks of allocated ima_rule_entry members, such as .fsname and .keyrings, when an error is encountered during rule parsing.
Set the args_p pointer to NULL after freeing it in the error path of ima_lsm_rule_init() so that it isn't freed twice.
This fixes a memory leak seen when loading an rule that contains an additional piece of allocated memory, such as an fsname, followed by an invalid conditional:
# echo "measure fsname=tmpfs bad=cond" > /sys/kernel/security/ima/policy
-bash: echo: write error: Invalid argument
# echo scan > /sys/kernel/debug/kmemleak
# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff98e7e4ece6c0 (size 8):
comm "bash", pid 672, jiffies 4294791843 (age 21.855s)
hex dump (first 8 bytes):
74 6d 70 66 73 00 6b a5 tmpfs.k.
backtrace:
[<00000000abab7413>] kstrdup+0x2e/0x60
[<00000000f11ede32>] ima_parse_add_rule+0x7d4/0x1020
[<00000000f883dd7a>] ima_write_policy+0xab/0x1d0
[<00000000b17cf753>] vfs_write+0xde/0x1d0
[<00000000b8ddfdea>] ksys_write+0x68/0xe0
[<00000000b8e21e87>] do_syscall_64+0x56/0xa0
[<0000000089ea7b98>] entry_SYSCALL_64_after_hwframe+0x44/0xa9--- security/integrity/ima/ima_policy.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
security/integrity/ima/ima_policy.c +2 -1
@@ -913,6 +913,7 @@ static int ima_lsm_rule_init(struct ima_rule_entry *entry,if (ima_rules == &ima_default_rules) {kfree (entry->lsm[lsm_rule].args_p); + entry->lsm[lsm_rule].args_p =NULL ; result = -EINVAL ; }else result =0 ;
@@ -1404,7 +1405,7 @@ ssize_t ima_parse_add_rule(char *rule) result =ima_parse_rule (p, entry);if (result) { -kfree (entry); +ima_free_rule (entry);integrity_audit_msg (AUDIT_INTEGRITY_STATUS ,NULL ,NULL , op,"invalid-policy" , result, audit_info);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 242/464 ima: Fail rule parsing when buffer hook functions have an invalid action
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
[ Upstream commit 712183437ebebc89cd086ef96cf9a521fd97fd09 ]
Buffer based hook functions, such as KEXEC_CMDLINE and KEY_CHECK, can only measure. The process_buffer_measurement() function quietly ignores all actions except measure so make this behavior clear at the time of policy load.
The parsing of the keyrings conditional had a check to ensure that it was only specified with measure actions but the check should be on the hook function and not the keyrings conditional since "appraise func=KEY_CHECK" is not a valid rule.
--- security/integrity/ima/ima_policy.c | 40 +++++++++++++++++++++++++++-- 1 file changed, 38 insertions(+), 2 deletions(-)
security/integrity/ima/ima_policy.c +38 -2
@@ -973,6 +973,43 @@ static void check_template_modsig(const struct ima_template_desc *template)#undef MSG } +static bool ima_validate_rule (struct ima_rule_entry *entry) +{ +/* Ensure that the action is set */ +if (entry->action ==UNKNOWN ) +return false; + +/* +* Ensure that the hook function is compatible with the other +* components of the rule +*/ +switch (entry->func) { +case NONE : +case FILE_CHECK : +case MMAP_CHECK : +case BPRM_CHECK : +case CREDS_CHECK : +case POST_SETATTR : +case MODULE_CHECK : +case FIRMWARE_CHECK : +case KEXEC_KERNEL_CHECK : +case KEXEC_INITRAMFS_CHECK : +case POLICY_CHECK : +/* Validation of these hook functions is in ima_parse_rule() */ +break ; +case KEXEC_CMDLINE : +case KEY_CHECK : +if (entry->action & ~(MEASURE |DONT_MEASURE )) +return false; + +break ; +default : +return false; + } + +return true; +} +static int ima_parse_rule (char *rule,struct ima_rule_entry *entry) {struct audit_buffer *ab;
@@ -1150,7 +1187,6 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) keyrings_len =strlen (args[0 ].from) +1 ;if ((entry->keyrings) || - (entry->action !=MEASURE ) || (entry->func !=KEY_CHECK ) || (keyrings_len <2 )) { result = -EINVAL ;
@@ -1356,7 +1392,7 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)break ; } } -if (!result && (entry->action ==UNKNOWN )) +if (!result && !ima_validate_rule (entry)) result = -EINVAL ;else if (entry->action ==APPRAISE ) temp_ima_appraise |=ima_appraise_flag (entry->func);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 243/464 ima: Fail rule parsing when the KEXEC_CMDLINE hook is combined with an invalid cond
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
[ Upstream commit db2045f5892a9db7354442bf77f9b03b50ff9ee1 ]
The KEXEC_CMDLINE hook function only supports the pcr conditional. Make this clear at policy load so that IMA policy authors don't assume that other conditionals are supported.
Since KEXEC_CMDLINE's inception, ima_match_rules() has always returned true on any loaded KEXEC_CMDLINE rule without any consideration for other conditionals present in the rule. Make it clear that pcr is the only supported KEXEC_CMDLINE conditional by returning an error during policy load.
An example of why this is a problem can be explained with the following rule:
dont_measure func=KEXEC_CMDLINE obj_type=foo_t
An IMA policy author would have assumed that rule is valid because the parser accepted it but the result was that measurements for all KEXEC_CMDLINE operations would be disabled.
--- security/integrity/ima/ima_policy.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
security/integrity/ima/ima_policy.c +21 -0
@@ -343,6 +343,17 @@ static int ima_lsm_update_rule(struct ima_rule_entry *entry)return 0 ; } +static bool ima_rule_contains_lsm_cond (struct ima_rule_entry *entry) +{ +int i; + +for (i =0 ; i <MAX_LSM_RULES ; i++) +if (entry->lsm[i].args_p) +return true; + +return false; +} +/* * The LSM policy can be reloaded, leaving the IMA LSM based rules referring * to the old, stale LSM policy. Update the IMA LSM based rules to reflect
@@ -998,6 +1009,16 @@ static bool ima_validate_rule(struct ima_rule_entry *entry)/* Validation of these hook functions is in ima_parse_rule() */ break ;case KEXEC_CMDLINE : +if (entry->action & ~(MEASURE |DONT_MEASURE )) +return false; + +if (entry->flags & ~(IMA_FUNC |IMA_PCR )) +return false; + +if (ima_rule_contains_lsm_cond (entry)) +return false; + +break ;case KEY_CHECK :if (entry->action & ~(MEASURE |DONT_MEASURE ))return false;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 244/464 ima: Fail rule parsing when the KEY_CHECK hook is combined with an invalid cond
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
[ Upstream commit eb624fe214a2e156ddafd9868377cf91499f789d ]
The KEY_CHECK function only supports the uid, pcr, and keyrings conditionals. Make this clear at policy load so that IMA policy authors don't assume that other conditionals are supported.
--- security/integrity/ima/ima_policy.c | 7 +++++++ 1 file changed, 7 insertions(+)
security/integrity/ima/ima_policy.c +7 -0
@@ -1023,6 +1023,13 @@ static bool ima_validate_rule(struct ima_rule_entry *entry)if (entry->action & ~(MEASURE |DONT_MEASURE ))return false; +if (entry->flags & ~(IMA_FUNC |IMA_UID |IMA_PCR | +IMA_KEYRINGS )) +return false; + +if (ima_rule_contains_lsm_cond (entry)) +return false; +break ;default :return false;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 245/464 staging: rtl8192u: fix a dubious looking mask before a shift
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit c4283950a9a4d3bf4a3f362e406c80ab14f10714 ]
Currently the masking of ret with 0xff and followed by a right shift of 8 bits always leaves a zero result. It appears the mask of 0xff is incorrect and should be 0xff00, but I don't have the hardware to test this. Fix this to mask the upper 8 bits before shifting.
[ Not tested ]
Addresses-Coverity: ("Operands don't affect result")
--- drivers/staging/rtl8192u/r8192U_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/rtl8192u/r8192U_core.c +1 -1
@@ -2374,7 +2374,7 @@ static int rtl8192_read_eeprom_info(struct net_device *dev) ret =eprom_read (dev, (EEPROM_TX_PW_INDEX_CCK >>1 ));if (ret <0 )return ret; - priv->EEPROMTxPowerLevelCCK = ((u16 )ret &0xff ) >>8 ; + priv->EEPROMTxPowerLevelCCK = ((u16 )ret &0xff00 ) >>8 ; }else priv->EEPROMTxPowerLevelCCK =0x10 ;RT_TRACE (COMP_EPROM ,"CCK Tx Power Levl: 0x%02x\n" , priv->EEPROMTxPowerLevelCCK);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 246/464 ASoC: meson: fixes the missed kfree() for axg_card_add_tdm_loopback
In reply to Greg Kroah-HartmanFrom: Jing Xiangfeng <[email protected]>
[ Upstream commit bd054ece7d9cdd88e900df6625e951a01d9f655e ]
axg_card_add_tdm_loopback() misses to call kfree() in an error path. We can use devm_kasprintf() to fix the issue, also improve maintainability. So use it instead.
--- sound/soc/meson/axg-card.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/meson/axg-card.c +1 -1
@@ -116,7 +116,7 @@ static int axg_card_add_tdm_loopback(struct snd_soc_card *card, lb = &card->dai_link[*index +1 ]; - lb->name =kasprintf (GFP_KERNEL ,"%s-lb" , pad->name); + lb->name =devm_kasprintf (card->dev,GFP_KERNEL ,"%s-lb" , pad->name);if (!lb->name)return -ENOMEM ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 247/464 PCI/ASPM: Add missing newline in sysfs policy
In reply to Greg Kroah-HartmanFrom: Xiongfeng Wang <[email protected]>
[ Upstream commit 3167e3d340c092fd47924bc4d23117a3074ef9a9 ]
When I cat ASPM parameter 'policy' by sysfs, it displays as follows. Add a newline for easy reading. Other sysfs attributes already include a newline.
[root@localhost ~]# cat /sys/module/pcie_aspm/parameters/policy [default] performance powersave powersupersave [root@localhost ~]#
--- drivers/pci/pcie/aspm.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/pcie/aspm.c +1 -0
@@ -1182,6 +1182,7 @@ static int pcie_aspm_get_policy(char *buffer, const struct kernel_param *kp) cnt +=sprintf (buffer + cnt,"[%s] " , policy_str[i]); else cnt += sprintf(buffer + cnt, "%s ", policy_str[i]); + cnt +=sprintf (buffer + cnt,"\n" );return cnt; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 248/464 go7007: add sanity checking for endpoints
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
[ Upstream commit 137641287eb40260783a4413847a0aef06023a6c ]
A malicious USB device may lack endpoints the driver assumes to exist Accessing them leads to NULL pointer accesses. This patch introduces sanity checking.
--- drivers/media/usb/go7007/go7007-usb.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/media/usb/go7007/go7007-usb.c +10 -1
@@ -1132,6 +1132,10 @@ static int go7007_usb_probe(struct usb_interface *intf, go->hpi_ops = &go7007_usb_onboard_hpi_ops; go->hpi_context = usb; + ep = usb->usbdev->ep_in[4 ]; +if (!ep) +return -ENODEV ; +/* Allocate the URB and buffer for receiving incoming interrupts */ usb->intr_urb =usb_alloc_urb (0 ,GFP_KERNEL );if (usb->intr_urb ==NULL )
@@ -1141,7 +1145,6 @@ static int go7007_usb_probe(struct usb_interface *intf,if (usb->intr_urb->transfer_buffer ==NULL ) goto allocfail; - ep = usb->usbdev->ep_in[4 ];if (usb_endpoint_type (&ep->desc) ==USB_ENDPOINT_XFER_BULK ) usb_fill_bulk_urb(usb->intr_urb, usb->usbdev, usb_rcvbulkpipe(usb->usbdev, 4),
@@ -1263,9 +1266,13 @@ static int go7007_usb_probe(struct usb_interface *intf,/* Allocate the URBs and buffers for receiving the video stream */ if (board->flags &GO7007_USB_EZUSB ) { +if (!usb->usbdev->ep_in[6 ]) + goto allocfail; v_urb_len =1024 ; video_pipe =usb_rcvbulkpipe (usb->usbdev,6 ); }else { +if (!usb->usbdev->ep_in[1 ]) + goto allocfail; v_urb_len =512 ; video_pipe =usb_rcvbulkpipe (usb->usbdev,1 ); }
@@ -1285,6 +1292,8 @@ static int go7007_usb_probe(struct usb_interface *intf,/* Allocate the URBs and buffers for receiving the audio stream */ if ((board->flags &GO7007_USB_EZUSB ) && (board->main_info.flags &GO7007_BOARD_HAS_AUDIO )) { +if (!usb->usbdev->ep_in[8 ]) + goto allocfail;for (i =0 ; i <8 ; ++i) { usb->audio_urbs[i] =usb_alloc_urb (0 ,GFP_KERNEL );if (usb->audio_urbs[i] ==NULL )
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 249/464 media: s5p-g2d: Fix a memory leak in an error handling path in g2d_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 94b9ce6870f9c90ac92505482689818b254312f7 ]
Memory allocated with 'v4l2_m2m_init()' must be freed by a corresponding call to 'v4l2_m2m_release()'
Also reorder the code at the end of the probe function so that 'video_register_device()' is called last.
Update the error handling path accordingly.
--- drivers/media/platform/s5p-g2d/g2d.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-)
drivers/media/platform/s5p-g2d/g2d.c +15 -13
@@ -695,21 +695,13 @@ static int g2d_probe(struct platform_device *pdev) vfd->lock = &dev->mutex; vfd->v4l2_dev = &dev->v4l2_dev; vfd->device_caps =V4L2_CAP_VIDEO_M2M |V4L2_CAP_STREAMING ; - ret =video_register_device (vfd,VFL_TYPE_VIDEO ,0 ); -if (ret) { -v4l2_err (&dev->v4l2_dev,"Failed to register video device\n" ); - goto rel_vdev; - } -video_set_drvdata (vfd, dev); - dev->vfd = vfd; -v4l2_info (&dev->v4l2_dev,"device registered as /dev/video%d\n" , - vfd->num); +platform_set_drvdata (pdev, dev); dev->m2m_dev =v4l2_m2m_init (&g2d_m2m_ops);if (IS_ERR (dev->m2m_dev)) {v4l2_err (&dev->v4l2_dev,"Failed to init mem2mem device\n" ); ret =PTR_ERR (dev->m2m_dev); - goto unreg_video_dev; + goto rel_vdev; } def_frame.stride = (def_frame.width * def_frame.fmt->depth) >>3 ;
@@ -717,14 +709,24 @@ static int g2d_probe(struct platform_device *pdev) of_id =of_match_node (exynos_g2d_match, pdev->dev.of_node);if (!of_id) { ret = -ENODEV ; - goto unreg_video_dev; + goto free_m2m; } dev->variant = (struct g2d_variant *)of_id->data; + ret =video_register_device (vfd,VFL_TYPE_VIDEO ,0 ); +if (ret) { +v4l2_err (&dev->v4l2_dev,"Failed to register video device\n" ); + goto free_m2m; + } +video_set_drvdata (vfd, dev); + dev->vfd = vfd; +v4l2_info (&dev->v4l2_dev,"device registered as /dev/video%d\n" , + vfd->num); +return 0 ; -unreg_video_dev: -video_unregister_device (dev->vfd); +free_m2m: +v4l2_m2m_release (dev->m2m_dev); rel_vdev:video_device_release (vfd); unreg_v4l2_dev:
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 250/464 phy: renesas: rcar-gen3-usb2: move irq registration to init
In reply to Greg Kroah-HartmanFrom: Yoshihiro Shimoda <[email protected]>
[ Upstream commit 08b0ad375ca66181faee725b1b358bcae8d592ee ]
If CONFIG_DEBUG_SHIRQ was enabled, r8a77951-salvator-xs could boot correctly. If we appended "earlycon keep_bootcon" to the kernel command like, we could get kernel log like below.
SError Interrupt on CPU0, code 0xbf000002 -- SError
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.8.0-rc3-salvator-x-00505-g6c843129e6faaf01 #785
Hardware name: Renesas Salvator-X 2nd version board based on r8a77951 (DT)
pstate: 60400085 (nZCv daIf +PAN -UAO BTYPE=--)
pc : rcar_gen3_phy_usb2_irq+0x14/0x54
lr : free_irq+0xf4/0x27cThis means free_irq() calls the interrupt handler while PM runtime is not getting if DEBUG_SHIRQ is enabled and rcar_gen3_phy_usb2_probe() failed. To fix the issue, move the irq registration place to rcar_gen3_phy_usb2_init() which is ready to handle the interrupts.
Note that after the commit 549b6b55b005 ("phy: renesas: rcar-gen3-usb2:
enable/disable independent irqs") which is merged into v5.2, since this driver creates multiple phy instances, needs to check whether one of phy instances is initialized. However, if we backport this patch to v5.1 or less, we don't need to check it because such kernel have single phy instance.
--- drivers/phy/renesas/phy-rcar-gen3-usb2.c | 61 +++++++++++++----------- 1 file changed, 33 insertions(+), 28 deletions(-)
drivers/phy/renesas/phy-rcar-gen3-usb2.c +33 -28
@@ -111,6 +111,7 @@ struct rcar_gen3_chan {struct work_struct work;struct mutex lock;/* protects rphys[...].powered */ enum usb_dr_mode dr_mode; +int irq;bool extcon_host;bool is_otg_channel;bool uses_otg_pins;
@@ -389,12 +390,38 @@ static void rcar_gen3_init_otg(struct rcar_gen3_chan *ch)rcar_gen3_device_recognition (ch); } +static irqreturn_t rcar_gen3_phy_usb2_irq (int irq,void *_ch) +{ +struct rcar_gen3_chan *ch = _ch; +void __iomem *usb2_base = ch->base; +u32 status =readl (usb2_base +USB2_OBINTSTA ); +irqreturn_t ret =IRQ_NONE ; + +if (status &USB2_OBINT_BITS ) { +dev_vdbg (ch->dev,"%s: %08x\n" , __func__, status); +writel (USB2_OBINT_BITS , usb2_base +USB2_OBINTSTA ); +rcar_gen3_device_recognition (ch); + ret =IRQ_HANDLED ; + } + +return ret; +} +static int rcar_gen3_phy_usb2_init (struct phy *p) {struct rcar_gen3_phy *rphy =phy_get_drvdata (p);struct rcar_gen3_chan *channel = rphy->ch;void __iomem *usb2_base = channel->base;u32 val; +int ret; + +if (!rcar_gen3_is_any_rphy_initialized (channel) && channel->irq >=0 ) { +INIT_WORK (&channel->work, rcar_gen3_phy_usb2_work); + ret =request_irq (channel->irq, rcar_gen3_phy_usb2_irq, +IRQF_SHARED ,dev_name (channel->dev), channel); +if (ret <0 ) +dev_err (channel->dev,"No irq handler (%d)\n" , channel->irq); + }/* Initialize USB2 part */ val =readl (usb2_base +USB2_INT_ENABLE );
@@ -433,6 +460,9 @@ static int rcar_gen3_phy_usb2_exit(struct phy *p) val &= ~USB2_INT_ENABLE_UCOM_INTEN ;writel (val, usb2_base +USB2_INT_ENABLE ); +if (channel->irq >=0 && !rcar_gen3_is_any_rphy_initialized (channel)) +free_irq (channel->irq, channel); +return 0 ; }
@@ -503,23 +533,6 @@ static const struct phy_ops rz_g1c_phy_usb2_ops = { .owner = THIS_MODULE, }; -static irqreturn_t rcar_gen3_phy_usb2_irq (int irq,void *_ch) -{ -struct rcar_gen3_chan *ch = _ch; -void __iomem *usb2_base = ch->base; -u32 status =readl (usb2_base +USB2_OBINTSTA ); -irqreturn_t ret =IRQ_NONE ; - -if (status &USB2_OBINT_BITS ) { -dev_vdbg (ch->dev,"%s: %08x\n" , __func__, status); -writel (USB2_OBINT_BITS , usb2_base +USB2_OBINTSTA ); -rcar_gen3_device_recognition (ch); - ret =IRQ_HANDLED ; - } - -return ret; -} -static const struct of_device_id rcar_gen3_phy_usb2_match_table[] = { { .compatible ="renesas,usb2-phy-r8a77470" ,
@@ -598,7 +611,7 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)struct phy_provider *provider;struct resource *res;const struct phy_ops *phy_usb2_ops; -int irq, ret =0 , i; +int ret =0 , i;if (!dev->of_node) {dev_err (dev,"This driver needs device tree\n" );
@@ -614,16 +627,8 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)if (IS_ERR (channel->base))return PTR_ERR (channel->base); -/* call request_irq for OTG */ - irq =platform_get_irq_optional (pdev,0 ); -if (irq >=0 ) { -INIT_WORK (&channel->work, rcar_gen3_phy_usb2_work); - irq =devm_request_irq (dev, irq, rcar_gen3_phy_usb2_irq, -IRQF_SHARED ,dev_name (dev), channel); -if (irq <0 ) -dev_err (dev,"No irq handler (%d)\n" , irq); - } - +/* get irq number here and request_irq for OTG in phy_init */ + channel->irq =platform_get_irq_optional (pdev,0 ); channel->dr_mode =rcar_gen3_get_dr_mode (dev->of_node);if (channel->dr_mode !=USB_DR_MODE_UNKNOWN ) {int ret;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 251/464 powerpc/mm/radix: Free PUD table when freeing pagetable
In reply to Greg Kroah-HartmanFrom: Bharata B Rao <[email protected]>
[ Upstream commit 9ce8853b4a735c8115f55ac0e9c2b27a4c8f80b5 ]
remove_pagetable() isn't freeing PUD table. This causes memory leak during memory unplug. Fix this.
--- arch/powerpc/mm/book3s64/radix_pgtable.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
arch/powerpc/mm/book3s64/radix_pgtable.c +16 -0
@@ -700,6 +700,21 @@ static void free_pmd_table(pmd_t *pmd_start, pud_t *pud)pud_clear (pud); } +static void free_pud_table (pud_t *pud_start,p4d_t *p4d) +{ +pud_t *pud; +int i; + +for (i =0 ; i <PTRS_PER_PUD ; i++) { + pud = pud_start + i; +if (!pud_none (*pud)) +return ; + } + +pud_free (&init_mm, pud_start); +p4d_clear (p4d); +} +struct change_mapping_params {pte_t *pte;unsigned long start;
@@ -874,6 +889,7 @@ static void __meminit remove_pagetable(unsigned long start, unsigned long end) pud_base = (pud_t *)p4d_page_vaddr (*p4d);remove_pud_table (pud_base, addr, next); +free_pud_table (pud_base, p4d); }spin_unlock (&init_mm.page_table_lock);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 252/464 powerpc/book3s64/pkeys: Use PVR check instead of cpu feature
In reply to Greg Kroah-HartmanFrom: Aneesh Kumar K.V <[email protected]>
[ Upstream commit d79e7a5f26f1d179cbb915a8bf2469b6d7431c29 ]
We are wrongly using CPU_FTRS_POWER8 to check for P8 support. Instead, we should use PVR value. Now considering we are using CPU_FTRS_POWER8, that implies we returned true for P9 with older firmware. Keep the same behavior by checking for P9 PVR value.
--- arch/powerpc/mm/book3s64/pkeys.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
arch/powerpc/mm/book3s64/pkeys.c +10 -6
@@ -83,13 +83,17 @@ static int pkey_initialize(void)scan_pkey_feature ();/* -* Let's assume 32 pkeys on P8 bare metal, if its not defined by device -* tree. We make this exception since skiboot forgot to expose this -* property on power8. +* Let's assume 32 pkeys on P8/P9 bare metal, if its not defined by device +* tree. We make this exception since some version of skiboot forgot to +* expose this property on power8/9. */ -if (!pkeys_devtree_defined && !firmware_has_feature (FW_FEATURE_LPAR ) && -cpu_has_feature (CPU_FTRS_POWER8 )) - pkeys_total =32 ; +if (!pkeys_devtree_defined && !firmware_has_feature (FW_FEATURE_LPAR )) { +unsigned long pvr =mfspr (SPRN_PVR ); + +if (PVR_VER (pvr) ==PVR_POWER8 ||PVR_VER (pvr) ==PVR_POWER8E || +PVR_VER (pvr) ==PVR_POWER8NVL ||PVR_VER (pvr) ==PVR_POWER9 ) + pkeys_total =32 ; + }/* * Adjust the upper limit, based on the number of bits supported by
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 253/464 drm/imx: fix use after free
In reply to Greg Kroah-HartmanFrom: Philipp Zabel <[email protected]>
[ Upstream commit ba807c94f67fd64b3051199810d9e4dd209fdc00 ]
Component driver structures allocated with devm_kmalloc() in bind() are freed automatically after unbind(). Since the contained drm structures are accessed afterwards in drm_mode_config_cleanup(), move the allocation into probe() to extend the driver structure's lifetime to the lifetime of the device. This should eventually be changed to use drm resource managed allocations with lifetime of the drm device.
We also need to ensure that all componets are available during the unbind() so we need to call component_unbind_all() before we free non-devres resources like planes.
Note this patch fixes the the use after free bug but introduces a possible boot loop issue. The issue is triggered if the HDMI support is enabled and a component driver always return -EPROBE_DEFER, see discussion [1] for more details.
[1] https://lkml.org/lkml/2020/3/24/1467
[m.felsch@pengutronix: resort component_unbind_all())
--- drivers/gpu/drm/imx/dw_hdmi-imx.c | 15 ++++++++++----- drivers/gpu/drm/imx/imx-drm-core.c | 3 ++- drivers/gpu/drm/imx/imx-ldb.c | 15 ++++++++++----- drivers/gpu/drm/imx/imx-tve.c | 15 ++++++++++----- drivers/gpu/drm/imx/ipuv3-crtc.c | 21 ++++++++++----------- drivers/gpu/drm/imx/parallel-display.c | 15 ++++++++++----- 6 files changed, 52 insertions(+), 32 deletions(-)
drivers/gpu/drm/imx/dw_hdmi-imx.c +10 -5
@@ -209,9 +209,8 @@ static int dw_hdmi_imx_bind(struct device *dev, struct device *master,if (!pdev->dev.of_node)return -ENODEV ; - hdmi =devm_kzalloc (&pdev->dev,sizeof (*hdmi),GFP_KERNEL ); -if (!hdmi) -return -ENOMEM ; + hdmi =dev_get_drvdata (dev); +memset (hdmi,0 ,sizeof (*hdmi)); match =of_match_node (dw_hdmi_imx_dt_ids, pdev->dev.of_node); plat_data = match->data;
@@ -235,8 +234,6 @@ static int dw_hdmi_imx_bind(struct device *dev, struct device *master,drm_encoder_helper_add (encoder, &dw_hdmi_imx_encoder_helper_funcs);drm_simple_encoder_init (drm, encoder,DRM_MODE_ENCODER_TMDS ); -platform_set_drvdata (pdev, hdmi); - hdmi->hdmi =dw_hdmi_bind (pdev, encoder, plat_data);/*
@@ -266,6 +263,14 @@ static const struct component_ops dw_hdmi_imx_ops = {static int dw_hdmi_imx_probe (struct platform_device *pdev) { +struct imx_hdmi *hdmi; + + hdmi =devm_kzalloc (&pdev->dev,sizeof (*hdmi),GFP_KERNEL ); +if (!hdmi) +return -ENOMEM ; + +platform_set_drvdata (pdev, hdmi); +return component_add (&pdev->dev, &dw_hdmi_imx_ops); }
drivers/gpu/drm/imx/imx-drm-core.c +2 -1
@@ -275,9 +275,10 @@ static void imx_drm_unbind(struct device *dev)drm_kms_helper_poll_fini (drm); +component_unbind_all (drm->dev, drm); +drm_mode_config_cleanup (drm); -component_unbind_all (drm->dev, drm);dev_set_drvdata (dev,NULL );drm_dev_put (drm);
drivers/gpu/drm/imx/imx-ldb.c +10 -5
@@ -590,9 +590,8 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)int ret;int i; - imx_ldb =devm_kzalloc (dev,sizeof (*imx_ldb),GFP_KERNEL ); -if (!imx_ldb) -return -ENOMEM ; + imx_ldb =dev_get_drvdata (dev); +memset (imx_ldb,0 ,sizeof (*imx_ldb)); imx_ldb->regmap =syscon_regmap_lookup_by_phandle (np,"gpr" );if (IS_ERR (imx_ldb->regmap)) {
@@ -700,8 +699,6 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) } } -dev_set_drvdata (dev, imx_ldb); -return 0 ; free_child:
@@ -733,6 +730,14 @@ static const struct component_ops imx_ldb_ops = {static int imx_ldb_probe (struct platform_device *pdev) { +struct imx_ldb *imx_ldb; + + imx_ldb =devm_kzalloc (&pdev->dev,sizeof (*imx_ldb),GFP_KERNEL ); +if (!imx_ldb) +return -ENOMEM ; + +platform_set_drvdata (pdev, imx_ldb); +return component_add (&pdev->dev, &imx_ldb_ops); }
drivers/gpu/drm/imx/imx-tve.c +10 -5
@@ -542,9 +542,8 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data)int irq;int ret; - tve =devm_kzalloc (dev,sizeof (*tve),GFP_KERNEL ); -if (!tve) -return -ENOMEM ; + tve =dev_get_drvdata (dev); +memset (tve,0 ,sizeof (*tve)); tve->dev = dev;spin_lock_init (&tve->lock);
@@ -655,8 +654,6 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data)if (ret)return ret; -dev_set_drvdata (dev, tve); -return 0 ; }
@@ -676,6 +673,14 @@ static const struct component_ops imx_tve_ops = {static int imx_tve_probe (struct platform_device *pdev) { +struct imx_tve *tve; + + tve =devm_kzalloc (&pdev->dev,sizeof (*tve),GFP_KERNEL ); +if (!tve) +return -ENOMEM ; + +platform_set_drvdata (pdev, tve); +return component_add (&pdev->dev, &imx_tve_ops); }
drivers/gpu/drm/imx/ipuv3-crtc.c +10 -11
@@ -438,21 +438,13 @@ static int ipu_drm_bind(struct device *dev, struct device *master, void *data)struct ipu_client_platformdata *pdata = dev->platform_data;struct drm_device *drm = data;struct ipu_crtc *ipu_crtc; -int ret; - ipu_crtc =devm_kzalloc (dev,sizeof (*ipu_crtc),GFP_KERNEL ); -if (!ipu_crtc) -return -ENOMEM ; + ipu_crtc =dev_get_drvdata (dev); +memset (ipu_crtc,0 ,sizeof (*ipu_crtc)); ipu_crtc->dev = dev; - ret =ipu_crtc_init (ipu_crtc, pdata, drm); -if (ret) -return ret; - -dev_set_drvdata (dev, ipu_crtc); - -return 0 ; +return ipu_crtc_init (ipu_crtc, pdata, drm); } static void ipu_drm_unbind(struct device *dev, struct device *master,
@@ -474,6 +466,7 @@ static const struct component_ops ipu_crtc_ops = {static int ipu_drm_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev; +struct ipu_crtc *ipu_crtc;int ret;if (!dev->platform_data)
@@ -483,6 +476,12 @@ static int ipu_drm_probe(struct platform_device *pdev)if (ret)return ret; + ipu_crtc =devm_kzalloc (dev,sizeof (*ipu_crtc),GFP_KERNEL ); +if (!ipu_crtc) +return -ENOMEM ; + +dev_set_drvdata (dev, ipu_crtc); +return component_add (dev, &ipu_crtc_ops); }
drivers/gpu/drm/imx/parallel-display.c +10 -5
@@ -326,9 +326,8 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data)u32 bus_format =0 ;const char *fmt; - imxpd =devm_kzalloc (dev,sizeof (*imxpd),GFP_KERNEL ); -if (!imxpd) -return -ENOMEM ; + imxpd =dev_get_drvdata (dev); +memset (imxpd,0 ,sizeof (*imxpd)); edidp =of_get_property (np,"edid" , &imxpd->edid_len);if (edidp)
@@ -359,8 +358,6 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data)if (ret)return ret; -dev_set_drvdata (dev, imxpd); -return 0 ; }
@@ -382,6 +379,14 @@ static const struct component_ops imx_pd_ops = {static int imx_pd_probe (struct platform_device *pdev) { +struct imx_parallel_display *imxpd; + + imxpd =devm_kzalloc (&pdev->dev,sizeof (*imxpd),GFP_KERNEL ); +if (!imxpd) +return -ENOMEM ; + +platform_set_drvdata (pdev, imxpd); +return component_add (&pdev->dev, &imx_pd_ops); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 254/464 drm/imx: tve: fix regulator_disable error path
In reply to Greg Kroah-HartmanFrom: Marco Felsch <[email protected]>
[ Upstream commit 7bb58b987fee26da2a1665c01033022624986b7c ]
Add missing regulator_disable() as devm_action to avoid dedicated unbind() callback and fix the missing error handling.
--- drivers/gpu/drm/imx/imx-tve.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/gpu/drm/imx/imx-tve.c +10 -10
@@ -490,6 +490,13 @@ static int imx_tve_register(struct drm_device *drm, struct imx_tve *tve)return 0 ; } +static void imx_tve_disable_regulator (void *data) +{ +struct imx_tve *tve = data; + +regulator_disable (tve->dac_reg); +} +static bool imx_tve_readable_reg (struct device *dev,unsigned int reg) {return (reg %4 ==0 ) && (reg <=0xdc );
@@ -613,6 +620,9 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data) ret =regulator_enable (tve->dac_reg);if (ret)return ret; + ret =devm_add_action_or_reset (dev, imx_tve_disable_regulator, tve); +if (ret) +return ret; } tve->clk =devm_clk_get (dev,"tve" );
@@ -657,18 +667,8 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data)return 0 ; } -static void imx_tve_unbind (struct device *dev,struct device *master, -void *data) -{ -struct imx_tve *tve =dev_get_drvdata (dev); - -if (!IS_ERR (tve->dac_reg)) -regulator_disable (tve->dac_reg); -} -static const struct component_ops imx_tve_ops = { .bind = imx_tve_bind, - .unbind = imx_tve_unbind, };static int imx_tve_probe (struct platform_device *pdev)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 255/464 gpu: ipu-v3: Restore RGB32, BGR32
In reply to Greg Kroah-HartmanFrom: Steve Longerbeam <[email protected]>
[ Upstream commit 22b2cfad752d4b278ea7c38c0ee961ca50198ce8 ]
RGB32 and BGR32 formats were inadvertently removed from the switch statement in ipu_pixelformat_to_colorspace(). Restore them.
--- drivers/gpu/ipu-v3/ipu-common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/ipu-v3/ipu-common.c +2 -0
@@ -124,6 +124,8 @@ enum ipu_color_space ipu_pixelformat_to_colorspace(u32 pixelformat)case V4L2_PIX_FMT_RGBX32 :case V4L2_PIX_FMT_ARGB32 :case V4L2_PIX_FMT_XRGB32 : +case V4L2_PIX_FMT_RGB32 : +case V4L2_PIX_FMT_BGR32 :return IPUV3_COLORSPACE_RGB ;default :return IPUV3_COLORSPACE_UNKNOWN ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 256/464 spi: lantiq-ssc: Fix warning by using WQ_MEM_RECLAIM
In reply to Greg Kroah-HartmanFrom: Hauke Mehrtens <[email protected]>
[ Upstream commit ba3548cf29616b58c93bbaffc3d636898d009858 ]
The lantiq-ssc driver uses internally an own workqueue to wait till the data is not only written out of the FIFO but really written to the wire. This workqueue is flushed while the SPI subsystem is working in some other system workqueue.
The system workqueue is marked as WQ_MEM_RECLAIM, but the workqueue in the lantiq-ssc driver does not use WQ_MEM_RECLAIM for now. Add this flag too to prevent this warning.
This fixes the following warning:
[ 2.975956] WARNING: CPU: 1 PID: 17 at kernel/workqueue.c:2614 check_flush_dependency+0x168/0x184 [ 2.984752] workqueue: WQ_MEM_RECLAIM kblockd:blk_mq_run_work_fn is flushing !WQ_MEM_RECLAIM 1e100800.spi:0x0
--- drivers/spi/spi-lantiq-ssc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-lantiq-ssc.c +1 -1
@@ -909,7 +909,7 @@ static int lantiq_ssc_probe(struct platform_device *pdev) master->bits_per_word_mask =SPI_BPW_RANGE_MASK (2 ,8 ) |SPI_BPW_MASK (16 ) |SPI_BPW_MASK (32 ); - spi->wq =alloc_ordered_workqueue (dev_name (dev),0 ); + spi->wq =alloc_ordered_workqueue (dev_name (dev),WQ_MEM_RECLAIM );if (!spi->wq) { err = -ENOMEM ; goto err_clk_put;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 257/464 PCI: loongson: Use DECLARE_PCI_FIXUP_EARLY for bridge_class_quirk()
In reply to Greg Kroah-HartmanFrom: Tiezhu Yang <[email protected]>
[ Upstream commit 14110af606965ce07abe4d121c100241c2e73b86 ]
According to the datasheet of Loongson LS7A bridge chip, the old version of Loongson LS7A PCIE port has a wrong value about PCI class which is 0x060000, the correct value should be 0x060400, this bug can be fixed by "dev->class = PCI_CLASS_BRIDGE_PCI << 8;" at the software level and it was fixed in hardware in the latest LS7A versions.
In order to maintain downward compatibility, use DECLARE_PCI_FIXUP_EARLY instead of DECLARE_PCI_FIXUP_HEADER for bridge_class_quirk() to fix it as early as possible.
Otherwise, in the function pci_setup_device(), the related code about "dev->class" such as "class = dev->class >> 8;" and "dev->transparent = ((dev->class & 0xff) == 1);" maybe get wrong value without EARLY fixup.
--- drivers/pci/controller/pci-loongson.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pci/controller/pci-loongson.c +3 -3
@@ -37,11 +37,11 @@ static void bridge_class_quirk(struct pci_dev *dev) { dev->class =PCI_CLASS_BRIDGE_PCI <<8 ; } -DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_LOONGSON , +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_LOONGSON ,DEV_PCIE_PORT_0 , bridge_class_quirk); -DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_LOONGSON , +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_LOONGSON ,DEV_PCIE_PORT_1 , bridge_class_quirk); -DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_LOONGSON , +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_LOONGSON ,DEV_PCIE_PORT_2 , bridge_class_quirk);static void system_bus_quirk (struct pci_dev *pdev)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 258/464 USB: serial: iuu_phoenix: fix led-activity helpers
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit de37458f8c2bfc465500a1dd0d15dbe96d2a698c ]
The set-led command is eight bytes long and starts with a command byte followed by six bytes of RGB data and ends with a byte encoding a frequency (see iuu_led() and iuu_rgbf_fill_buffer()).
The led activity helpers had a few long-standing bugs which corrupted the command packets by inserting a second command byte and thereby offsetting the RGB data and dropping the frequency in non-xmas mode.
In xmas mode, a related off-by-one error left the frequency field uninitialised.
--- drivers/usb/serial/iuu_phoenix.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/usb/serial/iuu_phoenix.c +8 -6
@@ -353,10 +353,11 @@ static void iuu_led_activity_on(struct urb *urb)struct usb_serial_port *port = urb->context;int result;char *buf_ptr = port->write_urb->transfer_buffer; - *buf_ptr++ =IUU_SET_LED ; +if (xmas) { -get_random_bytes (buf_ptr,6 ); - *(buf_ptr+7 ) =1 ; + buf_ptr[0 ] =IUU_SET_LED ; +get_random_bytes (buf_ptr +1 ,6 ); + buf_ptr[7 ] =1 ; }else {iuu_rgbf_fill_buffer (buf_ptr,255 ,255 ,0 ,0 ,0 ,0 ,255 ); }
@@ -374,13 +375,14 @@ static void iuu_led_activity_off(struct urb *urb)struct usb_serial_port *port = urb->context;int result;char *buf_ptr = port->write_urb->transfer_buffer; +if (xmas) {iuu_rxcmd (urb);return ; - }else { - *buf_ptr++ =IUU_SET_LED ; -iuu_rgbf_fill_buffer (buf_ptr,0 ,0 ,255 ,255 ,0 ,0 ,255 ); } + +iuu_rgbf_fill_buffer (buf_ptr,0 ,0 ,255 ,255 ,0 ,0 ,255 ); + usb_fill_bulk_urb(port->write_urb, port->serial->dev, usb_sndbulkpipe(port->serial->dev, port->bulk_out_endpointAddress),
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 259/464 clk: qcom: gcc: Make disp gpll0 branch aon for sc7180/sdm845
In reply to Greg Kroah-HartmanFrom: Taniya Das <[email protected]>
[ Upstream commit 9c3df2b1993da9ab1110702d7b2815d5cd8c02f3 ]
The display gpll0 branch clock inside GCC needs to always be enabled. Otherwise the AHB clk (disp_cc_mdss_ahb_clk_src) for the display clk controller (dispcc) will stop clocking while sourcing from gpll0 when this branch inside GCC is turned off during unused clk disabling. We can never turn this branch off because the AHB clk for the display subsystem is needed to read/write any registers inside the display subsystem including clk related ones. This makes this branch a really easy way to turn off AHB access to the display subsystem and cause all sorts of mayhem. Let's just make the clk ops keep the clk enabled forever and ignore any attempts to disable this clk so that dispcc accesses keep working.
--- drivers/clk/qcom/gcc-sc7180.c | 2 +- drivers/clk/qcom/gcc-sdm845.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/clk/qcom/gcc-sc7180.c +1 -1
@@ -1061,7 +1061,7 @@ static struct clk_branch gcc_disp_gpll0_clk_src = { .hw = &gpll0.clkr.hw, }, .num_parents = 1, - .ops = &clk_branch2_ops, + .ops = &clk_branch2_aon_ops, }, }, };
drivers/clk/qcom/gcc-sdm845.c +2 -2
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0 /* -* Copyright (c) 2018, The Linux Foundation. All rights reserved. +* Copyright (c) 2018, 2020, The Linux Foundation. All rights reserved. */ #include <linux/kernel.h>
@@ -1344,7 +1344,7 @@ static struct clk_branch gcc_disp_gpll0_clk_src = { "gpll0", }, .num_parents = 1, - .ops = &clk_branch2_ops, + .ops = &clk_branch2_aon_ops, }, }, };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 260/464 usb: core: fix quirks_param_set() writing to a const pointer
In reply to Greg Kroah-HartmanFrom: Kars Mulder <[email protected]>
[ Upstream commit b1b6bed3b5036509b449b5965285d5057ba42527 ]
The function quirks_param_set() takes as argument a const char* pointer to the new value of the usbcore.quirks parameter. It then casts this pointer to a non-const char* pointer and passes it to the strsep() function, which overwrites the value.
Fix this by creating a copy of the value using kstrdup() and letting that copy be written to by strsep().
--- drivers/usb/core/quirks.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/usb/core/quirks.c +12 -4
@@ -25,17 +25,23 @@ static unsigned int quirk_count;static char quirks_param[128 ]; -static int quirks_param_set (const char *val,const struct kernel_param *kp) +static int quirks_param_set (const char *value,const struct kernel_param *kp) { -char *p, *field; +char *val, *p, *field;u16 vid, pid;u32 flags;size_t i;int err; + val =kstrdup (value,GFP_KERNEL ); +if (!val) +return -ENOMEM ; + err =param_set_copystring (val, kp); -if (err) +if (err) { +kfree (val);return err; + }mutex_lock (&quirk_mutex);
@@ -60,10 +66,11 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)if (!quirk_list) { quirk_count =0 ;mutex_unlock (&quirk_mutex); +kfree (val);return -ENOMEM ; } -for (i =0 , p = (char *)val; p && *p;) { +for (i =0 , p = val; p && *p;) {/* Each entry consists of VID:PID:flags */ field =strsep (&p,":" );if (!field)
@@ -144,6 +151,7 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp) unlock:mutex_unlock (&quirk_mutex); +kfree (val);return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 261/464 thermal: ti-soc-thermal: Fix reversed condition in ti_thermal_expose_sensor()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 0f348db01fdf128813fdd659fcc339038fb421a4 ]
This condition is reversed and will cause breakage.
--- drivers/thermal/ti-soc-thermal/ti-thermal-common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thermal/ti-soc-thermal/ti-thermal-common.c +1 -1
@@ -169,7 +169,7 @@ int ti_thermal_expose_sensor(struct ti_bandgap *bgp, int id, data =ti_bandgap_get_sensor_data (bgp, id); -if (!IS_ERR_OR_NULL (data)) +if (IS_ERR_OR_NULL (data)) data =ti_thermal_build_data (bgp, id);if (!data)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 262/464 coresight: etmv4: Fix resource selector constant
In reply to Greg Kroah-HartmanFrom: Mike Leach <[email protected]>
[ Upstream commit cb8bba907a4ff4ba42f1d245cb506d55829674b8 ]
ETMv4 max resource selector constant incorrectly set to 16. Updated to the correct 32 value, and adjustments made to limited code using it.
--- drivers/hwtracing/coresight/coresight-etm4x.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwtracing/coresight/coresight-etm4x.h +2 -2
@@ -133,7 +133,7 @@#define ETMv4_MAX_CTXID_CMP 8#define ETM_MAX_VMID_CMP 8#define ETM_MAX_PE_CMP 8 -#define ETM_MAX_RES_SEL 16 +#define ETM_MAX_RES_SEL 32#define ETM_MAX_SS_CMP 8#define ETM_ARCH_V4 0x40
@@ -325,7 +325,7 @@ struct etmv4_save_state {u32 trccntctlr[ETMv4_MAX_CNTR];u32 trccntvr[ETMv4_MAX_CNTR]; -u32 trcrsctlr[ETM_MAX_RES_SEL *2 ]; +u32 trcrsctlr[ETM_MAX_RES_SEL ];u32 trcssccr[ETM_MAX_SS_CMP ];u32 trcsscsr[ETM_MAX_SS_CMP ];
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 263/464 coresight: etmv4: Counter values not saved on disable
In reply to Greg Kroah-HartmanFrom: Mike Leach <[email protected]>
[ Upstream commit 8fa43700f69703f995ea715b76be6fabdd2f05de ]
The counter value registers change during operation, however this change is not reflected in the values seen by the user in sysfs.
This fixes the issue by reading back the values on disable.
--- drivers/hwtracing/coresight/coresight-etm4x.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/hwtracing/coresight/coresight-etm4x.c +6 -0
@@ -507,6 +507,12 @@ static void etm4_disable_hw(void *info)readl_relaxed (drvdata->base +TRCSSCSRn (i)); } +/* read back the current counter values */ +for (i =0 ; i < drvdata->nr_cntr; i++) { + config->cntr_val[i] = +readl_relaxed (drvdata->base +TRCCNTVRn (i)); + } +coresight_disclaim_device_unlocked (drvdata->base);CS_LOCK (drvdata->base);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 264/464 coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb()
In reply to Greg Kroah-HartmanFrom: Sai Prakash Ranjan <[email protected]>
[ Upstream commit d021f5c5ff679432c5e9faee0fd7350db2efb97c ]
Reading TMC mode register without proper coresight power management can lead to exceptions like the one in the call trace below in tmc_read_unprepare_etb() when the trace data is read after the sink is disabled. So fix this by having a check for coresight sysfs mode before reading TMC mode management register in tmc_read_unprepare_etb() similar to tmc_read_prepare_etb().
SError Interrupt on CPU6, code 0xbe000411 -- SError
pstate: 80400089 (Nzcv daIf +PAN -UAO)
pc : tmc_read_unprepare_etb+0x74/0x108 lr : tmc_read_unprepare_etb+0x54/0x108 sp : ffffff80d9507c30 x29: ffffff80d9507c30 x28: ffffff80b3569a0c x27: 0000000000000000 x26: 00000000000a0001 x25: ffffff80cbae9550 x24: 0000000000000010 x23: ffffffd07296b0f0 x22: ffffffd0109ee028 x21: 0000000000000000 x20: ffffff80d19e70e0 x19: ffffff80d19e7080 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: dfffffd000000001 x9 : 0000000000000000 x8 : 0000000000000002 x7 : ffffffd071d0fe78 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffffffd071d0fe98 x2 : 0000000000000000 x1 : 0000000000000004 x0 : 0000000000000001 Kernel panic - not syncing: Asynchronous SError Interrupt
--- drivers/hwtracing/coresight/coresight-tmc-etf.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/hwtracing/coresight/coresight-tmc-etf.c +6 -7
@@ -639,15 +639,14 @@ int tmc_read_unprepare_etb(struct tmc_drvdata *drvdata)spin_lock_irqsave (&drvdata->spinlock, flags); -/* There is no point in reading a TMC in HW FIFO mode */ - mode =readl_relaxed (drvdata->base +TMC_MODE ); -if (mode !=TMC_MODE_CIRCULAR_BUFFER ) { -spin_unlock_irqrestore (&drvdata->spinlock, flags); -return -EINVAL ; - } -/* Re-enable the TMC if need be */ if (drvdata->mode ==CS_MODE_SYSFS ) { +/* There is no point in reading a TMC in HW FIFO mode */ + mode =readl_relaxed (drvdata->base +TMC_MODE ); +if (mode !=TMC_MODE_CIRCULAR_BUFFER ) { +spin_unlock_irqrestore (&drvdata->spinlock, flags); +return -EINVAL ; + }/* * The trace run will continue with the same allocated trace * buffer. As such zero-out the buffer so that we don't end
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 265/464 coresight: etm4x: Fix save/restore during cpu idle
In reply to Greg Kroah-HartmanFrom: Suzuki K Poulose <[email protected]>
[ Upstream commit 342c8a1d1d9e418d32fa02d635cf96989f9a986e ]
The ETM state save/restore incorrectly reads/writes some of the 64bit registers (e.g, address comparators, vmid/cid comparators etc.) using 32bit accesses. Ensure we use the appropriate width accessors for the registers.
--- drivers/hwtracing/coresight/coresight-etm4x.c | 16 ++++++++-------- drivers/hwtracing/coresight/coresight-etm4x.h | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-)
drivers/hwtracing/coresight/coresight-etm4x.c +8 -8
@@ -1202,8 +1202,8 @@ static int etm4_cpu_save(struct etmv4_drvdata *drvdata) }for (i =0 ; i < drvdata->nr_addr_cmp *2 ; i++) { - state->trcacvr[i] =readl (drvdata->base +TRCACVRn (i)); - state->trcacatr[i] =readl (drvdata->base +TRCACATRn (i)); + state->trcacvr[i] =readq (drvdata->base +TRCACVRn (i)); + state->trcacatr[i] =readq (drvdata->base +TRCACATRn (i)); }/*
@@ -1214,10 +1214,10 @@ static int etm4_cpu_save(struct etmv4_drvdata *drvdata)*/ for (i =0 ; i < drvdata->numcidc; i++) - state->trccidcvr[i] =readl (drvdata->base +TRCCIDCVRn (i)); + state->trccidcvr[i] =readq (drvdata->base +TRCCIDCVRn (i));for (i =0 ; i < drvdata->numvmidc; i++) - state->trcvmidcvr[i] =readl (drvdata->base +TRCVMIDCVRn (i)); + state->trcvmidcvr[i] =readq (drvdata->base +TRCVMIDCVRn (i)); state->trccidcctlr0 =readl (drvdata->base +TRCCIDCCTLR0 ); state->trccidcctlr1 =readl (drvdata->base +TRCCIDCCTLR1 );
@@ -1315,18 +1315,18 @@ static void etm4_cpu_restore(struct etmv4_drvdata *drvdata) }for (i =0 ; i < drvdata->nr_addr_cmp *2 ; i++) { -writel_relaxed (state->trcacvr[i], +writeq_relaxed (state->trcacvr[i], drvdata->base +TRCACVRn (i)); -writel_relaxed (state->trcacatr[i], +writeq_relaxed (state->trcacatr[i], drvdata->base +TRCACATRn (i)); }for (i =0 ; i < drvdata->numcidc; i++) -writel_relaxed (state->trccidcvr[i], +writeq_relaxed (state->trccidcvr[i], drvdata->base +TRCCIDCVRn (i));for (i =0 ; i < drvdata->numvmidc; i++) -writel_relaxed (state->trcvmidcvr[i], +writeq_relaxed (state->trcvmidcvr[i], drvdata->base +TRCVMIDCVRn (i));writel_relaxed (state->trccidcctlr0, drvdata->base +TRCCIDCCTLR0 );
drivers/hwtracing/coresight/coresight-etm4x.h +1 -1
@@ -334,7 +334,7 @@ struct etmv4_save_state {u64 trcacvr[ETM_MAX_SINGLE_ADDR_CMP ];u64 trcacatr[ETM_MAX_SINGLE_ADDR_CMP ];u64 trccidcvr[ETMv4_MAX_CTXID_CMP]; -u32 trcvmidcvr[ETM_MAX_VMID_CMP ]; +u64 trcvmidcvr[ETM_MAX_VMID_CMP ];u32 trccidcctlr0;u32 trccidcctlr1;u32 trcvmidcctlr0;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 266/464 powerpc/perf: Fix missing is_sier_aviable() during build
In reply to Greg Kroah-HartmanFrom: Madhavan Srinivasan <[email protected]>
[ Upstream commit 3c9450c053f88e525b2db1e6990cdf34d14e7696 ]
Compilation error:
arch/powerpc/perf/perf_regs.c:80:undefined reference to `.is_sier_available'
Currently is_sier_available() is part of core-book3s.c, which is added to build based on CONFIG_PPC_PERF_CTRS.
A config with CONFIG_PERF_EVENTS and without CONFIG_PPC_PERF_CTRS will have a build break because of missing is_sier_available().
In practice it only breaks when CONFIG_FSL_EMB_PERF_EVENT=n because that also guards the usage of is_sier_available(). That only happens with CONFIG_PPC_BOOK3E_64=y and CONFIG_FSL_SOC_BOOKE=n.
Patch adds is_sier_available() in asm/perf_event.h to fix the build break for configs missing CONFIG_PPC_PERF_CTRS.
--- arch/powerpc/include/asm/perf_event.h | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/include/asm/perf_event.h +2 -0
@@ -12,6 +12,8 @@#ifdef CONFIG_PPC_PERF_CTRS #include <asm/perf_event_server.h> +#else +static inline bool is_sier_available (void ) {return false; }#endif #ifdef CONFIG_FSL_EMB_PERF_EVENT
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 267/464 mt76: mt7663u: fix memory leak in set key
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit 4a850f8dc68b8c4a20333521b31600c9d31ccb5d ]
Fix memory leak in set key.
--- .../net/wireless/mediatek/mt76/mt7615/usb.c | 21 ++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7615/usb.c +14 -7
@@ -166,12 +166,16 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev,lockdep_assert_held (&dev->mt76.mutex); -if (!sta) -return -EINVAL ; +if (!sta) { + err = -EINVAL ; + goto out; + } cipher =mt7615_mac_get_cipher (key->cipher); -if (cipher ==MT_CIPHER_NONE ) -return -EOPNOTSUPP ; +if (cipher ==MT_CIPHER_NONE ) { + err = -EOPNOTSUPP ; + goto out; + } wcid = &wd->sta->wcid;
@@ -179,19 +183,22 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev, err =mt7615_mac_wtbl_update_key (dev, wcid, key->key, key->keylen, cipher, key->cmd);if (err <0 ) -return err; + goto out; err =mt7615_mac_wtbl_update_pk (dev, wcid, cipher, key->keyidx, key->cmd);if (err <0 ) -return err; + goto out;if (key->cmd ==SET_KEY ) wcid->cipher |=BIT (cipher);else wcid->cipher &= ~BIT (cipher); -return 0 ; +out: +kfree (key->key); + +return err; }void mt7663u_wtbl_work (struct work_struct *work)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 268/464 mt76: mt7663u: fix potential memory leak in mcu message handler
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit c876039e95559350ee101d4b6f6084d9803f2995 ]
Fix potential memory leak in mcu message handler on error condition.
--- drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c +1 -1
@@ -34,7 +34,6 @@ mt7663u_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb, ret =mt76u_bulk_msg (&dev->mt76, skb->data, skb->len,NULL ,1000 , ep); -dev_kfree_skb (skb);if (ret <0 ) goto out;
@@ -43,6 +42,7 @@ mt7663u_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb, out:mutex_unlock (&mdev->mcu.mutex); +dev_kfree_skb (skb);return ret; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 269/464 mt76: mt7615: fix potential memory leak in mcu message handler
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit 9248c08c3fc4ef816c82aa49d01123f4746d349f ]
Fix potential memory leak in mcu message handler on error condition.
--- drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +5 -2
@@ -180,8 +180,10 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;int ret =0 ; -if (seq != rxd->seq) -return -EAGAIN ; +if (seq != rxd->seq) { + ret = -EAGAIN ; + goto out; + }switch (cmd) {case MCU_CMD_PATCH_SEM_CONTROL :
@@ -208,6 +210,7 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,default :break ; } +out:dev_kfree_skb (skb);return ret;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 270/464 mt76: mt7915: potential array overflow in mt7915_mcu_tx_rate_report()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit eb744e5df86cf7e377d0acc4e686101b0fd9663a ]
Smatch complains that "wcidx" value comes from the network and thus cannot be trusted. In this case, it actually seems to come from the firmware. If your wireless firmware is malicious then probably no amount of carefulness can protect you.
On the other hand, these days we still try to check the firmware as much as possible. Verifying that the index is within bounds will silence a static checker warning. And it's harmless and a good exercise in kernel hardening. So I suggest that we do add a bounds check.
--- .../net/wireless/mediatek/mt76/mt7915/mcu.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +13 -6
@@ -505,15 +505,22 @@ static void mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb) { struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data; -u16 wcidx =le16_to_cpu (ra->wlan_idx); -struct mt76_wcid *wcid =rcu_dereference (dev->mt76.wcid[wcidx]); - struct mt7915_sta *msta = container_of(wcid, struct mt7915_sta, wcid); -struct mt7915_sta_stats *stats = &msta->stats; -struct mt76_phy *mphy = &dev->mphy;struct rate_info rate = {}, prob_rate = {}; +u16 probe =le16_to_cpu (ra->prob_up_rate);u16 attempts =le16_to_cpu (ra->attempts);u16 curr =le16_to_cpu (ra->curr_rate); -u16 probe =le16_to_cpu (ra->prob_up_rate); +u16 wcidx =le16_to_cpu (ra->wlan_idx); +struct mt76_phy *mphy = &dev->mphy; +struct mt7915_sta_stats *stats; +struct mt7915_sta *msta; +struct mt76_wcid *wcid; + +if (wcidx >=MT76_N_WCIDS ) +return ; + + wcid =rcu_dereference (dev->mt76.wcid[wcidx]); + msta = container_of(wcid, struct mt7915_sta, wcid); + stats = &msta->stats;if (msta->wcid.ext_phy && dev->mt76.phy2) mphy = dev->mt76.phy2;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 271/464 mt76: mt7915: add missing CONFIG_MAC80211_DEBUGFS
In reply to Greg Kroah-HartmanFrom: Ryder Lee <[email protected]>
[ Upstream commit a6e29d8ecd3d4eea8748d81d7b577083b4a7c441 ]
Add CONFIG_MAC80211_DEBUGFS to fix a reported warning.
--- drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +2 -0
@@ -384,6 +384,7 @@ int mt7915_init_debugfs(struct mt7915_dev *dev)return 0 ; } +#ifdef CONFIG_MAC80211_DEBUGFS /** per-station debugfs **/ /* usage: <tx mode> <ldpc> <stbc> <bw> <gi> <nss> <mcs> */
@@ -461,3 +462,4 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,debugfs_create_file ("fixed_rate" ,0600 , dir, sta, &fops_fixed_rate); debugfs_create_file("stats", 0400, dir, sta, &fops_sta_stats); } +#endif
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 272/464 mt76: mt7615: fix possible memory leak in mt7615_mcu_wtbl_sta_add
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 2bccc8415883c1cd5ae8836548d9783dbbd84999 ]
Free the second mcu skb if __mt76_mcu_skb_send_msg() fails to transmit the first one in mt7615_mcu_wtbl_sta_add().
--- drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +5 -1
@@ -1209,8 +1209,12 @@ mt7615_mcu_wtbl_sta_add(struct mt7615_dev *dev, struct ieee80211_vif *vif, skb = enable ? wskb : sskb; err =__mt76_mcu_skb_send_msg (&dev->mt76, skb, cmd, true); -if (err <0 ) +if (err <0 ) { + skb = enable ? sskb : wskb; +dev_kfree_skb (skb); +return err; + } cmd = enable ?MCU_EXT_CMD_STA_REC_UPDATE :MCU_EXT_CMD_WTBL_UPDATE ; skb = enable ? sskb : wskb;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 273/464 phy: armada-38x: fix NETA lockup when repeatedly switching speeds
In reply to Greg Kroah-HartmanFrom: Russell King <[email protected]>
[ Upstream commit 1dea06cd643da38931382ebdc151efced201ffad ]
The mvneta hardware appears to lock up in various random ways when repeatedly switching speeds between 1G and 2.5G, which involves reprogramming the COMPHY. It is not entirely clear why this happens, but best guess is that reprogramming the COMPHY glitches mvneta clocks causing the hardware to fail. It seems that rebooting resolves the failure, but not down/up cycling the interface alone.
Various other approaches have been tried, such as trying to cleanly power down the COMPHY and then take it back through the power up initialisation, but this does not seem to help.
It was finally noticed that u-boot's last step when configuring a COMPHY for "SGMII" mode was to poke at a register described as "GBE_CONFIGURATION_REG", which is undocumented in any external documentation. All that we have is the fact that u-boot sets a bit corresponding to the "SGMII" lane at the end of COMPHY initialisation.
Experimentation shows that if we clear this bit prior to changing the speed, and then set it afterwards, mvneta does not suffer this problem on the SolidRun Clearfog when switching speeds between 1G and 2.5G.
This problem was found while script-testing phylink.
This fix also requires the corresponding change to DT to be effective. See "ARM: dts: armada-38x: fix NETA lockup when repeatedly switching speeds".
--- drivers/phy/marvell/phy-armada38x-comphy.c | 45 ++++++++++++++++++---- 1 file changed, 38 insertions(+), 7 deletions(-)
drivers/phy/marvell/phy-armada38x-comphy.c +38 -7
@@ -41,6 +41,7 @@ struct a38x_comphy_lane {struct a38x_comphy {void __iomem *base; +void __iomem *conf;struct device *dev;struct a38x_comphy_lane lane[MAX_A38X_COMPHY ]; };
@@ -54,6 +55,21 @@ static const u8 gbe_mux[MAX_A38X_COMPHY][MAX_A38X_PORTS] = { { 0, 0, 3 }, }; +static void a38x_set_conf (struct a38x_comphy_lane *lane,bool enable) +{ +struct a38x_comphy *priv = lane->priv; +u32 conf; + +if (priv->conf) { + conf =readl_relaxed (priv->conf); +if (enable) + conf |=BIT (lane->port); +else + conf &= ~BIT (lane->port); +writel (conf, priv->conf); + } +} +static void a38x_comphy_set_reg (struct a38x_comphy_lane *lane,unsigned int offset,u32 mask,u32 value) {
@@ -97,6 +113,7 @@ static int a38x_comphy_set_mode(struct phy *phy, enum phy_mode mode, int sub) {struct a38x_comphy_lane *lane =phy_get_drvdata (phy);unsigned int gen; +int ret;if (mode !=PHY_MODE_ETHERNET )return -EINVAL ;
@@ -115,13 +132,20 @@ static int a38x_comphy_set_mode(struct phy *phy, enum phy_mode mode, int sub)return -EINVAL ; } +a38x_set_conf (lane, false); +a38x_comphy_set_speed (lane, gen, gen); -return a38x_comphy_poll (lane,COMPHY_STAT1 , -COMPHY_STAT1_PLL_RDY_TX | -COMPHY_STAT1_PLL_RDY_RX , -COMPHY_STAT1_PLL_RDY_TX | -COMPHY_STAT1_PLL_RDY_RX ); + ret =a38x_comphy_poll (lane,COMPHY_STAT1 , +COMPHY_STAT1_PLL_RDY_TX | +COMPHY_STAT1_PLL_RDY_RX , +COMPHY_STAT1_PLL_RDY_TX | +COMPHY_STAT1_PLL_RDY_RX ); + +if (ret ==0 ) +a38x_set_conf (lane, true); + +return ret; }static const struct phy_ops a38x_comphy_ops = {
@@ -174,14 +198,21 @@ static int a38x_comphy_probe(struct platform_device *pdev)if (!priv)return -ENOMEM ; - res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); - base =devm_ioremap_resource (&pdev->dev, res); + base =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (base))return PTR_ERR (base); priv->dev = &pdev->dev; priv->base = base; +/* Optional */ + res =platform_get_resource_byname (pdev,IORESOURCE_MEM ,"conf" ); +if (res) { + priv->conf =devm_ioremap_resource (&pdev->dev, res); +if (IS_ERR (priv->conf)) +return PTR_ERR (priv->conf); + } +for_each_available_child_of_node (pdev->dev.of_node, child) {struct phy *phy;int ret;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 274/464 s390/bpf: Fix sign extension in branch_ku
In reply to Greg Kroah-HartmanFrom: Ilya Leoshkevich <[email protected]>
[ Upstream commit 7477d43be5b1448bc0d4c85cb185a0144cc080e1 ]
Both signed and unsigned variants of BPF_JMP | BPF_K require sign-extending the immediate. JIT emits cgfi for the signed case, which is correct, and clgfi for the unsigned case, which is not
correct: clgfi zero-extends the immediate.
s390 does not provide an instruction that does sign-extension and unsigned comparison at the same time. Therefore, fix by first loading the sign-extended immediate into work register REG_1 and proceeding as if it's BPF_X.
--- arch/s390/net/bpf_jit_comp.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-)
arch/s390/net/bpf_jit_comp.c +4 -15
@@ -1417,21 +1417,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, }break ; branch_ku: - is_jmp32 =BPF_CLASS (insn->code) ==BPF_JMP32 ; -/* clfi or clgfi %dst,imm */ -EMIT6_IMM (is_jmp32 ?0xc20f0000 :0xc20e0000 , - dst_reg, imm); -if (!is_first_pass (jit) && -can_use_rel (jit, addrs[i + off +1 ])) { -/* brc mask,off */ -EMIT4_PCREL_RIC (0xa7040000 , - mask >>12 , addrs[i + off +1 ]); - }else { -/* brcl mask,off */ -EMIT6_PCREL_RILC (0xc0040000 , - mask >>12 , addrs[i + off +1 ]); - } -break ; +/* lgfi %w1,imm (load sign extend imm) */ + src_reg =REG_1 ; +EMIT6_IMM (0xc0010000 , src_reg, imm); + goto branch_xu; branch_xs: is_jmp32 =BPF_CLASS (insn->code) ==BPF_JMP32 ; if (!is_first_pass(jit) &&
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 275/464 s390/bpf: Use brcl for jumping to exit_ip if necessary
In reply to Greg Kroah-HartmanFrom: Ilya Leoshkevich <[email protected]>
[ Upstream commit 5fa6974471c5518a50bdd814067508dbcb477251 ]
"BPF_MAXINSNS: Maximum possible literals" test causes panic with bpf_jit_harden = 2. The reason is that BPF_JMP | BPF_EXIT is always emitted as brc, however, after removal of JITed image size limitations, brcl might be required.
Fix by using brcl when necessary.
--- arch/s390/net/bpf_jit_comp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/s390/net/bpf_jit_comp.c +6 -2
@@ -1268,8 +1268,12 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, last = (i == fp->len -1 ) ?1 :0 ;if (last)break ; -/* j <exit> */ -EMIT4_PCREL (0xa7f40000 , jit->exit_ip - jit->prg); +if (!is_first_pass (jit) &&can_use_rel (jit, jit->exit_ip)) +/* brc 0xf, <exit> */ +EMIT4_PCREL_RIC (0xa7040000 ,0xf , jit->exit_ip); +else +/* brcl 0xf, <exit> */ +EMIT6_PCREL_RILC (0xc0040000 ,0xf , jit->exit_ip);break ;/* * Branch relative (number of skipped instructions) to offset on
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 276/464 s390/bpf: Tolerate not converging code shrinking
In reply to Greg Kroah-HartmanFrom: Ilya Leoshkevich <[email protected]>
[ Upstream commit 1491b73311a15bb5beeab5d30e03bff761ef6c18 ]
"BPF_MAXINSNS: Maximum possible literals" unnecessarily falls back to the interpreter because of failing sanity check in bpf_set_addr. The problem is that there are a lot of branches that can be shrunk, and doing so opens up the possibility to shrink even more. This process does not converge after 3 passes, causing code offsets to change during the codegen pass, which must never happen.
Fix by inserting nops during codegen pass in order to preserve code offets.
--- arch/s390/net/bpf_jit_comp.c | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-)
arch/s390/net/bpf_jit_comp.c +26 -1
@@ -489,6 +489,24 @@ static void save_restore_regs(struct bpf_jit *jit, int op, u32 stack_depth) }while (re <= last); } +static void bpf_skip (struct bpf_jit *jit,int size) +{ +if (size >=6 && !is_valid_rel (size)) { +/* brcl 0xf,size */ +EMIT6_PCREL_RIL (0xc0f4000000 , size); + size -=6 ; + }else if (size >=4 &&is_valid_rel (size)) { +/* brc 0xf,size */ +EMIT4_PCREL (0xa7f40000 , size); + size -=4 ; + } +while (size >=2 ) { +/* bcr 0,%0 */ +_EMIT2 (0x0700 ); + size -=2 ; + } +} +/* * Emit function prologue *
@@ -1503,7 +1521,14 @@ static bool bpf_is_new_addr_sane(struct bpf_jit *jit, int i)*/ static int bpf_set_addr (struct bpf_jit *jit,int i) { -if (!bpf_is_new_addr_sane (jit, i)) +int delta; + +if (is_codegen_pass (jit)) { + delta = jit->prg - jit->addrs[i]; +if (delta <0 ) +bpf_skip (jit, -delta); + } +if (WARN_ON_ONCE (!bpf_is_new_addr_sane (jit, i)))return -1 ; jit->addrs[i] = jit->prg;return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 277/464 tools/bpftool: Fix error handing in do_skeleton()
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
[ Upstream commit 956fcfcd359512f15b19bcd157fa8206ed26605b ]
Fix pass 0 to PTR_ERR, also dump more err info using libbpf_strerror.
--- tools/bpf/bpftool/gen.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/bpf/bpftool/gen.c +4 -1
@@ -305,8 +305,11 @@ static int do_skeleton(int argc, char **argv) opts.object_name = obj_name; obj =bpf_object__open_mem (obj_data, file_sz, &opts);if (IS_ERR (obj)) { +char err_buf[256 ]; + +libbpf_strerror (PTR_ERR (obj), err_buf,sizeof (err_buf)); +p_err ("failed to open BPF object file: %s" , err_buf); obj =NULL ; -p_err ("failed to open BPF object file: %ld" ,PTR_ERR (obj)); goto out; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 278/464 ASoC: tas2770: Fix reset gpio property name
In reply to Greg Kroah-HartmanFrom: Dan Murphy <[email protected]>
[ Upstream commit 58b868f51d6e38146e44cb09fcd92b5fc35d83bc ]
Fix the reset property name when allocating the GPIO descriptor. The gpiod_get_optional appends either the -gpio or -gpios suffix to the name.
--- sound/soc/codecs/tas2770.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/codecs/tas2770.c +1 -2
@@ -758,8 +758,7 @@ static int tas2770_i2c_probe(struct i2c_client *client, } } - tas2770->reset_gpio =devm_gpiod_get_optional (tas2770->dev, -"reset-gpio" , + tas2770->reset_gpio =devm_gpiod_get_optional (tas2770->dev,"reset" ,GPIOD_OUT_HIGH );if (IS_ERR (tas2770->reset_gpio)) {if (PTR_ERR (tas2770->reset_gpio) == -EPROBE_DEFER ) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 279/464 qed: Fix ILT and XRCD bitmap memory leaks
In reply to Greg Kroah-HartmanFrom: Yuval Basson <[email protected]>
[ Upstream commit d4eae993fc45398526aed683e225d6fa713f8ddf ]
- Free ILT lines used for XRC-SRQ's contexts.
- Free XRCD bitmap
--- drivers/net/ethernet/qlogic/qed/qed_cxt.c | 5 +++++ drivers/net/ethernet/qlogic/qed/qed_rdma.c | 1 + 2 files changed, 6 insertions(+)
drivers/net/ethernet/qlogic/qed/qed_cxt.c +5 -0
@@ -2355,6 +2355,11 @@ qed_cxt_free_ilt_range(struct qed_hwfn *p_hwfn, elem_size =SRQ_CXT_SIZE ; p_blk = &p_cli->pf_blks[SRQ_BLK ];break ; +case QED_ELEM_XRC_SRQ : + p_cli = &p_hwfn->p_cxt_mngr->clients[ILT_CLI_TSDM ]; + elem_size =XRC_SRQ_CXT_SIZE ; + p_blk = &p_cli->pf_blks[SRQ_BLK ]; +break ;case QED_ELEM_TASK : p_cli = &p_hwfn->p_cxt_mngr->clients[ILT_CLI_CDUT ]; elem_size =TYPE1_TASK_CXT_SIZE (p_hwfn);
drivers/net/ethernet/qlogic/qed/qed_rdma.c +1 -0
@@ -404,6 +404,7 @@ static void qed_rdma_resc_free(struct qed_hwfn *p_hwfn)qed_rdma_bmap_free (p_hwfn, &p_hwfn->p_rdma_info->srq_map,1 );qed_rdma_bmap_free (p_hwfn, &p_hwfn->p_rdma_info->real_cid_map,1 );qed_rdma_bmap_free (p_hwfn, &p_hwfn->p_rdma_info->xrc_srq_map,1 ); +qed_rdma_bmap_free (p_hwfn, &p_hwfn->p_rdma_info->xrcd_map,1 );kfree (p_rdma_info->port);kfree (p_rdma_info->dev);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 280/464 ASoC: hdac_hda: fix deadlock after PCM open error
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
[ Upstream commit 06f07e2365378d51eddd0b5bf23506e1237662b0 ]
Commit 5bd70440cb0a ("ASoC: soc-dai: revert all changes to DAI startup/shutdown sequence"), introduced a slight change of semantics to DAI startup/shutdown. If startup() returns an error, shutdown() is now called for the DAI.
This causes a deadlock in hdac_hda which issues a call to snd_hda_codec_pcm_put() in case open fails. Upon error, soc_pcm_open() will call shutdown(), and pcm_put() ends up getting called twice. Result is a deadlock on pcm->open_mutex, as snd_device_free() gets called from within snd_pcm_open(). Typical task backtrace looks like this:
[ 334.244627] snd_pcm_dev_disconnect+0x49/0x340 [snd_pcm] [ 334.244634] __snd_device_disconnect.part.0+0x2c/0x50 [snd] [ 334.244640] __snd_device_free+0x7f/0xc0 [snd] [ 334.244650] snd_hda_codec_pcm_put+0x87/0x120 [snd_hda_codec] [ 334.244660] soc_pcm_open+0x6a0/0xbe0 [snd_soc_core] [ 334.244676] ? dpcm_add_paths.isra.0+0x491/0x590 [snd_soc_core] [ 334.244679] ? kfree+0x9a/0x230 [ 334.244686] dpcm_be_dai_startup+0x255/0x300 [snd_soc_core] [ 334.244695] dpcm_fe_dai_open+0x20e/0xf30 [snd_soc_core] [ 334.244701] ? snd_pcm_hw_rule_muldivk+0x110/0x110 [snd_pcm] [ 334.244709] ? dpcm_be_dai_startup+0x300/0x300 [snd_soc_core] [ 334.244714] ? snd_pcm_attach_substream+0x3c4/0x540 [snd_pcm] [ 334.244719] snd_pcm_open_substream+0x69a/0xb60 [snd_pcm] [ 334.244729] ? snd_pcm_release_substream+0x30/0x30 [snd_pcm] [ 334.244732] ? __mutex_lock_slowpath+0x10/0x10 [ 334.244736] snd_pcm_open+0x1b3/0x3c0 [snd_pcm]
--- sound/soc/codecs/hdac_hda.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
sound/soc/codecs/hdac_hda.c +1 -6
@@ -289,7 +289,6 @@ static int hdac_hda_dai_open(struct snd_pcm_substream *substream,struct hdac_hda_priv *hda_pvt;struct hda_pcm_stream *hda_stream;struct hda_pcm *pcm; -int ret; hda_pvt =snd_soc_component_get_drvdata (component); pcm =snd_soc_find_pcm_from_dai (hda_pvt, dai);
@@ -300,11 +299,7 @@ static int hdac_hda_dai_open(struct snd_pcm_substream *substream, hda_stream = &pcm->stream[substream->stream]; - ret = hda_stream->ops.open (hda_stream, &hda_pvt->codec, substream); -if (ret <0 ) -snd_hda_codec_pcm_put (pcm); - -return ret; +return hda_stream->ops.open (hda_stream, &hda_pvt->codec, substream); } static void hdac_hda_dai_close(struct snd_pcm_substream *substream,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 281/464 powerpc/spufs: Fix the type of ret in spufs_arch_write_note
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 7c7ff885c7bce40a487e41c68f1dac14dd2c8033 ]
Both the ->dump method and snprintf return an int. So switch to an int and properly handle errors from ->dump.
--- arch/powerpc/platforms/cell/spufs/coredump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/cell/spufs/coredump.c +1 -1
@@ -105,7 +105,7 @@ static int spufs_arch_write_note(struct spu_context *ctx, int i,size_t sz = spufs_coredump_read[i].size;char fullname[80 ];struct elf_note en; -size_t ret; +int ret;sprintf (fullname,"SPU/%d/%s" , dfd, spufs_coredump_read[i].name); en.n_namesz =strlen (fullname) +1 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 282/464 PCI: rcar: Fix runtime PM imbalance on error
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit a68e06e729b1b06c50ee52917d6b825b43e7d269 ]
pm_runtime_get_sync() increments the runtime PM usage counter even when the call returns an error code. Thus a corresponding decrement is needed on the error handling path to keep the counter balanced.
--- drivers/pci/controller/pcie-rcar-host.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/pci/controller/pcie-rcar-host.c +1 -3
@@ -986,7 +986,7 @@ static int rcar_pcie_probe(struct platform_device *pdev) err =pm_runtime_get_sync (pcie->dev);if (err <0 ) {dev_err (pcie->dev,"pm_runtime_get_sync failed\n" ); - goto err_pm_disable; + goto err_pm_put; } err =rcar_pcie_get_resources (host);
@@ -1057,8 +1057,6 @@ static int rcar_pcie_probe(struct platform_device *pdev) err_pm_put:pm_runtime_put (dev); - -err_pm_disable:pm_runtime_disable (dev);pci_free_resource_list (&host->resources);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 283/464 MIPS: OCTEON: add missing put_device() call in dwc3_octeon_device_init()
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit e8b9fc10f2615b9a525fce56981e40b489528355 ]
if of_find_device_by_node() succeed, dwc3_octeon_device_init() doesn't have a corresponding put_device(). Thus add put_device() to fix the exception handling for this function implementation.
--- arch/mips/cavium-octeon/octeon-usb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/mips/cavium-octeon/octeon-usb.c +4 -1
@@ -518,6 +518,7 @@ static int __init dwc3_octeon_device_init(void) res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );if (res ==NULL ) { +put_device (&pdev->dev);dev_err (&pdev->dev,"No memory resources\n" );return -ENXIO ; }
@@ -529,8 +530,10 @@ static int __init dwc3_octeon_device_init(void)* know the difference. */ base =devm_ioremap_resource (&pdev->dev, res); -if (IS_ERR (base)) +if (IS_ERR (base)) { +put_device (&pdev->dev);return PTR_ERR (base); + }mutex_lock (&dwc3_octeon_clocks_mutex);dwc3_octeon_clocks_start (&pdev->dev, (u64 )base);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 284/464 thermal: int340x: processor_thermal: fix: update Jasper Lake PCI id
In reply to Greg Kroah-HartmanFrom: Sumeet Pawnikar <[email protected]>
[ Upstream commit 287d959558357e155c889bc35579eb35691a8fcb ]
Update PCI device id for Jasper Lake processor thermal device. With this proc_thermal driver is getting loaded and processor thermal functionality works on Jasper Lake system.
--- .../thermal/intel/int340x_thermal/processor_thermal_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thermal/intel/int340x_thermal/processor_thermal_device.c +1 -1
@@ -43,7 +43,7 @@#define PCI_DEVICE_ID_PROC_ICL_THERMAL 0x8a03/* JasperLake thermal reporting device */ -#define PCI_DEVICE_ID_PROC_JSL_THERMAL 0x4503 +#define PCI_DEVICE_ID_PROC_JSL_THERMAL 0x4E03/* TigerLake thermal reporting device */ #define PCI_DEVICE_ID_PROC_TGL_THERMAL 0x9A03
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 285/464 usb: dwc3: meson-g12a: fix shared reset control use
In reply to Greg Kroah-HartmanFrom: Dan Robertson <[email protected]>
[ Upstream commit 7a410953d1fb4dbe91ffcfdee9cbbf889d19b0d7 ]
The reset is a shared reset line, but reset_control_reset is still used and reset_control_deassert is not guaranteed to have been called before the first reset_control_assert call. When suspending the following warning may be seen:
WARNING: CPU: 1 PID: 5530 at drivers/reset/core.c:355 reset_control_assert+0x184/0x19c Hardware name: Hardkernel ODROID-N2 (DT) [..] pc : reset_control_assert+0x184/0x19c lr : dwc3_meson_g12a_suspend+0x68/0x7c [..] Call trace: reset_control_assert+0x184/0x19c dwc3_meson_g12a_suspend+0x68/0x7c platform_pm_suspend+0x28/0x54 __device_suspend+0x590/0xabc dpm_suspend+0x104/0x404 dpm_suspend_start+0x84/0x1bc suspend_devices_and_enter+0xc4/0x4fc pm_suspend+0x198/0x2d4
--- drivers/usb/dwc3/dwc3-meson-g12a.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/usb/dwc3/dwc3-meson-g12a.c +9 -6
@@ -737,13 +737,13 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev) goto err_disable_clks; } - ret =reset_control_reset (priv->reset); + ret =reset_control_deassert (priv->reset);if (ret) - goto err_disable_clks; + goto err_assert_reset; ret =dwc3_meson_g12a_get_phys (priv);if (ret) - goto err_disable_clks; + goto err_assert_reset; ret = priv->drvdata->setup_regmaps (priv, base);if (ret)
@@ -752,7 +752,7 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)if (priv->vbus) { ret =regulator_enable (priv->vbus);if (ret) - goto err_disable_clks; + goto err_assert_reset; }/* Get dr_mode */
@@ -765,13 +765,13 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev) ret = priv->drvdata->usb_init (priv);if (ret) - goto err_disable_clks; + goto err_assert_reset;/* Init PHYs */ for (i =0 ; i <PHY_COUNT ; ++i) { ret =phy_init (priv->phys[i]);if (ret) - goto err_disable_clks; + goto err_assert_reset; }/* Set PHY Power */
@@ -809,6 +809,9 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)for (i =0 ; i <PHY_COUNT ; ++i)phy_exit (priv->phys[i]); +err_assert_reset: +reset_control_assert (priv->reset); + err_disable_clks:clk_bulk_disable_unprepare (priv->drvdata->num_clks, priv->drvdata->clks);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 286/464 usb: dwc2: Fix error path in gadget registration
In reply to Greg Kroah-HartmanFrom: Marek Szyprowski <[email protected]>
[ Upstream commit 33a06f1300a79cfd461cea0268f05e969d4f34ec ]
When gadget registration fails, one should not call usb_del_gadget_udc(). Ensure this by setting gadget->udc to NULL. Also in case of a failure there is no need to disable low-level hardware, so return immiedetly instead of jumping to error_init label.
This fixes the following kernel NULL ptr dereference on gadget failure (can be easily triggered with g_mass_storage without any module parameters):
dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter besl=1 dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter g_np_tx_fifo_size=1024 dwc2 12480000.hsotg: EPs: 16, dedicated fifos, 7808 entries in SPRAM Mass Storage Function, version: 2009/09/11
LUN: removable file: (no medium)
no file given for LUN0g_mass_storage 12480000.hsotg: failed to start g_mass_storage: -22 8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000104 pgd = (ptrval) [00000104] *pgd=00000000 Internal error: Oops: 805 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.8.0-rc5 #3133 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue: events deferred_probe_work_func PC is at usb_del_gadget_udc+0x38/0xc4 LR is at __mutex_lock+0x31c/0xb18 ... Process kworker/0:1 (pid: 12, stack limit = 0x(ptrval)) Stack: (0xef121db0 to 0xef122000)
...
[<c076bf3c>] (usb_del_gadget_udc) from [<c0726bec>] (dwc2_hsotg_remove+0x10/0x20) [<c0726bec>] (dwc2_hsotg_remove) from [<c0711208>] (dwc2_driver_probe+0x57c/0x69c) [<c0711208>] (dwc2_driver_probe) from [<c06247c0>] (platform_drv_probe+0x6c/0xa4) [<c06247c0>] (platform_drv_probe) from [<c0621df4>] (really_probe+0x200/0x48c) [<c0621df4>] (really_probe) from [<c06221e8>] (driver_probe_device+0x78/0x1fc) [<c06221e8>] (driver_probe_device) from [<c061fcd4>] (bus_for_each_drv+0x74/0xb8) [<c061fcd4>] (bus_for_each_drv) from [<c0621b54>] (__device_attach+0xd4/0x16c) [<c0621b54>] (__device_attach) from [<c0620c98>] (bus_probe_device+0x88/0x90) [<c0620c98>] (bus_probe_device) from [<c06211b0>] (deferred_probe_work_func+0x3c/0xd0) [<c06211b0>] (deferred_probe_work_func) from [<c0149280>] (process_one_work+0x234/0x7dc) [<c0149280>] (process_one_work) from [<c014986c>] (worker_thread+0x44/0x51c) [<c014986c>] (worker_thread) from [<c0150b1c>] (kthread+0x158/0x1a0) [<c0150b1c>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20)
Exception stack(0xef121fb0 to 0xef121ff8) ... ---[ end trace 9724c2fc7cc9c982 ]---
While fixing this also fix the double call to dwc2_lowlevel_hw_disable() if dr_mode is set to USB_DR_MODE_PERIPHERAL. In such case low-level hardware is already disabled before calling usb_add_gadget_udc(). That function correctly preserves low-level hardware state, there is no need for the second unconditional dwc2_lowlevel_hw_disable() call.
--- drivers/usb/dwc2/platform.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/dwc2/platform.c +3 -1
@@ -582,6 +582,7 @@ static int dwc2_driver_probe(struct platform_device *dev)if (hsotg->gadget_enabled) { retval =usb_add_gadget_udc (hsotg->dev, &hsotg->gadget);if (retval) { + hsotg->gadget.udc =NULL ;dwc2_hsotg_remove (hsotg); goto error_init; }
@@ -593,7 +594,8 @@ static int dwc2_driver_probe(struct platform_device *dev)if (hsotg->params.activate_stm_id_vb_detection)regulator_disable (hsotg->usb33d); error: -dwc2_lowlevel_hw_disable (hsotg); +if (hsotg->dr_mode !=USB_DR_MODE_PERIPHERAL ) +dwc2_lowlevel_hw_disable (hsotg);return retval; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 287/464 usb: gadget: f_uac2: fix AC Interface Header Descriptor wTotalLength
In reply to Greg Kroah-HartmanFrom: Ruslan Bilovol <[email protected]>
[ Upstream commit a9cf8715180b18c62addbfe6f6267b8101903119 ]
As per UAC2 spec (ch. 4.7.2), wTotalLength of AC Interface Header Descriptor "includes the combined length of this descriptor header and all Clock Source, Unit and Terminal descriptors."
Thus add its size to its wTotalLength.
Also after recent changes wTotalLength is calculated dynamically, update static definition of uac2_ac_header_descriptor accordingly
--- drivers/usb/gadget/function/f_uac2.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/usb/gadget/function/f_uac2.c +2 -5
@@ -215,10 +215,7 @@ static struct uac2_ac_header_descriptor ac_hdr_desc = { .bDescriptorSubtype = UAC_MS_HEADER, .bcdADC = cpu_to_le16(0x200), .bCategory = UAC2_FUNCTION_IO_BOX, - .wTotalLength =cpu_to_le16 (sizeof in_clk_src_desc - +sizeof out_clk_src_desc +sizeof usb_out_it_desc - +sizeof io_in_it_desc +sizeof usb_in_ot_desc - + sizeof io_out_ot_desc), + /* .wTotalLength = DYNAMIC */ .bmControls = 0, };
@@ -501,7 +498,7 @@ static void setup_descriptor(struct f_uac2_opts *opts) as_in_hdr_desc.bTerminalLink = usb_in_ot_desc.bTerminalID; iad_desc.bInterfaceCount =1 ; - ac_hdr_desc.wTotalLength =0 ; + ac_hdr_desc.wTotalLength =cpu_to_le16 (sizeof (ac_hdr_desc));if (EPIN_EN (opts)) {u16 len =le16_to_cpu (ac_hdr_desc.wTotalLength);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 288/464 scsi: megaraid_sas: Clear affinity hint
In reply to Greg Kroah-HartmanFrom: Tomas Henzl <[email protected]>
[ Upstream commit 1eb81df5c53b1e785fdef298d533feab991381e4 ]
To avoid a warning in free_irq, clear the affinity hint.
--- drivers/scsi/megaraid/megaraid_sas_base.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/scsi/megaraid/megaraid_sas_base.c +8 -1
@@ -5602,9 +5602,13 @@ megasas_setup_irqs_msix(struct megasas_instance *instance, u8 is_probe) &instance->irq_context[i])) {dev_err (&instance->pdev->dev,"Failed to register IRQ for vector %d.\n" , i); -for (j =0 ; j < i; j++) +for (j =0 ; j < i; j++) { +if (j < instance->low_latency_index_start) +irq_set_affinity_hint ( +pci_irq_vector (pdev, j),NULL );free_irq (pci_irq_vector (pdev, j), &instance->irq_context[j]); + }/* Retry irq register for IO_APIC*/ instance->msix_vectors =0 ; instance->msix_load_balance = false;
@@ -5642,6 +5646,9 @@ megasas_destroy_irqs(struct megasas_instance *instance) {if (instance->msix_vectors)for (i =0 ; i < instance->msix_vectors; i++) { +if (i < instance->low_latency_index_start) +irq_set_affinity_hint ( +pci_irq_vector (instance->pdev, i),NULL );free_irq (pci_irq_vector (instance->pdev, i), &instance->irq_context[i]); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 289/464 scsi: mesh: Fix panic after host or bus reset
In reply to Greg Kroah-HartmanFrom: Finn Thain <[email protected]>
[ Upstream commit edd7dd2292ab9c3628b65c4d04514c3068ad54f6 ]
Booting Linux with a Conner CP3200 drive attached to the MESH SCSI bus results in EH measures and a panic:
[ 25.499838] mesh: configured for synchronous 5 MB/s [ 25.787154] mesh: performing initial bus reset... [ 29.867115] scsi host0: MESH [ 29.929527] mesh: target 0 synchronous at 3.6 MB/s [ 29.998763] scsi 0:0:0:0: Direct-Access CONNER CP3200-200mb-3.5 4040 PQ: 0 ANSI: 1 CCS [ 31.989975] sd 0:0:0:0: [sda] 415872 512-byte logical blocks: (213 MB/203 MiB) [ 32.070975] sd 0:0:0:0: [sda] Write Protect is off [ 32.137197] sd 0:0:0:0: [sda] Mode Sense: 5b 00 00 08 [ 32.209661] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA [ 32.332708] sda: [mac] sda1 sda2 sda3 [ 32.417733] sd 0:0:0:0: [sda] Attached SCSI disk ... snip ... [ 76.687067] mesh_abort((ptrval)) [ 76.743606] mesh: state at (ptrval), regs at (ptrval), dma at (ptrval) [ 76.810798] ct=6000 seq=86 bs=4017 fc= 0 exc= 0 err= 0 im= 7 int= 0 sp=85 [ 76.880720] dma stat=84e0 cmdptr=1f73d000 [ 76.941387] phase=4 msgphase=0 conn_tgt=0 data_ptr=24576 [ 77.005567] dma_st=1 dma_ct=0 n_msgout=0 [ 77.065456] target 0: req=(ptrval) goes_out=0 saved_ptr=0 [ 77.130512] mesh_abort((ptrval)) [ 77.187670] mesh: state at (ptrval), regs at (ptrval), dma at (ptrval) [ 77.255594] ct=6000 seq=86 bs=4017 fc= 0 exc= 0 err= 0 im= 7 int= 0 sp=85 [ 77.325778] dma stat=84e0 cmdptr=1f73d000 [ 77.387239] phase=4 msgphase=0 conn_tgt=0 data_ptr=24576 [ 77.453665] dma_st=1 dma_ct=0 n_msgout=0 [ 77.515900] target 0: req=(ptrval) goes_out=0 saved_ptr=0 [ 77.582902] mesh_host_reset [ 88.187083] Kernel panic - not syncing: mesh: double DMA start ! [ 88.254510] CPU: 0 PID: 358 Comm: scsi_eh_0 Not tainted 5.6.13-pmac #1 [ 88.323302] Call Trace: [ 88.378854] [e16ddc58] [c0027080] panic+0x13c/0x308 (unreliable) [ 88.446221] [e16ddcb8] [c02b2478] mesh_start.part.12+0x130/0x414 [ 88.513298] [e16ddcf8] [c02b2fc8] mesh_queue+0x54/0x70 [ 88.577097] [e16ddd18] [c02a1848] scsi_send_eh_cmnd+0x374/0x384 [ 88.643476] [e16dddc8] [c02a1938] scsi_eh_tur+0x5c/0xb8 [ 88.707878] [e16dddf8] [c02a1ab8] scsi_eh_test_devices+0x124/0x178 [ 88.775663] [e16dde28] [c02a2094] scsi_eh_ready_devs+0x588/0x8a8 [ 88.843124] [e16dde98] [c02a31d8] scsi_error_handler+0x344/0x520 [ 88.910697] [e16ddf08] [c00409c8] kthread+0xe4/0xe8 [ 88.975166] [e16ddf38] [c000f234] ret_from_kernel_thread+0x14/0x1c [ 89.044112] Rebooting in 180 seconds..
In theory, a panic can happen after a bus or host reset with dma_started flag set. Fix this by halting the DMA before reinitializing the host. Don't assume that ms->current_req is set when halt_dma() is invoked as it may not hold for bus or host reset.
BTW, this particular Conner drive can be made to work by inhibiting disconnect/reselect with 'mesh.resel_targets=0'.
--- drivers/scsi/mesh.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/scsi/mesh.c +7 -1
@@ -1045,6 +1045,8 @@ static void handle_error(struct mesh_state *ms)while ((in_8 (&mr->bus_status1) &BS1_RST ) !=0 )udelay (1 );printk ("done\n" ); +if (ms->dma_started) +halt_dma (ms);handle_reset (ms);/* request_q is empty, no point in mesh_start() */ return ;
@@ -1357,7 +1359,8 @@ static void halt_dma(struct mesh_state *ms) ms->conn_tgt, ms->data_ptr,scsi_bufflen (cmd), ms->tgts[ms->conn_tgt].data_goes_out); } -scsi_dma_unmap (cmd); +if (cmd) +scsi_dma_unmap (cmd); ms->dma_started =0 ; }
@@ -1712,6 +1715,9 @@ static int mesh_host_reset(struct scsi_cmnd *cmd)spin_lock_irqsave (ms->host->host_lock, flags); +if (ms->dma_started) +halt_dma (ms); +/* Reset the controller & dbdma channel */ out_le32 (&md->control, (RUN |PAUSE |FLUSH |WAKE ) <<16 );/* stop dma */ out_8 (&mr->exception,0xff );/* clear all exception bits */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 290/464 scsi: core: Add missing scsi_device_put() in scsi_host_block()
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
[ Upstream commit f30785db7546520acd53aac7497d42352ff031e0 ]
The scsi_host_block() case was missing in commit 4dea170f4fb2 ("scsi: core:
Fix incorrect usage of shost_for_each_device").
--- drivers/scsi/scsi_lib.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/scsi_lib.c +3 -1
@@ -2841,8 +2841,10 @@ scsi_host_block(struct Scsi_Host *shost)mutex_lock (&sdev->state_mutex); ret =scsi_internal_device_block_nowait (sdev);mutex_unlock (&sdev->state_mutex); -if (ret) +if (ret) { +scsi_device_put (sdev);break ; + } }/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 291/464 net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration
In reply to Greg Kroah-HartmanFrom: Chris Packham <[email protected]>
[ Upstream commit 0f3c66a3c7b4e8b9f654b3c998e9674376a51b0f ]
The MV88E6097 chip does not support configuring jumbo frames. Prior to commit 5f4366660d65 only the 6352, 6351, 6165 and 6320 chips configured jumbo mode. The refactor accidentally added the function for the 6097. Remove the erroneous function pointer assignment.
--- drivers/net/dsa/mv88e6xxx/chip.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/dsa/mv88e6xxx/chip.c +0 -1
@@ -3485,7 +3485,6 @@ static const struct mv88e6xxx_ops mv88e6097_ops = { .port_set_frame_mode = mv88e6351_port_set_frame_mode, .port_set_egress_floods = mv88e6352_port_set_egress_floods, .port_set_ether_type = mv88e6351_port_set_ether_type, - .port_set_jumbo_size = mv88e6165_port_set_jumbo_size, .port_egress_rate_limiting = mv88e6095_port_egress_rate_limiting, .port_pause_limit = mv88e6097_port_pause_limit, .port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 292/464 bpf: Fix pos computation for bpf_iter seq_ops->start()
In reply to Greg Kroah-HartmanFrom: Yonghong Song <[email protected]>
[ Upstream commit 3f9969f2c040ba2ba635b6b5a7051f404bcc634d ]
Currently, the pos pointer in bpf iterator map/task/task_file seq_ops->start() is always incremented.
This is incorrect. It should be increased only if *pos is 0 (for SEQ_START_TOKEN) since these start() function actually returns the first real object.
If *pos is not 0, it merely found the object
based on the state in seq->private, and not really advancing the *pos. This patch fixed this issue
by only incrementing *pos if it is 0.
Note that the old *pos calculation, although not correct, does not affect correctness of bpf_iter as bpf_iter seq_file->read() does not support llseek.
This patch also renamed "mid" in bpf_map iterator seq_file private data to "map_id" for better clarity.
--- kernel/bpf/map_iter.c | 16 ++++++---------- kernel/bpf/task_iter.c | 6 ++++-- 2 files changed, 10 insertions(+), 12 deletions(-)
kernel/bpf/map_iter.c +6 -10
@@ -6,7 +6,7 @@#include <linux/kernel.h> struct bpf_iter_seq_map_info { -u32 mid; +u32 map_id; };static void *bpf_map_seq_start (struct seq_file *seq,loff_t *pos)
@@ -14,27 +14,23 @@ static void *bpf_map_seq_start(struct seq_file *seq, loff_t *pos)struct bpf_iter_seq_map_info *info = seq->private;struct bpf_map *map; - map =bpf_map_get_curr_or_next (&info->mid); + map =bpf_map_get_curr_or_next (&info->map_id);if (!map)return NULL ; - ++*pos; +if (*pos ==0 ) + ++*pos;return map; }static void *bpf_map_seq_next (struct seq_file *seq,void *v,loff_t *pos) {struct bpf_iter_seq_map_info *info = seq->private; -struct bpf_map *map; ++*pos; - ++info->mid; + ++info->map_id;bpf_map_put ((struct bpf_map *)v); - map =bpf_map_get_curr_or_next (&info->mid); -if (!map) -return NULL ; - -return map; +return bpf_map_get_curr_or_next (&info->map_id); }struct bpf_iter__bpf_map {
kernel/bpf/task_iter.c +4 -2
@@ -50,7 +50,8 @@ static void *task_seq_start(struct seq_file *seq, loff_t *pos)if (!task)return NULL ; - ++*pos; +if (*pos ==0 ) + ++*pos;return task; }
@@ -209,7 +210,8 @@ static void *task_file_seq_start(struct seq_file *seq, loff_t *pos)return NULL ; } - ++*pos; +if (*pos ==0 ) + ++*pos; info->task = task; info->files = files;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 293/464 powerpc/watchpoint: Fix 512 byte boundary limit
In reply to Greg Kroah-HartmanFrom: Ravi Bangoria <[email protected]>
[ Upstream commit 3190ecbfeeb2ab17778887ce3fa964615d6460fd ]
Milton Miller reported that we are aligning start and end address to wrong size SZ_512M. It should be SZ_512. Fix that.
While doing this change I also found a case where ALIGN() comparison fails. Within a given aligned range, ALIGN() of two addresses does not match when start address is pointing to the first byte and end address is pointing to any other byte except the first one. But that's not true for ALIGN_DOWN(). ALIGN_DOWN() of any two addresses within that range will always point to the first byte. So use ALIGN_DOWN() instead of ALIGN().
--- arch/powerpc/kernel/hw_breakpoint.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/hw_breakpoint.c +1 -1
@@ -419,7 +419,7 @@ static int hw_breakpoint_validate_len(struct arch_hw_breakpoint *hw)if (dawr_enabled ()) { max_len =DAWR_MAX_LEN ;/* DAWR region can't cross 512 bytes boundary */ -if (ALIGN (start_addr,SZ_512M ) !=ALIGN (end_addr -1 ,SZ_512M )) +if (ALIGN_DOWN (start_addr,SZ_512 ) !=ALIGN_DOWN (end_addr -1 ,SZ_512 ))return -EINVAL ; }else if (IS_ENABLED (CONFIG_PPC_8xx)) {/* 8xx can setup a range without limitation */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 294/464 powerpc/watchpoint: Fix DAWR exception constraint
In reply to Greg Kroah-HartmanFrom: Ravi Bangoria <[email protected]>
[ Upstream commit f6780ce619f8daa285760302d56e95892087bd1f ]
Pedro Miraglia Franco de Carvalho noticed that on p8/p9, DAR value is inconsistent with different type of load/store. Like for byte,word etc. load/stores, DAR is set to the address of the first byte of overlap between watch range and real access. But for quadword load/ store it's sometime set to the address of the first byte of real access whereas sometime set to the address of the first byte of overlap. This issue has been fixed in p10. In p10(ISA 3.1), DAR is always set to the address of the first byte of overlap. Commit 27985b2a640e ("powerpc/watchpoint: Don't ignore extraneous exceptions blindly") wrongly assumes that DAR is set to the address of the first byte of overlap for all load/stores on p8/p9 as well. Fix that. With the fix, we now rely on 'ea' provided by analyse_instr(). If analyse_instr() fails, generate event unconditionally on p8/p9, and on p10 generate event only if DAR is within a DAWR range.
Note: 8xx is not affected.
--- arch/powerpc/kernel/hw_breakpoint.c | 72 ++++++++++++++++------------- 1 file changed, 41 insertions(+), 31 deletions(-)
arch/powerpc/kernel/hw_breakpoint.c +41 -31
@@ -498,11 +498,11 @@ static bool dar_in_user_range(unsigned long dar, struct arch_hw_breakpoint *inforeturn ((info->address <= dar) && (dar - info->address < info->len)); } -static bool dar_user_range_overlaps (unsigned long dar,int size, -struct arch_hw_breakpoint *info) +static bool ea_user_range_overlaps (unsigned long ea,int size, +struct arch_hw_breakpoint *info) { -return ((dar < info->address + info->len) && - (dar + size > info->address)); +return ((ea < info->address + info->len) && + (ea + size > info->address)); }static bool dar_in_hw_range (unsigned long dar,struct arch_hw_breakpoint *info)
@@ -515,20 +515,22 @@ static bool dar_in_hw_range(unsigned long dar, struct arch_hw_breakpoint *info)return ((hw_start_addr <= dar) && (hw_end_addr > dar)); } -static bool dar_hw_range_overlaps (unsigned long dar,int size, -struct arch_hw_breakpoint *info) +static bool ea_hw_range_overlaps (unsigned long ea,int size, +struct arch_hw_breakpoint *info) {unsigned long hw_start_addr, hw_end_addr; hw_start_addr =ALIGN_DOWN (info->address,HW_BREAKPOINT_SIZE ); hw_end_addr =ALIGN (info->address + info->len,HW_BREAKPOINT_SIZE ); -return ((dar < hw_end_addr) && (dar + size > hw_start_addr)); +return ((ea < hw_end_addr) && (ea + size > hw_start_addr)); }/* * If hw has multiple DAWR registers, we also need to check all * dawrx constraint bits to confirm this is _really_ a valid event. +* If type is UNKNOWN, but privilege level matches, consider it as +* a positive match. */ static bool check_dawrx_constraints (struct pt_regs *regs,int type,struct arch_hw_breakpoint *info)
@@ -553,7 +555,8 @@ static bool check_dawrx_constraints(struct pt_regs *regs, int type,* including extraneous exception. Otherwise return false. */ static bool check_constraints (struct pt_regs *regs,struct ppc_inst instr, -int type,int size,struct arch_hw_breakpoint *info) +unsigned long ea,int type,int size, +struct arch_hw_breakpoint *info) {bool in_user_range =dar_in_user_range (regs->dar, info);bool dawrx_constraints;
@@ -569,22 +572,27 @@ static bool check_constraints(struct pt_regs *regs, struct ppc_inst instr, }if (unlikely (ppc_inst_equal (instr,ppc_inst (0 )))) { -if (in_user_range) -return true; +if (cpu_has_feature (CPU_FTR_ARCH_31 ) && + !dar_in_hw_range (regs->dar, info)) +return false; -if (dar_in_hw_range (regs->dar, info)) { - info->type |=HW_BRK_TYPE_EXTRANEOUS_IRQ ; -return true; - } -return false; +return true; } dawrx_constraints =check_dawrx_constraints (regs, type, info); -if (dar_user_range_overlaps (regs->dar, size, info)) +if (type ==UNKNOWN ) { +if (cpu_has_feature (CPU_FTR_ARCH_31 ) && + !dar_in_hw_range (regs->dar, info)) +return false; +return dawrx_constraints; + } -if (dar_hw_range_overlaps (regs->dar, size, info)) { +if (ea_user_range_overlaps (ea, size, info)) +return dawrx_constraints; + +if (ea_hw_range_overlaps (ea, size, info)) {if (dawrx_constraints) { info->type |=HW_BRK_TYPE_EXTRANEOUS_IRQ ;return true;
@@ -594,7 +602,7 @@ static bool check_constraints(struct pt_regs *regs, struct ppc_inst instr, }static void get_instr_detail (struct pt_regs *regs,struct ppc_inst *instr, -int *type,int *size,bool *larx_stcx) +int *type,int *size,unsigned long *ea) {struct instruction_op op;
@@ -602,16 +610,18 @@ static void get_instr_detail(struct pt_regs *regs, struct ppc_inst *instr,return ;analyse_instr (&op, regs, *instr); - -/* -* Set size = 8 if analyse_instr() fails. If it's a userspace -* watchpoint(valid or extraneous), we can notify user about it. -* If it's a kernel watchpoint, instruction emulation will fail -* in stepping_handler() and watchpoint will be disabled. -*/ *type =GETTYPE (op.type); - *size = !(*type ==UNKNOWN ) ?GETSIZE (op.type) :8 ; - *larx_stcx = (*type ==LARX || *type ==STCX ); + *ea = op.ea; +#ifdef __powerpc64__ +if (!(regs->msr &MSR_64BIT )) + *ea &=0xffffffffUL ; +#endif + *size =GETSIZE (op.type); +} + +static bool is_larx_stcx_instr (int type) +{ +return type ==LARX || type ==STCX ; }/*
@@ -678,7 +688,7 @@ int hw_breakpoint_handler(struct die_args *args)struct ppc_inst instr =ppc_inst (0 );int type =0 ;int size =0 ; -bool larx_stcx = false; +unsigned long ea;/* Disable breakpoints during exception handling */ hw_breakpoint_disable ();
@@ -692,7 +702,7 @@ int hw_breakpoint_handler(struct die_args *args)rcu_read_lock ();if (!IS_ENABLED (CONFIG_PPC_8xx)) -get_instr_detail (regs, &instr, &type, &size, &larx_stcx); +get_instr_detail (regs, &instr, &type, &size, &ea);for (i =0 ; i <nr_wp_slots (); i++) { bp[i] =__this_cpu_read (bp_per_reg[i]);
@@ -702,7 +712,7 @@ int hw_breakpoint_handler(struct die_args *args) info[i] =counter_arch_bp (bp[i]); info[i]->type &= ~HW_BRK_TYPE_EXTRANEOUS_IRQ ; -if (check_constraints (regs, instr, type, size, info[i])) { +if (check_constraints (regs, instr, ea, type, size, info[i])) {if (!IS_ENABLED (CONFIG_PPC_8xx) &&ppc_inst_equal (instr,ppc_inst (0 ))) {handler_error (bp[i], info[i]);
@@ -744,7 +754,7 @@ int hw_breakpoint_handler(struct die_args *args) }if (!IS_ENABLED (CONFIG_PPC_8xx)) { -if (larx_stcx) { +if (is_larx_stcx_instr (type)) {for (i =0 ; i <nr_wp_slots (); i++) {if (!hit[i])continue ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 295/464 powerpc/watchpoint: Fix DAWR exception for CACHEOP
In reply to Greg Kroah-HartmanFrom: Ravi Bangoria <[email protected]>
[ Upstream commit f3c832f1350bcf1e6906113ee3168066f4235dbe ]
'ea' returned by analyse_instr() needs to be aligned down to cache block size for CACHEOP instructions. analyse_instr() does not set size for CACHEOP, thus size also needs to be calculated manually.
--- arch/powerpc/kernel/hw_breakpoint.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
arch/powerpc/kernel/hw_breakpoint.c +20 -1
@@ -538,7 +538,12 @@ static bool check_dawrx_constraints(struct pt_regs *regs, int type,if (OP_IS_LOAD (type) && !(info->type &HW_BRK_TYPE_READ ))return false; -if (OP_IS_STORE (type) && !(info->type &HW_BRK_TYPE_WRITE )) +/* +* The Cache Management instructions other than dcbz never +* cause a match. i.e. if type is CACHEOP, the instruction +* is dcbz, and dcbz is treated as Store. +*/ +if ((OP_IS_STORE (type) || type ==CACHEOP ) && !(info->type &HW_BRK_TYPE_WRITE ))return false;if (is_kernel_addr (regs->nip) && !(info->type &HW_BRK_TYPE_KERNEL ))
@@ -601,6 +606,15 @@ static bool check_constraints(struct pt_regs *regs, struct ppc_inst instr,return false; } +static int cache_op_size (void ) +{ +#ifdef __powerpc64__ +return ppc64_caches.l1d.block_size; +#else +return L1_CACHE_BYTES ; +#endif +} +static void get_instr_detail (struct pt_regs *regs,struct ppc_inst *instr,int *type,int *size,unsigned long *ea) {
@@ -616,7 +630,12 @@ static void get_instr_detail(struct pt_regs *regs, struct ppc_inst *instr,if (!(regs->msr &MSR_64BIT )) *ea &=0xffffffffUL ;#endif + *size =GETSIZE (op.type); +if (*type ==CACHEOP ) { + *size =cache_op_size (); + *ea &= ~(*size -1 ); + } }static bool is_larx_stcx_instr (int type)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 296/464 macintosh/via-macii: Access autopoll_devs when inside lock
In reply to Greg Kroah-HartmanFrom: Finn Thain <[email protected]>
[ Upstream commit 59ea38f6b3af5636edf541768a1ed721eeaca99e ]
The interrupt handler should be excluded when accessing the autopoll_devs variable.
--- drivers/macintosh/via-macii.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/macintosh/via-macii.c +3 -6
@@ -270,15 +270,12 @@ static int macii_autopoll(int devs)unsigned long flags;int err =0 ; +local_irq_save (flags); +/* bit 1 == device 1, and so on. */ autopoll_devs = devs &0xFFFE ; -if (!autopoll_devs) -return 0 ; - -local_irq_save (flags); - -if (current_req ==NULL ) { +if (autopoll_devs && !current_req) {/* Send a Talk Reg 0. The controller will repeatedly transmit * this as long as it is idle. */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 297/464 gpio: regmap: fix type clash
In reply to Greg Kroah-HartmanFrom: Michael Walle <[email protected]>
[ Upstream commit a070bdbbb06d7787ec7844a4f1e059cf8b55205d ]
GPIO_REGMAP_ADDR_ZERO() cast to unsigned long but the actual config parameters are unsigned int. We use unsigned int here because that is the type which is used by the underlying regmap.
--- include/linux/gpio/regmap.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/gpio/regmap.h +1 -1
@@ -8,7 +8,7 @@ struct gpio_regmap;struct irq_domain ;struct regmap ; -#define GPIO_REGMAP_ADDR_ZERO ((unsigned long)(-1)) +#define GPIO_REGMAP_ADDR_ZERO ((unsigned int)(-1))#define GPIO_REGMAP_ADDR (addr) ((addr) ? : GPIO_REGMAP_ADDR_ZERO)/**
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 298/464 PCI: hv: Fix a timing issue which causes kdump to fail occasionally
In reply to Greg Kroah-HartmanFrom: Wei Hu <[email protected]>
[ Upstream commit d6af2ed29c7c1c311b96dac989dcb991e90ee195 ]
Kdump could fail sometime on Hyper-V guest because the retry in hv_pci_enter_d0() releases child device structures in hv_pci_bus_exit().
Although there is a second asynchronous device relations message sending from the host, if this message arrives to the guest after hv_send_resource_allocated() is called, the retry would fail.
Fix the problem by moving retry to hv_pci_probe() and start the retry from hv_pci_query_relations() call. This will cause a device relations message to arrive to the guest synchronously; the guest would then be able to rebuild the child device structures before calling hv_send_resource_allocated().
--- drivers/pci/controller/pci-hyperv.c | 71 +++++++++++++++-------------- 1 file changed, 37 insertions(+), 34 deletions(-)
drivers/pci/controller/pci-hyperv.c +37 -34
@@ -2759,10 +2759,8 @@ static int hv_pci_enter_d0(struct hv_device *hdev)struct pci_bus_d0_entry *d0_entry;struct hv_pci_compl comp_pkt;struct pci_packet *pkt; -bool retry = true;int ret; -enter_d0_retry:/* * Tell the host that the bus is ready to use, and moved into the * powered-on state. This includes telling the host which region
@@ -2789,38 +2787,6 @@ static int hv_pci_enter_d0(struct hv_device *hdev)if (ret) goto exit; -/* -* In certain case (Kdump) the pci device of interest was -* not cleanly shut down and resource is still held on host -* side, the host could return invalid device status. -* We need to explicitly request host to release the resource -* and try to enter D0 again. -*/ -if (comp_pkt.completion_status <0 && retry) { - retry = false; - -dev_err (&hdev->device,"Retrying D0 Entry\n" ); - -/* -* Hv_pci_bus_exit() calls hv_send_resource_released() -* to free up resources of its child devices. -* In the kdump kernel we need to set the -* wslot_res_allocated to 255 so it scans all child -* devices to release resources allocated in the -* normal kernel before panic happened. -*/ - hbus->wslot_res_allocated =255 ; - - ret =hv_pci_bus_exit (hdev, true); - -if (ret ==0 ) { -kfree (pkt); - goto enter_d0_retry; - } -dev_err (&hdev->device, -"Retrying D0 failed with ret %d\n" , ret); - } -if (comp_pkt.completion_status <0 ) { dev_err(&hdev->device, "PCI Pass-through VSP failed D0 Entry with status %x\n",
@@ -3058,6 +3024,7 @@ static int hv_pci_probe(struct hv_device *hdev,struct hv_pcibus_device *hbus;u16 dom_req, dom;char *name; +bool enter_d0_retry = true;int ret;/*
@@ -3178,11 +3145,47 @@ static int hv_pci_probe(struct hv_device *hdev,if (ret) goto free_fwnode; +retry: ret =hv_pci_query_relations (hdev);if (ret) goto free_irq_domain; ret =hv_pci_enter_d0 (hdev); +/* +* In certain case (Kdump) the pci device of interest was +* not cleanly shut down and resource is still held on host +* side, the host could return invalid device status. +* We need to explicitly request host to release the resource +* and try to enter D0 again. +* Since the hv_pci_bus_exit() call releases structures +* of all its child devices, we need to start the retry from +* hv_pci_query_relations() call, requesting host to send +* the synchronous child device relations message before this +* information is needed in hv_send_resources_allocated() +* call later. +*/ +if (ret == -EPROTO && enter_d0_retry) { + enter_d0_retry = false; + +dev_err (&hdev->device,"Retrying D0 Entry\n" ); + +/* +* Hv_pci_bus_exit() calls hv_send_resources_released() +* to free up resources of its child devices. +* In the kdump kernel we need to set the +* wslot_res_allocated to 255 so it scans all child +* devices to release resources allocated in the +* normal kernel before panic happened. +*/ + hbus->wslot_res_allocated =255 ; + ret =hv_pci_bus_exit (hdev, true); + +if (ret ==0 ) + goto retry; + +dev_err (&hdev->device, +"Retrying D0 failed with ret %d\n" , ret); + }if (ret) goto free_irq_domain;
Signature · 1 line
2.25.1
RE: [PATCH 5.8 298/464] PCI: hv: Fix a timing issue which causes kdump to fail occasionally
From: Greg Kroah-Hartman <[email protected]> Sent: Monday, August 17, 2020 8:14 AM
Quoted 26 lines
From: Wei Hu <[email protected]>
[ Upstream commit
d6af2ed29c7c1c311b96dac989dcb991e90ee195]Kdump could fail sometime on Hyper-V guest because the retry in
hv_pci_enter_d0()releases child device structures inhv_pci_bus_exit().Although there is a second asynchronous device relations message sending from the host, if this message arrives to the guest after
hv_send_resource_allocated()is called, the retry would fail.Fix the problem by moving retry to
hv_pci_probe()and start the retry fromhv_pci_query_relations()call. This will cause a device relations message to arrive to the guest synchronously; the guest would then be able to rebuild the child device structures before callinghv_send_resource_allocated().Link:
https://lore.kernel.org/linux-hyperv/[email protected]/Fixes c81992e7f4aa ("PCI: hv: Retry PCI bus D0 entry on invalid device state")Signed-off-by Wei Hu <[email protected]>[[email protected]: fixed a comment and commit log]Signed-off-by Lorenzo Pieralisi <[email protected]>Reviewed-by Michael Kelley <[email protected]>Signed-off-by Sasha Levin <[email protected]>
Quoted 4 lines
--- drivers/pci/controller/pci-hyperv.c | 71 +++++++++++++++-------------- 1 file changed, 37 insertions(+), 34 deletions(-)
Greg --
Don't backport this patch to 5.8 and earlier. It doesn't break anything, but it doesn't fully accomplish what was intended either. As such it will probably need a revision in 5.9. Wei Hu is unavailable for a few days for personal reasons, so I'm jumping in here on his behalf.
Michael
Sasha Levin
maintainerRe: [PATCH 5.8 298/464] PCI: hv: Fix a timing issue which causes kdump to fail occasionally
Quoted 32 lines · Michael Kelley
From: Greg Kroah-Hartman <[email protected]> Sent: Monday, August 17, 2020 8:14 AM
Quoted 26 lines
From: Wei Hu <[email protected]>
[ Upstream commit
d6af2ed29c7c1c311b96dac989dcb991e90ee195]Kdump could fail sometime on Hyper-V guest because the retry in
hv_pci_enter_d0()releases child device structures inhv_pci_bus_exit().Although there is a second asynchronous device relations message sending from the host, if this message arrives to the guest after
hv_send_resource_allocated()is called, the retry would fail.Fix the problem by moving retry to
hv_pci_probe()and start the retry fromhv_pci_query_relations()call. This will cause a device relations message to arrive to the guest synchronously; the guest would then be able to rebuild the child device structures before callinghv_send_resource_allocated().Link:
https://lore.kernel.org/linux-hyperv/[email protected]/Fixes c81992e7f4aa ("PCI: hv: Retry PCI bus D0 entry on invalid device state")Signed-off-by Wei Hu <[email protected]>[[email protected]: fixed a comment and commit log]Signed-off-by Lorenzo Pieralisi <[email protected]>Reviewed-by Michael Kelley <[email protected]>Signed-off-by Sasha Levin <[email protected]>Quoted 4 lines
--- drivers/pci/controller/pci-hyperv.c | 71 +++++++++++++++-------------- 1 file changed, 37 insertions(+), 34 deletions(-)
Quoted 6 lines
Greg --
Don't backport this patch to 5.8 and earlier. It doesn't break anything, but it doesn't fully accomplish what was intended either. As such it will probably need a revision in 5.9. Wei Hu is unavailable for a few days for personal reasons, so I'm jumping in here on his behalf.
I've dropped it, will wait for the fix.
Signature · 2 lines
Thanks, Sasha
Greg Kroah-Hartman
maintainerPATCH 299/464 PCI: cadence: Fix cdns_pcie_{host|ep}_setup() error path
In reply to Greg Kroah-HartmanFrom: Kishon Vijay Abraham I <[email protected]>
[ Upstream commit 19abcd790b51b26d775e1170ba2ac086823cceeb ]
commit bd22885aa188 ("PCI: cadence: Refactor driver to use as a core library") while refactoring the Cadence PCIe driver to be used as library, removed pm_runtime_get_sync() from cdns_pcie_ep_setup() and cdns_pcie_host_setup() but missed to remove the corresponding pm_runtime_put_sync() in the error path. Fix it here.
--- drivers/pci/controller/cadence/pcie-cadence-ep.c | 9 ++------- drivers/pci/controller/cadence/pcie-cadence-host.c | 6 +----- 2 files changed, 3 insertions(+), 12 deletions(-)
drivers/pci/controller/cadence/pcie-cadence-ep.c +2 -7
@@ -8,7 +8,6 @@#include <linux/of.h> #include <linux/pci-epc.h> #include <linux/platform_device.h> -#include <linux/pm_runtime.h> #include <linux/sizes.h> #include "pcie-cadence.h"
@@ -440,8 +439,7 @@ int cdns_pcie_ep_setup(struct cdns_pcie_ep *ep) epc =devm_pci_epc_create (dev, &cdns_pcie_epc_ops);if (IS_ERR (epc)) {dev_err (dev,"failed to create epc device\n" ); - ret =PTR_ERR (epc); - goto err_init; +return PTR_ERR (epc); }epc_set_drvdata (epc, ep);
@@ -453,7 +451,7 @@ int cdns_pcie_ep_setup(struct cdns_pcie_ep *ep) resource_size(pcie->mem_res), PAGE_SIZE);if (ret <0 ) {dev_err (dev,"failed to initialize the memory space\n" ); - goto err_init; +return ret; } ep->irq_cpu_addr = pci_epc_mem_alloc_addr(epc, &ep->irq_phys_addr,
@@ -472,8 +470,5 @@ int cdns_pcie_ep_setup(struct cdns_pcie_ep *ep) free_epc_mem:pci_epc_mem_exit (epc); - err_init: -pm_runtime_put_sync (dev); -return ret; }
drivers/pci/controller/cadence/pcie-cadence-host.c +1 -5
@@ -7,7 +7,6 @@#include <linux/of_address.h> #include <linux/of_pci.h> #include <linux/platform_device.h> -#include <linux/pm_runtime.h> #include "pcie-cadence.h"
@@ -250,7 +249,7 @@ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc) ret =cdns_pcie_host_init (dev, &resources, rc);if (ret) - goto err_init; +return ret;list_splice_init (&resources, &bridge->windows); bridge->dev.parent = dev;
@@ -268,8 +267,5 @@ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc) err_host_probe:pci_free_resource_list (&resources); - err_init: -pm_runtime_put_sync (dev); -return ret; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 300/464 PCI: cadence: Fix updating Vendor ID and Subsystem Vendor ID register
In reply to Greg Kroah-HartmanFrom: Kishon Vijay Abraham I <[email protected]>
[ Upstream commit e3bca37d15dca118f2ef1f0a068bb6e07846ea20 ]
Commit 1b79c5284439 ("PCI: cadence: Add host driver for Cadence PCIe controller") in order to update Vendor ID, directly wrote to PCI_VENDOR_ID register. However PCI_VENDOR_ID in root port configuration space is read-only register and writing to it will have no effect. Use local management register to configure Vendor ID and Subsystem Vendor ID.
--- drivers/pci/controller/cadence/pcie-cadence-host.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/pci/controller/cadence/pcie-cadence-host.c +7 -2
@@ -69,6 +69,7 @@ static int cdns_pcie_host_init_root_port(struct cdns_pcie_rc *rc) {struct cdns_pcie *pcie = &rc->pcie;u32 value, ctrl; +u32 id;/* * Set the root complex BAR configuration register:
@@ -88,8 +89,12 @@ static int cdns_pcie_host_init_root_port(struct cdns_pcie_rc *rc)cdns_pcie_writel (pcie,CDNS_PCIE_LM_RC_BAR_CFG , value);/* Set root port configuration space */ -if (rc->vendor_id !=0xffff ) -cdns_pcie_rp_writew (pcie,PCI_VENDOR_ID , rc->vendor_id); +if (rc->vendor_id !=0xffff ) { + id =CDNS_PCIE_LM_ID_VENDOR (rc->vendor_id) | +CDNS_PCIE_LM_ID_SUBSYS (rc->vendor_id); +cdns_pcie_writel (pcie,CDNS_PCIE_LM_ID , id); + } +if (rc->device_id !=0xffff )cdns_pcie_rp_writew (pcie,PCI_DEVICE_ID , rc->device_id);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 301/464 RDMA/core: Fix return error value in _ib_modify_qp() to negative
In reply to Greg Kroah-HartmanFrom: Li Heng <[email protected]>
[ Upstream commit 47fda651d5af2506deac57d54887cf55ce26e244 ]
The error codes in _ib_modify_qp() are supposed to be negative errno.
--- drivers/infiniband/core/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/verbs.c +1 -1
@@ -1712,7 +1712,7 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr,if (!(rdma_protocol_ib (qp->device, attr->alt_ah_attr.port_num) &&rdma_protocol_ib (qp->device, port))) { - ret =EINVAL ; + ret = -EINVAL ; goto out; } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 302/464 Smack: fix another vsscanf out of bounds
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit a6bd4f6d9b07452b0b19842044a6c3ea384b0b88 ]
This is similar to commit 84e99e58e8d1 ("Smack: slab-out-of-bounds in vsscanf") where we added a bounds check on "rule".
--- security/smack/smackfs.c | 4 ++++ 1 file changed, 4 insertions(+)
security/smack/smackfs.c +4 -0
@@ -905,6 +905,10 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,for (i =0 ; i < catlen; i++) { rule +=SMK_DIGITLEN ; +if (rule > data + count) { + rc = -EOVERFLOW ; + goto out; + } ret =sscanf (rule,"%u" , &cat);if (ret !=1 || cat >SMACK_CIPSO_MAXCATNUM ) goto out;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 303/464 Smack: prevent underflow in smk_set_cipso()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 42a2df3e829f3c5562090391b33714b2e2e5ad4a ]
We have an upper bound on "maplevel" but forgot to check for negative values.
--- security/smack/smackfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/smack/smackfs.c +1 -1
@@ -884,7 +884,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, } ret =sscanf (rule,"%d" , &maplevel); -if (ret !=1 || maplevel >SMACK_CIPSO_MAXLEVEL ) +if (ret !=1 || maplevel <0 || maplevel >SMACK_CIPSO_MAXLEVEL ) goto out; rule +=SMK_DIGITLEN ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 304/464 power: supply: check if calc_soc succeeded in pm860x_init_battery
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
[ Upstream commit ccf193dee1f0fff55b556928591f7818bac1b3b1 ]
clang static analysis flags this error
88pm860x_battery.c:522:19: warning: Assigned value is
garbage or undefined [core.uninitialized.Assign]
info->start_soc = soc;
^ ~~~soc is set by calling calc_soc.
But calc_soc can return without setting soc.
So check the return status and bail similarly to other checks in pm860x_init_battery and initialize soc to silence the warning.
--- drivers/power/supply/88pm860x_battery.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/power/supply/88pm860x_battery.c +4 -2
@@ -433,7 +433,7 @@ static void pm860x_init_battery(struct pm860x_battery_info *info)int ret;int data;int bat_remove; -int soc; +int soc =0 ;/* measure enable on GPADC1 */ data =MEAS1_GP1 ;
@@ -496,7 +496,9 @@ static void pm860x_init_battery(struct pm860x_battery_info *info) }mutex_unlock (&info->lock); -calc_soc (info,OCV_MODE_ACTIVE , &soc); + ret =calc_soc (info,OCV_MODE_ACTIVE , &soc); +if (ret <0 ) + goto out; data =pm860x_reg_read (info->i2c,PM8607_POWER_UP_LOG ); bat_remove = data &BAT_WU_LOG ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 305/464 Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers
In reply to Greg Kroah-HartmanFrom: Ismael Ferreras Morezuelas <[email protected]>
[ Upstream commit cde1a8a992875a7479c4321b2a4a190c2e92ec2a ]
For some reason they tend to squat on the very first CSR/ Cambridge Silicon Radio VID/PID instead of paying fees.
This is an extremely common problem; the issue goes as back as 2013 and these devices are only getting more popular, even rebranded by reputable vendors and sold by retailers everywhere.
So, at this point in time there are hundreds of modern dongles reusing the ID of what originally was an early Bluetooth 1.1 controller.
Linux is the only place where they don't work due to spotty checks in our detection code. It only covered a minimum subset.
So what's the big idea? Take advantage of the fact that all CSR chips report the same internal version as both the LMP sub-version and HCI revision number. It always matches, couple that with the manufacturer code, that rarely lies, and we now have a good idea of who is who.
Additionally, by compiling a list of user-reported HCI/lsusb dumps, and searching around for legit CSR dongles in similar product ranges we can find what CSR BlueCore firmware supported which Bluetooth versions.
That way we can narrow down ranges of fakes for each of them.
e.g. Real CSR dongles with LMP subversion 0x73 are old enough that
support BT 1.1 only; so it's a dead giveaway when some third-party BT 4.0 dongle reuses it.
So, to sum things up; there are multiple classes of fake controllers reusing the same 0A12:0001 VID/PID. This has been broken for a while.
Known 'fake' bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891
IC markings on 0x7558: FR3191AHAL 749H15143 (???)
https://bugzilla.kernel.org/show_bug.cgi?id=60824
--- drivers/bluetooth/btusb.c | 74 ++++++++++++++++++++++++++----- include/net/bluetooth/bluetooth.h | 2 + include/net/bluetooth/hci.h | 11 +++++ net/bluetooth/hci_core.c | 6 ++- 4 files changed, 81 insertions(+), 12 deletions(-)
drivers/bluetooth/btusb.c +64 -10
@@ -1720,6 +1720,7 @@ static int btusb_setup_csr(struct hci_dev *hdev) {struct hci_rp_read_local_version *rp;struct sk_buff *skb; +bool is_fake = false;BT_DBG ("%s" , hdev->name);
@@ -1739,18 +1740,69 @@ static int btusb_setup_csr(struct hci_dev *hdev) rp = (struct hci_rp_read_local_version *)skb->data; -/* Detect controllers which aren't real CSR ones. */ +/* Detect a wide host of Chinese controllers that aren't CSR. +* +* Known fake bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891 +* +* The main thing they have in common is that these are really popular low-cost +* options that support newer Bluetooth versions but rely on heavy VID/PID +* squatting of this poor old Bluetooth 1.1 device. Even sold as such. +* +* We detect actual CSR devices by checking that the HCI manufacturer code +* is Cambridge Silicon Radio (10) and ensuring that LMP sub-version and +* HCI rev values always match. As they both store the firmware number. +*/ if (le16_to_cpu (rp->manufacturer) !=10 || -le16_to_cpu (rp->lmp_subver) ==0x0c5c ) { +le16_to_cpu (rp->hci_rev) !=le16_to_cpu (rp->lmp_subver)) + is_fake = true; + +/* Known legit CSR firmware build numbers and their supported BT versions: +* - 1.1 (0x1) -> 0x0073, 0x020d, 0x033c, 0x034e +* - 1.2 (0x2) -> 0x04d9, 0x0529 +* - 2.0 (0x3) -> 0x07a6, 0x07ad, 0x0c5c +* - 2.1 (0x4) -> 0x149c, 0x1735, 0x1899 (0x1899 is a BlueCore4-External) +* - 4.0 (0x6) -> 0x1d86, 0x2031, 0x22bb +* +* e.g. Real CSR dongles with LMP subversion 0x73 are old enough that +* support BT 1.1 only; so it's a dead giveaway when some +* third-party BT 4.0 dongle reuses it. +*/ +else if (le16_to_cpu (rp->lmp_subver) <=0x034e && +le16_to_cpu (rp->hci_ver) >BLUETOOTH_VER_1_1 ) + is_fake = true; + +else if (le16_to_cpu (rp->lmp_subver) <=0x0529 && +le16_to_cpu (rp->hci_ver) >BLUETOOTH_VER_1_2 ) + is_fake = true; + +else if (le16_to_cpu (rp->lmp_subver) <=0x0c5c && +le16_to_cpu (rp->hci_ver) >BLUETOOTH_VER_2_0 ) + is_fake = true; + +else if (le16_to_cpu (rp->lmp_subver) <=0x1899 && +le16_to_cpu (rp->hci_ver) >BLUETOOTH_VER_2_1 ) + is_fake = true; + +else if (le16_to_cpu (rp->lmp_subver) <=0x22bb && +le16_to_cpu (rp->hci_ver) >BLUETOOTH_VER_4_0 ) + is_fake = true; + +if (is_fake) { +bt_dev_warn (hdev,"CSR: Unbranded CSR clone detected; adding workarounds..." ); + +/* Generally these clones have big discrepancies between +* advertised features and what's actually supported. +* Probably will need to be expanded in the future; +* without these the controller will lock up. +*/ +set_bit (HCI_QUIRK_BROKEN_STORED_LINK_KEY , &hdev->quirks); +set_bit (HCI_QUIRK_BROKEN_ERR_DATA_REPORTING , &hdev->quirks); +/* Clear the reset quirk since this is not an actual * early Bluetooth 1.1 device from CSR. */ clear_bit (HCI_QUIRK_RESET_ON_CLOSE , &hdev->quirks); - -/* These fake CSR controllers have all a broken -* stored link key handling and so just disable it. -*/ -set_bit (HCI_QUIRK_BROKEN_STORED_LINK_KEY , &hdev->quirks); +clear_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks); }kfree_skb (skb);
@@ -4015,11 +4067,13 @@ static int btusb_probe(struct usb_interface *intf,if (bcdDevice <0x117 )set_bit (HCI_QUIRK_RESET_ON_CLOSE , &hdev->quirks); +/* This must be set first in case we disable it for fakes */ +set_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks); +/* Fake CSR devices with broken commands */ -if (bcdDevice <=0x100 || bcdDevice ==0x134 ) +if (le16_to_cpu (udev->descriptor.idVendor) ==0x0a12 && +le16_to_cpu (udev->descriptor.idProduct) ==0x0001 ) hdev->setup = btusb_setup_csr; - -set_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks); }if (id->driver_info &BTUSB_SNIFFER ) {
include/net/bluetooth/bluetooth.h +2 -0
@@ -41,6 +41,8 @@#define BLUETOOTH_VER_1_1 1#define BLUETOOTH_VER_1_2 2#define BLUETOOTH_VER_2_0 3 +#define BLUETOOTH_VER_2_1 4 +#define BLUETOOTH_VER_4_0 6/* Reserv for core and drivers use */ #define BT_SKB_RESERVE 8
include/net/bluetooth/hci.h +11 -0
@@ -227,6 +227,17 @@ enum {* supported. */ HCI_QUIRK_VALID_LE_STATES , + +/* When this quirk is set, then erroneous data reporting +* is ignored. This is mainly due to the fact that the HCI +* Read Default Erroneous Data Reporting command is advertised, +* but not supported; these controllers often reply with unknown +* command and tend to lock up randomly. Needing a hard reset. +* +* This quirk can be set before hci_register_dev is called or +* during the hdev->setup vendor callback. +*/ + HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, };/* HCI device flags */
net/bluetooth/hci_core.c +4 -2
@@ -606,7 +606,8 @@ static int hci_init3_req(struct hci_request *req, unsigned long opt)if (hdev->commands[8 ] &0x01 )hci_req_add (req,HCI_OP_READ_PAGE_SCAN_ACTIVITY ,0 ,NULL ); -if (hdev->commands[18 ] &0x04 ) +if (hdev->commands[18 ] &0x04 && + !test_bit (HCI_QUIRK_BROKEN_ERR_DATA_REPORTING , &hdev->quirks))hci_req_add (req,HCI_OP_READ_DEF_ERR_DATA_REPORTING ,0 ,NULL );/* Some older Broadcom based Bluetooth 1.2 controllers do not
@@ -851,7 +852,8 @@ static int hci_init4_req(struct hci_request *req, unsigned long opt)/* Set erroneous data reporting if supported to the wideband speech * setting value */ -if (hdev->commands[18 ] &0x08 ) { +if (hdev->commands[18 ] &0x08 && + !test_bit (HCI_QUIRK_BROKEN_ERR_DATA_REPORTING , &hdev->quirks)) {bool enabled =hci_dev_test_flag (hdev,HCI_WIDEBAND_SPEECH_ENABLED );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 306/464 Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags
In reply to Greg Kroah-HartmanFrom: Nicolas Boichat <[email protected]>
[ Upstream commit a7ad4b6119d740b1ec5788f1b98be0fd1c1b5a5a ]
HCI_UART_RESET_ON_INIT belongs in hdev_flags, not flags.
--- drivers/bluetooth/hci_h5.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bluetooth/hci_h5.c +1 -1
@@ -793,7 +793,7 @@ static int h5_serdev_probe(struct serdev_device *serdev)if (!h5)return -ENOMEM ; -set_bit (HCI_UART_RESET_ON_INIT , &h5->serdev_hu.flags); +set_bit (HCI_UART_RESET_ON_INIT , &h5->serdev_hu.hdev_flags); h5->hu = &h5->serdev_hu; h5->serdev_hu.serdev = serdev;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 307/464 Bluetooth: hci_serdev: Only unregister device if it was registered
In reply to Greg Kroah-HartmanFrom: Nicolas Boichat <[email protected]>
[ Upstream commit 202798db9570104728dce8bb57dfeed47ce764bc ]
We should not call hci_unregister_dev if the device was not successfully registered.
--- drivers/bluetooth/hci_serdev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/bluetooth/hci_serdev.c +2 -1
@@ -355,7 +355,8 @@ void hci_uart_unregister_device(struct hci_uart *hu)struct hci_dev *hdev = hu->hdev;clear_bit (HCI_UART_PROTO_READY , &hu->flags); -hci_unregister_dev (hdev); +if (test_bit (HCI_UART_REGISTERED , &hu->flags)) +hci_unregister_dev (hdev);hci_free_dev (hdev);cancel_work_sync (&hu->write_work);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 308/464 bpf: Fix bpf_ringbuf_output() signature to return long
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit e1613b5714ee6c186c9628e9958edf65e9d9cddd ]
Due to bpf tree fix merge, bpf_ringbuf_output() signature ended up with int as a return type, while all other helpers got converted to returning long. So fix it in bpf-next now.
--- include/uapi/linux/bpf.h | 2 +- tools/include/uapi/linux/bpf.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
include/uapi/linux/bpf.h +1 -1
@@ -3168,7 +3168,7 @@ union bpf_attr {* Return * The id is returned or 0 in case the id could not be retrieved. * -* int bpf_ringbuf_output(void *ringbuf, void *data, u64 size, u64 flags) +* long bpf_ringbuf_output(void *ringbuf, void *data, u64 size, u64 flags) * Description * Copy *size* bytes from *data* into a ring buffer *ringbuf*. * If **BPF_RB_NO_WAKEUP** is specified in *flags*, no notification
tools/include/uapi/linux/bpf.h +1 -1
@@ -3168,7 +3168,7 @@ union bpf_attr {* Return * The id is returned or 0 in case the id could not be retrieved. * -* int bpf_ringbuf_output(void *ringbuf, void *data, u64 size, u64 flags) +* long bpf_ringbuf_output(void *ringbuf, void *data, u64 size, u64 flags) * Description * Copy *size* bytes from *data* into a ring buffer *ringbuf*. * If **BPF_RB_NO_WAKEUP** is specified in *flags*, no notification
Signature · 1 line
2.25.1