5.4.60-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.4.60-rc1 review
This is the start of the stable review cycle for the 5.4.60 release. There are 152 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2020 09:15:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.60-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.60-rc1
hersen wu <[email protected]>
drm/amd/display: dchubbub p-state warning during surface planes switch
Sandeep Raghuraman <[email protected]>
drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume
Xin Xiong <[email protected]>
drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
Marius Iacob <[email protected]>
drm: Added orientation quirk for ASUS tablet model T103HAF
Denis Efremov <[email protected]>
drm/panfrost: Use kvfree() to free bo->sgts
Denis Efremov <[email protected]>
drm/radeon: fix fb_div check in ni_init_smc_spll_table()
Tomasz Maciej Nowak <[email protected]>
arm64: dts: marvell: espressobin: add ethernet alias
Hugh Dickins <[email protected]>
khugepaged: retract_page_tables() remember to test exit
Geert Uytterhoeven <[email protected]>
sh: landisk: Add missing initialization of sh_io_port_base
Zhang Rui <[email protected]>
perf/x86/rapl: Fix missing psys sysfs attributes
Daniel Díaz <[email protected]>
tools build feature: Quote CC and CXX for their arguments
Vincent Whitchurch <[email protected]>
perf bench mem: Always memset source before memcpy
Dinghao Liu <[email protected]>
ALSA: echoaudio: Fix potential Oops in snd_echo_resume()
Ondrej Mosnacek <[email protected]>
crypto: algif_aead - fix uninitialized ctx->init
Andy Shevchenko <[email protected]>
mfd: dln2: Run event handler loop under spinlock
Dhananjay Phadke <[email protected]>
i2c: iproc: fix race between client unreg and isr
Tiezhu Yang <[email protected]>
test_kmod: avoid potential double free in trigger_config_run_type()
Colin Ian King <[email protected]>
fs/ufs: avoid potential u32 multiplication overflow
Eric Biggers <[email protected]>
fs/minix: remove expected error message in block_to_path()
Eric Biggers <[email protected]>
fs/minix: fix block limit check for V1 filesystems
Eric Biggers <[email protected]>
fs/minix: set s_maxbytes correctly
Jeffrey Mitchell <[email protected]>
nfs: Fix getxattr kernel panic and memory overflow
Wang Hai <[email protected]>
net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init
Dan Carpenter <[email protected]>
drm/vmwgfx: Fix two list_for_each loop exit tests
Dan Carpenter <[email protected]>
drm/vmwgfx: Use correct vmw_legacy_display_unit pointer
Christophe Leroy <[email protected]>
recordmcount: Fix build failure on non arm64
Colin Ian King <[email protected]>
Input: sentelic - fix error return when fsp_reg_write fails
Dilip Kota <[email protected]>
x86/tsr: Fix tsc frequency enumeration bug on Lightning Mountain SoC
Dan Carpenter <[email protected]>
md-cluster: Fix potential error pointer dereference in resize_bitmaps()
Krzysztof Sobota <[email protected]>
watchdog: initialize device before misc_register
Scott Mayhew <[email protected]>
nfs: nfs_file_write() should check for writeback errors
Ewan D. Milne <[email protected]>
scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport
Stafford Horne <[email protected]>
openrisc: Fix oops caused when dumping stack
Jane Chu <[email protected]>
libnvdimm/security: ensure sysfs poll thread woke up and fetch updated attr
Jane Chu <[email protected]>
libnvdimm/security: fix a typo
Nicolas Saenz Julienne <[email protected]>
clk: bcm2835: Do not use prediv with bcm2711's PLLs
Zhihao Cheng <[email protected]>
ubifs: Fix wrong orphan node deletion in ubifs_jnl_update|rename
Scott Mayhew <[email protected]>
nfs: ensure correct writeback errors are returned on close()
Wolfram Sang <[email protected]>
i2c: rcar: avoid race when unregistering slave
Thomas Hebb <[email protected]>
tools build feature: Use CC and CXX from parent
Rayagonda Kokatanur <[email protected]>
pwm: bcm-iproc: handle clk_get_rate() return
Xu Wang <[email protected]>
clk: clk-atlas6: fix return value check in atlas6_clk_init()
Konrad Dybcio <[email protected]>
clk: qcom: gcc-sdm660: Fix up gcc_mss_mnoc_bimc_axi_clk
Wolfram Sang <[email protected]>
i2c: rcar: slave: only send STOP event when we have been addressed
Liu Yi L <[email protected]>
iommu/vt-d: Enforce PASID devTLB field mask
Jonathan Marek <[email protected]>
clk: qcom: clk-alpha-pll: remove unused/incorrect PLL_CAL_VAL
Jonathan Marek <[email protected]>
clk: qcom: gcc: fix sm8150 GPU and NPU clocks
Colin Ian King <[email protected]>
iommu/omap: Check for failure of a call to omap_iommu_dump_ctx
Aneesh Kumar K.V <[email protected]>
selftests/powerpc: ptrace-pkey: Don't update expected UAMOR value
Aneesh Kumar K.V <[email protected]>
selftests/powerpc: ptrace-pkey: Update the test to mark an invalid pkey correctly
Aneesh Kumar K.V <[email protected]>
selftests/powerpc: ptrace-pkey: Rename variables to make it easier to follow code
Cristian Ciocaltea <[email protected]>
clk: actions: Fix h_clk for Actions S500 SoC
Ming Lei <[email protected]>
dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue()
Steve Longerbeam <[email protected]>
gpu: ipu-v3: image-convert: Wait for all EOFs before completing a tile
Steve Longerbeam <[email protected]>
gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers
Herbert Xu <[email protected]>
crypto: caam - Remove broken arc4 support
Yoshihiro Shimoda <[email protected]>
mmc: renesas_sdhi_internal_dmac: clean up the code for dma complete
Mark Zhang <[email protected]>
RDMA/counter: Allow manually bind QPs with different pids to same counter
Mark Zhang <[email protected]>
RDMA/counter: Only bind user QPs in auto mode
Vladimir Oltean <[email protected]>
devres: keep both device name and resource name in pretty name
Herbert Xu <[email protected]>
crypto: af_alg - Fix regression on empty requests
Johan Hovold <[email protected]>
USB: serial: ftdi_sio: fix break and sysrq handling
Johan Hovold <[email protected]>
USB: serial: ftdi_sio: clean up receive processing
Johan Hovold <[email protected]>
USB: serial: ftdi_sio: make process-packet buffer unsigned
Jesper Dangaard Brouer <[email protected]>
selftests/bpf: test_progs use another shell exit on non-actions
Jesper Dangaard Brouer <[email protected]>
selftests/bpf: Test_progs indicate to shell on non-actions
Yishai Hadas <[email protected]>
IB/uverbs: Set IOVA on IB MR in uverbs layer
Paul Kocialkowski <[email protected]>
media: rockchip: rga: Only set output CSC mode for RGB input
Paul Kocialkowski <[email protected]>
media: rockchip: rga: Introduce color fmt macros and refactor CSC mode logic
Jason Gunthorpe <[email protected]>
RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah()
Kamal Heib <[email protected]>
RDMA/ipoib: Return void from ipoib_ib_dev_stop()
Qiushi Wu <[email protected]>
platform/chrome: cros_ec_ishtp: Fix a double-unlock issue
Boris Brezillon <[email protected]>
mtd: rawnand: fsl_upm: Remove unused mtd var
Eric Dumazet <[email protected]>
octeontx2-af: change (struct qmem)->entry_sz from u8 to u16
Charles Keepax <[email protected]>
mfd: arizona: Ensure 32k clock is put on driver unbind and error
Herbert Xu <[email protected]>
crypto: algif_aead - Only wake up when ctx->more is zero
Paul Cercueil <[email protected]>
pinctrl: ingenic: Properly detect GPIO direction when configured for IRQ
Mike Marshall <[email protected]>
orangefs: get rid of knob code...
Liu Ying <[email protected]>
drm/imx: imx-ldb: Disable both channels for split mode in enc->disable()
Sibi Sankar <[email protected]>
remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load
Sibi Sankar <[email protected]>
remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load
Sibi Sankar <[email protected]>
remoteproc: qcom: q6v5: Update running state before requesting stop
Adrian Hunter <[email protected]>
perf intel-pt: Fix duplicate branch after CBR
Adrian Hunter <[email protected]>
perf intel-pt: Fix FUP packet state
Kees Cook <[email protected]>
module: Correctly truncate sysfs sections output
Anton Blanchard <[email protected]>
pseries: Fix 64 bit logical memory block panic
Jeff Layton <[email protected]>
ceph: handle zero-length feature mask in session messages
Jeff Layton <[email protected]>
ceph: set sec_context xattr on symlink creation
Ahmad Fatoum <[email protected]>
watchdog: f71808e_wdt: clear watchdog timeout occurred flag
Ahmad Fatoum <[email protected]>
watchdog: f71808e_wdt: remove use of wrong watchdog_info option
Ahmad Fatoum <[email protected]>
watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options
Steven Rostedt (VMware) <[email protected]>
tracing: Move pipe reference to trace array instead of current_tracer
Steven Rostedt (VMware) <[email protected]>
tracing: Use trace_sched_process_free() instead of exit() for pid tracing
Kevin Hao <[email protected]>
tracing/hwlat: Honor the tracing_cpumask
Muchun Song <[email protected]>
kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler
Chengming Zhou <[email protected]>
ftrace: Setup correct FTRACE_FL_REGS flags for module
Jia He <[email protected]>
mm/memory_hotplug: fix unpaired mem_hotplug_begin/done
Michal Koutný <[email protected]>
mm/page_counter.c: fix protection usage propagation
Junxiao Bi <[email protected]>
ocfs2: change slot number type s16 to u16
Hugh Dickins <[email protected]>
khugepaged: collapse_pte_mapped_thp() protect the pmd lock
Hugh Dickins <[email protected]>
khugepaged: collapse_pte_mapped_thp() flush the right range
Mikulas Patocka <[email protected]>
ext2: fix missing percpu_counter_inc
Paul Cercueil <[email protected]>
MIPS: qi_lb60: Fix routing to audio amplifier
Huacai Chen <[email protected]>
MIPS: CPU#0 is not hotpluggable
Lukas Wunner <[email protected]>
driver core: Avoid binding drivers to dead devices
Johannes Berg <[email protected]>
mac80211: fix misplaced while instead of if
Coly Li <[email protected]>
bcache: fix overflow in offset_to_stripe()
Coly Li <[email protected]>
bcache: allocate meta data pages as compound pages
ChangSyun Peng <[email protected]>
md/raid5: Fix Force reconstruct-write io stuck in degraded raid5
Kees Cook <[email protected]>
net/compat: Add missing sock updates for SCM_RIGHTS
Jonathan McDowell <[email protected]>
net: stmmac: dwmac1000: provide multicast filter fallback
Jonathan McDowell <[email protected]>
net: ethernet: stmmac: Disable hardware multicast filter
Eugeniu Rosca <[email protected]>
media: vsp1: dl: Fix NULL pointer dereference on unbind
Paul Cercueil <[email protected]>
pinctrl: ingenic: Enhance support for IRQ_TYPE_EDGE_BOTH
Michael Ellerman <[email protected]>
powerpc: Fix circular dependency between percpu.h and mmu.h
Michael Ellerman <[email protected]>
powerpc: Allow 4224 bytes of stack expansion for the signal frame
Christophe Leroy <[email protected]>
powerpc/ptdump: Fix build failure in hashpagetable.c
Paul Aurich <[email protected]>
cifs: Fix leak when handling lease break for cached root fid
Max Filippov <[email protected]>
xtensa: fix xtensa_pmu_setup prototype
Max Filippov <[email protected]>
xtensa: add missing exclusive access state management
Alexandru Ardelean <[email protected]>
iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw()
Christian Eggers <[email protected]>
dt-bindings: iio: io-channel-mux: Fix compatible string in example code
Shaokun Zhang <[email protected]>
arm64: perf: Correct the event index in sysfs
Pavel Machek <[email protected]>
btrfs: fix return value mixup in btrfs_get_extent
Josef Bacik <[email protected]>
btrfs: make sure SB_I_VERSION doesn't get unset by remount
Filipe Manana <[email protected]>
btrfs: fix memory leaks after failure to lookup checksums during inode logging
Qu Wenruo <[email protected]>
btrfs: inode: fix NULL pointer dereference if inode doesn't need compression
Josef Bacik <[email protected]>
btrfs: only search for left_info if there is no right_info in try_merge_free_space
David Sterba <[email protected]>
btrfs: fix messages after changing compression level by remount
Filipe Manana <[email protected]>
btrfs: fix race between page release and a fast fsync
Josef Bacik <[email protected]>
btrfs: don't WARN if we abort a transaction with EROFS
Josef Bacik <[email protected]>
btrfs: sysfs: use NOFS for device creation
Qu Wenruo <[email protected]>
btrfs: avoid possible signal interruption of btrfs_drop_snapshot() on relocation tree
David Sterba <[email protected]>
btrfs: add missing check for nocow and compression inode flags
Qu Wenruo <[email protected]>
btrfs: relocation: review the call sites which can be interrupted by signal
Josef Bacik <[email protected]>
btrfs: move the chunk_mutex in btrfs_read_chunk_tree
Josef Bacik <[email protected]>
btrfs: open device without device_list_mutex
Anand Jain <[email protected]>
btrfs: don't traverse into the seed devices in show_devname
Filipe Manana <[email protected]>
btrfs: remove no longer needed use of log_writers for the log root tree
Filipe Manana <[email protected]>
btrfs: stop incremening log_batch for the log root tree when syncing log
Tom Rix <[email protected]>
btrfs: ref-verify: fix memory leak in add_block_entry
Qu Wenruo <[email protected]>
btrfs: don't allocate anonymous block device for user invisible roots
Qu Wenruo <[email protected]>
btrfs: free anon block device right after subvolume deletion
David Sterba <[email protected]>
btrfs: allow use of global block reserve for balance item deletion
Ansuel Smith <[email protected]>
PCI: qcom: Add support for tx term offset for rev 2.1.0
Ansuel Smith <[email protected]>
PCI: qcom: Define some PARF params needed for ipq8064 SoC
Rajat Jain <[email protected]>
PCI: Add device even if driver attach failed
Kai-Heng Feng <[email protected]>
PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken
Rafael J. Wysocki <[email protected]>
PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context()
Guenter Roeck <[email protected]>
genirq/PM: Always unlock IRQ descriptor in rearm_wake_irq()
Thomas Gleixner <[email protected]>
genirq/affinity: Make affinity setting if activated opt-in
Steve French <[email protected]>
smb3: warn on confusing error scenario with sec=krb5
-------------
Diffstat:
.../bindings/iio/multiplexer/io-channel-mux.txt | 2 +- Makefile | 4 +- .../boot/dts/marvell/armada-3720-espressobin.dts | 6 + arch/arm64/kernel/perf_event.c | 13 +- arch/mips/boot/dts/ingenic/qi_lb60.dts | 2 +- arch/mips/kernel/topology.c | 2 +- arch/openrisc/kernel/stacktrace.c | 18 ++- arch/powerpc/include/asm/percpu.h | 4 +- arch/powerpc/mm/fault.c | 7 +- arch/powerpc/mm/ptdump/hashpagetable.c | 2 +- arch/powerpc/platforms/pseries/hotplug-memory.c | 2 +- arch/sh/boards/mach-landisk/setup.c | 3 + arch/x86/events/rapl.c | 2 +- arch/x86/kernel/apic/vector.c | 4 + arch/x86/kernel/tsc_msr.c | 9 +- arch/xtensa/include/asm/thread_info.h | 4 + arch/xtensa/kernel/asm-offsets.c | 3 + arch/xtensa/kernel/entry.S | 11 ++ arch/xtensa/kernel/perf_event.c | 2 +- crypto/af_alg.c | 11 +- crypto/algif_aead.c | 10 +- crypto/algif_skcipher.c | 11 +- drivers/base/dd.c | 4 +- drivers/clk/actions/owl-s500.c | 2 +- drivers/clk/bcm/clk-bcm2835.c | 25 +++- drivers/clk/qcom/clk-alpha-pll.c | 2 - drivers/clk/qcom/gcc-sdm660.c | 3 + drivers/clk/qcom/gcc-sm8150.c | 8 +- drivers/clk/sirf/clk-atlas6.c | 2 +- drivers/crypto/caam/caamalg.c | 29 ----- drivers/crypto/caam/compat.h | 1 - .../drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c | 69 +++++++++- drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 5 +- drivers/gpu/drm/drm_dp_mst_topology.c | 7 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/imx/imx-ldb.c | 7 +- drivers/gpu/drm/panfrost/panfrost_gem.c | 2 +- drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +- drivers/gpu/drm/radeon/ni_dpm.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c | 5 +- drivers/gpu/ipu-v3/ipu-image-convert.c | 145 +++++++++++++-------- drivers/i2c/busses/i2c-bcm-iproc.c | 13 +- drivers/i2c/busses/i2c-rcar.c | 15 ++- drivers/iio/dac/ad5592r-base.c | 4 +- drivers/infiniband/core/counters.c | 4 +- drivers/infiniband/core/uverbs_cmd.c | 4 + drivers/infiniband/hw/cxgb4/mem.c | 1 - drivers/infiniband/hw/mlx4/mr.c | 1 - drivers/infiniband/ulp/ipoib/ipoib.h | 2 +- drivers/infiniband/ulp/ipoib/ipoib_ib.c | 67 +++++----- drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 + drivers/input/mouse/sentelic.c | 2 +- drivers/iommu/omap-iommu-debug.c | 3 + drivers/irqchip/irq-gic-v3-its.c | 5 +- drivers/md/bcache/bcache.h | 2 +- drivers/md/bcache/bset.c | 2 +- drivers/md/bcache/btree.c | 2 +- drivers/md/bcache/journal.c | 4 +- drivers/md/bcache/super.c | 2 +- drivers/md/bcache/writeback.c | 14 +- drivers/md/bcache/writeback.h | 19 ++- drivers/md/dm-rq.c | 3 - drivers/md/md-cluster.c | 1 + drivers/md/raid5.c | 3 +- drivers/media/platform/rockchip/rga/rga-hw.c | 29 +++-- drivers/media/platform/rockchip/rga/rga-hw.h | 5 + drivers/media/platform/vsp1/vsp1_dl.c | 2 + drivers/mfd/arizona-core.c | 18 +++ drivers/mfd/dln2.c | 4 + drivers/mmc/host/renesas_sdhi_internal_dmac.c | 18 ++- drivers/mtd/nand/raw/fsl_upm.c | 1 - drivers/net/ethernet/marvell/octeontx2/af/common.h | 2 +- drivers/net/ethernet/qualcomm/emac/emac.c | 17 ++- .../net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 1 + .../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 3 + drivers/nvdimm/security.c | 13 +- drivers/pci/bus.c | 6 +- drivers/pci/controller/dwc/pcie-qcom.c | 41 +++++- drivers/pci/hotplug/acpiphp_glue.c | 14 +- drivers/pci/quirks.c | 5 +- drivers/pinctrl/pinctrl-ingenic.c | 9 +- drivers/platform/chrome/cros_ec_ishtp.c | 4 +- drivers/pwm/pwm-bcm-iproc.c | 9 +- drivers/remoteproc/qcom_q6v5.c | 2 + drivers/remoteproc/qcom_q6v5_mss.c | 11 +- drivers/scsi/lpfc/lpfc_nvmet.c | 2 +- drivers/usb/serial/ftdi_sio.c | 57 ++++---- drivers/watchdog/f71808e_wdt.c | 13 +- drivers/watchdog/watchdog_dev.c | 18 +-- fs/btrfs/ctree.h | 4 +- fs/btrfs/disk-io.c | 13 +- fs/btrfs/extent-tree.c | 9 +- fs/btrfs/extent_io.c | 16 ++- fs/btrfs/free-space-cache.c | 4 +- fs/btrfs/inode.c | 20 ++- fs/btrfs/ioctl.c | 30 +++-- fs/btrfs/ref-verify.c | 2 + fs/btrfs/relocation.c | 12 +- fs/btrfs/super.c | 41 +++--- fs/btrfs/sysfs.c | 3 + fs/btrfs/tree-log.c | 22 +--- fs/btrfs/volumes.c | 44 ++++++- fs/ceph/dir.c | 4 + fs/ceph/mds_client.c | 6 +- fs/cifs/smb2misc.c | 73 ++++++++--- fs/cifs/smb2pdu.c | 2 + fs/ext2/ialloc.c | 3 +- fs/minix/inode.c | 12 +- fs/minix/itree_v1.c | 12 +- fs/minix/itree_v2.c | 13 +- fs/minix/minix.h | 1 - fs/nfs/file.c | 17 ++- fs/nfs/nfs4file.c | 5 +- fs/nfs/nfs4proc.c | 2 - fs/nfs/nfs4xdr.c | 6 +- fs/ocfs2/ocfs2.h | 4 +- fs/ocfs2/suballoc.c | 4 +- fs/ocfs2/super.c | 4 +- fs/orangefs/file.c | 26 +--- fs/orangefs/inode.c | 39 +----- fs/orangefs/orangefs-kernel.h | 4 - fs/ubifs/journal.c | 10 +- fs/ufs/super.c | 2 +- include/crypto/if_alg.h | 4 +- include/linux/intel-iommu.h | 4 +- include/linux/irq.h | 13 ++ include/net/sock.h | 4 + kernel/irq/manage.c | 6 +- kernel/irq/pm.c | 8 +- kernel/kprobes.c | 7 + kernel/module.c | 22 +++- kernel/trace/ftrace.c | 15 ++- kernel/trace/trace.c | 12 +- kernel/trace/trace.h | 2 +- kernel/trace/trace_events.c | 4 +- kernel/trace/trace_hwlat.c | 5 +- lib/devres.c | 11 +- lib/test_kmod.c | 2 +- mm/khugepaged.c | 70 +++++----- mm/memory_hotplug.c | 5 +- mm/page_counter.c | 6 +- net/compat.c | 1 + net/core/sock.c | 21 +++ net/mac80211/sta_info.c | 2 +- scripts/recordmcount.c | 2 + sound/pci/echoaudio/echoaudio.c | 2 - tools/build/Makefile.feature | 2 +- tools/build/feature/Makefile | 2 - tools/perf/bench/mem-functions.c | 21 +-- .../perf/util/intel-pt-decoder/intel-pt-decoder.c | 29 ++--- tools/testing/selftests/bpf/test_progs.c | 5 + .../testing/selftests/powerpc/ptrace/ptrace-pkey.c | 55 ++++---- 153 files changed, 1120 insertions(+), 636 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/152 smb3: warn on confusing error scenario with sec=krb5
From: Steve French <[email protected]>
commit 0a018944eee913962bce8ffebbb121960d5125d9 upstream.
When mounting with Kerberos, users have been confused about the default error returned in scenarios in which either keyutils is not installed or the user did not properly acquire a krb5 ticket. Log a warning message in the case that "ENOKEY" is returned from the get_spnego_key upcall so that users can better understand why mount failed in those two cases.
--- fs/cifs/smb2pdu.c | 2 ++ 1 file changed, 2 insertions(+)
fs/cifs/smb2pdu.c +2 -0
@@ -1323,6 +1323,8 @@ SMB2_auth_kerberos(struct SMB2_sess_data spnego_key =cifs_get_spnego_key (ses);if (IS_ERR (spnego_key)) { rc =PTR_ERR (spnego_key); +if (rc == -ENOKEY ) +cifs_dbg (VFS ,"Verify user has a krb5 ticket and keyutils is installed\n" ); spnego_key =NULL ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 2/152 genirq/affinity: Make affinity setting if activated opt-in
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit f0c7baca180046824e07fc5f1326e83a8fd150c7 upstream.
John reported that on a RK3288 system the perf per CPU interrupts are all affine to CPU0 and provided the analysis:
"It looks like what happens is that because the interrupts are not per-CPU
in the hardware, armpmu_request_irq() calls irq_force_affinity() while the interrupt is deactivated and then request_irq() with IRQF_PERCPU | IRQF_NOBALANCING.
Now when irq_startup() runs with IRQ_STARTUP_NORMAL, it calls irq_setup_affinity() which returns early because IRQF_PERCPU and IRQF_NOBALANCING are set, leaving the interrupt on its original CPU."
This was broken by the recent commit which blocked interrupt affinity setting in hardware before activation of the interrupt. While this works in general, it does not work for this particular case. As contrary to the initial analysis not all interrupt chip drivers implement an activate callback, the safe cure is to make the deferred interrupt affinity setting at activation time opt-in.
Implement the necessary core logic and make the two irqchip implementations for which this is required opt-in. In hindsight this would have been the right thing to do, but ...
--- arch/x86/kernel/apic/vector.c | 4 ++++ drivers/irqchip/irq-gic-v3-its.c | 5 ++++- include/linux/irq.h | 13 +++++++++++++ kernel/irq/manage.c | 6 +++++- 4 files changed, 26 insertions(+), 2 deletions(-)
arch/x86/kernel/apic/vector.c +4 -0
@@ -554,6 +554,10 @@ static int x86_vector_alloc_irqs(struct irqd->chip_data = apicd; irqd->hwirq = virq + i;irqd_set_single_target (irqd); + +/* Don't invoke affinity setter on deactivated interrupts */ +irqd_set_affinity_on_activate (irqd); +/* * Legacy vectors are already assigned when the IOAPIC * takes them over. They stay on the same vector. This is
drivers/irqchip/irq-gic-v3-its.c +4 -1
@@ -2581,6 +2581,7 @@ static int its_irq_domain_alloc(struct imsi_alloc_info_t *info = args;struct its_device *its_dev = info->scratchpad[0 ].ptr;struct its_node *its = its_dev->its; +struct irq_data *irqd;irq_hw_number_t hwirq;int err;int i;
@@ -2600,7 +2601,9 @@ static int its_irq_domain_alloc(struct iirq_domain_set_hwirq_and_chip (domain, virq + i, hwirq + i, &its_irq_chip, its_dev); -irqd_set_single_target (irq_desc_get_irq_data (irq_to_desc (virq + i))); + irqd =irq_get_irq_data (virq + i); +irqd_set_single_target (irqd); +irqd_set_affinity_on_activate (irqd);pr_debug ("ID:%d pID:%d vID:%d\n" , (int )(hwirq + i - its_dev->event_map.lpi_base), (int )(hwirq + i), virq + i);
include/linux/irq.h +13 -0
@@ -211,6 +211,8 @@ struct irq_data {* IRQD_CAN_RESERVE - Can use reservation mode * IRQD_MSI_NOMASK_QUIRK - Non-maskable MSI quirk for affinity change * required +* IRQD_AFFINITY_ON_ACTIVATE - Affinity is set on activation. Don't call +* irq_chip::irq_set_affinity() when deactivated. */ enum {IRQD_TRIGGER_MASK =0xf ,
@@ -234,6 +236,7 @@ enum {IRQD_DEFAULT_TRIGGER_SET = (1 <<25 ),IRQD_CAN_RESERVE = (1 <<26 ),IRQD_MSI_NOMASK_QUIRK = (1 <<27 ), + IRQD_AFFINITY_ON_ACTIVATE = (1 << 29), };#define __irqd_to_state (d) ACCESS_PRIVATE((d)->common, state_use_accessors)
@@ -408,6 +411,16 @@ static inline bool irqd_msi_nomask_quirkreturn __irqd_to_state (d) &IRQD_MSI_NOMASK_QUIRK ; } +static inline void irqd_set_affinity_on_activate (struct irq_data *d) +{ +__irqd_to_state (d) |=IRQD_AFFINITY_ON_ACTIVATE ; +} + +static inline bool irqd_affinity_on_activate (struct irq_data *d) +{ +return __irqd_to_state (d) &IRQD_AFFINITY_ON_ACTIVATE ; +} +#undef __irqd_to_statestatic inline irq_hw_number_t irqd_to_hwirq (struct irq_data *d)
kernel/irq/manage.c +5 -1
@@ -281,12 +281,16 @@ static bool irq_set_affinity_deactivatedstruct irq_desc *desc =irq_data_to_desc (data);/* +* Handle irq chips which can handle affinity only in activated +* state correctly +* * If the interrupt is not yet activated, just store the affinity * mask and do not call the chip driver at all. On activation the * driver has to make sure anyway that the interrupt is in a * useable state so startup works. */ -if (!IS_ENABLED (CONFIG_IRQ_DOMAIN_HIERARCHY ) ||irqd_is_activated (data)) +if (!IS_ENABLED (CONFIG_IRQ_DOMAIN_HIERARCHY ) || +irqd_is_activated (data) || !irqd_affinity_on_activate (data))return false;cpumask_copy (desc->irq_common_data.affinity, mask);
Greg Kroah-Hartman
maintainerPATCH 3/152 genirq/PM: Always unlock IRQ descriptor in rearm_wake_irq()
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
commit e27b1636e9337d1a1d174b191e53d0f86421a822 upstream.
rearm_wake_irq() does not unlock the irq descriptor if the interrupt is not suspended or if wakeup is not enabled on it.
Restucture the exit conditions so the unlock is always ensured.
--- kernel/irq/pm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
kernel/irq/pm.c +6 -2
@@ -185,14 +185,18 @@ void rearm_wake_irq(unsigned int irq)unsigned long flags;struct irq_desc *desc =irq_get_desc_buslock (irq, &flags,IRQ_GET_DESC_CHECK_GLOBAL ); -if (!desc || !(desc->istate &IRQS_SUSPENDED ) || - !irqd_is_wakeup_set (&desc->irq_data)) +if (!desc)return ; +if (!(desc->istate &IRQS_SUSPENDED ) || + !irqd_is_wakeup_set (&desc->irq_data)) + goto unlock; + desc->istate &= ~IRQS_SUSPENDED ;irqd_set (&desc->irq_data,IRQD_WAKEUP_ARMED );__enable_irq (desc); +unlock:irq_put_desc_busunlock (desc, flags); }
Greg Kroah-Hartman
maintainerPATCH 4/152 PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit dae68d7fd4930315389117e9da35b763f12238f9 upstream.
If context is not NULL in acpiphp_grab_context(), but the is_going_away flag is set for the device's parent, the reference counter of the context needs to be decremented before returning NULL or the context will never be freed, so make that happen.
--- drivers/pci/hotplug/acpiphp_glue.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/pci/hotplug/acpiphp_glue.c +11 -3
@@ -122,13 +122,21 @@ static struct acpiphp_context *acpiphp_gstruct acpiphp_context *context;acpi_lock_hp_context (); + context =acpiphp_get_context (adev); -if (!context || context->func.parent->is_going_away) { -acpi_unlock_hp_context (); -return NULL ; +if (!context) + goto unlock; + +if (context->func.parent->is_going_away) { +acpiphp_put_context (context); + context =NULL ; + goto unlock; } +get_bridge (context->func.parent);acpiphp_put_context (context); + +unlock:acpi_unlock_hp_context ();return context; }
Greg Kroah-Hartman
maintainerPATCH 5/152 PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
commit 45beb31d3afb651bb5c41897e46bd4fa9980c51c upstream.
We are seeing AMD Radeon Pro W5700 doesn't work when IOMMU is enabled:
iommu ivhd0: AMD-Vi: Event logged [IOTLB_INV_TIMEOUT device=63:00.0 address=0x42b5b01a0] iommu ivhd0: AMD-Vi: Event logged [IOTLB_INV_TIMEOUT device=63:00.0 address=0x42b5b01c0]
The error also makes graphics driver fail to probe the device.
It appears to be the same issue as commit 5e89cd303e3a ("PCI: Mark AMD Navi14 GPU rev 0xc5 ATS as broken") addresses, and indeed the same ATS quirk can workaround the issue.
See-also: 5e89cd303e3a ("PCI: Mark AMD Navi14 GPU rev 0xc5 ATS as broken")
See-also: d28ca864c493 ("PCI: Mark AMD Stoney Radeon R7 GPU ATS as broken")
See-also: 9b44b0b09dec ("PCI: Mark AMD Stoney GPU ATS as broken")
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208725
--- drivers/pci/quirks.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/pci/quirks.c +4 -1
@@ -5208,7 +5208,8 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SE*/ static void quirk_amd_harvest_no_ats (struct pci_dev *pdev) { -if (pdev->device ==0x7340 && pdev->revision !=0xc5 ) +if ((pdev->device ==0x7312 && pdev->revision !=0x00 ) || + (pdev->device ==0x7340 && pdev->revision !=0xc5 ))return ;pci_info (pdev,"disabling ATS\n" );
@@ -5219,6 +5220,8 @@ static void quirk_amd_harvest_no_ats(strDECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_ATI ,0x98e4 , quirk_amd_harvest_no_ats);/* AMD Iceland dGPU */ DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_ATI ,0x6900 , quirk_amd_harvest_no_ats); +/* AMD Navi10 dGPU */ +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_ATI ,0x7312 , quirk_amd_harvest_no_ats);/* AMD Navi14 dGPU */ DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_ATI ,0x7340 , quirk_amd_harvest_no_ats);#endif /* CONFIG_PCI_ATS */
Greg Kroah-Hartman
maintainerPATCH 6/152 PCI: Add device even if driver attach failed
In reply to Greg Kroah-HartmanFrom: Rajat Jain <[email protected]>
commit 2194bc7c39610be7cabe7456c5f63a570604f015 upstream.
device_attach() returning failure indicates a driver error while trying to probe the device. In such a scenario, the PCI device should still be added in the system and be visible to the user.
When device_attach() fails, merely warn about it and keep the PCI device in the system.
This partially reverts ab1a187bba5c ("PCI: Check device_attach() return value always").
--- drivers/pci/bus.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/pci/bus.c +1 -5
@@ -322,12 +322,8 @@ void pci_bus_add_device(struct pci_dev * dev->match_driver = true; retval =device_attach (&dev->dev); -if (retval <0 && retval != -EPROBE_DEFER ) { +if (retval <0 && retval != -EPROBE_DEFER )pci_warn (dev,"device attach failed (%d)\n" , retval); -pci_proc_detach_device (dev); -pci_remove_sysfs_dev_files (dev); -return ; - }pci_dev_assign_added (dev, true); }
Greg Kroah-Hartman
maintainerPATCH 7/152 PCI: qcom: Define some PARF params needed for ipq8064 SoC
In reply to Greg Kroah-HartmanFrom: Ansuel Smith <[email protected]>
commit 5149901e9e6deca487c01cc434a3ac4125c7b00b upstream.
Set some specific value for Tx De-Emphasis, Tx Swing and Rx equalization needed on some ipq8064 based device (Netgear R7800 for example). Without this the system locks on kernel load.
--- drivers/pci/controller/dwc/pcie-qcom.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
drivers/pci/controller/dwc/pcie-qcom.c +24 -0
@@ -76,6 +76,18 @@#define DBI_RO_WR_EN 1#define PERST_DELAY_US 1000 +/* PARF registers */ +#define PCIE20_PARF_PCS_DEEMPH 0x34 +#define PCS_DEEMPH_TX_DEEMPH_GEN1 (x) ((x) << 16) +#define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB (x) ((x) << 8) +#define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB (x) ((x) << 0) + +#define PCIE20_PARF_PCS_SWING 0x38 +#define PCS_SWING_TX_SWING_FULL (x) ((x) << 8) +#define PCS_SWING_TX_SWING_LOW (x) ((x) << 0) + +#define PCIE20_PARF_CONFIG_BITS 0x50 +#define PHY_RX0_EQ (x) ((x) << 24)#define PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE 0x358#define SLV_ADDR_SPACE_SZ 0x10000000
@@ -275,6 +287,7 @@ static int qcom_pcie_init_2_1_0(struct qstruct qcom_pcie_resources_2_1_0 *res = &pcie->res.v2_1_0;struct dw_pcie *pci = pcie->pci;struct device *dev = pci->dev; +struct device_node *node = dev->of_node;u32 val;int ret;
@@ -319,6 +332,17 @@ static int qcom_pcie_init_2_1_0(struct q val &= ~BIT (0 );writel (val, pcie->parf +PCIE20_PARF_PHY_CTRL ); +if (of_device_is_compatible (node,"qcom,pcie-ipq8064" )) { +writel (PCS_DEEMPH_TX_DEEMPH_GEN1 (24 ) | +PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB (24 ) | +PCS_DEEMPH_TX_DEEMPH_GEN2_6DB (34 ), + pcie->parf +PCIE20_PARF_PCS_DEEMPH ); +writel (PCS_SWING_TX_SWING_FULL (120 ) | +PCS_SWING_TX_SWING_LOW (120 ), + pcie->parf +PCIE20_PARF_PCS_SWING ); +writel (PHY_RX0_EQ (4 ), pcie->parf +PCIE20_PARF_CONFIG_BITS ); + } +/* enable external reference clock */ val =readl (pcie->parf +PCIE20_PARF_PHY_REFCLK ); val |=BIT (16 );
Greg Kroah-Hartman
maintainerPATCH 8/152 PCI: qcom: Add support for tx term offset for rev 2.1.0
In reply to Greg Kroah-HartmanFrom: Ansuel Smith <[email protected]>
commit de3c4bf648975ea0b1d344d811e9b0748907b47c upstream.
Add tx term offset support to pcie qcom driver need in some revision of the ipq806x SoC. Ipq8064 needs tx term offset set to 7.
--- drivers/pci/controller/dwc/pcie-qcom.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-qcom.c +16 -1
@@ -45,7 +45,13 @@#define PCIE_CAP_CPL_TIMEOUT_DISABLE 0x10#define PCIE20_PARF_PHY_CTRL 0x40 +#define PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK GENMASK(20, 16) +#define PHY_CTRL_PHY_TX0_TERM_OFFSET (x) ((x) << 16) +#define PCIE20_PARF_PHY_REFCLK 0x4C +#define PHY_REFCLK_SSP_EN BIT(16) +#define PHY_REFCLK_USE_PAD BIT(12) +#define PCIE20_PARF_DBI_BASE_ADDR 0x168#define PCIE20_PARF_SLV_ADDR_SPACE_SIZE 0x16C#define PCIE20_PARF_MHI_CLOCK_RESET_CTRL 0x174
@@ -343,9 +349,18 @@ static int qcom_pcie_init_2_1_0(struct qwritel (PHY_RX0_EQ (4 ), pcie->parf +PCIE20_PARF_CONFIG_BITS ); } +if (of_device_is_compatible (node,"qcom,pcie-ipq8064" )) { +/* set TX termination offset */ + val =readl (pcie->parf +PCIE20_PARF_PHY_CTRL ); + val &= ~PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK ; + val |=PHY_CTRL_PHY_TX0_TERM_OFFSET (7 ); +writel (val, pcie->parf +PCIE20_PARF_PHY_CTRL ); + } +/* enable external reference clock */ val =readl (pcie->parf +PCIE20_PARF_PHY_REFCLK ); - val |=BIT (16 ); + val &= ~PHY_REFCLK_USE_PAD ; + val |=PHY_REFCLK_SSP_EN ;writel (val, pcie->parf +PCIE20_PARF_PHY_REFCLK ); ret =reset_control_deassert (res->phy_reset);
Greg Kroah-Hartman
maintainerPATCH 9/152 btrfs: allow use of global block reserve for balance item deletion
In reply to Greg Kroah-HartmanFrom: David Sterba <[email protected]>
commit 3502a8c0dc1bd4b4970b59b06e348f22a1c05581 upstream.
On a filesystem with exhausted metadata, but still enough to start balance, it's possible to hit this error:
[324402.053842] BTRFS info (device loop0): 1 enospc errors during balance [324402.060769] BTRFS info (device loop0): balance: ended with status: -28 [324402.172295] BTRFS: error (device loop0) in reset_balance_state:3321: errno=-28 No space left
It fails inside reset_balance_state and turns the filesystem to read-only, which is unnecessary and should be fixed too, but the problem is caused by lack for space when the balance item is deleted. This is a one-time operation and from the same rank as unlink that is allowed to use the global block reserve. So do the same for the balance item.
Status of the filesystem (100GiB) just after the balance fails:
$ btrfs fi df mnt Data, single: total=80.01GiB, used=38.58GiB System, single: total=4.00MiB, used=16.00KiB Metadata, single: total=19.99GiB, used=19.48GiB GlobalReserve, single: total=512.00MiB, used=50.11MiB
--- fs/btrfs/volumes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/volumes.c +1 -1
@@ -3283,7 +3283,7 @@ static int insert_balance_item(struct btif (!path)return -ENOMEM ; - trans =btrfs_start_transaction (root,0 ); + trans =btrfs_start_transaction_fallback_global_rsv (root,0 );if (IS_ERR (trans)) {btrfs_free_path (path);return PTR_ERR (trans);
Greg Kroah-Hartman
maintainerPATCH 10/152 btrfs: free anon block device right after subvolume deletion
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 082b6c970f02fefd278c7833880cda29691a5f34 upstream.
[BUG]
When a lot of subvolumes are created, there is a user report about transaction aborted caused by slow anonymous block device reclaim:
BTRFS: Transaction aborted (error -24)
WARNING: CPU: 17 PID: 17041 at fs/btrfs/transaction.c:1576 create_pending_snapshot+0xbc4/0xd10 [btrfs] RIP: 0010:create_pending_snapshot+0xbc4/0xd10 [btrfs] Call Trace: create_pending_snapshots+0x82/0xa0 [btrfs] btrfs_commit_transaction+0x275/0x8c0 [btrfs] btrfs_mksubvol+0x4b9/0x500 [btrfs] btrfs_ioctl_snap_create_transid+0x174/0x180 [btrfs] btrfs_ioctl_snap_create_v2+0x11c/0x180 [btrfs] btrfs_ioctl+0x11a4/0x2da0 [btrfs] do_vfs_ioctl+0xa9/0x640 ksys_ioctl+0x67/0x90 __x64_sys_ioctl+0x1a/0x20 do_syscall_64+0x5a/0x110 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ---[ end trace 33f2f83f3d5250e9 ]--- BTRFS: error (device sda1) in create_pending_snapshot:1576: errno=-24 unknown BTRFS info (device sda1): forced readonly BTRFS warning (device sda1): Skipping commit of aborted transaction. BTRFS: error (device sda1) in cleanup_transaction:1831: errno=-24 unknown
[CAUSE]
The anonymous device pool is shared and its size is 1M. It's possible to hit that limit if the subvolume deletion is not fast enough and the subvolumes to be cleaned keep the ids allocated.
[WORKAROUND]
We can't avoid the anon device pool exhaustion but we can shorten the time the id is attached to the subvolume root once the subvolume becomes invisible to the user.
--- fs/btrfs/inode.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/inode.c +2 -0
@@ -4681,6 +4681,8 @@ int btrfs_delete_subvolume(struct inode } } +free_anon_bdev (dest->anon_dev); + dest->anon_dev =0 ; out_end_trans: trans->block_rsv =NULL ; trans->bytes_reserved =0 ;
Greg Kroah-Hartman
maintainerPATCH 11/152 btrfs: dont allocate anonymous block device for user invisible roots
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 851fd730a743e072badaf67caf39883e32439431 upstream.
[BUG]
When a lot of subvolumes are created, there is a user report about transaction aborted:
BTRFS: Transaction aborted (error -24)
WARNING: CPU: 17 PID: 17041 at fs/btrfs/transaction.c:1576 create_pending_snapshot+0xbc4/0xd10 [btrfs] RIP: 0010:create_pending_snapshot+0xbc4/0xd10 [btrfs] Call Trace: create_pending_snapshots+0x82/0xa0 [btrfs] btrfs_commit_transaction+0x275/0x8c0 [btrfs] btrfs_mksubvol+0x4b9/0x500 [btrfs] btrfs_ioctl_snap_create_transid+0x174/0x180 [btrfs] btrfs_ioctl_snap_create_v2+0x11c/0x180 [btrfs] btrfs_ioctl+0x11a4/0x2da0 [btrfs] do_vfs_ioctl+0xa9/0x640 ksys_ioctl+0x67/0x90 __x64_sys_ioctl+0x1a/0x20 do_syscall_64+0x5a/0x110 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ---[ end trace 33f2f83f3d5250e9 ]--- BTRFS: error (device sda1) in create_pending_snapshot:1576: errno=-24 unknown BTRFS info (device sda1): forced readonly BTRFS warning (device sda1): Skipping commit of aborted transaction. BTRFS: error (device sda1) in cleanup_transaction:1831: errno=-24 unknown
[CAUSE]
The error is EMFILE (Too many files open) and comes from the anonymous block device allocation. The ids are in a shared pool of size 1<<20.
The ids are assigned to live subvolumes, ie. the root structure exists in memory (eg. after creation or after the root appears in some path). The pool could be exhausted if the numbers are not reclaimed fast enough, after subvolume deletion or if other system component uses the anon block devices.
[WORKAROUND]
Since it's not possible to completely solve the problem, we can only minimize the time the id is allocated to a subvolume root.
Firstly, we can reduce the use of anon_dev by trees that are not subvolume roots, like data reloc tree.
This patch will do extra check on root objectid, to skip roots that don't need anon_dev. Currently it's only data reloc tree and orphan roots.
--- fs/btrfs/disk-io.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
fs/btrfs/disk-io.c +10 -3
@@ -1475,9 +1475,16 @@ int btrfs_init_fs_root(struct btrfs_rootspin_lock_init (&root->ino_cache_lock);init_waitqueue_head (&root->ino_cache_wait); - ret =get_anon_bdev (&root->anon_dev); -if (ret) - goto fail; +/* +* Don't assign anonymous block device to roots that are not exposed to +* userspace, the id pool is limited to 1M +*/ +if (is_fstree (root->root_key.objectid) && +btrfs_root_refs (&root->root_item) >0 ) { + ret =get_anon_bdev (&root->anon_dev); +if (ret) + goto fail; + }mutex_lock (&root->objectid_mutex); ret = btrfs_find_highest_objectid(root,
Greg Kroah-Hartman
maintainerPATCH 12/152 btrfs: ref-verify: fix memory leak in add_block_entry
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
commit d60ba8de1164e1b42e296ff270c622a070ef8fe7 upstream.
clang static analysis flags this error
fs/btrfs/ref-verify.c:290:3: warning: Potential leak of memory pointed to by 're' [unix.Malloc]
kfree(be);
^~~~~The problem is in this block of code:
if (root_objectid) {
struct root_entry *exist_re;
exist_re = insert_root_entry(&exist->roots, re);
if (exist_re)
kfree(re);
}There is no 'else' block freeing when root_objectid is 0. Add the missing kfree to the else branch.
--- fs/btrfs/ref-verify.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/ref-verify.c +2 -0
@@ -286,6 +286,8 @@ static struct block_entry *add_block_ent exist_re =insert_root_entry (&exist->roots, re);if (exist_re)kfree (re); + }else { +kfree (re); }kfree (be);return exist;
Greg Kroah-Hartman
maintainerPATCH 13/152 btrfs: stop incremening log_batch for the log root tree when syncing log
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 28a9579561bcb9082715e720eac93012e708ab94 upstream.
We are incrementing the log_batch atomic counter of the root log tree but we never use that counter, it's used only for the log trees of subvolume roots. We started doing it when we moved the log_batch and log_write counters from the global, per fs, btrfs_fs_info structure, into the btrfs_root structure in commit 7237f1833601dc ("Btrfs: fix tree logs parallel sync").
So just stop doing it for the log root tree and add a comment over the field declaration so inform it's used only for log trees of subvolume roots.
This patch is part of a series that has the following patches:
1/4 btrfs: only commit the delayed inode when doing a full fsync 2/4 btrfs: only commit delayed items at fsync if we are logging a directory 3/4 btrfs: stop incremening log_batch for the log root tree when syncing log 4/4 btrfs: remove no longer needed use of log_writers for the log root tree
After the entire patchset applied I saw about 12% decrease on max latency reported by dbench. The test was done on a qemu vm, with 8 cores, 16Gb of ram, using kvm and using a raw NVMe device directly (no intermediary fs on the host). The test was invoked like the following:
mkfs.btrfs -f /dev/sdk
mount -o ssd -o nospace_cache /dev/sdk /mnt/sdk
dbench -D /mnt/sdk -t 300 8
umount /mnt/dsk
--- fs/btrfs/ctree.h | 1 + fs/btrfs/tree-log.c | 1 - 2 files changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/ctree.h +1 -0
@@ -992,6 +992,7 @@ struct btrfs_root {struct list_head log_ctxs[2 ];atomic_t log_writers;atomic_t log_commit[2 ]; +/* Used only for log trees of subvolumes, not for the log root tree */ atomic_t log_batch;int log_transid;/* No matter the commit succeeds or not*/
fs/btrfs/tree-log.c +0 -1
@@ -3140,7 +3140,6 @@ int btrfs_sync_log(struct btrfs_trans_habtrfs_init_log_ctx (&root_log_ctx,NULL );mutex_lock (&log_root_tree->log_mutex); -atomic_inc (&log_root_tree->log_batch);atomic_inc (&log_root_tree->log_writers); index2 = log_root_tree->log_transid %2 ;
Greg Kroah-Hartman
maintainerPATCH 14/152 btrfs: remove no longer needed use of log_writers for the log root tree
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit a93e01682e283f6de09d6ce8f805dc52a2e942fb upstream.
When syncing the log, we used to update the log root tree without holding neither the log_mutex of the subvolume root nor the log_mutex of log root tree.
We used to have two critical sections delimited by the log_mutex of the log root tree, so in the first one we incremented the log_writers of the log root tree and on the second one we decremented it and waited for the log_writers counter to go down to zero. This was because the update of the log root tree happened between the two critical sections.
The use of two critical sections allowed a little bit more of parallelism and required the use of the log_writers counter, necessary to make sure we didn't miss any log root tree update when we have multiple tasks trying to sync the log in parallel.
However after commit 06989c799f0481 ("Btrfs: fix race updating log root item during fsync") the log root tree update was moved into a critical section delimited by the subvolume's log_mutex. Later another commit moved the log tree update from that critical section into the second critical section delimited by the log_mutex of the log root tree. Both commits addressed different bugs.
The end result is that the first critical section delimited by the log_mutex of the log root tree became pointless, since there's nothing done between it and the second critical section, we just have an unlock of the log_mutex followed by a lock operation. This means we can merge both critical sections, as the first one does almost nothing now, and we can stop using the log_writers counter of the log root tree, which was incremented in the first critical section and decremented in the second criticial section, used to make sure no one in the second critical section started writeback of the log root tree before some other task updated it.
So just remove the mutex_unlock() followed by mutex_lock() of the log root tree, as well as the use of the log_writers counter for the log root tree.
This patch is part of a series that has the following patches:
1/4 btrfs: only commit the delayed inode when doing a full fsync 2/4 btrfs: only commit delayed items at fsync if we are logging a directory 3/4 btrfs: stop incremening log_batch for the log root tree when syncing log 4/4 btrfs: remove no longer needed use of log_writers for the log root tree
After the entire patchset applied I saw about 12% decrease on max latency reported by dbench. The test was done on a qemu vm, with 8 cores, 16Gb of ram, using kvm and using a raw NVMe device directly (no intermediary fs on the host). The test was invoked like the following:
mkfs.btrfs -f /dev/sdk
mount -o ssd -o nospace_cache /dev/sdk /mnt/sdk
dbench -D /mnt/sdk -t 300 8
umount /mnt/dsk
--- fs/btrfs/ctree.h | 1 + fs/btrfs/tree-log.c | 13 ------------- 2 files changed, 1 insertion(+), 13 deletions(-)
fs/btrfs/ctree.h +1 -0
@@ -990,6 +990,7 @@ struct btrfs_root {wait_queue_head_t log_writer_wait;wait_queue_head_t log_commit_wait[2 ];struct list_head log_ctxs[2 ]; +/* Used only for log trees of subvolumes, not for the log root tree */ atomic_t log_writers;atomic_t log_commit[2 ];/* Used only for log trees of subvolumes, not for the log root tree */
fs/btrfs/tree-log.c +0 -13
@@ -3140,28 +3140,17 @@ int btrfs_sync_log(struct btrfs_trans_habtrfs_init_log_ctx (&root_log_ctx,NULL );mutex_lock (&log_root_tree->log_mutex); -atomic_inc (&log_root_tree->log_writers); index2 = log_root_tree->log_transid %2 ;list_add_tail (&root_log_ctx.list, &log_root_tree->log_ctxs[index2]); root_log_ctx.log_transid = log_root_tree->log_transid; -mutex_unlock (&log_root_tree->log_mutex); - -mutex_lock (&log_root_tree->log_mutex); -/* * Now we are safe to update the log_root_tree because we're under the * log_mutex, and we're a current writer so we're holding the commit * open until we drop the log_mutex. */ ret =update_log_root (trans, log, &new_root_item); - -if (atomic_dec_and_test (&log_root_tree->log_writers)) { -/* atomic_dec_and_test implies a barrier */ -cond_wake_up_nomb (&log_root_tree->log_writer_wait); - } -if (ret) {if (!list_empty (&root_log_ctx.list))list_del_init (&root_log_ctx.list);
@@ -3207,8 +3196,6 @@ int btrfs_sync_log(struct btrfs_trans_ha root_log_ctx.log_transid - 1); } -wait_for_writer (log_root_tree); -/* * now that we've moved on to the tree of log tree roots, * check the full commit flag again
Greg Kroah-Hartman
maintainerPATCH 15/152 btrfs: dont traverse into the seed devices in show_devname
In reply to Greg Kroah-HartmanFrom: Anand Jain <[email protected]>
commit 4faf55b03823e96c44dc4e364520000ed3b12fdb upstream.
->show_devname currently shows the lowest devid in the list. As the seed devices have the lowest devid in the sprouted filesystem, the userland tool such as findmnt end up seeing seed device instead of the device from the read-writable sprouted filesystem. As shown below.
mount /dev/sda /btrfs
mount: /btrfs: WARNING: device write-protected, mounted read-only.
findmnt --output SOURCE,TARGET,UUID /btrfs
SOURCE TARGET UUID
/dev/sda /btrfs 899f7027-3e46-4626-93e7-7d4c9ad19111
btrfs dev add -f /dev/sdb /btrfs
umount /btrfs
mount /dev/sdb /btrfs
findmnt --output SOURCE,TARGET,UUID /btrfs
SOURCE TARGET UUID
/dev/sda /btrfs 899f7027-3e46-4626-93e7-7d4c9ad19111
All sprouts from a single seed will show the same seed device and the same fsid. That's confusing.
This is causing problems in our prototype as there isn't any reference to the sprout file-system(s) which is being used for actual read and write.
This was added in the patch which implemented the show_devname in btrfs commit 9c5085c14798 ("Btrfs: implement ->show_devname").
I tried to look for any particular reason that we need to show the seed device, there isn't any.
So instead, do not traverse through the seed devices, just show the lowest devid in the sprouted fsid.
After the patch:
mount /dev/sda /btrfs
mount: /btrfs: WARNING: device write-protected, mounted read-only.
findmnt --output SOURCE,TARGET,UUID /btrfs
SOURCE TARGET UUID
/dev/sda /btrfs 899f7027-3e46-4626-93e7-7d4c9ad19111
btrfs dev add -f /dev/sdb /btrfs
mount -o rw,remount /dev/sdb /btrfs
findmnt --output SOURCE,TARGET,UUID /btrfs
SOURCE TARGET UUID
/dev/sdb /btrfs 595ca0e6-b82e-46b5-b9e2-c72a6928be48
mount /dev/sda /btrfs1
mount: /btrfs1: WARNING: device write-protected, mounted read-only.
btrfs dev add -f /dev/sdc /btrfs1
findmnt --output SOURCE,TARGET,UUID /btrfs1
SOURCE TARGET UUID
/dev/sdc /btrfs1 ca1dbb7a-8446-4f95-853c-a20f3f82bdbb
cat /proc/self/mounts | grep btrfs
/dev/sdb /btrfs btrfs rw,relatime,noacl,space_cache,subvolid=5,subvol=/ 0 0 /dev/sdc /btrfs1 btrfs ro,relatime,noacl,space_cache,subvolid=5,subvol=/ 0 0
--- fs/btrfs/super.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-)
fs/btrfs/super.c +7 -14
@@ -2254,9 +2254,7 @@ static int btrfs_unfreeze(struct super_bstatic int btrfs_show_devname (struct seq_file *m,struct dentry *root) {struct btrfs_fs_info *fs_info =btrfs_sb (root->d_sb); -struct btrfs_fs_devices *cur_devices;struct btrfs_device *dev, *first_dev =NULL ; -struct list_head *head;/* * Lightweight locking of the devices. We should not need
@@ -2266,18 +2264,13 @@ static int btrfs_show_devname(struct seq* least until the rcu_read_unlock. */ rcu_read_lock (); - cur_devices = fs_info->fs_devices; -while (cur_devices) { - head = &cur_devices->devices; -list_for_each_entry_rcu (dev, head, dev_list) { -if (test_bit (BTRFS_DEV_STATE_MISSING , &dev->dev_state)) -continue ; -if (!dev->name) -continue ; -if (!first_dev || dev->devid < first_dev->devid) - first_dev = dev; - } - cur_devices = cur_devices->seed; +list_for_each_entry_rcu (dev, &fs_info->fs_devices->devices, dev_list) { +if (test_bit (BTRFS_DEV_STATE_MISSING , &dev->dev_state)) +continue ; +if (!dev->name) +continue ; +if (!first_dev || dev->devid < first_dev->devid) + first_dev = dev; }if (first_dev)
Greg Kroah-Hartman
maintainerPATCH 16/152 btrfs: open device without device_list_mutex
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 18c850fdc5a801bad4977b0f1723761d42267e45 upstream.
There's long existed a lockdep splat because we open our bdev's under the ->device_list_mutex at mount time, which acquires the bd_mutex. Usually this goes unnoticed, but if you do loopback devices at all suddenly the bd_mutex comes with a whole host of other dependencies, which results in the splat when you mount a btrfs file system.
======================================================
WARNING: possible circular locking dependency detected 5.8.0-0.rc3.1.fc33.x86_64+debug #1 Not tainted
------------------------------------------------------
systemd-journal/509 is trying to acquire lock:ffff970831f84db0 (&fs_info->reloc_mutex){+.+.}-{3:3}, at: btrfs_record_root_in_trans+0x44/0x70 [btrfs]
but task is already holding lock:ffff97083144d598 (sb_pagefaults){.+.+}-{0:0}, at: btrfs_page_mkwrite+0x59/0x560 [btrfs]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #6 (sb_pagefaults){.+.+}-{0:0}:
__sb_start_write+0x13e/0x220
btrfs_page_mkwrite+0x59/0x560 [btrfs]
do_page_mkwrite+0x4f/0x130
do_wp_page+0x3b0/0x4f0
handle_mm_fault+0xf47/0x1850
do_user_addr_fault+0x1fc/0x4b0
exc_page_fault+0x88/0x300
asm_exc_page_fault+0x1e/0x30-> #5 (&mm->mmap_lock#2){++++}-{3:3}:
__might_fault+0x60/0x80
_copy_from_user+0x20/0xb0
get_sg_io_hdr+0x9a/0xb0
scsi_cmd_ioctl+0x1ea/0x2f0
cdrom_ioctl+0x3c/0x12b4
sr_block_ioctl+0xa4/0xd0
block_ioctl+0x3f/0x50
ksys_ioctl+0x82/0xc0
__x64_sys_ioctl+0x16/0x20
do_syscall_64+0x52/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xa9-> #4 (&cd->lock){+.+.}-{3:3}:
__mutex_lock+0x7b/0x820
sr_block_open+0xa2/0x180
__blkdev_get+0xdd/0x550
blkdev_get+0x38/0x150
do_dentry_open+0x16b/0x3e0
path_openat+0x3c9/0xa00
do_filp_open+0x75/0x100
do_sys_openat2+0x8a/0x140
__x64_sys_openat+0x46/0x70
do_syscall_64+0x52/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xa9-> #3 (&bdev->bd_mutex){+.+.}-{3:3}:
__mutex_lock+0x7b/0x820
__blkdev_get+0x6a/0x550
blkdev_get+0x85/0x150
blkdev_get_by_path+0x2c/0x70
btrfs_get_bdev_and_sb+0x1b/0xb0 [btrfs]
open_fs_devices+0x88/0x240 [btrfs]
btrfs_open_devices+0x92/0xa0 [btrfs]
btrfs_mount_root+0x250/0x490 [btrfs]
legacy_get_tree+0x30/0x50
vfs_get_tree+0x28/0xc0
vfs_kern_mount.part.0+0x71/0xb0
btrfs_mount+0x119/0x380 [btrfs]
legacy_get_tree+0x30/0x50
vfs_get_tree+0x28/0xc0
do_mount+0x8c6/0xca0
__x64_sys_mount+0x8e/0xd0
do_syscall_64+0x52/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xa9-> #2 (&fs_devs->device_list_mutex){+.+.}-{3:3}:
__mutex_lock+0x7b/0x820
btrfs_run_dev_stats+0x36/0x420 [btrfs]
commit_cowonly_roots+0x91/0x2d0 [btrfs]
btrfs_commit_transaction+0x4e6/0x9f0 [btrfs]
btrfs_sync_file+0x38a/0x480 [btrfs]
__x64_sys_fdatasync+0x47/0x80
do_syscall_64+0x52/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xa9-> #1 (&fs_info->tree_log_mutex){+.+.}-{3:3}:
__mutex_lock+0x7b/0x820
btrfs_commit_transaction+0x48e/0x9f0 [btrfs]
btrfs_sync_file+0x38a/0x480 [btrfs]
__x64_sys_fdatasync+0x47/0x80
do_syscall_64+0x52/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xa9-> #0 (&fs_info->reloc_mutex){+.+.}-{3:3}:
__lock_acquire+0x1241/0x20c0
lock_acquire+0xb0/0x400
__mutex_lock+0x7b/0x820
btrfs_record_root_in_trans+0x44/0x70 [btrfs]
start_transaction+0xd2/0x500 [btrfs]
btrfs_dirty_inode+0x44/0xd0 [btrfs]
file_update_time+0xc6/0x120
btrfs_page_mkwrite+0xda/0x560 [btrfs]
do_page_mkwrite+0x4f/0x130
do_wp_page+0x3b0/0x4f0
handle_mm_fault+0xf47/0x1850
do_user_addr_fault+0x1fc/0x4b0
exc_page_fault+0x88/0x300
asm_exc_page_fault+0x1e/0x30other info that might help us debug this:
Chain exists of: &fs_info->reloc_mutex --> &mm->mmap_lock#2 --> sb_pagefaults Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(sb_pagefaults);
lock(&mm->mmap_lock#2);
lock(sb_pagefaults); lock(&fs_info->reloc_mutex);
*** DEADLOCK ***
3 locks held by systemd-journal/509:
#0: ffff97083bdec8b8 (&mm->mmap_lock#2){++++}-{3:3}, at: do_user_addr_fault+0x12e/0x4b0 #1: ffff97083144d598 (sb_pagefaults){.+.+}-{0:0}, at: btrfs_page_mkwrite+0x59/0x560 [btrfs] #2: ffff97083144d6a8 (sb_internal){.+.+}-{0:0}, at: start_transaction+0x3f8/0x500 [btrfs]
stack backtrace: CPU: 0 PID: 509 Comm: systemd-journal Not tainted 5.8.0-0.rc3.1.fc33.x86_64+debug #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: dump_stack+0x92/0xc8 check_noncircular+0x134/0x150 __lock_acquire+0x1241/0x20c0 lock_acquire+0xb0/0x400 ? btrfs_record_root_in_trans+0x44/0x70 [btrfs] ? lock_acquire+0xb0/0x400 ? btrfs_record_root_in_trans+0x44/0x70 [btrfs] __mutex_lock+0x7b/0x820 ? btrfs_record_root_in_trans+0x44/0x70 [btrfs] ? kvm_sched_clock_read+0x14/0x30 ? sched_clock+0x5/0x10 ? sched_clock_cpu+0xc/0xb0 btrfs_record_root_in_trans+0x44/0x70 [btrfs] start_transaction+0xd2/0x500 [btrfs] btrfs_dirty_inode+0x44/0xd0 [btrfs] file_update_time+0xc6/0x120 btrfs_page_mkwrite+0xda/0x560 [btrfs] ? sched_clock+0x5/0x10 do_page_mkwrite+0x4f/0x130 do_wp_page+0x3b0/0x4f0 handle_mm_fault+0xf47/0x1850 do_user_addr_fault+0x1fc/0x4b0 exc_page_fault+0x88/0x300 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x7fa3972fdbfe Code: Bad RIP value.
Fix this by not holding the ->device_list_mutex at this point. The device_list_mutex exists to protect us from modifying the device list while the file system is running.
However it can also be modified by doing a scan on a device. But this action is specifically protected by the uuid_mutex, which we are holding here. We cannot race with opening at this point because we have the ->s_mount lock held during the mount. Not having the ->device_list_mutex here is perfectly safe as we're not going to change the devices at this point.
--- fs/btrfs/volumes.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
fs/btrfs/volumes.c +18 -3
@@ -219,7 +219,9 @@ static int __btrfs_map_block(struct btrf* * global::fs_devs - add, remove, updates to the global list * -* does not protect: manipulation of the fs_devices::devices list! +* does not protect: manipulation of the fs_devices::devices list in general +* but in mount context it could be used to exclude list modifications by eg. +* scan ioctl * * btrfs_device::name - renames (write side), read is RCU *
@@ -232,6 +234,9 @@ static int __btrfs_map_block(struct btrf* may be used to exclude some operations from running concurrently without any * modifications to the list (see write_all_supers) * +* Is not required at mount and close times, because our device list is +* protected by the uuid_mutex at that point. +* * balance_mutex * ------------- * protects balance structures (status, state) and context accessed from
@@ -778,6 +783,11 @@ static int btrfs_free_stale_devices(consreturn ret; } +/* +* This is only used on mount, and we are protected from competing things +* messing with our fs_devices by the uuid_mutex, thus we do not need the +* fs_devices->device_list_mutex here. +*/ static int btrfs_open_one_device (struct btrfs_fs_devices *fs_devices,struct btrfs_device *device,fmode_t flags,void *holder)
@@ -1418,8 +1428,14 @@ int btrfs_open_devices(struct btrfs_fs_dint ret;lockdep_assert_held (&uuid_mutex); +/* +* The device_list_mutex cannot be taken here in case opening the +* underlying device takes further locks like bd_mutex. +* +* We also don't need the lock here as this is called during mount and +* exclusion is provided by uuid_mutex +*/ -mutex_lock (&fs_devices->device_list_mutex);if (fs_devices->opened) { fs_devices->opened++; ret =0 ;
@@ -1427,7 +1443,6 @@ int btrfs_open_devices(struct btrfs_fs_dlist_sort (NULL , &fs_devices->devices, devid_cmp); ret =open_fs_devices (fs_devices, flags, holder); } -mutex_unlock (&fs_devices->device_list_mutex);return ret; }
Greg Kroah-Hartman
maintainerPATCH 17/152 btrfs: move the chunk_mutex in btrfs_read_chunk_tree
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 01d01caf19ff7c537527d352d169c4368375c0a1 upstream.
We are currently getting this lockdep splat in btrfs/161:
======================================================
WARNING: possible circular locking dependency detected
5.8.0-rc5+ #20 Tainted: G E
------------------------------------------------------
mount/678048 is trying to acquire lock:
ffff9b769f15b6e0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: clone_fs_devices+0x4d/0x170 [btrfs]
but task is already holding lock:
ffff9b76abdb08d0 (&fs_info->chunk_mutex){+.+.}-{3:3}, at: btrfs_read_chunk_tree+0x6a/0x800 [btrfs]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&fs_info->chunk_mutex){+.+.}-{3:3}:
__mutex_lock+0x8b/0x8f0 btrfs_init_new_device+0x2d2/0x1240 [btrfs] btrfs_ioctl+0x1de/0x2d20 [btrfs] ksys_ioctl+0x87/0xc0 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x52/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xa9
-> #0 (&fs_devs->device_list_mutex){+.+.}-{3:3}:
__lock_acquire+0x1240/0x2460 lock_acquire+0xab/0x360 __mutex_lock+0x8b/0x8f0 clone_fs_devices+0x4d/0x170 [btrfs] btrfs_read_chunk_tree+0x330/0x800 [btrfs] open_ctree+0xb7c/0x18ce [btrfs] btrfs_mount_root.cold+0x13/0xfa [btrfs] legacy_get_tree+0x30/0x50 vfs_get_tree+0x28/0xc0 fc_mount+0xe/0x40 vfs_kern_mount.part.0+0x71/0x90 btrfs_mount+0x13b/0x3e0 [btrfs] legacy_get_tree+0x30/0x50 vfs_get_tree+0x28/0xc0 do_mount+0x7de/0xb30 __x64_sys_mount+0x8e/0xd0 do_syscall_64+0x52/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xa9
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&fs_info->chunk_mutex);
lock(&fs_devs->device_list_mutex);
lock(&fs_info->chunk_mutex);
lock(&fs_devs->device_list_mutex);*** DEADLOCK ***
3 locks held by mount/678048:
#0: ffff9b75ff5fb0e0 (&type->s_umount_key#63/1){+.+.}-{3:3}, at: alloc_super+0xb5/0x380 #1: ffffffffc0c2fbc8 (uuid_mutex){+.+.}-{3:3}, at: btrfs_read_chunk_tree+0x54/0x800 [btrfs] #2: ffff9b76abdb08d0 (&fs_info->chunk_mutex){+.+.}-{3:3}, at: btrfs_read_chunk_tree+0x6a/0x800 [btrfs]
stack backtrace: CPU: 2 PID: 678048 Comm: mount Tainted: G E 5.8.0-rc5+ #20 Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./890FX Deluxe5, BIOS P1.40 05/03/2011 Call Trace: dump_stack+0x96/0xd0 check_noncircular+0x162/0x180 __lock_acquire+0x1240/0x2460 ? asm_sysvec_apic_timer_interrupt+0x12/0x20 lock_acquire+0xab/0x360 ? clone_fs_devices+0x4d/0x170 [btrfs] __mutex_lock+0x8b/0x8f0 ? clone_fs_devices+0x4d/0x170 [btrfs] ? rcu_read_lock_sched_held+0x52/0x60 ? cpumask_next+0x16/0x20 ? module_assert_mutex_or_preempt+0x14/0x40 ? __module_address+0x28/0xf0 ? clone_fs_devices+0x4d/0x170 [btrfs] ? static_obj+0x4f/0x60 ? lockdep_init_map_waits+0x43/0x200 ? clone_fs_devices+0x4d/0x170 [btrfs] clone_fs_devices+0x4d/0x170 [btrfs] btrfs_read_chunk_tree+0x330/0x800 [btrfs] open_ctree+0xb7c/0x18ce [btrfs] ? super_setup_bdi_name+0x79/0xd0 btrfs_mount_root.cold+0x13/0xfa [btrfs] ? vfs_parse_fs_string+0x84/0xb0 ? rcu_read_lock_sched_held+0x52/0x60 ? kfree+0x2b5/0x310 legacy_get_tree+0x30/0x50 vfs_get_tree+0x28/0xc0 fc_mount+0xe/0x40 vfs_kern_mount.part.0+0x71/0x90 btrfs_mount+0x13b/0x3e0 [btrfs] ? cred_has_capability+0x7c/0x120 ? rcu_read_lock_sched_held+0x52/0x60 ? legacy_get_tree+0x30/0x50 legacy_get_tree+0x30/0x50 vfs_get_tree+0x28/0xc0 do_mount+0x7de/0xb30 ? memdup_user+0x4e/0x90 __x64_sys_mount+0x8e/0xd0 do_syscall_64+0x52/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xa9
This is because btrfs_read_chunk_tree() can come upon DEV_EXTENT's and then read the device, which takes the device_list_mutex. The device_list_mutex needs to be taken before the chunk_mutex, so this is a problem. We only really need the chunk mutex around adding the chunk, so move the mutex around read_one_chunk.
An argument could be made that we don't even need the chunk_mutex here as it's during mount, and we are protected by various other locks. However we already have special rules for ->device_list_mutex, and I'd rather not have another special case for ->chunk_mutex.
--- fs/btrfs/volumes.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/volumes.c +2 -2
@@ -7282,7 +7282,6 @@ int btrfs_read_chunk_tree(struct btrfs_f* otherwise we don't need it. */ mutex_lock (&uuid_mutex); -mutex_lock (&fs_info->chunk_mutex);/* * It is possible for mount and umount to race in such a way that
@@ -7327,7 +7326,9 @@ int btrfs_read_chunk_tree(struct btrfs_f }else if (found_key.type ==BTRFS_CHUNK_ITEM_KEY ) {struct btrfs_chunk *chunk; chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk); +mutex_lock (&fs_info->chunk_mutex); ret =read_one_chunk (&found_key, leaf, chunk); +mutex_unlock (&fs_info->chunk_mutex);if (ret) goto error; }
@@ -7357,7 +7358,6 @@ int btrfs_read_chunk_tree(struct btrfs_f } ret =0 ; error: -mutex_unlock (&fs_info->chunk_mutex);mutex_unlock (&uuid_mutex);btrfs_free_path (path);
Greg Kroah-Hartman
maintainerPATCH 18/152 btrfs: relocation: review the call sites which can be interrupted by signal
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 44d354abf33e92a5e73b965c84caf5a5d5e58a0b upstream.
Since most metadata reservation calls can return -EINTR when get interrupted by fatal signal, we need to review the all the metadata reservation call sites.
In relocation code, the metadata reservation happens in the following sites:
- btrfs_block_rsv_refill() in merge_reloc_root() merge_reloc_root() is a pretty critical section, we don't want to be interrupted by signal, so change the flush status to BTRFS_RESERVE_FLUSH_LIMIT, so it won't get interrupted by signal. Since such change can be ENPSPC-prone, also shrink the amount of metadata to reserve least amount avoid deadly ENOSPC there.
- btrfs_block_rsv_refill() in reserve_metadata_space()
It calls with BTRFS_RESERVE_FLUSH_LIMIT, which won't get interrupted by signal.
- btrfs_block_rsv_refill() in prepare_to_relocate()
- btrfs_block_rsv_add() in prepare_to_relocate()
- btrfs_block_rsv_refill() in relocate_block_group()
- btrfs_delalloc_reserve_metadata() in relocate_file_extent_cluster()
- btrfs_start_transaction() in relocate_block_group()
- btrfs_start_transaction() in create_reloc_inode()
Can be interrupted by fatal signal and we can handle it easily. For these call sites, just catch the -EINTR value in btrfs_balance() and count them as canceled.
--- fs/btrfs/relocation.c | 12 ++++++++++-- fs/btrfs/volumes.c | 17 ++++++++++++++++- 2 files changed, 26 insertions(+), 3 deletions(-)
fs/btrfs/relocation.c +10 -2
@@ -2312,12 +2312,20 @@ static noinline_for_stack int merge_relobtrfs_unlock_up_safe (path,0 ); } - min_reserved = fs_info->nodesize * (BTRFS_MAX_LEVEL -1 ) *2 ; +/* +* In merge_reloc_root(), we modify the upper level pointer to swap the +* tree blocks between reloc tree and subvolume tree. Thus for tree +* block COW, we COW at most from level 1 to root level for each tree. +* +* Thus the needed metadata size is at most root_level * nodesize, +* and * 2 since we have two trees to COW. +*/ + min_reserved = fs_info->nodesize *btrfs_root_level (root_item) *2 ;memset (&next_key,0 ,sizeof (next_key));while (1 ) { ret =btrfs_block_rsv_refill (root, rc->block_rsv, min_reserved, -BTRFS_RESERVE_FLUSH_ALL ); +BTRFS_RESERVE_FLUSH_LIMIT );if (ret) { err = ret; goto out;
fs/btrfs/volumes.c +16 -1
@@ -4261,7 +4261,22 @@ int btrfs_balance(struct btrfs_fs_info *mutex_lock (&fs_info->balance_mutex);if (ret == -ECANCELED &&atomic_read (&fs_info->balance_pause_req))btrfs_info (fs_info,"balance: paused" ); -else if (ret == -ECANCELED &&atomic_read (&fs_info->balance_cancel_req)) +/* +* Balance can be canceled by: +* +* - Regular cancel request +* Then ret == -ECANCELED and balance_cancel_req > 0 +* +* - Fatal signal to "btrfs" process +* Either the signal caught by wait_reserve_ticket() and callers +* got -EINTR, or caught by btrfs_should_cancel_balance() and +* got -ECANCELED. +* Either way, in this case balance_cancel_req = 0, and +* ret == -EINTR or ret == -ECANCELED. +* +* So here we only check the return value to catch canceled balance. +*/ +else if (ret == -ECANCELED || ret == -EINTR )btrfs_info (fs_info,"balance: canceled" );else btrfs_info (fs_info,"balance: ended with status: %d" , ret);
Greg Kroah-Hartman
maintainerPATCH 19/152 btrfs: add missing check for nocow and compression inode flags
In reply to Greg Kroah-HartmanFrom: David Sterba <[email protected]>
commit f37c563bab4297024c300b05c8f48430e323809d upstream.
User Forza reported on IRC that some invalid combinations of file attributes are accepted by chattr.
The NODATACOW and compression file flags/attributes are mutually exclusive, but they could be set by 'chattr +c +C' on an empty file. The nodatacow will be in effect because it's checked first in btrfs_run_delalloc_range.
Extend the flag validation to catch the following cases:
- input flags are conflicting
- old and new flags are conflicting
- initialize the local variable with inode flags after inode ls locked
Inode attributes take precedence over mount options and are an independent setting.
Nocompress would be a no-op with nodatacow, but we don't want to mix any compression-related options with nodatacow.
--- fs/btrfs/ioctl.c | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-)
fs/btrfs/ioctl.c +22 -8
@@ -167,8 +167,11 @@ static int btrfs_ioctl_getflags(struct freturn 0 ; } -/* Check if @flags are a supported and valid set of FS_*_FL flags */ -static int check_fsflags (unsigned int flags) +/* +* Check if @flags are a supported and valid set of FS_*_FL flags and that +* the old and new flags are not conflicting +*/ +static int check_fsflags (unsigned int old_flags,unsigned int flags) { if (flags & ~(FS_IMMUTABLE_FL | FS_APPEND_FL | \ FS_NOATIME_FL | FS_NODUMP_FL | \
@@ -177,9 +180,19 @@ static int check_fsflags(unsigned int fl FS_NOCOW_FL))return -EOPNOTSUPP ; +/* COMPR and NOCOMP on new/old are valid */ if ((flags &FS_NOCOMP_FL ) && (flags &FS_COMPR_FL ))return -EINVAL ; +if ((flags &FS_COMPR_FL ) && (flags &FS_NOCOW_FL )) +return -EINVAL ; + +/* NOCOW and compression options are mutually exclusive */ +if ((old_flags &FS_NOCOW_FL ) && (flags & (FS_COMPR_FL |FS_NOCOMP_FL ))) +return -EINVAL ; +if ((flags &FS_NOCOW_FL ) && (old_flags & (FS_COMPR_FL |FS_NOCOMP_FL ))) +return -EINVAL ; +return 0 ; }
@@ -193,7 +206,7 @@ static int btrfs_ioctl_setflags(struct funsigned int fsflags, old_fsflags;int ret;const char *comp =NULL ; -u32 binode_flags = binode->flags; +u32 binode_flags;if (!inode_owner_or_capable (inode))return -EPERM ;
@@ -204,22 +217,23 @@ static int btrfs_ioctl_setflags(struct fif (copy_from_user (&fsflags, arg,sizeof (fsflags)))return -EFAULT ; - ret =check_fsflags (fsflags); -if (ret) -return ret; - ret =mnt_want_write_file (file);if (ret)return ret;inode_lock (inode); - fsflags =btrfs_mask_fsflags_for_type (inode, fsflags); old_fsflags =btrfs_inode_flags_to_fsflags (binode->flags); + ret =vfs_ioc_setflags_prepare (inode, old_fsflags, fsflags);if (ret) goto out_unlock; + ret =check_fsflags (old_fsflags, fsflags); +if (ret) + goto out_unlock; + + binode_flags = binode->flags;if (fsflags &FS_SYNC_FL ) binode_flags |=BTRFS_INODE_SYNC ;else
Greg Kroah-Hartman
maintainerPATCH 20/152 btrfs: avoid possible signal interruption of btrfs_drop_snapshot() on relocation tree
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit f3e3d9cc35252a70a2fd698762c9687718268ec6 upstream.
[BUG]
There is a bug report about bad signal timing could lead to read-only fs during balance:
BTRFS info (device xvdb): balance: start -d -m -s
BTRFS info (device xvdb): relocating block group 73001861120 flags metadata BTRFS info (device xvdb): found 12236 extents, stage: move data extents BTRFS info (device xvdb): relocating block group 71928119296 flags data BTRFS info (device xvdb): found 3 extents, stage: move data extents BTRFS info (device xvdb): found 3 extents, stage: update data pointers BTRFS info (device xvdb): relocating block group 60922265600 flags metadata
BTRFS: error (device xvdb) in btrfs_drop_snapshot:5505: errno=-4 unknown BTRFS info (device xvdb): forced readonly
BTRFS info (device xvdb): balance: ended with status: -4
[CAUSE]
The direct cause is the -EINTR from the following call chain when a fatal signal is pending:
relocate_block_group()
|- clean_dirty_subvols()
|- btrfs_drop_snapshot()
|- btrfs_start_transaction()
|- btrfs_delayed_refs_rsv_refill()
|- btrfs_reserve_metadata_bytes()
|- __reserve_metadata_bytes()
|- wait_reserve_ticket()
|- prepare_to_wait_event();
|- ticket->error = -EINTR;Normally this behavior is fine for most btrfs_start_transaction() callers, as they need to catch any other error, same for the signal, and exit ASAP.
However for balance, especially for the clean_dirty_subvols() case, we're already doing cleanup works, getting -EINTR from btrfs_drop_snapshot() could cause a lot of unexpected problems.
Quoted 1 line
From the mentioned forced read-only report, to later balance error due
to half dropped reloc trees.
[FIX]
Fix this problem by using btrfs_join_transaction() if btrfs_drop_snapshot() is called from relocation context.
Since btrfs_join_transaction() won't get interrupted by signal, we can continue the cleanup.
--- fs/btrfs/extent-tree.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/btrfs/extent-tree.c +8 -1
@@ -5221,7 +5221,14 @@ int btrfs_drop_snapshot(struct btrfs_roo goto out; } - trans =btrfs_start_transaction (tree_root,0 ); +/* +* Use join to avoid potential EINTR from transaction start. See +* wait_reserve_ticket and the whole reservation callchain. +*/ +if (for_reloc) + trans =btrfs_join_transaction (tree_root); +else + trans =btrfs_start_transaction (tree_root,0 );if (IS_ERR (trans)) { err =PTR_ERR (trans); goto out_free;
Greg Kroah-Hartman
maintainerPATCH 21/152 btrfs: sysfs: use NOFS for device creation
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit a47bd78d0c44621efb98b525d04d60dc4d1a79b0 upstream.
Dave hit this splat during testing btrfs/078:
======================================================
WARNING: possible circular locking dependency detected
5.8.0-rc6-default+ #1191 Not tainted
------------------------------------------------------
kswapd0/75 is trying to acquire lock:
ffffa040e9d04ff8 (&delayed_node->mutex){+.+.}-{3:3}, at: __btrfs_release_delayed_node.part.0+0x3f/0x310 [btrfs]
but task is already holding lock:
ffffffff8b0c8040 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x5/0x30
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (fs_reclaim){+.+.}-{0:0}:
__lock_acquire+0x56f/0xaa0 lock_acquire+0xa3/0x440 fs_reclaim_acquire.part.0+0x25/0x30 __kmalloc_track_caller+0x49/0x330 kstrdup+0x2e/0x60 __kernfs_new_node.constprop.0+0x44/0x250 kernfs_new_node+0x25/0x50 kernfs_create_link+0x34/0xa0 sysfs_do_create_link_sd+0x5e/0xd0 btrfs_sysfs_add_devices_dir+0x65/0x100 [btrfs] btrfs_init_new_device+0x44c/0x12b0 [btrfs] btrfs_ioctl+0xc3c/0x25c0 [btrfs] ksys_ioctl+0x68/0xa0 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x50/0xe0 entry_SYSCALL_64_after_hwframe+0x44/0xa9
-> #1 (&fs_info->chunk_mutex){+.+.}-{3:3}:
__lock_acquire+0x56f/0xaa0 lock_acquire+0xa3/0x440 __mutex_lock+0xa0/0xaf0 btrfs_chunk_alloc+0x137/0x3e0 [btrfs] find_free_extent+0xb44/0xfb0 [btrfs] btrfs_reserve_extent+0x9b/0x180 [btrfs] btrfs_alloc_tree_block+0xc1/0x350 [btrfs] alloc_tree_block_no_bg_flush+0x4a/0x60 [btrfs] __btrfs_cow_block+0x143/0x7a0 [btrfs] btrfs_cow_block+0x15f/0x310 [btrfs] push_leaf_right+0x150/0x240 [btrfs] split_leaf+0x3cd/0x6d0 [btrfs] btrfs_search_slot+0xd14/0xf70 [btrfs] btrfs_insert_empty_items+0x64/0xc0 [btrfs] __btrfs_commit_inode_delayed_items+0xb2/0x840 [btrfs] btrfs_async_run_delayed_root+0x10e/0x1d0 [btrfs] btrfs_work_helper+0x2f9/0x650 [btrfs] process_one_work+0x22c/0x600 worker_thread+0x50/0x3b0 kthread+0x137/0x150 ret_from_fork+0x1f/0x30
-> #0 (&delayed_node->mutex){+.+.}-{3:3}:
check_prev_add+0x98/0xa20 validate_chain+0xa8c/0x2a00 __lock_acquire+0x56f/0xaa0 lock_acquire+0xa3/0x440 __mutex_lock+0xa0/0xaf0 __btrfs_release_delayed_node.part.0+0x3f/0x310 [btrfs] btrfs_evict_inode+0x3bf/0x560 [btrfs] evict+0xd6/0x1c0 dispose_list+0x48/0x70 prune_icache_sb+0x54/0x80 super_cache_scan+0x121/0x1a0 do_shrink_slab+0x175/0x420 shrink_slab+0xb1/0x2e0 shrink_node+0x192/0x600 balance_pgdat+0x31f/0x750 kswapd+0x206/0x510 kthread+0x137/0x150 ret_from_fork+0x1f/0x30
other info that might help us debug this:
Chain exists of:
&delayed_node->mutex --> &fs_info->chunk_mutex --> fs_reclaim
Possible unsafe locking scenario: CPU0 CPU1
---- ----
lock(fs_reclaim);
lock(&fs_info->chunk_mutex);
lock(fs_reclaim);
lock(&delayed_node->mutex);*** DEADLOCK ***
3 locks held by kswapd0/75:
#0: ffffffff8b0c8040 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x5/0x30 #1: ffffffff8b0b50b8 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab+0x54/0x2e0 #2: ffffa040e057c0e8 (&type->s_umount_key#26){++++}-{3:3}, at: trylock_super+0x16/0x50
stack backtrace: CPU: 2 PID: 75 Comm: kswapd0 Not tainted 5.8.0-rc6-default+ #1191 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014 Call Trace: dump_stack+0x78/0xa0 check_noncircular+0x16f/0x190 check_prev_add+0x98/0xa20 validate_chain+0xa8c/0x2a00 __lock_acquire+0x56f/0xaa0 lock_acquire+0xa3/0x440 ? __btrfs_release_delayed_node.part.0+0x3f/0x310 [btrfs] __mutex_lock+0xa0/0xaf0 ? __btrfs_release_delayed_node.part.0+0x3f/0x310 [btrfs] ? __lock_acquire+0x56f/0xaa0 ? __btrfs_release_delayed_node.part.0+0x3f/0x310 [btrfs] ? lock_acquire+0xa3/0x440 ? btrfs_evict_inode+0x138/0x560 [btrfs] ? btrfs_evict_inode+0x2fe/0x560 [btrfs] ? __btrfs_release_delayed_node.part.0+0x3f/0x310 [btrfs] __btrfs_release_delayed_node.part.0+0x3f/0x310 [btrfs] btrfs_evict_inode+0x3bf/0x560 [btrfs] evict+0xd6/0x1c0 dispose_list+0x48/0x70 prune_icache_sb+0x54/0x80 super_cache_scan+0x121/0x1a0 do_shrink_slab+0x175/0x420 shrink_slab+0xb1/0x2e0 shrink_node+0x192/0x600 balance_pgdat+0x31f/0x750 kswapd+0x206/0x510 ? _raw_spin_unlock_irqrestore+0x3e/0x50 ? finish_wait+0x90/0x90 ? balance_pgdat+0x750/0x750 kthread+0x137/0x150 ? kthread_stop+0x2a0/0x2a0 ret_from_fork+0x1f/0x30
This is because we're holding the chunk_mutex while adding this device and adding its sysfs entries. We actually hold different locks in different places when calling this function, the dev_replace semaphore for instance in dev replace, so instead of moving this call around simply wrap it's operations in NOFS.
--- fs/btrfs/sysfs.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/sysfs.c +3 -0
@@ -975,7 +975,9 @@ int btrfs_sysfs_add_device_link(struct b {int error =0 ;struct btrfs_device *dev; +unsigned int nofs_flag; + nofs_flag =memalloc_nofs_save ();list_for_each_entry (dev, &fs_devices->devices, dev_list) {struct hd_struct *disk;struct kobject *disk_kobj;
@@ -994,6 +996,7 @@ int btrfs_sysfs_add_device_link(struct bif (error)break ; } +memalloc_nofs_restore (nofs_flag);return error; }
Greg Kroah-Hartman
maintainerPATCH 22/152 btrfs: dont WARN if we abort a transaction with EROFS
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit f95ebdbed46a4d8b9fdb7bff109fdbb6fc9a6dc8 upstream.
If we got some sort of corruption via a read and call btrfs_handle_fs_error() we'll set BTRFS_FS_STATE_ERROR on the fs and complain. If a subsequent trans handle trips over this it'll get EROFS and then abort. However at that point we're not aborting for the original reason, we're aborting because we've been flipped read only. We do not need to WARN_ON() here.
--- fs/btrfs/ctree.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/ctree.h +1 -1
@@ -3166,7 +3166,7 @@ do { \/* Report first abort since mount */ \if (!test_and_set_bit (BTRFS_FS_STATE_TRANS_ABORTED , \ &((trans)->fs_info->fs_state))) { \ -if ((errno) != -EIO ) { \ +if ((errno) != -EIO && (errno) != -EROFS ) { \WARN (1 ,KERN_DEBUG \"BTRFS: Transaction aborted (error %d)\n" , \ (errno)); \
Greg Kroah-Hartman
maintainerPATCH 23/152 btrfs: fix race between page release and a fast fsync
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 3d6448e631591756da36efb3ea6355ff6f383c3a upstream.
When releasing an extent map, done through the page release callback, we can race with an ongoing fast fsync and cause the fsync to miss a new extent and not log it. The steps for this to happen are the following:
1) A page is dirtied for some inode I;
2) Writeback for that page is triggered by a path other than fsync, for example by the system due to memory pressure;
3) When the ordered extent for the extent (a single 4K page) finishes, we unpin the corresponding extent map and set its generation to N, the current transaction's generation;
4) The btrfs_releasepage() callback is invoked by the system due to memory pressure for that no longer dirty page of inode I;
5) At the same time, some task calls fsync on inode I, joins transaction N, and at btrfs_log_inode() it sees that the inode does not have the full sync flag set, so we proceed with a fast fsync. But before we get into btrfs_log_changed_extents() and lock the inode's extent map tree:
6) Through btrfs_releasepage() we end up at try_release_extent_mapping() and we remove the extent map for the new 4Kb extent, because it is neither pinned anymore nor locked. By calling remove_extent_mapping(), we remove the extent map from the list of modified extents, since the extent map does not have the logging flag set. We unlock the inode's extent map tree;
7) The task doing the fast fsync now enters btrfs_log_changed_extents(), locks the inode's extent map tree and iterates its list of modified extents, which no longer has the 4Kb extent in it, so it does not log the extent;
8) The fsync finishes;
9) Before transaction N is committed, a power failure happens. After replaying the log, the 4K extent of inode I will be missing, since it was not logged due to the race with try_release_extent_mapping().
So fix this by teaching try_release_extent_mapping() to not remove an extent map if it's still in the list of modified extents.
--- fs/btrfs/extent_io.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
fs/btrfs/extent_io.c +13 -3
@@ -4467,15 +4467,25 @@ int try_release_extent_mapping(struct pafree_extent_map (em);break ; } -if (!test_range_bit (tree, em->start, -extent_map_end (em) -1 , -EXTENT_LOCKED ,0 ,NULL )) { +if (test_range_bit (tree, em->start, +extent_map_end (em) -1 , +EXTENT_LOCKED ,0 ,NULL )) + goto next; +/* +* If it's not in the list of modified extents, used +* by a fast fsync, we can remove it. If it's being +* logged we can safely remove it since fsync took an +* extra reference on the em. +*/ +if (list_empty (&em->list) || +test_bit (EXTENT_FLAG_LOGGING , &em->flags)) {set_bit (BTRFS_INODE_NEEDS_FULL_SYNC , &btrfs_inode->runtime_flags);remove_extent_mapping (map, em);/* once for the rb tree */ free_extent_map (em); } +next: start =extent_map_end (em);write_unlock (&map->lock);
Greg Kroah-Hartman
maintainerPATCH 24/152 btrfs: fix messages after changing compression level by remount
In reply to Greg Kroah-HartmanFrom: David Sterba <[email protected]>
commit 27942c9971cc405c60432eca9395e514a2ae9f5e upstream.
Reported by Forza on IRC that remounting with compression options does not reflect the change in level, or at least it does not appear to do so according to the messages:
mount -o compress=zstd:1 /dev/sda /mnt
mount -o remount,compress=zstd:15 /mnt
does not print the change to the level to syslog:
[ 41.366060] BTRFS info (device vda): use zstd compression, level 1 [ 41.368254] BTRFS info (device vda): disk space caching is enabled [ 41.390429] BTRFS info (device vda): disk space caching is enabled
What really happens is that the message is lost but the level is actualy changed.
There's another weird output, if compression is reset to 'no':
[ 45.413776] BTRFS info (device vda): use no compression, level 4
To fix that, save the previous compression level and print the message in that case too and use separate message for 'no' compression.
--- fs/btrfs/super.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
fs/btrfs/super.c +9 -5
@@ -435,6 +435,7 @@ int btrfs_parse_options(struct btrfs_fs_char *compress_type;bool compress_force = false;enum btrfs_compression_type saved_compress_type; +int saved_compress_level;bool saved_compress_force;int no_compress =0 ;
@@ -517,6 +518,7 @@ int btrfs_parse_options(struct btrfs_fs_ info->compress_type : BTRFS_COMPRESS_NONE; saved_compress_force =btrfs_test_opt (info,FORCE_COMPRESS ); + saved_compress_level = info->compress_level;if (token == Opt_compress || token == Opt_compress_force ||strncmp (args[0 ].from,"zlib" ,4 ) ==0 ) {
@@ -561,6 +563,8 @@ int btrfs_parse_options(struct btrfs_fs_ no_compress =0 ; }else if (strncmp (args[0 ].from,"no" ,2 ) ==0 ) { compress_type ="no" ; + info->compress_level =0 ; + info->compress_type =0 ;btrfs_clear_opt (info->mount_opt,COMPRESS );btrfs_clear_opt (info->mount_opt,FORCE_COMPRESS ); compress_force = false;
@@ -581,11 +585,11 @@ int btrfs_parse_options(struct btrfs_fs_*/ btrfs_clear_opt (info->mount_opt,FORCE_COMPRESS ); } -if ((btrfs_test_opt (info,COMPRESS ) && - (info->compress_type != saved_compress_type || - compress_force != saved_compress_force)) || - (!btrfs_test_opt (info,COMPRESS ) && - no_compress ==1 )) { +if (no_compress ==1 ) { +btrfs_info (info,"use no compression" ); + }else if ((info->compress_type != saved_compress_type) || + (compress_force != saved_compress_force) || + (info->compress_level != saved_compress_level)) {btrfs_info (info,"%s %s compression, level %d" , (compress_force) ?"force" :"use" , compress_type, info->compress_level);
Greg Kroah-Hartman
maintainerPATCH 25/152 btrfs: only search for left_info if there is no right_info in try_merge_free_space
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit bf53d4687b8f3f6b752f091eb85f62369a515dfd upstream.
In try_to_merge_free_space we attempt to find entries to the left and right of the entry we are adding to see if they can be merged. We search for an entry past our current info (saved into right_info), and then if right_info exists and it has a rb_prev() we save the rb_prev() into left_info.
However there's a slight problem in the case that we have a right_info, but no entry previous to that entry. At that point we will search for an entry just before the info we're attempting to insert. This will simply find right_info again, and assign it to left_info, making them both the same pointer.
Now if right_info _can_ be merged with the range we're inserting, we'll add it to the info and free right_info. However further down we'll access left_info, which was right_info, and thus get a use-after-free.
Fix this by only searching for the left entry if we don't find a right entry at all.
The CVE referenced had a specially crafted file system that could trigger this use-after-free. However with the tree checker improvements we no longer trigger the conditions for the UAF. But the original conditions still apply, hence this fix.
Reference: CVE-2019-19448
--- fs/btrfs/free-space-cache.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/free-space-cache.c +2 -2
@@ -2166,7 +2166,7 @@ out:static bool try_merge_free_space (struct btrfs_free_space_ctl *ctl,struct btrfs_free_space *info,bool update_stat) { -struct btrfs_free_space *left_info; +struct btrfs_free_space *left_info =NULL ;struct btrfs_free_space *right_info;bool merged = false;u64 offset = info->offset;
@@ -2181,7 +2181,7 @@ static bool try_merge_free_space(structif (right_info &&rb_prev (&right_info->offset_index)) left_info =rb_entry (rb_prev (&right_info->offset_index), struct btrfs_free_space, offset_index); -else +else if (!right_info) left_info =tree_search_offset (ctl, offset -1 ,0 ,0 );if (right_info && !right_info->bitmap) {
Greg Kroah-Hartman
maintainerPATCH 26/152 btrfs: inode: fix NULL pointer dereference if inode doesnt need compression
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 1e6e238c3002ea3611465ce5f32777ddd6a40126 upstream.
[BUG]
There is a bug report of NULL pointer dereference caused in compress_file_extent():
Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Workqueue: btrfs-delalloc btrfs_delalloc_helper [btrfs] NIP [c008000006dd4d34] compress_file_range.constprop.41+0x75c/0x8a0 [btrfs] LR [c008000006dd4d1c] compress_file_range.constprop.41+0x744/0x8a0 [btrfs] Call Trace: [c000000c69093b00] [c008000006dd4d1c] compress_file_range.constprop.41+0x744/0x8a0 [btrfs] (unreliable) [c000000c69093bd0] [c008000006dd4ebc] async_cow_start+0x44/0xa0 [btrfs] [c000000c69093c10] [c008000006e14824] normal_work_helper+0xdc/0x598 [btrfs] [c000000c69093c80] [c0000000001608c0] process_one_work+0x2c0/0x5b0 [c000000c69093d10] [c000000000160c38] worker_thread+0x88/0x660 [c000000c69093db0] [c00000000016b55c] kthread+0x1ac/0x1c0 [c000000c69093e20] [c00000000000b660] ret_from_kernel_thread+0x5c/0x7c ---[ end trace f16954aa20d822f6 ]---
[CAUSE]
For the following execution route of compress_file_range(), it's possible to hit NULL pointer dereference:
compress_file_extent()
|- pages = NULL;
|- start = async_chunk->start = 0;
|- end = async_chunk = 4095;
|- nr_pages = 1;
|- inode_need_compress() == false; <<< Possible, see later explanation
| Now, we have nr_pages = 1, pages = NULL
|- cont:
|- ret = cow_file_range_inline();
|- if (ret <= 0) {
|- for (i = 0; i < nr_pages; i++) {
|- WARN_ON(pages[i]->mapping); <<< CrashTo enter above call execution branch, we need the following race:
Thread 1 (chattr) | Thread 2 (writeback)
--------------------------+------------------------------
| btrfs_run_delalloc_range
| |- inode_need_compress = true
| |- cow_file_range_async()
btrfs_ioctl_set_flag() |
|- binode_flags |= |
BTRFS_INODE_NOCOMPRESS |
| compress_file_range()
| |- inode_need_compress = false
| |- nr_page = 1 while pages = NULL
| | Then hit the crash[FIX]
This patch will fix it by checking @pages before doing accessing it. This patch is only designed as a hot fix and easy to backport.
More elegant fix may make btrfs only check inode_need_compress() once to avoid such race, but that would be another story.
--- fs/btrfs/inode.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
fs/btrfs/inode.c +11 -5
@@ -641,12 +641,18 @@ cont: page_error_op | PAGE_END_WRITEBACK); -for (i =0 ; i < nr_pages; i++) { -WARN_ON (pages[i]->mapping); -put_page (pages[i]); +/* +* Ensure we only free the compressed pages if we have +* them allocated, as we can still reach here with +* inode_need_compress() == false. +*/ +if (pages) { +for (i =0 ; i < nr_pages; i++) { +WARN_ON (pages[i]->mapping); +put_page (pages[i]); + } +kfree (pages); } -kfree (pages); -return 0 ; } }
Greg Kroah-Hartman
maintainerPATCH 27/152 btrfs: fix memory leaks after failure to lookup checksums during inode logging
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 4f26433e9b3eb7a55ed70d8f882ae9cd48ba448b upstream.
While logging an inode, at copy_items(), if we fail to lookup the checksums for an extent we release the destination path, free the ins_data array and then return immediately. However a previous iteration of the for loop may have added checksums to the ordered_sums list, in which case we leak the memory used by them.
So fix this by making sure we iterate the ordered_sums list and free all its checksums before returning.
--- fs/btrfs/tree-log.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
fs/btrfs/tree-log.c +2 -6
@@ -4040,11 +4040,8 @@ static noinline int copy_items(struct bt fs_info->csum_root, ds + cs, ds + cs + cl -1 , &ordered_sums, 0); -if (ret) { -btrfs_release_path (dst_path); -kfree (ins_data); -return ret; - } +if (ret) +break ; } } }
@@ -4057,7 +4054,6 @@ static noinline int copy_items(struct bt* we have to do this after the loop above to avoid changing the * log tree while trying to change the log tree. */ - ret =0 ;while (!list_empty (&ordered_sums)) { struct btrfs_ordered_sum *sums = list_entry(ordered_sums.next, struct btrfs_ordered_sum,
Greg Kroah-Hartman
maintainerPATCH 28/152 btrfs: make sure SB_I_VERSION doesnt get unset by remount
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit faa008899a4db21a2df99833cb4ff6fa67009a20 upstream.
There's some inconsistency around SB_I_VERSION handling with mount and remount. Since we don't really want it to be off ever just work around this by making sure we don't get the flag cleared on remount.
There's a tiny cpu cost of setting the bit, otherwise all changes to i_version also change some of the times (ctime/mtime) so the inode needs to be synced. We wouldn't save anything by disabling it.
--- fs/btrfs/super.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/btrfs/super.c +6 -0
@@ -1852,6 +1852,12 @@ static int btrfs_remount(struct super_blset_bit (BTRFS_FS_OPEN , &fs_info->flags); } out: +/* +* We need to set SB_I_VERSION here otherwise it'll get cleared by VFS, +* since the absence of the flag means it can be toggled off by remount. +*/ + *flags |=SB_I_VERSION ; +wake_up_process (fs_info->transaction_kthread);btrfs_remount_cleanup (fs_info, old_opts);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 29/152 btrfs: fix return value mixup in btrfs_get_extent
In reply to Greg Kroah-HartmanFrom: Pavel Machek <[email protected]>
commit 881a3a11c2b858fe9b69ef79ac5ee9978a266dc9 upstream.
btrfs_get_extent() sets variable ret, but out: error path expect error to be in variable err so the error code is lost.
--- fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/inode.c +1 -1
@@ -7194,7 +7194,7 @@ struct extent_map *btrfs_get_extent(stru extent_type == BTRFS_FILE_EXTENT_PREALLOC) {/* Only regular file could have regular/prealloc extent */ if (!S_ISREG (inode->vfs_inode.i_mode)) { - ret = -EUCLEAN ; + err = -EUCLEAN ;btrfs_crit (fs_info,"regular/prealloc extent found for non-regular inode %llu" ,btrfs_ino (inode));
Greg Kroah-Hartman
maintainerPATCH 30/152 arm64: perf: Correct the event index in sysfs
In reply to Greg Kroah-HartmanFrom: Shaokun Zhang <[email protected]>
commit 539707caa1a89ee4efc57b4e4231c20c46575ccc upstream.
When PMU event ID is equal or greater than 0x4000, it will be reduced by 0x4000 and it is not the raw number in the sysfs. Let's correct it and obtain the raw event ID.
Before this patch:
cat /sys/bus/event_source/devices/armv8_pmuv3_0/events/sample_feed event=0x001
After this patch:
cat /sys/bus/event_source/devices/armv8_pmuv3_0/events/sample_feed event=0x4001
--- arch/arm64/kernel/perf_event.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
arch/arm64/kernel/perf_event.c +8 -5
@@ -155,7 +155,7 @@ armv8pmu_events_sysfs_show(struct device pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr); -return sprintf (page,"event=0x%03llx\n" , pmu_attr->id); +return sprintf (page,"event=0x%04llx\n" , pmu_attr->id); }#define ARMV8_EVENT_ATTR (name, config) \
@@ -303,10 +303,13 @@ armv8pmu_event_attr_is_visible(struct ko test_bit(pmu_attr->id, cpu_pmu->pmceid_bitmap))return attr->mode; - pmu_attr->id -=ARMV8_PMUV3_EXT_COMMON_EVENT_BASE ; -if (pmu_attr->id <ARMV8_PMUV3_MAX_COMMON_EVENTS && -test_bit (pmu_attr->id, cpu_pmu->pmceid_ext_bitmap)) -return attr->mode; +if (pmu_attr->id >=ARMV8_PMUV3_EXT_COMMON_EVENT_BASE ) { +u64 id = pmu_attr->id -ARMV8_PMUV3_EXT_COMMON_EVENT_BASE ; + +if (id <ARMV8_PMUV3_MAX_COMMON_EVENTS && +test_bit (id, cpu_pmu->pmceid_ext_bitmap)) +return attr->mode; + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 31/152 dt-bindings: iio: io-channel-mux: Fix compatible string in example code
In reply to Greg Kroah-HartmanFrom: Christian Eggers <[email protected]>
commit add48ba425192c6e04ce70549129cacd01e2a09e upstream.
The correct compatible string is "gpio-mux" (see bindings/mux/gpio-mux.txt).
--- Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt +1 -1
@@ -21,7 +21,7 @@ controller state. The mux controller sta Example: mux: mux-controller { - compatible = "mux-gpio"; + compatible = "gpio-mux"; #mux-control-cells = <0>; mux-gpios = <&pioA 0 GPIO_ACTIVE_HIGH>,
Greg Kroah-Hartman
maintainerPATCH 32/152 iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw()
In reply to Greg Kroah-HartmanFrom: Alexandru Ardelean <[email protected]>
commit 65afb0932a81c1de719ceee0db0b276094b10ac8 upstream.
There are 2 exit paths where the lock isn't held, but try to unlock the mutex when exiting. In these places we should just return from the function.
A neater approach would be to cleanup the ad5592r_read_raw(), but that would make this patch more difficult to backport to stable versions.
Fixes 56ca9db862bf3: ("iio: dac: Add support for the AD5592R/AD5593R ADCs/DACs")
--- drivers/iio/dac/ad5592r-base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/dac/ad5592r-base.c +2 -2
@@ -416,7 +416,7 @@ static int ad5592r_read_raw(struct iio_ds64 tmp = *val * (3767897513LL /25LL ); *val =div_s64_rem (tmp,1000000000LL , val2); - ret =IIO_VAL_INT_PLUS_MICRO ; +return IIO_VAL_INT_PLUS_MICRO ; }else {int mult;
@@ -447,7 +447,7 @@ static int ad5592r_read_raw(struct iio_d ret =IIO_VAL_INT ;break ;default : - ret = -EINVAL ; +return -EINVAL ; } unlock:
Greg Kroah-Hartman
maintainerPATCH 33/152 xtensa: add missing exclusive access state management
In reply to Greg Kroah-HartmanFrom: Max Filippov <[email protected]>
commit a0fc1436f1f4f84e93144480bf30e0c958d135b6 upstream.
The result of the s32ex opcode is recorded in the ATOMCTL special register and must be retrieved with the getex opcode. Context switch between s32ex and getex may trash the ATOMCTL register and result in duplicate update or missing update of the atomic variable. Add atomctl8 field to the struct thread_info and use getex to swap ATOMCTL bit 8 as a part of context switch.
Clear exclusive access monitor on kernel entry.
--- arch/xtensa/include/asm/thread_info.h | 4 ++++ arch/xtensa/kernel/asm-offsets.c | 3 +++ arch/xtensa/kernel/entry.S | 11 +++++++++++ 3 files changed, 18 insertions(+)
arch/xtensa/include/asm/thread_info.h +4 -0
@@ -55,6 +55,10 @@ struct thread_info {mm_segment_t addr_limit;/* thread address space */ unsigned long cpenable; +#if XCHAL_HAVE_EXCLUSIVE +/* result of the most recent exclusive store */ +unsigned long atomctl8; +#endif /* Allocate storage for extra user states and coprocessor states. */ #if XTENSA_HAVE_COPROCESSORS
arch/xtensa/kernel/asm-offsets.c +3 -0
@@ -93,6 +93,9 @@ int main(void) DEFINE(THREAD_RA, offsetof (struct task_struct, thread.ra)); DEFINE(THREAD_SP, offsetof (struct task_struct, thread.sp));DEFINE (THREAD_CPENABLE , offsetof (struct thread_info , cpenable)); +#if XCHAL_HAVE_EXCLUSIVE +DEFINE (THREAD_ATOMCTL8 , offsetof (struct thread_info , atomctl8)); +#endif #if XTENSA_HAVE_COPROCESSORS DEFINE(THREAD_XTREGS_CP0, offsetof(struct thread_info, xtregs_cp.cp0)); DEFINE(THREAD_XTREGS_CP1, offsetof(struct thread_info, xtregs_cp.cp1));
arch/xtensa/kernel/entry.S +11 -0
@@ -374,6 +374,11 @@ common_exception: s32i a2, a1, PT_LCOUNT #endif +#if XCHAL_HAVE_EXCLUSIVE + /* Clear exclusive access monitor set by interrupted code */ + clrex +#endif + /* It is now save to restore the EXC_TABLE_FIXUP variable. */ rsr a2, exccause
@@ -2024,6 +2029,12 @@ ENTRY(_switch_to) s32i a3, a4, THREAD_CPENABLE #endif +#if XCHAL_HAVE_EXCLUSIVE + l32i a3, a5, THREAD_ATOMCTL8 + getex a3 + s32i a3, a4, THREAD_ATOMCTL8 +#endif + /* Flush register file. */ spill_registers_kernel
Greg Kroah-Hartman
maintainerPATCH 34/152 xtensa: fix xtensa_pmu_setup prototype
In reply to Greg Kroah-HartmanFrom: Max Filippov <[email protected]>
commit 6d65d3769d1910379e1cfa61ebf387efc6bfb22c upstream.
Fix the following build error in configurations with CONFIG_XTENSA_VARIANT_HAVE_PERF_EVENTS=y:
arch/xtensa/kernel/perf_event.c:420:29: error: passing argument 3 of ‘cpuhp_setup_state’ from incompatible pointer type
--- arch/xtensa/kernel/perf_event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/xtensa/kernel/perf_event.c +1 -1
@@ -401,7 +401,7 @@ static struct pmu xtensa_pmu = { .read = xtensa_pmu_read, }; -static int xtensa_pmu_setup (int cpu) +static int xtensa_pmu_setup (unsigned int cpu) {unsigned i;
Greg Kroah-Hartman
maintainerPATCH 35/152 cifs: Fix leak when handling lease break for cached root fid
In reply to Greg Kroah-HartmanFrom: Paul Aurich <[email protected]>
commit baf57b56d3604880ccb3956ec6c62ea894f5de99 upstream.
Handling a lease break for the cached root didn't free the smb2_lease_break_work allocation, resulting in a leak:
unreferenced object 0xffff98383a5af480 (size 128):
comm "cifsd", pid 684, jiffies 4294936606 (age 534.868s)
hex dump (first 32 bytes):
c0 ff ff ff 1f 00 00 00 88 f4 5a 3a 38 98 ff ff ..........Z:8...
88 f4 5a 3a 38 98 ff ff 80 88 d6 8a ff ff ff ff ..Z:8...........
backtrace:
[<0000000068957336>] smb2_is_valid_oplock_break+0x1fa/0x8c0
[<0000000073b70b9e>] cifs_demultiplex_thread+0x73d/0xcc0
[<00000000905fa372>] kthread+0x11c/0x150
[<0000000079378e4e>] ret_from_fork+0x22/0x30Avoid this leak by only allocating when necessary.
--- fs/cifs/smb2misc.c | 73 +++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 52 insertions(+), 21 deletions(-)
fs/cifs/smb2misc.c +52 -21
@@ -509,15 +509,31 @@ cifs_ses_oplock_break(struct work_structkfree (lw); } +static void +smb2_queue_pending_open_break (struct tcon_link *tlink,__u8 *lease_key, +__le32 new_lease_state) +{ +struct smb2_lease_break_work *lw; + + lw =kmalloc (sizeof (struct smb2_lease_break_work ),GFP_KERNEL ); +if (!lw) { +cifs_put_tlink (tlink); +return ; + } + +INIT_WORK (&lw->lease_break, cifs_ses_oplock_break); + lw->tlink = tlink; + lw->lease_state = new_lease_state; +memcpy (lw->lease_key, lease_key,SMB2_LEASE_KEY_SIZE ); +queue_work (cifsiod_wq, &lw->lease_break); +} +static bool -smb2_tcon_has_lease (struct cifs_tcon *tcon,struct smb2_lease_break *rsp, -struct smb2_lease_break_work *lw) +smb2_tcon_has_lease (struct cifs_tcon *tcon,struct smb2_lease_break *rsp) { -bool found;__u8 lease_state;struct list_head *tmp;struct cifsFileInfo *cfile; -struct cifs_pending_open *open;struct cifsInodeInfo *cinode;int ack_req =le32_to_cpu (rsp->Flags &SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED );
@@ -556,22 +572,29 @@ smb2_tcon_has_lease(struct cifs_tcon *tc &cinode->flags);cifs_queue_oplock_break (cfile); -kfree (lw);return true; } - found = false; +return false; +} + +static struct cifs_pending_open * +smb2_tcon_find_pending_open_lease (struct cifs_tcon *tcon, +struct smb2_lease_break *rsp) +{ +__u8 lease_state =le32_to_cpu (rsp->NewLeaseState); +int ack_req =le32_to_cpu (rsp->Flags & +SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED ); +struct cifs_pending_open *open; +struct cifs_pending_open *found =NULL ; +list_for_each_entry (open, &tcon->pending_opens, olist) {if (memcmp (open->lease_key, rsp->LeaseKey,SMB2_LEASE_KEY_SIZE ))continue ;if (!found && ack_req) { - found = true; -memcpy (lw->lease_key, open->lease_key, -SMB2_LEASE_KEY_SIZE ); - lw->tlink =cifs_get_tlink (open->tlink); -queue_work (cifsiod_wq, &lw->lease_break); + found = open; }cifs_dbg (FYI ,"found in the pending open list\n" );
@@ -592,14 +615,7 @@ smb2_is_valid_lease_break(char *buffer)struct TCP_Server_Info *server;struct cifs_ses *ses;struct cifs_tcon *tcon; -struct smb2_lease_break_work *lw; - - lw =kmalloc (sizeof (struct smb2_lease_break_work ),GFP_KERNEL ); -if (!lw) -return false; - -INIT_WORK (&lw->lease_break, cifs_ses_oplock_break); - lw->lease_state = rsp->NewLeaseState; +struct cifs_pending_open *open;cifs_dbg (FYI ,"Checking for lease break\n" );
@@ -617,11 +633,27 @@ smb2_is_valid_lease_break(char *buffer)spin_lock (&tcon->open_file_lock);cifs_stats_inc ( &tcon->stats.cifs_stats.num_oplock_brks); -if (smb2_tcon_has_lease (tcon, rsp, lw)) { +if (smb2_tcon_has_lease (tcon, rsp)) {spin_unlock (&tcon->open_file_lock);spin_unlock (&cifs_tcp_ses_lock);return true; } + open =smb2_tcon_find_pending_open_lease (tcon, + rsp); +if (open) { +__u8 lease_key[SMB2_LEASE_KEY_SIZE ]; +struct tcon_link *tlink; + + tlink =cifs_get_tlink (open->tlink); +memcpy (lease_key, open->lease_key, +SMB2_LEASE_KEY_SIZE ); +spin_unlock (&tcon->open_file_lock); +spin_unlock (&cifs_tcp_ses_lock); +smb2_queue_pending_open_break (tlink, + lease_key, + rsp->NewLeaseState); +return true; + }spin_unlock (&tcon->open_file_lock); if (tcon->crfid.is_valid &&
@@ -639,7 +671,6 @@ smb2_is_valid_lease_break(char *buffer) } }spin_unlock (&cifs_tcp_ses_lock); -kfree (lw);cifs_dbg (FYI ,"Can not process lease break - no lease matched\n" );return false; }
Greg Kroah-Hartman
maintainerPATCH 36/152 powerpc/ptdump: Fix build failure in hashpagetable.c
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
commit 7c466b0807960edc13e4b855be85ea765df9a6cd upstream.
H_SUCCESS is only defined when CONFIG_PPC_PSERIES is defined.
!= H_SUCCESS means != 0. Modify the test accordingly.
--- arch/powerpc/mm/ptdump/hashpagetable.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/mm/ptdump/hashpagetable.c +1 -1
@@ -259,7 +259,7 @@ static int pseries_find(unsigned long eafor (i =0 ; i <HPTES_PER_GROUP ; i +=4 , hpte_group +=4 ) { lpar_rc =plpar_pte_read_4 (0 , hpte_group, (void *)ptes); -if (lpar_rc !=H_SUCCESS ) +if (lpar_rc)continue ;for (j =0 ; j <4 ; j++) { if (HPTE_V_COMPARE(ptes[j].v, want_v) &&
Greg Kroah-Hartman
maintainerPATCH 37/152 powerpc: Allow 4224 bytes of stack expansion for the signal frame
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
commit 63dee5df43a31f3844efabc58972f0a206ca4534 upstream.
We have powerpc specific logic in our page fault handling to decide if an access to an unmapped address below the stack pointer should expand the stack VMA.
The code was originally added in 2004 "ported from 2.4". The rough logic is that the stack is allowed to grow to 1MB with no extra checking. Over 1MB the access must be within 2048 bytes of the stack pointer, or be from a user instruction that updates the stack pointer.
The 2048 byte allowance below the stack pointer is there to cover the 288 byte "red zone" as well as the "about 1.5kB" needed by the signal delivery code.
Unfortunately since then the signal frame has expanded, and is now 4224 bytes on 64-bit kernels with transactional memory enabled. This means if a process has consumed more than 1MB of stack, and its stack pointer lies less than 4224 bytes from the next page boundary, signal delivery will fault when trying to expand the stack and the process will see a SEGV.
The total size of the signal frame is the size of struct rt_sigframe (which includes the red zone) plus __SIGNAL_FRAMESIZE (128 bytes on 64-bit).
The 2048 byte allowance was correct until 2008 as the signal frame was:
struct rt_sigframe {
struct ucontext uc; /* 0 1440 */
/* --- cacheline 11 boundary (1408 bytes) was 32 bytes ago --- */
long unsigned int _unused[2]; /* 1440 16 */
unsigned int tramp[6]; /* 1456 24 */
struct siginfo * pinfo; /* 1480 8 */
void * puc; /* 1488 8 */
struct siginfo info; /* 1496 128 */
/* --- cacheline 12 boundary (1536 bytes) was 88 bytes ago --- */
char abigap[288]; /* 1624 288 */
/* size: 1920, cachelines: 15, members: 7 */ /* padding: 8 */
};
1920 + 128 = 2048
Then in commit ce48b2100785 ("powerpc: Add VSX context save/restore, ptrace and signal support") (Jul 2008) the signal frame expanded to 2304 bytes:
struct rt_sigframe {
struct ucontext uc; /* 0 1696 */ <--
/* --- cacheline 13 boundary (1664 bytes) was 32 bytes ago --- */
long unsigned int _unused[2]; /* 1696 16 */
unsigned int tramp[6]; /* 1712 24 */
struct siginfo * pinfo; /* 1736 8 */
void * puc; /* 1744 8 */
struct siginfo info; /* 1752 128 */
/* --- cacheline 14 boundary (1792 bytes) was 88 bytes ago --- */
char abigap[288]; /* 1880 288 */
/* size: 2176, cachelines: 17, members: 7 */ /* padding: 8 */
};
2176 + 128 = 2304
At this point we should have been exposed to the bug, though as far as I know it was never reported. I no longer have a system old enough to easily test on.
Then in 2010 commit 320b2b8de126 ("mm: keep a guard page below a grow-down stack segment") caused our stack expansion code to never trigger, as there was always a VMA found for a write up to PAGE_SIZE below r1.
That meant the bug was hidden as we continued to expand the signal frame in commit 2b0a576d15e0 ("powerpc: Add new transactional memory state to the signal context") (Feb 2013):
struct rt_sigframe {
struct ucontext uc; /* 0 1696 */
/* --- cacheline 13 boundary (1664 bytes) was 32 bytes ago --- */
struct ucontext uc_transact; /* 1696 1696 */ <--
/* --- cacheline 26 boundary (3328 bytes) was 64 bytes ago --- */
long unsigned int _unused[2]; /* 3392 16 */
unsigned int tramp[6]; /* 3408 24 */
struct siginfo * pinfo; /* 3432 8 */
void * puc; /* 3440 8 */
struct siginfo info; /* 3448 128 */
/* --- cacheline 27 boundary (3456 bytes) was 120 bytes ago --- */
char abigap[288]; /* 3576 288 */
/* size: 3872, cachelines: 31, members: 8 */
/* padding: 8 */
/* last cacheline: 32 bytes */
};3872 + 128 = 4000
And commit 573ebfa6601f ("powerpc: Increase stack redzone for 64-bit userspace to 512 bytes") (Feb 2014):
struct rt_sigframe {
struct ucontext uc; /* 0 1696 */
/* --- cacheline 13 boundary (1664 bytes) was 32 bytes ago --- */
struct ucontext uc_transact; /* 1696 1696 */
/* --- cacheline 26 boundary (3328 bytes) was 64 bytes ago --- */
long unsigned int _unused[2]; /* 3392 16 */
unsigned int tramp[6]; /* 3408 24 */
struct siginfo * pinfo; /* 3432 8 */
void * puc; /* 3440 8 */
struct siginfo info; /* 3448 128 */
/* --- cacheline 27 boundary (3456 bytes) was 120 bytes ago --- */
char abigap[512]; /* 3576 512 */ <--
/* size: 4096, cachelines: 32, members: 8 */ /* padding: 8 */
};
4096 + 128 = 4224
Then finally in 2017, commit 1be7107fbe18 ("mm: larger stack guard gap, between vmas") exposed us to the existing bug, because it changed the stack VMA to be the correct/real size, meaning our stack expansion code is now triggered.
Fix it by increasing the allowance to 4224 bytes.
Hard-coding 4224 is obviously unsafe against future expansions of the signal frame in the same way as the existing code. We can't easily use sizeof() because the signal frame structure is not in a header. We will either fix that, or rip out all the custom stack expansion checking logic entirely.
--- arch/powerpc/mm/fault.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
arch/powerpc/mm/fault.c +5 -2
@@ -241,6 +241,9 @@ static bool bad_kernel_fault(struct pt_rreturn false; } +// This comes from 64-bit struct rt_sigframe + __SIGNAL_FRAMESIZE +#define SIGFRAME_MAX_SIZE (4096 + 128) +static bool bad_stack_expansion (struct pt_regs *regs,unsigned long address,struct vm_area_struct *vma,unsigned int flags,bool *must_retry)
@@ -248,7 +251,7 @@ static bool bad_stack_expansion(struct p/* * N.B. The POWER/Open ABI allows programs to access up to * 288 bytes below the stack pointer. -* The kernel signal delivery code writes up to about 1.5kB +* The kernel signal delivery code writes a bit over 4KB * below the stack pointer (r1) before decrementing it. * The exec code can write slightly over 640kB to the stack * before setting the user r1. Thus we allow the stack to
@@ -273,7 +276,7 @@ static bool bad_stack_expansion(struct p* between the last mapped region and the stack will * expand the stack rather than segfaulting. */ -if (address +2048 >= uregs->gpr[1 ]) +if (address +SIGFRAME_MAX_SIZE >= uregs->gpr[1 ])return false; if ((flags & FAULT_FLAG_WRITE) && (flags & FAULT_FLAG_USER) &&
Greg Kroah-Hartman
maintainerPATCH 38/152 powerpc: Fix circular dependency between percpu.h and mmu.h
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
commit 0c83b277ada72b585e6a3e52b067669df15bcedb upstream.
Recently random.h started including percpu.h (see commit f227e3ec3b5c ("random32: update the net random state on interrupt and activity")), which broke corenet64_smp_defconfig:
In file included from /linux/arch/powerpc/include/asm/paca.h:18,
from /linux/arch/powerpc/include/asm/percpu.h:13,
from /linux/include/linux/random.h:14,
from /linux/lib/uuid.c:14:
/linux/arch/powerpc/include/asm/mmu.h:139:22: error: unknown type name 'next_tlbcam_idx'
139 | DECLARE_PER_CPU(int, next_tlbcam_idx);This is due to a circular header dependency:
asm/mmu.h includes asm/percpu.h, which includes asm/paca.h, which includes asm/mmu.h
Which means DECLARE_PER_CPU() isn't defined when mmu.h needs it.
We can fix it by moving the include of paca.h below the include of asm-generic/percpu.h.
This moves the include of paca.h out of the #ifdef __powerpc64__, but that is OK because paca.h is almost entirely inside #ifdef CONFIG_PPC64 anyway.
It also moves the include of paca.h out of the #ifdef CONFIG_SMP, which could possibly break something, but seems to have no ill effects.
--- arch/powerpc/include/asm/percpu.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/include/asm/percpu.h +2 -2
@@ -10,8 +10,6 @@#ifdef CONFIG_SMP -#include <asm/paca.h> -#define __my_cpu_offset local_paca->data_offset#endif /* CONFIG_SMP */
@@ -19,4 +17,6 @@#include <asm-generic/percpu.h> +#include <asm/paca.h> +#endif /* _ASM_POWERPC_PERCPU_H_ */
Greg Kroah-Hartman
maintainerPATCH 39/152 pinctrl: ingenic: Enhance support for IRQ_TYPE_EDGE_BOTH
In reply to Greg Kroah-HartmanFrom: Paul Cercueil <[email protected]>
commit 1c95348ba327fe8621d3680890c2341523d3524a upstream.
Ingenic SoCs don't natively support registering an interrupt for both rising and falling edges. This has to be emulated in software.
Until now, this was emulated by switching back and forth between IRQ_TYPE_EDGE_RISING and IRQ_TYPE_EDGE_FALLING according to the level of the GPIO. While this worked most of the time, when used with GPIOs that need debouncing, some events would be lost. For instance, between the time a falling-edge interrupt happens and the interrupt handler configures the hardware for rising-edge, the level of the pin may have already risen, and the rising-edge event is lost.
To address that issue, instead of switching back and forth between IRQ_TYPE_EDGE_RISING and IRQ_TYPE_EDGE_FALLING, we now switch back and forth between IRQ_TYPE_LEVEL_LOW and IRQ_TYPE_LEVEL_HIGH. Since we always switch in the interrupt handler, they actually permit to detect level changes. In the example above, if the pin level rises before switching the IRQ type from IRQ_TYPE_LEVEL_LOW to IRQ_TYPE_LEVEL_HIGH, a new interrupt will raise as soon as the handler exits, and the rising-edge event will be properly detected.
--- drivers/pinctrl/pinctrl-ingenic.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pinctrl/pinctrl-ingenic.c +3 -3
@@ -1500,9 +1500,9 @@ static void ingenic_gpio_irq_ack(struct*/ high =ingenic_gpio_get_value (jzgc, irq);if (high) -irq_set_type (jzgc, irq,IRQ_TYPE_EDGE_FALLING ); +irq_set_type (jzgc, irq,IRQ_TYPE_LEVEL_LOW );else -irq_set_type (jzgc, irq,IRQ_TYPE_EDGE_RISING ); +irq_set_type (jzgc, irq,IRQ_TYPE_LEVEL_HIGH ); }if (jzgc->jzpc->version >=ID_JZ4760 )
@@ -1538,7 +1538,7 @@ static int ingenic_gpio_irq_set_type(str*/ bool high =ingenic_gpio_get_value (jzgc, irqd->hwirq); - type = high ?IRQ_TYPE_EDGE_FALLING :IRQ_TYPE_EDGE_RISING ; + type = high ?IRQ_TYPE_LEVEL_LOW :IRQ_TYPE_LEVEL_HIGH ; }irq_set_type (jzgc, irqd->hwirq, type);
Greg Kroah-Hartman
maintainerPATCH 40/152 media: vsp1: dl: Fix NULL pointer dereference on unbind
In reply to Greg Kroah-HartmanFrom: Eugeniu Rosca <[email protected]>
commit c92d30e4b78dc331909f8c6056c2792aa14e2166 upstream.
In commit f3b98e3c4d2e16 ("media: vsp1: Provide support for extended command pools"), the vsp pointer used for referencing the VSP1 device structure from a command pool during vsp1_dl_ext_cmd_pool_destroy() was not populated.
Correctly assign the pointer to prevent the following null-pointer-dereference when removing the device:
[*] h3ulcb-kf #>
echo fea28000.vsp > /sys/bus/platform/devices/fea28000.vsp/driver/unbind
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Mem abort info: ESR = 0x96000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000007318be000 [0000000000000028] pgd=00000007333a1003, pud=00000007333a6003, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 486 Comm: sh Not tainted 5.7.0-rc6-arm64-renesas-00118-ge644645abf47 #185 Hardware name: Renesas H3ULCB Kingfisher board based on r8a77951 (DT) pstate: 40000005 (nZcv daif -PAN -UAO) pc : vsp1_dlm_destroy+0xe4/0x11c lr : vsp1_dlm_destroy+0xc8/0x11c sp : ffff800012963b60 x29: ffff800012963b60 x28: ffff0006f83fc440 x27: 0000000000000000 x26: ffff0006f5e13e80 x25: ffff0006f5e13ed0 x24: ffff0006f5e13ed0 x23: ffff0006f5e13ed0 x22: dead000000000122 x21: ffff0006f5e3a080 x20: ffff0006f5df2938 x19: ffff0006f5df2980 x18: 0000000000000003 x17: 0000000000000000 x16: 0000000000000016 x15: 0000000000000003 x14: 00000000000393c0 x13: ffff800011a5ec18 x12: ffff800011d8d000 x11: ffff0006f83fcc68 x10: ffff800011a53d70 x9 : ffff8000111f3000 x8 : 0000000000000000 x7 : 0000000000210d00 x6 : 0000000000000000 x5 : ffff800010872e60 x4 : 0000000000000004 x3 : 0000000078068000 x2 : ffff800012781000 x1 : 0000000000002c00 x0 : 0000000000000000 Call trace: vsp1_dlm_destroy+0xe4/0x11c vsp1_wpf_destroy+0x10/0x20 vsp1_entity_destroy+0x24/0x4c vsp1_destroy_entities+0x54/0x130 vsp1_remove+0x1c/0x40 platform_drv_remove+0x28/0x50 __device_release_driver+0x178/0x220 device_driver_detach+0x44/0xc0 unbind_store+0xe0/0x104 drv_attr_store+0x20/0x30 sysfs_kf_write+0x48/0x70 kernfs_fop_write+0x148/0x230 __vfs_write+0x18/0x40 vfs_write+0xdc/0x1c4 ksys_write+0x68/0xf0 __arm64_sys_write+0x18/0x20 el0_svc_common.constprop.0+0x70/0x170 do_el0_svc+0x20/0x80 el0_sync_handler+0x134/0x1b0 el0_sync+0x140/0x180 Code: b40000c2 f9403a60 d2800084 a9400663 (f9401400) ---[ end trace 3875369841fb288a ]---
--- drivers/media/platform/vsp1/vsp1_dl.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/platform/vsp1/vsp1_dl.c +2 -0
@@ -431,6 +431,8 @@ vsp1_dl_cmd_pool_create(struct vsp1_deviif (!pool)return NULL ; + pool->vsp1 = vsp1; +spin_lock_init (&pool->lock);INIT_LIST_HEAD (&pool->free);
Greg Kroah-Hartman
maintainerPATCH 41/152 net: ethernet: stmmac: Disable hardware multicast filter
In reply to Greg Kroah-HartmanFrom: Jonathan McDowell <[email protected]>
commit df43dd526e6609769ae513a81443c7aa727c8ca3 upstream.
The IPQ806x does not appear to have a functional multicast ethernet address filter. This was observed as a failure to correctly receive IPv6 packets on a LAN to the all stations address. Checking the vendor driver shows that it does not attempt to enable the multicast filter and instead falls back to receiving all multicast packets, internally setting ALLMULTI.
Use the new fallback support in the dwmac1000 driver to correctly achieve the same with the mainline IPQ806x driver. Confirmed to fix IPv6 functionality on an RB3011 router.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +1 -0
@@ -350,6 +350,7 @@ static int ipq806x_gmac_probe(struct pla plat_dat->has_gmac = true; plat_dat->bsp_priv = gmac; plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed; + plat_dat->multicast_filter_bins =0 ; err =stmmac_dvr_probe (&pdev->dev, plat_dat, &stmmac_res);if (err)
Greg Kroah-Hartman
maintainerPATCH 42/152 net: stmmac: dwmac1000: provide multicast filter fallback
In reply to Greg Kroah-HartmanFrom: Jonathan McDowell <[email protected]>
commit 592d751c1e174df5ff219946908b005eb48934b3 upstream.
If we don't have a hardware multicast filter available then instead of silently failing to listen for the requested ethernet broadcast addresses fall back to receiving all multicast packets, in a similar fashion to other drivers with no multicast filter.
--- drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c +3 -0
@@ -166,6 +166,9 @@ static void dwmac1000_set_filter(struct value =GMAC_FRAME_FILTER_PR |GMAC_FRAME_FILTER_PCF ; }else if (dev->flags &IFF_ALLMULTI ) { value =GMAC_FRAME_FILTER_PM ;/* pass all multi */ + }else if (!netdev_mc_empty (dev) && (mcbitslog2 ==0 )) { +/* Fall back to all multicast if we've no filter */ + value =GMAC_FRAME_FILTER_PM ; }else if (!netdev_mc_empty (dev)) {struct netdev_hw_addr *ha;
Greg Kroah-Hartman
maintainerPATCH 43/152 net/compat: Add missing sock updates for SCM_RIGHTS
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit d9539752d23283db4692384a634034f451261e29 upstream.
Add missed sock updates to compat path via a new helper, which will be used more in coming patches. (The net/core/scm.c code is left as-is here to assist with -stable backports for the compat path.)
--- include/net/sock.h | 4 ++++ net/compat.c | 1 + net/core/sock.c | 21 +++++++++++++++++++++ 3 files changed, 26 insertions(+)
include/net/sock.h +4 -0
@@ -849,6 +849,8 @@ static inline int sk_memalloc_socks(void {return static_branch_unlikely (&memalloc_socks_key); } + +void __receive_sock (struct file *file);#else static inline int sk_memalloc_socks (void )
@@ -856,6 +858,8 @@ static inline int sk_memalloc_socks(void return 0; } +static inline void __receive_sock (struct file *file) +{ }#endif static inline gfp_t sk_gfp_mask (const struct sock *sk,gfp_t gfp_mask)
net/compat.c +1 -0
@@ -291,6 +291,7 @@ void scm_detach_fds_compat(struct msghdrbreak ; }/* Bump the usage count and install the file. */ +__receive_sock (fp[i]);fd_install (new_fd,get_file (fp[i])); }
net/core/sock.c +21 -0
@@ -2736,6 +2736,27 @@ int sock_no_mmap(struct file *file, stru }EXPORT_SYMBOL (sock_no_mmap); +/* +* When a file is received (via SCM_RIGHTS, etc), we must bump the +* various sock-based usage counts. +*/ +void __receive_sock (struct file *file) +{ +struct socket *sock; +int error; + +/* +* The resulting value of "error" is ignored here since we only +* need to take action when the file is a socket and testing +* "sock" for NULL is sufficient. +*/ + sock =sock_from_file (file, &error); +if (sock) { +sock_update_netprioidx (&sock->sk->sk_cgrp_data); +sock_update_classid (&sock->sk->sk_cgrp_data); + } +} +ssize_t sock_no_sendpage (struct socket *sock,struct page *page,int offset,size_t size,int flags) {ssize_t res;
Greg Kroah-Hartman
maintainerPATCH 44/152 md/raid5: Fix Force reconstruct-write io stuck in degraded raid5
In reply to Greg Kroah-HartmanFrom: ChangSyun Peng <[email protected]>
commit a1c6ae3d9f3dd6aa5981a332a6f700cf1c25edef upstream.
In degraded raid5, we need to read parity to do reconstruct-write when data disks fail. However, we can not read parity from handle_stripe_dirtying() in force reconstruct-write mode.
Reproducible Steps:
1. Create degraded raid5
mdadm -C /dev/md2 --assume-clean -l5 -n3 /dev/sda2 /dev/sdb2 missing
2. Set rmw_level to 0
echo 0 > /sys/block/md2/md/rmw_level
3. IO to raid5
Now some io may be stuck in raid5. We can use handle_stripe_fill() to read the parity in this situation.
--- drivers/md/raid5.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/md/raid5.c +2 -1
@@ -3604,6 +3604,7 @@ static int need_this_block(struct stripe* is missing/faulty, then we need to read everything we can. */ if (sh->raid_conf->level !=6 && + sh->raid_conf->rmw_level !=PARITY_DISABLE_RMW && sh->sector < sh->raid_conf->mddev->recovery_cp)/* reconstruct-write isn't being forced */ return 0 ;
@@ -4839,7 +4840,7 @@ static void handle_stripe(struct stripe_* or to load a block that is being partially written. */ if (s.to_read || s.non_overwrite - || (conf->level ==6 && s.to_write && s.failed) + || (s.to_write && s.failed) || (s.syncing && (s.uptodate + s.compute < disks)) || s.replacing || s.expanding)
Greg Kroah-Hartman
maintainerPATCH 45/152 bcache: allocate meta data pages as compound pages
In reply to Greg Kroah-HartmanFrom: Coly Li <[email protected]>
commit 5fe48867856367142d91a82f2cbf7a57a24cbb70 upstream.
There are some meta data of bcache are allocated by multiple pages, and they are used as bio bv_page for I/Os to the cache device. for example cache_set->uuids, cache->disk_buckets, journal_write->data, bset_tree->data.
For such meta data memory, all the allocated pages should be treated as a single memory block. Then the memory management and underlying I/O code can treat them more clearly.
This patch adds __GFP_COMP flag to all the location allocating >0 order pages for the above mentioned meta data. Then their pages are treated as compound pages now.
--- drivers/md/bcache/bset.c | 2 +- drivers/md/bcache/btree.c | 2 +- drivers/md/bcache/journal.c | 4 ++-- drivers/md/bcache/super.c | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-)
drivers/md/bcache/bset.c +1 -1
@@ -321,7 +321,7 @@ int bch_btree_keys_alloc(struct btree_ke b->page_order = page_order; - t->data = (void *)__get_free_pages (gfp, b->page_order); + t->data = (void *)__get_free_pages (__GFP_COMP|gfp, b->page_order);if (!t->data) goto err;
drivers/md/bcache/btree.c +1 -1
@@ -840,7 +840,7 @@ int bch_btree_cache_alloc(struct cache_smutex_init (&c->verify_lock); c->verify_ondisk = (void *) -__get_free_pages (GFP_KERNEL ,ilog2 (bucket_pages (c))); +__get_free_pages (GFP_KERNEL |__GFP_COMP,ilog2 (bucket_pages (c))); c->verify_data =mca_bucket_alloc (c, &ZERO_KEY ,GFP_KERNEL );
drivers/md/bcache/journal.c +2 -2
@@ -1002,8 +1002,8 @@ int bch_journal_alloc(struct cache_set * j->w[1 ].c = c;if (!(init_fifo (&j->pin,JOURNAL_PIN ,GFP_KERNEL )) || - !(j->w[0 ].data = (void *)__get_free_pages (GFP_KERNEL ,JSET_BITS )) || - !(j->w[1 ].data = (void *)__get_free_pages (GFP_KERNEL ,JSET_BITS ))) + !(j->w[0 ].data = (void *)__get_free_pages (GFP_KERNEL |__GFP_COMP,JSET_BITS )) || + !(j->w[1 ].data = (void *)__get_free_pages (GFP_KERNEL |__GFP_COMP,JSET_BITS )))return -ENOMEM ;return 0 ;
drivers/md/bcache/super.c +1 -1
@@ -1754,7 +1754,7 @@ void bch_cache_set_unregister(struct cac }#define alloc_bucket_pages (gfp, c) \ - ((void *) __get_free_pages(__GFP_ZERO|gfp, ilog2(bucket_pages(c)))) + ((void *) __get_free_pages(__GFP_ZERO|__GFP_COMP|gfp, ilog2(bucket_pages(c))))struct cache_set *bch_cache_set_alloc (struct cache_sb *sb) {
Greg Kroah-Hartman
maintainerPATCH 46/152 bcache: fix overflow in offset_to_stripe()
In reply to Greg Kroah-HartmanFrom: Coly Li <[email protected]>
commit 7a1481267999c02abf4a624515c1b5c7c1fccbd6 upstream.
offset_to_stripe() returns the stripe number (in type unsigned int) from an offset (in type uint64_t) by the following calculation,
do_div(offset, d->stripe_size);
For large capacity backing device (e.g. 18TB) with small stripe size (e.g. 4KB), the result is 4831838208 and exceeds UINT_MAX. The actual returned value which caller receives is 536870912, due to the overflow.
Indeed in bcache_device_init(), bcache_device->nr_stripes is limited in range [1, INT_MAX]. Therefore all valid stripe numbers in bcache are in range [0, bcache_dev->nr_stripes - 1].
This patch adds a upper limition check in offset_to_stripe(): the max valid stripe number should be less than bcache_device->nr_stripes. If the calculated stripe number from do_div() is equal to or larger than bcache_device->nr_stripe, -EINVAL will be returned. (Normally nr_stripes is less than INT_MAX, exceeding upper limitation doesn't mean overflow, therefore -EOVERFLOW is not used as error code.)
This patch also changes nr_stripes' type of struct bcache_device from 'unsigned int' to 'int', and return value type of offset_to_stripe() from 'unsigned int' to 'int', to match their exact data ranges.
All locations where bcache_device->nr_stripes and offset_to_stripe() are referenced also get updated for the above type change.
--- drivers/md/bcache/bcache.h | 2 +- drivers/md/bcache/writeback.c | 14 +++++++++----- drivers/md/bcache/writeback.h | 19 +++++++++++++++++-- 3 files changed, 27 insertions(+), 8 deletions(-)
drivers/md/bcache/bcache.h +1 -1
@@ -264,7 +264,7 @@ struct bcache_device {#define BCACHE_DEV_UNLINK_DONE 2#define BCACHE_DEV_WB_RUNNING 3#define BCACHE_DEV_RATE_DW_RUNNING 4 -unsigned int nr_stripes; +int nr_stripes;unsigned int stripe_size;atomic_t *stripe_sectors_dirty;unsigned long *full_dirty_stripes;
drivers/md/bcache/writeback.c +9 -5
@@ -519,15 +519,19 @@ void bcache_dev_sectors_dirty_add(struct uint64_t offset, int nr_sectors) {struct bcache_device *d = c->devices[inode]; -unsigned int stripe_offset, stripe, sectors_dirty; +unsigned int stripe_offset, sectors_dirty; +int stripe;if (!d)return ; + stripe =offset_to_stripe (d, offset); +if (stripe <0 ) +return ; +if (UUID_FLASH_ONLY (&c->uuids[inode]))atomic_long_add (nr_sectors, &c->flash_dev_dirty_sectors); - stripe =offset_to_stripe (d, offset); stripe_offset = offset & (d->stripe_size -1 );while (nr_sectors) {
@@ -567,12 +571,12 @@ static bool dirty_pred(struct keybuf *bustatic void refill_full_stripes (struct cached_dev *dc) {struct keybuf *buf = &dc->writeback_keys; -unsigned int start_stripe, stripe, next_stripe; +unsigned int start_stripe, next_stripe; +int stripe;bool wrapped = false; stripe =offset_to_stripe (&dc->disk,KEY_OFFSET (&buf->last_scanned)); - -if (stripe >= dc->disk.nr_stripes) +if (stripe <0 ) stripe =0 ; start_stripe = stripe;
drivers/md/bcache/writeback.h +17 -2
@@ -33,10 +33,22 @@ static inline uint64_t bcache_dev_sectorreturn ret; } -static inline unsigned int offset_to_stripe (struct bcache_device *d, +static inline int offset_to_stripe (struct bcache_device *d,uint64_t offset) {do_div (offset, d->stripe_size); + +/* d->nr_stripes is in range [1, INT_MAX] */ +if (unlikely (offset >= d->nr_stripes)) { +pr_err ("Invalid stripe %llu (>= nr_stripes %d).\n" , + offset, d->nr_stripes); +return -EINVAL ; + } + +/* +* Here offset is definitly smaller than INT_MAX, +* return it as int will never overflow. +*/ return offset; }
@@ -44,7 +56,10 @@ static inline bool bcache_dev_stripe_diruint64_t offset, unsigned int nr_sectors) { - unsigned int stripe = offset_to_stripe(&dc->disk, offset); + int stripe = offset_to_stripe(&dc->disk, offset); + +if (stripe <0 ) +return false;while (1 ) {if (atomic_read (dc->disk.stripe_sectors_dirty + stripe))
Greg Kroah-Hartman
maintainerPATCH 47/152 mac80211: fix misplaced while instead of if
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit 5981fe5b0529ba25d95f37d7faa434183ad618c5 upstream.
This never was intended to be a 'while' loop, it should've just been an 'if' instead of 'while'. Fix this.
I noticed this while applying another patch from Ben that intended to fix a busy loop at this spot.
--- net/mac80211/sta_info.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/sta_info.c +1 -1
@@ -1033,7 +1033,7 @@ static void __sta_info_destroy_part2(strmight_sleep ();lockdep_assert_held (&local->sta_mtx); -while (sta->sta_state ==IEEE80211_STA_AUTHORIZED ) { +if (sta->sta_state ==IEEE80211_STA_AUTHORIZED ) { ret =sta_info_move_state (sta,IEEE80211_STA_ASSOC );WARN_ON_ONCE (ret); }
Greg Kroah-Hartman
maintainerPATCH 48/152 driver core: Avoid binding drivers to dead devices
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit 654888327e9f655a9d55ad477a9583e90e8c9b5c upstream.
Commit 3451a495ef24 ("driver core: Establish order of operations for device_add and device_del via bitflag") sought to prevent asynchronous driver binding to a device which is being removed. It added a per-device "dead" flag which is checked in the following code paths:
* asynchronous binding in __driver_attach_async_helper()
* synchronous binding in device_driver_attach()
* asynchronous binding in __device_attach_async_helper()
It did *not* check the flag upon:
* synchronous binding in __device_attach()
However __device_attach() may also be called asynchronously from:
deferred_probe_work_func()
bus_probe_device()
device_initial_probe()
__device_attach()So if the commit's intention was to check the "dead" flag in all asynchronous code paths, then a check is also necessary in __device_attach(). Add the missing check.
--- drivers/base/dd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/base/dd.c +3 -1
@@ -872,7 +872,9 @@ static int __device_attach(struct deviceint ret =0 ;device_lock (dev); -if (dev->driver) { +if (dev->p->dead) { + goto out_unlock; + }else if (dev->driver) {if (device_is_bound (dev)) { ret =1 ; goto out_unlock;
Greg Kroah-Hartman
maintainerPATCH 49/152 MIPS: CPU#0 is not hotpluggable
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
commit 9cce844abf07b683cff5f0273977d5f8d0af94c7 upstream.
Now CPU#0 is not hotpluggable on MIPS, so prevent to create /sys/devices /system/cpu/cpu0/online which confuses some user-space tools.
--- arch/mips/kernel/topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/kernel/topology.c +1 -1
@@ -20,7 +20,7 @@ static int __init topology_init(void)for_each_present_cpu (i) {struct cpu *c = &per_cpu (cpu_devices, i); - c->hotpluggable =1 ; + c->hotpluggable = !!i; ret =register_cpu (c, i);if (ret) printk(KERN_WARNING "topology_init: register_cpu %d "
Greg Kroah-Hartman
maintainerPATCH 50/152 MIPS: qi_lb60: Fix routing to audio amplifier
In reply to Greg Kroah-HartmanFrom: Paul Cercueil <[email protected]>
commit 0889a67a9e7a56ba39af223d536630b20b877fda upstream.
The ROUT (right channel output of audio codec) was connected to INL (left channel of audio amplifier) instead of INR (right channel of audio amplifier).
--- arch/mips/boot/dts/ingenic/qi_lb60.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/boot/dts/ingenic/qi_lb60.dts +1 -1
@@ -69,7 +69,7 @@ "Speaker", "OUTL", "Speaker", "OUTR", "INL", "LOUT", - "INL", "ROUT"; + "INR", "ROUT"; simple-audio-card,aux-devs = <&>;
Greg Kroah-Hartman
maintainerPATCH 51/152 ext2: fix missing percpu_counter_inc
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit bc2fbaa4d3808aef82dd1064a8e61c16549fe956 upstream.
sbi->s_freeinodes_counter is only decreased by the ext2 code, it is never increased. This patch fixes it.
Note that sbi->s_freeinodes_counter is only used in the algorithm that tries to find the group for new allocations, so this bug is not easily visible (the only visibility is that the group finding algorithm selects inoptinal result).
--- fs/ext2/ialloc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ext2/ialloc.c +2 -1
@@ -80,6 +80,7 @@ static void ext2_release_inode(struct suif (dir)le16_add_cpu (&desc->bg_used_dirs_count,-1 );spin_unlock (sb_bgl_lock (EXT2_SB (sb), group)); +percpu_counter_inc (&EXT2_SB (sb)->s_freeinodes_counter);if (dir)percpu_counter_dec (&EXT2_SB (sb)->s_dirs_counter);mark_buffer_dirty (bh);
@@ -528,7 +529,7 @@ got: goto fail; } -percpu_counter_add (&sbi->s_freeinodes_counter,-1 ); +percpu_counter_dec (&sbi->s_freeinodes_counter);if (S_ISDIR (mode))percpu_counter_inc (&sbi->s_dirs_counter);
Greg Kroah-Hartman
maintainerPATCH 52/152 khugepaged: collapse_pte_mapped_thp() flush the right range
In reply to Greg Kroah-HartmanFrom: Hugh Dickins <[email protected]>
commit 723a80dafed5c95889d48baab9aa433a6ffa0b4e upstream.
pmdp_collapse_flush() should be given the start address at which the huge page is mapped, haddr: it was given addr, which at that point has been used as a local variable, incremented to the end address of the extent.
Found by source inspection while chasing a hugepage locking bug, which I then could not explain by this. At first I thought this was very bad; then saw that all of the page translations that were not flushed would actually still point to the right pages afterwards, so harmless; then realized that I know nothing of how different architectures and models cache intermediate paging structures, so maybe it matters after all - particularly since the page table concerned is immediately freed.
Much easier to fix than to think about.
--- mm/khugepaged.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/khugepaged.c +1 -1
@@ -1384,7 +1384,7 @@ void collapse_pte_mapped_thp(struct mm_s/* step 4: collapse pmd */ ptl =pmd_lock (vma->vm_mm, pmd); - _pmd =pmdp_collapse_flush (vma, addr, pmd); + _pmd =pmdp_collapse_flush (vma, haddr, pmd);spin_unlock (ptl);mm_dec_nr_ptes (mm);pte_free (mm,pmd_pgtable (_pmd));
Greg Kroah-Hartman
maintainerPATCH 53/152 khugepaged: collapse_pte_mapped_thp() protect the pmd lock
In reply to Greg Kroah-HartmanFrom: Hugh Dickins <[email protected]>
commit 119a5fc16105b2b9383a6e2a7800b2ef861b2975 upstream.
When retract_page_tables() removes a page table to make way for a huge pmd, it holds huge page lock, i_mmap_lock_write, mmap_write_trylock and pmd lock; but when collapse_pte_mapped_thp() does the same (to handle the case when the original mmap_write_trylock had failed), only mmap_write_trylock and pmd lock are held.
That's not enough. One machine has twice crashed under load, with "BUG:
spinlock bad magic" and GPF on 6b6b6b6b6b6b6b6b. Examining the second crash, page_vma_mapped_walk_done()'s spin_unlock of pvmw->ptl (serving page_referenced() on a file THP, that had found a page table at *pmd) discovers that the page table page and its lock have already been freed by the time it comes to unlock.
Follow the example of retract_page_tables(), but we only need one of huge page lock or i_mmap_lock_write to secure against this: because it's the narrower lock, and because it simplifies collapse_pte_mapped_thp() to know the hpage earlier, choose to rely on huge page lock here.
--- mm/khugepaged.c | 44 +++++++++++++++++++------------------------- 1 file changed, 19 insertions(+), 25 deletions(-)
mm/khugepaged.c +19 -25
@@ -1294,7 +1294,7 @@ void collapse_pte_mapped_thp(struct mm_s {unsigned long haddr = addr &HPAGE_PMD_MASK ;struct vm_area_struct *vma =find_vma (mm, haddr); -struct page *hpage =NULL ; +struct page *hpage;pte_t *start_pte, *pte;pmd_t *pmd, _pmd;spinlock_t *ptl;
@@ -1314,9 +1314,17 @@ void collapse_pte_mapped_thp(struct mm_sif (!hugepage_vma_check (vma, vma->vm_flags |VM_HUGEPAGE ))return ; + hpage =find_lock_page (vma->vm_file->f_mapping, +linear_page_index (vma, haddr)); +if (!hpage) +return ; + +if (!PageHead (hpage)) + goto drop_hpage; + pmd =mm_find_pmd (mm, haddr);if (!pmd) -return ; + goto drop_hpage; start_pte =pte_offset_map_lock (mm, pmd, haddr, &ptl);
@@ -1335,30 +1343,11 @@ void collapse_pte_mapped_thp(struct mm_s page =vm_normal_page (vma, addr, *pte); -if (!page || !PageCompound (page)) - goto abort; - -if (!hpage) { - hpage =compound_head (page); -/* -* The mapping of the THP should not change. -* -* Note that uprobe, debugger, or MAP_PRIVATE may -* change the page table, but the new page will -* not pass PageCompound() check. -*/ -if (WARN_ON (hpage->mapping != vma->vm_file->f_mapping)) - goto abort; - } -/* -* Confirm the page maps to the correct subpage. -* -* Note that uprobe, debugger, or MAP_PRIVATE may change -* the page table, but the new page will not pass -* PageCompound() check. +* Note that uprobe, debugger, or MAP_PRIVATE may change the +* page table, but the new page will not be a subpage of hpage. */ -if (WARN_ON (hpage + i != page)) +if (hpage + i != page) goto abort; count++; }
@@ -1377,7 +1366,7 @@ void collapse_pte_mapped_thp(struct mm_spte_unmap_unlock (start_pte, ptl);/* step 3: set proper refcount and mm_counters. */ -if (hpage) { +if (count) {page_ref_sub (hpage, count);add_mm_counter (vma->vm_mm,mm_counter_file (hpage), -count); }
@@ -1388,10 +1377,15 @@ void collapse_pte_mapped_thp(struct mm_sspin_unlock (ptl);mm_dec_nr_ptes (mm);pte_free (mm,pmd_pgtable (_pmd)); + +drop_hpage: +unlock_page (hpage); +put_page (hpage);return ; abort:pte_unmap_unlock (start_pte, ptl); + goto drop_hpage; }static int khugepaged_collapse_pte_mapped_thps (struct mm_slot *mm_slot)
Greg Kroah-Hartman
maintainerPATCH 54/152 ocfs2: change slot number type s16 to u16
In reply to Greg Kroah-HartmanFrom: Junxiao Bi <[email protected]>
commit 38d51b2dd171ad973afc1f5faab825ed05a2d5e9 upstream.
Dan Carpenter reported the following static checker warning.
fs/ocfs2/super.c:1269 ocfs2_parse_options() warn: '(-1)' 65535 can't fit into 32767 'mopt->slot' fs/ocfs2/suballoc.c:859 ocfs2_init_inode_steal_slot() warn: '(-1)' 65535 can't fit into 32767 'osb->s_inode_steal_slot' fs/ocfs2/suballoc.c:867 ocfs2_init_meta_steal_slot() warn: '(-1)' 65535 can't fit into 32767 'osb->s_meta_steal_slot'
That's because OCFS2_INVALID_SLOT is (u16)-1. Slot number in ocfs2 can be never negative, so change s16 to u16.
--- fs/ocfs2/ocfs2.h | 4 ++-- fs/ocfs2/suballoc.c | 4 ++-- fs/ocfs2/super.c | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-)
fs/ocfs2/ocfs2.h +2 -2
@@ -326,8 +326,8 @@ struct ocfs2_superspinlock_t osb_lock;u32 s_next_generation;unsigned long osb_flags; -s16 s_inode_steal_slot; -s16 s_meta_steal_slot; +u16 s_inode_steal_slot; +u16 s_meta_steal_slot;atomic_t s_num_inodes_stolen;atomic_t s_num_meta_stolen;
fs/ocfs2/suballoc.c +2 -2
@@ -879,9 +879,9 @@ static void __ocfs2_set_steal_slot(struc {spin_lock (&osb->osb_lock);if (type ==INODE_ALLOC_SYSTEM_INODE ) - osb->s_inode_steal_slot = slot; + osb->s_inode_steal_slot = (u16 )slot;else if (type ==EXTENT_ALLOC_SYSTEM_INODE ) - osb->s_meta_steal_slot = slot; + osb->s_meta_steal_slot = (u16 )slot;spin_unlock (&osb->osb_lock); }
fs/ocfs2/super.c +2 -2
@@ -78,7 +78,7 @@ struct mount_optionsunsigned long commit_interval;unsigned long mount_opt;unsigned int atime_quantum; -signed short slot; +unsigned short slot;int localalloc_opt;unsigned int resv_level;int dir_resv_level;
@@ -1334,7 +1334,7 @@ static int ocfs2_parse_options(struct su goto bail; }if (option) - mopt->slot = (s16 )option; + mopt->slot = (u16 )option;break ;case Opt_commit:if (match_int (&args[0 ], &option)) {
Greg Kroah-Hartman
maintainerPATCH 55/152 mm/page_counter.c: fix protection usage propagation
In reply to Greg Kroah-HartmanFrom: Michal Koutný <[email protected]>
commit a6f23d14ec7d7d02220ad8bb2774be3322b9aeec upstream.
When workload runs in cgroups that aren't directly below root cgroup and their parent specifies reclaim protection, it may end up ineffective.
The reason is that propagate_protected_usage() is not called in all hierarchy up. All the protected usage is incorrectly accumulated in the workload's parent. This means that siblings_low_usage is overestimated and effective protection underestimated. Even though it is transitional phenomenon (uncharge path does correct propagation and fixes the wrong children_low_usage), it can undermine the intended protection unexpectedly.
We have noticed this problem while seeing a swap out in a descendant of a protected memcg (intermediate node) while the parent was conveniently under its protection limit and the memory pressure was external to that hierarchy. Michal has pinpointed this down to the wrong siblings_low_usage which led to the unwanted reclaim.
The fix is simply updating children_low_usage in respective ancestors also in the charging path.
--- mm/page_counter.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
mm/page_counter.c +3 -3
@@ -77,7 +77,7 @@ void page_counter_charge(struct page_coulong new; new =atomic_long_add_return (nr_pages, &c->usage); -propagate_protected_usage (counter, new); +propagate_protected_usage (c, new);/* * This is indeed racy, but we can live with some * inaccuracy in the watermark.
@@ -121,7 +121,7 @@ bool page_counter_try_charge(struct page new =atomic_long_add_return (nr_pages, &c->usage);if (new > c->max) {atomic_long_sub (nr_pages, &c->usage); -propagate_protected_usage (counter, new); +propagate_protected_usage (c, new);/* * This is racy, but we can live with some * inaccuracy in the failcnt.
@@ -130,7 +130,7 @@ bool page_counter_try_charge(struct page *fail = c; goto failed; } -propagate_protected_usage (counter, new); +propagate_protected_usage (c, new);/* * Just like with failcnt, we can live with some * inaccuracy in the watermark.
Greg Kroah-Hartman
maintainerPATCH 56/152 mm/memory_hotplug: fix unpaired mem_hotplug_begin/done
In reply to Greg Kroah-HartmanFrom: Jia He <[email protected]>
commit b4223a510e2ab1bf0f971d50af7c1431014b25ad upstream.
When check_memblock_offlined_cb() returns failed rc(e.g. the memblock is online at that time), mem_hotplug_begin/done is unpaired in such case.
Therefore a warning:
Call Trace: percpu_up_write+0x33/0x40 try_remove_memory+0x66/0x120 ? _cond_resched+0x19/0x30 remove_memory+0x2b/0x40 dev_dax_kmem_remove+0x36/0x72 [kmem] device_release_driver_internal+0xf0/0x1c0 device_release_driver+0x12/0x20 bus_remove_device+0xe1/0x150 device_del+0x17b/0x3e0 unregister_dev_dax+0x29/0x60 devm_action_release+0x15/0x20 release_nodes+0x19a/0x1e0 devres_release_all+0x3f/0x50 device_release_driver_internal+0x100/0x1c0 driver_detach+0x4c/0x8f bus_remove_driver+0x5c/0xd0 driver_unregister+0x31/0x50 dax_pmem_exit+0x10/0xfe0 [dax_pmem]
--- mm/memory_hotplug.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
mm/memory_hotplug.c +2 -3
@@ -1751,7 +1751,7 @@ static int __ref try_remove_memory(int n*/ rc =walk_memory_blocks (start, size,NULL , check_memblock_offlined_cb);if (rc) - goto done; +return rc;/* remove memmap entry */ firmware_map_remove (start, start + size,"System RAM" );
@@ -1771,9 +1771,8 @@ static int __ref try_remove_memory(int ntry_offline_node (nid); -done:mem_hotplug_done (); -return rc; +return 0 ; }/**
Greg Kroah-Hartman
maintainerPATCH 57/152 ftrace: Setup correct FTRACE_FL_REGS flags for module
In reply to Greg Kroah-HartmanFrom: Chengming Zhou <[email protected]>
commit 8a224ffb3f52b0027f6b7279854c71a31c48fc97 upstream.
When module loaded and enabled, we will use __ftrace_replace_code for module if any ftrace_ops referenced it found. But we will get wrong ftrace_addr for module rec in ftrace_get_addr_new, because rec->flags has not been setup correctly. It can cause the callback function of a ftrace_ops has FTRACE_OPS_FL_SAVE_REGS to be called with pt_regs set to NULL.
So setup correct FTRACE_FL_REGS flags for rec when we call referenced_filters to find ftrace_ops references it.
--- kernel/trace/ftrace.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
kernel/trace/ftrace.c +7 -4
@@ -5699,8 +5699,11 @@ static int referenced_filters(struct dynint cnt =0 ;for (ops = ftrace_ops_list; ops != &ftrace_list_end; ops = ops->next) { -if (ops_references_rec (ops, rec)) - cnt++; +if (ops_references_rec (ops, rec)) { + cnt++; +if (ops->flags &FTRACE_OPS_FL_SAVE_REGS ) + rec->flags |=FTRACE_FL_REGS ; + } }return cnt;
@@ -5877,8 +5880,8 @@ void ftrace_module_enable(struct moduleif (ftrace_start_up) cnt +=referenced_filters (rec); -/* This clears FTRACE_FL_DISABLED */ - rec->flags = cnt; + rec->flags &= ~FTRACE_FL_DISABLED ; + rec->flags += cnt;if (ftrace_start_up && cnt) {int failed =__ftrace_replace_code (rec,1 );
Greg Kroah-Hartman
maintainerPATCH 58/152 kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler
In reply to Greg Kroah-HartmanFrom: Muchun Song <[email protected]>
commit 0cb2f1372baa60af8456388a574af6133edd7d80 upstream.
We found a case of kernel panic on our server. The stack trace is as follows(omit some irrelevant information):
BUG: kernel NULL pointer dereference, address: 0000000000000080 RIP: 0010:kprobe_ftrace_handler+0x5e/0xe0 RSP: 0018:ffffb512c6550998 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8e9d16eea018 RCX: 0000000000000000 RDX: ffffffffbe1179c0 RSI: ffffffffc0535564 RDI: ffffffffc0534ec0 RBP: ffffffffc0534ec1 R08: ffff8e9d1bbb0f00 R09: 0000000000000004 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8e9d1f797060 R14: 000000000000bacc R15: ffff8e9ce13eca00 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000080 CR3: 00000008453d0005 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ftrace_ops_assist_func+0x56/0xe0 ftrace_call+0x5/0x34 tcpa_statistic_send+0x5/0x130 [ttcp_engine]
The tcpa_statistic_send is the function being kprobed. After analysis, the root cause is that the fourth parameter regs of kprobe_ftrace_handler is NULL. Why regs is NULL? We use the crash tool to analyze the kdump.
crash> dis tcpa_statistic_send -r
<tcpa_statistic_send>: callq 0xffffffffbd8018c0 <ftrace_caller>
The tcpa_statistic_send calls ftrace_caller instead of ftrace_regs_caller. So it is reasonable that the fourth parameter regs of kprobe_ftrace_handler is NULL. In theory, we should call the ftrace_regs_caller instead of the ftrace_caller. After in-depth analysis, we found a reproducible path.
Writing a simple kernel module which starts a periodic timer. The timer's handler is named 'kprobe_test_timer_handler'. The module name is kprobe_test.ko.
1) insmod kprobe_test.ko
2) bpftrace -e 'kretprobe:kprobe_test_timer_handler {}'
3) echo 0 > /proc/sys/kernel/ftrace_enabled
4) rmmod kprobe_test
5) stop step 2) kprobe
6) insmod kprobe_test.ko
7) bpftrace -e 'kretprobe:kprobe_test_timer_handler {}'
We mark the kprobe as GONE but not disarm the kprobe in the step 4). The step 5) also do not disarm the kprobe when unregister kprobe. So we do not remove the ip from the filter. In this case, when the module loads again in the step 6), we will replace the code to ftrace_caller via the ftrace_module_enable(). When we register kprobe again, we will not replace ftrace_caller to ftrace_regs_caller because the ftrace is disabled in the step 3). So the step 7) will trigger kernel panic. Fix this problem by disarming the kprobe when the module is going away.
--- kernel/kprobes.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/kprobes.c +7 -0
@@ -2104,6 +2104,13 @@ static void kill_kprobe(struct kprobe *p* the original probed function (which will be freed soon) any more. */ arch_remove_kprobe (p); + +/* +* The module is going away. We should disarm the kprobe which +* is using ftrace. +*/ +if (kprobe_ftrace (p)) +disarm_kprobe_ftrace (p); }/* Disable one kprobe */
Greg Kroah-Hartman
maintainerPATCH 59/152 tracing/hwlat: Honor the tracing_cpumask
In reply to Greg Kroah-HartmanFrom: Kevin Hao <[email protected]>
commit 96b4833b6827a62c295b149213c68b559514c929 upstream.
In calculation of the cpu mask for the hwlat kernel thread, the wrong cpu mask is used instead of the tracing_cpumask, this causes the tracing/tracing_cpumask useless for hwlat tracer. Fixes it.
--- kernel/trace/trace_hwlat.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
kernel/trace/trace_hwlat.c +3 -2
@@ -270,6 +270,7 @@ static bool disable_migrate;static void move_to_next_cpu (void ) {struct cpumask *current_mask = &save_cpumask; +struct trace_array *tr = hwlat_trace;int next_cpu;if (disable_migrate)
@@ -283,7 +284,7 @@ static void move_to_next_cpu(void) goto disable;get_online_cpus (); -cpumask_and (current_mask, cpu_online_mask, tracing_buffer_mask); +cpumask_and (current_mask, cpu_online_mask, tr->tracing_cpumask); next_cpu =cpumask_next (smp_processor_id (), current_mask);put_online_cpus ();
@@ -360,7 +361,7 @@ static int start_kthread(struct trace_ar/* Just pick the first CPU on first iteration */ current_mask = &save_cpumask;get_online_cpus (); -cpumask_and (current_mask, cpu_online_mask, tracing_buffer_mask); +cpumask_and (current_mask, cpu_online_mask, tr->tracing_cpumask);put_online_cpus (); next_cpu =cpumask_first (current_mask);
Greg Kroah-Hartman
maintainerPATCH 60/152 tracing: Use trace_sched_process_free() instead of exit() for pid tracing
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit afcab636657421f7ebfa0783a91f90256bba0091 upstream.
On exit, if a process is preempted after the trace_sched_process_exit() tracepoint but before the process is done exiting, then when it gets scheduled in, the function tracers will not filter it properly against the function tracing pid filters.
That is because the function tracing pid filters hooks to the sched_process_exit() tracepoint to remove the exiting task's pid from the filter list. Because the filtering happens at the sched_switch tracepoint, when the exiting task schedules back in to finish up the exit, it will no longer be in the function pid filtering tables.
This was noticeable in the notrace self tests on a preemptable kernel, as the tests would fail as it exits and preempted after being taken off the notrace filter table and on scheduling back in it would not be in the notrace list, and then the ending of the exit function would trace. The test detected this and would fail.
--- kernel/trace/ftrace.c | 4 ++-- kernel/trace/trace_events.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
kernel/trace/ftrace.c +2 -2
@@ -6462,12 +6462,12 @@ void ftrace_pid_follow_fork(struct traceif (enable) {register_trace_sched_process_fork (ftrace_pid_follow_sched_process_fork, tr); -register_trace_sched_process_exit (ftrace_pid_follow_sched_process_exit, +register_trace_sched_process_free (ftrace_pid_follow_sched_process_exit, tr); }else {unregister_trace_sched_process_fork (ftrace_pid_follow_sched_process_fork, tr); -unregister_trace_sched_process_exit (ftrace_pid_follow_sched_process_exit, +unregister_trace_sched_process_free (ftrace_pid_follow_sched_process_exit, tr); } }
kernel/trace/trace_events.c +2 -2
@@ -527,12 +527,12 @@ void trace_event_follow_fork(struct tracif (enable) {register_trace_prio_sched_process_fork (event_filter_pid_sched_process_fork, tr,INT_MIN ); -register_trace_prio_sched_process_exit (event_filter_pid_sched_process_exit, +register_trace_prio_sched_process_free (event_filter_pid_sched_process_exit, tr,INT_MAX ); }else {unregister_trace_sched_process_fork (event_filter_pid_sched_process_fork, tr); -unregister_trace_sched_process_exit (event_filter_pid_sched_process_exit, +unregister_trace_sched_process_free (event_filter_pid_sched_process_exit, tr); } }
Greg Kroah-Hartman
maintainerPATCH 61/152 tracing: Move pipe reference to trace array instead of current_tracer
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 7ef282e05132d56b6f6b71e3873f317664bea78b upstream.
If a process has the trace_pipe open on a trace_array, the current tracer for that trace array should not be changed. This was original enforced by a global lock, but when instances were introduced, it was moved to the current_trace. But this structure is shared by all instances, and a trace_pipe is for a single instance. There's no reason that a process that has trace_pipe open on one instance should prevent another instance from changing its current tracer. Move the reference counter to the trace_array instead.
This is marked as "Fixes" but is more of a clean up than a true fix. Backport if you want, but its not critical.
--- kernel/trace/trace.c | 12 ++++++------ kernel/trace/trace.h | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-)
kernel/trace/trace.c +6 -6
@@ -5686,7 +5686,7 @@ static int tracing_set_tracer(struct tra }/* If trace pipe files are being read, we can't change the tracer */ -if (tr->current_trace->ref) { +if (tr->trace_ref) { ret = -EBUSY ; goto out; }
@@ -5902,7 +5902,7 @@ static int tracing_open_pipe(struct inodnonseekable_open (inode, filp); - tr->current_trace->ref++; + tr->trace_ref++; out:mutex_unlock (&trace_types_lock);return ret;
@@ -5921,7 +5921,7 @@ static int tracing_release_pipe(struct imutex_lock (&trace_types_lock); - tr->current_trace->ref--; + tr->trace_ref--;if (iter->trace->pipe_close) iter->trace->pipe_close (iter);
@@ -7230,7 +7230,7 @@ static int tracing_buffers_open(struct i filp->private_data = info; - tr->current_trace->ref++; + tr->trace_ref++;mutex_unlock (&trace_types_lock);
@@ -7331,7 +7331,7 @@ static int tracing_buffers_release(strucmutex_lock (&trace_types_lock); - iter->tr->current_trace->ref--; + iter->tr->trace_ref--;__trace_array_put (iter->tr);
@@ -8470,7 +8470,7 @@ static int __remove_instance(struct trac {int i; -if (tr->ref || (tr->current_trace && tr->current_trace->ref)) +if (tr->ref || (tr->current_trace && tr->trace_ref))return -EBUSY ;list_del (&tr->list);
kernel/trace/trace.h +1 -1
@@ -309,6 +309,7 @@ struct trace_array {struct trace_event_file *trace_marker_file;cpumask_var_t tracing_cpumask;/* only trace on set CPUs */ int ref; +int trace_ref;#ifdef CONFIG_FUNCTION_TRACER struct ftrace_ops *ops;struct trace_pid_list __rcu *function_pids;
@@ -498,7 +499,6 @@ struct tracer {struct tracer *next;struct tracer_flags *flags;int enabled; -int ref;bool print_max;bool allow_instances;#ifdef CONFIG_TRACER_MAX_TRACE
Greg Kroah-Hartman
maintainerPATCH 62/152 watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options
In reply to Greg Kroah-HartmanFrom: Ahmad Fatoum <[email protected]>
commit e871e93fb08a619dfc015974a05768ed6880fd82 upstream.
The driver supports populating bootstatus with WDIOF_CARDRESET, but so far userspace couldn't portably determine whether absence of this flag meant no watchdog reset or no driver support. Or-in the bit to fix this.
--- drivers/watchdog/f71808e_wdt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/watchdog/f71808e_wdt.c +2 -1
@@ -691,7 +691,8 @@ static int __init watchdog_init(int sioa watchdog.sioaddr = sioaddr; watchdog.ident.options =WDIOC_SETTIMEOUT |WDIOF_MAGICCLOSE - |WDIOF_KEEPALIVEPING ; + |WDIOF_KEEPALIVEPING + |WDIOF_CARDRESET ; snprintf(watchdog.ident.identity, sizeof(watchdog.ident.identity), "%s watchdog",
Greg Kroah-Hartman
maintainerPATCH 63/152 watchdog: f71808e_wdt: remove use of wrong watchdog_info option
In reply to Greg Kroah-HartmanFrom: Ahmad Fatoum <[email protected]>
commit 802141462d844f2e6a4d63a12260d79b7afc4c34 upstream.
The flags that should be or-ed into the watchdog_info.options by drivers all start with WDIOF_, e.g. WDIOF_SETTIMEOUT, which indicates that the driver's watchdog_ops has a usable set_timeout.
WDIOC_SETTIMEOUT was used instead, which expands to 0xc0045706, which equals:
WDIOF_FANFAULT | WDIOF_EXTERN1 | WDIOF_PRETIMEOUT | WDIOF_ALARMONLY | WDIOF_MAGICCLOSE | 0xc0045000
These were so far indicated to userspace on WDIOC_GETSUPPORT. As the driver has not yet been migrated to the new watchdog kernel API, the constant can just be dropped without substitute.
--- drivers/watchdog/f71808e_wdt.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/watchdog/f71808e_wdt.c +1 -2
@@ -689,8 +689,7 @@ static int __init watchdog_init(int sioa* into the module have been registered yet. */ watchdog.sioaddr = sioaddr; - watchdog.ident.options =WDIOC_SETTIMEOUT - |WDIOF_MAGICCLOSE + watchdog.ident.options =WDIOF_MAGICCLOSE |WDIOF_KEEPALIVEPING |WDIOF_CARDRESET ;
Greg Kroah-Hartman
maintainerPATCH 64/152 watchdog: f71808e_wdt: clear watchdog timeout occurred flag
In reply to Greg Kroah-HartmanFrom: Ahmad Fatoum <[email protected]>
commit 4f39d575844148fbf3081571a1f3b4ae04150958 upstream.
The flag indicating a watchdog timeout having occurred normally persists till Power-On Reset of the Fintek Super I/O chip. The user can clear it by writing a `1' to the bit.
The driver doesn't offer a restart method, so regular system reboot might not reset the Super I/O and if the watchdog isn't enabled, we won't touch the register containing the bit on the next boot. In this case all subsequent regular reboots will be wrongly flagged by the driver as being caused by the watchdog.
Fix this by having the flag cleared after read. This is also done by other drivers like those for the i6300esb and mpc8xxx_wdt.
--- drivers/watchdog/f71808e_wdt.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/watchdog/f71808e_wdt.c +7 -0
@@ -705,6 +705,13 @@ static int __init watchdog_init(int sioa wdt_conf =superio_inb (sioaddr,F71808FG_REG_WDT_CONF ); watchdog.caused_reboot = wdt_conf &BIT (F71808FG_FLAG_WDTMOUT_STS ); +/* +* We don't want WDTMOUT_STS to stick around till regular reboot. +* Write 1 to the bit to clear it to zero. +*/ +superio_outb (sioaddr,F71808FG_REG_WDT_CONF , + wdt_conf |BIT (F71808FG_FLAG_WDTMOUT_STS )); +superio_exit (sioaddr); err =watchdog_set_timeout (timeout);
Greg Kroah-Hartman
maintainerPATCH 65/152 ceph: set sec_context xattr on symlink creation
In reply to Greg Kroah-HartmanFrom: Jeff Layton <[email protected]>
commit b748fc7a8763a5b3f8149f12c45711cd73ef8176 upstream.
Symlink inodes should have the security context set in their xattrs on creation. We already set the context on creation, but we don't attach the pagelist. The effect is that symlink inodes don't get an SELinux context set on them at creation, so they end up unlabeled instead of inheriting the proper context. Make it do so.
--- fs/ceph/dir.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ceph/dir.c +4 -0
@@ -920,6 +920,10 @@ static int ceph_symlink(struct inode *di req->r_num_caps =2 ; req->r_dentry_drop =CEPH_CAP_FILE_SHARED |CEPH_CAP_AUTH_EXCL ; req->r_dentry_unless =CEPH_CAP_FILE_EXCL ; +if (as_ctx.pagelist) { + req->r_pagelist = as_ctx.pagelist; + as_ctx.pagelist =NULL ; + } err =ceph_mdsc_do_request (mdsc, dir, req);if (!err && !req->r_reply_info.head->is_dentry) err =ceph_handle_notrace_create (dir, dentry);
Greg Kroah-Hartman
maintainerPATCH 66/152 ceph: handle zero-length feature mask in session messages
In reply to Greg Kroah-HartmanFrom: Jeff Layton <[email protected]>
commit 02e37571f9e79022498fd0525c073b07e9d9ac69 upstream.
Most session messages contain a feature mask, but the MDS will routinely send a REJECT message with one that is zero-length.
Commit 0fa8263367db ("ceph: fix endianness bug when handling MDS session feature bits") fixed the decoding of the feature mask, but failed to account for the MDS sending a zero-length feature mask. This causes REJECT message decoding to fail.
Skip trying to decode a feature mask if the word count is zero.
Cc: [email protected]
URL: https://tracker.ceph.com/issues/46823
--- fs/ceph/mds_client.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ceph/mds_client.c +4 -2
@@ -3091,8 +3091,10 @@ static void handle_session(struct ceph_m goto bad;/* version >= 3, feature bits */ ceph_decode_32_safe (&p, end, len, bad); -ceph_decode_64_safe (&p, end, features, bad); - p += len -sizeof (features); +if (len) { +ceph_decode_64_safe (&p, end, features, bad); + p += len -sizeof (features); + } }mutex_lock (&mdsc->mutex);
Greg Kroah-Hartman
maintainerPATCH 67/152 pseries: Fix 64 bit logical memory block panic
In reply to Greg Kroah-HartmanFrom: Anton Blanchard <[email protected]>
commit 89c140bbaeee7a55ed0360a88f294ead2b95201b upstream.
Booting with a 4GB LMB size causes us to panic:
qemu-system-ppc64: OS terminated: OS panic:
Memory block size not suitable: 0x0
Fix pseries_memory_block_size() to handle 64 bit LMBs.
--- arch/powerpc/platforms/pseries/hotplug-memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/pseries/hotplug-memory.c +1 -1
@@ -27,7 +27,7 @@ static bool rtas_hp_event;unsigned long pseries_memory_block_size (void ) {struct device_node *np; -unsigned int memblock_size =MIN_MEMORY_BLOCK_SIZE ; +u64 memblock_size =MIN_MEMORY_BLOCK_SIZE ;struct resource r; np =of_find_node_by_path ("/ibm,dynamic-reconfiguration-memory" );
Greg Kroah-Hartman
maintainerPATCH 68/152 module: Correctly truncate sysfs sections output
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 11990a5bd7e558e9203c1070fc52fb6f0488e75b upstream.
The only-root-readable /sys/module/$module/sections/$section files did not truncate their output to the available buffer size. While most paths into the kernfs read handlers end up using PAGE_SIZE buffers, it's possible to get there through other paths (e.g. splice, sendfile). Actually limit the output to the "count" passed into the read function, and report it back correctly. *sigh*
--- kernel/module.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-)
kernel/module.c +19 -3
@@ -1517,18 +1517,34 @@ struct module_sect_attrs {struct module_sect_attr attrs[0 ]; }; +#define MODULE_SECT_READ_SIZE (3 /* "0x", "\n" */ + (BITS_PER_LONG / 4))static ssize_t module_sect_read (struct file *file,struct kobject *kobj,struct bin_attribute *battr,char *buf,loff_t pos,size_t count) {struct module_sect_attr *sattr = container_of(battr, struct module_sect_attr, battr); +char bounce[MODULE_SECT_READ_SIZE +1 ]; +size_t wrote;if (pos !=0 )return -EINVAL ; -return sprintf (buf,"0x%px\n" , -kallsyms_show_value (file->f_cred) ? (void *)sattr->address :NULL ); +/* +* Since we're a binary read handler, we must account for the +* trailing NUL byte that sprintf will write: if "buf" is +* too small to hold the NUL, or the NUL is exactly the last +* byte, the read will look like it got truncated by one byte. +* Since there is no way to ask sprintf nicely to not write +* the NUL, we have to use a bounce buffer. +*/ + wrote =scnprintf (bounce,sizeof (bounce),"0x%px\n" , +kallsyms_show_value (file->f_cred) + ? (void *)sattr->address :NULL ); + count =min (count, wrote); +memcpy (buf, bounce, count); + +return count; }static void free_sect_attrs (struct module_sect_attrs *sect_attrs)
@@ -1577,7 +1593,7 @@ static void add_sect_attrs(struct module goto out; sect_attrs->nsections++; sattr->battr.read = module_sect_read; - sattr->battr.size =3 /* "0x", "\n" */ + (BITS_PER_LONG /4 ); + sattr->battr.size =MODULE_SECT_READ_SIZE ; sattr->battr.attr.mode =0400 ; *(gattr++) = &(sattr++)->battr; }
Greg Kroah-Hartman
maintainerPATCH 69/152 perf intel-pt: Fix FUP packet state
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
commit 401136bb084fd021acd9f8c51b52fe0a25e326b2 upstream.
While walking code towards a FUP ip, the packet state is INTEL_PT_STATE_FUP or INTEL_PT_STATE_FUP_NO_TIP. That was mishandled resulting in the state becoming INTEL_PT_STATE_IN_SYNC prematurely. The result was an occasional lost EXSTOP event.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 21 ++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +7 -14
@@ -1164,6 +1164,7 @@ static int intel_pt_walk_fup(struct intereturn 0 ;if (err == -EAGAIN ||intel_pt_fup_with_nlip (decoder, &intel_pt_insn, ip, err)) { + decoder->pkt_state =INTEL_PT_STATE_IN_SYNC ;if (intel_pt_fup_event (decoder))return 0 ;return -EAGAIN ;
@@ -1942,17 +1943,13 @@ next: }if (decoder->set_fup_mwait) no_tip = true; +if (no_tip) + decoder->pkt_state =INTEL_PT_STATE_FUP_NO_TIP ; +else + decoder->pkt_state =INTEL_PT_STATE_FUP ; err =intel_pt_walk_fup (decoder); -if (err != -EAGAIN ) { -if (err) -return err; -if (no_tip) - decoder->pkt_state = -INTEL_PT_STATE_FUP_NO_TIP ; -else - decoder->pkt_state =INTEL_PT_STATE_FUP ; -return 0 ; - } +if (err != -EAGAIN ) +return err;if (no_tip) { no_tip = false;break ;
@@ -2599,15 +2596,11 @@ const struct intel_pt_state *intel_pt_de err =intel_pt_walk_tip (decoder);break ;case INTEL_PT_STATE_FUP : - decoder->pkt_state =INTEL_PT_STATE_IN_SYNC ; err =intel_pt_walk_fup (decoder);if (err == -EAGAIN ) err =intel_pt_walk_fup_tip (decoder); -else if (!err) - decoder->pkt_state =INTEL_PT_STATE_FUP ;break ;case INTEL_PT_STATE_FUP_NO_TIP : - decoder->pkt_state =INTEL_PT_STATE_IN_SYNC ; err =intel_pt_walk_fup (decoder);if (err == -EAGAIN ) err =intel_pt_walk_trace (decoder);
Greg Kroah-Hartman
maintainerPATCH 70/152 perf intel-pt: Fix duplicate branch after CBR
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
commit a58a057ce65b52125dd355b7d8b0d540ea267a5f upstream.
CBR events can result in a duplicate branch event, because the state type defaults to a branch. Fix by clearing the state type.
Example: trace 'sleep' and hope for a frequency change
Before:
$ perf record -e intel_pt//u sleep 0.1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.034 MB perf.data ] $ perf script --itrace=bpe > before.txt
After:
$ perf script --itrace=bpe > after.txt
$ diff -u before.txt after.txt
# --- before.txt 2020-07-07 14:42:18.191508098 +0300
# +++ after.txt 2020-07-07 14:42:36.587891753 +0300
@@ -29673,7 +29673,6 @@
sleep 93431 [007] 15411.619905: 1 branches:u: 0 [unknown] ([unknown]) => 7f0818abb2e0 clock_nanosleep@@GLIBC_2.17+0x0 (/usr/lib/x86_64-linux-gnu/libc-2.31.so)
sleep 93431 [007] 15411.619905: 1 branches:u: 7f0818abb30c clock_nanosleep@@GLIBC_2.17+0x2c (/usr/lib/x86_64-linux-gnu/libc-2.31.so) => 0 [unknown] ([unknown])
sleep 93431 [007] 15411.720069: cbr: cbr: 15 freq: 1507 MHz ( 56%) 7f0818abb30c clock_nanosleep@@GLIBC_2.17+0x2c (/usr/lib/x86_64-linux-gnu/libc-2.31.so)
- sleep 93431 [007] 15411.720069: 1 branches:u: 7f0818abb30c clock_nanosleep@@GLIBC_2.17+0x2c (/usr/lib/x86_64-linux-gnu/libc-2.31.so) => 0 [unknown] ([unknown])
sleep 93431 [007] 15411.720076: 1 branches:u: 0 [unknown] ([unknown]) => 7f0818abb30e clock_nanosleep@@GLIBC_2.17+0x2e (/usr/lib/x86_64-linux-gnu/libc-2.31.so)
sleep 93431 [007] 15411.720077: 1 branches:u: 7f0818abb323 clock_nanosleep@@GLIBC_2.17+0x43 (/usr/lib/x86_64-linux-gnu/libc-2.31.so) => 7f0818ac0eb7 __nanosleep+0x17 (/usr/lib/x86_64-linux-gnu/libc-2.31.so)
sleep 93431 [007] 15411.720077: 1 branches:u: 7f0818ac0ebf __nanosleep+0x1f (/usr/lib/x86_64-linux-gnu/libc-2.31.so) => 55cb7e4c2827 rpl_nanosleep+0x97 (/usr/bin/sleep)--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +6 -2
@@ -1977,8 +1977,10 @@ next:* possibility of another CBR change that gets caught up * in the PSB+. */ -if (decoder->cbr != decoder->cbr_seen) +if (decoder->cbr != decoder->cbr_seen) { + decoder->state.type =0 ;return 0 ; + }break ;case INTEL_PT_PIP :
@@ -2019,8 +2021,10 @@ next:case INTEL_PT_CBR :intel_pt_calc_cbr (decoder); -if (decoder->cbr != decoder->cbr_seen) +if (decoder->cbr != decoder->cbr_seen) { + decoder->state.type =0 ;return 0 ; + }break ;case INTEL_PT_MODE_EXEC :
Greg Kroah-Hartman
maintainerPATCH 71/152 remoteproc: qcom: q6v5: Update running state before requesting stop
In reply to Greg Kroah-HartmanFrom: Sibi Sankar <[email protected]>
commit 5b7be880074c73540948f8fc597e0407b98fabfa upstream.
Sometimes the stop triggers a watchdog rather than a stop-ack. Update the running state to false on requesting stop to skip the watchdog instead.
Error Logs:
$ echo stop > /sys/class/remoteproc/remoteproc0/state ipa 1e40000.ipa: received modem stopping event remoteproc-modem: watchdog received: sys_m_smsm_mpss.c:291:APPS force stop qcom-q6v5-mss 4080000.remoteproc-modem: port failed halt ipa 1e40000.ipa: received modem offline event remoteproc0: stopped remote processor 4080000.remoteproc-modem
--- drivers/remoteproc/qcom_q6v5.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/remoteproc/qcom_q6v5.c +2 -0
@@ -151,6 +151,8 @@ int qcom_q6v5_request_stop(struct qcom_q {int ret; + q6v5->running = false; +qcom_smem_state_update_bits (q6v5->state,BIT (q6v5->stop_bit),BIT (q6v5->stop_bit));
Greg Kroah-Hartman
maintainerPATCH 72/152 remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load
In reply to Greg Kroah-HartmanFrom: Sibi Sankar <[email protected]>
commit e013f455d95add874f310dc47c608e8c70692ae5 upstream.
The following mem abort is observed when the mba firmware size exceeds the allocated mba region. MBA firmware size is restricted to a maximum size of 1M and remaining memory region is used by modem debug policy firmware when available. Hence verify whether the MBA firmware size lies within the allocated memory region and is not greater than 1M before loading.
Err Logs:
Unable to handle kernel paging request at virtual address Mem abort info: ... Call trace: __memcpy+0x110/0x180 rproc_start+0x40/0x218 rproc_boot+0x5b4/0x608 state_store+0x54/0xf8 dev_attr_store+0x44/0x60 sysfs_kf_write+0x58/0x80 kernfs_fop_write+0x140/0x230 vfs_write+0xc4/0x208 ksys_write+0x74/0xf8 __arm64_sys_write+0x24/0x30
...
--- drivers/remoteproc/qcom_q6v5_mss.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/remoteproc/qcom_q6v5_mss.c +6 -0
@@ -381,6 +381,12 @@ static int q6v5_load(struct rproc *rproc {struct q6v5 *qproc = rproc->priv; +/* MBA is restricted to a maximum size of 1M */ +if (fw->size > qproc->mba_size || fw->size >SZ_1M ) { +dev_err (qproc->dev,"MBA firmware load failed\n" ); +return -EINVAL ; + } +memcpy (qproc->mba_region, fw->data, fw->size);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 73/152 remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load
In reply to Greg Kroah-HartmanFrom: Sibi Sankar <[email protected]>
commit 135b9e8d1cd8ba5ac9ad9bcf24b464b7b052e5b8 upstream.
The following mem abort is observed when one of the modem blob firmware size exceeds the allocated mpss region. Fix this by restricting the copy size to segment size using request_firmware_into_buf before load.
Err Logs:
Unable to handle kernel paging request at virtual address Mem abort info: ... Call trace: __memcpy+0x110/0x180 rproc_start+0xd0/0x190 rproc_boot+0x404/0x550 state_store+0x54/0xf8 dev_attr_store+0x44/0x60 sysfs_kf_write+0x58/0x80 kernfs_fop_write+0x140/0x230 vfs_write+0xc4/0x208 ksys_write+0x74/0xf8
...
--- drivers/remoteproc/qcom_q6v5_mss.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/remoteproc/qcom_q6v5_mss.c +2 -3
@@ -1034,15 +1034,14 @@ static int q6v5_mpss_load(struct q6v5 *q }else if (phdr->p_filesz) {/* Replace "xxx.xxx" with "xxx.bxx" */ sprintf (fw_name + fw_name_len -3 ,"b%02d" , i); - ret =request_firmware (&seg_fw, fw_name, qproc->dev); + ret =request_firmware_into_buf (&seg_fw, fw_name, qproc->dev, + ptr, phdr->p_filesz);if (ret) {dev_err (qproc->dev,"failed to load %s\n" , fw_name);iounmap (ptr); goto release_firmware; } -memcpy (ptr, seg_fw->data, seg_fw->size); -release_firmware (seg_fw); }
Greg Kroah-Hartman
maintainerPATCH 74/152 drm/imx: imx-ldb: Disable both channels for split mode in enc->disable()
In reply to Greg Kroah-HartmanFrom: Liu Ying <[email protected]>
commit 3b2a999582c467d1883716b37ffcc00178a13713 upstream.
Both of the two LVDS channels should be disabled for split mode in the encoder's ->disable() callback, because they are enabled in the encoder's ->enable() callback.
--- drivers/gpu/drm/imx/imx-ldb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/imx/imx-ldb.c +4 -3
@@ -302,18 +302,19 @@ static void imx_ldb_encoder_disable(stru {struct imx_ldb_channel *imx_ldb_ch =enc_to_imx_ldb_ch (encoder);struct imx_ldb *ldb = imx_ldb_ch->ldb; +int dual = ldb->ldb_ctrl &LDB_SPLIT_MODE_EN ;int mux, ret;drm_panel_disable (imx_ldb_ch->panel); -if (imx_ldb_ch == &ldb->channel[0 ]) +if (imx_ldb_ch == &ldb->channel[0 ] || dual) ldb->ldb_ctrl &= ~LDB_CH0_MODE_EN_MASK ; -else if (imx_ldb_ch == &ldb->channel[1 ]) +if (imx_ldb_ch == &ldb->channel[1 ] || dual) ldb->ldb_ctrl &= ~LDB_CH1_MODE_EN_MASK ;regmap_write (ldb->regmap,IOMUXC_GPR2 , ldb->ldb_ctrl); -if (ldb->ldb_ctrl &LDB_SPLIT_MODE_EN ) { +if (dual) {clk_disable_unprepare (ldb->clk[0 ]);clk_disable_unprepare (ldb->clk[1 ]); }
Greg Kroah-Hartman
maintainerPATCH 75/152 orangefs: get rid of knob code...
In reply to Greg Kroah-HartmanFrom: Mike Marshall <[email protected]>
commit ec95f1dedc9c64ac5a8b0bdb7c276936c70fdedd upstream.
Christoph Hellwig sent in a reversion of "orangefs: remember count when reading." because:
->read_iter calls can race with each other and one or more ->flush calls. Remove the the scheme to store the read count in the file private data as is is completely racy and can cause use after free or double free conditions
Christoph's reversion caused Orangefs not to work or to compile. I added a patch that fixed that, but intel's kbuild test robot pointed out that sending Christoph's patch followed by my patch upstream, it would break bisection because of the failure to compile. So I have combined the reversion plus my patch... here's the commit message that was in my patch:
Logically, optimal Orangefs "pages" are 4 megabytes. Reading large Orangefs files 4096 bytes at a time is like trying to kick a dead whale down the beach. Before Christoph's "Revert
orangefs: remember count when reading." I tried to give users a knob whereby they could, for example, use "count" in read(2) or bs with dd(1) to get whatever they considered an appropriate amount of bytes at a time from Orangefs and fill as many page cache pages as they could at once.
Without the racy code that Christoph reverted Orangefs won't even compile, much less work. So this replaces the logic that used the private file data that Christoph reverted with a static number of bytes to read from Orangefs.
I ran tests like the following to determine what a reasonable static number of bytes might be:
dd if=/pvfsmnt/asdf of=/dev/null count=128 bs=4194304 dd if=/pvfsmnt/asdf of=/dev/null count=256 bs=2097152 dd if=/pvfsmnt/asdf of=/dev/null count=512 bs=1048576
.
.
.dd if=/pvfsmnt/asdf of=/dev/null count=4194304 bs=128
Reads seem faster using the static number, so my "knob code" wasn't just racy, it wasn't even a good idea...
--- fs/orangefs/file.c | 26 +------------------------- fs/orangefs/inode.c | 39 ++++++--------------------------------- fs/orangefs/orangefs-kernel.h | 4 ---- 3 files changed, 7 insertions(+), 62 deletions(-)
fs/orangefs/file.c +1 -25
@@ -311,23 +311,8 @@ static ssize_t orangefs_file_read_iter(s struct iov_iter *iter) {int ret; -struct orangefs_read_options *ro; - orangefs_stats.reads++; -/* -* Remember how they set "count" in read(2) or pread(2) or whatever - -* users can use count as a knob to control orangefs io size and later -* we can try to help them fill as many pages as possible in readpage. -*/ -if (!iocb->ki_filp->private_data) { - iocb->ki_filp->private_data =kmalloc (sizeof *ro,GFP_KERNEL ); -if (!iocb->ki_filp->private_data) -return (ENOMEM ); - ro = iocb->ki_filp->private_data; - ro->blksiz = iter->count; - } -down_read (&file_inode (iocb->ki_filp)->i_rwsem); ret =orangefs_revalidate_mapping (file_inode (iocb->ki_filp));if (ret)
@@ -615,12 +600,6 @@ static int orangefs_lock(struct file *fireturn rc; } -static int orangefs_file_open (struct inode * inode,struct file *file) -{ - file->private_data =NULL ; -return generic_file_open (inode, file); -} -static int orangefs_flush (struct file *file,fl_owner_t id) {/*
@@ -634,9 +613,6 @@ static int orangefs_flush(struct file *fstruct inode *inode = file->f_mapping->host;int r; -kfree (file->private_data); - file->private_data =NULL ; -if (inode->i_state &I_DIRTY_TIME ) {spin_lock (&inode->i_lock); inode->i_state &= ~I_DIRTY_TIME ;
@@ -659,7 +635,7 @@ const struct file_operations orangefs_fi .lock = orangefs_lock, .unlocked_ioctl = orangefs_ioctl, .mmap = orangefs_file_mmap, - .open = orangefs_file_open, + .open = generic_file_open, .flush = orangefs_flush, .release = orangefs_file_release, .fsync = orangefs_fsync,
fs/orangefs/inode.c +6 -33
@@ -259,46 +259,19 @@ static int orangefs_readpage(struct filepgoff_t index;/* which page */ struct page *next_page;char *kaddr; -struct orangefs_read_options *ro = file->private_data;loff_t read_size; -loff_t roundedup;int buffer_index =-1 ;/* orangefs shared memory slot */ int slot_index;/* index into slot */ int remaining;/* -* If they set some miniscule size for "count" in read(2) -* (for example) then let's try to read a page, or the whole file -* if it is smaller than a page. Once "count" goes over a page -* then lets round up to the highest page size multiple that is -* less than or equal to "count" and do that much orangefs IO and -* try to fill as many pages as we can from it. -* -* "count" should be represented in ro->blksiz. -* -* inode->i_size = file size. +* Get up to this many bytes from Orangefs at a time and try +* to fill them into the page cache at once. Tests with dd made +* this seem like a reasonable static number, if there was +* interest perhaps this number could be made setable through +* sysfs... */ -if (ro) { -if (ro->blksiz <PAGE_SIZE ) { -if (inode->i_size <PAGE_SIZE ) - read_size = inode->i_size; -else - read_size =PAGE_SIZE ; - }else { - roundedup = ((PAGE_SIZE -1 ) & ro->blksiz) ? - ((ro->blksiz +PAGE_SIZE ) & ~(PAGE_SIZE -1 )) : - ro->blksiz; -if (roundedup > inode->i_size) - read_size = inode->i_size; -else - read_size = roundedup; - - } - }else { - read_size =PAGE_SIZE ; - } -if (!read_size) - read_size =PAGE_SIZE ; + read_size =524288 ;if (PageDirty (page))orangefs_launder_page (page);
fs/orangefs/orangefs-kernel.h +0 -4
@@ -239,10 +239,6 @@ struct orangefs_write_range {kgid_t gid; }; -struct orangefs_read_options { -ssize_t blksiz; -}; -extern struct orangefs_stats orangefs_stats;/*
Greg Kroah-Hartman
maintainerPATCH 76/152 pinctrl: ingenic: Properly detect GPIO direction when configured for IRQ
In reply to Greg Kroah-HartmanFrom: Paul Cercueil <[email protected]>
commit 84e7a946da71f678affacea301f6d5cb4d9784e8 upstream.
The PAT1 register contains information about the IRQ type (edge/level) for input GPIOs with IRQ enabled, and the direction for non-IRQ GPIOs. So it makes sense to read it only if the GPIO has no interrupt configured, otherwise input GPIOs configured for level IRQs are misdetected as output GPIOs.
--- drivers/pinctrl/pinctrl-ingenic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-ingenic.c +2 -1
@@ -1644,7 +1644,8 @@ static int ingenic_gpio_get_direction(stunsigned int pin = gc->base + offset;if (jzpc->version >=ID_JZ4760 ) -return ingenic_get_pin_config (jzpc, pin,JZ4760_GPIO_PAT1 ); +return ingenic_get_pin_config (jzpc, pin,JZ4760_GPIO_INT ) || +ingenic_get_pin_config (jzpc, pin,JZ4760_GPIO_PAT1 );if (ingenic_get_pin_config (jzpc, pin,JZ4740_GPIO_SELECT ))return true;
Greg Kroah-Hartman
maintainerPATCH 77/152 crypto: algif_aead - Only wake up when ctx->more is zero
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit f3c802a1f30013f8f723b62d7fa49eb9e991da23 ]
AEAD does not support partial requests so we must not wake up while ctx->more is set. In order to distinguish between the case of no data sent yet and a zero-length request, a new init flag has been added to ctx.
SKCIPHER has also been modified to ensure that at least a block of data is available if there is more data to come.
--- crypto/af_alg.c | 11 ++++++++--- crypto/algif_aead.c | 4 ++-- crypto/algif_skcipher.c | 4 ++-- include/crypto/if_alg.h | 4 +++- 4 files changed, 15 insertions(+), 8 deletions(-)
crypto/af_alg.c +8 -3
@@ -635,6 +635,7 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,if (!ctx->used) ctx->merge =0 ; + ctx->init = ctx->more; }EXPORT_SYMBOL_GPL (af_alg_pull_tsgl);
@@ -734,9 +735,10 @@ EXPORT_SYMBOL_GPL(af_alg_wmem_wakeup);* * @sk socket of connection to user space * @flags If MSG_DONTWAIT is set, then only report if function would sleep +* @min Set to minimum request size if partial requests are allowed. * @return 0 when writable memory is available, < 0 upon error */ -int af_alg_wait_for_data (struct sock *sk,unsigned flags) +int af_alg_wait_for_data (struct sock *sk,unsigned flags,unsigned min) {DEFINE_WAIT_FUNC (wait, woken_wake_function);struct alg_sock *ask =alg_sk (sk);
@@ -754,7 +756,9 @@ int af_alg_wait_for_data(struct sock *sk, unsigned flags)if (signal_pending (current))break ; timeout =MAX_SCHEDULE_TIMEOUT ; -if (sk_wait_event (sk, &timeout, (ctx->used || !ctx->more), +if (sk_wait_event (sk, &timeout, + ctx->init && (!ctx->more || + (min && ctx->used >= min)), &wait)) { err =0 ;break ;
@@ -843,7 +847,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, }lock_sock (sk); -if (!ctx->more && ctx->used) { +if (ctx->init && (init || !ctx->more)) { err = -EINVAL ; goto unlock; }
@@ -854,6 +858,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,memcpy (ctx->iv, con.iv->iv, ivsize); ctx->aead_assoclen = con.aead_assoclen; + ctx->init = true; }while (size) {
crypto/algif_aead.c +2 -2
@@ -106,8 +106,8 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,size_t usedpages =0 ;/* [in] RX bufs to be used from user */ size_t processed =0 ;/* [in] TX bufs to be consumed */ -if (!ctx->used) { - err =af_alg_wait_for_data (sk, flags); +if (!ctx->init || ctx->more) { + err =af_alg_wait_for_data (sk, flags,0 );if (err)return err; }
crypto/algif_skcipher.c +2 -2
@@ -61,8 +61,8 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,int err =0 ;size_t len =0 ; -if (!ctx->used) { - err =af_alg_wait_for_data (sk, flags); +if (!ctx->init || (ctx->more && ctx->used < bs)) { + err =af_alg_wait_for_data (sk, flags, bs);if (err)return err; }
include/crypto/if_alg.h +3 -1
@@ -135,6 +135,7 @@ struct af_alg_async_req {* SG? * @enc: Cryptographic operation to be performed when * recvmsg is invoked. +* @init: True if metadata has been sent. * @len: Length of memory allocated for this data structure. */ struct af_alg_ctx {
@@ -151,6 +152,7 @@ struct af_alg_ctx {bool more;bool merge;bool enc; +bool init;unsigned int len; };
@@ -226,7 +228,7 @@ unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset);void af_alg_pull_tsgl (struct sock *sk,size_t used,struct scatterlist *dst,size_t dst_offset);void af_alg_wmem_wakeup (struct sock *sk); -int af_alg_wait_for_data (struct sock *sk,unsigned flags); +int af_alg_wait_for_data (struct sock *sk,unsigned flags,unsigned min);int af_alg_sendmsg (struct socket *sock,struct msghdr *msg,size_t size,unsigned int ivsize); ssize_t af_alg_sendpage(struct socket *sock, struct page *page,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 78/152 mfd: arizona: Ensure 32k clock is put on driver unbind and error
In reply to Greg Kroah-HartmanFrom: Charles Keepax <[email protected]>
[ Upstream commit ddff6c45b21d0437ce0c85f8ac35d7b5480513d7 ]
Whilst it doesn't matter if the internal 32k clock register settings are cleaned up on exit, as the part will be turned off losing any settings, hence the driver hasn't historially bothered. The external clock should however be cleaned up, as it could cause clocks to be left on, and will at best generate a warning on unbind.
Add clean up on both the probe error path and unbind for the 32k clock.
--- drivers/mfd/arizona-core.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/mfd/arizona-core.c +18 -0
@@ -1430,6 +1430,15 @@ int arizona_dev_init(struct arizona *arizona)arizona_irq_exit (arizona); err_pm:pm_runtime_disable (arizona->dev); + +switch (arizona->pdata.clk32k_src) { +case ARIZONA_32KZ_MCLK1 : +case ARIZONA_32KZ_MCLK2 : +arizona_clk32k_disable (arizona); +break ; +default : +break ; + } err_reset:arizona_enable_reset (arizona);regulator_disable (arizona->dcvdd);
@@ -1452,6 +1461,15 @@ int arizona_dev_exit(struct arizona *arizona)regulator_disable (arizona->dcvdd);regulator_put (arizona->dcvdd); +switch (arizona->pdata.clk32k_src) { +case ARIZONA_32KZ_MCLK1 : +case ARIZONA_32KZ_MCLK2 : +arizona_clk32k_disable (arizona); +break ; +default : +break ; + } +mfd_remove_devices (arizona->dev);arizona_free_irq (arizona,ARIZONA_IRQ_UNDERCLOCKED , arizona);arizona_free_irq (arizona,ARIZONA_IRQ_OVERCLOCKED , arizona);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 79/152 octeontx2-af: change (struct qmem)->entry_sz from u8 to u16
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 393415203f5c916b5907e0a7c89f4c2c5a9c5505 ]
We need to increase TSO_HEADER_SIZE from 128 to 256.
Since otx2_sq_init() calls qmem_alloc() with TSO_HEADER_SIZE, we need to change (struct qmem)->entry_sz to avoid truncation to 0.
--- drivers/net/ethernet/marvell/octeontx2/af/common.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/common.h +1 -1
@@ -43,7 +43,7 @@ struct qmem {void *base;dma_addr_t iova;int alloc_sz; -u8 entry_sz; +u16 entry_sz;u8 align;u32 qsize; };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 80/152 mtd: rawnand: fsl_upm: Remove unused mtd var
In reply to Greg Kroah-HartmanFrom: Boris Brezillon <[email protected]>
[ Upstream commit ccc49eff77bee2885447a032948959a134029fe3 ]
The mtd var in fun_wait_rnb() is now unused, let's get rid of it and fix the warning resulting from this unused var.
--- drivers/mtd/nand/raw/fsl_upm.c | 1 - 1 file changed, 1 deletion(-)
drivers/mtd/nand/raw/fsl_upm.c +0 -1
@@ -62,7 +62,6 @@ static int fun_chip_ready(struct nand_chip *chip)static void fun_wait_rnb (struct fsl_upm_nand *fun) {if (fun->rnb_gpio[fun->mchip_number] >=0 ) { -struct mtd_info *mtd =nand_to_mtd (&fun->chip);int cnt =1000000 ;while (--cnt && !fun_chip_ready (&fun->chip))
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 81/152 platform/chrome: cros_ec_ishtp: Fix a double-unlock issue
In reply to Greg Kroah-HartmanFrom: Qiushi Wu <[email protected]>
[ Upstream commit aaa3cbbac326c95308e315f1ab964a3369c4d07d ]
In function cros_ec_ishtp_probe(), "up_write" is already called before function "cros_ec_dev_init". But "up_write" will be called again after the calling of the function "cros_ec_dev_init" failed. Thus add a call of the function “down_write” in this if branch for the completion of the exception handling.
--- drivers/platform/chrome/cros_ec_ishtp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/platform/chrome/cros_ec_ishtp.c +3 -1
@@ -645,8 +645,10 @@ static int cros_ec_ishtp_probe(struct ishtp_cl_device *cl_device)/* Register croc_ec_dev mfd */ rv =cros_ec_dev_init (client_data); -if (rv) +if (rv) { +down_write (&init_lock); goto end_cros_ec_dev_init_error; + }return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 82/152 RDMA/ipoib: Return void from ipoib_ib_dev_stop()
In reply to Greg Kroah-HartmanFrom: Kamal Heib <[email protected]>
[ Upstream commit 95a5631f6c9f3045f26245e6045244652204dfdb ]
The return value from ipoib_ib_dev_stop() is always 0 - change it to be void.
--- drivers/infiniband/ulp/ipoib/ipoib.h | 2 +- drivers/infiniband/ulp/ipoib/ipoib_ib.c | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-)
drivers/infiniband/ulp/ipoib/ipoib.h +1 -1
@@ -515,7 +515,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev);int ipoib_ib_dev_open_default (struct net_device *dev);int ipoib_ib_dev_open (struct net_device *dev); -int ipoib_ib_dev_stop (struct net_device *dev); +void ipoib_ib_dev_stop (struct net_device *dev);void ipoib_ib_dev_up (struct net_device *dev);void ipoib_ib_dev_down (struct net_device *dev);int ipoib_ib_dev_stop_default (struct net_device *dev);
drivers/infiniband/ulp/ipoib/ipoib_ib.c +1 -3
@@ -846,7 +846,7 @@ int ipoib_ib_dev_stop_default(struct net_device *dev)return 0 ; } -int ipoib_ib_dev_stop (struct net_device *dev) +void ipoib_ib_dev_stop (struct net_device *dev) {struct ipoib_dev_priv *priv =ipoib_priv (dev);
@@ -854,8 +854,6 @@ int ipoib_ib_dev_stop(struct net_device *dev)clear_bit (IPOIB_FLAG_INITIALIZED , &priv->flags);ipoib_flush_ah (dev); - -return 0 ; }int ipoib_ib_dev_open_default (struct net_device *dev)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 83/152 RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah()
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
[ Upstream commit 65936bf25f90fe440bb2d11624c7d10fab266639 ]
ipoib_mcast_carrier_on_task() insanely open codes a rtnl_lock() such that the only time flush_workqueue() can be called is if it also clears IPOIB_FLAG_OPER_UP.
Thus the flush inside ipoib_flush_ah() will deadlock if it gets unlucky enough, and lockdep doesn't help us to find it early:
CPU0 CPU1 CPU2
__ipoib_ib_dev_flush()
down_read(vlan_rwsem)
ipoib_vlan_add()
rtnl_trylock()
down_write(vlan_rwsem)
ipoib_mcast_carrier_on_task()
while (!rtnl_trylock())
msleep(20);
ipoib_flush_ah()
flush_workqueue(priv->wq)Clean up the ah_reaper related functions and lifecycle to make sense:
- Start/Stop of the reaper should only be done in open/stop NDOs, not in any other places
- cancel and flush of the reaper should only happen in the stop NDO. cancel is only functional when combined with IPOIB_STOP_REAPER.
- Non-stop places were flushing the AH's just need to flush out dead AH's synchronously and ignore the background task completely. It is fully locked and harmless to leave running.
Which ultimately fixes the ABBA deadlock by removing the unnecessary flush_workqueue() from the problematic place under the vlan_rwsem.
--- drivers/infiniband/ulp/ipoib/ipoib_ib.c | 65 ++++++++++------------- drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 + 2 files changed, 31 insertions(+), 36 deletions(-)
drivers/infiniband/ulp/ipoib/ipoib_ib.c +29 -36
@@ -670,13 +670,12 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb,return rc; } -static void __ipoib_reap_ah (struct net_device *dev) +static void ipoib_reap_dead_ahs (struct ipoib_dev_priv *priv) { -struct ipoib_dev_priv *priv =ipoib_priv (dev);struct ipoib_ah *ah, *tah;unsigned long flags; -netif_tx_lock_bh (dev); +netif_tx_lock_bh (priv->dev);spin_lock_irqsave (&priv->lock, flags);list_for_each_entry_safe (ah, tah, &priv->dead_ahs, list)
@@ -687,37 +686,37 @@ static void __ipoib_reap_ah(struct net_device *dev) }spin_unlock_irqrestore (&priv->lock, flags); -netif_tx_unlock_bh (dev); +netif_tx_unlock_bh (priv->dev); }void ipoib_reap_ah (struct work_struct *work) {struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv, ah_reap_task.work); -struct net_device *dev = priv->dev; -__ipoib_reap_ah (dev); +ipoib_reap_dead_ahs (priv);if (!test_bit (IPOIB_STOP_REAPER , &priv->flags))queue_delayed_work (priv->wq, &priv->ah_reap_task,round_jiffies_relative (HZ )); } -static void ipoib_flush_ah (struct net_device *dev) +static void ipoib_start_ah_reaper (struct ipoib_dev_priv *priv) { -struct ipoib_dev_priv *priv =ipoib_priv (dev); - -cancel_delayed_work (&priv->ah_reap_task); -flush_workqueue (priv->wq); -ipoib_reap_ah (&priv->ah_reap_task.work); +clear_bit (IPOIB_STOP_REAPER , &priv->flags); +queue_delayed_work (priv->wq, &priv->ah_reap_task, +round_jiffies_relative (HZ )); } -static void ipoib_stop_ah (struct net_device *dev) +static void ipoib_stop_ah_reaper (struct ipoib_dev_priv *priv) { -struct ipoib_dev_priv *priv =ipoib_priv (dev); -set_bit (IPOIB_STOP_REAPER , &priv->flags); -ipoib_flush_ah (dev); +cancel_delayed_work (&priv->ah_reap_task); +/* +* After ipoib_stop_ah_reaper() we always go through +* ipoib_reap_dead_ahs() which ensures the work is really stopped and +* does a final flush out of the dead_ah's list +*/ }static int recvs_pending (struct net_device *dev)
@@ -846,16 +845,6 @@ int ipoib_ib_dev_stop_default(struct net_device *dev)return 0 ; } -void ipoib_ib_dev_stop (struct net_device *dev) -{ -struct ipoib_dev_priv *priv =ipoib_priv (dev); - - priv->rn_ops->ndo_stop (dev); - -clear_bit (IPOIB_FLAG_INITIALIZED , &priv->flags); -ipoib_flush_ah (dev); -} -int ipoib_ib_dev_open_default (struct net_device *dev) {struct ipoib_dev_priv *priv =ipoib_priv (dev);
@@ -899,10 +888,7 @@ int ipoib_ib_dev_open(struct net_device *dev)return -1 ; } -clear_bit (IPOIB_STOP_REAPER , &priv->flags); -queue_delayed_work (priv->wq, &priv->ah_reap_task, -round_jiffies_relative (HZ )); - +ipoib_start_ah_reaper (priv);if (priv->rn_ops->ndo_open (dev)) {pr_warn ("%s: Failed to open dev\n" , dev->name); goto dev_stop;
@@ -913,13 +899,20 @@ int ipoib_ib_dev_open(struct net_device *dev)return 0 ; dev_stop: -set_bit (IPOIB_STOP_REAPER , &priv->flags); -cancel_delayed_work (&priv->ah_reap_task); -set_bit (IPOIB_FLAG_INITIALIZED , &priv->flags); -ipoib_ib_dev_stop (dev); +ipoib_stop_ah_reaper (priv);return -1 ; } +void ipoib_ib_dev_stop (struct net_device *dev) +{ +struct ipoib_dev_priv *priv =ipoib_priv (dev); + + priv->rn_ops->ndo_stop (dev); + +clear_bit (IPOIB_FLAG_INITIALIZED , &priv->flags); +ipoib_stop_ah_reaper (priv); +} +void ipoib_pkey_dev_check_presence (struct net_device *dev) {struct ipoib_dev_priv *priv =ipoib_priv (dev);
@@ -1230,7 +1223,7 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,ipoib_mcast_dev_flush (dev);if (oper_up)set_bit (IPOIB_FLAG_OPER_UP , &priv->flags); -ipoib_flush_ah (dev); +ipoib_reap_dead_ahs (priv); }if (level >=IPOIB_FLUSH_NORMAL )
@@ -1305,7 +1298,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev)* the neighbor garbage collection is stopped and reaped. * That should all be done now, so make a final ah flush. */ -ipoib_stop_ah (dev); +ipoib_reap_dead_ahs (priv);clear_bit (IPOIB_PKEY_ASSIGNED , &priv->flags);
drivers/infiniband/ulp/ipoib/ipoib_main.c +2 -0
@@ -1979,6 +1979,8 @@ static void ipoib_ndo_uninit(struct net_device *dev)/* no more works over the priv->wq */ if (priv->wq) { +/* See ipoib_mcast_carrier_on_task() */ +WARN_ON (test_bit (IPOIB_FLAG_OPER_UP , &priv->flags));flush_workqueue (priv->wq);destroy_workqueue (priv->wq); priv->wq =NULL ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 84/152 media: rockchip: rga: Introduce color fmt macros and refactor CSC mode logic
In reply to Greg Kroah-HartmanFrom: Paul Kocialkowski <[email protected]>
[ Upstream commit ded874ece29d3fe2abd3775810a06056067eb68c ]
This introduces two macros: RGA_COLOR_FMT_IS_YUV and RGA_COLOR_FMT_IS_RGB which allow quick checking of the colorspace familily of a RGA color format.
These macros are then used to refactor the logic for CSC mode selection. The two nested tests for input colorspace are simplified into a single one, with a logical and, making the whole more readable.
--- drivers/media/platform/rockchip/rga/rga-hw.c | 23 +++++++++----------- drivers/media/platform/rockchip/rga/rga-hw.h | 5 +++++ 2 files changed, 15 insertions(+), 13 deletions(-)
drivers/media/platform/rockchip/rga/rga-hw.c +10 -13
@@ -200,22 +200,19 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx) dst_info.data.format = ctx->out.fmt->hw_format; dst_info.data.swap = ctx->out.fmt->color_swap; -if (ctx->in.fmt->hw_format >=RGA_COLOR_FMT_YUV422SP ) { -if (ctx->out.fmt->hw_format <RGA_COLOR_FMT_YUV422SP ) { -switch (ctx->in.colorspace) { -case V4L2_COLORSPACE_REC709 : - src_info.data.csc_mode = -RGA_SRC_CSC_MODE_BT709_R0 ; -break ; -default : - src_info.data.csc_mode = -RGA_SRC_CSC_MODE_BT601_R0 ; -break ; - } +if (RGA_COLOR_FMT_IS_YUV (ctx->in.fmt->hw_format) && +RGA_COLOR_FMT_IS_RGB (ctx->out.fmt->hw_format)) { +switch (ctx->in.colorspace) { +case V4L2_COLORSPACE_REC709 : + src_info.data.csc_mode =RGA_SRC_CSC_MODE_BT709_R0 ; +break ; +default : + src_info.data.csc_mode =RGA_SRC_CSC_MODE_BT601_R0 ; +break ; } } -if (ctx->out.fmt->hw_format >=RGA_COLOR_FMT_YUV422SP ) { +if (RGA_COLOR_FMT_IS_YUV (ctx->out.fmt->hw_format)) {switch (ctx->out.colorspace) {case V4L2_COLORSPACE_REC709 : dst_info.data.csc_mode =RGA_SRC_CSC_MODE_BT709_R0 ;
drivers/media/platform/rockchip/rga/rga-hw.h +5 -0
@@ -95,6 +95,11 @@#define RGA_COLOR_FMT_CP_8BPP 15#define RGA_COLOR_FMT_MASK 15 +#define RGA_COLOR_FMT_IS_YUV (fmt) \ + (((fmt) >= RGA_COLOR_FMT_YUV422SP) && ((fmt) < RGA_COLOR_FMT_CP_1BPP)) +#define RGA_COLOR_FMT_IS_RGB (fmt) \ + ((fmt) < RGA_COLOR_FMT_YUV422SP) +#define RGA_COLOR_NONE_SWAP 0#define RGA_COLOR_RB_SWAP 1#define RGA_COLOR_ALPHA_SWAP 2
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 85/152 media: rockchip: rga: Only set output CSC mode for RGB input
In reply to Greg Kroah-HartmanFrom: Paul Kocialkowski <[email protected]>
[ Upstream commit 0f879bab72f47e8ba2421a984e7acfa763d3e84e ]
Setting the output CSC mode is required for a YUV output, but must not be set when the input is also YUV. Doing this (as tested with a YUV420P to YUV420P conversion) results in wrong colors.
Adapt the logic to only set the output CSC mode when the output is YUV and the input is RGB. Also add a comment to clarify the rationale.
--- drivers/media/platform/rockchip/rga/rga-hw.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/media/platform/rockchip/rga/rga-hw.c +7 -1
@@ -200,6 +200,11 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx) dst_info.data.format = ctx->out.fmt->hw_format; dst_info.data.swap = ctx->out.fmt->color_swap; +/* +* CSC mode must only be set when the colorspace families differ between +* input and output. It must remain unset (zeroed) if both are the same. +*/ +if (RGA_COLOR_FMT_IS_YUV (ctx->in.fmt->hw_format) &&RGA_COLOR_FMT_IS_RGB (ctx->out.fmt->hw_format)) {switch (ctx->in.colorspace) {
@@ -212,7 +217,8 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx) } } -if (RGA_COLOR_FMT_IS_YUV (ctx->out.fmt->hw_format)) { +if (RGA_COLOR_FMT_IS_RGB (ctx->in.fmt->hw_format) && +RGA_COLOR_FMT_IS_YUV (ctx->out.fmt->hw_format)) {switch (ctx->out.colorspace) {case V4L2_COLORSPACE_REC709 : dst_info.data.csc_mode =RGA_SRC_CSC_MODE_BT709_R0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 86/152 IB/uverbs: Set IOVA on IB MR in uverbs layer
In reply to Greg Kroah-HartmanFrom: Yishai Hadas <[email protected]>
[ Upstream commit 04c0a5fcfcf65aade2fb238b6336445f1a99b646 ]
Set IOVA on IB MR in uverbs layer to let all drivers have it, this includes both reg/rereg MR flows.
As part of this change cleaned-up this setting from the drivers that already did it by themselves in their user flows.
--- drivers/infiniband/core/uverbs_cmd.c | 4 ++++ drivers/infiniband/hw/cxgb4/mem.c | 1 - drivers/infiniband/hw/mlx4/mr.c | 1 - 3 files changed, 4 insertions(+), 2 deletions(-)
drivers/infiniband/core/uverbs_cmd.c +4 -0
@@ -757,6 +757,7 @@ static int ib_uverbs_reg_mr(struct uverbs_attr_bundle *attrs) mr->uobject = uobj;atomic_inc (&pd->usecnt); mr->res.type =RDMA_RESTRACK_MR ; + mr->iova = cmd.hca_va;rdma_restrack_uadd (&mr->res); uobj->object = mr;
@@ -847,6 +848,9 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs)atomic_dec (&old_pd->usecnt); } +if (cmd.flags &IB_MR_REREG_TRANS ) + mr->iova = cmd.hca_va; +memset (&resp,0 ,sizeof (resp)); resp.lkey = mr->lkey; resp.rkey = mr->rkey;
drivers/infiniband/hw/cxgb4/mem.c +0 -1
@@ -399,7 +399,6 @@ static int finish_mem_reg(struct c4iw_mr *mhp, u32 stag) mmid = stag >>8 ; mhp->ibmr.rkey = mhp->ibmr.lkey = stag; mhp->ibmr.length = mhp->attr.len; - mhp->ibmr.iova = mhp->attr.va_fbo; mhp->ibmr.page_size =1U << (mhp->attr.page_size +12 );pr_debug ("mmid 0x%x mhp %p\n" , mmid, mhp);return xa_insert_irq (&mhp->rhp->mrs, mmid, mhp,GFP_KERNEL );
drivers/infiniband/hw/mlx4/mr.c +0 -1
@@ -439,7 +439,6 @@ struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, mr->ibmr.rkey = mr->ibmr.lkey = mr->mmr.key; mr->ibmr.length = length; - mr->ibmr.iova = virt_addr; mr->ibmr.page_size =1U << shift;return &mr->ibmr;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 87/152 selftests/bpf: Test_progs indicate to shell on non-actions
In reply to Greg Kroah-HartmanFrom: Jesper Dangaard Brouer <[email protected]>
[ Upstream commit 6c92bd5cd4650c39dd929565ee172984c680fead ]
When a user selects a non-existing test the summary is printed with indication 0 for all info types, and shell "success" (EXIT_SUCCESS) is indicated. This can be understood by a human end-user, but for shell scripting is it useful to indicate a shell failure (EXIT_FAILURE).
--- tools/testing/selftests/bpf/test_progs.c | 3 +++ 1 file changed, 3 insertions(+)
tools/testing/selftests/bpf/test_progs.c +3 -0
@@ -584,5 +584,8 @@ int main(int argc, char **argv)free (env.test_selector.num_set);free (env.subtest_selector.num_set); +if (env.succ_cnt + env.fail_cnt + env.skip_cnt ==0 ) +return EXIT_FAILURE ; +return env.fail_cnt ?EXIT_FAILURE :EXIT_SUCCESS ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 88/152 selftests/bpf: test_progs use another shell exit on non-actions
In reply to Greg Kroah-HartmanFrom: Jesper Dangaard Brouer <[email protected]>
[ Upstream commit 3220fb667842a9725cbb71656f406eadb03c094b ]
This is a follow up adjustment to commit 6c92bd5cd465 ("selftests/bpf:Test_progs indicate to shell on non-actions"), that returns shell exit indication EXIT_FAILURE (value 1) when user selects a non-existing test.
The problem with using EXIT_FAILURE is that a shell script cannot tell the difference between a non-existing test and the test failing.
This patch uses value 2 as shell exit indication. (Aside note unrecognized option parameters use value 64).
--- tools/testing/selftests/bpf/test_progs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/test_progs.c +3 -1
@@ -7,6 +7,8 @@#include <argp.h> #include <string.h> +#define EXIT_NO_TEST 2 +/* defined in test_progs.h */ struct test_env env;
@@ -585,7 +587,7 @@ int main(int argc, char **argv)free (env.subtest_selector.num_set);if (env.succ_cnt + env.fail_cnt + env.skip_cnt ==0 ) -return EXIT_FAILURE ; +return EXIT_NO_TEST ;return env.fail_cnt ?EXIT_FAILURE :EXIT_SUCCESS ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 89/152 USB: serial: ftdi_sio: make process-packet buffer unsigned
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit ab4cc4ef6724ea588e835fc1e764c4b4407a70b7 ]
Use an unsigned type for the process-packet buffer argument and give it a more apt name.
--- drivers/usb/serial/ftdi_sio.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
drivers/usb/serial/ftdi_sio.c +11 -11
@@ -2480,12 +2480,12 @@ static int ftdi_prepare_write_buffer(struct usb_serial_port *port,#define FTDI_RS_ERR_MASK (FTDI_RS_BI | FTDI_RS_PE | FTDI_RS_FE | FTDI_RS_OE)static int ftdi_process_packet (struct usb_serial_port *port, -struct ftdi_private *priv,char *packet,int len) +struct ftdi_private *priv,unsigned char *buf,int len) { +unsigned char status; +unsigned char *ch;int i; -char status;char flag; -char *ch;if (len <2 ) {dev_dbg (&port->dev,"malformed packet\n" );
@@ -2495,7 +2495,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,/* Compare new line status to the old one, signal if different/ N.B. packet may be processed more than once, but differences are only processed once. */ - status = packet[0 ] &FTDI_STATUS_B0_MASK ; + status = buf[0 ] &FTDI_STATUS_B0_MASK ;if (status != priv->prev_status) {char diff_status = status ^ priv->prev_status;
@@ -2521,7 +2521,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, }/* save if the transmitter is empty or not */ -if (packet[1 ] &FTDI_RS_TEMT ) +if (buf[1 ] &FTDI_RS_TEMT ) priv->transmit_empty =1 ;else priv->transmit_empty =0 ;
@@ -2535,29 +2535,29 @@ static int ftdi_process_packet(struct usb_serial_port *port,* data payload to avoid over-reporting. */ flag =TTY_NORMAL ; -if (packet[1 ] &FTDI_RS_ERR_MASK ) { +if (buf[1 ] &FTDI_RS_ERR_MASK ) {/* Break takes precedence over parity, which takes precedence * over framing errors */ -if (packet[1 ] &FTDI_RS_BI ) { +if (buf[1 ] &FTDI_RS_BI ) { flag =TTY_BREAK ; port->icount.brk++;usb_serial_handle_break (port); - }else if (packet[1 ] &FTDI_RS_PE ) { + }else if (buf[1 ] &FTDI_RS_PE ) { flag =TTY_PARITY ; port->icount.parity++; - }else if (packet[1 ] &FTDI_RS_FE ) { + }else if (buf[1 ] &FTDI_RS_FE ) { flag =TTY_FRAME ; port->icount.frame++; }/* Overrun is special, not associated with a char */ -if (packet[1 ] &FTDI_RS_OE ) { +if (buf[1 ] &FTDI_RS_OE ) { port->icount.overrun++;tty_insert_flip_char (&port->port,0 ,TTY_OVERRUN ); } } port->icount.rx += len; - ch = packet +2 ; + ch = buf +2 ;if (port->port.console && port->sysrq) {for (i =0 ; i < len; i++, ch++) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 90/152 USB: serial: ftdi_sio: clean up receive processing
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit ce054039ba5e47b75a3be02a00274e52b06a6456 ]
Clean up receive processing by dropping the character pointer and keeping the length argument unchanged throughout the function.
Also make it more apparent that sysrq processing can consume a characters by adding an explicit continue.
--- drivers/usb/serial/ftdi_sio.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/usb/serial/ftdi_sio.c +9 -10
@@ -2483,7 +2483,6 @@ static int ftdi_process_packet(struct usb_serial_port *port, struct ftdi_private *priv, unsigned char *buf, int len) { unsigned char status; -unsigned char *ch;int i;char flag;
@@ -2526,8 +2525,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,else priv->transmit_empty =0 ; - len -=2 ; -if (!len) +if (len ==2 )return 0 ;/* status only */ /*
@@ -2556,19 +2554,20 @@ static int ftdi_process_packet(struct usb_serial_port *port, } } - port->icount.rx += len; - ch = buf +2 ; + port->icount.rx += len -2 ;if (port->port.console && port->sysrq) { -for (i =0 ; i < len; i++, ch++) { -if (!usb_serial_handle_sysrq_char (port, *ch)) -tty_insert_flip_char (&port->port, *ch, flag); +for (i =2 ; i < len; i++) { +if (usb_serial_handle_sysrq_char (port, buf[i])) +continue ; +tty_insert_flip_char (&port->port, buf[i], flag); } }else { -tty_insert_flip_string_fixed_flag (&port->port, ch, flag, len); +tty_insert_flip_string_fixed_flag (&port->port, buf +2 , flag, + len -2 ); } -return len; +return len -2 ; }static void ftdi_process_read_urb (struct urb *urb)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 91/152 USB: serial: ftdi_sio: fix break and sysrq handling
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit 733fff67941dad64b8a630450b8372b1873edc41 ]
Only the last NUL in a packet should be flagged as a break character, for example, to avoid dropping unrelated characters when IGNBRK is set.
Also make sysrq work by consuming the break character instead of having it immediately cancel the sysrq request, and by not processing it prematurely to avoid triggering a sysrq based on an unrelated character received in the same packet (which was received *before* the break).
Note that the break flag can be left set also for a packet received immediately following a break and that and an ending NUL in such a packet will continue to be reported as a break as there's no good way to tell it apart from an actual break.
Tested on FT232R and FT232H.
--- drivers/usb/serial/ftdi_sio.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-)
drivers/usb/serial/ftdi_sio.c +17 -7
@@ -2483,6 +2483,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, struct ftdi_private *priv, unsigned char *buf, int len) { unsigned char status; +bool brkint = false;int i;char flag;
@@ -2534,13 +2535,17 @@ static int ftdi_process_packet(struct usb_serial_port *port,*/ flag =TTY_NORMAL ;if (buf[1 ] &FTDI_RS_ERR_MASK ) { -/* Break takes precedence over parity, which takes precedence -* over framing errors */ -if (buf[1 ] &FTDI_RS_BI ) { - flag =TTY_BREAK ; +/* +* Break takes precedence over parity, which takes precedence +* over framing errors. Note that break is only associated +* with the last character in the buffer and only when it's a +* NUL. +*/ +if (buf[1 ] &FTDI_RS_BI && buf[len -1 ] =='\0' ) { port->icount.brk++; -usb_serial_handle_break (port); - }else if (buf[1 ] &FTDI_RS_PE ) { + brkint = true; + } +if (buf[1 ] &FTDI_RS_PE ) { flag =TTY_PARITY ; port->icount.parity++; }else if (buf[1 ] &FTDI_RS_FE ) {
@@ -2556,8 +2561,13 @@ static int ftdi_process_packet(struct usb_serial_port *port, port->icount.rx += len -2 ; -if (port->port.console && port->sysrq) { +if (brkint || (port->port.console && port->sysrq)) {for (i =2 ; i < len; i++) { +if (brkint && i == len -1 ) { +if (usb_serial_handle_break (port)) +return len -3 ; + flag =TTY_BREAK ; + }if (usb_serial_handle_sysrq_char (port, buf[i]))continue ;tty_insert_flip_char (&port->port, buf[i], flag);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 92/152 crypto: af_alg - Fix regression on empty requests
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 662bb52f50bca16a74fe92b487a14d7dccb85e1a ]
Some user-space programs rely on crypto requests that have no control metadata. This broke when a check was added to require the presence of control metadata with the ctx->init flag.
This patch fixes the regression by setting ctx->init as long as one sendmsg(2) has been made, with or without a control message.
--- crypto/af_alg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/af_alg.c +1 -1
@@ -851,6 +851,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, err = -EINVAL ; goto unlock; } + ctx->init = true;if (init) { ctx->enc = enc;
@@ -858,7 +859,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,memcpy (ctx->iv, con.iv->iv, ivsize); ctx->aead_assoclen = con.aead_assoclen; - ctx->init = true; }while (size) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 93/152 devres: keep both device name and resource name in pretty name
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 35bd8c07db2ce8fd2834ef866240613a4ef982e7 ]
Sometimes debugging a device is easiest using devmem on its register map, and that can be seen with /proc/iomem. But some device drivers have many memory regions. Take for example a networking switch. Its memory map used to look like this in /proc/iomem:
1fc000000-1fc3fffff : pcie@1f0000000
1fc000000-1fc3fffff : 0000:00:00.5
1fc010000-1fc01ffff : sys
1fc030000-1fc03ffff : rew
1fc060000-1fc0603ff : s2
1fc070000-1fc0701ff : devcpu_gcb
1fc080000-1fc0800ff : qs
1fc090000-1fc0900cb : ptp
1fc100000-1fc10ffff : port0
1fc110000-1fc11ffff : port1
1fc120000-1fc12ffff : port2
1fc130000-1fc13ffff : port3
1fc140000-1fc14ffff : port4
1fc150000-1fc15ffff : port5
1fc200000-1fc21ffff : qsys
1fc280000-1fc28ffff : anaBut after the patch in Fixes: was applied, the information is now presented in a much more opaque way:
1fc000000-1fc3fffff : pcie@1f0000000
1fc000000-1fc3fffff : 0000:00:00.5
1fc010000-1fc01ffff : 0000:00:00.5
1fc030000-1fc03ffff : 0000:00:00.5
1fc060000-1fc0603ff : 0000:00:00.5
1fc070000-1fc0701ff : 0000:00:00.5
1fc080000-1fc0800ff : 0000:00:00.5
1fc090000-1fc0900cb : 0000:00:00.5
1fc100000-1fc10ffff : 0000:00:00.5
1fc110000-1fc11ffff : 0000:00:00.5
1fc120000-1fc12ffff : 0000:00:00.5
1fc130000-1fc13ffff : 0000:00:00.5
1fc140000-1fc14ffff : 0000:00:00.5
1fc150000-1fc15ffff : 0000:00:00.5
1fc200000-1fc21ffff : 0000:00:00.5
1fc280000-1fc28ffff : 0000:00:00.5That patch made a fair comment that /proc/iomem might be confusing when it shows resources without an associated device, but we can do better than just hide the resource name altogether. Namely, we can print the device name _and_ the resource name. Like this:
1fc000000-1fc3fffff : pcie@1f0000000
1fc000000-1fc3fffff : 0000:00:00.5
1fc010000-1fc01ffff : 0000:00:00.5 sys
1fc030000-1fc03ffff : 0000:00:00.5 rew
1fc060000-1fc0603ff : 0000:00:00.5 s2
1fc070000-1fc0701ff : 0000:00:00.5 devcpu_gcb
1fc080000-1fc0800ff : 0000:00:00.5 qs
1fc090000-1fc0900cb : 0000:00:00.5 ptp
1fc100000-1fc10ffff : 0000:00:00.5 port0
1fc110000-1fc11ffff : 0000:00:00.5 port1
1fc120000-1fc12ffff : 0000:00:00.5 port2
1fc130000-1fc13ffff : 0000:00:00.5 port3
1fc140000-1fc14ffff : 0000:00:00.5 port4
1fc150000-1fc15ffff : 0000:00:00.5 port5
1fc200000-1fc21ffff : 0000:00:00.5 qsys
1fc280000-1fc28ffff : 0000:00:00.5 ana--- lib/devres.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
lib/devres.c +10 -1
@@ -155,6 +155,7 @@ void __iomem *devm_ioremap_resource(struct device *dev, {resource_size_t size;void __iomem *dest_ptr; +char *pretty_name;BUG_ON (!dev);
@@ -165,7 +166,15 @@ void __iomem *devm_ioremap_resource(struct device *dev, size =resource_size (res); -if (!devm_request_mem_region (dev, res->start, size,dev_name (dev))) { +if (res->name) + pretty_name =devm_kasprintf (dev,GFP_KERNEL ,"%s %s" , +dev_name (dev), res->name); +else + pretty_name =devm_kstrdup (dev,dev_name (dev),GFP_KERNEL ); +if (!pretty_name) +return IOMEM_ERR_PTR (-ENOMEM ); + +if (!devm_request_mem_region (dev, res->start, size, pretty_name)) {dev_err (dev,"can't request region for resource %pR\n" , res);return IOMEM_ERR_PTR (-EBUSY ); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 94/152 RDMA/counter: Only bind user QPs in auto mode
In reply to Greg Kroah-HartmanFrom: Mark Zhang <[email protected]>
[ Upstream commit c9f557421e505f75da4234a6af8eff46bc08614b ]
In auto mode only bind user QPs to a dynamic counter, since this feature is mainly used for system statistic and diagnostic purpose, while there's no need to counter kernel QPs so far.
--- drivers/infiniband/core/counters.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/counters.c +1 -1
@@ -284,7 +284,7 @@ int rdma_counter_bind_qp_auto(struct ib_qp *qp, u8 port)struct rdma_counter *counter;int ret; -if (!qp->res.valid) +if (!qp->res.valid ||rdma_is_kernel_res (&qp->res))return 0 ;if (!rdma_is_port_valid (dev, port))
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 95/152 RDMA/counter: Allow manually bind QPs with different pids to same counter
In reply to Greg Kroah-HartmanFrom: Mark Zhang <[email protected]>
[ Upstream commit cbeb7d896c0f296451ffa7b67e7706786b8364c8 ]
In manual mode allow bind user QPs with different pids to same counter, since this is allowed in auto mode.
Bind kernel QPs and user QPs to the same counter are not allowed.
--- drivers/infiniband/core/counters.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/counters.c +1 -1
@@ -487,7 +487,7 @@ int rdma_counter_bind_qpn(struct ib_device *dev, u8 port, goto err; } -if (counter->res.task != qp->res.task) { +if (rdma_is_kernel_res (&counter->res) !=rdma_is_kernel_res (&qp->res)) { ret = -EINVAL ; goto err_task; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 96/152 mmc: renesas_sdhi_internal_dmac: clean up the code for dma complete
In reply to Greg Kroah-HartmanFrom: Yoshihiro Shimoda <[email protected]>
[ Upstream commit 2b26e34e9af3fa24fa1266e9ea2d66a1f7d62dc0 ]
To add end() operation in the future, clean the code of renesas_sdhi_internal_dmac_complete_tasklet_fn(). No behavior change.
--- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/mmc/host/renesas_sdhi_internal_dmac.c +13 -5
@@ -229,15 +229,12 @@ static void renesas_sdhi_internal_dmac_issue_tasklet_fn(unsigned long arg) DTRAN_CTRL_DM_START); } -static void renesas_sdhi_internal_dmac_complete_tasklet_fn (unsigned long arg) +static bool renesas_sdhi_internal_dmac_complete (struct tmio_mmc_host *host) { -struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg;enum dma_data_direction dir; -spin_lock_irq (&host->lock); -if (!host->data) - goto out; +return false;if (host->data->flags &MMC_DATA_READ ) dir =DMA_FROM_DEVICE ;
@@ -250,6 +247,17 @@ static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)if (dir ==DMA_FROM_DEVICE )clear_bit (SDHI_INTERNAL_DMAC_RX_IN_USE , &global_flags); +return true; +} + +static void renesas_sdhi_internal_dmac_complete_tasklet_fn (unsigned long arg) +{ +struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg; + +spin_lock_irq (&host->lock); +if (!renesas_sdhi_internal_dmac_complete (host)) + goto out; +tmio_mmc_do_data_irq (host); out:spin_unlock_irq (&host->lock);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 97/152 crypto: caam - Remove broken arc4 support
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit eeedb618378f8a09779546a3eeac16b000447d62 ]
The arc4 algorithm requires storing state in the request context in order to allow more than one encrypt/decrypt operation. As this driver does not seem to do that, it means that using it for more than one operation is broken.
--- drivers/crypto/caam/caamalg.c | 29 ----------------------------- drivers/crypto/caam/compat.h | 1 - 2 files changed, 30 deletions(-)
drivers/crypto/caam/caamalg.c +0 -29
@@ -818,12 +818,6 @@ static int ctr_skcipher_setkey(struct crypto_skcipher *skcipher,return skcipher_setkey (skcipher, key, keylen, ctx1_iv_off); } -static int arc4_skcipher_setkey (struct crypto_skcipher *skcipher, -const u8 *key,unsigned int keylen) -{ -return skcipher_setkey (skcipher, key, keylen,0 ); -} -static int des_skcipher_setkey (struct crypto_skcipher *skcipher,const u8 *key,unsigned int keylen) {
@@ -2058,21 +2052,6 @@ static struct caam_skcipher_alg driver_algs[] = { }, .caam.class1_alg_type = OP_ALG_ALGSEL_3DES | OP_ALG_AAI_ECB, }, - { - .skcipher = { - .base = { - .cra_name = "ecb(arc4)", - .cra_driver_name = "ecb-arc4-caam", - .cra_blocksize = ARC4_BLOCK_SIZE, - }, - .setkey = arc4_skcipher_setkey, - .encrypt = skcipher_encrypt, - .decrypt = skcipher_decrypt, - .min_keysize = ARC4_MIN_KEY_SIZE, - .max_keysize = ARC4_MAX_KEY_SIZE, - }, - .caam.class1_alg_type = OP_ALG_ALGSEL_ARC4 | OP_ALG_AAI_ECB, - }, }; static struct caam_aead_alg driver_aeads[] = {
@@ -3533,7 +3512,6 @@ int caam_algapi_init(struct device *ctrldev)struct caam_drv_private *priv =dev_get_drvdata (ctrldev);int i =0 , err =0 ;u32 aes_vid, aes_inst, des_inst, md_vid, md_inst, ccha_inst, ptha_inst; -u32 arc4_inst;unsigned int md_limit =SHA512_DIGEST_SIZE ;bool registered = false, gcm_support;
@@ -3553,8 +3531,6 @@ int caam_algapi_init(struct device *ctrldev)CHA_ID_LS_DES_SHIFT ; aes_inst = cha_inst &CHA_ID_LS_AES_MASK ; md_inst = (cha_inst &CHA_ID_LS_MD_MASK ) >>CHA_ID_LS_MD_SHIFT ; - arc4_inst = (cha_inst &CHA_ID_LS_ARC4_MASK ) >> -CHA_ID_LS_ARC4_SHIFT ; ccha_inst =0 ; ptha_inst =0 ;
@@ -3575,7 +3551,6 @@ int caam_algapi_init(struct device *ctrldev) md_inst = mdha &CHA_VER_NUM_MASK ; ccha_inst =rd_reg32 (&priv->ctrl->vreg.ccha) &CHA_VER_NUM_MASK ; ptha_inst =rd_reg32 (&priv->ctrl->vreg.ptha) &CHA_VER_NUM_MASK ; - arc4_inst =rd_reg32 (&priv->ctrl->vreg.afha) &CHA_VER_NUM_MASK ; gcm_support = aesa &CHA_VER_MISC_AES_GCM ; }
@@ -3598,10 +3573,6 @@ int caam_algapi_init(struct device *ctrldev)if (!aes_inst && (alg_sel ==OP_ALG_ALGSEL_AES ))continue ; -/* Skip ARC4 algorithms if not supported by device */ -if (!arc4_inst && alg_sel ==OP_ALG_ALGSEL_ARC4 ) -continue ; -/* * Check support for AES modes not available * on LP devices.
drivers/crypto/caam/compat.h +0 -1
@@ -43,7 +43,6 @@#include <crypto/akcipher.h> #include <crypto/scatterwalk.h> #include <crypto/skcipher.h> -#include <crypto/arc4.h> #include <crypto/internal/skcipher.h> #include <crypto/internal/hash.h> #include <crypto/internal/rsa.h>
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 98/152 gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers
In reply to Greg Kroah-HartmanFrom: Steve Longerbeam <[email protected]>
[ Upstream commit 0f6245f42ce9b7e4d20f2cda8d5f12b55a44d7d1 ]
Combine the rotate_irq() and norotate_irq() handlers into a single eof_irq() handler.
--- drivers/gpu/ipu-v3/ipu-image-convert.c | 58 +++++++++----------------- 1 file changed, 20 insertions(+), 38 deletions(-)
drivers/gpu/ipu-v3/ipu-image-convert.c +20 -38
@@ -1709,9 +1709,10 @@ static irqreturn_t do_irq(struct ipu_image_convert_run *run)return IRQ_WAKE_THREAD ; } -static irqreturn_t norotate_irq (int irq,void *data) +static irqreturn_t eof_irq (int irq,void *data) {struct ipu_image_convert_chan *chan = data; +struct ipu_image_convert_priv *priv = chan->priv;struct ipu_image_convert_ctx *ctx;struct ipu_image_convert_run *run;unsigned long flags;
@@ -1728,45 +1729,26 @@ static irqreturn_t norotate_irq(int irq, void *data) ctx = run->ctx; -if (ipu_rot_mode_is_irt (ctx->rot_mode)) { -/* this is a rotation operation, just ignore */ -spin_unlock_irqrestore (&chan->irqlock, flags); -return IRQ_HANDLED ; - } - - ret =do_irq (run); -out: -spin_unlock_irqrestore (&chan->irqlock, flags); -return ret; -} - -static irqreturn_t rotate_irq (int irq,void *data) -{ -struct ipu_image_convert_chan *chan = data; -struct ipu_image_convert_priv *priv = chan->priv; -struct ipu_image_convert_ctx *ctx; -struct ipu_image_convert_run *run; -unsigned long flags; -irqreturn_t ret; - -spin_lock_irqsave (&chan->irqlock, flags); - -/* get current run and its context */ - run = chan->current_run; -if (!run) { +if (irq == chan->out_eof_irq) { +if (ipu_rot_mode_is_irt (ctx->rot_mode)) { +/* this is a rotation op, just ignore */ + ret =IRQ_HANDLED ; + goto out; + } + }else if (irq == chan->rot_out_eof_irq) { +if (!ipu_rot_mode_is_irt (ctx->rot_mode)) { +/* this was NOT a rotation op, shouldn't happen */ +dev_err (priv->ipu->dev, +"Unexpected rotation interrupt\n" ); + ret =IRQ_HANDLED ; + goto out; + } + }else { +dev_err (priv->ipu->dev,"Received unknown irq %d\n" , irq); ret =IRQ_NONE ; goto out; } - ctx = run->ctx; - -if (!ipu_rot_mode_is_irt (ctx->rot_mode)) { -/* this was NOT a rotation operation, shouldn't happen */ -dev_err (priv->ipu->dev,"Unexpected rotation interrupt\n" ); -spin_unlock_irqrestore (&chan->irqlock, flags); -return IRQ_HANDLED ; - } - ret =do_irq (run); out:spin_unlock_irqrestore (&chan->irqlock, flags);
@@ -1859,7 +1841,7 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan) chan->out_chan, IPU_IRQ_EOF); - ret =request_threaded_irq (chan->out_eof_irq, norotate_irq, do_bh, + ret =request_threaded_irq (chan->out_eof_irq, eof_irq, do_bh,0 ,"ipu-ic" , chan);if (ret <0 ) { dev_err(priv->ipu->dev, "could not acquire irq %d\n",
@@ -1872,7 +1854,7 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan) chan->rotation_out_chan, IPU_IRQ_EOF); - ret =request_threaded_irq (chan->rot_out_eof_irq, rotate_irq, do_bh, + ret =request_threaded_irq (chan->rot_out_eof_irq, eof_irq, do_bh,0 ,"ipu-ic" , chan);if (ret <0 ) { dev_err(priv->ipu->dev, "could not acquire irq %d\n",
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 99/152 gpu: ipu-v3: image-convert: Wait for all EOFs before completing a tile
In reply to Greg Kroah-HartmanFrom: Steve Longerbeam <[email protected]>
[ Upstream commit dd81d821d0b3f77d949d0cac5c05c1f05b921d46 ]
Use a bit-mask of EOF irqs to determine when all required idmac channel EOFs have been received for a tile conversion, and only do tile completion processing after all EOFs have been received. Otherwise it was found that a conversion would stall after the completion of a tile and the start of the next tile, because the input/read idmac channel had not completed and entered idle state, thus locking up the channel when attempting to re-start it for the next tile.
--- drivers/gpu/ipu-v3/ipu-image-convert.c | 109 +++++++++++++++++++------ 1 file changed, 82 insertions(+), 27 deletions(-)
drivers/gpu/ipu-v3/ipu-image-convert.c +82 -27
@@ -137,6 +137,17 @@ struct ipu_image_convert_ctx;struct ipu_image_convert_chan ;struct ipu_image_convert_priv ; +enum eof_irq_mask { +EOF_IRQ_IN =BIT (0 ), +EOF_IRQ_ROT_IN =BIT (1 ), +EOF_IRQ_OUT =BIT (2 ), +EOF_IRQ_ROT_OUT =BIT (3 ), +}; + +#define EOF_IRQ_COMPLETE (EOF_IRQ_IN | EOF_IRQ_OUT) +#define EOF_IRQ_ROT_COMPLETE (EOF_IRQ_IN | EOF_IRQ_OUT | \ + EOF_IRQ_ROT_IN | EOF_IRQ_ROT_OUT) +struct ipu_image_convert_ctx {struct ipu_image_convert_chan *chan;
@@ -173,6 +184,9 @@ struct ipu_image_convert_ctx {/* where to place converted tile in dest image */ unsigned int out_tile_map[MAX_TILES ]; +/* mask of completed EOF irqs at every tile conversion */ +enum eof_irq_mask eof_mask; +struct list_head list; };
@@ -189,6 +203,8 @@ struct ipu_image_convert_chan {struct ipuv3_channel *rotation_out_chan;/* the IPU end-of-frame irqs */ +int in_eof_irq; +int rot_in_eof_irq;int out_eof_irq;int rot_out_eof_irq;
@@ -1380,6 +1396,9 @@ static int convert_start(struct ipu_image_convert_run *run, unsigned int tile)dev_dbg (priv->ipu->dev,"%s: task %u: starting ctx %p run %p tile %u -> %u\n" , __func__, chan->ic_task, ctx, run, tile, dst_tile); +/* clear EOF irq mask */ + ctx->eof_mask =0 ; +if (ipu_rot_mode_is_irt (ctx->rot_mode)) {/* swap width/height for resizer */ dest_width = d_image->tile[dst_tile].height;
@@ -1615,7 +1634,7 @@ static bool ic_settings_changed(struct ipu_image_convert_ctx *ctx) }/* hold irqlock when calling */ -static irqreturn_t do_irq (struct ipu_image_convert_run *run) +static irqreturn_t do_tile_complete (struct ipu_image_convert_run *run) {struct ipu_image_convert_ctx *ctx = run->ctx;struct ipu_image_convert_chan *chan = ctx->chan;
@@ -1700,6 +1719,7 @@ static irqreturn_t do_irq(struct ipu_image_convert_run *run) ctx->cur_buf_num ^=1 ; } + ctx->eof_mask =0 ;/* clear EOF irq mask for next tile */ ctx->next_tile++;return IRQ_HANDLED ; done:
@@ -1715,8 +1735,9 @@ static irqreturn_t eof_irq(int irq, void *data)struct ipu_image_convert_priv *priv = chan->priv;struct ipu_image_convert_ctx *ctx;struct ipu_image_convert_run *run; +irqreturn_t ret =IRQ_HANDLED ; +bool tile_complete = false;unsigned long flags; -irqreturn_t ret;spin_lock_irqsave (&chan->irqlock, flags);
@@ -1729,27 +1750,33 @@ static irqreturn_t eof_irq(int irq, void *data) ctx = run->ctx; -if (irq == chan->out_eof_irq) { -if (ipu_rot_mode_is_irt (ctx->rot_mode)) { -/* this is a rotation op, just ignore */ - ret =IRQ_HANDLED ; - goto out; - } - }else if (irq == chan->rot_out_eof_irq) { +if (irq == chan->in_eof_irq) { + ctx->eof_mask |=EOF_IRQ_IN ; + }else if (irq == chan->out_eof_irq) { + ctx->eof_mask |=EOF_IRQ_OUT ; + }else if (irq == chan->rot_in_eof_irq || + irq == chan->rot_out_eof_irq) {if (!ipu_rot_mode_is_irt (ctx->rot_mode)) {/* this was NOT a rotation op, shouldn't happen */ dev_err (priv->ipu->dev,"Unexpected rotation interrupt\n" ); - ret =IRQ_HANDLED ; goto out; } + ctx->eof_mask |= (irq == chan->rot_in_eof_irq) ? +EOF_IRQ_ROT_IN :EOF_IRQ_ROT_OUT ; }else {dev_err (priv->ipu->dev,"Received unknown irq %d\n" , irq); ret =IRQ_NONE ; goto out; } - ret =do_irq (run); +if (ipu_rot_mode_is_irt (ctx->rot_mode)) + tile_complete = (ctx->eof_mask ==EOF_IRQ_ROT_COMPLETE ); +else + tile_complete = (ctx->eof_mask ==EOF_IRQ_COMPLETE ); + +if (tile_complete) + ret =do_tile_complete (run); out:spin_unlock_irqrestore (&chan->irqlock, flags);return ret;
@@ -1783,6 +1810,10 @@ static void force_abort(struct ipu_image_convert_ctx *ctx)static void release_ipu_resources (struct ipu_image_convert_chan *chan) { +if (chan->in_eof_irq >=0 ) +free_irq (chan->in_eof_irq, chan); +if (chan->rot_in_eof_irq >=0 ) +free_irq (chan->rot_in_eof_irq, chan);if (chan->out_eof_irq >=0 )free_irq (chan->out_eof_irq, chan);if (chan->rot_out_eof_irq >=0 )
@@ -1801,7 +1832,27 @@ static void release_ipu_resources(struct ipu_image_convert_chan *chan) chan->in_chan = chan->out_chan = chan->rotation_in_chan = chan->rotation_out_chan =NULL ; - chan->out_eof_irq = chan->rot_out_eof_irq =-1 ; + chan->in_eof_irq =-1 ; + chan->rot_in_eof_irq =-1 ; + chan->out_eof_irq =-1 ; + chan->rot_out_eof_irq =-1 ; +} + +static int get_eof_irq (struct ipu_image_convert_chan *chan, +struct ipuv3_channel *channel) +{ +struct ipu_image_convert_priv *priv = chan->priv; +int ret, irq; + + irq =ipu_idmac_channel_irq (priv->ipu, channel,IPU_IRQ_EOF ); + + ret =request_threaded_irq (irq, eof_irq, do_bh,0 ,"ipu-ic" , chan); +if (ret <0 ) { +dev_err (priv->ipu->dev,"could not acquire irq %d\n" , irq); +return ret; + } + +return irq; }static int get_ipu_resources (struct ipu_image_convert_chan *chan)
@@ -1837,31 +1888,33 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan) }/* acquire the EOF interrupts */ - chan->out_eof_irq =ipu_idmac_channel_irq (priv->ipu, - chan->out_chan, -IPU_IRQ_EOF ); + ret =get_eof_irq (chan, chan->in_chan); +if (ret <0 ) { + chan->in_eof_irq =-1 ; + goto err; + } + chan->in_eof_irq = ret; - ret =request_threaded_irq (chan->out_eof_irq, eof_irq, do_bh, -0 ,"ipu-ic" , chan); + ret =get_eof_irq (chan, chan->rotation_in_chan);if (ret <0 ) { -dev_err (priv->ipu->dev,"could not acquire irq %d\n" , - chan->out_eof_irq); - chan->out_eof_irq =-1 ; + chan->rot_in_eof_irq =-1 ; goto err; } + chan->rot_in_eof_irq = ret; - chan->rot_out_eof_irq =ipu_idmac_channel_irq (priv->ipu, - chan->rotation_out_chan, -IPU_IRQ_EOF ); + ret =get_eof_irq (chan, chan->out_chan); +if (ret <0 ) { + chan->out_eof_irq =-1 ; + goto err; + } + chan->out_eof_irq = ret; - ret =request_threaded_irq (chan->rot_out_eof_irq, eof_irq, do_bh, -0 ,"ipu-ic" , chan); + ret =get_eof_irq (chan, chan->rotation_out_chan);if (ret <0 ) { -dev_err (priv->ipu->dev,"could not acquire irq %d\n" , - chan->rot_out_eof_irq); chan->rot_out_eof_irq =-1 ; goto err; } + chan->rot_out_eof_irq = ret;return 0 ; err:
@@ -2440,6 +2493,8 @@ int ipu_image_convert_init(struct ipu_soc *ipu, struct device *dev) chan->ic_task = i; chan->priv = priv; chan->dma_ch = &image_convert_dma_chan[i]; + chan->in_eof_irq =-1 ; + chan->rot_in_eof_irq =-1 ; chan->out_eof_irq =-1 ; chan->rot_out_eof_irq =-1 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 100/152 dm rq: dont call blk_mq_queue_stopped() in dm_stop_queue()
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit e766668c6cd49d741cfb49eaeb38998ba34d27bc ]
dm_stop_queue() only uses blk_mq_quiesce_queue() so it doesn't formally stop the blk-mq queue; therefore there is no point making the blk_mq_queue_stopped() check -- it will never be stopped.
In addition, even though dm_stop_queue() actually tries to quiesce hw queues via blk_mq_quiesce_queue(), checking with blk_queue_quiesced() to avoid unnecessary queue quiesce isn't reliable because: the QUEUE_FLAG_QUIESCED flag is set before synchronize_rcu() and dm_stop_queue() may be called when synchronize_rcu() from another blk_mq_quiesce_queue() is in-progress.
--- drivers/md/dm-rq.c | 3 --- 1 file changed, 3 deletions(-)
drivers/md/dm-rq.c +0 -3
@@ -70,9 +70,6 @@ void dm_start_queue(struct request_queue *q)void dm_stop_queue (struct request_queue *q) { -if (blk_mq_queue_stopped (q)) -return ; -blk_mq_quiesce_queue (q); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 101/152 clk: actions: Fix h_clk for Actions S500 SoC
In reply to Greg Kroah-HartmanFrom: Cristian Ciocaltea <[email protected]>
[ Upstream commit f47ee279d25fb0e010cae5d6e758e39b40eb6378 ]
The h_clk clock in the Actions Semi S500 SoC clock driver has an invalid parent. Replace with the correct one.
--- drivers/clk/actions/owl-s500.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/actions/owl-s500.c +1 -1
@@ -183,7 +183,7 @@ static OWL_GATE(timer_clk, "timer_clk", "hosc", CMU_DEVCLKEN1, 27, 0, 0); static OWL_GATE(hdmi_clk, "hdmi_clk", "hosc", CMU_DEVCLKEN1, 3, 0, 0);/* divider clocks */ -static OWL_DIVIDER(h_clk, "h_clk", "ahbprevdiv_clk", CMU_BUSCLK1, 12, 2, NULL, 0, 0); +static OWL_DIVIDER(h_clk, "h_clk", "ahbprediv_clk", CMU_BUSCLK1, 12, 2, NULL, 0, 0); static OWL_DIVIDER(rmii_ref_clk, "rmii_ref_clk", "ethernet_pll_clk", CMU_ETHERNETPLL, 1, 1, rmii_ref_div_table, 0, 0);/* factor clocks */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 102/152 selftests/powerpc: ptrace-pkey: Rename variables to make it easier to follow code
In reply to Greg Kroah-HartmanFrom: Aneesh Kumar K.V <[email protected]>
[ Upstream commit 9a11f12e0a6c374b3ef1ce81e32ce477d28eb1b8 ]
Rename variable to indicate that they are invalid values which we will use to test ptrace update of pkeys.
--- .../selftests/powerpc/ptrace/ptrace-pkey.c | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-)
tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c +13 -13
@@ -44,7 +44,7 @@ struct shared_info {unsigned long amr2;/* AMR value that ptrace should refuse to write to the child. */ -unsigned long amr3; +unsigned long invalid_amr;/* IAMR value the parent expects to read from the child. */ unsigned long expected_iamr;
@@ -57,8 +57,8 @@ struct shared_info {* (even though they're valid ones) because userspace doesn't have * access to those registers. */ -unsigned long new_iamr; -unsigned long new_uamor; +unsigned long invalid_iamr; +unsigned long invalid_uamor; };static int sys_pkey_alloc (unsigned long flags,unsigned long init_access_rights)
@@ -100,7 +100,7 @@ static int child(struct shared_info *info) info->amr1 |=3ul <<pkeyshift (pkey1); info->amr2 |=3ul <<pkeyshift (pkey2); - info->amr3 |= info->amr2 |3ul <<pkeyshift (pkey3); + info->invalid_amr |= info->amr2 |3ul <<pkeyshift (pkey3);if (disable_execute) info->expected_iamr |=1ul <<pkeyshift (pkey1);
@@ -111,8 +111,8 @@ static int child(struct shared_info *info) info->expected_uamor |=3ul <<pkeyshift (pkey1) |3ul <<pkeyshift (pkey2); - info->new_iamr |=1ul <<pkeyshift (pkey1) |1ul <<pkeyshift (pkey2); - info->new_uamor |=3ul <<pkeyshift (pkey1); + info->invalid_iamr |=1ul <<pkeyshift (pkey1) |1ul <<pkeyshift (pkey2); + info->invalid_uamor |=3ul <<pkeyshift (pkey1);/* * We won't use pkey3. We just want a plausible but invalid key to test
@@ -196,9 +196,9 @@ static int parent(struct shared_info *info, pid_t pid)PARENT_SKIP_IF_UNSUPPORTED (ret, &info->child_sync);PARENT_FAIL_IF (ret, &info->child_sync); - info->amr1 = info->amr2 = info->amr3 = regs[0 ]; - info->expected_iamr = info->new_iamr = regs[1 ]; - info->expected_uamor = info->new_uamor = regs[2 ]; + info->amr1 = info->amr2 = info->invalid_amr = regs[0 ]; + info->expected_iamr = info->invalid_iamr = regs[1 ]; + info->expected_uamor = info->invalid_uamor = regs[2 ];/* Wake up child so that it can set itself up. */ ret =prod_child (&info->child_sync);
@@ -234,10 +234,10 @@ static int parent(struct shared_info *info, pid_t pid)return ret;/* Write invalid AMR value in child. */ - ret =ptrace_write_regs (pid,NT_PPC_PKEY , &info->amr3,1 ); + ret =ptrace_write_regs (pid,NT_PPC_PKEY , &info->invalid_amr,1 );PARENT_FAIL_IF (ret, &info->child_sync); -printf ("%-30s AMR: %016lx\n" , ptrace_write_running, info->amr3); +printf ("%-30s AMR: %016lx\n" , ptrace_write_running, info->invalid_amr);/* Wake up child so that it can verify it didn't change. */ ret =prod_child (&info->child_sync);
@@ -249,7 +249,7 @@ static int parent(struct shared_info *info, pid_t pid)/* Try to write to IAMR. */ regs[0 ] = info->amr1; - regs[1 ] = info->new_iamr; + regs[1 ] = info->invalid_iamr; ret =ptrace_write_regs (pid,NT_PPC_PKEY , regs,2 );PARENT_FAIL_IF (!ret, &info->child_sync);
@@ -257,7 +257,7 @@ static int parent(struct shared_info *info, pid_t pid) ptrace_write_running, regs[0], regs[1]);/* Try to write to IAMR and UAMOR. */ - regs[2 ] = info->new_uamor; + regs[2 ] = info->invalid_uamor; ret =ptrace_write_regs (pid,NT_PPC_PKEY , regs,3 );PARENT_FAIL_IF (!ret, &info->child_sync);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 103/152 selftests/powerpc: ptrace-pkey: Update the test to mark an invalid pkey correctly
In reply to Greg Kroah-HartmanFrom: Aneesh Kumar K.V <[email protected]>
[ Upstream commit 0eaa3b5ca7b5a76e3783639c828498343be66a01 ]
--- .../selftests/powerpc/ptrace/ptrace-pkey.c | 30 ++++++++----------- 1 file changed, 12 insertions(+), 18 deletions(-)
tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c +12 -18
@@ -66,11 +66,6 @@ static int sys_pkey_alloc(unsigned long flags, unsigned long init_access_rights)return syscall (__NR_pkey_alloc, flags, init_access_rights); } -static int sys_pkey_free (int pkey) -{ -return syscall (__NR_pkey_free, pkey); -} -static int child (struct shared_info *info) {unsigned long reg;
@@ -100,7 +95,11 @@ static int child(struct shared_info *info) info->amr1 |=3ul <<pkeyshift (pkey1); info->amr2 |=3ul <<pkeyshift (pkey2); - info->invalid_amr |= info->amr2 |3ul <<pkeyshift (pkey3); +/* +* invalid amr value where we try to force write +* things which are deined by a uamor setting. +*/ + info->invalid_amr = info->amr2 | (~0x0UL & ~info->expected_uamor);if (disable_execute) info->expected_iamr |=1ul <<pkeyshift (pkey1);
@@ -111,17 +110,12 @@ static int child(struct shared_info *info) info->expected_uamor |=3ul <<pkeyshift (pkey1) |3ul <<pkeyshift (pkey2); - info->invalid_iamr |=1ul <<pkeyshift (pkey1) |1ul <<pkeyshift (pkey2); - info->invalid_uamor |=3ul <<pkeyshift (pkey1); -/* -* We won't use pkey3. We just want a plausible but invalid key to test -* whether ptrace will let us write to AMR bits we are not supposed to. -* -* This also tests whether the kernel restores the UAMOR permissions -* after a key is freed. +* Create an IAMR value different from expected value. +* Kernel will reject an IAMR and UAMOR change. */ -sys_pkey_free (pkey3); + info->invalid_iamr = info->expected_iamr | (1ul <<pkeyshift (pkey1) |1ul <<pkeyshift (pkey2)); + info->invalid_uamor = info->expected_uamor & ~(0x3ul <<pkeyshift (pkey1));printf ("%-30s AMR: %016lx pkey1: %d pkey2: %d pkey3: %d\n" , user_write, info->amr1, pkey1, pkey2, pkey3);
@@ -196,9 +190,9 @@ static int parent(struct shared_info *info, pid_t pid)PARENT_SKIP_IF_UNSUPPORTED (ret, &info->child_sync);PARENT_FAIL_IF (ret, &info->child_sync); - info->amr1 = info->amr2 = info->invalid_amr = regs[0 ]; - info->expected_iamr = info->invalid_iamr = regs[1 ]; - info->expected_uamor = info->invalid_uamor = regs[2 ]; + info->amr1 = info->amr2 = regs[0 ]; + info->expected_iamr = regs[1 ]; + info->expected_uamor = regs[2 ];/* Wake up child so that it can set itself up. */ ret =prod_child (&info->child_sync);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 104/152 selftests/powerpc: ptrace-pkey: Dont update expected UAMOR value
In reply to Greg Kroah-HartmanFrom: Aneesh Kumar K.V <[email protected]>
[ Upstream commit 3563b9bea0ca7f53e4218b5e268550341a49f333 ]
With commit 4a4a5e5d2aad ("powerpc/pkeys: key allocation/deallocation must not change pkey registers") we are not updating UAMOR on key allocation. So don't update the expected uamor value in the test.
--- tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c +8 -3
@@ -101,15 +101,20 @@ static int child(struct shared_info *info)*/ info->invalid_amr = info->amr2 | (~0x0UL & ~info->expected_uamor); +/* +* if PKEY_DISABLE_EXECUTE succeeded we should update the expected_iamr +*/ if (disable_execute) info->expected_iamr |=1ul <<pkeyshift (pkey1);else info->expected_iamr &= ~(1ul <<pkeyshift (pkey1)); - info->expected_iamr &= ~(1ul <<pkeyshift (pkey2) |1ul <<pkeyshift (pkey3)); +/* +* We allocated pkey2 and pkey 3 above. Clear the IAMR bits. +*/ + info->expected_iamr &= ~(1ul <<pkeyshift (pkey2)); + info->expected_iamr &= ~(1ul <<pkeyshift (pkey3)); - info->expected_uamor |=3ul <<pkeyshift (pkey1) | -3ul <<pkeyshift (pkey2);/* * Create an IAMR value different from expected value. * Kernel will reject an IAMR and UAMOR change.
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 105/152 iommu/omap: Check for failure of a call to omap_iommu_dump_ctx
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit dee9d154f40c58d02f69acdaa5cfd1eae6ebc28b ]
It is possible for the call to omap_iommu_dump_ctx to return a negative error number, so check for the failure and return the error number rather than pass the negative value to simple_read_from_buffer.
Addresses-Coverity: ("Improper use of negative value")
--- drivers/iommu/omap-iommu-debug.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/iommu/omap-iommu-debug.c +3 -0
@@ -98,8 +98,11 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf,mutex_lock (&iommu_debug_lock); bytes =omap_iommu_dump_ctx (obj, p, count); +if (bytes <0 ) + goto err; bytes =simple_read_from_buffer (userbuf, count, ppos, buf, bytes); +err:mutex_unlock (&iommu_debug_lock);kfree (buf);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 106/152 clk: qcom: gcc: fix sm8150 GPU and NPU clocks
In reply to Greg Kroah-HartmanFrom: Jonathan Marek <[email protected]>
[ Upstream commit 667f39b59b494d96ae70f4217637db2ebbee3df0 ]
Fix the parents and set BRANCH_HALT_SKIP. From the downstream driver it should be a 500us delay and not skip, however this matches what was done for other clocks that had 500us delay in downstream.
--- drivers/clk/qcom/gcc-sm8150.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/clk/qcom/gcc-sm8150.c +6 -2
@@ -1616,6 +1616,7 @@ static struct clk_branch gcc_gpu_cfg_ahb_clk = { };static struct clk_branch gcc_gpu_gpll0_clk_src = { + .halt_check =BRANCH_HALT_SKIP , .clkr = { .enable_reg =0x52004 , .enable_mask =BIT (15 ),
@@ -1631,13 +1632,14 @@ static struct clk_branch gcc_gpu_gpll0_clk_src = { };static struct clk_branch gcc_gpu_gpll0_div_clk_src = { + .halt_check =BRANCH_HALT_SKIP , .clkr = { .enable_reg =0x52004 , .enable_mask =BIT (16 ), .hw.init = &(struct clk_init_data ){ .name ="gcc_gpu_gpll0_div_clk_src" , .parent_hws = (const struct clk_hw *[]){ - &gcc_gpu_gpll0_clk_src.clkr.hw }, + &gpll0_out_even.clkr.hw }, .num_parents =1 , .flags =CLK_SET_RATE_PARENT , .ops = &clk_branch2_ops,
@@ -1728,6 +1730,7 @@ static struct clk_branch gcc_npu_cfg_ahb_clk = { };static struct clk_branch gcc_npu_gpll0_clk_src = { + .halt_check =BRANCH_HALT_SKIP , .clkr = { .enable_reg =0x52004 , .enable_mask =BIT (18 ),
@@ -1743,13 +1746,14 @@ static struct clk_branch gcc_npu_gpll0_clk_src = { };static struct clk_branch gcc_npu_gpll0_div_clk_src = { + .halt_check =BRANCH_HALT_SKIP , .clkr = { .enable_reg =0x52004 , .enable_mask =BIT (19 ), .hw.init = &(struct clk_init_data ){ .name ="gcc_npu_gpll0_div_clk_src" , .parent_hws = (const struct clk_hw *[]){ - &gcc_npu_gpll0_clk_src.clkr.hw }, + &gpll0_out_even.clkr.hw }, .num_parents =1 , .flags =CLK_SET_RATE_PARENT , .ops = &clk_branch2_ops,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 107/152 clk: qcom: clk-alpha-pll: remove unused/incorrect PLL_CAL_VAL
In reply to Greg Kroah-HartmanFrom: Jonathan Marek <[email protected]>
[ Upstream commit c8b9002f44e4a1d2771b2f59f6de900864b1f9d7 ]
0x44 isn't a register offset, it is the value that goes into CAL_L_VAL.
--- drivers/clk/qcom/clk-alpha-pll.c | 2 -- 1 file changed, 2 deletions(-)
drivers/clk/qcom/clk-alpha-pll.c +0 -2
@@ -55,7 +55,6 @@#define PLL_STATUS (p) ((p)->offset + (p)->regs[PLL_OFF_STATUS])#define PLL_OPMODE (p) ((p)->offset + (p)->regs[PLL_OFF_OPMODE])#define PLL_FRAC (p) ((p)->offset + (p)->regs[PLL_OFF_FRAC]) -#define PLL_CAL_VAL (p) ((p)->offset + (p)->regs[PLL_OFF_CAL_VAL])const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS ] = { [CLK_ALPHA_PLL_TYPE_DEFAULT ] = {
@@ -114,7 +113,6 @@ const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = { [PLL_OFF_STATUS] = 0x30, [PLL_OFF_OPMODE] = 0x38, [PLL_OFF_ALPHA_VAL] = 0x40, - [PLL_OFF_CAL_VAL] = 0x44, }, };EXPORT_SYMBOL_GPL (clk_alpha_pll_regs);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 108/152 iommu/vt-d: Enforce PASID devTLB field mask
In reply to Greg Kroah-HartmanFrom: Liu Yi L <[email protected]>
[ Upstream commit 5f77d6ca5ca74e4b4a5e2e010f7ff50c45dea326 ]
Set proper masks to avoid invalid input spillover to reserved bits.
--- include/linux/intel-iommu.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/intel-iommu.h +2 -2
@@ -359,8 +359,8 @@ enum {#define QI_DEV_EIOTLB_ADDR (a) ((u64)(a) & VTD_PAGE_MASK)#define QI_DEV_EIOTLB_SIZE (((u64)1) << 11) -#define QI_DEV_EIOTLB_GLOB (g) ((u64)g) -#define QI_DEV_EIOTLB_PASID (p) (((u64)p) << 32) +#define QI_DEV_EIOTLB_GLOB (g) ((u64)(g) & 0x1) +#define QI_DEV_EIOTLB_PASID (p) ((u64)((p) & 0xfffff) << 32)#define QI_DEV_EIOTLB_SID (sid) ((u64)((sid) & 0xffff) << 16)#define QI_DEV_EIOTLB_QDEP (qd) ((u64)((qd) & 0x1f) << 4)#define QI_DEV_EIOTLB_PFSID (pfsid) (((u64)(pfsid & 0xf) << 12) | \
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 109/152 i2c: rcar: slave: only send STOP event when we have been addressed
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit 314139f9f0abdba61ed9a8463bbcb0bf900ac5a2 ]
When the SSR interrupt is activated, it will detect every STOP condition on the bus, not only the ones after we have been addressed. So, enable this interrupt only after we have been addressed, and disable it otherwise.
--- drivers/i2c/busses/i2c-rcar.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/i2c/busses/i2c-rcar.c +4 -3
@@ -580,13 +580,14 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)rcar_i2c_write (priv,ICSIER ,SDR |SSR |SAR ); } -rcar_i2c_write (priv,ICSSR , ~SAR &0xff ); +/* Clear SSR, too, because of old STOPs to other clients than us */ +rcar_i2c_write (priv,ICSSR , ~(SAR |SSR ) &0xff ); }/* master sent stop */ if (ssr_filtered &SSR ) {i2c_slave_event (priv->slave,I2C_SLAVE_STOP , &value); -rcar_i2c_write (priv,ICSIER ,SAR |SSR ); +rcar_i2c_write (priv,ICSIER ,SAR );rcar_i2c_write (priv,ICSSR , ~SSR &0xff ); }
@@ -850,7 +851,7 @@ static int rcar_reg_slave(struct i2c_client *slave) priv->slave = slave;rcar_i2c_write (priv,ICSAR , slave->addr);rcar_i2c_write (priv,ICSSR ,0 ); -rcar_i2c_write (priv,ICSIER ,SAR |SSR ); +rcar_i2c_write (priv,ICSIER ,SAR );rcar_i2c_write (priv,ICSCR ,SIE |SDBS );return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 110/152 clk: qcom: gcc-sdm660: Fix up gcc_mss_mnoc_bimc_axi_clk
In reply to Greg Kroah-HartmanFrom: Konrad Dybcio <[email protected]>
[ Upstream commit 3386af51d3bcebcba3f7becdb1ef2e384abe90cf ]
Add missing halt_check, hwcg_reg and hwcg_bit properties. These were likely omitted when porting the driver upstream.
--- drivers/clk/qcom/gcc-sdm660.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/clk/qcom/gcc-sdm660.c +3 -0
@@ -1715,6 +1715,9 @@ static struct clk_branch gcc_mss_cfg_ahb_clk = {static struct clk_branch gcc_mss_mnoc_bimc_axi_clk = { .halt_reg =0x8a004 , + .halt_check =BRANCH_HALT , + .hwcg_reg =0x8a004 , + .hwcg_bit =1 , .clkr = { .enable_reg =0x8a004 , .enable_mask =BIT (0 ),
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 111/152 clk: clk-atlas6: fix return value check in atlas6_clk_init()
In reply to Greg Kroah-HartmanFrom: Xu Wang <[email protected]>
[ Upstream commit 12b90b40854a8461a02ef19f6f4474cc88d64b66 ]
In case of error, the function clk_register() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR().
--- drivers/clk/sirf/clk-atlas6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/sirf/clk-atlas6.c +1 -1
@@ -135,7 +135,7 @@ static void __init atlas6_clk_init(struct device_node *np)for (i = pll1; i < maxclk; i++) { atlas6_clks[i] =clk_register (NULL , atlas6_clk_hw_array[i]); -BUG_ON (!atlas6_clks[i]); +BUG_ON (IS_ERR (atlas6_clks[i])); }clk_register_clkdev (atlas6_clks[cpu],NULL ,"cpu" );clk_register_clkdev (atlas6_clks[io],NULL ,"io" );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 112/152 pwm: bcm-iproc: handle clk_get_rate() return
In reply to Greg Kroah-HartmanFrom: Rayagonda Kokatanur <[email protected]>
[ Upstream commit 6ced5ff0be8e94871ba846dfbddf69d21363f3d7 ]
Handle clk_get_rate() returning 0 to avoid possible division by zero.
--- drivers/pwm/pwm-bcm-iproc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/pwm/pwm-bcm-iproc.c +7 -2
@@ -85,8 +85,6 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm,u64 tmp, multi, rate;u32 value, prescale; - rate =clk_get_rate (ip->clk); - value =readl (ip->base +IPROC_PWM_CTRL_OFFSET );if (value &BIT (IPROC_PWM_CTRL_EN_SHIFT (pwm->hwpwm)))
@@ -99,6 +97,13 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm,else state->polarity =PWM_POLARITY_INVERSED ; + rate =clk_get_rate (ip->clk); +if (rate ==0 ) { + state->period =0 ; + state->duty_cycle =0 ; +return ; + } + value =readl (ip->base +IPROC_PWM_PRESCALE_OFFSET ); prescale = value >>IPROC_PWM_PRESCALE_SHIFT (pwm->hwpwm); prescale &=IPROC_PWM_PRESCALE_MAX ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 113/152 tools build feature: Use CC and CXX from parent
In reply to Greg Kroah-HartmanFrom: Thomas Hebb <[email protected]>
[ Upstream commit e3232c2f39acafd5a29128425bc30b9884642cfa ]
commit c8c188679ccf ("tools build: Use the same CC for feature detection and actual build") changed these assignments from unconditional (:=) to conditional (?=) so that they wouldn't clobber values from the environment. However, conditional assignment does not work properly for variables that Make implicitly sets, among which are CC and CXX. To quote tools/scripts/Makefile.include, which handles this properly:
# Makefiles suck: This macro sets a default value of $(2) for the
# variable named by $(1), unless the variable has been set by # environment or command line. This is necessary for CC and AR # because make sets default values, so the simpler ?= approach # won't work as expected.
In other words, the conditional assignments will not run even if the variables are not overridden in the environment; Make will set CC to "cc" and CXX to "g++" when it starts[1], meaning the variables are not empty by the time the conditional assignments are evaluated. This breaks cross-compilation when CROSS_COMPILE is set but CC isn't, since "cc" gets used for feature detection instead of the cross compiler (and likewise for CXX).
To fix the issue, just pass down the values of CC and CXX computed by the parent Makefile, which gets included by the Makefile that actually builds whatever we're detecting features for and so is guaranteed to have good values. This is a better solution anyway, since it means we aren't trying to replicate the logic of the parent build system and so don't risk it getting out of sync.
Leave PKG_CONFIG alone, since 1) there's no common logic to compute it in Makefile.include, and 2) it's not an implicit variable, so conditional assignment works properly.
[1] https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html
--- tools/build/Makefile.feature | 2 +- tools/build/feature/Makefile | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-)
tools/build/Makefile.feature +1 -1
@@ -8,7 +8,7 @@ endif feature_check = $(eval $(feature_check_code)) define feature_check_code - feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) + feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC=$(CC) CXX=$(CXX) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) endef feature_set = $(eval $(feature_set_code))
tools/build/feature/Makefile +0 -2
@@ -70,8 +70,6 @@ FILES= \ FILES := $(addprefix $(OUTPUT),$(FILES)) -CC ?= $(CROSS_COMPILE)gcc -CXX ?= $(CROSS_COMPILE)g++ PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config LLVM_CONFIG ?= llvm-config
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 114/152 i2c: rcar: avoid race when unregistering slave
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit c7c9e914f9a0478fba4dc6f227cfd69cf84a4063 ]
Due to the lockless design of the driver, it is theoretically possible to access a NULL pointer, if a slave interrupt was running while we were unregistering the slave. To make this rock solid, disable the interrupt for a short time while we are clearing the interrupt_enable register. This patch is purely based on code inspection. The OOPS is super-hard to trigger because clearing SAR (the address) makes interrupts even more unlikely to happen as well. While here, reinit SCR to SDBS because this bit should always be set according to documentation. There is no effect, though, because the interface is disabled.
--- drivers/i2c/busses/i2c-rcar.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/i2c/busses/i2c-rcar.c +5 -3
@@ -863,12 +863,14 @@ static int rcar_unreg_slave(struct i2c_client *slave)WARN_ON (!priv->slave); -/* disable irqs and ensure none is running before clearing ptr */ +/* ensure no irq is running before clearing ptr */ +disable_irq (priv->irq);rcar_i2c_write (priv,ICSIER ,0 ); -rcar_i2c_write (priv,ICSCR ,0 ); +rcar_i2c_write (priv,ICSSR ,0 ); +enable_irq (priv->irq); +rcar_i2c_write (priv,ICSCR ,SDBS );rcar_i2c_write (priv,ICSAR ,0 );/* Gen2: must be 0 if not using slave */ -synchronize_irq (priv->irq); priv->slave =NULL ;pm_runtime_put (rcar_i2c_priv_to_dev (priv));
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 115/152 nfs: ensure correct writeback errors are returned on close()
In reply to Greg Kroah-HartmanFrom: Scott Mayhew <[email protected]>
[ Upstream commit 67dd23f9e6fbaf163431912ef5599c5e0693476c ]
nfs_wb_all() calls filemap_write_and_wait(), which uses filemap_check_errors() to determine the error to return. filemap_check_errors() only looks at the mapping->flags and will therefore only return either -ENOSPC or -EIO. To ensure that the correct error is returned on close(), nfs{,4}_file_flush() should call filemap_check_wb_err() which looks at the errseq value in mapping->wb_err without consuming it.
generic one")
--- fs/nfs/file.c | 5 ++++- fs/nfs/nfs4file.c | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-)
fs/nfs/file.c +4 -1
@@ -140,6 +140,7 @@ static int nfs_file_flush(struct file *file, fl_owner_t id) {struct inode *inode =file_inode (file); +errseq_t since;dprintk ("NFS: flush(%pD2)\n" , file);
@@ -148,7 +149,9 @@ nfs_file_flush(struct file *file, fl_owner_t id)return 0 ;/* Flush writes to the server and return any errors */ -return nfs_wb_all (inode); + since =filemap_sample_wb_err (file->f_mapping); +nfs_wb_all (inode); +return filemap_check_wb_err (file->f_mapping, since); }ssize_t
fs/nfs/nfs4file.c +4 -1
@@ -109,6 +109,7 @@ static int nfs4_file_flush(struct file *file, fl_owner_t id) {struct inode *inode =file_inode (file); +errseq_t since;dprintk ("NFS: flush(%pD2)\n" , file);
@@ -124,7 +125,9 @@ nfs4_file_flush(struct file *file, fl_owner_t id)return filemap_fdatawrite (file->f_mapping);/* Flush writes to the server and return any errors */ -return nfs_wb_all (inode); + since =filemap_sample_wb_err (file->f_mapping); +nfs_wb_all (inode); +return filemap_check_wb_err (file->f_mapping, since); }#ifdef CONFIG_NFS_V4_2
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 116/152 ubifs: Fix wrong orphan node deletion in ubifs_jnl_update|rename
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit 094b6d1295474f338201b846a1f15e72eb0b12cf ]
There a wrong orphan node deleting in error handling path in ubifs_jnl_update() and ubifs_jnl_rename(), which may cause following error msg:
UBIFS error (ubi0:0 pid 1522): ubifs_delete_orphan [ubifs]:
missing orphan ino 65
Fix this by checking whether the node has been operated for adding to orphan list before being deleted,
--- fs/ubifs/journal.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
fs/ubifs/journal.c +6 -4
@@ -539,7 +539,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir, const struct fscrypt_name *nm, const struct inode *inode, int deletion, int xent) { - int err, dlen, ilen, len, lnum, ino_offs, dent_offs; + int err, dlen, ilen, len, lnum, ino_offs, dent_offs, orphan_added = 0;int aligned_dlen, aligned_ilen, sync =IS_DIRSYNC (dir);int last_reference = !!(deletion && inode->i_nlink ==0 );struct ubifs_inode *ui =ubifs_inode (inode);
@@ -630,6 +630,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir, goto out_finish; } ui->del_cmtno = c->cmt_no; + orphan_added =1 ; } err =write_head (c,BASEHD , dent, len, &lnum, &dent_offs, sync);
@@ -702,7 +703,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,kfree (dent); out_ro:ubifs_ro_mode (c, err); -if (last_reference) +if (orphan_added)ubifs_delete_orphan (c, inode->i_ino);finish_reservation (c);return err;
@@ -1217,7 +1218,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir,void *p;union ubifs_key key;struct ubifs_dent_node *dent, *dent2; -int err, dlen1, dlen2, ilen, lnum, offs, len; +int err, dlen1, dlen2, ilen, lnum, offs, len, orphan_added =0 ;int aligned_dlen1, aligned_dlen2, plen =UBIFS_INO_NODE_SZ ;int last_reference = !!(new_inode && new_inode->i_nlink ==0 );int move = (old_dir != new_dir);
@@ -1333,6 +1334,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir, goto out_finish; } new_ui->del_cmtno = c->cmt_no; + orphan_added =1 ; } err =write_head (c,BASEHD , dent, len, &lnum, &offs, sync);
@@ -1414,7 +1416,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir,release_head (c,BASEHD ); out_ro:ubifs_ro_mode (c, err); -if (last_reference) +if (orphan_added)ubifs_delete_orphan (c, new_inode->i_ino); out_finish:finish_reservation (c);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 117/152 clk: bcm2835: Do not use prediv with bcm2711s PLLs
In reply to Greg Kroah-HartmanFrom: Nicolas Saenz Julienne <[email protected]>
[ Upstream commit f34e4651ce66a754f41203284acf09b28b9dd955 ]
Contrary to previous SoCs, bcm2711 doesn't have a prescaler in the PLL feedback loop. Bypass it by zeroing fb_prediv_mask when running on bcm2711.
Note that, since the prediv configuration bits were re-purposed, this was triggering miscalculations on all clocks hanging from the VPU clock, notably the aux UART, making its output unintelligible.
--- drivers/clk/bcm/clk-bcm2835.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-)
drivers/clk/bcm/clk-bcm2835.c +21 -4
@@ -314,6 +314,7 @@ struct bcm2835_cprman {struct device *dev;void __iomem *regs;spinlock_t regs_lock;/* spinlock for all clocks */ +unsigned int soc;/* * Real names of cprman clock parents looked up through
@@ -525,6 +526,20 @@ static int bcm2835_pll_is_on(struct clk_hw *hw)A2W_PLL_CTRL_PRST_DISABLE ; } +static u32 bcm2835_pll_get_prediv_mask (struct bcm2835_cprman *cprman, +const struct bcm2835_pll_data *data) +{ +/* +* On BCM2711 there isn't a pre-divisor available in the PLL feedback +* loop. Bits 13:14 of ANA1 (PLLA,PLLB,PLLC,PLLD) have been re-purposed +* for to for VCO RANGE bits. +*/ +if (cprman->soc &SOC_BCM2711 ) +return 0 ; + +return data->ana->fb_prediv_mask; +} +static void bcm2835_pll_choose_ndiv_and_fdiv (unsigned long rate,unsigned long parent_rate,u32 *ndiv,u32 *fdiv)
@@ -582,7 +597,7 @@ static unsigned long bcm2835_pll_get_rate(struct clk_hw *hw, ndiv = (a2wctrl &A2W_PLL_CTRL_NDIV_MASK ) >>A2W_PLL_CTRL_NDIV_SHIFT ; pdiv = (a2wctrl &A2W_PLL_CTRL_PDIV_MASK ) >>A2W_PLL_CTRL_PDIV_SHIFT ; using_prediv =cprman_read (cprman, data->ana_reg_base +4 ) & - data->ana->fb_prediv_mask; +bcm2835_pll_get_prediv_mask (cprman, data);if (using_prediv) { ndiv *=2 ;
@@ -665,6 +680,7 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, struct bcm2835_pll *pll = container_of(hw, struct bcm2835_pll, hw);struct bcm2835_cprman *cprman = pll->cprman;const struct bcm2835_pll_data *data = pll->data; +u32 prediv_mask =bcm2835_pll_get_prediv_mask (cprman, data);bool was_using_prediv, use_fb_prediv, do_ana_setup_first;u32 ndiv, fdiv, a2w_ctl;u32 ana[4 ];
@@ -682,7 +698,7 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw,for (i =3 ; i >=0 ; i--) ana[i] =cprman_read (cprman, data->ana_reg_base + i *4 ); - was_using_prediv = ana[1 ] & data->ana->fb_prediv_mask; + was_using_prediv = ana[1 ] & prediv_mask; ana[0 ] &= ~data->ana->mask0; ana[0 ] |= data->ana->set0;
@@ -692,10 +708,10 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, ana[3 ] |= data->ana->set3;if (was_using_prediv && !use_fb_prediv) { - ana[1 ] &= ~data->ana->fb_prediv_mask; + ana[1 ] &= ~prediv_mask; do_ana_setup_first = true; }else if (!was_using_prediv && use_fb_prediv) { - ana[1 ] |= data->ana->fb_prediv_mask; + ana[1 ] |= prediv_mask; do_ana_setup_first = false; }else { do_ana_setup_first = true;
@@ -2234,6 +2250,7 @@ static int bcm2835_clk_probe(struct platform_device *pdev)platform_set_drvdata (pdev, cprman); cprman->onecell.num = asize; + cprman->soc = pdata->soc; hws = cprman->onecell.hws;for (i =0 ; i < asize; i++) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 118/152 libnvdimm/security: fix a typo
In reply to Greg Kroah-HartmanFrom: Jane Chu <[email protected]>
[ Upstream commit dad42d17558f316e9e807698cd4207359b636084 ]
commit d78c620a2e82 ("libnvdimm/security: Introduce a 'frozen' attribute") introduced a typo, causing a 'nvdimm->sec.flags' update being overwritten by the subsequent update meant for 'nvdimm->sec.ext_flags'.
--- drivers/nvdimm/security.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvdimm/security.c +1 -1
@@ -457,7 +457,7 @@ void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm)clear_bit (NDD_WORK_PENDING , &nvdimm->flags);put_device (&nvdimm->dev); nvdimm->sec.flags =nvdimm_security_flags (nvdimm,NVDIMM_USER ); - nvdimm->sec.flags =nvdimm_security_flags (nvdimm,NVDIMM_MASTER ); + nvdimm->sec.ext_flags =nvdimm_security_flags (nvdimm,NVDIMM_MASTER ); }void nvdimm_security_overwrite_query (struct work_struct *work)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 119/152 libnvdimm/security: ensure sysfs poll thread woke up and fetch updated attr
In reply to Greg Kroah-HartmanFrom: Jane Chu <[email protected]>
[ Upstream commit 7f674025d9f7321dea11b802cc0ab3f09cbe51c5 ]
commit 7d988097c546 ("acpi/nfit, libnvdimm/security: Add security DSM overwrite support") adds a sysfs_notify_dirent() to wake up userspace poll thread when the "overwrite" operation has completed. But the notification is issued before the internal dimm security state and flags have been updated, so the userspace poll thread wakes up and fetches the not-yet-updated attr and falls back to sleep, forever. But if user from another terminal issue "ndctl wait-overwrite nmemX" again, the command returns instantly.
--- drivers/nvdimm/security.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/nvdimm/security.c +8 -3
@@ -450,14 +450,19 @@ void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm)else dev_dbg (&nvdimm->dev,"overwrite completed\n" ); -if (nvdimm->sec.overwrite_state) -sysfs_notify_dirent (nvdimm->sec.overwrite_state); +/* +* Mark the overwrite work done and update dimm security flags, +* then send a sysfs event notification to wake up userspace +* poll threads to picked up the changed state. +*/ nvdimm->sec.overwrite_tmo =0 ;clear_bit (NDD_SECURITY_OVERWRITE , &nvdimm->flags);clear_bit (NDD_WORK_PENDING , &nvdimm->flags); -put_device (&nvdimm->dev); nvdimm->sec.flags =nvdimm_security_flags (nvdimm,NVDIMM_USER ); nvdimm->sec.ext_flags =nvdimm_security_flags (nvdimm,NVDIMM_MASTER ); +if (nvdimm->sec.overwrite_state) +sysfs_notify_dirent (nvdimm->sec.overwrite_state); +put_device (&nvdimm->dev); }void nvdimm_security_overwrite_query (struct work_struct *work)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 120/152 openrisc: Fix oops caused when dumping stack
In reply to Greg Kroah-HartmanFrom: Stafford Horne <[email protected]>
[ Upstream commit 57b8e277c33620e115633cdf700a260b55095460 ]
When dumping a stack with 'cat /proc/#/stack' the kernel would oops. For example:
# cat /proc/690/stack
Unable to handle kernel access
at virtual address 0x7fc60f58 Oops#: 0000
CPU #: 0
PC: c00097fc SR: 0000807f SP: d6f09b9c
GPR00: 00000000 GPR01: d6f09b9c GPR02: d6f09bb8 GPR03: d6f09bc4
GPR04: 7fc60f5c GPR05: c00099b4 GPR06: 00000000 GPR07: d6f09ba3
GPR08: ffffff00 GPR09: c0009804 GPR10: d6f08000 GPR11: 00000000
GPR12: ffffe000 GPR13: dbb86000 GPR14: 00000001 GPR15: dbb86250
GPR16: 7fc60f63 GPR17: 00000f5c GPR18: d6f09bc4 GPR19: 00000000
GPR20: c00099b4 GPR21: ffffffc0 GPR22: 00000000 GPR23: 00000000
GPR24: 00000001 GPR25: 000002c6 GPR26: d78b6850 GPR27: 00000001
GPR28: 00000000 GPR29: dbb86000 GPR30: ffffffff GPR31: dbb862fc
RES: 00000000 oGPR11: ffffffff
Process cat (pid: 702, stackpage=d79d6000)
Stack:
Call trace:
[<598977f2>] save_stack_trace_tsk+0x40/0x74
[<95063f0e>] stack_trace_save_tsk+0x44/0x58
[<b557bfdd>] proc_pid_stack+0xd0/0x13c
[<a2df8eda>] proc_single_show+0x6c/0xf0
[<e5a737b7>] seq_read+0x1b4/0x688
[<2d6c7480>] do_iter_read+0x208/0x248
[<2182a2fb>] vfs_readv+0x64/0x90This was caused by the stack trace code in save_stack_trace_tsk using the wrong stack pointer. It was using the user stack pointer instead of the kernel stack pointer. Fix this by using the right stack.
Also for good measure we add try_get_task_stack/put_task_stack to ensure the task is not lost while we are walking it's stack.
--- arch/openrisc/kernel/stacktrace.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
arch/openrisc/kernel/stacktrace.c +16 -2
@@ -13,6 +13,7 @@#include <linux/export.h> #include <linux/sched.h> #include <linux/sched/debug.h> +#include <linux/sched/task_stack.h> #include <linux/stacktrace.h> #include <asm/processor.h>
@@ -68,12 +69,25 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace) {unsigned long *sp =NULL ; +if (!try_get_task_stack (tsk)) +return ; +if (tsk == current) sp = (unsigned long *) &sp; -else - sp = (unsigned long *)KSTK_ESP (tsk); +else { +unsigned long ksp; + +/* Locate stack from kernel context */ + ksp =task_thread_info (tsk)->ksp; + ksp +=STACK_FRAME_OVERHEAD ;/* redzone */ + ksp +=sizeof (struct pt_regs ); + + sp = (unsigned long *) ksp; + }unwind_stack (trace, sp, save_stack_address_nosched); + +put_task_stack (tsk); }EXPORT_SYMBOL_GPL (save_stack_trace_tsk);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 121/152 scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport
In reply to Greg Kroah-HartmanFrom: Ewan D. Milne <[email protected]>
[ Upstream commit af6de8c60fe9433afa73cea6fcccdccd98ad3e5e ]
We cannot wait on a completion object in the lpfc_nvme_targetport structure in the _destroy_targetport() code path because the NVMe/fc transport will free that structure immediately after the .targetport_delete() callback. This results in a use-after-free, and a crash if slub_debug=FZPU is enabled.
An earlier fix put put the completion on the stack, but commit 2a0fb340fcc8 ("scsi: lpfc: Correct localport timeout duration error") subsequently changed the code to reference the completion through a pointer in the object rather than the local stack variable. Fix this by using the stack variable directly.
--- drivers/scsi/lpfc/lpfc_nvmet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_nvmet.c +1 -1
@@ -1923,7 +1923,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba) } tgtp->tport_unreg_cmp = &tport_unreg_cmp;nvmet_fc_unregister_targetport (phba->targetport); -if (!wait_for_completion_timeout (tgtp->tport_unreg_cmp, +if (!wait_for_completion_timeout (&tport_unreg_cmp,msecs_to_jiffies (LPFC_NVMET_WAIT_TMO )))lpfc_printf_log (phba,KERN_ERR ,LOG_NVME , "6179 Unreg targetport x%px timeout "
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 122/152 nfs: nfs_file_write() should check for writeback errors
In reply to Greg Kroah-HartmanFrom: Scott Mayhew <[email protected]>
[ Upstream commit ce368536dd614452407dc31e2449eb84681a06af ]
The NFS_CONTEXT_ERROR_WRITE flag (as well as the check of said flag) was removed by commit 6fbda89b257f. The absence of an error check allows writes to be continually queued up for a server that may no longer be able to handle them. Fix it by adding an error check using the generic error reporting functions.
--- fs/nfs/file.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
fs/nfs/file.c +9 -3
@@ -583,12 +583,14 @@ static const struct vm_operations_struct nfs_file_vm_ops = { .page_mkwrite = nfs_vm_page_mkwrite, }; -static int nfs_need_check_write (struct file *filp,struct inode *inode) +static int nfs_need_check_write (struct file *filp,struct inode *inode, +int error) {struct nfs_open_context *ctx; ctx =nfs_file_open_context (filp); -if (nfs_ctx_key_to_expire (ctx, inode)) +if (nfs_error_is_fatal_on_server (error) || +nfs_ctx_key_to_expire (ctx, inode))return 1 ;return 0 ; }
@@ -599,6 +601,8 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from)struct inode *inode =file_inode (file);unsigned long written =0 ;ssize_t result; +errseq_t since; +int error; result =nfs_key_timeout_notify (file, inode);if (result)
@@ -623,6 +627,7 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from)if (iocb->ki_pos >i_size_read (inode))nfs_revalidate_mapping (inode, file->f_mapping); + since =filemap_sample_wb_err (file->f_mapping);nfs_start_io_write (inode); result =generic_write_checks (iocb, from);if (result >0 ) {
@@ -641,7 +646,8 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) goto out;/* Return error values */ -if (nfs_need_check_write (file, inode)) { + error =filemap_check_wb_err (file->f_mapping, since); +if (nfs_need_check_write (file, inode, error)) {int err =nfs_wb_all (inode);if (err <0 ) result = err;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 123/152 watchdog: initialize device before misc_register
In reply to Greg Kroah-HartmanFrom: Krzysztof Sobota <[email protected]>
[ Upstream commit cb36e29bb0e4b0c33c3d5866a0a4aebace4c99b7 ]
When watchdog device is being registered, it calls misc_register that makes watchdog available for systemd to open. This is a data race scenario, because when device is open it may still have device struct not initialized - this in turn causes a crash. This patch moves device initialization before misc_register call and it solves the problem printed below.
------------[ cut here ]------------ WARNING: CPU: 3 PID: 1 at lib/kobject.c:612 kobject_get+0x50/0x54 kobject: '(null)' ((ptrval)): is not initialized, yet kobject_get() is being called. Modules linked in: k2_reset_status(O) davinci_wdt(+) sfn_platform_hwbcn(O) fsmddg_sfn(O) clk_misc_mmap(O) clk_sw_bcn(O) fsp_reset(O) cma_mod(O) slave_sup_notif(O) fpga_master(O) latency(O+) evnotify(O) enable_arm_pmu(O) xge(O) rio_mport_cdev br_netfilter bridge stp llc nvrd_checksum(O) ipv6 CPU: 3 PID: 1 Comm: systemd Tainted: G O 4.19.113-g2579778-fsm4_k2 #1 Hardware name: Keystone [<c02126c4>] (unwind_backtrace) from [<c020da94>] (show_stack+0x18/0x1c) [<c020da94>] (show_stack) from [<c07f87d8>] (dump_stack+0xb4/0xe8) [<c07f87d8>] (dump_stack) from [<c0221f70>] (__warn+0xfc/0x114) [<c0221f70>] (__warn) from [<c0221fd8>] (warn_slowpath_fmt+0x50/0x74) [<c0221fd8>] (warn_slowpath_fmt) from [<c07fd394>] (kobject_get+0x50/0x54) [<c07fd394>] (kobject_get) from [<c0602ce8>] (get_device+0x1c/0x24) [<c0602ce8>] (get_device) from [<c06961e0>] (watchdog_open+0x90/0xf0) [<c06961e0>] (watchdog_open) from [<c06001dc>] (misc_open+0x130/0x17c) [<c06001dc>] (misc_open) from [<c0388228>] (chrdev_open+0xec/0x1a8) [<c0388228>] (chrdev_open) from [<c037fa98>] (do_dentry_open+0x204/0x3cc) [<c037fa98>] (do_dentry_open) from [<c0391e2c>] (path_openat+0x330/0x1148) [<c0391e2c>] (path_openat) from [<c0394518>] (do_filp_open+0x78/0xec) [<c0394518>] (do_filp_open) from [<c0381100>] (do_sys_open+0x130/0x1f4) [<c0381100>] (do_sys_open) from [<c0201000>] (ret_fast_syscall+0x0/0x28) Exception stack(0xd2ceffa8 to 0xd2cefff0) ffa0: b6f69968 00000000 ffffff9c b6ebd210 000a0001 00000000 ffc0: b6f69968 00000000 00000000 00000142 fffffffd ffffffff 00b65530 bed7bb78 ffe0: 00000142 bed7ba70 b6cc2503 b6cc41d6 ---[ end trace 7b16eb105513974f ]--- ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1 at lib/refcount.c:153 kobject_get+0x24/0x54 refcount_t: increment on 0; use-after-free. Modules linked in: k2_reset_status(O) davinci_wdt(+) sfn_platform_hwbcn(O) fsmddg_sfn(O) clk_misc_mmap(O) clk_sw_bcn(O) fsp_reset(O) cma_mod(O) slave_sup_notif(O) fpga_master(O) latency(O+) evnotify(O) enable_arm_pmu(O) xge(O) rio_mport_cdev br_netfilter bridge stp llc nvrd_checksum(O) ipv6 CPU: 3 PID: 1 Comm: systemd Tainted: G W O 4.19.113-g2579778-fsm4_k2 #1 Hardware name: Keystone [<c02126c4>] (unwind_backtrace) from [<c020da94>] (show_stack+0x18/0x1c) [<c020da94>] (show_stack) from [<c07f87d8>] (dump_stack+0xb4/0xe8) [<c07f87d8>] (dump_stack) from [<c0221f70>] (__warn+0xfc/0x114) [<c0221f70>] (__warn) from [<c0221fd8>] (warn_slowpath_fmt+0x50/0x74) [<c0221fd8>] (warn_slowpath_fmt) from [<c07fd368>] (kobject_get+0x24/0x54) [<c07fd368>] (kobject_get) from [<c0602ce8>] (get_device+0x1c/0x24) [<c0602ce8>] (get_device) from [<c06961e0>] (watchdog_open+0x90/0xf0) [<c06961e0>] (watchdog_open) from [<c06001dc>] (misc_open+0x130/0x17c) [<c06001dc>] (misc_open) from [<c0388228>] (chrdev_open+0xec/0x1a8) [<c0388228>] (chrdev_open) from [<c037fa98>] (do_dentry_open+0x204/0x3cc) [<c037fa98>] (do_dentry_open) from [<c0391e2c>] (path_openat+0x330/0x1148) [<c0391e2c>] (path_openat) from [<c0394518>] (do_filp_open+0x78/0xec) [<c0394518>] (do_filp_open) from [<c0381100>] (do_sys_open+0x130/0x1f4) [<c0381100>] (do_sys_open) from [<c0201000>] (ret_fast_syscall+0x0/0x28) Exception stack(0xd2ceffa8 to 0xd2cefff0) ffa0: b6f69968 00000000 ffffff9c b6ebd210 000a0001 00000000 ffc0: b6f69968 00000000 00000000 00000142 fffffffd ffffffff 00b65530 bed7bb78 ffe0: 00000142 bed7ba70 b6cc2503 b6cc41d6 ---[ end trace 7b16eb1055139750 ]---
--- drivers/watchdog/watchdog_dev.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/watchdog/watchdog_dev.c +9 -9
@@ -974,6 +974,15 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)if (IS_ERR_OR_NULL (watchdog_kworker))return -ENODEV ; +device_initialize (&wd_data->dev); + wd_data->dev.devt =MKDEV (MAJOR (watchdog_devt), wdd->id); + wd_data->dev.class = &watchdog_class; + wd_data->dev.parent = wdd->parent; + wd_data->dev.groups = wdd->groups; + wd_data->dev.release = watchdog_core_data_release; +dev_set_drvdata (&wd_data->dev, wdd); +dev_set_name (&wd_data->dev,"watchdog%d" , wdd->id); +kthread_init_work (&wd_data->work, watchdog_ping_work);hrtimer_init (&wd_data->timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_HARD ); wd_data->timer.function = watchdog_timer_expired;
@@ -994,15 +1003,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) } } -device_initialize (&wd_data->dev); - wd_data->dev.devt =MKDEV (MAJOR (watchdog_devt), wdd->id); - wd_data->dev.class = &watchdog_class; - wd_data->dev.parent = wdd->parent; - wd_data->dev.groups = wdd->groups; - wd_data->dev.release = watchdog_core_data_release; -dev_set_drvdata (&wd_data->dev, wdd); -dev_set_name (&wd_data->dev,"watchdog%d" , wdd->id); -/* Fill in the data structures */ cdev_init (&wd_data->cdev, &watchdog_fops);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 124/152 md-cluster: Fix potential error pointer dereference in resize_bitmaps()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit e8abe1de43dac658dacbd04a4543e0c988a8d386 ]
The error handling calls md_bitmap_free(bitmap) which checks for NULL but will Oops if we pass an error pointer. Let's set "bitmap" to NULL on this error path.
--- drivers/md/md-cluster.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/md-cluster.c +1 -0
@@ -1139,6 +1139,7 @@ static int resize_bitmaps(struct mddev *mddev, sector_t newsize, sector_t oldsiz bitmap =get_bitmap_from_slot (mddev, i);if (IS_ERR (bitmap)) {pr_err ("can't get bitmap from slot %d\n" , i); + bitmap =NULL ; goto out; } counts = &bitmap->counts;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 125/152 x86/tsr: Fix tsc frequency enumeration bug on Lightning Mountain SoC
In reply to Greg Kroah-HartmanFrom: Dilip Kota <[email protected]>
[ Upstream commit 7d98585860d845e36ee612832a5ff021f201dbaf ]
Frequency descriptor of Lightning Mountain SoC doesn't have all the frequency entries so resulting in the below failure causing a kernel hang:
Error MSR_FSB_FREQ index 15 is unknown
tsc: Fast TSC calibration failed
So, add all the frequency entries in the Lightning Mountain SoC frequency descriptor.
--- arch/x86/kernel/tsc_msr.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/x86/kernel/tsc_msr.c +7 -2
@@ -133,10 +133,15 @@ static const struct freq_desc freq_desc_ann = { .mask = 0x0f, }; -/* 24 MHz crystal? : 24 * 13 / 4 = 78 MHz */ +/* +* 24 MHz crystal? : 24 * 13 / 4 = 78 MHz +* Frequency step for Lightning Mountain SoC is fixed to 78 MHz, +* so all the frequency entries are 78000. +*/ static const struct freq_desc freq_desc_lgm = { .use_msr_plat = true, - .freqs = {78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 }, + .freqs = {78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 , +78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 ,78000 }, .mask =0x0f , };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 126/152 Input: sentelic - fix error return when fsp_reg_write fails
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit ea38f06e0291986eb93beb6d61fd413607a30ca4 ]
Currently when the call to fsp_reg_write fails -EIO is not being returned because the count is being returned instead of the return value in retval. Fix this by returning the value in retval instead of count.
Addresses-Coverity: ("Unused value")
--- drivers/input/mouse/sentelic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/mouse/sentelic.c +1 -1
@@ -441,7 +441,7 @@ static ssize_t fsp_attr_set_setreg(struct psmouse *psmouse, void *data,fsp_reg_write_enable (psmouse, false); -return count; +return retval; }PSMOUSE_DEFINE_WO_ATTR (setreg,S_IWUSR ,NULL , fsp_attr_set_setreg);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 127/152 recordmcount: Fix build failure on non arm64
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit 3df14264ad9930733a8166e5bd0eccc1727564bb ]
Commit ea0eada45632 leads to the following build failure on powerpc:
HOSTCC scripts/recordmcountscripts/recordmcount.c: In function 'arm64_is_fake_mcount':scripts/recordmcount.c:440: error: 'R_AARCH64_CALL26' undeclared (first use in this function) scripts/recordmcount.c:440: error: (Each undeclared identifier is reported only once scripts/recordmcount.c:440: error: for each function it appears in.)
make[2]: *** [scripts/recordmcount] Error 1
Make sure R_AARCH64_CALL26 is always defined.
--- scripts/recordmcount.c | 2 ++ 1 file changed, 2 insertions(+)
scripts/recordmcount.c +2 -0
@@ -42,6 +42,8 @@#define R_ARM_THM_CALL 10#define R_ARM_CALL 28 +#define R_AARCH64_CALL26 283 +static int fd_map;/* File descriptor for file being modified. */ static int mmap_failed;/* Boolean flag. */ static char gpfx;/* prefix for global symbol name (sometimes '_') */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 128/152 drm/vmwgfx: Use correct vmw_legacy_display_unit pointer
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 1d2c0c565bc0da25f5e899a862fb58e612b222df ]
The "entry" pointer is an offset from the list head and it doesn't point to a valid vmw_legacy_display_unit struct. Presumably the intent was to point to the last entry.
Also the "i++" wasn't used so I have removed that as well.
--- drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c +2 -3
@@ -81,7 +81,7 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv)struct vmw_legacy_display_unit *entry;struct drm_framebuffer *fb =NULL ;struct drm_crtc *crtc =NULL ; -int i =0 ; +int i;/* If there is no display topology the host just assumes * that the guest will set the same layout as the host.
@@ -92,12 +92,11 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv) crtc = &entry->base.crtc; w =max (w, crtc->x + crtc->mode.hdisplay); h =max (h, crtc->y + crtc->mode.vdisplay); - i++; }if (crtc ==NULL )return 0 ; - fb = entry->base.crtc.primary->state->fb; + fb = crtc->primary->state->fb; return vmw_kms_write_svga(dev_priv, w, h, fb->pitches[0], fb->format->cpp[0] * 8,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 129/152 drm/vmwgfx: Fix two list_for_each loop exit tests
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 4437c1152ce0e57ab8f401aa696ea6291cc07ab1 ]
These if statements are supposed to be true if we ended the list_for_each_entry() loops without hitting a break statement but they don't work.
In the first loop, we increment "i" after the "if (i == unit)" condition so we don't necessarily know that "i" is not equal to unit at the end of the loop.
In the second loop we exit when mode is not pointing to a valid drm_display_mode struct so it doesn't make sense to check "mode->type".
--- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +4 -4
@@ -2666,7 +2666,7 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv, ++i; } -if (i != unit) { +if (&con->head == &dev_priv->dev->mode_config.connector_list) {DRM_ERROR ("Could not find initial display unit.\n" ); ret = -EINVAL ; goto out_unlock;
@@ -2690,13 +2690,13 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,break ; } -if (mode->type &DRM_MODE_TYPE_PREFERRED ) - *p_mode = mode; -else { +if (&mode->head == &con->modes) {WARN_ONCE (true,"Could not find initial preferred mode.\n" ); *p_mode =list_first_entry (&con->modes, struct drm_display_mode, head); + }else { + *p_mode = mode; } out_unlock:
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 130/152 net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit 50caa777a3a24d7027748e96265728ce748b41ef ]
Fix the missing clk_disable_unprepare() before return from emac_clks_phase1_init() in the error handling case.
--- drivers/net/ethernet/qualcomm/emac/emac.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
drivers/net/ethernet/qualcomm/emac/emac.c +14 -3
@@ -485,13 +485,24 @@ static int emac_clks_phase1_init(struct platform_device *pdev, ret =clk_prepare_enable (adpt->clk[EMAC_CLK_CFG_AHB ]);if (ret) -return ret; + goto disable_clk_axi; ret =clk_set_rate (adpt->clk[EMAC_CLK_HIGH_SPEED ],19200000 );if (ret) -return ret; + goto disable_clk_cfg_ahb; + + ret =clk_prepare_enable (adpt->clk[EMAC_CLK_HIGH_SPEED ]); +if (ret) + goto disable_clk_cfg_ahb; -return clk_prepare_enable (adpt->clk[EMAC_CLK_HIGH_SPEED ]); +return 0 ; + +disable_clk_cfg_ahb: +clk_disable_unprepare (adpt->clk[EMAC_CLK_CFG_AHB ]); +disable_clk_axi: +clk_disable_unprepare (adpt->clk[EMAC_CLK_AXI ]); + +return ret; }/* Enable clocks; needs emac_clks_phase1_init to be called before */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 131/152 nfs: Fix getxattr kernel panic and memory overflow
In reply to Greg Kroah-HartmanFrom: Jeffrey Mitchell <[email protected]>
[ Upstream commit b4487b93545214a9db8cbf32e86411677b0cca21 ]
Move the buffer size check to decode_attr_security_label() before memcpy() Only call memcpy() if the buffer is large enough
--- fs/nfs/nfs4proc.c | 2 -- fs/nfs/nfs4xdr.c | 6 +++++- 2 files changed, 5 insertions(+), 3 deletions(-)
fs/nfs/nfs4proc.c +0 -2
@@ -5811,8 +5811,6 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf,return ret;if (!(fattr.valid &NFS_ATTR_FATTR_V4_SECURITY_LABEL ))return -ENOENT ; -if (buflen < label.len) -return -ERANGE ;return 0 ; }
fs/nfs/nfs4xdr.c +5 -1
@@ -4169,7 +4169,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,return -EIO ;if (len <NFS4_MAXLABELLEN ) {if (label) { -memcpy (label->label, p, len); +if (label->len) { +if (label->len < len) +return -ERANGE ; +memcpy (label->label, p, len); + } label->len = len; label->pi = pi; label->lfs = lfs;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 132/152 fs/minix: set s_maxbytes correctly
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit 32ac86efff91a3e4ef8c3d1cadd4559e23c8e73a ]
The minix filesystem leaves super_block::s_maxbytes at MAX_NON_LFS rather than setting it to the actual filesystem-specific limit. This is broken because it means userspace doesn't see the standard behavior like getting EFBIG and SIGXFSZ when exceeding the maximum file size.
Fix this by setting s_maxbytes correctly.
--- fs/minix/inode.c | 12 +++++++----- fs/minix/itree_v1.c | 2 +- fs/minix/itree_v2.c | 3 +-- fs/minix/minix.h | 1 - 4 files changed, 9 insertions(+), 9 deletions(-)
fs/minix/inode.c +7 -5
@@ -150,8 +150,10 @@ static int minix_remount (struct super_block * sb, int * flags, char * data)return 0 ; } -static bool minix_check_superblock (struct minix_sb_info *sbi) +static bool minix_check_superblock (struct super_block *sb) { +struct minix_sb_info *sbi =minix_sb (sb); +if (sbi->s_imap_blocks ==0 || sbi->s_zmap_blocks ==0 )return false;
@@ -161,7 +163,7 @@ static bool minix_check_superblock(struct minix_sb_info *sbi)* of indirect blocks which places the limit well above U32_MAX. */ if (sbi->s_version ==MINIX_V1 && - sbi->s_max_size > (7 +512 +512 *512 ) *BLOCK_SIZE ) + sb->s_maxbytes > (7 +512 +512 *512 ) *BLOCK_SIZE )return false;return true;
@@ -202,7 +204,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) sbi->s_zmap_blocks = ms->s_zmap_blocks; sbi->s_firstdatazone = ms->s_firstdatazone; sbi->s_log_zone_size = ms->s_log_zone_size; - sbi->s_max_size = ms->s_max_size; + s->s_maxbytes = ms->s_max_size; s->s_magic = ms->s_magic;if (s->s_magic ==MINIX_SUPER_MAGIC ) { sbi->s_version =MINIX_V1 ;
@@ -233,7 +235,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) sbi->s_zmap_blocks = m3s->s_zmap_blocks; sbi->s_firstdatazone = m3s->s_firstdatazone; sbi->s_log_zone_size = m3s->s_log_zone_size; - sbi->s_max_size = m3s->s_max_size; + s->s_maxbytes = m3s->s_max_size; sbi->s_ninodes = m3s->s_ninodes; sbi->s_nzones = m3s->s_zones; sbi->s_dirsize =64 ;
@@ -245,7 +247,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) }else goto out_no_fs; -if (!minix_check_superblock (sbi)) +if (!minix_check_superblock (s)) goto out_illegal_sb;/*
fs/minix/itree_v1.c +1 -1
@@ -29,7 +29,7 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])if (block <0 ) {printk ("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n" , block, inode->i_sb->s_bdev); - }else if (block >= (minix_sb (inode->i_sb)->s_max_size/BLOCK_SIZE )) { + }else if (block >= inode->i_sb->s_maxbytes/BLOCK_SIZE ) {if (printk_ratelimit ()) printk("MINIX-fs: block_to_path: " "block %ld too big on dev %pg\n",
fs/minix/itree_v2.c +1 -2
@@ -32,8 +32,7 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])if (block <0 ) {printk ("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n" , block, sb->s_bdev); - }else if ((u64 )block * (u64 )sb->s_blocksize >= -minix_sb (sb)->s_max_size) { + }else if ((u64 )block * (u64 )sb->s_blocksize >= sb->s_maxbytes) {if (printk_ratelimit ()) printk("MINIX-fs: block_to_path: " "block %ld too big on dev %pg\n",
fs/minix/minix.h +0 -1
@@ -32,7 +32,6 @@ struct minix_sb_info {unsigned long s_zmap_blocks;unsigned long s_firstdatazone;unsigned long s_log_zone_size; -unsigned long s_max_size;int s_dirsize;int s_namelen;struct buffer_head ** s_imap;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 133/152 fs/minix: fix block limit check for V1 filesystems
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit 0a12c4a8069607247cb8edc3b035a664e636fd9a ]
The minix filesystem reads its maximum file size from its on-disk superblock. This value isn't necessarily a multiple of the block size. When it's not, the V1 block mapping code doesn't allow mapping the last possible block. Commit 6ed6a722f9ab ("minixfs: fix block limit check") fixed this in the V2 mapping code. Fix it in the V1 mapping code too.
--- fs/minix/itree_v1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/minix/itree_v1.c +1 -1
@@ -29,7 +29,7 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])if (block <0 ) {printk ("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n" , block, inode->i_sb->s_bdev); - }else if (block >= inode->i_sb->s_maxbytes/BLOCK_SIZE ) { + }else if ((u64 )block *BLOCK_SIZE >= inode->i_sb->s_maxbytes) {if (printk_ratelimit ()) printk("MINIX-fs: block_to_path: " "block %ld too big on dev %pg\n",
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 134/152 fs/minix: remove expected error message in block_to_path()
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit f666f9fb9a36f1c833b9d18923572f0e4d304754 ]
When truncating a file to a size within the last allowed logical block, block_to_path() is called with the *next* block. This exceeds the limit, causing the "block %ld too big" error message to be printed.
This case isn't actually an error; there are just no more blocks past that point. So, remove this error message.
--- fs/minix/itree_v1.c | 12 ++++++------ fs/minix/itree_v2.c | 12 ++++++------ 2 files changed, 12 insertions(+), 12 deletions(-)
fs/minix/itree_v1.c +6 -6
@@ -29,12 +29,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])if (block <0 ) {printk ("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n" , block, inode->i_sb->s_bdev); - }else if ((u64 )block *BLOCK_SIZE >= inode->i_sb->s_maxbytes) { -if (printk_ratelimit ()) -printk ("MINIX-fs: block_to_path: " -"block %ld too big on dev %pg\n" , - block, inode->i_sb->s_bdev); - }else if (block <7 ) { +return 0 ; + } +if ((u64 )block *BLOCK_SIZE >= inode->i_sb->s_maxbytes) +return 0 ; + +if (block <7 ) { offsets[n++] = block; }else if ((block -=7 ) <512 ) { offsets[n++] =7 ;
fs/minix/itree_v2.c +6 -6
@@ -32,12 +32,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])if (block <0 ) {printk ("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n" , block, sb->s_bdev); - }else if ((u64 )block * (u64 )sb->s_blocksize >= sb->s_maxbytes) { -if (printk_ratelimit ()) -printk ("MINIX-fs: block_to_path: " -"block %ld too big on dev %pg\n" , - block, sb->s_bdev); - }else if (block <DIRCOUNT ) { +return 0 ; + } +if ((u64 )block * (u64 )sb->s_blocksize >= sb->s_maxbytes) +return 0 ; + +if (block <DIRCOUNT ) { offsets[n++] = block; }else if ((block -=DIRCOUNT ) <INDIRCOUNT (sb)) { offsets[n++] =DIRCOUNT ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 135/152 fs/ufs: avoid potential u32 multiplication overflow
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 88b2e9b06381551b707d980627ad0591191f7a2d ]
The 64 bit ino is being compared to the product of two u32 values, however, the multiplication is being performed using a 32 bit multiply so there is a potential of an overflow. To be fully safe, cast uspi->s_ncg to a u64 to ensure a 64 bit multiplication occurs to avoid any chance of overflow.
Addresses-Coverity: ("Unintentional integer overflow")
--- fs/ufs/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ufs/super.c +1 -1
@@ -101,7 +101,7 @@ static struct inode *ufs_nfs_get_inode(struct super_block *sb, u64 ino, u32 genestruct ufs_sb_private_info *uspi =UFS_SB (sb)->s_uspi;struct inode *inode; -if (ino <UFS_ROOTINO || ino > uspi->s_ncg * uspi->s_ipg) +if (ino <UFS_ROOTINO || ino > (u64 )uspi->s_ncg * uspi->s_ipg)return ERR_PTR (-ESTALE ); inode =ufs_iget (sb, ino);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 136/152 test_kmod: avoid potential double free in trigger_config_run_type()
In reply to Greg Kroah-HartmanFrom: Tiezhu Yang <[email protected]>
[ Upstream commit 0776d1231bec0c7ab43baf440a3f5ef5f49dd795 ]
Reset the member "test_fs" of the test configuration after a call of the function "kfree_const" to a null pointer so that a double memory release will not be performed.
--- lib/test_kmod.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/test_kmod.c +1 -1
@@ -745,7 +745,7 @@ static int trigger_config_run_type(struct kmod_test_device *test_dev,break ;case TEST_KMOD_FS_TYPE :kfree_const (config->test_fs); - config->test_driver =NULL ; + config->test_fs =NULL ; copied =config_copy_test_fs (config, test_str,strlen (test_str));break ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 137/152 i2c: iproc: fix race between client unreg and isr
In reply to Greg Kroah-HartmanFrom: Dhananjay Phadke <[email protected]>
[ Upstream commit b1eef236f50ba6afea680da039ef3a2ca9c43d11 ]
When i2c client unregisters, synchronize irq before setting iproc_i2c->slave to NULL.
(1) disable_irq()
(2) Mask event enable bits in control reg
(3) Erase slave address (avoid further writes to rx fifo)
(4) Flush tx and rx FIFOs
(5) Clear pending event (interrupt) bits in status reg
(6) enable_irq()
(7) Set client pointer to NULL
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000318
[ 371.020421] pc : bcm_iproc_i2c_isr+0x530/0x11f0 [ 371.025098] lr : __handle_irq_event_percpu+0x6c/0x170 [ 371.030309] sp : ffff800010003e40 [ 371.033727] x29: ffff800010003e40 x28: 0000000000000060 [ 371.039206] x27: ffff800010ca9de0 x26: ffff800010f895df [ 371.044686] x25: ffff800010f18888 x24: ffff0008f7ff3600 [ 371.050165] x23: 0000000000000003 x22: 0000000001600000 [ 371.055645] x21: ffff800010f18888 x20: 0000000001600000 [ 371.061124] x19: ffff0008f726f080 x18: 0000000000000000 [ 371.066603] x17: 0000000000000000 x16: 0000000000000000 [ 371.072082] x15: 0000000000000000 x14: 0000000000000000 [ 371.077561] x13: 0000000000000000 x12: 0000000000000001 [ 371.083040] x11: 0000000000000000 x10: 0000000000000040 [ 371.088519] x9 : ffff800010f317c8 x8 : ffff800010f317c0 [ 371.093999] x7 : ffff0008f805b3b0 x6 : 0000000000000000 [ 371.099478] x5 : ffff0008f7ff36a4 x4 : ffff8008ee43d000 [ 371.104957] x3 : 0000000000000000 x2 : ffff8000107d64c0 [ 371.110436] x1 : 00000000c00000af x0 : 0000000000000000
[ 371.115916] Call trace: [ 371.118439] bcm_iproc_i2c_isr+0x530/0x11f0 [ 371.122754] __handle_irq_event_percpu+0x6c/0x170 [ 371.127606] handle_irq_event_percpu+0x34/0x88 [ 371.132189] handle_irq_event+0x40/0x120 [ 371.136234] handle_fasteoi_irq+0xcc/0x1a0 [ 371.140459] generic_handle_irq+0x24/0x38 [ 371.144594] __handle_domain_irq+0x60/0xb8 [ 371.148820] gic_handle_irq+0xc0/0x158 [ 371.152687] el1_irq+0xb8/0x140 [ 371.155927] arch_cpu_idle+0x10/0x18 [ 371.159615] do_idle+0x204/0x290 [ 371.162943] cpu_startup_entry+0x24/0x60 [ 371.166990] rest_init+0xb0/0xbc [ 371.170322] arch_call_rest_init+0xc/0x14 [ 371.174458] start_kernel+0x404/0x430
--- drivers/i2c/busses/i2c-bcm-iproc.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-bcm-iproc.c +12 -1
@@ -1037,7 +1037,7 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave)if (!iproc_i2c->slave)return -EINVAL ; - iproc_i2c->slave =NULL ; +disable_irq (iproc_i2c->irq);/* disable all slave interrupts */ tmp =iproc_i2c_rd_reg (iproc_i2c,IE_OFFSET );
@@ -1050,6 +1050,17 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave) tmp &= ~BIT (S_CFG_EN_NIC_SMB_ADDR3_SHIFT );iproc_i2c_wr_reg (iproc_i2c,S_CFG_SMBUS_ADDR_OFFSET , tmp); +/* flush TX/RX FIFOs */ + tmp = (BIT (S_FIFO_RX_FLUSH_SHIFT ) |BIT (S_FIFO_TX_FLUSH_SHIFT )); +iproc_i2c_wr_reg (iproc_i2c,S_FIFO_CTRL_OFFSET , tmp); + +/* clear all pending slave interrupts */ +iproc_i2c_wr_reg (iproc_i2c,IS_OFFSET ,ISR_MASK_SLAVE ); + + iproc_i2c->slave =NULL ; + +enable_irq (iproc_i2c->irq); +return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 138/152 mfd: dln2: Run event handler loop under spinlock
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 3d858942250820b9adc35f963a257481d6d4c81d ]
The event handler loop must be run with interrupts disabled. Otherwise we will have a warning:
[ 1970.785649] irq 31 handler lineevent_irq_handler+0x0/0x20 enabled interrupts [ 1970.792739] WARNING: CPU: 0 PID: 0 at kernel/irq/handle.c:159 __handle_irq_event_percpu+0x162/0x170 [ 1970.860732] RIP: 0010:__handle_irq_event_percpu+0x162/0x170 ... [ 1970.946994] Call Trace: [ 1970.949446] <IRQ> [ 1970.951471] handle_irq_event_percpu+0x2c/0x80 [ 1970.955921] handle_irq_event+0x23/0x43 [ 1970.959766] handle_simple_irq+0x57/0x70 [ 1970.963695] generic_handle_irq+0x42/0x50 [ 1970.967717] dln2_rx+0xc1/0x210 [dln2] [ 1970.971479] ? usb_hcd_unmap_urb_for_dma+0xa6/0x1c0 [ 1970.976362] __usb_hcd_giveback_urb+0x77/0xe0 [ 1970.980727] usb_giveback_urb_bh+0x8e/0xe0 [ 1970.984837] tasklet_action_common.isra.0+0x4a/0xe0
...
Recently xHCI driver switched to tasklets in the commit 36dc01657b49 ("usb: host: xhci: Support running urb giveback in tasklet context").
The handle_irq_event_* functions are expected to be called with interrupts disabled and they rightfully complain here because we run in tasklet context with interrupts enabled.
Use a event spinlock to protect event handler from being interrupted.
Note, that there are only two users of this GPIO and ADC drivers and both of them are using generic_handle_irq() which makes above happen.
--- drivers/mfd/dln2.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/mfd/dln2.c +4 -0
@@ -287,7 +287,11 @@ static void dln2_rx(struct urb *urb) len = urb->actual_length -sizeof (struct dln2_header );if (handle ==DLN2_HANDLE_EVENT ) { +unsigned long flags; + +spin_lock_irqsave (&dln2->event_cb_lock, flags);dln2_run_event_callbacks (dln2, id, echo, data, len); +spin_unlock_irqrestore (&dln2->event_cb_lock, flags); }else {/* URB will be re-submitted in _dln2_transfer (free_rx_slot) */ if (dln2_transfer_complete (dln2, urb, handle, echo))
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 139/152 crypto: algif_aead - fix uninitialized ctx->init
In reply to Greg Kroah-HartmanFrom: Ondrej Mosnacek <[email protected]>
[ Upstream commit 21dfbcd1f5cbff9cf2f9e7e43475aed8d072b0dd ]
In skcipher_accept_parent_nokey() the whole af_alg_ctx structure is cleared by memset() after allocation, so add such memset() also to aead_accept_parent_nokey() so that the new "init" field is also initialized to zero. Without that the initial ctx->init checks might randomly return true and cause errors.
While there, also remove the redundant zero assignments in both functions.
Found via libkcapi testsuite.
--- crypto/algif_aead.c | 6 ------ crypto/algif_skcipher.c | 7 +------ 2 files changed, 1 insertion(+), 12 deletions(-)
crypto/algif_aead.c +0 -6
@@ -558,12 +558,6 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk)INIT_LIST_HEAD (&ctx->tsgl_list); ctx->len = len; - ctx->used =0 ; -atomic_set (&ctx->rcvused,0 ); - ctx->more =0 ; - ctx->merge =0 ; - ctx->enc =0 ; - ctx->aead_assoclen =0 ;crypto_init_wait (&ctx->wait); ask->private = ctx;
crypto/algif_skcipher.c +1 -6
@@ -333,6 +333,7 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) ctx =sock_kmalloc (sk, len,GFP_KERNEL );if (!ctx)return -ENOMEM ; +memset (ctx,0 , len); ctx->iv =sock_kmalloc (sk,crypto_skcipher_ivsize (tfm),GFP_KERNEL );
@@ -340,16 +341,10 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk)sock_kfree_s (sk, ctx, len);return -ENOMEM ; } -memset (ctx->iv,0 ,crypto_skcipher_ivsize (tfm));INIT_LIST_HEAD (&ctx->tsgl_list); ctx->len = len; - ctx->used =0 ; -atomic_set (&ctx->rcvused,0 ); - ctx->more =0 ; - ctx->merge =0 ; - ctx->enc =0 ;crypto_init_wait (&ctx->wait); ask->private = ctx;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 140/152 ALSA: echoaudio: Fix potential Oops in snd_echo_resume()
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit 5a25de6df789cc805a9b8ba7ab5deef5067af47e ]
Freeing chip on error may lead to an Oops at the next time the system goes to resume. Fix this by removing all snd_echo_free() calls on error.
--- sound/pci/echoaudio/echoaudio.c | 2 -- 1 file changed, 2 deletions(-)
sound/pci/echoaudio/echoaudio.c +0 -2
@@ -2198,7 +2198,6 @@ static int snd_echo_resume(struct device *dev)if (err <0 ) {kfree (commpage_bak);dev_err (dev,"resume init_hw err=%d\n" , err); -snd_echo_free (chip);return err; }
@@ -2225,7 +2224,6 @@ static int snd_echo_resume(struct device *dev)if (request_irq (pci->irq, snd_echo_interrupt,IRQF_SHARED ,KBUILD_MODNAME , chip)) {dev_err (chip->card->dev,"cannot grab irq\n" ); -snd_echo_free (chip);return -EBUSY ; } chip->irq = pci->irq;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 141/152 perf bench mem: Always memset source before memcpy
In reply to Greg Kroah-HartmanFrom: Vincent Whitchurch <[email protected]>
[ Upstream commit 1beaef29c34154ccdcb3f1ae557f6883eda18840 ]
For memcpy, the source pages are memset to zero only when --cycles is used. This leads to wildly different results with or without --cycles, since all sources pages are likely to be mapped to the same zero page without explicit writes.
Before this fix:
$ export cmd="./perf stat -e LLC-loads -- ./perf bench \ mem memcpy -s 1024MB -l 100 -f default" $ $cmd
2,935,826 LLC-loads
3.821677452 seconds time elapsed$ $cmd --cycles
217,533,436 LLC-loads
8.616725985 seconds time elapsedAfter this fix:
$ $cmd
214,459,686 LLC-loads
8.674301124 seconds time elapsed$ $cmd --cycles
214,758,651 LLC-loads
8.644480006 seconds time elapsed--- tools/perf/bench/mem-functions.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
tools/perf/bench/mem-functions.c +11 -10
@@ -223,12 +223,8 @@ static int bench_mem_common(int argc, const char **argv, struct bench_mem_info *return 0 ; } -static u64 do_memcpy_cycles (const struct function *r,size_t size,void *src,void *dst) +static void memcpy_prefault (memcpy_t fn,size_t size,void *src,void *dst) { -u64 cycle_start =0ULL , cycle_end =0ULL ; -memcpy_t fn = r->fn.memcpy; -int i; -/* Make sure to always prefault zero pages even if MMAP_THRESH is crossed: */ memset (src,0 , size);
@@ -237,6 +233,15 @@ static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, vo* to not measure page fault overhead: */ fn (dst, src, size); +} + +static u64 do_memcpy_cycles (const struct function *r,size_t size,void *src,void *dst) +{ +u64 cycle_start =0ULL , cycle_end =0ULL ; +memcpy_t fn = r->fn.memcpy; +int i; + +memcpy_prefault (fn, size, src, dst); cycle_start =get_cycles ();for (i =0 ; i < nr_loops; ++i)
@@ -252,11 +257,7 @@ static double do_memcpy_gettimeofday(const struct function *r, size_t size, voidmemcpy_t fn = r->fn.memcpy;int i; -/* -* We prefault the freshly allocated memory range here, -* to not measure page fault overhead: -*/ -fn (dst, src, size); +memcpy_prefault (fn, size, src, dst);BUG_ON (gettimeofday (&tv_start,NULL ));for (i =0 ; i < nr_loops; ++i)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 142/152 tools build feature: Quote CC and CXX for their arguments
In reply to Greg Kroah-HartmanFrom: Daniel Díaz <[email protected]>
[ Upstream commit fa5c893181ed2ca2f96552f50073786d2cfce6c0 ]
When using a cross-compilation environment, such as OpenEmbedded, the CC an CXX variables are set to something more than just a
command: there are arguments (such as --sysroot) that need to be passed on to the compiler so that the right set of headers and libraries are used.
For the particular case that our systems detected, CC is set to the following:
export CC="aarch64-linaro-linux-gcc --sysroot=/oe/build/tmp/work/machine/perf/1.0-r9/recipe-sysroot"
Without quotes, detection is as follows:
Auto-detecting system features:
... dwarf: [ OFF ]
... dwarf_getlocations: [ OFF ]
... glibc: [ OFF ]
... gtk2: [ OFF ]
... libbfd: [ OFF ] ... libcap: [ OFF ] ... libelf: [ OFF ] ... libnuma: [ OFF ] ... numa_num_possible_cpus: [ OFF ] ... libperl: [ OFF ] ... libpython: [ OFF ] ... libcrypto: [ OFF ] ... libunwind: [ OFF ]
... libdw-dwarf-unwind: [ OFF ]
... zlib: [ OFF ]
... lzma: [ OFF ]
... get_cpuid: [ OFF ]
... bpf: [ OFF ]
... libaio: [ OFF ]
... libzstd: [ OFF ]
... disassembler-four-args: [ OFF ]
Makefile.config:414: *** No gnu/libc-version.h found, please install glibc-dev[el]. Stop. Makefile.perf:230: recipe for target 'sub-make' failed
make[1]: *** [sub-make] Error 2
Makefile:69: recipe for target 'all' failed
make: *** [all] Error 2
With CC and CXX quoted, some of those features are now detected.
--- tools/build/Makefile.feature | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/build/Makefile.feature +1 -1
@@ -8,7 +8,7 @@ endif feature_check = $(eval $(feature_check_code)) define feature_check_code - feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC=$(CC) CXX=$(CXX) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) + feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC="$(CC)" CXX="$(CXX)" CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) endef feature_set = $(eval $(feature_set_code))
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 143/152 perf/x86/rapl: Fix missing psys sysfs attributes
In reply to Greg Kroah-HartmanFrom: Zhang Rui <[email protected]>
[ Upstream commit 4bb5fcb97a5df0bbc0a27e0252b1e7ce140a8431 ]
This fixes a problem introduced by commit:
5fb5273a905c ("perf/x86/rapl: Use new MSR detection interface")
that perf event sysfs attributes for psys RAPL domain are missing.
--- arch/x86/events/rapl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/events/rapl.c +1 -1
@@ -642,7 +642,7 @@ static const struct attribute_group *rapl_attr_update[] = { &rapl_events_pkg_group, &rapl_events_ram_group, &rapl_events_gpu_group, - &rapl_events_gpu_group, + &rapl_events_psys_group, NULL, };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 144/152 sh: landisk: Add missing initialization of sh_io_port_base
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 0c64a0dce51faa9c706fdf1f957d6f19878f4b81 ]
The Landisk setup code maps the CF IDE area using ioremap_prot(), and passes the resulting virtual addresses to the pata_platform driver, disguising them as I/O port addresses. Hence the pata_platform driver translates them again using ioport_map().
As CONFIG_GENERIC_IOMAP=n, and CONFIG_HAS_IOPORT_MAP=y, the SuperH-specific mapping code in arch/sh/kernel/ioport.c translates I/O port addresses to virtual addresses by adding sh_io_port_base, which defaults to -1, thus breaking the assumption of an identity mapping.
Fix this by setting sh_io_port_base to zero.
--- arch/sh/boards/mach-landisk/setup.c | 3 +++ 1 file changed, 3 insertions(+)
arch/sh/boards/mach-landisk/setup.c +3 -0
@@ -82,6 +82,9 @@ device_initcall(landisk_devices_setup);static void __init landisk_setup (char **cmdline_p) { +/* I/O port identity mapping */ +__set_io_port_base (0 ); +/* LED ON */ __raw_writeb (__raw_readb (PA_LED ) |0x03 ,PA_LED );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 145/152 khugepaged: retract_page_tables() remember to test exit
In reply to Greg Kroah-HartmanFrom: Hugh Dickins <[email protected]>
commit 18e77600f7a1ed69f8ce46c9e11cad0985712dfa upstream.
Only once have I seen this scenario (and forgot even to notice what forced the eventual crash): a sequence of "BUG: Bad page map" alerts from vm_normal_page(), from zap_pte_range() servicing exit_mmap(); pmd:00000000, pte values corresponding to data in physical page 0.
The pte mappings being zapped in this case were supposed to be from a huge page of ext4 text (but could as well have been shmem): my belief is that it was racing with collapse_file()'s retract_page_tables(), found *pmd pointing to a page table, locked it, but *pmd had become 0 by the time start_pte was decided.
In most cases, that possibility is excluded by holding mmap lock; but exit_mmap() proceeds without mmap lock. Most of what's run by khugepaged checks khugepaged_test_exit() after acquiring mmap lock:khugepaged_collapse_pte_mapped_thps() and hugepage_vma_revalidate() do so, for example. But retract_page_tables() did not: fix that.
The fix is for retract_page_tables() to check khugepaged_test_exit(), after acquiring mmap lock, before doing anything to the page table. Getting the mmap lock serializes with __mmput(), which briefly takes and drops it in __khugepaged_exit(); then the khugepaged_test_exit() check on mm_users makes sure we don't touch the page table once exit_mmap() might reach it, since exit_mmap() will be proceeding without mmap lock, not expecting anyone to be racing with it.
--- mm/khugepaged.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-)
mm/khugepaged.c +14 -10
@@ -1414,6 +1414,7 @@ out:static void retract_page_tables (struct address_space *mapping,pgoff_t pgoff) {struct vm_area_struct *vma; +struct mm_struct *mm;unsigned long addr;pmd_t *pmd, _pmd;
@@ -1442,7 +1443,8 @@ static void retract_page_tables(struct acontinue ;if (vma->vm_end < addr +HPAGE_PMD_SIZE )continue ; - pmd =mm_find_pmd (vma->vm_mm, addr); + mm = vma->vm_mm; + pmd =mm_find_pmd (mm, addr);if (!pmd)continue ;/*
@@ -1452,17 +1454,19 @@ static void retract_page_tables(struct a* mmap_sem while holding page lock. Fault path does it in * reverse order. Trylock is a way to avoid deadlock. */ -if (down_write_trylock (&vma->vm_mm->mmap_sem)) { -spinlock_t *ptl =pmd_lock (vma->vm_mm, pmd); -/* assume page table is clear */ - _pmd =pmdp_collapse_flush (vma, addr, pmd); -spin_unlock (ptl); -up_write (&vma->vm_mm->mmap_sem); -mm_dec_nr_ptes (vma->vm_mm); -pte_free (vma->vm_mm,pmd_pgtable (_pmd)); +if (down_write_trylock (&mm->mmap_sem)) { +if (!khugepaged_test_exit (mm)) { +spinlock_t *ptl =pmd_lock (mm, pmd); +/* assume page table is clear */ + _pmd =pmdp_collapse_flush (vma, addr, pmd); +spin_unlock (ptl); +mm_dec_nr_ptes (mm); +pte_free (mm,pmd_pgtable (_pmd)); + } +up_write (&mm->mmap_sem); }else {/* Try again later */ -khugepaged_add_pte_mapped_thp (vma->vm_mm, addr); +khugepaged_add_pte_mapped_thp (mm, addr); } }i_mmap_unlock_write (mapping);
Greg Kroah-Hartman
maintainerPATCH 146/152 arm64: dts: marvell: espressobin: add ethernet alias
In reply to Greg Kroah-HartmanFrom: Tomasz Maciej Nowak <[email protected]>
commit 5253cb8c00a6f4356760efb38bca0e0393aa06de upstream.
The maker of this board and its variants, stores MAC address in U-Boot environment. Add alias for bootloader to recognise, to which ethernet node inject the factory MAC address.
--- arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts +6 -0
@@ -19,6 +19,12 @@ model = "Globalscale Marvell ESPRESSOBin Board"; compatible = "globalscale,espressobin", "marvell,armada3720", "marvell,armada3710"; + aliases { + ethernet0 = ð0; + serial0 = &uart0; + serial1 = &uart1; + }; + chosen { stdout-path = "serial0:115200n8"; };
Greg Kroah-Hartman
maintainerPATCH 147/152 drm/radeon: fix fb_div check in ni_init_smc_spll_table()
In reply to Greg Kroah-HartmanFrom: Denis Efremov <[email protected]>
commit f29aa08852e1953e461f2d47ab13c34e14bc08b3 upstream.
clk_s is checked twice in a row in ni_init_smc_spll_table(). fb_div should be checked instead.
--- drivers/gpu/drm/radeon/ni_dpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/radeon/ni_dpm.c +1 -1
@@ -2125,7 +2125,7 @@ static int ni_init_smc_spll_table(structif (p_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_PDIV_MASK >>SMC_NISLANDS_SPLL_DIV_TABLE_PDIV_SHIFT )) ret = -EINVAL ; -if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >>SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT )) +if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >>SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT )) ret = -EINVAL ;if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >>SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT ))
Greg Kroah-Hartman
maintainerPATCH 148/152 drm/panfrost: Use kvfree() to free bo->sgts
In reply to Greg Kroah-HartmanFrom: Denis Efremov <[email protected]>
commit 114427b8927a4def2942b2b886f7e4aeae289ccb upstream.
Use kvfree() to free bo->sgts, because the memory is allocated with kvmalloc_array() in panfrost_mmu_map_fault_addr().
--- drivers/gpu/drm/panfrost/panfrost_gem.c | 2 +- drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/panfrost/panfrost_gem.c +1 -1
@@ -46,7 +46,7 @@ static void panfrost_gem_free_object(strsg_free_table (&bo->sgts[i]); } } -kfree (bo->sgts); +kvfree (bo->sgts); }drm_gem_shmem_free_object (obj);
drivers/gpu/drm/panfrost/panfrost_mmu.c +1 -1
@@ -486,7 +486,7 @@ static int panfrost_mmu_map_fault_addr(s pages =kvmalloc_array (bo->base.base.size >>PAGE_SHIFT ,sizeof (struct page *),GFP_KERNEL | __GFP_ZERO);if (!pages) { -kfree (bo->sgts); +kvfree (bo->sgts); bo->sgts =NULL ;mutex_unlock (&bo->base.pages_lock); ret = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 149/152 drm: Added orientation quirk for ASUS tablet model T103HAF
In reply to Greg Kroah-HartmanFrom: Marius Iacob <[email protected]>
commit b5ac98cbb8e5e30c34ebc837d1e5a3982d2b5f5c upstream.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +6 -0
@@ -121,6 +121,12 @@ static const struct dmi_system_id orient DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T101HA"), }, .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* Asus T103HAF */ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, }, { /* GPD MicroPC (generic strings, also match on bios date) */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
Greg Kroah-Hartman
maintainerPATCH 150/152 drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
In reply to Greg Kroah-HartmanFrom: Xin Xiong <[email protected]>
commit a34a0a632dd991a371fec56431d73279f9c54029 upstream.
drm_dp_mst_allocate_vcpi() invokes drm_dp_mst_topology_get_port_validated(), which increases the refcount of the "port".
These reference counting issues take place in two exception handling paths separately. Either when “slots” is less than 0 or when drm_dp_init_vcpi() returns a negative value, the function forgets to reduce the refcnt increased drm_dp_mst_topology_get_port_validated(), which results in a refcount leak.
Fix these issues by pulling up the error handling when "slots" is less than 0, and calling drm_dp_mst_topology_put_port() before termination when drm_dp_init_vcpi() returns a negative value.
--- drivers/gpu/drm/drm_dp_mst_topology.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/drm_dp_mst_topology.c +4 -3
@@ -3369,11 +3369,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm {int ret; - port =drm_dp_mst_topology_get_port_validated (mgr, port); -if (!port) +if (slots <0 )return false; -if (slots <0 ) + port =drm_dp_mst_topology_get_port_validated (mgr, port); +if (!port)return false;if (port->vcpi.vcpi >0 ) {
@@ -3389,6 +3389,7 @@ bool drm_dp_mst_allocate_vcpi(struct drmif (ret) {DRM_DEBUG_KMS ("failed to init vcpi slots=%d max=63 ret=%d\n" ,DIV_ROUND_UP (pbn, mgr->pbn_div), ret); +drm_dp_mst_topology_put_port (port); goto out; } DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n",
Greg Kroah-Hartman
maintainerPATCH 151/152 drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume
In reply to Greg Kroah-HartmanFrom: Sandeep Raghuraman <[email protected]>
commit f87812284172a9809820d10143b573d833cd3f75 upstream.
Reproducing bug report here:
After hibernating and resuming, DPM is not enabled. This remains the case even if you test hibernate using the steps here:
https://www.kernel.org/doc/html/latest/power/basic-pm-debugging.html
I debugged the problem, and figured out that in the file hardwaremanager.c,
in the function, phm_enable_dynamic_state_management(), the check
'if (!hwmgr->pp_one_vf && smum_is_dpm_running(hwmgr) && !amdgpu_passthrough(adev) && adev->in_suspend)' returns true for the hibernate case, and false for the suspend case.
This means that for the hibernate case, the AMDGPU driver doesn't enable DPM (even though it should) and simply returns from that function.
In the suspend case, it goes ahead and enables DPM, even though it doesn't need to.
I debugged further, and found out that in the case of suspend, for the CIK/Hawaii GPUs, smum_is_dpm_running(hwmgr) returns false, while in the case of hibernate, smum_is_dpm_running(hwmgr) returns true.
For CIK, the ci_is_dpm_running() function calls the ci_is_smc_ram_running() function, which is ultimately used to determine if DPM is currently enabled or not, and this seems to provide the wrong answer.
I've changed the ci_is_dpm_running() function to instead use the same method that some other AMD GPU chips do (e.g Fiji), which seems to read the voltage controller. I've tested on my R9 390 and it seems to work correctly for both suspend and hibernate use cases, and has been stable so far.
--- drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +4 -1
@@ -2725,7 +2725,10 @@ static int ci_initialize_mc_reg_table(ststatic bool ci_is_dpm_running (struct pp_hwmgr *hwmgr) { -return ci_is_smc_ram_running (hwmgr); +return (1 ==PHM_READ_INDIRECT_FIELD (hwmgr->device, +CGS_IND_REG__SMC ,FEATURE_STATUS , +VOLTAGE_CONTROLLER_ON )) + ? true : false; }static int ci_smu_init (struct pp_hwmgr *hwmgr)
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.60 release. There are 152 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2020 09:15:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.60-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.4:
11 builds: 11 pass, 0 fail
26 boots: 26 pass, 0 fail
56 tests: 56 pass, 0 failLinux version: 5.4.60-rc1-g6793ee834d88
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Greg Kroah-Hartman
maintainerPATCH 152/152 drm/amd/display: dchubbub p-state warning during surface planes switch
In reply to Greg Kroah-HartmanFrom: hersen wu <[email protected]>
commit 8b0379a85762b516c7b46aed7dbf2a4947c00564 upstream.
[Why]ramp_up_dispclk_with_dpp is to change dispclk, dppclk and dprefclk according to bandwidth requirement. call stack: rv1_update_clocks --> update_clocks --> dcn10_prepare_bandwidth / dcn10_optimize_bandwidth --> prepare_bandwidth / optimize_bandwidth. before change dcn hw, prepare_bandwidth will be called first to allow enough clock, watermark for change, after end of dcn hw change, optimize_bandwidth is executed to lower clock to save power for new dcn hw settings.
below is sequence of commit_planes_for_stream:
step 1: prepare_bandwidth - raise clock to have enough bandwidth step 2: lock_doublebuffer_enable
step 3: pipe_control_lock(true) - make dchubp register change will not take effect right way
step 4: apply_ctx_for_surface - program dchubp
step 5: pipe_control_lock(false) - dchubp register change take effect step 6: optimize_bandwidth --> dc_post_update_surfaces_to_stream for full_date, optimize clock to save power
at end of step 1, dcn clocks (dprefclk, dispclk, dppclk) may be changed for new dchubp configuration. but real dcn hub dchubps are still running with old configuration until end of step 5. this need clocks settings at step 1 should not less than that before step 1. this is checked by two conditions: 1. if (should_set_clock(safe_to_lower , new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) || new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz)
2. request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz
the second condition is based on new dchubp configuration. dppclk for new dchubp may be different from dppclk before step 1. for example, before step 1, dchubps are as below:
pipe 0: recout=(0,40,1920,980) viewport=(0,0,1920,979) pipe 1: recout=(0,0,1920,1080) viewport=(0,0,1920,1080) for dppclk for pipe0 need dppclk = dispclk
new dchubp pipe split configuration:
pipe 0: recout=(0,0,960,1080) viewport=(0,0,960,1080) pipe 1: recout=(960,0,960,1080) viewport=(960,0,960,1080) dppclk only needs dppclk = dispclk /2.
dispclk, dppclk are not lock by otg master lock. they take effect after step 1. during this transition, dispclk are the same, but dppclk is changed to half of previous clock for old dchubp configuration between step 1 and step 6. This may cause p-state warning intermittently.
[How]
for new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz, we need make sure dppclk are not changed to less between step 1 and 6. for new_clocks->dispclk_khz > clk_mgr_base->clks.dispclk_khz, new display clock is raised, but we do not know ratio of new_clocks->dispclk_khz and clk_mgr_base->clks.dispclk_khz, new_clocks->dispclk_khz /2 does not guarantee equal or higher than old dppclk. we could ignore power saving different between dppclk = displck and dppclk = dispclk / 2 between step 1 and step 6. as long as safe_to_lower = false, set dpclk = dispclk to simplify condition check.
--- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c | 69 ++++++++++++- 1 file changed, 67 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c +67 -2
@@ -85,12 +85,77 @@ static int rv1_determine_dppclk_thresholreturn disp_clk_threshold; } -static void ramp_up_dispclk_with_dpp (struct clk_mgr_internal *clk_mgr,struct dc *dc,struct dc_clocks *new_clocks) +static void ramp_up_dispclk_with_dpp ( +struct clk_mgr_internal *clk_mgr, +struct dc *dc, +struct dc_clocks *new_clocks, +bool safe_to_lower) {int i;int dispclk_to_dpp_threshold =rv1_determine_dppclk_threshold (clk_mgr, new_clocks);bool request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz; +/* this function is to change dispclk, dppclk and dprefclk according to +* bandwidth requirement. Its call stack is rv1_update_clocks --> +* update_clocks --> dcn10_prepare_bandwidth / dcn10_optimize_bandwidth +* --> prepare_bandwidth / optimize_bandwidth. before change dcn hw, +* prepare_bandwidth will be called first to allow enough clock, +* watermark for change, after end of dcn hw change, optimize_bandwidth +* is executed to lower clock to save power for new dcn hw settings. +* +* below is sequence of commit_planes_for_stream: +* +* step 1: prepare_bandwidth - raise clock to have enough bandwidth +* step 2: lock_doublebuffer_enable +* step 3: pipe_control_lock(true) - make dchubp register change will +* not take effect right way +* step 4: apply_ctx_for_surface - program dchubp +* step 5: pipe_control_lock(false) - dchubp register change take effect +* step 6: optimize_bandwidth --> dc_post_update_surfaces_to_stream +* for full_date, optimize clock to save power +* +* at end of step 1, dcn clocks (dprefclk, dispclk, dppclk) may be +* changed for new dchubp configuration. but real dcn hub dchubps are +* still running with old configuration until end of step 5. this need +* clocks settings at step 1 should not less than that before step 1. +* this is checked by two conditions: 1. if (should_set_clock(safe_to_lower +* , new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) || +* new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz) +* 2. request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz +* +* the second condition is based on new dchubp configuration. dppclk +* for new dchubp may be different from dppclk before step 1. +* for example, before step 1, dchubps are as below: +* pipe 0: recout=(0,40,1920,980) viewport=(0,0,1920,979) +* pipe 1: recout=(0,0,1920,1080) viewport=(0,0,1920,1080) +* for dppclk for pipe0 need dppclk = dispclk +* +* new dchubp pipe split configuration: +* pipe 0: recout=(0,0,960,1080) viewport=(0,0,960,1080) +* pipe 1: recout=(960,0,960,1080) viewport=(960,0,960,1080) +* dppclk only needs dppclk = dispclk /2. +* +* dispclk, dppclk are not lock by otg master lock. they take effect +* after step 1. during this transition, dispclk are the same, but +* dppclk is changed to half of previous clock for old dchubp +* configuration between step 1 and step 6. This may cause p-state +* warning intermittently. +* +* for new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz, we +* need make sure dppclk are not changed to less between step 1 and 6. +* for new_clocks->dispclk_khz > clk_mgr_base->clks.dispclk_khz, +* new display clock is raised, but we do not know ratio of +* new_clocks->dispclk_khz and clk_mgr_base->clks.dispclk_khz, +* new_clocks->dispclk_khz /2 does not guarantee equal or higher than +* old dppclk. we could ignore power saving different between +* dppclk = displck and dppclk = dispclk / 2 between step 1 and step 6. +* as long as safe_to_lower = false, set dpclk = dispclk to simplify +* condition check. +* todo: review this change for other asic. +**/ +if (!safe_to_lower) + request_dpp_div = false; +/* set disp clk to dpp clk threshold */ clk_mgr->funcs->set_dispclk (clk_mgr, dispclk_to_dpp_threshold);
@@ -206,7 +271,7 @@ static void rv1_update_clocks(struct clk/* program dispclk on = as a w/a for sleep resume clock ramping issues */ if (should_set_clock (safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) || new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz) { -ramp_up_dispclk_with_dpp (clk_mgr, dc, new_clocks); +ramp_up_dispclk_with_dpp (clk_mgr, dc, new_clocks, safe_to_lower); clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz; send_request_to_lower = true; }
Quoted 15 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.60 release. There are 152 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2020 09:15:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.60-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.
Quoted 6 lines
thanks,
greg k-h
Herbert Xu <[email protected]>
crypto:af_alg- Fix regression on empty requests
Results from Linaro’s test farm.
Regressions detected.
LTP crypto af_alg02 and cve-2017-17805 failed on stable-rc 5.4, 5.7 and 5.8 branches on arm, arm64, i386 and x86_64.
ltp-crypto-tests:
* af_alg02
ltp-cve-tests:
* cve-2017-17805
Summary
------------------------------------------------------------------------
kernel: 5.4.60-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-5.4.y
git commit: 6793ee834d88110102e15d8b341347c80c91a79b
git describe: v5.4.59-153-g6793ee834d88
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-5.4-oe/build/v5.4.59-153-g6793ee834d88
Regressions (compared to build v5.4.59)
------------------------------------------------------------------------
ltp-crypto-tests:
* af_alg02
ltp-cve-tests:
* cve-2017-17805
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 22 lines · Naresh Kamboju
Quoted 18 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.60 release. There are 152 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2020 09:15:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.60-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Quoted 8 lines
Quoted 2 lines
Herbert Xu <[email protected]>
crypto:af_alg- Fix regression on empty requestsResults from Linaro’s test farm.
Regressions detected.LTP crypto
af_alg02and cve-2017-17805 failed on stable-rc 5.4, 5.7 and 5.8 branches on arm, arm64, i386 andx86_64.
Apart from the reported LTP crypto test case problem all other results look good to me.
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 5.4.60
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-5.4.y
git commit: 77fcb48939fc863d9ba9d808fac9000959e937d3
git describe: v5.4.60
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-5.4-oe/build/v5.4.60
No regressions (compared to build v5.4.59)
No fixes (compared to build v5.4.59)
Ran 28522 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c
- hi6220-hikey
- i386
- juno-r2
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15
- x86
- x86-kasan
Test Suites
-----------
* build
* igt-gpu-tools
* install-android-platform-tools-r2600
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-dio-tests
* ltp-fs-tests
* ltp-io-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* ltp-commands-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-tracing-tests
* network-basic-tests
* v4l2-compliance
* ltp-cve-tests
* ltp-open-posix-tests
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.60 release. There are 152 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2020 09:15:09 +0000. Anything received after that time might be too late.
Build results:
total: 157 pass: 157 fail: 0 Qemu test results: total: 430 pass: 430 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.60 release. There are 152 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2020 09:15:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.60-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah