5.9.9-rc1 review
Subsystems (9)
Greg Kroah-Hartman
maintainercover 5.9.9-rc1 review
This is the start of the stable review cycle for the 5.9.9 release. There are 255 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Nov 2020 12:20:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.9.9-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.9.9-rc1
Boris Protopopov <[email protected]>
Convert trailing spaces and periods in path components
Mike Leach <[email protected]>
coresight: Fix uninitialised pointer bug in etm_setup_aux()
Linu Cherian <[email protected]>
coresight: etm: perf: Sink selection using sysfs is deprecated
Arnaldo Carvalho de Melo <[email protected]>
perf scripting python: Avoid declaring function pointers with a visibility attribute
Damien Le Moal <[email protected]>
null_blk: Fix scheduling in atomic with zoned mode
Christophe Leroy <[email protected]>
powerpc/603: Always fault when _PAGE_ACCESSED is not set
Stefano Brivio <[email protected]>
tunnels: Fix off-by-one in lower MTU bounds for ICMP/ICMPv6 replies
Paolo Abeni <[email protected]>
mptcp: provide rmem[0] limit
Parav Pandit <[email protected]>
devlink: Avoid overwriting port attributes of registered port
Wang Hai <[email protected]>
tipc: fix memory leak in tipc_topsrv_start()
Martin Schiller <[email protected]>
net/x25: Fix null-ptr-deref in x25_connect
Mao Wenan <[email protected]>
net: Update window_clamp if SOCK_RCVBUF is set
Alexander Lobakin <[email protected]>
net: udp: fix UDP header access on Fast/frag0 UDP GRO
Alexander Lobakin <[email protected]>
net: udp: fix IP header access and skb lookup on Fast/frag0 UDP GRO
Ursula Braun <[email protected]>
net/af_iucv: fix null pointer dereference on shutdown
Oliver Herms <[email protected]>
IPv6: Set SIT tunnel hard_header_len to zero
Alexander Lobakin <[email protected]>
ethtool: netlink: add missing netdev_features_change() call
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Take CPUFREQ_GOV_STRICT_TARGET into account
Rafael J. Wysocki <[email protected]>
cpufreq: Add strict_target to struct cpufreq_policy
Rafael J. Wysocki <[email protected]>
cpufreq: Introduce CPUFREQ_GOV_STRICT_TARGET
Rafael J. Wysocki <[email protected]>
cpufreq: Introduce governor flags
Stefano Stabellini <[email protected]>
swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb"
Coiby Xu <[email protected]>
pinctrl: amd: fix incorrect way to disable debounce filter
Coiby Xu <[email protected]>
pinctrl: amd: use higher precision for 512 RtcClk
J. Bruce Fields <[email protected]>
NFSv4.2: fix failure to unregister shrinker
Thomas Zimmermann <[email protected]>
drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[]
Venkata Sandeep Dhanalakota <[email protected]>
drm/i915: Correctly set SFC capability for video engines
Bhawanpreet Lakha <[email protected]>
drm/amd/display: Add missing pflip irq
Al Viro <[email protected]>
don't dump the threads that had been already exiting when zapped.
Yoshihiro Shimoda <[email protected]>
mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove
Yangbo Lu <[email protected]>
mmc: sdhci-of-esdhc: Handle pulse width detection erratum for more SoCs
Arnaud de Turckheim <[email protected]>
gpio: pcie-idio-24: Enable PEX8311 interrupts
Arnaud de Turckheim <[email protected]>
gpio: pcie-idio-24: Fix IRQ Enable Register value
Arnaud de Turckheim <[email protected]>
gpio: pcie-idio-24: Fix irq mask when masking
Damien Le Moal <[email protected]>
gpio: sifive: Fix SiFive gpio probe
Jens Axboe <[email protected]>
io_uring: round-up cq size before comparing with rounded sq size
Chen Zhou <[email protected]>
selinux: Fix error return code in sel_ib_pkey_sid_slow()
Naveen Krishna Chatradhi <[email protected]>
hwmon: (amd_energy) modify the visibility of the counters
Wengang Wang <[email protected]>
ocfs2: initialize ip_next_orphan
Mike Kravetz <[email protected]>
hugetlbfs: fix anon huge page migration race
Matteo Croce <[email protected]>
reboot: fix overflow parsing reboot cpu number
Matteo Croce <[email protected]>
Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint"
Jason Gunthorpe <[email protected]>
mm/gup: use unpin_user_pages() in __gup_longterm_locked()
Nicholas Piggin <[email protected]>
mm/vmscan: fix NR_ISOLATED_FILE corruption on 64-bit
Laurent Dufour <[email protected]>
mm/slub: fix panic in slab_alloc_node()
Zi Yan <[email protected]>
mm/compaction: stop isolation if too many pages are isolated and we have pages to migrate
Zi Yan <[email protected]>
mm/compaction: count pages and stop correctly during page isolation
Masami Hiramatsu <[email protected]>
bootconfig: Extend the magic check range to the preceding 3 bytes
Theodore Ts'o <[email protected]>
jbd2: fix up sparse warnings in checkpoint code
Dan Carpenter <[email protected]>
futex: Don't enable IRQs unconditionally in put_pi_state()
Alexander Usyskin <[email protected]>
mei: protect mei_cl_mtu from null dereference
Alexander Lobakin <[email protected]>
virtio: virtio_console: fix DMA memory allocation for rproc serial
Zhang Qilong <[email protected]>
xhci: hisilicon: fix refercence leak in xhci_histb_probe
Heikki Krogerus <[email protected]>
usb: typec: ucsi: Report power supply changes
Chris Brandt <[email protected]>
usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode
Geert Uytterhoeven <[email protected]>
Revert "usb: musb: convert to devm_platform_ioremap_resource_byname"
Shin'ichiro Kawasaki <[email protected]>
uio: Fix use-after-free in uio_unregister_device()
Petr Vorel <[email protected]>
loop: Fix occasional uevent drop
Christoph Hellwig <[email protected]>
block: add a return value to set_capacity_revalidate_and_notify
Jing Xiangfeng <[email protected]>
thunderbolt: Add the missed ida_simple_remove() in ring_request_msix()
Mika Westerberg <[email protected]>
thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services()
Samuel Thibault <[email protected]>
speakup: Fix clearing selection in safe context
Samuel Thibault <[email protected]>
speakup ttyio: Do not schedule() in ttyio_in_nowait
Samuel Thibault <[email protected]>
speakup: Fix var_id_t values and thus keymap
Andrew Jones <[email protected]>
KVM: arm64: Don't hide ID registers from userspace
Anand Jain <[email protected]>
btrfs: dev-replace: fail mount if we don't have replace item with target device
Josef Bacik <[email protected]>
btrfs: fix min reserved size calculation in merge_reloc_root
Dinghao Liu <[email protected]>
btrfs: ref-verify: fix memory leak in btrfs_ref_tree_mod
Matthew Wilcox (Oracle) <[email protected]>
btrfs: fix potential overflow in cluster_pages_for_defrag on 32bit arch
Joseph Qi <[email protected]>
ext4: unlock xattr_sem properly in ext4_inline_data_truncate()
Kaixu Xia <[email protected]>
ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA
Gao Xiang <[email protected]>
erofs: derive atime instead of leaving it empty
Gao Xiang <[email protected]>
erofs: fix setting up pcluster for temporary pages
Arnd Bergmann <[email protected]>
firmware: xilinx: fix out-of-bounds access
Peter Zijlstra <[email protected]>
perf: Fix event multiplexing for exclusive groups
Peter Zijlstra <[email protected]>
perf: Simplify group_sched_in()
Sagi Grimberg <[email protected]>
nvme: fix incorrect behavior when BLKROSET is called by the user
Sasha Levin <[email protected]>
nvme: freeze the queue over ->lba_shift updates
Christoph Hellwig <[email protected]>
nvme: factor out a nvme_configure_metadata helper
Peter Zijlstra <[email protected]>
perf: Fix get_recursion_context()
David Howells <[email protected]>
afs: Fix afs_write_end() when called with copied == 0 [ver #3]
Muchun Song <[email protected]>
mm: memcontrol: fix missing wakeup polling thread
Santosh Sivaraj <[email protected]>
kernel/watchdog: fix watchdog_allowed_mask not used warning
Anshuman Khandual <[email protected]>
arm64/mm: Validate hotplug range before creating linear mapping
Sven Van Asbroeck <[email protected]>
lan743x: fix use of uninitialized variable
Martin Willi <[email protected]>
vrf: Fix fast path output packet handling with async Netfilter rules
Chuck Lever <[email protected]>
NFS: Fix listxattr receive buffer size
Brad Campbell <[email protected]>
hwmon: (applesmc) Re-work SMC comms
Wang Hai <[email protected]>
cosa: Add missing kfree in error path of cosa_write
Rohit Maheshwari <[email protected]>
ch_ktls: tcb update fails sometimes
Rohit Maheshwari <[email protected]>
ch_ktls: Update cheksum information
Evan Nimmo <[email protected]>
of/address: Fix of_node memory leak in of_dma_is_coherent
Christoph Hellwig <[email protected]>
xfs: fix a missing unlock on error in xfs_fs_map_blocks
Sven Van Asbroeck <[email protected]>
lan743x: fix "BUG: invalid wait context" when setting rx mode
Darrick J. Wong <[email protected]>
xfs: fix brainos in the refcount scrubber's rmap fragment processor
Darrick J. Wong <[email protected]>
xfs: fix rmap key and record comparison functions
Darrick J. Wong <[email protected]>
xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents
Darrick J. Wong <[email protected]>
xfs: fix flags argument to rmap lookup when converting shared file rmaps
Heiner Kallweit <[email protected]>
net: phy: realtek: support paged operations on RTL8201CP
Sven Van Asbroeck <[email protected]>
lan743x: correctly handle chips with internal PHY
Vinicius Costa Gomes <[email protected]>
igc: Fix returning wrong statistics
Slawomir Laba <[email protected]>
i40e: Fix MAC address setting for a VF via Host/VM
Vlad Buslov <[email protected]>
selftest: fix flower terse dump tests
Christoph Hellwig <[email protected]>
nbd: fix a block_device refcount leak in nbd_release
Bjorn Andersson <[email protected]>
pinctrl: qcom: sm8250: Specify PDC map
Maulik Shah <[email protected]>
pinctrl: qcom: Move clearing pending IRQ to .irq_request_resources callback
Heiner Kallweit <[email protected]>
r8169: disable hw csum for short packets on all chip versions
Heiner Kallweit <[email protected]>
r8169: fix potential skb double free in an error path
David Verbeiren <[email protected]>
bpf: Zero-fill re-used per-cpu map element
Lorenz Bauer <[email protected]>
tools/bpftool: Fix attaching flow dissector
Dai Ngo <[email protected]>
NFSD: fix missing refcount in nfsd4_copy by nfsd4_do_async_copy
Dai Ngo <[email protected]>
NFSD: Fix use-after-free warning when doing inter-server copy
Chuck Lever <[email protected]>
SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow()
Maxim Mikityanskiy <[email protected]>
net/mlx5e: Fix incorrect access of RCU-protected xdp_prog
Aya Levin <[email protected]>
net/mlx5e: Fix VXLAN synchronization after function reload
Parav Pandit <[email protected]>
net/mlx5: E-switch, Avoid extack error log for disabled vport
Maor Gottlieb <[email protected]>
net/mlx5: Fix deletion of duplicate rules
Maxim Mikityanskiy <[email protected]>
net/mlx5e: Use spin_lock_bh for async_icosq_lock
Vlad Buslov <[email protected]>
net/mlx5e: Protect encap route dev from concurrent release
Maor Dickman <[email protected]>
net/mlx5e: Fix modify header actions memory leak
Billy Tsai <[email protected]>
pinctrl: aspeed: Fix GPI only function problem.
Andy Shevchenko <[email protected]>
pinctrl: mcp23s08: Use full chunk of memory for regmap configuration
Ian Rogers <[email protected]>
libbpf, hashmap: Fix undefined behavior in hash_bits
Ard Biesheuvel <[email protected]>
bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE
Andrew Jeffery <[email protected]>
ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template
Billy Tsai <[email protected]>
gpio: aspeed: fix ast2600 bank properties
Andy Shevchenko <[email protected]>
pinctrl: intel: Set default bias in case no particular value given
Andy Shevchenko <[email protected]>
pinctrl: intel: Fix 2 kOhm bias which is 833 Ohm
Baolin Wang <[email protected]>
mfd: sprd: Add wakeup capability for PMIC IRQ
Martin Hundebøll <[email protected]>
spi: bcm2835: remove use of uninitialized gpio flags variable
Jerry Snitselaar <[email protected]>
tpm_tis: Disable interrupts on ThinkPad T490s
Michael Wu <[email protected]>
i2c: designware: slave should do WRITE_REQUESTED before WRITE_RECEIVED
Michael Wu <[email protected]>
i2c: designware: call i2c_dw_read_clear_intrbits_slave() once
Ulrich Hecht <[email protected]>
i2c: sh_mobile: implement atomic transfers
Sean Anderson <[email protected]>
riscv: Set text_offset correctly for M-Mode
Benjamin Gwin <[email protected]>
arm64: kexec_file: try more regions if loading segments fails
Tommi Rantala <[email protected]>
selftests: proc: fix warning: _GNU_SOURCE redefined
Brian Foster <[email protected]>
iomap: clean up writeback state logic on writepage error
Veerabadhran Gopalakrishnan <[email protected]>
amd/amdgpu: Disable VCN DPG mode for Picasso
Qii Wang <[email protected]>
i2c: mediatek: move dma reset before i2c reset
Fred Gao <[email protected]>
vfio/pci: Bypass IGD init in case of -ENODEV
Zhang Qilong <[email protected]>
vfio: platform: fix reference leak in vfio_platform_open
Qian Cai <[email protected]>
s390/smp: move rcu_cpu_starting() earlier
Suravee Suthikulpanit <[email protected]>
iommu/amd: Increase interrupt remapping table limit to 512 entries
Sagi Grimberg <[email protected]>
nvme-tcp: avoid repeated request completion
Sagi Grimberg <[email protected]>
nvme-rdma: avoid repeated request completion
Chao Leng <[email protected]>
nvme-tcp: avoid race between time out and tear down
Chao Leng <[email protected]>
nvme-rdma: avoid race between time out and tear down
Chao Leng <[email protected]>
nvme: introduce nvme_sync_io_queues
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Fix timeouts observed while reenabling IRQ
Hannes Reinecke <[email protected]>
scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()
Vineet Gupta <[email protected]>
ARC: [plat-hsdk] Remap CCMs super early in asm boot trampoline
Keith Busch <[email protected]>
Revert "nvme-pci: remove last_sq_tail"
Qiujun Huang <[email protected]>
tracing: Fix the checking of stackidx in __ftrace_trace_stack
Jason A. Donenfeld <[email protected]>
wireguard: selftests: check that route_me_harder packets use the right sk
Ye Bin <[email protected]>
cfg80211: regulatory: Fix inconsistent format argument
Johannes Berg <[email protected]>
mac80211: always wind down STA state
Johannes Berg <[email protected]>
cfg80211: initialize wdev data earlier
Johannes Berg <[email protected]>
mac80211: fix use of skb payload instead of header
Evan Quan <[email protected]>
drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running
Evan Quan <[email protected]>
drm/amd/pm: perform SMC reset on suspend/hibernation
Evan Quan <[email protected]>
drm/amd/pm: correct the baco reset sequence for CI ASICs
Evan Quan <[email protected]>
drm/amdgpu: perform srbm soft reset always on SDMA resume
Keita Suzuki <[email protected]>
scsi: hpsa: Fix memory leak in hpsa_init_one()
Bob Peterson <[email protected]>
gfs2: check for live vs. read-only file system in gfs2_fitrim
Bob Peterson <[email protected]>
gfs2: Add missing truncate_inode_pages_final for sd_aspace
Bob Peterson <[email protected]>
gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
Joerg Roedel <[email protected]>
x86/boot/compressed/64: Introduce sev_status
Kai-Heng Feng <[email protected]>
ALSA: hda: Reinstate runtime_allow() for all hda controllers
Kai-Heng Feng <[email protected]>
ALSA: hda: Separate runtime and system suspend
Tommi Rantala <[email protected]>
selftests: pidfd: fix compilation errors due to wait.h
Colin Ian King <[email protected]>
selftests/ftrace: check for do_sys_openat2 in user-memory test
Zqiang <[email protected]>
usb: raw-gadget: fix memory leak in gadget_setup
Evgeny Novikov <[email protected]>
usb: gadget: goku_udc: fix potential crashes in probe
Viresh Kumar <[email protected]>
opp: Reduce the size of critical section in _opp_table_kref_release()
Heikki Krogerus <[email protected]>
usb: dwc3: pci: add support for the Intel Alder Lake-S
Bard Liao <[email protected]>
ASoC: SOF: loader: handle all SOF_IPC_EXT types
Olivier Moysan <[email protected]>
ASoC: cs42l51: manage mclk shutdown delay
Srinivas Kandagatla <[email protected]>
ASoC: qcom: sdm845: set driver name correctly
Tzung-Bi Shih <[email protected]>
ASoC: mediatek: mt8183-da7219: fix DAPM paths for rt1015
Pujin Shi <[email protected]>
scsi: ufs: Fix missing brace warning for old compilers
Masashi Honma <[email protected]>
ath9k_htc: Use appropriate rs_datalen type
Stephen Boyd <[email protected]>
KVM: arm64: ARM_SMCCC_ARCH_WORKAROUND_1 doesn't return SMCCC_RET_NOT_REQUIRED
Tyler Hicks <[email protected]>
tpm: efi: Don't create binary_bios_measurements file for an empty log
Zhang Qilong <[email protected]>
USB: apple-mfi-fastcharge: fix reference leak in apple_mfi_fc_set_property
Palmer Dabbelt <[email protected]>
RISC-V: Fix the VDSO symbol generaton for binutils-2.35+
Bill Wendling <[email protected]>
kbuild: explicitly specify the build id style
Anand K Mistry <[email protected]>
x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP
Tommi Rantala <[email protected]>
selftests: binderfs: use SKIP instead of XFAIL
Tommi Rantala <[email protected]>
selftests: clone3: use SKIP instead of XFAIL
Tommi Rantala <[email protected]>
selftests: core: use SKIP instead of XFAIL in close_range_test.c
Jeff Layton <[email protected]>
ceph: check session state after bumping session->s_seq
Rob Herring <[email protected]>
PCI: mvebu: Fix duplicate resource requests
Zhao Qiang <[email protected]>
spi: fsl-dspi: fix wrong pointer in suspend/resume
Jens Axboe <[email protected]>
io_uring: ensure consistent view of original task ->mm from SQPOLL
Darrick J. Wong <[email protected]>
xfs: fix scrub flagging rtinherit even if there is no rt device
Darrick J. Wong <[email protected]>
xfs: fix missing CoW blocks writeback conversion retry
Brian Foster <[email protected]>
xfs: flush new eof page on truncate to avoid post-eof corruption
Joakim Zhang <[email protected]>
can: flexcan: flexcan_remove(): disable wakeup completely
Joakim Zhang <[email protected]>
can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A
Stephane Grosjean <[email protected]>
can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on
Stephane Grosjean <[email protected]>
can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
Dan Carpenter <[email protected]>
can: peak_usb: add range checking in decode operations
Navid Emamdoost <[email protected]>
can: xilinx_can: handle failure cases of pm_runtime_get_sync
Zhang Changzhong <[email protected]>
can: ti_hecc: ti_hecc_probe(): add missed clk_disable_unprepare() in error path
Zhang Changzhong <[email protected]>
can: j1939: j1939_sk_bind(): return failure if netdev is down
Yegor Yefremov <[email protected]>
can: j1939: swap addr and pgn in the send example
Oleksij Rempel <[email protected]>
can: can_create_echo_skb(): fix echo skb generation: always use skb_clone()
Oliver Hartkopp <[email protected]>
can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames
Vincent Mailhol <[email protected]>
can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
Marc Kleine-Budde <[email protected]>
can: rx-offload: don't call kfree_skb() from IRQ context
Alex Williamson <[email protected]>
vfio/pci: Implement ioeventfd thread handler for contended memory lock
David Howells <[email protected]>
afs: Fix incorrect freeing of the ACL passed to the YFS ACL store op
David Howells <[email protected]>
afs: Fix warning due to unadvanced marshalling pointer
Liu, Yi L <[email protected]>
iommu/vt-d: Fix a bug for PDP check in prq_event_thread
Liu Yi L <[email protected]>
iommu/vt-d: Fix sid not set issue in intel_svm_bind_gpasid()
Dan Carpenter <[email protected]>
ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
Namhyung Kim <[email protected]>
perf tools: Add missing swap for cgroup events
Jiri Olsa <[email protected]>
perf tools: Add missing swap for ino_generation
Stanislav Ivanichkin <[email protected]>
perf trace: Fix segfault when trying to trace events by cgroup
Steven Price <[email protected]>
drm/panfrost: Fix module unload
Clément Péron <[email protected]>
drm/panfrost: move devfreq_init()/fini() in device
Clément Péron <[email protected]>
drm/panfrost: rename error labels in device_init
zhongjiang-ali <[email protected]>
mm: memcontrol: correct the NR_ANON_THPS counter of hierarchical memcg
Maor Gottlieb <[email protected]>
IB/srpt: Fix memory leak in srpt_add_one
Maxime Ripard <[email protected]>
drm/vc4: bo: Add a managed action to cleanup the cache
Qian Cai <[email protected]>
powerpc/eeh_cache: Fix a possible debugfs deadlock
Greentime Hu <[email protected]>
irqchip/sifive-plic: Fix chip_data access within a hierarchy
Stefano Brivio <[email protected]>
netfilter: ipset: Update byte and packet counters regardless of whether they match
Rajat Jain <[email protected]>
PCI: Always enable ACS even if no ACS Capability
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: missing validation from the abort path
Jason A. Donenfeld <[email protected]>
netfilter: use actual socket sk rather than skb sk when routing harder
Pablo Neira Ayuso <[email protected]>
netfilter: nftables: fix netlink report logic in flowtable and genid
Johannes Berg <[email protected]>
mac80211: don't require VHT elements for HE on 2.4 GHz
Darrick J. Wong <[email protected]>
xfs: set xefi_discard when creating a deferred agfl free log intent item
Bert Vermeulen <[email protected]>
mtd: spi-nor: Fix address width on flash chips > 16MB
Srinivas Kandagatla <[email protected]>
ASoC: codecs: wcd9335: Set digital gain range correctly
Srinivas Kandagatla <[email protected]>
ASoC: codecs: wcd934x: Set digital gain range correctly
Tommi Rantala <[email protected]>
selftests: filter kselftest headers from command in lib.mk
Ran Wang <[email protected]>
usb: gadget: fsl: fix null pointer checking
Andy Shevchenko <[email protected]>
kunit: Don't fail test suites if one of them is empty
David Gow <[email protected]>
kunit: Fix kunit.py --raw_output option
Greentime Hu <[email protected]>
irqchip/sifive-plic: Fix broken irq_set_affinity() callback
Sascha Hauer <[email protected]>
spi: imx: fix runtime pm support for !CONFIG_PM
Srinivas Kandagatla <[email protected]>
ASoC: codecs: wsa881x: add missing stream rates and format
zhuoliang zhang <[email protected]>
net: xfrm: fix a race condition during allocing spi
Olaf Hering <[email protected]>
hv_balloon: disable warning when floor reached
Marc Zyngier <[email protected]>
genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY
Tomasz Figa <[email protected]>
ASoC: Intel: kbl_rt5663_max98927: Fix kabylake_ssp_fixup function
Xin Long <[email protected]>
xfrm: interface: fix the priorities for ipip and ipv6 tunnels
Santosh Shukla <[email protected]>
KVM: arm64: Force PTE mapping on fault resulting in a device mapping
Ming Lei <[email protected]>
nbd: don't update block size after device is started
Roman Gushchin <[email protected]>
mm: memcg: link page counters to root if use_hierarchy is false
Chris Wilson <[email protected]>
drm/i915/gem: Flush coherency domains on first set-domain-ioctl
Chris Wilson <[email protected]>
drm/i915: Hold onto an explicit ref to i915_vma_work.pinned
-------------
Diffstat:
Documentation/networking/j1939.rst | 4 +- Makefile | 8 +- arch/arc/kernel/head.S | 17 +- arch/arc/plat-hsdk/platform.c | 17 -- arch/arm/include/asm/kprobes.h | 22 +-- arch/arm/probes/kprobes/opt-arm.c | 18 +- arch/arm/vdso/Makefile | 2 +- arch/arm64/kernel/kexec_image.c | 41 +++- arch/arm64/kernel/machine_kexec_file.c | 9 +- arch/arm64/kernel/vdso/Makefile | 2 +- arch/arm64/kernel/vdso32/Makefile | 2 +- arch/arm64/kvm/hypercalls.c | 2 +- arch/arm64/kvm/mmu.c | 1 + arch/arm64/kvm/sys_regs.c | 18 +- arch/arm64/mm/mmu.c | 17 ++ arch/mips/vdso/Makefile | 2 +- arch/powerpc/kernel/eeh_cache.c | 5 +- arch/powerpc/kernel/head_32.S | 12 -- arch/riscv/kernel/head.S | 5 + arch/riscv/kernel/vdso/.gitignore | 1 + arch/riscv/kernel/vdso/Makefile | 18 +- arch/riscv/kernel/vdso/so2s.sh | 6 + arch/s390/kernel/smp.c | 3 +- arch/s390/kernel/vdso64/Makefile | 2 +- arch/sparc/vdso/Makefile | 2 +- arch/x86/boot/compressed/mem_encrypt.S | 16 +- arch/x86/entry/vdso/Makefile | 2 +- arch/x86/kernel/cpu/bugs.c | 51 +++-- block/genhd.c | 5 +- drivers/accessibility/speakup/main.c | 1 - drivers/accessibility/speakup/selection.c | 11 +- drivers/accessibility/speakup/speakup.h | 1 - drivers/accessibility/speakup/spk_ttyio.c | 10 +- drivers/accessibility/speakup/spk_types.h | 8 +- drivers/block/loop.c | 3 +- drivers/block/nbd.c | 10 +- drivers/block/null_blk.h | 1 + drivers/block/null_blk_zoned.c | 31 ++- drivers/char/tpm/eventlog/efi.c | 5 + drivers/char/tpm/tpm_tis.c | 29 ++- drivers/char/virtio_console.c | 8 +- drivers/cpufreq/cpufreq.c | 4 +- drivers/cpufreq/cpufreq_governor.h | 2 +- drivers/cpufreq/cpufreq_performance.c | 1 + drivers/cpufreq/cpufreq_powersave.c | 1 + drivers/cpufreq/intel_pstate.c | 16 +- drivers/crypto/chelsio/chcr_ktls.c | 27 ++- drivers/firmware/xilinx/zynqmp.c | 3 + drivers/gpio/gpio-aspeed.c | 1 + drivers/gpio/gpio-pcie-idio-24.c | 62 +++++- drivers/gpio/gpio-sifive.c | 2 +- drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 27 ++- drivers/gpu/drm/amd/amdgpu/soc15.c | 3 +- .../amd/display/dc/irq/dcn30/irq_service_dcn30.c | 4 +- drivers/gpu/drm/amd/powerplay/hwmgr/ci_baco.c | 7 +- drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 4 + drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 1 + drivers/gpu/drm/amd/powerplay/inc/smumgr.h | 2 + drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 29 ++- drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c | 8 + drivers/gpu/drm/gma500/psb_irq.c | 34 ++-- drivers/gpu/drm/i915/gem/i915_gem_domain.c | 28 ++- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 +- drivers/gpu/drm/i915/i915_vma.c | 6 +- drivers/gpu/drm/panfrost/panfrost_device.c | 40 ++-- drivers/gpu/drm/panfrost/panfrost_drv.c | 20 +- drivers/gpu/drm/vc4/vc4_bo.c | 5 +- drivers/gpu/drm/vc4/vc4_drv.c | 1 - drivers/gpu/drm/vc4/vc4_drv.h | 2 +- drivers/hv/hv_balloon.c | 2 +- drivers/hwmon/amd_energy.c | 2 +- drivers/hwmon/applesmc.c | 130 ++++++++----- drivers/hwtracing/coresight/coresight-etm-perf.c | 4 +- drivers/i2c/busses/i2c-designware-slave.c | 52 ++--- drivers/i2c/busses/i2c-mt65xx.c | 8 +- drivers/i2c/busses/i2c-sh_mobile.c | 86 +++++++-- drivers/infiniband/ulp/srpt/ib_srpt.c | 13 +- drivers/iommu/amd/amd_iommu_types.h | 6 +- drivers/iommu/intel/svm.c | 8 +- drivers/irqchip/irq-sifive-plic.c | 10 +- drivers/mfd/sprd-sc27xx-spi.c | 28 ++- drivers/misc/mei/client.h | 4 +- drivers/mmc/host/renesas_sdhi_core.c | 1 + drivers/mmc/host/sdhci-of-esdhc.c | 2 + drivers/mtd/spi-nor/core.c | 8 +- drivers/net/can/dev.c | 14 +- drivers/net/can/flexcan.c | 5 +- drivers/net/can/peak_canfd/peak_canfd.c | 11 +- drivers/net/can/rx-offload.c | 4 +- drivers/net/can/ti_hecc.c | 8 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 51 ++++- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 48 +++-- drivers/net/can/xilinx_can.c | 6 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 26 ++- drivers/net/ethernet/intel/igc/igc_main.c | 14 +- .../net/ethernet/mellanox/mlx5/core/en/rep/tc.c | 6 +- .../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 72 ++++--- .../net/ethernet/mellanox/mlx5/core/en/xsk/setup.c | 4 +- .../net/ethernet/mellanox/mlx5/core/en/xsk/tx.c | 4 +- .../ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c | 14 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_rep.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 2 - drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 7 +- .../net/ethernet/mellanox/mlx5/core/lib/vxlan.c | 23 ++- .../net/ethernet/mellanox/mlx5/core/lib/vxlan.h | 2 + drivers/net/ethernet/microchip/lan743x_main.c | 24 +-- drivers/net/ethernet/microchip/lan743x_main.h | 3 - drivers/net/ethernet/realtek/r8169_main.c | 18 +- drivers/net/phy/realtek.c | 2 + drivers/net/vrf.c | 92 ++++++--- drivers/net/wan/cosa.c | 1 + drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 2 +- drivers/nvme/host/core.c | 106 ++++++---- drivers/nvme/host/nvme.h | 1 + drivers/nvme/host/pci.c | 23 ++- drivers/nvme/host/rdma.c | 14 +- drivers/nvme/host/tcp.c | 16 +- drivers/of/address.c | 4 +- drivers/opp/core.c | 7 +- drivers/pci/controller/pci-mvebu.c | 23 +-- drivers/pci/pci.c | 9 +- drivers/pinctrl/aspeed/pinctrl-aspeed.c | 7 +- drivers/pinctrl/intel/pinctrl-intel.c | 40 +++- drivers/pinctrl/pinctrl-amd.c | 6 +- drivers/pinctrl/pinctrl-mcp23s08_spi.c | 2 +- drivers/pinctrl/qcom/pinctrl-msm.c | 32 +-- drivers/pinctrl/qcom/pinctrl-sm8250.c | 18 ++ drivers/scsi/device_handler/scsi_dh_alua.c | 9 +- drivers/scsi/hpsa.c | 4 +- drivers/scsi/mpt3sas/mpt3sas_base.c | 7 + drivers/scsi/ufs/ufshcd-crypto.c | 4 +- drivers/spi/spi-bcm2835.c | 3 +- drivers/spi/spi-fsl-dspi.c | 10 +- drivers/spi/spi-imx.c | 23 ++- drivers/thunderbolt/nhi.c | 19 +- drivers/thunderbolt/xdomain.c | 1 + drivers/uio/uio.c | 10 +- drivers/usb/class/cdc-acm.c | 9 + drivers/usb/dwc3/dwc3-pci.c | 4 + drivers/usb/gadget/legacy/raw_gadget.c | 5 +- drivers/usb/gadget/udc/fsl_udc_core.c | 2 +- drivers/usb/gadget/udc/goku_udc.c | 2 +- drivers/usb/host/xhci-histb.c | 2 +- drivers/usb/misc/apple-mfi-fastcharge.c | 4 +- drivers/usb/musb/musb_dsps.c | 4 +- drivers/usb/typec/ucsi/psy.c | 9 + drivers/usb/typec/ucsi/ucsi.c | 7 +- drivers/usb/typec/ucsi/ucsi.h | 2 + drivers/vfio/pci/vfio_pci.c | 2 +- drivers/vfio/pci/vfio_pci_rdwr.c | 43 ++++- drivers/vfio/platform/vfio_platform_common.c | 3 +- fs/afs/write.c | 5 +- fs/afs/xattr.c | 7 +- fs/afs/yfsclient.c | 1 + fs/btrfs/dev-replace.c | 26 ++- fs/btrfs/ioctl.c | 10 +- fs/btrfs/ref-verify.c | 1 + fs/btrfs/relocation.c | 4 +- fs/btrfs/volumes.c | 26 +-- fs/ceph/caps.c | 2 +- fs/ceph/mds_client.c | 50 +++-- fs/ceph/mds_client.h | 1 + fs/ceph/quota.c | 2 +- fs/ceph/snap.c | 2 +- fs/cifs/cifs_unicode.c | 8 +- fs/erofs/inode.c | 21 +- fs/erofs/zdata.c | 7 +- fs/ext4/inline.c | 1 + fs/ext4/super.c | 4 +- fs/gfs2/rgrp.c | 5 +- fs/gfs2/super.c | 1 + fs/io_uring.c | 29 ++- fs/iomap/buffered-io.c | 15 +- fs/jbd2/checkpoint.c | 2 + fs/jbd2/transaction.c | 4 +- fs/nfs/nfs42xattr.c | 2 + fs/nfs/nfs42xdr.c | 4 +- fs/nfsd/nfs4proc.c | 3 +- fs/ocfs2/super.c | 1 + fs/xfs/libxfs/xfs_alloc.c | 1 + fs/xfs/libxfs/xfs_bmap.h | 2 +- fs/xfs/libxfs/xfs_rmap.c | 2 +- fs/xfs/libxfs/xfs_rmap_btree.c | 16 +- fs/xfs/scrub/bmap.c | 2 + fs/xfs/scrub/inode.c | 3 +- fs/xfs/scrub/refcount.c | 8 +- fs/xfs/xfs_aops.c | 6 +- fs/xfs/xfs_iops.c | 10 + fs/xfs/xfs_pnfs.c | 2 +- include/linux/arm-smccc.h | 2 + include/linux/can/skb.h | 20 +- include/linux/compiler-gcc.h | 2 - include/linux/compiler_types.h | 4 - include/linux/cpufreq.h | 18 +- include/linux/genhd.h | 2 +- include/linux/memcontrol.h | 11 +- include/linux/netfilter/nfnetlink.h | 9 +- include/linux/netfilter_ipv4.h | 2 +- include/linux/netfilter_ipv6.h | 10 +- include/trace/events/sunrpc.h | 8 +- init/main.c | 14 +- kernel/bpf/Makefile | 6 +- kernel/bpf/core.c | 2 +- kernel/bpf/hashtab.c | 30 ++- kernel/dma/swiotlb.c | 6 +- kernel/events/core.c | 12 +- kernel/events/internal.h | 2 +- kernel/exit.c | 5 +- kernel/futex.c | 5 +- kernel/irq/Kconfig | 1 + kernel/reboot.c | 28 +-- kernel/sched/cpufreq_schedutil.c | 2 +- kernel/trace/trace.c | 4 +- kernel/watchdog.c | 4 +- mm/compaction.c | 12 +- mm/gup.c | 14 +- mm/hugetlb.c | 90 +-------- mm/memcontrol.c | 28 ++- mm/memory-failure.c | 36 ++-- mm/migrate.c | 44 +++-- mm/rmap.c | 5 +- mm/slub.c | 2 +- mm/vmscan.c | 5 +- net/can/j1939/socket.c | 6 + net/core/devlink.c | 8 +- net/ethtool/features.c | 2 +- net/ipv4/ip_tunnel_core.c | 4 +- net/ipv4/netfilter.c | 8 +- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 2 +- net/ipv4/syncookies.c | 9 +- net/ipv4/udp_offload.c | 19 +- net/ipv4/xfrm4_tunnel.c | 4 +- net/ipv6/netfilter.c | 6 +- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/ipv6/sit.c | 2 - net/ipv6/syncookies.c | 10 +- net/ipv6/udp_offload.c | 17 +- net/ipv6/xfrm6_tunnel.c | 4 +- net/iucv/af_iucv.c | 3 +- net/mac80211/mlme.c | 3 +- net/mac80211/sta_info.c | 18 ++ net/mac80211/tx.c | 37 ++-- net/mptcp/protocol.c | 1 + net/netfilter/ipset/ip_set_core.c | 3 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/netfilter/nf_nat_proto.c | 4 +- net/netfilter/nf_synproxy_core.c | 2 +- net/netfilter/nf_tables_api.c | 19 +- net/netfilter/nfnetlink.c | 22 ++- net/netfilter/nft_chain_route.c | 4 +- net/netfilter/utils.c | 4 +- net/tipc/topsrv.c | 10 +- net/wireless/core.c | 57 +++--- net/wireless/core.h | 5 +- net/wireless/nl80211.c | 3 +- net/wireless/reg.c | 2 +- net/x25/af_x25.c | 2 +- net/xfrm/xfrm_interface.c | 8 +- net/xfrm/xfrm_state.c | 8 +- security/selinux/ibpkey.c | 4 +- sound/hda/ext/hdac_ext_controller.c | 2 + sound/pci/hda/hda_controller.h | 3 +- sound/pci/hda/hda_intel.c | 63 +++--- sound/soc/codecs/cs42l51.c | 22 ++- sound/soc/codecs/wcd9335.c | 2 +- sound/soc/codecs/wcd934x.c | 2 +- sound/soc/codecs/wsa881x.c | 2 + sound/soc/intel/boards/kbl_rt5663_max98927.c | 39 +++- sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c | 31 ++- sound/soc/qcom/sdm845.c | 2 + sound/soc/sof/loader.c | 5 + tools/bpf/bpftool/prog.c | 2 +- tools/lib/bpf/hashmap.h | 15 +- tools/perf/builtin-trace.c | 15 +- .../util/scripting-engines/trace-event-python.c | 7 +- tools/perf/util/session.c | 14 ++ tools/testing/kunit/kunit_parser.py | 3 +- tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/prog_tests/map_init.c | 214 +++++++++++++++++++++ tools/testing/selftests/bpf/progs/test_map_init.c | 33 ++++ .../clone3/clone3_cap_checkpoint_restore.c | 2 +- tools/testing/selftests/core/close_range_test.c | 8 +- .../selftests/filesystems/binderfs/binderfs_test.c | 8 +- .../ftrace/test.d/kprobe/kprobe_args_user.tc | 4 + tools/testing/selftests/lib.mk | 2 +- tools/testing/selftests/pidfd/pidfd_open_test.c | 1 - tools/testing/selftests/pidfd/pidfd_poll_test.c | 1 - tools/testing/selftests/proc/proc-loadavg-001.c | 1 - tools/testing/selftests/proc/proc-self-syscall.c | 1 - tools/testing/selftests/proc/proc-uptime-002.c | 1 - .../tc-testing/tc-tests/filters/tests.json | 4 +- tools/testing/selftests/wireguard/netns.sh | 8 + .../testing/selftests/wireguard/qemu/kernel.config | 2 + 297 files changed, 2450 insertions(+), 1241 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/255 drm/i915: Hold onto an explicit ref to i915_vma_work.pinned
From: Chris Wilson <[email protected]>
[ Upstream commit 537457a979a02a410b555fab289dcb28b588f33b ]
Since __vma_release is run by a kworker after the fence has been signaled, it is no longer protected by the active reference on the vma, and so the alias of vw->pinned to vma->obj is also not protected by a reference on the object. Add an explicit reference for vw->pinned so it will always be safe.
Found by inspection.
--- drivers/gpu/drm/i915/i915_vma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/i915_vma.c +4 -2
@@ -315,8 +315,10 @@ static void __vma_release(struct dma_fence_work *work) {struct i915_vma_work *vw =container_of (work,typeof (*vw), base); -if (vw->pinned) +if (vw->pinned) {__i915_gem_object_unpin_pages (vw->pinned); +i915_gem_object_put (vw->pinned); + } }static const struct dma_fence_work_ops bind_ops = {
@@ -430,7 +432,7 @@ int i915_vma_bind(struct i915_vma *vma,if (vma->obj) {__i915_gem_object_pin_pages (vma->obj); - work->pinned = vma->obj; + work->pinned =i915_gem_object_get (vma->obj); } }else { ret = vma->ops->bind_vma (vma->vm, vma, cache_level, bind_flags);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 2/255 drm/i915/gem: Flush coherency domains on first set-domain-ioctl
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
[ Upstream commit 59dd13ad310793757e34afa489dd6fc8544fc3da ]
Avoid skipping what appears to be a no-op set-domain-ioctl if the cache coherency state is inconsistent with our target domain. This also has the utility of using the population of the pages to validate the backing store.
The danger in skipping the first set-domain is leaving the cache inconsistent and submitting stale data, or worse leaving the clean data in the cache and not flushing it to the GPU. The impact should be small as it requires a no-op set-domain as the very first ioctl in a particular sequence not found in typical userspace.
Testcase: igt/gem_mmap_offset/blt-coherency
--- drivers/gpu/drm/i915/gem/i915_gem_domain.c | 28 ++++++++++------------ 1 file changed, 13 insertions(+), 15 deletions(-)
drivers/gpu/drm/i915/gem/i915_gem_domain.c +13 -15
@@ -484,21 +484,6 @@ i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,if (!obj)return -ENOENT ; -/* -* Already in the desired write domain? Nothing for us to do! -* -* We apply a little bit of cunning here to catch a broader set of -* no-ops. If obj->write_domain is set, we must be in the same -* obj->read_domains, and only that domain. Therefore, if that -* obj->write_domain matches the request read_domains, we are -* already in the same read/write domain and can skip the operation, -* without having to further check the requested write_domain. -*/ -if (READ_ONCE (obj->write_domain) == read_domains) { - err =0 ; - goto out; - } -/* * Try to flush the object off the GPU without holding the lock. * We will repeat the flush holding the lock in the normal manner
@@ -536,6 +521,19 @@ i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,if (err) goto out; +/* +* Already in the desired write domain? Nothing for us to do! +* +* We apply a little bit of cunning here to catch a broader set of +* no-ops. If obj->write_domain is set, we must be in the same +* obj->read_domains, and only that domain. Therefore, if that +* obj->write_domain matches the request read_domains, we are +* already in the same read/write domain and can skip the operation, +* without having to further check the requested write_domain. +*/ +if (READ_ONCE (obj->write_domain) == read_domains) + goto out_unpin; + err =i915_gem_object_lock_interruptible (obj);if (err) goto out_unpin;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 3/255 mm: memcg: link page counters to root if use_hierarchy is false
In reply to Greg Kroah-HartmanFrom: Roman Gushchin <[email protected]>
[ Upstream commit 8de15e920dc85d1705ab9c202c95d56845bc2d48 ]
Richard reported a warning which can be reproduced by running the LTP madvise6 test (cgroup v1 in the non-hierarchical mode should be used):
WARNING: CPU: 0 PID: 12 at mm/page_counter.c:57 page_counter_uncharge (mm/page_counter.c:57 mm/page_counter.c:50 mm/page_counter.c:156)
Modules linked in:
CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.9.0-rc7-22-default #77
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812d-rebuilt.opensuse.org 04/01/2014
Workqueue: events drain_local_stock
RIP: 0010:page_counter_uncharge (mm/page_counter.c:57 mm/page_counter.c:50 mm/page_counter.c:156)
Call Trace:
__memcg_kmem_uncharge (mm/memcontrol.c:3022)
drain_obj_stock (./include/linux/rcupdate.h:689 mm/memcontrol.c:3114)
drain_local_stock (mm/memcontrol.c:2255)
process_one_work (./arch/x86/include/asm/jump_label.h:25 ./include/linux/jump_label.h:200 ./include/trace/events/workqueue.h:108 kernel/workqueue.c:2274)
worker_thread (./include/linux/list.h:282 kernel/workqueue.c:2416)
kthread (kernel/kthread.c:292)
ret_from_fork (arch/x86/entry/entry_64.S:300)The problem occurs because in the non-hierarchical mode non-root page counters are not linked to root page counters, so the charge is not propagated to the root memory cgroup.
After the removal of the original memory cgroup and reparenting of the object cgroup, the root cgroup might be uncharged by draining a objcg stock, for example. It leads to an eventual underflow of the charge and triggers a warning.
Fix it by linking all page counters to corresponding root page counters in the non-hierarchical mode.
Please note, that in the non-hierarchical mode all objcgs are always reparented to the root memory cgroup, even if the hierarchy has more than 1 level. This patch doesn't change it.
The patch also doesn't affect how the hierarchical mode is working, which is the only sane and truly supported mode now.
Thanks to Richard for reporting, debugging and providing an alternative version of the fix!
--- mm/memcontrol.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
mm/memcontrol.c +12 -6
@@ -5298,7 +5298,13 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css) memcg->swappiness =mem_cgroup_swappiness (parent); memcg->oom_kill_disable = parent->oom_kill_disable; } -if (parent && parent->use_hierarchy) { +if (!parent) { +page_counter_init (&memcg->memory,NULL ); +page_counter_init (&memcg->swap,NULL ); +page_counter_init (&memcg->memsw,NULL ); +page_counter_init (&memcg->kmem,NULL ); +page_counter_init (&memcg->tcpmem,NULL ); + }else if (parent->use_hierarchy) { memcg->use_hierarchy = true;page_counter_init (&memcg->memory, &parent->memory);page_counter_init (&memcg->swap, &parent->swap);
@@ -5306,11 +5312,11 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)page_counter_init (&memcg->kmem, &parent->kmem);page_counter_init (&memcg->tcpmem, &parent->tcpmem); }else { -page_counter_init (&memcg->memory,NULL ); -page_counter_init (&memcg->swap,NULL ); -page_counter_init (&memcg->memsw,NULL ); -page_counter_init (&memcg->kmem,NULL ); -page_counter_init (&memcg->tcpmem,NULL ); +page_counter_init (&memcg->memory, &root_mem_cgroup->memory); +page_counter_init (&memcg->swap, &root_mem_cgroup->swap); +page_counter_init (&memcg->memsw, &root_mem_cgroup->memsw); +page_counter_init (&memcg->kmem, &root_mem_cgroup->kmem); +page_counter_init (&memcg->tcpmem, &root_mem_cgroup->tcpmem);/* * Deeper hierachy with use_hierarchy == false doesn't make * much sense so let cgroup subsystem know about this
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 4/255 nbd: dont update block size after device is started
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit b40813ddcd6bf9f01d020804e4cb8febc480b9e4 ]
Mounted NBD device can be resized, one use case is rbd-nbd.
Fix the issue by setting up default block size, then not touch it in nbd_size_update() any more. This kind of usage is aligned with loop which has same use case too.
--- drivers/block/nbd.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/block/nbd.c +5 -4
@@ -296,7 +296,7 @@ static void nbd_size_clear(struct nbd_device *nbd) } } -static void nbd_size_update (struct nbd_device *nbd) +static void nbd_size_update (struct nbd_device *nbd,bool start) {struct nbd_config *config = nbd->config;struct block_device *bdev =bdget_disk (nbd->disk,0 );
@@ -312,7 +312,8 @@ static void nbd_size_update(struct nbd_device *nbd)if (bdev) {if (bdev->bd_disk) {bd_set_size (bdev, config->bytesize); -set_blocksize (bdev, config->blksize); +if (start) +set_blocksize (bdev, config->blksize); }else bdev->bd_invalidated =1 ;bdput (bdev);
@@ -327,7 +328,7 @@ static void nbd_size_set(struct nbd_device *nbd, loff_t blocksize, config->blksize = blocksize; config->bytesize = blocksize * nr_blocks;if (nbd->task_recv !=NULL ) -nbd_size_update (nbd); +nbd_size_update (nbd, false); }static void nbd_complete_rq (struct request *req)
@@ -1307,7 +1308,7 @@ static int nbd_start_device(struct nbd_device *nbd) args->index = i;queue_work (nbd->recv_workq, &args->work); } -nbd_size_update (nbd); +nbd_size_update (nbd, true);return error; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 5/255 KVM: arm64: Force PTE mapping on fault resulting in a device mapping
In reply to Greg Kroah-HartmanFrom: Santosh Shukla <[email protected]>
[ Upstream commit 91a2c34b7d6fadc9c5d9433c620ea4c32ee7cae8 ]
VFIO allows a device driver to resolve a fault by mapping a MMIO range. This can be subsequently result in user_mem_abort() to try and compute a huge mapping based on the MMIO pfn, which is a sure recipe for things to go wrong.
Instead, force a PTE mapping when the pfn faulted in has a device mapping.
--- arch/arm64/kvm/mmu.c | 1 + 1 file changed, 1 insertion(+)
arch/arm64/kvm/mmu.c +1 -0
@@ -1920,6 +1920,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,if (kvm_is_device_pfn (pfn)) { mem_type =PAGE_S2_DEVICE ; flags |=KVM_S2PTE_FLAG_IS_IOMAP ; + force_pte = true; }else if (logging_active) {/* * Faults on pages in a memslot with logging enabled
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 6/255 xfrm: interface: fix the priorities for ipip and ipv6 tunnels
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 7fe94612dd4cfcd35fe0ec87745fb31ad2be71f8 ]
As Nicolas noticed in his case, when xfrm_interface module is installed the standard IP tunnels will break in receiving packets.
This is caused by the IP tunnel handlers with a higher priority in xfrm interface processing incoming packets by xfrm_input(), which would drop the packets and return 0 instead when anything wrong happens.
Rather than changing xfrm_input(), this patch is to adjust the priority for the IP tunnel handlers in xfrm interface, so that the packets would go to xfrmi's later than the others', as the others' would not drop the packets when the handlers couldn't process them.
Note that IPCOMP also defines its own IPIP tunnel handler and it calls xfrm_input() as well, so we must make its priority lower than xfrmi's, which means having xfrmi loaded would still break IPCOMP. We may seek another way to fix it in xfrm_input() in the future.
--- net/ipv4/xfrm4_tunnel.c | 4 ++-- net/ipv6/xfrm6_tunnel.c | 4 ++-- net/xfrm/xfrm_interface.c | 8 ++++---- 3 files changed, 8 insertions(+), 8 deletions(-)
net/ipv4/xfrm4_tunnel.c +2 -2
@@ -64,14 +64,14 @@ static int xfrm_tunnel_err(struct sk_buff *skb, u32 info)static struct xfrm_tunnel xfrm_tunnel_handler__read_mostly = { .handler = xfrm_tunnel_rcv, .err_handler = xfrm_tunnel_err, - .priority =3 , + .priority =4 , };#if IS_ENABLED (CONFIG_IPV6 )static struct xfrm_tunnel xfrm64_tunnel_handler__read_mostly = { .handler = xfrm_tunnel_rcv, .err_handler = xfrm_tunnel_err, - .priority =2 , + .priority =3 , };#endif
net/ipv6/xfrm6_tunnel.c +2 -2
@@ -303,13 +303,13 @@ static const struct xfrm_type xfrm6_tunnel_type = {static struct xfrm6_tunnel xfrm6_tunnel_handler__read_mostly = { .handler = xfrm6_tunnel_rcv, .err_handler = xfrm6_tunnel_err, - .priority =2 , + .priority =3 , };static struct xfrm6_tunnel xfrm46_tunnel_handler__read_mostly = { .handler = xfrm6_tunnel_rcv, .err_handler = xfrm6_tunnel_err, - .priority =2 , + .priority =3 , };static int __net_init xfrm6_tunnel_net_init (struct net *net)
net/xfrm/xfrm_interface.c +4 -4
@@ -830,14 +830,14 @@ static struct xfrm6_tunnel xfrmi_ipv6_handler __read_mostly = { .handler = xfrmi6_rcv_tunnel, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi6_err, - .priority = -1, + .priority = 2, };static struct xfrm6_tunnel xfrmi_ip6ip_handler__read_mostly = { .handler = xfrmi6_rcv_tunnel, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi6_err, - .priority =-1 , + .priority =2 , };#endif
@@ -875,14 +875,14 @@ static struct xfrm_tunnel xfrmi_ipip_handler __read_mostly = { .handler = xfrmi4_rcv_tunnel, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi4_err, - .priority = -1, + .priority = 3, };static struct xfrm_tunnel xfrmi_ipip6_handler__read_mostly = { .handler = xfrmi4_rcv_tunnel, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi4_err, - .priority =-1 , + .priority =2 , };#endif
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 7/255 ASoC: Intel: kbl_rt5663_max98927: Fix kabylake_ssp_fixup function
In reply to Greg Kroah-HartmanFrom: Tomasz Figa <[email protected]>
[ Upstream commit 9fe9efd6924c9a62ebb759025bb8927e398f51f7 ]
This is a copy of commit 5c5f1baee85a ("ASoC: Intel:kbl_rt5663_rt5514_max98927: Fix kabylake_ssp_fixup function") applied to the kbl_rt5663_max98927 board file.
Original explanation of the change:
kabylake_ssp_fixup function uses snd_soc_dpcm to identify the codecs DAIs. The HW parameters are changed based on the codec DAI of the stream. The earlier approach to get snd_soc_dpcm was using container_of() macro on snd_pcm_hw_params.
The structures have been modified over time and snd_soc_dpcm does not have snd_pcm_hw_params as a reference but as a copy. This causes the current driver to crash when used.
This patch changes the way snd_soc_dpcm is extracted. snd_soc_pcm_runtime holds 2 dpcm instances (one for playback and one for capture). 2 codecs on the SSP are dmic (capture) and speakers (playback). Based on the stream direction, snd_soc_dpcm is extracted from snd_soc_pcm_runtime.
Fixes a boot crash on a HP Chromebook x2:
[ 16.582225] BUG: kernel NULL pointer dereference, address: 0000000000000050 [ 16.582231] #PF: supervisor read access in kernel mode [ 16.582233] #PF: error_code(0x0000) - not-present page [ 16.582234] PGD 0 P4D 0 [ 16.582238] Oops: 0000 [#1] PREEMPT SMP PTI [ 16.582241] CPU: 0 PID: 1980 Comm: cras Tainted: G C 5.4.58 #1 [ 16.582243] Hardware name: HP Soraka/Soraka, BIOS Google_Soraka.10431.75.0 08/30/2018 [ 16.582247] RIP: 0010:kabylake_ssp_fixup+0x19/0xbb [snd_soc_kbl_rt5663_max98927] [ 16.582250] Code: c6 6f c5 80 c0 44 89 f2 31 c0 e8 3e c9 4c d6 eb de 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 53 48 89 f3 48 8b 46 c8 48 8b 4e d0 <48> 8b 49 10 4c 8b 78 10 4c 8b 31 4c 89 f7 48 c7 c6 4b c2 80 c0 e8 [ 16.582252] RSP: 0000:ffffaf7e81e0b958 EFLAGS: 00010282 [ 16.582254] RAX: ffffffff96f13e0d RBX: ffffaf7e81e0ba00 RCX: 0000000000000040 [ 16.582256] RDX: ffffaf7e81e0ba00 RSI: ffffaf7e81e0ba00 RDI: ffffa3b208558028 [ 16.582258] RBP: ffffaf7e81e0b970 R08: ffffa3b203b54160 R09: ffffaf7e81e0ba00 [ 16.582259] R10: 0000000000000000 R11: ffffffffc080b345 R12: ffffa3b209fb6e00 [ 16.582261] R13: ffffa3b1b1a47838 R14: ffffa3b1e6197f28 R15: ffffaf7e81e0ba00 [ 16.582263] FS: 00007eb3f25aaf80(0000) GS:ffffa3b236a00000(0000) knlGS:0000000000000000 [ 16.582265] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 16.582267] CR2: 0000000000000050 CR3: 0000000246bc8006 CR4: 00000000003606f0 [ 16.582269] Call Trace: [ 16.582275] snd_soc_link_be_hw_params_fixup+0x21/0x68 [ 16.582278] snd_soc_dai_hw_params+0x25/0x94 [ 16.582282] soc_pcm_hw_params+0x2d8/0x583 [ 16.582288] dpcm_be_dai_hw_params+0x172/0x29e [ 16.582291] dpcm_fe_dai_hw_params+0x9f/0x12f [ 16.582295] snd_pcm_hw_params+0x137/0x41c [ 16.582298] snd_pcm_hw_params_user+0x3c/0x71 [ 16.582301] snd_pcm_common_ioctl+0x2c6/0x565 [ 16.582304] snd_pcm_ioctl+0x32/0x36 [ 16.582307] do_vfs_ioctl+0x506/0x783 [ 16.582311] ksys_ioctl+0x58/0x83 [ 16.582313] __x64_sys_ioctl+0x1a/0x1e [ 16.582316] do_syscall_64+0x54/0x7e [ 16.582319] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 16.582322] RIP: 0033:0x7eb3f1886157 [ 16.582324] Code: 8a 66 90 48 8b 05 11 dd 2b 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 dc 2b 00 f7 d8 64 89 01 48 [ 16.582326] RSP: 002b:00007ffff7559818 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 16.582329] RAX: ffffffffffffffda RBX: 00005acc9188b140 RCX: 00007eb3f1886157 [ 16.582330] RDX: 00007ffff7559940 RSI: 00000000c2604111 RDI: 000000000000001e [ 16.582332] RBP: 00007ffff7559840 R08: 0000000000000004 R09: 0000000000000000 [ 16.582333] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000bb80 [ 16.582335] R13: 00005acc91702e80 R14: 00007ffff7559940 R15: 00005acc91702e80 [ 16.582337] Modules linked in: rfcomm cmac algif_hash algif_skcipher af_alg uinput hid_google_hammer snd_soc_kbl_rt5663_max98927 snd_soc_hdac_hdmi snd_soc_dmic snd_soc_skl_ssp_clk snd_soc_skl snd_soc_sst_ipc snd_soc_sst_dsp snd_soc_hdac_hda snd_soc_acpi_intel_match snd_soc_acpi snd_hda_ext_core snd_intel_dspcfg snd_hda_codec snd_hwdep snd_hda_core ipu3_cio2 ipu3_imgu(C) videobuf2_v4l2 videobuf2_common videobuf2_dma_sg videobuf2_memops snd_soc_rt5663 snd_soc_max98927 snd_soc_rl6231 ov5670 ov13858 acpi_als v4l2_fwnode dw9714 fuse xt_MASQUERADE iio_trig_sysfs cros_ec_light_prox cros_ec_sensors cros_ec_sensors_core cros_ec_sensors_ring industrialio_triggered_buffer kfifo_buf industrialio cros_ec_sensorhub cdc_ether usbnet btusb btrtl btintel btbcm bluetooth ecdh_generic ecc lzo_rle lzo_compress iwlmvm zram iwl7000_mac80211 r8152 mii iwlwifi cfg80211 joydev [ 16.584243] gsmi: Log Shutdown Reason 0x03 [ 16.584246] CR2: 0000000000000050 [ 16.584248] ---[ end trace c8511d090c11edff ]---
--- sound/soc/intel/boards/kbl_rt5663_max98927.c | 39 ++++++++++++++++---- 1 file changed, 31 insertions(+), 8 deletions(-)
sound/soc/intel/boards/kbl_rt5663_max98927.c +31 -8
@@ -401,17 +401,40 @@ static int kabylake_ssp_fixup(struct snd_soc_pcm_runtime *rtd,struct snd_interval *chan =hw_param_interval (params,SNDRV_PCM_HW_PARAM_CHANNELS );struct snd_mask *fmt =hw_param_mask (params,SNDRV_PCM_HW_PARAM_FORMAT ); -struct snd_soc_dpcm *dpcm =container_of ( - params, struct snd_soc_dpcm, hw_params); -struct snd_soc_dai_link *fe_dai_link = dpcm->fe->dai_link; -struct snd_soc_dai_link *be_dai_link = dpcm->be->dai_link; +struct snd_soc_dpcm *dpcm, *rtd_dpcm =NULL ; + +/* +* The following loop will be called only for playback stream +* In this platform, there is only one playback device on every SSP +*/ +for_each_dpcm_fe (rtd,SNDRV_PCM_STREAM_PLAYBACK , dpcm) { + rtd_dpcm = dpcm; +break ; + } + +/* +* This following loop will be called only for capture stream +* In this platform, there is only one capture device on every SSP +*/ +for_each_dpcm_fe (rtd,SNDRV_PCM_STREAM_CAPTURE , dpcm) { + rtd_dpcm = dpcm; +break ; + } + +if (!rtd_dpcm) +return -EINVAL ; + +/* +* The above 2 loops are mutually exclusive based on the stream direction, +* thus rtd_dpcm variable will never be overwritten +*/ /* * The ADSP will convert the FE rate to 48k, stereo, 24 bit */ -if (!strcmp (fe_dai_link->name,"Kbl Audio Port" ) || - !strcmp (fe_dai_link->name,"Kbl Audio Headset Playback" ) || - !strcmp (fe_dai_link->name,"Kbl Audio Capture Port" )) { +if (!strcmp (rtd_dpcm->fe->dai_link->name,"Kbl Audio Port" ) || + !strcmp (rtd_dpcm->fe->dai_link->name,"Kbl Audio Headset Playback" ) || + !strcmp (rtd_dpcm->fe->dai_link->name,"Kbl Audio Capture Port" )) { rate->min = rate->max =48000 ; chan->min = chan->max =2 ;snd_mask_none (fmt);
@@ -421,7 +444,7 @@ static int kabylake_ssp_fixup(struct snd_soc_pcm_runtime *rtd,* The speaker on the SSP0 supports S16_LE and not S24_LE. * thus changing the mask here */ -if (!strcmp (be_dai_link->name,"SSP0-Codec" )) +if (!strcmp (rtd_dpcm->be->dai_link->name,"SSP0-Codec" ))snd_mask_set_format (fmt,SNDRV_PCM_FORMAT_S16_LE );return 0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 8/255 genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
[ Upstream commit 151a535171be6ff824a0a3875553ea38570f4c05 ]
kernel/irq/ipi.c otherwise fails to compile if nothing else selects it.
--- kernel/irq/Kconfig | 1 + 1 file changed, 1 insertion(+)
kernel/irq/Kconfig +1 -0
@@ -82,6 +82,7 @@ config IRQ_FASTEOI_HIERARCHY_HANDLERS # Generic IRQ IPI support config GENERIC_IRQ_IPI bool + select IRQ_DOMAIN_HIERARCHY # Generic MSI interrupt support config GENERIC_MSI_IRQ
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 9/255 hv_balloon: disable warning when floor reached
In reply to Greg Kroah-HartmanFrom: Olaf Hering <[email protected]>
[ Upstream commit 2c3bd2a5c86fe744e8377733c5e511a5ca1e14f5 ]
It is not an error if the host requests to balloon down, but the VM refuses to do so. Without this change a warning is logged in dmesg every five minutes.
--- drivers/hv/hv_balloon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hv/hv_balloon.c +1 -1
@@ -1275,7 +1275,7 @@ static void balloon_up(struct work_struct *dummy)/* Refuse to balloon below the floor. */ if (avail_pages < num_pages || avail_pages - num_pages < floor) { -pr_warn ("Balloon request will be partially fulfilled. %s\n" , +pr_info ("Balloon request will be partially fulfilled. %s\n" , avail_pages < num_pages ?"Not enough memory." :"Balloon floor reached." );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 10/255 net: xfrm: fix a race condition during allocing spi
In reply to Greg Kroah-HartmanFrom: zhuoliang zhang <[email protected]>
[ Upstream commit a779d91314ca7208b7feb3ad817b62904397c56d ]
we found that the following race condition exists in xfrm_alloc_userspi flow:
user thread state_hash_work thread
---- ----xfrm_alloc_userspi()
__find_acq_core()
/*alloc new xfrm_state:x*/
xfrm_state_alloc()
/*schedule state_hash_work thread*/
xfrm_hash_grow_check() xfrm_hash_resize()
xfrm_alloc_spi /*hold lock*/
x->id.spi = htonl(spi) spin_lock_bh(&net->xfrm.xfrm_state_lock)
/*waiting lock release*/ xfrm_hash_transfer()
spin_lock_bh(&net->xfrm.xfrm_state_lock) /*add x into hlist:net->xfrm.state_byspi*/
hlist_add_head_rcu(&x->byspi)
spin_unlock_bh(&net->xfrm.xfrm_state_lock)
/*add x into hlist:net->xfrm.state_byspi 2 times*/
hlist_add_head_rcu(&x->byspi)1. a new state x is alloced in xfrm_state_alloc() and added into the bydst hlist in __find_acq_core() on the LHS;
2. on the RHS, state_hash_work thread travels the old bydst and tranfers every xfrm_state (include x) into the new bydst hlist and new byspi hlist;
3. user thread on the LHS gets the lock and adds x into the new byspi hlist again.
So the same xfrm_state (x) is added into the same list_hash (net->xfrm.state_byspi) 2 times that makes the list_hash become an inifite loop.
To fix the race, x->id.spi = htonl(spi) in the xfrm_alloc_spi() is moved to the back of spin_lock_bh, sothat state_hash_work thread no longer add x which id.spi is zero into the hash_list.
--- net/xfrm/xfrm_state.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/xfrm/xfrm_state.c +5 -3
@@ -2004,6 +2004,7 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)int err = -ENOENT ;__be32 minspi =htonl (low);__be32 maxspi =htonl (high); +__be32 newspi =0 ;u32 mark = x->mark.v & x->mark.m;spin_lock_bh (&x->lock);
@@ -2022,21 +2023,22 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)xfrm_state_put (x0); goto unlock; } - x->id.spi = minspi; + newspi = minspi; }else {u32 spi =0 ;for (h =0 ; h < high-low+1 ; h++) { spi = low +prandom_u32 ()%(high-low+1 ); x0 =xfrm_state_lookup (net, mark, &x->id.daddr,htonl (spi), x->id.proto, x->props.family);if (x0 ==NULL ) { - x->id.spi =htonl (spi); + newspi =htonl (spi);break ; }xfrm_state_put (x0); } } -if (x->id.spi) { +if (newspi) {spin_lock_bh (&net->xfrm.xfrm_state_lock); + x->id.spi = newspi; h =xfrm_spi_hash (net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);hlist_add_head_rcu (&x->byspi, net->xfrm.state_byspi + h);spin_unlock_bh (&net->xfrm.xfrm_state_lock);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 11/255 ASoC: codecs: wsa881x: add missing stream rates and format
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit f47d0742515748162d3fc35f04331c5b81c0ed47 ]
Add missing supported rates and formats for the stream, without which attempt to do playback will fail to find any matching rates/format.
--- sound/soc/codecs/wsa881x.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/codecs/wsa881x.c +2 -0
@@ -1026,6 +1026,8 @@ static struct snd_soc_dai_driver wsa881x_dais[] = { .id = 0, .playback = { .stream_name = "SPKR Playback", + .rates = SNDRV_PCM_RATE_48000, + .formats = SNDRV_PCM_FMTBIT_S16_LE, .rate_max = 48000, .rate_min = 48000, .channels_min = 1,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 12/255 spi: imx: fix runtime pm support for !CONFIG_PM
In reply to Greg Kroah-HartmanFrom: Sascha Hauer <[email protected]>
[ Upstream commit 43b6bf406cd0319e522638f97c9086b7beebaeaa ]
525c9e5a32bd introduced pm_runtime support for the i.MX SPI driver. With this pm_runtime is used to bring up the clocks initially. When CONFIG_PM is disabled the clocks are no longer enabled and the driver doesn't work anymore. Fix this by enabling the clocks in the probe function and telling pm_runtime that the device is active using pm_runtime_set_active().
--- drivers/spi/spi-imx.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-)
drivers/spi/spi-imx.c +15 -8
@@ -1674,15 +1674,18 @@ static int spi_imx_probe(struct platform_device *pdev) goto out_master_put; } -pm_runtime_enable (spi_imx->dev); + ret =clk_prepare_enable (spi_imx->clk_per); +if (ret) + goto out_master_put; + + ret =clk_prepare_enable (spi_imx->clk_ipg); +if (ret) + goto out_put_per; +pm_runtime_set_autosuspend_delay (spi_imx->dev,MXC_RPM_TIMEOUT );pm_runtime_use_autosuspend (spi_imx->dev); - - ret =pm_runtime_get_sync (spi_imx->dev); -if (ret <0 ) { -dev_err (spi_imx->dev,"failed to enable clock\n" ); - goto out_runtime_pm_put; - } +pm_runtime_set_active (spi_imx->dev); +pm_runtime_enable (spi_imx->dev); spi_imx->spi_clk =clk_get_rate (spi_imx->clk_per);/*
@@ -1722,8 +1725,12 @@ out_bitbang_start:spi_imx_sdma_exit (spi_imx); out_runtime_pm_put:pm_runtime_dont_use_autosuspend (spi_imx->dev); -pm_runtime_put_sync (spi_imx->dev); +pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (spi_imx->dev); + +clk_disable_unprepare (spi_imx->clk_ipg); +out_put_per: +clk_disable_unprepare (spi_imx->clk_per); out_master_put:spi_master_put (master);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 13/255 irqchip/sifive-plic: Fix broken irq_set_affinity() callback
In reply to Greg Kroah-HartmanFrom: Greentime Hu <[email protected]>
[ Upstream commit a7480c5d725c4ecfc627e70960f249c34f5d13e8 ]
An interrupt submitted to an affinity change will always be left enabled after plic_set_affinity() has been called, while the expectation is that it should stay in whatever state it was before the call.
Preserving the configuration fixes a PWM hang issue on the Unleashed board.
[ 919.015783] rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [ 919.020922] rcu: 0-...0: (0 ticks this GP) idle=7d2/1/0x4000000000000002 softirq=1424/1424 fqs=105807 [ 919.030295] (detected by 1, t=225825 jiffies, g=1561, q=3496) [ 919.036109] Task dump for CPU 0: [ 919.039321] kworker/0:1 R running task 0 30 2 0x00000008 [ 919.046359] Workqueue: events set_brightness_delayed [ 919.051302] Call Trace: [ 919.053738] [<ffffffe000930d92>] __schedule+0x194/0x4de [ 982.035783] rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [ 982.040923] rcu: 0-...0: (0 ticks this GP) idle=7d2/1/0x4000000000000002 softirq=1424/1424 fqs=113325 [ 982.050294] (detected by 1, t=241580 jiffies, g=1561, q=3509) [ 982.056108] Task dump for CPU 0: [ 982.059321] kworker/0:1 R running task 0 30 2 0x00000008 [ 982.066359] Workqueue: events set_brightness_delayed [ 982.071302] Call Trace: [ 982.073739] [<ffffffe000930d92>] __schedule+0x194/0x4de
[..]
--- drivers/irqchip/irq-sifive-plic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/irq-sifive-plic.c +1 -1
@@ -151,7 +151,7 @@ static int plic_set_affinity(struct irq_data *d,return -EINVAL ;plic_irq_toggle (&priv->lmask, d,0 ); -plic_irq_toggle (cpumask_of (cpu), d,1 ); +plic_irq_toggle (cpumask_of (cpu), d, !irqd_irq_masked (d));irq_data_update_effective_affinity (d,cpumask_of (cpu));
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 14/255 kunit: Fix kunit.py --raw_output option
In reply to Greg Kroah-HartmanFrom: David Gow <[email protected]>
[ Upstream commit 3023d8ff3fc60e5d32dc1d05f99ad6ffa12b0033 ]
Due to the raw_output() function on kunit_parser.py actually being a generator, it only runs if something reads the lines it returns. Since we no-longer do that (parsing doesn't actually happen if raw_output is enabled), it was not printing anything.
--- tools/testing/kunit/kunit_parser.py | 1 - 1 file changed, 1 deletion(-)
tools/testing/kunit/kunit_parser.py +0 -1
@@ -65,7 +65,6 @@ def isolate_kunit_output(kernel_output): def raw_output(kernel_output): for line in kernel_output: print(line) - yield line DIVIDER = '=' * 60
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 15/255 kunit: Dont fail test suites if one of them is empty
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 3fc48259d5250f7a3ee021ad0492b604c428c564 ]
Empty test suite is okay test suite.
Don't fail the rest of the test suites if one of them is empty.
--- tools/testing/kunit/kunit_parser.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/kunit/kunit_parser.py +1 -1
@@ -232,7 +232,7 @@ def parse_test_suite(lines: List[str]) -> TestSuite: return None test_suite.name = name expected_test_case_num = parse_subtest_plan(lines) - if not expected_test_case_num: + if expected_test_case_num is None: return None while expected_test_case_num > 0: test_case = parse_test_case(lines)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 16/255 usb: gadget: fsl: fix null pointer checking
In reply to Greg Kroah-HartmanFrom: Ran Wang <[email protected]>
[ Upstream commit 48e7bbbbb261b007fe78aa14ae62df01d236497e ]
fsl_ep_fifo_status() should return error if _ep->desc is null.
--- drivers/usb/gadget/udc/fsl_udc_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/fsl_udc_core.c +1 -1
@@ -1051,7 +1051,7 @@ static int fsl_ep_fifo_status(struct usb_ep *_ep)u32 bitmask;struct ep_queue_head *qh; -if (!_ep || _ep->desc || !(_ep->desc->bEndpointAddress&0xF )) +if (!_ep || !_ep->desc || !(_ep->desc->bEndpointAddress&0xF ))return -ENODEV ; ep = container_of(_ep, struct fsl_ep, ep);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 17/255 selftests: filter kselftest headers from command in lib.mk
In reply to Greg Kroah-HartmanFrom: Tommi Rantala <[email protected]>
[ Upstream commit f825d3f7ed9305e7dd0a3e0a74673a4257d0cc53 ]
Commit 1056d3d2c97e ("selftests: enforce local header dependency in lib.mk") added header dependency to the rule, but as the rule uses $^, the headers are added to the compiler command line.
This can cause unexpected precompiled header files being generated when compilation fails:
$ echo { >> openat2_test.c $ make
gcc -Wall -O2 -g -fsanitize=address -fsanitize=undefined openat2_test.c
tools/testing/selftests/kselftest_harness.h tools/testing/selftests/kselftest.h helpers.c
-o tools/testing/selftests/openat2/openat2_test
openat2_test.c:313:1: error: expected identifier or ‘(’ before ‘{’ token
313 | {
| ^
make: *** [../lib.mk:140: tools/testing/selftests/openat2/openat2_test] Error 1$ file openat2_test* openat2_test: GCC precompiled header (version 014) for C openat2_test.c: C source, ASCII text
Fix it by filtering out the headers, so that we'll only pass the actual *.c files in the compiler command line.
--- tools/testing/selftests/lib.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/lib.mk +1 -1
@@ -137,7 +137,7 @@ endif ifeq ($(OVERRIDE_TARGETS),) LOCAL_HDRS := $(selfdir)/kselftest_harness.h $(selfdir)/kselftest.h $(OUTPUT)/%:%.c $(LOCAL_HDRS) - $(LINK.c) $^ $(LDLIBS) -o $@ + $(LINK.c) $(filter-out $(LOCAL_HDRS),$^) $(LDLIBS) -o $@ $(OUTPUT)/%.o:%.S $(COMPILE.S) $^ -o $@
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 18/255 ASoC: codecs: wcd934x: Set digital gain range correctly
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit fc0522bbe02fa4beb95c0514ace66b585616f111 ]
digital gain range is -84dB min to 40dB max, however this was not correctly specified in the range.
Fix this by with correct range!
--- sound/soc/codecs/wcd934x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wcd934x.c +1 -1
@@ -551,7 +551,7 @@ struct wcd_iir_filter_ctl {struct soc_bytes_ext bytes_ext; }; -static const DECLARE_TLV_DB_SCALE(digital_gain, 0, 1, 0); +static const DECLARE_TLV_DB_SCALE(digital_gain, -8400, 100, -8400); static const DECLARE_TLV_DB_SCALE(line_gain, 0, 7, 1); static const DECLARE_TLV_DB_SCALE(analog_gain, 0, 25, 1); static const DECLARE_TLV_DB_SCALE(ear_pa_gain, 0, 150, 0);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 19/255 ASoC: codecs: wcd9335: Set digital gain range correctly
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit 6d6bc54ab4f2404d46078abc04bf4dee4db01def ]
digital gain range is -84dB min to 40dB max, however this was not correctly specified in the range.
Fix this by with correct range!
--- sound/soc/codecs/wcd9335.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wcd9335.c +1 -1
@@ -618,7 +618,7 @@ static const char * const sb_tx8_mux_text[] = {"ZERO" ,"RX_MIX_TX8" ,"DEC8" ,"DEC8_192" }; -static const DECLARE_TLV_DB_SCALE(digital_gain, 0, 1, 0); +static const DECLARE_TLV_DB_SCALE(digital_gain, -8400, 100, -8400); static const DECLARE_TLV_DB_SCALE(line_gain, 0, 7, 1); static const DECLARE_TLV_DB_SCALE(analog_gain, 0, 25, 1); static const DECLARE_TLV_DB_SCALE(ear_pa_gain, 0, 150, 0);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 20/255 mtd: spi-nor: Fix address width on flash chips > 16MB
In reply to Greg Kroah-HartmanFrom: Bert Vermeulen <[email protected]>
[ Upstream commit 324f78dfb442b82365548b657ec4e6974c677502 ]
If a flash chip has more than 16MB capacity but its BFPT reports BFPT_DWORD1_ADDRESS_BYTES_3_OR_4, the spi-nor framework defaults to 3.
The check in spi_nor_set_addr_width() doesn't catch it because addr_width did get set. This fixes that check.
--- drivers/mtd/spi-nor/core.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/mtd/spi-nor/core.c +5 -3
@@ -3008,13 +3008,15 @@ static int spi_nor_set_addr_width(struct spi_nor *nor)/* already configured from SFDP */ }else if (nor->info->addr_width) { nor->addr_width = nor->info->addr_width; - }else if (nor->mtd.size >0x1000000 ) { -/* enable 4-byte addressing if the device exceeds 16MiB */ - nor->addr_width =4 ; }else { nor->addr_width =3 ; } +if (nor->addr_width ==3 && nor->mtd.size >0x1000000 ) { +/* enable 4-byte addressing if the device exceeds 16MiB */ + nor->addr_width =4 ; + } +if (nor->addr_width >SPI_NOR_MAX_ADDR_WIDTH ) {dev_dbg (nor->dev,"address width is too large: %u\n" , nor->addr_width);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 21/255 xfs: set xefi_discard when creating a deferred agfl free log intent item
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit 2c334e12f957cd8c6bb66b4aa3f79848b7c33cab ]
Make sure that we actually initialize xefi_discard when we're scheduling a deferred free of an AGFL block. This was (eventually) found by the UBSAN while I was banging on realtime rmap problems, but it exists in the upstream codebase. While we're at it, rearrange the structure to reduce the struct size from 64 to 56 bytes.
--- fs/xfs/libxfs/xfs_alloc.c | 1 + fs/xfs/libxfs/xfs_bmap.h | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
fs/xfs/libxfs/xfs_alloc.c +1 -0
@@ -2467,6 +2467,7 @@ xfs_defer_agfl_block( new->xefi_startblock =XFS_AGB_TO_FSB (mp, agno, agbno); new->xefi_blockcount =1 ; new->xefi_oinfo = *oinfo; + new->xefi_skip_discard = false;trace_xfs_agfl_free_defer (mp, agno,0 , agbno,1 );
fs/xfs/libxfs/xfs_bmap.h +1 -1
@@ -52,9 +52,9 @@ struct xfs_extent_free_item {xfs_fsblock_t xefi_startblock;/* starting fs block number */ xfs_extlen_t xefi_blockcount;/* number of blocks in extent */ +bool xefi_skip_discard;struct list_head xefi_list;struct xfs_owner_info xefi_oinfo;/* extent owner */ -bool xefi_skip_discard; };#define XFS_BMAP_MAX_NMAP 4
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 22/255 mac80211: dont require VHT elements for HE on 2.4 GHz
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit c2f46814521113f6699a74e0a0424cbc5b305479 ]
After the previous similar bugfix there was another bug here, if no VHT elements were found we also disabled HE. Fix this to disable HE only on the 5 GHz band; on 6 GHz it was already not disabled, and on 2.4 GHz there need (should) not be any VHT.
--- net/mac80211/mlme.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/mlme.c +2 -1
@@ -5359,6 +5359,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata, struct cfg80211_assoc_request *req) {bool is_6ghz = req->bss->channel->band ==NL80211_BAND_6GHZ ; +bool is_5ghz = req->bss->channel->band ==NL80211_BAND_5GHZ ;struct ieee80211_local *local = sdata->local;struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;struct ieee80211_bss *bss = (void *)req->bss->priv;
@@ -5507,7 +5508,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,if (vht_ie && vht_ie[1 ] >=sizeof (struct ieee80211_vht_cap ))memcpy (&assoc_data->ap_vht_cap, vht_ie +2 ,sizeof (struct ieee80211_vht_cap )); -else if (!is_6ghz) +else if (is_5ghz) ifmgd->flags |=IEEE80211_STA_DISABLE_VHT |IEEE80211_STA_DISABLE_HE ;rcu_read_unlock ();
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 23/255 netfilter: nftables: fix netlink report logic in flowtable and genid
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit dceababac29d1c53cbc1f7ddf6f688d2df01da87 ]
The netlink report should be sent regardless the available listeners.
--- net/netfilter/nf_tables_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +2 -2
@@ -7076,7 +7076,7 @@ static void nf_tables_flowtable_notify(struct nft_ctx *ctx, GFP_KERNEL);kfree (buf); -if (ctx->report && +if (!ctx->report && !nfnetlink_has_listeners (ctx->net,NFNLGRP_NFTABLES ))return ;
@@ -7198,7 +7198,7 @@ static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,audit_log_nfcfg ("?:0;?:0" ,0 , net->nft.base_seq,AUDIT_NFT_OP_GEN_REGISTER ,GFP_KERNEL ); -if (nlmsg_report (nlh) && +if (!nlmsg_report (nlh) && !nfnetlink_has_listeners (net,NFNLGRP_NFTABLES ))return ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 24/255 netfilter: use actual socket sk rather than skb sk when routing harder
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
[ Upstream commit 46d6c5ae953cc0be38efd0e469284df7c4328cf8 ]
If netfilter changes the packet mark when mangling, the packet is rerouted using the route_me_harder set of functions. Prior to this commit, there's one big difference between route_me_harder and the ordinary initial routing functions, described in the comment above __ip_queue_xmit():
/* Note: skb->sk can be different from sk, in case of tunnels */ int __ip_queue_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
That function goes on to correctly make use of sk->sk_bound_dev_if, rather than skb->sk->sk_bound_dev_if. And indeed the comment is true: a tunnel will receive a packet in ndo_start_xmit with an initial skb->sk. It will make some transformations to that packet, and then it will send the encapsulated packet out of a *new* socket. That new socket will basically always have a different sk_bound_dev_if (otherwise there'd be a routing loop). So for the purposes of routing the encapsulated packet, the routing information as it pertains to the socket should come from that socket's sk, rather than the packet's original skb->sk. For that reason __ip_queue_xmit() and related functions all do the right thing.
One might argue that all tunnels should just call skb_orphan(skb) before transmitting the encapsulated packet into the new socket. But tunnels do *not* do this -- and this is wisely avoided in skb_scrub_packet() too -- because features like TSQ rely on skb->destructor() being called when that buffer space is truely available again. Calling skb_orphan(skb) too early would result in buffers filling up unnecessarily and accounting info being all wrong. Instead, additional routing must take into account the new sk, just as __ip_queue_xmit() notes.
So, this commit addresses the problem by fishing the correct sk out of state->sk -- it's already set properly in the call to nf_hook() in __ip_local_out(), which receives the sk as part of its normal functionality. So we make sure to plumb state->sk through the various route_me_harder functions, and then make correct use of it following the example of __ip_queue_xmit().
--- include/linux/netfilter_ipv4.h | 2 +- include/linux/netfilter_ipv6.h | 10 +++++----- net/ipv4/netfilter.c | 8 +++++--- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 2 +- net/ipv6/netfilter.c | 6 +++--- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/netfilter/ipvs/ip_vs_core.c | 4 ++-- net/netfilter/nf_nat_proto.c | 4 ++-- net/netfilter/nf_synproxy_core.c | 2 +- net/netfilter/nft_chain_route.c | 4 ++-- net/netfilter/utils.c | 4 ++-- 12 files changed, 26 insertions(+), 24 deletions(-)
include/linux/netfilter_ipv4.h +1 -1
@@ -16,7 +16,7 @@ struct ip_rt_info {u_int32_t mark; }; -int ip_route_me_harder (struct net *net,struct sk_buff *skb,unsigned addr_type); +int ip_route_me_harder (struct net *net,struct sock *sk,struct sk_buff *skb,unsigned addr_type);struct nf_queue_entry ;
include/linux/netfilter_ipv6.h +5 -5
@@ -42,7 +42,7 @@ struct nf_ipv6_ops {#if IS_MODULE (CONFIG_IPV6 )int (*chk_addr)(struct net *net,const struct in6_addr *addr,const struct net_device *dev,int strict); -int (*route_me_harder)(struct net *net,struct sk_buff *skb); +int (*route_me_harder)(struct net *net,struct sock *sk,struct sk_buff *skb);int (*dev_get_saddr)(struct net *net,const struct net_device *dev,const struct in6_addr *daddr,unsigned int srcprefs,struct in6_addr *saddr);
@@ -143,9 +143,9 @@ static inline int nf_br_ip6_fragment(struct net *net, struct sock *sk,#endif } -int ip6_route_me_harder (struct net *net,struct sk_buff *skb); +int ip6_route_me_harder (struct net *net,struct sock *sk,struct sk_buff *skb); -static inline int nf_ip6_route_me_harder (struct net *net,struct sk_buff *skb) +static inline int nf_ip6_route_me_harder (struct net *net,struct sock *sk,struct sk_buff *skb) {#if IS_MODULE (CONFIG_IPV6 )const struct nf_ipv6_ops *v6_ops =nf_get_ipv6_ops ();
@@ -153,9 +153,9 @@ static inline int nf_ip6_route_me_harder(struct net *net, struct sk_buff *skb)if (!v6_ops)return -EHOSTUNREACH ; -return v6_ops->route_me_harder (net, skb); +return v6_ops->route_me_harder (net, sk, skb);#elif IS_BUILTIN (CONFIG_IPV6 ) -return ip6_route_me_harder (net, skb); +return ip6_route_me_harder (net, sk, skb);#else return -EHOSTUNREACH ;#endif
net/ipv4/netfilter.c +5 -3
@@ -17,17 +17,19 @@#include <net/netfilter/nf_queue.h> /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */ -int ip_route_me_harder (struct net *net,struct sk_buff *skb,unsigned int addr_type) +int ip_route_me_harder (struct net *net,struct sock *sk,struct sk_buff *skb,unsigned int addr_type) {const struct iphdr *iph =ip_hdr (skb);struct rtable *rt;struct flowi4 fl4 = {};__be32 saddr = iph->saddr; -const struct sock *sk =skb_to_full_sk (skb); -__u8 flags = sk ?inet_sk_flowi_flags (sk) :0 ; +__u8 flags;struct net_device *dev =skb_dst (skb)->dev;unsigned int hh_len; + sk =sk_to_full_sk (sk); + flags = sk ?inet_sk_flowi_flags (sk) :0 ; +if (addr_type ==RTN_UNSPEC ) addr_type =inet_addr_type_dev_table (net, dev, saddr);if (addr_type ==RTN_LOCAL || addr_type ==RTN_UNICAST )
net/ipv4/netfilter/iptable_mangle.c +1 -1
@@ -62,7 +62,7 @@ ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state) iph->daddr != daddr || skb->mark != mark || iph->tos != tos) { - err =ip_route_me_harder (state->net, skb,RTN_UNSPEC ); + err =ip_route_me_harder (state->net, state->sk, skb,RTN_UNSPEC );if (err <0 ) ret =NF_DROP_ERR (err); }
net/ipv4/netfilter/nf_reject_ipv4.c +1 -1
@@ -145,7 +145,7 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook) ip4_dst_hoplimit(skb_dst(nskb)));nf_reject_ip_tcphdr_put (nskb, oldskb, oth); -if (ip_route_me_harder (net, nskb,RTN_UNSPEC )) +if (ip_route_me_harder (net, nskb->sk, nskb,RTN_UNSPEC )) goto free_nskb; niph =ip_hdr (nskb);
net/ipv6/netfilter.c +3 -3
@@ -20,10 +20,10 @@#include <net/netfilter/ipv6/nf_defrag_ipv6.h> #include "../bridge/br_private.h" -int ip6_route_me_harder (struct net *net,struct sk_buff *skb) +int ip6_route_me_harder (struct net *net,struct sock *sk_partial,struct sk_buff *skb) {const struct ipv6hdr *iph =ipv6_hdr (skb); -struct sock *sk =sk_to_full_sk (skb->sk); +struct sock *sk =sk_to_full_sk (sk_partial);unsigned int hh_len;struct dst_entry *dst; int strict = (ipv6_addr_type(&iph->daddr) &
@@ -84,7 +84,7 @@ static int nf_ip6_reroute(struct sk_buff *skb,if (!ipv6_addr_equal (&iph->daddr, &rt_info->daddr) || !ipv6_addr_equal (&iph->saddr, &rt_info->saddr) || skb->mark != rt_info->mark) -return ip6_route_me_harder (entry->state.net, skb); +return ip6_route_me_harder (entry->state.net, entry->state.sk, skb); }return 0 ; }
net/ipv6/netfilter/ip6table_mangle.c +1 -1
@@ -57,7 +57,7 @@ ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state) skb->mark != mark || ipv6_hdr(skb)->hop_limit != hop_limit || flowlabel != *((u_int32_t *)ipv6_hdr(skb)))) { - err =ip6_route_me_harder (state->net, skb); + err =ip6_route_me_harder (state->net, state->sk, skb);if (err <0 ) ret =NF_DROP_ERR (err); }
net/netfilter/ipvs/ip_vs_core.c +2 -2
@@ -742,12 +742,12 @@ static int ip_vs_route_me_harder(struct netns_ipvs *ipvs, int af,struct dst_entry *dst =skb_dst (skb);if (dst->dev && !(dst->dev->flags &IFF_LOOPBACK ) && -ip6_route_me_harder (ipvs->net, skb) !=0 ) +ip6_route_me_harder (ipvs->net, skb->sk, skb) !=0 )return 1 ; } else#endif if (!(skb_rtable (skb)->rt_flags &RTCF_LOCAL ) && -ip_route_me_harder (ipvs->net, skb,RTN_LOCAL ) !=0 ) +ip_route_me_harder (ipvs->net, skb->sk, skb,RTN_LOCAL ) !=0 )return 1 ;return 0 ;
net/netfilter/nf_nat_proto.c +2 -2
@@ -715,7 +715,7 @@ nf_nat_ipv4_local_fn(void *priv, struct sk_buff *skb,if (ct->tuplehash[dir].tuple.dst.u3.ip != ct->tuplehash[!dir].tuple.src.u3.ip) { - err =ip_route_me_harder (state->net, skb,RTN_UNSPEC ); + err =ip_route_me_harder (state->net, state->sk, skb,RTN_UNSPEC );if (err <0 ) ret =NF_DROP_ERR (err); }
@@ -953,7 +953,7 @@ nf_nat_ipv6_local_fn(void *priv, struct sk_buff *skb,if (!nf_inet_addr_cmp (&ct->tuplehash[dir].tuple.dst.u3, &ct->tuplehash[!dir].tuple.src.u3)) { - err =nf_ip6_route_me_harder (state->net, skb); + err =nf_ip6_route_me_harder (state->net, state->sk, skb);if (err <0 ) ret =NF_DROP_ERR (err); }
net/netfilter/nf_synproxy_core.c +1 -1
@@ -446,7 +446,7 @@ synproxy_send_tcp(struct net *net,skb_dst_set_noref (nskb,skb_dst (skb)); nskb->protocol =htons (ETH_P_IP ); -if (ip_route_me_harder (net, nskb,RTN_UNSPEC )) +if (ip_route_me_harder (net, nskb->sk, nskb,RTN_UNSPEC )) goto free_nskb;if (nfct) {
net/netfilter/nft_chain_route.c +2 -2
@@ -42,7 +42,7 @@ static unsigned int nf_route_table_hook4(void *priv, iph->daddr != daddr || skb->mark != mark || iph->tos != tos) { - err =ip_route_me_harder (state->net, skb,RTN_UNSPEC ); + err =ip_route_me_harder (state->net, state->sk, skb,RTN_UNSPEC );if (err <0 ) ret =NF_DROP_ERR (err); }
@@ -92,7 +92,7 @@ static unsigned int nf_route_table_hook6(void *priv, skb->mark != mark || ipv6_hdr(skb)->hop_limit != hop_limit || flowlabel != *((u32 *)ipv6_hdr(skb)))) { - err =nf_ip6_route_me_harder (state->net, skb); + err =nf_ip6_route_me_harder (state->net, state->sk, skb);if (err <0 ) ret =NF_DROP_ERR (err); }
net/netfilter/utils.c +2 -2
@@ -191,8 +191,8 @@ static int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry skb->mark == rt_info->mark && iph->daddr == rt_info->daddr && iph->saddr == rt_info->saddr)) -return ip_route_me_harder (entry->state.net, skb, - RTN_UNSPEC); +return ip_route_me_harder (entry->state.net, entry->state.sk, + skb, RTN_UNSPEC); }#endif return 0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 25/255 netfilter: nf_tables: missing validation from the abort path
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit c0391b6ab810381df632677a1dcbbbbd63d05b6d ]
If userspace does not include the trailing end of batch message, then nfnetlink aborts the transaction. This allows to check that ruleset updates trigger no errors.
After this patch, invoking this command from the prerouting chain:
# nft -c add rule x y fib saddr . oif type local
fails since oif is not supported there.
This patch fixes the lack of rule validation from the abort/check path to catch configuration errors such as the one above.
--- include/linux/netfilter/nfnetlink.h | 9 ++++++++- net/netfilter/nf_tables_api.c | 15 ++++++++++----- net/netfilter/nfnetlink.c | 22 ++++++++++++++++++---- 3 files changed, 36 insertions(+), 10 deletions(-)
include/linux/netfilter/nfnetlink.h +8 -1
@@ -24,6 +24,12 @@ struct nfnl_callback {const u_int16_t attr_count;/* number of nlattr's */ }; +enum nfnl_abort_action { +NFNL_ABORT_NONE =0 , +NFNL_ABORT_AUTOLOAD , +NFNL_ABORT_VALIDATE , +}; +struct nfnetlink_subsystem {const char *name;__u8 subsys_id;/* nfnetlink subsystem ID */
@@ -31,7 +37,8 @@ struct nfnetlink_subsystem {const struct nfnl_callback *cb;/* callback for individual types */ struct module *owner;int (*commit)(struct net *net,struct sk_buff *skb); -int (*abort)(struct net *net,struct sk_buff *skb,bool autoload); +int (*abort)(struct net *net,struct sk_buff *skb, +enum nfnl_abort_action action);void (*cleanup)(struct net *net);bool (*valid_genid)(struct net *net,u32 genid); };
net/netfilter/nf_tables_api.c +10 -5
@@ -7992,12 +7992,16 @@ static void nf_tables_abort_release(struct nft_trans *trans)kfree (trans); } -static int __nf_tables_abort (struct net *net,bool autoload) +static int __nf_tables_abort (struct net *net,enum nfnl_abort_action action) {struct nft_trans *trans, *next;struct nft_trans_elem *te;struct nft_hook *hook; +if (action ==NFNL_ABORT_VALIDATE && +nf_tables_validate (net) <0 ) +return -EAGAIN ; +list_for_each_entry_safe_reverse (trans, next, &net->nft.commit_list, list) {switch (trans->msg_type) {
@@ -8129,7 +8133,7 @@ static int __nf_tables_abort(struct net *net, bool autoload)nf_tables_abort_release (trans); } -if (autoload) +if (action ==NFNL_ABORT_AUTOLOAD )nf_tables_module_autoload (net);else nf_tables_module_autoload_cleanup (net);
@@ -8142,9 +8146,10 @@ static void nf_tables_cleanup(struct net *net)nft_validate_state_update (net,NFT_VALIDATE_SKIP ); } -static int nf_tables_abort (struct net *net,struct sk_buff *skb,bool autoload) +static int nf_tables_abort (struct net *net,struct sk_buff *skb, +enum nfnl_abort_action action) { -int ret =__nf_tables_abort (net, autoload); +int ret =__nf_tables_abort (net, action);mutex_unlock (&net->nft.commit_mutex);
@@ -8775,7 +8780,7 @@ static void __net_exit nf_tables_exit_net(struct net *net) {mutex_lock (&net->nft.commit_mutex);if (!list_empty (&net->nft.commit_list)) -__nf_tables_abort (net, false); +__nf_tables_abort (net,NFNL_ABORT_NONE );__nft_release_tables (net);mutex_unlock (&net->nft.commit_mutex);WARN_ON_ONCE (!list_empty (&net->nft.tables));
net/netfilter/nfnetlink.c +18 -4
@@ -316,7 +316,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,return netlink_ack (skb, nlh, -EINVAL ,NULL ); replay: status =0 ; - +replay_abort: skb =netlink_skb_clone (oskb,GFP_KERNEL );if (!skb)return netlink_ack (oskb, nlh, -ENOMEM ,NULL );
@@ -482,7 +482,7 @@ ack: } done:if (status &NFNL_BATCH_REPLAY ) { - ss->abort (net, oskb, true); + ss->abort (net, oskb,NFNL_ABORT_AUTOLOAD );nfnl_err_reset (&err_list);kfree_skb (skb);module_put (ss->owner);
@@ -493,11 +493,25 @@ done: status |=NFNL_BATCH_REPLAY ; goto done; }else if (err) { - ss->abort (net, oskb, false); + ss->abort (net, oskb,NFNL_ABORT_NONE );netlink_ack (oskb,nlmsg_hdr (oskb), err,NULL ); } }else { - ss->abort (net, oskb, false); +enum nfnl_abort_action abort_action; + +if (status &NFNL_BATCH_FAILURE ) + abort_action =NFNL_ABORT_NONE ; +else + abort_action =NFNL_ABORT_VALIDATE ; + + err = ss->abort (net, oskb, abort_action); +if (err == -EAGAIN ) { +nfnl_err_reset (&err_list); +kfree_skb (skb); +module_put (ss->owner); + status |=NFNL_BATCH_FAILURE ; + goto replay_abort; + } }if (ss->cleanup) ss->cleanup (net);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 26/255 PCI: Always enable ACS even if no ACS Capability
In reply to Greg Kroah-HartmanFrom: Rajat Jain <[email protected]>
[ Upstream commit 462b58fb033996e999cc213ed0b430d4f22a28fe ]
Some devices support ACS functionality even though they don't have a spec-compliant ACS Capability; pci_enable_acs() has a quirk mechanism to handle them.
We want to enable ACS whenever possible, but 52fbf5bdeeef ("PCI: Cache ACS capability offset in device") inadvertently broke this by calling pci_enable_acs() only if we find an ACS Capability.
This resulted in ACS not being enabled for these non-compliant devices, which means devices can't be separated into different IOMMU groups, which in turn means we may not be able to pass those devices through to VMs, as reported by Boris V:
https://lore.kernel.org/r/[email protected]
--- drivers/pci/pci.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/pci/pci.c +7 -2
@@ -3503,8 +3503,13 @@ void pci_acs_init(struct pci_dev *dev) { dev->acs_cap =pci_find_ext_capability (dev,PCI_EXT_CAP_ID_ACS ); -if (dev->acs_cap) -pci_enable_acs (dev); +/* +* Attempt to enable ACS regardless of capability because some Root +* Ports (e.g. those quirked with *_intel_pch_acs_*) do not have +* the standard ACS capability but still support ACS via those +* quirks. +*/ +pci_enable_acs (dev); }/**
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 27/255 netfilter: ipset: Update byte and packet counters regardless of whether they match
In reply to Greg Kroah-HartmanFrom: Stefano Brivio <[email protected]>
[ Upstream commit 7d10e62c2ff8e084c136c94d32d9a94de4d31248 ]
In ip_set_match_extensions(), for sets with counters, we take care of updating counters themselves by calling ip_set_update_counter(), and of checking if the given comparison and values match, by calling ip_set_match_counter() if needed.
However, if a given comparison on counters doesn't match the configured values, that doesn't mean the set entry itself isn't matching.
This fix restores the behaviour we had before commit 4750005a85f7 ("netfilter: ipset: Fix "don't update counters" mode when counters used at the matching"), without reintroducing the issue fixed there: back then, mtype_data_match() first updated counters in any case, and then took care of matching on counters.
Now, if the IPSET_FLAG_SKIP_COUNTER_UPDATE flag is set, ip_set_update_counter() will anyway skip counter updates if desired.
The issue observed is illustrated by this reproducer:
ipset create c hash:ip counters ipset add c 192.0.2.1 iptables -I INPUT -m set --match-set c src --bytes-gt 800 -j DROP
if we now send packets from 192.0.2.1, bytes and packets counters for the entry as shown by 'ipset list' are always zero, and, no matter how many bytes we send, the rule will never match, because counters themselves are not updated.
--- net/netfilter/ipset/ip_set_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/ipset/ip_set_core.c +2 -1
@@ -652,13 +652,14 @@ ip_set_match_extensions(struct ip_set *set, const struct ip_set_ext *ext,if (SET_WITH_COUNTER (set)) {struct ip_set_counter *counter =ext_counter (data, set); +ip_set_update_counter (counter, ext, flags); +if (flags &IPSET_FLAG_MATCH_COUNTERS && !(ip_set_match_counter (ip_set_get_packets (counter), mext->packets, mext->packets_op) &&ip_set_match_counter (ip_set_get_bytes (counter), mext->bytes, mext->bytes_op)))return false; -ip_set_update_counter (counter, ext, flags); }if (SET_WITH_SKBINFO (set)) ip_set_get_skbinfo(ext_skbinfo(data, set),
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 28/255 irqchip/sifive-plic: Fix chip_data access within a hierarchy
In reply to Greg Kroah-HartmanFrom: Greentime Hu <[email protected]>
[ Upstream commit f9ac7bbd6e4540dcc6df621b9c9b6eb2e26ded1d ]
The plic driver crashes in plic_irq_unmask() when the interrupt is within a hierarchy, as it picks the top-level chip_data instead of its local one.
Using irq_data_get_irq_chip_data() instead of irq_get_chip_data() solves the issue for good.
--- drivers/irqchip/irq-sifive-plic.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/irqchip/irq-sifive-plic.c +4 -4
@@ -99,7 +99,7 @@ static inline void plic_irq_toggle(const struct cpumask *mask, struct irq_data *d, int enable) { int cpu; -struct plic_priv *priv =irq_get_chip_data (d->irq); +struct plic_priv *priv =irq_data_get_irq_chip_data (d);writel (enable, priv->regs +PRIORITY_BASE + d->hwirq *PRIORITY_PER_ID );for_each_cpu (cpu, mask) {
@@ -115,7 +115,7 @@ static void plic_irq_unmask(struct irq_data *d) {struct cpumask amask;unsigned int cpu; -struct plic_priv *priv =irq_get_chip_data (d->irq); +struct plic_priv *priv =irq_data_get_irq_chip_data (d);cpumask_and (&amask, &priv->lmask, cpu_online_mask); cpu = cpumask_any_and(irq_data_get_affinity_mask(d),
@@ -127,7 +127,7 @@ static void plic_irq_unmask(struct irq_data *d)static void plic_irq_mask (struct irq_data *d) { -struct plic_priv *priv =irq_get_chip_data (d->irq); +struct plic_priv *priv =irq_data_get_irq_chip_data (d);plic_irq_toggle (&priv->lmask, d,0 ); }
@@ -138,7 +138,7 @@ static int plic_set_affinity(struct irq_data *d, {unsigned int cpu;struct cpumask amask; -struct plic_priv *priv =irq_get_chip_data (d->irq); +struct plic_priv *priv =irq_data_get_irq_chip_data (d);cpumask_and (&amask, &priv->lmask, mask_val);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 29/255 powerpc/eeh_cache: Fix a possible debugfs deadlock
In reply to Greg Kroah-HartmanFrom: Qian Cai <[email protected]>
[ Upstream commit fd552e0542b4532483289cce48fdbd27b692984b ]
Lockdep complains that a possible deadlock below in eeh_addr_cache_show() because it is acquiring a lock with IRQ enabled, but eeh_addr_cache_insert_dev() needs to acquire the same lock with IRQ disabled. Let's just make eeh_addr_cache_show() acquire the lock with IRQ disabled as well.
CPU0 CPU1
---- ----
lock(&pci_io_addr_cache_root.piar_lock);
local_irq_disable();
lock(&tp->lock);
lock(&pci_io_addr_cache_root.piar_lock);
<Interrupt>
lock(&tp->lock);*** DEADLOCK ***
lock_acquire+0x140/0x5f0 _raw_spin_lock_irqsave+0x64/0xb0 eeh_addr_cache_insert_dev+0x48/0x390 eeh_probe_device+0xb8/0x1a0 pnv_pcibios_bus_add_device+0x3c/0x80 pcibios_bus_add_device+0x118/0x290 pci_bus_add_device+0x28/0xe0 pci_bus_add_devices+0x54/0xb0 pcibios_init+0xc4/0x124 do_one_initcall+0xac/0x528 kernel_init_freeable+0x35c/0x3fc kernel_init+0x24/0x148 ret_from_kernel_thread+0x5c/0x80 lock_acquire+0x140/0x5f0 _raw_spin_lock+0x4c/0x70 eeh_addr_cache_show+0x38/0x110 seq_read+0x1a0/0x660 vfs_read+0xc8/0x1f0 ksys_read+0x74/0x130 system_call_exception+0xf8/0x1d0 system_call_common+0xe8/0x218
--- arch/powerpc/kernel/eeh_cache.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/powerpc/kernel/eeh_cache.c +3 -2
@@ -264,8 +264,9 @@ static int eeh_addr_cache_show(struct seq_file *s, void *v) {struct pci_io_addr_range *piar;struct rb_node *n; +unsigned long flags; -spin_lock (&pci_io_addr_cache_root.piar_lock); +spin_lock_irqsave (&pci_io_addr_cache_root.piar_lock, flags);for (n =rb_first (&pci_io_addr_cache_root.rb_root); n; n =rb_next (n)) { piar = rb_entry(n, struct pci_io_addr_range, rb_node);
@@ -273,7 +274,7 @@ static int eeh_addr_cache_show(struct seq_file *s, void *v) (piar->flags &IORESOURCE_IO ) ?"i/o" :"mem" , &piar->addr_lo, &piar->addr_hi, pci_name(piar->pcidev)); } -spin_unlock (&pci_io_addr_cache_root.piar_lock); +spin_unlock_irqrestore (&pci_io_addr_cache_root.piar_lock, flags);return 0 ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 30/255 drm/vc4: bo: Add a managed action to cleanup the cache
In reply to Greg Kroah-HartmanFrom: Maxime Ripard <[email protected]>
[ Upstream commit 1c80be48c70a2198f7cf04a546b3805b92293ac6 ]
The BO cache needs to be cleaned up using vc4_bo_cache_destroy, but it's not used consistently (vc4_drv's bind calls it in its error path, but doesn't in unbind), and we can make that automatic through a managed action. Let's remove the requirement to call vc4_bo_cache_destroy.
--- drivers/gpu/drm/vc4/vc4_bo.c | 5 +++-- drivers/gpu/drm/vc4/vc4_drv.c | 1 - drivers/gpu/drm/vc4/vc4_drv.h | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/vc4/vc4_bo.c +3 -2
@@ -1005,6 +1005,7 @@ int vc4_get_tiling_ioctl(struct drm_device *dev, void *data,return 0 ; } +static void vc4_bo_cache_destroy (struct drm_device *dev,void *unused);int vc4_bo_cache_init (struct drm_device *dev) {struct vc4_dev *vc4 =to_vc4_dev (dev);
@@ -1033,10 +1034,10 @@ int vc4_bo_cache_init(struct drm_device *dev)INIT_WORK (&vc4->bo_cache.time_work, vc4_bo_cache_time_work);timer_setup (&vc4->bo_cache.time_timer, vc4_bo_cache_time_timer,0 ); -return 0 ; +return drmm_add_action_or_reset (dev, vc4_bo_cache_destroy,NULL ); } -void vc4_bo_cache_destroy (struct drm_device *dev) +static void vc4_bo_cache_destroy (struct drm_device *dev,void *unused) {struct vc4_dev *vc4 =to_vc4_dev (dev);int i;
drivers/gpu/drm/vc4/vc4_drv.c +0 -1
@@ -311,7 +311,6 @@ unbind_all: gem_destroy:vc4_gem_destroy (drm);drm_mode_config_cleanup (drm); -vc4_bo_cache_destroy (drm); dev_put:drm_dev_put (drm);return ret;
drivers/gpu/drm/vc4/vc4_drv.h +1 -1
@@ -14,6 +14,7 @@#include <drm/drm_device.h> #include <drm/drm_encoder.h> #include <drm/drm_gem_cma_helper.h> +#include <drm/drm_managed.h> #include <drm/drm_mm.h> #include <drm/drm_modeset_lock.h>
@@ -786,7 +787,6 @@ struct drm_gem_object *vc4_prime_import_sg_table(struct drm_device *dev, struct sg_table *sgt);void *vc4_prime_vmap (struct drm_gem_object *obj);int vc4_bo_cache_init (struct drm_device *dev); -void vc4_bo_cache_destroy (struct drm_device *dev);int vc4_bo_inc_usecnt (struct vc4_bo *bo);void vc4_bo_dec_usecnt (struct vc4_bo *bo);void vc4_bo_add_to_purgeable_pool (struct vc4_bo *bo);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 31/255 IB/srpt: Fix memory leak in srpt_add_one
In reply to Greg Kroah-HartmanFrom: Maor Gottlieb <[email protected]>
[ Upstream commit 372a1786283e50e7cb437ab7fdb1b95597310ad7 ]
Failure in srpt_refresh_port() for the second port will leave MAD registered for the first one, however, the srpt_add_one() will be marked as "failed" and SRPT will leak resources for that registered but not used and released first port.
Unregister the MAD agent for all ports in case of failure.
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/infiniband/ulp/srpt/ib_srpt.c +8 -5
@@ -622,10 +622,11 @@ static int srpt_refresh_port(struct srpt_port *sport)/** * srpt_unregister_mad_agent - unregister MAD callback functions * @sdev: SRPT HCA pointer. +* #port_cnt: number of ports with registered MAD * * Note: It is safe to call this function more than once for the same device. */ -static void srpt_unregister_mad_agent (struct srpt_device *sdev) +static void srpt_unregister_mad_agent (struct srpt_device *sdev,int port_cnt) {struct ib_port_modify port_modify = { .clr_port_cap_mask =IB_PORT_DEVICE_MGMT_SUP ,
@@ -633,7 +634,7 @@ static void srpt_unregister_mad_agent(struct srpt_device *sdev)struct srpt_port *sport;int i; -for (i =1 ; i <= sdev->device->phys_port_cnt; i++) { +for (i =1 ; i <= port_cnt; i++) { sport = &sdev->port[i -1 ];WARN_ON (sport->port != i);if (sport->mad_agent) {
@@ -3185,7 +3186,8 @@ static int srpt_add_one(struct ib_device *device)if (ret) {pr_err ("MAD registration failed for %s-%d.\n" ,dev_name (&sdev->device->dev), i); - goto err_event; + i--; + goto err_port; } }
@@ -3197,7 +3199,8 @@ static int srpt_add_one(struct ib_device *device)pr_debug ("added %s.\n" ,dev_name (&device->dev));return 0 ; -err_event: +err_port: +srpt_unregister_mad_agent (sdev, i);ib_unregister_event_handler (&sdev->event_handler); err_cm:if (sdev->cm_id)
@@ -3221,7 +3224,7 @@ static void srpt_remove_one(struct ib_device *device, void *client_data)struct srpt_device *sdev = client_data;int i; -srpt_unregister_mad_agent (sdev); +srpt_unregister_mad_agent (sdev, sdev->device->phys_port_cnt);ib_unregister_event_handler (&sdev->event_handler);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 32/255 mm: memcontrol: correct the NR_ANON_THPS counter of hierarchical memcg
In reply to Greg Kroah-HartmanFrom: zhongjiang-ali <[email protected]>
[ Upstream commit 7de2e9f195b9cb27583c5c64deaaf5e6afcc163e ]
memcg_page_state will get the specified number in hierarchical memcg, It should multiply by HPAGE_PMD_NR rather than an page if the item is NR_ANON_THPS.
[[email protected]: fix printk warning] [[email protected]: use u64 cast, per Michal]
--- mm/memcontrol.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
mm/memcontrol.c +8 -2
@@ -4068,11 +4068,17 @@ static int memcg_stat_show(struct seq_file *m, void *v) (u64)memsw * PAGE_SIZE);for (i =0 ; i <ARRAY_SIZE (memcg1_stats); i++) { +unsigned long nr; +if (memcg1_stats[i] ==MEMCG_SWAP && !do_memsw_account ())continue ; + nr =memcg_page_state (memcg, memcg1_stats[i]); +#ifdef CONFIG_TRANSPARENT_HUGEPAGE +if (memcg1_stats[i] ==NR_ANON_THPS ) + nr *=HPAGE_PMD_NR ; +#endif seq_printf (m,"total_%s %llu\n" , memcg1_stat_names[i], - (u64 )memcg_page_state (memcg, memcg1_stats[i]) * -PAGE_SIZE ); + (u64 )nr *PAGE_SIZE ); }for (i =0 ; i <ARRAY_SIZE (memcg1_events); i++)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 33/255 drm/panfrost: rename error labels in device_init
In reply to Greg Kroah-HartmanFrom: Clément Péron <[email protected]>
[ Upstream commit d3c335da0200be9287cdf5755d19f62ce1670a8d ]
Rename goto labels in device_init it will be easier to maintain.
--- drivers/gpu/drm/panfrost/panfrost_device.c | 30 +++++++++++----------- 1 file changed, 15 insertions(+), 15 deletions(-)
drivers/gpu/drm/panfrost/panfrost_device.c +15 -15
@@ -216,56 +216,56 @@ int panfrost_device_init(struct panfrost_device *pfdev) err =panfrost_regulator_init (pfdev);if (err) - goto err_out0; + goto out_clk; err =panfrost_reset_init (pfdev);if (err) {dev_err (pfdev->dev,"reset init failed %d\n" , err); - goto err_out1; + goto out_regulator; } err =panfrost_pm_domain_init (pfdev);if (err) - goto err_out2; + goto out_reset; res =platform_get_resource (pfdev->pdev,IORESOURCE_MEM ,0 ); pfdev->iomem =devm_ioremap_resource (pfdev->dev, res);if (IS_ERR (pfdev->iomem)) {dev_err (pfdev->dev,"failed to ioremap iomem\n" ); err =PTR_ERR (pfdev->iomem); - goto err_out3; + goto out_pm_domain; } err =panfrost_gpu_init (pfdev);if (err) - goto err_out3; + goto out_pm_domain; err =panfrost_mmu_init (pfdev);if (err) - goto err_out4; + goto out_gpu; err =panfrost_job_init (pfdev);if (err) - goto err_out5; + goto out_mmu; err =panfrost_perfcnt_init (pfdev);if (err) - goto err_out6; + goto out_job;return 0 ; -err_out6: +out_job:panfrost_job_fini (pfdev); -err_out5: +out_mmu:panfrost_mmu_fini (pfdev); -err_out4: +out_gpu:panfrost_gpu_fini (pfdev); -err_out3: +out_pm_domain:panfrost_pm_domain_fini (pfdev); -err_out2: +out_reset:panfrost_reset_fini (pfdev); -err_out1: +out_regulator:panfrost_regulator_fini (pfdev); -err_out0: +out_clk:panfrost_clk_fini (pfdev);return err; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 34/255 drm/panfrost: move devfreq_init()/fini() in device
In reply to Greg Kroah-HartmanFrom: Clément Péron <[email protected]>
[ Upstream commit 25e247bbf85af3ad721dfeb2e2caf405f43b7e66 ]
Later we will introduce devfreq probing regulator if they are present. As regulator should be probe only one time we need to get this logic in the device_init().
panfrost_device is already taking care of devfreq_resume() and devfreq_suspend(), so it's not totally illogic to move the devfreq_init() and devfreq_fini() here.
--- drivers/gpu/drm/panfrost/panfrost_device.c | 12 +++++++++++- drivers/gpu/drm/panfrost/panfrost_drv.c | 15 ++------------- 2 files changed, 13 insertions(+), 14 deletions(-)
drivers/gpu/drm/panfrost/panfrost_device.c +11 -1
@@ -214,9 +214,16 @@ int panfrost_device_init(struct panfrost_device *pfdev)return err; } + err =panfrost_devfreq_init (pfdev); +if (err) { +if (err != -EPROBE_DEFER ) +dev_err (pfdev->dev,"devfreq init failed %d\n" , err); + goto out_clk; + } + err =panfrost_regulator_init (pfdev);if (err) - goto out_clk; + goto out_devfreq; err =panfrost_reset_init (pfdev);if (err) {
@@ -265,6 +272,8 @@ out_reset:panfrost_reset_fini (pfdev); out_regulator:panfrost_regulator_fini (pfdev); +out_devfreq: +panfrost_devfreq_fini (pfdev); out_clk:panfrost_clk_fini (pfdev);return err;
@@ -278,6 +287,7 @@ void panfrost_device_fini(struct panfrost_device *pfdev)panfrost_gpu_fini (pfdev);panfrost_pm_domain_fini (pfdev);panfrost_reset_fini (pfdev); +panfrost_devfreq_fini (pfdev);panfrost_regulator_fini (pfdev);panfrost_clk_fini (pfdev); }
drivers/gpu/drm/panfrost/panfrost_drv.c +2 -13
@@ -14,7 +14,6 @@#include <drm/drm_utils.h> #include "panfrost_device.h" -#include "panfrost_devfreq.h" #include "panfrost_gem.h" #include "panfrost_mmu.h" #include "panfrost_job.h"
@@ -606,13 +605,6 @@ static int panfrost_probe(struct platform_device *pdev) goto err_out0; } - err =panfrost_devfreq_init (pfdev); -if (err) { -if (err != -EPROBE_DEFER ) -dev_err (&pdev->dev,"Fatal error during devfreq init\n" ); - goto err_out1; - } -pm_runtime_set_active (pfdev->dev);pm_runtime_mark_last_busy (pfdev->dev);pm_runtime_enable (pfdev->dev);
@@ -625,16 +617,14 @@ static int panfrost_probe(struct platform_device *pdev)*/ err =drm_dev_register (ddev,0 );if (err <0 ) - goto err_out2; + goto err_out1;panfrost_gem_shrinker_init (ddev);return 0 ; -err_out2: -pm_runtime_disable (pfdev->dev); -panfrost_devfreq_fini (pfdev); err_out1: +pm_runtime_disable (pfdev->dev);panfrost_device_fini (pfdev); err_out0:drm_dev_put (ddev);
@@ -650,7 +640,6 @@ static int panfrost_remove(struct platform_device *pdev)panfrost_gem_shrinker_cleanup (ddev);pm_runtime_get_sync (pfdev->dev); -panfrost_devfreq_fini (pfdev);panfrost_device_fini (pfdev);pm_runtime_put_sync_suspend (pfdev->dev);pm_runtime_disable (pfdev->dev);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 35/255 drm/panfrost: Fix module unload
In reply to Greg Kroah-HartmanFrom: Steven Price <[email protected]>
[ Upstream commit 876b15d2c88d8c005f1aebeaa23f1e448d834757 ]
When unloading the call to pm_runtime_put_sync_suspend() will attempt to turn the GPU cores off, however panfrost_device_fini() will have turned the clocks off. This leads to the hardware locking up.
Instead don't call pm_runtime_put_sync_suspend() and instead simply mark the device as suspended using pm_runtime_set_suspended(). And also include this on the error path in panfrost_probe().
--- drivers/gpu/drm/panfrost/panfrost_drv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/panfrost/panfrost_drv.c +3 -2
@@ -626,6 +626,7 @@ static int panfrost_probe(struct platform_device *pdev) err_out1:pm_runtime_disable (pfdev->dev);panfrost_device_fini (pfdev); +pm_runtime_set_suspended (pfdev->dev); err_out0:drm_dev_put (ddev);return err;
@@ -640,9 +641,9 @@ static int panfrost_remove(struct platform_device *pdev)panfrost_gem_shrinker_cleanup (ddev);pm_runtime_get_sync (pfdev->dev); -panfrost_device_fini (pfdev); -pm_runtime_put_sync_suspend (pfdev->dev);pm_runtime_disable (pfdev->dev); +panfrost_device_fini (pfdev); +pm_runtime_set_suspended (pfdev->dev);drm_dev_put (ddev);return 0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 36/255 perf trace: Fix segfault when trying to trace events by cgroup
In reply to Greg Kroah-HartmanFrom: Stanislav Ivanichkin <[email protected]>
[ Upstream commit a6293f36ac92ab513771a98efe486477be2f981f ]
# ./perf trace -e sched:sched_switch -G test -a sleep 1 perf: Segmentation fault Obtained 11 stack frames. ./perf(sighandler_dump_stack+0x43) [0x55cfdc636db3] /lib/x86_64-linux-gnu/libc.so.6(+0x3efcf) [0x7fd23eecafcf] ./perf(parse_cgroups+0x36) [0x55cfdc673f36] ./perf(+0x3186ed) [0x55cfdc70d6ed] ./perf(parse_options_subcommand+0x629) [0x55cfdc70e999] ./perf(cmd_trace+0x9c2) [0x55cfdc5ad6d2] ./perf(+0x1e8ae0) [0x55cfdc5ddae0] ./perf(+0x1e8ded) [0x55cfdc5ddded] ./perf(main+0x370) [0x55cfdc556f00] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe6) [0x7fd23eeadb96] ./perf(_start+0x29) [0x55cfdc557389] Segmentation fault #
It happens because "struct trace" in option->value is passed to the parse_cgroups function instead of "struct evlist".
--- tools/perf/builtin-trace.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
tools/perf/builtin-trace.c +9 -6
@@ -4639,9 +4639,9 @@ do_concat: err =0 ;if (lists[0 ]) { -struct option o =OPT_CALLBACK ('e' ,"event" , &trace->evlist,"event" , -"event selector. use 'perf list' to list available events" , - parse_events_option); +struct option o = { + .value = &trace->evlist, + }; err =parse_events_option (&o, lists[0 ],0 ); } out:
@@ -4655,9 +4655,12 @@ static int trace__parse_cgroups(const struct option *opt, const char *str, int u {struct trace *trace = opt->value; -if (!list_empty (&trace->evlist->core.entries)) -return parse_cgroups (opt, str, unset); - +if (!list_empty (&trace->evlist->core.entries)) { +struct option o = { + .value = &trace->evlist, + }; +return parse_cgroups (&o, str, unset); + } trace->cgroup =evlist__findnew_cgroup (trace->evlist, str);return 0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 37/255 perf tools: Add missing swap for ino_generation
In reply to Greg Kroah-HartmanFrom: Jiri Olsa <[email protected]>
[ Upstream commit fe01adb72356a4e2f8735e4128af85921ca98fa1 ]
We are missing swap for ino_generation field.
--- tools/perf/util/session.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/util/session.c +1 -0
@@ -595,6 +595,7 @@ static void perf_event__mmap2_swap(union perf_event *event, event->mmap2.maj =bswap_32 (event->mmap2.maj); event->mmap2.min =bswap_32 (event->mmap2.min); event->mmap2.ino =bswap_64 (event->mmap2.ino); + event->mmap2.ino_generation =bswap_64 (event->mmap2.ino_generation);if (sample_id_all) {void *data = &event->mmap2.filename;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 38/255 perf tools: Add missing swap for cgroup events
In reply to Greg Kroah-HartmanFrom: Namhyung Kim <[email protected]>
[ Upstream commit 2c589d933e54d183ee2a052971b730e423c62031 ]
It was missed to add a swap function for PERF_RECORD_CGROUP.
--- tools/perf/util/session.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
tools/perf/util/session.c +13 -0
@@ -711,6 +711,18 @@ static void perf_event__namespaces_swap(union perf_event *event,swap_sample_id_all (event, &event->namespaces.link_info[i]); } +static void perf_event__cgroup_swap (union perf_event *event,bool sample_id_all) +{ + event->cgroup.id =bswap_64 (event->cgroup.id); + +if (sample_id_all) { +void *data = &event->cgroup.path; + + data +=PERF_ALIGN (strlen (data) +1 ,sizeof (u64)); +swap_sample_id_all (event, data); + } +} +static u8 revbyte (u8 b) {int rev = (b >>4 ) | ((b &0xf ) <<4 );
@@ -953,6 +965,7 @@ static perf_event__swap_op perf_event__swap_ops[] = { [PERF_RECORD_SWITCH] = perf_event__switch_swap, [PERF_RECORD_SWITCH_CPU_WIDE] = perf_event__switch_swap, [PERF_RECORD_NAMESPACES] = perf_event__namespaces_swap, + [PERF_RECORD_CGROUP] = perf_event__cgroup_swap, [PERF_RECORD_TEXT_POKE] = perf_event__text_poke_swap, [PERF_RECORD_HEADER_ATTR] = perf_event__hdr_attr_swap, [PERF_RECORD_HEADER_EVENT_TYPE] = perf_event__event_type_swap,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 39/255 ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 158e1886b6262c1d1c96a18c85fac5219b8bf804 ]
This is harmless, but the "addr" comes from the user and it could lead to a negative shift or to shift wrapping if it's too high.
--- sound/hda/ext/hdac_ext_controller.c | 2 ++ 1 file changed, 2 insertions(+)
sound/hda/ext/hdac_ext_controller.c +2 -0
@@ -148,6 +148,8 @@ struct hdac_ext_link *snd_hdac_ext_bus_get_link(struct hdac_bus *bus,return NULL ;if (bus->idx != bus_idx)return NULL ; +if (addr <0 || addr >31 ) +return NULL ;list_for_each_entry (hlink, &bus->hlink_list, list) {for (i =0 ; i <HDA_MAX_CODECS ; i++) {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 40/255 iommu/vt-d: Fix sid not set issue in intel_svm_bind_gpasid()
In reply to Greg Kroah-HartmanFrom: Liu Yi L <[email protected]>
[ Upstream commit eea4e29ab8bef254b228d6e1e3de188087b2c7d0 ]
Should get correct sid and set it into sdev. Because we execute 'sdev->sid != req->rid' in the loop of prq_event_thread().
--- drivers/iommu/intel/svm.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/iommu/intel/svm.c +6 -0
@@ -278,6 +278,7 @@ int intel_svm_bind_gpasid(struct iommu_domain *domain, struct device *dev,struct intel_iommu *iommu =device_to_iommu (dev,NULL ,NULL );struct intel_svm_dev *sdev =NULL ;struct dmar_domain *dmar_domain; +struct device_domain_info *info;struct intel_svm *svm =NULL ;int ret =0 ;
@@ -302,6 +303,10 @@ int intel_svm_bind_gpasid(struct iommu_domain *domain, struct device *dev,if (data->hpasid <=0 || data->hpasid >=PASID_MAX )return -EINVAL ; + info =get_domain_info (dev); +if (!info) +return -EINVAL ; + dmar_domain =to_dmar_domain (domain);mutex_lock (&pasid_mutex);
@@ -349,6 +354,7 @@ int intel_svm_bind_gpasid(struct iommu_domain *domain, struct device *dev, goto out; } sdev->dev = dev; + sdev->sid =PCI_DEVID (info->bus, info->devfn);/* Only count users if device has aux domains */ if (iommu_dev_feature_enabled (dev,IOMMU_DEV_FEAT_AUX ))
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 41/255 iommu/vt-d: Fix a bug for PDP check in prq_event_thread
In reply to Greg Kroah-HartmanFrom: Liu, Yi L <[email protected]>
[ Upstream commit 71cd8e2d16703a9df5c86a9e19f4cba99316cc53 ]
In prq_event_thread(), the QI_PGRP_PDP is wrongly set by 'req->pasid_present' which should be replaced to 'req->priv_data_present'.
--- drivers/iommu/intel/svm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/intel/svm.c +1 -1
@@ -1001,7 +1001,7 @@ no_pasid: resp.qw0 =QI_PGRP_PASID (req->pasid) |QI_PGRP_DID (req->rid) |QI_PGRP_PASID_P (req->pasid_present) | -QI_PGRP_PDP (req->pasid_present) | +QI_PGRP_PDP (req->priv_data_present) |QI_PGRP_RESP_CODE (result) |QI_PGRP_RESP_TYPE ; resp.qw1 = QI_PGRP_IDX(req->prg_index) |
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 42/255 afs: Fix warning due to unadvanced marshalling pointer
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit c80afa1d9c3603d5eddeb8d63368823b1982f3f0 ]
When using the afs.yfs.acl xattr to change an AuriStor ACL, a warning can be generated when the request is marshalled because the buffer pointer isn't increased after adding the last element, thereby triggering the check at the end if the ACL wasn't empty. This just causes something like the following warning, but doesn't stop the call from happening successfully:
kAFS: YFS.StoreOpaqueACL2: Request buffer underflow (36<108)
Fix this simply by increasing the count prior to the check.
--- fs/afs/yfsclient.c | 1 + 1 file changed, 1 insertion(+)
fs/afs/yfsclient.c +1 -0
@@ -1990,6 +1990,7 @@ void yfs_fs_store_opaque_acl2(struct afs_operation *op)memcpy (bp, acl->data, acl->size);if (acl->size != size)memset ((void *)bp + acl->size,0 , size - acl->size); + bp += size /sizeof (__be32);yfs_check_req (call, bp);trace_afs_make_fs_call (call, &vp->fid);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 43/255 afs: Fix incorrect freeing of the ACL passed to the YFS ACL store op
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit f4c79144edd8a49ffca8fa737a31d606be742a34 ]
The cleanup for the yfs_store_opaque_acl2_operation calls the wrong function to destroy the ACL content buffer. It's an afs_acl struct, not a yfs_acl struct - and the free function for latter may pass invalid pointers to kfree().
Fix this by using the afs_acl_put() function. The yfs_acl_put() function is then no longer used and can be removed.
general protection fault, probably for non-canonical address 0x7ebde00000000: 0000 [#1] SMP PTI ... RIP: 0010:compound_head+0x0/0x11 ... Call Trace: virt_to_cache+0x8/0x51 kfree+0x5d/0x79 yfs_free_opaque_acl+0x16/0x29 afs_put_operation+0x60/0x114 __vfs_setxattr+0x67/0x72 __vfs_setxattr_noperm+0x66/0xe9 vfs_setxattr+0x67/0xce setxattr+0x14e/0x184 __do_sys_fsetxattr+0x66/0x8f do_syscall_64+0x2d/0x3a entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- fs/afs/xattr.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
fs/afs/xattr.c +1 -6
@@ -148,11 +148,6 @@ static const struct xattr_handler afs_xattr_afs_acl_handler = { .set = afs_xattr_set_acl, }; -static void yfs_acl_put (struct afs_operation *op) -{ -yfs_free_opaque_acl (op->yacl); -} -static const struct afs_operation_ops yfs_fetch_opaque_acl_operation = { .issue_yfs_rpc = yfs_fs_fetch_opaque_acl, .success = afs_acl_success,
@@ -246,7 +241,7 @@ error:static const struct afs_operation_ops yfs_store_opaque_acl2_operation = { .issue_yfs_rpc = yfs_fs_store_opaque_acl2, .success = afs_acl_success, - .put = yfs_acl_put, + .put = afs_acl_put, };/*
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 44/255 vfio/pci: Implement ioeventfd thread handler for contended memory lock
In reply to Greg Kroah-HartmanFrom: Alex Williamson <[email protected]>
[ Upstream commit 38565c93c8a1306dc5f245572a545fbea908ac41 ]
The ioeventfd is called under spinlock with interrupts disabled, therefore if the memory lock is contended defer code that might sleep to a thread context.
--- drivers/vfio/pci/vfio_pci_rdwr.c | 43 ++++++++++++++++++++++++++------ 1 file changed, 35 insertions(+), 8 deletions(-)
drivers/vfio/pci/vfio_pci_rdwr.c +35 -8
@@ -356,34 +356,60 @@ ssize_t vfio_pci_vga_rw(struct vfio_pci_device *vdev, char __user *buf,return done; } -static int vfio_pci_ioeventfd_handler (void *opaque,void *unused) +static void vfio_pci_ioeventfd_do_write (struct vfio_pci_ioeventfd *ioeventfd, +bool test_mem) { -struct vfio_pci_ioeventfd *ioeventfd = opaque; -switch (ioeventfd->count) {case 1 : -vfio_pci_iowrite8 (ioeventfd->vdev, ioeventfd->test_mem, +vfio_pci_iowrite8 (ioeventfd->vdev, test_mem, ioeventfd->data, ioeventfd->addr);break ;case 2 : -vfio_pci_iowrite16 (ioeventfd->vdev, ioeventfd->test_mem, +vfio_pci_iowrite16 (ioeventfd->vdev, test_mem, ioeventfd->data, ioeventfd->addr);break ;case 4 : -vfio_pci_iowrite32 (ioeventfd->vdev, ioeventfd->test_mem, +vfio_pci_iowrite32 (ioeventfd->vdev, test_mem, ioeventfd->data, ioeventfd->addr);break ;#ifdef iowrite64case 8 : -vfio_pci_iowrite64 (ioeventfd->vdev, ioeventfd->test_mem, +vfio_pci_iowrite64 (ioeventfd->vdev, test_mem, ioeventfd->data, ioeventfd->addr);break ;#endif } +} + +static int vfio_pci_ioeventfd_handler (void *opaque,void *unused) +{ +struct vfio_pci_ioeventfd *ioeventfd = opaque; +struct vfio_pci_device *vdev = ioeventfd->vdev; + +if (ioeventfd->test_mem) { +if (!down_read_trylock (&vdev->memory_lock)) +return 1 ;/* Lock contended, use thread */ +if (!__vfio_pci_memory_enabled (vdev)) { +up_read (&vdev->memory_lock); +return 0 ; + } + } + +vfio_pci_ioeventfd_do_write (ioeventfd, false); + +if (ioeventfd->test_mem) +up_read (&vdev->memory_lock);return 0 ; } +static void vfio_pci_ioeventfd_thread (void *opaque,void *unused) +{ +struct vfio_pci_ioeventfd *ioeventfd = opaque; + +vfio_pci_ioeventfd_do_write (ioeventfd, ioeventfd->test_mem); +} +long vfio_pci_ioeventfd (struct vfio_pci_device *vdev,loff_t offset,uint64_t data,int count,int fd) {
@@ -457,7 +483,8 @@ long vfio_pci_ioeventfd(struct vfio_pci_device *vdev, loff_t offset, ioeventfd->test_mem = vdev->pdev->resource[bar].flags &IORESOURCE_MEM ; ret =vfio_virqfd_enable (ioeventfd, vfio_pci_ioeventfd_handler, -NULL ,NULL , &ioeventfd->virqfd, fd); + vfio_pci_ioeventfd_thread,NULL , + &ioeventfd->virqfd, fd);if (ret) {kfree (ioeventfd); goto out_unlock;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 45/255 can: rx-offload: dont call kfree_skb() from IRQ context
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
[ Upstream commit 2ddd6bfe7bdbb6c661835c3ff9cab8e0769940a6 ]
A CAN driver, using the rx-offload infrastructure, is reading CAN frames (usually in IRQ context) from the hardware and placing it into the rx-offload queue to be delivered to the networking stack via NAPI.
In case the rx-offload queue is full, trying to add more skbs results in the skbs being dropped using kfree_skb(). If done from hard-IRQ context this results in the following warning:
[ 682.552693] ------------[ cut here ]------------ [ 682.557360] WARNING: CPU: 0 PID: 3057 at net/core/skbuff.c:650 skb_release_head_state+0x74/0x84 [ 682.566075] Modules linked in: can_raw can coda_vpu flexcan dw_hdmi_ahb_audio v4l2_jpeg imx_vdoa can_dev [ 682.575597] CPU: 0 PID: 3057 Comm: cansend Tainted: G W 5.7.0+ #18 [ 682.583098] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) [ 682.589657] [<c0112628>] (unwind_backtrace) from [<c010c1c4>] (show_stack+0x10/0x14) [ 682.597423] [<c010c1c4>] (show_stack) from [<c06c481c>] (dump_stack+0xe0/0x114) [ 682.604759] [<c06c481c>] (dump_stack) from [<c0128f10>] (__warn+0xc0/0x10c) [ 682.611742] [<c0128f10>] (__warn) from [<c0129314>] (warn_slowpath_fmt+0x5c/0xc0) [ 682.619248] [<c0129314>] (warn_slowpath_fmt) from [<c0b95dec>] (skb_release_head_state+0x74/0x84) [ 682.628143] [<c0b95dec>] (skb_release_head_state) from [<c0b95e08>] (skb_release_all+0xc/0x24) [ 682.636774] [<c0b95e08>] (skb_release_all) from [<c0b95eac>] (kfree_skb+0x74/0x1c8) [ 682.644479] [<c0b95eac>] (kfree_skb) from [<bf001d1c>] (can_rx_offload_queue_sorted+0xe0/0xe8 [can_dev]) [ 682.654051] [<bf001d1c>] (can_rx_offload_queue_sorted [can_dev]) from [<bf001d6c>] (can_rx_offload_get_echo_skb+0x48/0x94 [can_dev]) [ 682.666007] [<bf001d6c>] (can_rx_offload_get_echo_skb [can_dev]) from [<bf01efe4>] (flexcan_irq+0x194/0x5dc [flexcan]) [ 682.676734] [<bf01efe4>] (flexcan_irq [flexcan]) from [<c019c1ec>] (__handle_irq_event_percpu+0x4c/0x3ec) [ 682.686322] [<c019c1ec>] (__handle_irq_event_percpu) from [<c019c5b8>] (handle_irq_event_percpu+0x2c/0x88) [ 682.695993] [<c019c5b8>] (handle_irq_event_percpu) from [<c019c64c>] (handle_irq_event+0x38/0x5c) [ 682.704887] [<c019c64c>] (handle_irq_event) from [<c01a1058>] (handle_fasteoi_irq+0xc8/0x180) [ 682.713432] [<c01a1058>] (handle_fasteoi_irq) from [<c019b2c0>] (generic_handle_irq+0x30/0x44) [ 682.722063] [<c019b2c0>] (generic_handle_irq) from [<c019b8f8>] (__handle_domain_irq+0x64/0xdc) [ 682.730783] [<c019b8f8>] (__handle_domain_irq) from [<c06df4a4>] (gic_handle_irq+0x48/0x9c) [ 682.739158] [<c06df4a4>] (gic_handle_irq) from [<c0100b30>] (__irq_svc+0x70/0x98) [ 682.746656] Exception stack(0xe80e9dd8 to 0xe80e9e20) [ 682.751725] 9dc0: 00000001 e80e8000 [ 682.759922] 9de0: e820cf80 00000000 ffffe000 00000000 eaf08fe4 00000000 600d0013 00000000 [ 682.768117] 9e00: c1732e3c c16093a8 e820d4c0 e80e9e28 c018a57c c018b870 600d0013 ffffffff [ 682.776315] [<c0100b30>] (__irq_svc) from [<c018b870>] (lock_acquire+0x108/0x4e8) [ 682.783821] [<c018b870>] (lock_acquire) from [<c0e938e4>] (down_write+0x48/0xa8) [ 682.791242] [<c0e938e4>] (down_write) from [<c02818dc>] (unlink_file_vma+0x24/0x40) [ 682.798922] [<c02818dc>] (unlink_file_vma) from [<c027a258>] (free_pgtables+0x34/0xb8) [ 682.806858] [<c027a258>] (free_pgtables) from [<c02835a4>] (exit_mmap+0xe4/0x170) [ 682.814361] [<c02835a4>] (exit_mmap) from [<c01248e0>] (mmput+0x5c/0x110) [ 682.821171] [<c01248e0>] (mmput) from [<c012e910>] (do_exit+0x374/0xbe4) [ 682.827892] [<c012e910>] (do_exit) from [<c0130888>] (do_group_exit+0x38/0xb4) [ 682.835132] [<c0130888>] (do_group_exit) from [<c0130914>] (__wake_up_parent+0x0/0x14) [ 682.843063] irq event stamp: 1936 [ 682.846399] hardirqs last enabled at (1935): [<c02938b0>] rmqueue+0xf4/0xc64 [ 682.853553] hardirqs last disabled at (1936): [<c0100b20>] __irq_svc+0x60/0x98 [ 682.860799] softirqs last enabled at (1878): [<bf04cdcc>] raw_release+0x108/0x1f0 [can_raw] [ 682.869256] softirqs last disabled at (1876): [<c0b8f478>] release_sock+0x18/0x98 [ 682.876753] ---[ end trace 7bca4751ce44c444 ]---
This patch fixes the problem by replacing the kfree_skb() by dev_kfree_skb_any(), as rx-offload might be called from threaded IRQ handlers as well.
--- drivers/net/can/rx-offload.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/can/rx-offload.c +2 -2
@@ -245,7 +245,7 @@ int can_rx_offload_queue_sorted(struct can_rx_offload *offload,if (skb_queue_len (&offload->skb_queue) > offload->skb_queue_len_max) { -kfree_skb (skb); +dev_kfree_skb_any (skb);return -ENOBUFS ; }
@@ -290,7 +290,7 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload, {if (skb_queue_len (&offload->skb_queue) > offload->skb_queue_len_max) { -kfree_skb (skb); +dev_kfree_skb_any (skb);return -ENOBUFS ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 46/255 can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
In reply to Greg Kroah-HartmanFrom: Vincent Mailhol <[email protected]>
[ Upstream commit 2283f79b22684d2812e5c76fc2280aae00390365 ]
If a driver calls can_get_echo_skb() during a hardware IRQ (which is often, but not always, the case), the 'WARN_ON(in_irq)' in net/core/skbuff.c#skb_release_head_state() might be triggered, under network congestion circumstances, together with the potential risk of a NULL pointer dereference.
The root cause of this issue is the call to kfree_skb() instead of dev_kfree_skb_irq() in net/core/dev.c#enqueue_to_backlog().
This patch prevents the skb to be freed within the call to netif_rx() by incrementing its reference count with skb_get(). The skb is finally freed by one of the in-irq-context safe functions: dev_consume_skb_any() or dev_kfree_skb_any(). The "any" version is used because some drivers might call can_get_echo_skb() in a normal context.
The reason for this issue to occur is that initially, in the core network stack, loopback skb were not supposed to be received in hardware IRQ context. The CAN stack is an exeption.
This bug was previously reported back in 2017 in [1] but the proposed patch never got accepted.
While [1] directly modifies net/core/dev.c, we try to propose here a smoother modification local to CAN network stack (the assumption behind is that only CAN devices are affected by this issue).
[1] http://lore.kernel.org/r/[email protected]
--- drivers/net/can/dev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/can/dev.c +5 -1
@@ -512,7 +512,11 @@ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)if (!skb)return 0 ; -netif_rx (skb); +skb_get (skb); +if (netif_rx (skb) ==NET_RX_SUCCESS ) +dev_consume_skb_any (skb); +else +dev_kfree_skb_any (skb);return len; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 47/255 can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames
In reply to Greg Kroah-HartmanFrom: Oliver Hartkopp <[email protected]>
[ Upstream commit ed3320cec279407a86bc4c72edc4a39eb49165ec ]
The can_get_echo_skb() function returns the number of received bytes to be used for netdev statistics. In the case of RTR frames we get a valid (potential non-zero) data length value which has to be passed for further operations. But on the wire RTR frames have no payload length. Therefore the value to be used in the statistics has to be zero for RTR frames.
--- drivers/net/can/dev.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/can/dev.c +6 -2
@@ -486,9 +486,13 @@ __can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr)*/ struct sk_buff *skb = priv->echo_skb[idx];struct canfd_frame *cf = (struct canfd_frame *)skb->data; -u8 len = cf->len; - *len_ptr = len; +/* get the real payload length for netdev statistics */ +if (cf->can_id &CAN_RTR_FLAG ) + *len_ptr =0 ; +else + *len_ptr = cf->len; + priv->echo_skb[idx] =NULL ;return skb;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 48/255 can: can_create_echo_skb(): fix echo skb generation: always use skb_clone()
In reply to Greg Kroah-HartmanFrom: Oleksij Rempel <[email protected]>
[ Upstream commit 286228d382ba6320f04fa2e7c6fc8d4d92e428f4 ]
All user space generated SKBs are owned by a socket (unless injected into the key via AF_PACKET). If a socket is closed, all associated skbs will be cleaned up.
This leads to a problem when a CAN driver calls can_put_echo_skb() on a unshared SKB. If the socket is closed prior to the TX complete handler, can_get_echo_skb() and the subsequent delivering of the echo SKB to all registered callbacks, a SKB with a refcount of 0 is delivered.
To avoid the problem, in can_get_echo_skb() the original SKB is now always cloned, regardless of shared SKB or not. If the process exists it can now safely discard its SKBs, without disturbing the delivery of the echo SKB.
The problem shows up in the j1939 stack, when it clones the incoming skb, which detects the already 0 refcount.
We can easily reproduce this with following example:
testj1939 -B -r can0: &
cansend can0 1823ff40#0123
WARNING: CPU: 0 PID: 293 at lib/refcount.c:25 refcount_warn_saturate+0x108/0x174 refcount_t: addition on 0; use-after-free. Modules linked in: coda_vpu imx_vdoa videobuf2_vmalloc dw_hdmi_ahb_audio vcan CPU: 0 PID: 293 Comm: cansend Not tainted 5.5.0-rc6-00376-g9e20dcb7040d #1 Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) Backtrace: [<c010f570>] (dump_backtrace) from [<c010f90c>] (show_stack+0x20/0x24) [<c010f8ec>] (show_stack) from [<c0c3e1a4>] (dump_stack+0x8c/0xa0) [<c0c3e118>] (dump_stack) from [<c0127fec>] (__warn+0xe0/0x108) [<c0127f0c>] (__warn) from [<c01283c8>] (warn_slowpath_fmt+0xa8/0xcc) [<c0128324>] (warn_slowpath_fmt) from [<c0539c0c>] (refcount_warn_saturate+0x108/0x174) [<c0539b04>] (refcount_warn_saturate) from [<c0ad2cac>] (j1939_can_recv+0x20c/0x210) [<c0ad2aa0>] (j1939_can_recv) from [<c0ac9dc8>] (can_rcv_filter+0xb4/0x268) [<c0ac9d14>] (can_rcv_filter) from [<c0aca2cc>] (can_receive+0xb0/0xe4) [<c0aca21c>] (can_receive) from [<c0aca348>] (can_rcv+0x48/0x98) [<c0aca300>] (can_rcv) from [<c09b1fdc>] (__netif_receive_skb_one_core+0x64/0x88) [<c09b1f78>] (__netif_receive_skb_one_core) from [<c09b2070>] (__netif_receive_skb+0x38/0x94) [<c09b2038>] (__netif_receive_skb) from [<c09b2130>] (netif_receive_skb_internal+0x64/0xf8) [<c09b20cc>] (netif_receive_skb_internal) from [<c09b21f8>] (netif_receive_skb+0x34/0x19c) [<c09b21c4>] (netif_receive_skb) from [<c0791278>] (can_rx_offload_napi_poll+0x58/0xb4)
--- include/linux/can/skb.h | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-)
include/linux/can/skb.h +8 -12
@@ -61,21 +61,17 @@ static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk)*/ static inline struct sk_buff *can_create_echo_skb (struct sk_buff *skb) { -if (skb_shared (skb)) { -struct sk_buff *nskb =skb_clone (skb,GFP_ATOMIC ); +struct sk_buff *nskb; -if (likely (nskb)) { -can_skb_set_owner (nskb, skb->sk); -consume_skb (skb); -return nskb; - }else { -kfree_skb (skb); -return NULL ; - } + nskb =skb_clone (skb,GFP_ATOMIC ); +if (unlikely (!nskb)) { +kfree_skb (skb); +return NULL ; } -/* we can assume to have an unshared skb with proper owner */ -return skb; +can_skb_set_owner (nskb, skb->sk); +consume_skb (skb); +return nskb; }#endif /* !_CAN_SKB_H */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 49/255 can: j1939: swap addr and pgn in the send example
In reply to Greg Kroah-HartmanFrom: Yegor Yefremov <[email protected]>
[ Upstream commit ea780d39b1888ed5afc243c29b23d9bdb3828c7a ]
The address was wrongly assigned to the PGN field and vice versa.
--- Documentation/networking/j1939.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Documentation/networking/j1939.rst +2 -2
@@ -414,8 +414,8 @@ Send: .can_family = AF_CAN, .can_addr.j1939 = { .name = J1939_NO_NAME; - .pgn = 0x30, - .addr = 0x12300, + .addr = 0x30, + .pgn = 0x12300, }, };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 50/255 can: j1939: j1939_sk_bind(): return failure if netdev is down
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit 08c487d8d807535f509ed80c6a10ad90e6872139 ]
When a netdev down event occurs after a successful call to j1939_sk_bind(), j1939_netdev_notify() can handle it correctly.
But if the netdev already in down state before calling j1939_sk_bind(), j1939_sk_release() will stay in wait_event_interruptible() blocked forever. Because in this case, j1939_netdev_notify() won't be called and j1939_tp_txtimer() won't call j1939_session_cancel() or other function to clear session for ENETDOWN error, this lead to mismatch of j1939_session_get/put() and jsk->skb_pending will never decrease to zero.
To reproduce it use following commands:
1. ip link add dev vcan0 type vcan
2. j1939acd -r 100,80-120 1122334455667788 vcan0
3. presses ctrl-c and thread will be blocked forever
This patch adds check for ndev->flags in j1939_sk_bind() to avoid this kind of situation and return with -ENETDOWN.
--- net/can/j1939/socket.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/can/j1939/socket.c +6 -0
@@ -475,6 +475,12 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr *uaddr, int len) goto out_release_sock; } +if (!(ndev->flags &IFF_UP )) { +dev_put (ndev); + ret = -ENETDOWN ; + goto out_release_sock; + } + priv =j1939_netdev_start (ndev);dev_put (ndev);if (IS_ERR (priv)) {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 51/255 can: ti_hecc: ti_hecc_probe(): add missed clk_disable_unprepare() in error path
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit e002103b36a695f7cb6048b96da73e66c86ddffb ]
The driver forgets to call clk_disable_unprepare() in error path after a success calling for clk_prepare_enable().
Fix it by adding a clk_disable_unprepare() in error path.
--- drivers/net/can/ti_hecc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/can/ti_hecc.c +5 -3
@@ -950,7 +950,7 @@ static int ti_hecc_probe(struct platform_device *pdev) err =clk_prepare_enable (priv->clk);if (err) {dev_err (&pdev->dev,"clk_prepare_enable() failed\n" ); - goto probe_exit_clk; + goto probe_exit_release_clk; } priv->offload.mailbox_read = ti_hecc_mailbox_read;
@@ -959,7 +959,7 @@ static int ti_hecc_probe(struct platform_device *pdev) err =can_rx_offload_add_timestamp (ndev, &priv->offload);if (err) {dev_err (&pdev->dev,"can_rx_offload_add_timestamp() failed\n" ); - goto probe_exit_clk; + goto probe_exit_disable_clk; } err =register_candev (ndev);
@@ -977,7 +977,9 @@ static int ti_hecc_probe(struct platform_device *pdev) probe_exit_offload:can_rx_offload_del (&priv->offload); -probe_exit_clk: +probe_exit_disable_clk: +clk_disable_unprepare (priv->clk); +probe_exit_release_clk:clk_put (priv->clk); probe_exit_candev:free_candev (ndev);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 52/255 can: xilinx_can: handle failure cases of pm_runtime_get_sync
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
[ Upstream commit 79c43333bdd5a7026a5aab606b53053b643585e7 ]
Calling pm_runtime_get_sync increments the counter even in case of failure, causing incorrect ref count. Call pm_runtime_put if pm_runtime_get_sync fails.
--- drivers/net/can/xilinx_can.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/can/xilinx_can.c +3 -3
@@ -1391,7 +1391,7 @@ static int xcan_open(struct net_device *ndev)if (ret <0 ) {netdev_err (ndev,"%s: pm_runtime_get failed(%d)\n" , __func__, ret); -return ret; + goto err; } ret = request_irq(ndev->irq, xcan_interrupt, priv->irq_flags,
@@ -1475,6 +1475,7 @@ static int xcan_get_berr_counter(const struct net_device *ndev,if (ret <0 ) {netdev_err (ndev,"%s: pm_runtime_get failed(%d)\n" , __func__, ret); +pm_runtime_put (priv->dev);return ret; }
@@ -1789,7 +1790,7 @@ static int xcan_probe(struct platform_device *pdev)if (ret <0 ) {netdev_err (ndev,"%s: pm_runtime_get failed(%d)\n" , __func__, ret); - goto err_pmdisable; + goto err_disableclks; }if (priv->read_reg (priv,XCAN_SR_OFFSET ) !=XCAN_SR_CONFIG_MASK ) {
@@ -1824,7 +1825,6 @@ static int xcan_probe(struct platform_device *pdev) err_disableclks:pm_runtime_put (priv->dev); -err_pmdisable:pm_runtime_disable (&pdev->dev); err_free:free_candev (ndev);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 53/255 can: peak_usb: add range checking in decode operations
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit a6921dd524fe31d1f460c161d3526a407533b6db ]
These values come from skb->data so Smatch considers them untrusted. I believe Smatch is correct but I don't have a way to test this.
The usb_if->dev[] array has 2 elements but the index is in the 0-15 range without checks. The cfd->len can be up to 255 but the maximum valid size is CANFD_MAX_DLEN (64) so that could lead to memory corruption.
--- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 48 +++++++++++++++++----- 1 file changed, 37 insertions(+), 11 deletions(-)
drivers/net/can/usb/peak_usb/pcan_usb_fd.c +37 -11
@@ -468,12 +468,18 @@ static int pcan_usb_fd_decode_canmsg(struct pcan_usb_fd_if *usb_if, struct pucan_msg *rx_msg) {struct pucan_rx_msg *rm = (struct pucan_rx_msg *)rx_msg; -struct peak_usb_device *dev = usb_if->dev[pucan_msg_get_channel (rm)]; -struct net_device *netdev = dev->netdev; +struct peak_usb_device *dev; +struct net_device *netdev;struct canfd_frame *cfd;struct sk_buff *skb;const u16 rx_msg_flags =le16_to_cpu (rm->flags); +if (pucan_msg_get_channel (rm) >=ARRAY_SIZE (usb_if->dev)) +return -ENOMEM ; + + dev = usb_if->dev[pucan_msg_get_channel (rm)]; + netdev = dev->netdev; +if (rx_msg_flags &PUCAN_MSG_EXT_DATA_LEN ) {/* CANFD frame case */ skb =alloc_canfd_skb (netdev, &cfd);
@@ -519,15 +525,21 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if, struct pucan_msg *rx_msg) {struct pucan_status_msg *sm = (struct pucan_status_msg *)rx_msg; -struct peak_usb_device *dev = usb_if->dev[pucan_stmsg_get_channel (sm)]; -struct pcan_usb_fd_device *pdev = - container_of(dev, struct pcan_usb_fd_device, dev); +struct pcan_usb_fd_device *pdev;enum can_state new_state =CAN_STATE_ERROR_ACTIVE ;enum can_state rx_state, tx_state; -struct net_device *netdev = dev->netdev; +struct peak_usb_device *dev; +struct net_device *netdev;struct can_frame *cf;struct sk_buff *skb; +if (pucan_stmsg_get_channel (sm) >=ARRAY_SIZE (usb_if->dev)) +return -ENOMEM ; + + dev = usb_if->dev[pucan_stmsg_get_channel (sm)]; + pdev = container_of(dev, struct pcan_usb_fd_device, dev); + netdev = dev->netdev; +/* nothing should be sent while in BUS_OFF state */ if (dev->can.state ==CAN_STATE_BUS_OFF )return 0 ;
@@ -579,9 +591,14 @@ static int pcan_usb_fd_decode_error(struct pcan_usb_fd_if *usb_if, struct pucan_msg *rx_msg) {struct pucan_error_msg *er = (struct pucan_error_msg *)rx_msg; -struct peak_usb_device *dev = usb_if->dev[pucan_ermsg_get_channel (er)]; -struct pcan_usb_fd_device *pdev = - container_of(dev, struct pcan_usb_fd_device, dev); +struct pcan_usb_fd_device *pdev; +struct peak_usb_device *dev; + +if (pucan_ermsg_get_channel (er) >=ARRAY_SIZE (usb_if->dev)) +return -EINVAL ; + + dev = usb_if->dev[pucan_ermsg_get_channel (er)]; + pdev = container_of(dev, struct pcan_usb_fd_device, dev);/* keep a trace of tx and rx error counters for later use */ pdev->bec.txerr = er->tx_err_cnt;
@@ -595,11 +612,17 @@ static int pcan_usb_fd_decode_overrun(struct pcan_usb_fd_if *usb_if, struct pucan_msg *rx_msg) {struct pcan_ufd_ovr_msg *ov = (struct pcan_ufd_ovr_msg *)rx_msg; -struct peak_usb_device *dev = usb_if->dev[pufd_omsg_get_channel (ov)]; -struct net_device *netdev = dev->netdev; +struct peak_usb_device *dev; +struct net_device *netdev;struct can_frame *cf;struct sk_buff *skb; +if (pufd_omsg_get_channel (ov) >=ARRAY_SIZE (usb_if->dev)) +return -EINVAL ; + + dev = usb_if->dev[pufd_omsg_get_channel (ov)]; + netdev = dev->netdev; +/* allocate an skb to store the error frame */ skb =alloc_can_err_skb (netdev, &cf);if (!skb)
@@ -716,6 +739,9 @@ static int pcan_usb_fd_encode_msg(struct peak_usb_device *dev,u16 tx_msg_size, tx_msg_flags;u8 can_dlc; +if (cfd->len >CANFD_MAX_DLEN ) +return -EINVAL ; + tx_msg_size =ALIGN (sizeof (struct pucan_tx_msg ) + cfd->len,4 ); tx_msg->size =cpu_to_le16 (tx_msg_size); tx_msg->type =cpu_to_le16 (PUCAN_MSG_CAN_TX );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 54/255 can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
In reply to Greg Kroah-HartmanFrom: Stephane Grosjean <[email protected]>
[ Upstream commit ecc7b4187dd388549544195fb13a11b4ea8e6a84 ]
Fabian Inostroza <[email protected]> has discovered a potential problem in the hardware timestamp reporting from the PCAN-USB USB CAN interface (only), related to the fact that a timestamp of an event may precede the timestamp used for synchronization when both records are part of the same USB packet. However, this case was used to detect the wrapping of the time counter.
This patch details and fixes the two identified cases where this problem can occur.
--- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 51 ++++++++++++++++++-- 1 file changed, 46 insertions(+), 5 deletions(-)
drivers/net/can/usb/peak_usb/pcan_usb_core.c +46 -5
@@ -130,14 +130,55 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time)/* protect from getting time before setting now */ if (ktime_to_ns (time_ref->tv_host)) {u64 delta_us; +s64 delta_ts =0 ; + +/* General case: dev_ts_1 < dev_ts_2 < ts, with: +* +* - dev_ts_1 = previous sync timestamp +* - dev_ts_2 = last sync timestamp +* - ts = event timestamp +* - ts_period = known sync period (theoretical) +* ~ dev_ts2 - dev_ts1 +* *but*: +* +* - time counters wrap (see adapter->ts_used_bits) +* - sometimes, dev_ts_1 < ts < dev_ts2 +* +* "normal" case (sync time counters increase): +* must take into account case when ts wraps (tsw) +* +* < ts_period > < > +* | | | +* ---+--------+----+-------0-+--+--> +* ts_dev_1 | ts_dev_2 | +* ts tsw +*/ +if (time_ref->ts_dev_1 < time_ref->ts_dev_2) { +/* case when event time (tsw) wraps */ +if (ts < time_ref->ts_dev_1) + delta_ts =1 << time_ref->adapter->ts_used_bits; + +/* Otherwise, sync time counter (ts_dev_2) has wrapped: +* handle case when event time (tsn) hasn't. +* +* < ts_period > < > +* | | | +* ---+--------+--0-+---------+--+--> +* ts_dev_1 | ts_dev_2 | +* tsn ts +*/ + }else if (time_ref->ts_dev_1 < ts) { + delta_ts = -(1 << time_ref->adapter->ts_used_bits); + } - delta_us = ts - time_ref->ts_dev_2; -if (ts < time_ref->ts_dev_2) - delta_us &= (1 << time_ref->adapter->ts_used_bits) -1 ; +/* add delay between last sync and event timestamps */ + delta_ts += (signed int )(ts - time_ref->ts_dev_2); - delta_us += time_ref->ts_total; +/* add time from beginning to last sync */ + delta_ts += time_ref->ts_total; - delta_us *= time_ref->adapter->us_per_ts_scale; +/* convert ticks number into microseconds */ + delta_us = delta_ts * time_ref->adapter->us_per_ts_scale; delta_us >>= time_ref->adapter->us_per_ts_shift; *time =ktime_add_us (time_ref->tv_host_0, delta_us);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 55/255 can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on
In reply to Greg Kroah-HartmanFrom: Stephane Grosjean <[email protected]>
[ Upstream commit 93ef65e5a6357cc7381f85fcec9283fe29970045 ]
Echo management is driven by PUCAN_MSG_LOOPED_BACK bit, while loopback frames are identified with PUCAN_MSG_SELF_RECEIVE bit. Those bits are set for each outgoing frame written to the IP core so that a copy of each one will be placed into the rx path. Thus,
- when PUCAN_MSG_LOOPED_BACK is set then the rx frame is an echo of a previously sent frame,
- when PUCAN_MSG_LOOPED_BACK+PUCAN_MSG_SELF_RECEIVE are set, then the rx frame is an echo AND a loopback frame. Therefore, this frame must be put into the socket rx path too.
This patch fixes how CAN frames are handled when these are sent while the can interface is configured in "loopback on" mode.
--- drivers/net/can/peak_canfd/peak_canfd.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/can/peak_canfd/peak_canfd.c +8 -3
@@ -262,8 +262,7 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv, cf_len =get_can_dlc (pucan_msg_get_dlc (msg));/* if this frame is an echo, */ -if ((rx_msg_flags &PUCAN_MSG_LOOPED_BACK ) && - !(rx_msg_flags &PUCAN_MSG_SELF_RECEIVE )) { +if (rx_msg_flags &PUCAN_MSG_LOOPED_BACK ) {unsigned long flags;spin_lock_irqsave (&priv->echo_lock, flags);
@@ -277,7 +276,13 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv,netif_wake_queue (priv->ndev);spin_unlock_irqrestore (&priv->echo_lock, flags); -return 0 ; + +/* if this frame is only an echo, stop here. Otherwise, +* continue to push this application self-received frame into +* its own rx queue. +*/ +if (!(rx_msg_flags &PUCAN_MSG_SELF_RECEIVE )) +return 0 ; }/* otherwise, it should be pushed into rx fifo */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 56/255 can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A
In reply to Greg Kroah-HartmanFrom: Joakim Zhang <[email protected]>
[ Upstream commit 018799649071a1638c0c130526af36747df4355a ]
After double check with Layerscape CAN owner (Pankaj Bansal), confirm that LS1021A doesn't support ECC feature, so remove FLEXCAN_QUIRK_DISABLE_MECR quirk.
--- drivers/net/can/flexcan.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/can/flexcan.c +1 -2
@@ -321,8 +321,7 @@ static const struct flexcan_devtype_data fsl_vf610_devtype_data = {static const struct flexcan_devtype_data fsl_ls1021a_r2_devtype_data = { .quirks =FLEXCAN_QUIRK_DISABLE_RXFG |FLEXCAN_QUIRK_ENABLE_EACEN_RRS | -FLEXCAN_QUIRK_DISABLE_MECR |FLEXCAN_QUIRK_BROKEN_PERR_STATE | -FLEXCAN_QUIRK_USE_OFF_TIMESTAMP , +FLEXCAN_QUIRK_BROKEN_PERR_STATE |FLEXCAN_QUIRK_USE_OFF_TIMESTAMP , };static const struct can_bittiming_const flexcan_bittiming_const = {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 57/255 can: flexcan: flexcan_remove(): disable wakeup completely
In reply to Greg Kroah-HartmanFrom: Joakim Zhang <[email protected]>
[ Upstream commit ab07ff1c92fa60f29438e655a1b4abab860ed0b6 ]
With below sequence, we can see wakeup default is enabled after re-load module, if it was enabled before, so we need disable wakeup in flexcan_remove().
| # cat /sys/bus/platform/drivers/flexcan/5a8e0000.can/power/wakeup | disabled | # echo enabled > /sys/bus/platform/drivers/flexcan/5a8e0000.can/power/wakeup | # cat /sys/bus/platform/drivers/flexcan/5a8e0000.can/power/wakeup | enabled | # rmmod flexcan | # modprobe flexcan | # cat /sys/bus/platform/drivers/flexcan/5a8e0000.can/power/wakeup | enabled
--- drivers/net/can/flexcan.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/can/flexcan.c +2 -0
@@ -1695,6 +1695,8 @@ static int flexcan_remove(struct platform_device *pdev) {struct net_device *dev =platform_get_drvdata (pdev); +device_set_wakeup_enable (&pdev->dev, false); +device_set_wakeup_capable (&pdev->dev, false);unregister_flexcandev (dev);pm_runtime_disable (&pdev->dev);free_candev (dev);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 58/255 xfs: flush new eof page on truncate to avoid post-eof corruption
In reply to Greg Kroah-HartmanFrom: Brian Foster <[email protected]>
[ Upstream commit 869ae85dae64b5540e4362d7fe4cd520e10ec05c ]
It is possible to expose non-zeroed post-EOF data in XFS if the new EOF page is dirty, backed by an unwritten block and the truncate happens to race with writeback. iomap_truncate_page() will not zero the post-EOF portion of the page if the underlying block is unwritten. The subsequent call to truncate_setsize() will, but doesn't dirty the page. Therefore, if writeback happens to complete after iomap_truncate_page() (so it still sees the unwritten block) but before truncate_setsize(), the cached page becomes inconsistent with the on-disk block. A mapped read after the associated page is reclaimed or invalidated exposes non-zero post-EOF data.
For example, consider the following sequence when run on a kernel modified to explicitly flush the new EOF page within the race window:
$ xfs_io -fc "falloc 0 4k" -c fsync /mnt/file $ xfs_io -c "pwrite 0 4k" -c "truncate 1k" /mnt/file ... $ xfs_io -c "mmap 0 4k" -c "mread -v 1k 8" /mnt/file 00000400: 00 00 00 00 00 00 00 00 ........ $ umount /mnt/; mount <dev> /mnt/ $ xfs_io -c "mmap 0 4k" -c "mread -v 1k 8" /mnt/file 00000400: cd cd cd cd cd cd cd cd ........
Update xfs_setattr_size() to explicitly flush the new EOF page prior to the page truncate to ensure iomap has the latest state of the underlying block.
--- fs/xfs/xfs_iops.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/xfs/xfs_iops.c +10 -0
@@ -911,6 +911,16 @@ xfs_setattr_size( error =iomap_zero_range (inode, oldsize, newsize - oldsize, &did_zeroing, &xfs_buffered_write_iomap_ops); }else { +/* +* iomap won't detect a dirty page over an unwritten block (or a +* cow block over a hole) and subsequently skips zeroing the +* newly post-EOF portion of the page. Flush the new EOF to +* convert the block before the pagecache truncate. +*/ + error =filemap_write_and_wait_range (inode->i_mapping, newsize, + newsize); +if (error) +return error; error =iomap_truncate_page (inode, newsize, &did_zeroing, &xfs_buffered_write_iomap_ops); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 59/255 xfs: fix missing CoW blocks writeback conversion retry
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit c2f09217a4305478c55adc9a98692488dd19cd32 ]
In commit 7588cbeec6df, we tried to fix a race stemming from the lack of coordination between higher level code that wants to allocate and remap CoW fork extents into the data fork. Christoph cites as examples the always_cow mode, and a directio write completion racing with writeback.
According to the comments before the goto retry, we want to restart the lookup to catch the extent in the data fork, but we don't actually reset whichfork or cow_fsb, which means the second try executes using stale information. Up until now I think we've gotten lucky that either there's something left in the CoW fork to cause cow_fsb to be reset, or either data/cow fork sequence numbers have advanced enough to force a fresh lookup from the data fork. However, if we reach the retry with an empty stable CoW fork and a stable data fork, neither of those things happens. The retry foolishly re-calls xfs_convert_blocks on the CoW fork which fails again. This time, we toss the write.
I've recently been working on extending reflink to the realtime device. When the realtime extent size is larger than a single block, we have to force the page cache to CoW the entire rt extent if a write (or fallocate) are not aligned with the rt extent size. The strategy I've chosen to deal with this is derived from Dave's blocksize > pagesize
series: dirtying around the write range, and ensuring that writeback always starts mapping on an rt extent boundary. This has brought this race front and center, since generic/522 blows up immediately.
However, I'm pretty sure this is a bug outright, independent of that.
--- fs/xfs/xfs_aops.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/xfs/xfs_aops.c +4 -2
@@ -346,8 +346,8 @@ xfs_map_blocks(ssize_t count =i_blocksize (inode);xfs_fileoff_t offset_fsb =XFS_B_TO_FSBT (mp, offset);xfs_fileoff_t end_fsb =XFS_B_TO_FSB (mp, offset + count); -xfs_fileoff_t cow_fsb =NULLFILEOFF ; -int whichfork =XFS_DATA_FORK ; +xfs_fileoff_t cow_fsb; +int whichfork;struct xfs_bmbt_irec imap;struct xfs_iext_cursor icur;int retries =0 ;
@@ -381,6 +381,8 @@ xfs_map_blocks(* landed in a hole and we skip the block. */ retry: + cow_fsb =NULLFILEOFF ; + whichfork =XFS_DATA_FORK ;xfs_ilock (ip,XFS_ILOCK_SHARED );ASSERT (ip->i_df.if_format !=XFS_DINODE_FMT_BTREE || (ip->i_df.if_flags &XFS_IFEXTENTS ));
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 60/255 xfs: fix scrub flagging rtinherit even if there is no rt device
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit c1f6b1ac00756a7108e5fcb849a2f8230c0b62a5 ]
The kernel has always allowed directories to have the rtinherit flag set, even if there is no rt device, so this check is wrong.
--- fs/xfs/scrub/inode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/xfs/scrub/inode.c +1 -2
@@ -121,8 +121,7 @@ xchk_inode_flags( goto bad;/* rt flags require rt device */ -if ((flags & (XFS_DIFLAG_REALTIME |XFS_DIFLAG_RTINHERIT )) && - !mp->m_rtdev_targp) +if ((flags &XFS_DIFLAG_REALTIME ) && !mp->m_rtdev_targp) goto bad;/* new rt bitmap flag only valid for rbmino */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 61/255 io_uring: ensure consistent view of original task ->mm from SQPOLL
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
[ Upstream commit 4b70cf9dea4cd239b425f3282fa56ce19e234c8a ]
Ensure we get a valid view of the task mm, by using task_lock() when attempting to grab the original task mm.
--- fs/io_uring.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-)
fs/io_uring.c +20 -7
@@ -952,20 +952,33 @@ static void io_sq_thread_drop_mm(void)if (mm) {kthread_unuse_mm (mm);mmput (mm); + current->mm =NULL ; } }static int __io_sq_thread_acquire_mm (struct io_ring_ctx *ctx) { -if (!current->mm) { -if (unlikely (!(ctx->flags &IORING_SETUP_SQPOLL ) || - !ctx->sqo_task->mm || - !mmget_not_zero (ctx->sqo_task->mm))) -return -EFAULT ; -kthread_use_mm (ctx->sqo_task->mm); +struct mm_struct *mm; + +if (current->mm) +return 0 ; + +/* Should never happen */ +if (unlikely (!(ctx->flags &IORING_SETUP_SQPOLL ))) +return -EFAULT ; + +task_lock (ctx->sqo_task); + mm = ctx->sqo_task->mm; +if (unlikely (!mm || !mmget_not_zero (mm))) + mm =NULL ; +task_unlock (ctx->sqo_task); + +if (mm) { +kthread_use_mm (mm); +return 0 ; } -return 0 ; +return -EFAULT ; } static int io_sq_thread_acquire_mm(struct io_ring_ctx *ctx,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 62/255 spi: fsl-dspi: fix wrong pointer in suspend/resume
In reply to Greg Kroah-HartmanFrom: Zhao Qiang <[email protected]>
[ Upstream commit 9bd77a9ce31dd242fece27219d14fbee5068dd85 ]
Since commit 530b5affc675 ("spi: fsl-dspi: fix use-after-free in remove path"), this driver causes a "NULL pointer dereference" in dspi_suspend/resume.
This is because since this commit, the drivers private data point to "dspi" instead of "ctlr", the codes in suspend and resume func were not modified correspondly.
--- drivers/spi/spi-fsl-dspi.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/spi/spi-fsl-dspi.c +4 -6
@@ -1106,12 +1106,11 @@ MODULE_DEVICE_TABLE(of, fsl_dspi_dt_ids);#ifdef CONFIG_PM_SLEEP static int dspi_suspend (struct device *dev) { -struct spi_controller *ctlr =dev_get_drvdata (dev); -struct fsl_dspi *dspi =spi_controller_get_devdata (ctlr); +struct fsl_dspi *dspi =dev_get_drvdata (dev);if (dspi->irq)disable_irq (dspi->irq); -spi_controller_suspend (ctlr); +spi_controller_suspend (dspi->ctlr);clk_disable_unprepare (dspi->clk);pinctrl_pm_select_sleep_state (dev);
@@ -1121,8 +1120,7 @@ static int dspi_suspend(struct device *dev)static int dspi_resume (struct device *dev) { -struct spi_controller *ctlr =dev_get_drvdata (dev); -struct fsl_dspi *dspi =spi_controller_get_devdata (ctlr); +struct fsl_dspi *dspi =dev_get_drvdata (dev);int ret;pinctrl_pm_select_default_state (dev);
@@ -1130,7 +1128,7 @@ static int dspi_resume(struct device *dev) ret =clk_prepare_enable (dspi->clk);if (ret)return ret; -spi_controller_resume (ctlr); +spi_controller_resume (dspi->ctlr);if (dspi->irq)enable_irq (dspi->irq);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 63/255 PCI: mvebu: Fix duplicate resource requests
In reply to Greg Kroah-HartmanFrom: Rob Herring <[email protected]>
[ Upstream commit 832ea234277a2465ec6602fa6a4db5cd9ee87ae3 ]
With commit 669cbc708122 ("PCI: Move DT resource setup into devm_pci_alloc_host_bridge()"), the DT 'ranges' is parsed and populated into resources when the host bridge is allocated. The resources are requested as well, but that happens a second time for the mvebu driver in mvebu_pcie_parse_request_resources(). We should only be requesting the additional resources added in mvebu_pcie_parse_request_resources(). These are not added by default because they use custom properties rather than standard DT address translation.
Also, the bus ranges was also populated by default, so we can remove it from mvebu_pci_host_probe().
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=209729
--- drivers/pci/controller/pci-mvebu.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
drivers/pci/controller/pci-mvebu.c +10 -13
@@ -960,25 +960,16 @@ static void mvebu_pcie_powerdown(struct mvebu_pcie_port *port) }/* -* We can't use devm_of_pci_get_host_bridge_resources() because we -* need to parse our special DT properties encoding the MEM and IO -* apertures. +* devm_of_pci_get_host_bridge_resources() only sets up translateable resources, +* so we need extra resource setup parsing our special DT properties encoding +* the MEM and IO apertures. */ static int mvebu_pcie_parse_request_resources (struct mvebu_pcie *pcie) {struct device *dev = &pcie->pdev->dev; -struct device_node *np = dev->of_node;struct pci_host_bridge *bridge =pci_host_bridge_from_priv (pcie);int ret; -/* Get the bus range */ - ret =of_pci_parse_bus_range (np, &pcie->busn); -if (ret) { -dev_err (dev,"failed to parse bus-range property: %d\n" , ret); -return ret; - } -pci_add_resource (&bridge->windows, &pcie->busn); -/* Get the PCIe memory aperture */ mvebu_mbus_get_pcie_mem_aperture (&pcie->mem);if (resource_size (&pcie->mem) ==0 ) {
@@ -988,6 +979,9 @@ static int mvebu_pcie_parse_request_resources(struct mvebu_pcie *pcie) pcie->mem.name ="PCI MEM" ;pci_add_resource (&bridge->windows, &pcie->mem); + ret =devm_request_resource (dev, &iomem_resource, &pcie->mem); +if (ret) +return ret;/* Get the PCIe IO aperture */ mvebu_mbus_get_pcie_io_aperture (&pcie->io);
@@ -1001,9 +995,12 @@ static int mvebu_pcie_parse_request_resources(struct mvebu_pcie *pcie) pcie->realio.name ="PCI I/O" ;pci_add_resource (&bridge->windows, &pcie->realio); + ret =devm_request_resource (dev, &ioport_resource, &pcie->realio); +if (ret) +return ret; } -return devm_request_pci_bus_resources (dev, &bridge->windows); +return 0 ; }/*
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 64/255 ceph: check session state after bumping session->s_seq
In reply to Greg Kroah-HartmanFrom: Jeff Layton <[email protected]>
[ Upstream commit 62575e270f661aba64778cbc5f354511cf9abb21 ]
Some messages sent by the MDS entail a session sequence number increment, and the MDS will drop certain types of requests on the floor when the sequence numbers don't match.
In particular, a REQUEST_CLOSE message can cross with one of the sequence morphing messages from the MDS which can cause the client to stall, waiting for a response that will never come.
Originally, this meant an up to 5s delay before the recurring workqueue job kicked in and resent the request, but a recent change made it so that the client would never resend, causing a 60s stall unmounting and sometimes a blockisting event.
Add a new helper for incrementing the session sequence and then testing to see whether a REQUEST_CLOSE needs to be resent, and move the handling of CEPH_MDS_SESSION_CLOSING into that function. Change all of the bare sequence counter increments to use the new helper.
Reorganize check_session_state with a switch statement. It should no longer be called when the session is CLOSING, so throw a warning if it ever is (but still handle that case sanely).
[ idryomov: whitespace, pr_err() call fixup ]
URL: https://tracker.ceph.com/issues/47563
--- fs/ceph/caps.c | 2 +- fs/ceph/mds_client.c | 50 +++++++++++++++++++++++++++++++------------- fs/ceph/mds_client.h | 1 + fs/ceph/quota.c | 2 +- fs/ceph/snap.c | 2 +- 5 files changed, 39 insertions(+), 18 deletions(-)
fs/ceph/caps.c +1 -1
@@ -4064,7 +4064,7 @@ void ceph_handle_caps(struct ceph_mds_session *session, vino.snap, inode);mutex_lock (&session->s_mutex); - session->s_seq++; +inc_session_sequence (session);dout (" mds%d seq %lld cap seq %u\n" , session->s_mds, session->s_seq, (unsigned )seq);
fs/ceph/mds_client.c +35 -15
70 lines not on this page · raw message
fs/ceph/mds_client.h +1 -0
@@ -480,6 +480,7 @@ struct ceph_mds_client {extern const char *ceph_mds_op_name (int op);extern bool check_session_state (struct ceph_mds_session *s); +void inc_session_sequence (struct ceph_mds_session *s);extern struct ceph_mds_session *__ceph_lookup_mds_session (struct ceph_mds_client *,int mds);
fs/ceph/quota.c +1 -1
@@ -53,7 +53,7 @@ void ceph_handle_quota(struct ceph_mds_client *mdsc,/* increment msg sequence number */ mutex_lock (&session->s_mutex); - session->s_seq++; +inc_session_sequence (session);mutex_unlock (&session->s_mutex);/* lookup inode */
fs/ceph/snap.c +1 -1
@@ -873,7 +873,7 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc, ceph_snap_op_name(op), split, trace_len);mutex_lock (&session->s_mutex); - session->s_seq++; +inc_session_sequence (session);mutex_unlock (&session->s_mutex);down_write (&mdsc->snap_rwsem);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 65/255 selftests: core: use SKIP instead of XFAIL in close_range_test.c
In reply to Greg Kroah-HartmanFrom: Tommi Rantala <[email protected]>
[ Upstream commit 1d44d0dd61b6121b49f25b731f2f7f605cb3c896 ]
XFAIL is gone since commit 9847d24af95c ("selftests/harness: Refactor XFAIL into SKIP"), use SKIP instead.
--- tools/testing/selftests/core/close_range_test.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/core/close_range_test.c +4 -4
@@ -44,7 +44,7 @@ TEST(close_range) fd =open ("/dev/null" ,O_RDONLY |O_CLOEXEC ); ASSERT_GE(fd, 0) {if (errno ==ENOENT ) -XFAIL (return,"Skipping test since /dev/null does not exist" ); +SKIP (return,"Skipping test since /dev/null does not exist" ); } open_fds[i] = fd;
@@ -52,7 +52,7 @@ TEST(close_range) EXPECT_EQ(-1, sys_close_range(open_fds[0], open_fds[100], -1)) {if (errno ==ENOSYS ) -XFAIL (return,"close_range() syscall not supported" ); +SKIP (return,"close_range() syscall not supported" ); }EXPECT_EQ (0 ,sys_close_range (open_fds[0 ], open_fds[50 ],0 ));
@@ -108,7 +108,7 @@ TEST(close_range_unshare) fd =open ("/dev/null" ,O_RDONLY |O_CLOEXEC ); ASSERT_GE(fd, 0) {if (errno ==ENOENT ) -XFAIL (return,"Skipping test since /dev/null does not exist" ); +SKIP (return,"Skipping test since /dev/null does not exist" ); } open_fds[i] = fd;
@@ -197,7 +197,7 @@ TEST(close_range_unshare_capped) fd =open ("/dev/null" ,O_RDONLY |O_CLOEXEC ); ASSERT_GE(fd, 0) {if (errno ==ENOENT ) -XFAIL (return,"Skipping test since /dev/null does not exist" ); +SKIP (return,"Skipping test since /dev/null does not exist" ); } open_fds[i] = fd;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 66/255 selftests: clone3: use SKIP instead of XFAIL
In reply to Greg Kroah-HartmanFrom: Tommi Rantala <[email protected]>
[ Upstream commit afba8b0a2cc532b54eaf4254092f57bba5d7eb65 ]
XFAIL is gone since commit 9847d24af95c ("selftests/harness: Refactor XFAIL into SKIP"), use SKIP instead.
--- tools/testing/selftests/clone3/clone3_cap_checkpoint_restore.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/clone3/clone3_cap_checkpoint_restore.c +1 -1
@@ -145,7 +145,7 @@ TEST(clone3_cap_checkpoint_restore)test_clone3_supported (); EXPECT_EQ(getuid(), 0) -XFAIL (return,"Skipping all tests as non-root\n" ); +SKIP (return,"Skipping all tests as non-root" );memset (&set_tid,0 ,sizeof (set_tid));
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 67/255 selftests: binderfs: use SKIP instead of XFAIL
In reply to Greg Kroah-HartmanFrom: Tommi Rantala <[email protected]>
[ Upstream commit 7d764b685ee1bc73a9fa2b6cb4d42fa72b943145 ]
XFAIL is gone since commit 9847d24af95c ("selftests/harness: Refactor XFAIL into SKIP"), use SKIP instead.
--- .../selftests/filesystems/binderfs/binderfs_test.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/filesystems/binderfs/binderfs_test.c +4 -4
@@ -74,7 +74,7 @@ static int __do_binderfs_test(struct __test_metadata *_metadata) ret =mount (NULL , binderfs_mntpt,"binder" ,0 ,0 ); EXPECT_EQ(ret, 0) {if (errno ==ENODEV ) - XFAIL(goto out, "binderfs missing"); + SKIP(goto out, "binderfs missing");TH_LOG ("%s - Failed to mount binderfs" ,strerror (errno)); goto rmdir; }
@@ -475,10 +475,10 @@ TEST(binderfs_stress)TEST (binderfs_test_privileged) {if (geteuid () !=0 ) -XFAIL (return,"Tests are not run as root. Skipping privileged tests" ); +SKIP (return,"Tests are not run as root. Skipping privileged tests" );if (__do_binderfs_test (_metadata)) -XFAIL (return,"The Android binderfs filesystem is not available" ); +SKIP (return,"The Android binderfs filesystem is not available" ); }TEST (binderfs_test_unprivileged)
@@ -511,7 +511,7 @@ TEST(binderfs_test_unprivileged) ret =wait_for_pid (pid);if (ret) {if (ret ==2 ) -XFAIL (return,"The Android binderfs filesystem is not available" ); +SKIP (return,"The Android binderfs filesystem is not available" ); ASSERT_EQ(ret, 0) {TH_LOG ("wait_for_pid() failed" ); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 68/255 x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP
In reply to Greg Kroah-HartmanFrom: Anand K Mistry <[email protected]>
[ Upstream commit 1978b3a53a74e3230cd46932b149c6e62e832e9a ]
On AMD CPUs which have the feature X86_FEATURE_AMD_STIBP_ALWAYS_ON, STIBP is set to on and
spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED
At the same time, IBPB can be set to conditional.
However, this leads to the case where it's impossible to turn on IBPB for a process because in the PR_SPEC_DISABLE case in ib_prctl_set() the
spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED
condition leads to a return before the task flag is set. Similarly, ib_prctl_get() will return PR_SPEC_DISABLE even though IBPB is set to conditional.
More generally, the following cases are possible:
1. STIBP = conditional && IBPB = on for spectre_v2_user=seccomp,ibpb
2. STIBP = on && IBPB = conditional for AMD CPUs with X86_FEATURE_AMD_STIBP_ALWAYS_ON
The first case functions correctly today, but only because spectre_v2_user_ibpb isn't updated to reflect the IBPB mode.
At a high level, this change does one thing. If either STIBP or IBPB is set to conditional, allow the prctl to change the task flag. Also, reflect that capability when querying the state. This isn't perfect since it doesn't take into account if only STIBP or IBPB is unconditionally on. But it allows the conditional feature to work as expected, without affecting the unconditional one.
[ bp: Massage commit message and comment; space out statements for
better readability. ]
--- arch/x86/kernel/cpu/bugs.c | 51 ++++++++++++++++++++++++-------------- 1 file changed, 33 insertions(+), 18 deletions(-)
arch/x86/kernel/cpu/bugs.c +33 -18
@@ -1254,6 +1254,14 @@ static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)return 0 ; } +static bool is_spec_ib_user_controlled (void ) +{ +return spectre_v2_user_ibpb ==SPECTRE_V2_USER_PRCTL || + spectre_v2_user_ibpb ==SPECTRE_V2_USER_SECCOMP || + spectre_v2_user_stibp ==SPECTRE_V2_USER_PRCTL || + spectre_v2_user_stibp ==SPECTRE_V2_USER_SECCOMP ; +} +static int ib_prctl_set (struct task_struct *task,unsigned long ctrl) {switch (ctrl) {
@@ -1261,16 +1269,26 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_NONE && spectre_v2_user_stibp ==SPECTRE_V2_USER_NONE )return 0 ; +/* -* Indirect branch speculation is always disabled in strict -* mode. It can neither be enabled if it was force-disabled -* by a previous prctl call. +* With strict mode for both IBPB and STIBP, the instruction +* code paths avoid checking this task flag and instead, +* unconditionally run the instruction. However, STIBP and IBPB +* are independent and either can be set to conditionally +* enabled regardless of the mode of the other. +* +* If either is set to conditional, allow the task flag to be +* updated, unless it was force-disabled by a previous prctl +* call. Currently, this is possible on an AMD CPU which has the +* feature X86_FEATURE_AMD_STIBP_ALWAYS_ON. In this case, if the +* kernel is booted with 'spectre_v2_user=seccomp', then +* spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP and +* spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED. */ -if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_STRICT || - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT || - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT_PREFERRED || +if (!is_spec_ib_user_controlled () ||task_spec_ib_force_disable (task))return -EPERM ; +task_clear_spec_ib_disable (task);task_update_spec_tif (task);break ;
@@ -1283,10 +1301,10 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_NONE && spectre_v2_user_stibp ==SPECTRE_V2_USER_NONE )return -EPERM ; -if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_STRICT || - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT || - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT_PREFERRED ) + +if (!is_spec_ib_user_controlled ())return 0 ; +task_set_spec_ib_disable (task);if (ctrl ==PR_SPEC_FORCE_DISABLE )task_set_spec_ib_force_disable (task);
@@ -1351,20 +1369,17 @@ static int ib_prctl_get(struct task_struct *task)if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_NONE && spectre_v2_user_stibp ==SPECTRE_V2_USER_NONE )return PR_SPEC_ENABLE ; -else if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_STRICT || - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT || - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT_PREFERRED ) -return PR_SPEC_DISABLE ; -else if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_PRCTL || - spectre_v2_user_ibpb ==SPECTRE_V2_USER_SECCOMP || - spectre_v2_user_stibp ==SPECTRE_V2_USER_PRCTL || - spectre_v2_user_stibp ==SPECTRE_V2_USER_SECCOMP ) { +else if (is_spec_ib_user_controlled ()) {if (task_spec_ib_force_disable (task))return PR_SPEC_PRCTL |PR_SPEC_FORCE_DISABLE ;if (task_spec_ib_disable (task))return PR_SPEC_PRCTL |PR_SPEC_DISABLE ;return PR_SPEC_PRCTL |PR_SPEC_ENABLE ; - }else + }else if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_STRICT || + spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT || + spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT_PREFERRED ) +return PR_SPEC_DISABLE ; +else return PR_SPEC_NOT_AFFECTED ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 69/255 kbuild: explicitly specify the build id style
In reply to Greg Kroah-HartmanFrom: Bill Wendling <[email protected]>
[ Upstream commit a968433723310f35898b4a2f635a7991aeef66b1 ]
ld's --build-id defaults to "sha1" style, while lld defaults to "fast". The build IDs are very different between the two, which may confuse programs that reference them.
--- Makefile | 4 ++-- arch/arm/vdso/Makefile | 2 +- arch/arm64/kernel/vdso/Makefile | 2 +- arch/arm64/kernel/vdso32/Makefile | 2 +- arch/mips/vdso/Makefile | 2 +- arch/riscv/kernel/vdso/Makefile | 2 +- arch/s390/kernel/vdso64/Makefile | 2 +- arch/sparc/vdso/Makefile | 2 +- arch/x86/entry/vdso/Makefile | 2 +- tools/testing/selftests/bpf/Makefile | 2 +- 10 files changed, 11 insertions(+), 11 deletions(-)
Makefile +2 -2
@@ -973,8 +973,8 @@ KBUILD_CPPFLAGS += $(KCPPFLAGS) KBUILD_AFLAGS += $(KAFLAGS) KBUILD_CFLAGS += $(KCFLAGS) -KBUILD_LDFLAGS_MODULE += --build-id -LDFLAGS_vmlinux += --build-id +KBUILD_LDFLAGS_MODULE += --build-id=sha1 +LDFLAGS_vmlinux += --build-id=sha1 ifeq ($(CONFIG_STRIP_ASM_SYMS),y) LDFLAGS_vmlinux += $(call ld-option, -X,)
arch/arm/vdso/Makefile +1 -1
@@ -19,7 +19,7 @@ ccflags-y += -DDISABLE_BRANCH_PROFILING -DBUILD_VDSO32 ldflags-$(CONFIG_CPU_ENDIAN_BE8) := --be8 ldflags-y := -Bsymbolic --no-undefined -soname=linux-vdso.so.1 \ -z max-page-size=4096 -nostdlib -shared $(ldflags-y) \ - --hash-style=sysv --build-id \ + --hash-style=sysv --build-id=sha1 \ -T obj-$(CONFIG_VDSO) += vdso.o
arch/arm64/kernel/vdso/Makefile +1 -1
@@ -24,7 +24,7 @@ btildflags-$(CONFIG_ARM64_BTI_KERNEL) += -z force-bti # routines, as x86 does (see 6f121e548f83 ("x86, vdso: Reimplement vdso.so # preparation in build-time C")). ldflags-y := -shared -nostdlib -soname=linux-vdso.so.1 --hash-style=sysv \ - -Bsymbolic $(call ld-option, --no-eh-frame-hdr) --build-id -n \ + -Bsymbolic $(call ld-option, --no-eh-frame-hdr) --build-id=sha1 -n \ $(btildflags-y) -T ccflags-y := -fno-common -fno-builtin -fno-stack-protector -ffixed-x18
arch/arm64/kernel/vdso32/Makefile +1 -1
@@ -128,7 +128,7 @@ VDSO_LDFLAGS += -Wl,-Bsymbolic -Wl,--no-undefined -Wl,-soname=linux-vdso.so.1 VDSO_LDFLAGS += -Wl,-z,max-page-size=4096 -Wl,-z,common-page-size=4096 VDSO_LDFLAGS += -nostdlib -shared -mfloat-abi=soft VDSO_LDFLAGS += -Wl,--hash-style=sysv -VDSO_LDFLAGS += -Wl,--build-id +VDSO_LDFLAGS += -Wl,--build-id=sha1 VDSO_LDFLAGS += $(call cc32-ldoption,-fuse-ld=bfd)
arch/mips/vdso/Makefile +1 -1
@@ -61,7 +61,7 @@ endif # VDSO linker flags. ldflags-y := -Bsymbolic --no-undefined -soname=linux-vdso.so.1 \ $(filter -E%,$(KBUILD_CFLAGS)) -nostdlib -shared \ - -G 0 --eh-frame-hdr --hash-style=sysv --build-id -T + -G 0 --eh-frame-hdr --hash-style=sysv --build-id=sha1 -T CFLAGS_REMOVE_vdso.o = -pg
arch/riscv/kernel/vdso/Makefile +1 -1
@@ -49,7 +49,7 @@ $(obj)/vdso.so.dbg: $(src)/vdso.lds $(obj-vdso) FORCE # refer to these symbols in the kernel code rather than hand-coded addresses. SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \ - -Wl,--build-id -Wl,--hash-style=both + -Wl,--build-id=sha1 -Wl,--hash-style=both $(obj)/vdso-dummy.o: $(src)/vdso.lds $(obj)/rt_sigreturn.o FORCE $(call if_changed,vdsold)
arch/s390/kernel/vdso64/Makefile +1 -1
@@ -19,7 +19,7 @@ KBUILD_AFLAGS_64 += -m64 -s KBUILD_CFLAGS_64 := $(filter-out -m64,$(KBUILD_CFLAGS)) KBUILD_CFLAGS_64 += -m64 -fPIC -shared -fno-common -fno-builtin ldflags-y := -fPIC -shared -nostdlib -soname=linux-vdso64.so.1 \ - --hash-style=both --build-id -T + --hash-style=both --build-id=sha1 -T $(targets:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_64) $(targets:%=$(obj)/%.dbg): KBUILD_AFLAGS = $(KBUILD_AFLAGS_64)
arch/sparc/vdso/Makefile +1 -1
@@ -115,7 +115,7 @@ quiet_cmd_vdso = VDSO $@ -T $(filter %.lds,$^) $(filter %.o,$^) && \ sh $(srctree)/$(src)/checkundef.sh '$(OBJDUMP)' '$@' -VDSO_LDFLAGS = -shared --hash-style=both --build-id -Bsymbolic +VDSO_LDFLAGS = -shared --hash-style=both --build-id=sha1 -Bsymbolic GCOV_PROFILE := n #
arch/x86/entry/vdso/Makefile +1 -1
@@ -176,7 +176,7 @@ quiet_cmd_vdso = VDSO $@ -T $(filter %.lds,$^) $(filter %.o,$^) && \ sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@' -VDSO_LDFLAGS = -shared --hash-style=both --build-id \ +VDSO_LDFLAGS = -shared --hash-style=both --build-id=sha1 \ $(call ld-option, --eh-frame-hdr) -Bsymbolic GCOV_PROFILE := n
tools/testing/selftests/bpf/Makefile +1 -1
@@ -133,7 +133,7 @@ $(OUTPUT)/%:%.c $(OUTPUT)/urandom_read: urandom_read.c $(call msg,BINARY,,$@) - $(Q)$(CC) $(LDFLAGS) -o $@ $< $(LDLIBS) -Wl,--build-id + $(Q)$(CC) $(LDFLAGS) -o $@ $< $(LDLIBS) -Wl,--build-id=sha1 $(OUTPUT)/test_stub.o: test_stub.c $(BPFOBJ) $(call msg,CC,,$@)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 70/255 RISC-V: Fix the VDSO symbol generaton for binutils-2.35+
In reply to Greg Kroah-HartmanFrom: Palmer Dabbelt <[email protected]>
[ Upstream commit c2c81bb2f69138f902e1a58d3bef6ad97fb8a92c ]
We were relying on GNU ld's ability to re-link executable files in order to extract our VDSO symbols. This behavior was deemed a bug as of binutils-2.35 (specifically the binutils-gdb commit a87e1817a4 ("Have the linker fail if any attempt to link in an executable is made."), but as that has been backported to at least Debian's binutils-2.34 in may manifest in other places.
The previous version of this was a bit of a mess: we were linking a static executable version of the VDSO, containing only a subset of the input symbols, which we then linked into the kernel. This worked, but certainly wasn't a supported path through the toolchain. Instead this new version parses the textual output of nm to produce a symbol table. Both rely on near-zero addresses being linkable, but as we rely on weak undefined symbols being linkable elsewhere I don't view this as a major issue.
--- arch/riscv/kernel/vdso/.gitignore | 1 + arch/riscv/kernel/vdso/Makefile | 18 +++++++++--------- arch/riscv/kernel/vdso/so2s.sh | 6 ++++++ 3 files changed, 16 insertions(+), 9 deletions(-) create mode 100755 arch/riscv/kernel/vdso/so2s.sh
arch/riscv/kernel/vdso/.gitignore +1 -0
@@ -1,3 +1,4 @@ # SPDX-License-Identifier: GPL-2.0-only vdso.lds *.tmp +vdso-syms.S
arch/riscv/kernel/vdso/Makefile +9 -9
@@ -43,19 +43,14 @@ $(obj)/vdso.o: $(obj)/vdso.so SYSCFLAGS_vdso.so.dbg = $(c_flags) $(obj)/vdso.so.dbg: $(src)/vdso.lds $(obj-vdso) FORCE $(call if_changed,vdsold) +SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \ + -Wl,--build-id -Wl,--hash-style=both # We also create a special relocatable object that should mirror the symbol # table and layout of the linked DSO. With ld --just-symbols we can then # refer to these symbols in the kernel code rather than hand-coded addresses. - -SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \ - -Wl,--build-id=sha1 -Wl,--hash-style=both -$(obj)/vdso-dummy.o: $(src)/vdso.lds $(obj)/rt_sigreturn.o FORCE - $(call if_changed,vdsold) - -LDFLAGS_vdso-syms.o := -r --just-symbols -$(obj)/vdso-syms.o: $(obj)/vdso-dummy.o FORCE - $(call if_changed,ld) +$(obj)/vdso-syms.S: $(obj)/vdso.so FORCE + $(call if_changed,so2s) # strip rule for the .so file $(obj)/%.so: OBJCOPYFLAGS := -S
@@ -73,6 +68,11 @@ quiet_cmd_vdsold = VDSOLD $@ $(patsubst %, -G __vdso_%, $(vdso-syms)) [email protected] $@ && \ rm [email protected] +# Extracts symbol offsets from the VDSO, converting them into an assembly file +# that contains the same symbols at the same offsets. +quiet_cmd_so2s = SO2S $@ + cmd_so2s = $(NM) -D $< | $(srctree)/$(src)/so2s.sh > $@ + # install commands for the unstripped file quiet_cmd_vdso_install = INSTALL $@ cmd_vdso_install = cp $(obj)/[email protected] $(MODLIB)/vdso/$@
arch/riscv/kernel/vdso/so2s.sh new file +6 -0
@@ -0,0 +1,6 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0+ +# Copyright 2020 Palmer Dabbelt <[email protected]> + +sed 's!\([0-9a-f]*\) T \([a-z0-9_]*\)\(@@LINUX_4.15\)*!.global \2\n.set \2,0x\1!' \ +| grep '^\.'
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 71/255 USB: apple-mfi-fastcharge: fix reference leak in apple_mfi_fc_set_property
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 00bd6bca3fb1e98190a24eda2583062803c9e8b5 ]
pm_runtime_get_sync() will increment pm usage at first and it will resume the device later. If runtime of the device has error or device is in inaccessible state(or other error state), resume operation will fail. If we do not call put operation to decrease the reference, the result is that this device cannot enter the idle state and always stay busy or other non-idle state.
--- drivers/usb/misc/apple-mfi-fastcharge.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/misc/apple-mfi-fastcharge.c +3 -1
@@ -120,8 +120,10 @@ static int apple_mfi_fc_set_property(struct power_supply *psy,dev_dbg (&mfi->udev->dev,"prop: %d\n" , psp); ret =pm_runtime_get_sync (&mfi->udev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_noidle (&mfi->udev->dev);return ret; + }switch (psp) {case POWER_SUPPLY_PROP_CHARGE_TYPE :
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 72/255 tpm: efi: Dont create binary_bios_measurements file for an empty log
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
[ Upstream commit 8ffd778aff45be760292225049e0141255d4ad6e ]
Mimic the pre-existing ACPI and Device Tree event log behavior by not creating the binary_bios_measurements file when the EFI TPM event log is empty.
This fixes the following NULL pointer dereference that can occur when reading /sys/kernel/security/tpm0/binary_bios_measurements after the kernel received an empty event log from the firmware:
BUG: kernel NULL pointer dereference, address: 000000000000002c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 2 PID: 3932 Comm: fwupdtpmevlog Not tainted 5.9.0-00003-g629990edad62 #17 Hardware name: LENOVO 20LCS03L00/20LCS03L00, BIOS N27ET38W (1.24 ) 11/28/2019 RIP: 0010:tpm2_bios_measurements_start+0x3a/0x550 Code: 54 53 48 83 ec 68 48 8b 57 70 48 8b 1e 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 48 8b 82 c0 06 00 00 48 8b 8a c8 06 00 00 <44> 8b 60 1c 48 89 4d a0 4c 89 e2 49 83 c4 20 48 83 fb 00 75 2a 49 RSP: 0018:ffffa9c901203db0 EFLAGS: 00010246 RAX: 0000000000000010 RBX: 0000000000000000 RCX: 0000000000000010 RDX: ffff8ba1eb99c000 RSI: ffff8ba1e4ce8280 RDI: ffff8ba1e4ce8258 RBP: ffffa9c901203e40 R08: ffffa9c901203dd8 R09: ffff8ba1ec443300 R10: ffffa9c901203e50 R11: 0000000000000000 R12: ffff8ba1e4ce8280 R13: ffffa9c901203ef0 R14: ffffa9c901203ef0 R15: ffff8ba1e4ce8258 FS: 00007f6595460880(0000) GS:ffff8ba1ef880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000002c CR3: 00000007d8d18003 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __kmalloc_node+0x113/0x320 ? kvmalloc_node+0x31/0x80 seq_read+0x94/0x420 vfs_read+0xa7/0x190 ksys_read+0xa7/0xe0 __x64_sys_read+0x1a/0x20 do_syscall_64+0x37/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xa9
In this situation, the bios_event_log pointer in the tpm_bios_log struct was not NULL but was equal to the ZERO_SIZE_PTR (0x10) value. This was due to the following kmemdup() in tpm_read_log_efi():
int tpm_read_log_efi(struct tpm_chip *chip)
{
...
/* malloc EventLog space */
log->bios_event_log = kmemdup(log_tbl->log, log_size, GFP_KERNEL);
if (!log->bios_event_log) {
ret = -ENOMEM;
goto out;
}...
}
When log_size is zero, due to an empty event log from firmware, ZERO_SIZE_PTR is returned from kmemdup(). Upon a read of the binary_bios_measurements file, the tpm2_bios_measurements_start() function does not perform a ZERO_OR_NULL_PTR() check on the bios_event_log pointer before dereferencing it.
Rather than add a ZERO_OR_NULL_PTR() check in functions that make use of the bios_event_log pointer, simply avoid creating the binary_bios_measurements_file as is done in other event log retrieval backends.
Explicitly ignore all of the events in the final event log when the main event log is empty. The list of events in the final event log cannot be accurately parsed without referring to the first event in the main event log (the event log header) so the final event log is useless in such a situation.
--- drivers/char/tpm/eventlog/efi.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/char/tpm/eventlog/efi.c +5 -0
@@ -41,6 +41,11 @@ int tpm_read_log_efi(struct tpm_chip *chip) log_size = log_tbl->size;memunmap (log_tbl); +if (!log_size) { +pr_warn ("UEFI TPM log area empty\n" ); +return -EIO ; + } + log_tbl =memremap (efi.tpm_log,sizeof (*log_tbl) + log_size,MEMREMAP_WB );if (!log_tbl) {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 73/255 KVM: arm64: ARM_SMCCC_ARCH_WORKAROUND_1 doesnt return SMCCC_RET_NOT_REQUIRED
In reply to Greg Kroah-HartmanFrom: Stephen Boyd <[email protected]>
commit 1de111b51b829bcf01d2e57971f8fd07a665fa3f upstream.
According to the SMCCC spec[1](7.5.2 Discovery) the ARM_SMCCC_ARCH_WORKAROUND_1 function id only returns 0, 1, and SMCCC_RET_NOT_SUPPORTED.
0 is "workaround required and safe to call this function"
1 is "workaround not required but safe to call this function" SMCCC_RET_NOT_SUPPORTED is "might be vulnerable or might not be, who knows, I give up!"
SMCCC_RET_NOT_SUPPORTED might as well mean "workaround required, except calling this function may not work because it isn't implemented in some cases". Wonderful. We map this SMC call to
0 is SPECTRE_MITIGATED
1 is SPECTRE_UNAFFECTED
SMCCC_RET_NOT_SUPPORTED is SPECTRE_VULNERABLE
For KVM hypercalls (hvc), we've implemented this function id to return SMCCC_RET_NOT_SUPPORTED, 0, and SMCCC_RET_NOT_REQUIRED. One of those isn't supposed to be there. Per the code we call arm64_get_spectre_v2_state() to figure out what to return for this feature discovery call.
0 is SPECTRE_MITIGATED
SMCCC_RET_NOT_REQUIRED is SPECTRE_UNAFFECTED
SMCCC_RET_NOT_SUPPORTED is SPECTRE_VULNERABLE
Let's clean this up so that KVM tells the guest this mapping:
0 is SPECTRE_MITIGATED
1 is SPECTRE_UNAFFECTED
SMCCC_RET_NOT_SUPPORTED is SPECTRE_VULNERABLE
Note: SMCCC_RET_NOT_AFFECTED is 1 but isn't part of the SMCCC spec
--- arch/arm64/kvm/hypercalls.c | 2 +- include/linux/arm-smccc.h | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-)
arch/arm64/kvm/hypercalls.c +1 -1
@@ -31,7 +31,7 @@ int kvm_hvc_call_handler(struct kvm_vcpu val =SMCCC_RET_SUCCESS ;break ;case KVM_BP_HARDEN_NOT_REQUIRED : - val =SMCCC_RET_NOT_REQUIRED ; + val =SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED ;break ; }break ;
include/linux/arm-smccc.h +2 -0
@@ -86,6 +86,8 @@ ARM_SMCCC_SMC_32, \ 0, 0x7fff) +#define SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED 1 +/* Paravirtualised time calls (defined by ARM DEN0057A) */ #define ARM_SMCCC_HV_PV_TIME_FEATURES \ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
Greg Kroah-Hartman
maintainerPATCH 74/255 ath9k_htc: Use appropriate rs_datalen type
In reply to Greg Kroah-HartmanFrom: Masashi Honma <[email protected]>
commit 5024f21c159f8c1668f581fff37140741c0b1ba9 upstream.
kernel test robot says:drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: warning: incorrect type in assignment (different base types)drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: expected restricted __be16 [usertype] rs_datalendrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: got unsigned short [usertype]drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:988:13: sparse: warning: restricted __be16 degrades to integer drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:1001:13: sparse: warning: restricted __be16 degrades to integer
Indeed rs_datalen has host byte order, so modify it's own type.
--- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +1 -1
@@ -974,7 +974,7 @@ static bool ath9k_rx_prepare(struct ath9struct ath_htc_rx_status *rxstatus;struct ath_rx_status rx_stats;bool decrypt_error = false; -__be16 rs_datalen; +u16 rs_datalen;bool is_phyerr;if (skb->len <HTC_RX_FRAME_HEADER_SIZE ) {
Greg Kroah-Hartman
maintainerPATCH 75/255 scsi: ufs: Fix missing brace warning for old compilers
In reply to Greg Kroah-HartmanFrom: Pujin Shi <[email protected]>
commit 6500251e590657066a227dce897a0392f302af24 upstream.
For older versions of gcc, the array = {0}; will cause warnings:
drivers/scsi/ufs/ufshcd-crypto.c: In function 'ufshcd_crypto_keyslot_program':drivers/scsi/ufs/ufshcd-crypto.c:62:8: warning: missing braces around initializer [-Wmissing-braces]
union ufs_crypto_cfg_entry cfg = { 0 };
^
drivers/scsi/ufs/ufshcd-crypto.c:62:8: warning: (near initialization for 'cfg.reg_val') [-Wmissing-braces]
drivers/scsi/ufs/ufshcd-crypto.c: In function 'ufshcd_clear_keyslot':
drivers/scsi/ufs/ufshcd-crypto.c:103:8: warning: missing braces around initializer [-Wmissing-braces]
union ufs_crypto_cfg_entry cfg = { 0 };
^2 warnings generated
--- drivers/scsi/ufs/ufshcd-crypto.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/ufs/ufshcd-crypto.c +2 -2
@@ -59,7 +59,7 @@ static int ufshcd_crypto_keyslot_programu8 data_unit_mask = key->crypto_cfg.data_unit_size /512 ;int i;int cap_idx =-1 ; -union ufs_crypto_cfg_entry cfg = {0 }; +union ufs_crypto_cfg_entry cfg = {};int err;BUILD_BUG_ON (UFS_CRYPTO_KEY_SIZE_INVALID !=0 );
@@ -100,7 +100,7 @@ static int ufshcd_clear_keyslot(struct u* Clear the crypto cfg on the device. Clearing CFGE * might not be sufficient, so just clear the entire cfg. */ -union ufs_crypto_cfg_entry cfg = {0 }; +union ufs_crypto_cfg_entry cfg = {};return ufshcd_program_key (hba, &cfg, slot); }
Greg Kroah-Hartman
maintainerPATCH 76/255 ASoC: mediatek: mt8183-da7219: fix DAPM paths for rt1015
In reply to Greg Kroah-HartmanFrom: Tzung-Bi Shih <[email protected]>
[ Upstream commit eb5a558705c7f63d06b4ddd072898b1ca894e053 ]
RT1015's output widget name is "SPO" instead of "Speaker". Fixes it to use the correct names.
--- .../mediatek/mt8183/mt8183-da7219-max98357.c | 31 +++++++++++++++---- 1 file changed, 25 insertions(+), 6 deletions(-)
sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c +25 -6
@@ -624,15 +624,34 @@ static struct snd_soc_codec_conf mt8183_da7219_rt1015_codec_conf[] = { }, }; +static const struct snd_kcontrol_new mt8183_da7219_rt1015_snd_controls[] = { +SOC_DAPM_PIN_SWITCH ("Left Spk" ), +SOC_DAPM_PIN_SWITCH ("Right Spk" ), +}; + +static const +struct snd_soc_dapm_widget mt8183_da7219_rt1015_dapm_widgets[] = { +SND_SOC_DAPM_SPK ("Left Spk" ,NULL ), +SND_SOC_DAPM_SPK ("Right Spk" ,NULL ), +SND_SOC_DAPM_PINCTRL ("TDM_OUT_PINCTRL" , +"aud_tdm_out_on" ,"aud_tdm_out_off" ), +}; + +static const struct snd_soc_dapm_route mt8183_da7219_rt1015_dapm_routes[] = { + {"Left Spk" ,NULL ,"Left SPO" }, + {"Right Spk" ,NULL ,"Right SPO" }, + {"I2S Playback" ,NULL ,"TDM_OUT_PINCTRL" }, +}; +static struct snd_soc_card mt8183_da7219_rt1015_card = { .name ="mt8183_da7219_rt1015" , .owner =THIS_MODULE , - .controls = mt8183_da7219_max98357_snd_controls, - .num_controls =ARRAY_SIZE (mt8183_da7219_max98357_snd_controls), - .dapm_widgets = mt8183_da7219_max98357_dapm_widgets, - .num_dapm_widgets =ARRAY_SIZE (mt8183_da7219_max98357_dapm_widgets), - .dapm_routes = mt8183_da7219_max98357_dapm_routes, - .num_dapm_routes =ARRAY_SIZE (mt8183_da7219_max98357_dapm_routes), + .controls = mt8183_da7219_rt1015_snd_controls, + .num_controls =ARRAY_SIZE (mt8183_da7219_rt1015_snd_controls), + .dapm_widgets = mt8183_da7219_rt1015_dapm_widgets, + .num_dapm_widgets =ARRAY_SIZE (mt8183_da7219_rt1015_dapm_widgets), + .dapm_routes = mt8183_da7219_rt1015_dapm_routes, + .num_dapm_routes =ARRAY_SIZE (mt8183_da7219_rt1015_dapm_routes), .dai_link = mt8183_da7219_dai_links, .num_links =ARRAY_SIZE (mt8183_da7219_dai_links), .aux_dev = &mt8183_da7219_max98357_headset_dev,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 77/255 ASoC: qcom: sdm845: set driver name correctly
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit 3f48b6eba15ea342ef4cb420b580f5ed6605669f ]
With the current state of code, we would endup with something like below in /proc/asound/cards for 2 machines based on this driver.
Machine 1:
0 [DB845c ]: DB845c - DB845c
DB845c
Machine 2:
0 [LenovoYOGAC6301]: Lenovo-YOGA-C63 - Lenovo-YOGA-C630-13Q50
LENOVO-81JL-LenovoYOGAC630_13Q50-LNVNB161216This is not very UCM friendly both w.r.t to common up configs and card identification, and UCM2 became totally not usefull with just one ucm sdm845.conf for two machines which have different setups w.r.t HDMI and other dais.
Reasons for such thing is partly because Qualcomm machine drivers never cared to set driver_name.
This patch sets up driver name for the this driver to sort out the UCM integration issues!
after this patch contents of /proc/asound/cards:
Machine 1:
0 [DB845c ]: sdm845 - DB845c
DB845c
Machine 2:
0 [LenovoYOGAC6301]: sdm845 - Lenovo-YOGA-C630-13Q50
LENOVO-81JL-LenovoYOGAC630_13Q50-LNVNB161216with this its possible to align with what UCM2 expects and we can have sdm845/DB845.conf sdm845/LENOVO-81JL-LenovoYOGAC630_13Q50-LNVNB161216.conf ... for board variants. This should scale much better!
--- sound/soc/qcom/sdm845.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/qcom/sdm845.c +2 -0
@@ -17,6 +17,7 @@#include "qdsp6/q6afe.h" #include "../codecs/rt5663.h" +#define DRIVER_NAME "sdm845"#define DEFAULT_SAMPLE_RATE_48K 48000#define DEFAULT_MCLK_RATE 24576000#define TDM_BCLK_RATE 6144000
@@ -552,6 +553,7 @@ static int sdm845_snd_platform_probe(struct platform_device *pdev)if (!data)return -ENOMEM ; + card->driver_name =DRIVER_NAME ; card->dapm_widgets = sdm845_snd_widgets; card->num_dapm_widgets =ARRAY_SIZE (sdm845_snd_widgets); card->dev = dev;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 78/255 ASoC: cs42l51: manage mclk shutdown delay
In reply to Greg Kroah-HartmanFrom: Olivier Moysan <[email protected]>
[ Upstream commit 20afe581c9b980848ad097c4d54dde9bec7593ef ]
A delay must be introduced before the shutdown down of the mclk, as stated in CS42L51 datasheet. Otherwise the codec may produce some noise after the end of DAPM power down sequence. The delay between DAC and CLOCK_SUPPLY widgets is too short. Add a delay in mclk shutdown request to manage the shutdown delay explicitly. From experiments, at least 10ms delay is necessary. Set delay to 20ms as recommended in Documentation/timers/timers-howto.rst when using msleep().
--- sound/soc/codecs/cs42l51.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-)
sound/soc/codecs/cs42l51.c +21 -1
@@ -245,8 +245,28 @@ static const struct snd_soc_dapm_widget cs42l51_dapm_widgets[] = { &cs42l51_adcr_mux_controls), }; +static int mclk_event (struct snd_soc_dapm_widget *w, +struct snd_kcontrol *kcontrol,int event) +{ +struct snd_soc_component *comp =snd_soc_dapm_to_component (w->dapm); +struct cs42l51_private *cs42l51 =snd_soc_component_get_drvdata (comp); + +switch (event) { +case SND_SOC_DAPM_PRE_PMU : +return clk_prepare_enable (cs42l51->mclk_handle); +case SND_SOC_DAPM_POST_PMD : +/* Delay mclk shutdown to fulfill power-down sequence requirements */ +msleep (20 ); +clk_disable_unprepare (cs42l51->mclk_handle); +break ; + } + +return 0 ; +} +static const struct snd_soc_dapm_widget cs42l51_dapm_mclk_widgets[] = { -SND_SOC_DAPM_CLOCK_SUPPLY ("MCLK" ) +SND_SOC_DAPM_SUPPLY ("MCLK" ,SND_SOC_NOPM ,0 ,0 , mclk_event, +SND_SOC_DAPM_PRE_PMU |SND_SOC_DAPM_POST_PMD ), };static const struct snd_soc_dapm_route cs42l51_routes[] = {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 79/255 ASoC: SOF: loader: handle all SOF_IPC_EXT types
In reply to Greg Kroah-HartmanFrom: Bard Liao <[email protected]>
[ Upstream commit 6e5329c6e6032cd997400b43b8299f607a61883e ]
Do not emit a warning for extended firmware header fields that are not used by kernel. This creates unnecessary noise to kernel logs like:
sof-audio-pci 0000:00:1f.3: warning: unknown ext header type 3 size 0x1c sof-audio-pci 0000:00:1f.3: warning: unknown ext header type 4 size 0x10
--- sound/soc/sof/loader.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/soc/sof/loader.c +5 -0
@@ -118,6 +118,11 @@ int snd_sof_fw_parse_ext_data(struct snd_sof_dev *sdev, u32 bar, u32 offset)case SOF_IPC_EXT_CC_INFO : ret =get_cc_info (sdev, ext_hdr);break ; +case SOF_IPC_EXT_UNUSED : +case SOF_IPC_EXT_PROBE_INFO : +case SOF_IPC_EXT_USER_ABI_INFO : +/* They are supported but we don't do anything here */ +break ;default :dev_warn (sdev->dev,"warning: unknown ext header type %d size 0x%x\n" , ext_hdr->type, ext_hdr->hdr.size);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 80/255 usb: dwc3: pci: add support for the Intel Alder Lake-S
In reply to Greg Kroah-HartmanFrom: Heikki Krogerus <[email protected]>
[ Upstream commit 1384ab4fee12c4c4f8bd37bc9f8686881587b286 ]
This patch adds the necessary PCI ID for Intel Alder Lake-S devices.
--- drivers/usb/dwc3/dwc3-pci.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/dwc3/dwc3-pci.c +4 -0
@@ -40,6 +40,7 @@#define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee#define PCI_DEVICE_ID_INTEL_TGPH 0x43ee#define PCI_DEVICE_ID_INTEL_JSP 0x4dee +#define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1#define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"#define PCI_INTEL_BXT_FUNC_PMU_PWR 4
@@ -367,6 +368,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { {PCI_VDEVICE (INTEL ,PCI_DEVICE_ID_INTEL_JSP ), (kernel_ulong_t) &dwc3_pci_intel_properties, }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), (kernel_ulong_t) &dwc3_pci_amd_properties, }, { } /* Terminating Entry */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 81/255 opp: Reduce the size of critical section in _opp_table_kref_release()
In reply to Greg Kroah-HartmanFrom: Viresh Kumar <[email protected]>
[ Upstream commit e0df59de670b48a923246fae1f972317b84b2764 ]
There is a lot of stuff here which can be done outside of the big opp_table_lock, do that. This helps avoiding few circular dependency lockdeps around debugfs and interconnects.
--- drivers/opp/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/opp/core.c +4 -3
@@ -1160,6 +1160,10 @@ static void _opp_table_kref_release(struct kref *kref)struct opp_device *opp_dev, *temp;int i; +/* Drop the lock as soon as we can */ +list_del (&opp_table->node); +mutex_unlock (&opp_table_lock); +_of_clear_opp_table (opp_table);/* Release clk */
@@ -1187,10 +1191,7 @@ static void _opp_table_kref_release(struct kref *kref)mutex_destroy (&opp_table->genpd_virt_dev_lock);mutex_destroy (&opp_table->lock); -list_del (&opp_table->node);kfree (opp_table); - -mutex_unlock (&opp_table_lock); }void dev_pm_opp_put_opp_table (struct opp_table *opp_table)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 82/255 usb: gadget: goku_udc: fix potential crashes in probe
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit 0d66e04875c5aae876cf3d4f4be7978fa2b00523 ]
goku_probe() goes to error label "err" and invokes goku_remove() in case of failures of pci_enable_device(), pci_resource_start() and ioremap(). goku_remove() gets a device from pci_get_drvdata(pdev) and works with it without any checks, in particular it dereferences a corresponding pointer. But goku_probe() did not set this device yet. So, one can expect various crashes. The patch moves setting the device just after allocation of memory for it.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/usb/gadget/udc/goku_udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/goku_udc.c +1 -1
@@ -1760,6 +1760,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto err; } +pci_set_drvdata (pdev, dev);spin_lock_init (&dev->lock); dev->pdev = pdev; dev->gadget.ops = &goku_ops;
@@ -1793,7 +1794,6 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id) } dev->regs = (struct goku_udc_regs __iomem *) base; -pci_set_drvdata (pdev, dev);INFO (dev,"%s\n" , driver_desc);INFO (dev,"version: " DRIVER_VERSION " %s\n" ,dmastr ());INFO (dev,"irq %d, pci mem %p\n" , pdev->irq, base);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 83/255 usb: raw-gadget: fix memory leak in gadget_setup
In reply to Greg Kroah-HartmanFrom: Zqiang <[email protected]>
[ Upstream commit 129aa9734559a17990ee933351c7b6956f1dba62 ]
When fetch 'event' from event queue, after copy its address space content to user space, the 'event' the memory space pointed to by the 'event' pointer need be freed.
BUG: memory leak
unreferenced object 0xffff888110622660 (size 32):
comm "softirq", pid 0, jiffies 4294941981 (age 12.480s)
hex dump (first 32 bytes):
02 00 00 00 08 00 00 00 80 06 00 01 00 00 40 00 ..............@.
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000efd29abd>] kmalloc include/linux/slab.h:554 [inline]
[<00000000efd29abd>] raw_event_queue_add drivers/usb/gadget/legacy/raw_gadget.c:66 [inline]
[<00000000efd29abd>] raw_queue_event drivers/usb/gadget/legacy/raw_gadget.c:225 [inline]
[<00000000efd29abd>] gadget_setup+0xf6/0x220 drivers/usb/gadget/legacy/raw_gadget.c:343
[<00000000952c4a46>] dummy_timer+0xb9f/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1899
[<0000000074ac2c54>] call_timer_fn+0x38/0x200 kernel/time/timer.c:1415
[<00000000560a3a79>] expire_timers kernel/time/timer.c:1460 [inline]
[<00000000560a3a79>] __run_timers.part.0+0x319/0x400 kernel/time/timer.c:1757
[<000000009d9503d0>] __run_timers kernel/time/timer.c:1738 [inline]
[<000000009d9503d0>] run_timer_softirq+0x3d/0x80 kernel/time/timer.c:1770
[<000000009df27c89>] __do_softirq+0xcc/0x2c2 kernel/softirq.c:298
[<000000007a3f1a47>] asm_call_irq_on_stack+0xf/0x20
[<000000004a62cc2e>] __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
[<000000004a62cc2e>] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
[<000000004a62cc2e>] do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77
[<00000000b0086800>] invoke_softirq kernel/softirq.c:393 [inline]
[<00000000b0086800>] __irq_exit_rcu kernel/softirq.c:423 [inline]
[<00000000b0086800>] irq_exit_rcu+0x91/0xc0 kernel/softirq.c:435
[<00000000175f9523>] sysvec_apic_timer_interrupt+0x36/0x80 arch/x86/kernel/apic/apic.c:1091
[<00000000a348e847>] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631
[<0000000060661100>] native_safe_halt arch/x86/include/asm/irqflags.h:60 [inline]
[<0000000060661100>] arch_safe_halt arch/x86/include/asm/irqflags.h:103 [inline]
[<0000000060661100>] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]
[<0000000060661100>] acpi_idle_do_entry+0xc3/0xd0 drivers/acpi/processor_idle.c:517
[<000000003f413b99>] acpi_idle_enter+0x128/0x1f0 drivers/acpi/processor_idle.c:648
[<00000000f5e5afb8>] cpuidle_enter_state+0xc9/0x650 drivers/cpuidle/cpuidle.c:237
[<00000000d50d51fc>] cpuidle_enter+0x29/0x40 drivers/cpuidle/cpuidle.c:351
[<00000000d674baed>] call_cpuidle kernel/sched/idle.c:132 [inline]
[<00000000d674baed>] cpuidle_idle_call kernel/sched/idle.c:213 [inline]
[<00000000d674baed>] do_idle+0x1c8/0x250 kernel/sched/idle.c:273--- drivers/usb/gadget/legacy/raw_gadget.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/gadget/legacy/raw_gadget.c +4 -1
@@ -564,9 +564,12 @@ static int raw_ioctl_event_fetch(struct raw_dev *dev, unsigned long value)return -ENODEV ; } length =min (arg.length, event->length); -if (copy_to_user ((void __user *)value, event,sizeof (*event) + length)) +if (copy_to_user ((void __user *)value, event,sizeof (*event) + length)) { +kfree (event);return -EFAULT ; + } +kfree (event);return 0 ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 84/255 selftests/ftrace: check for do_sys_openat2 in user-memory test
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit e3e40312567087fbe6880f316cb2b0e1f3d8a82c ]
More recent libc implementations are now using openat/openat2 system calls so also add do_sys_openat2 to the tracing so that the test passes on these systems because do_sys_open may not be called.
Thanks to Masami Hiramatsu for the help on getting this fix to work correctly.
--- .../selftests/ftrace/test.d/kprobe/kprobe_args_user.tc | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_user.tc +4 -0
@@ -9,12 +9,16 @@ grep -A10 "fetcharg:" README | grep -q '\[u\]<offset>' || exit_unsupported :;: "user-memory access syntax and ustring working on user memory";: echo 'p:myevent do_sys_open path=+0($arg2):ustring path2=+u0($arg2):string' \ > kprobe_events +echo 'p:myevent2 do_sys_openat2 path=+0($arg2):ustring path2=+u0($arg2):string' \ + >> kprobe_events grep myevent kprobe_events | \ grep -q 'path=+0($arg2):ustring path2=+u0($arg2):string' echo 1 > events/kprobes/myevent/enable +echo 1 > events/kprobes/myevent2/enable echo > /dev/null echo 0 > events/kprobes/myevent/enable +echo 0 > events/kprobes/myevent2/enable grep myevent trace | grep -q 'path="/dev/null" path2="/dev/null"'
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 85/255 selftests: pidfd: fix compilation errors due to wait.h
In reply to Greg Kroah-HartmanFrom: Tommi Rantala <[email protected]>
[ Upstream commit 1948172fdba5ad643529ddcd00a601c0caa913ed ]
Drop unneeded <linux/wait.h> header inclusion to fix pidfd compilation errors seen in Fedora 32:
In file included from pidfd_open_test.c:9:../../../../usr/include/linux/wait.h:17:16: error: expected identifier before numeric constant
17 | #define P_ALL 0
| ^--- tools/testing/selftests/pidfd/pidfd_open_test.c | 1 - tools/testing/selftests/pidfd/pidfd_poll_test.c | 1 - 2 files changed, 2 deletions(-)
tools/testing/selftests/pidfd/pidfd_open_test.c +0 -1
@@ -6,7 +6,6 @@#include <inttypes.h> #include <limits.h> #include <linux/types.h> -#include <linux/wait.h> #include <sched.h> #include <signal.h> #include <stdbool.h>
tools/testing/selftests/pidfd/pidfd_poll_test.c +0 -1
@@ -3,7 +3,6 @@#define _GNU_SOURCE#include <errno.h> #include <linux/types.h> -#include <linux/wait.h> #include <poll.h> #include <signal.h> #include <stdbool.h>
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 86/255 ALSA: hda: Separate runtime and system suspend
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit f5dac54d9d93826a776dffc848df76746f7135bb ]
Both pm_runtime_force_suspend() and pm_runtime_force_resume() have some implicit checks, so it can make code flow more straightforward if we separate runtime and system suspend callbacks.
High Definition Audio Specification, 4.5.9.3 Codec Wake From System S3 states that codec can wake the system up from S3 if WAKEEN is toggled. Since HDA controller has different wakeup settings for runtime and system susend, we also need to explicitly disable direct-complete which can be enabled automatically by PCI core. In addition to that, avoid waking up codec if runtime resume is for system suspend, to not break direct-complete for codecs.
While at it, also remove AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP, as the original bug commit a6630529aecb ("ALSA: hda: Workaround for spurious wakeups on some Intel platforms") solves doesn't happen with this patch.
--- sound/pci/hda/hda_controller.h | 3 +- sound/pci/hda/hda_intel.c | 62 +++++++++++++++++++--------------- 2 files changed, 36 insertions(+), 29 deletions(-)
sound/pci/hda/hda_controller.h +2 -1
@@ -41,7 +41,7 @@/* 24 unused */ #define AZX_DCAPS_COUNT_LPIB_DELAY (1 << 25)/* Take LPIB as delay */ #define AZX_DCAPS_PM_RUNTIME (1 << 26)/* runtime PM support */ -#define AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP (1 << 27)/* Workaround for spurious wakeups after suspend */ +/* 27 unused */ #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28)/* CORBRP clears itself after reset */ #define AZX_DCAPS_NO_MSI64 (1 << 29)/* Stick to 32-bit MSIs */ #define AZX_DCAPS_SEPARATE_STREAM_TAG (1 << 30)/* capture and playback use separate stream tag */
@@ -143,6 +143,7 @@ struct azx { unsigned int align_buffer_size:1; unsigned int region_requested:1; unsigned int disabled:1; /* disabled by vga_switcheroo */ + unsigned int pm_prepared:1;/* GTS present */ unsigned int gts_present:1;
sound/pci/hda/hda_intel.c +34 -28
122 lines not on this page · raw message
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 87/255 ALSA: hda: Reinstate runtime_allow() for all hda controllers
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit 9fc149c3bce7bdbb94948a8e6bd025e3b3538603 ]
The broken jack detection should be fixed by commit a6e7d0a4bdb0 ("ALSA:
hda: fix jack detection with Realtek codecs when in D3"), let's try enabling runtime PM by default again.
--- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/hda_intel.c +1 -0
@@ -2361,6 +2361,7 @@ static int azx_probe_continue(struct azx *chip)if (azx_has_pm_runtime (chip)) {pm_runtime_use_autosuspend (&pci->dev); +pm_runtime_allow (&pci->dev);pm_runtime_put_autosuspend (&pci->dev); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 88/255 x86/boot/compressed/64: Introduce sev_status
In reply to Greg Kroah-HartmanFrom: Joerg Roedel <[email protected]>
[ Upstream commit 3ad84246a4097010f3ae3d6944120c0be00e9e7a ]
Introduce sev_status and initialize it together with sme_me_mask to have an indicator which SEV features are enabled.
--- arch/x86/boot/compressed/mem_encrypt.S | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
arch/x86/boot/compressed/mem_encrypt.S +15 -1
@@ -81,6 +81,19 @@ SYM_FUNC_START(set_sev_encryption_mask) bts %rax, sme_me_mask(%rip) /* Create the encryption mask */ + /* + * Read MSR_AMD64_SEV again and store it to sev_status. Can't do this in + * get_sev_encryption_bit() because this function is 32-bit code and + * shared between 64-bit and 32-bit boot path. + */ + movl $MSR_AMD64_SEV, %ecx /* Read the SEV MSR */ + rdmsr + + /* Store MSR value in sev_status */ + shlq $32, %rdx + orq %rdx, %rax + movq %rax, sev_status(%rip) + .Lno_sev_mask: movq %rbp, %rsp /* Restore original stack pointer */
@@ -96,5 +109,6 @@ SYM_FUNC_END(set_sev_encryption_mask) #ifdef CONFIG_AMD_MEM_ENCRYPT .balign 8 -SYM_DATA(sme_me_mask, .quad 0) +SYM_DATA(sme_me_mask, .quad 0) +SYM_DATA(sev_status, .quad 0) #endif
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 89/255 gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]
Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling return_all_reservations, but return_all_reservations still dereferences rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the call to return_all_reservations.
--- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/gfs2/rgrp.c +1 -1
@@ -719,9 +719,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) }gfs2_free_clones (rgd); +return_all_reservations (rgd);kfree (rgd->rd_bits); rgd->rd_bits =NULL ; -return_all_reservations (rgd);kmem_cache_free (gfs2_rgrpd_cachep, rgd); } }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 90/255 gfs2: Add missing truncate_inode_pages_final for sd_aspace
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit a9dd945ccef07a904e412f208f8de708a3d7159e ]
Gfs2 creates an address space for its rgrps called sd_aspace, but it never called truncate_inode_pages_final on it. This confused vfs greatly which tried to reference the address space after gfs2 had freed the superblock that contained it.
This patch adds a call to truncate_inode_pages_final for sd_aspace, thus avoiding the use-after-free.
--- fs/gfs2/super.c | 1 + 1 file changed, 1 insertion(+)
fs/gfs2/super.c +1 -0
@@ -732,6 +732,7 @@ restart:gfs2_jindex_free (sdp);/* Take apart glock structures and buffer lists */ gfs2_gl_hash_clear (sdp); +truncate_inode_pages_final (&sdp->sd_aspace);gfs2_delete_debugfs_file (sdp);/* Unmount the locking protocol */ gfs2_lm_unmount (sdp);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 91/255 gfs2: check for live vs. read-only file system in gfs2_fitrim
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit c5c68724696e7d2f8db58a5fce3673208d35c485 ]
Before this patch, gfs2_fitrim was not properly checking for a "live" file system. If the file system had something to trim and the file system was read-only (or spectator) it would start the trim, but when it starts the transaction, gfs2_trans_begin returns -EROFS (read-only file system) and it errors out. However, if the file system was already trimmed so there's no work to do, it never called gfs2_trans_begin. That code is bypassed so it never returns the error. Instead, it returns a good return code with 0 work. All this makes for inconsistent behavior:
The same fstrim command can return -EROFS in one case and 0 in another. This tripped up xfstests generic/537 which reports the error as:
+fstrim with unrecovered metadata just ate your filesystem
This patch adds a check for a "live" (iow, active journal, iow, RW) file system, and if not, returns the error properly.
--- fs/gfs2/rgrp.c | 3 +++ 1 file changed, 3 insertions(+)
fs/gfs2/rgrp.c +3 -0
@@ -1374,6 +1374,9 @@ int gfs2_fitrim(struct file *filp, void __user *argp)if (!capable (CAP_SYS_ADMIN ))return -EPERM ; +if (!test_bit (SDF_JOURNAL_LIVE , &sdp->sd_flags)) +return -EROFS ; +if (!blk_queue_discard (q))return -EOPNOTSUPP ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 92/255 scsi: hpsa: Fix memory leak in hpsa_init_one()
In reply to Greg Kroah-HartmanFrom: Keita Suzuki <[email protected]>
[ Upstream commit af61bc1e33d2c0ec22612b46050f5b58ac56a962 ]
When hpsa_scsi_add_host() fails, h->lastlogicals is leaked since it is missing a free() in the error handler.
Fix this by adding free() when hpsa_scsi_add_host() fails.
--- drivers/scsi/hpsa.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/hpsa.c +3 -1
@@ -8854,7 +8854,7 @@ reinit_after_soft_reset:/* hook into SCSI subsystem */ rc =hpsa_scsi_add_host (h);if (rc) - goto clean7;/* perf, sg, cmd, irq, shost, pci, lu, aer/h */ + goto clean8;/* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */ /* Monitor the controller for firmware lockups */ h->heartbeat_sample_interval =HEARTBEAT_SAMPLE_INTERVAL ;
@@ -8869,6 +8869,8 @@ reinit_after_soft_reset: HPSA_EVENT_MONITOR_INTERVAL);return 0 ; +clean8:/* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */ +kfree (h->lastlogicals); clean7:/* perf, sg, cmd, irq, shost, pci, lu, aer/h */ hpsa_free_performant_mode (h); h->access.set_intr_mask (h,HPSA_INTR_OFF );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 93/255 drm/amdgpu: perform srbm soft reset always on SDMA resume
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
[ Upstream commit 253475c455eb5f8da34faa1af92709e7bb414624 ]
This can address the random SDMA hang after pci config reset seen on Hawaii.
--- drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-)
drivers/gpu/drm/amd/amdgpu/cik_sdma.c +12 -15
@@ -1071,22 +1071,19 @@ static int cik_sdma_soft_reset(void *handle) {u32 srbm_soft_reset =0 ;struct amdgpu_device *adev = (struct amdgpu_device *)handle; -u32 tmp =RREG32 (mmSRBM_STATUS2); +u32 tmp; -if (tmp &SRBM_STATUS2__SDMA_BUSY_MASK ) { -/* sdma0 */ - tmp =RREG32 (mmSDMA0_F32_CNTL +SDMA0_REGISTER_OFFSET ); - tmp |=SDMA0_F32_CNTL__HALT_MASK ; -WREG32 (mmSDMA0_F32_CNTL +SDMA0_REGISTER_OFFSET , tmp); - srbm_soft_reset |=SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK ; - } -if (tmp &SRBM_STATUS2__SDMA1_BUSY_MASK ) { -/* sdma1 */ - tmp =RREG32 (mmSDMA0_F32_CNTL +SDMA1_REGISTER_OFFSET ); - tmp |=SDMA0_F32_CNTL__HALT_MASK ; -WREG32 (mmSDMA0_F32_CNTL +SDMA1_REGISTER_OFFSET , tmp); - srbm_soft_reset |=SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK ; - } +/* sdma0 */ + tmp =RREG32 (mmSDMA0_F32_CNTL +SDMA0_REGISTER_OFFSET ); + tmp |=SDMA0_F32_CNTL__HALT_MASK ; +WREG32 (mmSDMA0_F32_CNTL +SDMA0_REGISTER_OFFSET , tmp); + srbm_soft_reset |=SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK ; + +/* sdma1 */ + tmp =RREG32 (mmSDMA0_F32_CNTL +SDMA1_REGISTER_OFFSET ); + tmp |=SDMA0_F32_CNTL__HALT_MASK ; +WREG32 (mmSDMA0_F32_CNTL +SDMA1_REGISTER_OFFSET , tmp); + srbm_soft_reset |=SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK ;if (srbm_soft_reset) { tmp =RREG32 (mmSRBM_SOFT_RESET);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 94/255 drm/amd/pm: correct the baco reset sequence for CI ASICs
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
[ Upstream commit c108725ef589af462be6b957f63c7925e38213eb ]
Correct some registers bitmasks and add mmBIOS_SCRATCH_7 reset.
--- drivers/gpu/drm/amd/powerplay/hwmgr/ci_baco.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/powerplay/hwmgr/ci_baco.c +4 -3
@@ -142,12 +142,12 @@ static const struct baco_cmd_entry exit_baco_tbl[] = { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_BCLK_OFF_MASK, BACO_CNTL__BACO_BCLK_OFF__SHIFT, 0, 0x00 }, { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_POWER_OFF_MASK, BACO_CNTL__BACO_POWER_OFF__SHIFT, 0, 0x00 }, { CMD_DELAY_MS, 0, 0, 0, 20, 0 }, - { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__PWRGOOD_BF_MASK, 0, 0xffffffff, 0x20 }, + { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__PWRGOOD_BF_MASK, 0, 0xffffffff, 0x200 }, { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_ISO_DIS_MASK, BACO_CNTL__BACO_ISO_DIS__SHIFT, 0, 0x01 }, - { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__PWRGOOD_MASK, 0, 5, 0x1c }, + { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__PWRGOOD_MASK, 0, 5, 0x1c00 }, { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_ANA_ISO_DIS_MASK, BACO_CNTL__BACO_ANA_ISO_DIS__SHIFT, 0, 0x01 }, { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_RESET_EN_MASK, BACO_CNTL__BACO_RESET_EN__SHIFT, 0, 0x00 }, - { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__RCU_BIF_CONFIG_DONE_MASK, 0, 5, 0x10 }, + { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__RCU_BIF_CONFIG_DONE_MASK, 0, 5, 0x100 }, { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_EN_MASK, BACO_CNTL__BACO_EN__SHIFT, 0, 0x00 }, { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__BACO_MODE_MASK, 0, 0xffffffff, 0x00 } };
@@ -155,6 +155,7 @@ static const struct baco_cmd_entry exit_baco_tbl[] =static const struct baco_cmd_entry clean_baco_tbl[] = { {CMD_WRITE , mmBIOS_SCRATCH_6,0 ,0 ,0 ,0 }, + {CMD_WRITE , mmBIOS_SCRATCH_7,0 ,0 ,0 ,0 }, {CMD_WRITE , mmCP_PFP_UCODE_ADDR,0 ,0 ,0 ,0 } };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 95/255 drm/amd/pm: perform SMC reset on suspend/hibernation
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
[ Upstream commit 277b080f98803cb73a83fb234f0be83a10e63958 ]
So that the succeeding resume can be performed based on a clean state.
--- .../gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 4 ++++ drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 1 + drivers/gpu/drm/amd/powerplay/inc/smumgr.h | 2 ++ .../gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 24 +++++++++++++++++++ drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c | 8 +++++++ 5 files changed, 39 insertions(+)
drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +4 -0
@@ -1541,6 +1541,10 @@ static int smu7_disable_dpm_tasks(struct pp_hwmgr *hwmgr)PP_ASSERT_WITH_CODE ((tmp_result ==0 ),"Failed to reset to default!" , result = tmp_result); + tmp_result =smum_stop_smc (hwmgr); +PP_ASSERT_WITH_CODE ((tmp_result ==0 ), +"Failed to stop smc!" , result = tmp_result); + tmp_result =smu7_force_switch_to_arbf0 (hwmgr);PP_ASSERT_WITH_CODE ((tmp_result ==0 ),"Failed to force to switch arbf0!" , result = tmp_result);
drivers/gpu/drm/amd/powerplay/inc/hwmgr.h +1 -0
@@ -229,6 +229,7 @@ struct pp_smumgr_func {bool (*is_hw_avfs_present)(struct pp_hwmgr *hwmgr);int (*update_dpm_settings)(struct pp_hwmgr *hwmgr,void *profile_setting);int (*smc_table_manager)(struct pp_hwmgr *hwmgr,uint8_t *table,uint16_t table_id,bool rw);/*rw: true for read, false for write */ +int (*stop_smc)(struct pp_hwmgr *hwmgr); };struct pp_hwmgr_func {
drivers/gpu/drm/amd/powerplay/inc/smumgr.h +2 -0
@@ -113,4 +113,6 @@ extern int smum_update_dpm_settings(struct pp_hwmgr *hwmgr, void *profile_settinextern int smum_smc_table_manager (struct pp_hwmgr *hwmgr,uint8_t *table,uint16_t table_id,bool rw); +extern int smum_stop_smc (struct pp_hwmgr *hwmgr); +#endif
drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +24 -0
@@ -2939,6 +2939,29 @@ static int ci_update_smc_table(struct pp_hwmgr *hwmgr, uint32_t type)return 0 ; } +static void ci_reset_smc (struct pp_hwmgr *hwmgr) +{ +PHM_WRITE_INDIRECT_FIELD (hwmgr->device,CGS_IND_REG__SMC , +SMC_SYSCON_RESET_CNTL , + rst_reg,1 ); +} + + +static void ci_stop_smc_clock (struct pp_hwmgr *hwmgr) +{ +PHM_WRITE_INDIRECT_FIELD (hwmgr->device,CGS_IND_REG__SMC , +SMC_SYSCON_CLOCK_CNTL_0 , + ck_disable,1 ); +} + +static int ci_stop_smc (struct pp_hwmgr *hwmgr) +{ +ci_reset_smc (hwmgr); +ci_stop_smc_clock (hwmgr); + +return 0 ; +} +const struct pp_smumgr_func ci_smu_funcs = { .name ="ci_smu" , .smu_init = ci_smu_init,
@@ -2964,4 +2987,5 @@ const struct pp_smumgr_func ci_smu_funcs = { .is_dpm_running = ci_is_dpm_running, .update_dpm_settings = ci_update_dpm_settings, .update_smc_table = ci_update_smc_table, + .stop_smc = ci_stop_smc, };
drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c +8 -0
@@ -245,3 +245,11 @@ int smum_smc_table_manager(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t tablreturn -EINVAL ; } + +int smum_stop_smc (struct pp_hwmgr *hwmgr) +{ +if (hwmgr->smumgr_funcs->stop_smc) +return hwmgr->smumgr_funcs->stop_smc (hwmgr); + +return 0 ; +}
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 96/255 drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
[ Upstream commit 786436b453001dafe81025389f96bf9dac1e9690 ]
This reverts commit f87812284172a9809820d10143b573d833cd3f75 ("drm/amdgpu:
Fix bug where DPM is not enabled after hibernate and resume"). It was intended to fix Hawaii S4(hibernation) issue but break S3. As ixFEATURE_STATUS is filled with garbage data on resume which can be only cleared by reloading smc firmware(but that will involve many changes). So, we will revert this S4 fix and seek a new way.
--- drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +1 -4
@@ -2726,10 +2726,7 @@ static int ci_initialize_mc_reg_table(struct pp_hwmgr *hwmgr)static bool ci_is_dpm_running (struct pp_hwmgr *hwmgr) { -return (1 ==PHM_READ_INDIRECT_FIELD (hwmgr->device, -CGS_IND_REG__SMC ,FEATURE_STATUS , -VOLTAGE_CONTROLLER_ON )) - ? true : false; +return ci_is_smc_ram_running (hwmgr); }static int ci_smu_init (struct pp_hwmgr *hwmgr)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 97/255 mac80211: fix use of skb payload instead of header
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 14f46c1e5108696ec1e5a129e838ecedf108c7bf ]
When ieee80211_skb_resize() is called from ieee80211_build_hdr() the skb has no 802.11 header yet, in fact it consist only of the payload as the ethernet frame is removed. As such, we're using the payload data for ieee80211_is_mgmt(), which is of course completely wrong. This didn't really hurt us because these are always data frames, so we could only have added more tailroom than we needed if we determined it was a management frame and sdata->crypto_tx_tailroom_needed_cnt was false.
However, syzbot found that of course there need not be any payload, so we're using at best uninitialized memory for the check.
Fix this to pass explicitly the kind of frame that we have instead of checking there, by replacing the "bool may_encrypt" argument with an argument that can carry the three possible states - it's not going to be encrypted, it's a management frame, or it's a data frame (and then we check sdata->crypto_tx_tailroom_needed_cnt).
--- net/mac80211/tx.c | 37 ++++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-)
net/mac80211/tx.c +24 -13
@@ -1938,19 +1938,24 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,/* device xmit handlers */ +enum ieee80211_encrypt { +ENCRYPT_NO , +ENCRYPT_MGMT , +ENCRYPT_DATA , +}; +static int ieee80211_skb_resize (struct ieee80211_sub_if_data *sdata,struct sk_buff *skb, -int head_need,bool may_encrypt) +int head_need, +enum ieee80211_encrypt encrypt) {struct ieee80211_local *local = sdata->local; -struct ieee80211_hdr *hdr;bool enc_tailroom;int tail_need =0 ; - hdr = (struct ieee80211_hdr *) skb->data; - enc_tailroom = may_encrypt && - (sdata->crypto_tx_tailroom_needed_cnt || -ieee80211_is_mgmt (hdr->frame_control)); + enc_tailroom = encrypt ==ENCRYPT_MGMT || + (encrypt ==ENCRYPT_DATA && + sdata->crypto_tx_tailroom_needed_cnt);if (enc_tailroom) { tail_need =IEEE80211_ENCRYPT_TAILROOM ;
@@ -1981,23 +1986,29 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, {struct ieee80211_local *local = sdata->local;struct ieee80211_tx_info *info =IEEE80211_SKB_CB (skb); -struct ieee80211_hdr *hdr; +struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;int headroom; -bool may_encrypt; +enum ieee80211_encrypt encrypt; - may_encrypt = !(info->flags &IEEE80211_TX_INTFL_DONT_ENCRYPT ); +if (info->flags &IEEE80211_TX_INTFL_DONT_ENCRYPT ) + encrypt =ENCRYPT_NO ; +else if (ieee80211_is_mgmt (hdr->frame_control)) + encrypt =ENCRYPT_MGMT ; +else + encrypt =ENCRYPT_DATA ; headroom = local->tx_headroom; -if (may_encrypt) +if (encrypt !=ENCRYPT_NO ) headroom += sdata->encrypt_headroom; headroom -=skb_headroom (skb); headroom =max_t (int,0 , headroom); -if (ieee80211_skb_resize (sdata, skb, headroom, may_encrypt)) { +if (ieee80211_skb_resize (sdata, skb, headroom, encrypt)) {ieee80211_free_txskb (&local->hw, skb);return ; } +/* reload after potential resize */ hdr = (struct ieee80211_hdr *) skb->data; info->control.vif = &sdata->vif;
@@ -2822,7 +2833,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata, head_need += sdata->encrypt_headroom; head_need += local->tx_headroom; head_need =max_t (int,0 , head_need); -if (ieee80211_skb_resize (sdata, skb, head_need, true)) { +if (ieee80211_skb_resize (sdata, skb, head_need,ENCRYPT_DATA )) {ieee80211_free_txskb (&local->hw, skb); skb =NULL ;return ERR_PTR (-ENOMEM );
@@ -3496,7 +3507,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,if (unlikely (ieee80211_skb_resize (sdata, skb,max_t (int, extra_head + hw_headroom -skb_headroom (skb),0 ), - false))) { +ENCRYPT_NO ))) {kfree_skb (skb);return true; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 98/255 cfg80211: initialize wdev data earlier
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 9bdaf3b91efd229dd272b228e13df10310c80d19 ]
There's a race condition in the netdev registration in that NETDEV_REGISTER actually happens after the netdev is available, and so if we initialize things only there, we might get called with an uninitialized wdev through nl80211 - not using a wdev but using a netdev interface index.
I found this while looking into a syzbot report, but it doesn't really seem to be related, and unfortunately there's no repro for it (yet). I can't (yet) explain how it managed to get into cfg80211_release_pmsr() from nl80211_netlink_notify() without the wdev having been initialized, as the latter only iterates the wdevs that are linked into the rdev, which even without the change here happened after init.
However, looking at this, it seems fairly clear that the init needs to be done earlier, otherwise we might even re-init on a netns move, when data might still be pending.
--- net/wireless/core.c | 57 +++++++++++++++++++++++------------------- net/wireless/core.h | 5 ++-- net/wireless/nl80211.c | 3 ++- 3 files changed, 36 insertions(+), 29 deletions(-)
net/wireless/core.c +31 -26
@@ -1248,8 +1248,7 @@ void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev, }EXPORT_SYMBOL (cfg80211_stop_iface); -void cfg80211_init_wdev (struct cfg80211_registered_device *rdev, -struct wireless_dev *wdev) +void cfg80211_init_wdev (struct wireless_dev *wdev) {mutex_init (&wdev->mtx);INIT_LIST_HEAD (&wdev->event_list);
@@ -1260,6 +1259,30 @@ void cfg80211_init_wdev(struct cfg80211_registered_device *rdev,spin_lock_init (&wdev->pmsr_lock);INIT_WORK (&wdev->pmsr_free_wk, cfg80211_pmsr_free_wk); +#ifdef CONFIG_CFG80211_WEXT + wdev->wext.default_key =-1 ; + wdev->wext.default_mgmt_key =-1 ; + wdev->wext.connect.auth_type =NL80211_AUTHTYPE_AUTOMATIC ; +#endif + +if (wdev->wiphy->flags &WIPHY_FLAG_PS_ON_BY_DEFAULT ) + wdev->ps = true; +else + wdev->ps = false; +/* allow mac80211 to determine the timeout */ + wdev->ps_timeout =-1 ; + +if ((wdev->iftype ==NL80211_IFTYPE_STATION || + wdev->iftype ==NL80211_IFTYPE_P2P_CLIENT || + wdev->iftype ==NL80211_IFTYPE_ADHOC ) && !wdev->use_4addr) + wdev->netdev->priv_flags |=IFF_DONT_BRIDGE ; + +INIT_WORK (&wdev->disconnect_wk, cfg80211_autodisconnect_wk); +} + +void cfg80211_register_wdev (struct cfg80211_registered_device *rdev, +struct wireless_dev *wdev) +{/* * We get here also when the interface changes network namespaces, * as it's registered into the new one, but we don't want it to
@@ -1293,6 +1316,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,switch (state) {case NETDEV_POST_INIT :SET_NETDEV_DEVTYPE (dev, &wiphy_type); + wdev->netdev = dev; +/* can only change netns with wiphy */ + dev->features |=NETIF_F_NETNS_LOCAL ; + +cfg80211_init_wdev (wdev);break ;case NETDEV_REGISTER :/*
@@ -1300,35 +1328,12 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,* called within code protected by it when interfaces * are added with nl80211. */ -/* can only change netns with wiphy */ - dev->features |=NETIF_F_NETNS_LOCAL ; -if (sysfs_create_link (&dev->dev.kobj, &rdev->wiphy.dev.kobj,"phy80211" )) {pr_err ("failed to add phy80211 symlink to netdev!\n" ); } - wdev->netdev = dev; -#ifdef CONFIG_CFG80211_WEXT - wdev->wext.default_key =-1 ; - wdev->wext.default_mgmt_key =-1 ; - wdev->wext.connect.auth_type =NL80211_AUTHTYPE_AUTOMATIC ; -#endif - -if (wdev->wiphy->flags &WIPHY_FLAG_PS_ON_BY_DEFAULT ) - wdev->ps = true; -else - wdev->ps = false; -/* allow mac80211 to determine the timeout */ - wdev->ps_timeout =-1 ; - -if ((wdev->iftype ==NL80211_IFTYPE_STATION || - wdev->iftype ==NL80211_IFTYPE_P2P_CLIENT || - wdev->iftype ==NL80211_IFTYPE_ADHOC ) && !wdev->use_4addr) - dev->priv_flags |=IFF_DONT_BRIDGE ; - -INIT_WORK (&wdev->disconnect_wk, cfg80211_autodisconnect_wk); -cfg80211_init_wdev (rdev, wdev); +cfg80211_register_wdev (rdev, wdev);break ;case NETDEV_GOING_DOWN :cfg80211_leave (rdev, wdev);
net/wireless/core.h +3 -2
@@ -208,8 +208,9 @@ struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx);int cfg80211_switch_netns (struct cfg80211_registered_device *rdev,struct net *net); -void cfg80211_init_wdev (struct cfg80211_registered_device *rdev, -struct wireless_dev *wdev); +void cfg80211_init_wdev (struct wireless_dev *wdev); +void cfg80211_register_wdev (struct cfg80211_registered_device *rdev, +struct wireless_dev *wdev); static inline void wdev_lock(struct wireless_dev *wdev) __acquires(wdev)
net/wireless/nl80211.c +2 -1
@@ -3801,7 +3801,8 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)* P2P Device and NAN do not have a netdev, so don't go * through the netdev notifier and must be added here */ -cfg80211_init_wdev (rdev, wdev); +cfg80211_init_wdev (wdev); +cfg80211_register_wdev (rdev, wdev);break ;default :break ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 99/255 mac80211: always wind down STA state
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit dcd479e10a0510522a5d88b29b8f79ea3467d501 ]
When (for example) an IBSS station is pre-moved to AUTHORIZED before it's inserted, and then the insertion fails, we don't clean up the fast RX/TX states that might already have been created, since we don't go through all the state transitions again on the way down.
Do that, if it hasn't been done already, when the station is freed. I considered only freeing the fast TX/RX state there, but we might add more state so it's more robust to wind down the state properly.
Note that we warn if the station was ever inserted, it should have been properly cleaned up in that case, and the driver will probably not like things happening out of order.
--- net/mac80211/sta_info.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
net/mac80211/sta_info.c +18 -0
@@ -258,6 +258,24 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,*/ void sta_info_free (struct ieee80211_local *local,struct sta_info *sta) { +/* +* If we had used sta_info_pre_move_state() then we might not +* have gone through the state transitions down again, so do +* it here now (and warn if it's inserted). +* +* This will clear state such as fast TX/RX that may have been +* allocated during state transitions. +*/ +while (sta->sta_state >IEEE80211_STA_NONE ) { +int ret; + +WARN_ON_ONCE (test_sta_flag (sta,WLAN_STA_INSERTED )); + + ret =sta_info_move_state (sta, sta->sta_state -1 ); +if (WARN_ONCE (ret,"sta_info_move_state() returned %d\n" , ret)) +break ; + } +if (sta->rate_ctrl)rate_control_free_sta (sta);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 100/255 cfg80211: regulatory: Fix inconsistent format argument
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
[ Upstream commit db18d20d1cb0fde16d518fb5ccd38679f174bc04 ]
Fix follow warning:
[net/wireless/reg.c:3619]: (warning) %d in format string (no. 2) requires 'int' but the argument type is 'unsigned int'.
--- net/wireless/reg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/reg.c +1 -1
@@ -3411,7 +3411,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd) power_rule = ®_rule->power_rule;if (reg_rule->flags &NL80211_RRF_AUTO_BW ) -snprintf (bw,sizeof (bw),"%d KHz, %d KHz AUTO" , +snprintf (bw,sizeof (bw),"%d KHz, %u KHz AUTO" , freq_range->max_bandwidth_khz,reg_get_max_bandwidth (rd, reg_rule));else
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 101/255 wireguard: selftests: check that route_me_harder packets use the right sk
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
[ Upstream commit af8afcf1fdd5f365f70e2386c2d8c7a1abd853d7 ]
If netfilter changes the packet mark, the packet is rerouted. The ip_route_me_harder family of functions fails to use the right sk, opting to instead use skb->sk, resulting in a routing loop when used with tunnels. With the next change fixing this issue in netfilter, test for the relevant condition inside our test suite, since wireguard was where the bug was discovered.
--- tools/testing/selftests/wireguard/netns.sh | 8 ++++++++ tools/testing/selftests/wireguard/qemu/kernel.config | 2 ++ 2 files changed, 10 insertions(+)
tools/testing/selftests/wireguard/netns.sh +8 -0
@@ -316,6 +316,14 @@ pp sleep 3 n2 ping -W 1 -c 1 192.168.241.1 n1 wg set wg0 peer "$pub2" persistent-keepalive 0 +# Test that sk_bound_dev_if works +n1 ping -I wg0 -c 1 -W 1 192.168.241.2 +# What about when the mark changes and the packet must be rerouted? +n1 iptables -t mangle -I OUTPUT -j MARK --set-xmark 1 +n1 ping -c 1 -W 1 192.168.241.2 # First the boring case +n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # Then the sk_bound_dev_if case +n1 iptables -t mangle -D OUTPUT -j MARK --set-xmark 1 + # Test that onion routing works, even when it loops n1 wg set wg0 peer "$pub3" allowed-ips 192.168.242.2/32 endpoint 192.168.241.2:5 ip1 addr add 192.168.242.1/24 dev wg0
tools/testing/selftests/wireguard/qemu/kernel.config +2 -0
@@ -18,10 +18,12 @@ CONFIG_NF_NAT=y CONFIG_NETFILTER_XTABLES=y CONFIG_NETFILTER_XT_NAT=y CONFIG_NETFILTER_XT_MATCH_LENGTH=y +CONFIG_NETFILTER_XT_MARK=y CONFIG_NF_CONNTRACK_IPV4=y CONFIG_NF_NAT_IPV4=y CONFIG_IP_NF_IPTABLES=y CONFIG_IP_NF_FILTER=y +CONFIG_IP_NF_MANGLE=y CONFIG_IP_NF_NAT=y CONFIG_IP_ADVANCED_ROUTER=y CONFIG_IP_MULTIPLE_TABLES=y
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 102/255 tracing: Fix the checking of stackidx in __ftrace_trace_stack
In reply to Greg Kroah-HartmanFrom: Qiujun Huang <[email protected]>
[ Upstream commit 906695e59324635c62b5ae59df111151a546ca66 ]
The array size is FTRACE_KSTACK_NESTING, so the index FTRACE_KSTACK_NESTING is illegal too. And fix two typos by the way.
--- kernel/trace/trace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/trace.c +2 -2
@@ -2611,7 +2611,7 @@ trace_event_buffer_lock_reserve(struct trace_buffer **current_rb,/* * If tracing is off, but we have triggers enabled * we still need to look at the event data. Use the temp_buffer -* to store the trace event for the tigger to use. It's recusive +* to store the trace event for the trigger to use. It's recursive * safe and will not be recorded anywhere. */ if (!entry && trace_file->flags &EVENT_FILE_FL_TRIGGER_COND ) {
@@ -2934,7 +2934,7 @@ static void __ftrace_trace_stack(struct trace_buffer *buffer, stackidx =__this_cpu_inc_return (ftrace_stack_reserve) -1 ;/* This should never happen. If it does, yell once and skip */ -if (WARN_ON_ONCE (stackidx >FTRACE_KSTACK_NESTING )) +if (WARN_ON_ONCE (stackidx >=FTRACE_KSTACK_NESTING )) goto out;/*
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 103/255 Revert "nvme-pci: remove last_sq_tail"
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
[ Upstream commit 38210800bf66d7302da1bb5b624ad68638da1562 ]
Multiple CPUs may be mapped to the same hctx, allowing mulitple submission contexts to attempt commit_rqs(). We need to verify we're not writing the same doorbell value multiple times since that's a spec violation.
Revert commit 54b2fcee1db041a83b52b51752dade6090cf952f.
--- drivers/nvme/host/pci.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
drivers/nvme/host/pci.c +19 -4
@@ -198,6 +198,7 @@ struct nvme_queue {u32 q_depth;u16 cq_vector;u16 sq_tail; +u16 last_sq_tail;u16 cq_head;u16 qid;u8 cq_phase;
@@ -455,11 +456,24 @@ static int nvme_pci_map_queues(struct blk_mq_tag_set *set)return 0 ; } -static inline void nvme_write_sq_db (struct nvme_queue *nvmeq) +/* +* Write sq tail if we are asked to, or if the next command would wrap. +*/ +static inline void nvme_write_sq_db (struct nvme_queue *nvmeq,bool write_sq) { +if (!write_sq) { +u16 next_tail = nvmeq->sq_tail +1 ; + +if (next_tail == nvmeq->q_depth) + next_tail =0 ; +if (next_tail != nvmeq->last_sq_tail) +return ; + } +if (nvme_dbbuf_update_and_check_event (nvmeq->sq_tail, nvmeq->dbbuf_sq_db, nvmeq->dbbuf_sq_ei))writel (nvmeq->sq_tail, nvmeq->q_db); + nvmeq->last_sq_tail = nvmeq->sq_tail; }/**
@@ -476,8 +490,7 @@ static void nvme_submit_cmd(struct nvme_queue *nvmeq, struct nvme_command *cmd, cmd, sizeof(*cmd));if (++nvmeq->sq_tail == nvmeq->q_depth) nvmeq->sq_tail =0 ; -if (write_sq) -nvme_write_sq_db (nvmeq); +nvme_write_sq_db (nvmeq, write_sq);spin_unlock (&nvmeq->sq_lock); }
@@ -486,7 +499,8 @@ static void nvme_commit_rqs(struct blk_mq_hw_ctx *hctx)struct nvme_queue *nvmeq = hctx->driver_data;spin_lock (&nvmeq->sq_lock); -nvme_write_sq_db (nvmeq); +if (nvmeq->sq_tail != nvmeq->last_sq_tail) +nvme_write_sq_db (nvmeq, true);spin_unlock (&nvmeq->sq_lock); }
@@ -1496,6 +1510,7 @@ static void nvme_init_queue(struct nvme_queue *nvmeq, u16 qid)struct nvme_dev *dev = nvmeq->dev; nvmeq->sq_tail =0 ; + nvmeq->last_sq_tail =0 ; nvmeq->cq_head =0 ; nvmeq->cq_phase =1 ; nvmeq->q_db = &dev->dbs[qid *2 * dev->db_stride];
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 104/255 ARC: [plat-hsdk] Remap CCMs super early in asm boot trampoline
In reply to Greg Kroah-HartmanFrom: Vineet Gupta <[email protected]>
[ Upstream commit 3b57533b460c8dc22a432684b7e8d22571f34d2e ]
ARC HSDK platform stopped booting on released v5.10-rc1, getting stuck in startup of non master SMP cores.
This was bisected to upstream commit 7fef431be9c9ac25 "(mm/page_alloc: place pages to tail in __free_pages_core())" That commit itself is harmless, it just exposed a subtle assumption in our platform code (hence CC'ing linux-mm just as FYI in case some other arches / platforms trip on it).
The upstream commit is semantically disruptive as it reverses the order of page allocations (actually it can be good test for hardware verification to exercise different memory patterns altogether). For ARC HSDK platform that meant a remapped memory region (pertaining to unused Closely Coupled Memory) started getting used early for dynamice allocations, while not effectively remapped on all the cores, triggering memory error exception on those cores.
The fix is to move the CCM remapping from early platform code to to early core boot code. And while it is undesirable to riddle common boot code with platform quirks, there is no other way to do this since the faltering code involves setting up stack itself so even function calls are not allowed at that point.
If anyone is interested, all the gory details can be found at Link below.
--- arch/arc/kernel/head.S | 17 ++++++++++++++++- arch/arc/plat-hsdk/platform.c | 17 ----------------- 2 files changed, 16 insertions(+), 18 deletions(-)
arch/arc/kernel/head.S +16 -1
@@ -67,7 +67,22 @@ sr r5, [ARC_REG_LPB_CTRL] 1: #endif /* CONFIG_ARC_LPB_DISABLE */ -#endif + + /* On HSDK, CCMs need to remapped super early */ +#ifdef CONFIG_ARC_SOC_HSDK + mov r6, 0x60000000 + lr r5, [ARC_REG_ICCM_BUILD] + breq r5, 0, 1f + sr r6, [ARC_REG_AUX_ICCM] +1: + lr r5, [ARC_REG_DCCM_BUILD] + breq r5, 0, 2f + sr r6, [ARC_REG_AUX_DCCM] +2: +#endif /* CONFIG_ARC_SOC_HSDK */ + +#endif /* CONFIG_ISA_ARCV2 */ + ; Config DSP_CTRL properly, so kernel may use integer multiply, ; multiply-accumulate, and divide operations DSP_EARLY_INIT
arch/arc/plat-hsdk/platform.c +0 -17
@@ -17,22 +17,6 @@ int arc_hsdk_axi_dmac_coherent __section(.data) = 0;#define ARC_CCM_UNUSED_ADDR 0x60000000 -static void __init hsdk_init_per_cpu (unsigned int cpu) -{ -/* -* By default ICCM is mapped to 0x7z while this area is used for -* kernel virtual mappings, so move it to currently unused area. -*/ -if (cpuinfo_arc700[cpu].iccm.sz) -write_aux_reg (ARC_REG_AUX_ICCM ,ARC_CCM_UNUSED_ADDR ); - -/* -* By default DCCM is mapped to 0x8z while this area is used by kernel, -* so move it to currently unused area. -*/ -if (cpuinfo_arc700[cpu].dccm.sz) -write_aux_reg (ARC_REG_AUX_DCCM ,ARC_CCM_UNUSED_ADDR ); -}#define ARC_PERIPHERAL_BASE 0xf0000000#define CREG_BASE (ARC_PERIPHERAL_BASE + 0x1000)
@@ -339,5 +323,4 @@ static const char *hsdk_compat[] __initconst = {MACHINE_START (SIMULATION ,"hsdk" ) .dt_compat = hsdk_compat, .init_early = hsdk_init_early, - .init_per_cpu = hsdk_init_per_cpu,MACHINE_END
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 105/255 scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()
In reply to Greg Kroah-HartmanFrom: Hannes Reinecke <[email protected]>
[ Upstream commit 5faf50e9e9fdc2117c61ff7e20da49cd6a29e0ca ]
alua_bus_detach() might be running concurrently with alua_rtpg_work(), so we might trip over h->sdev == NULL and call BUG_ON(). The correct way of handling it is to not set h->sdev to NULL in alua_bus_detach(), and call rcu_synchronize() before the final delete to ensure that all concurrent threads have left the critical section. Then we can get rid of the BUG_ON() and replace it with a simple if condition.
--- drivers/scsi/device_handler/scsi_dh_alua.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/scsi/device_handler/scsi_dh_alua.c +5 -4
@@ -658,8 +658,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)rcu_read_lock ();list_for_each_entry_rcu (h, &tmp_pg->dh_list, node) { -/* h->sdev should always be valid */ -BUG_ON (!h->sdev); +if (!h->sdev) +continue ; h->sdev->access_state = desc[0 ]; }rcu_read_unlock ();
@@ -705,7 +705,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) pg->expiry =0 ;rcu_read_lock ();list_for_each_entry_rcu (h, &pg->dh_list, node) { -BUG_ON (!h->sdev); +if (!h->sdev) +continue ; h->sdev->access_state = (pg->state &SCSI_ACCESS_STATE_MASK );if (pg->pref)
@@ -1147,7 +1148,6 @@ static void alua_bus_detach(struct scsi_device *sdev)spin_lock (&h->pg_lock); pg =rcu_dereference_protected (h->pg,lockdep_is_held (&h->pg_lock));rcu_assign_pointer (h->pg,NULL ); - h->sdev =NULL ;spin_unlock (&h->pg_lock);if (pg) {spin_lock_irq (&pg->lock);
@@ -1156,6 +1156,7 @@ static void alua_bus_detach(struct scsi_device *sdev)kref_put (&pg->kref, release_port_group); } sdev->handler_data =NULL ; +synchronize_rcu ();kfree (h); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 106/255 scsi: mpt3sas: Fix timeouts observed while reenabling IRQ
In reply to Greg Kroah-HartmanFrom: Sreekanth Reddy <[email protected]>
[ Upstream commit 5feed64f9199ff90c4239971733f23f30aeb2484 ]
While reenabling the IRQ after irq poll there may be small time window where HBA firmware has posted some replies and raise the interrupts but driver has not received the interrupts. So we may observe I/O timeouts as the driver has not processed the replies as interrupts got missed while reenabling the IRQ.
To fix this issue the driver has to go for one more round of processing the reply descriptors from reply descriptor post queue after enabling the IRQ.
--- drivers/scsi/mpt3sas/mpt3sas_base.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/scsi/mpt3sas/mpt3sas_base.c +7 -0
@@ -1742,6 +1742,13 @@ _base_irqpoll(struct irq_poll *irqpoll, int budget) reply_q->irq_poll_scheduled = false; reply_q->irq_line_enable = true;enable_irq (reply_q->os_irq); +/* +* Go for one more round of processing the +* reply descriptor post queue incase if HBA +* Firmware has posted some reply descriptors +* while reenabling the IRQ. +*/ +_base_process_reply_queue (reply_q); }return num_entries;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 107/255 nvme: introduce nvme_sync_io_queues
In reply to Greg Kroah-HartmanFrom: Chao Leng <[email protected]>
[ Upstream commit 04800fbff4764ab7b32c49d19628605a5d4cb85c ]
Introduce sync io queues for some scenarios which just only need sync io queues not sync all queues.
--- drivers/nvme/host/core.c | 8 ++++++-- drivers/nvme/host/nvme.h | 1 + 2 files changed, 7 insertions(+), 2 deletions(-)
drivers/nvme/host/core.c +6 -2
@@ -4641,8 +4641,7 @@ void nvme_start_queues(struct nvme_ctrl *ctrl) }EXPORT_SYMBOL_GPL (nvme_start_queues); - -void nvme_sync_queues (struct nvme_ctrl *ctrl) +void nvme_sync_io_queues (struct nvme_ctrl *ctrl) {struct nvme_ns *ns;
@@ -4650,7 +4649,12 @@ void nvme_sync_queues(struct nvme_ctrl *ctrl)list_for_each_entry (ns, &ctrl->namespaces, list)blk_sync_queue (ns->queue);up_read (&ctrl->namespaces_rwsem); +} +EXPORT_SYMBOL_GPL (nvme_sync_io_queues); +void nvme_sync_queues (struct nvme_ctrl *ctrl) +{ +nvme_sync_io_queues (ctrl);if (ctrl->admin_q)blk_sync_queue (ctrl->admin_q); }
drivers/nvme/host/nvme.h +1 -0
@@ -602,6 +602,7 @@ void nvme_stop_queues(struct nvme_ctrl *ctrl);void nvme_start_queues (struct nvme_ctrl *ctrl);void nvme_kill_queues (struct nvme_ctrl *ctrl);void nvme_sync_queues (struct nvme_ctrl *ctrl); +void nvme_sync_io_queues (struct nvme_ctrl *ctrl);void nvme_unfreeze (struct nvme_ctrl *ctrl);void nvme_wait_freeze (struct nvme_ctrl *ctrl);int nvme_wait_freeze_timeout (struct nvme_ctrl *ctrl,long timeout);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 108/255 nvme-rdma: avoid race between time out and tear down
In reply to Greg Kroah-HartmanFrom: Chao Leng <[email protected]>
[ Upstream commit 3017013dcc82a4862bd1e140f8b762cfc594008d ]
Now use teardown_lock to serialize for time out and tear down. This may cause abnormal: first cancel all request in tear down, then time out may complete the request again, but the request may already be freed or restarted.
To avoid race between time out and tear down, in tear down process, first we quiesce the queue, and then delete the timer and cancel the time out work for the queue. At the same time we need to delete teardown_lock.
--- drivers/nvme/host/rdma.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-)
drivers/nvme/host/rdma.c +2 -10
@@ -122,7 +122,6 @@ struct nvme_rdma_ctrl {struct sockaddr_storage src_addr;struct nvme_ctrl ctrl; -struct mutex teardown_lock;bool use_inline_data;u32 io_queues[HCTX_MAX_TYPES ]; };
@@ -1010,8 +1009,8 @@ out_free_io_queues:static void nvme_rdma_teardown_admin_queue (struct nvme_rdma_ctrl *ctrl,bool remove) { -mutex_lock (&ctrl->teardown_lock);blk_mq_quiesce_queue (ctrl->ctrl.admin_q); +blk_sync_queue (ctrl->ctrl.admin_q);nvme_rdma_stop_queue (&ctrl->queues[0 ]);if (ctrl->ctrl.admin_tagset) { blk_mq_tagset_busy_iter(ctrl->ctrl.admin_tagset,
@@ -1021,16 +1020,15 @@ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl,if (remove)blk_mq_unquiesce_queue (ctrl->ctrl.admin_q);nvme_rdma_destroy_admin_queue (ctrl, remove); -mutex_unlock (&ctrl->teardown_lock); }static void nvme_rdma_teardown_io_queues (struct nvme_rdma_ctrl *ctrl,bool remove) { -mutex_lock (&ctrl->teardown_lock);if (ctrl->ctrl.queue_count >1 ) {nvme_start_freeze (&ctrl->ctrl);nvme_stop_queues (&ctrl->ctrl); +nvme_sync_io_queues (&ctrl->ctrl);nvme_rdma_stop_io_queues (ctrl);if (ctrl->ctrl.tagset) { blk_mq_tagset_busy_iter(ctrl->ctrl.tagset,
@@ -1041,7 +1039,6 @@ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,nvme_start_queues (&ctrl->ctrl);nvme_rdma_destroy_io_queues (ctrl, remove); } -mutex_unlock (&ctrl->teardown_lock); }static void nvme_rdma_free_ctrl (struct nvme_ctrl *nctrl)
@@ -1975,16 +1972,12 @@ static void nvme_rdma_complete_timed_out(struct request *rq) {struct nvme_rdma_request *req =blk_mq_rq_to_pdu (rq);struct nvme_rdma_queue *queue = req->queue; -struct nvme_rdma_ctrl *ctrl = queue->ctrl; -/* fence other contexts that may complete the command */ -mutex_lock (&ctrl->teardown_lock);nvme_rdma_stop_queue (queue);if (!blk_mq_request_completed (rq)) {nvme_req (rq)->status =NVME_SC_HOST_ABORTED_CMD ;blk_mq_complete_request (rq); } -mutex_unlock (&ctrl->teardown_lock); } static enum blk_eh_timer_return
@@ -2319,7 +2312,6 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,return ERR_PTR (-ENOMEM ); ctrl->ctrl.opts = opts;INIT_LIST_HEAD (&ctrl->list); -mutex_init (&ctrl->teardown_lock);if (!(opts->mask &NVMF_OPT_TRSVCID )) { opts->trsvcid =
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 109/255 nvme-tcp: avoid race between time out and tear down
In reply to Greg Kroah-HartmanFrom: Chao Leng <[email protected]>
[ Upstream commit d6f66210f4b1aa2f5944f0e34e0f8db44f499f92 ]
Now use teardown_lock to serialize for time out and tear down. This may cause abnormal: first cancel all request in tear down, then time out may complete the request again, but the request may already be freed or restarted.
To avoid race between time out and tear down, in tear down process, first we quiesce the queue, and then delete the timer and cancel the time out work for the queue. At the same time we need to delete teardown_lock.
--- drivers/nvme/host/tcp.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-)
drivers/nvme/host/tcp.c +3 -11
@@ -124,7 +124,6 @@ struct nvme_tcp_ctrl {struct sockaddr_storage src_addr;struct nvme_ctrl ctrl; -struct mutex teardown_lock;struct work_struct err_work;struct delayed_work connect_work;struct nvme_tcp_request async_req;
@@ -1886,8 +1885,8 @@ out_free_queue:static void nvme_tcp_teardown_admin_queue (struct nvme_ctrl *ctrl,bool remove) { -mutex_lock (&to_tcp_ctrl (ctrl)->teardown_lock);blk_mq_quiesce_queue (ctrl->admin_q); +blk_sync_queue (ctrl->admin_q);nvme_tcp_stop_queue (ctrl,0 );if (ctrl->admin_tagset) { blk_mq_tagset_busy_iter(ctrl->admin_tagset,
@@ -1897,18 +1896,17 @@ static void nvme_tcp_teardown_admin_queue(struct nvme_ctrl *ctrl,if (remove)blk_mq_unquiesce_queue (ctrl->admin_q);nvme_tcp_destroy_admin_queue (ctrl, remove); -mutex_unlock (&to_tcp_ctrl (ctrl)->teardown_lock); }static void nvme_tcp_teardown_io_queues (struct nvme_ctrl *ctrl,bool remove) { -mutex_lock (&to_tcp_ctrl (ctrl)->teardown_lock);if (ctrl->queue_count <=1 ) - goto out; +return ;blk_mq_quiesce_queue (ctrl->admin_q);nvme_start_freeze (ctrl);nvme_stop_queues (ctrl); +nvme_sync_io_queues (ctrl);nvme_tcp_stop_io_queues (ctrl);if (ctrl->tagset) { blk_mq_tagset_busy_iter(ctrl->tagset,
@@ -1918,8 +1916,6 @@ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl,if (remove)nvme_start_queues (ctrl);nvme_tcp_destroy_io_queues (ctrl, remove); -out: -mutex_unlock (&to_tcp_ctrl (ctrl)->teardown_lock); }static void nvme_tcp_reconnect_or_remove (struct nvme_ctrl *ctrl)
@@ -2171,14 +2167,11 @@ static void nvme_tcp_complete_timed_out(struct request *rq)struct nvme_tcp_request *req =blk_mq_rq_to_pdu (rq);struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl; -/* fence other contexts that may complete the command */ -mutex_lock (&to_tcp_ctrl (ctrl)->teardown_lock);nvme_tcp_stop_queue (ctrl,nvme_tcp_queue_id (req->queue));if (!blk_mq_request_completed (rq)) {nvme_req (rq)->status =NVME_SC_HOST_ABORTED_CMD ;blk_mq_complete_request (rq); } -mutex_unlock (&to_tcp_ctrl (ctrl)->teardown_lock); } static enum blk_eh_timer_return
@@ -2455,7 +2448,6 @@ static struct nvme_ctrl *nvme_tcp_create_ctrl(struct device *dev, nvme_tcp_reconnect_ctrl_work);INIT_WORK (&ctrl->err_work, nvme_tcp_error_recovery_work);INIT_WORK (&ctrl->ctrl.reset_work, nvme_reset_ctrl_work); -mutex_init (&ctrl->teardown_lock);if (!(opts->mask &NVMF_OPT_TRSVCID )) { opts->trsvcid =
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 110/255 nvme-rdma: avoid repeated request completion
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit fdf58e02adecbef4c7cbb2073d8ea225e6fd5f26 ]
The request may be executed asynchronously, and rq->state may be changed to IDLE. To avoid repeated request completion, only MQ_RQ_COMPLETE of rq->state is checked in nvme_rdma_complete_timed_out. It is not safe, so need adding check IDLE for rq->state.
--- drivers/nvme/host/rdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/rdma.c +1 -1
@@ -1974,7 +1974,7 @@ static void nvme_rdma_complete_timed_out(struct request *rq)struct nvme_rdma_queue *queue = req->queue;nvme_rdma_stop_queue (queue); -if (!blk_mq_request_completed (rq)) { +if (blk_mq_request_started (rq) && !blk_mq_request_completed (rq)) {nvme_req (rq)->status =NVME_SC_HOST_ABORTED_CMD ;blk_mq_complete_request (rq); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 111/255 nvme-tcp: avoid repeated request completion
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit 0a8a2c85b83589a5c10bc5564b796836bf4b4984 ]
The request may be executed asynchronously, and rq->state may be changed to IDLE. To avoid repeated request completion, only MQ_RQ_COMPLETE of rq->state is checked in nvme_tcp_complete_timed_out. It is not safe, so need adding check IDLE for rq->state.
--- drivers/nvme/host/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/tcp.c +1 -1
@@ -2168,7 +2168,7 @@ static void nvme_tcp_complete_timed_out(struct request *rq)struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl;nvme_tcp_stop_queue (ctrl,nvme_tcp_queue_id (req->queue)); -if (!blk_mq_request_completed (rq)) { +if (blk_mq_request_started (rq) && !blk_mq_request_completed (rq)) {nvme_req (rq)->status =NVME_SC_HOST_ABORTED_CMD ;blk_mq_complete_request (rq); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 112/255 iommu/amd: Increase interrupt remapping table limit to 512 entries
In reply to Greg Kroah-HartmanFrom: Suravee Suthikulpanit <[email protected]>
[ Upstream commit 73db2fc595f358460ce32bcaa3be1f0cce4a2db1 ]
Certain device drivers allocate IO queues on a per-cpu basis. On AMD EPYC platform, which can support up-to 256 cpu threads, this can exceed the current MAX_IRQ_PER_TABLE limit of 256, and result in the error message:
AMD-Vi: Failed to allocate IRTE
This has been observed with certain NVME devices.
AMD IOMMU hardware can actually support upto 512 interrupt remapping table entries. Therefore, update the driver to match the hardware limit.
Please note that this also increases the size of interrupt remapping table to 8KB per device when using the 128-bit IRTE format.
--- drivers/iommu/amd/amd_iommu_types.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/iommu/amd/amd_iommu_types.h +5 -1
@@ -406,7 +406,11 @@ extern bool amd_iommu_np_cache;/* Only true if all IOMMUs support device IOTLBs */ extern bool amd_iommu_iotlb_sup; -#define MAX_IRQS_PER_TABLE 256 +/* +* AMD IOMMU hardware only support 512 IRTEs despite +* the architectural limitation of 2048 entries. +*/ +#define MAX_IRQS_PER_TABLE 512#define IRQ_TABLE_ALIGNMENT 128struct irq_remap_table {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 113/255 s390/smp: move rcu_cpu_starting() earlier
In reply to Greg Kroah-HartmanFrom: Qian Cai <[email protected]>
[ Upstream commit de5d9dae150ca1c1b5c7676711a9ca139d1a8dec ]
The call to rcu_cpu_starting() in smp_init_secondary() is not early enough in the CPU-hotplug onlining process, which results in lockdep splats as follows:
WARNING: suspicious RCU usage
-----------------------------
kernel/locking/lockdep.c:3497 RCU-list traversed in non-reader section!!
other info that might help us debug this:
RCU used illegally from offline CPU!
rcu_scheduler_active = 1, debug_locks = 1
no locks held by swapper/1/0.
Call Trace: show_stack+0x158/0x1f0 dump_stack+0x1f2/0x238 __lock_acquire+0x2640/0x4dd0 lock_acquire+0x3a8/0xd08 _raw_spin_lock_irqsave+0xc0/0xf0 clockevents_register_device+0xa8/0x528 init_cpu_timer+0x33e/0x468 smp_init_secondary+0x11a/0x328 smp_start_secondary+0x82/0x88
This is avoided by moving the call to rcu_cpu_starting up near the beginning of the smp_init_secondary() function. Note that the raw_smp_processor_id() is required in order to avoid calling into lockdep before RCU has declared the CPU to be watched for readers.
--- arch/s390/kernel/smp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/s390/kernel/smp.c +2 -1
@@ -855,13 +855,14 @@ void __init smp_detect_cpus(void)static void smp_init_secondary (void ) { -int cpu =smp_processor_id (); +int cpu =raw_smp_processor_id (); S390_lowcore.last_update_clock =get_tod_clock ();restore_access_regs (S390_lowcore.access_regs_save_area);set_cpu_flag (CIF_ASCE_PRIMARY );set_cpu_flag (CIF_ASCE_SECONDARY );cpu_init (); +rcu_cpu_starting (cpu);preempt_disable ();init_cpu_timer ();vtime_init ();
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 114/255 vfio: platform: fix reference leak in vfio_platform_open
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit bb742ad01961a3b9d1f9d19375487b879668b6b2 ]
pm_runtime_get_sync() will increment pm usage counter even it failed. Forgetting to call pm_runtime_put will result in reference leak in vfio_platform_open, so we should fix it.
--- drivers/vfio/platform/vfio_platform_common.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/vfio/platform/vfio_platform_common.c +1 -2
@@ -267,7 +267,7 @@ static int vfio_platform_open(void *device_data) ret =pm_runtime_get_sync (vdev->device);if (ret <0 ) - goto err_pm; + goto err_rst; ret =vfio_platform_call_reset (vdev, &extra_dbg);if (ret && vdev->reset_required) {
@@ -284,7 +284,6 @@ static int vfio_platform_open(void *device_data) err_rst:pm_runtime_put (vdev->device); -err_pm:vfio_platform_irq_cleanup (vdev); err_irq:vfio_platform_regions_cleanup (vdev);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 115/255 vfio/pci: Bypass IGD init in case of -ENODEV
In reply to Greg Kroah-HartmanFrom: Fred Gao <[email protected]>
[ Upstream commit e4eccb853664de7bcf9518fb658f35e748bf1f68 ]
Bypass the IGD initialization when -ENODEV returns, that should be the case if opregion is not available for IGD or within discrete graphics device's option ROM, or host/lpc bridge is not found.
Then use of -ENODEV here means no special device resources found which needs special care for VFIO, but we still allow other normal device resource access.
--- drivers/vfio/pci/vfio_pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/vfio/pci/vfio_pci.c +1 -1
@@ -385,7 +385,7 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev) pdev->vendor == PCI_VENDOR_ID_INTEL && IS_ENABLED(CONFIG_VFIO_PCI_IGD)) { ret =vfio_pci_igd_init (vdev); -if (ret) { +if (ret && ret != -ENODEV ) {pci_warn (pdev,"Failed to setup Intel IGD regions\n" ); goto disable_exit; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 116/255 i2c: mediatek: move dma reset before i2c reset
In reply to Greg Kroah-HartmanFrom: Qii Wang <[email protected]>
[ Upstream commit aafced673c06b7c77040c1df42e2e965be5d0376 ]
The i2c driver default do dma reset after i2c reset, but sometimes i2c reset will trigger dma tx2rx, then apdma write data to dram which has been i2c_put_dma_safe_msg_buf(kfree). Move dma reset before i2c reset in mtk_i2c_init_hw to fix it.
--- drivers/i2c/busses/i2c-mt65xx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-mt65xx.c +4 -4
@@ -475,6 +475,10 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c) {u16 control_reg; +writel (I2C_DMA_HARD_RST , i2c->pdmabase +OFFSET_RST ); +udelay (50 ); +writel (I2C_DMA_CLR_FLAG , i2c->pdmabase +OFFSET_RST ); +mtk_i2c_writew (i2c,I2C_SOFT_RST ,OFFSET_SOFTRESET );/* Set ioconfig */
@@ -529,10 +533,6 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c)mtk_i2c_writew (i2c, control_reg,OFFSET_CONTROL );mtk_i2c_writew (i2c,I2C_DELAY_LEN ,OFFSET_DELAY_LEN ); - -writel (I2C_DMA_HARD_RST , i2c->pdmabase +OFFSET_RST ); -udelay (50 ); -writel (I2C_DMA_CLR_FLAG , i2c->pdmabase +OFFSET_RST ); }static const struct i2c_spec_values *mtk_i2c_get_spec (unsigned int speed)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 117/255 amd/amdgpu: Disable VCN DPG mode for Picasso
In reply to Greg Kroah-HartmanFrom: Veerabadhran Gopalakrishnan <[email protected]>
[ Upstream commit c6d2b0fbb893d5c7dda405aa0e7bcbecf1c75f98 ]
Concurrent operation of VCN and JPEG decoder in DPG mode is causing ring timeout due to power state.
--- drivers/gpu/drm/amd/amdgpu/soc15.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/soc15.c +1 -2
@@ -1220,8 +1220,7 @@ static int soc15_common_early_init(void *handle) adev->pg_flags =AMD_PG_SUPPORT_SDMA |AMD_PG_SUPPORT_MMHUB | -AMD_PG_SUPPORT_VCN | -AMD_PG_SUPPORT_VCN_DPG ; +AMD_PG_SUPPORT_VCN ; }else { adev->cg_flags =AMD_CG_SUPPORT_GFX_MGCG | AMD_CG_SUPPORT_GFX_MGLS |
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 118/255 iomap: clean up writeback state logic on writepage error
In reply to Greg Kroah-HartmanFrom: Brian Foster <[email protected]>
[ Upstream commit 50e7d6c7a5210063b9a6f0d8799d9d1440907fcf ]
The iomap writepage error handling logic is a mash of old and slightly broken XFS writepage logic. When keepwrite writeback state tracking was introduced in XFS in commit 0d085a529b42 ("xfs: ensure WB_SYNC_ALL writeback handles partial pages correctly"), XFS had an additional cluster writeback context that scanned ahead of ->writepage() to process dirty pages over the current ->writepage() extent mapping. This context expected a dirty page and required retention of the TOWRITE tag on partial page processing so the higher level writeback context would revisit the page (in contrast to ->writepage(), which passes a page with the dirty bit already cleared).
The cluster writeback mechanism was eventually removed and some of the error handling logic folded into the primary writeback path in commit 150d5be09ce4 ("xfs: remove xfs_cancel_ioend"). This patch accidentally conflated the two contexts by using the keepwrite logic in ->writepage() without accounting for the fact that the page is not dirty. Further, the keepwrite logic has no practical effect on the core ->writepage() caller (write_cache_pages()) because it never revisits a page in the current function invocation.
Technically, the page should be redirtied for the keepwrite logic to have any effect. Otherwise, write_cache_pages() may find the tagged page but will skip it since it is clean. Even if the page was redirtied, however, there is still no practical effect to keepwrite since write_cache_pages() does not wrap around within a single invocation of the function. Therefore, the dirty page would simply end up retagged on the next writeback sequence over the associated range.
All that being said, none of this really matters because redirtying a partially processed page introduces a potential infinite redirty -> writeback failure loop that deviates from the current design principle of clearing the dirty state on writepage failure to avoid building up too much dirty, unreclaimable memory on the system. Therefore, drop the spurious keepwrite usage and dirty state clearing logic from iomap_writepage_map(), treat the partially processed page the same as a fully processed page, and let the imminent ioend failure clean up the writeback state.
--- fs/iomap/buffered-io.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-)
fs/iomap/buffered-io.c +2 -13
@@ -1395,6 +1395,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc,WARN_ON_ONCE (!wpc->ioend && !list_empty (&submit_list));WARN_ON_ONCE (!PageLocked (page));WARN_ON_ONCE (PageWriteback (page)); +WARN_ON_ONCE (PageDirty (page));/* * We cannot cancel the ioend directly here on error. We may have
@@ -1415,21 +1416,9 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc,unlock_page (page); goto done; } - -/* -* If the page was not fully cleaned, we need to ensure that the -* higher layers come back to it correctly. That means we need -* to keep the page dirty, and for WB_SYNC_ALL writeback we need -* to ensure the PAGECACHE_TAG_TOWRITE index mark is not removed -* so another attempt to write this page in this writeback sweep -* will be made. -*/ -set_page_writeback_keepwrite (page); - }else { -clear_page_dirty_for_io (page); -set_page_writeback (page); } +set_page_writeback (page);unlock_page (page);/*
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 119/255 selftests: proc: fix warning: _GNU_SOURCE redefined
In reply to Greg Kroah-HartmanFrom: Tommi Rantala <[email protected]>
[ Upstream commit f3ae6c6e8a3ea49076d826c64e63ea78fbf9db43 ]
Makefile already contains -D_GNU_SOURCE, so we can remove it from the *.c files.
--- tools/testing/selftests/proc/proc-loadavg-001.c | 1 - tools/testing/selftests/proc/proc-self-syscall.c | 1 - tools/testing/selftests/proc/proc-uptime-002.c | 1 - 3 files changed, 3 deletions(-)
tools/testing/selftests/proc/proc-loadavg-001.c +0 -1
@@ -14,7 +14,6 @@* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ /* Test that /proc/loadavg correctly reports last pid in pid namespace. */ -#define _GNU_SOURCE#include <errno.h> #include <sched.h> #include <sys/types.h>
tools/testing/selftests/proc/proc-self-syscall.c +0 -1
@@ -13,7 +13,6 @@* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -#define _GNU_SOURCE#include <unistd.h> #include <sys/syscall.h> #include <sys/types.h>
tools/testing/selftests/proc/proc-uptime-002.c +0 -1
@@ -15,7 +15,6 @@*/ // Test that values in /proc/uptime increment monotonically // while shifting across CPUs. -#define _GNU_SOURCE#undef NDEBUG#include <assert.h> #include <unistd.h>
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 120/255 arm64: kexec_file: try more regions if loading segments fails
In reply to Greg Kroah-HartmanFrom: Benjamin Gwin <[email protected]>
[ Upstream commit 108aa503657ee2fe8aa071dc620d96372c252ecd ]
It's possible that the first region picked for the new kernel will make it impossible to fit the other segments in the required 32GB window, especially if we have a very large initrd.
Instead of giving up, we can keep testing other regions for the kernel until we find one that works.
--- arch/arm64/kernel/kexec_image.c | 41 +++++++++++++++++++------- arch/arm64/kernel/machine_kexec_file.c | 9 +++++- 2 files changed, 39 insertions(+), 11 deletions(-)
arch/arm64/kernel/kexec_image.c +31 -10
@@ -43,7 +43,7 @@ static void *image_load(struct kimage *image,u64 flags, value;bool be_image, be_kernel;struct kexec_buf kbuf; -unsigned long text_offset; +unsigned long text_offset, kernel_segment_number;struct kexec_segment *kernel_segment;int ret;
@@ -88,11 +88,37 @@ static void *image_load(struct kimage *image,/* Adjust kernel segment with TEXT_OFFSET */ kbuf.memsz += text_offset; - ret =kexec_add_buffer (&kbuf); -if (ret) + kernel_segment_number = image->nr_segments; + +/* +* The location of the kernel segment may make it impossible to satisfy +* the other segment requirements, so we try repeatedly to find a +* location that will work. +*/ +while ((ret =kexec_add_buffer (&kbuf)) ==0 ) { +/* Try to load additional data */ + kernel_segment = &image->segment[kernel_segment_number]; + ret =load_other_segments (image, kernel_segment->mem, + kernel_segment->memsz, initrd, + initrd_len, cmdline); +if (!ret) +break ; + +/* +* We couldn't find space for the other segments; erase the +* kernel segment and try the next available hole. +*/ + image->nr_segments -=1 ; + kbuf.buf_min = kernel_segment->mem + kernel_segment->memsz; + kbuf.mem =KEXEC_BUF_MEM_UNKNOWN ; + } + +if (ret) { +pr_err ("Could not find any suitable kernel location!" );return ERR_PTR (ret); + } - kernel_segment = &image->segment[image->nr_segments -1 ]; + kernel_segment = &image->segment[kernel_segment_number]; kernel_segment->mem += text_offset; kernel_segment->memsz -= text_offset; image->start = kernel_segment->mem;
@@ -101,12 +127,7 @@ static void *image_load(struct kimage *image, kernel_segment->mem, kbuf.bufsz, kernel_segment->memsz); -/* Load additional data */ - ret =load_other_segments (image, - kernel_segment->mem, kernel_segment->memsz, - initrd, initrd_len, cmdline); - -return ERR_PTR (ret); +return 0 ; }#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
arch/arm64/kernel/machine_kexec_file.c +8 -1
@@ -242,6 +242,11 @@ static int prepare_elf_headers(void **addr, unsigned long *sz)return ret; } +/* +* Tries to add the initrd and DTB to the image. If it is not possible to find +* valid locations, this function will undo changes to the image and return non +* zero. +*/ int load_other_segments(struct kimage *image, unsigned long kernel_load_addr, unsigned long kernel_size,
@@ -250,7 +255,8 @@ int load_other_segments(struct kimage *image, {struct kexec_buf kbuf;void *headers, *dtb =NULL ; -unsigned long headers_sz, initrd_load_addr =0 , dtb_len; +unsigned long headers_sz, initrd_load_addr =0 , dtb_len, + orig_segments = image->nr_segments;int ret =0 ; kbuf.image = image;
@@ -336,6 +342,7 @@ int load_other_segments(struct kimage *image,return 0 ; out_err: + image->nr_segments = orig_segments;vfree (dtb);return ret; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 121/255 riscv: Set text_offset correctly for M-Mode
In reply to Greg Kroah-HartmanFrom: Sean Anderson <[email protected]>
[ Upstream commit 79605f1394261995c2b955c906a5a20fb27cdc84 ]
M-Mode Linux is loaded at the start of RAM, not 2MB later. Perhaps this should be calculated based on PAGE_OFFSET somehow? Even better would be to deprecate text_offset and instead introduce something absolute.
--- arch/riscv/kernel/head.S | 5 +++++ 1 file changed, 5 insertions(+)
arch/riscv/kernel/head.S +5 -0
@@ -27,12 +27,17 @@ ENTRY(_start) /* reserved */ .word 0 .balign 8 +#ifdef CONFIG_RISCV_M_MODE + /* Image load offset (0MB) from start of RAM for M-mode */ + .dword 0 +#else #if __riscv_xlen == 64 /* Image load offset(2MB) from start of RAM */ .dword 0x200000 #else /* Image load offset(4MB) from start of RAM */ .dword 0x400000 +#endif #endif /* Effective size of kernel image */ .dword _end - _start
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 122/255 i2c: sh_mobile: implement atomic transfers
In reply to Greg Kroah-HartmanFrom: Ulrich Hecht <[email protected]>
[ Upstream commit a49cc1fe9d64a2dc4e19b599204f403e5d25f44b ]
Implements atomic transfers to fix reboot/shutdown on r8a7790 Lager and similar boards.
--- drivers/i2c/busses/i2c-sh_mobile.c | 86 +++++++++++++++++++++++------- 1 file changed, 66 insertions(+), 20 deletions(-)
drivers/i2c/busses/i2c-sh_mobile.c +66 -20
@@ -129,6 +129,7 @@ struct sh_mobile_i2c_data {int sr;bool send_stop;bool stop_after_dma; +bool atomic_xfer;struct resource *res;struct dma_chan *dma_tx;
@@ -330,13 +331,15 @@ static unsigned char i2c_op(struct sh_mobile_i2c_data *pd, enum sh_mobile_i2c_op ret =iic_rd (pd,ICDR );break ;case OP_RX_STOP :/* enable DTE interrupt, issue stop */ -iic_wr (pd,ICIC , -ICIC_DTEE |ICIC_WAITE |ICIC_ALE |ICIC_TACKE ); +if (!pd->atomic_xfer) +iic_wr (pd,ICIC , +ICIC_DTEE |ICIC_WAITE |ICIC_ALE |ICIC_TACKE );iic_wr (pd,ICCR ,ICCR_ICE |ICCR_RACK );break ;case OP_RX_STOP_DATA :/* enable DTE interrupt, read data, issue stop */ -iic_wr (pd,ICIC , -ICIC_DTEE |ICIC_WAITE |ICIC_ALE |ICIC_TACKE ); +if (!pd->atomic_xfer) +iic_wr (pd,ICIC , +ICIC_DTEE |ICIC_WAITE |ICIC_ALE |ICIC_TACKE ); ret =iic_rd (pd,ICDR );iic_wr (pd,ICCR ,ICCR_ICE |ICCR_RACK );break ;
@@ -429,7 +432,8 @@ static irqreturn_t sh_mobile_i2c_isr(int irq, void *dev_id)if (wakeup) { pd->sr |=SW_DONE ; -wake_up (&pd->wait); +if (!pd->atomic_xfer) +wake_up (&pd->wait); }/* defeat write posting to avoid spurious WAIT interrupts */
@@ -581,6 +585,9 @@ static void start_ch(struct sh_mobile_i2c_data *pd, struct i2c_msg *usr_msg, pd->pos =-1 ; pd->sr =0 ; +if (pd->atomic_xfer) +return ; + pd->dma_buf =i2c_get_dma_safe_msg_buf (pd->msg,8 );if (pd->dma_buf)sh_mobile_i2c_xfer_dma (pd);
@@ -637,15 +644,13 @@ static int poll_busy(struct sh_mobile_i2c_data *pd)return i ?0 : -ETIMEDOUT ; } -static int sh_mobile_i2c_xfer (struct i2c_adapter *adapter, -struct i2c_msg *msgs, -int num) +static int sh_mobile_xfer (struct sh_mobile_i2c_data *pd, +struct i2c_msg *msgs,int num) { -struct sh_mobile_i2c_data *pd =i2c_get_adapdata (adapter);struct i2c_msg *msg;int err =0 ;int i; -long timeout; +long time_left;/* Wake up device and enable clock */ pm_runtime_get_sync (pd->dev);
@@ -662,15 +667,35 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,if (do_start)i2c_op (pd,OP_START ); -/* The interrupt handler takes care of the rest... */ - timeout =wait_event_timeout (pd->wait, - pd->sr & (ICSR_TACK |SW_DONE ), - adapter->timeout); - -/* 'stop_after_dma' tells if DMA transfer was complete */ -i2c_put_dma_safe_msg_buf (pd->dma_buf, pd->msg, pd->stop_after_dma); +if (pd->atomic_xfer) { +unsigned long j = jiffies + pd->adap.timeout; + + time_left =time_before_eq (jiffies, j); +while (time_left && + !(pd->sr & (ICSR_TACK |SW_DONE ))) { +unsigned char sr =iic_rd (pd,ICSR ); + +if (sr & (ICSR_AL |ICSR_TACK | +ICSR_WAIT |ICSR_DTE )) { +sh_mobile_i2c_isr (0 , pd); +udelay (150 ); + }else { +cpu_relax (); + } + time_left =time_before_eq (jiffies, j); + } + }else { +/* The interrupt handler takes care of the rest... */ + time_left =wait_event_timeout (pd->wait, + pd->sr & (ICSR_TACK |SW_DONE ), + pd->adap.timeout); + +/* 'stop_after_dma' tells if DMA xfer was complete */ +i2c_put_dma_safe_msg_buf (pd->dma_buf, pd->msg, + pd->stop_after_dma); + } -if (!timeout) { +if (!time_left) {dev_err (pd->dev,"Transfer request timed out\n" );if (pd->dma_direction !=DMA_NONE )sh_mobile_i2c_cleanup_dma (pd);
@@ -696,14 +721,35 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,return err ?: num; } +static int sh_mobile_i2c_xfer (struct i2c_adapter *adapter, +struct i2c_msg *msgs, +int num) +{ +struct sh_mobile_i2c_data *pd =i2c_get_adapdata (adapter); + + pd->atomic_xfer = false; +return sh_mobile_xfer (pd, msgs, num); +} + +static int sh_mobile_i2c_xfer_atomic (struct i2c_adapter *adapter, +struct i2c_msg *msgs, +int num) +{ +struct sh_mobile_i2c_data *pd =i2c_get_adapdata (adapter); + + pd->atomic_xfer = true; +return sh_mobile_xfer (pd, msgs, num); +} +static u32 sh_mobile_i2c_func (struct i2c_adapter *adapter) {return I2C_FUNC_I2C |I2C_FUNC_SMBUS_EMUL |I2C_FUNC_PROTOCOL_MANGLING ; }static const struct i2c_algorithm sh_mobile_i2c_algorithm = { - .functionality = sh_mobile_i2c_func, - .master_xfer = sh_mobile_i2c_xfer, + .functionality = sh_mobile_i2c_func, + .master_xfer = sh_mobile_i2c_xfer, + .master_xfer_atomic = sh_mobile_i2c_xfer_atomic, };static const struct i2c_adapter_quirks sh_mobile_i2c_quirks = {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 123/255 i2c: designware: call i2c_dw_read_clear_intrbits_slave() once
In reply to Greg Kroah-HartmanFrom: Michael Wu <[email protected]>
[ Upstream commit 66b92313e2ca9208b5f3ebf5d86e9a818299d8fa ]
If some bits were cleared by i2c_dw_read_clear_intrbits_slave() in i2c_dw_isr_slave() and not handled immediately, those cleared bits would not be shown again by later i2c_dw_read_clear_intrbits_slave(). They therefore were forgotten to be handled.
i2c_dw_read_clear_intrbits_slave() should be called once in an ISR and take its returned state for all later handlings.
--- drivers/i2c/busses/i2c-designware-slave.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/i2c/busses/i2c-designware-slave.c +1 -6
@@ -159,7 +159,6 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)u32 raw_stat, stat, enabled, tmp;u8 val =0 , slave_activity; -regmap_read (dev->map,DW_IC_INTR_STAT , &stat);regmap_read (dev->map,DW_IC_ENABLE , &enabled);regmap_read (dev->map,DW_IC_RAW_INTR_STAT , &raw_stat);regmap_read (dev->map,DW_IC_STATUS , &tmp);
@@ -168,6 +167,7 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)if (!enabled || !(raw_stat & ~DW_IC_INTR_ACTIVITY ) || !dev->slave)return 0 ; + stat =i2c_dw_read_clear_intrbits_slave (dev);dev_dbg (dev->dev,"%#x STATUS SLAVE_ACTIVITY=%#x : RAW_INTR_STAT=%#x : INTR_STAT=%#x\n" , enabled, slave_activity, raw_stat, stat);
@@ -188,11 +188,9 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev) val); }regmap_read (dev->map,DW_IC_CLR_RD_REQ , &tmp); - stat =i2c_dw_read_clear_intrbits_slave (dev); } else {regmap_read (dev->map,DW_IC_CLR_RD_REQ , &tmp);regmap_read (dev->map,DW_IC_CLR_RX_UNDER , &tmp); - stat =i2c_dw_read_clear_intrbits_slave (dev); } if (!i2c_slave_event(dev->slave, I2C_SLAVE_READ_REQUESTED,
@@ -207,7 +205,6 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)regmap_read (dev->map,DW_IC_CLR_RX_DONE , &tmp);i2c_slave_event (dev->slave,I2C_SLAVE_STOP , &val); - stat =i2c_dw_read_clear_intrbits_slave (dev);return 1 ; }
@@ -219,7 +216,6 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)dev_vdbg (dev->dev,"Byte %X acked!" , val); }else {i2c_slave_event (dev->slave,I2C_SLAVE_STOP , &val); - stat =i2c_dw_read_clear_intrbits_slave (dev); }return 1 ;
@@ -230,7 +226,6 @@ static irqreturn_t i2c_dw_isr_slave(int this_irq, void *dev_id)struct dw_i2c_dev *dev = dev_id;int ret; -i2c_dw_read_clear_intrbits_slave (dev); ret =i2c_dw_irq_handler_slave (dev);if (ret >0 )complete (&dev->cmd_complete);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 124/255 i2c: designware: slave should do WRITE_REQUESTED before WRITE_RECEIVED
In reply to Greg Kroah-HartmanFrom: Michael Wu <[email protected]>
[ Upstream commit 3b5f7f10ff6e6b66f553e12cc50d9bb751ce60ad ]
Sometimes we would get the following flow when doing an i2cset:
0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x514 : INTR_STAT=0x4 I2C_SLAVE_WRITE_RECEIVED0x1 STATUS SLAVE_ACTIVITY=0x0 : RAW_INTR_STAT=0x714 : INTR_STAT=0x204 I2C_SLAVE_WRITE_REQUESTEDI2C_SLAVE_WRITE_RECEIVED
Documentation/i2c/slave-interface.rst says that I2C_SLAVE_WRITE_REQUESTED, which is mandatory, should be sent while the data did not arrive yet. It means in a write-request I2C_SLAVE_WRITE_REQUESTED should be reported before any I2C_SLAVE_WRITE_RECEIVED.
By the way, I2C_SLAVE_STOP didn't be reported in the above case because DW_IC_INTR_STAT was not 0x200.
dev->status can be used to record the current state, especially Designware I2C controller has no interrupts to identify a write-request. This patch makes not only I2C_SLAVE_WRITE_REQUESTED been reported first when IC_INTR_RX_FULL is rising and dev->status isn't STATUS_WRITE_IN_PROGRESS but also I2C_SLAVE_STOP been reported when a STOP condition is received.
--- drivers/i2c/busses/i2c-designware-slave.c | 45 +++++++++-------------- 1 file changed, 18 insertions(+), 27 deletions(-)
drivers/i2c/busses/i2c-designware-slave.c +18 -27
@@ -172,26 +172,25 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)"%#x STATUS SLAVE_ACTIVITY=%#x : RAW_INTR_STAT=%#x : INTR_STAT=%#x\n" , enabled, slave_activity, raw_stat, stat); -if ((stat &DW_IC_INTR_RX_FULL ) && (stat &DW_IC_INTR_STOP_DET )) -i2c_slave_event (dev->slave,I2C_SLAVE_WRITE_REQUESTED , &val); +if (stat &DW_IC_INTR_RX_FULL ) { +if (dev->status !=STATUS_WRITE_IN_PROGRESS ) { + dev->status =STATUS_WRITE_IN_PROGRESS ; +i2c_slave_event (dev->slave,I2C_SLAVE_WRITE_REQUESTED , + &val); + } + +regmap_read (dev->map,DW_IC_DATA_CMD , &tmp); + val = tmp; +if (!i2c_slave_event (dev->slave,I2C_SLAVE_WRITE_RECEIVED , + &val)) +dev_vdbg (dev->dev,"Byte %X acked!" , val); + }if (stat &DW_IC_INTR_RD_REQ ) {if (slave_activity) { -if (stat &DW_IC_INTR_RX_FULL ) { -regmap_read (dev->map,DW_IC_DATA_CMD , &tmp); - val = tmp; - -if (!i2c_slave_event (dev->slave, -I2C_SLAVE_WRITE_RECEIVED , - &val)) { -dev_vdbg (dev->dev,"Byte %X acked!" , - val); - } -regmap_read (dev->map,DW_IC_CLR_RD_REQ , &tmp); - }else { -regmap_read (dev->map,DW_IC_CLR_RD_REQ , &tmp); -regmap_read (dev->map,DW_IC_CLR_RX_UNDER , &tmp); - } +regmap_read (dev->map,DW_IC_CLR_RD_REQ , &tmp); + + dev->status =STATUS_READ_IN_PROGRESS ;if (!i2c_slave_event (dev->slave,I2C_SLAVE_READ_REQUESTED , &val))
@@ -203,18 +202,10 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)if (!i2c_slave_event (dev->slave,I2C_SLAVE_READ_PROCESSED , &val))regmap_read (dev->map,DW_IC_CLR_RX_DONE , &tmp); - -i2c_slave_event (dev->slave,I2C_SLAVE_STOP , &val); -return 1 ; } -if (stat &DW_IC_INTR_RX_FULL ) { -regmap_read (dev->map,DW_IC_DATA_CMD , &tmp); - val = tmp; -if (!i2c_slave_event (dev->slave,I2C_SLAVE_WRITE_RECEIVED , - &val)) -dev_vdbg (dev->dev,"Byte %X acked!" , val); - }else { +if (stat &DW_IC_INTR_STOP_DET ) { + dev->status =STATUS_IDLE ;i2c_slave_event (dev->slave,I2C_SLAVE_STOP , &val); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 125/255 tpm_tis: Disable interrupts on ThinkPad T490s
In reply to Greg Kroah-HartmanFrom: Jerry Snitselaar <[email protected]>
[ Upstream commit b154ce11ead925de6a94feb3b0317fafeefa0ebc ]
There is a misconfiguration in the bios of the gpio pin used for the interrupt in the T490s. When interrupts are enabled in the tpm_tis driver code this results in an interrupt storm. This was initially reported when we attempted to enable the interrupt code in the tpm_tis driver, which previously wasn't setting a flag to enable it. Due to the reports of the interrupt storm that code was reverted and we went back to polling instead of using interrupts. Now that we know the T490s problem is a firmware issue, add code to check if the system is a T490s and disable interrupts if that is the case. This will allow us to enable interrupts for everyone else. If the user has a fixed bios they can force the enabling of interrupts with tpm_tis.interrupts=1 on the kernel command line.
--- drivers/char/tpm/tpm_tis.c | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_tis.c +27 -2
@@ -27,6 +27,7 @@#include <linux/of.h> #include <linux/of_device.h> #include <linux/kernel.h> +#include <linux/dmi.h> #include "tpm.h" #include "tpm_tis_core.h"
@@ -49,8 +50,8 @@ static inline struct tpm_tis_tcg_phy *to_tpm_tis_tcg_phy(struct tpm_tis_data *da return container_of(data, struct tpm_tis_tcg_phy, priv); } -static bool interrupts = true; -module_param (interrupts, bool,0444 ); +static int interrupts =-1 ; +module_param (interrupts, int,0444 );MODULE_PARM_DESC (interrupts,"Enable interrupts" );static bool itpm;
@@ -63,6 +64,28 @@ module_param(force, bool, 0444);MODULE_PARM_DESC (force,"Force device probe rather than using ACPI entry" );#endif +static int tpm_tis_disable_irq (const struct dmi_system_id *d) +{ +if (interrupts ==-1 ) { +pr_notice ("tpm_tis: %s detected: disabling interrupts.\n" , d->ident); + interrupts =0 ; + } + +return 0 ; +} + +static const struct dmi_system_id tpm_tis_dmi_table[] = { + { + .callback = tpm_tis_disable_irq, + .ident ="ThinkPad T490s" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"ThinkPad T490s" ), + }, + }, + {} +}; +#if defined(CONFIG_PNP ) && defined(CONFIG_ACPI )static int has_hid (struct acpi_device *dev,const char *hid) {
@@ -192,6 +215,8 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info)int irq =-1 ;int rc; +dmi_check_system (tpm_tis_dmi_table); + rc =check_acpi_tpm2 (dev);if (rc)return rc;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 126/255 spi: bcm2835: remove use of uninitialized gpio flags variable
In reply to Greg Kroah-HartmanFrom: Martin Hundebøll <[email protected]>
commit bc7f2cd7559c5595dc38b909ae9a8d43e0215994 upstream.
Removing the duplicate gpio chip select level handling in bcm2835_spi_setup() left the lflags variable uninitialized. Avoid trhe use of such variable by passing default flags to gpiochip_request_own_desc().
--- drivers/spi/spi-bcm2835.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/spi/spi-bcm2835.c +1 -2
@@ -1193,7 +1193,6 @@ static int bcm2835_spi_setup(struct spi_struct spi_controller *ctlr = spi->controller;struct bcm2835_spi *bs =spi_controller_get_devdata (ctlr);struct gpio_chip *chip; -enum gpio_lookup_flags lflags;u32 cs;/*
@@ -1261,7 +1260,7 @@ static int bcm2835_spi_setup(struct spi_ spi->cs_gpiod =gpiochip_request_own_desc (chip,8 - spi->chip_select,DRV_NAME , - lflags, +GPIO_LOOKUP_FLAGS_DEFAULT ,GPIOD_OUT_LOW );if (IS_ERR (spi->cs_gpiod))return PTR_ERR (spi->cs_gpiod);
Greg Kroah-Hartman
maintainerPATCH 127/255 mfd: sprd: Add wakeup capability for PMIC IRQ
In reply to Greg Kroah-HartmanFrom: Baolin Wang <[email protected]>
commit a75bfc824a2d33f57ebdc003bfe6b7a9e11e9cb9 upstream.
When changing to use suspend-to-idle to save power, the PMIC irq can not wakeup the system due to lack of wakeup capability, which will cause the sub-irqs (such as power key) of the PMIC can not wake up the system. Thus we can add the wakeup capability for PMIC irq to solve this issue, as well as removing the IRQF_NO_SUSPEND flag to allow PMIC irq to be a wakeup source.
--- drivers/mfd/sprd-sc27xx-spi.c | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-)
drivers/mfd/sprd-sc27xx-spi.c +27 -1
@@ -189,7 +189,7 @@ static int sprd_pmic_probe(struct spi_de ddata->irqs[i].mask =BIT (i); ret =devm_regmap_add_irq_chip (&spi->dev, ddata->regmap, ddata->irq, -IRQF_ONESHOT |IRQF_NO_SUSPEND ,0 , +IRQF_ONESHOT ,0 , &ddata->irq_chip, &ddata->irq_data);if (ret) {dev_err (&spi->dev,"Failed to add PMIC irq chip %d\n" , ret);
@@ -202,9 +202,34 @@ static int sprd_pmic_probe(struct spi_dereturn ret; } +device_init_wakeup (&spi->dev, true);return 0 ; } +#ifdef CONFIG_PM_SLEEP +static int sprd_pmic_suspend (struct device *dev) +{ +struct sprd_pmic *ddata =dev_get_drvdata (dev); + +if (device_may_wakeup (dev)) +enable_irq_wake (ddata->irq); + +return 0 ; +} + +static int sprd_pmic_resume (struct device *dev) +{ +struct sprd_pmic *ddata =dev_get_drvdata (dev); + +if (device_may_wakeup (dev)) +disable_irq_wake (ddata->irq); + +return 0 ; +} +#endif + +static SIMPLE_DEV_PM_OPS(sprd_pmic_pm_ops, sprd_pmic_suspend, sprd_pmic_resume); +static const struct of_device_id sprd_pmic_match[] = { { .compatible ="sprd,sc2731" , .data = &sc2731_data }, {},
@@ -215,6 +240,7 @@ static struct spi_driver sprd_pmic_drive .driver = { .name = "sc27xx-pmic", .of_match_table = sprd_pmic_match, + .pm = &sprd_pmic_pm_ops, }, .probe = sprd_pmic_probe, };
Greg Kroah-Hartman
maintainerPATCH 128/255 pinctrl: intel: Fix 2 kOhm bias which is 833 Ohm
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit dd26209bc56886cacdbd828571e54a6bca251e55 ]
2 kOhm bias was never an option in Intel GPIO hardware, the available matrix is:
000 none 001 1 kOhm (if available) 010 5 kOhm 100 20 kOhm
As easy to get the 3 resistors are gated separately and according to parallel circuits calculations we may get combinations of the above where the result is always strictly less than minimal resistance. Hence, additional values can be:
011 ~833.3 Ohm 101 ~952.4 Ohm 110 ~4 kOhm 111 ~800 Ohm
That said, convert TERM definitions to be the bit masks to reflect the above.
While at it, enable the same setting for pull down case.
--- drivers/pinctrl/intel/pinctrl-intel.c | 32 ++++++++++++++++++--------- 1 file changed, 22 insertions(+), 10 deletions(-)
drivers/pinctrl/intel/pinctrl-intel.c +22 -10
@@ -62,10 +62,10 @@#define PADCFG1_TERM_UP BIT(13)#define PADCFG1_TERM_SHIFT 10#define PADCFG1_TERM_MASK GENMASK(12, 10) -#define PADCFG1_TERM_20K 4 -#define PADCFG1_TERM_2K 3 -#define PADCFG1_TERM_5K 2 -#define PADCFG1_TERM_1K 1 +#define PADCFG1_TERM_20K BIT(2) +#define PADCFG1_TERM_5K BIT(1) +#define PADCFG1_TERM_1K BIT(0) +#define PADCFG1_TERM_833 (BIT(1) | BIT(0))#define PADCFG2 0x008#define PADCFG2_DEBEN BIT(0)
@@ -549,12 +549,12 @@ static int intel_config_get_pull(struct intel_pinctrl *pctrl, unsigned int pin,return -EINVAL ;switch (term) { +case PADCFG1_TERM_833 : + *arg =833 ; +break ;case PADCFG1_TERM_1K : *arg =1000 ;break ; -case PADCFG1_TERM_2K : - *arg =2000 ; -break ;case PADCFG1_TERM_5K : *arg =5000 ;break ;
@@ -570,6 +570,11 @@ static int intel_config_get_pull(struct intel_pinctrl *pctrl, unsigned int pin,return -EINVAL ;switch (term) { +case PADCFG1_TERM_833 : +if (!(community->features &PINCTRL_FEATURE_1K_PD )) +return -EINVAL ; + *arg =833 ; +break ;case PADCFG1_TERM_1K :if (!(community->features &PINCTRL_FEATURE_1K_PD ))return -EINVAL ;
@@ -685,12 +690,12 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned int pin,case 5000 : value |=PADCFG1_TERM_5K <<PADCFG1_TERM_SHIFT ;break ; -case 2000 : - value |=PADCFG1_TERM_2K <<PADCFG1_TERM_SHIFT ; -break ;case 1000 : value |=PADCFG1_TERM_1K <<PADCFG1_TERM_SHIFT ;break ; +case 833 : + value |=PADCFG1_TERM_833 <<PADCFG1_TERM_SHIFT ; +break ;default : ret = -EINVAL ; }
@@ -714,6 +719,13 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned int pin, } value |=PADCFG1_TERM_1K <<PADCFG1_TERM_SHIFT ;break ; +case 833 : +if (!(community->features &PINCTRL_FEATURE_1K_PD )) { + ret = -EINVAL ; +break ; + } + value |=PADCFG1_TERM_833 <<PADCFG1_TERM_SHIFT ; +break ;default : ret = -EINVAL ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 129/255 pinctrl: intel: Set default bias in case no particular value given
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit f3c75e7a9349d1d33eb53ddc1b31640994969f73 ]
When GPIO library asks pin control to set the bias, it doesn't pass any value of it and argument is considered boolean (and this is true for ACPI GpioIo() / GpioInt() resources, by the way). Thus, individual drivers must behave well, when they got the resistance value of 1 Ohm, i.e. transforming it to sane default.
In case of Intel pin control hardware the 5 kOhm sounds plausible because on one hand it's a minimum of resistors present in all hardware generations and at the same time it's high enough to minimize leakage current (will be only 200 uA with the above choice).
--- drivers/pinctrl/intel/pinctrl-intel.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/pinctrl/intel/pinctrl-intel.c +8 -0
@@ -683,6 +683,10 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned int pin, value |=PADCFG1_TERM_UP ; +/* Set default strength value in case none is given */ +if (arg ==1 ) + arg =5000 ; +switch (arg) {case 20000 : value |=PADCFG1_TERM_20K <<PADCFG1_TERM_SHIFT ;
@@ -705,6 +709,10 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned int pin,case PIN_CONFIG_BIAS_PULL_DOWN : value &= ~(PADCFG1_TERM_UP |PADCFG1_TERM_MASK ); +/* Set default strength value in case none is given */ +if (arg ==1 ) + arg =5000 ; +switch (arg) {case 20000 : value |=PADCFG1_TERM_20K <<PADCFG1_TERM_SHIFT ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 130/255 gpio: aspeed: fix ast2600 bank properties
In reply to Greg Kroah-HartmanFrom: Billy Tsai <[email protected]>
[ Upstream commit 560b6ac37a87fcb78d580437e3e0bc2b6b5b0295 ]
GPIO_T is mapped to the most significant byte of input/output mask, and the byte in "output" mask should be 0 because GPIO_T is input only. All the other bits need to be 1 because GPIO_Q/R/S support both input and output modes.
--- drivers/gpio/gpio-aspeed.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpio/gpio-aspeed.c +1 -0
@@ -1114,6 +1114,7 @@ static const struct aspeed_gpio_config ast2500_config =static const struct aspeed_bank_props ast2600_bank_props[] = {/* input output */ + {4 ,0xffffffff ,0x00ffffff },/* Q/R/S/T */ {5 ,0xffffffff ,0xffffff00 },/* U/V/W/X */ {6 ,0x0000ffff ,0x0000ffff },/* Y/Z */ { },
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 131/255 ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template
In reply to Greg Kroah-HartmanFrom: Andrew Jeffery <[email protected]>
[ Upstream commit 9fa2e7af3d53a4b769136eccc32c02e128a4ee51 ]
Setting both CONFIG_KPROBES=y and CONFIG_FORTIFY_SOURCE=y on ARM leads to a panic in memcpy() when injecting a kprobe despite the fixes found in commit e46daee53bb5 ("ARM: 8806/1: kprobes: Fix false positive with FORTIFY_SOURCE") and commit 0ac569bf6a79 ("ARM: 8834/1: Fix: kprobes:
optimized kprobes illegal instruction").
arch/arm/include/asm/kprobes.h effectively declares
the target type of the optprobe_template_entry assembly label as a u32 which leads memcpy()'s __builtin_object_size() call to determine that the pointed-to object is of size four. However, the symbol is used as a handle for the optimised probe assembly template that is at least 96 bytes in size. The symbol's use despite its type blows up the memcpy() in ARM's arch_prepare_optimized_kprobe() with a false-positive fortify_panic() when it should instead copy the optimised probe template into place:
``` $ sudo perf probe -a aspeed_g6_pinctrl_probe [ 158.457252] detected buffer overflow in memcpy [ 158.458069] ------------[ cut here ]------------ [ 158.458283] kernel BUG at lib/string.c:1153! [ 158.458436] Internal error: Oops - BUG: 0 [#1] SMP ARM [ 158.458768] Modules linked in: [ 158.459043] CPU: 1 PID: 99 Comm: perf Not tainted 5.9.0-rc7-00038-gc53ebf8167e9 #158 [ 158.459296] Hardware name: Generic DT based system [ 158.459529] PC is at fortify_panic+0x18/0x20 [ 158.459658] LR is at __irq_work_queue_local+0x3c/0x74 [ 158.459831] pc : [<8047451c>] lr : [<8020ecd4>] psr: 60000013 [ 158.460032] sp : be2d1d50 ip : be2d1c58 fp : be2d1d5c [ 158.460174] r10: 00000006 r9 : 00000000 r8 : 00000060 [ 158.460348] r7 : 8011e434 r6 : b9e0b800 r5 : 7f000000 r4 : b9fe4f0c [ 158.460557] r3 : 80c04cc8 r2 : 00000000 r1 : be7c03cc r0 : 00000022 [ 158.460801] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 158.461037] Control: 10c5387d Table: b9cd806a DAC: 00000051 [ 158.461251] Process perf (pid: 99, stack limit = 0x81c71a69) [ 158.461472] Stack: (0xbe2d1d50 to 0xbe2d2000) [ 158.461757] 1d40: be2d1d84 be2d1d60 8011e724 80474510 [ 158.462104] 1d60: b9e0b800 b9fe4f0c 00000000 b9fe4f14 80c8ec80 be235000 be2d1d9c be2d1d88 [ 158.462436] 1d80: 801cee44 8011e57c b9fe4f0c 00000000 be2d1dc4 be2d1da0 801d0ad0 801cedec [ 158.462742] 1da0: 00000000 00000000 b9fe4f00 ffffffea 00000000 be235000 be2d1de4 be2d1dc8 [ 158.463087] 1dc0: 80204604 801d0738 00000000 00000000 b9fe4004 ffffffea be2d1e94 be2d1de8 [ 158.463428] 1de0: 80205434 80204570 00385c00 00000000 00000000 00000000 be2d1e14 be2d1e08 [ 158.463880] 1e00: 802ba014 b9fe4f00 b9e718c0 b9fe4f84 b9e71ec8 be2d1e24 00000000 00385c00 [ 158.464365] 1e20: 00000000 626f7270 00000065 802b905c be2d1e94 0000002e 00000000 802b9914 [ 158.464829] 1e40: be2d1e84 be2d1e50 802b9914 8028ff78 804629d0 b9e71ec0 0000002e b9e71ec0 [ 158.465141] 1e60: be2d1ea8 80c04cc8 00000cc0 b9e713c4 00000002 80205834 80205834 0000002e [ 158.465488] 1e80: be235000 be235000 be2d1ea4 be2d1e98 80205854 80204e94 be2d1ecc be2d1ea8 [ 158.465806] 1ea0: 801ee4a0 80205840 00000002 80c04cc8 00000000 0000002e 0000002e 00000000 [ 158.466110] 1ec0: be2d1f0c be2d1ed0 801ee5c8 801ee428 00000000 be2d0000 006b1fd0 00000051 [ 158.466398] 1ee0: 00000000 b9eedf00 0000002e 80204410 006b1fd0 be2d1f60 00000000 00000004 [ 158.466763] 1f00: be2d1f24 be2d1f10 8020442c 801ee4c4 80205834 802c613c be2d1f5c be2d1f28 [ 158.467102] 1f20: 802c60ac 8020441c be2d1fac be2d1f38 8010c764 802e9888 be2d1f5c b9eedf00 [ 158.467447] 1f40: b9eedf00 006b1fd0 0000002e 00000000 be2d1f94 be2d1f60 802c634c 802c5fec [ 158.467812] 1f60: 00000000 00000000 00000000 80c04cc8 006b1fd0 00000003 76f7a610 00000004 [ 158.468155] 1f80: 80100284 be2d0000 be2d1fa4 be2d1f98 802c63ec 802c62e8 00000000 be2d1fa8 [ 158.468508] 1fa0: 80100080 802c63e0 006b1fd0 00000003 00000003 006b1fd0 0000002e 00000000 [ 158.468858] 1fc0: 006b1fd0 00000003 76f7a610 00000004 006b1fb0 0026d348 00000017 7ef2738c [ 158.469202] 1fe0: 76f3431c 7ef272d8 0014ec50 76f34338 60000010 00000003 00000000 00000000 [ 158.469461] Backtrace: [ 158.469683] [<80474504>] (fortify_panic) from [<8011e724>] (arch_prepare_optimized_kprobe+0x1b4/0x1f8) [ 158.470021] [<8011e570>] (arch_prepare_optimized_kprobe) from [<801cee44>] (alloc_aggr_kprobe+0x64/0x70) [ 158.470287] r9:be235000 r8:80c8ec80 r7:b9fe4f14 r6:00000000 r5:b9fe4f0c r4:b9e0b800 [ 158.470478] [<801cede0>] (alloc_aggr_kprobe) from [<801d0ad0>] (register_kprobe+0x3a4/0x5a0) [ 158.470685] r5:00000000 r4:b9fe4f0c [ 158.470790] [<801d072c>] (register_kprobe) from [<80204604>] (__register_trace_kprobe+0xa0/0xa4) [ 158.471001] r9:be235000 r8:00000000 r7:ffffffea r6:b9fe4f00 r5:00000000 r4:00000000 [ 158.471188] [<80204564>] (__register_trace_kprobe) from [<80205434>] (trace_kprobe_create+0x5ac/0x9ac) [ 158.471408] r7:ffffffea r6:b9fe4004 r5:00000000 r4:00000000 [ 158.471553] [<80204e88>] (trace_kprobe_create) from [<80205854>] (create_or_delete_trace_kprobe+0x20/0x3c) [ 158.471766] r10:be235000 r9:be235000 r8:0000002e r7:80205834 r6:80205834 r5:00000002 [ 158.471949] r4:b9e713c4 [ 158.472027] [<80205834>] (create_or_delete_trace_kprobe) from [<801ee4a0>] (trace_run_command+0x84/0x9c) [ 158.472255] [<801ee41c>] (trace_run_command) from [<801ee5c8>] (trace_parse_run_command+0x110/0x1f8) [ 158.472471] r6:00000000 r5:0000002e r4:0000002e [ 158.472594] [<801ee4b8>] (trace_parse_run_command) from [<8020442c>] (probes_write+0x1c/0x28) [ 158.472800] r10:00000004 r9:00000000 r8:be2d1f60 r7:006b1fd0 r6:80204410 r5:0000002e [ 158.472968] r4:b9eedf00 [ 158.473046] [<80204410>] (probes_write) from [<802c60ac>] (vfs_write+0xcc/0x1e8) [ 158.473226] [<802c5fe0>] (vfs_write) from [<802c634c>] (ksys_write+0x70/0xf8) [ 158.473400] r8:00000000 r7:0000002e r6:006b1fd0 r5:b9eedf00 r4:b9eedf00 [ 158.473567] [<802c62dc>] (ksys_write) from [<802c63ec>] (sys_write+0x18/0x1c) [ 158.473745] r9:be2d0000 r8:80100284 r7:00000004 r6:76f7a610 r5:00000003 r4:006b1fd0 [ 158.473932] [<802c63d4>] (sys_write) from [<80100080>] (ret_fast_syscall+0x0/0x54) [ 158.474126] Exception stack(0xbe2d1fa8 to 0xbe2d1ff0) [ 158.474305] 1fa0: 006b1fd0 00000003 00000003 006b1fd0 0000002e 00000000 [ 158.474573] 1fc0: 006b1fd0 00000003 76f7a610 00000004 006b1fb0 0026d348 00000017 7ef2738c [ 158.474811] 1fe0: 76f3431c 7ef272d8 0014ec50 76f34338 [ 158.475171] Code: e24cb004 e1a01000 e59f0004 ebf40dd3 (e7f001f2) [ 158.475847] ---[ end trace 55a5b31c08a29f00 ]--- [ 158.476088] Kernel panic - not syncing: Fatal exception [ 158.476375] CPU0: stopping [ 158.476709] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G D 5.9.0-rc7-00038-gc53ebf8167e9 #158 [ 158.477176] Hardware name: Generic DT based system [ 158.477411] Backtrace: [ 158.477604] [<8010dd28>] (dump_backtrace) from [<8010dfd4>] (show_stack+0x20/0x24) [ 158.477990] r7:00000000 r6:60000193 r5:00000000 r4:80c2f634 [ 158.478323] [<8010dfb4>] (show_stack) from [<8046390c>] (dump_stack+0xcc/0xe8) [ 158.478686] [<80463840>] (dump_stack) from [<80110750>] (handle_IPI+0x334/0x3a0) [ 158.479063] r7:00000000 r6:00000004 r5:80b65cc8 r4:80c78278 [ 158.479352] [<8011041c>] (handle_IPI) from [<801013f8>] (gic_handle_irq+0x88/0x94) [ 158.479757] r10:10c5387d r9:80c01ed8 r8:00000000 r7:c0802000 r6:80c0537c r5:000003ff [ 158.480146] r4:c080200c r3:fffffff4 [ 158.480364] [<80101370>] (gic_handle_irq) from [<80100b6c>] (__irq_svc+0x6c/0x90) [ 158.480748] Exception stack(0x80c01ed8 to 0x80c01f20) [ 158.481031] 1ec0: 000128bc 00000000 [ 158.481499] 1ee0: be7b8174 8011d3a0 80c00000 00000000 80c04cec 80c04d28 80c5d7c2 80a026d4 [ 158.482091] 1f00: 10c5387d 80c01f34 80c01f38 80c01f28 80109554 80109558 60000013 ffffffff [ 158.482621] r9:80c00000 r8:80c5d7c2 r7:80c01f0c r6:ffffffff r5:60000013 r4:80109558 [ 158.482983] [<80109518>] (arch_cpu_idle) from [<80818780>] (default_idle_call+0x38/0x120) [ 158.483360] [<80818748>] (default_idle_call) from [<801585a8>] (do_idle+0xd4/0x158) [ 158.483945] r5:00000000 r4:80c00000 [ 158.484237] [<801584d4>] (do_idle) from [<801588f4>] (cpu_startup_entry+0x28/0x2c) [ 158.484784] r9:80c78000 r8:00000000 r7:80c78000 r6:80c78040 r5:80c04cc0 r4:000000d6 [ 158.485328] [<801588cc>] (cpu_startup_entry) from [<80810a78>] (rest_init+0x9c/0xbc) [ 158.485930] [<808109dc>] (rest_init) from [<80b00ae4>] (arch_call_rest_init+0x18/0x1c) [ 158.486503] r5:80c04cc0 r4:00000001 [ 158.486857] [<80b00acc>] (arch_call_rest_init) from [<80b00fcc>] (start_kernel+0x46c/0x548) [ 158.487589] [<80b00b60>] (start_kernel) from [<00000000>] (0x0) ```
--- arch/arm/include/asm/kprobes.h | 22 +++++++++++----------- arch/arm/probes/kprobes/opt-arm.c | 18 +++++++++--------- 2 files changed, 20 insertions(+), 20 deletions(-)
arch/arm/include/asm/kprobes.h +11 -11
@@ -44,20 +44,20 @@ int kprobe_exceptions_notify(struct notifier_block *self, unsigned long val, void *data);/* optinsn template addresses */ -extern __visible kprobe_opcode_t optprobe_template_entry; -extern __visible kprobe_opcode_t optprobe_template_val; -extern __visible kprobe_opcode_t optprobe_template_call; -extern __visible kprobe_opcode_t optprobe_template_end; -extern __visible kprobe_opcode_t optprobe_template_sub_sp; -extern __visible kprobe_opcode_t optprobe_template_add_sp; -extern __visible kprobe_opcode_t optprobe_template_restore_begin; -extern __visible kprobe_opcode_t optprobe_template_restore_orig_insn; -extern __visible kprobe_opcode_t optprobe_template_restore_end; +extern __visible kprobe_opcode_t optprobe_template_entry[]; +extern __visible kprobe_opcode_t optprobe_template_val[]; +extern __visible kprobe_opcode_t optprobe_template_call[]; +extern __visible kprobe_opcode_t optprobe_template_end[]; +extern __visible kprobe_opcode_t optprobe_template_sub_sp[]; +extern __visible kprobe_opcode_t optprobe_template_add_sp[]; +extern __visible kprobe_opcode_t optprobe_template_restore_begin[]; +extern __visible kprobe_opcode_t optprobe_template_restore_orig_insn[]; +extern __visible kprobe_opcode_t optprobe_template_restore_end[];#define MAX_OPTIMIZED_LENGTH 4#define MAX_OPTINSN_SIZE \ - ((unsigned long)&optprobe_template_end - \ - (unsigned long)&optprobe_template_entry) + ((unsigned long)optprobe_template_end - \ + (unsigned long)optprobe_template_entry)#define RELATIVEJUMP_SIZE 4struct arch_optimized_insn {
arch/arm/probes/kprobes/opt-arm.c +9 -9
@@ -85,21 +85,21 @@ asm ( "optprobe_template_end:\n");#define TMPL_VAL_IDX \ - ((unsigned long *)&optprobe_template_val - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_val - (unsigned long *)optprobe_template_entry)#define TMPL_CALL_IDX \ - ((unsigned long *)&optprobe_template_call - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_call - (unsigned long *)optprobe_template_entry)#define TMPL_END_IDX \ - ((unsigned long *)&optprobe_template_end - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_end - (unsigned long *)optprobe_template_entry)#define TMPL_ADD_SP \ - ((unsigned long *)&optprobe_template_add_sp - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_add_sp - (unsigned long *)optprobe_template_entry)#define TMPL_SUB_SP \ - ((unsigned long *)&optprobe_template_sub_sp - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_sub_sp - (unsigned long *)optprobe_template_entry)#define TMPL_RESTORE_BEGIN \ - ((unsigned long *)&optprobe_template_restore_begin - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_restore_begin - (unsigned long *)optprobe_template_entry)#define TMPL_RESTORE_ORIGN_INSN \ - ((unsigned long *)&optprobe_template_restore_orig_insn - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_restore_orig_insn - (unsigned long *)optprobe_template_entry)#define TMPL_RESTORE_END \ - ((unsigned long *)&optprobe_template_restore_end - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_restore_end - (unsigned long *)optprobe_template_entry)/* * ARM can always optimize an instruction when using ARM ISA, except
@@ -234,7 +234,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, struct kprobe *or }/* Copy arch-dep-instance from template. */ -memcpy (code, (unsigned long *)&optprobe_template_entry, +memcpy (code, (unsigned long *)optprobe_template_entry,TMPL_END_IDX *sizeof (kprobe_opcode_t));/* Adjust buffer according to instruction. */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 132/255 bpf: Dont rely on GCC __attribute__((optimize)) to disable GCSE
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
[ Upstream commit 080b6f40763565f65ebb9540219c71ce885cf568 ]
Commit 3193c0836 ("bpf: Disable GCC -fgcse optimization for ___bpf_prog_run()") introduced a __no_fgcse macro that expands to a function scope __attribute__((optimize("-fno-gcse"))), to disable a GCC specific optimization that was causing trouble on x86 builds, and was not expected to have any positive effect in the first place.
However, as the GCC manual documents, __attribute__((optimize)) is not for production use, and results in all other optimization options to be forgotten for the function in question. This can cause all kinds of trouble, but in one particular reported case, it causes -fno-asynchronous-unwind-tables to be disregarded, resulting in .eh_frame info to be emitted for the function.
This reverts commit 3193c0836, and instead, it disables the -fgcse optimization for the entire source file, but only when building for X86 using GCC with CONFIG_BPF_JIT_ALWAYS_ON disabled. Note that the original commit states that CONFIG_RETPOLINE=n triggers the issue, whereas CONFIG_RETPOLINE=y performs better without the optimization, so it is kept disabled in both cases.
--- include/linux/compiler-gcc.h | 2 -- include/linux/compiler_types.h | 4 ---- kernel/bpf/Makefile | 6 +++++- kernel/bpf/core.c | 2 +- 4 files changed, 6 insertions(+), 8 deletions(-)
include/linux/compiler-gcc.h +0 -2
@@ -175,5 +175,3 @@#else #define __diag_GCC_8 (s)#endif - -#define __no_fgcse __attribute__((optimize("-fno-gcse")))
include/linux/compiler_types.h +0 -4
@@ -247,10 +247,6 @@ struct ftrace_likely_data {#define asm_inline asm#endif -#ifndef __no_fgcse -# define __no_fgcse -#endif -/* Are two types/vars the same type (ignoring qualifiers)? */ #define __same_type (a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
kernel/bpf/Makefile +5 -1
@@ -1,6 +1,10 @@ # SPDX-License-Identifier: GPL-2.0 obj-y := core.o -CFLAGS_core.o += $(call cc-disable-warning, override-init) +ifneq ($(CONFIG_BPF_JIT_ALWAYS_ON),y) +# ___bpf_prog_run() needs GCSE disabled on x86; see 3193c0836f203 for details +cflags-nogcse-$(CONFIG_X86)$(CONFIG_CC_IS_GCC) := -fno-gcse +endif +CFLAGS_core.o += $(call cc-disable-warning, override-init) $(cflags-nogcse-yy) obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o bpf_iter.o map_iter.o task_iter.o prog_iter.o obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o percpu_freelist.o bpf_lru_list.o lpm_trie.o map_in_map.o
kernel/bpf/core.c +1 -1
@@ -1364,7 +1364,7 @@ u64 __weak bpf_probe_read_kernel(void *dst, u32 size, const void *unsafe_ptr)* * Decode and execute eBPF instructions. */ -static u64 __no_fgcse ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack) +static u64 ___bpf_prog_run (u64 *regs,const struct bpf_insn *insn,u64 *stack) {#define BPF_INSN_2_LBL (x, y) [BPF_##x | BPF_##y] = &&x##_##y#define BPF_INSN_3_LBL (x, y, z) [BPF_##x | BPF_##y | BPF_##z] = &&x##_##y##_##z
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 133/255 libbpf, hashmap: Fix undefined behavior in hash_bits
In reply to Greg Kroah-HartmanFrom: Ian Rogers <[email protected]>
[ Upstream commit 7a078d2d18801bba7bde7337a823d7342299acf7 ]
If bits is 0, the case when the map is empty, then the >> is the size of the register which is undefined behavior - on x86 it is the same as a shift by 0.
Fix by handling the 0 case explicitly and guarding calls to hash_bits for empty maps in hashmap__for_each_key_entry and hashmap__for_each_entry_safe.
--- tools/lib/bpf/hashmap.h | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
tools/lib/bpf/hashmap.h +9 -6
@@ -15,6 +15,9 @@static inline size_t hash_bits (size_t h,int bits) {/* shuffle bits and return requested number of upper bits */ +if (bits ==0 ) +return 0 ; +#if (__SIZEOF_SIZE_T__ == __SIZEOF_LONG_LONG__)/* LP64 case */ return (h *11400714819323198485llu ) >> (__SIZEOF_LONG_LONG__ *8 - bits);
@@ -162,17 +165,17 @@ bool hashmap__find(const struct hashmap *map, const void *key, void **value);* @key: key to iterate entries for */ #define hashmap__for_each_key_entry (map, cur, _key) \ - for (cur = ({ size_t bkt = hash_bits(map->hash_fn((_key), map->ctx),\ - map->cap_bits); \ - map->buckets ? map->buckets[bkt] : NULL; }); \ + for (cur = map->buckets \ + ? map->buckets[hash_bits(map->hash_fn((_key), map->ctx), map->cap_bits)] \ + : NULL; \ cur; \ cur = cur->next) \ if (map->equal_fn(cur->key, (_key), map->ctx))#define hashmap__for_each_key_entry_safe (map, cur, tmp, _key) \ - for (cur = ({ size_t bkt = hash_bits(map->hash_fn((_key), map->ctx),\ - map->cap_bits); \ - cur = map->buckets ? map->buckets[bkt] : NULL; }); \ + for (cur = map->buckets \ + ? map->buckets[hash_bits(map->hash_fn((_key), map->ctx), map->cap_bits)] \ + : NULL; \ cur && ({ tmp = cur->next; true; }); \ cur = tmp) \ if (map->equal_fn(cur->key, (_key), map->ctx))
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 134/255 pinctrl: mcp23s08: Use full chunk of memory for regmap configuration
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 2b12c13637134897ba320bd8906a8d918ee7069b ]
It appears that simplification of mcp23s08_spi_regmap_init() made a regression due to wrong size calculation for dev_kmemdup() call. It misses the fact that config variable is already a pointer, thus the sizeof() calculation is wrong and only 4 or 8 bytes were copied.
Fix the parameters to devm_kmemdup() to copy a full chunk of memory.
--- drivers/pinctrl/pinctrl-mcp23s08_spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/pinctrl-mcp23s08_spi.c +1 -1
@@ -119,7 +119,7 @@ static int mcp23s08_spi_regmap_init(struct mcp23s08 *mcp, struct device *dev,return -EINVAL ; } - copy =devm_kmemdup (dev, &config,sizeof (config),GFP_KERNEL ); + copy =devm_kmemdup (dev, config,sizeof (*config),GFP_KERNEL );if (!copy)return -ENOMEM ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 135/255 pinctrl: aspeed: Fix GPI only function problem.
In reply to Greg Kroah-HartmanFrom: Billy Tsai <[email protected]>
[ Upstream commit 9b92f5c51e9a41352d665f6f956bd95085a56a83 ]
Some gpio pin at aspeed soc is input only and the prefix name of these pin is "GPI" only.
This patch fine-tune the condition of GPIO check from "GPIO" to "GPI" and it will fix the usage error of banks D and E in the AST2400/AST2500 and banks T and U in the AST2600.
--- drivers/pinctrl/aspeed/pinctrl-aspeed.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/pinctrl/aspeed/pinctrl-aspeed.c +4 -3
@@ -286,13 +286,14 @@ int aspeed_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned int function,static bool aspeed_expr_is_gpio (const struct aspeed_sig_expr *expr) {/* -* The signal type is GPIO if the signal name has "GPIO" as a prefix. +* The signal type is GPIO if the signal name has "GPI" as a prefix. * strncmp (rather than strcmp) is used to implement the prefix * requirement. * -* expr->signal might look like "GPIOT3" in the GPIO case. +* expr->signal might look like "GPIOB1" in the GPIO case. +* expr->signal might look like "GPIT0" in the GPI case. */ -return strncmp (expr->signal,"GPIO" ,4 ) ==0 ; +return strncmp (expr->signal,"GPI" ,3 ) ==0 ; }static bool aspeed_gpio_in_exprs (const struct aspeed_sig_expr **exprs)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 136/255 net/mlx5e: Fix modify header actions memory leak
In reply to Greg Kroah-HartmanFrom: Maor Dickman <[email protected]>
[ Upstream commit e68e28b4a9d71261e3f8fd05a72d6cf0b443a493 ]
Modify header actions are allocated during parse tc actions and only freed during the flow creation, however, on error flow the allocated memory is wrongly unfreed.
Fix this by calling dealloc_mod_hdr_actions in __mlx5e_add_fdb_flow and mlx5e_add_nic_flow error flow.
--- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +2 -0
@@ -4430,6 +4430,7 @@ __mlx5e_add_fdb_flow(struct mlx5e_priv *priv,return flow; err_free: +dealloc_mod_hdr_actions (&parse_attr->mod_hdr_acts);mlx5e_flow_put (priv, flow); out:return ERR_PTR (err);
@@ -4564,6 +4565,7 @@ mlx5e_add_nic_flow(struct mlx5e_priv *priv,return 0 ; err_free: +dealloc_mod_hdr_actions (&parse_attr->mod_hdr_acts);mlx5e_flow_put (priv, flow);kvfree (parse_attr); out:
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 137/255 net/mlx5e: Protect encap route dev from concurrent release
In reply to Greg Kroah-HartmanFrom: Vlad Buslov <[email protected]>
[ Upstream commit 78c906e430b13d30a8cfbdef4ccbbe1686841a9e ]
In functions mlx5e_route_lookup_ipv{4|6}() route_dev can be arbitrary net device and not necessary mlx5 eswitch port representor. As such, in order to ensure that route_dev is not destroyed concurrent the code needs either explicitly take reference to the device before releasing reference to rtable instance or ensure that caller holds rtnl lock. First approach is chosen as a fix since rtnl lock dependency was intentionally removed from mlx5 TC layer.
To prevent unprotected usage of route_dev in encap code take a reference to the device before releasing rt. Don't save direct pointer to the device in mlx5_encap_entry structure and use ifindex instead. Modify users of route_dev pointer to properly obtain the net device instance from its ifindex.
--- .../ethernet/mellanox/mlx5/core/en/rep/tc.c | 6 +- .../ethernet/mellanox/mlx5/core/en/tc_tun.c | 72 ++++++++++++------- .../net/ethernet/mellanox/mlx5/core/en_rep.h | 2 +- 3 files changed, 52 insertions(+), 28 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c +5 -1
@@ -107,12 +107,16 @@ void mlx5e_rep_update_flows(struct mlx5e_priv *priv,mlx5e_tc_encap_flows_del (priv, e, &flow_list);if (neigh_connected && !(e->flags &MLX5_ENCAP_ENTRY_VALID )) { +struct net_device *route_dev; +ether_addr_copy (e->h_dest, ha);ether_addr_copy (eth->h_dest, ha);/* Update the encap source mac, in case that we delete * the flows when encap source mac changed. */ -ether_addr_copy (eth->h_source, e->route_dev->dev_addr); + route_dev =__dev_get_by_index (dev_net (priv->netdev), e->route_dev_ifindex); +if (route_dev) +ether_addr_copy (eth->h_source, route_dev->dev_addr);mlx5e_tc_encap_flows_add (priv, e, &flow_list); }
drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c +46 -26
161 lines not on this page · raw message
drivers/net/ethernet/mellanox/mlx5/core/en_rep.h +1 -1
@@ -187,7 +187,7 @@ struct mlx5e_encap_entry {unsigned char h_dest[ETH_ALEN ];/* destination eth addr */ struct net_device *out_dev; -struct net_device *route_dev; +int route_dev_ifindex;struct mlx5e_tc_tunnel *tunnel;int reformat_type;u8 flags;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 138/255 net/mlx5e: Use spin_lock_bh for async_icosq_lock
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit f42139ba49791ab6b12443c60044872705b74a1e ]
async_icosq_lock may be taken from softirq and non-softirq contexts. It requires protection with spin_lock_bh, otherwise a softirq may be triggered in the middle of the critical section, and it may deadlock if it tries to take the same lock. This patch fixes such a scenario by using spin_lock_bh to disable softirqs on that CPU while inside the critical section.
--- .../net/ethernet/mellanox/mlx5/core/en/xsk/setup.c | 4 ++-- .../net/ethernet/mellanox/mlx5/core/en/xsk/tx.c | 4 ++-- .../ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c | 14 +++++++------- 3 files changed, 11 insertions(+), 11 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c +2 -2
@@ -122,9 +122,9 @@ void mlx5e_activate_xsk(struct mlx5e_channel *c)set_bit (MLX5E_RQ_STATE_ENABLED , &c->xskrq.state);/* TX queue is created active. */ -spin_lock (&c->async_icosq_lock); +spin_lock_bh (&c->async_icosq_lock);mlx5e_trigger_irq (&c->async_icosq); -spin_unlock (&c->async_icosq_lock); +spin_unlock_bh (&c->async_icosq_lock); }void mlx5e_deactivate_xsk (struct mlx5e_channel *c)
drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c +2 -2
@@ -36,9 +36,9 @@ int mlx5e_xsk_wakeup(struct net_device *dev, u32 qid, u32 flags)if (test_and_set_bit (MLX5E_SQ_STATE_PENDING_XSK_TX , &c->async_icosq.state))return 0 ; -spin_lock (&c->async_icosq_lock); +spin_lock_bh (&c->async_icosq_lock);mlx5e_trigger_irq (&c->async_icosq); -spin_unlock (&c->async_icosq_lock); +spin_unlock_bh (&c->async_icosq_lock); }return 0 ;
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c +7 -7
@@ -188,7 +188,7 @@ static int post_rx_param_wqes(struct mlx5e_channel *c, err =0 ; sq = &c->async_icosq; -spin_lock (&c->async_icosq_lock); +spin_lock_bh (&c->async_icosq_lock); cseg =post_static_params (sq, priv_rx);if (IS_ERR (cseg))
@@ -199,7 +199,7 @@ static int post_rx_param_wqes(struct mlx5e_channel *c,mlx5e_notify_hw (&sq->wq, sq->pc, sq->uar_map, cseg); unlock: -spin_unlock (&c->async_icosq_lock); +spin_unlock_bh (&c->async_icosq_lock);return err;
@@ -265,10 +265,10 @@ resync_post_get_progress_params(struct mlx5e_icosq *sq,BUILD_BUG_ON (MLX5E_KTLS_GET_PROGRESS_WQEBBS !=1 ); -spin_lock (&sq->channel->async_icosq_lock); +spin_lock_bh (&sq->channel->async_icosq_lock);if (unlikely (!mlx5e_wqc_has_room_for (&sq->wq, sq->cc, sq->pc,1 ))) { -spin_unlock (&sq->channel->async_icosq_lock); +spin_unlock_bh (&sq->channel->async_icosq_lock); err = -ENOSPC ; goto err_dma_unmap; }
@@ -299,7 +299,7 @@ resync_post_get_progress_params(struct mlx5e_icosq *sq,icosq_fill_wi (sq, pi, &wi); sq->pc++;mlx5e_notify_hw (&sq->wq, sq->pc, sq->uar_map, cseg); -spin_unlock (&sq->channel->async_icosq_lock); +spin_unlock_bh (&sq->channel->async_icosq_lock);return 0 ;
@@ -360,7 +360,7 @@ static int resync_handle_seq_match(struct mlx5e_ktls_offload_context_rx *priv_rx err =0 ; sq = &c->async_icosq; -spin_lock (&c->async_icosq_lock); +spin_lock_bh (&c->async_icosq_lock); cseg =post_static_params (sq, priv_rx);if (IS_ERR (cseg)) {
@@ -372,7 +372,7 @@ static int resync_handle_seq_match(struct mlx5e_ktls_offload_context_rx *priv_rxmlx5e_notify_hw (&sq->wq, sq->pc, sq->uar_map, cseg); priv_rx->stats->tls_resync_res_ok++; unlock: -spin_unlock (&c->async_icosq_lock); +spin_unlock_bh (&c->async_icosq_lock);return err; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 139/255 net/mlx5: Fix deletion of duplicate rules
In reply to Greg Kroah-HartmanFrom: Maor Gottlieb <[email protected]>
[ Upstream commit 465e7baab6d93b399344f5868f84c177ab5cd16f ]
When a rule is duplicated, the refcount of the rule is increased so only the second deletion of the rule should cause destruction of the FTE. Currently, the FTE will be destroyed in the first deletion of rule since the modify_mask will be 0.
Fix it and call to destroy FTE only if all the rules (FTE's children) have been removed.
--- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +4 -3
@@ -1994,10 +1994,11 @@ void mlx5_del_flow_rules(struct mlx5_flow_handle *handle)down_write_ref_node (&fte->node, false);for (i = handle->num_rules -1 ; i >=0 ; i--)tree_remove_node (&handle->rule[i]->node, true); -if (fte->modify_mask && fte->dests_size) { -modify_fte (fte); +if (fte->dests_size) { +if (fte->modify_mask) +modify_fte (fte);up_write_ref_node (&fte->node, false); - }else { + }else if (list_empty (&fte->node.children)) {del_hw_fte (&fte->node);/* Avoid double call to del_hw_fte */ fte->node.del_hw_func =NULL ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 140/255 net/mlx5: E-switch, Avoid extack error log for disabled vport
In reply to Greg Kroah-HartmanFrom: Parav Pandit <[email protected]>
[ Upstream commit ae35859445607f7f18dd4f332749219cd636ed59 ]
When E-switch vport is disabled, querying its hardware address is unsupported.
Avoid setting extack error log message in such case.
--- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +0 -2
@@ -1902,8 +1902,6 @@ int mlx5_devlink_port_function_hw_addr_get(struct devlink *devlink,ether_addr_copy (hw_addr, vport->info.mac); *hw_addr_len =ETH_ALEN ; err =0 ; - }else { -NL_SET_ERR_MSG_MOD (extack,"Eswitch vport is disabled" ); }mutex_unlock (&esw->state_lock);return err;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 141/255 net/mlx5e: Fix VXLAN synchronization after function reload
In reply to Greg Kroah-HartmanFrom: Aya Levin <[email protected]>
[ Upstream commit c5eb51adf06b2644fa28d4af886bfdcc53e288da ]
During driver reload, perform firmware tear-down which results in firmware losing the configured VXLAN ports. These ports are still available in the driver's database. Fix this by cleaning up driver's VXLAN database in the nic unload flow, before firmware tear-down. With that, minimize mlx5_vxlan_destroy() to remove only what was added in mlx5_vxlan_create() and warn on leftover UDP ports.
--- .../net/ethernet/mellanox/mlx5/core/en_main.c | 1 + .../ethernet/mellanox/mlx5/core/lib/vxlan.c | 23 ++++++++++++++----- .../ethernet/mellanox/mlx5/core/lib/vxlan.h | 2 ++ 3 files changed, 20 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +1 -0
@@ -5226,6 +5226,7 @@ static void mlx5e_nic_disable(struct mlx5e_priv *priv)mlx5e_disable_async_events (priv);mlx5_lag_remove (mdev); +mlx5_vxlan_reset_to_default (mdev->vxlan); }int mlx5e_update_nic_rx (struct mlx5e_priv *priv)
drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.c +17 -6
@@ -167,6 +167,17 @@ struct mlx5_vxlan *mlx5_vxlan_create(struct mlx5_core_dev *mdev) }void mlx5_vxlan_destroy (struct mlx5_vxlan *vxlan) +{ +if (!mlx5_vxlan_allowed (vxlan)) +return ; + +mlx5_vxlan_del_port (vxlan,IANA_VXLAN_UDP_PORT ); +WARN_ON (!hash_empty (vxlan->htable)); + +kfree (vxlan); +} + +void mlx5_vxlan_reset_to_default (struct mlx5_vxlan *vxlan) {struct mlx5_vxlan_port *vxlanp;struct hlist_node *tmp;
@@ -175,12 +186,12 @@ void mlx5_vxlan_destroy(struct mlx5_vxlan *vxlan)if (!mlx5_vxlan_allowed (vxlan))return ; -/* Lockless since we are the only hash table consumers*/ hash_for_each_safe (vxlan->htable, bkt, tmp, vxlanp, hlist) { -hash_del (&vxlanp->hlist); -mlx5_vxlan_core_del_port_cmd (vxlan->mdev, vxlanp->udp_port); -kfree (vxlanp); +/* Don't delete default UDP port added by the HW. +* Remove only user configured ports +*/ +if (vxlanp->udp_port ==IANA_VXLAN_UDP_PORT ) +continue ; +mlx5_vxlan_del_port (vxlan, vxlanp->udp_port); } - -kfree (vxlan); }
drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.h +2 -0
@@ -56,6 +56,7 @@ void mlx5_vxlan_destroy(struct mlx5_vxlan *vxlan);int mlx5_vxlan_add_port (struct mlx5_vxlan *vxlan,u16 port);int mlx5_vxlan_del_port (struct mlx5_vxlan *vxlan,u16 port);bool mlx5_vxlan_lookup_port (struct mlx5_vxlan *vxlan,u16 port); +void mlx5_vxlan_reset_to_default (struct mlx5_vxlan *vxlan);#else static inline struct mlx5_vxlan *mlx5_vxlan_create (struct mlx5_core_dev *mdev) {return ERR_PTR (-EOPNOTSUPP ); }
@@ -63,6 +64,7 @@ static inline void mlx5_vxlan_destroy(struct mlx5_vxlan *vxlan) { return; }static inline int mlx5_vxlan_add_port (struct mlx5_vxlan *vxlan,u16 port) {return -EOPNOTSUPP ; }static inline int mlx5_vxlan_del_port (struct mlx5_vxlan *vxlan,u16 port) {return -EOPNOTSUPP ; }static inline bool mlx5_vxlan_lookup_port (struct mlx5_vxlan *vxlan,u16 port) {return false; } +static inline void mlx5_vxlan_reset_to_default (struct mlx5_vxlan *vxlan) {return ; }#endif #endif /* __MLX5_VXLAN_H__ */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 142/255 net/mlx5e: Fix incorrect access of RCU-protected xdp_prog
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit 1a50cf9a67ff2241c2949d30bc11c8dd4280eef8 ]
rq->xdp_prog is RCU-protected and should be accessed only with rcu_access_pointer for the NULL check in mlx5e_poll_rx_cq.
rq->xdp_prog may change on the fly only from one non-NULL value to another non-NULL value, so the checks in mlx5e_xdp_handle and mlx5e_poll_rx_cq will have the same result during one NAPI cycle, meaning that no additional synchronization is needed.
--- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +1 -1
@@ -1566,7 +1566,7 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget) }while ((++work_done < budget) && (cqe =mlx5_cqwq_get_cqe (cqwq))); out: -if (rq->xdp_prog) +if (rcu_access_pointer (rq->xdp_prog))mlx5e_xdp_rx_poll_complete (rq);mlx5_cqwq_update_db_record (cqwq);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 143/255 SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow()
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
[ Upstream commit d321ff589c16d8c2207485a6d7fbdb14e873d46e ]
The TP_fast_assign() section is careful enough not to dereference xdr->rqst if it's NULL. The TP_STRUCT__entry section is not.
--- include/trace/events/sunrpc.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
include/trace/events/sunrpc.h +4 -4
@@ -607,10 +607,10 @@ TRACE_EVENT(rpc_xdr_overflow, __field(size_t, tail_len) __field(unsigned int, page_len) __field(unsigned int, len) - __string(progname, - xdr->rqst->rq_task->tk_client->cl_program->name) - __string(procedure, - xdr->rqst->rq_task->tk_msg.rpc_proc->p_name) + __string(progname, xdr->rqst ? + xdr->rqst->rq_task->tk_client->cl_program->name : "unknown") + __string(procedure, xdr->rqst ? + xdr->rqst->rq_task->tk_msg.rpc_proc->p_name : "unknown") ), TP_fast_assign(
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 144/255 NFSD: Fix use-after-free warning when doing inter-server copy
In reply to Greg Kroah-HartmanFrom: Dai Ngo <[email protected]>
[ Upstream commit 36e1e5ba90fb3fba6888fae26e4dfc28bf70aaf1 ]
The source file nfsd_file is not constructed the same as other nfsd_file's via nfsd_file_alloc. nfsd_file_put should not be called to free the object; nfsd_file_put is not the inverse of kzalloc, instead kfree is called by nfsd4_do_async_copy when done.
--- fs/nfsd/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4proc.c +1 -1
@@ -1299,7 +1299,7 @@ nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct nfsd_file *src, struct nfsd_file *dst) {nfs42_ssc_close (src->nf_file); -nfsd_file_put (src); +/* 'src' is freed by nfsd4_do_async_copy */ nfsd_file_put (dst);mntput (ss_mnt); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 145/255 NFSD: fix missing refcount in nfsd4_copy by nfsd4_do_async_copy
In reply to Greg Kroah-HartmanFrom: Dai Ngo <[email protected]>
[ Upstream commit 49a361327332c9221438397059067f9b205f690d ]
Need to initialize nfsd4_copy's refcount to 1 to avoid use-after-free warning when nfs4_put_copy is called from nfsd4_cb_offload_release.
--- fs/nfsd/nfs4proc.c | 1 + 1 file changed, 1 insertion(+)
fs/nfsd/nfs4proc.c +1 -0
@@ -1486,6 +1486,7 @@ do_callback: cb_copy =kzalloc (sizeof (struct nfsd4_copy ),GFP_KERNEL );if (!cb_copy) goto out; +refcount_set (&cb_copy->refcount,1 );memcpy (&cb_copy->cp_res, ©->cp_res,sizeof (copy->cp_res)); cb_copy->cp_clp = copy->cp_clp; cb_copy->nfserr = copy->nfserr;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 146/255 tools/bpftool: Fix attaching flow dissector
In reply to Greg Kroah-HartmanFrom: Lorenz Bauer <[email protected]>
[ Upstream commit f9b7ff0d7f7a466a920424246e7ddc2b84c87e52 ]
My earlier patch to reject non-zero arguments to flow dissector attach broke attaching via bpftool. Instead of 0 it uses -1 for target_fd. Fix this by passing a zero argument when attaching the flow dissector.
--- tools/bpf/bpftool/prog.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/bpf/bpftool/prog.c +1 -1
@@ -741,7 +741,7 @@ static int parse_attach_detach_args(int argc, char **argv, int *progfd, }if (*attach_type ==BPF_FLOW_DISSECTOR ) { - *mapfd =-1 ; + *mapfd =0 ;return 0 ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 147/255 bpf: Zero-fill re-used per-cpu map element
In reply to Greg Kroah-HartmanFrom: David Verbeiren <[email protected]>
[ Upstream commit d3bec0138bfbe58606fc1d6f57a4cdc1a20218db ]
Zero-fill element values for all other cpus than current, just as when not using prealloc. This is the only way the bpf program can ensure known initial values for all cpus ('onallcpus' cannot be set when coming from the bpf program).
The scenario is: bpf program inserts some elements in a per-cpu map, then deletes some (or userspace does). When later adding new elements using bpf_map_update_elem(), the bpf program can only set the value of the new elements for the current cpu. When prealloc is enabled, previously deleted elements are re-used. Without the fix, values for other cpus remain whatever they were when the re-used entry was previously freed.
A selftest is added to validate correct operation in above scenario as well as in case of LRU per-cpu map element re-use.
--- kernel/bpf/hashtab.c | 30 ++- .../selftests/bpf/prog_tests/map_init.c | 214 ++++++++++++++++++ .../selftests/bpf/progs/test_map_init.c | 33 +++ 3 files changed, 275 insertions(+), 2 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/map_init.c create mode 100644 tools/testing/selftests/bpf/progs/test_map_init.c
kernel/bpf/hashtab.c +28 -2
@@ -821,6 +821,32 @@ static void pcpu_copy_value(struct bpf_htab *htab, void __percpu *pptr, } } +static void pcpu_init_value (struct bpf_htab *htab,void __percpu *pptr, +void *value,bool onallcpus) +{ +/* When using prealloc and not setting the initial value on all cpus, +* zero-fill element values for other cpus (just as what happens when +* not using prealloc). Otherwise, bpf program has no way to ensure +* known initial values for cpus other than current one +* (onallcpus=false always when coming from bpf prog). +*/ +if (htab_is_prealloc (htab) && !onallcpus) { +u32 size =round_up (htab->map.value_size,8 ); +int current_cpu =raw_smp_processor_id (); +int cpu; + +for_each_possible_cpu (cpu) { +if (cpu == current_cpu) +bpf_long_memcpy (per_cpu_ptr (pptr, cpu), value, + size); +else +memset (per_cpu_ptr (pptr, cpu),0 , size); + } + }else { +pcpu_copy_value (htab, pptr, value, onallcpus); + } +} +static bool fd_htab_map_needs_adjust (const struct bpf_htab *htab) { return htab->map.map_type == BPF_MAP_TYPE_HASH_OF_MAPS &&
@@ -891,7 +917,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, } } -pcpu_copy_value (htab, pptr, value, onallcpus); +pcpu_init_value (htab, pptr, value, onallcpus);if (!prealloc)htab_elem_set_ptr (l_new, key_size, pptr);
@@ -1183,7 +1209,7 @@ static int __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,pcpu_copy_value (htab,htab_elem_get_ptr (l_old, key_size), value, onallcpus); }else { -pcpu_copy_value (htab,htab_elem_get_ptr (l_new, key_size), +pcpu_init_value (htab,htab_elem_get_ptr (l_new, key_size), value, onallcpus);hlist_nulls_add_head_rcu (&l_new->hash_node, head); l_new =NULL ;
tools/testing/selftests/bpf/prog_tests/map_init.c new file +214 -0
214 lines not on this page · raw message
tools/testing/selftests/bpf/progs/test_map_init.c new file +33 -0
@@ -0,0 +1,33 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2020 Tessares SA <http://www.tessares.net> */ + +#include "vmlinux.h" +#include <bpf/bpf_helpers.h> + +__u64 inKey =0 ; +__u64 inValue =0 ; +__u32 inPid =0 ; + +struct { + __uint(type, BPF_MAP_TYPE_PERCPU_HASH); + __uint(max_entries, 2); + __type(key, __u64); + __type(value, __u64); +} hashmap1 SEC(".maps"); + + +SEC("tp/syscalls/sys_enter_getpgid") +int sysenter_getpgid (const void *ctx) +{ +/* Just do it for once, when called from our own test prog. This +* ensures the map value is only updated for a single CPU. +*/ +int cur_pid =bpf_get_current_pid_tgid () >>32 ; + +if (cur_pid == inPid) +bpf_map_update_elem (&hashmap1, &inKey, &inValue,BPF_NOEXIST ); + +return 0 ; +} + +char _license[] SEC("license") = "GPL";
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 148/255 r8169: fix potential skb double free in an error path
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit cc6528bc9a0c901c83b8220a2e2617f3354d6dd9 ]
The caller of rtl8169_tso_csum_v2() frees the skb if false is returned. eth_skb_pad() internally frees the skb on error what would result in a double free. Therefore use __skb_put_padto() directly and instruct it to not free the skb on error.
--- drivers/net/ethernet/realtek/r8169_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/realtek/r8169_main.c +2 -1
@@ -4145,7 +4145,8 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp, opts[1 ] |= transport_offset <<TCPHO_SHIFT ; }else {if (unlikely (skb->len <ETH_ZLEN &&rtl_test_hw_pad_bug (tp))) -return !eth_skb_pad (skb); +/* eth_skb_pad would free the skb on error */ +return !__skb_put_padto (skb,ETH_ZLEN , false); }return true;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 149/255 r8169: disable hw csum for short packets on all chip versions
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit 847f0a2bfd2fe16d6afa537816b313b71f32e139 ]
RTL8125B has same or similar short packet hw padding bug as RTL8168evl. The main workaround has been extended accordingly, however we have to disable also hw checksumming for short packets on affected new chip versions. Instead of checking for an affected chip version let's simply disable hw checksumming for short packets in general.
v2:
- remove the version checks and disable short packet hw csum in general
- reflect this in commit title and message
--- drivers/net/ethernet/realtek/r8169_main.c | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-)
drivers/net/ethernet/realtek/r8169_main.c +3 -12
@@ -4325,18 +4325,9 @@ static netdev_features_t rtl8169_features_check(struct sk_buff *skb, rtl_chip_supports_csum_v2(tp)) features &= ~NETIF_F_ALL_TSO ; }else if (skb->ip_summed ==CHECKSUM_PARTIAL ) { -if (skb->len <ETH_ZLEN ) { -switch (tp->mac_version) { -case RTL_GIGA_MAC_VER_11 : -case RTL_GIGA_MAC_VER_12 : -case RTL_GIGA_MAC_VER_17 : -case RTL_GIGA_MAC_VER_34 : - features &= ~NETIF_F_CSUM_MASK ; -break ; -default : -break ; - } - } +/* work around hw bug on some chip versions */ +if (skb->len <ETH_ZLEN ) + features &= ~NETIF_F_CSUM_MASK ;if (transport_offset >TCPHO_MAX &&rtl_chip_supports_csum_v2 (tp))
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 150/255 pinctrl: qcom: Move clearing pending IRQ to .irq_request_resources callback
In reply to Greg Kroah-HartmanFrom: Maulik Shah <[email protected]>
[ Upstream commit 71266d9d39366c9b24b866d811b3facaf837f13f ]
When GPIOs that are routed to PDC are used as output they can still latch the IRQ pending at GIC. As a result the spurious IRQ was handled when the client driver change the direction to input to starts using it as IRQ.
Currently such erroneous latched IRQ are cleared with .irq_enable callback however if the driver continue to use GPIO as interrupt and invokes disable_irq() followed by enable_irq() then everytime during enable_irq() previously latched interrupt gets cleared.
This can make edge IRQs not seen after enable_irq() if they had arrived after the driver has invoked disable_irq() and were pending at GIC.
Move clearing erroneous IRQ to .irq_request_resources callback as this is the place where GPIO direction is changed as input and its locked as IRQ.
While at this add a missing check to invoke msm_gpio_irq_clear_unmask() from .irq_enable callback only when GPIO is not routed to PDC.
--- drivers/pinctrl/qcom/pinctrl-msm.c | 32 ++++++++++++++++++------------ 1 file changed, 19 insertions(+), 13 deletions(-)
drivers/pinctrl/qcom/pinctrl-msm.c +19 -13
@@ -815,21 +815,14 @@ static void msm_gpio_irq_clear_unmask(struct irq_data *d, bool status_clear)static void msm_gpio_irq_enable (struct irq_data *d) { -/* -* Clear the interrupt that may be pending before we enable -* the line. -* This is especially a problem with the GPIOs routed to the -* PDC. These GPIOs are direct-connect interrupts to the GIC. -* Disabling the interrupt line at the PDC does not prevent -* the interrupt from being latched at the GIC. The state at -* GIC needs to be cleared before enabling. -*/ -if (d->parent_data) { -irq_chip_set_parent_state (d,IRQCHIP_STATE_PENDING ,0 ); +struct gpio_chip *gc =irq_data_get_irq_chip_data (d); +struct msm_pinctrl *pctrl =gpiochip_get_data (gc); + +if (d->parent_data)irq_chip_enable_parent (d); - } -msm_gpio_irq_clear_unmask (d, true); +if (!test_bit (d->hwirq, pctrl->skip_wake_irqs)) +msm_gpio_irq_clear_unmask (d, true); }static void msm_gpio_irq_disable (struct irq_data *d)
@@ -1104,6 +1097,19 @@ static int msm_gpio_irq_reqres(struct irq_data *d) ret = -EINVAL ; goto out; } + +/* +* Clear the interrupt that may be pending before we enable +* the line. +* This is especially a problem with the GPIOs routed to the +* PDC. These GPIOs are direct-connect interrupts to the GIC. +* Disabling the interrupt line at the PDC does not prevent +* the interrupt from being latched at the GIC. The state at +* GIC needs to be cleared before enabling. +*/ +if (d->parent_data &&test_bit (d->hwirq, pctrl->skip_wake_irqs)) +irq_chip_set_parent_state (d,IRQCHIP_STATE_PENDING ,0 ); +return 0 ; out:module_put (gc->owner);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 151/255 pinctrl: qcom: sm8250: Specify PDC map
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit b41efeed507addecb92e83dd444d86c1fbe38ae0 ]
Specify the PDC mapping for SM8250, so that gpio interrupts are propertly mapped to the wakeup IRQs of the PDC.
--- drivers/pinctrl/qcom/pinctrl-sm8250.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/pinctrl/qcom/pinctrl-sm8250.c +18 -0
@@ -1313,6 +1313,22 @@ static const struct msm_pingroup sm8250_groups[] = { [183] = SDC_PINGROUP(sdc2_data, 0xb7000, 9, 0), }; +static const struct msm_gpio_wakeirq_map sm8250_pdc_map[] = { + {0 ,79 }, {1 ,84 }, {2 ,80 }, {3 ,82 }, {4 ,107 }, {7 ,43 }, + {11 ,42 }, {14 ,44 }, {15 ,52 }, {19 ,67 }, {23 ,68 }, {24 ,105 }, + {27 ,92 }, {28 ,106 }, {31 ,69 }, {35 ,70 }, {39 ,37 }, + {40 ,108 }, {43 ,71 }, {45 ,72 }, {47 ,83 }, {51 ,74 }, {55 ,77 }, + {59 ,78 }, {63 ,75 }, {64 ,81 }, {65 ,87 }, {66 ,88 }, {67 ,89 }, + {68 ,54 }, {70 ,85 }, {77 ,46 }, {80 ,90 }, {81 ,91 }, {83 ,97 }, + {84 ,98 }, {86 ,99 }, {87 ,100 }, {88 ,101 }, {89 ,102 }, + {92 ,103 }, {93 ,104 }, {100 ,53 }, {103 ,47 }, {104 ,48 }, + {108 ,49 }, {109 ,94 }, {110 ,95 }, {111 ,96 }, {112 ,55 }, + {113 ,56 }, {118 ,50 }, {121 ,51 }, {122 ,57 }, {123 ,58 }, + {124 ,45 }, {126 ,59 }, {128 ,76 }, {129 ,86 }, {132 ,93 }, + {133 ,65 }, {134 ,66 }, {136 ,62 }, {137 ,63 }, {138 ,64 }, + {142 ,60 }, {143 ,61 } +}; +static const struct msm_pinctrl_soc_data sm8250_pinctrl = { .pins = sm8250_pins, .npins =ARRAY_SIZE (sm8250_pins),
@@ -1323,6 +1339,8 @@ static const struct msm_pinctrl_soc_data sm8250_pinctrl = { .ngpios = 181, .tiles = sm8250_tiles, .ntiles = ARRAY_SIZE(sm8250_tiles), + .wakeirq_map = sm8250_pdc_map, + .nwakeirq_map = ARRAY_SIZE(sm8250_pdc_map), };static int sm8250_pinctrl_probe (struct platform_device *pdev)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 152/255 nbd: fix a block_device refcount leak in nbd_release
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 2bd645b2d3f0bacadaa6037f067538e1cd4e42ef ]
bdget_disk needs to be paired with bdput to not leak a reference on the block device inode.
--- drivers/block/nbd.c | 1 + 1 file changed, 1 insertion(+)
drivers/block/nbd.c +1 -0
@@ -1517,6 +1517,7 @@ static void nbd_release(struct gendisk *disk, fmode_t mode)if (test_bit (NBD_RT_DISCONNECT_ON_CLOSE , &nbd->config->runtime_flags) && bdev->bd_openers ==0 )nbd_disconnect_and_put (nbd); +bdput (bdev);nbd_config_put (nbd);nbd_put (nbd);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 153/255 selftest: fix flower terse dump tests
In reply to Greg Kroah-HartmanFrom: Vlad Buslov <[email protected]>
[ Upstream commit 97adb13dc9ba08ecd4758bc59efc0205f5cbf377 ]
Iproute2 tc classifier terse dump has been accepted with modified syntax. Update the tests accordingly.
--- .../testing/selftests/tc-testing/tc-tests/filters/tests.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/tc-testing/tc-tests/filters/tests.json +2 -2
@@ -100,7 +100,7 @@ ], "cmdUnderTest": "$TC filter add dev $DEV2 protocol ip pref 1 ingress flower dst_mac e4:11:22:11:4a:51 action drop", "expExitCode": "0", - "verifyCmd": "$TC filter show terse dev $DEV2 ingress", + "verifyCmd": "$TC -br filter show dev $DEV2 ingress", "matchPattern": "filter protocol ip pref 1 flower.*handle", "matchCount": "1", "teardown": [
@@ -119,7 +119,7 @@ ], "cmdUnderTest": "$TC filter add dev $DEV2 protocol ip pref 1 ingress flower dst_mac e4:11:22:11:4a:51 action drop", "expExitCode": "0", - "verifyCmd": "$TC filter show terse dev $DEV2 ingress", + "verifyCmd": "$TC -br filter show dev $DEV2 ingress", "matchPattern": " dst_mac e4:11:22:11:4a:51", "matchCount": "0", "teardown": [
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 154/255 i40e: Fix MAC address setting for a VF via Host/VM
In reply to Greg Kroah-HartmanFrom: Slawomir Laba <[email protected]>
[ Upstream commit 3a7001788fed0311d6fb77ed0dabe7bed3567bc0 ]
Fix MAC setting flow for the PF driver.
Update the unicast VF's MAC address in VF structure if it is a new setting in i40e_vc_add_mac_addr_msg.
When unicast MAC address gets deleted, record that and
set the new unicast MAC address that is already waiting in the filter list. This logic is based on the order of messages arriving to the PF driver.
Without this change the MAC address setting was interpreted incorrectly in the following use cases:
1) Print incorrect VF MAC or zero MAC
ip link show dev $pf
2) Don't preserve MAC between driver reload
rmmod iavf; modprobe iavf
3) Update VF MAC when macvlan was set
ip link add link $vf address $mac $vf.1 type macvlan
4) Failed to update mac address when VF was trusted ip link set dev $vf address $mac
This includes all other configurations including above commands.
--- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 26 +++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +24 -2
@@ -2712,6 +2712,10 @@ static int i40e_vc_add_mac_addr_msg(struct i40e_vf *vf, u8 *msg)spin_unlock_bh (&vsi->mac_filter_hash_lock); goto error_param; } +if (is_valid_ether_addr (al->list[i].addr) && +is_zero_ether_addr (vf->default_lan_addr.addr)) +ether_addr_copy (vf->default_lan_addr.addr, + al->list[i].addr); } }spin_unlock_bh (&vsi->mac_filter_hash_lock);
@@ -2739,6 +2743,7 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg) {struct virtchnl_ether_addr_list *al = (struct virtchnl_ether_addr_list *)msg; +bool was_unimac_deleted = false;struct i40e_pf *pf = vf->pf;struct i40e_vsi *vsi =NULL ;i40e_status ret =0 ;
@@ -2758,6 +2763,8 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg) ret =I40E_ERR_INVALID_MAC_ADDR ; goto error_param; } +if (ether_addr_equal (al->list[i].addr, vf->default_lan_addr.addr)) + was_unimac_deleted = true; } vsi = pf->vsi[vf->lan_vsi_idx];
@@ -2778,10 +2785,25 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg)dev_err (&pf->pdev->dev,"Unable to program VF %d MAC filters, error %d\n" , vf->vf_id, ret); +if (vf->trusted && was_unimac_deleted) { +struct i40e_mac_filter *f; +struct hlist_node *h; +u8 *macaddr =NULL ; +int bkt; + +/* set last unicast mac address as default */ +spin_lock_bh (&vsi->mac_filter_hash_lock); +hash_for_each_safe (vsi->mac_filter_hash, bkt, h, f, hlist) { +if (is_valid_ether_addr (f->macaddr)) + macaddr = f->macaddr; + } +if (macaddr) +ether_addr_copy (vf->default_lan_addr.addr, macaddr); +spin_unlock_bh (&vsi->mac_filter_hash_lock); + } error_param:/* send the response to the VF */ -return i40e_vc_send_resp_to_vf (vf,VIRTCHNL_OP_DEL_ETH_ADDR , - ret); +return i40e_vc_send_resp_to_vf (vf,VIRTCHNL_OP_DEL_ETH_ADDR , ret); }/**
Signature · 1 line
2.27.0