5.11.11-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.11.11-rc1 review
This is the start of the stable review cycle for the 5.11.11 release. There are 254 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.11.11-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.11.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.11.11-rc1
Alexei Starovoitov <[email protected]>
selftest/bpf: Add a test to check trampoline freeing logic.
Marc Kleine-Budde <[email protected]>
can: peak_usb: Revert "can: peak_usb: add forgotten supported devices"
Christoph Hellwig <[email protected]>
nvme: fix the nsid value to print in nvme_validate_or_alloc_ns
Roger Pau Monne <[email protected]>
Revert "xen: fix p2m size in dom0 for disabled memory hotplug case"
Sabyrzhan Tasbolatov <[email protected]>
fs/ext4: fix integer overflow in s_log_groups_per_flex
Jan Kara <[email protected]>
ext4: add reclaim checks to xattr code
Markus Theil <[email protected]>
mac80211: fix double free in ibss_leave
Florian Fainelli <[email protected]>
net: dsa: b53: VLAN filtering is global to all users
Heiner Kallweit <[email protected]>
r8169: fix DMA being used after buffer free if WoL is enabled
Martin Willi <[email protected]>
can: dev: Move device back to init netns on owning netns delete
Arnd Bergmann <[email protected]>
ch_ktls: fix enum-conversion warning
Matthew Wilcox (Oracle) <[email protected]>
fs/cachefiles: Remove wait_bit_key layout dependency
Isaku Yamahata <[email protected]>
x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc()
Thomas Gleixner <[email protected]>
locking/mutex: Fix non debug version of mutex_lock_io_nested()
Shyam Prasad N <[email protected]>
cifs: Adjust key sizes and key generation routines for AES256 encryption
Steve French <[email protected]>
smb3: fix cached file size problems in duplicate extents (reflink)
Jia-Ju Bai <[email protected]>
scsi: mpt3sas: Fix error return code of mpt3sas_base_attach()
Jia-Ju Bai <[email protected]>
scsi: qedi: Fix error return code of qedi_alloc_global_queues()
Bart Van Assche <[email protected]>
scsi: Revert "qla2xxx: Make sure that aborted commands are freed"
David Jeffery <[email protected]>
block: recalculate segment count for multi-segment discards correctly
Pavel Begunkov <[email protected]>
io_uring: fix provide_buffers sign extension
Ian Rogers <[email protected]>
perf synthetic events: Avoid write of uninitialized memory when generating PERF_RECORD_MMAP* records
Adrian Hunter <[email protected]>
perf auxtrace: Fix auxtrace queue conflict
Andy Shevchenko <[email protected]>
ACPI: scan: Use unique number for instance_no
Rafael J. Wysocki <[email protected]>
ACPI: scan: Rearrange memory allocation in acpi_device_add()
Mark Tomlinson <[email protected]>
Revert "netfilter: x_tables: Update remaining dereference to RCU"
Sean Christopherson <[email protected]>
mm/mmu_notifiers: ensure range_end() is paired with range_start()
Shin'ichiro Kawasaki <[email protected]>
dm table: Fix zoned model check and zone sectors check
Pavel Tatashin <[email protected]>
arm64: mm: correct the inside linear map range during hotplug check
Anshuman Khandual <[email protected]>
arm64/mm: define arch_get_mappable_range()
Hans de Goede <[email protected]>
platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files()
Stanislav Fomichev <[email protected]>
bpf: Use NOP_ATOMIC5 instead of emit_nops(&prog, 5) for BPF_TRAMP_F_CALL_ORIG
Alexei Starovoitov <[email protected]>
bpf: Fix fexit trampoline.
Mark Tomlinson <[email protected]>
netfilter: x_tables: Use correct memory barriers.
Mark Tomlinson <[email protected]>
Revert "netfilter: x_tables: Switch synchronization to RCU"
Florian Fainelli <[email protected]>
net: phy: broadcom: Fix RGMII delays for BCM50160 and BCM50610M
Robert Hancock <[email protected]>
net: phy: broadcom: Set proper 1000BaseX/SGMII interface mode for BCM54616S
Florian Fainelli <[email protected]>
net: phy: broadcom: Avoid forward for bcm54xx_config_clock_delay()
Michael Walle <[email protected]>
net: phy: introduce phydev->port
Robert Hancock <[email protected]>
net: axienet: Fix probe error cleanup
Li RongQing <[email protected]>
igb: avoid premature Rx buffer reuse
Daniel Borkmann <[email protected]>
net, bpf: Fix ip6ip6 crash with collect_md populated skbs
Daniel Borkmann <[email protected]>
net: Consolidate common blackhole dst ops
Sasha Levin <[email protected]>
bpf: Don't do bpf_cgroup_storage_set() for kuprobe/tp programs
Mike Rapoport <[email protected]>
mm: memblock: fix section mismatch warning again
Potnuri Bharat Teja <[email protected]>
RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server
Roger Pau Monne <[email protected]>
xen/x86: make XEN_BALLOON_MEMORY_HOTPLUG_LIMIT depend on MEMORY_HOTPLUG
Colin Ian King <[email protected]>
octeontx2-af: Fix memory leak of object buf
Vladimir Oltean <[email protected]>
net: bridge: don't notify switchdev for local FDB addresses
David E. Box <[email protected]>
platform/x86: intel_pmt_crashlog: Fix incorrect macros
Lukasz Luba <[email protected]>
PM: EM: postpone creating the debugfs dir till fs_initcall
Andy Shevchenko <[email protected]>
mfd: intel_quark_i2c_gpio: Revert "Constify static struct resources"
Aya Levin <[email protected]>
net/mlx5e: Fix error path for ethtool set-priv-flag
Dima Chumak <[email protected]>
net/mlx5e: Offload tuple rewrite for non-CT flows
Alaa Hleihel <[email protected]>
net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP
Huy Nguyen <[email protected]>
net/mlx5: Add back multicast stats for uplink representor
Rafael J. Wysocki <[email protected]>
PM: runtime: Defer suspending suppliers
Pavel Tatashin <[email protected]>
arm64: kdump: update ppos when reading elfcorehdr
Fabio Estevam <[email protected]>
drm/msm: Fix suspend/resume on i.MX5
Dmitry Baryshkov <[email protected]>
drm/msm: fix shutdown hook in case GPU components failed to bind
Hans de Goede <[email protected]>
platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found
Hans de Goede <[email protected]>
platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling
Hans de Goede <[email protected]>
platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure
Hans de Goede <[email protected]>
platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times
Hans de Goede <[email protected]>
platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit
Hans de Goede <[email protected]>
platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice
Oliver Hartkopp <[email protected]>
can: isotp: tx-path: zero initialize outgoing CAN frames
Zqiang <[email protected]>
bpf: Fix umd memory leak in copy_process()
Jean-Philippe Brucker <[email protected]>
libbpf: Fix BTF dump of pointer-to-array-of-struct
Hangbin Liu <[email protected]>
selftests: forwarding: vxlan_bridge_1d: Fix vxlan ecn decapsulate value
David Brazdil <[email protected]>
selinux: vsock: Set SID for socket returned by accept()
Corentin Labbe <[email protected]>
net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes
Hayes Wang <[email protected]>
r8152: limit the RX buffer size of RTL8153A for USB 2.0
Xin Long <[email protected]>
sctp: move sk_route_caps check and set into sctp_outq_flush_transports
Jesse Brandeburg <[email protected]>
igb: check timestamp validity
Johan Hovold <[email protected]>
net: cdc-phonet: fix data-interface release on probe failure
Jiri Bohac <[email protected]>
net: check all name nodes in __dev_alloc_name
Hariprasad Kelam <[email protected]>
octeontx2-af: fix infinite loop in unmapping NPC counter
Geetha sowjanya <[email protected]>
octeontx2-pf: Clear RSS enable flag on interace down
Geetha sowjanya <[email protected]>
octeontx2-af: Fix irq free in rvu teardown
Subbaraya Sundeep <[email protected]>
octeontx2-af: Remove TOS field from MKEX TX
Rakesh Babu <[email protected]>
octeontx2-af: Formatting debugfs entry rsrc_alloc.
Jakub Kicinski <[email protected]>
ipv6: weaken the v4mapped source check
dillon min <[email protected]>
ARM: dts: imx6ull: fix ubi filesystem mount failed
Kumar Kartikeya Dwivedi <[email protected]>
libbpf: Use SOCK_CLOEXEC when opening the netlink socket
Namhyung Kim <[email protected]>
libbpf: Fix error path in bpf_object__elf_init()
Yinjun Zhang <[email protected]>
netfilter: flowtable: Make sure GC works periodically in idle system
Pablo Neira Ayuso <[email protected]>
netfilter: nftables: allow to update flowtable flags
Pablo Neira Ayuso <[email protected]>
netfilter: nftables: report EOPNOTSUPP on unsupported flowtable flags
wenxu <[email protected]>
net/sched: cls_flower: fix only mask bit check in the validate_ct_state
Shannon Nelson <[email protected]>
ionic: linearize tso skb with too many frags
Dmitry Baryshkov <[email protected]>
drm/msm/dsi: fix check-before-set in the 7nm dsi_pll code
Alexei Starovoitov <[email protected]>
ftrace: Fix modify_ftrace_direct.
Louis Peens <[email protected]>
nfp: flower: fix pre_tun mask id allocation
Louis Peens <[email protected]>
nfp: flower: add ipv6 bit to pre_tunnel control message
Louis Peens <[email protected]>
nfp: flower: fix unsupported pre_tunnel flows
Carlos Llamas <[email protected]>
selftests/net: fix warnings on reuseaddr_ports_exhausted
Brian Norris <[email protected]>
mac80211: Allow HE operation to be longer than expected.
Johannes Berg <[email protected]>
mac80211: fix rate mask reset
Torin Cooper-Bennun <[email protected]>
can: m_can: m_can_rx_peripheral(): fix RX being blocked by errors
Torin Cooper-Bennun <[email protected]>
can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning
Tong Zhang <[email protected]>
can: c_can: move runtime PM enable/disable to c_can_platform
Tong Zhang <[email protected]>
can: c_can_pci: c_can_pci_remove(): fix use-after-free
Jimmy Assarsson <[email protected]>
can: kvaser_pciefd: Always disable bus load reporting
Angelo Dureghello <[email protected]>
can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate
Stephane Grosjean <[email protected]>
can: peak_usb: add forgotten supported devices
Marc Kleine-Budde <[email protected]>
can: isotp: TX-path: ensure that CAN frame flags are initialized
Marc Kleine-Budde <[email protected]>
can: isotp: isotp_setsockopt(): only allow to set low level TX flags for CAN-FD
Davide Caratti <[email protected]>
mptcp: fix ADD_ADDR HMAC in case port is specified
Alexander Ovechkin <[email protected]>
tcp: relookup sock for RST+ACK packets handled by obsolete req sock
Eric Dumazet <[email protected]>
tipc: better validate user input in tipc_nl_retrieve_key()
Ong Boon Leong <[email protected]>
net: phylink: Fix phylink_err() function name error in phylink_major_config
Xie He <[email protected]>
net: hdlc_x25: Prevent racing between "x25_close" and "x25_xmit"/"x25_rx"
Florian Westphal <[email protected]>
netfilter: ctnetlink: fix dump of the expect mask attribute
Hangbin Liu <[email protected]>
selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed
Alexander Lobakin <[email protected]>
flow_dissector: fix byteorder of dissected ICMP ID
Eric Dumazet <[email protected]>
net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()
Alex Elder <[email protected]>
net: ipa: terminate message handler arrays
Douglas Anderson <[email protected]>
clk: qcom: gcc-sc7180: Use floor ops for the correct sdcc1 clk
Dylan Hung <[email protected]>
ftgmac100: Restart MAC HW once
Magnus Karlsson <[email protected]>
ice: fix napi work done reporting in xsk path
Florian Fainelli <[email protected]>
net: phy: broadcom: Add power down exit reset state delay
Lv Yunlong <[email protected]>
net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template
David Gow <[email protected]>
kunit: tool: Disable PAGE_POISONING under --alltests
Dinghao Liu <[email protected]>
e1000e: Fix error handling in e1000_set_d0_lplu_state_82571
Vitaly Lifshits <[email protected]>
e1000e: add rtnl_lock() to e1000_reset_task
Andre Guedes <[email protected]>
igc: Fix igc_ptp_rx_pktstamp()
Muhammad Husaini Zulkifli <[email protected]>
igc: Fix Supported Pause Frame Link Setting
Muhammad Husaini Zulkifli <[email protected]>
igc: Fix Pause Frame Advertising
Sasha Neftin <[email protected]>
igc: reinit_locked() should be called with rtnl_lock
Florian Fainelli <[email protected]>
net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port
Eric Dumazet <[email protected]>
net: sched: validate stab values
Eric Dumazet <[email protected]>
macvlan: macvlan_count_rx() needs to be aware of preemption
Ido Schimmel <[email protected]>
drop_monitor: Perform cleanup upon probe registration failure
Wei Wang <[email protected]>
ipv6: fix suspecious RCU usage warning
Parav Pandit <[email protected]>
net/mlx5e: E-switch, Fix rate calculation division
Maor Dickman <[email protected]>
net/mlx5e: Don't match on Geneve options in case option masks are all zero
Maxim Mikityanskiy <[email protected]>
net/mlx5e: Revert parameters on errors when changing PTP state without reset
Maxim Mikityanskiy <[email protected]>
net/mlx5e: When changing XDP program without reset, take refs for XSK RQs
Aya Levin <[email protected]>
net/mlx5e: Set PTP channel pointer explicitly to NULL
Tariq Toukan <[email protected]>
net/mlx5e: RX, Mind the MPWQE gaps when calculating offsets
Georgi Valkov <[email protected]>
libbpf: Fix INSTALL flag order
Tal Lossos <[email protected]>
bpf: Change inode_storage's lookup_elem return value from NULL to -EBADF
Alexei Starovoitov <[email protected]>
bpf: Dont allow vmlinux BTF to be used in map_create and prog_load.
Maciej Fijalkowski <[email protected]>
veth: Store queue_mapping independently of XDP prog presence
Tony Lindgren <[email protected]>
soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva
Tony Lindgren <[email protected]>
ARM: OMAP2+: Fix smartreflex init regression after dropping legacy data
Tony Lindgren <[email protected]>
soc: ti: omap-prm: Fix reboot issue with invalid pcie reset map for dra7
Grygorii Strashko <[email protected]>
bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD
Mikulas Patocka <[email protected]>
dm ioctl: fix out of bounds array access when no devices
Mikulas Patocka <[email protected]>
dm: don't report "detected capacity change" on device creation
JeongHyeon Lee <[email protected]>
dm verity: fix DM_VERITY_OPTS_MAX value
Imre Deak <[email protected]>
drm/i915: Fix the GT fence revocation runtime PM logic
Jani Nikula <[email protected]>
drm/i915/dsc: fix DSS CTL register usage for ICL DSI transcoders
Alex Deucher <[email protected]>
drm/amdgpu: Add additional Sienna Cichlid PCI ID
Prike Liang <[email protected]>
drm/amdgpu: fix the hibernation suspend with s0ix
Alex Deucher <[email protected]>
drm/amdgpu/display: restore AUX_DPHY_TX_CONTROL for DCN2.x
Kenneth Feng <[email protected]>
drm/amd/pm: workaround for audio noise issue
Daniel Vetter <[email protected]>
drm/etnaviv: Use FOLL_FORCE for userptr
Lyude Paul <[email protected]>
drm/nouveau/kms/nve4-nv108: Limit cursors to 128x128
Mimi Zohar <[email protected]>
integrity: double check iint_cache was initialized
Claudiu Beznea <[email protected]>
ARM: dts: at91-sama5d27_som1: fix phy address to 7
Nicolas Ferre <[email protected]>
ARM: dts: at91: sam9x60: fix mux-mask to match product's datasheet
Federico Pellegrin <[email protected]>
ARM: dts: at91: sam9x60: fix mux-mask for PA7 so it can be set to A, B and C
Horia Geantă <[email protected]>
arm64: dts: ls1043a: mark crypto engine dma coherent
Horia Geantă <[email protected]>
arm64: dts: ls1012a: mark crypto engine dma coherent
Horia Geantă <[email protected]>
arm64: dts: ls1046a: mark crypto engine dma coherent
Mark Rutland <[email protected]>
arm64: stacktrace: don't trace arch_stack_walk()
Vegard Nossum <[email protected]>
ACPICA: Always create namespace nodes using acpi_ns_create_node()
Chris Chiu <[email protected]>
ACPI: video: Add missing callback back for Sony VPCEH3U1E
Ira Weiny <[email protected]>
mm/highmem: fix CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP
Nick Desaulniers <[email protected]>
gcov: fix clang-11+ support
Andrey Konovalov <[email protected]>
kasan: fix per-page tags for non-page_alloc pages
Miaohe Lin <[email protected]>
hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings
Phillip Lougher <[email protected]>
squashfs: fix xattr id and id lookup sanity checks
Sean Nyekjaer <[email protected]>
squashfs: fix inode lookup sanity checks
Thomas Hebb <[email protected]>
z3fold: prevent reclaim/free race for headless pages
Ido Schimmel <[email protected]>
psample: Fix user API breakage
Hans de Goede <[email protected]>
platform/x86: intel-vbtn: Stop reporting SW_DOCK events
Mian Yousaf Kaukab <[email protected]>
netsec: restore phy power state after controller reset
Ondrej Mosnacek <[email protected]>
selinux: fix variable scope issue in live sidtab conversion
Ondrej Mosnacek <[email protected]>
selinux: don't log MAC_POLICY_LOAD record on failed policy load
Filipe Manana <[email protected]>
btrfs: fix subvolume/snapshot deletion not triggered on mount
Filipe Manana <[email protected]>
btrfs: fix sleep while in non-sleep context during qgroup removal
Josef Bacik <[email protected]>
btrfs: initialize device::fs_info always
Omar Sandoval <[email protected]>
btrfs: fix check_data_csum() error message for direct I/O
Josef Bacik <[email protected]>
btrfs: do not initialize dev replace for bad dev root
Josef Bacik <[email protected]>
btrfs: do not initialize dev stats if we have no dev_root
Sean Christopherson <[email protected]>
KVM: x86: Protect userspace MSR filter with SRCU, and set atomically-ish
Peter Zijlstra <[email protected]>
static_call: Fix static_call_set_init()
Peter Zijlstra <[email protected]>
static_call: Fix the module key fixup
Josh Poimboeuf <[email protected]>
static_call: Allow module use without exposing static_call_key
Peter Zijlstra <[email protected]>
static_call: Pull some static_call declarations to the type headers
Sergei Trofimovich <[email protected]>
ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign
Sergei Trofimovich <[email protected]>
ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls
Fenghua Yu <[email protected]>
mm/fork: clear PASID for new mm
Pavel Begunkov <[email protected]>
io_uring: cancel deferred requests in try_cancel
Daniel Wagner <[email protected]>
block: Suppress uevent for hidden device when removed
J. Bruce Fields <[email protected]>
nfs: we don't support removing system.nfs4_acl
Dmitry Monakhov <[email protected]>
nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a
Lv Yunlong <[email protected]>
nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done
Chaitanya Kulkarni <[email protected]>
nvme-core: check ctrl css before setting up zns
Hannes Reinecke <[email protected]>
nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted
Hannes Reinecke <[email protected]>
nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange()
Hannes Reinecke <[email protected]>
nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request()
Hannes Reinecke <[email protected]>
nvme: simplify error logic in nvme_validate_ns()
Christian König <[email protected]>
drm/radeon: fix AGP dependency
Nirmoy Das <[email protected]>
drm/amdgpu: fb BO should be ttm_bo_type_device
Zhan Liu <[email protected]>
drm/amdgpu/display: Use wm_table.entries for dcn301 calculate_wm
Dillon Varone <[email protected]>
drm/amd/display: Enabled pipe harvesting in dcn30
Sung Lee <[email protected]>
drm/amd/display: Revert dram_clock_change_latency for DCN2.1
Qingqing Zhuo <[email protected]>
drm/amd/display: Enable pflip interrupt upon pipe enable
Damien Le Moal <[email protected]>
block: Fix REQ_OP_ZONE_RESET_ALL handling
satya priya <[email protected]>
regulator: qcom-rpmh: Use correct buck for S1C regulator
satya priya <[email protected]>
regulator: qcom-rpmh: Correct the pmic5_hfsmps515 buck
Mark Brown <[email protected]>
kselftest: arm64: Fix exit code of sve-ptrace
Peter Zijlstra <[email protected]>
u64_stats,lockdep: Fix u64_stats_init() vs lockdep
Julian Braha <[email protected]>
staging: rtl8192e: fix kconfig dependency on CRYPTO
Tomer Tayar <[email protected]>
habanalabs: Disable file operations after device is removed
Tomer Tayar <[email protected]>
habanalabs: Call put_pid() when releasing control device
Rob Gardner <[email protected]>
sparc64: Fix opcode filtering in handling of no fault loads
Wei Yongjun <[email protected]>
umem: fix error return code in mm_pci_probe()
Jiri Slaby <[email protected]>
kbuild: dummy-tools: fix inverted tests for gcc
Masahiro Yamada <[email protected]>
kbuild: add image_name to no-sync-config-targets
Paul Cercueil <[email protected]>
irqchip/ingenic: Add support for the JZ4760
Paulo Alcantara <[email protected]>
cifs: change noisy error message to FYI
Tong Zhang <[email protected]>
atm: idt77252: fix null-ptr-dereference
Tong Zhang <[email protected]>
atm: uPD98402: fix incorrect allocation
Alex Marginean <[email protected]>
net: enetc: set MAC RX FIFO to recommended value
Paul Cercueil <[email protected]>
net: davicom: Use platform_get_irq_optional()
Jia-Ju Bai <[email protected]>
net: wan: fix error return code of uhdlc_init()
Jia-Ju Bai <[email protected]>
net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch()
Frank Sorenson <[email protected]>
NFS: Correct size calculation for create reply length
Timo Rothenpieler <[email protected]>
nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default
Yang Li <[email protected]>
gpiolib: acpi: Add missing IRQF_ONESHOT
Sudeep Holla <[email protected]>
cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev
Bob Peterson <[email protected]>
gfs2: fix use-after-free in trans_drain
Aurelien Aptel <[email protected]>
cifs: ask for more credit on async read/write code paths
Michael Braun <[email protected]>
gianfar: fix jumbo packets+napi+rx overrun crash
Denis Efremov <[email protected]>
sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count
Jia-Ju Bai <[email protected]>
net: intel: iavf: fix error return code of iavf_init_get_resources()
Jia-Ju Bai <[email protected]>
net: tehuti: fix error return code in bdx_probe()
Xunlei Pang <[email protected]>
blk-cgroup: Fix the recursive blkg rwstat
Nitin Rawat <[email protected]>
scsi: ufs: ufs-qcom: Disable interrupt in reset path
Dinghao Liu <[email protected]>
ixgbe: Fix memleak in ixgbe_configure_clsu32
Mark Pearson <[email protected]>
ALSA: hda: ignore invalid NHLT table
Hayes Wang <[email protected]>
Revert "r8152: adjust the settings about MAC clock speed down for RTL8153"
Tong Zhang <[email protected]>
atm: lanai: dont run lanai_dev_close if not open
Tong Zhang <[email protected]>
atm: eni: dont release is never initialized
Michael Ellerman <[email protected]>
powerpc/4xx: Fix build errors from mfdcr()
Heiko Thiery <[email protected]>
net: fec: ptp: avoid register access when ipg clock is disabled
Joakim Zhang <[email protected]>
net: stmmac: fix dma physical address of descriptor when display ring
Felix Fietkau <[email protected]>
mt76: mt7915: only modify tx buffer list after allocating tx token id
Felix Fietkau <[email protected]>
mt76: fix tx skb error handling in mt76_dma_tx_queue_skb
-------------
Diffstat:
Documentation/virt/kvm/api.rst | 6 +- Makefile | 7 +- arch/arm/boot/dts/at91-sam9x60ek.dts | 8 - arch/arm/boot/dts/at91-sama5d27_som1.dtsi | 4 +- arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts | 1 + arch/arm/boot/dts/sam9x60.dtsi | 9 + arch/arm/mach-omap2/sr_device.c | 75 +++++-- arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi | 1 + arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi | 1 + arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi | 1 + arch/arm64/kernel/crash_dump.c | 2 + arch/arm64/kernel/stacktrace.c | 9 +- arch/arm64/mm/mmu.c | 32 ++- arch/ia64/include/asm/syscall.h | 2 +- arch/ia64/kernel/ptrace.c | 24 ++- arch/powerpc/include/asm/dcr-native.h | 8 +- arch/sparc/kernel/traps_64.c | 13 +- arch/x86/include/asm/kvm_host.h | 14 +- arch/x86/include/asm/static_call.h | 7 + arch/x86/include/asm/xen/page.h | 12 -- arch/x86/kvm/x86.c | 109 ++++++----- arch/x86/mm/mem_encrypt.c | 2 +- arch/x86/net/bpf_jit_comp.c | 27 ++- arch/x86/xen/p2m.c | 7 +- arch/x86/xen/setup.c | 16 +- block/blk-cgroup-rwstat.c | 3 +- block/blk-merge.c | 8 + block/blk-zoned.c | 2 +- block/genhd.c | 4 +- drivers/acpi/acpica/nsaccess.c | 3 +- drivers/acpi/internal.h | 6 +- drivers/acpi/scan.c | 88 +++++---- drivers/acpi/video_detect.c | 1 + drivers/atm/eni.c | 3 +- drivers/atm/idt77105.c | 4 +- drivers/atm/lanai.c | 5 +- drivers/atm/uPD98402.c | 2 +- drivers/base/power/runtime.c | 45 ++++- drivers/block/umem.c | 5 +- drivers/bus/omap_l3_noc.c | 4 +- drivers/clk/qcom/gcc-sc7180.c | 4 +- drivers/cpufreq/cpufreq-dt-platdev.c | 2 + drivers/gpio/gpiolib-acpi.c | 2 +- drivers/gpu/drm/Kconfig | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + drivers/gpu/drm/amd/display/dc/dc.h | 1 + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c | 11 ++ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h | 6 + .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 7 + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c | 1 + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 6 + .../drm/amd/display/dc/dcn20/dcn20_link_encoder.c | 3 +- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c | 1 + .../gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 2 +- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c | 1 + .../gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 31 +++ .../drm/amd/display/dc/dcn301/dcn301_resource.c | 96 ++++++++- drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h | 2 + .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 54 +++++ .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 74 +++++-- .../gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 24 +++ .../gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 25 +++ drivers/gpu/drm/etnaviv/etnaviv_gem.c | 2 +- drivers/gpu/drm/i915/display/intel_vdsc.c | 10 +- drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c | 13 +- drivers/gpu/drm/i915/intel_runtime_pm.c | 29 ++- drivers/gpu/drm/i915/intel_runtime_pm.h | 5 + drivers/gpu/drm/msm/dsi/pll/dsi_pll.c | 2 +- drivers/gpu/drm/msm/dsi/pll/dsi_pll.h | 6 +- drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c | 5 +- drivers/gpu/drm/msm/msm_drv.c | 12 ++ drivers/gpu/drm/nouveau/dispnv50/disp.c | 13 +- drivers/infiniband/hw/cxgb4/cm.c | 4 +- drivers/irqchip/irq-ingenic-tcu.c | 1 + drivers/irqchip/irq-ingenic.c | 1 + drivers/md/dm-ioctl.c | 2 +- drivers/md/dm-table.c | 33 +++- drivers/md/dm-verity-target.c | 2 +- drivers/md/dm-zoned-target.c | 2 +- drivers/md/dm.c | 5 +- drivers/mfd/intel_quark_i2c_gpio.c | 6 +- drivers/misc/habanalabs/common/device.c | 40 +++- drivers/misc/habanalabs/common/habanalabs_ioctl.c | 12 ++ drivers/net/can/c_can/c_can.c | 24 +-- drivers/net/can/c_can/c_can_pci.c | 3 +- drivers/net/can/c_can/c_can_platform.c | 6 +- drivers/net/can/dev.c | 1 + drivers/net/can/flexcan.c | 8 +- drivers/net/can/kvaser_pciefd.c | 4 + drivers/net/can/m_can/m_can.c | 5 +- drivers/net/dsa/b53/b53_common.c | 14 +- drivers/net/dsa/bcm_sf2.c | 6 +- .../chelsio/inline_crypto/ch_ktls/chcr_ktls.c | 2 +- drivers/net/ethernet/davicom/dm9000.c | 2 +- drivers/net/ethernet/faraday/ftgmac100.c | 1 + drivers/net/ethernet/freescale/enetc/enetc_hw.h | 2 + drivers/net/ethernet/freescale/enetc/enetc_pf.c | 6 + drivers/net/ethernet/freescale/fec_ptp.c | 7 + drivers/net/ethernet/freescale/gianfar.c | 15 ++ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 4 +- drivers/net/ethernet/intel/e1000e/82571.c | 2 + drivers/net/ethernet/intel/e1000e/netdev.c | 6 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 3 +- drivers/net/ethernet/intel/ice/ice_base.c | 6 +- drivers/net/ethernet/intel/ice/ice_xsk.c | 10 +- drivers/net/ethernet/intel/igb/igb.h | 4 +- drivers/net/ethernet/intel/igb/igb_main.c | 33 ++-- drivers/net/ethernet/intel/igb/igb_ptp.c | 31 ++- drivers/net/ethernet/intel/igc/igc.h | 2 +- drivers/net/ethernet/intel/igc/igc_ethtool.c | 7 +- drivers/net/ethernet/intel/igc/igc_main.c | 9 + drivers/net/ethernet/intel/igc/igc_ptp.c | 72 ++++--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 6 +- .../ethernet/marvell/octeontx2/af/npc_profile.h | 2 - drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 6 +- .../ethernet/marvell/octeontx2/af/rvu_debugfs.c | 48 +++-- .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 2 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 5 + drivers/net/ethernet/mellanox/mlx5/core/en.h | 7 +- drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 3 +- .../ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c | 4 + .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 11 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 21 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 57 ++++-- .../net/ethernet/netronome/nfp/flower/metadata.c | 24 ++- .../net/ethernet/netronome/nfp/flower/offload.c | 18 ++ .../ethernet/netronome/nfp/flower/tunnel_conf.c | 15 +- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 13 +- .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 + drivers/net/ethernet/realtek/r8169_main.c | 6 +- drivers/net/ethernet/socionext/netsec.c | 9 +- drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2 + drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 50 ++++- drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 9 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 3 +- drivers/net/ethernet/stmicro/stmmac/norm_desc.c | 9 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 57 ++++-- drivers/net/ethernet/sun/niu.c | 2 - drivers/net/ethernet/tehuti/tehuti.c | 1 + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 35 ++-- drivers/net/ipa/ipa_qmi.c | 2 + drivers/net/phy/broadcom.c | 147 ++++++++++---- drivers/net/phy/dp83822.c | 3 + drivers/net/phy/dp83869.c | 4 + drivers/net/phy/lxt.c | 1 + drivers/net/phy/marvell.c | 1 + drivers/net/phy/marvell10g.c | 2 + drivers/net/phy/micrel.c | 14 +- drivers/net/phy/phy.c | 2 +- drivers/net/phy/phy_device.c | 9 + drivers/net/phy/phylink.c | 2 +- drivers/net/usb/cdc-phonet.c | 2 + drivers/net/usb/r8152.c | 40 +--- drivers/net/veth.c | 3 +- drivers/net/wan/fsl_ucc_hdlc.c | 8 +- drivers/net/wan/hdlc_x25.c | 42 +++- drivers/net/wireless/mediatek/mt76/dma.c | 15 +- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 10 +- drivers/nvme/host/core.c | 15 +- drivers/nvme/host/fc.c | 3 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/target/rdma.c | 5 +- .../platform/x86/dell-wmi-sysman/enum-attributes.c | 3 + .../platform/x86/dell-wmi-sysman/int-attributes.c | 3 + .../x86/dell-wmi-sysman/passobj-attributes.c | 3 + .../x86/dell-wmi-sysman/string-attributes.c | 3 + drivers/platform/x86/dell-wmi-sysman/sysman.c | 84 +++----- drivers/platform/x86/intel-vbtn.c | 12 +- drivers/platform/x86/intel_pmt_crashlog.c | 13 +- drivers/regulator/qcom-rpmh-regulator.c | 6 +- drivers/scsi/mpt3sas/mpt3sas_base.c | 8 +- drivers/scsi/qedi/qedi_main.c | 1 + drivers/scsi/qla2xxx/qla_target.c | 13 +- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 4 - drivers/scsi/ufs/ufs-qcom.c | 10 + drivers/soc/ti/omap_prm.c | 8 +- drivers/staging/rtl8192e/Kconfig | 1 + drivers/xen/Kconfig | 4 +- fs/btrfs/dev-replace.c | 3 + fs/btrfs/disk-io.c | 19 +- fs/btrfs/inode.c | 14 +- fs/btrfs/qgroup.c | 12 +- fs/btrfs/volumes.c | 3 + fs/cachefiles/rdwr.c | 7 +- fs/cifs/cifsglob.h | 4 +- fs/cifs/cifspdu.h | 5 + fs/cifs/smb2glob.h | 1 + fs/cifs/smb2ops.c | 27 ++- fs/cifs/smb2pdu.c | 6 +- fs/cifs/smb2transport.c | 37 +++- fs/cifs/transport.c | 2 +- fs/ext4/mballoc.c | 11 +- fs/ext4/xattr.c | 4 + fs/gfs2/log.c | 4 + fs/gfs2/trans.c | 2 + fs/io_uring.c | 14 +- fs/nfs/Kconfig | 2 +- fs/nfs/nfs3xdr.c | 3 +- fs/nfs/nfs4proc.c | 3 + fs/squashfs/export.c | 8 +- fs/squashfs/id.c | 6 +- fs/squashfs/squashfs_fs.h | 1 + fs/squashfs/xattr_id.c | 6 +- include/acpi/acpi_bus.h | 1 + include/asm-generic/vmlinux.lds.h | 5 +- include/linux/bpf.h | 33 +++- include/linux/brcmphy.h | 4 + include/linux/device-mapper.h | 15 +- include/linux/hugetlb_cgroup.h | 15 +- include/linux/if_macvlan.h | 3 +- include/linux/memblock.h | 4 +- include/linux/mm.h | 18 +- include/linux/mm_types.h | 1 + include/linux/mmu_notifier.h | 10 +- include/linux/mutex.h | 2 +- include/linux/netfilter/x_tables.h | 7 +- include/linux/pagemap.h | 1 - include/linux/phy.h | 2 + include/linux/static_call.h | 43 ++-- include/linux/static_call_types.h | 50 +++++ include/linux/u64_stats_sync.h | 7 +- include/linux/usermode_driver.h | 1 + include/net/dst.h | 11 ++ include/net/inet_connection_sock.h | 2 +- include/net/netfilter/nf_tables.h | 3 + include/net/nexthop.h | 24 +++ include/net/red.h | 10 +- include/net/rtnetlink.h | 2 + include/uapi/linux/psample.h | 5 +- kernel/bpf/bpf_inode_storage.c | 2 +- kernel/bpf/bpf_struct_ops.c | 2 +- kernel/bpf/core.c | 4 +- kernel/bpf/preload/bpf_preload_kern.c | 19 +- kernel/bpf/syscall.c | 5 + kernel/bpf/trampoline.c | 218 ++++++++++++++++----- kernel/bpf/verifier.c | 4 + kernel/fork.c | 8 + kernel/gcov/clang.c | 69 +++++++ kernel/power/energy_model.c | 2 +- kernel/static_call.c | 71 ++++++- kernel/trace/ftrace.c | 43 +++- kernel/usermode_driver.c | 21 +- mm/highmem.c | 4 +- mm/hugetlb.c | 41 +++- mm/hugetlb_cgroup.c | 10 +- mm/mmu_notifier.c | 23 +++ mm/z3fold.c | 16 +- net/bridge/br_switchdev.c | 2 + net/can/isotp.c | 18 +- net/core/dev.c | 14 +- net/core/drop_monitor.c | 23 +++ net/core/dst.c | 59 ++++-- net/core/flow_dissector.c | 2 +- net/dccp/ipv6.c | 5 + net/ipv4/inet_connection_sock.c | 7 +- net/ipv4/netfilter/arp_tables.c | 16 +- net/ipv4/netfilter/ip_tables.c | 16 +- net/ipv4/route.c | 45 +---- net/ipv4/tcp_minisocks.c | 7 +- net/ipv6/ip6_fib.c | 2 +- net/ipv6/ip6_input.c | 10 - net/ipv6/netfilter/ip6_tables.c | 16 +- net/ipv6/route.c | 36 +--- net/ipv6/tcp_ipv6.c | 5 + net/mac80211/cfg.c | 4 +- net/mac80211/ibss.c | 2 + net/mac80211/mlme.c | 2 +- net/mac80211/util.c | 2 +- net/mptcp/options.c | 24 ++- net/mptcp/subflow.c | 5 + net/netfilter/nf_conntrack_netlink.c | 1 + net/netfilter/nf_flow_table_core.c | 2 +- net/netfilter/nf_tables_api.c | 19 +- net/netfilter/x_tables.c | 49 +++-- net/qrtr/qrtr.c | 5 + net/sched/cls_flower.c | 2 +- net/sched/sch_choke.c | 7 +- net/sched/sch_gred.c | 2 +- net/sched/sch_red.c | 7 +- net/sched/sch_sfq.c | 2 +- net/sctp/output.c | 7 - net/sctp/outqueue.c | 7 + net/tipc/node.c | 11 +- net/vmw_vsock/af_vsock.c | 1 + scripts/dummy-tools/gcc | 5 + security/integrity/iint.c | 8 + security/selinux/include/security.h | 15 +- security/selinux/selinuxfs.c | 13 +- security/selinux/ss/services.c | 63 +++--- sound/hda/intel-nhlt.c | 5 + tools/include/linux/static_call_types.h | 50 +++++ tools/lib/bpf/Makefile | 2 +- tools/lib/bpf/btf_dump.c | 2 +- tools/lib/bpf/libbpf.c | 3 +- tools/lib/bpf/netlink.c | 2 +- tools/objtool/check.c | 17 +- tools/perf/util/auxtrace.c | 4 - tools/perf/util/synthetic-events.c | 9 +- tools/testing/kunit/configs/broken_on_uml.config | 2 + tools/testing/selftests/arm64/fp/sve-ptrace.c | 2 +- .../testing/selftests/bpf/prog_tests/fexit_sleep.c | 82 ++++++++ tools/testing/selftests/bpf/progs/fexit_sleep.c | 31 +++ .../testing/selftests/bpf/progs/test_tunnel_kern.c | 6 +- .../selftests/net/forwarding/vxlan_bridge_1d.sh | 2 +- .../selftests/net/reuseaddr_ports_exhausted.c | 32 +-- 309 files changed, 3116 insertions(+), 1113 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/254 mt76: fix tx skb error handling in mt76_dma_tx_queue_skb
From: Felix Fietkau <[email protected]>
[ Upstream commit ae064fc0e32a4d28389086d9f4b260a0c157cfee ]
When running out of room in the tx queue after calling drv->tx_prepare_skb, the buffer list will already have been modified on MT7615 and newer drivers. This can leak a DMA mapping and will show up as swiotlb allocation failures on x86.
Fix this by moving the queue length check further up. This is less accurate, since it can overestimate the needed room in the queue on MT7615 and newer, but the difference is small enough to not matter in practice.
--- drivers/net/wireless/mediatek/mt76/dma.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/net/wireless/mediatek/mt76/dma.c +6 -9
@@ -345,7 +345,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, };struct ieee80211_hw *hw;int len, n =0 , ret = -ENOMEM ; -struct mt76_queue_entry e;struct mt76_txwi_cache *t;struct sk_buff *iter;dma_addr_t addr;
@@ -387,6 +386,11 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, } tx_info.nbuf = n; +if (q->queued + (tx_info.nbuf +1 ) /2 >= q->ndesc -1 ) { + ret = -ENOMEM ; + goto unmap; + } +dma_sync_single_for_cpu (dev->dev, t->dma_addr, dev->drv->txwi_size,DMA_TO_DEVICE ); ret = dev->drv->tx_prepare_skb (dev, txwi, q->qid, wcid, sta, &tx_info);
@@ -395,11 +399,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,if (ret <0 ) goto unmap; -if (q->queued + (tx_info.nbuf +1 ) /2 >= q->ndesc -1 ) { - ret = -ENOMEM ; - goto unmap; - } -return mt76_dma_add_buf (dev, q, tx_info.buf, tx_info.nbuf, tx_info.info, tx_info.skb, t);
@@ -415,9 +414,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, dev->test.tx_done--;#endif - e.skb = tx_info.skb; - e.txwi = t; - dev->drv->tx_complete_skb (dev, &e); +dev_kfree_skb (tx_info.skb);mt76_put_txwi (dev, t);return ret; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 2/254 mt76: mt7915: only modify tx buffer list after allocating tx token id
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 94f0e6256c2ab6803c935634aa1f653174c94879 ]
Modifying the tx buffer list too early can leak DMA mappings
--- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/mac.c +5 -5
@@ -957,11 +957,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, } txp->nbuf = nbuf; -/* pass partial skb header to fw */ - tx_info->buf[1 ].len =MT_CT_PARSE_LEN ; - tx_info->buf[1 ].skip_unmap = true; - tx_info->nbuf =MT_CT_DMA_BUF_NUM ; - txp->flags =cpu_to_le16 (MT_CT_INFO_APPLY_TXD |MT_CT_INFO_FROM_HOST );if (!key)
@@ -999,6 +994,11 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, txp->rept_wds_wcid =cpu_to_le16 (0x3ff ); tx_info->skb =DMA_DUMMY_DATA ; +/* pass partial skb header to fw */ + tx_info->buf[1 ].len =MT_CT_PARSE_LEN ; + tx_info->buf[1 ].skip_unmap = true; + tx_info->nbuf =MT_CT_DMA_BUF_NUM ; +return 0 ; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 3/254 net: stmmac: fix dma physical address of descriptor when display ring
In reply to Greg Kroah-HartmanFrom: Joakim Zhang <[email protected]>
[ Upstream commit bfaf91ca848e758ed7be99b61fd936d03819fa56 ]
Driver uses dma_alloc_coherent to allocate dma memory for descriptors, dma_alloc_coherent will return both the virtual address and physical address. AFAIK, virt_to_phys could not convert virtual address to physical address, for which memory is allocated by dma_alloc_coherent.
dwmac4_display_ring() function is broken for various descriptor, it only support normal descriptor(struct dma_desc) now, this patch also extends to support all descriptor types.
--- .../ethernet/stmicro/stmmac/dwmac4_descs.c | 50 +++++++++++++--- .../net/ethernet/stmicro/stmmac/enh_desc.c | 9 ++- drivers/net/ethernet/stmicro/stmmac/hwif.h | 3 +- .../net/ethernet/stmicro/stmmac/norm_desc.c | 9 ++- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 57 ++++++++++++------- 5 files changed, 94 insertions(+), 34 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +42 -8
@@ -402,19 +402,53 @@ static void dwmac4_rd_set_tx_ic(struct dma_desc *p) p->des2 |=cpu_to_le32 (TDES2_INTERRUPT_ON_COMPLETION ); } -static void dwmac4_display_ring (void *head,unsigned int size,bool rx) +static void dwmac4_display_ring (void *head,unsigned int size,bool rx, +dma_addr_t dma_rx_phy,unsigned int desc_size) { -struct dma_desc *p = (struct dma_desc *)head; +dma_addr_t dma_addr;int i;pr_info ("%s descriptor ring:\n" , rx ?"RX" :"TX" ); -for (i =0 ; i < size; i++) { -pr_info ("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n" , - i, (unsigned int )virt_to_phys (p), -le32_to_cpu (p->des0),le32_to_cpu (p->des1), -le32_to_cpu (p->des2),le32_to_cpu (p->des3)); - p++; +if (desc_size ==sizeof (struct dma_desc )) { +struct dma_desc *p = (struct dma_desc *)head; + +for (i =0 ; i < size; i++) { + dma_addr = dma_rx_phy + i *sizeof (*p); +pr_info ("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n" , + i, &dma_addr, +le32_to_cpu (p->des0),le32_to_cpu (p->des1), +le32_to_cpu (p->des2),le32_to_cpu (p->des3)); + p++; + } + }else if (desc_size ==sizeof (struct dma_extended_desc )) { +struct dma_extended_desc *extp = (struct dma_extended_desc *)head; + +for (i =0 ; i < size; i++) { + dma_addr = dma_rx_phy + i *sizeof (*extp); +pr_info ("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n" , + i, &dma_addr, +le32_to_cpu (extp->basic.des0),le32_to_cpu (extp->basic.des1), +le32_to_cpu (extp->basic.des2),le32_to_cpu (extp->basic.des3), +le32_to_cpu (extp->des4),le32_to_cpu (extp->des5), +le32_to_cpu (extp->des6),le32_to_cpu (extp->des7)); + extp++; + } + }else if (desc_size ==sizeof (struct dma_edesc )) { +struct dma_edesc *ep = (struct dma_edesc *)head; + +for (i =0 ; i < size; i++) { + dma_addr = dma_rx_phy + i *sizeof (*ep); +pr_info ("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n" , + i, &dma_addr, +le32_to_cpu (ep->des4),le32_to_cpu (ep->des5), +le32_to_cpu (ep->des6),le32_to_cpu (ep->des7), +le32_to_cpu (ep->basic.des0),le32_to_cpu (ep->basic.des1), +le32_to_cpu (ep->basic.des2),le32_to_cpu (ep->basic.des3)); + ep++; + } + }else { +pr_err ("unsupported descriptor!" ); } }
drivers/net/ethernet/stmicro/stmmac/enh_desc.c +6 -3
@@ -417,19 +417,22 @@ static int enh_desc_get_rx_timestamp_status(void *desc, void *next_desc, } } -static void enh_desc_display_ring (void *head,unsigned int size,bool rx) +static void enh_desc_display_ring (void *head,unsigned int size,bool rx, +dma_addr_t dma_rx_phy,unsigned int desc_size) {struct dma_extended_desc *ep = (struct dma_extended_desc *)head; +dma_addr_t dma_addr;int i;pr_info ("Extended %s descriptor ring:\n" , rx ?"RX" :"TX" );for (i =0 ; i < size; i++) {u64 x; + dma_addr = dma_rx_phy + i *sizeof (*ep); x = *(u64 *)ep; -pr_info ("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n" , - i, (unsigned int )virt_to_phys (ep), +pr_info ("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n" , + i, &dma_addr, (unsigned int )x, (unsigned int )(x >>32 ), ep->basic.des2, ep->basic.des3); ep++;
drivers/net/ethernet/stmicro/stmmac/hwif.h +2 -1
@@ -78,7 +78,8 @@ struct stmmac_desc_ops {/* get rx timestamp status */ int (*get_rx_timestamp_status)(void *desc,void *next_desc,u32 ats);/* Display ring */ -void (*display_ring)(void *head,unsigned int size,bool rx); +void (*display_ring)(void *head,unsigned int size,bool rx, +dma_addr_t dma_rx_phy,unsigned int desc_size);/* set MSS via context descriptor */ void (*set_mss)(struct dma_desc *p,unsigned int mss);/* get descriptor skbuff address */
drivers/net/ethernet/stmicro/stmmac/norm_desc.c +6 -3
@@ -269,19 +269,22 @@ static int ndesc_get_rx_timestamp_status(void *desc, void *next_desc, u32 ats)return 1 ; } -static void ndesc_display_ring (void *head,unsigned int size,bool rx) +static void ndesc_display_ring (void *head,unsigned int size,bool rx, +dma_addr_t dma_rx_phy,unsigned int desc_size) {struct dma_desc *p = (struct dma_desc *)head; +dma_addr_t dma_addr;int i;pr_info ("%s descriptor ring:\n" , rx ?"RX" :"TX" );for (i =0 ; i < size; i++) {u64 x; + dma_addr = dma_rx_phy + i *sizeof (*p); x = *(u64 *)p; -pr_info ("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x" , - i, (unsigned int )virt_to_phys (p), +pr_info ("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x" , + i, &dma_addr, (unsigned int )x, (unsigned int )(x >>32 ), p->des2, p->des3); p++;
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +38 -19
141 lines not on this page · raw message
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 4/254 net: fec: ptp: avoid register access when ipg clock is disabled
In reply to Greg Kroah-HartmanFrom: Heiko Thiery <[email protected]>
[ Upstream commit 6a4d7234ae9a3bb31181f348ade9bbdb55aeb5c5 ]
When accessing the timecounter register on an i.MX8MQ the kernel hangs. This is only the case when the interface is down. This can be reproduced by reading with 'phc_ctrl eth0 get'.
Like described in the change in 91c0d987a9788dcc5fe26baafd73bf9242b68900 the igp clock is disabled when the interface is down and leads to a system hang.
So we check if the ptp clock status before reading the timecounter register.
--- drivers/net/ethernet/freescale/fec_ptp.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/ethernet/freescale/fec_ptp.c +7 -0
@@ -377,9 +377,16 @@ static int fec_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)u64 ns;unsigned long flags; +mutex_lock (&adapter->ptp_clk_mutex); +/* Check the ptp clock */ +if (!adapter->ptp_clk_on) { +mutex_unlock (&adapter->ptp_clk_mutex); +return -EINVAL ; + }spin_lock_irqsave (&adapter->tmreg_lock, flags); ns =timecounter_read (&adapter->tc);spin_unlock_irqrestore (&adapter->tmreg_lock, flags); +mutex_unlock (&adapter->ptp_clk_mutex); *ts =ns_to_timespec64 (ns);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 5/254 powerpc/4xx: Fix build errors from mfdcr()
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit eead089311f4d935ab5d1d8fbb0c42ad44699ada ]
lkp reported a build error in fsp2.o:
CC arch/powerpc/platforms/44x/fsp2.o
{standard input}:577: Error: unsupported relocation against base
Which comes from:
pr_err("GESR0: 0x%08x\n", mfdcr(base + PLB4OPB_GESR0));Where our mfdcr() macro is stringifying "base + PLB4OPB_GESR0", and passing that to the assembler, which obviously doesn't work.
The mfdcr() macro already checks that the argument is constant using __builtin_constant_p(), and if not calls the out-of-line version of mfdcr(). But in this case GCC is smart enough to notice that "base + PLB4OPB_GESR0" will be constant, even though it's not something we can immediately stringify into a register number.
Segher pointed out that passing the register number to the inline asm as a constant would be better, and in fact it fixes the build error, presumably because it gives GCC a chance to resolve the value.
While we're at it, change mtdcr() similarly.
--- arch/powerpc/include/asm/dcr-native.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/powerpc/include/asm/dcr-native.h +4 -4
@@ -53,8 +53,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)#define mfdcr (rn) \ ({unsigned int rval; \ if (__builtin_constant_p(rn) && rn < 1024) \ - asm volatile("mfdcr %0," __stringify(rn) \ - : "=r" (rval)); \ + asm volatile("mfdcr %0, %1" : "=r" (rval) \ + : "n" (rn)); \ else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ rval = mfdcrx(rn); \ else \
@@ -64,8 +64,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)#define mtdcr (rn, v) \ do { \ if (__builtin_constant_p(rn) && rn < 1024) \ - asm volatile("mtdcr " __stringify(rn) ",%0" \ - : : "r" (v)); \ + asm volatile("mtdcr %0, %1" \ + : : "n" (rn), "r" (v)); \ else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ mtdcrx(rn, v); \ else \
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 6/254 atm: eni: dont release is never initialized
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 4deb550bc3b698a1f03d0332cde3df154d1b6c1e ]
label err_eni_release is reachable when eni_start() fail.
In eni_start() it calls dev->phy->start() in the last step, if start() fail we don't need to call phy->stop(), if start() is never called, we neither need to call phy->stop(), otherwise null-ptr-deref will happen.
In order to fix this issue, don't call phy->stop() in label err_eni_release
[ 4.875714] ================================================================== [ 4.876091] BUG: KASAN: null-ptr-deref in suni_stop+0x47/0x100 [suni] [ 4.876433] Read of size 8 at addr 0000000000000030 by task modprobe/95 [ 4.876778] [ 4.876862] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #2 [ 4.877290] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd94 [ 4.877876] Call Trace: [ 4.878009] dump_stack+0x7d/0xa3 [ 4.878191] kasan_report.cold+0x10c/0x10e [ 4.878410] ? __slab_free+0x2f0/0x340 [ 4.878612] ? suni_stop+0x47/0x100 [suni] [ 4.878832] suni_stop+0x47/0x100 [suni] [ 4.879043] eni_do_release+0x3b/0x70 [eni] [ 4.879269] eni_init_one.cold+0x1152/0x1747 [eni] [ 4.879528] ? _raw_spin_lock_irqsave+0x7b/0xd0 [ 4.879768] ? eni_ioctl+0x270/0x270 [eni] [ 4.879990] ? __mutex_lock_slowpath+0x10/0x10 [ 4.880226] ? eni_ioctl+0x270/0x270 [eni] [ 4.880448] local_pci_probe+0x6f/0xb0 [ 4.880650] pci_device_probe+0x171/0x240 [ 4.880864] ? pci_device_remove+0xe0/0xe0 [ 4.881086] ? kernfs_create_link+0xb6/0x110 [ 4.881315] ? sysfs_do_create_link_sd.isra.0+0x76/0xe0 [ 4.881594] really_probe+0x161/0x420 [ 4.881791] driver_probe_device+0x6d/0xd0 [ 4.882010] device_driver_attach+0x82/0x90 [ 4.882233] ? device_driver_attach+0x90/0x90 [ 4.882465] __driver_attach+0x60/0x100 [ 4.882671] ? device_driver_attach+0x90/0x90 [ 4.882903] bus_for_each_dev+0xe1/0x140 [ 4.883114] ? subsys_dev_iter_exit+0x10/0x10 [ 4.883346] ? klist_node_init+0x61/0x80 [ 4.883557] bus_add_driver+0x254/0x2a0 [ 4.883764] driver_register+0xd3/0x150 [ 4.883971] ? 0xffffffffc0038000 [ 4.884149] do_one_initcall+0x84/0x250 [ 4.884355] ? trace_event_raw_event_initcall_finish+0x150/0x150 [ 4.884674] ? unpoison_range+0xf/0x30 [ 4.884875] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 [ 4.885150] ? unpoison_range+0xf/0x30 [ 4.885352] ? unpoison_range+0xf/0x30 [ 4.885557] do_init_module+0xf8/0x350 [ 4.885760] load_module+0x3fe6/0x4340 [ 4.885960] ? vm_unmap_ram+0x1d0/0x1d0 [ 4.886166] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 [ 4.886441] ? module_frob_arch_sections+0x20/0x20 [ 4.886697] ? __do_sys_finit_module+0x108/0x170 [ 4.886941] __do_sys_finit_module+0x108/0x170 [ 4.887178] ? __ia32_sys_init_module+0x40/0x40 [ 4.887419] ? file_open_root+0x200/0x200 [ 4.887634] ? do_sys_open+0x85/0xe0 [ 4.887826] ? filp_open+0x50/0x50 [ 4.888009] ? fpregs_assert_state_consistent+0x4d/0x60 [ 4.888287] ? exit_to_user_mode_prepare+0x2f/0x130 [ 4.888547] do_syscall_64+0x33/0x40 [ 4.888739] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 4.889010] RIP: 0033:0x7ff62fcf1cf7 [ 4.889202] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f71 [ 4.890172] RSP: 002b:00007ffe6644ade8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 4.890570] RAX: ffffffffffffffda RBX: 0000000000f2ca70 RCX: 00007ff62fcf1cf7 [ 4.890944] RDX: 0000000000000000 RSI: 0000000000f2b9e0 RDI: 0000000000000003 [ 4.891318] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 [ 4.891691] R10: 00007ff62fd55300 R11: 0000000000000246 R12: 0000000000f2b9e0 [ 4.892064] R13: 0000000000000000 R14: 0000000000f2bdd0 R15: 0000000000000001 [ 4.892439] ==================================================================
--- drivers/atm/eni.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/atm/eni.c +2 -1
@@ -2260,7 +2260,8 @@ static int eni_init_one(struct pci_dev *pci_dev,return rc; err_eni_release: -eni_do_release (dev); + dev->phy =NULL ; +iounmap (ENI_DEV (dev)->ioaddr); err_unregister:atm_dev_deregister (dev); err_free_consistent:
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 7/254 atm: lanai: dont run lanai_dev_close if not open
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit a2bd45834e83d6c5a04d397bde13d744a4812dfc ]
lanai_dev_open() can fail. When it fail, lanai->base is unmapped and the pci device is disabled. The caller, lanai_init_one(), then tries to run atm_dev_deregister(). This will subsequently call lanai_dev_close() and use the already released MMIO area.
To fix this issue, set the lanai->base to NULL if open fail, and test the flag in lanai_dev_close().
[ 8.324153] lanai: lanai_start() failed, err=19 [ 8.324819] lanai(itf 0): shutting down interface [ 8.325211] BUG: unable to handle page fault for address: ffffc90000180024 [ 8.325781] #PF: supervisor write access in kernel mode [ 8.326215] #PF: error_code(0x0002) - not-present page [ 8.326641] PGD 100000067 P4D 100000067 PUD 100139067 PMD 10013a067 PTE 0 [ 8.327206] Oops: 0002 [#1] SMP KASAN NOPTI [ 8.327557] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #12 [ 8.328229] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-4 [ 8.329145] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai] [ 8.329587] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80 [ 8.330917] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246 [ 8.331196] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a [ 8.331572] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000 [ 8.331948] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa [ 8.332326] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4 [ 8.332701] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88 [ 8.333077] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000 [ 8.333502] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.333806] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0 [ 8.334182] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8.334557] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8.334932] Call Trace: [ 8.335066] atm_dev_deregister+0x161/0x1a0 [atm] [ 8.335324] lanai_init_one.cold+0x20c/0x96d [lanai] [ 8.335594] ? lanai_send+0x2a0/0x2a0 [lanai] [ 8.335831] local_pci_probe+0x6f/0xb0 [ 8.336039] pci_device_probe+0x171/0x240 [ 8.336255] ? pci_device_remove+0xe0/0xe0 [ 8.336475] ? kernfs_create_link+0xb6/0x110 [ 8.336704] ? sysfs_do_create_link_sd.isra.0+0x76/0xe0 [ 8.336983] really_probe+0x161/0x420 [ 8.337181] driver_probe_device+0x6d/0xd0 [ 8.337401] device_driver_attach+0x82/0x90 [ 8.337626] ? device_driver_attach+0x90/0x90 [ 8.337859] __driver_attach+0x60/0x100 [ 8.338065] ? device_driver_attach+0x90/0x90 [ 8.338298] bus_for_each_dev+0xe1/0x140 [ 8.338511] ? subsys_dev_iter_exit+0x10/0x10 [ 8.338745] ? klist_node_init+0x61/0x80 [ 8.338956] bus_add_driver+0x254/0x2a0 [ 8.339164] driver_register+0xd3/0x150 [ 8.339370] ? 0xffffffffc0028000 [ 8.339550] do_one_initcall+0x84/0x250 [ 8.339755] ? trace_event_raw_event_initcall_finish+0x150/0x150 [ 8.340076] ? free_vmap_area_noflush+0x1a5/0x5c0 [ 8.340329] ? unpoison_range+0xf/0x30 [ 8.340532] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 [ 8.340806] ? unpoison_range+0xf/0x30 [ 8.341014] ? unpoison_range+0xf/0x30 [ 8.341217] do_init_module+0xf8/0x350 [ 8.341419] load_module+0x3fe6/0x4340 [ 8.341621] ? vm_unmap_ram+0x1d0/0x1d0 [ 8.341826] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 [ 8.342101] ? module_frob_arch_sections+0x20/0x20 [ 8.342358] ? __do_sys_finit_module+0x108/0x170 [ 8.342604] __do_sys_finit_module+0x108/0x170 [ 8.342841] ? __ia32_sys_init_module+0x40/0x40 [ 8.343083] ? file_open_root+0x200/0x200 [ 8.343298] ? do_sys_open+0x85/0xe0 [ 8.343491] ? filp_open+0x50/0x50 [ 8.343675] ? exit_to_user_mode_prepare+0xfc/0x130 [ 8.343935] do_syscall_64+0x33/0x40 [ 8.344132] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 8.344401] RIP: 0033:0x7f08eb887cf7 [ 8.344594] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d6 41 [ 8.345565] RSP: 002b:00007ffcd5c98ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 8.345962] RAX: ffffffffffffffda RBX: 00000000008fea70 RCX: 00007f08eb887cf7 [ 8.346336] RDX: 0000000000000000 RSI: 00000000008fd9e0 RDI: 0000000000000003 [ 8.346711] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 [ 8.347085] R10: 00007f08eb8eb300 R11: 0000000000000246 R12: 00000000008fd9e0 [ 8.347460] R13: 0000000000000000 R14: 00000000008fddd0 R15: 0000000000000001 [ 8.347836] Modules linked in: lanai(+) atm [ 8.348065] CR2: ffffc90000180024 [ 8.348244] ---[ end trace 7fdc1c668f2003e5 ]--- [ 8.348490] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai] [ 8.348772] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80 [ 8.349745] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246 [ 8.350022] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a [ 8.350397] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000 [ 8.350772] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa [ 8.351151] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4 [ 8.351525] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88 [ 8.351918] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000 [ 8.352343] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.352647] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0 [ 8.353022] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8.353397] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8.353958] modprobe (95) used greatest stack depth: 26216 bytes left
--- drivers/atm/lanai.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/atm/lanai.c +4 -1
@@ -2233,6 +2233,7 @@ static int lanai_dev_open(struct atm_dev *atmdev)conf1_write (lanai);#endif iounmap (lanai->base); + lanai->base =NULL ; error_pci:pci_disable_device (lanai->pci); error:
@@ -2245,6 +2246,8 @@ static int lanai_dev_open(struct atm_dev *atmdev)static void lanai_dev_close (struct atm_dev *atmdev) {struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data; +if (lanai->base==NULL ) +return ; printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n", lanai->number);lanai_timed_poll_stop (lanai);
@@ -2552,7 +2555,7 @@ static int lanai_init_one(struct pci_dev *pci,struct atm_dev *atmdev;int result; - lanai =kmalloc (sizeof (*lanai),GFP_KERNEL ); + lanai =kzalloc (sizeof (*lanai),GFP_KERNEL );if (lanai ==NULL ) { printk(KERN_ERR DEV_LABEL ": couldn't allocate dev_data structure!\n");
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 8/254 Revert "r8152: adjust the settings about MAC clock speed down for RTL8153"
In reply to Greg Kroah-HartmanFrom: Hayes Wang <[email protected]>
[ Upstream commit 4b5dc1a94d4f92b5845e98bd9ae344b26d933aad ]
This reverts commit 134f98bcf1b898fb9d6f2b91bc85dd2e5478b4b8.
The r8153_mac_clk_spd() is used for RTL8153A only, because the register table of RTL8153B is different from RTL8153A. However, this function would be called when RTL8153B calls r8153_first_init() and r8153_enter_oob(). That causes RTL8153B becomes unstable when suspending and resuming. The worst case may let the device stop working.
Besides, revert this commit to disable MAC clock speed down for RTL8153A. It would avoid the known issue when enabling U1. The data of the first control transfer may be wrong when exiting U1.
--- drivers/net/usb/r8152.c | 35 ++++++----------------------------- 1 file changed, 6 insertions(+), 29 deletions(-)
drivers/net/usb/r8152.c +6 -29
@@ -3016,29 +3016,6 @@ static void __rtl_set_wol(struct r8152 *tp, u32 wolopts)device_set_wakeup_enable (&tp->udev->dev, false); } -static void r8153_mac_clk_spd (struct r8152 *tp,bool enable) -{ -/* MAC clock speed down */ -if (enable) { -ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL , -ALDPS_SPDWN_RATIO ); -ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL2 , -EEE_SPDWN_RATIO ); -ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL3 , -PKT_AVAIL_SPDWN_EN |SUSPEND_SPDWN_EN | -U1U2_SPDWN_EN |L1_SPDWN_EN ); -ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL4 , -PWRSAVE_SPDWN_EN |RXDV_SPDWN_EN |TX10MIDLE_EN | -TP100_SPDWN_EN |TP500_SPDWN_EN |EEE_SPDWN_EN | -TP1000_SPDWN_EN ); - }else { -ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL ,0 ); -ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL2 ,0 ); -ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL3 ,0 ); -ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL4 ,0 ); - } -} -static void r8153_u1u2en (struct r8152 *tp,bool enable) {u8 u1u2[8 ];
@@ -3338,11 +3315,9 @@ static void rtl8153_runtime_enable(struct r8152 *tp, bool enable)if (enable) {r8153_u1u2en (tp, false);r8153_u2p3en (tp, false); -r8153_mac_clk_spd (tp, true);rtl_runtime_suspend_enable (tp, true); }else {rtl_runtime_suspend_enable (tp, false); -r8153_mac_clk_spd (tp, false);switch (tp->version) {case RTL_VER_03 :
@@ -4678,7 +4653,6 @@ static void r8153_first_init(struct r8152 *tp) {u32 ocp_data; -r8153_mac_clk_spd (tp, false);rxdy_gated_en (tp, true);r8153_teredo_off (tp);
@@ -4729,8 +4703,6 @@ static void r8153_enter_oob(struct r8152 *tp) {u32 ocp_data; -r8153_mac_clk_spd (tp, true); - ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL ); ocp_data &= ~NOW_IS_OOB ;ocp_write_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL , ocp_data);
@@ -5456,10 +5428,15 @@ static void r8153_init(struct r8152 *tp)ocp_write_word (tp,MCU_TYPE_USB ,USB_CONNECT_TIMER ,0x0001 ); +/* MAC clock speed down */ +ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL ,0 ); +ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL2 ,0 ); +ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL3 ,0 ); +ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL4 ,0 ); +r8153_power_cut_en (tp, false);rtl_runtime_suspend_enable (tp, false);r8153_u1u2en (tp, true); -r8153_mac_clk_spd (tp, false);usb_enable_lpm (tp->udev); ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_CONFIG6 );
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 9/254 ALSA: hda: ignore invalid NHLT table
In reply to Greg Kroah-HartmanFrom: Mark Pearson <[email protected]>
[ Upstream commit a14a6219996ee6f6e858d83b11affc7907633687 ]
On some Lenovo systems if the microphone is disabled in the BIOS only the NHLT table header is created, with no data. This means the endpoints field is not correctly set to zero - leading to an unintialised variable and hence invalid descriptors are parsed leading to page faults.
The Lenovo firmware team is addressing this, but adding a check preventing invalid tables being parsed is worthwhile.
Tested on a Lenovo T14.
--- sound/hda/intel-nhlt.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/hda/intel-nhlt.c +5 -0
@@ -39,6 +39,11 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt)if (!nhlt)return 0 ; +if (nhlt->header.length <=sizeof (struct acpi_table_header )) { +dev_warn (dev,"Invalid DMIC description table\n" ); +return 0 ; + } +for (j =0 , epnt = nhlt->desc; j < nhlt->endpoint_count; j++, epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length)) {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 10/254 ixgbe: Fix memleak in ixgbe_configure_clsu32
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit 7a766381634da19fc837619b0a34590498d9d29a ]
When ixgbe_fdir_write_perfect_filter_82599() fails, input allocated by kzalloc() has not been freed, which leads to memleak.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +4 -2
@@ -9582,8 +9582,10 @@ static int ixgbe_configure_clsu32(struct ixgbe_adapter *adapter,ixgbe_atr_compute_perfect_hash_82599 (&input->filter, mask); err =ixgbe_fdir_write_perfect_filter_82599 (hw, &input->filter, input->sw_idx, queue); -if (!err) -ixgbe_update_ethtool_fdir_entry (adapter, input, input->sw_idx); +if (err) + goto err_out_w_lock; + +ixgbe_update_ethtool_fdir_entry (adapter, input, input->sw_idx);spin_unlock (&adapter->fdir_perfect_lock);if ((uhtid !=0x800 ) && (adapter->jump_tables[uhtid]))
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 11/254 scsi: ufs: ufs-qcom: Disable interrupt in reset path
In reply to Greg Kroah-HartmanFrom: Nitin Rawat <[email protected]>
[ Upstream commit 4a791574a0ccf36eb3a0a46fbd71d2768df3eef9 ]
Disable interrupt in reset path to flush pending IRQ handler in order to avoid possible NoC issues.
--- drivers/scsi/ufs/ufs-qcom.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/scsi/ufs/ufs-qcom.c +10 -0
@@ -253,12 +253,17 @@ static int ufs_qcom_host_reset(struct ufs_hba *hba) {int ret =0 ;struct ufs_qcom_host *host =ufshcd_get_variant (hba); +bool reenable_intr = false;if (!host->core_reset) {dev_warn (hba->dev,"%s: reset control not set\n" , __func__); goto out; } + reenable_intr = hba->is_irq_enabled; +disable_irq (hba->irq); + hba->is_irq_enabled = false; + ret =reset_control_assert (host->core_reset);if (ret) { dev_err(hba->dev, "%s: core_reset assert failed, err = %d\n",
@@ -280,6 +285,11 @@ static int ufs_qcom_host_reset(struct ufs_hba *hba)usleep_range (1000 ,1100 ); +if (reenable_intr) { +enable_irq (hba->irq); + hba->is_irq_enabled = true; + } + out:return ret; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 12/254 blk-cgroup: Fix the recursive blkg rwstat
In reply to Greg Kroah-HartmanFrom: Xunlei Pang <[email protected]>
[ Upstream commit 4f44657d74873735e93a50eb25014721a66aac19 ]
The current blkio.throttle.io_service_bytes_recursive doesn't work correctly.
As an example, for the following blkcg hierarchy:
(Made 1GB READ in test1, 512MB READ in test2)
test
/ \test1 test2
$ head -n 1 test/test1/blkio.throttle.io_service_bytes_recursive 8:0 Read 1073684480 $ head -n 1 test/test2/blkio.throttle.io_service_bytes_recursive 8:0 Read 537448448 $ head -n 1 test/blkio.throttle.io_service_bytes_recursive 8:0 Read 537448448
Clearly, above data of "test" reflects "test2" not "test1"+"test2".
Do the correct summary in blkg_rwstat_recursive_sum().
--- block/blk-cgroup-rwstat.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
block/blk-cgroup-rwstat.c +2 -1
@@ -109,6 +109,7 @@ void blkg_rwstat_recursive_sum(struct blkcg_gq *blkg, struct blkcg_policy *pol,lockdep_assert_held (&blkg->q->queue_lock); +memset (sum,0 ,sizeof (*sum));rcu_read_lock ();blkg_for_each_descendant_pre (pos_blkg, pos_css, blkg) {struct blkg_rwstat *rwstat;
@@ -122,7 +123,7 @@ void blkg_rwstat_recursive_sum(struct blkcg_gq *blkg, struct blkcg_policy *pol, rwstat = (void *)pos_blkg + off;for (i =0 ; i <BLKG_RWSTAT_NR ; i++) - sum->cnt[i] =blkg_rwstat_read_counter (rwstat, i); + sum->cnt[i] +=blkg_rwstat_read_counter (rwstat, i); }rcu_read_unlock (); }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 13/254 net: tehuti: fix error return code in bdx_probe()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 38c26ff3048af50eee3fcd591921357ee5bfd9ee ]
When bdx_read_mac() fails, no error return code of bdx_probe() is assigned.
To fix this bug, err is assigned with -EFAULT as error return code.
--- drivers/net/ethernet/tehuti/tehuti.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/tehuti/tehuti.c +1 -0
@@ -2044,6 +2044,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)/*bdx_hw_reset(priv); */ if (bdx_read_mac (priv)) {pr_err ("load MAC address failed\n" ); + err = -EFAULT ; goto err_out_iomap; }SET_NETDEV_DEV (ndev, &pdev->dev);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 14/254 net: intel: iavf: fix error return code of iavf_init_get_resources()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 6650d31f21b8a0043613ae0a4a2e42e49dc20b2d ]
When iavf_process_config() fails, no error return code of iavf_init_get_resources() is assigned.
To fix this bug, err is assigned with the return value of iavf_process_config(), and then err is checked.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +2 -1
@@ -1776,7 +1776,8 @@ static int iavf_init_get_resources(struct iavf_adapter *adapter) goto err_alloc; } -if (iavf_process_config (adapter)) + err =iavf_process_config (adapter); +if (err) goto err_alloc; adapter->current_op =VIRTCHNL_OP_UNKNOWN ;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 15/254 sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count
In reply to Greg Kroah-HartmanFrom: Denis Efremov <[email protected]>
[ Upstream commit 155b23e6e53475ca3b8c2a946299b4d4dd6a5a1e ]
RXMAC_BC_FRM_CNT_COUNT added to mp->rx_bcasts twice in a row in niu_xmac_interrupt(). Remove the second addition.
--- drivers/net/ethernet/sun/niu.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/sun/niu.c +0 -2
@@ -3931,8 +3931,6 @@ static void niu_xmac_interrupt(struct niu *np) mp->rx_mcasts +=RXMAC_MC_FRM_CNT_COUNT ;if (val &XRXMAC_STATUS_RXBCAST_CNT_EXP ) mp->rx_bcasts +=RXMAC_BC_FRM_CNT_COUNT ; -if (val &XRXMAC_STATUS_RXBCAST_CNT_EXP ) - mp->rx_bcasts +=RXMAC_BC_FRM_CNT_COUNT ;if (val &XRXMAC_STATUS_RXHIST1_CNT_EXP ) mp->rx_hist_cnt1 +=RXMAC_HIST_CNT1_COUNT ;if (val &XRXMAC_STATUS_RXHIST2_CNT_EXP )
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 16/254 gianfar: fix jumbo packets+napi+rx overrun crash
In reply to Greg Kroah-HartmanFrom: Michael Braun <[email protected]>
[ Upstream commit d8861bab48b6c1fc3cdbcab8ff9d1eaea43afe7f ]
When using jumbo packets and overrunning rx queue with napi enabled, the following sequence is observed in gfar_add_rx_frag:
| lstatus | | skb | t | lstatus, size, flags | first | len, data_len, *ptr | ---+--------------------------------------+-------+-----------------------+ 13 | 18002348, 9032, INTERRUPT LAST | 0 | 9600, 8000, f554c12e | 12 | 10000640, 1600, INTERRUPT | 0 | 8000, 6400, f554c12e | 11 | 10000640, 1600, INTERRUPT | 0 | 6400, 4800, f554c12e | 10 | 10000640, 1600, INTERRUPT | 0 | 4800, 3200, f554c12e | 09 | 10000640, 1600, INTERRUPT | 0 | 3200, 1600, f554c12e | 08 | 14000640, 1600, INTERRUPT FIRST | 0 | 1600, 0, f554c12e | 07 | 14000640, 1600, INTERRUPT FIRST | 1 | 0, 0, f554c12e | 06 | 1c000080, 128, INTERRUPT LAST FIRST | 1 | 0, 0, abf3bd6e | 05 | 18002348, 9032, INTERRUPT LAST | 0 | 8000, 6400, c5a57780 | 04 | 10000640, 1600, INTERRUPT | 0 | 6400, 4800, c5a57780 | 03 | 10000640, 1600, INTERRUPT | 0 | 4800, 3200, c5a57780 | 02 | 10000640, 1600, INTERRUPT | 0 | 3200, 1600, c5a57780 | 01 | 10000640, 1600, INTERRUPT | 0 | 1600, 0, c5a57780 | 00 | 14000640, 1600, INTERRUPT FIRST | 1 | 0, 0, c5a57780 |
So at t=7 a new packets is started but not finished, probably due to rx overrun - but rx overrun is not indicated in the flags. Instead a new packets starts at t=8. This results in skb->len to exceed size for the LAST fragment at t=13 and thus a negative fragment size added to the skb.
This then crashes:
kernel BUG at include/linux/skbuff.h:2277!
Oops: Exception in kernel mode, sig: 5 [#1] ... NIP [c04689f4] skb_pull+0x2c/0x48 LR [c03f62ac] gfar_clean_rx_ring+0x2e4/0x844 Call Trace: [ec4bfd38] [c06a84c4] _raw_spin_unlock_irqrestore+0x60/0x7c (unreliable) [ec4bfda8] [c03f6a44] gfar_poll_rx_sq+0x48/0xe4 [ec4bfdc8] [c048d504] __napi_poll+0x54/0x26c [ec4bfdf8] [c048d908] net_rx_action+0x138/0x2c0 [ec4bfe68] [c06a8f34] __do_softirq+0x3a4/0x4fc [ec4bfed8] [c0040150] run_ksoftirqd+0x58/0x70 [ec4bfee8] [c0066ecc] smpboot_thread_fn+0x184/0x1cc [ec4bff08] [c0062718] kthread+0x140/0x144 [ec4bff38] [c0012350] ret_from_kernel_thread+0x14/0x1c
This patch fixes this by checking for computed LAST fragment size, so a negative sized fragment is never added.
In order to prevent the newer rx frame from getting corrupted, the FIRST flag is checked to discard the incomplete older frame.
--- drivers/net/ethernet/freescale/gianfar.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/net/ethernet/freescale/gianfar.c +15 -0
@@ -2391,6 +2391,10 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,if (lstatus &BD_LFLAG (RXBD_LAST )) size -= skb->len; +WARN (size <0 ,"gianfar: rx fragment size underflow" ); +if (size <0 ) +return false; +skb_add_rx_frag (skb,skb_shinfo (skb)->nr_frags, page, rxb->page_offset +RXBUF_ALIGNMENT , size,GFAR_RXB_TRUESIZE );
@@ -2553,6 +2557,17 @@ static int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue,if (lstatus &BD_LFLAG (RXBD_EMPTY ))break ; +/* lost RXBD_LAST descriptor due to overrun */ +if (skb && + (lstatus &BD_LFLAG (RXBD_FIRST ))) { +/* discard faulty buffer */ +dev_kfree_skb (skb); + skb =NULL ; + rx_queue->stats.rx_dropped++; + +/* can continue normally */ + } +/* order rx buffer descriptor reads */ rmb ();
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 17/254 cifs: ask for more credit on async read/write code paths
In reply to Greg Kroah-HartmanFrom: Aurelien Aptel <[email protected]>
[ Upstream commit 88fd98a2306755b965e4f4567f84e73db3b6738c ]
When doing a large read or write workload we only very gradually increase the number of credits which can cause problems with parallelizing large i/o (I/O ramps up more slowly than it should for large read/write workloads) especially with multichannel when the number of credits on the secondary channels starts out low (e.g. less than about 130) or when recovering after server throttled back the number of credit.
--- fs/cifs/smb2pdu.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/cifs/smb2pdu.c +2 -4
@@ -4033,8 +4033,7 @@ smb2_async_readv(struct cifs_readdata *rdata)if (rdata->credits.value >0 ) { shdr->CreditCharge =cpu_to_le16 (DIV_ROUND_UP (rdata->bytes,SMB2_MAX_BUFFER_SIZE )); - shdr->CreditRequest = -cpu_to_le16 (le16_to_cpu (shdr->CreditCharge) +1 ); + shdr->CreditRequest =cpu_to_le16 (le16_to_cpu (shdr->CreditCharge) +8 ); rc =adjust_credits (server, &rdata->credits, rdata->bytes);if (rc)
@@ -4340,8 +4339,7 @@ smb2_async_writev(struct cifs_writedata *wdata,if (wdata->credits.value >0 ) { shdr->CreditCharge =cpu_to_le16 (DIV_ROUND_UP (wdata->bytes,SMB2_MAX_BUFFER_SIZE )); - shdr->CreditRequest = -cpu_to_le16 (le16_to_cpu (shdr->CreditCharge) +1 ); + shdr->CreditRequest =cpu_to_le16 (le16_to_cpu (shdr->CreditCharge) +8 ); rc =adjust_credits (server, &wdata->credits, wdata->bytes);if (rc)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 18/254 gfs2: fix use-after-free in trans_drain
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit 1a5a2cfd34c17db73c53ef127272c8c1ae220485 ]
This patch adds code to function trans_drain to remove drained bd elements from the ail lists, if queued, before freeing the bd. If we don't remove the bd from the ail, function ail_drain will try to reference the bd after it has been freed by trans_drain.
Thanks to Andy Price for his analysis of the problem.
--- fs/gfs2/log.c | 4 ++++ fs/gfs2/trans.c | 2 ++ 2 files changed, 6 insertions(+)
fs/gfs2/log.c +4 -0
@@ -935,12 +935,16 @@ static void trans_drain(struct gfs2_trans *tr)while (!list_empty (head)) { bd = list_first_entry(head, struct gfs2_bufdata, bd_list);list_del_init (&bd->bd_list); +if (!list_empty (&bd->bd_ail_st_list)) +gfs2_remove_from_ail (bd);kmem_cache_free (gfs2_bufdata_cachep, bd); } head = &tr->tr_databuf;while (!list_empty (head)) { bd = list_first_entry(head, struct gfs2_bufdata, bd_list);list_del_init (&bd->bd_list); +if (!list_empty (&bd->bd_ail_st_list)) +gfs2_remove_from_ail (bd);kmem_cache_free (gfs2_bufdata_cachep, bd); } }
fs/gfs2/trans.c +2 -0
@@ -134,6 +134,8 @@ static struct gfs2_bufdata *gfs2_alloc_bufdata(struct gfs2_glock *gl, bd->bd_bh = bh; bd->bd_gl = gl;INIT_LIST_HEAD (&bd->bd_list); +INIT_LIST_HEAD (&bd->bd_ail_st_list); +INIT_LIST_HEAD (&bd->bd_ail_gl_list); bh->b_private = bd;return bd; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 19/254 cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev
In reply to Greg Kroah-HartmanFrom: Sudeep Holla <[email protected]>
[ Upstream commit fbb31cb805fd3574d3be7defc06a7fd2fd9af7d2 ]
Add "arm,vexpress" to cpufreq-dt-platdev blacklist since the actual scaling is handled by the firmware cpufreq drivers(scpi, scmi and vexpress-spc).
--- drivers/cpufreq/cpufreq-dt-platdev.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/cpufreq/cpufreq-dt-platdev.c +2 -0
@@ -103,6 +103,8 @@ static const struct of_device_id whitelist[] __initconst = {static const struct of_device_id blacklist[]__initconst = { { .compatible ="allwinner,sun50i-h6" , }, + { .compatible ="arm,vexpress" , }, + { .compatible ="calxeda,highbank" , }, { .compatible ="calxeda,ecx-2000" , },
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 20/254 gpiolib: acpi: Add missing IRQF_ONESHOT
In reply to Greg Kroah-HartmanFrom: Yang Li <[email protected]>
[ Upstream commit 6e5d5791730b55a1f987e1db84b078b91eb49e99 ]
fixed the following coccicheck:
./drivers/gpio/gpiolib-acpi.c:176:7-27: ERROR: Threaded IRQ with no primary handler requested without IRQF_ONESHOT
Make sure threaded IRQs without a primary handler are always request with IRQF_ONESHOT
--- drivers/gpio/gpiolib-acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpiolib-acpi.c +1 -1
@@ -174,7 +174,7 @@ static void acpi_gpiochip_request_irq(struct acpi_gpio_chip *acpi_gpio,int ret, value; ret =request_threaded_irq (event->irq,NULL , event->handler, - event->irqflags,"ACPI:Event" , event); + event->irqflags |IRQF_ONESHOT ,"ACPI:Event" , event);if (ret) { dev_err(acpi_gpio->chip->parent, "Failed to setup interrupt handler for %d\n",
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 21/254 nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default
In reply to Greg Kroah-HartmanFrom: Timo Rothenpieler <[email protected]>
[ Upstream commit a0590473c5e6c4ef17c3132ad08fbad170f72d55 ]
This follows what was done in 8c2fabc6542d9d0f8b16bd1045c2eda59bdcde13. With the default being m, it's impossible to build the module into the kernel.
--- fs/nfs/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/Kconfig +1 -1
@@ -127,7 +127,7 @@ config PNFS_BLOCK config PNFS_FLEXFILE_LAYOUT tristate depends on NFS_V4_1 && NFS_V3 - default m + default NFS_V4 config NFS_V4_1_IMPLEMENTATION_ID_DOMAIN string "NFSv4.1 Implementation ID Domain"
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 22/254 NFS: Correct size calculation for create reply length
In reply to Greg Kroah-HartmanFrom: Frank Sorenson <[email protected]>
[ Upstream commit ad3dbe35c833c2d4d0bbf3f04c785d32f931e7c9 ]
CREATE requests return a post_op_fh3, rather than nfs_fh3. The post_op_fh3 includes an extra word to indicate 'handle_follows'.
Without that additional word, create fails when full 64-byte filehandles are in use.
Add NFS3_post_op_fh_sz, and correct the size calculation for NFS3_createres_sz.
--- fs/nfs/nfs3xdr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfs/nfs3xdr.c +2 -1
@@ -36,6 +36,7 @@#define NFS3_pagepad_sz (1)/* Page padding */ #define NFS3_fhandle_sz (1+16)#define NFS3_fh_sz (NFS3_fhandle_sz)/* shorthand */ +#define NFS3_post_op_fh_sz (1+NFS3_fh_sz)#define NFS3_sattr_sz (15)#define NFS3_filename_sz (1+(NFS3_MAXNAMLEN>>2))#define NFS3_path_sz (1+(NFS3_MAXPATHLEN>>2))
@@ -73,7 +74,7 @@#define NFS3_readlinkres_sz (1+NFS3_post_op_attr_sz+1+NFS3_pagepad_sz)#define NFS3_readres_sz (1+NFS3_post_op_attr_sz+3+NFS3_pagepad_sz)#define NFS3_writeres_sz (1+NFS3_wcc_data_sz+4) -#define NFS3_createres_sz (1+NFS3_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) +#define NFS3_createres_sz (1+NFS3_post_op_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)#define NFS3_renameres_sz (1+(2 * NFS3_wcc_data_sz))#define NFS3_linkres_sz (1+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)#define NFS3_readdirres_sz (1+NFS3_post_op_attr_sz+2+NFS3_pagepad_sz)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 23/254 net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 143c253f42bad20357e7e4432087aca747c43384 ]
When hns_assemble_skb() returns NULL to skb, no error return code of hns_nic_clear_all_rx_fetch() is assigned.
To fix this bug, ret is assigned with -ENOMEM in this case.
--- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns/hns_enet.c +3 -1
@@ -1663,8 +1663,10 @@ static int hns_nic_clear_all_rx_fetch(struct net_device *ndev)for (j =0 ; j < fetch_num; j++) {/* alloc one skb and init */ skb =hns_assemble_skb (ndev); -if (!skb) +if (!skb) { + ret = -ENOMEM ; goto out; + } rd = &tx_ring_data (priv, skb->queue_mapping);hns_nic_net_xmit_hw (ndev, skb, rd);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 24/254 net: wan: fix error return code of uhdlc_init()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 62765d39553cfd1ad340124fe1e280450e8c89e2 ]
When priv->rx_skbuff or priv->tx_skbuff is NULL, no error return code of uhdlc_init() is assigned.
To fix this bug, ret is assigned with -ENOMEM in these cases.
--- drivers/net/wan/fsl_ucc_hdlc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/wan/fsl_ucc_hdlc.c +6 -2
@@ -204,14 +204,18 @@ static int uhdlc_init(struct ucc_hdlc_private *priv) priv->rx_skbuff =kcalloc (priv->rx_ring_size,sizeof (*priv->rx_skbuff),GFP_KERNEL ); -if (!priv->rx_skbuff) +if (!priv->rx_skbuff) { + ret = -ENOMEM ; goto free_ucc_pram; + } priv->tx_skbuff =kcalloc (priv->tx_ring_size,sizeof (*priv->tx_skbuff),GFP_KERNEL ); -if (!priv->tx_skbuff) +if (!priv->tx_skbuff) { + ret = -ENOMEM ; goto free_rx_skbuff; + } priv->skb_curtx =0 ; priv->skb_dirtytx =0 ;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 25/254 net: davicom: Use platform_get_irq_optional()
In reply to Greg Kroah-HartmanFrom: Paul Cercueil <[email protected]>
[ Upstream commit 2e2696223676d56db1a93acfca722c1b96cd552d ]
The second IRQ line really is optional, so use platform_get_irq_optional() to obtain it.
--- drivers/net/ethernet/davicom/dm9000.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/davicom/dm9000.c +1 -1
@@ -1507,7 +1507,7 @@ dm9000_probe(struct platform_device *pdev) goto out; } - db->irq_wake =platform_get_irq (pdev,1 ); + db->irq_wake =platform_get_irq_optional (pdev,1 );if (db->irq_wake >=0 ) {dev_dbg (db->dev,"wakeup irq %d\n" , db->irq_wake);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 26/254 net: enetc: set MAC RX FIFO to recommended value
In reply to Greg Kroah-HartmanFrom: Alex Marginean <[email protected]>
[ Upstream commit 1b2395dfff5bb40228a187f21f577cd90673d344 ]
On LS1028A, the MAC RX FIFO defaults to the value 2, which is too high and may lead to RX lock-up under traffic at a rate higher than 6 Gbps. Set it to 1 instead, as recommended by the hardware design team and by later versions of the ENETC block guide.
--- drivers/net/ethernet/freescale/enetc/enetc_hw.h | 2 ++ drivers/net/ethernet/freescale/enetc/enetc_pf.c | 6 ++++++ 2 files changed, 8 insertions(+)
drivers/net/ethernet/freescale/enetc/enetc_hw.h +2 -0
@@ -234,6 +234,8 @@ enum enetc_bdr_type {TX, RX};#define ENETC_PM0_MAXFRM 0x8014#define ENETC_SET_TX_MTU (val) ((val) << 16)#define ENETC_SET_MAXFRM (val) ((val) & 0xffff) +#define ENETC_PM0_RX_FIFO 0x801c +#define ENETC_PM0_RX_FIFO_VAL 1#define ENETC_PM_IMDIO_BASE 0x8030
drivers/net/ethernet/freescale/enetc/enetc_pf.c +6 -0
@@ -490,6 +490,12 @@ static void enetc_configure_port_mac(struct enetc_hw *hw)enetc_port_wr (hw,ENETC_PM1_CMD_CFG ,ENETC_PM0_CMD_PHY_TX_EN |ENETC_PM0_CMD_TXP |ENETC_PM0_PROMISC ); + +/* On LS1028A, the MAC RX FIFO defaults to 2, which is too high +* and may lead to RX lock-up under traffic. Set it to 1 instead, +* as recommended by the hardware team. +*/ +enetc_port_wr (hw,ENETC_PM0_RX_FIFO ,ENETC_PM0_RX_FIFO_VAL ); }static void enetc_mac_config (struct enetc_hw *hw,phy_interface_t phy_mode)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 27/254 atm: uPD98402: fix incorrect allocation
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 3153724fc084d8ef640c611f269ddfb576d1dcb1 ]
dev->dev_data is set in zatm.c, calling zatm_start() will overwrite this dev->dev_data in uPD98402_start() and a subsequent PRIV(dev)->lock (i.e dev->phy_data->lock) will result in a null-ptr-dereference.
I believe this is a typo and what it actually want to do is to allocate phy_data instead of dev_data.
--- drivers/atm/uPD98402.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/atm/uPD98402.c +1 -1
@@ -211,7 +211,7 @@ static void uPD98402_int(struct atm_dev *dev)static int uPD98402_start (struct atm_dev *dev) {DPRINTK ("phy_start\n" ); -if (!(dev->dev_data =kmalloc (sizeof (struct uPD98402_priv ),GFP_KERNEL ))) +if (!(dev->phy_data =kmalloc (sizeof (struct uPD98402_priv ),GFP_KERNEL )))return -ENOMEM ;spin_lock_init (&PRIV (dev)->lock);memset (&PRIV (dev)->sonet_stats,0 ,sizeof (struct k_sonet_stats ));
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 28/254 atm: idt77252: fix null-ptr-dereference
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 4416e98594dc04590ebc498fc4e530009535c511 ]
this one is similar to the phy_data allocation fix in uPD98402, the driver allocate the idt77105_priv and store to dev_data but later dereference using dev->dev_data, which will cause null-ptr-dereference.
fix this issue by changing dev_data to phy_data so that PRIV(dev) can work correctly.
--- drivers/atm/idt77105.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/atm/idt77105.c +2 -2
@@ -262,7 +262,7 @@ static int idt77105_start(struct atm_dev *dev) {unsigned long flags; -if (!(dev->dev_data =kmalloc (sizeof (struct idt77105_priv ),GFP_KERNEL ))) +if (!(dev->phy_data =kmalloc (sizeof (struct idt77105_priv ),GFP_KERNEL )))return -ENOMEM ;PRIV (dev)->dev = dev;spin_lock_irqsave (&idt77105_priv_lock, flags);
@@ -337,7 +337,7 @@ static int idt77105_stop(struct atm_dev *dev)else idt77105_all = walk->next; dev->phy =NULL ; - dev->dev_data =NULL ; + dev->phy_data =NULL ;kfree (walk);break ; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 29/254 cifs: change noisy error message to FYI
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
[ Upstream commit e3d100eae44b42f309c1366efb8397368f1cf8ed ]
A customer has reported that their dmesg were being flooded by
CIFS: VFS: \\server Cancelling wait for mid xxx cmd: a
CIFS: VFS: \\server Cancelling wait for mid yyy cmd: b
CIFS: VFS: \\server Cancelling wait for mid zzz cmd: c
because some processes that were performing statfs(2) on the share had been interrupted due to their automount setup when certain users logged in and out.
Change it to FYI as they should be mostly informative rather than error messages.
--- fs/cifs/transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/transport.c +1 -1
@@ -1185,7 +1185,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, }if (rc !=0 ) {for (; i < num_rqst; i++) { -cifs_server_dbg (VFS ,"Cancelling wait for mid %llu cmd: %d\n" , +cifs_server_dbg (FYI ,"Cancelling wait for mid %llu cmd: %d\n" , midQ[i]->mid,le16_to_cpu (midQ[i]->command));send_cancel (server, &rqst[i], midQ[i]);spin_lock (&GlobalMid_Lock);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 30/254 irqchip/ingenic: Add support for the JZ4760
In reply to Greg Kroah-HartmanFrom: Paul Cercueil <[email protected]>
[ Upstream commit 5fbecd2389f48e1415799c63130d0cdce1cf3f60 ]
Add support for the interrupt controller found in the JZ4760 SoC, which works exactly like the one in the JZ4770.
--- drivers/irqchip/irq-ingenic-tcu.c | 1 + drivers/irqchip/irq-ingenic.c | 1 + 2 files changed, 2 insertions(+)
drivers/irqchip/irq-ingenic-tcu.c +1 -0
@@ -179,5 +179,6 @@ static int __init ingenic_tcu_irq_init(struct device_node *np, }IRQCHIP_DECLARE (jz4740_tcu_irq,"ingenic,jz4740-tcu" , ingenic_tcu_irq_init);IRQCHIP_DECLARE (jz4725b_tcu_irq,"ingenic,jz4725b-tcu" , ingenic_tcu_irq_init); +IRQCHIP_DECLARE (jz4760_tcu_irq,"ingenic,jz4760-tcu" , ingenic_tcu_irq_init);IRQCHIP_DECLARE (jz4770_tcu_irq,"ingenic,jz4770-tcu" , ingenic_tcu_irq_init);IRQCHIP_DECLARE (x1000_tcu_irq,"ingenic,x1000-tcu" , ingenic_tcu_irq_init);
drivers/irqchip/irq-ingenic.c +1 -0
@@ -155,6 +155,7 @@ static int __init intc_2chip_of_init(struct device_node *node, {return ingenic_intc_of_init (node,2 ); } +IRQCHIP_DECLARE (jz4760_intc,"ingenic,jz4760-intc" , intc_2chip_of_init);IRQCHIP_DECLARE (jz4770_intc,"ingenic,jz4770-intc" , intc_2chip_of_init);IRQCHIP_DECLARE (jz4775_intc,"ingenic,jz4775-intc" , intc_2chip_of_init);IRQCHIP_DECLARE (jz4780_intc,"ingenic,jz4780-intc" , intc_2chip_of_init);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 31/254 kbuild: add image_name to no-sync-config-targets
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
[ Upstream commit 993bdde94547887faaad4a97f0b0480a6da271c3 ]
'make image_name' needs include/config/auto.conf to show the correct output because KBUILD_IMAGE depends on CONFIG options, but should not attempt to resync the configuration.
--- Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
Makefile +2 -1
@@ -265,7 +265,8 @@ no-dot-config-targets := $(clean-targets) \ $(version_h) headers headers_% archheaders archscripts \ %asm-generic kernelversion %src-pkg dt_binding_check \ outputmakefile -no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease +no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease \ + image_name single-targets := %.a %.i %.ko %.lds %.ll %.lst %.mod %.o %.s %.symtypes %/ config-build :=
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 32/254 kbuild: dummy-tools: fix inverted tests for gcc
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
[ Upstream commit b3d9fc1436808a4ef9927e558b3415e728e710c5 ]
There is a test in Kconfig which takes inverted value of a compiler check:
* config CC_HAS_INT128
def_bool !$(cc-option,$(m64-flag) -D__SIZEOF_INT128__=0)
This results in CC_HAS_INT128 not being in super-config generated by dummy-tools. So take this into account in the gcc script.
--- scripts/dummy-tools/gcc | 5 +++++ 1 file changed, 5 insertions(+)
scripts/dummy-tools/gcc +5 -0
@@ -85,3 +85,8 @@ if arg_contain -print-file-name=plugin "$@"; then echo $plugin_dir exit 0 fi + +# inverted return value +if arg_contain -D__SIZEOF_INT128__=0 "$@"; then + exit 1 +fi
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 33/254 umem: fix error return code in mm_pci_probe()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit eeb05595d22c19c8f814ff893dcf88ec277a2365 ]
Fix to return negative error code -ENOMEM from the blk_alloc_queue() and dma_alloc_coherent() error handling cases instead of 0, as done elsewhere in this function.
--- drivers/block/umem.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/block/umem.c +4 -1
@@ -877,6 +877,7 @@ static int mm_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)if (card->mm_pages[0 ].desc ==NULL || card->mm_pages[1 ].desc ==NULL ) {dev_printk (KERN_ERR , &card->dev->dev,"alloc failed\n" ); + ret = -ENOMEM ; goto failed_alloc; }reset_page (&card->mm_pages[0 ]);
@@ -888,8 +889,10 @@ static int mm_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)spin_lock_init (&card->lock); card->queue =blk_alloc_queue (NUMA_NO_NODE ); -if (!card->queue) +if (!card->queue) { + ret = -ENOMEM ; goto failed_alloc; + }tasklet_init (&card->tasklet, process_page, (unsigned long )card);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 34/254 sparc64: Fix opcode filtering in handling of no fault loads
In reply to Greg Kroah-HartmanFrom: Rob Gardner <[email protected]>
[ Upstream commit e5e8b80d352ec999d2bba3ea584f541c83f4ca3f ]
is_no_fault_exception() has two bugs which were discovered via random opcode testing with stress-ng. Both are caused by improper filtering of opcodes.
The first bug can be triggered by a floating point store with a no-fault ASI, for instance "sta %f0, [%g0] #ASI_PNF", opcode C1A01040.
The code first tests op3[5] (0x1000000), which denotes a floating point instruction, and then tests op3[2] (0x200000), which denotes a store instruction. But these bits are not mutually exclusive, and the above mentioned opcode has both bits set. The intent is to filter out stores, so the test for stores must be done first in order to have any effect.
The second bug can be triggered by a floating point load with one of the invalid ASI values 0x8e or 0x8f, which pass this check in is_no_fault_exception():
if ((asi & 0xf2) == ASI_PNF)
An example instruction is "ldqa [%l7 + %o7] #ASI 0x8f, %f38", opcode CF95D1EF. Asi values greater than 0x8b (ASI_SNFL) are fatal in handle_ldf_stq(), and is_no_fault_exception() must not allow these invalid asi values to make it that far.
In both of these cases, handle_ldf_stq() reacts by calling sun4v_data_access_exception() or spitfire_data_access_exception(), which call is_no_fault_exception() and results in an infinite recursion.
--- arch/sparc/kernel/traps_64.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
arch/sparc/kernel/traps_64.c +6 -7
@@ -275,14 +275,13 @@ bool is_no_fault_exception(struct pt_regs *regs) asi = (regs->tstate >>24 );/* saved %asi */ else asi = (insn >>5 );/* immediate asi */ -if ((asi &0xf2 ) ==ASI_PNF ) { -if (insn &0x1000000 ) {/* op3[5:4]=3 */ -handle_ldf_stq (insn, regs); -return true; - }else if (insn &0x200000 ) {/* op3[2], stores */ +if ((asi &0xf6 ) ==ASI_PNF ) { +if (insn &0x200000 )/* op3[2], stores */ return false; - } -handle_ld_nf (insn, regs); +if (insn &0x1000000 )/* op3[5:4]=3 (fp) */ +handle_ldf_stq (insn, regs); +else +handle_ld_nf (insn, regs);return true; } }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 35/254 habanalabs: Call put_pid() when releasing control device
In reply to Greg Kroah-HartmanFrom: Tomer Tayar <[email protected]>
[ Upstream commit 27ac5aada024e0821c86540ad18f37edadd77d5e ]
The refcount of the "hl_fpriv" structure is not used for the control device, and thus hl_hpriv_put() is not called when releasing this device.
This results with no call to put_pid(), so add it explicitly in hl_device_release_ctrl().
--- drivers/misc/habanalabs/common/device.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/misc/habanalabs/common/device.c +2 -0
@@ -117,6 +117,8 @@ static int hl_device_release_ctrl(struct inode *inode, struct file *filp)list_del (&hpriv->dev_node);mutex_unlock (&hdev->fpriv_list_lock); +put_pid (hpriv->taskpid); +kfree (hpriv);return 0 ;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 36/254 habanalabs: Disable file operations after device is removed
In reply to Greg Kroah-HartmanFrom: Tomer Tayar <[email protected]>
[ Upstream commit ffd123fe839700366ea79b19ac3683bf56817372 ]
A device can be removed from the PCI subsystem while a process holds the file descriptor opened.
In such a case, the driver attempts to kill the process, but as it is still possible that the process will be alive after this step, the device removal will complete, and we will end up with a process object that points to a device object which was already released.
To prevent the usage of this released device object, disable the following file operations for this process object, and avoid the cleanup steps when the file descriptor is eventually closed.
The latter is just a best effort, as memory leak will occur.
--- drivers/misc/habanalabs/common/device.c | 40 ++++++++++++++++--- .../misc/habanalabs/common/habanalabs_ioctl.c | 12 ++++++ 2 files changed, 46 insertions(+), 6 deletions(-)
drivers/misc/habanalabs/common/device.c +34 -6
@@ -93,12 +93,19 @@ void hl_hpriv_put(struct hl_fpriv *hpriv)static int hl_device_release (struct inode *inode,struct file *filp) {struct hl_fpriv *hpriv = filp->private_data; +struct hl_device *hdev = hpriv->hdev; + + filp->private_data =NULL ; + +if (!hdev) { +pr_crit ("Closing FD after device was removed. Memory leak will occur and it is advised to reboot.\n" ); +put_pid (hpriv->taskpid); +return 0 ; + }hl_cb_mgr_fini (hpriv->hdev, &hpriv->cb_mgr);hl_ctx_mgr_fini (hpriv->hdev, &hpriv->ctx_mgr); - filp->private_data =NULL ; -hl_hpriv_put (hpriv);return 0 ;
@@ -107,16 +114,19 @@ static int hl_device_release(struct inode *inode, struct file *filp)static int hl_device_release_ctrl (struct inode *inode,struct file *filp) {struct hl_fpriv *hpriv = filp->private_data; -struct hl_device *hdev; +struct hl_device *hdev = hpriv->hdev; filp->private_data =NULL ; - hdev = hpriv->hdev; +if (!hdev) { +pr_err ("Closing FD after device was removed\n" ); + goto out; + }mutex_lock (&hdev->fpriv_list_lock);list_del (&hpriv->dev_node);mutex_unlock (&hdev->fpriv_list_lock); - +out:put_pid (hpriv->taskpid);kfree (hpriv);
@@ -136,8 +146,14 @@ static int hl_device_release_ctrl(struct inode *inode, struct file *filp)static int hl_mmap (struct file *filp,struct vm_area_struct *vma) {struct hl_fpriv *hpriv = filp->private_data; +struct hl_device *hdev = hpriv->hdev;unsigned long vm_pgoff; +if (!hdev) { +pr_err_ratelimited ("Trying to mmap after device was removed! Please close FD\n" ); +return -ENODEV ; + } + vm_pgoff = vma->vm_pgoff; vma->vm_pgoff =HL_MMAP_OFFSET_VALUE_GET (vm_pgoff);
@@ -884,6 +900,16 @@ static int device_kill_open_processes(struct hl_device *hdev, u32 timeout)return -EBUSY ; } +static void device_disable_open_processes (struct hl_device *hdev) +{ +struct hl_fpriv *hpriv; + +mutex_lock (&hdev->fpriv_list_lock); +list_for_each_entry (hpriv, &hdev->fpriv_list, dev_node) + hpriv->hdev =NULL ; +mutex_unlock (&hdev->fpriv_list_lock); +} +/* * hl_device_reset - reset the device *
@@ -1538,8 +1564,10 @@ void hl_device_fini(struct hl_device *hdev) HL_PENDING_RESET_LONG_SEC); rc =device_kill_open_processes (hdev,HL_PENDING_RESET_LONG_SEC ); -if (rc) +if (rc) {dev_crit (hdev->dev,"Failed to kill all open processes\n" ); +device_disable_open_processes (hdev); + }hl_cb_pool_fini (hdev);
drivers/misc/habanalabs/common/habanalabs_ioctl.c +12 -0
@@ -5,6 +5,8 @@* All Rights Reserved. */ +#define pr_fmt (fmt) "habanalabs: " fmt +#include <uapi/misc/habanalabs.h> #include "habanalabs.h"
@@ -667,6 +669,11 @@ long hl_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)const struct hl_ioctl_desc *ioctl =NULL ;unsigned int nr =_IOC_NR (cmd); +if (!hdev) { +pr_err_ratelimited ("Sending ioctl after device was removed! Please close FD\n" ); +return -ENODEV ; + } +if ((nr >=HL_COMMAND_START ) && (nr <HL_COMMAND_END )) { ioctl = &hl_ioctls[nr]; }else {
@@ -685,6 +692,11 @@ long hl_ioctl_control(struct file *filep, unsigned int cmd, unsigned long arg)const struct hl_ioctl_desc *ioctl =NULL ;unsigned int nr =_IOC_NR (cmd); +if (!hdev) { +pr_err_ratelimited ("Sending ioctl after device was removed! Please close FD\n" ); +return -ENODEV ; + } +if (nr ==_IOC_NR (HL_IOCTL_INFO )) { ioctl = &hl_ioctls_control[nr]; }else {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 37/254 staging: rtl8192e: fix kconfig dependency on CRYPTO
In reply to Greg Kroah-HartmanFrom: Julian Braha <[email protected]>
[ Upstream commit 7c36194558cf49a86a53b5f60db8046c5e3013ae ]
When RTLLIB_CRYPTO_TKIP is enabled and CRYPTO is disabled, Kbuild gives the following warning:
WARNING: unmet direct dependencies detected for CRYPTO_MICHAEL_MIC
Depends on [n]: CRYPTO [=n]
Selected by [m]:
- RTLLIB_CRYPTO_TKIP [=m] && STAGING [=y] && RTLLIB [=m]
WARNING: unmet direct dependencies detected for CRYPTO_LIB_ARC4
Depends on [n]: CRYPTO [=n]
Selected by [m]:
- RTLLIB_CRYPTO_TKIP [=m] && STAGING [=y] && RTLLIB [=m]
- RTLLIB_CRYPTO_WEP [=m] && STAGING [=y] && RTLLIB [=m]
This is because RTLLIB_CRYPTO_TKIP selects CRYPTO_MICHAEL_MIC and CRYPTO_LIB_ARC4, without depending on or selecting CRYPTO, despite those config options being subordinate to CRYPTO.
--- drivers/staging/rtl8192e/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/staging/rtl8192e/Kconfig +1 -0
@@ -26,6 +26,7 @@ config RTLLIB_CRYPTO_CCMP config RTLLIB_CRYPTO_TKIP tristate "Support for rtllib TKIP crypto" depends on RTLLIB + select CRYPTO select CRYPTO_LIB_ARC4 select CRYPTO_MICHAEL_MIC default y
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 38/254 u64_stats,lockdep: Fix u64_stats_init() vs lockdep
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit d5b0e0677bfd5efd17c5bbb00156931f0d41cb85 ]
Jakub reported that:
static struct net_device *rtl8139_init_board(struct pci_dev *pdev)
{
...
u64_stats_init(&tp->rx_stats.syncp);
u64_stats_init(&tp->tx_stats.syncp);
...
}results in lockdep getting confused between the RX and TX stats lock. This is because u64_stats_init() is an inline calling seqcount_init(), which is a macro using a static variable to generate a lockdep class.
By wrapping that in an inline, we negate the effect of the macro and fold the static key variable, hence the confusion.
Fix by also making u64_stats_init() a macro for the case where it matters, leaving the other case an inline for argument validation etc.
--- include/linux/u64_stats_sync.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
include/linux/u64_stats_sync.h +4 -3
@@ -115,12 +115,13 @@ static inline void u64_stats_inc(u64_stats_t *p) }#endif +#if BITS_PER_LONG ==32 && defined(CONFIG_SMP ) +#define u64_stats_init (syncp) seqcount_init(&(syncp)->seq) +#else static inline void u64_stats_init (struct u64_stats_sync *syncp) { -#if BITS_PER_LONG ==32 && defined(CONFIG_SMP ) -seqcount_init (&syncp->seq); -#endif } +#endif static inline void u64_stats_update_begin (struct u64_stats_sync *syncp) {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 39/254 kselftest: arm64: Fix exit code of sve-ptrace
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
[ Upstream commit 07e644885bf6727a48db109fad053cb43f3c9859 ]
We track if sve-ptrace encountered a failure in a variable but don't actually use that value when we exit the program, do so.
--- tools/testing/selftests/arm64/fp/sve-ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/arm64/fp/sve-ptrace.c +1 -1
@@ -332,5 +332,5 @@ int main(void)ksft_print_cnts (); -return 0 ; +return ret; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 40/254 regulator: qcom-rpmh: Correct the pmic5_hfsmps515 buck
In reply to Greg Kroah-HartmanFrom: satya priya <[email protected]>
[ Upstream commit e610e072c87a30658479a7b4c51e1801cb3f450c ]
Correct the REGULATOR_LINEAR_RANGE and n_voltges for pmic5_hfsmps515 buck.
--- drivers/regulator/qcom-rpmh-regulator.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/regulator/qcom-rpmh-regulator.c +2 -2
@@ -726,8 +726,8 @@ static const struct rpmh_vreg_hw_data pmic5_ftsmps510 = {static const struct rpmh_vreg_hw_data pmic5_hfsmps515 = { .regulator_type =VRM , .ops = &rpmh_regulator_vrm_ops, - .voltage_range =REGULATOR_LINEAR_RANGE (2800000 ,0 ,4 ,16000 ), - .n_voltages =5 , + .voltage_range =REGULATOR_LINEAR_RANGE (320000 ,0 ,235 ,16000 ), + .n_voltages =236 , .pmic_mode_map = pmic_mode_map_pmic5_smps, .of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode, };
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 41/254 regulator: qcom-rpmh: Use correct buck for S1C regulator
In reply to Greg Kroah-HartmanFrom: satya priya <[email protected]>
[ Upstream commit dfe03bca8db4957d4b60614ff7df4d136ba90f37 ]
Use correct buck, that is, pmic5_hfsmps515 for S1C regulator of PM8350C PMIC.
--- drivers/regulator/qcom-rpmh-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/qcom-rpmh-regulator.c +1 -1
@@ -901,7 +901,7 @@ static const struct rpmh_vreg_init_data pm8350_vreg_data[] = { };static const struct rpmh_vreg_init_data pm8350c_vreg_data[] = { -RPMH_VREG ("smps1" ,"smp%s1" , &pmic5_hfsmps510,"vdd-s1" ), +RPMH_VREG ("smps1" ,"smp%s1" , &pmic5_hfsmps515,"vdd-s1" ),RPMH_VREG ("smps2" ,"smp%s2" , &pmic5_ftsmps510,"vdd-s2" ),RPMH_VREG ("smps3" ,"smp%s3" , &pmic5_ftsmps510,"vdd-s3" ),RPMH_VREG ("smps4" ,"smp%s4" , &pmic5_ftsmps510,"vdd-s4" ),
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 42/254 block: Fix REQ_OP_ZONE_RESET_ALL handling
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit faa44c69daf9ccbd5b8a1aee13e0e0d037c0be17 ]
Similarly to a single zone reset operation (REQ_OP_ZONE_RESET), execute REQ_OP_ZONE_RESET_ALL operations with REQ_SYNC set.
--- block/blk-zoned.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/blk-zoned.c +1 -1
@@ -240,7 +240,7 @@ int blkdev_zone_mgmt(struct block_device *bdev, enum req_opf op,*/ if (op ==REQ_OP_ZONE_RESET &&blkdev_allow_reset_all_zones (bdev, sector, nr_sectors)) { - bio->bi_opf =REQ_OP_ZONE_RESET_ALL ; + bio->bi_opf =REQ_OP_ZONE_RESET_ALL |REQ_SYNC ;break ; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 43/254 drm/amd/display: Enable pflip interrupt upon pipe enable
In reply to Greg Kroah-HartmanFrom: Qingqing Zhuo <[email protected]>
[ Upstream commit 7afa0033d6f7fb8a84798ef99d1117661c4e696c ]
[Why]
pflip interrupt would not be enabled promptly if a pipe is disabled and re-enabled, causing flip_done timeout error during DP compliance tests
[How]
Enable pflip interrupt upon pipe enablement
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + drivers/gpu/drm/amd/display/dc/dc.h | 1 + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c | 11 +++++++++++ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h | 6 ++++++ .../gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 7 +++++++ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c | 1 + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 6 ++++++ drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c | 1 + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c | 1 + drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h | 2 ++ 10 files changed, 37 insertions(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -0
@@ -4616,6 +4616,7 @@ static int fill_dc_plane_attributes(struct amdgpu_device *adev, dc_plane_state->global_alpha_value = plane_info.global_alpha_value; dc_plane_state->dcc = plane_info.dcc; dc_plane_state->layer_index = plane_info.layer_index;// Always returns 0 + dc_plane_state->flip_int_enabled = true;/* * Always set input transfer function, since plane state is refreshed
drivers/gpu/drm/amd/display/dc/dc.h +1 -0
@@ -889,6 +889,7 @@ struct dc_plane_state {int layer_index;union surface_update_flags update_flags; +bool flip_int_enabled;/* private to DC core */ struct dc_plane_status status;struct dc_context *ctx;
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c +11 -0
@@ -1257,6 +1257,16 @@ void hubp1_soft_reset(struct hubp *hubp, bool reset)REG_UPDATE (DCHUBP_CNTL ,HUBP_DISABLE , reset ?1 :0 ); } +void hubp1_set_flip_int (struct hubp *hubp) +{ +struct dcn10_hubp *hubp1 =TO_DCN10_HUBP (hubp); + +REG_UPDATE (DCSURF_SURFACE_FLIP_INTERRUPT , +SURFACE_FLIP_INT_MASK ,1 ); + +return ; +} +void hubp1_init (struct hubp *hubp) {//do nothing
@@ -1290,6 +1300,7 @@ static const struct hubp_funcs dcn10_hubp_funcs = { .dmdata_load = NULL, .hubp_soft_reset = hubp1_soft_reset, .hubp_in_blank = hubp1_in_blank, + .hubp_set_flip_int = hubp1_set_flip_int, };/*****************************************/
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h +6 -0
@@ -74,6 +74,7 @@SRI (DCSURF_SURFACE_EARLIEST_INUSE_C ,HUBPREQ , id),\SRI (DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C ,HUBPREQ , id),\SRI (DCSURF_SURFACE_CONTROL ,HUBPREQ , id),\ +SRI (DCSURF_SURFACE_FLIP_INTERRUPT ,HUBPREQ , id),\SRI (HUBPRET_CONTROL ,HUBPRET , id),\SRI (DCN_EXPANSION_MODE ,HUBPREQ , id),\ SRI(DCHUBP_REQ_SIZE_CONFIG, HUBP, id),\
@@ -183,6 +184,7 @@uint32_t DCSURF_SURFACE_EARLIEST_INUSE_C ; \uint32_t DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C ; \uint32_t DCSURF_SURFACE_CONTROL ; \ +uint32_t DCSURF_SURFACE_FLIP_INTERRUPT ; \uint32_t HUBPRET_CONTROL ; \uint32_t DCN_EXPANSION_MODE ; \uint32_t DCHUBP_REQ_SIZE_CONFIG ; \
@@ -332,6 +334,7 @@HUBP_SF (HUBPREQ0_DCSURF_SURFACE_CONTROL ,SECONDARY_META_SURFACE_TMZ_C , mask_sh),\HUBP_SF (HUBPREQ0_DCSURF_SURFACE_CONTROL ,SECONDARY_SURFACE_DCC_EN , mask_sh),\HUBP_SF (HUBPREQ0_DCSURF_SURFACE_CONTROL ,SECONDARY_SURFACE_DCC_IND_64B_BLK , mask_sh),\ +HUBP_SF (HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT ,SURFACE_FLIP_INT_MASK , mask_sh),\HUBP_SF (HUBPRET0_HUBPRET_CONTROL ,DET_BUF_PLANE1_BASE_ADDRESS , mask_sh),\HUBP_SF (HUBPRET0_HUBPRET_CONTROL ,CROSSBAR_SRC_CB_B , mask_sh),\ HUBP_SF(HUBPRET0_HUBPRET_CONTROL, CROSSBAR_SRC_CR_R, mask_sh),\
@@ -531,6 +534,7 @@type PRIMARY_SURFACE_DCC_IND_64B_BLK ;\type SECONDARY_SURFACE_DCC_EN ;\type SECONDARY_SURFACE_DCC_IND_64B_BLK ;\ +type SURFACE_FLIP_INT_MASK ;\type DET_BUF_PLANE1_BASE_ADDRESS ;\type CROSSBAR_SRC_CB_B ;\type CROSSBAR_SRC_CR_R ;\
@@ -777,4 +781,6 @@ void hubp1_read_state_common(struct hubp *hubp);bool hubp1_in_blank (struct hubp *hubp);void hubp1_soft_reset (struct hubp *hubp,bool reset); +void hubp1_set_flip_int (struct hubp *hubp); +#endif
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +7 -0
@@ -2195,6 +2195,13 @@ static void dcn10_enable_plane(if (dc->debug.sanity_checks) { hws->funcs.verify_allow_pstate_change_high (dc); } + +if (!pipe_ctx->top_pipe + && pipe_ctx->plane_state + && pipe_ctx->plane_state->flip_int_enabled + && pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int) + pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int (pipe_ctx->plane_res.hubp); + }void dcn10_program_gamut_remap (struct pipe_ctx *pipe_ctx)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c +1 -0
@@ -1597,6 +1597,7 @@ static struct hubp_funcs dcn20_hubp_funcs = { .validate_dml_output = hubp2_validate_dml_output, .hubp_in_blank = hubp1_in_blank, .hubp_soft_reset = hubp1_soft_reset, + .hubp_set_flip_int = hubp1_set_flip_int, };
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +6 -0
@@ -1146,6 +1146,12 @@ void dcn20_enable_plane( pipe_ctx->plane_res.hubp->funcs->hubp_set_vm_system_aperture_settings (pipe_ctx->plane_res.hubp, &apt); } +if (!pipe_ctx->top_pipe + && pipe_ctx->plane_state + && pipe_ctx->plane_state->flip_int_enabled + && pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int) + pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int (pipe_ctx->plane_res.hubp); +// if (dc->debug.sanity_checks) { // dcn10_verify_allow_pstate_change_high(dc); // }
drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c +1 -0
@@ -838,6 +838,7 @@ static struct hubp_funcs dcn21_hubp_funcs = { .hubp_set_flip_control_surface_gsl = hubp2_set_flip_control_surface_gsl, .hubp_init = hubp21_init, .validate_dml_output = hubp21_validate_dml_output, + .hubp_set_flip_int = hubp1_set_flip_int, }; bool hubp21_construct(
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c +1 -0
@@ -511,6 +511,7 @@ static struct hubp_funcs dcn30_hubp_funcs = { .hubp_init = hubp3_init, .hubp_in_blank = hubp1_in_blank, .hubp_soft_reset = hubp1_soft_reset, + .hubp_set_flip_int = hubp1_set_flip_int, }; bool hubp3_construct(
drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h +2 -0
@@ -191,6 +191,8 @@ struct hubp_funcs {bool (*hubp_in_blank)(struct hubp *hubp);void (*hubp_soft_reset)(struct hubp *hubp,bool reset); + void (*hubp_set_flip_int)(struct hubp *hubp); + };#endif
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 44/254 drm/amd/display: Revert dram_clock_change_latency for DCN2.1
In reply to Greg Kroah-HartmanFrom: Sung Lee <[email protected]>
[ Upstream commit b0075d114c33580f5c9fa9cee8e13d06db41471b ]
[WHY & HOW]
Using values provided by DF for latency may cause hangs in multi display configurations. Revert change to previous value.
--- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +1 -1
@@ -296,7 +296,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_1_soc = { .num_banks = 8, .num_chans = 4, .vmm_page_size_bytes = 4096, - .dram_clock_change_latency_us = 11.72, + .dram_clock_change_latency_us = 23.84, .return_bus_width_bytes = 64, .dispclk_dppclk_vco_speed_mhz = 3600, .xfc_bus_transport_time_us = 4,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 45/254 drm/amd/display: Enabled pipe harvesting in dcn30
In reply to Greg Kroah-HartmanFrom: Dillon Varone <[email protected]>
[ Upstream commit d2c91285958a3e77db99c352c136af4243f8f529 ]
[Why & How]
Ported logic from dcn21 for reading in pipe fusing to dcn30. Supported configurations are 1 and 6 pipes. Invalid fusing will revert to 1 pipe being enabled.
--- .../drm/amd/display/dc/dcn30/dcn30_resource.c | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c +31 -0
@@ -2601,6 +2601,19 @@ static const struct resource_funcs dcn30_res_pool_funcs = { .patch_unknown_plane_state = dcn20_patch_unknown_plane_state, }; +#define CTX ctx + +#define REG (reg_name) \ + (DCN_BASE.instance[0].segment[mm ## reg_name ## _BASE_IDX] + mm ## reg_name) + +static uint32_t read_pipe_fuses (struct dc_context *ctx) +{ +uint32_t value =REG_READ (CC_DC_PIPE_DIS ); +/* Support for max 6 pipes */ + value = value &0x3f ; +return value; +} + static bool dcn30_resource_construct( uint8_t num_virtual_links, struct dc *dc,
@@ -2610,6 +2623,15 @@ static bool dcn30_resource_construct(struct dc_context *ctx = dc->ctx;struct irq_service_init_data init_data;struct ddc_service_init_data ddc_init_data; +uint32_t pipe_fuses =read_pipe_fuses (ctx); +uint32_t num_pipes =0 ; + +if (!(pipe_fuses ==0 || pipe_fuses ==0x3e )) { +BREAK_TO_DEBUGGER (); +dm_error ("DC: Unexpected fuse recipe for navi2x !\n" ); +/* fault to single pipe */ + pipe_fuses =0x3e ; + }DC_FP_START ();
@@ -2739,6 +2761,15 @@ static bool dcn30_resource_construct(/* PP Lib and SMU interfaces */ init_soc_bounding_box (dc, pool); + num_pipes = dcn3_0_ip.max_num_dpp; + +for (i =0 ; i < dcn3_0_ip.max_num_dpp; i++) +if (pipe_fuses &1 << i) + num_pipes--; + + dcn3_0_ip.max_num_dpp = num_pipes; + dcn3_0_ip.max_num_otg = num_pipes; +dml_init_instance (&dc->dml, &dcn3_0_soc, &dcn3_0_ip,DML_PROJECT_DCN30 );/* IRQ */
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 46/254 drm/amdgpu/display: Use wm_table.entries for dcn301 calculate_wm
In reply to Greg Kroah-HartmanFrom: Zhan Liu <[email protected]>
[ Upstream commit eda29602f1a8b2b32d8c8c354232d9d1ee1c064d ]
[Why]
For DGPU Navi, the wm_table.nv_entries are used. These entires are not populated for DCN301 Vangogh APU, but instead wm_table.entries are.
[How]
Use DCN21 Renoir style wm calculations.
--- .../amd/display/dc/dcn301/dcn301_resource.c | 96 ++++++++++++++++++- 1 file changed, 95 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c +95 -1
@@ -1722,12 +1722,106 @@ static void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bdml_init_instance (&dc->dml, &dcn3_01_soc, &dcn3_01_ip,DML_PROJECT_DCN30 ); } +static void calculate_wm_set_for_vlevel ( +int vlevel, +struct wm_range_table_entry *table_entry, +struct dcn_watermarks *wm_set, +struct display_mode_lib *dml, +display_e2e_pipe_params_st *pipes, +int pipe_cnt) +{ +double dram_clock_change_latency_cached = dml->soc.dram_clock_change_latency_us; + +ASSERT (vlevel < dml->soc.num_states); +/* only pipe 0 is read for voltage and dcf/soc clocks */ + pipes[0 ].clks_cfg.voltage = vlevel; + pipes[0 ].clks_cfg.dcfclk_mhz = dml->soc.clock_limits[vlevel].dcfclk_mhz; + pipes[0 ].clks_cfg.socclk_mhz = dml->soc.clock_limits[vlevel].socclk_mhz; + + dml->soc.dram_clock_change_latency_us = table_entry->pstate_latency_us; + dml->soc.sr_exit_time_us = table_entry->sr_exit_time_us; + dml->soc.sr_enter_plus_exit_time_us = table_entry->sr_enter_plus_exit_time_us; + + wm_set->urgent_ns =get_wm_urgent (dml, pipes, pipe_cnt) *1000 ; + wm_set->cstate_pstate.cstate_enter_plus_exit_ns =get_wm_stutter_enter_exit (dml, pipes, pipe_cnt) *1000 ; + wm_set->cstate_pstate.cstate_exit_ns =get_wm_stutter_exit (dml, pipes, pipe_cnt) *1000 ; + wm_set->cstate_pstate.pstate_change_ns =get_wm_dram_clock_change (dml, pipes, pipe_cnt) *1000 ; + wm_set->pte_meta_urgent_ns =get_wm_memory_trip (dml, pipes, pipe_cnt) *1000 ; + wm_set->frac_urg_bw_nom =get_fraction_of_urgent_bandwidth (dml, pipes, pipe_cnt) *1000 ; + wm_set->frac_urg_bw_flip =get_fraction_of_urgent_bandwidth_imm_flip (dml, pipes, pipe_cnt) *1000 ; + wm_set->urgent_latency_ns =get_urgent_latency (dml, pipes, pipe_cnt) *1000 ; + dml->soc.dram_clock_change_latency_us = dram_clock_change_latency_cached; + +} + +static void dcn301_calculate_wm_and_dlg ( +struct dc *dc,struct dc_state *context, +display_e2e_pipe_params_st *pipes, +int pipe_cnt, +int vlevel_req) +{ +int i, pipe_idx; +int vlevel, vlevel_max; +struct wm_range_table_entry *table_entry; +struct clk_bw_params *bw_params = dc->clk_mgr->bw_params; + +ASSERT (bw_params); + + vlevel_max = bw_params->clk_table.num_entries -1 ; + +/* WM Set D */ + table_entry = &bw_params->wm_table.entries[WM_D ]; +if (table_entry->wm_type ==WM_TYPE_RETRAINING ) + vlevel =0 ; +else + vlevel = vlevel_max; +calculate_wm_set_for_vlevel (vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.d, + &context->bw_ctx.dml, pipes, pipe_cnt); +/* WM Set C */ + table_entry = &bw_params->wm_table.entries[WM_C ]; + vlevel =min (max (vlevel_req,2 ), vlevel_max); +calculate_wm_set_for_vlevel (vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.c, + &context->bw_ctx.dml, pipes, pipe_cnt); +/* WM Set B */ + table_entry = &bw_params->wm_table.entries[WM_B ]; + vlevel =min (max (vlevel_req,1 ), vlevel_max); +calculate_wm_set_for_vlevel (vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.b, + &context->bw_ctx.dml, pipes, pipe_cnt); + +/* WM Set A */ + table_entry = &bw_params->wm_table.entries[WM_A ]; + vlevel =min (vlevel_req, vlevel_max); +calculate_wm_set_for_vlevel (vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.a, + &context->bw_ctx.dml, pipes, pipe_cnt); + +for (i =0 , pipe_idx =0 ; i < dc->res_pool->pipe_count; i++) { +if (!context->res_ctx.pipe_ctx[i].stream) +continue ; + + pipes[pipe_idx].clks_cfg.dispclk_mhz =get_dispclk_calculated (&context->bw_ctx.dml, pipes, pipe_cnt); + pipes[pipe_idx].clks_cfg.dppclk_mhz =get_dppclk_calculated (&context->bw_ctx.dml, pipes, pipe_cnt, pipe_idx); + +if (dc->config.forced_clocks) { + pipes[pipe_idx].clks_cfg.dispclk_mhz = context->bw_ctx.dml.soc.clock_limits[0 ].dispclk_mhz; + pipes[pipe_idx].clks_cfg.dppclk_mhz = context->bw_ctx.dml.soc.clock_limits[0 ].dppclk_mhz; + } +if (dc->debug.min_disp_clk_khz > pipes[pipe_idx].clks_cfg.dispclk_mhz *1000 ) + pipes[pipe_idx].clks_cfg.dispclk_mhz = dc->debug.min_disp_clk_khz /1000.0 ; +if (dc->debug.min_dpp_clk_khz > pipes[pipe_idx].clks_cfg.dppclk_mhz *1000 ) + pipes[pipe_idx].clks_cfg.dppclk_mhz = dc->debug.min_dpp_clk_khz /1000.0 ; + + pipe_idx++; + } + +dcn20_calculate_dlg_params (dc, context, pipes, pipe_cnt, vlevel); +} +static struct resource_funcs dcn301_res_pool_funcs = { .destroy = dcn301_destroy_resource_pool, .link_enc_create = dcn301_link_encoder_create, .panel_cntl_create = dcn301_panel_cntl_create, .validate_bandwidth = dcn30_validate_bandwidth, - .calculate_wm_and_dlg = dcn30_calculate_wm_and_dlg, + .calculate_wm_and_dlg = dcn301_calculate_wm_and_dlg, .populate_dml_pipes = dcn30_populate_dml_pipes_from_context, .acquire_idle_pipe_for_layer = dcn20_acquire_idle_pipe_for_layer, .add_stream_to_ctx = dcn30_add_stream_to_ctx,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 47/254 drm/amdgpu: fb BO should be ttm_bo_type_device
In reply to Greg Kroah-HartmanFrom: Nirmoy Das <[email protected]>
[ Upstream commit 521f04f9e3ffc73ef96c776035f8a0a31b4cdd81 ]
FB BO should not be ttm_bo_type_kernel type and amdgpufb_create_pinned_object() pins the FB BO anyway.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c +1 -1
@@ -146,7 +146,7 @@ static int amdgpufb_create_pinned_object(struct amdgpu_fbdev *rfbdev, size = mode_cmd->pitches[0 ] * height; aligned_size =ALIGN (size,PAGE_SIZE ); ret =amdgpu_gem_object_create (adev, aligned_size,0 , domain, flags, - ttm_bo_type_kernel,NULL , &gobj); + ttm_bo_type_device,NULL , &gobj);if (ret) {pr_err ("failed to allocate framebuffer (%d)\n" , aligned_size);return -ENOMEM ;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 48/254 drm/radeon: fix AGP dependency
In reply to Greg Kroah-HartmanFrom: Christian König <[email protected]>
[ Upstream commit cba2afb65cb05c3d197d17323fee4e3c9edef9cd ]
When AGP is compiled as module radeon must be compiled as module as well.
--- drivers/gpu/drm/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/Kconfig +1 -0
@@ -232,6 +232,7 @@ source "drivers/gpu/drm/arm/Kconfig" config DRM_RADEON tristate "ATI Radeon" depends on DRM && PCI && MMU + depends on AGP || !AGP select FW_LOADER select DRM_KMS_HELPER select DRM_TTM
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 49/254 nvme: simplify error logic in nvme_validate_ns()
In reply to Greg Kroah-HartmanFrom: Hannes Reinecke <[email protected]>
[ Upstream commit d95c1f4179a7f3ea8aa728ed00252a8ed0f8158f ]
We only should remove namespaces when we get fatal error back from the device or when the namespace IDs have changed.
So instead of painfully masking out error numbers which might indicate that the error should be ignored we could use an NVME status code to indicated when the namespace should be removed.
That simplifies the final logic and makes it less error-prone.
--- drivers/nvme/host/core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/nvme/host/core.c +4 -4
@@ -1425,7 +1425,7 @@ static int nvme_identify_ns(struct nvme_ctrl *ctrl, unsigned nsid, goto out_free_id; } - error = -ENODEV ; + error =NVME_SC_INVALID_NS |NVME_SC_DNR ;if ((*id)->ncap ==0 )/* namespace not allocated or attached */ goto out_free_id;
@@ -4011,7 +4011,7 @@ static void nvme_ns_remove_by_nsid(struct nvme_ctrl *ctrl, u32 nsid)static void nvme_validate_ns (struct nvme_ns *ns,struct nvme_ns_ids *ids) {struct nvme_id_ns *id; -int ret = -ENODEV ; +int ret =NVME_SC_INVALID_NS |NVME_SC_DNR ;if (test_bit (NVME_NS_DEAD , &ns->flags)) goto out;
@@ -4020,7 +4020,7 @@ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids)if (ret) goto out; - ret = -ENODEV ; + ret =NVME_SC_INVALID_NS |NVME_SC_DNR ;if (!nvme_ns_ids_equal (&ns->head->ids, ids)) {dev_err (ns->ctrl->device,"identifiers changed for nsid %d\n" , ns->head->ns_id);
@@ -4038,7 +4038,7 @@ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids)* * TODO: we should probably schedule a delayed retry here. */ -if (ret && ret != -ENOMEM && !(ret >0 && !(ret &NVME_SC_DNR ))) +if (ret >0 && (ret &NVME_SC_DNR ))nvme_ns_remove (ns); }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 50/254 nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request()
In reply to Greg Kroah-HartmanFrom: Hannes Reinecke <[email protected]>
[ Upstream commit d3589381987ec879b03f8ce3039df57e87f05901 ]
NVME_REQ_CANCELLED is translated into -EINTR in nvme_submit_sync_cmd(), so we should be setting this flags during nvme_cancel_request() to ensure that the callers to nvme_submit_sync_cmd() will get the correct error code when the controller is reset.
--- drivers/nvme/host/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/nvme/host/core.c +1 -0
@@ -366,6 +366,7 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved)return true;nvme_req (req)->status =NVME_SC_HOST_ABORTED_CMD ; +nvme_req (req)->flags |=NVME_REQ_CANCELLED ;blk_mq_complete_request (req);return true; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 51/254 nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange()
In reply to Greg Kroah-HartmanFrom: Hannes Reinecke <[email protected]>
[ Upstream commit 3c7aafbc8d3d4d90430dfa126847a796c3e4ecfc ]
nvme_fc_terminate_exchange() is being called when exchanges are being deleted, and as such we should be setting the NVME_REQ_CANCELLED flag to have identical behaviour on all transports.
--- drivers/nvme/host/fc.c | 1 + 1 file changed, 1 insertion(+)
drivers/nvme/host/fc.c +1 -0
@@ -2443,6 +2443,7 @@ nvme_fc_terminate_exchange(struct request *req, void *data, bool reserved)struct nvme_fc_ctrl *ctrl =to_fc_ctrl (nctrl);struct nvme_fc_fcp_op *op =blk_mq_rq_to_pdu (req); + op->nreq.flags |=NVME_REQ_CANCELLED ;__nvme_fc_abort_op (ctrl, op);return true; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 52/254 nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted
In reply to Greg Kroah-HartmanFrom: Hannes Reinecke <[email protected]>
[ Upstream commit ae3afe6308b43bbf49953101d4ba2c1c481133a8 ]
When a command has been aborted we should return NVME_SC_HOST_ABORTED_CMD to be consistent with the other transports.
--- drivers/nvme/host/fc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/fc.c +1 -1
@@ -1956,7 +1956,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req) sizeof(op->rsp_iu), DMA_FROM_DEVICE);if (opstate ==FCPOP_STATE_ABORTED ) - status =cpu_to_le16 (NVME_SC_HOST_PATH_ERROR <<1 ); + status =cpu_to_le16 (NVME_SC_HOST_ABORTED_CMD <<1 );else if (freq->status) { status =cpu_to_le16 (NVME_SC_HOST_PATH_ERROR <<1 ); dev_info(ctrl->ctrl.device,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 53/254 nvme-core: check ctrl css before setting up zns
In reply to Greg Kroah-HartmanFrom: Chaitanya Kulkarni <[email protected]>
[ Upstream commit 0ec84df4953bd42c6583a555773f1d4996a061eb ]
Ensure multiple Command Sets are supported before starting to setup a ZNS namespace.
--- drivers/nvme/host/core.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/nvme/host/core.c +6 -0
@@ -4069,6 +4069,12 @@ static void nvme_validate_or_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid) nsid);break ; } +if (!nvme_multi_css (ctrl)) { +dev_warn (ctrl->device, +"command set not reported for nsid: %d\n" , + ns->head->ns_id); +break ; + }nvme_alloc_ns (ctrl, nsid, &ids);break ;default :
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 54/254 nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit abec6561fc4e0fbb19591a0b35676d8c783b5493 ]
In nvmet_rdma_write_data_done, rsp is recoverd by wc->wr_cqe and freed by nvmet_rdma_release_rsp(). But after that, pr_info() used the freed chunk's member object and could leak the freed chunk address with wc->wr_cqe by computing the offset.
--- drivers/nvme/target/rdma.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/nvme/target/rdma.c +2 -3
@@ -802,9 +802,8 @@ static void nvmet_rdma_write_data_done(struct ib_cq *cq, struct ib_wc *wc)nvmet_req_uninit (&rsp->req);nvmet_rdma_release_rsp (rsp);if (wc->status !=IB_WC_WR_FLUSH_ERR ) { -pr_info ("RDMA WRITE for CQE 0x%p failed with status %s (%d).\n" , - wc->wr_cqe,ib_wc_status_msg (wc->status), - wc->status); +pr_info ("RDMA WRITE for CQE failed with status %s (%d).\n" , +ib_wc_status_msg (wc->status), wc->status);nvmet_rdma_error_comp (queue); }return ;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 55/254 nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a
In reply to Greg Kroah-HartmanFrom: Dmitry Monakhov <[email protected]>
[ Upstream commit abbb5f5929ec6c52574c430c5475c158a65c2a8c ]
This adds a quirk for Samsung PM1725a drive which fixes timeouts and I/O errors due to the fact that the controller does not properly handle the Write Zeroes command, dmesg log:
nvme nvme0: I/O 528 QID 10 timeout, aborting
nvme nvme0: I/O 529 QID 10 timeout, aborting
nvme nvme0: I/O 530 QID 10 timeout, aborting
nvme nvme0: I/O 531 QID 10 timeout, aborting
nvme nvme0: I/O 532 QID 10 timeout, aborting
nvme nvme0: I/O 533 QID 10 timeout, aborting
nvme nvme0: I/O 534 QID 10 timeout, aborting
nvme nvme0: I/O 535 QID 10 timeout, aborting
nvme nvme0: Abort status: 0x0
nvme nvme0: Abort status: 0x0
nvme nvme0: Abort status: 0x0
nvme nvme0: Abort status: 0x0
nvme nvme0: Abort status: 0x0
nvme nvme0: Abort status: 0x0
nvme nvme0: Abort status: 0x0
nvme nvme0: Abort status: 0x0
nvme nvme0: I/O 528 QID 10 timeout, reset controller
nvme nvme0: controller is down; will reset: CSTS=0x3, PCI_STATUS=0x10
nvme nvme0: Device not ready; aborting reset, CSTS=0x3
nvme nvme0: Device not ready; aborting reset, CSTS=0x3
nvme nvme0: Removing after probe failure status: -19
nvme0n1: detected capacity change from 6251233968 to 0blk_update_request: I/O error, dev nvme0n1, sector 32776 op 0x1:(WRITE) flags 0x3000 phys_seg 6 prio class 0blk_update_request: I/O error, dev nvme0n1, sector 113319936 op 0x9:(WRITE_ZEROES) flags 0x800 phys_seg 0 prio class 0 Buffer I/O error on dev nvme0n1p2, logical block 1, lost async page writeblk_update_request: I/O error, dev nvme0n1, sector 113319680 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 Buffer I/O error on dev nvme0n1p2, logical block 2, lost async page writeblk_update_request: I/O error, dev nvme0n1, sector 113319424 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 Buffer I/O error on dev nvme0n1p2, logical block 3, lost async page writeblk_update_request: I/O error, dev nvme0n1, sector 113319168 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 Buffer I/O error on dev nvme0n1p2, logical block 4, lost async page writeblk_update_request: I/O error, dev nvme0n1, sector 113318912 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 Buffer I/O error on dev nvme0n1p2, logical block 5, lost async page writeblk_update_request: I/O error, dev nvme0n1, sector 113318656 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 Buffer I/O error on dev nvme0n1p2, logical block 6, lost async page writeblk_update_request: I/O error, dev nvme0n1, sector 113318400 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0blk_update_request: I/O error, dev nvme0n1, sector 113318144 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0blk_update_request: I/O error, dev nvme0n1, sector 113317888 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0
--- drivers/nvme/host/pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/nvme/host/pci.c +1 -0
@@ -3242,6 +3242,7 @@ static const struct pci_device_id nvme_id_table[] = { .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, }, { PCI_DEVICE(0x144d, 0xa822), /* Samsung PM1725a */ .driver_data =NVME_QUIRK_DELAY_BEFORE_CHK_RDY | +NVME_QUIRK_DISABLE_WRITE_ZEROES | NVME_QUIRK_IGNORE_DEV_SUBNQN, }, { PCI_DEVICE(0x1987, 0x5016), /* Phison E16 */ .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 56/254 nfs: we dont support removing system.nfs4_acl
In reply to Greg Kroah-HartmanFrom: J. Bruce Fields <[email protected]>
[ Upstream commit 4f8be1f53bf615102d103c0509ffa9596f65b718 ]
The NFSv4 protocol doesn't have any notion of reomoving an attribute, so removexattr(path,"system.nfs4_acl") doesn't make sense.
There's no documented return value. Arguably it could be EOPNOTSUPP but I'm a little worried an application might take that to mean that we don't support ACLs or xattrs. How about EINVAL?
--- fs/nfs/nfs4proc.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nfs/nfs4proc.c +3 -0
@@ -5896,6 +5896,9 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflunsigned int npages =DIV_ROUND_UP (buflen,PAGE_SIZE );int ret, i; +/* You can't remove system.nfs4_acl: */ +if (buflen ==0 ) +return -EINVAL ;if (!nfs4_server_supports_acls (server))return -EOPNOTSUPP ;if (npages >ARRAY_SIZE (pages))
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 57/254 block: Suppress uevent for hidden device when removed
In reply to Greg Kroah-HartmanFrom: Daniel Wagner <[email protected]>
[ Upstream commit 9ec491447b90ad6a4056a9656b13f0b3a1e83043 ]
register_disk() suppress uevents for devices with the GENHD_FL_HIDDEN but enables uevents at the end again in order to announce disk after possible partitions are created.
When the device is removed the uevents are still on and user land sees 'remove' messages for devices which were never 'add'ed to the system.
KERNEL[95481.571887] remove /devices/virtual/nvme-fabrics/ctl/nvme5/nvme0c5n1 (block)
Let's suppress the uevents for GENHD_FL_HIDDEN by not enabling the uevents at all.
--- block/genhd.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
block/genhd.c +1 -3
@@ -658,10 +658,8 @@ static void register_disk(struct device *parent, struct gendisk *disk,kobject_create_and_add ("holders" , &ddev->kobj); disk->slave_dir =kobject_create_and_add ("slaves" , &ddev->kobj); -if (disk->flags &GENHD_FL_HIDDEN ) { -dev_set_uevent_suppress (ddev,0 ); +if (disk->flags &GENHD_FL_HIDDEN )return ; - }disk_scan_partitions (disk);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 58/254 io_uring: cancel deferred requests in try_cancel
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
[ Upstream commit e1915f76a8981f0a750cf56515df42582a37c4b0 ]
As io_uring_cancel_files() and others let SQO to run between io_uring_try_cancel_requests(), SQO may generate new deferred requests, so it's safer to try to cancel them in it.
--- fs/io_uring.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
fs/io_uring.c +6 -4
@@ -8861,11 +8861,11 @@ static bool io_cancel_task_cb(struct io_wq_work *work, void *data)return ret; } -static void io_cancel_defer_files (struct io_ring_ctx *ctx, +static bool io_cancel_defer_files (struct io_ring_ctx *ctx,struct task_struct *task,struct files_struct *files) { -struct io_defer_entry *de =NULL ; +struct io_defer_entry *de;LIST_HEAD (list);spin_lock_irq (&ctx->completion_lock);
@@ -8876,6 +8876,8 @@ static void io_cancel_defer_files(struct io_ring_ctx *ctx, } }spin_unlock_irq (&ctx->completion_lock); +if (list_empty (&list)) +return false;while (!list_empty (&list)) { de = list_first_entry(&list, struct io_defer_entry, list);
@@ -8885,6 +8887,7 @@ static void io_cancel_defer_files(struct io_ring_ctx *ctx,io_req_complete (de->req, -ECANCELED );kfree (de); } +return true; } static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx,
@@ -8912,6 +8915,7 @@ static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx, } } + ret |=io_cancel_defer_files (ctx, task, files); ret |=io_poll_remove_all (ctx, task, files); ret |=io_kill_timeouts (ctx, task, files); ret |=io_run_task_work ();
@@ -8992,8 +8996,6 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,io_sq_thread_park (ctx->sq_data); } -io_cancel_defer_files (ctx, task, files); -io_uring_cancel_files (ctx, task, files);if (!files)io_uring_try_cancel_requests (ctx, task,NULL );
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 59/254 mm/fork: clear PASID for new mm
In reply to Greg Kroah-HartmanFrom: Fenghua Yu <[email protected]>
[ Upstream commit 82e69a121be4b1597ce758534816a8ee04c8b761 ]
When a new mm is created, its PASID should be cleared, i.e. the PASID is initialized to its init state 0 on both ARM and X86.
This patch was part of the series introducing mm->pasid, but got lost along the way [1]. It still makes sense to have it, because each address space has a different PASID. And the IOMMU code in iommu_sva_alloc_pasid() expects the pasid field of a new mm struct to be cleared.
[1] https://lore.kernel.org/linux-iommu/[email protected]/
--- include/linux/mm_types.h | 1 + kernel/fork.c | 8 ++++++++ 2 files changed, 9 insertions(+)
include/linux/mm_types.h +1 -0
@@ -23,6 +23,7 @@#endif #define AT_VECTOR_SIZE (2*(AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1)) +#define INIT_PASID 0struct address_space ;struct mem_cgroup ;
kernel/fork.c +8 -0
@@ -994,6 +994,13 @@ static void mm_init_owner(struct mm_struct *mm, struct task_struct *p)#endif } +static void mm_init_pasid (struct mm_struct *mm) +{ +#ifdef CONFIG_IOMMU_SUPPORT + mm->pasid =INIT_PASID ; +#endif +} +static void mm_init_uprobes_state (struct mm_struct *mm) {#ifdef CONFIG_UPROBES
@@ -1024,6 +1031,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,mm_init_cpumask (mm);mm_init_aio (mm);mm_init_owner (mm, p); +mm_init_pasid (mm);RCU_INIT_POINTER (mm->exe_file,NULL );mmu_notifier_subscriptions_init (mm);init_tlb_flush_pending (mm);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 60/254 ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls
In reply to Greg Kroah-HartmanFrom: Sergei Trofimovich <[email protected]>
[ Upstream commit 0ceb1ace4a2778e34a5414e5349712ae4dc41d85 ]
In https://bugs.gentoo.org/769614 Dmitry noticed that ptrace(PTRACE_GET_SYSCALL_INFO) does not work for syscalls called via glibc's syscall() wrapper.
ia64 has two ways to call syscalls from userspace: via break and via eps instructions.
The difference is in stack layout:
1. eps creates simple stack frame: no locals, in{0..7} == out{0..8}
2. break uses userspace stack frame: may be locals (glibc provides one), in{0..7} == out{0..8}.
Both work fine in syscall handling cde itself.
But ptrace(PTRACE_GET_SYSCALL_INFO) uses unwind mechanism to re-extract syscall arguments but it does not account for locals.
The change always skips locals registers. It should not change eps path as kernel's handler already enforces locals=0 and fixes break.
Tested on v5.10 on rx3600 machine (ia64 9040 CPU).
--- arch/ia64/kernel/ptrace.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
arch/ia64/kernel/ptrace.c +18 -6
@@ -2013,27 +2013,39 @@ static void syscall_get_set_args_cb(struct unw_frame_info *info, void *data) {struct syscall_get_set_args *args = data;struct pt_regs *pt = args->regs; -unsigned long *krbs, cfm, ndirty; +unsigned long *krbs, cfm, ndirty, nlocals, nouts;int i, count;if (unw_unwind_to_user (info) <0 )return ; +/* +* We get here via a few paths: +* - break instruction: cfm is shared with caller. +* syscall args are in out= regs, locals are non-empty. +* - epsinstruction: cfm is set by br.call +* locals don't exist. +* +* For both cases argguments are reachable in cfm.sof - cfm.sol. +* CFM: [ ... | sor: 17..14 | sol : 13..7 | sof : 6..0 ] +*/ cfm = pt->cr_ifs; + nlocals = (cfm >>7 ) &0x7f ;/* aka sol */ + nouts = (cfm &0x7f ) - nlocals;/* aka sof - sol */ krbs = (unsigned long *)info->task +IA64_RBS_OFFSET /8 ; ndirty =ia64_rse_num_regs (krbs, krbs + (pt->loadrs >>19 )); count =0 ;if (in_syscall (pt)) - count =min_t (int, args->n, cfm &0x7f ); + count =min_t (int, args->n, nouts); +/* Iterate over outs. */ for (i =0 ; i < count; i++) { +int j = ndirty + nlocals + i + args->i;if (args->rw) - *ia64_rse_skip_regs (krbs, ndirty + i + args->i) = - args->args[i]; + *ia64_rse_skip_regs (krbs, j) = args->args[i];else - args->args[i] = *ia64_rse_skip_regs (krbs, - ndirty + i + args->i); + args->args[i] = *ia64_rse_skip_regs (krbs, j); }if (!args->rw) {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 61/254 ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign
In reply to Greg Kroah-HartmanFrom: Sergei Trofimovich <[email protected]>
[ Upstream commit 61bf318eac2c13356f7bd1c6a05421ef504ccc8a ]
In https://bugs.gentoo.org/769614 Dmitry noticed that ptrace(PTRACE_GET_SYSCALL_INFO) does not return error sign properly.
The bug is in mismatch between get/set errors:
static inline long syscall_get_error(struct task_struct *task,
struct pt_regs *regs)
{
return regs->r10 == -1 ? regs->r8:0;
}static inline long syscall_get_return_value(struct task_struct *task,
struct pt_regs *regs)
{
return regs->r8;
}static inline void syscall_set_return_value(struct task_struct *task,
struct pt_regs *regs, int error, long val)
{
if (error) {
/* error < 0, but ia64 uses > 0 return value */
regs->r8 = -error;
regs->r10 = -1;
} else {
regs->r8 = val;
regs->r10 = 0;
}
}Tested on v5.10 on rx3600 machine (ia64 9040 CPU).
--- arch/ia64/include/asm/syscall.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/ia64/include/asm/syscall.h +1 -1
@@ -32,7 +32,7 @@ static inline void syscall_rollback(struct task_struct *task,static inline long syscall_get_error (struct task_struct *task,struct pt_regs *regs) { -return regs->r10 ==-1 ? regs->r8:0 ; +return regs->r10 ==-1 ? -regs->r8:0 ; } static inline long syscall_get_return_value(struct task_struct *task,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 62/254 static_call: Pull some static_call declarations to the type headers
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 880cfed3a012d7863f42251791cea7fe78c39390 ]
Some static call declarations are going to be needed on low level header files. Move the necessary material to the dedicated static call types header to avoid inclusion dependency hell.
--- include/linux/static_call.h | 21 ------------------- include/linux/static_call_types.h | 27 +++++++++++++++++++++++++ tools/include/linux/static_call_types.h | 27 +++++++++++++++++++++++++ 3 files changed, 54 insertions(+), 21 deletions(-)
include/linux/static_call.h +0 -21
@@ -107,26 +107,10 @@ extern void arch_static_call_transform(void *site, void *tramp, void *func, bool#define STATIC_CALL_TRAMP_ADDR (name) &STATIC_CALL_TRAMP(name) -/* -* __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from -* the symbol table so that objtool can reference it when it generates the -* .static_call_sites section. -*/ -#define __static_call (name) \ -({ \ - __ADDRESSABLE(STATIC_CALL_KEY(name)); \ - &STATIC_CALL_TRAMP(name); \ -}) -#else #define STATIC_CALL_TRAMP_ADDR (name) NULL#endif - -#define DECLARE_STATIC_CALL (name, func) \ - extern struct static_call_key STATIC_CALL_KEY(name); \ - extern typeof(func) STATIC_CALL_TRAMP(name); -#define static_call_update (name, func) \ ({ \ BUILD_BUG_ON(!__same_type(*(func), STATIC_CALL_TRAMP(name))); \
@@ -174,7 +158,6 @@ extern int static_call_text_reserved(void *start, void *end); }; \ ARCH_DEFINE_STATIC_CALL_NULL_TRAMP(name) -#define static_call (name) __static_call(name)#define static_call_cond (name) (void)__static_call(name)#define EXPORT_STATIC_CALL (name) \
@@ -207,7 +190,6 @@ struct static_call_key { }; \ ARCH_DEFINE_STATIC_CALL_NULL_TRAMP(name) -#define static_call (name) __static_call(name)#define static_call_cond (name) (void)__static_call(name) static inline
@@ -252,9 +234,6 @@ struct static_call_key { .func = NULL, \ } -#define static_call (name) \ - ((typeof(STATIC_CALL_TRAMP(name))*)(STATIC_CALL_KEY(name).func)) -static inline void __static_call_nop (void ) { }/*
include/linux/static_call_types.h +27 -0
@@ -4,6 +4,7 @@#include <linux/types.h> #include <linux/stringify.h> +#include <linux/compiler.h> #define STATIC_CALL_KEY_PREFIX __SCK__#define STATIC_CALL_KEY_PREFIX_STR __stringify(STATIC_CALL_KEY_PREFIX)
@@ -32,4 +33,30 @@ struct static_call_site { s32 key; }; +#define DECLARE_STATIC_CALL (name, func) \ + extern struct static_call_key STATIC_CALL_KEY(name); \ + extern typeof(func) STATIC_CALL_TRAMP(name); + +#ifdef CONFIG_HAVE_STATIC_CALL + +/* +* __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from +* the symbol table so that objtool can reference it when it generates the +* .static_call_sites section. +*/ +#define __static_call (name) \ +({ \ + __ADDRESSABLE(STATIC_CALL_KEY(name)); \ + &STATIC_CALL_TRAMP(name); \ +}) + +#define static_call (name) __static_call(name) + +#else + +#define static_call (name) \ + ((typeof(STATIC_CALL_TRAMP(name))*)(STATIC_CALL_KEY(name).func)) + +#endif /* CONFIG_HAVE_STATIC_CALL */ +#endif /* _STATIC_CALL_TYPES_H */
tools/include/linux/static_call_types.h +27 -0
@@ -4,6 +4,7 @@#include <linux/types.h> #include <linux/stringify.h> +#include <linux/compiler.h> #define STATIC_CALL_KEY_PREFIX __SCK__#define STATIC_CALL_KEY_PREFIX_STR __stringify(STATIC_CALL_KEY_PREFIX)
@@ -32,4 +33,30 @@ struct static_call_site { s32 key; }; +#define DECLARE_STATIC_CALL (name, func) \ + extern struct static_call_key STATIC_CALL_KEY(name); \ + extern typeof(func) STATIC_CALL_TRAMP(name); + +#ifdef CONFIG_HAVE_STATIC_CALL + +/* +* __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from +* the symbol table so that objtool can reference it when it generates the +* .static_call_sites section. +*/ +#define __static_call (name) \ +({ \ + __ADDRESSABLE(STATIC_CALL_KEY(name)); \ + &STATIC_CALL_TRAMP(name); \ +}) + +#define static_call (name) __static_call(name) + +#else + +#define static_call (name) \ + ((typeof(STATIC_CALL_TRAMP(name))*)(STATIC_CALL_KEY(name).func)) + +#endif /* CONFIG_HAVE_STATIC_CALL */ +#endif /* _STATIC_CALL_TYPES_H */
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 63/254 static_call: Allow module use without exposing static_call_key
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
[ Upstream commit 73f44fe19d359635a607e8e8daa0da4001c1cfc2 ]
When exporting static_call_key; with EXPORT_STATIC_CALL*(), the module can use static_call_update() to change the function called. This is not desirable in general.
Not exporting static_call_key however also disallows usage of static_call(), since objtool needs the key to construct the static_call_site.
Solve this by allowing objtool to create the static_call_site using the trampoline address when it builds a module and cannot find the static_call_key symbol. The module loader will then try and map the trampole back to a key before it constructs the normal sites list.
Doing this requires a trampoline -> key associsation, so add another magic section that keeps those.
--- arch/x86/include/asm/static_call.h | 7 ++++ include/asm-generic/vmlinux.lds.h | 5 ++- include/linux/static_call.h | 22 +++++++++- include/linux/static_call_types.h | 27 +++++++++++- kernel/static_call.c | 55 ++++++++++++++++++++++++- tools/include/linux/static_call_types.h | 27 +++++++++++- tools/objtool/check.c | 17 +++++++- 7 files changed, 149 insertions(+), 11 deletions(-)
arch/x86/include/asm/static_call.h +7 -0
@@ -37,4 +37,11 @@#define ARCH_DEFINE_STATIC_CALL_NULL_TRAMP (name) \ __ARCH_DEFINE_STATIC_CALL_TRAMP(name, "ret; nop; nop; nop; nop") + +#define ARCH_ADD_TRAMP_KEY (name) \ + asm(".pushsection .static_call_tramp_key, \"a\" \n" \ + ".long " STATIC_CALL_TRAMP_STR(name) " - . \n" \ + ".long " STATIC_CALL_KEY_STR(name) " - . \n" \ + ".popsection \n") +#endif /* _ASM_STATIC_CALL_H */
include/asm-generic/vmlinux.lds.h +4 -1
@@ -393,7 +393,10 @@ . = ALIGN(8); \ __start_static_call_sites = .; \ KEEP(*(.static_call_sites)) \ - __stop_static_call_sites = .; + __stop_static_call_sites = .; \ + __start_static_call_tramp_key = .; \ + KEEP(*(.static_call_tramp_key)) \ + __stop_static_call_tramp_key = .;/* * Allow architectures to handle ro_after_init data on their
include/linux/static_call.h +20 -2
@@ -138,6 +138,12 @@ struct static_call_key { }; }; +/* For finding the key associated with a trampoline */ +struct static_call_tramp_key { +s32 tramp; +s32 key; +}; +extern void __static_call_update (struct static_call_key *key,void *tramp,void *func);extern int static_call_mod_init (struct module *mod);extern int static_call_text_reserved (void *start,void *end);
@@ -163,11 +169,18 @@ extern int static_call_text_reserved(void *start, void *end);#define EXPORT_STATIC_CALL (name) \ EXPORT_SYMBOL(STATIC_CALL_KEY(name)); \ EXPORT_SYMBOL(STATIC_CALL_TRAMP(name)) -#define EXPORT_STATIC_CALL_GPL (name) \ EXPORT_SYMBOL_GPL(STATIC_CALL_KEY(name)); \ EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name)) +/* Leave the key unexported, so modules can't change static call targets: */ +#define EXPORT_STATIC_CALL_TRAMP (name) \ + EXPORT_SYMBOL(STATIC_CALL_TRAMP(name)); \ + ARCH_ADD_TRAMP_KEY(name) +#define EXPORT_STATIC_CALL_TRAMP_GPL (name) \ + EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name)); \ + ARCH_ADD_TRAMP_KEY(name) +#elif defined(CONFIG_HAVE_STATIC_CALL )static inline int static_call_init (void ) {return 0 ; }
@@ -209,11 +222,16 @@ static inline int static_call_text_reserved(void *start, void *end)#define EXPORT_STATIC_CALL (name) \ EXPORT_SYMBOL(STATIC_CALL_KEY(name)); \ EXPORT_SYMBOL(STATIC_CALL_TRAMP(name)) -#define EXPORT_STATIC_CALL_GPL (name) \ EXPORT_SYMBOL_GPL(STATIC_CALL_KEY(name)); \ EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name)) +/* Leave the key unexported, so modules can't change static call targets: */ +#define EXPORT_STATIC_CALL_TRAMP (name) \ + EXPORT_SYMBOL(STATIC_CALL_TRAMP(name)) +#define EXPORT_STATIC_CALL_TRAMP_GPL (name) \ + EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name)) +#else /* Generic implementation */ static inline int static_call_init (void ) {return 0 ; }
include/linux/static_call_types.h +25 -2
@@ -10,6 +10,7 @@#define STATIC_CALL_KEY_PREFIX_STR __stringify(STATIC_CALL_KEY_PREFIX)#define STATIC_CALL_KEY_PREFIX_LEN (sizeof(STATIC_CALL_KEY_PREFIX_STR) - 1)#define STATIC_CALL_KEY (name) __PASTE(STATIC_CALL_KEY_PREFIX, name) +#define STATIC_CALL_KEY_STR (name) __stringify(STATIC_CALL_KEY(name))#define STATIC_CALL_TRAMP_PREFIX __SCT__#define STATIC_CALL_TRAMP_PREFIX_STR __stringify(STATIC_CALL_TRAMP_PREFIX)
@@ -39,17 +40,39 @@ struct static_call_site {#ifdef CONFIG_HAVE_STATIC_CALL +#define __raw_static_call (name) (&STATIC_CALL_TRAMP(name)) + +#ifdef CONFIG_HAVE_STATIC_CALL_INLINE +/* * __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from * the symbol table so that objtool can reference it when it generates the * .static_call_sites section. */ +#define __STATIC_CALL_ADDRESSABLE (name) \ + __ADDRESSABLE(STATIC_CALL_KEY(name)) +#define __static_call (name) \ ({ \ - __ADDRESSABLE(STATIC_CALL_KEY(name)); \ - &STATIC_CALL_TRAMP(name); \ + __STATIC_CALL_ADDRESSABLE(name); \ + __raw_static_call(name); \ }) +#else /* !CONFIG_HAVE_STATIC_CALL_INLINE */ + +#define __STATIC_CALL_ADDRESSABLE (name) +#define __static_call (name) __raw_static_call(name) + +#endif /* CONFIG_HAVE_STATIC_CALL_INLINE */ + +#ifdef MODULE +#define __STATIC_CALL_MOD_ADDRESSABLE (name) +#define static_call_mod (name) __raw_static_call(name) +#else +#define __STATIC_CALL_MOD_ADDRESSABLE (name) __STATIC_CALL_ADDRESSABLE(name) +#define static_call_mod (name) __static_call(name) +#endif +#define static_call (name) __static_call(name)#else
kernel/static_call.c +53 -2
69 lines not on this page · raw message
tools/include/linux/static_call_types.h +25 -2
@@ -10,6 +10,7 @@#define STATIC_CALL_KEY_PREFIX_STR __stringify(STATIC_CALL_KEY_PREFIX)#define STATIC_CALL_KEY_PREFIX_LEN (sizeof(STATIC_CALL_KEY_PREFIX_STR) - 1)#define STATIC_CALL_KEY (name) __PASTE(STATIC_CALL_KEY_PREFIX, name) +#define STATIC_CALL_KEY_STR (name) __stringify(STATIC_CALL_KEY(name))#define STATIC_CALL_TRAMP_PREFIX __SCT__#define STATIC_CALL_TRAMP_PREFIX_STR __stringify(STATIC_CALL_TRAMP_PREFIX)
@@ -39,17 +40,39 @@ struct static_call_site {#ifdef CONFIG_HAVE_STATIC_CALL +#define __raw_static_call (name) (&STATIC_CALL_TRAMP(name)) + +#ifdef CONFIG_HAVE_STATIC_CALL_INLINE +/* * __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from * the symbol table so that objtool can reference it when it generates the * .static_call_sites section. */ +#define __STATIC_CALL_ADDRESSABLE (name) \ + __ADDRESSABLE(STATIC_CALL_KEY(name)) +#define __static_call (name) \ ({ \ - __ADDRESSABLE(STATIC_CALL_KEY(name)); \ - &STATIC_CALL_TRAMP(name); \ + __STATIC_CALL_ADDRESSABLE(name); \ + __raw_static_call(name); \ }) +#else /* !CONFIG_HAVE_STATIC_CALL_INLINE */ + +#define __STATIC_CALL_ADDRESSABLE (name) +#define __static_call (name) __raw_static_call(name) + +#endif /* CONFIG_HAVE_STATIC_CALL_INLINE */ + +#ifdef MODULE +#define __STATIC_CALL_MOD_ADDRESSABLE (name) +#define static_call_mod (name) __raw_static_call(name) +#else +#define __STATIC_CALL_MOD_ADDRESSABLE (name) __STATIC_CALL_ADDRESSABLE(name) +#define static_call_mod (name) __static_call(name) +#endif +#define static_call (name) __static_call(name)#else
tools/objtool/check.c +15 -2
@@ -502,8 +502,21 @@ static int create_static_call_sections(struct objtool_file *file) key_sym =find_symbol_by_name (file->elf, tmp);if (!key_sym) { -WARN ("static_call: can't find static_call_key symbol: %s" , tmp); -return -1 ; +if (!module) { +WARN ("static_call: can't find static_call_key symbol: %s" , tmp); +return -1 ; + } + +/* +* For modules(), the key might not be exported, which +* means the module can make static calls but isn't +* allowed to change them. +* +* In that case we temporarily set the key to be the +* trampoline address. This is fixed up in +* static_call_add_module(). +*/ + key_sym = insn->call_dest; }free (key_name);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 64/254 static_call: Fix the module key fixup
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 50bf8080a94d171e843fc013abec19d8ab9f50ae ]
Provided the target address of a R_X86_64_PC32 relocation is aligned, the low two bits should be invariant between the relative and absolute value.
Turns out the address is not aligned and things go sideways, ensure we transfer the bits in the absolute form when fixing up the key address.
--- kernel/static_call.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
kernel/static_call.c +4 -3
@@ -358,7 +358,8 @@ static int static_call_add_module(struct module *mod)struct static_call_site *site;for (site = start; site != stop; site++) { -unsigned long addr = (unsigned long )static_call_key (site); +unsigned long s_key = (long )site->key + (long )&site->key; +unsigned long addr = s_key & ~STATIC_CALL_SITE_FLAGS ;unsigned long key;/*
@@ -382,8 +383,8 @@ static int static_call_add_module(struct module *mod)return -EINVAL ; } - site->key = (key - (long )&site->key) | - (site->key &STATIC_CALL_SITE_FLAGS ); + key |= s_key &STATIC_CALL_SITE_FLAGS ; + site->key = key - (long )&site->key; }return __static_call_init (mod, start, stop);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 65/254 static_call: Fix static_call_set_init()
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 68b1eddd421d2b16c6655eceb48918a1e896bbbc ]
It turns out that static_call_set_init() does not preserve the other flags; IOW. it clears TAIL if it was set.
--- kernel/static_call.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
kernel/static_call.c +10 -7
@@ -35,27 +35,30 @@ static inline void *static_call_addr(struct static_call_site *site)return (void *)((long )site->addr + (long )&site->addr); } +static inline unsigned long __static_call_key (const struct static_call_site *site) +{ +return (long )site->key + (long )&site->key; +}static inline struct static_call_key *static_call_key (const struct static_call_site *site) { -return (struct static_call_key *) - (((long )site->key + (long )&site->key) & ~STATIC_CALL_SITE_FLAGS ); +return (void *)(__static_call_key (site) & ~STATIC_CALL_SITE_FLAGS ); }/* These assume the key is word-aligned. */ static inline bool static_call_is_init (struct static_call_site *site) { -return ((long )site->key + (long )&site->key) &STATIC_CALL_SITE_INIT ; +return __static_call_key (site) &STATIC_CALL_SITE_INIT ; }static inline bool static_call_is_tail (struct static_call_site *site) { -return ((long )site->key + (long )&site->key) &STATIC_CALL_SITE_TAIL ; +return __static_call_key (site) &STATIC_CALL_SITE_TAIL ; }static inline void static_call_set_init (struct static_call_site *site) { - site->key = ((long )static_call_key (site) |STATIC_CALL_SITE_INIT ) - + site->key = (__static_call_key (site) |STATIC_CALL_SITE_INIT ) - (long )&site->key; }
@@ -199,7 +202,7 @@ void __static_call_update(struct static_call_key *key, void *tramp, void *func) }arch_static_call_transform (site_addr,NULL , func, -static_call_is_tail (site)); +static_call_is_tail (site)); } }
@@ -358,7 +361,7 @@ static int static_call_add_module(struct module *mod)struct static_call_site *site;for (site = start; site != stop; site++) { -unsigned long s_key = (long )site->key + (long )&site->key; +unsigned long s_key =__static_call_key (site);unsigned long addr = s_key & ~STATIC_CALL_SITE_FLAGS ;unsigned long key;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 66/254 KVM: x86: Protect userspace MSR filter with SRCU, and set atomically-ish
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit b318e8decf6b9ef1bcf4ca06fae6d6a2cb5d5c5c ]
Fix a plethora of issues with MSR filtering by installing the resulting filter as an atomic bundle instead of updating the live filter one range at a time. The KVM_X86_SET_MSR_FILTER ioctl() isn't truly atomic, as the hardware MSR bitmaps won't be updated until the next VM-Enter, but the relevant software struct is atomically updated, which is what KVM really needs.
Similar to the approach used for modifying memslots, make arch.msr_filter a SRCU-protected pointer, do all the work configuring the new filter outside of kvm->lock, and then acquire kvm->lock only when the new filter has been vetted and created. That way vCPU readers either see the old filter or the new filter in their entirety, not some half-baked state.
Yuan Yao pointed out a use-after-free in ksm_msr_allowed() due to a TOCTOU bug, but that's just the tip of the iceberg...
- Nothing is __rcu annotated, making it nigh impossible to audit the code for correctness.
- kvm_add_msr_filter() has an unpaired smp_wmb(). Violation of kernel coding style aside, the lack of a smb_rmb() anywhere casts all code into doubt.
- kvm_clear_msr_filter() has a double free TOCTOU bug, as it grabs count before taking the lock.
- kvm_clear_msr_filter() also has memory leak due to the same TOCTOU bug.
The entire approach of updating the live filter is also flawed. While installing a new filter is inherently racy if vCPUs are running, fixing the above issues also makes it trivial to ensure certain behavior is deterministic, e.g. KVM can provide deterministic behavior for MSRs with identical settings in the old and new filters. An atomic update of the filter also prevents KVM from getting into a half-baked state, e.g. if installing a filter fails, the existing approach would leave the filter in a half-baked state, having already committed whatever bits of the filter were already processed.
[*] https://lkml.kernel.org/r/[email protected]
Message-Id: <[email protected]>
--- Documentation/virt/kvm/api.rst | 6 +- arch/x86/include/asm/kvm_host.h | 14 ++-- arch/x86/kvm/x86.c | 109 +++++++++++++++++++------------- 3 files changed, 78 insertions(+), 51 deletions(-)
Documentation/virt/kvm/api.rst +4 -2
@@ -4831,8 +4831,10 @@ If an MSR access is not permitted through the filtering, it generates a allows user space to deflect and potentially handle various MSR accesses into user space. -If a vCPU is in running state while this ioctl is invoked, the vCPU may -experience inconsistent filtering behavior on MSR accesses. +Note, invoking this ioctl with a vCPU is running is inherently racy. However, +KVM does guarantee that vCPUs will see either the previous filter or the new +filter, e.g. MSRs with identical settings in both the old and new filter will +have deterministic behavior. 5. The kvm_run structure
arch/x86/include/asm/kvm_host.h +9 -5
@@ -894,6 +894,12 @@ enum kvm_irqchip_mode { KVM_IRQCHIP_SPLIT, /* created with KVM_CAP_SPLIT_IRQCHIP */ }; +struct kvm_x86_msr_filter { +u8 count; +bool default_allow:1 ; +struct msr_bitmap_range ranges[16 ]; +}; +#define APICV_INHIBIT_REASON_DISABLE 0#define APICV_INHIBIT_REASON_HYPERV 1#define APICV_INHIBIT_REASON_NESTED 2
@@ -989,14 +995,12 @@ struct kvm_arch {bool guest_can_read_msr_platform_info;bool exception_payload_enabled; +bool bus_lock_detection_enabled; +/* Deflect RDMSR and WRMSR to user space when they trigger a #GP */ u32 user_space_msr_mask; -struct { -u8 count; -bool default_allow:1 ; -struct msr_bitmap_range ranges[16 ]; - } msr_filter; +struct kvm_x86_msr_filter __rcu *msr_filter;struct kvm_pmu_event_filter *pmu_event_filter;struct task_struct *nx_lpage_recovery_thread;
arch/x86/kvm/x86.c +65 -44
187 lines not on this page · raw message
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 67/254 btrfs: do not initialize dev stats if we have no dev_root
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 82d62d06db404d03836cdabbca41d38646d97cbb upstream.
Neal reported a panic trying to use -o rescue=all
BUG: kernel NULL pointer dereference, address: 0000000000000030 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 0 PID: 4095 Comm: mount Not tainted 5.11.0-0.rc7.149.fc34.x86_64 #1 RIP: 0010:btrfs_device_init_dev_stats+0x4c/0x1f0 RSP: 0018:ffffa60285fbfb68 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88b88f806498 RCX: ffff88b82e7a2a10 RDX: ffffa60285fbfb97 RSI: ffff88b82e7a2a10 RDI: 0000000000000000 RBP: ffff88b88f806b3c R08: 0000000000000000 R09: 0000000000000000 R10: ffff88b82e7a2a10 R11: 0000000000000000 R12: ffff88b88f806a00 R13: ffff88b88f806478 R14: ffff88b88f806a00 R15: ffff88b82e7a2a10 FS: 00007f698be1ec40(0000) GS:ffff88b937e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000030 CR3: 0000000092c9c006 CR4: 00000000003706f0 Call Trace: ? btrfs_init_dev_stats+0x1f/0xf0 btrfs_init_dev_stats+0x62/0xf0 open_ctree+0x1019/0x15ff btrfs_mount_root.cold+0x13/0xfa legacy_get_tree+0x27/0x40 vfs_get_tree+0x25/0xb0 vfs_kern_mount.part.0+0x71/0xb0 btrfs_mount+0x131/0x3d0 ? legacy_get_tree+0x27/0x40 ? btrfs_show_options+0x640/0x640 legacy_get_tree+0x27/0x40 vfs_get_tree+0x25/0xb0 path_mount+0x441/0xa80 __x64_sys_mount+0xf4/0x130 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f698c04e52e
This happens because we unconditionally attempt to initialize device stats on mount, but we may not have been able to read the device root. Fix this by skipping initializing the device stats if we do not have a device root.
--- fs/btrfs/volumes.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/volumes.c +3 -0
@@ -7282,6 +7282,9 @@ static int btrfs_device_init_dev_stats(sint item_size;int i, ret, slot; +if (!device->fs_info->dev_root) +return 0 ; + key.objectid =BTRFS_DEV_STATS_OBJECTID ; key.type =BTRFS_PERSISTENT_ITEM_KEY ; key.offset = device->devid;
Greg Kroah-Hartman
maintainerPATCH 68/254 btrfs: do not initialize dev replace for bad dev root
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 3cb894972f1809aa8d087c42e5e8b26c64b7d508 upstream.
While helping Neal fix his broken file system I added a debug patch to catch if we were calling btrfs_search_slot with a NULL root, and this stack trace popped:
we tried to search with a NULL root
CPU: 0 PID: 1760 Comm: mount Not tainted 5.11.0-155.nealbtrfstest.1.fc34.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/22/2020 Call Trace: dump_stack+0x6b/0x83 btrfs_search_slot.cold+0x11/0x1b ? btrfs_init_dev_replace+0x36/0x450 btrfs_init_dev_replace+0x71/0x450 open_ctree+0x1054/0x1610 btrfs_mount_root.cold+0x13/0xfa legacy_get_tree+0x27/0x40 vfs_get_tree+0x25/0xb0 vfs_kern_mount.part.0+0x71/0xb0 btrfs_mount+0x131/0x3d0 ? legacy_get_tree+0x27/0x40 ? btrfs_show_options+0x640/0x640 legacy_get_tree+0x27/0x40 vfs_get_tree+0x25/0xb0 path_mount+0x441/0xa80 __x64_sys_mount+0xf4/0x130 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f644730352e
Fix this by not starting the device replace stuff if we do not have a NULL dev root.
--- fs/btrfs/dev-replace.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/dev-replace.c +3 -0
@@ -80,6 +80,9 @@ int btrfs_init_dev_replace(struct btrfs_struct btrfs_dev_replace_item *ptr;u64 src_devid; +if (!dev_root) +return 0 ; + path =btrfs_alloc_path ();if (!path) { ret = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 69/254 btrfs: fix check_data_csum() error message for direct I/O
In reply to Greg Kroah-HartmanFrom: Omar Sandoval <[email protected]>
commit c1d6abdac46ca8127274bea195d804e3f2cec7ee upstream.
Commit 1dae796aabf6 ("btrfs: inode: sink parameter start and len to check_data_csum()") replaced the start parameter to check_data_csum() with page_offset(), but page_offset() is not meaningful for direct I/O pages. Bring back the start parameter.
--- fs/btrfs/inode.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
fs/btrfs/inode.c +9 -5
@@ -2947,11 +2947,13 @@ void btrfs_writepage_endio_finish_ordere* @bio_offset: offset to the beginning of the bio (in bytes) * @page: page where is the data to be verified * @pgoff: offset inside the page +* @start: logical offset in the file * * The length of such check is always one sector size. */ static int check_data_csum (struct inode *inode,struct btrfs_io_bio *io_bio, -u32 bio_offset,struct page *page,u32 pgoff) +u32 bio_offset,struct page *page,u32 pgoff, +u64 start) {struct btrfs_fs_info *fs_info =btrfs_sb (inode->i_sb);SHASH_DESC_ON_STACK (shash, fs_info->csum_shash);
@@ -2978,8 +2980,8 @@ static int check_data_csum(struct inodekunmap_atomic (kaddr);return 0 ; zeroit: -btrfs_print_data_csum_error (BTRFS_I (inode),page_offset (page) + pgoff, - csum, csum_expected, io_bio->mirror_num); +btrfs_print_data_csum_error (BTRFS_I (inode), start, csum, csum_expected, + io_bio->mirror_num);if (io_bio->device)btrfs_dev_stat_inc_and_print (io_bio->device,BTRFS_DEV_STAT_CORRUPTION_ERRS );
@@ -3032,7 +3034,8 @@ int btrfs_verify_data_csum(struct btrfs_ pg_off += sectorsize, bio_offset += sectorsize) {int ret; - ret =check_data_csum (inode, io_bio, bio_offset, page, pg_off); + ret =check_data_csum (inode, io_bio, bio_offset, page, pg_off, +page_offset (page) + pg_off);if (ret <0 )return -EIO ; }
@@ -7742,7 +7745,8 @@ static blk_status_t btrfs_check_read_dioASSERT (pgoff <PAGE_SIZE );if (uptodate && (!csum || !check_data_csum (inode, io_bio, - bio_offset, bvec.bv_page, pgoff))) { + bio_offset, bvec.bv_page, + pgoff, start))) { clean_io_failure(fs_info, failure_tree, io_tree, start, bvec.bv_page, btrfs_ino(BTRFS_I(inode)),
Greg Kroah-Hartman
maintainerPATCH 70/254 btrfs: initialize device::fs_info always
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 820a49dafc3304de06f296c35c9ff1ebc1666343 upstream.
Neal reported a panic trying to use -o rescue=all
BUG: kernel NULL pointer dereference, address: 0000000000000030 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 0 PID: 696 Comm: mount Tainted: G W 5.12.0-rc2+ #296 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 RIP: 0010:btrfs_device_init_dev_stats+0x1d/0x200 RSP: 0018:ffffafaec1483bb8 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff9a5715bcb298 RCX: 0000000000000070 RDX: ffff9a5703248000 RSI: ffff9a57052ea150 RDI: ffff9a5715bca400 RBP: ffff9a57052ea150 R08: 0000000000000070 R09: ffff9a57052ea150 R10: 000130faf0741c10 R11: 0000000000000000 R12: ffff9a5703700000 R13: 0000000000000000 R14: ffff9a5715bcb278 R15: ffff9a57052ea150 FS: 00007f600d122c40(0000) GS:ffff9a577bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000030 CR3: 0000000112a46005 CR4: 0000000000370ef0 Call Trace: ? btrfs_init_dev_stats+0x1f/0xf0 ? kmem_cache_alloc+0xef/0x1f0 btrfs_init_dev_stats+0x5f/0xf0 open_ctree+0x10cb/0x1720 btrfs_mount_root.cold+0x12/0xea legacy_get_tree+0x27/0x40 vfs_get_tree+0x25/0xb0 vfs_kern_mount.part.0+0x71/0xb0 btrfs_mount+0x10d/0x380 legacy_get_tree+0x27/0x40 vfs_get_tree+0x25/0xb0 path_mount+0x433/0xa00 __x64_sys_mount+0xe3/0x120 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae
This happens because when we call btrfs_init_dev_stats we do device->fs_info->dev_root. However device->fs_info isn't initialized because we were only calling btrfs_init_devices_late() if we properly read the device root. However we don't actually need the device root to init the devices, this function simply assigns the devices their ->fs_info pointer properly, so this needs to be done unconditionally always so that we can properly dereference device->fs_info in rescue cases.
--- fs/btrfs/disk-io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/btrfs/disk-io.c +2 -1
@@ -2300,8 +2300,9 @@ static int btrfs_read_roots(struct btrfs }else {set_bit (BTRFS_ROOT_TRACK_DIRTY , &root->state); fs_info->dev_root = root; -btrfs_init_devices_late (fs_info); } +/* Initialize fs_info for all devices in any case */ +btrfs_init_devices_late (fs_info);/* If IGNOREDATACSUMS is set don't bother reading the csum root. */ if (!btrfs_test_opt (fs_info,IGNOREDATACSUMS )) {
Greg Kroah-Hartman
maintainerPATCH 71/254 btrfs: fix sleep while in non-sleep context during qgroup removal
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 0bb788300990d3eb5582d3301a720f846c78925c upstream.
While removing a qgroup's sysfs entry we end up taking the kernfs_mutex, through kobject_del(), while holding the fs_info->qgroup_lock spinlock, producing the following trace:
[821.843637] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:281 [821.843641] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 28214, name: podman [821.843644] CPU: 3 PID: 28214 Comm: podman Tainted: G W 5.11.6 #15 [821.843646] Hardware name: Dell Inc. PowerEdge R330/084XW4, BIOS 2.11.0 12/08/2020 [821.843647] Call Trace: [821.843650] dump_stack+0xa1/0xfb [821.843656] ___might_sleep+0x144/0x160 [821.843659] mutex_lock+0x17/0x40 [821.843662] kernfs_remove_by_name_ns+0x1f/0x80 [821.843666] sysfs_remove_group+0x7d/0xe0 [821.843668] sysfs_remove_groups+0x28/0x40 [821.843670] kobject_del+0x2a/0x80 [821.843672] btrfs_sysfs_del_one_qgroup+0x2b/0x40 [btrfs] [821.843685] __del_qgroup_rb+0x12/0x150 [btrfs] [821.843696] btrfs_remove_qgroup+0x288/0x2a0 [btrfs] [821.843707] btrfs_ioctl+0x3129/0x36a0 [btrfs] [821.843717] ? __mod_lruvec_page_state+0x5e/0xb0 [821.843719] ? page_add_new_anon_rmap+0xbc/0x150 [821.843723] ? kfree+0x1b4/0x300 [821.843725] ? mntput_no_expire+0x55/0x330 [821.843728] __x64_sys_ioctl+0x5a/0xa0 [821.843731] do_syscall_64+0x33/0x70 [821.843733] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [821.843736] RIP: 0033:0x4cd3fb [821.843741] RSP: 002b:000000c000906b20 EFLAGS: 00000206 ORIG_RAX: 0000000000000010 [821.843744] RAX: ffffffffffffffda RBX: 000000c000050000 RCX: 00000000004cd3fb [821.843745] RDX: 000000c000906b98 RSI: 000000004010942a RDI: 000000000000000f [821.843747] RBP: 000000c000907cd0 R08: 000000c000622901 R09: 0000000000000000 [821.843748] R10: 000000c000d992c0 R11: 0000000000000206 R12: 000000000000012d [821.843749] R13: 000000000000012c R14: 0000000000000200 R15: 0000000000000049
Fix this by removing the qgroup sysfs entry while not holding the spinlock, since the spinlock is only meant for protection of the qgroup rbtree.
--- fs/btrfs/qgroup.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
fs/btrfs/qgroup.c +10 -2
@@ -226,7 +226,6 @@ static void __del_qgroup_rb(struct btrfs {struct btrfs_qgroup_list *list; -btrfs_sysfs_del_one_qgroup (fs_info, qgroup);list_del (&qgroup->dirty);while (!list_empty (&qgroup->groups)) { list = list_first_entry(&qgroup->groups,
@@ -243,7 +242,6 @@ static void __del_qgroup_rb(struct btrfslist_del (&list->next_member);kfree (list); } -kfree (qgroup); }/* must be called with qgroup_lock held */
@@ -569,6 +567,8 @@ void btrfs_free_qgroup_config(struct btr qgroup = rb_entry(n, struct btrfs_qgroup, node);rb_erase (n, &fs_info->qgroup_tree);__del_qgroup_rb (fs_info, qgroup); +btrfs_sysfs_del_one_qgroup (fs_info, qgroup); +kfree (qgroup); }/* * We call btrfs_free_qgroup_config() when unmounting
@@ -1578,6 +1578,14 @@ int btrfs_remove_qgroup(struct btrfs_traspin_lock (&fs_info->qgroup_lock);del_qgroup_rb (fs_info, qgroupid);spin_unlock (&fs_info->qgroup_lock); + +/* +* Remove the qgroup from sysfs now without holding the qgroup_lock +* spinlock, since the sysfs_remove_group() function needs to take +* the mutex kernfs_mutex through kernfs_remove_by_name_ns(). +*/ +btrfs_sysfs_del_one_qgroup (fs_info, qgroup); +kfree (qgroup); out:mutex_unlock (&fs_info->qgroup_ioctl_lock);return ret;
Greg Kroah-Hartman
maintainerPATCH 72/254 btrfs: fix subvolume/snapshot deletion not triggered on mount
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 8d488a8c7ba22d7112fbf6b0a82beb1cdea1c0d5 upstream.
During the mount procedure we are calling btrfs_orphan_cleanup() against the root tree, which will find all orphans items in this tree. When an orphan item corresponds to a deleted subvolume/snapshot (instead of an inode space cache), it must not delete the orphan item, because that will cause btrfs_find_orphan_roots() to not find the orphan item and therefore not add the corresponding subvolume root to the list of dead roots, which results in the subvolume's tree never being deleted by the cleanup thread.
The same applies to the remount from RO to RW path.
Fix this by making btrfs_find_orphan_roots() run before calling btrfs_orphan_cleanup() against the root tree.
A test case for fstests will follow soon.
--- fs/btrfs/disk-io.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
fs/btrfs/disk-io.c +15 -1
@@ -2914,6 +2914,21 @@ int btrfs_start_pre_rw_mount(struct btrf } } +/* +* btrfs_find_orphan_roots() is responsible for finding all the dead +* roots (with 0 refs), flag them with BTRFS_ROOT_DEAD_TREE and load +* them into the fs_info->fs_roots_radix tree. This must be done before +* calling btrfs_orphan_cleanup() on the tree root. If we don't do it +* first, then btrfs_orphan_cleanup() will delete a dead root's orphan +* item before the root's tree is deleted - this means that if we unmount +* or crash before the deletion completes, on the next mount we will not +* delete what remains of the tree because the orphan item does not +* exists anymore, which is what tells us we have a pending deletion. +*/ + ret =btrfs_find_orphan_roots (fs_info); +if (ret) + goto out; + ret =btrfs_cleanup_fs_roots (fs_info);if (ret) goto out;
@@ -2973,7 +2988,6 @@ int btrfs_start_pre_rw_mount(struct btrf } } - ret =btrfs_find_orphan_roots (fs_info); out:return ret; }
Greg Kroah-Hartman
maintainerPATCH 73/254 selinux: dont log MAC_POLICY_LOAD record on failed policy load
In reply to Greg Kroah-HartmanFrom: Ondrej Mosnacek <[email protected]>
commit 519dad3bcd809dc1523bf80ab0310ddb3bf00ade upstream.
If sel_make_policy_nodes() fails, we should jump to 'out', not 'out1', as the latter would incorrectly log an MAC_POLICY_LOAD audit record, even though the policy hasn't actually been reloaded. The 'out1' jump label now becomes unused and can be removed.
--- security/selinux/selinuxfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
security/selinux/selinuxfs.c +1 -2
@@ -651,14 +651,13 @@ static ssize_t sel_write_load(struct fil length =sel_make_policy_nodes (fsi, newpolicy);if (length) {selinux_policy_cancel (fsi->state, newpolicy); - goto out1; + goto out; }selinux_policy_commit (fsi->state, newpolicy); length = count; -out1: audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_POLICY_LOAD, "auid=%u ses=%u lsm=selinux res=1", from_kuid(&init_user_ns, audit_get_loginuid(current)),
Greg Kroah-Hartman
maintainerPATCH 74/254 selinux: fix variable scope issue in live sidtab conversion
In reply to Greg Kroah-HartmanFrom: Ondrej Mosnacek <[email protected]>
commit 6406887a12ee5dcdaffff1a8508d91113d545559 upstream.
Commit 02a52c5c8c3b ("selinux: move policy commit after updating selinuxfs") moved the selinux_policy_commit() call out of security_load_policy() into sel_write_load(), which caused a subtle yet rather serious bug.
The problem is that security_load_policy() passes a reference to the convert_params local variable to sidtab_convert(), which stores it in the sidtab, where it may be accessed until the policy is swapped over and RCU synchronized. Before 02a52c5c8c3b, selinux_policy_commit() was called directly from security_load_policy(), so the convert_params pointer remained valid all the way until the old sidtab was destroyed, but now that's no longer the case and calls to sidtab_context_to_sid() on the old sidtab after security_load_policy() returns may cause invalid memory accesses.
This can be easily triggered using the stress test from commit ee1a84fdfeed ("selinux: overhaul sidtab to fix bug and improve performance"):
```
function rand_cat() {
echo $(( $RANDOM % 1024 ))
}
function do_work() {
while true; do
echo -n "system_u:system_r:kernel_t:s0:c$(rand_cat),c$(rand_cat)" \
>/sys/fs/selinux/context 2>/dev/null || true
done
}
do_work >/dev/null &
do_work >/dev/null &
do_work >/dev/null &
while load_policy; do echo -n .; sleep 0.1; done
kill %1
kill %2
kill %3
```Fix this by allocating the temporary sidtab convert structures dynamically and passing them among the selinux_policy_{load,cancel,commit} functions.
--- security/selinux/include/security.h | 15 ++++++-- security/selinux/selinuxfs.c | 10 ++--- security/selinux/ss/services.c | 65 ++++++++++++++++++++++-------------- 3 files changed, 56 insertions(+), 34 deletions(-)
security/selinux/include/security.h +11 -4
@@ -219,14 +219,21 @@ static inline bool selinux_policycap_genreturn READ_ONCE (state->policycap[POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS ]); } +struct selinux_policy_convert_data ; + +struct selinux_load_state { +struct selinux_policy *policy; +struct selinux_policy_convert_data *convert_data; +}; +int security_mls_enabled (struct selinux_state *state);int security_load_policy (struct selinux_state *state, -void *data,size_t len, -struct selinux_policy **newpolicyp); +void *data,size_t len, +struct selinux_load_state *load_state);void selinux_policy_commit (struct selinux_state *state, -struct selinux_policy *newpolicy); +struct selinux_load_state *load_state);void selinux_policy_cancel (struct selinux_state *state, -struct selinux_policy *policy); +struct selinux_load_state *load_state);int security_read_policy (struct selinux_state *state,void **data,size_t *len);
security/selinux/selinuxfs.c +5 -5
@@ -616,7 +616,7 @@ static ssize_t sel_write_load(struct fil {struct selinux_fs_info *fsi =file_inode (file)->i_sb->s_fs_info; -struct selinux_policy *newpolicy; +struct selinux_load_state load_state;ssize_t length;void *data =NULL ;
@@ -642,19 +642,19 @@ static ssize_t sel_write_load(struct filif (copy_from_user (data, buf, count) !=0 ) goto out; - length =security_load_policy (fsi->state, data, count, &newpolicy); + length =security_load_policy (fsi->state, data, count, &load_state);if (length) {pr_warn_ratelimited ("SELinux: failed to load policy\n" ); goto out; } - length =sel_make_policy_nodes (fsi, newpolicy); + length =sel_make_policy_nodes (fsi, load_state.policy);if (length) { -selinux_policy_cancel (fsi->state, newpolicy); +selinux_policy_cancel (fsi->state, &load_state); goto out; } -selinux_policy_commit (fsi->state, newpolicy); +selinux_policy_commit (fsi->state, &load_state); length = count;
security/selinux/ss/services.c +40 -25
137 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 75/254 netsec: restore phy power state after controller reset
In reply to Greg Kroah-HartmanFrom: Mian Yousaf Kaukab <[email protected]>
commit 804741ac7b9f2fdebe3740cb0579cb8d94d49e60 upstream.
Since commit 8e850f25b581 ("net: socionext: Stop PHY before resetting netsec") netsec_netdev_init() power downs phy before resetting the controller. However, the state is not restored once the reset is complete. As a result it is not possible to bring up network on a platform with Broadcom BCM5482 phy.
Fix the issue by restoring phy power state after controller reset is complete.
--- drivers/net/ethernet/socionext/netsec.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/ethernet/socionext/netsec.c +6 -3
@@ -1718,14 +1718,17 @@ static int netsec_netdev_init(struct net goto err1;/* set phy power down */ - data =netsec_phy_read (priv->mii_bus, priv->phy_addr,MII_BMCR ) | -BMCR_PDOWN ; -netsec_phy_write (priv->mii_bus, priv->phy_addr,MII_BMCR , data); + data =netsec_phy_read (priv->mii_bus, priv->phy_addr,MII_BMCR ); +netsec_phy_write (priv->mii_bus, priv->phy_addr,MII_BMCR , + data |BMCR_PDOWN ); ret =netsec_reset_hardware (priv, true);if (ret) goto err2; +/* Restore phy power state */ +netsec_phy_write (priv->mii_bus, priv->phy_addr,MII_BMCR , data); +spin_lock_init (&priv->desc_ring[NETSEC_RING_TX ].lock);spin_lock_init (&priv->desc_ring[NETSEC_RING_RX ].lock);
Greg Kroah-Hartman
maintainerPATCH 76/254 platform/x86: intel-vbtn: Stop reporting SW_DOCK events
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 538d2dd0b9920334e6596977a664e9e7bac73703 upstream.
Stop reporting SW_DOCK events because this breaks suspend-on-lid-close.
SW_DOCK should only be reported for docking stations, but all the DSDTs in my DSDT collection which use the intel-vbtn code, always seem to use this for 2-in-1s / convertibles and set SW_DOCK=1 when in laptop-mode (in tandem with setting SW_TABLET_MODE=0).
This causes userspace to think the laptop is docked to a port-replicator and to disable suspend-on-lid-close, which is undesirable.
Map the dock events to KEY_IGNORE to avoid this broken SW_DOCK reporting.
Note this may theoretically cause us to stop reporting SW_DOCK on some device where the 0xCA and 0xCB intel-vbtn events are actually used for reporting docking to a classic docking-station / port-replicator but I'm not aware of any such devices.
Also the most important thing is that we only report SW_DOCK when it reliably reports being docked to a classic docking-station without any false positives, which clearly is not the case here. If there is a chance of reporting false positives then it is better to not report SW_DOCK at all.
--- drivers/platform/x86/intel-vbtn.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/platform/x86/intel-vbtn.c +10 -2
@@ -47,8 +47,16 @@ static const struct key_entry intel_vbtn };static const struct key_entry intel_vbtn_switchmap[] = { - {KE_SW ,0xCA , { .sw = {SW_DOCK ,1 } } },/* Docked */ - {KE_SW ,0xCB , { .sw = {SW_DOCK ,0 } } },/* Undocked */ +/* +* SW_DOCK should only be reported for docking stations, but DSDTs using the +* intel-vbtn code, always seem to use this for 2-in-1s / convertibles and set +* SW_DOCK=1 when in laptop-mode (in tandem with setting SW_TABLET_MODE=0). +* This causes userspace to think the laptop is docked to a port-replicator +* and to disable suspend-on-lid-close, which is undesirable. +* Map the dock events to KEY_IGNORE to avoid this broken SW_DOCK reporting. +*/ + {KE_IGNORE ,0xCA , { .sw = {SW_DOCK ,1 } } },/* Docked */ + {KE_IGNORE ,0xCB , { .sw = {SW_DOCK ,0 } } },/* Undocked */ {KE_SW ,0xCC , { .sw = {SW_TABLET_MODE ,1 } } },/* Tablet */ {KE_SW ,0xCD , { .sw = {SW_TABLET_MODE ,0 } } },/* Laptop */ };
Greg Kroah-Hartman
maintainerPATCH 77/254 psample: Fix user API breakage
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit e43accba9b071dcd106b5e7643b1b106a158cbb1 upstream.
Cited commit added a new attribute before the existing group reference count attribute, thereby changing its value and breaking existing applications on new kernels.
Before:
# psample -l libpsample ERROR psample_group_foreach: failed to recv message: Operation not supported
After:
# psample -l Group Num Refcount Group Seq 1 1 0
Fix by restoring the value of the old attribute and remove the misleading comments from the enumerator to avoid future bugs.
--- include/uapi/linux/psample.h | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
include/uapi/linux/psample.h +1 -4
@@ -3,7 +3,6 @@#define __UAPI_PSAMPLE_Henum { -/* sampled packet metadata */ PSAMPLE_ATTR_IIFINDEX ,PSAMPLE_ATTR_OIFINDEX ,PSAMPLE_ATTR_ORIGSIZE ,
@@ -11,10 +10,8 @@ enum {PSAMPLE_ATTR_GROUP_SEQ ,PSAMPLE_ATTR_SAMPLE_RATE ,PSAMPLE_ATTR_DATA , -PSAMPLE_ATTR_TUNNEL , - -/* commands attributes */ PSAMPLE_ATTR_GROUP_REFCOUNT , +PSAMPLE_ATTR_TUNNEL , __PSAMPLE_ATTR_MAX };
Greg Kroah-Hartman
maintainerPATCH 78/254 z3fold: prevent reclaim/free race for headless pages
In reply to Greg Kroah-HartmanFrom: Thomas Hebb <[email protected]>
commit 6d679578fe9c762c8fbc3d796a067cbba84a7884 upstream.
Commit ca0246bb97c2 ("z3fold: fix possible reclaim races") introduced the PAGE_CLAIMED flag "to avoid racing on a z3fold 'headless' page release." By atomically testing and setting the bit in each of z3fold_free() and z3fold_reclaim_page(), a double-free was avoided.
However, commit dcf5aedb24f8 ("z3fold: stricter locking and more careful reclaim") appears to have unintentionally broken this behavior by moving the PAGE_CLAIMED check in z3fold_reclaim_page() to after the page lock gets taken, which only happens for non-headless pages. For headless pages, the check is now skipped entirely and races can occur again.
I have observed such a race on my system:
page:00000000ffbd76b7 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x165316
flags: 0x2ffff0000000000()
raw: 02ffff0000000000 ffffea0004535f48 ffff8881d553a170 0000000000000000
raw: 0000000000000000 0000000000000011 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:707!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 2 PID: 291928 Comm: kworker/2:0 Tainted: G B 5.10.7-arch1-1-kasan #1
Hardware name: Gigabyte Technology Co., Ltd. H97N-WIFI/H97N-WIFI, BIOS F9b 03/03/2016
Workqueue: zswap-shrink shrink_worker
RIP: 0010:__free_pages+0x10a/0x130
Code: c1 e7 06 48 01 ef 45 85 e4 74 d1 44 89 e6 31 d2 41 83 ec 01 e8 e7 b0 ff ff eb da 48 c7 c6 e0 32 91 88 48 89 ef e8 a6 89 f8 ff <0f> 0b 4c 89 e7 e8 fc 79 07 00 e9 33 ff ff ff 48 89 ef e8 ff 79 07
RSP: 0000:ffff88819a2ffb98 EFLAGS: 00010296
RAX: 0000000000000000 RBX: ffffea000594c5a8 RCX: 0000000000000000
RDX: 1ffffd4000b298b7 RSI: 0000000000000000 RDI: ffffea000594c5b8
RBP: ffffea000594c580 R08: 000000000000003e R09: ffff8881d5520bbb
R10: ffffed103aaa4177 R11: 0000000000000001 R12: ffffea000594c5b4
R13: 0000000000000000 R14: ffff888165316000 R15: ffffea000594c588
FS: 0000000000000000(0000) GS:ffff8881d5500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7c8c3654d8 CR3: 0000000103f42004 CR4: 00000000001706e0
Call Trace:
z3fold_zpool_shrink+0x9b6/0x1240
shrink_worker+0x35/0x90
process_one_work+0x70c/0x1210
worker_thread+0x539/0x1200
kthread+0x330/0x400
ret_from_fork+0x22/0x30
Modules linked in: rfcomm ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ccm algif_aead des_generic libdes ecb algif_skcipher cmac bnep md4 algif_hash af_alg vfat fat intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel iwlmvm hid_logitech_hidpp kvm at24 mac80211 snd_hda_codec_realtek iTCO_wdt snd_hda_codec_generic intel_pmc_bxt snd_hda_codec_hdmi ledtrig_audio iTCO_vendor_support mei_wdt mei_hdcp snd_hda_intel snd_intel_dspcfg libarc4 soundwire_intel irqbypass iwlwifi soundwire_generic_allocation rapl soundwire_cadence intel_cstate snd_hda_codec intel_uncore btusb joydev mousedev snd_usb_audio pcspkr btrtl uvcvideo nouveau btbcm i2c_i801 btintel snd_hda_core videobuf2_vmalloc i2c_smbus snd_usbmidi_lib videobuf2_memops bluetooth snd_hwdep soundwire_bus snd_soc_rt5640 videobuf2_v4l2 cfg80211 snd_soc_rl6231 videobuf2_common snd_rawmidi lpc_ich alx videodev mdio snd_seq_device snd_soc_core mc ecdh_generic mxm_wmi mei_me
hid_logitech_dj wmi snd_compress e1000e ac97_bus mei ttm rfkill snd_pcm_dmaengine ecc snd_pcm snd_timer snd soundcore mac_hid acpi_pad pkcs8_key_parser it87 hwmon_vid crypto_user fuse ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 dm_crypt cbc encrypted_keys trusted tpm rng_core usbhid dm_mod crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper xhci_pci xhci_pci_renesas i915 video intel_gtt i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm agpgart
---[ end trace 126d646fc3dc0ad8 ]---To fix the issue, re-add the earlier test and set in the case where we have a headless page.
--- mm/z3fold.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
mm/z3fold.c +15 -1
@@ -1353,8 +1353,22 @@ static int z3fold_reclaim_page(struct z3 page = list_entry(pos, struct page, lru); zhdr =page_address (page); -if (test_bit (PAGE_HEADLESS , &page->private)) +if (test_bit (PAGE_HEADLESS , &page->private)) { +/* +* For non-headless pages, we wait to do this +* until we have the page lock to avoid racing +* with __z3fold_alloc(). Headless pages don't +* have a lock (and __z3fold_alloc() will never +* see them), but we still need to test and set +* PAGE_CLAIMED to avoid racing with +* z3fold_free(), so just do it now before +* leaving the loop. +*/ +if (test_and_set_bit (PAGE_CLAIMED , &page->private)) +continue ; +break ; + }if (kref_get_unless_zero (&zhdr->refcount) ==0 ) { zhdr =NULL ;
Greg Kroah-Hartman
maintainerPATCH 79/254 squashfs: fix inode lookup sanity checks
In reply to Greg Kroah-HartmanFrom: Sean Nyekjaer <[email protected]>
commit c1b2028315c6b15e8d6725e0d5884b15887d3daa upstream.
When mouting a squashfs image created without inode compression it fails
with: "unable to read inode lookup table"
It turns out that the BLOCK_OFFSET is missing when checking the SQUASHFS_METADATA_SIZE agaist the actual size.
--- fs/squashfs/export.c | 8 ++++++-- fs/squashfs/squashfs_fs.h | 1 + 2 files changed, 7 insertions(+), 2 deletions(-)
fs/squashfs/export.c +6 -2
@@ -152,14 +152,18 @@ __le64 *squashfs_read_inode_lookup_table start =le64_to_cpu (table[n]); end =le64_to_cpu (table[n +1 ]); -if (start >= end || (end - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= end + || (end - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); } } start =le64_to_cpu (table[indexes -1 ]); -if (start >= lookup_table_start || (lookup_table_start - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= lookup_table_start || + (lookup_table_start - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); }
fs/squashfs/squashfs_fs.h +1 -0
@@ -17,6 +17,7 @@/* size of metadata (inode and directory) blocks */ #define SQUASHFS_METADATA_SIZE 8192 +#define SQUASHFS_BLOCK_OFFSET 2/* default size of block device I/O */ #ifdef CONFIG_SQUASHFS_4K_DEVBLK_SIZE
Greg Kroah-Hartman
maintainerPATCH 80/254 squashfs: fix xattr id and id lookup sanity checks
In reply to Greg Kroah-HartmanFrom: Phillip Lougher <[email protected]>
commit 8b44ca2b634527151af07447a8090a5f3a043321 upstream.
The checks for maximum metadata block size is missing SQUASHFS_BLOCK_OFFSET (the two byte length count).
--- fs/squashfs/id.c | 6 ++++-- fs/squashfs/xattr_id.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-)
fs/squashfs/id.c +4 -2
@@ -97,14 +97,16 @@ __le64 *squashfs_read_id_index_table(str start =le64_to_cpu (table[n]); end =le64_to_cpu (table[n +1 ]); -if (start >= end || (end - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= end || (end - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); } } start =le64_to_cpu (table[indexes -1 ]); -if (start >= id_table_start || (id_table_start - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= id_table_start || (id_table_start - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); }
fs/squashfs/xattr_id.c +4 -2
@@ -109,14 +109,16 @@ __le64 *squashfs_read_xattr_id_table(str start =le64_to_cpu (table[n]); end =le64_to_cpu (table[n +1 ]); -if (start >= end || (end - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= end || (end - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); } } start =le64_to_cpu (table[indexes -1 ]); -if (start >= table_start || (table_start - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= table_start || (table_start - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); }
Greg Kroah-Hartman
maintainerPATCH 81/254 hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
commit d85aecf2844ff02a0e5f077252b2461d4f10c9f0 upstream.
The current implementation of hugetlb_cgroup for shared mappings could have different behavior. Consider the following two scenarios:
1.Assume initial css reference count of hugetlb_cgroup is 1:
1.1 Call hugetlb_reserve_pages with from = 1, to = 2. So css reference
count is 2 associated with 1 file_region.
1.2 Call hugetlb_reserve_pages with from = 2, to = 3. So css reference
count is 3 associated with 2 file_region.
1.3 coalesce_file_region will coalesce these two file_regions into
one. So css reference count is 3 associated with 1 file_region now.
2.Assume initial css reference count of hugetlb_cgroup is 1 again:
2.1 Call hugetlb_reserve_pages with from = 1, to = 3. So css reference
count is 2 associated with 1 file_region.
Therefore, we might have one file_region while holding one or more css reference counts. This inconsistency could lead to imbalanced css_get() and css_put() pair. If we do css_put one by one (i.g. hole punch case), scenario 2 would put one more css reference. If we do css_put all together (i.g. truncate case), scenario 1 will leak one css reference.
The imbalanced css_get() and css_put() pair would result in a non-zero reference when we try to destroy the hugetlb cgroup. The hugetlb cgroup directory is removed __but__ associated resource is not freed. This might result in OOM or can not create a new hugetlb cgroup in a busy workload ultimately.
In order to fix this, we have to make sure that one file_region must hold exactly one css reference. So in coalesce_file_region case, we should release one css reference before coalescence. Also only put css reference when the entire file_region is removed.
The last thing to note is that the caller of region_add() will only hold one reference to h_cg->css for the whole contiguous reservation region. But this area might be scattered when there are already some file_regions reside in it. As a result, many file_regions may share only one h_cg->css reference. In order to ensure that one file_region must hold exactly one css reference, we should do css_get() for each file_region and release the reference held by caller when they are done.
--- include/linux/hugetlb_cgroup.h | 15 +++++++++++++-- mm/hugetlb.c | 41 +++++++++++++++++++++++++++++++++++++---- mm/hugetlb_cgroup.c | 10 ++++++++-- 3 files changed, 58 insertions(+), 8 deletions(-)
include/linux/hugetlb_cgroup.h +13 -2
@@ -113,6 +113,11 @@ static inline bool hugetlb_cgroup_disablreturn !cgroup_subsys_enabled (hugetlb_cgrp_subsys); } +static inline void hugetlb_cgroup_put_rsvd_cgroup (struct hugetlb_cgroup *h_cg) +{ +css_put (&h_cg->css); +} +extern int hugetlb_cgroup_charge_cgroup (int idx,unsigned long nr_pages,struct hugetlb_cgroup **ptr); extern int hugetlb_cgroup_charge_cgroup_rsvd(int idx, unsigned long nr_pages,
@@ -138,7 +143,8 @@ extern void hugetlb_cgroup_uncharge_counextern void hugetlb_cgroup_uncharge_file_region (struct resv_map *resv,struct file_region *rg, -unsigned long nr_pages); +unsigned long nr_pages, +bool region_del);extern void hugetlb_cgroup_file_init (void )__init ; extern void hugetlb_cgroup_migrate(struct page *oldhpage,
@@ -147,7 +153,8 @@ extern void hugetlb_cgroup_migrate(struc#else static inline void hugetlb_cgroup_uncharge_file_region (struct resv_map *resv,struct file_region *rg, -unsigned long nr_pages) +unsigned long nr_pages, +bool region_del) { }
@@ -185,6 +192,10 @@ static inline bool hugetlb_cgroup_disablreturn true; } +static inline void hugetlb_cgroup_put_rsvd_cgroup (struct hugetlb_cgroup *h_cg) +{ +} +static inline int hugetlb_cgroup_charge_cgroup (int idx,unsigned long nr_pages,struct hugetlb_cgroup **ptr) {
mm/hugetlb.c +37 -4
100 lines not on this page · raw message
mm/hugetlb_cgroup.c +8 -2
@@ -391,7 +391,8 @@ void hugetlb_cgroup_uncharge_counter(strvoid hugetlb_cgroup_uncharge_file_region (struct resv_map *resv,struct file_region *rg, -unsigned long nr_pages) +unsigned long nr_pages, +bool region_del) {if (hugetlb_cgroup_disabled () || !resv || !rg || !nr_pages)return ;
@@ -400,7 +401,12 @@ void hugetlb_cgroup_uncharge_file_region !resv->reservation_counter) {page_counter_uncharge (rg->reservation_counter, nr_pages * resv->pages_per_hpage); -css_put (rg->css); +/* +* Only do css_put(rg->css) when we delete the entire region +* because one file_region must hold exactly one css reference. +*/ +if (region_del) +css_put (rg->css); } }
Greg Kroah-Hartman
maintainerPATCH 82/254 kasan: fix per-page tags for non-page_alloc pages
In reply to Greg Kroah-HartmanFrom: Andrey Konovalov <[email protected]>
commit cf10bd4c4aff8dd64d1aa7f2a529d0c672bc16af upstream.
To allow performing tag checks on page_alloc addresses obtained via page_address(), tag-based KASAN modes store tags for page_alloc allocations in page->flags.
Currently, the default tag value stored in page->flags is 0x00. Therefore, page_address() returns a 0x00ffff... address for pages that were not allocated via page_alloc.
This might cause problems. A particular case we encountered is a conflict with KFENCE. If a KFENCE-allocated slab object is being freed via kfree(page_address(page) + offset), the address passed to kfree() will get tagged with 0x00 (as slab pages keep the default per-page tags). This leads to is_kfence_address() check failing, and a KFENCE object ending up in normal slab freelist, which causes memory corruptions.
This patch changes the way KASAN stores tag in page-flags: they are now stored xor'ed with 0xff. This way, KASAN doesn't need to initialize per-page flags for every created page, which might be slow.
With this change, page_address() returns natively-tagged (with 0xff) pointers for pages that didn't have tags set explicitly.
This patch fixes the encountered conflict with KFENCE and prevents more similar issues that can occur in the future.
--- include/linux/mm.h | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
include/linux/mm.h +15 -3
@@ -1431,16 +1431,28 @@ static inline bool cpupid_match_pid(stru#if defined(CONFIG_KASAN_SW_TAGS ) || defined(CONFIG_KASAN_HW_TAGS ) +/* +* KASAN per-page tags are stored xor'ed with 0xff. This allows to avoid +* setting tags for all pages to native kernel tag value 0xff, as the default +* value 0x00 maps to 0xff. +*/ +static inline u8 page_kasan_tag (const struct page *page) { -if (kasan_enabled ()) -return (page->flags >>KASAN_TAG_PGSHIFT ) &KASAN_TAG_MASK ; -return 0xff ; +u8 tag =0xff ; + +if (kasan_enabled ()) { + tag = (page->flags >>KASAN_TAG_PGSHIFT ) &KASAN_TAG_MASK ; + tag ^=0xff ; + } + +return tag; }static inline void page_kasan_tag_set (struct page *page,u8 tag) {if (kasan_enabled ()) { + tag ^=0xff ; page->flags &= ~(KASAN_TAG_MASK <<KASAN_TAG_PGSHIFT ); page->flags |= (tag &KASAN_TAG_MASK ) <<KASAN_TAG_PGSHIFT ; }
Greg Kroah-Hartman
maintainerPATCH 83/254 gcov: fix clang-11+ support
In reply to Greg Kroah-HartmanFrom: Nick Desaulniers <[email protected]>
commit 60bcf728ee7c60ac2a1f9a0eaceb3a7b3954cd2b upstream.
LLVM changed the expected function signatures for llvm_gcda_start_file() and llvm_gcda_emit_function() in the clang-11 release. Users of clang-11 or newer may have noticed their kernels failing to boot due to a panic when enabling CONFIG_GCOV_KERNEL=y +CONFIG_GCOV_PROFILE_ALL=y. Fix up the function signatures so calling these functions doesn't panic the kernel.
--- kernel/gcov/clang.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 69 insertions(+)
kernel/gcov/clang.c +69 -0
@@ -75,7 +75,9 @@ struct gcov_fn_info {u32 num_counters;u64 *counters; +#if CONFIG_CLANG_VERSION <110000 const char *function_name; +#endif };static struct gcov_info *current_info;
@@ -105,6 +107,7 @@ void llvm_gcov_init(llvm_gcov_callback w }EXPORT_SYMBOL (llvm_gcov_init); +#if CONFIG_CLANG_VERSION <110000 void llvm_gcda_start_file (const char *orig_filename,const char version[4 ],u32 checksum) {
@@ -113,7 +116,17 @@ void llvm_gcda_start_file(const char *or current_info->checksum = checksum; }EXPORT_SYMBOL (llvm_gcda_start_file); +#else +void llvm_gcda_start_file (const char *orig_filename,u32 version,u32 checksum) +{ + current_info->filename = orig_filename; + current_info->version = version; + current_info->checksum = checksum; +} +EXPORT_SYMBOL (llvm_gcda_start_file); +#endif +#if CONFIG_CLANG_VERSION <110000 void llvm_gcda_emit_function (u32 ident,const char *function_name,u32 func_checksum,u8 use_extra_checksum,u32 cfg_checksum) {
@@ -133,6 +146,24 @@ void llvm_gcda_emit_function(u32 ident, list_add_tail(&info->head, ¤t_info->functions); }EXPORT_SYMBOL (llvm_gcda_emit_function); +#else +void llvm_gcda_emit_function (u32 ident,u32 func_checksum, +u8 use_extra_checksum,u32 cfg_checksum) +{ +struct gcov_fn_info *info =kzalloc (sizeof (*info),GFP_KERNEL ); + +if (!info) +return ; + +INIT_LIST_HEAD (&info->head); + info->ident = ident; + info->checksum = func_checksum; + info->use_extra_checksum = use_extra_checksum; + info->cfg_checksum = cfg_checksum; +list_add_tail (&info->head, ¤t_info->functions); +} +EXPORT_SYMBOL (llvm_gcda_emit_function); +#endif void llvm_gcda_emit_arcs (u32 num_counters,u64 *counters) {
@@ -295,6 +326,7 @@ void gcov_info_add(struct gcov_info *dst } } +#if CONFIG_CLANG_VERSION <110000 static struct gcov_fn_info *gcov_fn_info_dup (struct gcov_fn_info *fn) {size_t cv_size;/* counter values size */
@@ -322,6 +354,28 @@ err_name:kfree (fn_dup); return NULL; } +#else +static struct gcov_fn_info *gcov_fn_info_dup (struct gcov_fn_info *fn) +{ +size_t cv_size;/* counter values size */ +struct gcov_fn_info *fn_dup =kmemdup (fn,sizeof (*fn), +GFP_KERNEL ); +if (!fn_dup) +return NULL ; +INIT_LIST_HEAD (&fn_dup->head); + + cv_size = fn->num_counters *sizeof (fn->counters[0 ]); + fn_dup->counters =vmalloc (cv_size); +if (!fn_dup->counters) { +kfree (fn_dup); +return NULL ; + } + +memcpy (fn_dup->counters, fn->counters, cv_size); + +return fn_dup; +} +#endif /** * gcov_info_dup - duplicate profiling data set
@@ -362,6 +416,7 @@ err:* gcov_info_free - release memory for profiling data set duplicate * @info: profiling data set duplicate to free */ +#if CONFIG_CLANG_VERSION <110000 void gcov_info_free (struct gcov_info *info) {struct gcov_fn_info *fn, *tmp;
@@ -375,6 +430,20 @@ void gcov_info_free(struct gcov_info *inkfree (info->filename); kfree(info); } +#else +void gcov_info_free (struct gcov_info *info) +{ +struct gcov_fn_info *fn, *tmp; + +list_for_each_entry_safe (fn, tmp, &info->functions, head) { +vfree (fn->counters); +list_del (&fn->head); +kfree (fn); + } +kfree (info->filename); +kfree (info); +} +#endif #define ITER_STRIDE PAGE_SIZE
Greg Kroah-Hartman
maintainerPATCH 84/254 mm/highmem: fix CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP
In reply to Greg Kroah-HartmanFrom: Ira Weiny <[email protected]>
commit 487cfade12fae0eb707bdce71c4d585128238a7d upstream.
The kernel test robot found that __kmap_local_sched_out() was not correctly skipping the guard pages when DEBUG_KMAP_LOCAL_FORCE_MAP was set.[1] This was due to DEBUG_HIGHMEM check being used.
Change the configuration check to be correct.
[1] https://lore.kernel.org/lkml/20210304083825.GB17830@xsang-OptiPlex-9020/
--- mm/highmem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
mm/highmem.c +2 -2
@@ -618,7 +618,7 @@ void __kmap_local_sched_out(void)int idx;/* With debug all even slots are unmapped and act as guard */ -if (IS_ENABLED (CONFIG_DEBUG_HIGHMEM ) && !(i &0x01 )) { +if (IS_ENABLED (CONFIG_DEBUG_KMAP_LOCAL ) && !(i &0x01 )) {WARN_ON_ONCE (!pte_none (pteval));continue ; }
@@ -654,7 +654,7 @@ void __kmap_local_sched_in(void)int idx;/* With debug all even slots are unmapped and act as guard */ -if (IS_ENABLED (CONFIG_DEBUG_HIGHMEM ) && !(i &0x01 )) { +if (IS_ENABLED (CONFIG_DEBUG_KMAP_LOCAL ) && !(i &0x01 )) {WARN_ON_ONCE (!pte_none (pteval));continue ; }
Signature · 1 line
2.31.0
Greg Kroah-Hartman
maintainerPATCH 85/254 ACPI: video: Add missing callback back for Sony VPCEH3U1E
In reply to Greg Kroah-HartmanFrom: Chris Chiu <[email protected]>
commit c1d1e25a8c542816ae8dee41b81a18d30c7519a0 upstream.
The .callback of the quirk for Sony VPCEH3U1E was unintetionally removed by the commit 25417185e9b5 ("ACPI: video: Add DMI quirk for GIGABYTE GB-BXBT-2807"). Add it back to make sure the quirk for Sony VPCEH3U1E works as expected.
--- drivers/acpi/video_detect.c | 1 + 1 file changed, 1 insertion(+)
drivers/acpi/video_detect.c +1 -0
@@ -147,6 +147,7 @@ static const struct dmi_system_id video_ }, }, { + .callback = video_detect_force_vendor, .ident = "Sony VPCEH3U1E", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
Greg Kroah-Hartman
maintainerPATCH 86/254 ACPICA: Always create namespace nodes using acpi_ns_create_node()
In reply to Greg Kroah-HartmanFrom: Vegard Nossum <[email protected]>
commit 25928deeb1e4e2cdae1dccff349320c6841eb5f8 upstream.
ACPICA commit 29da9a2a3f5b2c60420893e5c6309a0586d7a329
ACPI is allocating an object using kmalloc(), but then frees it using kmem_cache_free(<"Acpi-Namespace" kmem_cache>).
This is wrong and can lead to boot failures manifesting like this:
hpet0: 3 comparators, 64-bit 100.000000 MHz counter
clocksource: Switched to clocksource tsc-early
BUG: unable to handle page fault for address: 000000003ffe0018
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.6.0+ #211
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-1.8.2-1ubuntu1 04/01/2014
RIP: 0010:kmem_cache_alloc+0x70/0x1d0
Code: 00 00 4c 8b 45 00 65 49 8b 50 08 65 4c 03 05 6f cc e7 7e 4d 8b
20 4d 85 e4 0f 84 3d 01 00 00 8b 45 20 48 8b 7d 00 48 8d 4a 01 <49> 8b
1c 04 4c 89 e0 65 48 0f c7 0f 0f 94 c0 84 c0 74 c5 8b 45 20
RSP: 0000:ffffc90000013df8 EFLAGS: 00010206
RAX: 0000000000000018 RBX: ffffffff81c49200 RCX: 0000000000000002
RDX: 0000000000000001 RSI: 0000000000000dc0 RDI: 000000000002b300
RBP: ffff88803e403d00 R08: ffff88803ec2b300 R09: 0000000000000001
R10: 0000000000000dc0 R11: 0000000000000006 R12: 000000003ffe0000
R13: ffffffff8110a583 R14: 0000000000000dc0 R15: ffffffff81c49a80
FS: 0000000000000000(0000) GS:ffff88803ec00000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000003ffe0018 CR3: 0000000001c0a001 CR4: 00000000003606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__trace_define_field+0x33/0xa0
event_trace_init+0xeb/0x2b4
tracer_init_tracefs+0x60/0x195
? register_tracer+0x1e7/0x1e7
do_one_initcall+0x74/0x160
kernel_init_freeable+0x190/0x1f0
? rest_init+0x9a/0x9a
kernel_init+0x5/0xf6
ret_from_fork+0x35/0x40
CR2: 000000003ffe0018
---[ end trace 707efa023f2ee960 ]---
RIP: 0010:kmem_cache_alloc+0x70/0x1d0Bisection leads to unrelated changes in slab; Vlastimil Babka suggests an unrelated layout or slab merge change merely exposed the underlying bug.
--- drivers/acpi/acpica/nsaccess.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/acpi/acpica/nsaccess.c +1 -2
@@ -99,13 +99,12 @@ acpi_status acpi_ns_root_initialize(void* just create and link the new node(s) here. */ new_node = -ACPI_ALLOCATE_ZEROED (sizeof (struct acpi_namespace_node )); +acpi_ns_create_node (*ACPI_CAST_PTR (u32, init_val->name));if (!new_node) { status =AE_NO_MEMORY ; goto unlock_and_exit; } -ACPI_COPY_NAMESEG (new_node->name.ascii, init_val->name); new_node->descriptor_type =ACPI_DESC_TYPE_NAMED ; new_node->type = init_val->type;
Greg Kroah-Hartman
maintainerPATCH 87/254 arm64: stacktrace: dont trace arch_stack_walk()
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
commit c607ab4f916d4d5259072eca34055d3f5a795c21 upstream.
We recently converted arm64 to use arch_stack_walk() in commit:
5fc57df2f6fd ("arm64: stacktrace: Convert to ARCH_STACKWALK")
The core stacktrace code expects that (when tracing the current task) arch_stack_walk() starts a trace at its caller, and does not include itself in the trace. However, arm64's arch_stack_walk() includes itself, and so traces include one more entry than callers expect. The core stacktrace code which calls arch_stack_walk() tries to skip a number of entries to prevent itself appearing in a trace, and the additional entry prevents skipping one of the core stacktrace functions, leaving this in the trace unexpectedly.
We can fix this by having arm64's arch_stack_walk() begin the trace with its caller. The first value returned by the trace will be __builtin_return_address(0), i.e. the caller of arch_stack_walk(). The first frame record to be unwound will be __builtin_frame_address(1), i.e. the caller's frame record. To prevent surprises, arch_stack_walk() is also marked noinline.
While __builtin_frame_address(1) is not safe in portable code, local GCC developers have confirmed that it is safe on arm64. To find the caller's frame record, the builtin can safely dereference the current function's frame record or (in theory) could stash the original FP into another GPR at function entry time, neither of which are problematic.
Prior to this patch, the tracing code would unexpectedly show up in traces of the current task, e.g.
| # cat /proc/self/stack | [<0>] stack_trace_save_tsk+0x98/0x100 | [<0>] proc_pid_stack+0xb4/0x130 | [<0>] proc_single_show+0x60/0x110 | [<0>] seq_read_iter+0x230/0x4d0 | [<0>] seq_read+0xdc/0x130 | [<0>] vfs_read+0xac/0x1e0 | [<0>] ksys_read+0x6c/0xfc | [<0>] __arm64_sys_read+0x20/0x30 | [<0>] el0_svc_common.constprop.0+0x60/0x120 | [<0>] do_el0_svc+0x24/0x90 | [<0>] el0_svc+0x2c/0x54 | [<0>] el0_sync_handler+0x1a4/0x1b0 | [<0>] el0_sync+0x170/0x180
After this patch, the tracing code will not show up in such traces:
| # cat /proc/self/stack | [<0>] proc_pid_stack+0xb4/0x130 | [<0>] proc_single_show+0x60/0x110 | [<0>] seq_read_iter+0x230/0x4d0 | [<0>] seq_read+0xdc/0x130 | [<0>] vfs_read+0xac/0x1e0 | [<0>] ksys_read+0x6c/0xfc | [<0>] __arm64_sys_read+0x20/0x30 | [<0>] el0_svc_common.constprop.0+0x60/0x120 | [<0>] do_el0_svc+0x24/0x90 | [<0>] el0_svc+0x2c/0x54 | [<0>] el0_sync_handler+0x1a4/0x1b0 | [<0>] el0_sync+0x170/0x180
Erring on the side of caution, I've given this a spin with a bunch of toolchains, verifying the output of /proc/self/stack and checking that the assembly looked sound. For GCC (where we require version 5.1.0 or later) I tested with the kernel.org crosstool binares for versions 5.5.0, 6.4.0, 6.5.0, 7.3.0, 7.5.0, 8.1.0, 8.3.0, 8.4.0, 9.2.0, and 10.1.0. For clang (where we require version 10.0.1 or later) I tested with the llvm.org binary releases of 11.0.0, and 11.0.1.
--- arch/arm64/kernel/stacktrace.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/arm64/kernel/stacktrace.c +5 -4
@@ -199,8 +199,9 @@ void show_stack(struct task_struct *tsk,#ifdef CONFIG_STACKTRACE -void arch_stack_walk (stack_trace_consume_fn consume_entry,void *cookie, -struct task_struct *task,struct pt_regs *regs) +noinline void arch_stack_walk(stack_trace_consume_fn consume_entry, +void *cookie,struct task_struct *task, +struct pt_regs *regs) {struct stackframe frame;
@@ -208,8 +209,8 @@ void arch_stack_walk(stack_trace_consumestart_backtrace (&frame, regs->regs[29 ], regs->pc); else if (task == current) start_backtrace(&frame, - (unsigned long)__builtin_frame_address(0), - (unsigned long)arch_stack_walk); + (unsigned long)__builtin_frame_address(1), + (unsigned long)__builtin_return_address(0)); else start_backtrace(&frame, thread_saved_fp(task),thread_saved_pc (task ));
Greg Kroah-Hartman
maintainerPATCH 88/254 arm64: dts: ls1046a: mark crypto engine dma coherent
In reply to Greg Kroah-HartmanFrom: Horia Geantă <[email protected]>
commit 9c3a16f88385e671b63a0de7b82b85e604a80f42 upstream.
Crypto engine (CAAM) on LS1046A platform is configured HW-coherent, mark accordingly the DT node.
As reported by Greg and Sascha, and explained by Robin, lack of "dma-coherent" property for an IP that is configured HW-coherent can lead to problems, e.g. on v5.11:
Quoted 34 lines
kernel BUG at
drivers/crypto/caam/jr.c:247!Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.11.0-20210225-3-00039-g434215968816-dirty #12 Hardware name: TQ TQMLS1046A SoM on Arkona AT1130 (C300) board (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--) pc : caam_jr_dequeue+0x98/0x57c lr : caam_jr_dequeue+0x98/0x57csp :
ffff800010003d50
x29:ffff800010003d50x28:ffff8000118d4000
x27:ffff8000118d4328x26:00000000000001f0
x25:ffff0008022be480x24:ffff0008022c6410
x23:00000000000001f1x22:ffff8000118d4329
x21:0000000000004d80x20:00000000000001f1
x19: 0000000000000001 x18: 0000000000000020
x17: 0000000000000000 x16: 0000000000000015
x15:ffff800011690230x14:2e2e2e2e2e2e2e2e
x13:2e2e2e2e2e2e2020x12: 3030303030303030
x11:ffff800011700a38x10:00000000fffff000
x9 :ffff8000100ada30x8 :ffff8000116a8a38
x7 : 0000000000000001 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000
x3 :00000000ffffffffx2 : 0000000000000000
x1 : 0000000000000000 x0 : 0000000000001800Call trace: caam_jr_dequeue+0x98/0x57c tasklet_action_common.constprop.0+0x164/0x18c tasklet_action+0x44/0x54 __do_softirq+0x160/0x454 __irq_exit_rcu+0x164/0x16c irq_exit+0x1c/0x30 __handle_domain_irq+0xc0/0x13c gic_handle_irq+0x5c/0xf0 el1_irq+0xb4/0x180
Quoted 8 lines
arch_cpu_idle+0x18/0x30 default_idle_call+0x3c/0x1c0 do_idle+0x23c/0x274 cpu_startup_entry+0x34/0x70 rest_init+0xdc/0xec arch_call_rest_init+0x1c/0x28 start_kernel+0x4ac/0x4e4 Code: 91392021 912c2000 d377d8c6 97f24d96 (d4210000)
--- arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi +1 -0
@@ -325,6 +325,7 @@ ranges = <0x0 0x00 0x1700000 0x100000>; reg = <0x00 0x1700000 0x0 0x100000>; interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>; + dma-coherent; sec_jr0: jr@10000 { compatible = "fsl,sec-v5.4-job-ring",
Greg Kroah-Hartman
maintainerPATCH 89/254 arm64: dts: ls1012a: mark crypto engine dma coherent
In reply to Greg Kroah-HartmanFrom: Horia Geantă <[email protected]>
commit ba8da03fa7dff59d9400250aebd38f94cde3cb0f upstream.
Crypto engine (CAAM) on LS1012A platform is configured HW-coherent, mark accordingly the DT node.
Lack of "dma-coherent" property for an IP that is configured HW-coherent can lead to problems, similar to what has been reported for LS1046A.
--- arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi +1 -0
@@ -192,6 +192,7 @@ ranges = <0x0 0x00 0x1700000 0x100000>; reg = <0x00 0x1700000 0x0 0x100000>; interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>; + dma-coherent; sec_jr0: jr@10000 { compatible = "fsl,sec-v5.4-job-ring",
Greg Kroah-Hartman
maintainerPATCH 90/254 arm64: dts: ls1043a: mark crypto engine dma coherent
In reply to Greg Kroah-HartmanFrom: Horia Geantă <[email protected]>
commit 4fb3a074755b7737c4081cffe0ccfa08c2f2d29d upstream.
Crypto engine (CAAM) on LS1043A platform is configured HW-coherent, mark accordingly the DT node.
Lack of "dma-coherent" property for an IP that is configured HW-coherent can lead to problems, similar to what has been reported for LS1046A.
--- arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi +1 -0
@@ -322,6 +322,7 @@ ranges = <0x0 0x00 0x1700000 0x100000>; reg = <0x00 0x1700000 0x0 0x100000>; interrupts = <0 75 0x4>; + dma-coherent; sec_jr0: jr@10000 { compatible = "fsl,sec-v5.4-job-ring",
Greg Kroah-Hartman
maintainerPATCH 91/254 ARM: dts: at91: sam9x60: fix mux-mask for PA7 so it can be set to A, B and C
In reply to Greg Kroah-HartmanFrom: Federico Pellegrin <[email protected]>
commit 664979bba8169d775959452def968d1a7c03901f upstream.
According to the datasheet PA7 can be set to either function A, B or C (see table 6-2 of DS60001579D). The previous value would permit just configuring with function C.
--- arch/arm/boot/dts/at91-sam9x60ek.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/at91-sam9x60ek.dts +1 -1
@@ -336,7 +336,7 @@ &pinctrl { atmel,mux-mask = < /* A B C */ - 0xFFFFFE7F 0xC0E0397F 0xEF00019D /* pioA */ + 0xFFFFFEFF 0xC0E039FF 0xEF00019D /* pioA */ 0x03FFFFFF 0x02FC7E68 0x00780000 /* pioB */ 0xffffffff 0xF83FFFFF 0xB800F3FC /* pioC */ 0x003FFFFF 0x003F8000 0x00000000 /* pioD */
Greg Kroah-Hartman
maintainerPATCH 92/254 ARM: dts: at91: sam9x60: fix mux-mask to match products datasheet
In reply to Greg Kroah-HartmanFrom: Nicolas Ferre <[email protected]>
commit 2c69c8a1736eace8de491d480e6e577a27c2087c upstream.
Fix the whole mux-mask table according to datasheet for the sam9x60 product. Too much functions for pins were disabled leading to misunderstandings when enabling more peripherals or taking this table as an example for another board.
Take advantage of this fix to move the mux-mask in the SoC file where it belongs and use lower case letters for hex numbers like everywhere in the file.
--- arch/arm/boot/dts/at91-sam9x60ek.dts | 8 -------- arch/arm/boot/dts/sam9x60.dtsi | 9 +++++++++ 2 files changed, 9 insertions(+), 8 deletions(-)
arch/arm/boot/dts/at91-sam9x60ek.dts +0 -8
@@ -334,14 +334,6 @@ }; &pinctrl { - atmel,mux-mask = < - /* A B C */ - 0xFFFFFEFF 0xC0E039FF 0xEF00019D /* pioA */ - 0x03FFFFFF 0x02FC7E68 0x00780000 /* pioB */ - 0xffffffff 0xF83FFFFF 0xB800F3FC /* pioC */ - 0x003FFFFF 0x003F8000 0x00000000 /* pioD */ - >; - adc { pinctrl_adc_default: adc_default { atmel,pins = <AT91_PIOB 15 AT91_PERIPH_A AT91_PINCTRL_NONE>;
arch/arm/boot/dts/sam9x60.dtsi +9 -0
@@ -606,6 +606,15 @@ compatible = "microchip,sam9x60-pinctrl", "atmel,at91sam9x5-pinctrl", "atmel,at91rm9200-pinctrl", "simple-bus"; ranges = <0xfffff400 0xfffff400 0x800>; + /* mux-mask corresponding to sam9x60 SoC in TFBGA228L package */ + atmel,mux-mask = < + /* A B C */ + 0xffffffff 0xffe03fff 0xef00019d /* pioA */ + 0x03ffffff 0x02fc7e7f 0x00780000 /* pioB */ + 0xffffffff 0xffffffff 0xf83fffff /* pioC */ + 0x003fffff 0x003f8000 0x00000000 /* pioD */ + >; + pioA: gpio@fffff400 { compatible = "microchip,sam9x60-gpio", "atmel,at91sam9x5-gpio", "atmel,at91rm9200-gpio"; reg = <0xfffff400 0x200>;
Greg Kroah-Hartman
maintainerPATCH 93/254 ARM: dts: at91-sama5d27_som1: fix phy address to 7
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
commit 221c3a09ddf70a0a51715e6c2878d8305e95c558 upstream.
Fix the phy address to 7 for Ethernet PHY on SAMA5D27 SOM1. No connection established if phy address 0 is used.
The board uses the 24 pins version of the KSZ8081RNA part, KSZ8081RNA pin 16 REFCLK as PHYAD bit [2] has weak internal pull-down. But at reset, connected to PD09 of the MPU it's connected with an internal pull-up forming PHYAD[2:0] = 7.
--- arch/arm/boot/dts/at91-sama5d27_som1.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/at91-sama5d27_som1.dtsi +2 -2
@@ -84,8 +84,8 @@ pinctrl-0 = <&pinctrl_macb0_default>; phy-mode = "rmii"; - ethernet-phy@0 { - reg = <0x0>; + ethernet-phy@7 { + reg = <0x7>; interrupt-parent = <&pioA>; interrupts = <PIN_PD31 IRQ_TYPE_LEVEL_LOW>; pinctrl-names = "default";
Greg Kroah-Hartman
maintainerPATCH 94/254 integrity: double check iint_cache was initialized
In reply to Greg Kroah-HartmanFrom: Mimi Zohar <[email protected]>
commit 92063f3ca73aab794bd5408d3361fd5b5ea33079 upstream.
The kernel may be built with multiple LSMs, but only a subset may be enabled on the boot command line by specifying "lsm=". Not including "integrity" on the ordered LSM list may result in a NULL deref.
As reported by Dmitry Vyukov:
in qemu:
qemu-system-x86_64 -enable-kvm -machine q35,nvdimm -cpu
max,migratable=off -smp 4 -m 4G,slots=4,maxmem=16G -hda
wheezy.img -kernel arch/x86/boot/bzImage -nographic -vga std
-soundhw all -usb -usbdevice tablet -bt hci -bt device:keyboard
-net user,host=10.0.2.10,hostfwd=tcp::10022-:22 -net
nic,model=virtio-net-pci -object
memory-backend-file,id=pmem1,share=off,mem-path=/dev/zero,size=64M
-device nvdimm,id=nvdimm1,memdev=pmem1 -append "console=ttyS0
root=/dev/sda earlyprintk=serial rodata=n oops=panic panic_on_warn=1
panic=86400 lsm=smack numa=fake=2 nopcid dummy_hcd.num=8" -pidfilevm_pid -m 2G -cpu host
But it crashes on NULL deref in integrity_inode_get during boot:
Run /sbin/init as init process
BUG: kernel NULL pointer dereference, address: 000000000000001c PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc2+ #97 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-44-g88ab0c15525c-prebuilt.qemu.org 04/01/2014 RIP: 0010:kmem_cache_alloc+0x2b/0x370 mm/slub.c:2920 Code: 57 41 56 41 55 41 54 41 89 f4 55 48 89 fd 53 48 83 ec 10 44 8b 3d d9 1f 90 0b 65 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 <8b> 5f 1c 4cf RSP: 0000:ffffc9000032f9d8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888017fc4f00 RCX: 0000000000000000 RDX: ffff888040220000 RSI: 0000000000000c40 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: ffff888019263627 R10: ffffffff83937cd1 R11: 0000000000000000 R12: 0000000000000c40 R13: ffff888019263538 R14: 0000000000000000 R15: 0000000000ffffff FS: 0000000000000000(0000) GS:ffff88802d180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000001c CR3: 000000000b48e000 CR4: 0000000000750ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: integrity_inode_get+0x47/0x260 security/integrity/iint.c:105 process_measurement+0x33d/0x17e0 security/integrity/ima/ima_main.c:237 ima_bprm_check+0xde/0x210 security/integrity/ima/ima_main.c:474 security_bprm_check+0x7d/0xa0 security/security.c:845 search_binary_handler fs/exec.c:1708 [inline] exec_binprm fs/exec.c:1761 [inline] bprm_execve fs/exec.c:1830 [inline] bprm_execve+0x764/0x19a0 fs/exec.c:1792 kernel_execve+0x370/0x460 fs/exec.c:1973 try_to_run_init_process+0x14/0x4e init/main.c:1366 kernel_init+0x11d/0x1b8 init/main.c:1477 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Modules linked in: CR2: 000000000000001c ---[ end trace 22d601a500de7d79 ]---
Since LSMs and IMA may be configured at build time, but not enabled at run time, panic the system if "integrity" was not initialized before use.
--- security/integrity/iint.c | 8 ++++++++ 1 file changed, 8 insertions(+)
security/integrity/iint.c +8 -0
@@ -98,6 +98,14 @@ struct integrity_iint_cache *integrity_istruct rb_node *node, *parent =NULL ;struct integrity_iint_cache *iint, *test_iint; +/* +* The integrity's "iint_cache" is initialized at security_init(), +* unless it is not included in the ordered list of LSMs enabled +* on the boot command line. +*/ +if (!iint_cache) +panic ("%s: lsm=integrity required.\n" , __func__); + iint =integrity_iint_find (inode);if (iint)return iint;
Greg Kroah-Hartman
maintainerPATCH 95/254 drm/nouveau/kms/nve4-nv108: Limit cursors to 128x128
In reply to Greg Kroah-HartmanFrom: Lyude Paul <[email protected]>
commit d3999c1f7bbbc100c167d7ad3cd79c1d10446ba2 upstream.
While Kepler does technically support 256x256 cursors, it turns out that Kepler actually has some additional requirements for scanout surfaces that we're not enforcing correctly, which aren't present on Maxwell and later. Cursor surfaces must always use small pages (4K), and overlay surfaces must always use large pages (128K).
Fixing this correctly though will take a bit more work: as we'll need to add some code in prepare_fb() to move cursor FBs in large pages to small pages, and vice-versa for overlay FBs. So until we have the time to do that, just limit cursor surfaces to 128x128 - a size small enough to always default to small pages.
This means small ovlys are still broken on Kepler, but it is extremely unlikely anyone cares about those anyway :).
--- drivers/gpu/drm/nouveau/dispnv50/disp.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/dispnv50/disp.c +12 -1
@@ -2663,9 +2663,20 @@ nv50_display_create(struct drm_device *delse nouveau_display (dev)->format_modifiers = disp50xx_modifiers; -if (disp->disp->object.oclass >=GK104_DISP ) { +/* FIXME: 256x256 cursors are supported on Kepler, however unlike Maxwell and later +* generations Kepler requires that we use small pages (4K) for cursor scanout surfaces. The +* proper fix for this is to teach nouveau to migrate fbs being used for the cursor plane to +* small page allocations in prepare_fb(). When this is implemented, we should also force +* large pages (128K) for ovly fbs in order to fix Kepler ovlys. +* But until then, just limit cursors to 128x128 - which is small enough to avoid ever using +* large pages. +*/ +if (disp->disp->object.oclass >=GM107_DISP ) { dev->mode_config.cursor_width =256 ; dev->mode_config.cursor_height =256 ; + }else if (disp->disp->object.oclass >=GK104_DISP ) { + dev->mode_config.cursor_width =128 ; + dev->mode_config.cursor_height =128 ; }else { dev->mode_config.cursor_width =64 ; dev->mode_config.cursor_height =64 ;
Greg Kroah-Hartman
maintainerPATCH 96/254 drm/etnaviv: Use FOLL_FORCE for userptr
In reply to Greg Kroah-HartmanFrom: Daniel Vetter <[email protected]>
commit cd5297b0855f17c8b4e3ef1d20c6a3656209c7b3 upstream.
Nothing checks userptr.ro except this call to pup_fast, which means there's nothing actually preventing userspace from writing to this. Which means you can just read-only mmap any file you want, userptr it and then write to it with the gpu. Not good.
The right way to handle this is FOLL_WRITE | FOLL_FORCE, which will break any COW mappings and update tracking for MAY_WRITE mappings so there's no exploit and the vm isn't confused about what's going on. For any legit use case there's no difference from what userspace can observe and do.
--- drivers/gpu/drm/etnaviv/etnaviv_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/etnaviv/etnaviv_gem.c +1 -1
@@ -689,7 +689,7 @@ static int etnaviv_gem_userptr_get_pagesstruct page **pages = pvec + pinned; ret =pin_user_pages_fast (ptr, num_pages, - !userptr->ro ?FOLL_WRITE :0 , pages); +FOLL_WRITE |FOLL_FORCE , pages);if (ret <0 ) {unpin_user_pages (pvec, pinned);kvfree (pvec);
Greg Kroah-Hartman
maintainerPATCH 97/254 drm/amd/pm: workaround for audio noise issue
In reply to Greg Kroah-HartmanFrom: Kenneth Feng <[email protected]>
commit 9d03730ecbc5afabfda26d4dbb014310bc4ea4d9 upstream.
On some Intel platforms, audio noise can be detected due to high pcie speed switch latency.
This patch leaverages ppfeaturemask to fix to the highest pcie speed then disable pcie switching.
v2:
coding style fix
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 54 +++++++++++++ drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 74 +++++++++++++++--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 24 +++++ drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 25 ++++++ 4 files changed, 166 insertions(+), 11 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +54 -0
@@ -587,6 +587,48 @@ static int smu7_force_switch_to_arbf0(st tmp, MC_CG_ARB_FREQ_F0); } +static uint16_t smu7_override_pcie_speed (struct pp_hwmgr *hwmgr) +{ +struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev); +uint16_t pcie_gen =0 ; + +if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4 && + adev->pm.pcie_gen_mask &CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN4 ) + pcie_gen =3 ; +else if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3 && + adev->pm.pcie_gen_mask &CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN3 ) + pcie_gen =2 ; +else if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2 && + adev->pm.pcie_gen_mask &CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN2 ) + pcie_gen =1 ; +else if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1 && + adev->pm.pcie_gen_mask &CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN1 ) + pcie_gen =0 ; + +return pcie_gen; +} + +static uint16_t smu7_override_pcie_width (struct pp_hwmgr *hwmgr) +{ +struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev); +uint16_t pcie_width =0 ; + +if (adev->pm.pcie_mlw_mask &CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 ) + pcie_width =16 ; +else if (adev->pm.pcie_mlw_mask &CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 ) + pcie_width =12 ; +else if (adev->pm.pcie_mlw_mask &CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 ) + pcie_width =8 ; +else if (adev->pm.pcie_mlw_mask &CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 ) + pcie_width =4 ; +else if (adev->pm.pcie_mlw_mask &CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 ) + pcie_width =2 ; +else if (adev->pm.pcie_mlw_mask &CAIL_PCIE_LINK_WIDTH_SUPPORT_X1 ) + pcie_width =1 ; + +return pcie_width; +} +static int smu7_setup_default_pcie_table (struct pp_hwmgr *hwmgr) {struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
@@ -683,6 +725,11 @@ static int smu7_setup_default_pcie_table PP_Min_PCIEGen),get_pcie_lane_support (data->pcie_lane_cap, PP_Max_PCIELane)); + +if (data->pcie_dpm_key_disabled) +phm_setup_pcie_table_entry (&data->dpm_table.pcie_speed_table, + data->dpm_table.pcie_speed_table.count, +smu7_override_pcie_speed (hwmgr),smu7_override_pcie_width (hwmgr)); }return 0 ; }
@@ -1248,6 +1295,13 @@ static int smu7_start_dpm(struct pp_hwmg NULL)),"Failed to enable pcie DPM during DPM Start Function!" , return -EINVAL); + }else { +PP_ASSERT_WITH_CODE ( + (0 ==smum_send_msg_to_smc (hwmgr, + PPSMC_MSG_PCIeDPM_Disable, +NULL )), +"Failed to disble pcie DPM during DPM Start Function!" , + return -EINVAL ); } if (phm_cap_enabled(hwmgr->platform_descriptor.platformCaps,
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +63 -11
118 lines not on this page · raw message
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c +24 -0
@@ -133,6 +133,7 @@ static void vega12_set_default_registry_ data->registry_data.auto_wattman_debug =0 ; data->registry_data.auto_wattman_sample_period =100 ; data->registry_data.auto_wattman_threshold =50 ; + data->registry_data.pcie_dpm_key_disabled = !(hwmgr->feature_mask &PP_PCIE_DPM_MASK ); }static int vega12_set_features_platform_caps (struct pp_hwmgr *hwmgr)
@@ -539,6 +540,29 @@ static int vega12_override_pcie_paramete pp_table->PcieLaneCount[i] = pcie_width_arg; } +/* override to the highest if it's disabled from ppfeaturmask */ +if (data->registry_data.pcie_dpm_key_disabled) { +for (i =0 ; i <NUM_LINK_LEVELS ; i++) { + smu_pcie_arg = (i <<16 ) | (pcie_gen <<8 ) | pcie_width; + ret =smum_send_msg_to_smc_with_parameter (hwmgr, + PPSMC_MSG_OverridePcieParameters, smu_pcie_arg, +NULL ); +PP_ASSERT_WITH_CODE (!ret, +"[OverridePcieParameters] Attempt to override pcie params failed!" , + return ret); + + pp_table->PcieGenSpeed[i] = pcie_gen; + pp_table->PcieLaneCount[i] = pcie_width; + } + ret =vega12_enable_smc_features (hwmgr, + false, + data->smu_features[GNLD_DPM_LINK ].smu_feature_bitmap); +PP_ASSERT_WITH_CODE (!ret, +"Attempt to Disable DPM LINK Failed!" , + return ret); + data->smu_features[GNLD_DPM_LINK ].enabled = false; + data->smu_features[GNLD_DPM_LINK ].supported = false; + }return 0 ; }
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c +25 -0
@@ -171,6 +171,7 @@ static void vega20_set_default_registry_ data->registry_data.gfxoff_controlled_by_driver =1 ; data->gfxoff_allowed = false; data->counter_gfxoff =0 ; + data->registry_data.pcie_dpm_key_disabled = !(hwmgr->feature_mask &PP_PCIE_DPM_MASK ); }static int vega20_set_features_platform_caps (struct pp_hwmgr *hwmgr)
@@ -885,6 +886,30 @@ static int vega20_override_pcie_paramete pp_table->PcieLaneCount[i] = pcie_width_arg; } +/* override to the highest if it's disabled from ppfeaturmask */ +if (data->registry_data.pcie_dpm_key_disabled) { +for (i =0 ; i <NUM_LINK_LEVELS ; i++) { + smu_pcie_arg = (i <<16 ) | (pcie_gen <<8 ) | pcie_width; + ret =smum_send_msg_to_smc_with_parameter (hwmgr, + PPSMC_MSG_OverridePcieParameters, smu_pcie_arg, +NULL ); +PP_ASSERT_WITH_CODE (!ret, +"[OverridePcieParameters] Attempt to override pcie params failed!" , + return ret); + + pp_table->PcieGenSpeed[i] = pcie_gen; + pp_table->PcieLaneCount[i] = pcie_width; + } + ret =vega20_enable_smc_features (hwmgr, + false, + data->smu_features[GNLD_DPM_LINK ].smu_feature_bitmap); +PP_ASSERT_WITH_CODE (!ret, +"Attempt to Disable DPM LINK Failed!" , + return ret); + data->smu_features[GNLD_DPM_LINK ].enabled = false; + data->smu_features[GNLD_DPM_LINK ].supported = false; + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 98/254 drm/amdgpu/display: restore AUX_DPHY_TX_CONTROL for DCN2.x
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
commit 5c458585c0141754cdcbf25feebb547dd671b559 upstream.
Commit 098214999c8f added fetching of the AUX_DPHY register values from the vbios, but it also changed the default values in the case when there are no values in the vbios. This causes problems with displays with high refresh rates. To fix this, switch back to the original default value for AUX_DPHY_TX_CONTROL.
--- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c +1 -2
@@ -341,8 +341,7 @@ void enc2_hw_init(struct link_encoder *e }else {AUX_REG_WRITE (AUX_DPHY_RX_CONTROL0 ,0x103d1110 ); -AUX_REG_WRITE (AUX_DPHY_TX_CONTROL ,0x21c4d ); - +AUX_REG_WRITE (AUX_DPHY_TX_CONTROL ,0x21c7a ); }//AUX_DPHY_TX_REF_CONTROL'AUX_TX_REF_DIV HW default is 0x32;
Greg Kroah-Hartman
maintainerPATCH 99/254 drm/amdgpu: fix the hibernation suspend with s0ix
In reply to Greg Kroah-HartmanFrom: Prike Liang <[email protected]>
commit 9aa26019c1a60013ea866d460de6392acb1712ee upstream.
During system hibernation suspend still need un-gate gfx CG/PG firstly to handle HW status check before HW resource destory.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +6 -2
@@ -2666,7 +2666,7 @@ static int amdgpu_device_ip_suspend_phas {int i, r; -if (adev->in_poweroff_reboot_com || +if (adev->in_poweroff_reboot_com || adev->in_hibernate || !amdgpu_acpi_is_s0ix_supported (adev) ||amdgpu_in_reset (adev)) {amdgpu_device_set_pg_state (adev,AMD_PG_STATE_UNGATE );amdgpu_device_set_cg_state (adev,AMD_CG_STATE_UNGATE );
@@ -3727,7 +3727,11 @@ int amdgpu_device_suspend(struct drm_devamdgpu_fence_driver_suspend (adev); -if (adev->in_poweroff_reboot_com || +/* +* TODO: Need figure out the each GNB IP idle off dependency and then +* improve the AMDGPU suspend/resume sequence for system-wide Sx entry/exit. +*/ +if (adev->in_poweroff_reboot_com || adev->in_hibernate || !amdgpu_acpi_is_s0ix_supported (adev) ||amdgpu_in_reset (adev)) r =amdgpu_device_ip_suspend_phase2 (adev);else
Greg Kroah-Hartman
maintainerPATCH 100/254 drm/amdgpu: Add additional Sienna Cichlid PCI ID
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
commit c933b111094f2818571fc51b81b98ee0d370c035 upstream.
Add new DID.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +1 -0
@@ -1102,6 +1102,7 @@ static const struct pci_device_id pciidl {0x1002, 0x73A3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, {0x1002, 0x73AB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, {0x1002, 0x73AE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, + {0x1002, 0x73AF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, {0x1002, 0x73BF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID}, /* Van Gogh */
Greg Kroah-Hartman
maintainerPATCH 101/254 drm/i915/dsc: fix DSS CTL register usage for ICL DSI transcoders
In reply to Greg Kroah-HartmanFrom: Jani Nikula <[email protected]>
commit b61fde1beb6b1847f1743e75f4d9839acebad76a upstream.
Use the correct DSS CTL registers for ICL DSI transcoders.
As a side effect, this also brings back the sanity check for trying to use pipe DSC registers on pipe A on ICL.
--- drivers/gpu/drm/i915/display/intel_vdsc.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
drivers/gpu/drm/i915/display/intel_vdsc.c +2 -8
@@ -1016,20 +1016,14 @@ static i915_reg_t dss_ctl1_reg(const str {enum pipe pipe =to_intel_crtc (crtc_state->uapi.crtc)->pipe; -if (crtc_state->cpu_transcoder ==TRANSCODER_EDP ) -return DSS_CTL1 ; - -return ICL_PIPE_DSS_CTL1 (pipe); +return is_pipe_dsc (crtc_state) ?ICL_PIPE_DSS_CTL1 (pipe) :DSS_CTL1 ; }static i915_reg_t dss_ctl2_reg (const struct intel_crtc_state *crtc_state) {enum pipe pipe =to_intel_crtc (crtc_state->uapi.crtc)->pipe; -if (crtc_state->cpu_transcoder ==TRANSCODER_EDP ) -return DSS_CTL2 ; - -return ICL_PIPE_DSS_CTL2 (pipe); +return is_pipe_dsc (crtc_state) ?ICL_PIPE_DSS_CTL2 (pipe) :DSS_CTL2 ; } void intel_dsc_enable(struct intel_encoder *encoder,
Greg Kroah-Hartman
maintainerPATCH 102/254 drm/i915: Fix the GT fence revocation runtime PM logic
In reply to Greg Kroah-HartmanFrom: Imre Deak <[email protected]>
commit 8840e3bd981f128846b01c12d3966d115e8617c9 upstream.
To optimize some task deferring it until runtime resume unless someone holds a runtime PM reference (because in this case the task can be done w/o the overhead of runtime resume), we have to use the runtime PM get-if-active logic: If the runtime PM usage count is 0 (and so get-if-in-use would return false) the runtime suspend handler is not necessarily called yet (it could be just pending), so the device is not necessarily powered down, and so the runtime resume handler is not guaranteed to be called.
The fence revocation depends on the above deferral, so add a get-if-active helper and use it during fence revocation.
v2:
- Add code comment explaining the fence reg programming deferral logic to i915_vma_revoke_fence(). (Chris)
- Add Cc: stable and Fixes: tags. (Chris)
- Fix the function docbook comment.
--- drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c | 13 +++++++++++- drivers/gpu/drm/i915/intel_runtime_pm.c | 29 ++++++++++++++++++++++----- drivers/gpu/drm/i915/intel_runtime_pm.h | 5 ++++ 3 files changed, 41 insertions(+), 6 deletions(-)
drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c +12 -1
@@ -316,7 +316,18 @@ void i915_vma_revoke_fence(struct i915_vWRITE_ONCE (fence->vma,NULL ); vma->fence =NULL ; - with_intel_runtime_pm_if_in_use(fence_to_uncore(fence)->rpm, wakeref) +/* +* Skip the write to HW if and only if the device is currently +* suspended. +* +* If the driver does not currently hold a wakeref (if_in_use == 0), +* the device may currently be runtime suspended, or it may be woken +* up before the suspend takes place. If the device is not suspended +* (powered down) and we skip clearing the fence register, the HW is +* left in an undefined state where we may end up with multiple +* registers overlapping. +*/ + with_intel_runtime_pm_if_active(fence_to_uncore(fence)->rpm, wakeref)fence_write (fence); }
drivers/gpu/drm/i915/intel_runtime_pm.c +24 -5
@@ -412,12 +412,20 @@ intel_wakeref_t intel_runtime_pm_get(str }/** -* intel_runtime_pm_get_if_in_use - grab a runtime pm reference if device in use +* __intel_runtime_pm_get_if_active - grab a runtime pm reference if device is active * @rpm: the intel_runtime_pm structure +* @ignore_usecount: get a ref even if dev->power.usage_count is 0 * * This function grabs a device-level runtime pm reference if the device is -* already in use and ensures that it is powered up. It is illegal to try -* and access the HW should intel_runtime_pm_get_if_in_use() report failure. +* already active and ensures that it is powered up. It is illegal to try +* and access the HW should intel_runtime_pm_get_if_active() report failure. +* +* If @ignore_usecount=true, a reference will be acquired even if there is no +* user requiring the device to be powered up (dev->power.usage_count == 0). +* If the function returns false in this case then it's guaranteed that the +* device's runtime suspend hook has been called already or that it will be +* called (and hence it's also guaranteed that the device's runtime resume +* hook will be called eventually). * * Any runtime pm reference obtained by this function must have a symmetric * call to intel_runtime_pm_put() to release the reference again.
@@ -425,7 +433,8 @@ intel_wakeref_t intel_runtime_pm_get(str* Returns: the wakeref cookie to pass to intel_runtime_pm_put(), evaluates * as True if the wakeref was acquired, or False otherwise. */ -intel_wakeref_t intel_runtime_pm_get_if_in_use (struct intel_runtime_pm *rpm) +static intel_wakeref_t __intel_runtime_pm_get_if_active (struct intel_runtime_pm *rpm, +bool ignore_usecount) {if (IS_ENABLED (CONFIG_PM )) {/*
@@ -434,7 +443,7 @@ intel_wakeref_t intel_runtime_pm_get_if_* function, since the power state is undefined. This applies * atm to the late/early system suspend/resume handlers. */ -if (pm_runtime_get_if_in_use (rpm->kdev) <=0 ) +if (pm_runtime_get_if_active (rpm->kdev, ignore_usecount) <=0 )return 0 ; }
@@ -443,6 +452,16 @@ intel_wakeref_t intel_runtime_pm_get_if_return track_intel_runtime_pm_wakeref (rpm); } +intel_wakeref_t intel_runtime_pm_get_if_in_use (struct intel_runtime_pm *rpm) +{ +return __intel_runtime_pm_get_if_active (rpm, false); +} + +intel_wakeref_t intel_runtime_pm_get_if_active (struct intel_runtime_pm *rpm) +{ +return __intel_runtime_pm_get_if_active (rpm, true); +} +/** * intel_runtime_pm_get_noresume - grab a runtime pm reference * @rpm: the intel_runtime_pm structure
drivers/gpu/drm/i915/intel_runtime_pm.h +5 -0
@@ -177,6 +177,7 @@ void intel_runtime_pm_driver_release(strintel_wakeref_t intel_runtime_pm_get (struct intel_runtime_pm *rpm);intel_wakeref_t intel_runtime_pm_get_if_in_use (struct intel_runtime_pm *rpm); +intel_wakeref_t intel_runtime_pm_get_if_active (struct intel_runtime_pm *rpm);intel_wakeref_t intel_runtime_pm_get_noresume (struct intel_runtime_pm *rpm);intel_wakeref_t intel_runtime_pm_get_raw (struct intel_runtime_pm *rpm);
@@ -188,6 +189,10 @@ intel_wakeref_t intel_runtime_pm_get_rawfor ((wf) =intel_runtime_pm_get_if_in_use (rpm); (wf); \ intel_runtime_pm_put((rpm), (wf)), (wf) = 0) +#define with_intel_runtime_pm_if_active (rpm, wf) \ + for ((wf) = intel_runtime_pm_get_if_active(rpm); (wf); \ + intel_runtime_pm_put((rpm), (wf)), (wf) = 0) +void intel_runtime_pm_put_unchecked (struct intel_runtime_pm *rpm);#if IS_ENABLED (CONFIG_DRM_I915_DEBUG_RUNTIME_PM )void intel_runtime_pm_put (struct intel_runtime_pm *rpm,intel_wakeref_t wref);
Greg Kroah-Hartman
maintainerPATCH 103/254 dm verity: fix DM_VERITY_OPTS_MAX value
In reply to Greg Kroah-HartmanFrom: JeongHyeon Lee <[email protected]>
commit 160f99db943224e55906dd83880da1a704c6e6b9 upstream.
Three optional parameters must be accepted at once in a DM verity table, e.g.:
(verity_error_handling_mode) (ignore_zero_block) (check_at_most_once)
Fix this to be possible by incrementing DM_VERITY_OPTS_MAX.
--- drivers/md/dm-verity-target.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-verity-target.c +1 -1
@@ -34,7 +34,7 @@#define DM_VERITY_OPT_IGN_ZEROES "ignore_zero_blocks"#define DM_VERITY_OPT_AT_MOST_ONCE "check_at_most_once" -#define DM_VERITY_OPTS_MAX (2 + DM_VERITY_OPTS_FEC + \ +#define DM_VERITY_OPTS_MAX (3 + DM_VERITY_OPTS_FEC + \ DM_VERITY_ROOT_HASH_VERIFICATION_OPTS)static unsigned dm_verity_prefetch_cluster =DM_VERITY_DEFAULT_PREFETCH_SIZE ;
Greg Kroah-Hartman
maintainerPATCH 104/254 dm: dont report "detected capacity change" on device creation
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 5424a0b867e65f1ecf34ffe88d091a4fcbb35bc1 upstream.
When a DM device is first created it doesn't yet have an established capacity, therefore the use of set_capacity_and_notify() should be conditional given the potential for needless pr_info "detected capacity change" noise even if capacity is 0.
One could argue that the pr_info() in set_capacity_and_notify() is misplaced, but that position is not held uniformly.
--- drivers/md/dm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/md/dm.c +4 -1
@@ -2016,7 +2016,10 @@ static struct dm_table *__bind(struct maif (size !=dm_get_size (md))memset (&md->geometry,0 ,sizeof (md->geometry)); -set_capacity_and_notify (md->disk, size); +if (!get_capacity (md->disk)) +set_capacity (md->disk, size); +else +set_capacity_and_notify (md->disk, size);dm_table_event_callback (t, event_callback, md);
Greg Kroah-Hartman
maintainerPATCH 105/254 dm ioctl: fix out of bounds array access when no devices
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.
If there are not any dm devices, we need to zero the "dev" argument in the first structure dm_name_list. However, this can cause out of bounds write, because the "needed" variable is zero and len may be less than eight.
Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is too small to hold the "nl->dev" value.
--- drivers/md/dm-ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-ioctl.c +1 -1
@@ -529,7 +529,7 @@ static int list_devices(struct file *fil* Grab our output buffer. */ nl = orig_nl =get_result_buffer (param, param_size, &len); -if (len < needed) { +if (len < needed || len <sizeof (nl->dev)) { param->flags |=DM_BUFFER_FULL_FLAG ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 106/254 bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD
In reply to Greg Kroah-HartmanFrom: Grygorii Strashko <[email protected]>
[ Upstream commit 7d7275b3e866cf8092bd12553ec53ba26864f7bb ]
The main purpose of l3 IRQs is to catch OCP bus access errors and identify corresponding code places by showing call stack, so it's important to handle L3 interconnect errors as fast as possible. On RT these IRQs will became threaded and will be scheduled much more late from the moment actual error occurred so showing completely useless information.
Hence, mark l3 IRQs as IRQF_NO_THREAD so they will not be forced threaded on RT or if force_irqthreads = true.
--- drivers/bus/omap_l3_noc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/bus/omap_l3_noc.c +2 -2
@@ -285,7 +285,7 @@ static int omap_l3_probe(struct platform_device *pdev)*/ l3->debug_irq =platform_get_irq (pdev,0 ); ret =devm_request_irq (l3->dev, l3->debug_irq, l3_interrupt_handler, -0x0 ,"l3-dbg-irq" , l3); +IRQF_NO_THREAD ,"l3-dbg-irq" , l3);if (ret) {dev_err (l3->dev,"request_irq failed for %d\n" , l3->debug_irq);
@@ -294,7 +294,7 @@ static int omap_l3_probe(struct platform_device *pdev) l3->app_irq =platform_get_irq (pdev,1 ); ret =devm_request_irq (l3->dev, l3->app_irq, l3_interrupt_handler, -0x0 ,"l3-app-irq" , l3); +IRQF_NO_THREAD ,"l3-app-irq" , l3);if (ret)dev_err (l3->dev,"request_irq failed for %d\n" , l3->app_irq);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 107/254 soc: ti: omap-prm: Fix reboot issue with invalid pcie reset map for dra7
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit a249ca66d15fa4b54dc6deaff4155df3db1308e1 ]
Yongqin Liu <[email protected]> reported an issue where reboot hangs on beagleboard-x15. This started happening after commit 7078a5ba7a58 ("soc: ti: omap-prm: Fix boot time errors for rst_map_012 bits 0 and 1").
We now assert any 012 type resets on init to prevent unconfigured accelerator MMUs getting enabled on init depending on the bootloader or kexec configured state.
Turns out that we now also wrongly assert dra7 l3init domain PCIe reset bits causing a hang during reboot. Let's fix the l3init reset bits to use a 01 map instead of 012 map. There are only two rstctrl bits and not three. This is documented in TRM "Table 3-1647. RM_PCIESS_RSTCTRL".
--- drivers/soc/ti/omap_prm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/ti/omap_prm.c +1 -1
@@ -332,7 +332,7 @@ static const struct omap_prm_data dra7_prm_data[] = { { .name = "l3init", .base = 0x4ae07300, .pwrstctrl = 0x0, .pwrstst = 0x4, .dmap = &omap_prm_alwon, - .rstctrl = 0x10, .rstst = 0x14, .rstmap = rst_map_012, + .rstctrl = 0x10, .rstst = 0x14, .rstmap = rst_map_01, .clkdm_name ="pcie" }, {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 108/254 ARM: OMAP2+: Fix smartreflex init regression after dropping legacy data
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit fbfa463be8dc7957ee4f81556e9e1ea2a951807d ]
When I dropped legacy data for omap4 and dra7 smartreflex in favor of device tree based data, it seems I only testd for the "SmartReflex Class3 initialized" line in dmesg. I missed the fact that there is also omap_devinit_smartreflex() that happens later, and now it produces an error on boot for "No Voltage table for the corresponding vdd. Cannot create debugfs entries for n-values".
This happens as we no longer have the smartreflex instance legacy data, and have not yet moved completely to device tree based booting for the driver. Let's fix the issue by changing the smartreflex init to use names. This should all eventually go away in favor of doing the init in the driver based on devicetree compatible value.
Note that dra7xx_init_early() is not calling any voltage domain init like omap54xx_voltagedomains_init(), or a dra7 specific voltagedomains init. This means that on dra7 smartreflex is still not fully initialized, and also seems to be missing the related devicetree nodes.
--- arch/arm/mach-omap2/sr_device.c | 75 +++++++++++++++++++++++++-------- 1 file changed, 58 insertions(+), 17 deletions(-)
arch/arm/mach-omap2/sr_device.c +58 -17
@@ -88,34 +88,26 @@ static void __init sr_set_nvalues(struct omap_volt_data *volt_data,extern struct omap_sr_data omap_sr_pdata[]; -static int __init sr_dev_init (struct omap_hwmod *oh,void *user) +static int __init sr_init_by_name (const char *name,const char *voltdm) {struct omap_sr_data *sr_data =NULL ;struct omap_volt_data *volt_data; -struct omap_smartreflex_dev_attr *sr_dev_attr;static int i; -if (!strncmp (oh->name,"smartreflex_mpu_iva" ,20 ) || - !strncmp (oh->name,"smartreflex_mpu" ,16 )) +if (!strncmp (name,"smartreflex_mpu_iva" ,20 ) || + !strncmp (name,"smartreflex_mpu" ,16 )) sr_data = &omap_sr_pdata[OMAP_SR_MPU ]; -else if (!strncmp (oh->name,"smartreflex_core" ,17 )) +else if (!strncmp (name,"smartreflex_core" ,17 )) sr_data = &omap_sr_pdata[OMAP_SR_CORE ]; -else if (!strncmp (oh->name,"smartreflex_iva" ,16 )) +else if (!strncmp (name,"smartreflex_iva" ,16 )) sr_data = &omap_sr_pdata[OMAP_SR_IVA ];if (!sr_data) { -pr_err ("%s: Unknown instance %s\n" , __func__, oh->name); +pr_err ("%s: Unknown instance %s\n" , __func__, name);return -EINVAL ; } - sr_dev_attr = (struct omap_smartreflex_dev_attr *)oh->dev_attr; -if (!sr_dev_attr || !sr_dev_attr->sensor_voltdm_name) { -pr_err ("%s: No voltage domain specified for %s. Cannot initialize\n" , - __func__, oh->name); - goto exit; - } - - sr_data->name = oh->name; + sr_data->name = name;if (cpu_is_omap343x ()) sr_data->ip_type =1 ;else
@@ -136,10 +128,10 @@ static int __init sr_dev_init(struct omap_hwmod *oh, void *user) } } - sr_data->voltdm =voltdm_lookup (sr_dev_attr->sensor_voltdm_name); + sr_data->voltdm =voltdm_lookup (voltdm);if (!sr_data->voltdm) {pr_err ("%s: Unable to get voltage domain pointer for VDD %s\n" , - __func__, sr_dev_attr->sensor_voltdm_name); + __func__, voltdm); goto exit; }
@@ -160,6 +152,20 @@ exit:return 0 ; } +static int __init sr_dev_init (struct omap_hwmod *oh,void *user) +{ +struct omap_smartreflex_dev_attr *sr_dev_attr; + + sr_dev_attr = (struct omap_smartreflex_dev_attr *)oh->dev_attr; +if (!sr_dev_attr || !sr_dev_attr->sensor_voltdm_name) { +pr_err ("%s: No voltage domain specified for %s. Cannot initialize\n" , + __func__, oh->name); +return 0 ; + } + +return sr_init_by_name (oh->name, sr_dev_attr->sensor_voltdm_name); +} +/* * API to be called from board files to enable smartreflex * autocompensation at init.
@@ -169,7 +175,42 @@ void __init omap_enable_smartreflex_on_init(void) sr_enable_on_init = true; } +static const char *const omap4_sr_instances[] = { +"mpu" , +"iva" , +"core" , +}; + +static const char *const dra7_sr_instances[] = { +"mpu" , +"core" , +}; +int __init omap_devinit_smartreflex (void ) { +const char *const *sr_inst; +int i, nr_sr =0 ; + +if (soc_is_omap44xx ()) { + sr_inst = omap4_sr_instances; + nr_sr =ARRAY_SIZE (omap4_sr_instances); + + }else if (soc_is_dra7xx ()) { + sr_inst = dra7_sr_instances; + nr_sr =ARRAY_SIZE (dra7_sr_instances); + } + +if (nr_sr) { +const char *name, *voltdm; + +for (i =0 ; i < nr_sr; i++) { + name =kasprintf (GFP_KERNEL ,"smartreflex_%s" , sr_inst[i]); + voltdm = sr_inst[i]; +sr_init_by_name (name, voltdm); + } + +return 0 ; + } +return omap_hwmod_for_each_by_class ("smartreflex" , sr_dev_init,NULL ); }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 109/254 soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit effe89e40037038db7711bdab5d3401fe297d72c ]
On reset deassert, we must wait a bit after the rstst bit change before we allow clockdomain autoidle again. Otherwise we get the following oops sometimes on dra7 with iva:
Unhandled fault: imprecise external abort (0x1406) at 0x00000000 44000000.ocp:L3 Standard Error: MASTER MPU TARGET IVA_CONFIG (Read Link):
At Address: 0x0005A410 : Data Access in User mode during Functional access
Internal error: : 1406 [#1] SMP ARM
...
(sysc_write_sysconfig) from [<c0782cb0>] (sysc_enable_module+0xcc/0x260) (sysc_enable_module) from [<c0782f0c>] (sysc_runtime_resume+0xc8/0x174) (sysc_runtime_resume) from [<c0a3e1ac>] (genpd_runtime_resume+0x94/0x224) (genpd_runtime_resume) from [<c0a33f0c>] (__rpm_callback+0xd8/0x180)
It is unclear what all devices this might affect, but presumably other devices with the rstst bit too can be affected. So let's just enable the delay for all the devices with rstst bit for now. Later on we may want to limit the list to the know affected devices if needed.
--- drivers/soc/ti/omap_prm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/soc/ti/omap_prm.c +5 -1
@@ -830,8 +830,12 @@ static int omap_reset_deassert(struct reset_controller_dev *rcdev, reset->prm->data->name, id); exit: -if (reset->clkdm) +if (reset->clkdm) { +/* At least dra7 iva needs a delay before clkdm idle */ +if (has_rstst) +udelay (1 ); pdata->clkdm_allow_idle (reset->clkdm); + }return ret; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 110/254 veth: Store queue_mapping independently of XDP prog presence
In reply to Greg Kroah-HartmanFrom: Maciej Fijalkowski <[email protected]>
[ Upstream commit edbea922025169c0e5cdca5ebf7bf5374cc5566c ]
Currently, veth_xmit() would call the skb_record_rx_queue() only when there is XDP program loaded on peer interface in native mode.
If peer has XDP prog in generic mode, then netif_receive_generic_xdp() has a call to netif_get_rxqueue(skb), so for multi-queue veth it will not be possible to grab a correct rxq.
To fix that, store queue_mapping independently of XDP prog presence on peer interface.
--- drivers/net/veth.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/veth.c +1 -2
@@ -301,8 +301,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)if (rxq < rcv->real_num_rx_queues) { rq = &rcv_priv->rq[rxq]; rcv_xdp =rcu_access_pointer (rq->xdp_prog); -if (rcv_xdp) -skb_record_rx_queue (skb, rxq); +skb_record_rx_queue (skb, rxq); }skb_tx_timestamp (skb);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 111/254 bpf: Dont allow vmlinux BTF to be used in map_create and prog_load.
In reply to Greg Kroah-HartmanFrom: Alexei Starovoitov <[email protected]>
[ Upstream commit 350a5c4dd2452ea999cc5e1d4a8dbf12de2f97ef ]
The syzbot got FD of vmlinux BTF and passed it into map_create which caused crash in btf_type_id_size() when it tried to access resolved_ids. The vmlinux BTF doesn't have 'resolved_ids' and 'resolved_sizes' initialized to save memory. To avoid such issues disallow using vmlinux BTF in prog_load and map_create commands.
--- kernel/bpf/syscall.c | 5 +++++ kernel/bpf/verifier.c | 4 ++++ 2 files changed, 9 insertions(+)
kernel/bpf/syscall.c +5 -0
@@ -854,6 +854,11 @@ static int map_create(union bpf_attr *attr) err =PTR_ERR (btf); goto free_map; } +if (btf_is_kernel (btf)) { +btf_put (btf); + err = -EACCES ; + goto free_map; + } map->btf = btf;if (attr->btf_value_type_id) {
kernel/bpf/verifier.c +4 -0
@@ -8580,6 +8580,10 @@ static int check_btf_info(struct bpf_verifier_env *env, btf =btf_get_by_fd (attr->prog_btf_fd);if (IS_ERR (btf))return PTR_ERR (btf); +if (btf_is_kernel (btf)) { +btf_put (btf); +return -EACCES ; + } env->prog->aux->btf = btf; err =check_btf_func (env, attr, uattr);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 112/254 bpf: Change inode_storages lookup_elem return value from NULL to -EBADF
In reply to Greg Kroah-HartmanFrom: Tal Lossos <[email protected]>
[ Upstream commit 769c18b254ca191b45047e1fcb3b2ce56fada0b6 ]
bpf_fd_inode_storage_lookup_elem() returned NULL when getting a bad FD, which caused -ENOENT in bpf_map_copy_value. -EBADF error is better than -ENOENT for a bad FD behaviour.
The patch was partially contributed by CyberArk Software, Inc.
--- kernel/bpf/bpf_inode_storage.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/bpf_inode_storage.c +1 -1
@@ -109,7 +109,7 @@ static void *bpf_fd_inode_storage_lookup_elem(struct bpf_map *map, void *key) fd = *(int *)key; f =fget_raw (fd);if (!f) -return NULL ; +return ERR_PTR (-EBADF ); sdata =inode_storage_lookup (f->f_inode, map, true);fput (f);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 113/254 libbpf: Fix INSTALL flag order
In reply to Greg Kroah-HartmanFrom: Georgi Valkov <[email protected]>
[ Upstream commit e7fb6465d4c8e767e39cbee72464e0060ab3d20c ]
It was reported ([0]) that having optional -m flag between source and destination arguments in install command breaks bpftools cross-build on MacOS. Move -m to the front to fix this issue.
[0] https://github.com/openwrt/openwrt/pull/3959
--- tools/lib/bpf/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/Makefile +1 -1
@@ -236,7 +236,7 @@ define do_install if [ ! -d '$(DESTDIR_SQ)$2' ]; then \ $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2'; \ fi; \ - $(INSTALL) $1 $(if $3,-m $3,) '$(DESTDIR_SQ)$2' + $(INSTALL) $(if $3,-m $3,) $1 '$(DESTDIR_SQ)$2' endef install_lib: all_cmd
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 114/254 net/mlx5e: RX, Mind the MPWQE gaps when calculating offsets
In reply to Greg Kroah-HartmanFrom: Tariq Toukan <[email protected]>
[ Upstream commit d5dd03b26ba49c4ffe67ee1937add82293c19794 ]
Since cited patch, MLX5E_REQUIRED_WQE_MTTS is not a power of two. Hence, usage of MLX5E_LOG_ALIGNED_MPWQE_PPW should be replaced, as it lost some accuracy. Use the designated macro to calculate the number of required MTTs.
This makes sure the solution in cited patch works properly.
While here, un-inline mlx5e_get_mpwqe_offset(), and remove the unused RQ parameter.
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 7 ++++--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 6 +++--- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 4 ++-- 3 files changed, 9 insertions(+), 8 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +4 -3
@@ -90,14 +90,15 @@ struct page_pool; MLX5_MPWRQ_LOG_WQE_SZ - PAGE_SHIFT : 0)#define MLX5_MPWRQ_PAGES_PER_WQE BIT(MLX5_MPWRQ_WQE_PAGE_ORDER) -#define MLX5_MTT_OCTW (npages) (ALIGN(npages, 8) / 2) +#define MLX5_ALIGN_MTTS (mtts) (ALIGN(mtts, 8)) +#define MLX5_ALIGNED_MTTS_OCTW (mtts) ((mtts) / 2) +#define MLX5_MTT_OCTW (mtts) (MLX5_ALIGNED_MTTS_OCTW(MLX5_ALIGN_MTTS(mtts)))/* Add another page to MLX5E_REQUIRED_WQE_MTTS as a buffer between * WQEs, This page will absorb write overflow by the hardware, when * receiving packets larger than MTU. These oversize packets are * dropped by the driver at a later stage. */ -#define MLX5E_REQUIRED_WQE_MTTS (ALIGN(MLX5_MPWRQ_PAGES_PER_WQE + 1, 8)) -#define MLX5E_LOG_ALIGNED_MPWQE_PPW (ilog2(MLX5E_REQUIRED_WQE_MTTS)) +#define MLX5E_REQUIRED_WQE_MTTS (MLX5_ALIGN_MTTS(MLX5_MPWRQ_PAGES_PER_WQE + 1))#define MLX5E_REQUIRED_MTTS (wqes) (wqes * MLX5E_REQUIRED_WQE_MTTS)#define MLX5E_MAX_RQ_NUM_MTTS \ ((1 << 16) * 2)/* So that MLX5_MTT_OCTW(num_mtts) fits into u16 */
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +3 -3
@@ -305,9 +305,9 @@ static int mlx5e_create_rq_umr_mkey(struct mlx5_core_dev *mdev, struct mlx5e_rq rq->wqe_overflow.addr); } -static inline u64 mlx5e_get_mpwqe_offset (struct mlx5e_rq *rq,u16 wqe_ix) +static u64 mlx5e_get_mpwqe_offset (u16 wqe_ix) { -return (wqe_ix <<MLX5E_LOG_ALIGNED_MPWQE_PPW ) <<PAGE_SHIFT ; +return MLX5E_REQUIRED_MTTS (wqe_ix) <<PAGE_SHIFT ; }static void mlx5e_init_frags_partition (struct mlx5e_rq *rq)
@@ -547,7 +547,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,mlx5_wq_ll_get_wqe (&rq->mpwqe.wq, i);u32 byte_count = rq->mpwqe.num_strides << rq->mpwqe.log_stride_sz; -u64 dma_offset =mlx5e_get_mpwqe_offset (rq, i); +u64 dma_offset =mlx5e_get_mpwqe_offset (i); wqe->data[0 ].addr =cpu_to_be64 (dma_offset + rq->buff.headroom); wqe->data[0 ].byte_count =cpu_to_be32 (byte_count);
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +2 -2
@@ -505,7 +505,6 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix)struct mlx5e_icosq *sq = rq->icosq;struct mlx5_wq_cyc *wq = &sq->wq;struct mlx5e_umr_wqe *umr_wqe; -u16 xlt_offset = ix << (MLX5E_LOG_ALIGNED_MPWQE_PPW -1 );u16 pi;int err;int i;
@@ -536,7 +535,8 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix) umr_wqe->ctrl.opmod_idx_opcode =cpu_to_be32 ((sq->pc <<MLX5_WQE_CTRL_WQE_INDEX_SHIFT ) |MLX5_OPCODE_UMR ); - umr_wqe->uctrl.xlt_offset =cpu_to_be16 (xlt_offset); + umr_wqe->uctrl.xlt_offset = +cpu_to_be16 (MLX5_ALIGNED_MTTS_OCTW (MLX5E_REQUIRED_MTTS (ix))); sq->db.wqe_info[pi] = (struct mlx5e_icosq_wqe_info ) { .wqe_type =MLX5E_ICOSQ_WQE_UMR_RX ,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 115/254 net/mlx5e: Set PTP channel pointer explicitly to NULL
In reply to Greg Kroah-HartmanFrom: Aya Levin <[email protected]>
[ Upstream commit 1c2cdf0b603a3b0c763288ad92e9f3f1555925cf ]
When closing the PTP channel, set its pointer explicitly to NULL. PTP channel is opened on demand, the code verify the pointer validity before access. Nullify it when closing the PTP channel to avoid unexpected behavior.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +3 -1
@@ -2443,8 +2443,10 @@ void mlx5e_close_channels(struct mlx5e_channels *chs) {int i; -if (chs->port_ptp) +if (chs->port_ptp) {mlx5e_port_ptp_close (chs->port_ptp); + chs->port_ptp =NULL ; + }for (i =0 ; i < chs->num; i++)mlx5e_close_channel (chs->c[i]);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 116/254 net/mlx5e: When changing XDP program without reset, take refs for XSK RQs
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit e5eb01344e9b09bb9d255b9727449186f7168df8 ]
Each RQ (including XSK RQs) takes a reference to the XDP program. When an XDP program is attached or detached, the channels and queues are recreated, however, there is a special flow for changing an active XDP program to another one. In that flow, channels and queues stay alive, but the refcounts of the old and new XDP programs are adjusted. This flow didn't increment refcount by the number of active XSK RQs, and this commit fixes it.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +3 -1
@@ -4550,8 +4550,10 @@ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog)struct mlx5e_channel *c = priv->channels.c[i];mlx5e_rq_replace_xdp_prog (&c->rq, prog); -if (test_bit (MLX5E_CHANNEL_STATE_XSK , c->state)) +if (test_bit (MLX5E_CHANNEL_STATE_XSK , c->state)) { +bpf_prog_inc (prog);mlx5e_rq_replace_xdp_prog (&c->xskrq, prog); + } } unlock:
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 117/254 net/mlx5e: Revert parameters on errors when changing PTP state without reset
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit 74640f09735f935437bd8df9fe61a66f03eabb34 ]
Port timestamping for PTP can be enabled/disabled while the channels are closed. In that case mlx5e_safe_switch_channels is skipped, and the preactivate hook is called directly. However, if that hook returns an error, the channel parameters must be reverted back to their old values. This commit adds missing handling on this case.
--- drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +5 -0
@@ -1993,8 +1993,13 @@ static int set_pflag_tx_port_ts(struct net_device *netdev, bool enable)*/ if (!test_bit (MLX5E_STATE_OPENED , &priv->state)) { +struct mlx5e_params old_params; + + old_params = priv->channels.params; priv->channels.params = new_channels.params; err =mlx5e_num_channels_changed (priv); +if (err) + priv->channels.params = old_params; goto out; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 118/254 net/mlx5e: Dont match on Geneve options in case option masks are all zero
In reply to Greg Kroah-HartmanFrom: Maor Dickman <[email protected]>
[ Upstream commit 385d40b042e60aa0b677d7b400a0fefb44bcbaf4 ]
The cited change added offload support for Geneve options without verifying the validity of the options masks, this caused offload of rules with match on Geneve options with class,type and data masks which are zero to fail.
Fix by ignoring the match on Geneve options in case option masks are all zero.
--- drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c +4 -0
@@ -227,6 +227,10 @@ static int mlx5e_tc_tun_parse_geneve_options(struct mlx5e_priv *priv, option_key = (struct geneve_opt *)&enc_opts.key->data[0 ]; option_mask = (struct geneve_opt *)&enc_opts.mask->data[0 ]; +if (option_mask->opt_class ==0 && option_mask->type ==0 && + !memchr_inv (option_mask->opt_data,0 , option_mask->length *4 )) +return 0 ; +if (option_key->length > max_tlv_option_data_len) {NL_SET_ERR_MSG_MOD (extack,"Matching on GENEVE options: unsupported option len" );
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 119/254 net/mlx5e: E-switch, Fix rate calculation division
In reply to Greg Kroah-HartmanFrom: Parav Pandit <[email protected]>
[ Upstream commit 8b90d897823b28a51811931f3bdc79f8df79407e ]
do_div() returns reminder, while cited patch wanted to use quotient.
Fix it by using quotient.
--- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +2 -1
@@ -5040,7 +5040,8 @@ static int apply_police_params(struct mlx5e_priv *priv, u64 rate,*/ if (rate) { rate = (rate *BITS_PER_BYTE ) +500000 ; - rate_mbps =max_t (u64,do_div (rate,1000000 ),1 ); +do_div (rate,1000000 ); + rate_mbps =max_t (u32, rate,1 ); } err =mlx5_esw_modify_vport_rate (esw, vport_num, rate_mbps);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 120/254 ipv6: fix suspecious RCU usage warning
In reply to Greg Kroah-HartmanFrom: Wei Wang <[email protected]>
[ Upstream commit 28259bac7f1dde06d8ba324e222bbec9d4e92f2b ]
Syzbot reported the suspecious RCU usage in nexthop_fib6_nh() when called from ipv6_route_seq_show(). The reason is ipv6_route_seq_start() calls rcu_read_lock_bh(), while nexthop_fib6_nh() calls rcu_dereference_rtnl().
The fix proposed is to add a variant of nexthop_fib6_nh() to use rcu_dereference_bh_rtnl() for ipv6_route_seq_show().
The reported trace is as follows:./include/net/nexthop.h:416 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by syz-executor.0/17895:
at: seq_read+0x71/0x12a0 fs/seq_file.c:169
at: seq_file_net include/linux/seq_file_net.h:19 [inline]
at: ipv6_route_seq_start+0xaf/0x300 net/ipv6/ip6_fib.c:2616stack backtrace: CPU: 1 PID: 17895 Comm: syz-executor.0 Not tainted 4.15.0-syzkaller #0 Call Trace: [<ffffffff849edf9e>] __dump_stack lib/dump_stack.c:17 [inline] [<ffffffff849edf9e>] dump_stack+0xd8/0x147 lib/dump_stack.c:53 [<ffffffff8480b7fa>] lockdep_rcu_suspicious+0x153/0x15d kernel/locking/lockdep.c:5745 [<ffffffff8459ada6>] nexthop_fib6_nh include/net/nexthop.h:416 [inline] [<ffffffff8459ada6>] ipv6_route_native_seq_show net/ipv6/ip6_fib.c:2488 [inline] [<ffffffff8459ada6>] ipv6_route_seq_show+0x436/0x7a0 net/ipv6/ip6_fib.c:2673 [<ffffffff81c556df>] seq_read+0xccf/0x12a0 fs/seq_file.c:276 [<ffffffff81dbc62c>] proc_reg_read+0x10c/0x1d0 fs/proc/inode.c:231 [<ffffffff81bc28ae>] do_loop_readv_writev fs/read_write.c:714 [inline] [<ffffffff81bc28ae>] do_loop_readv_writev fs/read_write.c:701 [inline] [<ffffffff81bc28ae>] do_iter_read+0x49e/0x660 fs/read_write.c:935 [<ffffffff81bc81ab>] vfs_readv+0xfb/0x170 fs/read_write.c:997 [<ffffffff81c88847>] kernel_readv fs/splice.c:361 [inline] [<ffffffff81c88847>] default_file_splice_read+0x487/0x9c0 fs/splice.c:416 [<ffffffff81c86189>] do_splice_to+0x129/0x190 fs/splice.c:879 [<ffffffff81c86f66>] splice_direct_to_actor+0x256/0x890 fs/splice.c:951 [<ffffffff81c8777d>] do_splice_direct+0x1dd/0x2b0 fs/splice.c:1060 [<ffffffff81bc4747>] do_sendfile+0x597/0xce0 fs/read_write.c:1459 [<ffffffff81bca205>] SYSC_sendfile64 fs/read_write.c:1520 [inline] [<ffffffff81bca205>] SyS_sendfile64+0x155/0x170 fs/read_write.c:1506 [<ffffffff81015fcf>] do_syscall_64+0x1ff/0x310 arch/x86/entry/common.c:305 [<ffffffff84a00076>] entry_SYSCALL_64_after_hwframe+0x42/0xb7
--- include/net/nexthop.h | 24 ++++++++++++++++++++++++ net/ipv6/ip6_fib.c | 2 +- 2 files changed, 25 insertions(+), 1 deletion(-)
include/net/nexthop.h +24 -0
@@ -400,6 +400,7 @@ static inline struct fib_nh *fib_info_nh(struct fib_info *fi, int nhsel)int fib6_check_nexthop (struct nexthop *nh,struct fib6_config *cfg,struct netlink_ext_ack *extack); +/* Caller should either hold rcu_read_lock(), or RTNL. */ static inline struct fib6_nh *nexthop_fib6_nh (struct nexthop *nh) {struct nh_info *nhi;
@@ -420,6 +421,29 @@ static inline struct fib6_nh *nexthop_fib6_nh(struct nexthop *nh)return NULL ; } +/* Variant of nexthop_fib6_nh(). +* Caller should either hold rcu_read_lock_bh(), or RTNL. +*/ +static inline struct fib6_nh *nexthop_fib6_nh_bh (struct nexthop *nh) +{ +struct nh_info *nhi; + +if (nh->is_group) { +struct nh_group *nh_grp; + + nh_grp =rcu_dereference_bh_rtnl (nh->nh_grp); + nh =nexthop_mpath_select (nh_grp,0 ); +if (!nh) +return NULL ; + } + + nhi =rcu_dereference_bh_rtnl (nh->nh_info); +if (nhi->family ==AF_INET6 ) +return &nhi->fib6_nh; + +return NULL ; +} +static inline struct net_device *fib6_info_nh_dev (struct fib6_info *f6i) {struct fib6_nh *fib6_nh;
net/ipv6/ip6_fib.c +1 -1
@@ -2485,7 +2485,7 @@ static int ipv6_route_native_seq_show(struct seq_file *seq, void *v)const struct net_device *dev;if (rt->nh) - fib6_nh =nexthop_fib6_nh (rt->nh); + fib6_nh =nexthop_fib6_nh_bh (rt->nh);seq_printf (seq,"%pi6 %02x " , &rt->fib6_dst.addr, rt->fib6_dst.plen);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 121/254 drop_monitor: Perform cleanup upon probe registration failure
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
[ Upstream commit 9398e9c0b1d44eeb700e9e766c02bcc765c82570 ]
In the rare case that drop_monitor fails to register its probe on the 'napi_poll' tracepoint, it will not deactivate its hysteresis timer as part of the error path. If the hysteresis timer was armed by the shortly lived 'kfree_skb' probe and user space retries to initiate tracing, a warning will be emitted for trying to initialize an active object [1].
Fix this by properly undoing all the operations that were done prior to probe registration, in both software and hardware code paths.
Note that syzkaller managed to fail probe registration by injecting a slab allocation failure [2].
[1]
ODEBUG: init active (active state 0) object type: timer_list hint: sched_send_work+0x0/0x60 include/linux/list.h:135
WARNING: CPU: 1 PID: 8649 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505 Modules linked in: CPU: 1 PID: 8649 Comm: syz-executor.0 Not tainted 5.11.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505 [...] Call Trace: __debug_object_init+0x524/0xd10 lib/debugobjects.c:588 debug_timer_init kernel/time/timer.c:722 [inline] debug_init kernel/time/timer.c:770 [inline] init_timer_key+0x2d/0x340 kernel/time/timer.c:814 net_dm_trace_on_set net/core/drop_monitor.c:1111 [inline] set_all_monitor_traces net/core/drop_monitor.c:1188 [inline] net_dm_monitor_start net/core/drop_monitor.c:1295 [inline] net_dm_cmd_trace+0x720/0x1220 net/core/drop_monitor.c:1339 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:739 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:672 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2348 ___sys_sendmsg+0xf3/0x170 net/socket.c:2402 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2435 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae
[2]
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 1 PID: 8645 Comm: syz-executor.0 Not tainted 5.11.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: dump_stack+0xfa/0x151 should_fail.cold+0x5/0xa should_failslab+0x5/0x10 __kmalloc+0x72/0x3f0 tracepoint_add_func+0x378/0x990 tracepoint_probe_register+0x9c/0xe0 net_dm_cmd_trace+0x7fc/0x1220 genl_family_rcv_msg_doit+0x228/0x320 genl_rcv_msg+0x328/0x580 netlink_rcv_skb+0x153/0x420 genl_rcv+0x24/0x40 netlink_unicast+0x533/0x7d0 netlink_sendmsg+0x856/0xd90 sock_sendmsg+0xcf/0x120 ____sys_sendmsg+0x6e8/0x810 ___sys_sendmsg+0xf3/0x170 __sys_sendmsg+0xe5/0x1b0 do_syscall_64+0x2d/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xae
--- net/core/drop_monitor.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
net/core/drop_monitor.c +23 -0
@@ -1053,6 +1053,20 @@ static int net_dm_hw_monitor_start(struct netlink_ext_ack *extack)return 0 ; err_module_put: +for_each_possible_cpu (cpu) { +struct per_cpu_dm_data *hw_data = &per_cpu (dm_hw_cpu_data, cpu); +struct sk_buff *skb; + +del_timer_sync (&hw_data->send_timer); +cancel_work_sync (&hw_data->dm_alert_work); +while ((skb =__skb_dequeue (&hw_data->drop_queue))) { +struct devlink_trap_metadata *hw_metadata; + + hw_metadata =NET_DM_SKB_CB (skb)->hw_metadata; +net_dm_hw_metadata_free (hw_metadata); +consume_skb (skb); + } + }module_put (THIS_MODULE );return rc; }
@@ -1134,6 +1148,15 @@ static int net_dm_trace_on_set(struct netlink_ext_ack *extack) err_unregister_trace:unregister_trace_kfree_skb (ops->kfree_skb_probe,NULL ); err_module_put: +for_each_possible_cpu (cpu) { +struct per_cpu_dm_data *data = &per_cpu (dm_cpu_data, cpu); +struct sk_buff *skb; + +del_timer_sync (&data->send_timer); +cancel_work_sync (&data->dm_alert_work); +while ((skb =__skb_dequeue (&data->drop_queue))) +consume_skb (skb); + }module_put (THIS_MODULE );return rc; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 122/254 macvlan: macvlan_count_rx() needs to be aware of preemption
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit dd4fa1dae9f4847cc1fd78ca468ad69e16e5db3e ]
macvlan_count_rx() can be called from process context, it is thus necessary to disable preemption before calling u64_stats_update_begin()
syzbot was able to spot this on 32bit arch:
WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert include/linux/seqlock.h:271 [inline] WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269 Modules linked in: Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 4632 Comm: kworker/1:3 Not tainted 5.12.0-rc2-syzkaller #0 Hardware name: ARM-Versatile Express Workqueue: events macvlan_process_broadcast Backtrace: [<82740468>] (dump_backtrace) from [<827406dc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252) r7:00000080 r6:60000093 r5:00000000 r4:8422a3c4
[<827406c4>] (show_stack) from [<82751b58>] (__dump_stack lib/dump_stack.c:79 [inline])
[<827406c4>] (show_stack) from [<82751b58>] (dump_stack+0xb8/0xe8 lib/dump_stack.c:120)
[<82751aa0>] (dump_stack) from [<82741270>] (panic+0x130/0x378 kernel/panic.c:231)
r7:830209b4 r6:84069ea4 r5:00000000 r4:844350d0
[<82741140>] (panic) from [<80244924>] (__warn+0xb0/0x164 kernel/panic.c:605)
r3:8404ec8c r2:00000000 r1:00000000 r0:830209b4
r7:0000010f
[<80244874>] (__warn) from [<82741520>] (warn_slowpath_fmt+0x68/0xd4 kernel/panic.c:628)
r7:81363f70 r6:0000010f r5:83018e50 r4:00000000
[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert include/linux/seqlock.h:271 [inline]) [<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269)
r8:5a109000 r7:0000000f r6:a568dac0 r5:89802300 r4:00000001
[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (u64_stats_update_begin include/linux/u64_stats_sync.h:128 [inline]) [<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_count_rx include/linux/if_macvlan.h:47 [inline]) [<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_broadcast+0x154/0x26c drivers/net/macvlan.c:291)
r5:89802300 r4:8a927740
[<8136499c>] (macvlan_broadcast) from [<81365020>] (macvlan_process_broadcast+0x258/0x2d0 drivers/net/macvlan.c:317)
r10:81364f78 r9:8a86d000 r8:8a9c7e7c r7:8413aa5c r6:00000000 r5:00000000
r4:89802840
[<81364dc8>] (macvlan_process_broadcast) from [<802696a4>] (process_one_work+0x2d4/0x998 kernel/workqueue.c:2275)
r10:00000008 r9:8404ec98 r8:84367a02 r7:ddfe6400 r6:ddfe2d40 r5:898dac80
r4:8a86d43c
[<802693d0>] (process_one_work) from [<80269dcc>] (worker_thread+0x64/0x54c kernel/workqueue.c:2421)
r10:00000008 r9:8a9c6000 r8:84006d00 r7:ddfe2d78 r6:898dac94 r5:ddfe2d40
r4:898dac80
[<80269d68>] (worker_thread) from [<80271f40>] (kthread+0x184/0x1a4 kernel/kthread.c:292)
r10:85247e64 r9:898dac80 r8:80269d68 r7:00000000 r6:8a9c6000 r5:89a2ee40
r4:8a97bd00
[<80271dbc>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:158)
Exception stack(0x8a9c7fb0 to 0x8a9c7ff8)
--- include/linux/if_macvlan.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/linux/if_macvlan.h +2 -1
@@ -43,13 +43,14 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan,if (likely (success)) {struct vlan_pcpu_stats *pcpu_stats; - pcpu_stats =this_cpu_ptr (vlan->pcpu_stats); + pcpu_stats =get_cpu_ptr (vlan->pcpu_stats);u64_stats_update_begin (&pcpu_stats->syncp); pcpu_stats->rx_packets++; pcpu_stats->rx_bytes += len;if (multicast) pcpu_stats->rx_multicast++;u64_stats_update_end (&pcpu_stats->syncp); +put_cpu_ptr (vlan->pcpu_stats); }else {this_cpu_inc (vlan->pcpu_stats->rx_errors); }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 123/254 net: sched: validate stab values
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit e323d865b36134e8c5c82c834df89109a5c60dab ]
iproute2 package is well behaved, but malicious user space can provide illegal shift values and trigger UBSAN reports.
Add stab parameter to red_check_params() to validate user input.
syzbot reported:
UBSAN: shift-out-of-bounds in ./include/net/red.h:312:18 shift exponent 111 is too large for 64-bit type 'long unsigned int' CPU: 1 PID: 14662 Comm: syz-executor.3 Not tainted 5.12.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 red_calc_qavg_from_idle_time include/net/red.h:312 [inline] red_calc_qavg include/net/red.h:353 [inline] choke_enqueue.cold+0x18/0x3dd net/sched/sch_choke.c:221 __dev_xmit_skb net/core/dev.c:3837 [inline] __dev_queue_xmit+0x1943/0x2e00 net/core/dev.c:4150 neigh_hh_output include/net/neighbour.h:499 [inline] neigh_output include/net/neighbour.h:508 [inline] ip6_finish_output2+0x911/0x1700 net/ipv6/ip6_output.c:117 __ip6_finish_output net/ipv6/ip6_output.c:182 [inline] __ip6_finish_output+0x4c1/0xe10 net/ipv6/ip6_output.c:161 ip6_finish_output+0x35/0x200 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] NF_HOOK include/linux/netfilter.h:295 [inline] ip6_xmit+0x127e/0x1eb0 net/ipv6/ip6_output.c:320 inet6_csk_xmit+0x358/0x630 net/ipv6/inet6_connection_sock.c:135 dccp_transmit_skb+0x973/0x12c0 net/dccp/output.c:138 dccp_send_reset+0x21b/0x2b0 net/dccp/output.c:535 dccp_finish_passive_close net/dccp/proto.c:123 [inline] dccp_finish_passive_close+0xed/0x140 net/dccp/proto.c:118 dccp_terminate_connection net/dccp/proto.c:958 [inline] dccp_close+0xb3c/0xe60 net/dccp/proto.c:1028 inet_release+0x12e/0x280 net/ipv4/af_inet.c:431 inet6_release+0x4c/0x70 net/ipv6/af_inet6.c:478 __sock_release+0xcd/0x280 net/socket.c:599 sock_close+0x18/0x20 net/socket.c:1258 __fput+0x288/0x920 fs/file_table.c:280 task_work_run+0xdd/0x1a0 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
--- include/net/red.h | 10 +++++++++- net/sched/sch_choke.c | 7 ++++--- net/sched/sch_gred.c | 2 +- net/sched/sch_red.c | 7 +++++-- net/sched/sch_sfq.c | 2 +- 5 files changed, 20 insertions(+), 8 deletions(-)
include/net/red.h +9 -1
@@ -168,7 +168,8 @@ static inline void red_set_vars(struct red_vars *v) v->qcount =-1 ; } -static inline bool red_check_params (u32 qth_min,u32 qth_max,u8 Wlog,u8 Scell_log) +static inline bool red_check_params (u32 qth_min,u32 qth_max,u8 Wlog, +u8 Scell_log,u8 *stab) {if (fls (qth_min) + Wlog >32 )return false;
@@ -178,6 +179,13 @@ static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_return false;if (qth_max < qth_min)return false; +if (stab) { +int i; + +for (i =0 ; i <RED_STAB_SIZE ; i++) +if (stab[i] >=32 ) +return false; + }return true; }
net/sched/sch_choke.c +4 -3
@@ -345,6 +345,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt,struct sk_buff **old =NULL ;unsigned int mask;u32 max_P; +u8 *stab;if (opt ==NULL )return -EINVAL ;
@@ -361,8 +362,8 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, max_P = tb[TCA_CHOKE_MAX_P ] ?nla_get_u32 (tb[TCA_CHOKE_MAX_P ]) :0 ; ctl =nla_data (tb[TCA_CHOKE_PARMS ]); - -if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) + stab =nla_data (tb[TCA_CHOKE_STAB ]); +if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab))return -EINVAL ;if (ctl->limit >CHOKE_MAX_QUEUE )
@@ -412,7 +413,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt,red_set_parms (&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Plog, ctl->Scell_log, -nla_data (tb[TCA_CHOKE_STAB ]), + stab, max_P);red_set_vars (&q->vars);
net/sched/sch_gred.c +1 -1
@@ -480,7 +480,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,struct gred_sched *table =qdisc_priv (sch);struct gred_sched_data *q = table->tab[dp]; -if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) { +if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab)) {NL_SET_ERR_MSG_MOD (extack,"invalid RED parameters" );return -EINVAL ; }
net/sched/sch_red.c +5 -2
@@ -242,6 +242,7 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb,unsigned char flags;int err;u32 max_P; +u8 *stab;if (tb[TCA_RED_PARMS ] ==NULL || tb[TCA_RED_STAB ] ==NULL )
@@ -250,7 +251,9 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb, max_P = tb[TCA_RED_MAX_P ] ?nla_get_u32 (tb[TCA_RED_MAX_P ]) :0 ; ctl =nla_data (tb[TCA_RED_PARMS ]); -if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) + stab =nla_data (tb[TCA_RED_STAB ]); +if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, + ctl->Scell_log, stab))return -EINVAL ; err = red_get_flags(ctl->flags, TC_RED_HISTORIC_FLAGS,
@@ -288,7 +291,7 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb,red_set_parms (&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Plog, ctl->Scell_log, -nla_data (tb[TCA_RED_STAB ]), + stab, max_P);red_set_vars (&q->vars);
net/sched/sch_sfq.c +1 -1
@@ -647,7 +647,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) }if (ctl_v1 && !red_check_params (ctl_v1->qth_min, ctl_v1->qth_max, - ctl_v1->Wlog, ctl_v1->Scell_log)) + ctl_v1->Wlog, ctl_v1->Scell_log,NULL ))return -EINVAL ;if (ctl_v1 && ctl_v1->qth_min) { p =kmalloc (sizeof (*p),GFP_KERNEL );
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 124/254 net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 47142ed6c34d544ae9f0463e58d482289cbe0d46 ]
Similar to commit 92696286f3bb37ba50e4bd8d1beb24afb759a799 ("net:
bcmgenet: Set phydev->dev_flags only for internal PHYs") we need to qualify the phydev->dev_flags based on whether the port is connected to an internal or external PHY otherwise we risk having a flags collision with a completely different interpretation depending on the driver.
--- drivers/net/dsa/bcm_sf2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/dsa/bcm_sf2.c +4 -2
@@ -584,8 +584,10 @@ static u32 bcm_sf2_sw_get_phy_flags(struct dsa_switch *ds, int port)* in bits 15:8 and the patch level in bits 7:0 which is exactly what * the REG_PHY_REVISION register layout is. */ - -return priv->hw_params.gphy_rev; +if (priv->int_phy_mask &BIT (port)) +return priv->hw_params.gphy_rev; +else +return 0 ; } static void bcm_sf2_sw_validate(struct dsa_switch *ds, int port,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 125/254 igc: reinit_locked() should be called with rtnl_lock
In reply to Greg Kroah-HartmanFrom: Sasha Neftin <[email protected]>
[ Upstream commit 6da262378c99b17b1a1ac2e42aa65acc1bd471c7 ]
This commit applies to the igc_reset_task the same changes that were applied to the igb driver in commit 024a8168b749 ("igb:reinit_locked() should be called with rtnl_lock")
and fix possible race in reset subtask.
--- drivers/net/ethernet/intel/igc/igc_main.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/ethernet/intel/igc/igc_main.c +9 -0
@@ -3847,10 +3847,19 @@ static void igc_reset_task(struct work_struct *work) adapter = container_of(work, struct igc_adapter, reset_task); +rtnl_lock (); +/* If we're already down or resetting, just bail */ +if (test_bit (__IGC_DOWN, &adapter->state) || +test_bit (__IGC_RESETTING, &adapter->state)) { +rtnl_unlock (); +return ; + } +igc_rings_dump (adapter);igc_regs_dump (adapter);netdev_err (adapter->netdev,"Reset adapter\n" );igc_reinit_locked (adapter); +rtnl_unlock (); }/**
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 126/254 igc: Fix Pause Frame Advertising
In reply to Greg Kroah-HartmanFrom: Muhammad Husaini Zulkifli <[email protected]>
[ Upstream commit 8876529465c368beafd51a70f79d7a738f2aadf4 ]
Fix Pause Frame Advertising when getting the advertisement via ethtool. Remove setting the "advertising" bit in link_ksettings during default case when Tx and Rx are in off state with Auto Negotiate off.
Below is the original output of advertisement link during Tx and Rx off:
Advertised pause frame use: Symmetric Receive-only
Expected output:
Advertised pause frame use: No
--- drivers/net/ethernet/intel/igc/igc_ethtool.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/intel/igc/igc_ethtool.c +1 -3
@@ -1709,9 +1709,7 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev, Asym_Pause);break ;default : -ethtool_link_ksettings_add_link_mode (cmd, advertising, Pause); -ethtool_link_ksettings_add_link_mode (cmd, advertising, - Asym_Pause); +break ; } status = pm_runtime_suspended(&adapter->pdev->dev) ?
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 127/254 igc: Fix Supported Pause Frame Link Setting
In reply to Greg Kroah-HartmanFrom: Muhammad Husaini Zulkifli <[email protected]>
[ Upstream commit 9a4a1cdc5ab52118c1f2b216f4240830b6528d32 ]
The Supported Pause Frame always display "No" even though the Advertised pause frame showing the correct setting based on the pause parameters via ethtool. Set bit in link_ksettings to "Supported" for Pause Frame.
Before output:
Supported pause frame use: No
Expected output:
Supported pause frame use: Symmetric
--- drivers/net/ethernet/intel/igc/igc_ethtool.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/intel/igc/igc_ethtool.c +3 -0
@@ -1695,6 +1695,9 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev, Autoneg); } +/* Set pause flow control settings */ +ethtool_link_ksettings_add_link_mode (cmd, supported, Pause); +switch (hw->fc.requested_mode) {case igc_fc_full:ethtool_link_ksettings_add_link_mode (cmd, advertising, Pause);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 128/254 igc: Fix igc_ptp_rx_pktstamp()
In reply to Greg Kroah-HartmanFrom: Andre Guedes <[email protected]>
[ Upstream commit fc9e5020971d57d7d0b3fef9e2ab2108fcb5588b ]
The comment describing the timestamps layout in the packet buffer is wrong and the code is actually retrieving the timestamp in Timer 1 reference instead of Timer 0. This hasn't been a big issue so far because hardware is configured to report both timestamps using Timer 0 (see IGC_SRRCTL register configuration in igc_ptp_enable_rx_timestamp() helper). This patch fixes the comment and the code so we retrieve the timestamp in Timer 0 reference as expected.
This patch also takes the opportunity to get rid of the hw.mac.type check since it is not required.
--- drivers/net/ethernet/intel/igc/igc.h | 2 +- drivers/net/ethernet/intel/igc/igc_ptp.c | 72 +++++++++++++----------- 2 files changed, 41 insertions(+), 33 deletions(-)
drivers/net/ethernet/intel/igc/igc.h +1 -1
@@ -545,7 +545,7 @@ void igc_ptp_init(struct igc_adapter *adapter);void igc_ptp_reset (struct igc_adapter *adapter);void igc_ptp_suspend (struct igc_adapter *adapter);void igc_ptp_stop (struct igc_adapter *adapter); -void igc_ptp_rx_pktstamp (struct igc_q_vector *q_vector,void *va, +void igc_ptp_rx_pktstamp (struct igc_q_vector *q_vector,__le32 *va,struct sk_buff *skb);int igc_ptp_set_ts_config (struct net_device *netdev,struct ifreq *ifr);int igc_ptp_get_ts_config (struct net_device *netdev,struct ifreq *ifr);
drivers/net/ethernet/intel/igc/igc_ptp.c +40 -32
86 lines not on this page · raw message
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 129/254 e1000e: add rtnl_lock() to e1000_reset_task
In reply to Greg Kroah-HartmanFrom: Vitaly Lifshits <[email protected]>
[ Upstream commit 21f857f0321d0d0ea9b1a758bd55dc63d1cb2437 ]
A possible race condition was found in e1000_reset_task, after discovering a similar issue in igb driver via commit 024a8168b749 ("igb: reinit_locked() should be called with rtnl_lock").
Added rtnl_lock() and rtnl_unlock() to avoid this.
--- drivers/net/ethernet/intel/e1000e/netdev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/e1000e/netdev.c +5 -1
@@ -5974,15 +5974,19 @@ static void e1000_reset_task(struct work_struct *work)struct e1000_adapter *adapter; adapter = container_of(work, struct e1000_adapter, reset_task); +rtnl_lock ();/* don't run the task if already down */ -if (test_bit (__E1000_DOWN, &adapter->state)) +if (test_bit (__E1000_DOWN, &adapter->state)) { +rtnl_unlock ();return ; + }if (!(adapter->flags &FLAG_RESTART_NOW )) {e1000e_dump (adapter);e_err ("Reset adapter unexpectedly\n" ); }e1000e_reinit_locked (adapter); +rtnl_unlock (); }/**
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 130/254 e1000e: Fix error handling in e1000_set_d0_lplu_state_82571
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit b52912b8293f2c496f42583e65599aee606a0c18 ]
There is one e1e_wphy() call in e1000_set_d0_lplu_state_82571 that we have caught its return value but lack further handling. Check and terminate the execution flow just like other e1e_wphy() in this function.
--- drivers/net/ethernet/intel/e1000e/82571.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/intel/e1000e/82571.c +2 -0
@@ -899,6 +899,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active) }else { data &= ~IGP02E1000_PM_D0_LPLU ; ret_val =e1e_wphy (hw,IGP02E1000_PHY_POWER_MGMT , data); +if (ret_val) +return ret_val;/* LPLU and SmartSpeed are mutually exclusive. LPLU is used * during Dx states where the power conservation is most * important. During driver activity we should enable
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 131/254 kunit: tool: Disable PAGE_POISONING under --alltests
In reply to Greg Kroah-HartmanFrom: David Gow <[email protected]>
[ Upstream commit 7fd53f41f771d250eb08db08650940f017e37c26 ]
kunit_tool maintains a list of config options which are broken under UML, which we exclude from an otherwise 'make ARCH=um allyesconfig' build used to run all tests with the --alltests option.
Something in UML allyesconfig is causing segfaults when page poisining is enabled (and is poisoning with a non-zero value). Previously, this didn't occur, as allyesconfig enabled the CONFIG_PAGE_POISONING_ZERO option, which worked around the problem by zeroing memory. This option has since been removed, and memory is now poisoned with 0xAA, which triggers segfaults in many different codepaths, preventing UML from booting.
Note that we have to disable both CONFIG_PAGE_POISONING and CONFIG_DEBUG_PAGEALLOC, as the latter will 'select' the former on architectures (such as UML) which don't implement __kernel_map_pages().
Ideally, we'd fix this properly by tracking down the real root cause, but since this is breaking KUnit's --alltests feature, it's worth disabling there in the meantime so the kernel can boot to the point where tests can actually run.
--- tools/testing/kunit/configs/broken_on_uml.config | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/kunit/configs/broken_on_uml.config +2 -0
@@ -40,3 +40,5 @@ # CONFIG_RESET_BRCMSTB_RESCAL is not set # CONFIG_RESET_INTEL_GW is not set # CONFIG_ADI_AXI_ADC is not set +# CONFIG_DEBUG_PAGEALLOC is not set +# CONFIG_PAGE_POISONING is not set
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 132/254 net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit db74623a3850db99cb9692fda9e836a56b74198d ]
In qlcnic_83xx_get_minidump_template, fw_dump->tmpl_hdr was freed by vfree(). But unfortunately, it is used when extended is true.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +3 -0
@@ -1425,6 +1425,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)if (fw_dump->tmpl_hdr ==NULL || current_version > prev_version) {vfree (fw_dump->tmpl_hdr); + fw_dump->tmpl_hdr =NULL ;if (qlcnic_83xx_md_check_extended_dump_capability (adapter)) extended = !qlcnic_83xx_extend_md_capab (adapter);
@@ -1443,6 +1444,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)struct qlcnic_83xx_dump_template_hdr *hdr; hdr = fw_dump->tmpl_hdr; +if (!hdr) +return ; hdr->drv_cap_mask =0x1f ; fw_dump->cap_mask =0x1f ; dev_info(&pdev->dev,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 133/254 net: phy: broadcom: Add power down exit reset state delay
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 7a1468ba0e02eee24ae1353e8933793a27198e20 ]
Per the datasheet, when we clear the power down bit, the PHY remains in an internal reset state for 40us and then resume normal operation. Account for that delay to avoid any issues in the future if genphy_resume() changes.
--- drivers/net/phy/broadcom.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/phy/broadcom.c +5 -0
@@ -332,6 +332,11 @@ static int bcm54xx_resume(struct phy_device *phydev)if (ret <0 )return ret; +/* Upon exiting power down, the PHY remains in an internal reset state +* for 40us +*/ +fsleep (40 ); +return bcm54xx_config_init (phydev); }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 134/254 ice: fix napi work done reporting in xsk path
In reply to Greg Kroah-HartmanFrom: Magnus Karlsson <[email protected]>
[ Upstream commit ed0907e3bdcfc7fe1c1756a480451e757b207a69 ]
Fix the wrong napi work done reporting in the xsk path of the ice driver. The code in the main Rx processing loop was written to assume that the buffer allocation code returns true if all allocations where successful and false if not. In contrast with all other Intel NIC xsk drivers, the ice_alloc_rx_bufs_zc() has the inverted logic messing up the work done reporting in the napi loop.
This can be fixed either by inverting the return value from ice_alloc_rx_bufs_zc() in the function that uses this in an incorrect way, or by changing the return value of ice_alloc_rx_bufs_zc(). We chose the latter as it makes all the xsk allocation functions for Intel NICs behave in the same way. My guess is that it was this unexpected discrepancy that gave rise to this bug in the first place.
--- drivers/net/ethernet/intel/ice/ice_base.c | 6 ++++-- drivers/net/ethernet/intel/ice/ice_xsk.c | 10 +++++----- 2 files changed, 9 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/ice/ice_base.c +4 -2
@@ -418,6 +418,8 @@ int ice_setup_rx_ctx(struct ice_ring *ring)writel (0 , ring->tail);if (ring->xsk_pool) { +bool ok; +if (!xsk_buff_can_alloc (ring->xsk_pool, num_bufs)) {dev_warn (dev,"XSK buffer pool does not provide enough addresses to fill %d buffers on Rx ring %d\n" , num_bufs, ring->q_index);
@@ -426,8 +428,8 @@ int ice_setup_rx_ctx(struct ice_ring *ring)return 0 ; } - err =ice_alloc_rx_bufs_zc (ring, num_bufs); -if (err) + ok =ice_alloc_rx_bufs_zc (ring, num_bufs); +if (!ok)dev_info (dev,"Failed to allocate some buffers on XSK buffer pool enabled Rx ring %d (pf_q %d)\n" , ring->q_index, pf_q);return 0 ;
drivers/net/ethernet/intel/ice/ice_xsk.c +5 -5
@@ -408,18 +408,18 @@ xsk_pool_if_up:* This function allocates a number of Rx buffers from the fill ring * or the internal recycle mechanism and places them on the Rx ring. * -* Returns false if all allocations were successful, true if any fail. +* Returns true if all allocations were successful, false if any fail. */ bool ice_alloc_rx_bufs_zc (struct ice_ring *rx_ring,u16 count) {union ice_32b_rx_flex_desc *rx_desc;u16 ntu = rx_ring->next_to_use;struct ice_rx_buf *rx_buf; -bool ret = false; +bool ok = true;dma_addr_t dma;if (!count) -return false; +return true; rx_desc =ICE_RX_DESC (rx_ring, ntu); rx_buf = &rx_ring->rx_buf[ntu];
@@ -427,7 +427,7 @@ bool ice_alloc_rx_bufs_zc(struct ice_ring *rx_ring, u16 count) do { rx_buf->xdp = xsk_buff_alloc(rx_ring->xsk_pool); if (!rx_buf->xdp) { - ret = true; + ok = false; break; }
@@ -452,7 +452,7 @@ bool ice_alloc_rx_bufs_zc(struct ice_ring *rx_ring, u16 count)ice_release_rx_desc (rx_ring, ntu); } -return ret; +return ok; }/**
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 135/254 ftgmac100: Restart MAC HW once
In reply to Greg Kroah-HartmanFrom: Dylan Hung <[email protected]>
[ Upstream commit 6897087323a2fde46df32917462750c069668b2f ]
The interrupt handler may set the flag to reset the mac in the future, but that flag is not cleared once the reset has occurred.
--- drivers/net/ethernet/faraday/ftgmac100.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/faraday/ftgmac100.c +1 -0
@@ -1337,6 +1337,7 @@ static int ftgmac100_poll(struct napi_struct *napi, int budget)*/ if (unlikely (priv->need_mac_restart)) {ftgmac100_start_hw (priv); + priv->need_mac_restart = false;/* Re-enable "bad" interrupts */ iowrite32(FTGMAC100_INT_BAD,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 136/254 clk: qcom: gcc-sc7180: Use floor ops for the correct sdcc1 clk
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
[ Upstream commit 148ddaa89d4a0a927c4353398096cc33687755c1 ]
While picking commit a8cd989e1a57 ("mmc: sdhci-msm: Warn about overclocking SD/MMC") back to my tree I was surprised that it was reporting warnings. I thought I fixed those! Looking closer at the fix, I see that I totally bungled it (or at least I halfway bungled it). The SD card clock got fixed (and that was the one I was really focused on fixing), but I totally adjusted the wrong clock for eMMC. Sigh. Let's fix my dumb mistake.
Now both SD and eMMC have floor for the "apps" clock.
This doesn't matter a lot for the final clock rate for HS400 eMMC but could matter if someone happens to put some slower eMMC on a sc7180. We also transition through some of these lower rates sometimes and having them wrong could cause problems during these transitions. These were the messages I was seeing at boot:
mmc1: Card appears overclocked; req 52000000 Hz, actual 100000000 Hz
mmc1: Card appears overclocked; req 52000000 Hz, actual 100000000 Hz
mmc1: Card appears overclocked; req 104000000 Hz, actual 192000000 Hz
--- drivers/clk/qcom/gcc-sc7180.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/qcom/gcc-sc7180.c +2 -2
@@ -620,7 +620,7 @@ static struct clk_rcg2 gcc_sdcc1_apps_clk_src = { .name = "gcc_sdcc1_apps_clk_src", .parent_data = gcc_parent_data_1, .num_parents = 5, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_floor_ops, }, };
@@ -642,7 +642,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = { .name = "gcc_sdcc1_ice_core_clk_src", .parent_data = gcc_parent_data_0, .num_parents = 4, - .ops = &clk_rcg2_floor_ops, + .ops = &clk_rcg2_ops, }, };
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 137/254 net: ipa: terminate message handler arrays
In reply to Greg Kroah-HartmanFrom: Alex Elder <[email protected]>
[ Upstream commit 3a9ef3e11c5d33e5cb355b4aad1a4caad2407541 ]
When a QMI handle is initialized, an array of message handler structures is provided, defining how any received message should be handled based on its type and message ID. The QMI core code traverses this array when a message arrives and calls the function associated with the (type, msg_id) found in the array.
The array is supposed to be terminated with an empty (all zero) entry though. Without it, an unsupported message will cause the QMI core code to go past the end of the array.
Fix this bug, by properly terminating the message handler arrays provided when QMI handles are set up by the IPA driver.
--- drivers/net/ipa/ipa_qmi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ipa/ipa_qmi.c +2 -0
@@ -249,6 +249,7 @@ static const struct qmi_msg_handler ipa_server_msg_handlers[] = { .decoded_size = IPA_QMI_DRIVER_INIT_COMPLETE_REQ_SZ, .fn = ipa_server_driver_init_complete, }, + { }, };/* Handle an INIT_DRIVER response message from the modem. */
@@ -269,6 +270,7 @@ static const struct qmi_msg_handler ipa_client_msg_handlers[] = { .decoded_size = IPA_QMI_INIT_DRIVER_RSP_SZ, .fn = ipa_client_init_driver, }, + { }, };/* Return a pointer to an init modem driver request structure, which contains
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 138/254 net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 50535249f624d0072cd885bcdce4e4b6fb770160 ]
struct sockaddr_qrtr has a 2-byte hole, and qrtr_recvmsg() currently does not clear it before copying kernel data to user space.
It might be too late to name the hole since sockaddr_qrtr structure is uapi.
BUG: KMSAN: kernel-infoleak in kmsan_copy_to_user+0x9c/0xb0 mm/kmsan/kmsan_hooks.c:249 CPU: 0 PID: 29705 Comm: syz-executor.3 Not tainted 5.11.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 kmsan_internal_check_memory+0x202/0x520 mm/kmsan/kmsan.c:402 kmsan_copy_to_user+0x9c/0xb0 mm/kmsan/kmsan_hooks.c:249 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0x1ac/0x270 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:209 [inline] move_addr_to_user+0x3a2/0x640 net/socket.c:237 ____sys_recvmsg+0x696/0xd50 net/socket.c:2575 ___sys_recvmsg net/socket.c:2610 [inline] do_recvmmsg+0xa97/0x22d0 net/socket.c:2710 __sys_recvmmsg net/socket.c:2789 [inline] __do_sys_recvmmsg net/socket.c:2812 [inline] __se_sys_recvmmsg+0x24a/0x410 net/socket.c:2805 __x64_sys_recvmmsg+0x62/0x80 net/socket.c:2805 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x465f69 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f43659d6188 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 RDX: 0000000000000008 RSI: 0000000020003e40 RDI: 0000000000000003 RBP: 00000000004bfa8f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000010060 R11: 0000000000000246 R12: 000000000056bf60 R13: 0000000000a9fb1f R14: 00007f43659d6300 R15: 0000000000022000
Local variable ----addr@____sys_recvmsg created at:
____sys_recvmsg+0x168/0xd50 net/socket.c:2550 ____sys_recvmsg+0x168/0xd50 net/socket.c:2550
Bytes 2-3 of 12 are uninitialized
Memory access of size 12 starts at ffff88817c627b40 Data copied to user address 0000000020000140
--- net/qrtr/qrtr.c | 5 +++++ 1 file changed, 5 insertions(+)
net/qrtr/qrtr.c +5 -0
@@ -1058,6 +1058,11 @@ static int qrtr_recvmsg(struct socket *sock, struct msghdr *msg, rc = copied;if (addr) { +/* There is an anonymous 2-byte hole after sq_family, +* make sure to clear it. +*/ +memset (addr,0 ,sizeof (*addr)); + addr->sq_family =AF_QIPCRTR ; addr->sq_node = cb->src_node; addr->sq_port = cb->src_port;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 139/254 flow_dissector: fix byteorder of dissected ICMP ID
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
[ Upstream commit a25f822285420486f5da434efc8d940d42a83bce ]
flow_dissector_key_icmp::id is of type u16 (CPU byteorder), ICMP header has its ID field in network byteorder obviously. Sparse says:
net/core/flow_dissector.c:178:43: warning: restricted __be16 degrades to integer
Convert ID value to CPU byteorder when storing it into flow_dissector_key_icmp.
--- net/core/flow_dissector.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/flow_dissector.c +1 -1
@@ -175,7 +175,7 @@ void skb_flow_get_icmp_tci(const struct sk_buff *skb,* avoid confusion with packets without such field */ if (icmp_has_id (ih->type)) - key_icmp->id = ih->un.echo.id ? :1 ; + key_icmp->id = ih->un.echo.id ?ntohs (ih->un.echo.id) :1 ;else key_icmp->id =0 ; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 140/254 selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit 31254dc9566221429d2cfb45fd5737985d70f2b6 ]
When fixing the bpf test_tunnel.sh geneve failure. I only fixed the IPv4 part but forgot the IPv6 issue. Similar with the IPv4 fixes 557c223b643a ("selftests/bpf: No need to drop the packet when there is no geneve opt"), when there is no tunnel option and bpf_skb_get_tunnel_opt() returns error, there is no need to drop the packets and break all geneve rx traffic. Just set opt_class to 0 and keep returning TC_ACT_OK at the end.
--- tools/testing/selftests/bpf/progs/test_tunnel_kern.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
tools/testing/selftests/bpf/progs/test_tunnel_kern.c +2 -4
@@ -508,10 +508,8 @@ int _ip6geneve_get_tunnel(struct __sk_buff *skb) } ret =bpf_skb_get_tunnel_opt (skb, &gopt,sizeof (gopt)); -if (ret <0 ) { -ERROR (ret); -return TC_ACT_SHOT ; - } +if (ret <0 ) + gopt.opt_class =0 ;bpf_trace_printk (fmt,sizeof (fmt), key.tunnel_id, key.remote_ipv4, gopt.opt_class);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 141/254 netfilter: ctnetlink: fix dump of the expect mask attribute
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit b58f33d49e426dc66e98ed73afb5d97b15a25f2d ]
Before this change, the mask is never included in the netlink message, so "conntrack -E expect" always prints 0.0.0.0.
In older kernels the l3num callback struct was passed as argument, based on tuple->src.l3num. After the l3num indirection got removed, the call chain is based on m.src.l3num, but this value is 0xffff.
Init l3num to the correct value.
--- net/netfilter/nf_conntrack_netlink.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nf_conntrack_netlink.c +1 -0
@@ -2969,6 +2969,7 @@ static int ctnetlink_exp_dump_mask(struct sk_buff *skb,memset (&m,0xFF ,sizeof (m));memcpy (&m.src.u3, &mask->src.u3,sizeof (m.src.u3)); m.src.u.all = mask->src.u.all; + m.src.l3num = tuple->src.l3num; m.dst.protonum = tuple->dst.protonum; nest_parms =nla_nest_start (skb,CTA_EXPECT_MASK );
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 142/254 net: hdlc_x25: Prevent racing between "x25_close" and "x25_xmit"/"x25_rx"
In reply to Greg Kroah-HartmanFrom: Xie He <[email protected]>
[ Upstream commit bf0ffea336b493c0a8c8bc27b46683ecf1e8f294 ]
"x25_close" is called by "hdlc_close" in "hdlc.c", which is called by hardware drivers' "ndo_stop" function.
"x25_xmit" is called by "hdlc_start_xmit" in "hdlc.c", which is hardware drivers' "ndo_start_xmit" function.
"x25_rx" is called by "hdlc_rcv" in "hdlc.c", which receives HDLC frames from "net/core/dev.c".
"x25_close" races with "x25_xmit" and "x25_rx" because their callers race.
However, we need to ensure that the LAPB APIs called in "x25_xmit" and "x25_rx" are called before "lapb_unregister" is called in "x25_close".
This patch adds locking to ensure when "x25_xmit" and "x25_rx" are doing their work, "lapb_unregister" is not yet called in "x25_close".
Reasons for not solving the racing between "x25_close" and "x25_xmit" by calling "netif_tx_disable" in "x25_close":
1. We still need to solve the racing between "x25_close" and "x25_rx";
2. The design of the HDLC subsystem assumes the HDLC hardware drivers have full control over the TX queue, and the HDLC protocol drivers (like this driver) have no control. Controlling the queue here in the protocol driver may interfere with hardware drivers' control of the queue.
--- drivers/net/wan/hdlc_x25.c | 42 +++++++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-)
drivers/net/wan/hdlc_x25.c +41 -1
@@ -23,6 +23,8 @@struct x25_state {x25_hdlc_proto settings; +bool up; +spinlock_t up_lock;/* Protects "up" */ };static int x25_ioctl (struct net_device *dev,struct ifreq *ifr);
@@ -104,6 +106,8 @@ static void x25_data_transmit(struct net_device *dev, struct sk_buff *skb)static netdev_tx_t x25_xmit (struct sk_buff *skb,struct net_device *dev) { +hdlc_device *hdlc =dev_to_hdlc (dev); +struct x25_state *x25st =state (hdlc);int result;/* There should be a pseudo header of 1 byte added by upper layers.
@@ -114,11 +118,19 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)return NETDEV_TX_OK ; } +spin_lock_bh (&x25st->up_lock); +if (!x25st->up) { +spin_unlock_bh (&x25st->up_lock); +kfree_skb (skb); +return NETDEV_TX_OK ; + } +switch (skb->data[0 ]) {case X25_IFACE_DATA :/* Data to be transmitted */ skb_pull (skb,1 );if ((result =lapb_data_request (dev, skb)) !=LAPB_OK )dev_kfree_skb (skb); +spin_unlock_bh (&x25st->up_lock);return NETDEV_TX_OK ;case X25_IFACE_CONNECT :
@@ -147,6 +159,7 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)break ; } +spin_unlock_bh (&x25st->up_lock);dev_kfree_skb (skb);return NETDEV_TX_OK ; }
@@ -164,6 +177,7 @@ static int x25_open(struct net_device *dev) .data_transmit = x25_data_transmit, };hdlc_device *hdlc =dev_to_hdlc (dev); +struct x25_state *x25st =state (hdlc);struct lapb_parms_struct params;int result;
@@ -190,6 +204,10 @@ static int x25_open(struct net_device *dev)if (result !=LAPB_OK )return -EINVAL ; +spin_lock_bh (&x25st->up_lock); + x25st->up = true; +spin_unlock_bh (&x25st->up_lock); +return 0 ; }
@@ -197,6 +215,13 @@ static int x25_open(struct net_device *dev)static void x25_close (struct net_device *dev) { +hdlc_device *hdlc =dev_to_hdlc (dev); +struct x25_state *x25st =state (hdlc); + +spin_lock_bh (&x25st->up_lock); + x25st->up = false; +spin_unlock_bh (&x25st->up_lock); +lapb_unregister (dev); }
@@ -205,15 +230,28 @@ static void x25_close(struct net_device *dev)static int x25_rx (struct sk_buff *skb) {struct net_device *dev = skb->dev; +hdlc_device *hdlc =dev_to_hdlc (dev); +struct x25_state *x25st =state (hdlc);if ((skb =skb_share_check (skb,GFP_ATOMIC )) ==NULL ) { dev->stats.rx_dropped++;return NET_RX_DROP ; } -if (lapb_data_received (dev, skb) ==LAPB_OK ) +spin_lock_bh (&x25st->up_lock); +if (!x25st->up) { +spin_unlock_bh (&x25st->up_lock); +kfree_skb (skb); + dev->stats.rx_dropped++; +return NET_RX_DROP ; + } + +if (lapb_data_received (dev, skb) ==LAPB_OK ) { +spin_unlock_bh (&x25st->up_lock);return NET_RX_SUCCESS ; + } +spin_unlock_bh (&x25st->up_lock); dev->stats.rx_errors++;dev_kfree_skb_any (skb);return NET_RX_DROP ;
@@ -298,6 +336,8 @@ static int x25_ioctl(struct net_device *dev, struct ifreq *ifr)return result;memcpy (&state (hdlc)->settings, &new_settings, size); +state (hdlc)->up = false; +spin_lock_init (&state (hdlc)->up_lock);/* There's no header_ops so hard_header_len should be 0. */ dev->hard_header_len =0 ;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 143/254 net: phylink: Fix phylink_err() function name error in phylink_major_config
In reply to Greg Kroah-HartmanFrom: Ong Boon Leong <[email protected]>
[ Upstream commit d82c6c1aaccd2877b6082cebcb1746a13648a16d ]
if pl->mac_ops->mac_finish() failed, phylink_err should use "mac_finish" instead of "mac_prepare".
--- drivers/net/phy/phylink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/phy/phylink.c +1 -1
@@ -472,7 +472,7 @@ static void phylink_major_config(struct phylink *pl, bool restart, err = pl->mac_ops->mac_finish (pl->config, pl->cur_link_an_mode, state->interface);if (err <0 ) -phylink_err (pl,"mac_prepare failed: %pe\n" , +phylink_err (pl,"mac_finish failed: %pe\n" ,ERR_PTR (err)); } }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 144/254 tipc: better validate user input in tipc_nl_retrieve_key()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 0217ed2848e8538bcf9172d97ed2eeb4a26041bb ]
Before calling tipc_aead_key_size(ptr), we need to ensure we have enough data to dereference ptr->keylen.
We probably also want to make sure tipc_aead_key_size() wont overflow with malicious ptr->keylen values.
Syzbot reported:
BUG: KMSAN: uninit-value in __tipc_nl_node_set_key net/tipc/node.c:2971 [inline] BUG: KMSAN: uninit-value in tipc_nl_node_set_key+0x9bf/0x13b0 net/tipc/node.c:3023 CPU: 0 PID: 21060 Comm: syz-executor.5 Not tainted 5.11.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197 __tipc_nl_node_set_key net/tipc/node.c:2971 [inline] tipc_nl_node_set_key+0x9bf/0x13b0 net/tipc/node.c:3023 genl_family_rcv_msg_doit net/netlink/genetlink.c:739 [inline] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] genl_rcv_msg+0x1319/0x1610 net/netlink/genetlink.c:800 netlink_rcv_skb+0x6fa/0x810 net/netlink/af_netlink.c:2494 genl_rcv+0x63/0x80 net/netlink/genetlink.c:811 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline] netlink_unicast+0x11d6/0x14a0 net/netlink/af_netlink.c:1330 netlink_sendmsg+0x1740/0x1840 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg net/socket.c:672 [inline] ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2345 ___sys_sendmsg net/socket.c:2399 [inline] __sys_sendmsg+0x714/0x830 net/socket.c:2432 __compat_sys_sendmsg net/compat.c:347 [inline] __do_compat_sys_sendmsg net/compat.c:354 [inline] __se_compat_sys_sendmsg+0xa7/0xc0 net/compat.c:351 __ia32_compat_sys_sendmsg+0x4a/0x70 net/compat.c:351 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x102/0x160 arch/x86/entry/common.c:141 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:166 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:209 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f60549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f555a5fc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000200 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_slab_alloc+0x8d/0xe0 mm/kmsan/kmsan_hooks.c:76 slab_alloc_node mm/slub.c:2907 [inline] __kmalloc_node_track_caller+0xa37/0x1430 mm/slub.c:4527 __kmalloc_reserve net/core/skbuff.c:142 [inline] __alloc_skb+0x2f8/0xb30 net/core/skbuff.c:210 alloc_skb include/linux/skbuff.h:1099 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1176 [inline] netlink_sendmsg+0xdbc/0x1840 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg net/socket.c:672 [inline] ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2345 ___sys_sendmsg net/socket.c:2399 [inline] __sys_sendmsg+0x714/0x830 net/socket.c:2432 __compat_sys_sendmsg net/compat.c:347 [inline] __do_compat_sys_sendmsg net/compat.c:354 [inline] __se_compat_sys_sendmsg+0xa7/0xc0 net/compat.c:351 __ia32_compat_sys_sendmsg+0x4a/0x70 net/compat.c:351 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x102/0x160 arch/x86/entry/common.c:141 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:166 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:209 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
--- net/tipc/node.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
net/tipc/node.c +8 -3
@@ -2895,17 +2895,22 @@ int tipc_nl_node_dump_monitor_peer(struct sk_buff *skb,#ifdef CONFIG_TIPC_CRYPTO static int tipc_nl_retrieve_key (struct nlattr **attrs, -struct tipc_aead_key **key) +struct tipc_aead_key **pkey) {struct nlattr *attr = attrs[TIPC_NLA_NODE_KEY ]; +struct tipc_aead_key *key;if (!attr)return -ENODATA ; - *key = (struct tipc_aead_key *)nla_data (attr); -if (nla_len (attr) <tipc_aead_key_size (*key)) +if (nla_len (attr) <sizeof (*key)) +return -EINVAL ; + key = (struct tipc_aead_key *)nla_data (attr); +if (key->keylen >TIPC_AEAD_KEYLEN_MAX || +nla_len (attr) <tipc_aead_key_size (key))return -EINVAL ; + *pkey = key;return 0 ; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 145/254 tcp: relookup sock for RST+ACK packets handled by obsolete req sock
In reply to Greg Kroah-HartmanFrom: Alexander Ovechkin <[email protected]>
[ Upstream commit 7233da86697efef41288f8b713c10c2499cffe85 ]
Currently tcp_check_req can be called with obsolete req socket for which big socket have been already created (because of CPU race or early demux assigning req socket to multiple packets in gro batch).
Commit e0f9759f530bf789e984 ("tcp: try to keep packet if SYN_RCV race is lost") added retry in case when tcp_check_req is called for PSH|ACK packet. But if client sends RST+ACK immediatly after connection being established (it is performing healthcheck, for example) retry does not occur. In that case tcp_check_req tries to close req socket, leaving big socket active.
--- include/net/inet_connection_sock.h | 2 +- net/ipv4/inet_connection_sock.c | 7 +++++-- net/ipv4/tcp_minisocks.c | 7 +++++-- 3 files changed, 11 insertions(+), 5 deletions(-)
include/net/inet_connection_sock.h +1 -1
@@ -284,7 +284,7 @@ static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk)return inet_csk_reqsk_queue_len (sk) >= sk->sk_max_ack_backlog; } -void inet_csk_reqsk_queue_drop (struct sock *sk,struct request_sock *req); +bool inet_csk_reqsk_queue_drop (struct sock *sk,struct request_sock *req);void inet_csk_reqsk_queue_drop_and_put (struct sock *sk,struct request_sock *req);static inline void inet_csk_prepare_for_destroy_sock (struct sock *sk)
net/ipv4/inet_connection_sock.c +5 -2
@@ -705,12 +705,15 @@ static bool reqsk_queue_unlink(struct request_sock *req)return found; } -void inet_csk_reqsk_queue_drop (struct sock *sk,struct request_sock *req) +bool inet_csk_reqsk_queue_drop (struct sock *sk,struct request_sock *req) { -if (reqsk_queue_unlink (req)) { +bool unlinked =reqsk_queue_unlink (req); + +if (unlinked) {reqsk_queue_removed (&inet_csk (sk)->icsk_accept_queue, req);reqsk_put (req); } +return unlinked; }EXPORT_SYMBOL (inet_csk_reqsk_queue_drop);
net/ipv4/tcp_minisocks.c +5 -2
@@ -804,8 +804,11 @@ embryonic_reset:tcp_reset (sk, skb); }if (!fastopen) { -inet_csk_reqsk_queue_drop (sk, req); -__NET_INC_STATS (sock_net (sk),LINUX_MIB_EMBRYONICRSTS ); +bool unlinked =inet_csk_reqsk_queue_drop (sk, req); + +if (unlinked) +__NET_INC_STATS (sock_net (sk),LINUX_MIB_EMBRYONICRSTS ); + *req_stolen = !unlinked; }return NULL ; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 146/254 mptcp: fix ADD_ADDR HMAC in case port is specified
In reply to Greg Kroah-HartmanFrom: Davide Caratti <[email protected]>
[ Upstream commit 13832ae2755395b2585500c85b64f5109a44227e ]
Currently, Linux computes the HMAC contained in ADD_ADDR sub-option using the Address Id and the IP Address, and hardcodes a destination port equal to zero. This is not ok for ADD_ADDR with port: ensure to account for the endpoint port when computing the HMAC, in compliance with RFC8684 §3.4.1.
--- net/mptcp/options.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-)
net/mptcp/options.c +14 -10
@@ -555,15 +555,15 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb, }static u64 add_addr_generate_hmac (u64 key1,u64 key2,u8 addr_id, -struct in_addr *addr) +struct in_addr *addr,u16 port) {u8 hmac[SHA256_DIGEST_SIZE ];u8 msg[7 ]; msg[0 ] = addr_id;memcpy (&msg[1 ], &addr->s_addr,4 ); - msg[5 ] =0 ; - msg[6 ] =0 ; + msg[5 ] = port >>8 ; + msg[6 ] = port &0xFF ;mptcp_crypto_hmac_sha (key1, key2, msg,7 , hmac);
@@ -572,15 +572,15 @@ static u64 add_addr_generate_hmac(u64 key1, u64 key2, u8 addr_id,#if IS_ENABLED (CONFIG_MPTCP_IPV6 )static u64 add_addr6_generate_hmac (u64 key1,u64 key2,u8 addr_id, -struct in6_addr *addr) +struct in6_addr *addr,u16 port) {u8 hmac[SHA256_DIGEST_SIZE ];u8 msg[19 ]; msg[0 ] = addr_id;memcpy (&msg[1 ], &addr->s6_addr,16 ); - msg[17 ] =0 ; - msg[18 ] =0 ; + msg[17 ] = port >>8 ; + msg[18 ] = port &0xFF ;mptcp_crypto_hmac_sha (key1, key2, msg,19 , hmac);
@@ -634,7 +634,8 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * opts->ahmac =add_addr_generate_hmac (msk->local_key, msk->remote_key, opts->addr_id, - &opts->addr); + &opts->addr, + opts->port); } }#if IS_ENABLED (CONFIG_MPTCP_IPV6 )
@@ -645,7 +646,8 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * opts->ahmac =add_addr6_generate_hmac (msk->local_key, msk->remote_key, opts->addr_id, - &opts->addr6); + &opts->addr6, + opts->port); } }#endif
@@ -922,12 +924,14 @@ static bool add_addr_hmac_valid(struct mptcp_sock *msk,if (mp_opt->family ==MPTCP_ADDR_IPVERSION_4 ) hmac =add_addr_generate_hmac (msk->remote_key, msk->local_key, - mp_opt->addr_id, &mp_opt->addr); + mp_opt->addr_id, &mp_opt->addr, + mp_opt->port);#if IS_ENABLED (CONFIG_MPTCP_IPV6 ) else hmac =add_addr6_generate_hmac (msk->remote_key, msk->local_key, - mp_opt->addr_id, &mp_opt->addr6); + mp_opt->addr_id, &mp_opt->addr6, + mp_opt->port);#endif pr_debug("msk=%p, ahmac=%llu, mp_opt->ahmac=%llu\n",
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 147/254 can: isotp: isotp_setsockopt(): only allow to set low level TX flags for CAN-FD
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
[ Upstream commit e4912459bd5edd493b61bc7c3a5d9b2eb17f5a89 ]
CAN-FD frames have struct canfd_frame::flags, while classic CAN frames don't.
This patch refuses to set TX flags (struct can_isotp_ll_options::tx_flags) on non CAN-FD isotp sockets.
--- net/can/isotp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/can/isotp.c +2 -1
@@ -1228,7 +1228,8 @@ static int isotp_setsockopt(struct socket *sock, int level, int optname,if (ll.mtu !=CAN_MTU && ll.mtu !=CANFD_MTU )return -EINVAL ; -if (ll.mtu ==CAN_MTU && ll.tx_dl >CAN_MAX_DLEN ) +if (ll.mtu ==CAN_MTU && + (ll.tx_dl >CAN_MAX_DLEN || ll.tx_flags !=0 ))return -EINVAL ;memcpy (&so->ll, &ll,sizeof (ll));
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 148/254 can: isotp: TX-path: ensure that CAN frame flags are initialized
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
[ Upstream commit d4eb538e1f48b3cf7bb6cb9eb39fe3e9e8a701f7 ]
The previous patch ensures that the TX flags (struct can_isotp_ll_options::tx_flags) are 0 for classic CAN frames or a user configured value for CAN-FD frames.
This patch sets the CAN frames flags unconditionally to the ISO-TP TX flags, so that they are initialized to a proper value. Otherwise when running "candump -x" on a classical CAN ISO-TP stream shows wrongly set "B" and "E" flags.
| $ candump any,0:0,#FFFFFFFF -extA | [...] | can0 TX B E 713 [8] 2B 0A 0B 0C 0D 0E 0F 00 | can0 TX B E 713 [8] 2C 01 02 03 04 05 06 07 | can0 TX B E 713 [8] 2D 08 09 0A 0B 0C 0D 0E | can0 TX B E 713 [8] 2E 0F 00 01 02 03 04 05
--- net/can/isotp.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
net/can/isotp.c +3 -6
@@ -215,8 +215,7 @@ static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus)if (ae) ncf->data[0 ] = so->opt.ext_address; -if (so->ll.mtu ==CANFD_MTU ) - ncf->flags = so->ll.tx_flags; + ncf->flags = so->ll.tx_flags; can_send_ret =can_send (nskb,1 );if (can_send_ret)
@@ -790,8 +789,7 @@ isotp_tx_burst: so->tx.sn %=16 ; so->tx.bs++; -if (so->ll.mtu ==CANFD_MTU ) - cf->flags = so->ll.tx_flags; + cf->flags = so->ll.tx_flags; skb->dev = dev;can_skb_set_owner (skb, sk);
@@ -939,8 +937,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) }/* send the first or only CAN frame */ -if (so->ll.mtu ==CANFD_MTU ) - cf->flags = so->ll.tx_flags; + cf->flags = so->ll.tx_flags; skb->dev = dev; skb->sk = sk;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 149/254 can: peak_usb: add forgotten supported devices
In reply to Greg Kroah-HartmanFrom: Stephane Grosjean <[email protected]>
[ Upstream commit 59ec7b89ed3e921cd0625a8c83f31a30d485fdf8 ]
Since the peak_usb driver also supports the CAN-USB interfaces "PCAN-USB X6" and "PCAN-Chip USB" from PEAK-System GmbH, this patch adds their names to the list of explicitly supported devices.
--- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/can/usb/peak_usb/pcan_usb_fd.c +2 -0
@@ -18,6 +18,8 @@MODULE_SUPPORTED_DEVICE ("PEAK-System PCAN-USB FD adapter" );MODULE_SUPPORTED_DEVICE ("PEAK-System PCAN-USB Pro FD adapter" ); +MODULE_SUPPORTED_DEVICE ("PEAK-System PCAN-Chip USB" ); +MODULE_SUPPORTED_DEVICE ("PEAK-System PCAN-USB X6 adapter" );#define PCAN_USBPROFD_CHANNEL_COUNT 2#define PCAN_USBFD_CHANNEL_COUNT 1
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 150/254 can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate
In reply to Greg Kroah-HartmanFrom: Angelo Dureghello <[email protected]>
[ Upstream commit 47c5e474bc1e1061fb037d13b5000b38967eb070 ]
For cases when flexcan is built-in, bitrate is still not set at registering. So flexcan_chip_freeze() generates:
[ 1.860000] *** ZERO DIVIDE *** FORMAT=4 [ 1.860000] Current process id is 1 [ 1.860000] BAD KERNEL TRAP: 00000000 [ 1.860000] PC: [<402e70c8>] flexcan_chip_freeze+0x1a/0xa8
To allow chip freeze, using an hardcoded timeout when bitrate is still not set.
--- drivers/net/can/flexcan.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/can/flexcan.c +7 -1
@@ -697,9 +697,15 @@ static int flexcan_chip_disable(struct flexcan_priv *priv)static int flexcan_chip_freeze (struct flexcan_priv *priv) {struct flexcan_regs __iomem *regs = priv->regs; -unsigned int timeout =1000 *1000 *10 / priv->can.bittiming.bitrate; +unsigned int timeout; +u32 bitrate = priv->can.bittiming.bitrate;u32 reg; +if (bitrate) + timeout =1000 *1000 *10 / bitrate; +else + timeout =FLEXCAN_TIMEOUT_US /10 ; + reg = priv->read (®s->mcr); reg |=FLEXCAN_MCR_FRZ |FLEXCAN_MCR_HALT ; priv->write (reg, ®s->mcr);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 151/254 can: kvaser_pciefd: Always disable bus load reporting
In reply to Greg Kroah-HartmanFrom: Jimmy Assarsson <[email protected]>
[ Upstream commit 7c6e6bce08f918b64459415f58061d4d6df44994 ]
Under certain circumstances, when switching from Kvaser's linuxcan driver (kvpciefd) to the SocketCAN driver (kvaser_pciefd), the bus load reporting is not disabled.
This is flooding the kernel log with prints like:
[3485.574677] kvaser_pciefd 0000:02:00.0: Received unexpected packet type 0x00000009
Always put the controller in the expected state, instead of assuming that bus load reporting is inactive.
Note: If bus load reporting is enabled when the driver is loaded, you will
still get a number of bus load packages (and printouts), before it is disabled.
--- drivers/net/can/kvaser_pciefd.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/can/kvaser_pciefd.c +4 -0
@@ -57,6 +57,7 @@ MODULE_DESCRIPTION("CAN driver for Kvaser CAN/PCIe devices");#define KVASER_PCIEFD_KCAN_STAT_REG 0x418#define KVASER_PCIEFD_KCAN_MODE_REG 0x41c#define KVASER_PCIEFD_KCAN_BTRN_REG 0x420 +#define KVASER_PCIEFD_KCAN_BUS_LOAD_REG 0x424#define KVASER_PCIEFD_KCAN_BTRD_REG 0x428#define KVASER_PCIEFD_KCAN_PWM_REG 0x430/* Loopback control register */
@@ -949,6 +950,9 @@ static int kvaser_pciefd_setup_can_ctrls(struct kvaser_pciefd *pcie)timer_setup (&can->bec_poll_timer, kvaser_pciefd_bec_poll_timer,0 ); +/* Disable Bus load reporting */ +iowrite32 (0 , can->reg_base +KVASER_PCIEFD_KCAN_BUS_LOAD_REG ); + tx_npackets =ioread32 (can->reg_base +KVASER_PCIEFD_KCAN_TX_NPACKETS_REG ); if (((tx_npackets >> KVASER_PCIEFD_KCAN_TX_NPACKETS_MAX_SHIFT) &
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 152/254 can: c_can_pci: c_can_pci_remove(): fix use-after-free
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 0429d6d89f97ebff4f17f13f5b5069c66bde8138 ]
There is a UAF in c_can_pci_remove(). dev is released by free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later. To fix this issue, save the mmio address before releasing dev.
--- drivers/net/can/c_can/c_can_pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/can/c_can/c_can_pci.c +2 -1
@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev) {struct net_device *dev =pci_get_drvdata (pdev);struct c_can_priv *priv =netdev_priv (dev); +void __iomem *addr = priv->base;unregister_c_can_dev (dev);free_c_can_dev (dev); -pci_iounmap (pdev, priv->base); +pci_iounmap (pdev, addr);pci_disable_msi (pdev);pci_clear_master (pdev);pci_release_regions (pdev);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 153/254 can: c_can: move runtime PM enable/disable to c_can_platform
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 6e2fe01dd6f98da6cae8b07cd5cfa67abc70d97d ]
Currently doing modprobe c_can_pci will make the kernel complain:
Unbalanced pm_runtime_enable!
this is caused by pm_runtime_enable() called before pm is initialized.
This fix is similar to 227619c3ff7c, move those pm_enable/disable code to c_can_platform.
--- drivers/net/can/c_can/c_can.c | 24 +----------------------- drivers/net/can/c_can/c_can_platform.c | 6 +++++- 2 files changed, 6 insertions(+), 24 deletions(-)
drivers/net/can/c_can/c_can.c +1 -23
@@ -212,18 +212,6 @@ static const struct can_bittiming_const c_can_bittiming_const = { .brp_inc = 1, }; -static inline void c_can_pm_runtime_enable (const struct c_can_priv *priv) -{ -if (priv->device) -pm_runtime_enable (priv->device); -} - -static inline void c_can_pm_runtime_disable (const struct c_can_priv *priv) -{ -if (priv->device) -pm_runtime_disable (priv->device); -} -static inline void c_can_pm_runtime_get_sync (const struct c_can_priv *priv) {if (priv->device)
@@ -1335,7 +1323,6 @@ static const struct net_device_ops c_can_netdev_ops = {int register_c_can_dev (struct net_device *dev) { -struct c_can_priv *priv =netdev_priv (dev);int err;/* Deactivate pins to prevent DRA7 DCAN IP from being
@@ -1345,28 +1332,19 @@ int register_c_can_dev(struct net_device *dev)*/ pinctrl_pm_select_sleep_state (dev->dev.parent); -c_can_pm_runtime_enable (priv); - dev->flags |=IFF_ECHO ;/* we support local echo */ dev->netdev_ops = &c_can_netdev_ops; err =register_candev (dev); -if (err) -c_can_pm_runtime_disable (priv); -else +if (!err)devm_can_led_init (dev); -return err; }EXPORT_SYMBOL_GPL (register_c_can_dev);void unregister_c_can_dev (struct net_device *dev) { -struct c_can_priv *priv =netdev_priv (dev); -unregister_candev (dev); - -c_can_pm_runtime_disable (priv); }EXPORT_SYMBOL_GPL (unregister_c_can_dev);
drivers/net/can/c_can/c_can_platform.c +5 -1
@@ -29,6 +29,7 @@#include <linux/list.h> #include <linux/io.h> #include <linux/platform_device.h> +#include <linux/pm_runtime.h> #include <linux/clk.h> #include <linux/of.h> #include <linux/of_device.h>
@@ -386,6 +387,7 @@ static int c_can_plat_probe(struct platform_device *pdev)platform_set_drvdata (pdev, dev);SET_NETDEV_DEV (dev, &pdev->dev); +pm_runtime_enable (priv->device); ret =register_c_can_dev (dev);if (ret) { dev_err(&pdev->dev, "registering %s failed (err=%d)\n",
@@ -398,6 +400,7 @@ static int c_can_plat_probe(struct platform_device *pdev)return 0 ; exit_free_device: +pm_runtime_disable (priv->device);free_c_can_dev (dev); exit:dev_err (&pdev->dev,"probe failed\n" );
@@ -408,9 +411,10 @@ exit:static int c_can_plat_remove (struct platform_device *pdev) {struct net_device *dev =platform_get_drvdata (pdev); +struct c_can_priv *priv =netdev_priv (dev);unregister_c_can_dev (dev); - +pm_runtime_disable (priv->device);free_c_can_dev (dev);return 0 ;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 154/254 can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning
In reply to Greg Kroah-HartmanFrom: Torin Cooper-Bennun <[email protected]>
[ Upstream commit c0e399f3baf42279f48991554240af8c457535d1 ]
Message loss from RX FIFO 0 is already handled in m_can_handle_lost_msg(), with netdev output included.
Removing this warning also improves driver performance under heavy load, where m_can_do_rx_poll() may be called many times before this interrupt is cleared, causing this message to be output many times (thanks Mariusz Madej for this report).
--- drivers/net/can/m_can/m_can.c | 3 --- 1 file changed, 3 deletions(-)
drivers/net/can/m_can/m_can.c +0 -3
@@ -501,9 +501,6 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota) }while ((rxfs &RXFS_FFL_MASK ) && (quota >0 )) { -if (rxfs &RXFS_RFL ) -netdev_warn (dev,"Rx FIFO 0 Message Lost\n" ); -m_can_read_fifo (dev, rxfs); quota--;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 155/254 can: m_can: m_can_rx_peripheral(): fix RX being blocked by errors
In reply to Greg Kroah-HartmanFrom: Torin Cooper-Bennun <[email protected]>
[ Upstream commit e98d9ee64ee2cc9b1d1a8e26610ec4d0392ebe50 ]
For M_CAN peripherals, m_can_rx_handler() was called with quota = 1, which caused any error handling to block RX from taking place until the next time the IRQ handler is called. This had been observed to cause RX to be blocked indefinitely in some cases.
This is fixed by calling m_can_rx_handler with a sensibly high quota.
--- drivers/net/can/m_can/m_can.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/m_can/m_can.c +1 -1
@@ -873,7 +873,7 @@ static int m_can_rx_peripheral(struct net_device *dev) {struct m_can_classdev *cdev =netdev_priv (dev); -m_can_rx_handler (dev,1 ); +m_can_rx_handler (dev,M_CAN_NAPI_WEIGHT );m_can_enable_all_interrupts (cdev);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 156/254 mac80211: fix rate mask reset
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 1944015fe9c1d9fa5e9eb7ffbbb5ef8954d6753b ]
Coverity reported the strange "if (~...)" condition that's always true. It suggested that ! was intended instead of ~, but upon further analysis I'm convinced that what really was intended was a comparison to 0xff/0xffff (in HT/VHT cases respectively), since this indicates that all of the rates are enabled.
Change the comparison accordingly.
I'm guessing this never really mattered because a reset to not having a rate mask is basically equivalent to having a mask that enables all rates.
--- net/mac80211/cfg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mac80211/cfg.c +2 -2
@@ -2950,14 +2950,14 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,continue ;for (j =0 ; j <IEEE80211_HT_MCS_MASK_LEN ; j++) { -if (~sdata->rc_rateidx_mcs_mask[i][j]) { +if (sdata->rc_rateidx_mcs_mask[i][j] !=0xff ) { sdata->rc_has_mcs_mask[i] = true;break ; } }for (j =0 ; j <NL80211_VHT_NSS_MAX ; j++) { -if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) { +if (sdata->rc_rateidx_vht_mcs_mask[i][j] !=0xffff ) { sdata->rc_has_vht_mcs_mask[i] = true;break ; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 157/254 mac80211: Allow HE operation to be longer than expected.
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
[ Upstream commit 0f7e90faddeef53a3568f449a0c3992d77510b66 ]
We observed some Cisco APs sending the following HE Operation IE in associate response:
ff 0a 24 f4 3f 00 01 fc ff 00 00 00
Its HE operation parameter is 0x003ff4, so the expected total length is 7 which does not match the actual length = 10. This causes association failing with "HE AP is missing HE Capability/operation."
According to P802.11ax_D4 Table9-94, HE operation is extensible, and according to 802.11-2016 10.27.8, STA should discard the part beyond the maximum length and parse the truncated element.
Allow HE operation element to be longer than expected to handle this case and future extensions.
--- net/mac80211/mlme.c | 2 +- net/mac80211/util.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/mac80211/mlme.c +1 -1
@@ -5071,7 +5071,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata, he_oper_ie =cfg80211_find_ext_ie (WLAN_EID_EXT_HE_OPERATION , ies->data, ies->len);if (he_oper_ie && - he_oper_ie[1 ] ==ieee80211_he_oper_size (&he_oper_ie[3 ])) + he_oper_ie[1 ] >=ieee80211_he_oper_size (&he_oper_ie[3 ])) he_oper = (void *)(he_oper_ie +3 );else he_oper =NULL ;
net/mac80211/util.c +1 -1
@@ -968,7 +968,7 @@ static void ieee80211_parse_extension_element(u32 *crc,break ;case WLAN_EID_EXT_HE_OPERATION :if (len >=sizeof (*elems->he_operation) && - len ==ieee80211_he_oper_size (data) -1 ) { + len >=ieee80211_he_oper_size (data) -1 ) {if (crc) *crc =crc32_be (*crc, (void *)elem, elem->datalen +2 );
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 158/254 selftests/net: fix warnings on reuseaddr_ports_exhausted
In reply to Greg Kroah-HartmanFrom: Carlos Llamas <[email protected]>
[ Upstream commit 81f711d67a973bf8a6db9556faf299b4074d536e ]
Fix multiple warnings seen with gcc 10.2.1:
reuseaddr_ports_exhausted.c:32:41: warning: missing braces around initializer [-Wmissing-braces]
32 | struct reuse_opts unreusable_opts[12] = {
| ^
33 | {0, 0, 0, 0},
| { } { }--- .../selftests/net/reuseaddr_ports_exhausted.c | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-)
tools/testing/selftests/net/reuseaddr_ports_exhausted.c +16 -16
@@ -30,25 +30,25 @@ struct reuse_opts { };struct reuse_opts unreusable_opts[12 ] = { - {0 ,0 ,0 ,0 }, - {0 ,0 ,0 ,1 }, - {0 ,0 ,1 ,0 }, - {0 ,0 ,1 ,1 }, - {0 ,1 ,0 ,0 }, - {0 ,1 ,0 ,1 }, - {0 ,1 ,1 ,0 }, - {0 ,1 ,1 ,1 }, - {1 ,0 ,0 ,0 }, - {1 ,0 ,0 ,1 }, - {1 ,0 ,1 ,0 }, - {1 ,0 ,1 ,1 }, + {{0 ,0 }, {0 ,0 }}, + {{0 ,0 }, {0 ,1 }}, + {{0 ,0 }, {1 ,0 }}, + {{0 ,0 }, {1 ,1 }}, + {{0 ,1 }, {0 ,0 }}, + {{0 ,1 }, {0 ,1 }}, + {{0 ,1 }, {1 ,0 }}, + {{0 ,1 }, {1 ,1 }}, + {{1 ,0 }, {0 ,0 }}, + {{1 ,0 }, {0 ,1 }}, + {{1 ,0 }, {1 ,0 }}, + {{1 ,0 }, {1 ,1 }}, };struct reuse_opts reusable_opts[4 ] = { - {1 ,1 ,0 ,0 }, - {1 ,1 ,0 ,1 }, - {1 ,1 ,1 ,0 }, - {1 ,1 ,1 ,1 }, + {{1 ,1 }, {0 ,0 }}, + {{1 ,1 }, {0 ,1 }}, + {{1 ,1 }, {1 ,0 }}, + {{1 ,1 }, {1 ,1 }}, };int bind_port (struct __test_metadata *_metadata,int reuseaddr,int reuseport)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 159/254 nfp: flower: fix unsupported pre_tunnel flows
In reply to Greg Kroah-HartmanFrom: Louis Peens <[email protected]>
[ Upstream commit 982e5ee23d764fe6158f67a7813d416335e978b0 ]
There are some pre_tunnel flows combinations which are incorrectly being offloaded without proper support, fix these.
- Matching on MPLS is not supported for pre_tun.
- Match on IPv4/IPv6 layer must be present.
- Destination MAC address must match pre_tun.dev MAC
--- .../ethernet/netronome/nfp/flower/offload.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/net/ethernet/netronome/nfp/flower/offload.c +18 -0
@@ -1142,6 +1142,12 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app,return -EOPNOTSUPP ; } +if (!(key_layer &NFP_FLOWER_LAYER_IPV4 ) && + !(key_layer &NFP_FLOWER_LAYER_IPV6 )) { +NL_SET_ERR_MSG_MOD (extack,"unsupported pre-tunnel rule: match on ipv4/ipv6 eth_type must be present" ); +return -EOPNOTSUPP ; + } +/* Skip fields known to exist. */ mask +=sizeof (struct nfp_flower_meta_tci ); ext +=sizeof (struct nfp_flower_meta_tci );
@@ -1152,6 +1158,13 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app, mask +=sizeof (struct nfp_flower_in_port ); ext +=sizeof (struct nfp_flower_in_port ); +/* Ensure destination MAC address matches pre_tun_dev. */ + mac = (struct nfp_flower_mac_mpls *)ext; +if (memcmp (&mac->mac_dst[0 ], flow->pre_tun_rule.dev->dev_addr,6 )) { +NL_SET_ERR_MSG_MOD (extack,"unsupported pre-tunnel rule: dest MAC must match output dev MAC" ); +return -EOPNOTSUPP ; + } +/* Ensure destination MAC address is fully matched. */ mac = (struct nfp_flower_mac_mpls *)mask;if (!is_broadcast_ether_addr (&mac->mac_dst[0 ])) {
@@ -1159,6 +1172,11 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app,return -EOPNOTSUPP ; } +if (mac->mpls_lse) { +NL_SET_ERR_MSG_MOD (extack,"unsupported pre-tunnel rule: MPLS not supported" ); +return -EOPNOTSUPP ; + } + mask +=sizeof (struct nfp_flower_mac_mpls ); ext +=sizeof (struct nfp_flower_mac_mpls ); if (key_layer & NFP_FLOWER_LAYER_IPV4 ||
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 160/254 nfp: flower: add ipv6 bit to pre_tunnel control message
In reply to Greg Kroah-HartmanFrom: Louis Peens <[email protected]>
[ Upstream commit 5c4f5e19d6a8e159127b9d653bb67e0dc7a28047 ]
Differentiate between ipv4 and ipv6 flows when configuring the pre_tunnel table to prevent them trampling each other in the table.
--- .../ethernet/netronome/nfp/flower/tunnel_conf.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c +13 -2
@@ -16,8 +16,9 @@#define NFP_FL_MAX_ROUTES 32#define NFP_TUN_PRE_TUN_RULE_LIMIT 32 -#define NFP_TUN_PRE_TUN_RULE_DEL 0x1 -#define NFP_TUN_PRE_TUN_IDX_BIT 0x8 +#define NFP_TUN_PRE_TUN_RULE_DEL BIT(0) +#define NFP_TUN_PRE_TUN_IDX_BIT BIT(3) +#define NFP_TUN_PRE_TUN_IPV6_BIT BIT(7)/** * struct nfp_tun_pre_run_rule - rule matched before decap
@@ -1268,6 +1269,7 @@ int nfp_flower_xmit_pre_tun_flow(struct nfp_app *app, {struct nfp_flower_priv *app_priv = app->priv;struct nfp_tun_offloaded_mac *mac_entry; +struct nfp_flower_meta_tci *key_meta;struct nfp_tun_pre_tun_rule payload;struct net_device *internal_dev;int err;
@@ -1290,6 +1292,15 @@ int nfp_flower_xmit_pre_tun_flow(struct nfp_app *app,if (!mac_entry)return -ENOENT ; +/* Set/clear IPV6 bit. cpu_to_be16() swap will lead to MSB being +* set/clear for port_idx. +*/ + key_meta = (struct nfp_flower_meta_tci *)flow->unmasked_data; +if (key_meta->nfp_flow_key_layer &NFP_FLOWER_LAYER_IPV6 ) + mac_entry->index |=NFP_TUN_PRE_TUN_IPV6_BIT ; +else + mac_entry->index &= ~NFP_TUN_PRE_TUN_IPV6_BIT ; + payload.port_idx =cpu_to_be16 (mac_entry->index);/* Copy mac id and vlan to flow - dev may not exist at delete time. */
Signature · 1 line
2.30.1