5.11.11-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainerPATCH 161/254 nfp: flower: fix pre_tun mask id allocation
In reply to Greg Kroah-HartmanFrom: Louis Peens <[email protected]>
[ Upstream commit d8ce0275e45ec809a33f98fc080fe7921b720dfb ]
pre_tun_rule flows does not follow the usual add-flow path, instead they are used to update the pre_tun table on the firmware. This means that if the mask-id gets allocated here the firmware will never see the "NFP_FL_META_FLAG_MANAGE_MASK" flag for the specific mask id, which triggers the allocation on the firmware side. This leads to the firmware mask being corrupted and causing all sorts of strange behaviour.
--- .../ethernet/netronome/nfp/flower/metadata.c | 24 +++++++++++++------ 1 file changed, 17 insertions(+), 7 deletions(-)
drivers/net/ethernet/netronome/nfp/flower/metadata.c +17 -7
@@ -327,8 +327,14 @@ int nfp_compile_flow_metadata(struct nfp_app *app, goto err_free_ctx_entry; } +/* Do net allocate a mask-id for pre_tun_rules. These flows are used to +* configure the pre_tun table and are never actually send to the +* firmware as an add-flow message. This causes the mask-id allocation +* on the firmware to get out of sync if allocated here. +*/ new_mask_id =0 ; -if (!nfp_check_mask_add (app, nfp_flow->mask_data, +if (!nfp_flow->pre_tun_rule.dev && + !nfp_check_mask_add (app, nfp_flow->mask_data, nfp_flow->meta.mask_len, &nfp_flow->meta.flags, &new_mask_id)) {NL_SET_ERR_MSG_MOD (extack,"invalid entry: cannot allocate a new mask id" );
@@ -359,7 +365,8 @@ int nfp_compile_flow_metadata(struct nfp_app *app, goto err_remove_mask; } -if (!nfp_check_mask_remove (app, nfp_flow->mask_data, +if (!nfp_flow->pre_tun_rule.dev && + !nfp_check_mask_remove (app, nfp_flow->mask_data, nfp_flow->meta.mask_len,NULL , &new_mask_id)) {NL_SET_ERR_MSG_MOD (extack,"invalid entry: cannot release mask id" );
@@ -374,8 +381,10 @@ int nfp_compile_flow_metadata(struct nfp_app *app,return 0 ; err_remove_mask: -nfp_check_mask_remove (app, nfp_flow->mask_data, nfp_flow->meta.mask_len, -NULL , &new_mask_id); +if (!nfp_flow->pre_tun_rule.dev) +nfp_check_mask_remove (app, nfp_flow->mask_data, + nfp_flow->meta.mask_len, +NULL , &new_mask_id); err_remove_rhash: WARN_ON_ONCE(rhashtable_remove_fast(&priv->stats_ctx_table, &ctx_entry->ht_node,
@@ -406,9 +415,10 @@ int nfp_modify_flow_metadata(struct nfp_app *app,__nfp_modify_flow_metadata (priv, nfp_flow); -nfp_check_mask_remove (app, nfp_flow->mask_data, - nfp_flow->meta.mask_len, &nfp_flow->meta.flags, - &new_mask_id); +if (!nfp_flow->pre_tun_rule.dev) +nfp_check_mask_remove (app, nfp_flow->mask_data, + nfp_flow->meta.mask_len, &nfp_flow->meta.flags, + &new_mask_id);/* Update flow payload with mask ids. */ nfp_flow->unmasked_data[NFP_FL_MASK_ID_LOCATION ] = new_mask_id;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 162/254 ftrace: Fix modify_ftrace_direct.
In reply to Greg Kroah-HartmanFrom: Alexei Starovoitov <[email protected]>
[ Upstream commit 8a141dd7f7060d1e64c14a5257e0babae20ac99b ]
The following sequence of commands:
register_ftrace_direct(ip, addr1);
modify_ftrace_direct(ip, addr1, addr2);
unregister_ftrace_direct(ip, addr2);
will cause the kernel to warn:
[ 30.179191] WARNING: CPU: 2 PID: 1961 at kernel/trace/ftrace.c:5223 unregister_ftrace_direct+0x130/0x150 [ 30.180556] CPU: 2 PID: 1961 Comm: test_progs W O 5.12.0-rc2-00378-g86bc10a0a711-dirty #3246 [ 30.182453] RIP: 0010:unregister_ftrace_direct+0x130/0x150
When modify_ftrace_direct() changes the addr from old to new it should update the addr stored in ftrace_direct_funcs. Otherwise the final unregister_ftrace_direct() won't find the address and will cause the splat.
--- kernel/trace/ftrace.c | 43 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 38 insertions(+), 5 deletions(-)
kernel/trace/ftrace.c +38 -5
@@ -5045,6 +5045,20 @@ struct ftrace_direct_func *ftrace_find_direct_func(unsigned long addr)return NULL ; } +static struct ftrace_direct_func *ftrace_alloc_direct_func (unsigned long addr) +{ +struct ftrace_direct_func *direct; + + direct =kmalloc (sizeof (*direct),GFP_KERNEL ); +if (!direct) +return NULL ; + direct->addr = addr; + direct->count =0 ; +list_add_rcu (&direct->next, &ftrace_direct_funcs); + ftrace_direct_func_count++; +return direct; +} +/** * register_ftrace_direct - Call a custom trampoline directly * @ip: The address of the nop at the beginning of a function
@@ -5120,15 +5134,11 @@ int register_ftrace_direct(unsigned long ip, unsigned long addr) direct =ftrace_find_direct_func (addr);if (!direct) { - direct =kmalloc (sizeof (*direct),GFP_KERNEL ); + direct =ftrace_alloc_direct_func (addr);if (!direct) {kfree (entry); goto out_unlock; } - direct->addr = addr; - direct->count =0 ; -list_add_rcu (&direct->next, &ftrace_direct_funcs); - ftrace_direct_func_count++; } entry->ip = ip;
@@ -5329,6 +5339,7 @@ int __weak ftrace_modify_direct_caller(struct ftrace_func_entry *entry,int modify_ftrace_direct (unsigned long ip,unsigned long old_addr,unsigned long new_addr) { +struct ftrace_direct_func *direct, *new_direct =NULL ;struct ftrace_func_entry *entry;struct dyn_ftrace *rec;int ret = -ENODEV ;
@@ -5344,6 +5355,20 @@ int modify_ftrace_direct(unsigned long ip,if (entry->direct != old_addr) goto out_unlock; + direct =ftrace_find_direct_func (old_addr); +if (WARN_ON (!direct)) + goto out_unlock; +if (direct->count >1 ) { + ret = -ENOMEM ; + new_direct =ftrace_alloc_direct_func (new_addr); +if (!new_direct) + goto out_unlock; + direct->count--; + new_direct->count++; + }else { + direct->addr = new_addr; + } +/* * If there's no other ftrace callback on the rec->ip location, * then it can be changed directly by the architecture.
@@ -5357,6 +5382,14 @@ int modify_ftrace_direct(unsigned long ip, ret =0 ; } +if (unlikely (ret && new_direct)) { + direct->count++; +list_del_rcu (&new_direct->next); +synchronize_rcu_tasks (); +kfree (new_direct); + ftrace_direct_func_count--; + } + out_unlock:mutex_unlock (&ftrace_lock);mutex_unlock (&direct_mutex);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 163/254 drm/msm/dsi: fix check-before-set in the 7nm dsi_pll code
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 3b24cdfc721a5f1098da22f9f68ff5f4a5efccc9 ]
Fix setting min/max DSI PLL rate for the V4.1 7nm DSI PLL (used on sm8250). Current code checks for pll->type before it is set (as it is set in the msm_dsi_pll_init() after calling device-specific functions.
--- drivers/gpu/drm/msm/dsi/pll/dsi_pll.c | 2 +- drivers/gpu/drm/msm/dsi/pll/dsi_pll.h | 6 ++++-- drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c | 5 +++-- 3 files changed, 8 insertions(+), 5 deletions(-)
drivers/gpu/drm/msm/dsi/pll/dsi_pll.c +1 -1
@@ -163,7 +163,7 @@ struct msm_dsi_pll *msm_dsi_pll_init(struct platform_device *pdev,break ;case MSM_DSI_PHY_7NM :case MSM_DSI_PHY_7NM_V4_1 : - pll =msm_dsi_pll_7nm_init (pdev, id); + pll =msm_dsi_pll_7nm_init (pdev, type, id);break ;default : pll =ERR_PTR (-ENXIO );
drivers/gpu/drm/msm/dsi/pll/dsi_pll.h +4 -2
@@ -117,10 +117,12 @@ msm_dsi_pll_10nm_init(struct platform_device *pdev, int id) }#endif #ifdef CONFIG_DRM_MSM_DSI_7NM_PHY -struct msm_dsi_pll *msm_dsi_pll_7nm_init (struct platform_device *pdev,int id); +struct msm_dsi_pll *msm_dsi_pll_7nm_init (struct platform_device *pdev, +enum msm_dsi_phy_type type,int id);#else static inline struct msm_dsi_pll * -msm_dsi_pll_7nm_init (struct platform_device *pdev,int id) +msm_dsi_pll_7nm_init (struct platform_device *pdev, +enum msm_dsi_phy_type type,int id) {return ERR_PTR (-ENODEV ); }
drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c +3 -2
@@ -852,7 +852,8 @@ err_base_clk_hw:return ret; } -struct msm_dsi_pll *msm_dsi_pll_7nm_init (struct platform_device *pdev,int id) +struct msm_dsi_pll *msm_dsi_pll_7nm_init (struct platform_device *pdev, +enum msm_dsi_phy_type type,int id) {struct dsi_pll_7nm *pll_7nm;struct msm_dsi_pll *pll;
@@ -885,7 +886,7 @@ struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, int id) pll = &pll_7nm->base; pll->min_rate =1000000000UL ; pll->max_rate =3500000000UL ; -if (pll->type ==MSM_DSI_PHY_7NM_V4_1 ) { +if (type ==MSM_DSI_PHY_7NM_V4_1 ) { pll->min_rate =600000000UL ; pll->max_rate = (unsigned long )5000000000ULL ;/* workaround for max rate overflowing on 32-bit builds: */
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 164/254 ionic: linearize tso skb with too many frags
In reply to Greg Kroah-HartmanFrom: Shannon Nelson <[email protected]>
[ Upstream commit d2c21422323b06938b3c070361dc544f047489d7 ]
We were linearizing non-TSO skbs that had too many frags, but we weren't checking number of frags on TSO skbs. This could lead to a bad page reference when we received a TSO skb with more frags than the Tx descriptor could support.
v2: use gso_segs rather than yet another division
don't rework the check on the nr_frags
--- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_txrx.c +7 -6
@@ -1079,15 +1079,17 @@ static int ionic_tx_descs_needed(struct ionic_queue *q, struct sk_buff *skb) {int sg_elems = q->lif->qtype_info[IONIC_QTYPE_TXQ ].max_sg_elems;struct ionic_tx_stats *stats =q_to_tx_stats (q); +int ndescs;int err; -/* If TSO, need roundup(skb->len/mss) descs */ +/* Each desc is mss long max, so a descriptor for each gso_seg */ if (skb_is_gso (skb)) -return (skb->len /skb_shinfo (skb)->gso_size) +1 ; + ndescs =skb_shinfo (skb)->gso_segs; +else + ndescs =1 ; -/* If non-TSO, just need 1 desc and nr_frags sg elems */ if (skb_shinfo (skb)->nr_frags <= sg_elems) -return 1 ; +return ndescs;/* Too many frags, so linearize */ err =skb_linearize (skb);
@@ -1096,8 +1098,7 @@ static int ionic_tx_descs_needed(struct ionic_queue *q, struct sk_buff *skb) stats->linearize++; -/* Need 1 desc and zero sg elems */ -return 1 ; +return ndescs; }static int ionic_maybe_stop_tx (struct ionic_queue *q,int ndescs)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 165/254 net/sched: cls_flower: fix only mask bit check in the validate_ct_state
In reply to Greg Kroah-HartmanFrom: wenxu <[email protected]>
[ Upstream commit afa536d8405a9ca36e45ba035554afbb8da27b82 ]
The ct_state validate should not only check the mask bit and also check mask_bit & key_bit..
For the +new+est case example, The 'new' and 'est' bits should be set in both state_mask and state flags. Or the -new-est case also will be reject by kernel.
When Openvswitch with two flows ct_state=+trk+new,action=commit,forward ct_state=+trk+est,action=forward
A packet go through the kernel and the contrack state is invalid, The ct_state will be +trk-inv. Upcall to the ovs-vswitchd, the finally dp action will be drop with -new-est+trk.
--- net/sched/cls_flower.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/cls_flower.c +1 -1
@@ -1432,7 +1432,7 @@ static int fl_set_key_ct(struct nlattr **tb, &mask->ct_state,TCA_FLOWER_KEY_CT_STATE_MASK , sizeof(key->ct_state)); - err =fl_validate_ct_state (mask->ct_state, + err =fl_validate_ct_state (key->ct_state & mask->ct_state, tb[TCA_FLOWER_KEY_CT_STATE_MASK ], extack);if (err)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 166/254 netfilter: nftables: report EOPNOTSUPP on unsupported flowtable flags
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 7e6136f1b7272b2202817cff37ada355eb5e6784 ]
Error was not set accordingly.
--- net/netfilter/nf_tables_api.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +3 -1
@@ -6929,8 +6929,10 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,if (nla[NFTA_FLOWTABLE_FLAGS ]) { flowtable->data.flags =ntohl (nla_get_be32 (nla[NFTA_FLOWTABLE_FLAGS ])); -if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK ) +if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK ) { + err = -EOPNOTSUPP ; goto err3; + } }write_pnet (&flowtable->data.net, net);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 167/254 netfilter: nftables: allow to update flowtable flags
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 7b35582cd04ace2fd1807c1b624934e465cc939d ]
Honor flowtable flags from the control update path. Disallow disabling to toggle hardware offload support though.
--- include/net/netfilter/nf_tables.h | 3 +++ net/netfilter/nf_tables_api.c | 15 +++++++++++++++ 2 files changed, 18 insertions(+)
include/net/netfilter/nf_tables.h +3 -0
@@ -1531,6 +1531,7 @@ struct nft_trans_flowtable {struct nft_flowtable *flowtable;bool update;struct list_head hook_list; +u32 flags; };#define nft_trans_flowtable (trans) \
@@ -1539,6 +1540,8 @@ struct nft_trans_flowtable { (((struct nft_trans_flowtable *)trans->data)->update)#define nft_trans_flowtable_hooks (trans) \ (((struct nft_trans_flowtable *)trans->data)->hook_list) +#define nft_trans_flowtable_flags (trans) \ + (((struct nft_trans_flowtable *)trans->data)->flags)int __init nft_chain_filter_init (void );void nft_chain_filter_fini (void );
net/netfilter/nf_tables_api.c +15 -0
@@ -6808,6 +6808,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,struct nft_hook *hook, *next;struct nft_trans *trans;bool unregister = false; +u32 flags;int err; err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
@@ -6822,6 +6823,17 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, } } +if (nla[NFTA_FLOWTABLE_FLAGS ]) { + flags =ntohl (nla_get_be32 (nla[NFTA_FLOWTABLE_FLAGS ])); +if (flags & ~NFT_FLOWTABLE_MASK ) +return -EOPNOTSUPP ; +if ((flowtable->data.flags &NFT_FLOWTABLE_HW_OFFLOAD ) ^ + (flags &NFT_FLOWTABLE_HW_OFFLOAD )) +return -EOPNOTSUPP ; + }else { + flags = flowtable->data.flags; + } + err =nft_register_flowtable_net_hooks (ctx->net, ctx->table, &flowtable_hook.list, flowtable);if (err <0 )
@@ -6835,6 +6847,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, goto err_flowtable_update_hook; } +nft_trans_flowtable_flags (trans) = flags;nft_trans_flowtable (trans) = flowtable;nft_trans_flowtable_update (trans) = true;INIT_LIST_HEAD (&nft_trans_flowtable_hooks (trans));
@@ -8144,6 +8157,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)break ;case NFT_MSG_NEWFLOWTABLE :if (nft_trans_flowtable_update (trans)) { +nft_trans_flowtable (trans)->data.flags = +nft_trans_flowtable_flags (trans); nf_tables_flowtable_notify(&trans->ctx, nft_trans_flowtable(trans), &nft_trans_flowtable_hooks(trans),
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 168/254 netfilter: flowtable: Make sure GC works periodically in idle system
In reply to Greg Kroah-HartmanFrom: Yinjun Zhang <[email protected]>
[ Upstream commit 740b486a8d1f966e68ac0666f1fd57441a7cda94 ]
Currently flowtable's GC work is initialized as deferrable, which means GC cannot work on time when system is idle. So the hardware offloaded flow may be deleted for timeout, since its used time is not timely updated.
Resolve it by initializing the GC work as delayed work instead of deferrable.
--- net/netfilter/nf_flow_table_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_flow_table_core.c +1 -1
@@ -506,7 +506,7 @@ int nf_flow_table_init(struct nf_flowtable *flowtable) {int err; -INIT_DEFERRABLE_WORK (&flowtable->gc_work, nf_flow_offload_work_gc); +INIT_DELAYED_WORK (&flowtable->gc_work, nf_flow_offload_work_gc);flow_block_init (&flowtable->flow_block);init_rwsem (&flowtable->flow_block_lock);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 169/254 libbpf: Fix error path in bpf_object__elf_init()
In reply to Greg Kroah-HartmanFrom: Namhyung Kim <[email protected]>
[ Upstream commit 8f3f5792f2940c16ab63c614b26494c8689c9c1e ]
When it failed to get section names, it should call into bpf_object__elf_finish() like others.
--- tools/lib/bpf/libbpf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/lib/bpf/libbpf.c +2 -1
@@ -1180,7 +1180,8 @@ static int bpf_object__elf_init(struct bpf_object *obj)if (!elf_rawdata (elf_getscn (obj->efile.elf, obj->efile.shstrndx),NULL )) {pr_warn ("elf: failed to get section names strings from %s: %s\n" , obj->path,elf_errmsg (-1 )); -return -LIBBPF_ERRNO__FORMAT ; + err = -LIBBPF_ERRNO__FORMAT ; + goto errout; }/* Old LLVM set e_machine to EM_NONE */
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 170/254 libbpf: Use SOCK_CLOEXEC when opening the netlink socket
In reply to Greg Kroah-HartmanFrom: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit 58bfd95b554f1a23d01228672f86bb489bdbf4ba ]
Otherwise, there exists a small window between the opening and closing of the socket fd where it may leak into processes launched by some other thread.
--- tools/lib/bpf/netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/netlink.c +1 -1
@@ -40,7 +40,7 @@ static int libbpf_netlink_open(__u32 *nl_pid)memset (&sa,0 ,sizeof (sa)); sa.nl_family =AF_NETLINK ; - sock =socket (AF_NETLINK ,SOCK_RAW ,NETLINK_ROUTE ); + sock =socket (AF_NETLINK ,SOCK_RAW |SOCK_CLOEXEC ,NETLINK_ROUTE );if (sock <0 )return -errno;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 171/254 ARM: dts: imx6ull: fix ubi filesystem mount failed
In reply to Greg Kroah-HartmanFrom: dillon min <[email protected]>
[ Upstream commit e4817a1b6b77db538bc0141c3b138f2df803ce87 ]
For NAND Ecc layout, there is a dependency from old kernel's nand driver setting and current. if old kernel use 4 bit ecc , we should use 4 bit in new kernel either. else will run into following error at filesystem mounting.
So, enable fsl,use-minimum-ecc from device tree, to fix this mismatch
[ 9.449265] ubi0: scanning is finished [ 9.463968] ubi0 warning: ubi_io_read: error -74 (ECC error) while reading 22528 bytes from PEB 513:4096, read only 22528 bytes, retry [ 9.486940] ubi0 warning: ubi_io_read: error -74 (ECC error) while reading 22528 bytes from PEB 513:4096, read only 22528 bytes, retry [ 9.509906] ubi0 warning: ubi_io_read: error -74 (ECC error) while reading 22528 bytes from PEB 513:4096, read only 22528 bytes, retry [ 9.532845] ubi0 error: ubi_io_read: error -74 (ECC error) while reading
22528 bytes from PEB 513:4096, read 22528 bytes
--- arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts +1 -0
@@ -14,5 +14,6 @@ }; &gpmi { + fsl,use-minimum-ecc; status = "okay"; };
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 172/254 ipv6: weaken the v4mapped source check
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit dcc32f4f183ab8479041b23a1525d48233df1d43 ]
This reverts commit 6af1799aaf3f1bc8defedddfa00df3192445bbf3.
Commit 6af1799aaf3f ("ipv6: drop incoming packets having a v4mapped source address") introduced an input check against v4mapped addresses. Use of such addresses on the wire is indeed questionable and not allowed on public Internet. As the commit pointed out
https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02
lists potential issues.
Unfortunately there are applications which use v4mapped addresses, and breaking them is a clear regression. For example v4mapped addresses (or any semi-valid addresses, really) may be used for uni-direction event streams or packet export.
Since the issue which sparked the addition of the check was with TCP and request_socks in particular push the check down to TCPv6 and DCCP. This restores the ability to receive UDPv6 packets with v4mapped address as the source.
Keep using the IPSTATS_MIB_INHDRERRORS statistic to minimize the user-visible changes.
--- net/dccp/ipv6.c | 5 +++++ net/ipv6/ip6_input.c | 10 ---------- net/ipv6/tcp_ipv6.c | 5 +++++ net/mptcp/subflow.c | 5 +++++ 4 files changed, 15 insertions(+), 10 deletions(-)
net/dccp/ipv6.c +5 -0
@@ -319,6 +319,11 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)if (!ipv6_unicast_destination (skb))return 0 ;/* discard, don't send a reset here */ +if (ipv6_addr_v4mapped (&ipv6_hdr (skb)->saddr)) { +__IP6_INC_STATS (sock_net (sk),NULL ,IPSTATS_MIB_INHDRERRORS ); +return 0 ; + } +if (dccp_bad_service_code (sk, service)) { dcb->dccpd_reset_code =DCCP_RESET_CODE_BAD_SERVICE_CODE ; goto drop;
net/ipv6/ip6_input.c +0 -10
@@ -245,16 +245,6 @@ static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, struct net_device *dev,if (ipv6_addr_is_multicast (&hdr->saddr)) goto err; -/* While RFC4291 is not explicit about v4mapped addresses -* in IPv6 headers, it seems clear linux dual-stack -* model can not deal properly with these. -* Security models could be fooled by ::ffff:127.0.0.1 for example. -* -* https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02 -*/ -if (ipv6_addr_v4mapped (&hdr->saddr)) - goto err; - skb->transport_header = skb->network_header +sizeof (*hdr);IP6CB (skb)->nhoff = offsetof(struct ipv6hdr , nexthdr);
net/ipv6/tcp_ipv6.c +5 -0
@@ -1175,6 +1175,11 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)if (!ipv6_unicast_destination (skb)) goto drop; +if (ipv6_addr_v4mapped (&ipv6_hdr (skb)->saddr)) { +__IP6_INC_STATS (sock_net (sk),NULL ,IPSTATS_MIB_INHDRERRORS ); +return 0 ; + } +return tcp_conn_request (&tcp6_request_sock_ops, &tcp_request_sock_ipv6_ops, sk, skb);
net/mptcp/subflow.c +5 -0
@@ -440,6 +440,11 @@ static int subflow_v6_conn_request(struct sock *sk, struct sk_buff *skb)if (!ipv6_unicast_destination (skb)) goto drop; +if (ipv6_addr_v4mapped (&ipv6_hdr (skb)->saddr)) { +__IP6_INC_STATS (sock_net (sk),NULL ,IPSTATS_MIB_INHDRERRORS ); +return 0 ; + } +return tcp_conn_request (&mptcp_subflow_request_sock_ops, &subflow_request_sock_ipv6_ops, sk, skb);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 173/254 octeontx2-af: Formatting debugfs entry rsrc_alloc.
In reply to Greg Kroah-HartmanFrom: Rakesh Babu <[email protected]>
[ Upstream commit f7884097141b615b6ce89c16f456a53902b4eec3 ]
With the existing rsrc_alloc's format, there is misalignment for the pcifunc entries whose VF's index is a double digit. This patch fixes this.
pcifunc NPA NIX0 NIX1 SSO GROUP SSOWS
TIM CPT0 CPT1 REE0 REE1
PF0:VF0 8 5
PF0:VF1 9 3
PF0:VF10 18 10
PF0:VF11 19 8
PF0:VF12 20 11
PF0:VF13 21 9
PF0:VF14 22 12
PF0:VF15 23 10
PF1 0 0--- .../marvell/octeontx2/af/rvu_debugfs.c | 46 ++++++++++++------- 1 file changed, 29 insertions(+), 17 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +29 -17
@@ -150,12 +150,14 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp,char __user *buffer, size_t count, loff_t *ppos) { - int index, off = 0, flag = 0, go_back = 0, off_prev; + int index, off = 0, flag = 0, go_back = 0, len = 0;struct rvu *rvu = filp->private_data;int lf, pf, vf, pcifunc;struct rvu_block block;int bytes_not_copied; +int lf_str_size =12 ;int buf_size =2048 ; +char *lfs;char *buf;/* don't allow partial reads */
@@ -165,12 +167,18 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, buf =kzalloc (buf_size,GFP_KERNEL );if (!buf)return -ENOSPC ; - off +=scnprintf (&buf[off], buf_size -1 - off,"\npcifunc\t\t" ); + + lfs =kzalloc (lf_str_size,GFP_KERNEL ); +if (!lfs) +return -ENOMEM ; + off +=scnprintf (&buf[off], buf_size -1 - off,"%-*s" , lf_str_size, +"pcifunc" );for (index =0 ; index <BLK_COUNT ; index++) -if (strlen (rvu->hw->block[index].name)) - off +=scnprintf (&buf[off], buf_size -1 - off, -"%*s\t" , (index -1 ) *2 , - rvu->hw->block[index].name); +if (strlen (rvu->hw->block[index].name)) { + off +=scnprintf (&buf[off], buf_size -1 - off, +"%-*s" , lf_str_size, + rvu->hw->block[index].name); + } off +=scnprintf (&buf[off], buf_size -1 - off,"\n" );for (pf =0 ; pf < rvu->hw->total_pfs; pf++) {for (vf =0 ; vf <= rvu->hw->total_vfs; vf++) {
@@ -179,14 +187,15 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp,continue ;if (vf) { +sprintf (lfs,"PF%d:VF%d" , pf, vf -1 ); go_back =scnprintf (&buf[off], buf_size -1 - off, -"PF%d:VF%d\t\t" , pf, - vf -1 ); +"%-*s" , lf_str_size, lfs); }else { +sprintf (lfs,"PF%d" , pf); go_back =scnprintf (&buf[off], buf_size -1 - off, -"PF%d\t\t" , pf); +"%-*s" , lf_str_size, lfs); } off += go_back;
@@ -194,20 +203,22 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, block = rvu->hw->block[index];if (!strlen (block.name))continue ; - off_prev = off; + len =0 ; + lfs[len] ='\0' ;for (lf =0 ; lf < block.lf.max; lf++) {if (block.fn_map[lf] != pcifunc)continue ; flag =1 ; - off +=scnprintf (&buf[off], buf_size -1 - - off,"%3d," , lf); + len +=sprintf (&lfs[len],"%d," , lf); } -if (flag && off_prev != off) - off--; -else - go_back++; + +if (flag) + len--; + lfs[len] ='\0' ; off +=scnprintf (&buf[off], buf_size -1 - off, -"\t" ); +"%-*s" , lf_str_size, lfs); +if (!strlen (lfs)) + go_back += lf_str_size; }if (!flag) off -= go_back;
@@ -219,6 +230,7 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, } bytes_not_copied =copy_to_user (buffer, buf, off); +kfree (lfs);kfree (buf);if (bytes_not_copied)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 174/254 octeontx2-af: Remove TOS field from MKEX TX
In reply to Greg Kroah-HartmanFrom: Subbaraya Sundeep <[email protected]>
[ Upstream commit ce86c2a531e2f2995ee55ea527c1f39ba1d95f73 ]
The MKEX profile describes what packet fields need to be extracted from the input packet and how to place those packet fields in the output key for MCAM matching. The MKEX profile can be in a way where higher layer packet fields can overwrite lower layer packet fields in output MCAM Key.
Hence MKEX profile is always ensured that there are no overlaps between any of the layers. But the commit 42006910b5ea ("octeontx2-af: cleanup KPU config data") introduced TX TOS field which overlaps with DMAC in MCAM key.
This led to AF driver returning error when TX rule is installed with DMAC as match criteria since DMAC gets overwritten and cannot be supported. This patch fixes the issue by removing TOS field from MKEX TX profile.
--- drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h +0 -2
@@ -13499,8 +13499,6 @@ static struct npc_mcam_kex npc_mkex_default = { [NPC_LT_LC_IP] = { /* SIP+DIP: 8 bytes, KW2[63:0] */ KEX_LD_CFG(0x07, 0xc, 0x1, 0x0, 0x10), -/* TOS: 1 byte, KW1[63:56] */ - KEX_LD_CFG(0x0, 0x1, 0x1, 0x0, 0xf), }, /* Layer C: IPv6 */ [NPC_LT_LC_IP6] = {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 175/254 octeontx2-af: Fix irq free in rvu teardown
In reply to Greg Kroah-HartmanFrom: Geetha sowjanya <[email protected]>
[ Upstream commit ae2619dd4fccdad9876aa5f900bd85484179c50f ]
Current devlink code try to free already freed irqs as the irq_allocate flag is not cleared after free leading to kernel crash while removing rvu driver. The patch fixes the irq free sequence and clears the irq_allocate flag on free.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu.c +4 -2
@@ -2358,8 +2358,10 @@ static void rvu_unregister_interrupts(struct rvu *rvu) INTR_MASK(rvu->hw->total_pfs) & ~1ULL);for (irq =0 ; irq < rvu->num_vec; irq++) { -if (rvu->irq_allocated[irq]) +if (rvu->irq_allocated[irq]) {free_irq (pci_irq_vector (rvu->pdev, irq), rvu); + rvu->irq_allocated[irq] = false; + } }pci_free_irq_vectors (rvu->pdev);
@@ -2873,8 +2875,8 @@ static void rvu_remove(struct pci_dev *pdev)struct rvu *rvu =pci_get_drvdata (pdev);rvu_dbg_exit (rvu); -rvu_unregister_interrupts (rvu);rvu_unregister_dl (rvu); +rvu_unregister_interrupts (rvu);rvu_flr_wq_destroy (rvu);rvu_cgx_exit (rvu);rvu_fwdata_exit (rvu);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 176/254 octeontx2-pf: Clear RSS enable flag on interace down
In reply to Greg Kroah-HartmanFrom: Geetha sowjanya <[email protected]>
[ Upstream commit f12098ce9b43e1a6fcaa524acbd90f9118a74c0a ]
RSS configuration can not be get/set when interface is in down state as they required mbox communication. RSS enable flag status is used for set/get configuration. Current code do not clear the RSS enable flag on interface down which lead to mbox error while trying to set/get RSS configuration.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +5 -0
@@ -1625,6 +1625,7 @@ int otx2_stop(struct net_device *netdev)struct otx2_nic *pf =netdev_priv (netdev);struct otx2_cq_poll *cq_poll =NULL ;struct otx2_qset *qset = &pf->qset; +struct otx2_rss_info *rss;int qidx, vec, wrk;netif_carrier_off (netdev);
@@ -1637,6 +1638,10 @@ int otx2_stop(struct net_device *netdev)/* First stop packet Rx/Tx */ otx2_rxtx_enable (pf, false); +/* Clear RSS enable flag */ + rss = &pf->hw.rss_info; + rss->enable = false; +/* Cleanup Queue IRQ */ vec =pci_irq_vector (pf->pdev, pf->hw.nix_msixoff +NIX_LF_QINT_VEC_START );
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 177/254 octeontx2-af: fix infinite loop in unmapping NPC counter
In reply to Greg Kroah-HartmanFrom: Hariprasad Kelam <[email protected]>
[ Upstream commit 64451b98306bf1334a62bcd020ec92bdb4cb68db ]
unmapping npc counter works in a way by traversing all mcam entries to find which mcam rule is associated with counter. But loop cursor variable 'entry' is not incremented before checking next mcam entry which resulting in infinite loop.
This in turn hogs the kworker thread forever and no other mbox message is processed by AF driver after that. Fix this by updating entry value before checking next mcam entry.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +1 -1
@@ -2490,10 +2490,10 @@ int rvu_mbox_handler_npc_mcam_free_counter(struct rvu *rvu, index =find_next_bit (mcam->bmap, mcam->bmap_entries, entry);if (index >= mcam->bmap_entries)break ; + entry = index +1 ;if (mcam->entry2cntr_map[index] != req->cntr)continue ; - entry = index +1 ;npc_unmap_mcam_entry_and_cntr (rvu, mcam, blkaddr, index, req->cntr); }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 178/254 net: check all name nodes in __dev_alloc_name
In reply to Greg Kroah-HartmanFrom: Jiri Bohac <[email protected]>
[ Upstream commit 6c015a2256801597fadcbc11d287774c9c512fa5 ]
__dev_alloc_name(), when supplied with a name containing '%d', will search for the first available device number to generate a unique device name.
Since commit ff92741270bf8b6e78aa885f166b68c7a67ab13a ("net:
introduce name_node struct to be used in hashlist") network devices may have alternate names. __dev_alloc_name() does take these alternate names into account, possibly generating a name that is already taken and failing with -ENFILE as a result.
This demonstrates the bug:
# rmmod dummy 2>/dev/null
# ip link property add dev lo altname dummy0
# modprobe dummy numdummies=1
modprobe: ERROR: could not insert 'dummy': Too many open files in systemInstead of creating a device named dummy1, modprobe fails.
Fix this by checking all the names in the d->name_node list, not just d->name.
--- net/core/dev.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
net/core/dev.c +12 -0
@@ -1182,6 +1182,18 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf)return -ENOMEM ;for_each_netdev (net, d) { +struct netdev_name_node *name_node; +list_for_each_entry (name_node, &d->name_node->list, list) { +if (!sscanf (name_node->name, name, &i)) +continue ; +if (i <0 || i >= max_netdevices) +continue ; + +/* avoid cases where sscanf is not exact inverse of printf */ +snprintf (buf,IFNAMSIZ , name, i); +if (!strncmp (buf, name_node->name,IFNAMSIZ )) +set_bit (i, inuse); + }if (!sscanf (d->name, name, &i))continue ;if (i <0 || i >= max_netdevices)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 179/254 net: cdc-phonet: fix data-interface release on probe failure
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit c79a707072fe3fea0e3c92edee6ca85c1e53c29f ]
Set the disconnected flag before releasing the data interface in case netdev registration fails to avoid having the disconnect callback try to deregister the never registered netdev (and trigger a WARN_ON()).
--- drivers/net/usb/cdc-phonet.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/cdc-phonet.c +2 -0
@@ -387,6 +387,8 @@ static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *i err =register_netdev (dev);if (err) { +/* Set disconnected flag so that disconnect() returns early. */ + pnd->disconnected =1 ;usb_driver_release_interface (&usbpn_driver, data_intf); goto out; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 180/254 igb: check timestamp validity
In reply to Greg Kroah-HartmanFrom: Jesse Brandeburg <[email protected]>
[ Upstream commit f0a03a026857d6c7766eb7d5835edbf5523ca15c ]
Add a couple of checks to make sure timestamping is on and that the timestamp value from DMA is valid. This avoids any functional issues that could come from a misinterpreted time stamp.
One of the functions changed doesn't need a return value added because there was no value in checking from the calling locations.
While here, fix a couple of reverse christmas tree issues next to the code being changed.
--- drivers/net/ethernet/intel/igb/igb.h | 4 +-- drivers/net/ethernet/intel/igb/igb_main.c | 11 ++++---- drivers/net/ethernet/intel/igb/igb_ptp.c | 31 ++++++++++++++++++----- 3 files changed, 32 insertions(+), 14 deletions(-)
drivers/net/ethernet/intel/igb/igb.h +2 -2
@@ -748,8 +748,8 @@ void igb_ptp_suspend(struct igb_adapter *adapter);void igb_ptp_rx_hang (struct igb_adapter *adapter);void igb_ptp_tx_hang (struct igb_adapter *adapter);void igb_ptp_rx_rgtstamp (struct igb_q_vector *q_vector,struct sk_buff *skb); -void igb_ptp_rx_pktstamp (struct igb_q_vector *q_vector,void *va, -struct sk_buff *skb); +int igb_ptp_rx_pktstamp (struct igb_q_vector *q_vector,void *va, +struct sk_buff *skb);int igb_ptp_set_ts_config (struct net_device *netdev,struct ifreq *ifr);int igb_ptp_get_ts_config (struct net_device *netdev,struct ifreq *ifr);void igb_set_flag_queue_pairs (struct igb_adapter *,const u32 );
drivers/net/ethernet/intel/igb/igb_main.c +6 -5
@@ -8319,9 +8319,10 @@ static struct sk_buff *igb_construct_skb(struct igb_ring *rx_ring,return NULL ;if (unlikely (igb_test_staterr (rx_desc,E1000_RXDADV_STAT_TSIP ))) { -igb_ptp_rx_pktstamp (rx_ring->q_vector, xdp->data, skb); - xdp->data +=IGB_TS_HDR_LEN ; - size -=IGB_TS_HDR_LEN ; +if (!igb_ptp_rx_pktstamp (rx_ring->q_vector, xdp->data, skb)) { + xdp->data +=IGB_TS_HDR_LEN ; + size -=IGB_TS_HDR_LEN ; + } }/* Determine available headroom for copy */
@@ -8382,8 +8383,8 @@ static struct sk_buff *igb_build_skb(struct igb_ring *rx_ring,/* pull timestamp out of packet data */ if (igb_test_staterr (rx_desc,E1000_RXDADV_STAT_TSIP )) { -igb_ptp_rx_pktstamp (rx_ring->q_vector, skb->data, skb); -__skb_pull (skb,IGB_TS_HDR_LEN ); +if (!igb_ptp_rx_pktstamp (rx_ring->q_vector, skb->data, skb)) +__skb_pull (skb,IGB_TS_HDR_LEN ); }/* update buffer offset */
drivers/net/ethernet/intel/igb/igb_ptp.c +24 -7
@@ -856,6 +856,9 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter)dev_kfree_skb_any (skb); } +#define IGB_RET_PTP_DISABLED 1 +#define IGB_RET_PTP_INVALID 2 +/** * igb_ptp_rx_pktstamp - retrieve Rx per packet timestamp * @q_vector: Pointer to interrupt specific structure
@@ -864,19 +867,29 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter)* * This function is meant to retrieve a timestamp from the first buffer of an * incoming frame. The value is stored in little endian format starting on -* byte 8. +* byte 8 +* +* Returns: 0 if success, nonzero if failure **/ -void igb_ptp_rx_pktstamp (struct igb_q_vector *q_vector,void *va, -struct sk_buff *skb) +int igb_ptp_rx_pktstamp (struct igb_q_vector *q_vector,void *va, +struct sk_buff *skb) { -__le64 *regval = (__le64 *)va;struct igb_adapter *adapter = q_vector->adapter; +__le64 *regval = (__le64 *)va;int adjust =0 ; +if (!(adapter->ptp_flags &IGB_PTP_ENABLED )) +return IGB_RET_PTP_DISABLED ; +/* The timestamp is recorded in little endian format. * DWORD: 0 1 2 3 * Field: Reserved Reserved SYSTIML SYSTIMH */ + +/* check reserved dwords are zero, be/le doesn't matter for zero */ +if (regval[0 ]) +return IGB_RET_PTP_INVALID ; +igb_ptp_systim_to_hwtstamp (adapter,skb_hwtstamps (skb),le64_to_cpu (regval[1 ]));
@@ -896,6 +909,8 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, }skb_hwtstamps (skb)->hwtstamp =ktime_sub_ns (skb_hwtstamps (skb)->hwtstamp, adjust); + +return 0 ; }/**
@@ -906,13 +921,15 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va,* This function is meant to retrieve a timestamp from the internal registers * of the adapter and store it in the skb. **/ -void igb_ptp_rx_rgtstamp (struct igb_q_vector *q_vector, -struct sk_buff *skb) +void igb_ptp_rx_rgtstamp (struct igb_q_vector *q_vector,struct sk_buff *skb) {struct igb_adapter *adapter = q_vector->adapter;struct e1000_hw *hw = &adapter->hw; -u64 regval;int adjust =0 ; +u64 regval; + +if (!(adapter->ptp_flags &IGB_PTP_ENABLED )) +return ;/* If this bit is set, then the RX registers contain the time stamp. No * other packet will be time stamped until we read these registers, so
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 181/254 sctp: move sk_route_caps check and set into sctp_outq_flush_transports
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 8ff0b1f08ea73e5c08f5addd23481e76a60e741c ]
The sk's sk_route_caps is set in sctp_packet_config, and later it only needs to change when traversing the transport_list in a loop, as the dst might be changed in the tx path.
So move sk_route_caps check and set into sctp_outq_flush_transports from sctp_packet_transmit. This also fixes a dst leak reported by Chen Yi:
https://bugzilla.kernel.org/show_bug.cgi?id=212227
As calling sk_setup_caps() in sctp_packet_transmit may also set the sk_route_caps for the ctrl sock in a netns. When the netns is being deleted, the ctrl sock's releasing is later than dst dev's deleting, which will cause this dev's deleting to hang and dmesg error occurs:
unregister_netdevice: waiting for xxx to become free. Usage count = 1
--- net/sctp/output.c | 7 ------- net/sctp/outqueue.c | 7 +++++++ 2 files changed, 7 insertions(+), 7 deletions(-)
net/sctp/output.c +0 -7
@@ -584,13 +584,6 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp) goto out; } -rcu_read_lock (); -if (__sk_dst_get (sk) != tp->dst) { -dst_hold (tp->dst); -sk_setup_caps (sk, tp->dst); - } -rcu_read_unlock (); -/* pack up chunks */ pkt_count =sctp_packet_pack (packet, head, gso, gfp);if (!pkt_count) {
net/sctp/outqueue.c +7 -0
@@ -1135,6 +1135,7 @@ static void sctp_outq_flush_data(struct sctp_flush_ctx *ctx,static void sctp_outq_flush_transports (struct sctp_flush_ctx *ctx) { +struct sock *sk = ctx->asoc->base.sk;struct list_head *ltransport;struct sctp_packet *packet;struct sctp_transport *t;
@@ -1144,6 +1145,12 @@ static void sctp_outq_flush_transports(struct sctp_flush_ctx *ctx) t = list_entry(ltransport, struct sctp_transport, send_ready); packet = &t->packet;if (!sctp_packet_empty (packet)) { +rcu_read_lock (); +if (t->dst &&__sk_dst_get (sk) != t->dst) { +dst_hold (t->dst); +sk_setup_caps (sk, t->dst); + } +rcu_read_unlock (); error =sctp_packet_transmit (packet, ctx->gfp);if (error <0 ) ctx->q->asoc->base.sk->sk_err = -error;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 182/254 r8152: limit the RX buffer size of RTL8153A for USB 2.0
In reply to Greg Kroah-HartmanFrom: Hayes Wang <[email protected]>
[ Upstream commit f91a50d8b51b5c8ef1cfb08115a005bba4250507 ]
If the USB host controller is EHCI, the throughput is reduced from 300Mb/s to 60Mb/s, when the rx buffer size is modified from 16K to 32K.
According to the EHCI spec, the maximum size of the qTD is 20K. Therefore, when the driver uses more than 20K buffer, the latency time of EHCI would be increased. And, it let the RTL8153A get worse throughput.
However, the driver uses alloc_pages() for rx buffer, so I limit the rx buffer to 16K rather than 20K.
--- drivers/net/usb/r8152.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/usb/r8152.c +4 -1
@@ -6502,7 +6502,10 @@ static int rtl_ops_init(struct r8152 *tp) ops->in_nway = rtl8153_in_nway; ops->hw_phy_cfg = r8153_hw_phy_cfg; ops->autosuspend_en = rtl8153_runtime_enable; - tp->rx_buf_sz =32 *1024 ; +if (tp->udev->speed <USB_SPEED_SUPER ) + tp->rx_buf_sz =16 *1024 ; +else + tp->rx_buf_sz =32 *1024 ; tp->eee_en = true; tp->eee_adv =MDIO_EEE_1000T |MDIO_EEE_100TX ;break ;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 183/254 net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes
In reply to Greg Kroah-HartmanFrom: Corentin Labbe <[email protected]>
[ Upstream commit 014dfa26ce1c647af09bf506285ef67e0e3f0a6b ]
MTU cannot be changed on dwmac-sun8i. (ip link set eth0 mtu xxx returning EINVAL) This is due to tx_fifo_size being 0, since this value is used to compute valid
MTU range.
Like dwmac-sunxi (with commit 806fd188ce2a ("net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes")) dwmac-sun8i need to have tx and rx fifo sizes set.
I have used values from datasheets.
After this patch, setting a non-default MTU (like 1000) value works and network is still useable.
Tested-on: sun8i-h3-orangepi-pc
Tested-on: sun8i-r40-bananapi-m2-ultra
Tested-on: sun50i-a64-bananapi-m64
Tested-on: sun50i-h5-nanopi-neo-plus2
Tested-on: sun50i-h6-pine-h64
--- drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +2 -0
@@ -1217,6 +1217,8 @@ static int sun8i_dwmac_probe(struct platform_device *pdev) plat_dat->init = sun8i_dwmac_init; plat_dat->exit = sun8i_dwmac_exit; plat_dat->setup = sun8i_dwmac_setup; + plat_dat->tx_fifo_size =4096 ; + plat_dat->rx_fifo_size =16384 ; ret =sun8i_dwmac_set_syscon (&pdev->dev, plat_dat);if (ret)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 184/254 selinux: vsock: Set SID for socket returned by accept()
In reply to Greg Kroah-HartmanFrom: David Brazdil <[email protected]>
[ Upstream commit 1f935e8e72ec28dddb2dc0650b3b6626a293d94b ]
For AF_VSOCK, accept() currently returns sockets that are unlabelled. Other socket families derive the child's SID from the SID of the parent and the SID of the incoming packet. This is typically done as the connected socket is placed in the queue that accept() removes from.
Reuse the existing 'security_sk_clone' hook to copy the SID from the parent (server) socket to the child. There is no packet SID in this case.
--- net/vmw_vsock/af_vsock.c | 1 + 1 file changed, 1 insertion(+)
net/vmw_vsock/af_vsock.c +1 -0
@@ -755,6 +755,7 @@ static struct sock *__vsock_create(struct net *net, vsk->buffer_size = psk->buffer_size; vsk->buffer_min_size = psk->buffer_min_size; vsk->buffer_max_size = psk->buffer_max_size; +security_sk_clone (parent, sk); }else { vsk->trusted =ns_capable_noaudit (&init_user_ns,CAP_NET_ADMIN ); vsk->owner =get_current_cred ();
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 185/254 selftests: forwarding: vxlan_bridge_1d: Fix vxlan ecn decapsulate value
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit 5aa3c334a449bab24519c4967f5ac2b3304c8dcf ]
The ECN bit defines ECT(1) = 1, ECT(0) = 2. So inner 0x02 + outer 0x01 should be inner ECT(0) + outer ECT(1). Based on the description of __INET_ECN_decapsulate, the final decapsulate value should be ECT(1). So fix the test expect value to 0x01.
Before the fix:
TEST: VXLAN: ECN decap: 01/02->0x02 [FAIL]
Expected to capture 10 packets, got 0.
After the fix:
TEST: VXLAN: ECN decap: 01/02->0x01 [ OK ]
--- tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh +1 -1
@@ -658,7 +658,7 @@ test_ecn_decap() # In accordance with INET_ECN_decapsulate() __test_ecn_decap 00 00 0x00 __test_ecn_decap 01 01 0x01 - __test_ecn_decap 02 01 0x02 + __test_ecn_decap 02 01 0x01 __test_ecn_decap 01 03 0x03 __test_ecn_decap 02 03 0x03 test_ecn_decap_error
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 186/254 libbpf: Fix BTF dump of pointer-to-array-of-struct
In reply to Greg Kroah-HartmanFrom: Jean-Philippe Brucker <[email protected]>
[ Upstream commit 901ee1d750f29a335423eeb9463c3ca461ca18c2 ]
The vmlinux.h generated from BTF is invalid when building drivers/phy/ti/phy-gmii-sel.c with clang:
vmlinux.h:61702:27: error: array type has incomplete element type ‘struct reg_field’
61702 | const struct reg_field (*regfields)[3];
| ^~~~~~~~~bpftool generates a forward declaration for this struct regfield, which compilers aren't happy about. Here's a simplified reproducer:
struct inner {
int val;
};
struct outer {
struct inner (*ptr_to_array)[2];
} A;After build with clang -> bpftool btf dump c -> clang/gcc:
./def-clang.h:11:23: error: array has incomplete element type 'struct inner'
struct inner (*ptr_to_array)[2];
Member ptr_to_array of struct outer is a pointer to an array of struct inner. In the DWARF generated by clang, struct outer appears before struct inner, so when converting BTF of struct outer into C, bpftool issues a forward declaration to struct inner. With GCC the DWARF info is reversed so struct inner gets fully defined.
That forward declaration is not sufficient when compilers handle an array of the struct, even when it's only used through a pointer. Note that we can trigger the same issue with an intermediate typedef:
struct inner {
int val;
};
typedef struct inner inner2_t[2];
struct outer {
inner2_t *ptr_to_array;
} A;Becomes:
struct inner; typedef struct inner inner2_t[2];
And causes:
./def-clang.h:10:30: error: array has incomplete element type 'struct inner'
typedef struct inner inner2_t[2];
To fix this, clear through_ptr whenever we encounter an intermediate array, to make the inner struct part of a strong link and force full declaration.
--- tools/lib/bpf/btf_dump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/btf_dump.c +1 -1
@@ -462,7 +462,7 @@ static int btf_dump_order_type(struct btf_dump *d, __u32 id, bool through_ptr)return err;case BTF_KIND_ARRAY : -return btf_dump_order_type (d,btf_array (t)->type, through_ptr); +return btf_dump_order_type (d,btf_array (t)->type, false);case BTF_KIND_STRUCT :case BTF_KIND_UNION : {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 187/254 bpf: Fix umd memory leak in copy_process()
In reply to Greg Kroah-HartmanFrom: Zqiang <[email protected]>
[ Upstream commit f60a85cad677c4f9bb4cadd764f1d106c38c7cf8 ]
The syzbot reported a memleak as follows:
BUG: memory leak
unreferenced object 0xffff888101b41d00 (size 120):
comm "kworker/u4:0", pid 8, jiffies 4294944270 (age 12.780s)
backtrace:
[<ffffffff8125dc56>] alloc_pid+0x66/0x560
[<ffffffff81226405>] copy_process+0x1465/0x25e0
[<ffffffff81227943>] kernel_clone+0xf3/0x670
[<ffffffff812281a1>] kernel_thread+0x61/0x80
[<ffffffff81253464>] call_usermodehelper_exec_work
[<ffffffff81253464>] call_usermodehelper_exec_work+0xc4/0x120
[<ffffffff812591c9>] process_one_work+0x2c9/0x600
[<ffffffff81259ab9>] worker_thread+0x59/0x5d0
[<ffffffff812611c8>] kthread+0x178/0x1b0
[<ffffffff8100227f>] ret_from_fork+0x1f/0x30unreferenced object 0xffff888110ef5c00 (size 232):
comm "kworker/u4:0", pid 8414, jiffies 4294944270 (age 12.780s) backtrace:
[<ffffffff8154a0cf>] kmem_cache_zalloc
[<ffffffff8154a0cf>] __alloc_file+0x1f/0xf0
[<ffffffff8154a809>] alloc_empty_file+0x69/0x120
[<ffffffff8154a8f3>] alloc_file+0x33/0x1b0
[<ffffffff8154ab22>] alloc_file_pseudo+0xb2/0x140
[<ffffffff81559218>] create_pipe_files+0x138/0x2e0
[<ffffffff8126c793>] umd_setup+0x33/0x220
[<ffffffff81253574>] call_usermodehelper_exec_async+0xb4/0x1b0
[<ffffffff8100227f>] ret_from_fork+0x1f/0x30After the UMD process exits, the pipe_to_umh/pipe_from_umh and tgid need to be released.
--- include/linux/usermode_driver.h | 1 + kernel/bpf/preload/bpf_preload_kern.c | 19 +++++++++++++++---- kernel/usermode_driver.c | 21 +++++++++++++++------ 3 files changed, 31 insertions(+), 10 deletions(-)
include/linux/usermode_driver.h +1 -0
@@ -14,5 +14,6 @@ struct umd_info {int umd_load_blob (struct umd_info *info,const void *data,size_t len);int umd_unload_blob (struct umd_info *info);int fork_usermode_driver (struct umd_info *info); +void umd_cleanup_helper (struct umd_info *info);#endif /* __LINUX_USERMODE_DRIVER_H__ */
kernel/bpf/preload/bpf_preload_kern.c +15 -4
@@ -60,9 +60,12 @@ static int finish(void) &magic, sizeof(magic), &pos);if (n !=sizeof (magic))return -EPIPE ; + tgid = umd_ops.info.tgid; -wait_event (tgid->wait_pidfd,thread_group_exited (tgid)); - umd_ops.info.tgid =NULL ; +if (tgid) { +wait_event (tgid->wait_pidfd,thread_group_exited (tgid)); +umd_cleanup_helper (&umd_ops.info); + }return 0 ; }
@@ -80,10 +83,18 @@ static int __init load_umd(void) static void __exit fini_umd(void) { +struct pid *tgid; + bpf_preload_ops =NULL ; +/* kill UMD in case it's still there due to earlier error */ -kill_pid (umd_ops.info.tgid,SIGKILL ,1 ); - umd_ops.info.tgid =NULL ; + tgid = umd_ops.info.tgid; +if (tgid) { +kill_pid (tgid,SIGKILL ,1 ); + +wait_event (tgid->wait_pidfd,thread_group_exited (tgid)); +umd_cleanup_helper (&umd_ops.info); + }umd_unload_blob (&umd_ops.info); }late_initcall (load_umd);
kernel/usermode_driver.c +15 -6
@@ -139,13 +139,22 @@ static void umd_cleanup(struct subprocess_info *info)struct umd_info *umd_info = info->data;/* cleanup if umh_setup() was successful but exec failed */ -if (info->retval) { -fput (umd_info->pipe_to_umh); -fput (umd_info->pipe_from_umh); -put_pid (umd_info->tgid); - umd_info->tgid =NULL ; - } +if (info->retval) +umd_cleanup_helper (umd_info); +} + +/** +* umd_cleanup_helper - release the resources which were allocated in umd_setup +* @info: information about usermode driver +*/ +void umd_cleanup_helper (struct umd_info *info) +{ +fput (info->pipe_to_umh); +fput (info->pipe_from_umh); +put_pid (info->tgid); + info->tgid =NULL ; } +EXPORT_SYMBOL_GPL (umd_cleanup_helper);/** * fork_usermode_driver - fork a usermode driver
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 188/254 can: isotp: tx-path: zero initialize outgoing CAN frames
In reply to Greg Kroah-HartmanFrom: Oliver Hartkopp <[email protected]>
[ Upstream commit b5f020f82a8e41201c6ede20fa00389d6980b223 ]
Commit d4eb538e1f48 ("can: isotp: TX-path: ensure that CAN frame flags are initialized") ensured the TX flags to be properly set for outgoing CAN frames.
In fact the root cause of the issue results from a missing initialization of outgoing CAN frames created by isotp. This is no problem on the CAN bus as the CAN driver only picks the correctly defined content from the struct can(fd)_frame. But when the outgoing frames are monitored (e.g. with candump) we potentially leak some bytes in the unused content of struct can(fd)_frame.
--- net/can/isotp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/can/isotp.c +3 -3
@@ -196,7 +196,7 @@ static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus) nskb->dev = dev;can_skb_set_owner (nskb, sk); ncf = (struct canfd_frame *)nskb->data; -skb_put (nskb, so->ll.mtu); +skb_put_zero (nskb, so->ll.mtu);/* create & send flow control reply */ ncf->can_id = so->txid;
@@ -779,7 +779,7 @@ isotp_tx_burst:can_skb_prv (skb)->skbcnt =0 ; cf = (struct canfd_frame *)skb->data; -skb_put (skb, so->ll.mtu); +skb_put_zero (skb, so->ll.mtu);/* create consecutive frame */ isotp_fill_dataframe (cf, so, ae,0 );
@@ -895,7 +895,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) so->tx.idx =0 ; cf = (struct canfd_frame *)skb->data; -skb_put (skb, so->ll.mtu); +skb_put_zero (skb, so->ll.mtu);/* check for single frame transmission depending on TX_DL */ if (size <= so->tx.ll_dl -SF_PCI_SZ4 - ae - off) {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 189/254 platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit d939cd96b9df6dcde1605fab23bbd6307e11f930 ]
On some system the WMI GUIDs used by dell-wmi-sysman are present but there are no enum type attributes, this causes init_bios_attributes() to return -ENODEV, after which sysman_init() does a "goto fail_create_group" and then calls release_attributes_data().
release_attributes_data() calls kset_unregister(wmi_priv.main_dir_kset); but before this commit it was missing a "wmi_priv.main_dir_kset = NULL;" statement; and after calling release_attributes_data() the sysman_init() error handling does this:
if (wmi_priv.main_dir_kset) {
kset_unregister(wmi_priv.main_dir_kset);
wmi_priv.main_dir_kset = NULL;
}Which causes a second kset_unregister(wmi_priv.main_dir_kset), leading to a double-free, which causes a crash.
Add the missing "wmi_priv.main_dir_kset = NULL;" statement to release_attributes_data() to fix this double-free crash.
--- drivers/platform/x86/dell-wmi-sysman/sysman.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/dell-wmi-sysman/sysman.c +1 -0
@@ -388,6 +388,7 @@ static void release_attributes_data(void)if (wmi_priv.main_dir_kset) {destroy_attribute_objs (wmi_priv.main_dir_kset);kset_unregister (wmi_priv.main_dir_kset); + wmi_priv.main_dir_kset =NULL ; }mutex_unlock (&wmi_priv.mutex);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 190/254 platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit c59ab4cedab70a1a117a2dba3c48bb78e66c55ca ]
It is possible for release_attributes_data() to get called when the main_dir_kset has not been created yet, move the removal of the bios-reset sysfs attr to under a if (main_dir_kset) check to avoid a NULL pointer deref.
--- drivers/platform/x86/dell-wmi-sysman/sysman.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
drivers/platform/x86/dell-wmi-sysman/sysman.c +2 -9
@@ -225,12 +225,6 @@ static int create_attributes_level_sysfs_files(void)return ret; } -static void release_reset_bios_data (void ) -{ -sysfs_remove_file (&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); -sysfs_remove_file (&wmi_priv.main_dir_kset->kobj, &pending_reboot.attr); -} -static ssize_t wmi_sysman_attr_show (struct kobject *kobj,struct attribute *attr,char *buf) {
@@ -373,8 +367,6 @@ static void destroy_attribute_objs(struct kset *kset)*/ static void release_attributes_data (void ) { -release_reset_bios_data (); -mutex_lock (&wmi_priv.mutex);exit_enum_attributes ();exit_int_attributes ();
@@ -386,12 +378,13 @@ static void release_attributes_data(void) wmi_priv.authentication_dir_kset =NULL ; }if (wmi_priv.main_dir_kset) { +sysfs_remove_file (&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); +sysfs_remove_file (&wmi_priv.main_dir_kset->kobj, &pending_reboot.attr);destroy_attribute_objs (wmi_priv.main_dir_kset);kset_unregister (wmi_priv.main_dir_kset); wmi_priv.main_dir_kset =NULL ; }mutex_unlock (&wmi_priv.mutex); - }/**
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 191/254 platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 2d0c418c91d8c86a1b9fb254dda842ada9919513 ]
During some of the error-exit paths it is possible that release_attributes_data() will get called multiple times, which results in exit_foo_attributes() getting called multiple times.
Make it safe to call exit_foo_attributes() multiple times, avoiding double-free()s in this case.
Note that release_attributes_data() really should only be called once during error-exit paths. This will be fixed in a separate patch and it is good to have the exit_foo_attributes() functions modified this way regardless.
--- drivers/platform/x86/dell-wmi-sysman/enum-attributes.c | 3 +++ drivers/platform/x86/dell-wmi-sysman/int-attributes.c | 3 +++ drivers/platform/x86/dell-wmi-sysman/passobj-attributes.c | 3 +++ drivers/platform/x86/dell-wmi-sysman/string-attributes.c | 3 +++ 4 files changed, 12 insertions(+)
drivers/platform/x86/dell-wmi-sysman/enum-attributes.c +3 -0
@@ -185,5 +185,8 @@ void exit_enum_attributes(void)sysfs_remove_group (wmi_priv.enumeration_data[instance_id].attr_name_kobj, &enumeration_attr_group); } + wmi_priv.enumeration_instances_count =0 ; +kfree (wmi_priv.enumeration_data); + wmi_priv.enumeration_data =NULL ; }
drivers/platform/x86/dell-wmi-sysman/int-attributes.c +3 -0
@@ -175,5 +175,8 @@ void exit_int_attributes(void)sysfs_remove_group (wmi_priv.integer_data[instance_id].attr_name_kobj, &integer_attr_group); } + wmi_priv.integer_instances_count =0 ; +kfree (wmi_priv.integer_data); + wmi_priv.integer_data =NULL ; }
drivers/platform/x86/dell-wmi-sysman/passobj-attributes.c +3 -0
@@ -183,5 +183,8 @@ void exit_po_attributes(void)sysfs_remove_group (wmi_priv.po_data[instance_id].attr_name_kobj, &po_attr_group); } + wmi_priv.po_instances_count =0 ; +kfree (wmi_priv.po_data); + wmi_priv.po_data =NULL ; }
drivers/platform/x86/dell-wmi-sysman/string-attributes.c +3 -0
@@ -155,5 +155,8 @@ void exit_str_attributes(void)sysfs_remove_group (wmi_priv.str_data[instance_id].attr_name_kobj, &str_attr_group); } + wmi_priv.str_instances_count =0 ; +kfree (wmi_priv.str_data); + wmi_priv.str_data =NULL ; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 192/254 platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 59bbbeb9c22cc7c55965cd5ea8c16af7f16e61eb ]
All calls of init_bios_attributes() will result in a goto fail_create_group if they fail, which calls release_attributes_data().
So there is no need to call release_attributes_data() from init_bios_attributes() on failure itself.
--- drivers/platform/x86/dell-wmi-sysman/sysman.c | 1 - 1 file changed, 1 deletion(-)
drivers/platform/x86/dell-wmi-sysman/sysman.c +0 -1
@@ -491,7 +491,6 @@ nextobj: err_attr_init:mutex_unlock (&wmi_priv.mutex); -release_attributes_data ();kfree (obj);return retval; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 193/254 platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 9c90cd869747e3492a9306dcd8123c17502ff1fc ]
Cleanup sysman_init() error-exit handling:
1. There is no need for the fail_reset_bios and fail_authentication_kset eror-exit cases, these can be handled by release_attributes_data()
2. Rename all the labels from fail_what_failed, to err_what_to_cleanup this is the usual way to name these and avoids the need to rename them when extra steps are added.
--- drivers/platform/x86/dell-wmi-sysman/sysman.c | 45 +++++++------------ 1 file changed, 16 insertions(+), 29 deletions(-)
drivers/platform/x86/dell-wmi-sysman/sysman.c +16 -29
@@ -508,100 +508,87 @@ static int __init sysman_init(void) ret =init_bios_attr_set_interface ();if (ret || !wmi_priv.bios_attr_wdev) {pr_debug ("failed to initialize set interface\n" ); - goto fail_set_interface; +return ret; } ret =init_bios_attr_pass_interface ();if (ret || !wmi_priv.password_attr_wdev) {pr_debug ("failed to initialize pass interface\n" ); - goto fail_pass_interface; + goto err_exit_bios_attr_set_interface; } ret =class_register (&firmware_attributes_class);if (ret) - goto fail_class; + goto err_exit_bios_attr_pass_interface; wmi_priv.class_dev =device_create (&firmware_attributes_class,NULL ,MKDEV (0 ,0 ),NULL ,"%s" ,DRIVER_NAME );if (IS_ERR (wmi_priv.class_dev)) { ret =PTR_ERR (wmi_priv.class_dev); - goto fail_classdev; + goto err_unregister_class; } wmi_priv.main_dir_kset =kset_create_and_add ("attributes" ,NULL , &wmi_priv.class_dev->kobj);if (!wmi_priv.main_dir_kset) { ret = -ENOMEM ; - goto fail_main_kset; + goto err_destroy_classdev; } wmi_priv.authentication_dir_kset =kset_create_and_add ("authentication" ,NULL , &wmi_priv.class_dev->kobj);if (!wmi_priv.authentication_dir_kset) { ret = -ENOMEM ; - goto fail_authentication_kset; + goto err_release_attributes_data; } ret =create_attributes_level_sysfs_files ();if (ret) {pr_debug ("could not create reset BIOS attribute\n" ); - goto fail_reset_bios; + goto err_release_attributes_data; } ret =init_bios_attributes (ENUM ,DELL_WMI_BIOS_ENUMERATION_ATTRIBUTE_GUID );if (ret) {pr_debug ("failed to populate enumeration type attributes\n" ); - goto fail_create_group; + goto err_release_attributes_data; } ret =init_bios_attributes (INT ,DELL_WMI_BIOS_INTEGER_ATTRIBUTE_GUID );if (ret) {pr_debug ("failed to populate integer type attributes\n" ); - goto fail_create_group; + goto err_release_attributes_data; } ret =init_bios_attributes (STR ,DELL_WMI_BIOS_STRING_ATTRIBUTE_GUID );if (ret) {pr_debug ("failed to populate string type attributes\n" ); - goto fail_create_group; + goto err_release_attributes_data; } ret =init_bios_attributes (PO ,DELL_WMI_BIOS_PASSOBJ_ATTRIBUTE_GUID );if (ret) {pr_debug ("failed to populate pass object type attributes\n" ); - goto fail_create_group; + goto err_release_attributes_data; }return 0 ; -fail_create_group: +err_release_attributes_data:release_attributes_data (); -fail_reset_bios: -if (wmi_priv.authentication_dir_kset) { -kset_unregister (wmi_priv.authentication_dir_kset); - wmi_priv.authentication_dir_kset =NULL ; - } - -fail_authentication_kset: -if (wmi_priv.main_dir_kset) { -kset_unregister (wmi_priv.main_dir_kset); - wmi_priv.main_dir_kset =NULL ; - } - -fail_main_kset: +err_destroy_classdev:device_destroy (&firmware_attributes_class,MKDEV (0 ,0 )); -fail_classdev: +err_unregister_class:class_unregister (&firmware_attributes_class); -fail_class: +err_exit_bios_attr_pass_interface:exit_bios_attr_pass_interface (); -fail_pass_interface: +err_exit_bios_attr_set_interface:exit_bios_attr_set_interface (); -fail_set_interface:return ret; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 194/254 platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 32418dd58c957f8fef25b97450d00275967604f1 ]
When either the attributes or the password interface is not found, then unregister the 2 wmi drivers again and return -ENODEV from sysman_init().
--- drivers/platform/x86/dell-wmi-sysman/sysman.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/platform/x86/dell-wmi-sysman/sysman.c +7 -5
@@ -506,15 +506,17 @@ static int __init sysman_init(void) } ret =init_bios_attr_set_interface (); -if (ret || !wmi_priv.bios_attr_wdev) { -pr_debug ("failed to initialize set interface\n" ); +if (ret)return ret; - } ret =init_bios_attr_pass_interface (); -if (ret || !wmi_priv.password_attr_wdev) { -pr_debug ("failed to initialize pass interface\n" ); +if (ret) goto err_exit_bios_attr_set_interface; + +if (!wmi_priv.bios_attr_wdev || !wmi_priv.password_attr_wdev) { +pr_debug ("failed to find set or pass interface\n" ); + ret = -ENODEV ; + goto err_exit_bios_attr_pass_interface; } ret =class_register (&firmware_attributes_class);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 195/254 drm/msm: fix shutdown hook in case GPU components failed to bind
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 623f279c77811475ac8fd5635cc4e4451aa71291 ]
If GPU components have failed to bind, shutdown callback would fail with the following backtrace. Add safeguard check to stop that oops from happening and allow the board to reboot.
[ 66.617046] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 66.626066] Mem abort info: [ 66.628939] ESR = 0x96000006 [ 66.632088] EC = 0x25: DABT (current EL), IL = 32 bits [ 66.637542] SET = 0, FnV = 0 [ 66.640688] EA = 0, S1PTW = 0 [ 66.643924] Data abort info: [ 66.646889] ISV = 0, ISS = 0x00000006 [ 66.650832] CM = 0, WnR = 0 [ 66.653890] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000107f81000 [ 66.660505] [0000000000000000] pgd=0000000100bb2003, p4d=0000000100bb2003, pud=0000000100897003, pmd=0000000000000000 [ 66.671398] Internal error: Oops: 96000006 [#1] PREEMPT SMP [ 66.677115] Modules linked in: [ 66.680261] CPU: 6 PID: 352 Comm: reboot Not tainted 5.11.0-rc2-00309-g79e3faa756b2 #38 [ 66.688473] Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) [ 66.695347] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 66.701507] pc : msm_atomic_commit_tail+0x78/0x4e0 [ 66.706437] lr : commit_tail+0xa4/0x184 [ 66.710381] sp : ffff8000108f3af0 [ 66.713791] x29: ffff8000108f3af0 x28: ffff418c44337000 [ 66.719242] x27: 0000000000000000 x26: ffff418c40a24490 [ 66.724693] x25: ffffd3a842a4f1a0 x24: 0000000000000008 [ 66.730146] x23: ffffd3a84313f030 x22: ffff418c444ce000 [ 66.735598] x21: ffff418c408a4980 x20: 0000000000000000 [ 66.741049] x19: 0000000000000000 x18: ffff800010710fbc [ 66.746500] x17: 000000000000000c x16: 0000000000000001 [ 66.751954] x15: 0000000000010008 x14: 0000000000000068 [ 66.757405] x13: 0000000000000001 x12: 0000000000000000 [ 66.762855] x11: 0000000000000001 x10: 00000000000009b0 [ 66.768306] x9 : ffffd3a843192000 x8 : ffff418c44337000 [ 66.773757] x7 : 0000000000000000 x6 : 00000000a401b34e [ 66.779210] x5 : 00ffffffffffffff x4 : 0000000000000000 [ 66.784660] x3 : 0000000000000000 x2 : ffff418c444ce000 [ 66.790111] x1 : ffffd3a841dce530 x0 : ffff418c444cf000 [ 66.795563] Call trace: [ 66.798075] msm_atomic_commit_tail+0x78/0x4e0 [ 66.802633] commit_tail+0xa4/0x184 [ 66.806217] drm_atomic_helper_commit+0x160/0x390 [ 66.811051] drm_atomic_commit+0x4c/0x60 [ 66.815082] drm_atomic_helper_disable_all+0x1f4/0x210 [ 66.820355] drm_atomic_helper_shutdown+0x80/0x130 [ 66.825276] msm_pdev_shutdown+0x14/0x20 [ 66.829303] platform_shutdown+0x28/0x40 [ 66.833330] device_shutdown+0x158/0x330 [ 66.837357] kernel_restart+0x40/0xa0 [ 66.841122] __do_sys_reboot+0x228/0x250 [ 66.845148] __arm64_sys_reboot+0x28/0x34 [ 66.849264] el0_svc_common.constprop.0+0x74/0x190 [ 66.854187] do_el0_svc+0x24/0x90 [ 66.857595] el0_svc+0x14/0x20 [ 66.860739] el0_sync_handler+0x1a4/0x1b0 [ 66.864858] el0_sync+0x174/0x180 [ 66.868269] Code: 1ac020a0 2a000273 eb02007f 54ffff01 (f9400285) [ 66.874525] ---[ end trace 20dedb2a3229fec8 ]---
--- drivers/gpu/drm/msm/msm_drv.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/msm/msm_drv.c +4 -0
@@ -1311,6 +1311,10 @@ static int msm_pdev_remove(struct platform_device *pdev)static void msm_pdev_shutdown (struct platform_device *pdev) {struct drm_device *drm =platform_get_drvdata (pdev); +struct msm_drm_private *priv = drm ? drm->dev_private :NULL ; + +if (!priv || !priv->kms) +return ;drm_atomic_helper_shutdown (drm); }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 196/254 drm/msm: Fix suspend/resume on i.MX5
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
[ Upstream commit a9748134ea4aad989e52a6a91479e0acfd306e5b ]
When putting iMX5 into suspend, the following flow is observed:
[ 70.023427] [<c07755f0>] (msm_atomic_commit_tail) from [<c06e7218>] (commit_tail+0x9c/0x18c) [ 70.031890] [<c06e7218>] (commit_tail) from [<c0e2920c>] (drm_atomic_helper_commit+0x1a0/0x1d4) [ 70.040627] [<c0e2920c>] (drm_atomic_helper_commit) from [<c06e74d4>] (drm_atomic_helper_disable_all+0x1c4/0x1d4) [ 70.050913] [<c06e74d4>] (drm_atomic_helper_disable_all) from [<c0e2943c>] (drm_atomic_helper_suspend+0xb8/0x170) [ 70.061198] [<c0e2943c>] (drm_atomic_helper_suspend) from
[<c06e84bc>] (drm_mode_config_helper_suspend+0x24/0x58)
In the i.MX5 case, priv->kms is not populated (as i.MX5 does not use any of the Qualcomm display controllers), causing a NULL pointer dereference in msm_atomic_commit_tail():
[ 24.268964] 8<--- cut here --- [ 24.274602] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 24.283434] pgd = (ptrval) [ 24.286387] [00000000] *pgd=ca212831 [ 24.290788] Internal error: Oops: 17 [#1] SMP ARM [ 24.295609] Modules linked in: [ 24.298777] CPU: 0 PID: 197 Comm: init Not tainted 5.11.0-rc2-next-20210111 #333 [ 24.306276] Hardware name: Freescale i.MX53 (Device Tree Support) [ 24.312442] PC is at msm_atomic_commit_tail+0x54/0xb9c [ 24.317743] LR is at commit_tail+0xa4/0x1b0
Fix the problem by calling drm_mode_config_helper_suspend/resume() only when priv->kms is available.
--- drivers/gpu/drm/msm/msm_drv.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/msm/msm_drv.c +8 -0
@@ -1072,6 +1072,10 @@ static int __maybe_unused msm_pm_resume(struct device *dev)static int __maybe_unused msm_pm_prepare (struct device *dev) {struct drm_device *ddev =dev_get_drvdata (dev); +struct msm_drm_private *priv = ddev ? ddev->dev_private :NULL ; + +if (!priv || !priv->kms) +return 0 ;return drm_mode_config_helper_suspend (ddev); }
@@ -1079,6 +1083,10 @@ static int __maybe_unused msm_pm_prepare(struct device *dev)static void __maybe_unused msm_pm_complete (struct device *dev) {struct drm_device *ddev =dev_get_drvdata (dev); +struct msm_drm_private *priv = ddev ? ddev->dev_private :NULL ; + +if (!priv || !priv->kms) +return ;drm_mode_config_helper_resume (ddev); }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 197/254 arm64: kdump: update ppos when reading elfcorehdr
In reply to Greg Kroah-HartmanFrom: Pavel Tatashin <[email protected]>
[ Upstream commit 141f8202cfa4192c3af79b6cbd68e7760bb01b5a ]
The ppos points to a position in the old kernel memory (and in case of arm64 in the crash kernel since elfcorehdr is passed as a segment). The function should update the ppos by the amount that was read. This bug is not exposed by accident, but other platforms update this value properly. So, fix it in ARM64 version of elfcorehdr_read() as well.
--- arch/arm64/kernel/crash_dump.c | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/kernel/crash_dump.c +2 -0
@@ -64,5 +64,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,ssize_t elfcorehdr_read (char *buf,size_t count,u64 *ppos) {memcpy (buf,phys_to_virt ((phys_addr_t)*ppos), count); + *ppos += count; +return count; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 198/254 PM: runtime: Defer suspending suppliers
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit 5244f5e2d801259af877ee759e8c22364c607072 ]
Because the PM-runtime status of the device is not updated in __rpm_callback(), attempts to suspend the suppliers of the given device triggered by the rpm_put_suppliers() call in there may cause a supplier to be suspended completely before the status of the consumer is updated to RPM_SUSPENDED, which is confusing.
To avoid that (1) modify __rpm_callback() to only decrease the PM-runtime usage counter of each supplier and (2) make rpm_suspend() try to suspend the suppliers after changing the consumer's status to RPM_SUSPENDED, in analogy with the device's parent.
--- drivers/base/power/runtime.c | 45 +++++++++++++++++++++++++++++++----- 1 file changed, 39 insertions(+), 6 deletions(-)
drivers/base/power/runtime.c +39 -6
@@ -305,7 +305,7 @@ static int rpm_get_suppliers(struct device *dev)return 0 ; } -static void rpm_put_suppliers (struct device *dev) +static void __rpm_put_suppliers (struct device *dev,bool try_to_suspend) {struct device_link *link;
@@ -313,10 +313,30 @@ static void rpm_put_suppliers(struct device *dev) device_links_read_lock_held()) {while (refcount_dec_not_one (&link->rpm_active)) -pm_runtime_put (link->supplier); +pm_runtime_put_noidle (link->supplier); + +if (try_to_suspend) +pm_request_idle (link->supplier); } } +static void rpm_put_suppliers (struct device *dev) +{ +__rpm_put_suppliers (dev, true); +} + +static void rpm_suspend_suppliers (struct device *dev) +{ +struct device_link *link; +int idx =device_links_read_lock (); + +list_for_each_entry_rcu (link, &dev->links.suppliers, c_node, +device_links_read_lock_held ()) +pm_request_idle (link->supplier); + +device_links_read_unlock (idx); +} +/** * __rpm_callback - Run a given runtime PM callback for a given device. * @cb: Runtime PM callback to run.
@@ -344,8 +364,10 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev) idx =device_links_read_lock (); retval =rpm_get_suppliers (dev); -if (retval) +if (retval) { +rpm_put_suppliers (dev); goto fail; + }device_links_read_unlock (idx); }
@@ -368,9 +390,9 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev) || (dev->power.runtime_status == RPM_RESUMING && retval))) { idx =device_links_read_lock (); - fail: -rpm_put_suppliers (dev); +__rpm_put_suppliers (dev, false); +fail:device_links_read_unlock (idx); }
@@ -642,8 +664,11 @@ static int rpm_suspend(struct device *dev, int rpmflags) goto out; } +if (dev->power.irq_safe) + goto out; +/* Maybe the parent is now able to suspend. */ -if (parent && !parent->power.ignore_children && !dev->power.irq_safe) { +if (parent && !parent->power.ignore_children) {spin_unlock (&dev->power.lock);spin_lock (&parent->power.lock);
@@ -652,6 +677,14 @@ static int rpm_suspend(struct device *dev, int rpmflags)spin_lock (&dev->power.lock); } +/* Maybe the suppliers are now able to suspend. */ +if (dev->power.links_count >0 ) { +spin_unlock_irq (&dev->power.lock); + +rpm_suspend_suppliers (dev); + +spin_lock_irq (&dev->power.lock); + } out:trace_rpm_return_int_rcuidle (dev, _THIS_IP_, retval);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 199/254 net/mlx5: Add back multicast stats for uplink representor
In reply to Greg Kroah-HartmanFrom: Huy Nguyen <[email protected]>
[ Upstream commit a07231084da2207629b42244380ae2f1e10bd9b4 ]
The multicast counter got removed from uplink representor due to the cited patch.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +7 -0
@@ -3703,10 +3703,17 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats) }if (mlx5e_is_uplink_rep (priv)) { +struct mlx5e_vport_stats *vstats = &priv->stats.vport; + stats->rx_packets =PPORT_802_3_GET (pstats, a_frames_received_ok); stats->rx_bytes =PPORT_802_3_GET (pstats, a_octets_received_ok); stats->tx_packets =PPORT_802_3_GET (pstats, a_frames_transmitted_ok); stats->tx_bytes =PPORT_802_3_GET (pstats, a_octets_transmitted_ok); + +/* vport multicast also counts packets that are dropped due to steering +* or rx out of buffer +*/ + stats->multicast =VPORT_COUNTER_GET (vstats, received_eth_multicast.packets); }else {mlx5e_fold_sw_stats64 (priv, stats); }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 200/254 net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP
In reply to Greg Kroah-HartmanFrom: Alaa Hleihel <[email protected]>
[ Upstream commit 7d6c86e3ccb5ceea767df5c7a9a17cdfccd3df9a ]
Currently, we support hardware offload only for MPLS over UDP. However, rules matching on MPLS parameters are now wrongly offloaded for regular MPLS, without actually taking the parameters into consideration when doing the offload.
Fix it by rejecting such unsupported rules.
--- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +10 -0
@@ -2595,6 +2595,16 @@ static int __parse_cls_flower(struct mlx5e_priv *priv, *match_level =MLX5_MATCH_L4 ; } +/* Currenlty supported only for MPLS over UDP */ +if (flow_rule_match_key (rule,FLOW_DISSECTOR_KEY_MPLS ) && + !netif_is_bareudp (filter_dev)) { +NL_SET_ERR_MSG_MOD (extack, +"Matching on MPLS is supported only for MPLS over UDP" ); +netdev_err (priv->netdev, +"Matching on MPLS is supported only for MPLS over UDP\n" ); +return -EOPNOTSUPP ; + } +return 0 ; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 201/254 net/mlx5e: Offload tuple rewrite for non-CT flows
In reply to Greg Kroah-HartmanFrom: Dima Chumak <[email protected]>
[ Upstream commit 96b5b4585843e3c83fb1930e5dfbefd0fb889c55 ]
Setting connection tracking OVS flows and then setting non-CT flows that use tuple rewrite action (e.g. mod_tp_dst), causes the latter flows not being offloaded.
Fix by using a stricter condition in modify_header_match_supported() to check tuple rewrite support only for flows with CT action. The check is factored out into standalone modify_tuple_supported() function to aid readability.
--- .../ethernet/mellanox/mlx5/core/en/tc_ct.c | 3 +- .../net/ethernet/mellanox/mlx5/core/en_tc.c | 44 ++++++++++++++----- 2 files changed, 35 insertions(+), 12 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c +2 -1
@@ -1182,7 +1182,8 @@ int mlx5_tc_ct_add_no_trk_match(struct mlx5_flow_spec *spec)mlx5e_tc_match_to_reg_get_match (spec,CTSTATE_TO_REG , &ctstate, &ctstate_mask); -if (ctstate_mask) + +if ((ctstate & ctstate_mask) ==MLX5_CT_STATE_TRK_BIT )return -EOPNOTSUPP ; ctstate_mask |=MLX5_CT_STATE_TRK_BIT ;
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +33 -11
57 lines not on this page · raw message
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 202/254 net/mlx5e: Fix error path for ethtool set-priv-flag
In reply to Greg Kroah-HartmanFrom: Aya Levin <[email protected]>
[ Upstream commit 4eacfe72e3e037e3fc019113df32c39a705148c2 ]
Expose error value when failing to comply to command:
$ ethtool --set-priv-flags eth2 rx_cqe_compress [on/off]
--- drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +5 -1
@@ -1876,6 +1876,7 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, {struct mlx5e_priv *priv =netdev_priv (netdev);struct mlx5_core_dev *mdev = priv->mdev; +int err;if (!MLX5_CAP_GEN (mdev, cqe_compression))return -EOPNOTSUPP ;
@@ -1885,7 +1886,10 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev,return -EINVAL ; } -mlx5e_modify_rx_cqe_compression_locked (priv, enable); + err =mlx5e_modify_rx_cqe_compression_locked (priv, enable); +if (err) +return err; + priv->channels.params.rx_cqe_compress_def = enable;return 0 ;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 203/254 mfd: intel_quark_i2c_gpio: Revert "Constify static struct resources"
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit a61f4661fba404418a7c77e86586dc52a58a93c6 ]
The structures are used as place holders, so they are modified at run-time. Obviously they may not be constants.
BUG: unable to handle page fault for address: d0643220 ... CPU: 0 PID: 110 Comm: modprobe Not tainted 5.11.0+ #1 Hardware name: Intel Corp. QUARK/GalileoGen2, BIOS 0x01000200 01/01/2014 EIP: intel_quark_mfd_probe+0x93/0x1c0 [intel_quark_i2c_gpio]
This partially reverts the commit c4a164f41554d2899bed94bdcc499263f41787b4.
While at it, add a comment to avoid similar changes in the future.
--- drivers/mfd/intel_quark_i2c_gpio.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/mfd/intel_quark_i2c_gpio.c +4 -2
@@ -72,7 +72,8 @@ static const struct dmi_system_id dmi_platform_info[] = { {} }; -static const struct resource intel_quark_i2c_res[] = { +/* This is used as a place holder and will be modified at run-time */ +static struct resource intel_quark_i2c_res[] = { [INTEL_QUARK_IORES_MEM ] = { .flags =IORESOURCE_MEM , },
@@ -85,7 +86,8 @@ static struct mfd_cell_acpi_match intel_quark_acpi_match_i2c = { .adr = MFD_ACPI_MATCH_I2C, }; -static const struct resource intel_quark_gpio_res[] = { +/* This is used as a place holder and will be modified at run-time */ +static struct resource intel_quark_gpio_res[] = { [INTEL_QUARK_IORES_MEM ] = { .flags =IORESOURCE_MEM , },
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 204/254 PM: EM: postpone creating the debugfs dir till fs_initcall
In reply to Greg Kroah-HartmanFrom: Lukasz Luba <[email protected]>
[ Upstream commit fb9d62b27ab1e07d625591549c314b7d406d21df ]
The debugfs directory '/sys/kernel/debug/energy_model' is needed before the Energy Model registration can happen. With the recent change in debugfs subsystem it's not allowed to create this directory at early stage (core_initcall). Thus creating this directory would fail.
Postpone the creation of the EM debug dir to later stage: fs_initcall.
It should be safe since all clients: CPUFreq drivers, Devfreq drivers will be initialized in later stages.
The custom debug log below prints the time of creation the EM debug dir at fs_initcall and successful registration of EMs at later stages.
[ 1.505717] energy_model: creating rootdir [ 3.698307] cpu cpu0: EM: created perf domain [ 3.709022] cpu cpu1: EM: created perf domain
--- kernel/power/energy_model.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/power/energy_model.c +1 -1
@@ -98,7 +98,7 @@ static int __init em_debug_init(void) return 0; } -core_initcall (em_debug_init); +fs_initcall (em_debug_init);#else /* CONFIG_DEBUG_FS */ static void em_debug_create_pd (struct device *dev) {}static void em_debug_remove_pd (struct device *dev) {}
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 205/254 platform/x86: intel_pmt_crashlog: Fix incorrect macros
In reply to Greg Kroah-HartmanFrom: David E. Box <[email protected]>
[ Upstream commit 10c931cdfe64ebc38a15a485dd794915044f2111 ]
Fixes off-by-one bugs in the macro assignments for the crashlog control bits. Was initially tested on emulation but bug revealed after testing on silicon.
--- drivers/platform/x86/intel_pmt_crashlog.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/platform/x86/intel_pmt_crashlog.c +6 -7
@@ -23,18 +23,17 @@#define CRASH_TYPE_OOBMSM 1/* Control Flags */ -#define CRASHLOG_FLAG_DISABLE BIT(27) +#define CRASHLOG_FLAG_DISABLE BIT(28)/* -* Bits 28 and 29 control the state of bit 31. +* Bits 29 and 30 control the state of bit 31. * -* Bit 28 will clear bit 31, if set, allowing a new crashlog to be captured. -* Bit 29 will immediately trigger a crashlog to be generated, setting bit 31. -* Bit 30 is read-only and reserved as 0. +* Bit 29 will clear bit 31, if set, allowing a new crashlog to be captured. +* Bit 30 will immediately trigger a crashlog to be generated, setting bit 31. * Bit 31 is the read-only status with a 1 indicating log is complete. */ -#define CRASHLOG_FLAG_TRIGGER_CLEAR BIT(28) -#define CRASHLOG_FLAG_TRIGGER_EXECUTE BIT(29) +#define CRASHLOG_FLAG_TRIGGER_CLEAR BIT(29) +#define CRASHLOG_FLAG_TRIGGER_EXECUTE BIT(30)#define CRASHLOG_FLAG_TRIGGER_COMPLETE BIT(31)#define CRASHLOG_FLAG_TRIGGER_MASK GENMASK(31, 28)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 206/254 net: bridge: dont notify switchdev for local FDB addresses
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 6ab4c3117aec4e08007d9e971fa4133e1de1082d ]
As explained in this discussion:
https://lore.kernel.org/netdev/20210117193009.io3nungdwuzmo5f7@skbuf/
the switchdev notifiers for FDB entries managed to have a zero-day bug. The bridge would not say that this entry is local:
ip link add br0 type bridge
ip link set swp0 master br0
bridge fdb add dev swp0 00:01:02:03:04:05 master local
and the switchdev driver would be more than happy to offload it as a normal static FDB entry. This is despite the fact that 'local' and non-'local' entries have completely opposite directions: a local entry is locally terminated and not forwarded, whereas a static entry is forwarded and not locally terminated. So, for example, DSA would install this entry on swp0 instead of installing it on the CPU port as it should.
There is an even sadder part, which is that the 'local' flag is implicit if 'static' is not specified, meaning that this command produces the same result of adding a 'local' entry:
bridge fdb add dev swp0 00:01:02:03:04:05 master
I've updated the man pages for 'bridge', and after reading it now, it should be pretty clear to any user that the commands above were broken and should have never resulted in the 00:01:02:03:04:05 address being forwarded (this behavior is coherent with non-switchdev interfaces):
https://patchwork.kernel.org/project/netdevbpf/cover/[email protected]/
If you're a user reading this and this is what you want, just use:
bridge fdb add dev swp0 00:01:02:03:04:05 master static
Because switchdev should have given drivers the means from day one to classify FDB entries as local/non-local, but didn't, it means that all drivers are currently broken. So we can just as well omit the switchdev notifications for local FDB entries, which is exactly what this patch does to close the bug in stable trees. For further development work where drivers might want to trap the local FDB entries to the host, we can add a 'bool is_local' to br_switchdev_fdb_call_notifiers(), and selectively make drivers act upon that bit, while all the others ignore those entries if the 'is_local' bit is set.
--- net/bridge/br_switchdev.c | 2 ++ 1 file changed, 2 insertions(+)
net/bridge/br_switchdev.c +2 -0
@@ -123,6 +123,8 @@ br_switchdev_fdb_notify(const struct net_bridge_fdb_entry *fdb, int type) {if (!fdb->dst)return ; +if (test_bit (BR_FDB_LOCAL , &fdb->flags)) +return ;switch (type) {case RTM_DELNEIGH :
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 207/254 octeontx2-af: Fix memory leak of object buf
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 9e0a537d06fc36861e4f78d0a7df1fe2b3592714 ]
Currently the error return path when lfs fails to allocate is not free'ing the memory allocated to buf. Fix this by adding the missing kfree.
Addresses-Coverity: ("Resource leak")
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +3 -1
@@ -169,8 +169,10 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp,return -ENOSPC ; lfs =kzalloc (lf_str_size,GFP_KERNEL ); -if (!lfs) +if (!lfs) { +kfree (buf);return -ENOMEM ; + } off +=scnprintf (&buf[off], buf_size -1 - off,"%-*s" , lf_str_size,"pcifunc" );for (index =0 ; index <BLK_COUNT ; index++)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 208/254 xen/x86: make XEN_BALLOON_MEMORY_HOTPLUG_LIMIT depend on MEMORY_HOTPLUG
In reply to Greg Kroah-HartmanFrom: Roger Pau Monne <[email protected]>
[ Upstream commit 2b514ec72706a31bea0c3b97e622b81535b5323a ]
The Xen memory hotplug limit should depend on the memory hotplug generic option, rather than the Xen balloon configuration. It's possible to have a kernel with generic memory hotplug enabled, but without Xen balloon enabled, at which point memory hotplug won't work correctly due to the size limitation of the p2m.
Rename the option to XEN_MEMORY_HOTPLUG_LIMIT since it's no longer tied to ballooning.
--- arch/x86/xen/p2m.c | 4 ++-- drivers/xen/Kconfig | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/x86/xen/p2m.c +2 -2
@@ -98,8 +98,8 @@ EXPORT_SYMBOL_GPL(xen_p2m_size);unsigned long xen_max_p2m_pfn__read_mostly ;EXPORT_SYMBOL_GPL (xen_max_p2m_pfn); -#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT -#define P2M_LIMIT CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT +#ifdef CONFIG_XEN_MEMORY_HOTPLUG_LIMIT +#define P2M_LIMIT CONFIG_XEN_MEMORY_HOTPLUG_LIMIT#else #define P2M_LIMIT 0#endif
drivers/xen/Kconfig +2 -2
@@ -50,11 +50,11 @@ config XEN_BALLOON_MEMORY_HOTPLUG SUBSYSTEM=="memory", ACTION=="add", RUN+="/bin/sh -c '[ -f /sys$devpath/state ] && echo online > /sys$devpath/state'" -config XEN_BALLOON_MEMORY_HOTPLUG_LIMIT +config XEN_MEMORY_HOTPLUG_LIMIT int "Hotplugged memory limit (in GiB) for a PV guest" default 512 depends on XEN_HAVE_PVMMU - depends on XEN_BALLOON_MEMORY_HOTPLUG + depends on MEMORY_HOTPLUG help Maxmium amount of memory (in GiB) that a PV guest can be expanded to when using memory hotplug.
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 209/254 RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server
In reply to Greg Kroah-HartmanFrom: Potnuri Bharat Teja <[email protected]>
[ Upstream commit 3408be145a5d6418ff955fe5badde652be90e700 ]
Not setting the ipv6 bit while destroying ipv6 listening servers may result in potential fatal adapter errors due to lookup engine memory hash errors. Therefore always set ipv6 field while destroying ipv6 listening servers.
--- drivers/infiniband/hw/cxgb4/cm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/cxgb4/cm.c +2 -2
@@ -3610,13 +3610,13 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id) ep->com.local_addr.ss_family == AF_INET) { err = cxgb4_remove_server_filter( ep->com.dev->rdev.lldi.ports[0], ep->stid, - ep->com.dev->rdev.lldi.rxq_ids[0], 0); + ep->com.dev->rdev.lldi.rxq_ids[0], false); } else {struct sockaddr_in6 *sin6;c4iw_init_wr_wait (ep->com.wr_waitp); err =cxgb4_remove_server ( ep->com.dev->rdev.lldi.ports[0 ], ep->stid, - ep->com.dev->rdev.lldi.rxq_ids[0 ],0 ); + ep->com.dev->rdev.lldi.rxq_ids[0 ], true);if (err) goto done; err = c4iw_wait_for_reply(&ep->com.dev->rdev, ep->com.wr_waitp,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 210/254 mm: memblock: fix section mismatch warning again
In reply to Greg Kroah-HartmanFrom: Mike Rapoport <[email protected]>
[ Upstream commit a024b7c2850dddd01e65b8270f0971deaf272f27 ]
Commit 34dc2efb39a2 ("memblock: fix section mismatch warning") marked memblock_bottom_up() and memblock_set_bottom_up() as __init, but they could be referenced from non-init functions like memblock_find_in_range_node() on architectures that enable CONFIG_ARCH_KEEP_MEMBLOCK.
For such builds kernel test robot reports:
WARNING: modpost: vmlinux.o(.text+0x74fea4): Section mismatch in reference from the function memblock_find_in_range_node() to the function .init.text:memblock_bottom_up() The function memblock_find_in_range_node() references the function __init memblock_bottom_up().
This is often because memblock_find_in_range_node lacks a __init annotation or the annotation of memblock_bottom_up is wrong.
Replace __init annotations with __init_memblock annotations so that the appropriate section will be selected depending on CONFIG_ARCH_KEEP_MEMBLOCK.
--- include/linux/memblock.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/memblock.h +2 -2
@@ -460,7 +460,7 @@ static inline void memblock_free_late(phys_addr_t base, phys_addr_t size)/* * Set the allocation direction to bottom-up or top-down. */ -static inline __init void memblock_set_bottom_up (bool enable) +static inline __init_memblock void memblock_set_bottom_up(bool enable) { memblock.bottom_up = enable; }
@@ -470,7 +470,7 @@ static inline __init void memblock_set_bottom_up(bool enable)* if this is true, that said, memblock will allocate memory * in bottom-up direction. */ -static inline __init bool memblock_bottom_up (void ) +static inline __init_memblock bool memblock_bottom_up(void) {return memblock.bottom_up; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 211/254 bpf: Dont do bpf_cgroup_storage_set() for kuprobe/tp programs
In reply to Greg Kroah-Hartman[ Upstream commit 05a68ce5fa51a83c360381630f823545c5757aa2 ]
For kuprobe and tracepoint bpf programs, kernel calls trace_call_bpf() which calls BPF_PROG_RUN_ARRAY_CHECK() to run the program array. Currently, BPF_PROG_RUN_ARRAY_CHECK() also calls bpf_cgroup_storage_set() to set percpu cgroup local storage with NULL value. This is
due to Commit 394e40a29788 ("bpf: extend bpf_prog_array to store pointers to the cgroup storage") which modified __BPF_PROG_RUN_ARRAY() to call bpf_cgroup_storage_set() and this macro is also used by BPF_PROG_RUN_ARRAY_CHECK().
kuprobe and tracepoint programs are not allowed to call bpf_get_local_storage() helper hence does not access percpu cgroup local storage. Let us change BPF_PROG_RUN_ARRAY_CHECK() not to modify percpu cgroup local storage.
The issue is observed when I tried to debug [1] where percpu data is overwritten due to
preempt_disable -> migration_disable
change. This patch does not completely fix the above issue, which will be addressed separately, e.g., multiple cgroup prog runs may preempt each other. But it does fix any potential issue caused by tracing program overwriting percpu cgroup storage:
- in a busy system, a tracing program is to run between bpf_cgroup_storage_set() and the cgroup prog run.
- a kprobe program is triggered by a helper in cgroup prog before bpf_get_local_storage() is called.
[1] https://lore.kernel.org/bpf/CAKH8qBuXCfUz=w8L+Fj74OaUpbosO29niYwTki7e3Ag044_aww@mail.gmail.com/T
--- include/linux/bpf.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
include/linux/bpf.h +5 -4
@@ -1066,7 +1066,7 @@ int bpf_prog_array_copy(struct bpf_prog_array *old_array,struct bpf_prog *include_prog, struct bpf_prog_array **new_array); -#define __BPF_PROG_RUN_ARRAY (array, ctx, func, check_non_null) \ +#define __BPF_PROG_RUN_ARRAY (array, ctx, func, check_non_null, set_cg_storage) \ ({ \ struct bpf_prog_array_item *_item; \ struct bpf_prog *_prog; \
@@ -1079,7 +1079,8 @@ int bpf_prog_array_copy(struct bpf_prog_array *old_array, goto _out; \ _item = &_array->items[0 ]; \while ((_prog =READ_ONCE (_item->prog))) { \ -bpf_cgroup_storage_set (_item->cgroup_storage); \ +if (set_cg_storage) \ +bpf_cgroup_storage_set (_item->cgroup_storage); \ _ret &=func (_prog, ctx); \ _item++; \ } \
@@ -1140,10 +1141,10 @@ _out: \ })#define BPF_PROG_RUN_ARRAY (array, ctx, func) \ - __BPF_PROG_RUN_ARRAY(array, ctx, func, false) + __BPF_PROG_RUN_ARRAY(array, ctx, func, false, true)#define BPF_PROG_RUN_ARRAY_CHECK (array, ctx, func) \ - __BPF_PROG_RUN_ARRAY(array, ctx, func, true) + __BPF_PROG_RUN_ARRAY(array, ctx, func, true, false)#ifdef CONFIG_BPF_SYSCALL DECLARE_PER_CPU (int, bpf_prog_active);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 212/254 net: Consolidate common blackhole dst ops
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
[ Upstream commit c4c877b2732466b4c63217baad05c96f775912c7 ]
Move generic blackhole dst ops to the core and use them from both ipv4_dst_blackhole_ops and ip6_dst_blackhole_ops where possible. No functional change otherwise. We need these also in other locations and having to define them over and over again is not great.
--- include/net/dst.h | 11 +++++++++++ net/core/dst.c | 38 ++++++++++++++++++++++++++++++++++++++ net/ipv4/route.c | 45 ++++++++------------------------------------- net/ipv6/route.c | 36 +++++++++--------------------------- 4 files changed, 66 insertions(+), 64 deletions(-)
include/net/dst.h +11 -0
@@ -533,4 +533,15 @@ static inline void skb_dst_update_pmtu_no_confirm(struct sk_buff *skb, u32 mtu) dst->ops->update_pmtu(dst, NULL, skb, mtu, false); } +struct dst_entry *dst_blackhole_check (struct dst_entry *dst,u32 cookie); +void dst_blackhole_update_pmtu (struct dst_entry *dst,struct sock *sk, +struct sk_buff *skb,u32 mtu,bool confirm_neigh); +void dst_blackhole_redirect (struct dst_entry *dst,struct sock *sk, +struct sk_buff *skb); +u32 *dst_blackhole_cow_metrics (struct dst_entry *dst,unsigned long old); +struct neighbour *dst_blackhole_neigh_lookup (const struct dst_entry *dst, +struct sk_buff *skb, +const void *daddr); +unsigned int dst_blackhole_mtu (const struct dst_entry *dst); +#endif /* _NET_DST_H */
net/core/dst.c +38 -0
@@ -237,6 +237,44 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old) }EXPORT_SYMBOL (__dst_destroy_metrics_generic); +struct dst_entry *dst_blackhole_check (struct dst_entry *dst,u32 cookie) +{ +return NULL ; +} + +u32 *dst_blackhole_cow_metrics (struct dst_entry *dst,unsigned long old) +{ +return NULL ; +} + +struct neighbour *dst_blackhole_neigh_lookup (const struct dst_entry *dst, +struct sk_buff *skb, +const void *daddr) +{ +return NULL ; +} + +void dst_blackhole_update_pmtu (struct dst_entry *dst,struct sock *sk, +struct sk_buff *skb,u32 mtu, +bool confirm_neigh) +{ +} +EXPORT_SYMBOL_GPL (dst_blackhole_update_pmtu); + +void dst_blackhole_redirect (struct dst_entry *dst,struct sock *sk, +struct sk_buff *skb) +{ +} +EXPORT_SYMBOL_GPL (dst_blackhole_redirect); + +unsigned int dst_blackhole_mtu (const struct dst_entry *dst) +{ +unsigned int mtu =dst_metric_raw (dst,RTAX_MTU ); + +return mtu ? : dst->dev->mtu; +} +EXPORT_SYMBOL_GPL (dst_blackhole_mtu); +static struct dst_ops md_dst_ops = { .family =AF_UNSPEC , };
net/ipv4/route.c +8 -37
52 lines not on this page · raw message
net/ipv6/route.c +9 -27
@@ -258,34 +258,16 @@ static struct dst_ops ip6_dst_ops_template = { .confirm_neigh = ip6_confirm_neigh, }; -static unsigned int ip6_blackhole_mtu (const struct dst_entry *dst) -{ -unsigned int mtu =dst_metric_raw (dst,RTAX_MTU ); - -return mtu ? : dst->dev->mtu; -} - -static void ip6_rt_blackhole_update_pmtu (struct dst_entry *dst,struct sock *sk, -struct sk_buff *skb,u32 mtu, -bool confirm_neigh) -{ -} - -static void ip6_rt_blackhole_redirect (struct dst_entry *dst,struct sock *sk, -struct sk_buff *skb) -{ -} -static struct dst_ops ip6_dst_blackhole_ops = { - .family =AF_INET6 , - .destroy = ip6_dst_destroy, - .check = ip6_dst_check, - .mtu = ip6_blackhole_mtu, - .default_advmss = ip6_default_advmss, - .update_pmtu = ip6_rt_blackhole_update_pmtu, - .redirect = ip6_rt_blackhole_redirect, - .cow_metrics = dst_cow_metrics_generic, - .neigh_lookup = ip6_dst_neigh_lookup, + .family =AF_INET6 , + .default_advmss = ip6_default_advmss, + .neigh_lookup = ip6_dst_neigh_lookup, + .check = ip6_dst_check, + .destroy = ip6_dst_destroy, + .cow_metrics = dst_cow_metrics_generic, + .update_pmtu = dst_blackhole_update_pmtu, + .redirect = dst_blackhole_redirect, + .mtu = dst_blackhole_mtu, };static const u32 ip6_template_metrics[RTAX_MAX ] = {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 213/254 net, bpf: Fix ip6ip6 crash with collect_md populated skbs
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
[ Upstream commit a188bb5638d41aa99090ebf2f85d3505ab13fba5 ]
I ran into a crash where setting up a ip6ip6 tunnel device which was /not/ set to collect_md mode was receiving collect_md populated skbs for xmit.
The BPF prog was populating the skb via bpf_skb_set_tunnel_key() which is assigning special metadata dst entry and then redirecting the skb to the device, taking ip6_tnl_start_xmit() -> ipxip6_tnl_xmit() -> ip6_tnl_xmit() and in the latter it performs a neigh lookup based on skb_dst(skb) where we trigger a NULL pointer dereference on dst->ops->neigh_lookup() since the md_dst_ops do not populate neigh_lookup callback with a fake handler.
Transform the md_dst_ops into generic dst_blackhole_ops that can also be reused elsewhere when needed, and use them for the metadata dst entries as callback ops.
Also, remove the dst_md_discard{,_out}() ops and rely on dst_discard{,_out}() from dst_init() which free the skb the same way modulo the splat. Given we will be able to recover just fine from there, avoid any potential splats iff this gets ever triggered in future (or worse, panic on warns when set).
--- net/core/dst.c | 31 +++++++++---------------------- 1 file changed, 9 insertions(+), 22 deletions(-)
net/core/dst.c +9 -22
@@ -275,37 +275,24 @@ unsigned int dst_blackhole_mtu(const struct dst_entry *dst) }EXPORT_SYMBOL_GPL (dst_blackhole_mtu); -static struct dst_ops md_dst_ops = { - .family =AF_UNSPEC , +static struct dst_ops dst_blackhole_ops = { + .family =AF_UNSPEC , + .neigh_lookup = dst_blackhole_neigh_lookup, + .check = dst_blackhole_check, + .cow_metrics = dst_blackhole_cow_metrics, + .update_pmtu = dst_blackhole_update_pmtu, + .redirect = dst_blackhole_redirect, + .mtu = dst_blackhole_mtu, }; -static int dst_md_discard_out (struct net *net,struct sock *sk,struct sk_buff *skb) -{ -WARN_ONCE (1 ,"Attempting to call output on metadata dst\n" ); -kfree_skb (skb); -return 0 ; -} - -static int dst_md_discard (struct sk_buff *skb) -{ -WARN_ONCE (1 ,"Attempting to call input on metadata dst\n" ); -kfree_skb (skb); -return 0 ; -} -static void __metadata_dst_init (struct metadata_dst *md_dst,enum metadata_type type,u8 optslen) - {struct dst_entry *dst; dst = &md_dst->dst; -dst_init (dst, &md_dst_ops,NULL ,1 ,DST_OBSOLETE_NONE , +dst_init (dst, &dst_blackhole_ops,NULL ,1 ,DST_OBSOLETE_NONE ,DST_METADATA |DST_NOCOUNT ); - - dst->input = dst_md_discard; - dst->output = dst_md_discard_out; -memset (dst +1 ,0 ,sizeof (*md_dst) + optslen -sizeof (*dst)); md_dst->type = type; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 214/254 igb: avoid premature Rx buffer reuse
In reply to Greg Kroah-HartmanFrom: Li RongQing <[email protected]>
[ Upstream commit 98dfb02aa22280bd8833836d1b00ab0488fa951f ]
Igb needs a similar fix as commit 75aab4e10ae6a ("i40e: avoid premature Rx buffer reuse")
The page recycle code, incorrectly, relied on that a page fragment could not be freed inside xdp_do_redirect(). This assumption leads to that page fragments that are used by the stack/XDP redirect can be reused and overwritten.
To avoid this, store the page count prior invoking xdp_do_redirect().
Longer explanation:
Intel NICs have a recycle mechanism. The main idea is that a page is split into two parts. One part is owned by the driver, one part might be owned by someone else, such as the stack.
t0: Page is allocated, and put on the Rx ring
+---------------
used by NIC ->| upper buffer
(rx_buffer) +---------------
| lower buffer
+---------------
page count == USHRT_MAX rx_buffer->pagecnt_bias == USHRT_MAX
t1: Buffer is received, and passed to the stack (e.g.)
+---------------
| upper buff (skb)
+---------------
used by NIC ->| lower buffer
(rx_buffer) +---------------
page count == USHRT_MAX rx_buffer->pagecnt_bias == USHRT_MAX - 1
t2: Buffer is received, and redirected
+---------------
| upper buff (skb)
+---------------
used by NIC ->| lower buffer
(rx_buffer) +---------------Now, prior calling xdp_do_redirect():
page count == USHRT_MAX
rx_buffer->pagecnt_bias == USHRT_MAX - 2
This means that buffer *cannot* be flipped/reused, because the skb is still using it.
The problem arises when xdp_do_redirect() actually frees the segment. Then we get:
page count == USHRT_MAX - 1 rx_buffer->pagecnt_bias == USHRT_MAX - 2
Quoted 1 line
From a recycle perspective, the buffer can be flipped and reused,
which means that the skb data area is passed to the Rx HW ring!
To work around this, the page count is stored prior calling xdp_do_redirect().
--- drivers/net/ethernet/intel/igb/igb_main.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/igb/igb_main.c +15 -7
@@ -8232,7 +8232,8 @@ static inline bool igb_page_is_reserved(struct page *page)return (page_to_nid (page) !=numa_mem_id ()) ||page_is_pfmemalloc (page); } -static bool igb_can_reuse_rx_page (struct igb_rx_buffer *rx_buffer) +static bool igb_can_reuse_rx_page (struct igb_rx_buffer *rx_buffer, +int rx_buf_pgcnt) {unsigned int pagecnt_bias = rx_buffer->pagecnt_bias;struct page *page = rx_buffer->page;
@@ -8243,7 +8244,7 @@ static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer)#if (PAGE_SIZE <8192 )/* if we are only owner of page we can reuse it */ -if (unlikely ((page_ref_count (page) - pagecnt_bias) >1 )) +if (unlikely ((rx_buf_pgcnt - pagecnt_bias) >1 ))return false;#else #define IGB_LAST_OFFSET \
@@ -8633,11 +8634,17 @@ static unsigned int igb_rx_offset(struct igb_ring *rx_ring) }static struct igb_rx_buffer *igb_get_rx_buffer (struct igb_ring *rx_ring, -const unsigned int size) +const unsigned int size,int *rx_buf_pgcnt) {struct igb_rx_buffer *rx_buffer; rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean]; + *rx_buf_pgcnt = +#if (PAGE_SIZE <8192 ) +page_count (rx_buffer->page); +#else +0 ; +#endif prefetchw (rx_buffer->page);/* we are reusing so sync this buffer for CPU use */
@@ -8653,9 +8660,9 @@ static struct igb_rx_buffer *igb_get_rx_buffer(struct igb_ring *rx_ring, }static void igb_put_rx_buffer (struct igb_ring *rx_ring, -struct igb_rx_buffer *rx_buffer) +struct igb_rx_buffer *rx_buffer,int rx_buf_pgcnt) { -if (igb_can_reuse_rx_page (rx_buffer)) { +if (igb_can_reuse_rx_page (rx_buffer, rx_buf_pgcnt)) {/* hand second half of page back to the ring */ igb_reuse_rx_page (rx_ring, rx_buffer); }else {
@@ -8682,6 +8689,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget)u16 cleaned_count =igb_desc_unused (rx_ring);unsigned int xdp_xmit =0 ;struct xdp_buff xdp; +int rx_buf_pgcnt; xdp.rxq = &rx_ring->xdp_rxq;
@@ -8712,7 +8720,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget)*/ dma_rmb (); - rx_buffer =igb_get_rx_buffer (rx_ring, size); + rx_buffer =igb_get_rx_buffer (rx_ring, size, &rx_buf_pgcnt);/* retrieve a buffer from the ring */ if (!skb) {
@@ -8755,7 +8763,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget)break ; } -igb_put_rx_buffer (rx_ring, rx_buffer); +igb_put_rx_buffer (rx_ring, rx_buffer, rx_buf_pgcnt); cleaned_count++;/* fetch next buffer in frame if non-eop */
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 215/254 net: axienet: Fix probe error cleanup
In reply to Greg Kroah-HartmanFrom: Robert Hancock <[email protected]>
[ Upstream commit 59cd4f19267a0aab87a8c07e4426eb7187ee548d ]
The driver did not always clean up all allocated resources when probe failed. Fix the probe cleanup path to clean up everything that was allocated.
--- .../net/ethernet/xilinx/xilinx_axienet_main.c | 35 +++++++++++++------ 1 file changed, 24 insertions(+), 11 deletions(-)
drivers/net/ethernet/xilinx/xilinx_axienet_main.c +24 -11
@@ -1835,7 +1835,7 @@ static int axienet_probe(struct platform_device *pdev)if (IS_ERR (lp->regs)) {dev_err (&pdev->dev,"could not map Axi Ethernet regs.\n" ); ret =PTR_ERR (lp->regs); - goto free_netdev; + goto cleanup_clk; } lp->regs_start = ethres->start;
@@ -1910,12 +1910,12 @@ static int axienet_probe(struct platform_device *pdev)break ;default : ret = -EINVAL ; - goto free_netdev; + goto cleanup_clk; } }else { ret =of_get_phy_mode (pdev->dev.of_node, &lp->phy_mode);if (ret) - goto free_netdev; + goto cleanup_clk; }/* Find the DMA node, map the DMA registers, and decode the DMA IRQs */
@@ -1928,7 +1928,7 @@ static int axienet_probe(struct platform_device *pdev)dev_err (&pdev->dev,"unable to get DMA resource\n" );of_node_put (np); - goto free_netdev; + goto cleanup_clk; } lp->dma_regs =devm_ioremap_resource (&pdev->dev, &dmares);
@@ -1948,12 +1948,12 @@ static int axienet_probe(struct platform_device *pdev)if (IS_ERR (lp->dma_regs)) {dev_err (&pdev->dev,"could not map DMA regs\n" ); ret =PTR_ERR (lp->dma_regs); - goto free_netdev; + goto cleanup_clk; }if ((lp->rx_irq <=0 ) || (lp->tx_irq <=0 )) {dev_err (&pdev->dev,"could not determine irqs\n" ); ret = -ENOMEM ; - goto free_netdev; + goto cleanup_clk; }/* Autodetect the need for 64-bit DMA pointers.
@@ -1983,7 +1983,7 @@ static int axienet_probe(struct platform_device *pdev) ret =dma_set_mask_and_coherent (&pdev->dev,DMA_BIT_MASK (addr_width));if (ret) {dev_err (&pdev->dev,"No suitable DMA available\n" ); - goto free_netdev; + goto cleanup_clk; }/* Check for Ethernet core IRQ (optional) */
@@ -2014,12 +2014,12 @@ static int axienet_probe(struct platform_device *pdev)if (!lp->phy_node) {dev_err (&pdev->dev,"phy-handle required for 1000BaseX/SGMII\n" ); ret = -EINVAL ; - goto free_netdev; + goto cleanup_mdio; } lp->pcs_phy =of_mdio_find_device (lp->phy_node);if (!lp->pcs_phy) { ret = -EPROBE_DEFER ; - goto free_netdev; + goto cleanup_mdio; } lp->phylink_config.pcs_poll = true; }
@@ -2033,17 +2033,30 @@ static int axienet_probe(struct platform_device *pdev)if (IS_ERR (lp->phylink)) { ret =PTR_ERR (lp->phylink);dev_err (&pdev->dev,"phylink_create error (%i)\n" , ret); - goto free_netdev; + goto cleanup_mdio; } ret =register_netdev (lp->ndev);if (ret) {dev_err (lp->dev,"register_netdev() error (%i)\n" , ret); - goto free_netdev; + goto cleanup_phylink; }return 0 ; +cleanup_phylink: +phylink_destroy (lp->phylink); + +cleanup_mdio: +if (lp->pcs_phy) +put_device (&lp->pcs_phy->dev); +if (lp->mii_bus) +axienet_mdio_teardown (lp); +of_node_put (lp->phy_node); + +cleanup_clk: +clk_disable_unprepare (lp->clk); + free_netdev:free_netdev (ndev);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 216/254 net: phy: introduce phydev->port
In reply to Greg Kroah-HartmanFrom: Michael Walle <[email protected]>
[ Upstream commit 4217a64e18a1647a0dbc68cb3169a5a06f054ec8 ]
At the moment, PORT_MII is reported in the ethtool ops. This is odd because it is an interface between the MAC and the PHY and no external port. Some network card drivers will overwrite the port to twisted pair or fiber, though. Even worse, the MDI/MDIX setting is only used by ethtool if the port is twisted pair.
Set the port to PORT_TP by default because most PHY drivers are copper ones. If there is fibre support and it is enabled, the PHY driver will set it to PORT_FIBRE.
This will change reporting PORT_MII to either PORT_TP or PORT_FIBRE; except for the genphy fallback driver.
--- drivers/net/phy/broadcom.c | 2 ++ drivers/net/phy/dp83822.c | 3 +++ drivers/net/phy/dp83869.c | 4 ++++ drivers/net/phy/lxt.c | 1 + drivers/net/phy/marvell.c | 1 + drivers/net/phy/marvell10g.c | 2 ++ drivers/net/phy/micrel.c | 14 +++++++++++--- drivers/net/phy/phy.c | 2 +- drivers/net/phy/phy_device.c | 9 +++++++++ include/linux/phy.h | 2 ++ 10 files changed, 36 insertions(+), 4 deletions(-)
drivers/net/phy/broadcom.c +2 -0
@@ -505,6 +505,8 @@ static int bcm54616s_probe(struct phy_device *phydev)*/ if (!(val &BCM54616S_100FX_MODE )) phydev->dev_flags |=PHY_BCM_FLAGS_MODE_1000BX ; + + phydev->port =PORT_FIBRE ; }return 0 ;
drivers/net/phy/dp83822.c +3 -0
@@ -555,6 +555,9 @@ static int dp83822_probe(struct phy_device *phydev)dp83822_of_init (phydev); +if (dp83822->fx_enabled) + phydev->port =PORT_FIBRE ; +return 0 ; }
drivers/net/phy/dp83869.c +4 -0
@@ -855,6 +855,10 @@ static int dp83869_probe(struct phy_device *phydev)if (ret)return ret; +if (dp83869->mode ==DP83869_RGMII_100_BASE || + dp83869->mode ==DP83869_RGMII_1000_BASE ) + phydev->port =PORT_FIBRE ; +return dp83869_config_init (phydev); }
drivers/net/phy/lxt.c +1 -0
@@ -292,6 +292,7 @@ static int lxt973_probe(struct phy_device *phydev)phy_write (phydev,MII_BMCR , val);/* Remember that the port is in fiber mode. */ phydev->priv = lxt973_probe; + phydev->port =PORT_FIBRE ; }else { phydev->priv =NULL ; }
drivers/net/phy/marvell.c +1 -0
@@ -1552,6 +1552,7 @@ static int marvell_read_status_page(struct phy_device *phydev, int page) phydev->asym_pause =0 ; phydev->speed =SPEED_UNKNOWN ; phydev->duplex =DUPLEX_UNKNOWN ; + phydev->port = fiber ?PORT_FIBRE :PORT_TP ;if (phydev->autoneg ==AUTONEG_ENABLE ) err =marvell_read_status_page_an (phydev, fiber, status);
drivers/net/phy/marvell10g.c +2 -0
@@ -631,6 +631,7 @@ static int mv3310_read_status_10gbaser(struct phy_device *phydev) phydev->link =1 ; phydev->speed =SPEED_10000 ; phydev->duplex =DUPLEX_FULL ; + phydev->port =PORT_FIBRE ;return 0 ; }
@@ -690,6 +691,7 @@ static int mv3310_read_status_copper(struct phy_device *phydev) phydev->duplex = cssr1 &MV_PCS_CSSR1_DUPLEX_FULL ?DUPLEX_FULL :DUPLEX_HALF ; + phydev->port =PORT_TP ; phydev->mdix = cssr1 &MV_PCS_CSSR1_MDIX ?ETH_TP_MDI_X :ETH_TP_MDI ;
drivers/net/phy/micrel.c +11 -3
@@ -341,14 +341,19 @@ static int kszphy_config_init(struct phy_device *phydev)return kszphy_config_reset (phydev); } +static int ksz8041_fiber_mode (struct phy_device *phydev) +{ +struct device_node *of_node = phydev->mdio.dev.of_node; + +return of_property_read_bool (of_node,"micrel,fiber-mode" ); +} +static int ksz8041_config_init (struct phy_device *phydev) {__ETHTOOL_DECLARE_LINK_MODE_MASK (mask) = {0 , }; -struct device_node *of_node = phydev->mdio.dev.of_node; -/* Limit supported and advertised modes in fiber mode */ -if (of_property_read_bool (of_node,"micrel,fiber-mode" )) { +if (ksz8041_fiber_mode (phydev)) { phydev->dev_flags |=MICREL_PHY_FXEN ;linkmode_set_bit (ETHTOOL_LINK_MODE_100baseT_Full_BIT, mask);linkmode_set_bit (ETHTOOL_LINK_MODE_100baseT_Half_BIT, mask);
@@ -1176,6 +1181,9 @@ static int kszphy_probe(struct phy_device *phydev) } } +if (ksz8041_fiber_mode (phydev)) + phydev->port =PORT_FIBRE ; +/* Support legacy board-file configuration */ if (phydev->dev_flags &MICREL_PHY_50MHZ_CLK ) { priv->rmii_ref_clk_sel = true;
drivers/net/phy/phy.c +1 -1
@@ -310,7 +310,7 @@ void phy_ethtool_ksettings_get(struct phy_device *phydev,if (phydev->interface ==PHY_INTERFACE_MODE_MOCA ) cmd->base.port =PORT_BNC ;else - cmd->base.port =PORT_MII ; + cmd->base.port = phydev->port; cmd->base.transceiver =phy_is_internal (phydev) ?XCVR_INTERNAL :XCVR_EXTERNAL ; cmd->base.phy_address = phydev->mdio.addr;
drivers/net/phy/phy_device.c +9 -0
@@ -576,6 +576,7 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, dev->pause =0 ; dev->asym_pause =0 ; dev->link =0 ; + dev->port =PORT_TP ; dev->interface =PHY_INTERFACE_MODE_GMII ; dev->autoneg =AUTONEG_ENABLE ;
@@ -1382,6 +1383,14 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, phydev->state =PHY_READY ; +/* Port is set to PORT_TP by default and the actual PHY driver will set +* it to different value depending on the PHY configuration. If we have +* the generic PHY driver we can't figure it out, thus set the old +* legacy PORT_MII value. +*/ +if (using_genphy) + phydev->port =PORT_MII ; +/* Initial carrier state is off as the phy is about to be * (re)initialized. */
include/linux/phy.h +2 -0
@@ -499,6 +499,7 @@ struct macsec_ops;* * @speed: Current link speed * @duplex: Current duplex +* @port: Current port * @pause: Current pause * @asym_pause: Current asymmetric pause * @supported: Combined MAC/PHY supported linkmodes
@@ -577,6 +578,7 @@ struct phy_device {*/ int speed;int duplex; +int port;int pause;int asym_pause;u8 master_slave_get;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 217/254 net: phy: broadcom: Avoid forward for bcm54xx_config_clock_delay()
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 133bf7b4fbbe58cff5492e37e95e75c88161f1b8 ]
Avoid a forward declaration by moving the callers of bcm54xx_config_clock_delay() below its body.
--- drivers/net/phy/broadcom.c | 74 +++++++++++++++++++------------------- 1 file changed, 36 insertions(+), 38 deletions(-)
drivers/net/phy/broadcom.c +36 -38
@@ -26,44 +26,6 @@ MODULE_DESCRIPTION("Broadcom PHY driver");MODULE_AUTHOR ("Maciej W. Rozycki" );MODULE_LICENSE ("GPL" ); -static int bcm54xx_config_clock_delay (struct phy_device *phydev); - -static int bcm54210e_config_init (struct phy_device *phydev) -{ -int val; - -bcm54xx_config_clock_delay (phydev); - -if (phydev->dev_flags &PHY_BRCM_EN_MASTER_MODE ) { - val =phy_read (phydev,MII_CTRL1000 ); - val |=CTL1000_AS_MASTER |CTL1000_ENABLE_MASTER ; -phy_write (phydev,MII_CTRL1000 , val); - } - -return 0 ; -} - -static int bcm54612e_config_init (struct phy_device *phydev) -{ -int reg; - -bcm54xx_config_clock_delay (phydev); - -/* Enable CLK125 MUX on LED4 if ref clock is enabled. */ -if (!(phydev->dev_flags &PHY_BRCM_RX_REFCLK_UNUSED )) { -int err; - - reg =bcm_phy_read_exp (phydev,BCM54612E_EXP_SPARE0 ); - err =bcm_phy_write_exp (phydev,BCM54612E_EXP_SPARE0 , -BCM54612E_LED4_CLK125OUT_EN | reg); - -if (err <0 ) -return err; - } - -return 0 ; -} -static int bcm54xx_config_clock_delay (struct phy_device *phydev) {int rc, val;
@@ -105,6 +67,42 @@ static int bcm54xx_config_clock_delay(struct phy_device *phydev)return 0 ; } +static int bcm54210e_config_init (struct phy_device *phydev) +{ +int val; + +bcm54xx_config_clock_delay (phydev); + +if (phydev->dev_flags &PHY_BRCM_EN_MASTER_MODE ) { + val =phy_read (phydev,MII_CTRL1000 ); + val |=CTL1000_AS_MASTER |CTL1000_ENABLE_MASTER ; +phy_write (phydev,MII_CTRL1000 , val); + } + +return 0 ; +} + +static int bcm54612e_config_init (struct phy_device *phydev) +{ +int reg; + +bcm54xx_config_clock_delay (phydev); + +/* Enable CLK125 MUX on LED4 if ref clock is enabled. */ +if (!(phydev->dev_flags &PHY_BRCM_RX_REFCLK_UNUSED )) { +int err; + + reg =bcm_phy_read_exp (phydev,BCM54612E_EXP_SPARE0 ); + err =bcm_phy_write_exp (phydev,BCM54612E_EXP_SPARE0 , +BCM54612E_LED4_CLK125OUT_EN | reg); + +if (err <0 ) +return err; + } + +return 0 ; +} +/* Needs SMDSP clock enabled via bcm54xx_phydsp_config() */ static int bcm50610_a0_workaround (struct phy_device *phydev) {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 218/254 net: phy: broadcom: Set proper 1000BaseX/SGMII interface mode for BCM54616S
In reply to Greg Kroah-HartmanFrom: Robert Hancock <[email protected]>
[ Upstream commit 3afd0218992a8d1398e9791d6c2edd4c948ae7ee ]
The default configuration for the BCM54616S PHY may not match the desired mode when using 1000BaseX or SGMII interface modes, such as when it is on an SFP module. Add code to explicitly set the correct mode using programming sequences provided by Bel-Fuse:
https://www.belfuse.com/resources/datasheets/powersolutions/ds-bps-sfp-1gbt-05-series.pdf
https://www.belfuse.com/resources/datasheets/powersolutions/ds-bps-sfp-1gbt-06-series.pdf
--- drivers/net/phy/broadcom.c | 84 ++++++++++++++++++++++++++++++++------ include/linux/brcmphy.h | 4 ++ 2 files changed, 76 insertions(+), 12 deletions(-)
drivers/net/phy/broadcom.c +72 -12
@@ -103,6 +103,64 @@ static int bcm54612e_config_init(struct phy_device *phydev)return 0 ; } +static int bcm54616s_config_init (struct phy_device *phydev) +{ +int rc, val; + +if (phydev->interface !=PHY_INTERFACE_MODE_SGMII && + phydev->interface !=PHY_INTERFACE_MODE_1000BASEX ) +return 0 ; + +/* Ensure proper interface mode is selected. */ +/* Disable RGMII mode */ + val =bcm54xx_auxctl_read (phydev,MII_BCM54XX_AUXCTL_SHDWSEL_MISC ); +if (val <0 ) +return val; + val &= ~MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN ; + val |=MII_BCM54XX_AUXCTL_MISC_WREN ; + rc =bcm54xx_auxctl_write (phydev,MII_BCM54XX_AUXCTL_SHDWSEL_MISC , + val); +if (rc <0 ) +return rc; + +/* Select 1000BASE-X register set (primary SerDes) */ + val =bcm_phy_read_shadow (phydev,BCM54XX_SHD_MODE ); +if (val <0 ) +return val; + val |=BCM54XX_SHD_MODE_1000BX ; + rc =bcm_phy_write_shadow (phydev,BCM54XX_SHD_MODE , val); +if (rc <0 ) +return rc; + +/* Power down SerDes interface */ + rc =phy_set_bits (phydev,MII_BMCR ,BMCR_PDOWN ); +if (rc <0 ) +return rc; + +/* Select proper interface mode */ + val &= ~BCM54XX_SHD_INTF_SEL_MASK ; + val |= phydev->interface ==PHY_INTERFACE_MODE_SGMII ? +BCM54XX_SHD_INTF_SEL_SGMII : +BCM54XX_SHD_INTF_SEL_GBIC ; + rc =bcm_phy_write_shadow (phydev,BCM54XX_SHD_MODE , val); +if (rc <0 ) +return rc; + +/* Power up SerDes interface */ + rc =phy_clear_bits (phydev,MII_BMCR ,BMCR_PDOWN ); +if (rc <0 ) +return rc; + +/* Select copper register set */ + val &= ~BCM54XX_SHD_MODE_1000BX ; + rc =bcm_phy_write_shadow (phydev,BCM54XX_SHD_MODE , val); +if (rc <0 ) +return rc; + +/* Power up copper interface */ +return phy_clear_bits (phydev,MII_BMCR ,BMCR_PDOWN ); +} +/* Needs SMDSP clock enabled via bcm54xx_phydsp_config() */ static int bcm50610_a0_workaround (struct phy_device *phydev) {
@@ -281,15 +339,17 @@ static int bcm54xx_config_init(struct phy_device *phydev)bcm54xx_adjust_rxrefclk (phydev); -if (BRCM_PHY_MODEL (phydev) ==PHY_ID_BCM54210E ) { +switch (BRCM_PHY_MODEL (phydev)) { +case PHY_ID_BCM54210E : err =bcm54210e_config_init (phydev); -if (err) -return err; - }else if (BRCM_PHY_MODEL (phydev) ==PHY_ID_BCM54612E ) { +break ; +case PHY_ID_BCM54612E : err =bcm54612e_config_init (phydev); -if (err) -return err; - }else if (BRCM_PHY_MODEL (phydev) ==PHY_ID_BCM54810 ) { +break ; +case PHY_ID_BCM54616S : + err =bcm54616s_config_init (phydev); +break ; +case PHY_ID_BCM54810 :/* For BCM54810, we need to disable BroadR-Reach function */ val =bcm_phy_read_exp (phydev,BCM54810_EXP_BROADREACH_LRE_MISC_CTL );
@@ -297,9 +357,10 @@ static int bcm54xx_config_init(struct phy_device *phydev) err =bcm_phy_write_exp (phydev,BCM54810_EXP_BROADREACH_LRE_MISC_CTL , val); -if (err <0 ) -return err; +break ; } +if (err) +return err;bcm54xx_phydsp_config (phydev);
@@ -478,7 +539,7 @@ static int bcm5481_config_aneg(struct phy_device *phydev)static int bcm54616s_probe (struct phy_device *phydev) { -int val, intf_sel; +int val; val =bcm_phy_read_shadow (phydev,BCM54XX_SHD_MODE );if (val <0 )
@@ -490,8 +551,7 @@ static int bcm54616s_probe(struct phy_device *phydev)* RGMII-1000Base-X is properly supported, but RGMII-100Base-FX * support is still missing as of now. */ - intf_sel = (val &BCM54XX_SHD_INTF_SEL_MASK ) >>1 ; -if (intf_sel ==1 ) { +if ((val &BCM54XX_SHD_INTF_SEL_MASK ) ==BCM54XX_SHD_INTF_SEL_RGMII ) { val =bcm_phy_read_shadow (phydev,BCM54616S_SHD_100FX_CTRL );if (val <0 )return val;
include/linux/brcmphy.h +4 -0
@@ -136,6 +136,7 @@#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC 0x07#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_WIRESPEED_EN 0x0010 +#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN 0x0080#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN 0x0100#define MII_BCM54XX_AUXCTL_MISC_FORCE_AMDIX 0x0200#define MII_BCM54XX_AUXCTL_MISC_WREN 0x8000
@@ -222,6 +223,9 @@/* 11111: Mode Control Register */ #define BCM54XX_SHD_MODE 0x1f#define BCM54XX_SHD_INTF_SEL_MASK GENMASK(2, 1)/* INTERF_SEL[1:0] */ +#define BCM54XX_SHD_INTF_SEL_RGMII 0x02 +#define BCM54XX_SHD_INTF_SEL_SGMII 0x04 +#define BCM54XX_SHD_INTF_SEL_GBIC 0x06#define BCM54XX_SHD_MODE_1000BX BIT(0)/* Enable 1000-X registers */ /*
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 219/254 net: phy: broadcom: Fix RGMII delays for BCM50160 and BCM50610M
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit b1dd9bf688b0dcc5a34dca660de46c7570bd9243 ]
The PHY driver entry for BCM50160 and BCM50610M calls bcm54xx_config_init() but does not call bcm54xx_config_clock_delay() in order to configuration appropriate clock delays on the PHY, fix that.
--- drivers/net/phy/broadcom.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/phy/broadcom.c +4 -0
@@ -340,6 +340,10 @@ static int bcm54xx_config_init(struct phy_device *phydev)bcm54xx_adjust_rxrefclk (phydev);switch (BRCM_PHY_MODEL (phydev)) { +case PHY_ID_BCM50610 : +case PHY_ID_BCM50610M : + err =bcm54xx_config_clock_delay (phydev); +break ;case PHY_ID_BCM54210E : err =bcm54210e_config_init (phydev);break ;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 220/254 Revert "netfilter: x_tables: Switch synchronization to RCU"
In reply to Greg Kroah-HartmanFrom: Mark Tomlinson <[email protected]>
[ Upstream commit d3d40f237480abf3268956daf18cdc56edd32834 ]
This reverts commit cc00bcaa589914096edef7fb87ca5cee4a166b5c.
This (and the preceding) patch basically re-implemented the RCU mechanisms of patch 784544739a25. That patch was replaced because of the performance problems that it created when replacing tables. Now, we have the same issue: the call to synchronize_rcu() makes replacing tables slower by as much as an order of magnitude.
Prior to using RCU a script calling "iptables" approx. 200 times was taking 1.16s. With RCU this increased to 11.59s.
Revert these patches and fix the issue in a different way.
--- include/linux/netfilter/x_tables.h | 5 +-- net/ipv4/netfilter/arp_tables.c | 14 ++++----- net/ipv4/netfilter/ip_tables.c | 14 ++++----- net/ipv6/netfilter/ip6_tables.c | 14 ++++----- net/netfilter/x_tables.c | 49 +++++++++++++++++++++--------- 5 files changed, 56 insertions(+), 40 deletions(-)
include/linux/netfilter/x_tables.h +1 -4
@@ -227,7 +227,7 @@ struct xt_table {unsigned int valid_hooks;/* Man behind the curtain... */ -struct xt_table_info __rcu *private; +struct xt_table_info *private;/* Set this to THIS_MODULE if you are a module, otherwise NULL */ struct module *me;
@@ -448,9 +448,6 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)struct nf_hook_ops *xt_hook_ops_alloc (const struct xt_table *,nf_hookfn *); -struct xt_table_info -*xt_table_get_private_protected (const struct xt_table *table); -#ifdef CONFIG_COMPAT #include <net/compat.h>
net/ipv4/netfilter/arp_tables.c +7 -7
@@ -203,7 +203,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,local_bh_disable (); addend =xt_write_recseq_begin (); - private =rcu_access_pointer (table->private); + private =READ_ONCE (table->private);/* Address dependency. */ cpu =smp_processor_id (); table_base = private->entries; jumpstack = (struct arpt_entry **)private->jumpstack[cpu];
@@ -649,7 +649,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) {unsigned int countersize;struct xt_counters *counters; -const struct xt_table_info *private =xt_table_get_private_protected (table); +const struct xt_table_info *private = table->private;/* We need atomic snapshot of counters: rest doesn't change * (other than comefrom, which userspace doesn't care
@@ -673,7 +673,7 @@ static int copy_entries_to_user(unsigned int total_size,unsigned int off, num;const struct arpt_entry *e;struct xt_counters *counters; -struct xt_table_info *private =xt_table_get_private_protected (table); +struct xt_table_info *private = table->private;int ret =0 ;void *loc_cpu_entry;
@@ -807,7 +807,7 @@ static int get_info(struct net *net, void __user *user, const int *len) t =xt_request_find_table_lock (net,NFPROTO_ARP , name);if (!IS_ERR (t)) {struct arpt_getinfo info; -const struct xt_table_info *private =xt_table_get_private_protected (t); +const struct xt_table_info *private = t->private;#ifdef CONFIG_COMPAT struct xt_table_info tmp;
@@ -860,7 +860,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr, t =xt_find_table_lock (net,NFPROTO_ARP , get.name);if (!IS_ERR (t)) { -const struct xt_table_info *private =xt_table_get_private_protected (t); +const struct xt_table_info *private = t->private;if (get.size == private->size) ret = copy_entries_to_user(private->size,
@@ -1017,7 +1017,7 @@ static int do_add_counters(struct net *net, sockptr_t arg, unsigned int len) }local_bh_disable (); - private =xt_table_get_private_protected (t); + private = t->private;if (private->number != tmp.num_counters) { ret = -EINVAL ; goto unlock_up_free;
@@ -1330,7 +1330,7 @@ static int compat_copy_entries_to_user(unsigned int total_size, void __user *userptr) {struct xt_counters *counters; -const struct xt_table_info *private =xt_table_get_private_protected (table); +const struct xt_table_info *private = table->private;void __user *pos;unsigned int size;int ret =0 ;
net/ipv4/netfilter/ip_tables.c +7 -7
@@ -258,7 +258,7 @@ ipt_do_table(struct sk_buff *skb,WARN_ON (!(table->valid_hooks & (1 << hook)));local_bh_disable (); addend =xt_write_recseq_begin (); - private =rcu_access_pointer (table->private); + private =READ_ONCE (table->private);/* Address dependency. */ cpu =smp_processor_id (); table_base = private->entries; jumpstack = (struct ipt_entry **)private->jumpstack[cpu];
@@ -791,7 +791,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) {unsigned int countersize;struct xt_counters *counters; -const struct xt_table_info *private =xt_table_get_private_protected (table); +const struct xt_table_info *private = table->private;/* We need atomic snapshot of counters: rest doesn't change (other than comefrom, which userspace doesn't care
@@ -815,7 +815,7 @@ copy_entries_to_user(unsigned int total_size,unsigned int off, num;const struct ipt_entry *e;struct xt_counters *counters; -const struct xt_table_info *private =xt_table_get_private_protected (table); +const struct xt_table_info *private = table->private;int ret =0 ;const void *loc_cpu_entry;
@@ -964,7 +964,7 @@ static int get_info(struct net *net, void __user *user, const int *len) t =xt_request_find_table_lock (net,AF_INET , name);if (!IS_ERR (t)) {struct ipt_getinfo info; -const struct xt_table_info *private =xt_table_get_private_protected (t); +const struct xt_table_info *private = t->private;#ifdef CONFIG_COMPAT struct xt_table_info tmp;
@@ -1018,7 +1018,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr, t =xt_find_table_lock (net,AF_INET , get.name);if (!IS_ERR (t)) { -const struct xt_table_info *private =xt_table_get_private_protected (t); +const struct xt_table_info *private = t->private;if (get.size == private->size) ret =copy_entries_to_user (private->size, t, uptr->entrytable);
@@ -1173,7 +1173,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len) }local_bh_disable (); - private =xt_table_get_private_protected (t); + private = t->private;if (private->number != tmp.num_counters) { ret = -EINVAL ; goto unlock_up_free;
@@ -1543,7 +1543,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, void __user *userptr) {struct xt_counters *counters; -const struct xt_table_info *private =xt_table_get_private_protected (table); +const struct xt_table_info *private = table->private;void __user *pos;unsigned int size;int ret =0 ;
net/ipv6/netfilter/ip6_tables.c +7 -7
@@ -280,7 +280,7 @@ ip6t_do_table(struct sk_buff *skb,local_bh_disable (); addend =xt_write_recseq_begin (); - private =rcu_access_pointer (table->private); + private =READ_ONCE (table->private);/* Address dependency. */ cpu =smp_processor_id (); table_base = private->entries; jumpstack = (struct ip6t_entry **)private->jumpstack[cpu];
@@ -807,7 +807,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) {unsigned int countersize;struct xt_counters *counters; -const struct xt_table_info *private =xt_table_get_private_protected (table); +const struct xt_table_info *private = table->private;/* We need atomic snapshot of counters: rest doesn't change (other than comefrom, which userspace doesn't care
@@ -831,7 +831,7 @@ copy_entries_to_user(unsigned int total_size,unsigned int off, num;const struct ip6t_entry *e;struct xt_counters *counters; -const struct xt_table_info *private =xt_table_get_private_protected (table); +const struct xt_table_info *private = table->private;int ret =0 ;const void *loc_cpu_entry;
@@ -980,7 +980,7 @@ static int get_info(struct net *net, void __user *user, const int *len) t =xt_request_find_table_lock (net,AF_INET6 , name);if (!IS_ERR (t)) {struct ip6t_getinfo info; -const struct xt_table_info *private =xt_table_get_private_protected (t); +const struct xt_table_info *private = t->private;#ifdef CONFIG_COMPAT struct xt_table_info tmp;
@@ -1035,7 +1035,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr, t =xt_find_table_lock (net,AF_INET6 , get.name);if (!IS_ERR (t)) { -struct xt_table_info *private =xt_table_get_private_protected (t); +struct xt_table_info *private = t->private;if (get.size == private->size) ret =copy_entries_to_user (private->size, t, uptr->entrytable);
@@ -1189,7 +1189,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len) }local_bh_disable (); - private =xt_table_get_private_protected (t); + private = t->private;if (private->number != tmp.num_counters) { ret = -EINVAL ; goto unlock_up_free;
@@ -1552,7 +1552,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, void __user *userptr) {struct xt_counters *counters; -const struct xt_table_info *private =xt_table_get_private_protected (table); +const struct xt_table_info *private = table->private;void __user *pos;unsigned int size;int ret =0 ;
net/netfilter/x_tables.c +34 -15
94 lines not on this page · raw message
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 221/254 netfilter: x_tables: Use correct memory barriers.
In reply to Greg Kroah-HartmanFrom: Mark Tomlinson <[email protected]>
[ Upstream commit 175e476b8cdf2a4de7432583b49c871345e4f8a1 ]
When a new table value was assigned, it was followed by a write memory barrier. This ensured that all writes before this point would complete before any writes after this point. However, to determine whether the rules are unused, the sequence counter is read. To ensure that all writes have been done before these reads, a full memory barrier is needed, not just a write memory barrier. The same argument applies when incrementing the counter, before the rules are read.
Changing to using smp_mb() instead of smp_wmb() fixes the kernel panic reported in cc00bcaa5899 (which is still present), while still maintaining the same speed of replacing tables.
The smb_mb() barriers potentially slow the packet path, however testing has shown no measurable change in performance on a 4-core MIPS64 platform.
--- include/linux/netfilter/x_tables.h | 2 +- net/netfilter/x_tables.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
include/linux/netfilter/x_tables.h +1 -1
@@ -376,7 +376,7 @@ static inline unsigned int xt_write_recseq_begin(void)* since addend is most likely 1 */ __this_cpu_add (xt_recseq.sequence, addend); -smp_wmb (); +smp_mb ();return addend; }
net/netfilter/x_tables.c +1 -1
@@ -1389,7 +1389,7 @@ xt_replace_table(struct xt_table *table, table->private = newinfo;/* make sure all cpus see new ->private value */ -smp_wmb (); +smp_mb ();/* * Even though table entries have now been swapped, other CPU's
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 222/254 bpf: Fix fexit trampoline.
In reply to Greg Kroah-HartmanFrom: Alexei Starovoitov <[email protected]>
[ Upstream commit e21aa341785c679dd409c8cb71f864c00fe6c463 ]
The fexit/fmod_ret programs can be attached to kernel functions that can sleep. The synchronize_rcu_tasks() will not wait for such tasks to complete. In such case the trampoline image will be freed and when the task wakes up the return IP will point to freed memory causing the crash. Solve this by adding percpu_ref_get/put for the duration of trampoline and separate trampoline vs its image life times.
The "half page" optimization has to be removed, since first_half->second_half->first_half transition cannot be guaranteed to complete in deterministic time. Every trampoline update becomes a new image. The image with fmod_ret or fexit progs will be freed via percpu_ref_kill and call_rcu_tasks. Together they will wait for the original function and trampoline asm to complete. The trampoline is patched from nop to jmp to skip fexit progs. They are freed independently from the trampoline. The image with fentry progs only will be freed via call_rcu_tasks_trace+call_rcu_tasks which will wait for both sleepable and non-sleepable progs to complete.
--- arch/x86/net/bpf_jit_comp.c | 26 ++++- include/linux/bpf.h | 24 +++- kernel/bpf/bpf_struct_ops.c | 2 +- kernel/bpf/core.c | 4 +- kernel/bpf/trampoline.c | 218 +++++++++++++++++++++++++++--------- 5 files changed, 213 insertions(+), 61 deletions(-)
arch/x86/net/bpf_jit_comp.c +22 -4
@@ -1735,7 +1735,7 @@ static int invoke_bpf_mod_ret(const struct btf_func_model *m, u8 **pprog,* add rsp, 8 // skip eth_type_trans's frame * ret // return to its caller */ -int arch_prepare_bpf_trampoline (void *image,void *image_end, +int arch_prepare_bpf_trampoline (struct bpf_tramp_image *im,void *image,void *image_end,const struct btf_func_model *m,u32 flags,struct bpf_tramp_progs *tprogs,void *orig_call)
@@ -1774,6 +1774,15 @@ int arch_prepare_bpf_trampoline(void *image, void *image_end,save_regs (m, &prog, nr_args, stack_size); +if (flags &BPF_TRAMP_F_CALL_ORIG ) { +/* arg1: mov rdi, im */ +emit_mov_imm64 (&prog,BPF_REG_1 , (long ) im >>32 , (u32 ) (long ) im); +if (emit_call (&prog, __bpf_tramp_enter, prog)) { + ret = -EINVAL ; + goto cleanup; + } + } +if (fentry->nr_progs)if (invoke_bpf (m, &prog, fentry, stack_size))return -EINVAL ;
@@ -1792,8 +1801,7 @@ int arch_prepare_bpf_trampoline(void *image, void *image_end, }if (flags &BPF_TRAMP_F_CALL_ORIG ) { -if (fentry->nr_progs || fmod_ret->nr_progs) -restore_regs (m, &prog, nr_args, stack_size); +restore_regs (m, &prog, nr_args, stack_size);/* call original function */ if (emit_call (&prog, orig_call, prog)) {
@@ -1802,6 +1810,8 @@ int arch_prepare_bpf_trampoline(void *image, void *image_end, }/* remember return value in a stack for bpf prog to access */ emit_stx (&prog,BPF_DW ,BPF_REG_FP ,BPF_REG_0 ,-8 ); + im->ip_after_call = prog; +emit_nops (&prog,5 ); }if (fmod_ret->nr_progs) {
@@ -1832,9 +1842,17 @@ int arch_prepare_bpf_trampoline(void *image, void *image_end,* the return value is only updated on the stack and still needs to be * restored to R0. */ -if (flags &BPF_TRAMP_F_CALL_ORIG ) +if (flags &BPF_TRAMP_F_CALL_ORIG ) { + im->ip_epilogue = prog; +/* arg1: mov rdi, im */ +emit_mov_imm64 (&prog,BPF_REG_1 , (long ) im >>32 , (u32 ) (long ) im); +if (emit_call (&prog, __bpf_tramp_exit, prog)) { + ret = -EINVAL ; + goto cleanup; + }/* restore original return value back into RAX */ emit_ldx (&prog,BPF_DW ,BPF_REG_0 ,BPF_REG_FP ,-8 ); + }EMIT1 (0x5B );/* pop rbx */ EMIT1 (0xC9 );/* leave */
include/linux/bpf.h +20 -4
@@ -22,6 +22,7 @@#include <linux/capability.h> #include <linux/sched/mm.h> #include <linux/slab.h> +#include <linux/percpu-refcount.h> struct bpf_verifier_env ;struct bpf_verifier_log ;
@@ -563,7 +564,8 @@ struct bpf_tramp_progs {* fentry = a set of program to run before calling original function * fexit = a set of program to run after original function */ -int arch_prepare_bpf_trampoline (void *image,void *image_end, +struct bpf_tramp_image ; +int arch_prepare_bpf_trampoline (struct bpf_tramp_image *tr,void *image,void *image_end,const struct btf_func_model *m,u32 flags,struct bpf_tramp_progs *tprogs,void *orig_call);
@@ -572,6 +574,8 @@ u64 notrace __bpf_prog_enter(void); void notrace __bpf_prog_exit(struct bpf_prog *prog, u64 start); void notrace __bpf_prog_enter_sleepable(void); void notrace __bpf_prog_exit_sleepable(void); +void notrace __bpf_tramp_enter(struct bpf_tramp_image *tr); +void notrace __bpf_tramp_exit(struct bpf_tramp_image *tr);struct bpf_ksym {unsigned long start;
@@ -590,6 +594,18 @@ enum bpf_tramp_prog_type { BPF_TRAMP_REPLACE, /* more than MAX */ }; +struct bpf_tramp_image { +void *image; +struct bpf_ksym ksym; +struct percpu_ref pcref; +void *ip_after_call; +void *ip_epilogue; +union { +struct rcu_head rcu; +struct work_struct work; + }; +}; +struct bpf_trampoline {/* hlist for trampoline_table */ struct hlist_node hlist;
@@ -612,9 +628,8 @@ struct bpf_trampoline {/* Number of attached programs. A counter per kind. */ int progs_cnt[BPF_TRAMP_MAX ];/* Executable image of trampoline */ -void *image; +struct bpf_tramp_image *cur_image;u64 selector; -struct bpf_ksym ksym; };struct bpf_attach_target_info {
@@ -698,6 +713,8 @@ void bpf_image_ksym_add(void *data, struct bpf_ksym *ksym);void bpf_image_ksym_del (struct bpf_ksym *ksym);void bpf_ksym_add (struct bpf_ksym *ksym);void bpf_ksym_del (struct bpf_ksym *ksym); +int bpf_jit_charge_modmem (u32 pages); +void bpf_jit_uncharge_modmem (u32 pages);#else static inline int bpf_trampoline_link_prog (struct bpf_prog *prog,struct bpf_trampoline *tr)
@@ -788,7 +805,6 @@ struct bpf_prog_aux {bool func_proto_unreliable;bool sleepable;bool tail_call_reachable; -enum bpf_tramp_prog_type trampoline_prog_type;struct hlist_node tramp_hlist;/* BTF_KIND_FUNC_PROTO for valid attach_btf_id */ const struct btf_type *attach_func_proto;
kernel/bpf/bpf_struct_ops.c +1 -1
@@ -430,7 +430,7 @@ static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, tprogs[BPF_TRAMP_FENTRY ].progs[0 ] = prog; tprogs[BPF_TRAMP_FENTRY ].nr_progs =1 ; - err =arch_prepare_bpf_trampoline (image, + err =arch_prepare_bpf_trampoline (NULL , image, st_map->image +PAGE_SIZE , &st_ops->func_models[i],0 , tprogs,NULL );
kernel/bpf/core.c +2 -2
@@ -817,7 +817,7 @@ static int __init bpf_jit_charge_init(void) }pure_initcall (bpf_jit_charge_init); -static int bpf_jit_charge_modmem (u32 pages) +int bpf_jit_charge_modmem (u32 pages) {if (atomic_long_add_return (pages, &bpf_jit_current) > (bpf_jit_limit >>PAGE_SHIFT )) {
@@ -830,7 +830,7 @@ static int bpf_jit_charge_modmem(u32 pages)return 0 ; } -static void bpf_jit_uncharge_modmem (u32 pages) +void bpf_jit_uncharge_modmem (u32 pages) {atomic_long_sub (pages, &bpf_jit_current); }
kernel/bpf/trampoline.c +168 -50
286 lines not on this page · raw message
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 223/254 bpf: Use NOP_ATOMIC5 instead of emit_nops(&prog, 5) for BPF_TRAMP_F_CALL_ORIG
In reply to Greg Kroah-HartmanFrom: Stanislav Fomichev <[email protected]>
[ Upstream commit b9082970478009b778aa9b22d5561eef35b53b63 ]
__bpf_arch_text_poke does rewrite only for atomic nop5, emit_nops(xxx, 5) emits non-atomic one which breaks fentry/fexit with k8 atomics:
P6_NOP5 == P6_NOP5_ATOMIC (0f1f440000 == 0f1f440000) K8_NOP5 != K8_NOP5_ATOMIC (6666906690 != 6666666690)
Can be reproduced by doing "ideal_nops = k8_nops" in "arch_init_ideal_nops() and running fexit_bpf2bpf selftest.
--- arch/x86/net/bpf_jit_comp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/net/bpf_jit_comp.c +2 -1
@@ -1811,7 +1811,8 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i/* remember return value in a stack for bpf prog to access */ emit_stx (&prog,BPF_DW ,BPF_REG_FP ,BPF_REG_0 ,-8 ); im->ip_after_call = prog; -emit_nops (&prog,5 ); +memcpy (prog, ideal_nops[NOP_ATOMIC5 ],X86_PATCH_SIZE ); + prog +=X86_PATCH_SIZE ; }if (fmod_ret->nr_progs) {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 224/254 platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files()
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 35471138a9f7193482a2019e39643f575f8098dc ]
Cleanup create_attributes_level_sysfs_files():
1. There is no need to call sysfs_remove_file() on error, sysman_init() will already call release_attributes_data() on failure which already does this.
2. There is no need for the pr_debug() calls sysfs_create_file() should never fail and if it does it will already complain about the problem itself.
--- drivers/platform/x86/dell-wmi-sysman/sysman.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
drivers/platform/x86/dell-wmi-sysman/sysman.c +7 -9
@@ -210,19 +210,17 @@ static struct kobj_attribute pending_reboot = __ATTR_RO(pending_reboot);*/ static int create_attributes_level_sysfs_files (void ) { -int ret =sysfs_create_file (&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); +int ret; -if (ret) { -pr_debug ("could not create reset_bios file\n" ); + ret =sysfs_create_file (&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); +if (ret)return ret; - } ret =sysfs_create_file (&wmi_priv.main_dir_kset->kobj, &pending_reboot.attr); -if (ret) { -pr_debug ("could not create changing_pending_reboot file\n" ); -sysfs_remove_file (&wmi_priv.main_dir_kset->kobj, &reset_bios.attr); - } -return ret; +if (ret) +return ret; + +return 0 ; } static ssize_t wmi_sysman_attr_show(struct kobject *kobj, struct attribute *attr,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 225/254 arm64/mm: define arch_get_mappable_range()
In reply to Greg Kroah-HartmanFrom: Anshuman Khandual <[email protected]>
[ Upstream commit 03aaf83fba6e5af08b5dd174c72edee9b7d9ed9b ]
This overrides arch_get_mappable_range() on arm64 platform which will be used with recently added generic framework. It drops inside_linear_region() and subsequent check in arch_add_memory() which are no longer required. It also adds a VM_BUG_ON() check that would ensure that mhp_range_allowed() has already been called.
--- arch/arm64/mm/mmu.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
arch/arm64/mm/mmu.c +7 -8
@@ -1443,16 +1443,19 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)free_empty_tables (start, end,PAGE_OFFSET ,PAGE_END ); } -static bool inside_linear_region (u64 start,u64 size) +struct range arch_get_mappable_range (void ) { +struct range mhp_range; +/* * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] * accommodating both its ends but excluding PAGE_END. Max physical * range which can be mapped inside this linear mapping range, must * also be derived from its end points. */ -return start >=__pa (_PAGE_OFFSET (vabits_actual)) && - (start + size -1 ) <=__pa (PAGE_END -1 ); + mhp_range.start =__pa (_PAGE_OFFSET (vabits_actual)); + mhp_range.end =__pa (PAGE_END -1 ); +return mhp_range; } int arch_add_memory(int nid, u64 start, u64 size,
@@ -1460,11 +1463,7 @@ int arch_add_memory(int nid, u64 start, u64 size, {int ret, flags =0 ; -if (!inside_linear_region (start, size)) { -pr_err ("[%llx %llx] is outside linear mapping region\n" , start, start + size); -return -EINVAL ; - } - +VM_BUG_ON (!mhp_range_allowed (start, size, true));if (rodata_full ||debug_pagealloc_enabled ()) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ;
Signature · 1 line
2.30.1
Re: [PATCH 5.11 225/254] arm64/mm: define arch_get_mappable_range()
Quoted 65 lines · Greg Kroah-Hartman
From: Anshuman Khandual <[email protected]>
[ Upstream commit
03aaf83fba6e5af08b5dd174c72edee9b7d9ed9b]This overrides
arch_get_mappable_range()on arm64 platform which will be used with recently added generic framework. It dropsinside_linear_region()and subsequent check inarch_add_memory()which are no longer required. It also adds aVM_BUG_ON()check that would ensure thatmhp_range_allowed()has already been called.Signed-off-by Anshuman Khandual <[email protected]>Reviewed-by David Hildenbrand <[email protected]>Reviewed-by Catalin Marinas <[email protected]>Cc Will Deacon <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Mark Rutland <[email protected]>Cc Heiko Carstens <[email protected]>Cc Jason Wang <[email protected]>Cc Jonathan Cameron <[email protected]>Cc "Michael S. Tsirkin" <[email protected]>Cc Michal Hocko <[email protected]>Cc Oscar Salvador <[email protected]>Cc Pankaj Gupta <[email protected]>Cc Pankaj Gupta <[email protected]>Cc teawater <[email protected]>Cc Vasily Gorbik <[email protected]>Cc Wei Yang <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/arm64/mm/mmu.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)arch/arm64/mm/mmu.c +6
-3@@ -1443,16 +1443,19 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)free_empty_tables (start, end,PAGE_OFFSET ,PAGE_END ); } -static bool inside_linear_region (u64 start,u64 size) +struct range arch_get_mappable_range (void ) { +struct range mhp_range; +/* * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] * accommodating both its ends but excluding PAGE_END. Max physical * range which can be mapped inside this linear mapping range, must * also be derived from its end points. */ -return start >=__pa (_PAGE_OFFSET (vabits_actual)) && - (start + size -1 ) <=__pa (PAGE_END -1 ); + mhp_range.start =__pa (_PAGE_OFFSET (vabits_actual)); + mhp_range.end =__pa (PAGE_END -1 ); +return mhp_range; } int arch_add_memory(int nid, u64 start, u64 size,@@ -1460,11 +1463,7 @@ int arch_add_memory(int nid, u64 start, u64 size, {
arch/arm64/mm/mmu.c int arch_add_memory(int nid, u64 start, u64 size, · line 1468
Quoted 10 lines
arch/arm64/mm/mmu.c +1
-5int ret, flags =0 ; -if (!inside_linear_region (start, size)) { -pr_err ("[%llx %llx] is outside linear mapping region\n" , start, start + size); -return -EINVAL ; - } - +VM_BUG_ON (!mhp_range_allowed (start, size, true));if (rodata_full ||debug_pagealloc_enabled ()) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ;
The stable rc 5.10 and 5.11 builds failed for arm64 architecture due to below warnings / errors,
Quoted 2 lines
Anshuman Khandual <[email protected]>
arm64/mm: definearch_get_mappable_range()
arch/arm64/mm/mmu.c: In function 'arch_add_memory':
arch/arm64/mm/mmu.c:1483:13: error: implicit declaration of function
'mhp_range_allowed'; did you mean 'cpu_map_prog_allowed'? [-Werror=implicit-function-declaration]
VM_BUG_ON(!mhp_range_allowed(start, size, true));
^
include/linux/build_bug.h:30:63: note: in definition of macro
'BUILD_BUG_ON_INVALID'
#define BUILD_BUG_ON_INVALID(e) ((void)(sizeof((__force long)(e))))
^
arch/arm64/mm/mmu.c:1483:2: note: in expansion of macro 'VM_BUG_ON'
VM_BUG_ON(!mhp_range_allowed(start, size, true));
^~~~~~~~~Build link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.11/DISTRO=lkft,MACHINE=juno,label=docker-buster-lkft/41/consoleText
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.10/DISTRO=lkft,MACHINE=dragonboard-410c,label=docker-buster-lkft/120/consoleFull
--
Linaro LKFT
https://lkft.linaro.org
Greg Kroah-Hartman
maintainerRe: [PATCH 5.11 225/254] arm64/mm: define arch_get_mappable_range()
Quoted 99 lines · Naresh Kamboju
Quoted 65 lines · Greg Kroah-Hartman
From: Anshuman Khandual <[email protected]>
[ Upstream commit
03aaf83fba6e5af08b5dd174c72edee9b7d9ed9b]This overrides
arch_get_mappable_range()on arm64 platform which will be used with recently added generic framework. It dropsinside_linear_region()and subsequent check inarch_add_memory()which are no longer required. It also adds aVM_BUG_ON()check that would ensure thatmhp_range_allowed()has already been called.Signed-off-by Anshuman Khandual <[email protected]>Reviewed-by David Hildenbrand <[email protected]>Reviewed-by Catalin Marinas <[email protected]>Cc Will Deacon <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Mark Rutland <[email protected]>Cc Heiko Carstens <[email protected]>Cc Jason Wang <[email protected]>Cc Jonathan Cameron <[email protected]>Cc "Michael S. Tsirkin" <[email protected]>Cc Michal Hocko <[email protected]>Cc Oscar Salvador <[email protected]>Cc Pankaj Gupta <[email protected]>Cc Pankaj Gupta <[email protected]>Cc teawater <[email protected]>Cc Vasily Gorbik <[email protected]>Cc Wei Yang <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/arm64/mm/mmu.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)arch/arm64/mm/mmu.c +6
-3@@ -1443,16 +1443,19 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)free_empty_tables (start, end,PAGE_OFFSET ,PAGE_END ); } -static bool inside_linear_region (u64 start,u64 size) +struct range arch_get_mappable_range (void ) { +struct range mhp_range; +/* * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] * accommodating both its ends but excluding PAGE_END. Max physical * range which can be mapped inside this linear mapping range, must * also be derived from its end points. */ -return start >=__pa (_PAGE_OFFSET (vabits_actual)) && - (start + size -1 ) <=__pa (PAGE_END -1 ); + mhp_range.start =__pa (_PAGE_OFFSET (vabits_actual)); + mhp_range.end =__pa (PAGE_END -1 ); +return mhp_range; } int arch_add_memory(int nid, u64 start, u64 size,@@ -1460,11 +1463,7 @@ int arch_add_memory(int nid, u64 start, u64 size, {arch/arm64/mm/mmu.c int arch_add_memory(int nid, u64 start, u64 size, · line 1468
Quoted 10 lines
arch/arm64/mm/mmu.c +1
-5int ret, flags =0 ; -if (!inside_linear_region (start, size)) { -pr_err ("[%llx %llx] is outside linear mapping region\n" , start, start + size); -return -EINVAL ; - } - +VM_BUG_ON (!mhp_range_allowed (start, size, true));if (rodata_full ||debug_pagealloc_enabled ()) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ;The stable rc 5.10 and 5.11 builds failed for arm64 architecture due to below warnings / errors,
Quoted 2 lines
Anshuman Khandual <[email protected]>
arm64/mm: definearch_get_mappable_range()
arch/arm64/mm/mmu.c: In function 'arch_add_memory':
arch/arm64/mm/mmu.c:1483:13: error: implicit declaration of function
'mhp_range_allowed'; did you mean 'cpu_map_prog_allowed'? [-Werror=implicit-function-declaration]VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^ include/linux/build_bug.h:30:63: note: in definition of macro 'BUILD_BUG_ON_INVALID' #define BUILD_BUG_ON_INVALID(e) ((void)(sizeof((__force long)(e)))) ^ arch/arm64/mm/mmu.c:1483:2: note: in expansion of macro 'VM_BUG_ON' VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^~~~~~~~~
Quoted 3 lines
Build link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.11/DISTRO=lkft,MACHINE=juno,label=docker-buster-lkft/41/consoleText
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.10/DISTRO=lkft,MACHINE=dragonboard-410c,label=docker-buster-lkft/120/consoleFull
thanks, will go drop this, and the patch that was after it in the series, from both trees and will push out a -rc2.
Note, I used tuxbuild before doing this release, and it does not show this error in the arm64 defconfigs. What config did you use to trigger this?
thanks,
greg k-h
Re: [PATCH 5.11 225/254] arm64/mm: define arch_get_mappable_range()
Quoted 105 lines · Greg Kroah-Hartman
Quoted 99 lines · Naresh Kamboju
Quoted 65 lines · Greg Kroah-Hartman
From: Anshuman Khandual <[email protected]>
[ Upstream commit
03aaf83fba6e5af08b5dd174c72edee9b7d9ed9b]This overrides
arch_get_mappable_range()on arm64 platform which will be used with recently added generic framework. It dropsinside_linear_region()and subsequent check inarch_add_memory()which are no longer required. It also adds aVM_BUG_ON()check that would ensure thatmhp_range_allowed()has already been called.Signed-off-by Anshuman Khandual <[email protected]>Reviewed-by David Hildenbrand <[email protected]>Reviewed-by Catalin Marinas <[email protected]>Cc Will Deacon <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Mark Rutland <[email protected]>Cc Heiko Carstens <[email protected]>Cc Jason Wang <[email protected]>Cc Jonathan Cameron <[email protected]>Cc "Michael S. Tsirkin" <[email protected]>Cc Michal Hocko <[email protected]>Cc Oscar Salvador <[email protected]>Cc Pankaj Gupta <[email protected]>Cc Pankaj Gupta <[email protected]>Cc teawater <[email protected]>Cc Vasily Gorbik <[email protected]>Cc Wei Yang <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/arm64/mm/mmu.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)arch/arm64/mm/mmu.c +6
-3@@ -1443,16 +1443,19 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)free_empty_tables (start, end,PAGE_OFFSET ,PAGE_END ); } -static bool inside_linear_region (u64 start,u64 size) +struct range arch_get_mappable_range (void ) { +struct range mhp_range; +/* * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] * accommodating both its ends but excluding PAGE_END. Max physical * range which can be mapped inside this linear mapping range, must * also be derived from its end points. */ -return start >=__pa (_PAGE_OFFSET (vabits_actual)) && - (start + size -1 ) <=__pa (PAGE_END -1 ); + mhp_range.start =__pa (_PAGE_OFFSET (vabits_actual)); + mhp_range.end =__pa (PAGE_END -1 ); +return mhp_range; } int arch_add_memory(int nid, u64 start, u64 size,@@ -1460,11 +1463,7 @@ int arch_add_memory(int nid, u64 start, u64 size, {arch/arm64/mm/mmu.c int arch_add_memory(int nid, u64 start, u64 size, · line 1468
Quoted 10 lines
arch/arm64/mm/mmu.c +1
-5int ret, flags =0 ; -if (!inside_linear_region (start, size)) { -pr_err ("[%llx %llx] is outside linear mapping region\n" , start, start + size); -return -EINVAL ; - } - +VM_BUG_ON (!mhp_range_allowed (start, size, true));if (rodata_full ||debug_pagealloc_enabled ()) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ;The stable rc 5.10 and 5.11 builds failed for arm64 architecture due to below warnings / errors,
Quoted 2 lines
Anshuman Khandual <[email protected]>
arm64/mm: definearch_get_mappable_range()
arch/arm64/mm/mmu.c: In function 'arch_add_memory':
arch/arm64/mm/mmu.c:1483:13: error: implicit declaration of function
'mhp_range_allowed'; did you mean 'cpu_map_prog_allowed'? [-Werror=implicit-function-declaration]VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^ include/linux/build_bug.h:30:63: note: in definition of macro 'BUILD_BUG_ON_INVALID' #define BUILD_BUG_ON_INVALID(e) ((void)(sizeof((__force long)(e)))) ^ arch/arm64/mm/mmu.c:1483:2: note: in expansion of macro 'VM_BUG_ON' VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^~~~~~~~~Quoted 3 lines
Build link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.11/DISTRO=lkft,MACHINE=juno,label=docker-buster-lkft/41/consoleText
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.10/DISTRO=lkft,MACHINE=dragonboard-410c,label=docker-buster-lkft/120/consoleFull
Quoted 6 lines
thanks, will go drop this, and the patch that was after it in the series, from both trees and will push out a -rc2.
Note, I used tuxbuild before doing this release, and it does not show this error in the arm64 defconfigs. What config did you use to trigger this?
We have a build with CONFIG_MEMORY_HOTPLUG=y enabled too.
This is a way to reproduce it locally:
tuxmake --runtime podman --target-arch arm64 --toolchain gcc --kconfig defconfig --kconfig-add CONFIG_MEMORY_HOTPLUG=y
Cheers,
Anders
Greg Kroah-Hartman
maintainerRe: [PATCH 5.11 225/254] arm64/mm: define arch_get_mappable_range()
Quoted 114 lines · Anders Roxell
Quoted 105 lines · Greg Kroah-Hartman
Quoted 99 lines · Naresh Kamboju
Quoted 65 lines · Greg Kroah-Hartman
From: Anshuman Khandual <[email protected]>
[ Upstream commit
03aaf83fba6e5af08b5dd174c72edee9b7d9ed9b]This overrides
arch_get_mappable_range()on arm64 platform which will be used with recently added generic framework. It dropsinside_linear_region()and subsequent check inarch_add_memory()which are no longer required. It also adds aVM_BUG_ON()check that would ensure thatmhp_range_allowed()has already been called.Signed-off-by Anshuman Khandual <[email protected]>Reviewed-by David Hildenbrand <[email protected]>Reviewed-by Catalin Marinas <[email protected]>Cc Will Deacon <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Mark Rutland <[email protected]>Cc Heiko Carstens <[email protected]>Cc Jason Wang <[email protected]>Cc Jonathan Cameron <[email protected]>Cc "Michael S. Tsirkin" <[email protected]>Cc Michal Hocko <[email protected]>Cc Oscar Salvador <[email protected]>Cc Pankaj Gupta <[email protected]>Cc Pankaj Gupta <[email protected]>Cc teawater <[email protected]>Cc Vasily Gorbik <[email protected]>Cc Wei Yang <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/arm64/mm/mmu.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)arch/arm64/mm/mmu.c +6
-3@@ -1443,16 +1443,19 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)free_empty_tables (start, end,PAGE_OFFSET ,PAGE_END ); } -static bool inside_linear_region (u64 start,u64 size) +struct range arch_get_mappable_range (void ) { +struct range mhp_range; +/* * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] * accommodating both its ends but excluding PAGE_END. Max physical * range which can be mapped inside this linear mapping range, must * also be derived from its end points. */ -return start >=__pa (_PAGE_OFFSET (vabits_actual)) && - (start + size -1 ) <=__pa (PAGE_END -1 ); + mhp_range.start =__pa (_PAGE_OFFSET (vabits_actual)); + mhp_range.end =__pa (PAGE_END -1 ); +return mhp_range; } int arch_add_memory(int nid, u64 start, u64 size,@@ -1460,11 +1463,7 @@ int arch_add_memory(int nid, u64 start, u64 size, {arch/arm64/mm/mmu.c int arch_add_memory(int nid, u64 start, u64 size, · line 1468
Quoted 10 lines
arch/arm64/mm/mmu.c +1
-5int ret, flags =0 ; -if (!inside_linear_region (start, size)) { -pr_err ("[%llx %llx] is outside linear mapping region\n" , start, start + size); -return -EINVAL ; - } - +VM_BUG_ON (!mhp_range_allowed (start, size, true));if (rodata_full ||debug_pagealloc_enabled ()) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ;The stable rc 5.10 and 5.11 builds failed for arm64 architecture due to below warnings / errors,
Quoted 2 lines
Anshuman Khandual <[email protected]>
arm64/mm: definearch_get_mappable_range()
arch/arm64/mm/mmu.c: In function 'arch_add_memory':
arch/arm64/mm/mmu.c:1483:13: error: implicit declaration of function
'mhp_range_allowed'; did you mean 'cpu_map_prog_allowed'? [-Werror=implicit-function-declaration]VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^ include/linux/build_bug.h:30:63: note: in definition of macro 'BUILD_BUG_ON_INVALID' #define BUILD_BUG_ON_INVALID(e) ((void)(sizeof((__force long)(e)))) ^ arch/arm64/mm/mmu.c:1483:2: note: in expansion of macro 'VM_BUG_ON' VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^~~~~~~~~Quoted 3 lines
Build link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.11/DISTRO=lkft,MACHINE=juno,label=docker-buster-lkft/41/consoleText
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.10/DISTRO=lkft,MACHINE=dragonboard-410c,label=docker-buster-lkft/120/consoleFullQuoted 6 lines
thanks, will go drop this, and the patch that was after it in the series, from both trees and will push out a -rc2.
Note, I used tuxbuild before doing this release, and it does not show this error in the arm64 defconfigs. What config did you use to trigger this?
Quoted 5 lines
We have a build with
CONFIG_MEMORY_HOTPLUG=yenabled too.This is a way to reproduce it locally:
tuxmake --runtime podman --target-arch arm64 --toolchain gcc --kconfig defconfig --kconfig-addCONFIG_MEMORY_HOTPLUG=y
Ah, that wasn't expected, but makes sense, thanks.
Does 'allmodconfig' also trigger that? Maybe I'll go add that to my build tests for arm64...
thanks,
greg k-h
Re: [PATCH 5.11 225/254] arm64/mm: define arch_get_mappable_range()
Quoted 118 lines · Greg Kroah-Hartman
Quoted 116 lines · Anders Roxell
Quoted 105 lines · Greg Kroah-Hartman
Quoted 99 lines · Naresh Kamboju
Quoted 65 lines · Greg Kroah-Hartman
From: Anshuman Khandual <[email protected]>
[ Upstream commit
03aaf83fba6e5af08b5dd174c72edee9b7d9ed9b]This overrides
arch_get_mappable_range()on arm64 platform which will be used with recently added generic framework. It dropsinside_linear_region()and subsequent check inarch_add_memory()which are no longer required. It also adds aVM_BUG_ON()check that would ensure thatmhp_range_allowed()has already been called.Signed-off-by Anshuman Khandual <[email protected]>Reviewed-by David Hildenbrand <[email protected]>Reviewed-by Catalin Marinas <[email protected]>Cc Will Deacon <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Mark Rutland <[email protected]>Cc Heiko Carstens <[email protected]>Cc Jason Wang <[email protected]>Cc Jonathan Cameron <[email protected]>Cc "Michael S. Tsirkin" <[email protected]>Cc Michal Hocko <[email protected]>Cc Oscar Salvador <[email protected]>Cc Pankaj Gupta <[email protected]>Cc Pankaj Gupta <[email protected]>Cc teawater <[email protected]>Cc Vasily Gorbik <[email protected]>Cc Wei Yang <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/arm64/mm/mmu.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)arch/arm64/mm/mmu.c +6
-3@@ -1443,16 +1443,19 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)free_empty_tables (start, end,PAGE_OFFSET ,PAGE_END ); } -static bool inside_linear_region (u64 start,u64 size) +struct range arch_get_mappable_range (void ) { +struct range mhp_range; +/* * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] * accommodating both its ends but excluding PAGE_END. Max physical * range which can be mapped inside this linear mapping range, must * also be derived from its end points. */ -return start >=__pa (_PAGE_OFFSET (vabits_actual)) && - (start + size -1 ) <=__pa (PAGE_END -1 ); + mhp_range.start =__pa (_PAGE_OFFSET (vabits_actual)); + mhp_range.end =__pa (PAGE_END -1 ); +return mhp_range; } int arch_add_memory(int nid, u64 start, u64 size,@@ -1460,11 +1463,7 @@ int arch_add_memory(int nid, u64 start, u64 size, {arch/arm64/mm/mmu.c int arch_add_memory(int nid, u64 start, u64 size, · line 1468
Quoted 10 lines
arch/arm64/mm/mmu.c +1
-5int ret, flags =0 ; -if (!inside_linear_region (start, size)) { -pr_err ("[%llx %llx] is outside linear mapping region\n" , start, start + size); -return -EINVAL ; - } - +VM_BUG_ON (!mhp_range_allowed (start, size, true));if (rodata_full ||debug_pagealloc_enabled ()) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ;The stable rc 5.10 and 5.11 builds failed for arm64 architecture due to below warnings / errors,
Quoted 2 lines
Anshuman Khandual <[email protected]>
arm64/mm: definearch_get_mappable_range()
arch/arm64/mm/mmu.c: In function 'arch_add_memory':
arch/arm64/mm/mmu.c:1483:13: error: implicit declaration of function
'mhp_range_allowed'; did you mean 'cpu_map_prog_allowed'? [-Werror=implicit-function-declaration]VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^ include/linux/build_bug.h:30:63: note: in definition of macro 'BUILD_BUG_ON_INVALID' #define BUILD_BUG_ON_INVALID(e) ((void)(sizeof((__force long)(e)))) ^ arch/arm64/mm/mmu.c:1483:2: note: in expansion of macro 'VM_BUG_ON' VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^~~~~~~~~Quoted 3 lines
Build link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.11/DISTRO=lkft,MACHINE=juno,label=docker-buster-lkft/41/consoleText
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.10/DISTRO=lkft,MACHINE=dragonboard-410c,label=docker-buster-lkft/120/consoleFullQuoted 6 lines
thanks, will go drop this, and the patch that was after it in the series, from both trees and will push out a -rc2.
Note, I used tuxbuild before doing this release, and it does not show this error in the arm64 defconfigs. What config did you use to trigger this?
We have a build with
CONFIG_MEMORY_HOTPLUG=yenabled too.
Quoted 7 lines
Quoted 3 lines
This is a way to reproduce it locally:
tuxmake --runtime podman --target-arch arm64 --toolchain gcc --kconfig defconfig --kconfig-addCONFIG_MEMORY_HOTPLUG=yAh, that wasn't expected, but makes sense, thanks.
Does 'allmodconfig' also trigger that?
Yes that would trigger it. I tried this:
tuxmake --runtime docker --target-arch arm64 --toolchain gcc --kconfig allmodconfig --build-dir=$(pwd)/obj/test-allmod-arm64
Quoted 2 lines
Maybe I'll go add that to my
build tests for arm64...
It will take a few minutes to build an allmodconfig kernel on tuxsuite.
Cheers,
Anders
Re: [PATCH 5.11 225/254] arm64/mm: define arch_get_mappable_range()
In reply to Greg Kroah-HartmanQuoted 101 lines · Greg Kroah-Hartman
Quoted 99 lines · Naresh Kamboju
Quoted 65 lines · Greg Kroah-Hartman
From: Anshuman Khandual <[email protected]>
[ Upstream commit
03aaf83fba6e5af08b5dd174c72edee9b7d9ed9b]This overrides
arch_get_mappable_range()on arm64 platform which will be used with recently added generic framework. It dropsinside_linear_region()and subsequent check inarch_add_memory()which are no longer required. It also adds aVM_BUG_ON()check that would ensure thatmhp_range_allowed()has already been called.Signed-off-by Anshuman Khandual <[email protected]>Reviewed-by David Hildenbrand <[email protected]>Reviewed-by Catalin Marinas <[email protected]>Cc Will Deacon <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Mark Rutland <[email protected]>Cc Heiko Carstens <[email protected]>Cc Jason Wang <[email protected]>Cc Jonathan Cameron <[email protected]>Cc "Michael S. Tsirkin" <[email protected]>Cc Michal Hocko <[email protected]>Cc Oscar Salvador <[email protected]>Cc Pankaj Gupta <[email protected]>Cc Pankaj Gupta <[email protected]>Cc teawater <[email protected]>Cc Vasily Gorbik <[email protected]>Cc Wei Yang <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/arm64/mm/mmu.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)arch/arm64/mm/mmu.c +6
-3@@ -1443,16 +1443,19 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)free_empty_tables (start, end,PAGE_OFFSET ,PAGE_END ); } -static bool inside_linear_region (u64 start,u64 size) +struct range arch_get_mappable_range (void ) { +struct range mhp_range; +/* * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] * accommodating both its ends but excluding PAGE_END. Max physical * range which can be mapped inside this linear mapping range, must * also be derived from its end points. */ -return start >=__pa (_PAGE_OFFSET (vabits_actual)) && - (start + size -1 ) <=__pa (PAGE_END -1 ); + mhp_range.start =__pa (_PAGE_OFFSET (vabits_actual)); + mhp_range.end =__pa (PAGE_END -1 ); +return mhp_range; } int arch_add_memory(int nid, u64 start, u64 size,@@ -1460,11 +1463,7 @@ int arch_add_memory(int nid, u64 start, u64 size, {arch/arm64/mm/mmu.c int arch_add_memory(int nid, u64 start, u64 size, · line 1468
Quoted 10 lines
arch/arm64/mm/mmu.c +1
-5int ret, flags =0 ; -if (!inside_linear_region (start, size)) { -pr_err ("[%llx %llx] is outside linear mapping region\n" , start, start + size); -return -EINVAL ; - } - +VM_BUG_ON (!mhp_range_allowed (start, size, true));if (rodata_full ||debug_pagealloc_enabled ()) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ;The stable rc 5.10 and 5.11 builds failed for arm64 architecture due to below warnings / errors,
Quoted 2 lines
Anshuman Khandual <[email protected]>
arm64/mm: definearch_get_mappable_range()
arch/arm64/mm/mmu.c: In function 'arch_add_memory':
arch/arm64/mm/mmu.c:1483:13: error: implicit declaration of function
'mhp_range_allowed'; did you mean 'cpu_map_prog_allowed'? [-Werror=implicit-function-declaration]VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^ include/linux/build_bug.h:30:63: note: in definition of macro 'BUILD_BUG_ON_INVALID' #define BUILD_BUG_ON_INVALID(e) ((void)(sizeof((__force long)(e)))) ^ arch/arm64/mm/mmu.c:1483:2: note: in expansion of macro 'VM_BUG_ON' VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^~~~~~~~~
Quoted 7 lines
Quoted 3 lines
Build link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.11/DISTRO=lkft,MACHINE=juno,label=docker-buster-lkft/41/consoleText
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.10/DISTRO=lkft,MACHINE=dragonboard-410c,label=docker-buster-lkft/120/consoleFullthanks, will go drop this, and the patch that was after it in the series, from both trees and will push out a -rc2.
Why were these picked up in the first place? I don't see any fixes or cc:stable tags, and the commit log clearly describes that the change is preparatory work for enabling arm64 support into a recently introduced generic framework.
Signature · 1 line
Ard.
Greg Kroah-Hartman
maintainerRe: [PATCH 5.11 225/254] arm64/mm: define arch_get_mappable_range()
Quoted 107 lines · Ard Biesheuvel
Quoted 105 lines · Greg Kroah-Hartman
Quoted 102 lines · Naresh Kamboju
Quoted 65 lines · Greg Kroah-Hartman
From: Anshuman Khandual <[email protected]>
[ Upstream commit
03aaf83fba6e5af08b5dd174c72edee9b7d9ed9b]This overrides
arch_get_mappable_range()on arm64 platform which will be used with recently added generic framework. It dropsinside_linear_region()and subsequent check inarch_add_memory()which are no longer required. It also adds aVM_BUG_ON()check that would ensure thatmhp_range_allowed()has already been called.Signed-off-by Anshuman Khandual <[email protected]>Reviewed-by David Hildenbrand <[email protected]>Reviewed-by Catalin Marinas <[email protected]>Cc Will Deacon <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Mark Rutland <[email protected]>Cc Heiko Carstens <[email protected]>Cc Jason Wang <[email protected]>Cc Jonathan Cameron <[email protected]>Cc "Michael S. Tsirkin" <[email protected]>Cc Michal Hocko <[email protected]>Cc Oscar Salvador <[email protected]>Cc Pankaj Gupta <[email protected]>Cc Pankaj Gupta <[email protected]>Cc teawater <[email protected]>Cc Vasily Gorbik <[email protected]>Cc Wei Yang <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/arm64/mm/mmu.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)arch/arm64/mm/mmu.c +6
-3@@ -1443,16 +1443,19 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)free_empty_tables (start, end,PAGE_OFFSET ,PAGE_END ); } -static bool inside_linear_region (u64 start,u64 size) +struct range arch_get_mappable_range (void ) { +struct range mhp_range; +/* * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] * accommodating both its ends but excluding PAGE_END. Max physical * range which can be mapped inside this linear mapping range, must * also be derived from its end points. */ -return start >=__pa (_PAGE_OFFSET (vabits_actual)) && - (start + size -1 ) <=__pa (PAGE_END -1 ); + mhp_range.start =__pa (_PAGE_OFFSET (vabits_actual)); + mhp_range.end =__pa (PAGE_END -1 ); +return mhp_range; } int arch_add_memory(int nid, u64 start, u64 size,@@ -1460,11 +1463,7 @@ int arch_add_memory(int nid, u64 start, u64 size, {arch/arm64/mm/mmu.c int arch_add_memory(int nid, u64 start, u64 size, · line 1468
Quoted 10 lines
arch/arm64/mm/mmu.c +1
-5int ret, flags =0 ; -if (!inside_linear_region (start, size)) { -pr_err ("[%llx %llx] is outside linear mapping region\n" , start, start + size); -return -EINVAL ; - } - +VM_BUG_ON (!mhp_range_allowed (start, size, true));if (rodata_full ||debug_pagealloc_enabled ()) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ;The stable rc 5.10 and 5.11 builds failed for arm64 architecture due to below warnings / errors,
Quoted 2 lines
Anshuman Khandual <[email protected]>
arm64/mm: definearch_get_mappable_range()
arch/arm64/mm/mmu.c: In function 'arch_add_memory':
arch/arm64/mm/mmu.c:1483:13: error: implicit declaration of function
'mhp_range_allowed'; did you mean 'cpu_map_prog_allowed'? [-Werror=implicit-function-declaration]VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^ include/linux/build_bug.h:30:63: note: in definition of macro 'BUILD_BUG_ON_INVALID' #define BUILD_BUG_ON_INVALID(e) ((void)(sizeof((__force long)(e)))) ^ arch/arm64/mm/mmu.c:1483:2: note: in expansion of macro 'VM_BUG_ON' VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^~~~~~~~~Build link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.11/DISTRO=lkft,MACHINE=juno,label=docker-buster-lkft/41/consoleText
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.10/DISTRO=lkft,MACHINE=dragonboard-410c,label=docker-buster-lkft/120/consoleFull
Quoted 8 lines
Quoted 3 lines
thanks, will go drop this, and the patch that was after it in the series, from both trees and will push out a -rc2.
Why were these picked up in the first place? I don't see any fixes or cc:stable tags, and the commit log clearly describes that the change is preparatory work for enabling arm64 support into a recently introduced generic framework.
This was needed for a follow-on patch in the series that fixed an issue. Specifically it was commit ee7febce0519 ("arm64: mm: correct the inside linear map range during hotplug check")
thanks,
greg k-h
Re: [PATCH 5.11 225/254] arm64/mm: define arch_get_mappable_range()
(+ Pavel)
Quoted 113 lines · Greg Kroah-Hartman
Quoted 111 lines · Ard Biesheuvel
Quoted 108 lines · Greg Kroah-Hartman
Quoted 99 lines · Naresh Kamboju
Quoted 65 lines · Greg Kroah-Hartman
From: Anshuman Khandual <[email protected]>
[ Upstream commit
03aaf83fba6e5af08b5dd174c72edee9b7d9ed9b]This overrides
arch_get_mappable_range()on arm64 platform which will be used with recently added generic framework. It dropsinside_linear_region()and subsequent check inarch_add_memory()which are no longer required. It also adds aVM_BUG_ON()check that would ensure thatmhp_range_allowed()has already been called.Signed-off-by Anshuman Khandual <[email protected]>Reviewed-by David Hildenbrand <[email protected]>Reviewed-by Catalin Marinas <[email protected]>Cc Will Deacon <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Mark Rutland <[email protected]>Cc Heiko Carstens <[email protected]>Cc Jason Wang <[email protected]>Cc Jonathan Cameron <[email protected]>Cc "Michael S. Tsirkin" <[email protected]>Cc Michal Hocko <[email protected]>Cc Oscar Salvador <[email protected]>Cc Pankaj Gupta <[email protected]>Cc Pankaj Gupta <[email protected]>Cc teawater <[email protected]>Cc Vasily Gorbik <[email protected]>Cc Wei Yang <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/arm64/mm/mmu.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)arch/arm64/mm/mmu.c +6
-3@@ -1443,16 +1443,19 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)free_empty_tables (start, end,PAGE_OFFSET ,PAGE_END ); } -static bool inside_linear_region (u64 start,u64 size) +struct range arch_get_mappable_range (void ) { +struct range mhp_range; +/* * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] * accommodating both its ends but excluding PAGE_END. Max physical * range which can be mapped inside this linear mapping range, must * also be derived from its end points. */ -return start >=__pa (_PAGE_OFFSET (vabits_actual)) && - (start + size -1 ) <=__pa (PAGE_END -1 ); + mhp_range.start =__pa (_PAGE_OFFSET (vabits_actual)); + mhp_range.end =__pa (PAGE_END -1 ); +return mhp_range; } int arch_add_memory(int nid, u64 start, u64 size,@@ -1460,11 +1463,7 @@ int arch_add_memory(int nid, u64 start, u64 size, {arch/arm64/mm/mmu.c int arch_add_memory(int nid, u64 start, u64 size, · line 1468
Quoted 10 lines
arch/arm64/mm/mmu.c +1
-5int ret, flags =0 ; -if (!inside_linear_region (start, size)) { -pr_err ("[%llx %llx] is outside linear mapping region\n" , start, start + size); -return -EINVAL ; - } - +VM_BUG_ON (!mhp_range_allowed (start, size, true));if (rodata_full ||debug_pagealloc_enabled ()) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ;The stable rc 5.10 and 5.11 builds failed for arm64 architecture due to below warnings / errors,
Quoted 2 lines
Anshuman Khandual <[email protected]>
arm64/mm: definearch_get_mappable_range()
arch/arm64/mm/mmu.c: In function 'arch_add_memory':
arch/arm64/mm/mmu.c:1483:13: error: implicit declaration of function
'mhp_range_allowed'; did you mean 'cpu_map_prog_allowed'? [-Werror=implicit-function-declaration]VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^ include/linux/build_bug.h:30:63: note: in definition of macro 'BUILD_BUG_ON_INVALID' #define BUILD_BUG_ON_INVALID(e) ((void)(sizeof((__force long)(e)))) ^ arch/arm64/mm/mmu.c:1483:2: note: in expansion of macro 'VM_BUG_ON' VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^~~~~~~~~Quoted 3 lines
Build link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.11/DISTRO=lkft,MACHINE=juno,label=docker-buster-lkft/41/consoleText
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.10/DISTRO=lkft,MACHINE=dragonboard-410c,label=docker-buster-lkft/120/consoleFullthanks, will go drop this, and the patch that was after it in the series, from both trees and will push out a -rc2.
Quoted 9 lines
Quoted 4 lines
Why were these picked up in the first place? I don't see any fixes or cc:stable tags, and the commit log clearly describes that the change is preparatory work for enabling arm64 support into a recently introduced generic framework.
This was needed for a follow-on patch in the series that fixed an issue. Specifically it was commit
ee7febce0519("arm64: mm: correct the inside linear map range during hotplug check")
Yeah, but during the discussion of that patch [0], we pointed out that it needed to be rebased because of these new changes. So trying to backport this rebased version is obviously not the right approach:
Pavel's original patch would be much more suitable for that.
Could we have annotated this patch in a better way to make this more obvious?
[0] https://lore.kernel.org/linux-arm-kernel/[email protected]/
Greg Kroah-Hartman
maintainerRe: [PATCH 5.11 225/254] arm64/mm: define arch_get_mappable_range()
Quoted 127 lines · Ard Biesheuvel
(+ Pavel)
Quoted 113 lines · Greg Kroah-Hartman
Quoted 111 lines · Ard Biesheuvel
Quoted 108 lines · Greg Kroah-Hartman
Quoted 99 lines · Naresh Kamboju
Quoted 65 lines · Greg Kroah-Hartman
From: Anshuman Khandual <[email protected]>
[ Upstream commit
03aaf83fba6e5af08b5dd174c72edee9b7d9ed9b]This overrides
arch_get_mappable_range()on arm64 platform which will be used with recently added generic framework. It dropsinside_linear_region()and subsequent check inarch_add_memory()which are no longer required. It also adds aVM_BUG_ON()check that would ensure thatmhp_range_allowed()has already been called.Signed-off-by Anshuman Khandual <[email protected]>Reviewed-by David Hildenbrand <[email protected]>Reviewed-by Catalin Marinas <[email protected]>Cc Will Deacon <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Mark Rutland <[email protected]>Cc Heiko Carstens <[email protected]>Cc Jason Wang <[email protected]>Cc Jonathan Cameron <[email protected]>Cc "Michael S. Tsirkin" <[email protected]>Cc Michal Hocko <[email protected]>Cc Oscar Salvador <[email protected]>Cc Pankaj Gupta <[email protected]>Cc Pankaj Gupta <[email protected]>Cc teawater <[email protected]>Cc Vasily Gorbik <[email protected]>Cc Wei Yang <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/arm64/mm/mmu.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)arch/arm64/mm/mmu.c +6
-3@@ -1443,16 +1443,19 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)free_empty_tables (start, end,PAGE_OFFSET ,PAGE_END ); } -static bool inside_linear_region (u64 start,u64 size) +struct range arch_get_mappable_range (void ) { +struct range mhp_range; +/* * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] * accommodating both its ends but excluding PAGE_END. Max physical * range which can be mapped inside this linear mapping range, must * also be derived from its end points. */ -return start >=__pa (_PAGE_OFFSET (vabits_actual)) && - (start + size -1 ) <=__pa (PAGE_END -1 ); + mhp_range.start =__pa (_PAGE_OFFSET (vabits_actual)); + mhp_range.end =__pa (PAGE_END -1 ); +return mhp_range; } int arch_add_memory(int nid, u64 start, u64 size,@@ -1460,11 +1463,7 @@ int arch_add_memory(int nid, u64 start, u64 size, {arch/arm64/mm/mmu.c int arch_add_memory(int nid, u64 start, u64 size, · line 1468
Quoted 10 lines
arch/arm64/mm/mmu.c +1
-5int ret, flags =0 ; -if (!inside_linear_region (start, size)) { -pr_err ("[%llx %llx] is outside linear mapping region\n" , start, start + size); -return -EINVAL ; - } - +VM_BUG_ON (!mhp_range_allowed (start, size, true));if (rodata_full ||debug_pagealloc_enabled ()) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ;The stable rc 5.10 and 5.11 builds failed for arm64 architecture due to below warnings / errors,
Quoted 2 lines
Anshuman Khandual <[email protected]>
arm64/mm: definearch_get_mappable_range()
arch/arm64/mm/mmu.c: In function 'arch_add_memory':
arch/arm64/mm/mmu.c:1483:13: error: implicit declaration of function
'mhp_range_allowed'; did you mean 'cpu_map_prog_allowed'? [-Werror=implicit-function-declaration]VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^ include/linux/build_bug.h:30:63: note: in definition of macro 'BUILD_BUG_ON_INVALID' #define BUILD_BUG_ON_INVALID(e) ((void)(sizeof((__force long)(e)))) ^ arch/arm64/mm/mmu.c:1483:2: note: in expansion of macro 'VM_BUG_ON' VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^~~~~~~~~Quoted 3 lines
Build link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.11/DISTRO=lkft,MACHINE=juno,label=docker-buster-lkft/41/consoleText
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.10/DISTRO=lkft,MACHINE=dragonboard-410c,label=docker-buster-lkft/120/consoleFullthanks, will go drop this, and the patch that was after it in the series, from both trees and will push out a -rc2.
Quoted 9 lines
Quoted 4 lines
Why were these picked up in the first place? I don't see any fixes or cc:stable tags, and the commit log clearly describes that the change is preparatory work for enabling arm64 support into a recently introduced generic framework.
This was needed for a follow-on patch in the series that fixed an issue. Specifically it was commit
ee7febce0519("arm64: mm: correct the inside linear map range during hotplug check")
Quoted 6 lines
Yeah, but during the discussion of that patch [0], we pointed out that it needed to be rebased because of these new changes. So trying to backport this rebased version is obviously not the right approach:
Pavel's original patch would be much more suitable for that.Could we have annotated this patch in a better way to make this more obvious?
Yes, given that there was no annotation on the patch at all to let us know this :)
You can say things like "do not apply to stable trees" or "needs total rework for older kernels" or other fun such things that when we read them, we know to ask for help. As it is, the patch provided nothing so we guessed and got it wrong...
thanks,
greg k-h
Re: [PATCH 5.11 225/254] arm64/mm: define arch_get_mappable_range()
Quoted 136 lines · Greg Kroah-Hartman
Quoted 127 lines · Ard Biesheuvel
(+ Pavel)
Quoted 113 lines · Greg Kroah-Hartman
Quoted 111 lines · Ard Biesheuvel
Quoted 108 lines · Greg Kroah-Hartman
Quoted 99 lines · Naresh Kamboju
Quoted 65 lines · Greg Kroah-Hartman
From: Anshuman Khandual <[email protected]>
[ Upstream commit
03aaf83fba6e5af08b5dd174c72edee9b7d9ed9b]This overrides
arch_get_mappable_range()on arm64 platform which will be used with recently added generic framework. It dropsinside_linear_region()and subsequent check inarch_add_memory()which are no longer required. It also adds aVM_BUG_ON()check that would ensure thatmhp_range_allowed()has already been called.Signed-off-by Anshuman Khandual <[email protected]>Reviewed-by David Hildenbrand <[email protected]>Reviewed-by Catalin Marinas <[email protected]>Cc Will Deacon <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Mark Rutland <[email protected]>Cc Heiko Carstens <[email protected]>Cc Jason Wang <[email protected]>Cc Jonathan Cameron <[email protected]>Cc "Michael S. Tsirkin" <[email protected]>Cc Michal Hocko <[email protected]>Cc Oscar Salvador <[email protected]>Cc Pankaj Gupta <[email protected]>Cc Pankaj Gupta <[email protected]>Cc teawater <[email protected]>Cc Vasily Gorbik <[email protected]>Cc Wei Yang <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/arm64/mm/mmu.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)arch/arm64/mm/mmu.c +6
-3@@ -1443,16 +1443,19 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)free_empty_tables (start, end,PAGE_OFFSET ,PAGE_END ); } -static bool inside_linear_region (u64 start,u64 size) +struct range arch_get_mappable_range (void ) { +struct range mhp_range; +/* * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] * accommodating both its ends but excluding PAGE_END. Max physical * range which can be mapped inside this linear mapping range, must * also be derived from its end points. */ -return start >=__pa (_PAGE_OFFSET (vabits_actual)) && - (start + size -1 ) <=__pa (PAGE_END -1 ); + mhp_range.start =__pa (_PAGE_OFFSET (vabits_actual)); + mhp_range.end =__pa (PAGE_END -1 ); +return mhp_range; } int arch_add_memory(int nid, u64 start, u64 size,@@ -1460,11 +1463,7 @@ int arch_add_memory(int nid, u64 start, u64 size, {arch/arm64/mm/mmu.c int arch_add_memory(int nid, u64 start, u64 size, · line 1468
Quoted 10 lines
arch/arm64/mm/mmu.c +1
-5int ret, flags =0 ; -if (!inside_linear_region (start, size)) { -pr_err ("[%llx %llx] is outside linear mapping region\n" , start, start + size); -return -EINVAL ; - } - +VM_BUG_ON (!mhp_range_allowed (start, size, true));if (rodata_full ||debug_pagealloc_enabled ()) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ;The stable rc 5.10 and 5.11 builds failed for arm64 architecture due to below warnings / errors,
Quoted 2 lines
Anshuman Khandual <[email protected]>
arm64/mm: definearch_get_mappable_range()
arch/arm64/mm/mmu.c: In function 'arch_add_memory':
arch/arm64/mm/mmu.c:1483:13: error: implicit declaration of function
'mhp_range_allowed'; did you mean 'cpu_map_prog_allowed'? [-Werror=implicit-function-declaration]VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^ include/linux/build_bug.h:30:63: note: in definition of macro 'BUILD_BUG_ON_INVALID' #define BUILD_BUG_ON_INVALID(e) ((void)(sizeof((__force long)(e)))) ^ arch/arm64/mm/mmu.c:1483:2: note: in expansion of macro 'VM_BUG_ON' VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^~~~~~~~~Quoted 3 lines
Build link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.11/DISTRO=lkft,MACHINE=juno,label=docker-buster-lkft/41/consoleText
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.10/DISTRO=lkft,MACHINE=dragonboard-410c,label=docker-buster-lkft/120/consoleFullthanks, will go drop this, and the patch that was after it in the series, from both trees and will push out a -rc2.
Quoted 9 lines
Quoted 4 lines
Why were these picked up in the first place? I don't see any fixes or cc:stable tags, and the commit log clearly describes that the change is preparatory work for enabling arm64 support into a recently introduced generic framework.
This was needed for a follow-on patch in the series that fixed an issue. Specifically it was commit
ee7febce0519("arm64: mm: correct the inside linear map range during hotplug check")Quoted 6 lines
Yeah, but during the discussion of that patch [0], we pointed out that it needed to be rebased because of these new changes. So trying to backport this rebased version is obviously not the right approach:
Pavel's original patch would be much more suitable for that.Could we have annotated this patch in a better way to make this more obvious?
Quoted 7 lines
Yes, given that there was no annotation on the patch at all to let us know this :)
You can say things like "do not apply to stable trees" or "needs total rework for older kernels" or other fun such things that when we read them, we know to ask for help. As it is, the patch provided nothing so we guessed and got it wrong...
I will send the patch for stable trees with the commit id included as requested.
Pasha
Quoted 4 lines
thanks,
greg k-h
Greg Kroah-Hartman
maintainerRe: [PATCH 5.11 225/254] arm64/mm: define arch_get_mappable_range()
Quoted 141 lines · Pavel Tatashin
Quoted 139 lines · Greg Kroah-Hartman
Quoted 127 lines · Ard Biesheuvel
(+ Pavel)
Quoted 113 lines · Greg Kroah-Hartman
Quoted 111 lines · Ard Biesheuvel
Quoted 108 lines · Greg Kroah-Hartman
Quoted 99 lines · Naresh Kamboju
Quoted 65 lines · Greg Kroah-Hartman
From: Anshuman Khandual <[email protected]>
[ Upstream commit
03aaf83fba6e5af08b5dd174c72edee9b7d9ed9b]This overrides
arch_get_mappable_range()on arm64 platform which will be used with recently added generic framework. It dropsinside_linear_region()and subsequent check inarch_add_memory()which are no longer required. It also adds aVM_BUG_ON()check that would ensure thatmhp_range_allowed()has already been called.Signed-off-by Anshuman Khandual <[email protected]>Reviewed-by David Hildenbrand <[email protected]>Reviewed-by Catalin Marinas <[email protected]>Cc Will Deacon <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Mark Rutland <[email protected]>Cc Heiko Carstens <[email protected]>Cc Jason Wang <[email protected]>Cc Jonathan Cameron <[email protected]>Cc "Michael S. Tsirkin" <[email protected]>Cc Michal Hocko <[email protected]>Cc Oscar Salvador <[email protected]>Cc Pankaj Gupta <[email protected]>Cc Pankaj Gupta <[email protected]>Cc teawater <[email protected]>Cc Vasily Gorbik <[email protected]>Cc Wei Yang <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/arm64/mm/mmu.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)arch/arm64/mm/mmu.c +6
-3@@ -1443,16 +1443,19 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)free_empty_tables (start, end,PAGE_OFFSET ,PAGE_END ); } -static bool inside_linear_region (u64 start,u64 size) +struct range arch_get_mappable_range (void ) { +struct range mhp_range; +/* * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] * accommodating both its ends but excluding PAGE_END. Max physical * range which can be mapped inside this linear mapping range, must * also be derived from its end points. */ -return start >=__pa (_PAGE_OFFSET (vabits_actual)) && - (start + size -1 ) <=__pa (PAGE_END -1 ); + mhp_range.start =__pa (_PAGE_OFFSET (vabits_actual)); + mhp_range.end =__pa (PAGE_END -1 ); +return mhp_range; } int arch_add_memory(int nid, u64 start, u64 size,@@ -1460,11 +1463,7 @@ int arch_add_memory(int nid, u64 start, u64 size, {arch/arm64/mm/mmu.c int arch_add_memory(int nid, u64 start, u64 size, · line 1468
Quoted 10 lines
arch/arm64/mm/mmu.c +1
-5int ret, flags =0 ; -if (!inside_linear_region (start, size)) { -pr_err ("[%llx %llx] is outside linear mapping region\n" , start, start + size); -return -EINVAL ; - } - +VM_BUG_ON (!mhp_range_allowed (start, size, true));if (rodata_full ||debug_pagealloc_enabled ()) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ;The stable rc 5.10 and 5.11 builds failed for arm64 architecture due to below warnings / errors,
Quoted 2 lines
Anshuman Khandual <[email protected]>
arm64/mm: definearch_get_mappable_range()
arch/arm64/mm/mmu.c: In function 'arch_add_memory':
arch/arm64/mm/mmu.c:1483:13: error: implicit declaration of function
'mhp_range_allowed'; did you mean 'cpu_map_prog_allowed'? [-Werror=implicit-function-declaration]VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^ include/linux/build_bug.h:30:63: note: in definition of macro 'BUILD_BUG_ON_INVALID' #define BUILD_BUG_ON_INVALID(e) ((void)(sizeof((__force long)(e)))) ^ arch/arm64/mm/mmu.c:1483:2: note: in expansion of macro 'VM_BUG_ON' VM_BUG_ON(!mhp_range_allowed(start, size, true)); ^~~~~~~~~Quoted 3 lines
Build link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.11/DISTRO=lkft,MACHINE=juno,label=docker-buster-lkft/41/consoleText
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.10/DISTRO=lkft,MACHINE=dragonboard-410c,label=docker-buster-lkft/120/consoleFullthanks, will go drop this, and the patch that was after it in the series, from both trees and will push out a -rc2.
Quoted 9 lines
Quoted 4 lines
Why were these picked up in the first place? I don't see any fixes or cc:stable tags, and the commit log clearly describes that the change is preparatory work for enabling arm64 support into a recently introduced generic framework.
This was needed for a follow-on patch in the series that fixed an issue. Specifically it was commit
ee7febce0519("arm64: mm: correct the inside linear map range during hotplug check")Quoted 6 lines
Yeah, but during the discussion of that patch [0], we pointed out that it needed to be rebased because of these new changes. So trying to backport this rebased version is obviously not the right approach:
Pavel's original patch would be much more suitable for that.Could we have annotated this patch in a better way to make this more obvious?
Yes, given that there was no annotation on the patch at all to let us know this :)
Quoted 6 lines
Quoted 4 lines
You can say things like "do not apply to stable trees" or "needs total rework for older kernels" or other fun such things that when we read them, we know to ask for help. As it is, the patch provided nothing so we guessed and got it wrong...
I will send the patch for stable trees with the commit id included as requested.
Wonderful, thank you so much.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 226/254 arm64: mm: correct the inside linear map range during hotplug check
In reply to Greg Kroah-HartmanFrom: Pavel Tatashin <[email protected]>
[ Upstream commit ee7febce051945be28ad86d16a15886f878204de ]
Memory hotplug may fail on systems with CONFIG_RANDOMIZE_BASE because the linear map range is not checked correctly.
The start physical address that linear map covers can be actually at the end of the range because of randomization. Check that and if so reduce it to 0.
This can be verified on QEMU with setting kaslr-seed to ~0ul:
memstart_offset_seed = 0xffff
START: __pa(_PAGE_OFFSET(vabits_actual)) = ffff9000c0000000 END: __pa(PAGE_END - 1) = 1000bfffffff
--- arch/arm64/mm/mmu.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-)
arch/arm64/mm/mmu.c +19 -2
@@ -1446,6 +1446,22 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)struct range arch_get_mappable_range (void ) {struct range mhp_range; +u64 start_linear_pa =__pa (_PAGE_OFFSET (vabits_actual)); +u64 end_linear_pa =__pa (PAGE_END -1 ); + +if (IS_ENABLED (CONFIG_RANDOMIZE_BASE )) { +/* +* Check for a wrap, it is possible because of randomized linear +* mapping the start physical address is actually bigger than +* the end physical address. In this case set start to zero +* because [0, end_linear_pa] range must still be able to cover +* all addressable physical addresses. +*/ +if (start_linear_pa > end_linear_pa) + start_linear_pa =0 ; + } + +WARN_ON (start_linear_pa > end_linear_pa);/* * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)]
@@ -1453,8 +1469,9 @@ struct range arch_get_mappable_range(void)* range which can be mapped inside this linear mapping range, must * also be derived from its end points. */ - mhp_range.start =__pa (_PAGE_OFFSET (vabits_actual)); - mhp_range.end =__pa (PAGE_END -1 ); + mhp_range.start = start_linear_pa; + mhp_range.end = end_linear_pa; +return mhp_range; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 227/254 dm table: Fix zoned model check and zone sectors check
In reply to Greg Kroah-HartmanFrom: Shin'ichiro Kawasaki <[email protected]>
[ Upstream commit 2d669ceb69c276f7637cf760287ca4187add082e ]
Commit 24f6b6036c9e ("dm table: fix zoned iterate_devices based device capability checks") triggered dm table load failure when dm-zoned device is set up for zoned block devices and a regular device for cache.
The commit inverted logic of two callback functions for iterate_devices:device_is_zoned_model() and device_matches_zone_sectors(). The logic of device_is_zoned_model() was inverted then all destination devices of all targets in dm table are required to have the expected zoned model. This is fine for dm-linear, dm-flakey and dm-crypt on zoned block devices since each target has only one destination device. However, this results in failure for dm-zoned with regular cache device since that target has both regular block device and zoned block devices.
As for device_matches_zone_sectors(), the commit inverted the logic to require all zoned block devices in each target have the specified zone_sectors. This check also fails for regular block device which does not have zones.
To avoid the check failures, fix the zone model check and the zone sectors check. For zone model check, introduce the new feature flag DM_TARGET_MIXED_ZONED_MODEL, and set it to dm-zoned target. When the target has this flag, allow it to have destination devices with any zoned model. For zone sectors check, skip the check if the destination device is not a zoned block device. Also add comments and improve an error message to clarify expectations to the two checks.
--- drivers/md/dm-table.c | 33 +++++++++++++++++++++++++-------- drivers/md/dm-zoned-target.c | 2 +- include/linux/device-mapper.h | 15 ++++++++++++++- 3 files changed, 40 insertions(+), 10 deletions(-)
drivers/md/dm-table.c +25 -8
@@ -1380,6 +1380,13 @@ static int device_not_zoned_model(struct dm_target *ti, struct dm_dev *dev,return !q ||blk_queue_zoned_model (q) != *zoned_model; } +/* +* Check the device zoned model based on the target feature flag. If the target +* has the DM_TARGET_ZONED_HM feature flag set, host-managed zoned devices are +* also accepted but all devices must have the same zoned model. If the target +* has the DM_TARGET_MIXED_ZONED_MODEL feature set, the devices can have any +* zoned model with all zoned devices having the same zone size. +*/ static bool dm_table_supports_zoned_model (struct dm_table *t,enum blk_zoned_model zoned_model) {
@@ -1389,13 +1396,15 @@ static bool dm_table_supports_zoned_model(struct dm_table *t,for (i =0 ; i <dm_table_get_num_targets (t); i++) { ti =dm_table_get_target (t, i); -if (zoned_model ==BLK_ZONED_HM && - !dm_target_supports_zoned_hm (ti->type)) -return false; - -if (!ti->type->iterate_devices || - ti->type->iterate_devices (ti, device_not_zoned_model, &zoned_model)) -return false; +if (dm_target_supports_zoned_hm (ti->type)) { +if (!ti->type->iterate_devices || + ti->type->iterate_devices (ti, device_not_zoned_model, + &zoned_model)) +return false; + }else if (!dm_target_supports_mixed_zoned_model (ti->type)) { +if (zoned_model ==BLK_ZONED_HM ) +return false; + } }return true;
@@ -1407,9 +1416,17 @@ static int device_not_matches_zone_sectors(struct dm_target *ti, struct dm_dev *struct request_queue *q =bdev_get_queue (dev->bdev);unsigned int *zone_sectors = data; +if (!blk_queue_is_zoned (q)) +return 0 ; +return !q ||blk_queue_zone_sectors (q) != *zone_sectors; } +/* +* Check consistency of zoned model and zone sectors across all targets. For +* zone sectors, if the destination device is a zoned block device, it shall +* have the specified zone_sectors. +*/ static int validate_hardware_zoned_model (struct dm_table *table,enum blk_zoned_model zoned_model,unsigned int zone_sectors)
@@ -1428,7 +1445,7 @@ static int validate_hardware_zoned_model(struct dm_table *table,return -EINVAL ;if (dm_table_any_dev_attr (table, device_not_matches_zone_sectors, &zone_sectors)) { -DMERR ("%s: zone sectors is not consistent across all devices" , +DMERR ("%s: zone sectors is not consistent across all zoned devices" ,dm_device_name (table->md));return -EINVAL ; }
drivers/md/dm-zoned-target.c +1 -1
@@ -1143,7 +1143,7 @@ static int dmz_message(struct dm_target *ti, unsigned int argc, char **argv,static struct target_type dmz_type = { .name ="zoned" , .version = {2 ,0 ,0 }, - .features =DM_TARGET_SINGLETON |DM_TARGET_ZONED_HM , + .features =DM_TARGET_SINGLETON |DM_TARGET_MIXED_ZONED_MODEL , .module =THIS_MODULE , .ctr = dmz_ctr, .dtr = dmz_dtr,
include/linux/device-mapper.h +14 -1
@@ -246,7 +246,11 @@ struct target_type {#define dm_target_passes_integrity (type) ((type)->features & DM_TARGET_PASSES_INTEGRITY)/* -* Indicates that a target supports host-managed zoned block devices. +* Indicates support for zoned block devices: +* - DM_TARGET_ZONED_HM: the target also supports host-managed zoned +* block devices but does not support combining different zoned models. +* - DM_TARGET_MIXED_ZONED_MODEL: the target supports combining multiple +* devices with different zoned models. */ #define DM_TARGET_ZONED_HM 0x00000040#define dm_target_supports_zoned_hm (type) ((type)->features & DM_TARGET_ZONED_HM)
@@ -257,6 +261,15 @@ struct target_type {#define DM_TARGET_NOWAIT 0x00000080#define dm_target_supports_nowait (type) ((type)->features & DM_TARGET_NOWAIT) +#ifdef CONFIG_BLK_DEV_ZONED +#define DM_TARGET_MIXED_ZONED_MODEL 0x00000200 +#define dm_target_supports_mixed_zoned_model (type) \ + ((type)->features & DM_TARGET_MIXED_ZONED_MODEL) +#else +#define DM_TARGET_MIXED_ZONED_MODEL 0x00000000 +#define dm_target_supports_mixed_zoned_model (type) (false) +#endif +struct dm_target {struct dm_table *table;struct target_type *type;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 228/254 mm/mmu_notifiers: ensure range_end() is paired with range_start()
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit c2655835fd8cabdfe7dab737253de3ffb88da126 ]
If one or more notifiers fails .invalidate_range_start(), invoke .invalidate_range_end() for "all" notifiers. If there are multiple notifiers, those that did not fail are expecting _start() and _end() to be paired, e.g. KVM's mmu_notifier_count would become imbalanced. Disallow notifiers that can fail _start() from implementing _end() so that it's unnecessary to either track which notifiers rejected _start(), or had already succeeded prior to a failed _start().
Note, the existing behavior of calling _start() on all notifiers even after a previous notifier failed _start() was an unintented "feature". Make it canon now that the behavior is depended on for correctness.
As of today, the bug is likely benign:
1. The only caller of the non-blocking notifier is OOM kill.
2. The only notifiers that can fail _start() are the i915 and Nouveau drivers.
3. The only notifiers that utilize _end() are the SGI UV GRU driver and KVM.
4. The GRU driver will never coincide with the i195/Nouveau drivers.
5. An imbalanced kvm->mmu_notifier_count only causes soft lockup in the _guest_, and the guest is already doomed due to being an OOM victim.
Fix the bug now to play nice with future usage, e.g. KVM has a potential use case for blocking memslot updates in KVM while an invalidation is in-progress, and failure to unblock would result in said updates being blocked indefinitely and hanging.
Found by inspection. Verified by adding a second notifier in KVM that periodically returns -EAGAIN on non-blockable ranges, triggering OOM, and observing that KVM exits with an elevated notifier count.
--- include/linux/mmu_notifier.h | 10 +++++----- mm/mmu_notifier.c | 23 +++++++++++++++++++++++ 2 files changed, 28 insertions(+), 5 deletions(-)
include/linux/mmu_notifier.h +5 -5
@@ -169,11 +169,11 @@ struct mmu_notifier_ops {* the last refcount is dropped. * * If blockable argument is set to false then the callback cannot -* sleep and has to return with -EAGAIN. 0 should be returned -* otherwise. Please note that if invalidate_range_start approves -* a non-blocking behavior then the same applies to -* invalidate_range_end. -* +* sleep and has to return with -EAGAIN if sleeping would be required. +* 0 should be returned otherwise. Please note that notifiers that can +* fail invalidate_range_start are not allowed to implement +* invalidate_range_end, as there is no mechanism for informing the +* notifier that its start failed. */ int (*invalidate_range_start)(struct mmu_notifier *subscription,const struct mmu_notifier_range *range);
mm/mmu_notifier.c +23 -0
@@ -501,10 +501,33 @@ static int mn_hlist_invalidate_range_start( "");WARN_ON (mmu_notifier_range_blockable (range) || _ret != -EAGAIN ); +/* +* We call all the notifiers on any EAGAIN, +* there is no way for a notifier to know if +* its start method failed, thus a start that +* does EAGAIN can't also do end. +*/ +WARN_ON (ops->invalidate_range_end); ret = _ret; } } } + +if (ret) { +/* +* Must be non-blocking to get here. If there are multiple +* notifiers and one or more failed start, any that succeeded +* start are expecting their end to be called. Do so now. +*/ +hlist_for_each_entry_rcu (subscription, &subscriptions->list, + hlist,srcu_read_lock_held (&srcu)) { +if (!subscription->ops->invalidate_range_end) +continue ; + + subscription->ops->invalidate_range_end (subscription, + range); + } + }srcu_read_unlock (&srcu, id);return ret;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 229/254 Revert "netfilter: x_tables: Update remaining dereference to RCU"
In reply to Greg Kroah-HartmanFrom: Mark Tomlinson <[email protected]>
[ Upstream commit abe7034b9a8d57737e80cc16d60ed3666990bdbf ]
This reverts commit 443d6e86f821a165fae3fc3fc13086d27ac140b1.
This (and the following) patch basically re-implemented the RCU mechanisms of patch 784544739a25. That patch was replaced because of the performance problems that it created when replacing tables. Now, we have the same issue: the call to synchronize_rcu() makes replacing tables slower by as much as an order of magnitude.
Revert these patches and fix the issue in a different way.
--- net/ipv4/netfilter/arp_tables.c | 2 +- net/ipv4/netfilter/ip_tables.c | 2 +- net/ipv6/netfilter/ip6_tables.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
net/ipv4/netfilter/arp_tables.c +1 -1
@@ -1379,7 +1379,7 @@ static int compat_get_entries(struct net *net,xt_compat_lock (NFPROTO_ARP ); t =xt_find_table_lock (net,NFPROTO_ARP , get.name);if (!IS_ERR (t)) { -const struct xt_table_info *private =xt_table_get_private_protected (t); +const struct xt_table_info *private = t->private;struct xt_table_info info; ret =compat_table_info (private, &info);
net/ipv4/netfilter/ip_tables.c +1 -1
@@ -1589,7 +1589,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,xt_compat_lock (AF_INET ); t =xt_find_table_lock (net,AF_INET , get.name);if (!IS_ERR (t)) { -const struct xt_table_info *private =xt_table_get_private_protected (t); +const struct xt_table_info *private = t->private;struct xt_table_info info; ret =compat_table_info (private, &info);if (!ret && get.size == info.size)
net/ipv6/netfilter/ip6_tables.c +1 -1
@@ -1598,7 +1598,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,xt_compat_lock (AF_INET6 ); t =xt_find_table_lock (net,AF_INET6 , get.name);if (!IS_ERR (t)) { -const struct xt_table_info *private =xt_table_get_private_protected (t); +const struct xt_table_info *private = t->private;struct xt_table_info info; ret =compat_table_info (private, &info);if (!ret && get.size == info.size)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 230/254 ACPI: scan: Rearrange memory allocation in acpi_device_add()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit c1013ff7a5472db637c56bb6237f8343398c03a7 ]
The upfront allocation of new_bus_id is done to avoid allocating memory under acpi_device_lock, but it doesn't really help, because (1) it leads to many unnecessary memory allocations for _ADR devices, (2) kstrdup_const() is run under that lock anyway and
(3) it complicates the code.
Rearrange acpi_device_add() to allocate memory for a new struct acpi_device_bus_id instance only when necessary, eliminate a redundant local variable from it and reduce the number of labels in there.
No intentional functional impact.
--- drivers/acpi/scan.c | 57 +++++++++++++++++++++------------------------ 1 file changed, 26 insertions(+), 31 deletions(-)
drivers/acpi/scan.c +26 -31
@@ -623,12 +623,23 @@ void acpi_bus_put_acpi_device(struct acpi_device *adev)put_device (&adev->dev); } +static struct acpi_device_bus_id *acpi_device_bus_id_match (const char *dev_id) +{ +struct acpi_device_bus_id *acpi_device_bus_id; + +/* Find suitable bus_id and instance number in acpi_bus_id_list. */ +list_for_each_entry (acpi_device_bus_id, &acpi_bus_id_list, node) { +if (!strcmp (acpi_device_bus_id->bus_id, dev_id)) +return acpi_device_bus_id; + } +return NULL ; +} +int acpi_device_add (struct acpi_device *device,void (*release)(struct device *)) { +struct acpi_device_bus_id *acpi_device_bus_id;int result; -struct acpi_device_bus_id *acpi_device_bus_id, *new_bus_id; -int found =0 ;if (device->handle) {acpi_status status;
@@ -654,38 +665,26 @@ int acpi_device_add(struct acpi_device *device,INIT_LIST_HEAD (&device->del_list);mutex_init (&device->physical_node_lock); - new_bus_id =kzalloc (sizeof (struct acpi_device_bus_id ),GFP_KERNEL ); -if (!new_bus_id) { -pr_err (PREFIX "Memory allocation error\n" ); - result = -ENOMEM ; - goto err_detach; - } -mutex_lock (&acpi_device_lock); -/* -* Find suitable bus_id and instance number in acpi_bus_id_list -* If failed, create one and link it into acpi_bus_id_list -*/ -list_for_each_entry (acpi_device_bus_id, &acpi_bus_id_list, node) { -if (!strcmp (acpi_device_bus_id->bus_id, -acpi_device_hid (device))) { - acpi_device_bus_id->instance_no++; - found =1 ; -kfree (new_bus_id); -break ; + + acpi_device_bus_id =acpi_device_bus_id_match (acpi_device_hid (device)); +if (acpi_device_bus_id) { + acpi_device_bus_id->instance_no++; + }else { + acpi_device_bus_id =kzalloc (sizeof (*acpi_device_bus_id), +GFP_KERNEL ); +if (!acpi_device_bus_id) { + result = -ENOMEM ; + goto err_unlock; } - } -if (!found) { - acpi_device_bus_id = new_bus_id; acpi_device_bus_id->bus_id =kstrdup_const (acpi_device_hid (device),GFP_KERNEL );if (!acpi_device_bus_id->bus_id) { -pr_err (PREFIX "Memory allocation error for bus id\n" ); +kfree (acpi_device_bus_id); result = -ENOMEM ; - goto err_free_new_bus_id; + goto err_unlock; } - acpi_device_bus_id->instance_no =0 ;list_add_tail (&acpi_device_bus_id->node, &acpi_bus_id_list); }dev_set_name (&device->dev,"%s:%02x" , acpi_device_bus_id->bus_id, acpi_device_bus_id->instance_no);
@@ -720,13 +719,9 @@ int acpi_device_add(struct acpi_device *device,list_del (&device->node);list_del (&device->wakeup_list); - err_free_new_bus_id: -if (!found) -kfree (new_bus_id); - + err_unlock:mutex_unlock (&acpi_device_lock); - err_detach:acpi_detach_data (device->handle, acpi_scan_drop_device);return result; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 231/254 ACPI: scan: Use unique number for instance_no
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit eb50aaf960e3bedfef79063411ffd670da94b84b ]
The decrementation of acpi_device_bus_id->instance_no in acpi_device_del() is incorrect, because it may cause a duplicate instance number to be allocated next time a device with the same acpi_device_bus_id is added.
Replace above mentioned approach by using IDA framework.
While at it, define the instance range to be [0, 4096).
--- drivers/acpi/internal.h | 6 +++++- drivers/acpi/scan.c | 33 ++++++++++++++++++++++++++++----- include/acpi/acpi_bus.h | 1 + 3 files changed, 34 insertions(+), 6 deletions(-)
drivers/acpi/internal.h +5 -1
@@ -9,6 +9,8 @@#ifndef _ACPI_INTERNAL_H_#define _ACPI_INTERNAL_H_ +#include <linux/idr.h> +#define PREFIX "ACPI: "int early_acpi_osi_init (void );
@@ -96,9 +98,11 @@ void acpi_scan_table_handler(u32 event, void *table, void *context);extern struct list_head acpi_bus_id_list; +#define ACPI_MAX_DEVICE_INSTANCES 4096 +struct acpi_device_bus_id {const char *bus_id; -unsigned int instance_no; +struct ida instance_ida;struct list_head node; };
drivers/acpi/scan.c +28 -5
@@ -482,9 +482,8 @@ static void acpi_device_del(struct acpi_device *device)list_for_each_entry (acpi_device_bus_id, &acpi_bus_id_list, node)if (!strcmp (acpi_device_bus_id->bus_id,acpi_device_hid (device))) { -if (acpi_device_bus_id->instance_no >0 ) - acpi_device_bus_id->instance_no--; -else { +ida_simple_remove (&acpi_device_bus_id->instance_ida, device->pnp.instance_no); +if (ida_is_empty (&acpi_device_bus_id->instance_ida)) {list_del (&acpi_device_bus_id->node);kfree_const (acpi_device_bus_id->bus_id);kfree (acpi_device_bus_id);
@@ -635,6 +634,21 @@ static struct acpi_device_bus_id *acpi_device_bus_id_match(const char *dev_id)return NULL ; } +static int acpi_device_set_name (struct acpi_device *device, +struct acpi_device_bus_id *acpi_device_bus_id) +{ +struct ida *instance_ida = &acpi_device_bus_id->instance_ida; +int result; + + result =ida_simple_get (instance_ida,0 ,ACPI_MAX_DEVICE_INSTANCES ,GFP_KERNEL ); +if (result <0 ) +return result; + + device->pnp.instance_no = result; +dev_set_name (&device->dev,"%s:%02x" , acpi_device_bus_id->bus_id, result); +return 0 ; +} +int acpi_device_add (struct acpi_device *device,void (*release)(struct device *)) {
@@ -669,7 +683,9 @@ int acpi_device_add(struct acpi_device *device, acpi_device_bus_id =acpi_device_bus_id_match (acpi_device_hid (device));if (acpi_device_bus_id) { - acpi_device_bus_id->instance_no++; + result =acpi_device_set_name (device, acpi_device_bus_id); +if (result) + goto err_unlock; }else { acpi_device_bus_id =kzalloc (sizeof (*acpi_device_bus_id),GFP_KERNEL );
@@ -685,9 +701,16 @@ int acpi_device_add(struct acpi_device *device, goto err_unlock; } +ida_init (&acpi_device_bus_id->instance_ida); + + result =acpi_device_set_name (device, acpi_device_bus_id); +if (result) { +kfree (acpi_device_bus_id); + goto err_unlock; + } +list_add_tail (&acpi_device_bus_id->node, &acpi_bus_id_list); } -dev_set_name (&device->dev,"%s:%02x" , acpi_device_bus_id->bus_id, acpi_device_bus_id->instance_no);if (device->parent)list_add_tail (&device->node, &device->parent->children);
include/acpi/acpi_bus.h +1 -0
@@ -233,6 +233,7 @@ struct acpi_pnp_type {struct acpi_device_pnp {acpi_bus_id bus_id;/* Object name */ +int instance_no;/* Instance number of this object */ struct acpi_pnp_type type;/* ID type */ acpi_bus_address bus_address;/* _ADR */ char *unique_id;/* _UID */
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 232/254 perf auxtrace: Fix auxtrace queue conflict
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
[ Upstream commit b410ed2a8572d41c68bd9208555610e4b07d0703 ]
The only requirement of an auxtrace queue is that the buffers are in time order. That is achieved by making separate queues for separate perf buffer or AUX area buffer mmaps.
That generally means a separate queue per cpu for per-cpu contexts, and a separate queue per thread for per-task contexts.
When buffers are added to a queue, perf checks that the buffer cpu and thread id (tid) match the queue cpu and thread id.
However, generally, that need not be true, and perf will queue buffers correctly anyway, so the check is not needed.
In addition, the check gets erroneously hit when using sample mode to trace multiple threads.
Consequently, fix that case by removing the check.
--- tools/perf/util/auxtrace.c | 4 ---- 1 file changed, 4 deletions(-)
tools/perf/util/auxtrace.c +0 -4
@@ -298,10 +298,6 @@ static int auxtrace_queues__queue_buffer(struct auxtrace_queues *queues, queue->set = true; queue->tid = buffer->tid; queue->cpu = buffer->cpu; - }else if (buffer->cpu != queue->cpu || buffer->tid != queue->tid) { -pr_err ("auxtrace queue conflict: cpu %d, tid %d vs cpu %d, tid %d\n" , - queue->cpu, queue->tid, buffer->cpu, buffer->tid); -return -EINVAL ; } buffer->buffer_nr = queues->next_buffer_nr++;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 233/254 perf synthetic events: Avoid write of uninitialized memory when generating PERF_RECORD_MMAP* records
In reply to Greg Kroah-HartmanFrom: Ian Rogers <[email protected]>
[ Upstream commit 2a76f6de07906f0bb5f2a13fb02845db1695cc29 ]
Account for alignment bytes in the zero-ing memset.
--- tools/perf/util/synthetic-events.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
tools/perf/util/synthetic-events.c +5 -4
@@ -384,7 +384,7 @@ int perf_event__synthesize_mmap_events(struct perf_tool *tool,while (!io.eof) {static const char anonstr[] ="//anon" ; -size_t size; +size_t size, aligned_size;/* ensure null termination since stack will be reused. */ event->mmap2.filename[0 ] ='\0' ;
@@ -444,11 +444,12 @@ int perf_event__synthesize_mmap_events(struct perf_tool *tool, } size =strlen (event->mmap2.filename) +1 ; - size =PERF_ALIGN (size,sizeof (u64)); + aligned_size =PERF_ALIGN (size,sizeof (u64)); event->mmap2.len -= event->mmap.start; event->mmap2.header.size = (sizeof (event->mmap2) - - (sizeof (event->mmap2.filename) - size)); -memset (event->mmap2.filename + size,0 , machine->id_hdr_size); + (sizeof (event->mmap2.filename) - aligned_size)); +memset (event->mmap2.filename + size,0 , machine->id_hdr_size + + (aligned_size - size)); event->mmap2.header.size += machine->id_hdr_size; event->mmap2.pid = tgid; event->mmap2.tid = pid;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 234/254 io_uring: fix provide_buffers sign extension
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
[ Upstream commit d81269fecb8ce16eb07efafc9ff5520b2a31c486 ]
io_provide_buffers_prep()'s "p->len * p->nbufs" to sign extension problems. Not a huge problem as it's only used for access_ok() and increases the checked length, but better to keep typing right.
--- fs/io_uring.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/io_uring.c +3 -1
@@ -4214,6 +4214,7 @@ static int io_remove_buffers(struct io_kiocb *req, bool force_nonblock,static int io_provide_buffers_prep (struct io_kiocb *req,const struct io_uring_sqe *sqe) { +unsigned long size;struct io_provide_buf *p = &req->pbuf;u64 tmp;
@@ -4227,7 +4228,8 @@ static int io_provide_buffers_prep(struct io_kiocb *req, p->addr =READ_ONCE (sqe->addr); p->len =READ_ONCE (sqe->len); -if (!access_ok (u64_to_user_ptr (p->addr), (p->len * p->nbufs))) + size = (unsigned long )p->len * p->nbufs; +if (!access_ok (u64_to_user_ptr (p->addr), size))return -EFAULT ; p->bgid =READ_ONCE (sqe->buf_group);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 235/254 block: recalculate segment count for multi-segment discards correctly
In reply to Greg Kroah-HartmanFrom: David Jeffery <[email protected]>
[ Upstream commit a958937ff166fc60d1c3a721036f6ff41bfa2821 ]
When a stacked block device inserts a request into another block device using blk_insert_cloned_request, the request's nr_phys_segments field gets recalculated by a call to blk_recalc_rq_segments in blk_cloned_rq_check_limits. But blk_recalc_rq_segments does not know how to handle multi-segment discards. For disk types which can handle multi-segment discards like nvme, this results in discard requests which claim a single segment when it should report several, triggering a warning in nvme and causing nvme to fail the discard from the invalid state.
WARNING: CPU: 5 PID: 191 at drivers/nvme/host/core.c:700 nvme_setup_discard+0x170/0x1e0 [nvme_core] ... nvme_setup_cmd+0x217/0x270 [nvme_core] nvme_loop_queue_rq+0x51/0x1b0 [nvme_loop] __blk_mq_try_issue_directly+0xe7/0x1b0 blk_mq_request_issue_directly+0x41/0x70 ? blk_account_io_start+0x40/0x50 dm_mq_queue_rq+0x200/0x3e0 blk_mq_dispatch_rq_list+0x10a/0x7d0 ? __sbitmap_queue_get+0x25/0x90 ? elv_rb_del+0x1f/0x30 ? deadline_remove_request+0x55/0xb0 ? dd_dispatch_request+0x181/0x210 __blk_mq_do_dispatch_sched+0x144/0x290 ? bio_attempt_discard_merge+0x134/0x1f0 __blk_mq_sched_dispatch_requests+0x129/0x180 blk_mq_sched_dispatch_requests+0x30/0x60 __blk_mq_run_hw_queue+0x47/0xe0 __blk_mq_delay_run_hw_queue+0x15b/0x170 blk_mq_sched_insert_requests+0x68/0xe0 blk_mq_flush_plug_list+0xf0/0x170 blk_finish_plug+0x36/0x50 xlog_cil_committed+0x19f/0x290 [xfs] xlog_cil_process_committed+0x57/0x80 [xfs] xlog_state_do_callback+0x1e0/0x2a0 [xfs] xlog_ioend_work+0x2f/0x80 [xfs] process_one_work+0x1b6/0x350 worker_thread+0x53/0x3e0 ? process_one_work+0x350/0x350 kthread+0x11b/0x140 ? __kthread_bind_mask+0x60/0x60 ret_from_fork+0x22/0x30
This patch fixes blk_recalc_rq_segments to be aware of devices which can have multi-segment discards. It calculates the correct discard segment count by counting the number of bio as each discard bio is considered its own segment.
--- block/blk-merge.c | 8 ++++++++ 1 file changed, 8 insertions(+)
block/blk-merge.c +8 -0
@@ -383,6 +383,14 @@ unsigned int blk_recalc_rq_segments(struct request *rq)switch (bio_op (rq->bio)) {case REQ_OP_DISCARD :case REQ_OP_SECURE_ERASE : +if (queue_max_discard_segments (rq->q) >1 ) { +struct bio *bio = rq->bio; + +for_each_bio (bio) + nr_phys_segs++; +return nr_phys_segs; + } +return 1 ;case REQ_OP_WRITE_ZEROES :return 0 ;case REQ_OP_WRITE_SAME :
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 236/254 scsi: Revert "qla2xxx: Make sure that aborted commands are freed"
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 39c0c8553bfb5a3d108aa47f1256076d507605e3 ]
Calling vha->hw->tgt.tgt_ops->free_cmd() from qlt_xmit_response() is wrong since the command for which a response is sent must remain valid until the SCSI target core calls .release_cmd(). It has been observed that the following scenario triggers a kernel crash:
- qlt_xmit_response() calls qlt_check_reserve_free_req()
- qlt_check_reserve_free_req() returns -EAGAIN
- qlt_xmit_response() calls vha->hw->tgt.tgt_ops->free_cmd(cmd)
- transport_handle_queue_full() tries to retransmit the response
Fix this crash by reverting the patch that introduced it.
--- drivers/scsi/qla2xxx/qla_target.c | 13 +++++-------- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 4 ---- 2 files changed, 5 insertions(+), 12 deletions(-)
drivers/scsi/qla2xxx/qla_target.c +5 -8
@@ -3223,8 +3223,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) || (cmd->sess && cmd->sess->deleted)) { cmd->state =QLA_TGT_STATE_PROCESSED ; - res =0 ; - goto free; +return 0 ; } ql_dbg_qp(ql_dbg_tgt, qpair, 0xe018,
@@ -3235,8 +3234,9 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, res =qlt_pre_xmit_response (cmd, &prm, xmit_type, scsi_status, &full_req_cnt); -if (unlikely (res !=0 )) - goto free; +if (unlikely (res !=0 )) { +return res; + }spin_lock_irqsave (qpair->qp_lock_ptr, flags);
@@ -3256,8 +3256,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, vha->flags.online,qla2x00_reset_active (vha), cmd->reset_count, qpair->chip_reset);spin_unlock_irqrestore (qpair->qp_lock_ptr, flags); - res =0 ; - goto free; +return 0 ; }/* Does F/W have an IOCBs for this request */
@@ -3360,8 +3359,6 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,qlt_unmap_sg (vha, cmd);spin_unlock_irqrestore (qpair->qp_lock_ptr, flags); -free: - vha->hw->tgt.tgt_ops->free_cmd (cmd);return res; }EXPORT_SYMBOL (qlt_xmit_response);
drivers/scsi/qla2xxx/tcm_qla2xxx.c +0 -4
@@ -644,7 +644,6 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd) {struct qla_tgt_cmd *cmd =container_of (se_cmd, struct qla_tgt_cmd, se_cmd); -struct scsi_qla_host *vha = cmd->vha;if (cmd->aborted) {/* Cmd can loop during Q-full. tcm_qla2xxx_aborted_task
@@ -657,7 +656,6 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd) cmd->se_cmd.transport_state, cmd->se_cmd.t_state, cmd->se_cmd.se_cmd_flags); - vha->hw->tgt.tgt_ops->free_cmd (cmd);return 0 ; }
@@ -685,7 +683,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd) {struct qla_tgt_cmd *cmd =container_of (se_cmd, struct qla_tgt_cmd, se_cmd); -struct scsi_qla_host *vha = cmd->vha;int xmit_type =QLA_TGT_XMIT_STATUS ;if (cmd->aborted) {
@@ -699,7 +696,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd) cmd,kref_read (&cmd->se_cmd.cmd_kref), cmd->se_cmd.transport_state, cmd->se_cmd.t_state, cmd->se_cmd.se_cmd_flags); - vha->hw->tgt.tgt_ops->free_cmd (cmd);return 0 ; } cmd->bufflen = se_cmd->data_length;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 237/254 scsi: qedi: Fix error return code of qedi_alloc_global_queues()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit f69953837ca5d98aa983a138dc0b90a411e9c763 ]
When kzalloc() returns NULL to qedi->global_queues[i], no error return code of qedi_alloc_global_queues() is assigned. To fix this bug, status is assigned with -ENOMEM in this case.
--- drivers/scsi/qedi/qedi_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/qedi/qedi_main.c +1 -0
@@ -1675,6 +1675,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)if (!qedi->global_queues[i]) {QEDI_ERR (&qedi->dbg_ctx,"Unable to allocation global queue %d.\n" , i); + status = -ENOMEM ; goto mem_alloc_failure; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 238/254 scsi: mpt3sas: Fix error return code of mpt3sas_base_attach()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 3401ecf7fc1b9458a19d42c0e26a228f18ac7dda ]
When kzalloc() returns NULL, no error return code of mpt3sas_base_attach() is assigned. To fix this bug, r is assigned with -ENOMEM in this case.
--- drivers/scsi/mpt3sas/mpt3sas_base.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/scsi/mpt3sas/mpt3sas_base.c +6 -2
@@ -7789,14 +7789,18 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->pend_os_device_add_sz++; ioc->pend_os_device_add =kzalloc (ioc->pend_os_device_add_sz,GFP_KERNEL ); -if (!ioc->pend_os_device_add) +if (!ioc->pend_os_device_add) { + r = -ENOMEM ; goto out_free_resources; + } ioc->device_remove_in_progress_sz = ioc->pend_os_device_add_sz; ioc->device_remove_in_progress =kzalloc (ioc->device_remove_in_progress_sz,GFP_KERNEL ); -if (!ioc->device_remove_in_progress) +if (!ioc->device_remove_in_progress) { + r = -ENOMEM ; goto out_free_resources; + } ioc->fwfault_debug = mpt3sas_fwfault_debug;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 239/254 smb3: fix cached file size problems in duplicate extents (reflink)
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
commit cfc63fc8126a93cbf95379bc4cad79a7b15b6ece upstream.
There were two problems (one of which could cause data corruption) that were noticed with duplicate extents (ie reflink) when debugging why various xfstests were being incorrectly skipped (e.g. generic/138, generic/140, generic/142). First, we were not updating the file size locally in the cache when extending a file due to reflink (it would refresh after actimeo expires) but xfstest was checking the size immediately which was still 0 so caused the test to be skipped. Second, we were setting the target file size (which could shrink the file) in all cases to the end of the reflinked range rather than only setting the target file size when reflink would extend the file.
--- fs/cifs/smb2ops.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
fs/cifs/smb2ops.c +15 -3
@@ -2007,6 +2007,7 @@ smb2_duplicate_extents(const unsigned in {int rc;unsigned int ret_data_len; +struct inode *inode;struct duplicate_extents_to_file dup_ext_buf;struct cifs_tcon *tcon =tlink_tcon (trgtfile->tlink);
@@ -2023,10 +2024,21 @@ smb2_duplicate_extents(const unsigned incifs_dbg (FYI ,"Duplicate extents: src off %lld dst off %lld len %lld\n" , src_off, dest_off, len); - rc =smb2_set_file_size (xid, tcon, trgtfile, dest_off + len, false); -if (rc) - goto duplicate_extents_out; + inode =d_inode (trgtfile->dentry); +if (inode->i_size < dest_off + len) { + rc =smb2_set_file_size (xid, tcon, trgtfile, dest_off + len, false); +if (rc) + goto duplicate_extents_out; +/* +* Although also could set plausible allocation size (i_blocks) +* here in addition to setting the file size, in reflink +* it is likely that the target file is sparse. Its allocation +* size will be queried on next revalidate, but it is important +* to make sure that file's cached size is updated immediately +*/ +cifs_setsize (inode, dest_off + len); + } rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid, trgtfile->fid.volatile_fid, FSCTL_DUPLICATE_EXTENTS_TO_FILE,
Greg Kroah-Hartman
maintainerPATCH 240/254 cifs: Adjust key sizes and key generation routines for AES256 encryption
In reply to Greg Kroah-HartmanFrom: Shyam Prasad N <[email protected]>
commit 45a4546c6167a2da348a31ca439d8a8ff773b6ea upstream.
For AES256 encryption (GCM and CCM), we need to adjust the size of a few fields to 32 bytes instead of 16 to accommodate the larger keys.
Also, the L value supplied to the key generator needs to be changed from to 256 when these algorithms are used.
Keeping the ioctl struct for dumping keys of the same size for now. Will send out a different patch for that one.
--- fs/cifs/cifsglob.h | 4 ++-- fs/cifs/cifspdu.h | 5 +++++ fs/cifs/smb2glob.h | 1 + fs/cifs/smb2ops.c | 9 +++++---- fs/cifs/smb2transport.c | 37 ++++++++++++++++++++++++++++--------- 5 files changed, 41 insertions(+), 15 deletions(-)
fs/cifs/cifsglob.h +2 -2
@@ -915,8 +915,8 @@ struct cifs_ses { bool binding:1; /* are we binding the session? */__u16 session_flags;__u8 smb3signingkey[SMB3_SIGN_KEY_SIZE ]; -__u8 smb3encryptionkey[SMB3_SIGN_KEY_SIZE ]; -__u8 smb3decryptionkey[SMB3_SIGN_KEY_SIZE ]; +__u8 smb3encryptionkey[SMB3_ENC_DEC_KEY_SIZE ]; +__u8 smb3decryptionkey[SMB3_ENC_DEC_KEY_SIZE ];__u8 preauth_sha_hash[SMB2_PREAUTH_HASH_SIZE ];__u8 binding_preauth_sha_hash[SMB2_PREAUTH_HASH_SIZE ];
fs/cifs/cifspdu.h +5 -0
@@ -147,6 +147,11 @@*/ #define SMB3_SIGN_KEY_SIZE (16) +/* +* Size of the smb3 encryption/decryption keys +*/ +#define SMB3_ENC_DEC_KEY_SIZE (32) +#define CIFS_CLIENT_CHALLENGE_SIZE (8)#define CIFS_SERVER_CHALLENGE_SIZE (8)#define CIFS_HMAC_MD5_HASH_SIZE (16)
fs/cifs/smb2glob.h +1 -0
@@ -58,6 +58,7 @@#define SMB2_HMACSHA256_SIZE (32)#define SMB2_CMACAES_SIZE (16)#define SMB3_SIGNKEY_SIZE (16) +#define SMB3_GCM128_CRYPTKEY_SIZE (16)#define SMB3_GCM256_CRYPTKEY_SIZE (32)/* Maximum buffer size value we can send with 1 credit */
fs/cifs/smb2ops.c +5 -4
@@ -4109,7 +4109,7 @@ smb2_get_enc_key(struct TCP_Server_Infoif (ses->Suid == ses_id) { ses_enc_key = enc ? ses->smb3encryptionkey : ses->smb3decryptionkey; -memcpy (key, ses_enc_key,SMB3_SIGN_KEY_SIZE ); +memcpy (key, ses_enc_key,SMB3_ENC_DEC_KEY_SIZE );spin_unlock (&cifs_tcp_ses_lock);return 0 ; }
@@ -4136,7 +4136,7 @@ crypt_message(struct TCP_Server_Info *seint rc =0 ;struct scatterlist *sg;u8 sign[SMB2_SIGNATURE_SIZE ] = {}; -u8 key[SMB3_SIGN_KEY_SIZE ]; +u8 key[SMB3_ENC_DEC_KEY_SIZE ];struct aead_request *req;char *iv;unsigned int iv_len;
@@ -4160,10 +4160,11 @@ crypt_message(struct TCP_Server_Info *se tfm = enc ? server->secmech.ccmaesencrypt : server->secmech.ccmaesdecrypt; -if (server->cipher_type ==SMB2_ENCRYPTION_AES256_GCM ) +if ((server->cipher_type ==SMB2_ENCRYPTION_AES256_CCM ) || + (server->cipher_type ==SMB2_ENCRYPTION_AES256_GCM )) rc =crypto_aead_setkey (tfm, key,SMB3_GCM256_CRYPTKEY_SIZE );else - rc =crypto_aead_setkey (tfm, key,SMB3_SIGN_KEY_SIZE ); + rc =crypto_aead_setkey (tfm, key,SMB3_GCM128_CRYPTKEY_SIZE );if (rc) {cifs_server_dbg (VFS ,"%s: Failed to set aead key %d\n" , __func__, rc);
fs/cifs/smb2transport.c +28 -9
@@ -298,7 +298,8 @@ static int generate_key(struct cifs_ses {unsigned char zero =0x0 ;__u8 i[4 ] = {0 ,0 ,0 ,1 }; -__u8 L [4 ] = {0 ,0 ,0 ,128 }; +__u8 L128 [4 ] = {0 ,0 ,0 ,128 }; +__u8 L256 [4 ] = {0 ,0 ,1 ,0 };int rc =0 ;unsigned char prfhash[SMB2_HMACSHA256_SIZE ];unsigned char *hashptr = prfhash;
@@ -354,8 +355,14 @@ static int generate_key(struct cifs_ses goto smb3signkey_ret; } - rc =crypto_shash_update (&server->secmech.sdeschmacsha256->shash, -L ,4 ); +if ((server->cipher_type ==SMB2_ENCRYPTION_AES256_CCM ) || + (server->cipher_type ==SMB2_ENCRYPTION_AES256_GCM )) { + rc =crypto_shash_update (&server->secmech.sdeschmacsha256->shash, +L256 ,4 ); + }else { + rc =crypto_shash_update (&server->secmech.sdeschmacsha256->shash, +L128 ,4 ); + }if (rc) {cifs_server_dbg (VFS ,"%s: Could not update with L\n" , __func__); goto smb3signkey_ret;
@@ -390,6 +397,9 @@ generate_smb3signingkey(struct cifs_ses const struct derivation_triplet *ptriplet) {int rc; +#ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS +struct TCP_Server_Info *server = ses->server; +#endif /* * All channels use the same encryption/decryption keys but
@@ -422,11 +432,11 @@ generate_smb3signingkey(struct cifs_ses rc =generate_key (ses, ptriplet->encryption.label, ptriplet->encryption.context, ses->smb3encryptionkey, -SMB3_SIGN_KEY_SIZE ); +SMB3_ENC_DEC_KEY_SIZE ); rc =generate_key (ses, ptriplet->decryption.label, ptriplet->decryption.context, ses->smb3decryptionkey, -SMB3_SIGN_KEY_SIZE ); +SMB3_ENC_DEC_KEY_SIZE );if (rc)return rc; }
@@ -442,14 +452,23 @@ generate_smb3signingkey(struct cifs_ses*/ cifs_dbg (VFS ,"Session Id %*ph\n" , (int )sizeof (ses->Suid), &ses->Suid); +cifs_dbg (VFS ,"Cipher type %d\n" , server->cipher_type);cifs_dbg (VFS ,"Session Key %*ph\n" ,SMB2_NTLMV2_SESSKEY_SIZE , ses->auth_key.response);cifs_dbg (VFS ,"Signing Key %*ph\n" ,SMB3_SIGN_KEY_SIZE , ses->smb3signingkey); -cifs_dbg (VFS ,"ServerIn Key %*ph\n" , -SMB3_SIGN_KEY_SIZE , ses->smb3encryptionkey); -cifs_dbg (VFS ,"ServerOut Key %*ph\n" , -SMB3_SIGN_KEY_SIZE , ses->smb3decryptionkey); +if ((server->cipher_type ==SMB2_ENCRYPTION_AES256_CCM ) || + (server->cipher_type ==SMB2_ENCRYPTION_AES256_GCM )) { +cifs_dbg (VFS ,"ServerIn Key %*ph\n" , +SMB3_GCM256_CRYPTKEY_SIZE , ses->smb3encryptionkey); +cifs_dbg (VFS ,"ServerOut Key %*ph\n" , +SMB3_GCM256_CRYPTKEY_SIZE , ses->smb3decryptionkey); + }else { +cifs_dbg (VFS ,"ServerIn Key %*ph\n" , +SMB3_GCM128_CRYPTKEY_SIZE , ses->smb3encryptionkey); +cifs_dbg (VFS ,"ServerOut Key %*ph\n" , +SMB3_GCM128_CRYPTKEY_SIZE , ses->smb3decryptionkey); + }#endif return rc; }
Greg Kroah-Hartman
maintainerPATCH 241/254 locking/mutex: Fix non debug version of mutex_lock_io_nested()
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 291da9d4a9eb3a1cb0610b7f4480f5b52b1825e7 upstream.
If CONFIG_DEBUG_LOCK_ALLOC=n then mutex_lock_io_nested() maps to mutex_lock() which is clearly wrong because mutex_lock() lacks the io_schedule_prepare()/finish() invocations.
Map it to mutex_lock_io().
--- include/linux/mutex.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/mutex.h +1 -1
@@ -185,7 +185,7 @@ extern void mutex_lock_io(struct mutex *# define mutex_lock_interruptible_nested (lock, subclass) mutex_lock_interruptible(lock)# define mutex_lock_killable_nested (lock, subclass) mutex_lock_killable(lock)# define mutex_lock_nest_lock (lock, nest_lock) mutex_lock(lock) -# define mutex_lock_io_nested (lock, subclass) mutex_lock(lock) +# define mutex_lock_io_nested (lock, subclass) mutex_lock_io(lock)#endif /*
Greg Kroah-Hartman
maintainerPATCH 242/254 x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc()
In reply to Greg Kroah-HartmanFrom: Isaku Yamahata <[email protected]>
commit 8249d17d3194eac064a8ca5bc5ca0abc86feecde upstream.
The pfn variable contains the page frame number as returned by the pXX_pfn() functions, shifted to the right by PAGE_SHIFT to remove the page bits. After page protection computations are done to it, it gets shifted back to the physical address using page_level_shift().
That is wrong, of course, because that function determines the shift length based on the level of the page in the page table but in all the cases, it was shifted by PAGE_SHIFT before.
Therefore, shift it back using PAGE_SHIFT to get the correct physical address.
[ bp: Rewrite commit message. ]
--- arch/x86/mm/mem_encrypt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/mm/mem_encrypt.c +1 -1
@@ -262,7 +262,7 @@ static void __init __set_clr_pte_enc(pteif (pgprot_val (old_prot) ==pgprot_val (new_prot))return ; - pa = pfn <<page_level_shift (level); + pa = pfn <<PAGE_SHIFT ; size =page_level_size (level);/*
Greg Kroah-Hartman
maintainerPATCH 243/254 fs/cachefiles: Remove wait_bit_key layout dependency
In reply to Greg Kroah-HartmanFrom: Matthew Wilcox (Oracle) <[email protected]>
commit 39f985c8f667c80a3d1eb19d31138032fa36b09e upstream.
Cachefiles was relying on wait_page_key and wait_bit_key being the same layout, which is fragile. Now that wait_page_key is exposed in the pagemap.h header, we can remove that fragility
A comment on the need to maintain structure layout equivalence was added by Linus[1] and that is no longer applicable.
--- fs/cachefiles/rdwr.c | 7 +++---- include/linux/pagemap.h | 1 - 2 files changed, 3 insertions(+), 5 deletions(-)
fs/cachefiles/rdwr.c +3 -4
@@ -24,17 +24,16 @@ static int cachefiles_read_waiter(wait_q container_of(wait, struct cachefiles_one_read, monitor);struct cachefiles_object *object;struct fscache_retrieval *op = monitor->op; -struct wait_bit_key *key = _key; +struct wait_page_key *key = _key;struct page *page = wait->private;ASSERT (key);_enter ("{%lu},%u,%d,{%p,%u}" , monitor->netfs_page->index, mode, sync, - key->flags, key->bit_nr); + key->page, key->bit_nr); -if (key->flags != &page->flags || - key->bit_nr != PG_locked) +if (key->page != page || key->bit_nr != PG_locked)return 0 ;_debug ("--- monitor %p %lx ---" , page, page->flags);
include/linux/pagemap.h +0 -1
@@ -559,7 +559,6 @@ static inline pgoff_t linear_page_index(return pgoff; } -/* This has the same layout as wait_bit_key - see fs/cachefiles/rdwr.c */ struct wait_page_key {struct page *page;int bit_nr;
Greg Kroah-Hartman
maintainerPATCH 244/254 ch_ktls: fix enum-conversion warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 6f235a69e59484e382dc31952025b0308efedc17 upstream.
gcc points out an incorrect enum assignment:
drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c: In function 'chcr_ktls_cpl_set_tcb_rpl':drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c:684:22: warning: implicit conversion from 'enum <anonymous>' to 'enum ch_ktls_open_state' [-Wenum-conversion]
This appears harmless, and should apparently use 'CH_KTLS_OPEN_SUCCESS' instead of 'false', with the same value '0'.
--- drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c +1 -1
@@ -727,7 +727,7 @@ static int chcr_ktls_cpl_set_tcb_rpl(strkvfree (tx_info);return 0 ; } - tx_info->open_state = false; + tx_info->open_state =CH_KTLS_OPEN_SUCCESS ;spin_unlock (&tx_info->lock);complete (&tx_info->completion);
Greg Kroah-Hartman
maintainerPATCH 245/254 can: dev: Move device back to init netns on owning netns delete
In reply to Greg Kroah-HartmanFrom: Martin Willi <[email protected]>
commit 3a5ca857079ea022e0b1b17fc154f7ad7dbc150f upstream.
When a non-initial netns is destroyed, the usual policy is to delete all virtual network interfaces contained, but move physical interfaces back to the initial netns. This keeps the physical interface visible on the system.
CAN devices are somewhat special, as they define rtnl_link_ops even if they are physical devices. If a CAN interface is moved into a non-initial netns, destroying that netns lets the interface vanish instead of moving it back to the initial netns. default_device_exit() skips CAN interfaces due to having rtnl_link_ops set. Reproducer:
ip netns add foo
ip link set can0 netns foo
ip netns delete foo
WARNING: CPU: 1 PID: 84 at net/core/dev.c:11030 ops_exit_list+0x38/0x60 CPU: 1 PID: 84 Comm: kworker/u4:2 Not tainted 5.10.19 #1 Workqueue: netns cleanup_net [<c010e700>] (unwind_backtrace) from [<c010a1d8>] (show_stack+0x10/0x14) [<c010a1d8>] (show_stack) from [<c086dc10>] (dump_stack+0x94/0xa8) [<c086dc10>] (dump_stack) from [<c086b938>] (__warn+0xb8/0x114) [<c086b938>] (__warn) from [<c086ba10>] (warn_slowpath_fmt+0x7c/0xac) [<c086ba10>] (warn_slowpath_fmt) from [<c0629f20>] (ops_exit_list+0x38/0x60) [<c0629f20>] (ops_exit_list) from [<c062a5c4>] (cleanup_net+0x230/0x380) [<c062a5c4>] (cleanup_net) from [<c0142c20>] (process_one_work+0x1d8/0x438) [<c0142c20>] (process_one_work) from [<c0142ee4>] (worker_thread+0x64/0x5a8) [<c0142ee4>] (worker_thread) from [<c0148a98>] (kthread+0x148/0x14c) [<c0148a98>] (kthread) from [<c0100148>] (ret_from_fork+0x14/0x2c)
To properly restore physical CAN devices to the initial netns on owning netns exit, introduce a flag on rtnl_link_ops that can be set by drivers. For CAN devices setting this flag, default_device_exit() considers them non-virtual, applying the usual namespace move.
The issue was introduced in the commit mentioned below, as at that time CAN devices did not have a dellink() operation.
--- drivers/net/can/dev.c | 1 + include/net/rtnetlink.h | 2 ++ net/core/dev.c | 2 +- 3 files changed, 4 insertions(+), 1 deletion(-)
drivers/net/can/dev.c +1 -0
@@ -1255,6 +1255,7 @@ static void can_dellink(struct net_devicstatic struct rtnl_link_ops can_link_ops__read_mostly = { .kind ="can" , + .netns_refund = true, .maxtype =IFLA_CAN_MAX , .policy = can_policy, .setup = can_setup,
include/net/rtnetlink.h +2 -0
@@ -33,6 +33,7 @@ static inline int rtnl_msg_family(const* * @list: Used internally * @kind: Identifier +* @netns_refund: Physical device, move to init_net on netns exit * @maxtype: Highest device specific netlink attribute number * @policy: Netlink policy for device specific attribute validation * @validate: Optional validation function for netlink/changelink parameters
@@ -64,6 +65,7 @@ struct rtnl_link_ops {size_t priv_size;void (*setup)(struct net_device *dev); +bool netns_refund;unsigned int maxtype;const struct nla_policy *policy; int (*validate)(struct nlattr *tb[],
net/core/dev.c +1 -1
@@ -11194,7 +11194,7 @@ static void __net_exit default_device_excontinue ;/* Leave virtual devices for the generic cleanup */ -if (dev->rtnl_link_ops) +if (dev->rtnl_link_ops && !dev->rtnl_link_ops->netns_refund)continue ;/* Push remaining network devices to init_net */
Greg Kroah-Hartman
maintainerPATCH 246/254 r8169: fix DMA being used after buffer free if WoL is enabled
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
commit f658b90977d2e79822a558e48116e059a7e75dec upstream.
IOMMU errors have been reported if WoL is enabled and interface is brought down. It turned out that the network chip triggers DMA transfers after the DMA buffers have been freed. For WoL to work we need to leave rx enabled, therefore simply stop the chip from being a DMA busmaster.
--- drivers/net/ethernet/realtek/r8169_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/realtek/r8169_main.c +4 -2
@@ -4677,6 +4677,9 @@ static void rtl8169_down(struct rtl8169_rtl8169_update_counters (tp); +pci_clear_master (tp->pci_dev); +rtl_pci_commit (tp); +rtl8169_cleanup (tp, true);rtl_pll_power_down (tp);
@@ -4684,6 +4687,7 @@ static void rtl8169_down(struct rtl8169_static void rtl8169_up (struct rtl8169_private *tp) { +pci_set_master (tp->pci_dev);rtl_pll_power_up (tp);rtl8169_init_phy (tp);napi_enable (&tp->napi);
@@ -5348,8 +5352,6 @@ static int rtl_init_one(struct pci_dev *rtl_hw_reset (tp); -pci_set_master (pdev); - rc =rtl_alloc_irq (tp);if (rc <0 ) {dev_err (&pdev->dev,"Can't allocate interrupt\n" );
Greg Kroah-Hartman
maintainerPATCH 247/254 net: dsa: b53: VLAN filtering is global to all users
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit d45c36bafb94e72fdb6dee437279b61b6d97e706 upstream.
The bcm_sf2 driver uses the b53 driver as a library but does not make usre of the b53_setup() function, this made it fail to inherit the vlan_filtering_is_global attribute. Fix this by moving the assignment to b53_switch_alloc() which is used by bcm_sf2.
--- drivers/net/dsa/b53/b53_common.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/dsa/b53/b53_common.c +7 -7
@@ -1070,13 +1070,6 @@ static int b53_setup(struct dsa_switch *b53_disable_port (ds, port); } -/* Let DSA handle the case were multiple bridges span the same switch -* device and different VLAN awareness settings are requested, which -* would be breaking filtering semantics for any of the other bridge -* devices. (not hardware supported) -*/ - ds->vlan_filtering_is_global = true; -return b53_setup_devlink_resources (ds); }
@@ -2627,6 +2620,13 @@ struct b53_device *b53_switch_alloc(stru ds->configure_vlan_while_not_filtering = true; ds->untag_bridge_pvid = true; dev->vlan_enabled = ds->configure_vlan_while_not_filtering; +/* Let DSA handle the case were multiple bridges span the same switch +* device and different VLAN awareness settings are requested, which +* would be breaking filtering semantics for any of the other bridge +* devices. (not hardware supported) +*/ + ds->vlan_filtering_is_global = true; +mutex_init (&dev->reg_mutex);mutex_init (&dev->stats_mutex);
Greg Kroah-Hartman
maintainerPATCH 248/254 mac80211: fix double free in ibss_leave
In reply to Greg Kroah-HartmanFrom: Markus Theil <[email protected]>
commit 3bd801b14e0c5d29eeddc7336558beb3344efaa3 upstream.
Clear beacon ie pointer and ie length after free
in order to prevent double free.
==================================================================
BUG: KASAN: double-free or invalid-free \ in ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876 CPU: 0 PID: 8472 Comm: syz-executor100 Not tainted 5.11.0-rc6-syzkaller #0 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2c6 mm/kasan/report.c:230 kasan_report_invalid_free+0x51/0x80 mm/kasan/report.c:355 ____kasan_slab_free+0xcc/0xe0 mm/kasan/common.c:341 kasan_slab_free include/linux/kasan.h:192 [inline] __cache_free mm/slab.c:3424 [inline] kfree+0xed/0x270 mm/slab.c:3760 ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876 rdev_leave_ibss net/wireless/rdev-ops.h:545 [inline] __cfg80211_leave_ibss+0x19a/0x4c0 net/wireless/ibss.c:212 __cfg80211_leave+0x327/0x430 net/wireless/core.c:1172 cfg80211_leave net/wireless/core.c:1221 [inline] cfg80211_netdev_notifier_call+0x9e8/0x12c0 net/wireless/core.c:1335 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2040 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_close_many+0xee/0x2e0 net/core/dev.c:1586 __dev_close net/core/dev.c:1624 [inline] __dev_change_flags+0x2cb/0x730 net/core/dev.c:8476 dev_change_flags+0x8a/0x160 net/core/dev.c:8549 dev_ifsioc+0x210/0xa70 net/core/dev_ioctl.c:265 dev_ioctl+0x1b1/0xc40 net/core/dev_ioctl.c:511 sock_do_ioctl+0x148/0x2d0 net/socket.c:1060 sock_ioctl+0x477/0x6a0 net/socket.c:1177 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- net/mac80211/ibss.c | 2 ++ 1 file changed, 2 insertions(+)
net/mac80211/ibss.c +2 -0
@@ -1874,6 +1874,8 @@ int ieee80211_ibss_leave(struct ieee8021/* remove beacon */ kfree (sdata->u.ibss.ie); + sdata->u.ibss.ie =NULL ; + sdata->u.ibss.ie_len =0 ;/* on the next join, re-program HT parameters */ memset (&ifibss->ht_capa,0 ,sizeof (ifibss->ht_capa));
Greg Kroah-Hartman
maintainerPATCH 249/254 ext4: add reclaim checks to xattr code
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 163f0ec1df33cf468509ff38cbcbb5eb0d7fac60 upstream.
Syzbot is reporting that ext4 can enter fs reclaim from kvmalloc() while the transaction is started like:
fs_reclaim_acquire+0x117/0x150 mm/page_alloc.c:4340 might_alloc include/linux/sched/mm.h:193 [inline] slab_pre_alloc_hook mm/slab.h:493 [inline] slab_alloc_node mm/slub.c:2817 [inline] __kmalloc_node+0x5f/0x430 mm/slub.c:4015 kmalloc_node include/linux/slab.h:575 [inline] kvmalloc_node+0x61/0xf0 mm/util.c:587 kvmalloc include/linux/mm.h:781 [inline] ext4_xattr_inode_cache_find fs/ext4/xattr.c:1465 [inline] ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1508 [inline] ext4_xattr_set_entry+0x1ce6/0x3780 fs/ext4/xattr.c:1649 ext4_xattr_ibody_set+0x78/0x2b0 fs/ext4/xattr.c:2224 ext4_xattr_set_handle+0x8f4/0x13e0 fs/ext4/xattr.c:2380 ext4_xattr_set+0x13a/0x340 fs/ext4/xattr.c:2493
This should be impossible since transaction start sets PF_MEMALLOC_NOFS. Add some assertions to the code to catch if something isn't working as expected early.
--- fs/ext4/xattr.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ext4/xattr.c +4 -0
@@ -1462,6 +1462,9 @@ ext4_xattr_inode_cache_find(struct inodeif (!ce)return NULL ; +WARN_ON_ONCE (ext4_handle_valid (journal_current_handle ()) && + !(current->flags &PF_MEMALLOC_NOFS )); + ea_data =kvmalloc (value_len,GFP_KERNEL );if (!ea_data) {mb_cache_entry_put (ea_inode_cache, ce);
@@ -2327,6 +2330,7 @@ ext4_xattr_set_handle(handle_t *handle, error = -ENOSPC ; goto cleanup; } +WARN_ON_ONCE (!(current->flags &PF_MEMALLOC_NOFS )); } error =ext4_reserve_inode_write (handle, inode, &is.iloc);
Greg Kroah-Hartman
maintainerPATCH 250/254 fs/ext4: fix integer overflow in s_log_groups_per_flex
In reply to Greg Kroah-HartmanFrom: Sabyrzhan Tasbolatov <[email protected]>
commit f91436d55a279f045987e8b8c1385585dca54be9 upstream.
syzbot found UBSAN: shift-out-of-bounds in ext4_mb_init [1], when 1 << sbi->s_es->s_log_groups_per_flex is bigger than UINT_MAX, where sbi->s_mb_prefetch is unsigned integer type.
32 is the maximum allowed power of s_log_groups_per_flex. Following if check will also trigger UBSAN shift-out-of-bound:
if (1 << sbi->s_es->s_log_groups_per_flex >= UINT_MAX) {
So I'm checking it against the raw number, perhaps there is another way to calculate UINT_MAX max power. Also use min_t as to make sure it's uint type.
[1] UBSAN: shift-out-of-bounds in fs/ext4/mballoc.c:2713:24 shift exponent 60 is too large for 32-bit type 'int'
Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x137/0x1be lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:148 [inline] __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395 ext4_mb_init_backend fs/ext4/mballoc.c:2713 [inline] ext4_mb_init+0x19bc/0x19f0 fs/ext4/mballoc.c:2898 ext4_fill_super+0xc2ec/0xfbe0 fs/ext4/super.c:4983
--- fs/ext4/mballoc.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
fs/ext4/mballoc.c +9 -2
@@ -2709,8 +2709,15 @@ static int ext4_mb_init_backend(struct s }if (ext4_has_feature_flex_bg (sb)) { -/* a single flex group is supposed to be read by a single IO */ - sbi->s_mb_prefetch =min (1 << sbi->s_es->s_log_groups_per_flex, +/* a single flex group is supposed to be read by a single IO. +* 2 ^ s_log_groups_per_flex != UINT_MAX as s_mb_prefetch is +* unsigned integer, so the maximum shift is 32. +*/ +if (sbi->s_es->s_log_groups_per_flex >=32 ) { +ext4_msg (sb,KERN_ERR ,"too many log groups per flexible block group" ); + goto err_freesgi; + } + sbi->s_mb_prefetch =min_t (uint,1 << sbi->s_es->s_log_groups_per_flex,BLK_MAX_SEGMENT_SIZE >> (sb->s_blocksize_bits -9 )); sbi->s_mb_prefetch *=8 ;/* 8 prefetch IOs in flight at most */ }else {
Greg Kroah-Hartman
maintainerPATCH 251/254 Revert "xen: fix p2m size in dom0 for disabled memory hotplug case"
In reply to Greg Kroah-HartmanFrom: Roger Pau Monne <[email protected]>
commit af44a387e743ab7aa39d3fb5e29c0a973cf91bdc upstream.
This partially reverts commit 882213990d32 ("xen: fix p2m size in dom0 for disabled memory hotplug case")
There's no need to special case XEN_UNPOPULATED_ALLOC anymore in order to correctly size the p2m. The generic memory hotplug option has already been tied together with the Xen hotplug limit, so enabling memory hotplug should already trigger a properly sized p2m on Xen PV.
Note that XEN_UNPOPULATED_ALLOC depends on ZONE_DEVICE which pulls in MEMORY_HOTPLUG.
Leave the check added to __set_phys_to_machine and the adjusted comment about EXTRA_MEM_RATIO.
--- arch/x86/include/asm/xen/page.h | 12 ------------ arch/x86/xen/p2m.c | 3 --- arch/x86/xen/setup.c | 16 ++++++++++++++-- 3 files changed, 14 insertions(+), 17 deletions(-)
arch/x86/include/asm/xen/page.h +0 -12
@@ -87,18 +87,6 @@ clear_foreign_p2m_mapping(struct gnttab_#endif /* -* The maximum amount of extra memory compared to the base size. The -* main scaling factor is the size of struct page. At extreme ratios -* of base:extra, all the base memory can be filled with page -* structures for the extra memory, leaving no space for anything -* else. -* -* 10x seems like a reasonable balance between scaling flexibility and -* leaving a practically usable system. -*/ -#define XEN_EXTRA_MEM_RATIO (10) - -/* * Helper functions to write or read unsigned long values to/from * memory, when the access may fault. */
arch/x86/xen/p2m.c +0 -3
@@ -416,9 +416,6 @@ void __init xen_vmalloc_p2m_tree(void) xen_p2m_last_pfn = xen_max_p2m_pfn; p2m_limit = (phys_addr_t )P2M_LIMIT *1024 *1024 *1024 /PAGE_SIZE ; -if (!p2m_limit &&IS_ENABLED (CONFIG_XEN_UNPOPULATED_ALLOC )) - p2m_limit = xen_start_info->nr_pages *XEN_EXTRA_MEM_RATIO ; - vm.flags =VM_ALLOC ; vm.size =ALIGN (sizeof (unsigned long ) *max (xen_max_p2m_pfn, p2m_limit),PMD_SIZE *PMDS_PER_MID_PAGE );
arch/x86/xen/setup.c +14 -2
@@ -59,6 +59,18 @@ static struct { } xen_remap_buf__initdata __aligned(PAGE_SIZE) ;static unsigned long xen_remap_mfn__initdata =INVALID_P2M_ENTRY ; +/* +* The maximum amount of extra memory compared to the base size. The +* main scaling factor is the size of struct page. At extreme ratios +* of base:extra, all the base memory can be filled with page +* structures for the extra memory, leaving no space for anything +* else. +* +* 10x seems like a reasonable balance between scaling flexibility and +* leaving a practically usable system. +*/ +#define EXTRA_MEM_RATIO (10) +static bool xen_512gb_limit__initdata =IS_ENABLED (CONFIG_XEN_512GB );static void __init xen_parse_512gb (void )
@@ -778,13 +790,13 @@ char * __init xen_memory_setup(void) extra_pages += max_pages - max_pfn;/* -* Clamp the amount of extra memory to a XEN_EXTRA_MEM_RATIO +* Clamp the amount of extra memory to a EXTRA_MEM_RATIO * factor the base size. * * Make sure we have no memory above max_pages, as this area * isn't handled by the p2m management. */ - extra_pages =min3 (XEN_EXTRA_MEM_RATIO *min (max_pfn,PFN_DOWN (MAXMEM )), + extra_pages =min3 (EXTRA_MEM_RATIO *min (max_pfn,PFN_DOWN (MAXMEM )), extra_pages, max_pages - max_pfn); i =0 ; addr = xen_e820_table.entries[0 ].addr;
Greg Kroah-Hartman
maintainerPATCH 252/254 nvme: fix the nsid value to print in nvme_validate_or_alloc_ns
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit f4f9fc29e56b6fa9d7fa65ec51d3c82aff99c99b upstream.
ns can be NULL at this point, and my move of the check from the original patch by Chaitanya broke this.
--- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/core.c +1 -1
@@ -4072,7 +4072,7 @@ static void nvme_validate_or_alloc_ns(stif (!nvme_multi_css (ctrl)) {dev_warn (ctrl->device,"command set not reported for nsid: %d\n" , - ns->head->ns_id); + nsid);break ; }nvme_alloc_ns (ctrl, nsid, &ids);
Greg Kroah-Hartman
maintainerPATCH 253/254 can: peak_usb: Revert "can: peak_usb: add forgotten supported devices"
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
commit 5d7047ed6b7214fbabc16d8712a822e256b1aa44 upstream.
In commit 6417f03132a6 ("module: remove never implemented MODULE_SUPPORTED_DEVICE") the MODULE_SUPPORTED_DEVICE macro was removed from the kerne entirely. Shortly before this patch was applied mainline the commit 59ec7b89ed3e ("can: peak_usb: add forgotten supported devices") was added to net/master. As this would result in a merge conflict, let's revert this patch.
--- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/can/usb/peak_usb/pcan_usb_fd.c +0 -2
@@ -18,8 +18,6 @@MODULE_SUPPORTED_DEVICE ("PEAK-System PCAN-USB FD adapter" );MODULE_SUPPORTED_DEVICE ("PEAK-System PCAN-USB Pro FD adapter" ); -MODULE_SUPPORTED_DEVICE ("PEAK-System PCAN-Chip USB" ); -MODULE_SUPPORTED_DEVICE ("PEAK-System PCAN-USB X6 adapter" );#define PCAN_USBPROFD_CHANNEL_COUNT 2#define PCAN_USBFD_CHANNEL_COUNT 1
Greg Kroah-Hartman
maintainerPATCH 254/254 selftest/bpf: Add a test to check trampoline freeing logic.
In reply to Greg Kroah-HartmanFrom: Alexei Starovoitov <[email protected]>
commit eddbe8e6521401003e37e7848ef72e75c10ee2aa upstream.
Add a selftest for commit e21aa341785c ("bpf: Fix fexit trampoline.") to make sure that attaching fexit prog to a sleeping kernel function will trigger appropriate trampoline and program destruction.
--- tools/testing/selftests/bpf/prog_tests/fexit_sleep.c | 82 +++++++++++++++++++ tools/testing/selftests/bpf/progs/fexit_sleep.c | 31 +++++++ 2 files changed, 113 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/fexit_sleep.c create mode 100644 tools/testing/selftests/bpf/progs/fexit_sleep.c
tools/testing/selftests/bpf/prog_tests/fexit_sleep.c new file +82 -0
@@ -0,0 +1,82 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2021 Facebook */ +#define _GNU_SOURCE +#include <sched.h> +#include <test_progs.h> +#include <time.h> +#include <sys/mman.h> +#include <sys/syscall.h> +#include "fexit_sleep.skel.h" + +static int do_sleep (void *skel) +{ +struct fexit_sleep *fexit_skel = skel; +struct timespec ts1 = { .tv_nsec =1 }; +struct timespec ts2 = { .tv_sec =10 }; + + fexit_skel->bss->pid =getpid (); + (void )syscall (__NR_nanosleep, &ts1,NULL ); + (void )syscall (__NR_nanosleep, &ts2,NULL ); +return 0 ; +} + +#define STACK_SIZE (1024 * 1024) +static char child_stack[STACK_SIZE ]; + +void test_fexit_sleep (void ) +{ +struct fexit_sleep *fexit_skel =NULL ; +int wstatus, duration =0 ; +pid_t cpid; +int err, fexit_cnt; + + fexit_skel =fexit_sleep__open_and_load (); +if (CHECK (!fexit_skel,"fexit_skel_load" ,"fexit skeleton failed\n" )) + goto cleanup; + + err =fexit_sleep__attach (fexit_skel); +if (CHECK (err,"fexit_attach" ,"fexit attach failed: %d\n" , err)) + goto cleanup; + + cpid =clone (do_sleep, child_stack +STACK_SIZE ,CLONE_FILES |SIGCHLD , fexit_skel); +if (CHECK (cpid ==-1 ,"clone" ,strerror (errno))) + goto cleanup; + +/* wait until first sys_nanosleep ends and second sys_nanosleep starts */ +while (READ_ONCE (fexit_skel->bss->fentry_cnt) !=2 ); + fexit_cnt =READ_ONCE (fexit_skel->bss->fexit_cnt); +if (CHECK (fexit_cnt !=1 ,"fexit_cnt" ,"%d" , fexit_cnt)) + goto cleanup; + +/* close progs and detach them. That will trigger two nop5->jmp5 rewrites +* in the trampolines to skip nanosleep_fexit prog. +* The nanosleep_fentry prog will get detached first. +* The nanosleep_fexit prog will get detached second. +* Detaching will trigger freeing of both progs JITed images. +* There will be two dying bpf_tramp_image-s, but only the initial +* bpf_tramp_image (with both _fentry and _fexit progs will be stuck +* waiting for percpu_ref_kill to confirm). The other one +* will be freed quickly. +*/ +close (bpf_program__fd (fexit_skel->progs.nanosleep_fentry)); +close (bpf_program__fd (fexit_skel->progs.nanosleep_fexit)); +fexit_sleep__detach (fexit_skel); + +/* kill the thread to unwind sys_nanosleep stack through the trampoline */ +kill (cpid,9 ); + +if (CHECK (waitpid (cpid, &wstatus,0 ) ==-1 ,"waitpid" ,strerror (errno))) + goto cleanup; +if (CHECK (WEXITSTATUS (wstatus) !=0 ,"exitstatus" ,"failed" )) + goto cleanup; + +/* The bypassed nanosleep_fexit prog shouldn't have executed. +* Unlike progs the maps were not freed and directly accessible. +*/ + fexit_cnt =READ_ONCE (fexit_skel->bss->fexit_cnt); +if (CHECK (fexit_cnt !=1 ,"fexit_cnt" ,"%d" , fexit_cnt)) + goto cleanup; + +cleanup: +fexit_sleep__destroy (fexit_skel); +}
tools/testing/selftests/bpf/progs/fexit_sleep.c new file +31 -0
@@ -0,0 +1,31 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2021 Facebook */ +#include "vmlinux.h" +#include <bpf/bpf_helpers.h> +#include <bpf/bpf_tracing.h> + +char LICENSE[] SEC("license") = "GPL"; + +int pid =0 ; +int fentry_cnt =0 ; +int fexit_cnt =0 ; + +SEC("fentry/__x64_sys_nanosleep") +int BPF_PROG (nanosleep_fentry ,const struct pt_regs *regs) +{ +if ((int )bpf_get_current_pid_tgid () != pid) +return 0 ; + + fentry_cnt++; +return 0 ; +} + +SEC("fexit/__x64_sys_nanosleep") +int BPF_PROG (nanosleep_fexit ,const struct pt_regs *regs,int ret) +{ +if ((int )bpf_get_current_pid_tgid () != pid) +return 0 ; + + fexit_cnt++; +return 0 ; +}
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.11.11 release. There are 254 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.11.11-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.11.y
and the diffstat can be found below.thanks,
greg k-h
The stable rc 5.10 and 5.11 builds failed for arm64 architecture due to below warnings / errors,
Quoted 2 lines
Anshuman Khandual <[email protected]>
arm64/mm: definearch_get_mappable_range()
arch/arm64/mm/mmu.c: In function 'arch_add_memory':
arch/arm64/mm/mmu.c:1483:13: error: implicit declaration of function
'mhp_range_allowed'; did you mean 'cpu_map_prog_allowed'? [-Werror=implicit-function-declaration]
VM_BUG_ON(!mhp_range_allowed(start, size, true));
^
include/linux/build_bug.h:30:63: note: in definition of macro
'BUILD_BUG_ON_INVALID'
#define BUILD_BUG_ON_INVALID(e) ((void)(sizeof((__force long)(e))))
^
arch/arm64/mm/mmu.c:1483:2: note: in expansion of macro 'VM_BUG_ON'
VM_BUG_ON(!mhp_range_allowed(start, size, true));
^~~~~~~~~Build link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.11/DISTRO=lkft,MACHINE=juno,label=docker-buster-lkft/41/consoleText
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.10/DISTRO=lkft,MACHINE=dragonboard-410c,label=docker-buster-lkft/120/consoleFull
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org