5.12.5-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainerPATCH 287/363 iio: proximity: pulsedlight: Fix rumtime PM imbalance on error
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit a2fa9242e89f27696515699fe0f0296bf1ac1815 ]
When lidar_write_control() fails, a pairing PM usage counter decrement is needed to keep the counter balanced.
--- drivers/iio/proximity/pulsedlight-lidar-lite-v2.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +1 -0
@@ -160,6 +160,7 @@ static int lidar_get_measurement(struct lidar_data *data, u16 *reg) ret =lidar_write_control (data,LIDAR_REG_CONTROL_ACQUIRE );if (ret <0 ) {dev_err (&client->dev,"cannot send start measurement command" ); +pm_runtime_put_noidle (&client->dev);return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 288/363 iio: hid-sensors: select IIO_TRIGGERED_BUFFER under HID_SENSOR_IIO_TRIGGER
In reply to Greg Kroah-HartmanFrom: Alexandru Ardelean <[email protected]>
[ Upstream commit 7061803522ee7876df1ca18cdd1e1551f761352d ]
During commit 067fda1c065ff ("iio: hid-sensors: move triggered buffer setup into hid_sensor_setup_trigger"), the iio_triggered_buffer_{setup,cleanup}() functions got moved under the hid-sensor-trigger module.
The above change works fine, if any of the sensors get built. However, when only the common hid-sensor-trigger module gets built (and none of the drivers), then the IIO_TRIGGERED_BUFFER symbol isn't selected/enforced.
Previously, each driver would enforce/select the IIO_TRIGGERED_BUFFER symbol. With this change the HID_SENSOR_IIO_TRIGGER (for the hid-sensor-trigger module) will enforce that IIO_TRIGGERED_BUFFER gets selected.
All HID sensor drivers select the HID_SENSOR_IIO_TRIGGER symbol. So, this change removes the IIO_TRIGGERED_BUFFER enforcement from each driver.
--- drivers/iio/accel/Kconfig | 1 - drivers/iio/common/hid-sensors/Kconfig | 1 + drivers/iio/gyro/Kconfig | 1 - drivers/iio/humidity/Kconfig | 1 - drivers/iio/light/Kconfig | 2 -- drivers/iio/magnetometer/Kconfig | 1 - drivers/iio/orientation/Kconfig | 2 -- drivers/iio/pressure/Kconfig | 1 - drivers/iio/temperature/Kconfig | 1 - 9 files changed, 1 insertion(+), 10 deletions(-)
drivers/iio/accel/Kconfig +0 -1
@@ -211,7 +211,6 @@ config DMARD10 config HID_SENSOR_ACCEL_3D depends on HID_SENSOR_HUB select IIO_BUFFER - select IIO_TRIGGERED_BUFFER select HID_SENSOR_IIO_COMMON select HID_SENSOR_IIO_TRIGGER tristate "HID Accelerometers 3D"
drivers/iio/common/hid-sensors/Kconfig +1 -0
@@ -19,6 +19,7 @@ config HID_SENSOR_IIO_TRIGGER tristate "Common module (trigger) for all HID Sensor IIO drivers" depends on HID_SENSOR_HUB && HID_SENSOR_IIO_COMMON && IIO_BUFFER select IIO_TRIGGER + select IIO_TRIGGERED_BUFFER help Say yes here to build trigger support for HID sensors. Triggers will be send if all requested attributes were read.
drivers/iio/gyro/Kconfig +0 -1
@@ -111,7 +111,6 @@ config FXAS21002C_SPI config HID_SENSOR_GYRO_3D depends on HID_SENSOR_HUB select IIO_BUFFER - select IIO_TRIGGERED_BUFFER select HID_SENSOR_IIO_COMMON select HID_SENSOR_IIO_TRIGGER tristate "HID Gyroscope 3D"
drivers/iio/humidity/Kconfig +0 -1
@@ -52,7 +52,6 @@ config HID_SENSOR_HUMIDITY tristate "HID Environmental humidity sensor" depends on HID_SENSOR_HUB select IIO_BUFFER - select IIO_TRIGGERED_BUFFER select HID_SENSOR_IIO_COMMON select HID_SENSOR_IIO_TRIGGER help
drivers/iio/light/Kconfig +0 -2
@@ -256,7 +256,6 @@ config ISL29125 config HID_SENSOR_ALS depends on HID_SENSOR_HUB select IIO_BUFFER - select IIO_TRIGGERED_BUFFER select HID_SENSOR_IIO_COMMON select HID_SENSOR_IIO_TRIGGER tristate "HID ALS"
@@ -270,7 +269,6 @@ config HID_SENSOR_ALS config HID_SENSOR_PROX depends on HID_SENSOR_HUB select IIO_BUFFER - select IIO_TRIGGERED_BUFFER select HID_SENSOR_IIO_COMMON select HID_SENSOR_IIO_TRIGGER tristate "HID PROX"
drivers/iio/magnetometer/Kconfig +0 -1
@@ -95,7 +95,6 @@ config MAG3110 config HID_SENSOR_MAGNETOMETER_3D depends on HID_SENSOR_HUB select IIO_BUFFER - select IIO_TRIGGERED_BUFFER select HID_SENSOR_IIO_COMMON select HID_SENSOR_IIO_TRIGGER tristate "HID Magenetometer 3D"
drivers/iio/orientation/Kconfig +0 -2
@@ -9,7 +9,6 @@ menu "Inclinometer sensors" config HID_SENSOR_INCLINOMETER_3D depends on HID_SENSOR_HUB select IIO_BUFFER - select IIO_TRIGGERED_BUFFER select HID_SENSOR_IIO_COMMON select HID_SENSOR_IIO_TRIGGER tristate "HID Inclinometer 3D"
@@ -20,7 +19,6 @@ config HID_SENSOR_INCLINOMETER_3D config HID_SENSOR_DEVICE_ROTATION depends on HID_SENSOR_HUB select IIO_BUFFER - select IIO_TRIGGERED_BUFFER select HID_SENSOR_IIO_COMMON select HID_SENSOR_IIO_TRIGGER tristate "HID Device Rotation"
drivers/iio/pressure/Kconfig +0 -1
@@ -79,7 +79,6 @@ config DPS310 config HID_SENSOR_PRESS depends on HID_SENSOR_HUB select IIO_BUFFER - select IIO_TRIGGERED_BUFFER select HID_SENSOR_IIO_COMMON select HID_SENSOR_IIO_TRIGGER tristate "HID PRESS"
drivers/iio/temperature/Kconfig +0 -1
@@ -45,7 +45,6 @@ config HID_SENSOR_TEMP tristate "HID Environmental temperature sensor" depends on HID_SENSOR_HUB select IIO_BUFFER - select IIO_TRIGGERED_BUFFER select HID_SENSOR_IIO_COMMON select HID_SENSOR_IIO_TRIGGER help
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 289/363 iio: core: return ENODEV if ioctl is unknown
In reply to Greg Kroah-HartmanFrom: Alexandru Ardelean <[email protected]>
[ Upstream commit af0670b0bf1b116fd729b1b1011cf814bc34e12e ]
When the ioctl() mechanism was introduced in IIO core to centralize the registration of all ioctls in one place via commit 8dedcc3eee3ac ("iio:
core: centralize ioctl() calls to the main chardev"), the return code was changed from ENODEV to EINVAL, when the ioctl code isn't known.
This was done by accident.
This change reverts back to the old behavior, where if the ioctl() code isn't known, ENODEV is returned (vs EINVAL).
This was brought into perspective by this patch:
https://lore.kernel.org/linux-iio/[email protected]/
--- drivers/iio/industrialio-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/iio/industrialio-core.c +1 -2
@@ -1734,7 +1734,6 @@ static long iio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)if (!indio_dev->info) goto out_unlock; - ret = -EINVAL ;list_for_each_entry (h, &iio_dev_opaque->ioctl_handlers, entry) { ret = h->ioctl (indio_dev, filp, cmd, arg);if (ret !=IIO_IOCTL_UNHANDLED )
@@ -1742,7 +1741,7 @@ static long iio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) }if (ret ==IIO_IOCTL_UNHANDLED ) - ret = -EINVAL ; + ret = -ENODEV ; out_unlock:mutex_unlock (&indio_dev->info_exist_lock);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 290/363 usb: fotg210-hcd: Fix an error message
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit a60a34366e0d09ca002c966dd7c43a68c28b1f82 ]
'retval' is known to be -ENODEV here.
This is a hard-coded default error code which is not useful in the error message. Moreover, another error message is printed at the end of the error handling path. The corresponding error code (-ENOMEM) is more informative.
So remove simplify the first error message.
While at it, also remove the useless initialization of 'retval'.
--- drivers/usb/host/fotg210-hcd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/host/fotg210-hcd.c +2 -2
@@ -5568,7 +5568,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev)struct usb_hcd *hcd;struct resource *res;int irq; -int retval = -ENODEV ; +int retval;struct fotg210_hcd *fotg210;if (usb_disabled ())
@@ -5588,7 +5588,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) hcd =usb_create_hcd (&fotg210_fotg210_hc_driver, dev,dev_name (dev));if (!hcd) { -dev_err (dev,"failed to create hcd with err %d\n" , retval); +dev_err (dev,"failed to create hcd\n" ); retval = -ENOMEM ; goto fail_create_hcd; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 291/363 hwmon: (occ) Fix poll rate limiting
In reply to Greg Kroah-HartmanFrom: Eddie James <[email protected]>
[ Upstream commit 5216dff22dc2bbbbe6f00335f9fd2879670e753b ]
The poll rate limiter time was initialized at zero. This breaks the comparison in time_after if jiffies is large. Switch to storing the next update time rather than the previous time, and initialize the time when the device is probed.
--- drivers/hwmon/occ/common.c | 5 +++-- drivers/hwmon/occ/common.h | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/hwmon/occ/common.c +3 -2
@@ -217,9 +217,9 @@ int occ_update_response(struct occ *occ)return rc;/* limit the maximum rate of polling the OCC */ -if (time_after (jiffies, occ->last_update +OCC_UPDATE_FREQUENCY )) { +if (time_after (jiffies, occ->next_update)) { rc =occ_poll (occ); - occ->last_update = jiffies; + occ->next_update = jiffies +OCC_UPDATE_FREQUENCY ; }else { rc = occ->last_error; }
@@ -1164,6 +1164,7 @@ int occ_setup(struct occ *occ, const char *name)return rc; } + occ->next_update = jiffies +OCC_UPDATE_FREQUENCY ;occ_parse_poll_response (occ); rc =occ_setup_sensor_attrs (occ);
drivers/hwmon/occ/common.h +1 -1
@@ -99,7 +99,7 @@ struct occ {u8 poll_cmd_data;/* to perform OCC poll command */ int (*send_cmd)(struct occ *occ,u8 *cmd); -unsigned long last_update; +unsigned long next_update;struct mutex lock;/* lock OCC access */ struct device *hwmon;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 292/363 usb: typec: tcpm: Fix wrong handling for Not_Supported in VDM AMS
In reply to Greg Kroah-HartmanFrom: Kyle Tso <[email protected]>
[ Upstream commit f1fbd950b59b67bc5c202216c8e1c6ca8c99a3b4 ]
Not_Supported Message is acceptable in VDM AMS. Redirect the VDM state machine to VDM_STATE_DONE when receiving Not_Supported and finish the VDM AMS.
Also, after the loop in vdm_state_machine_work, add more conditions of VDM states to clear the vdm_sm_running flag because those are all stopping states when leaving the loop.
In addition, finish the VDM AMS if the port partner responds BUSY.
--- drivers/usb/typec/tcpm/tcpm.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/usb/typec/tcpm/tcpm.c +12 -2
@@ -1877,7 +1877,6 @@ static void vdm_run_state_machine(struct tcpm_port *port) }if (res <0 ) { - port->vdm_sm_running = false;return ; } }
@@ -1893,6 +1892,7 @@ static void vdm_run_state_machine(struct tcpm_port *port) port->vdo_data[0 ] = port->vdo_retry; port->vdo_count =1 ; port->vdm_state =VDM_STATE_READY ; +tcpm_ams_finish (port);break ;case VDM_STATE_BUSY : port->vdm_state =VDM_STATE_ERR_TMOUT ;
@@ -1958,7 +1958,7 @@ static void vdm_state_machine_work(struct kthread_work *work) port->vdm_state !=VDM_STATE_BUSY && port->vdm_state != VDM_STATE_SEND_MESSAGE); -if (port->vdm_state ==VDM_STATE_ERR_TMOUT ) +if (port->vdm_state <VDM_STATE_READY ) port->vdm_sm_running = false;mutex_unlock (&port->lock);
@@ -2549,6 +2549,16 @@ static void tcpm_pd_ctrl_request(struct tcpm_port *port, port->sink_cap_done = true;tcpm_set_state (port,ready_state (port),0 );break ; +case SRC_READY : +case SNK_READY : +if (port->vdm_state >VDM_STATE_READY ) { + port->vdm_state =VDM_STATE_DONE ; +if (tcpm_vdm_ams (port)) +tcpm_ams_finish (port); +mod_vdm_delayed_work (port,0 ); +break ; + } + fallthrough;default : tcpm_pd_handle_state(port, port->pwr_role == TYPEC_SOURCE ?
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 293/363 usb: musb: Fix an error message
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit d9ff1096a840dddea3d5cfa2149ff7da9f499fb2 ]
'ret' is known to be 0 here.
Initialize 'ret' with the expected error code before using it.
--- drivers/usb/musb/mediatek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/musb/mediatek.c +1 -1
@@ -518,8 +518,8 @@ static int mtk_musb_probe(struct platform_device *pdev) glue->xceiv =devm_usb_get_phy (dev,USB_PHY_TYPE_USB2 );if (IS_ERR (glue->xceiv)) { -dev_err (dev,"fail to getting usb-phy %d\n" , ret); ret =PTR_ERR (glue->xceiv); +dev_err (dev,"fail to getting usb-phy %d\n" , ret); goto err_unregister_usb_phy; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 294/363 hwmon: (ltc2992) Put fwnode in error case during ->probe()
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 8370e5b093080c03cf89f7ebf0bef6984545429e ]
In each iteration fwnode_for_each_available_child_node() bumps a reference counting of a loop variable followed by dropping in on a next iteration,
Since in error case the loop is broken, we have to drop a reference count by ourselves. Do it for port_fwnode in error case during ->probe().
--- drivers/hwmon/ltc2992.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/hwmon/ltc2992.c +6 -2
@@ -900,11 +900,15 @@ static int ltc2992_parse_dt(struct ltc2992_state *st)fwnode_for_each_available_child_node (fwnode, child) { ret =fwnode_property_read_u32 (child,"reg" , &addr); -if (ret <0 ) +if (ret <0 ) { +fwnode_handle_put (child);return ret; + } -if (addr >1 ) +if (addr >1 ) { +fwnode_handle_put (child);return -EINVAL ; + } ret =fwnode_property_read_u32 (child,"shunt-resistor-micro-ohms" , &val);if (!ret)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 295/363 ACPI: scan: Fix a memory leak in an error handling path
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 0c8bd174f0fc131bc9dfab35cd8784f59045da87 ]
If 'acpi_device_set_name()' fails, we must free 'acpi_device_bus_id->bus_id' or there is a (potential) memory leak.
--- drivers/acpi/scan.c | 1 + 1 file changed, 1 insertion(+)
drivers/acpi/scan.c +1 -0
@@ -701,6 +701,7 @@ int acpi_device_add(struct acpi_device *device, result =acpi_device_set_name (device, acpi_device_bus_id);if (result) { +kfree_const (acpi_device_bus_id->bus_id);kfree (acpi_device_bus_id); goto err_unlock; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 296/363 kyber: fix out of bounds access when preempted
In reply to Greg Kroah-HartmanFrom: Omar Sandoval <[email protected]>
[ Upstream commit efed9a3337e341bd0989161b97453b52567bc59d ]
__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and passes the hctx to ->bio_merge(). kyber_bio_merge() then gets the ctx for the current CPU again and uses that to get the corresponding Kyber context in the passed hctx. However, the thread may be preempted between the two calls to blk_mq_get_ctx(), and the ctx returned the second time may no longer correspond to the passed hctx. This "works" accidentally most of the time, but it can cause us to read garbage if the second ctx came from an hctx with more ctx's than the first one (i.e., if ctx->index_hw[hctx->type] > hctx->nr_ctx).
This manifested as this UBSAN array index out of bounds error reported by Jakub:
UBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9 index 13106 is out of range for type 'long unsigned int [128]' Call Trace: dump_stack+0xa4/0xe5 ubsan_epilogue+0x5/0x40 __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34 queued_spin_lock_slowpath+0x476/0x480 do_raw_spin_lock+0x1c2/0x1d0 kyber_bio_merge+0x112/0x180 blk_mq_submit_bio+0x1f5/0x1100 submit_bio_noacct+0x7b0/0x870 submit_bio+0xc2/0x3a0 btrfs_map_bio+0x4f0/0x9d0 btrfs_submit_data_bio+0x24e/0x310 submit_one_bio+0x7f/0xb0 submit_extent_page+0xc4/0x440 __extent_writepage_io+0x2b8/0x5e0 __extent_writepage+0x28d/0x6e0 extent_write_cache_pages+0x4d7/0x7a0 extent_writepages+0xa2/0x110 do_writepages+0x8f/0x180 __writeback_single_inode+0x99/0x7f0 writeback_sb_inodes+0x34e/0x790 __writeback_inodes_wb+0x9e/0x120 wb_writeback+0x4d2/0x660 wb_workfn+0x64d/0xa10 process_one_work+0x53a/0xa80 worker_thread+0x69/0x5b0 kthread+0x20b/0x240 ret_from_fork+0x1f/0x30
Only Kyber uses the hctx, so fix it by passing the request_queue to ->bio_merge() instead. BFQ and mq-deadline just use that, and Kyber can map the queues itself to avoid the mismatch.
--- block/bfq-iosched.c | 3 +-- block/blk-mq-sched.c | 8 +++++--- block/kyber-iosched.c | 5 +++-- block/mq-deadline.c | 3 +-- include/linux/elevator.h | 2 +- 5 files changed, 11 insertions(+), 10 deletions(-)
block/bfq-iosched.c +1 -2
@@ -2263,10 +2263,9 @@ static void bfq_remove_request(struct request_queue *q, } -static bool bfq_bio_merge (struct blk_mq_hw_ctx *hctx,struct bio *bio, +static bool bfq_bio_merge (struct request_queue *q,struct bio *bio,unsigned int nr_segs) { -struct request_queue *q = hctx->queue;struct bfq_data *bfqd = q->elevator->elevator_data;struct request *free =NULL ;/*
block/blk-mq-sched.c +5 -3
@@ -348,14 +348,16 @@ bool __blk_mq_sched_bio_merge(struct request_queue *q, struct bio *bio, unsigned int nr_segs) {struct elevator_queue *e = q->elevator; -struct blk_mq_ctx *ctx =blk_mq_get_ctx (q); -struct blk_mq_hw_ctx *hctx =blk_mq_map_queue (q, bio->bi_opf, ctx); +struct blk_mq_ctx *ctx; +struct blk_mq_hw_ctx *hctx;bool ret = false;enum hctx_type type;if (e && e->type->ops.bio_merge) -return e->type->ops.bio_merge (hctx, bio, nr_segs); +return e->type->ops.bio_merge (q, bio, nr_segs); + ctx =blk_mq_get_ctx (q); + hctx =blk_mq_map_queue (q, bio->bi_opf, ctx); type = hctx->type;if (!(hctx->flags &BLK_MQ_F_SHOULD_MERGE ) ||list_empty_careful (&ctx->rq_lists[type]))
block/kyber-iosched.c +3 -2
@@ -560,11 +560,12 @@ static void kyber_limit_depth(unsigned int op, struct blk_mq_alloc_data *data) } } -static bool kyber_bio_merge (struct blk_mq_hw_ctx *hctx,struct bio *bio, +static bool kyber_bio_merge (struct request_queue *q,struct bio *bio,unsigned int nr_segs) { +struct blk_mq_ctx *ctx =blk_mq_get_ctx (q); +struct blk_mq_hw_ctx *hctx =blk_mq_map_queue (q, bio->bi_opf, ctx);struct kyber_hctx_data *khd = hctx->sched_data; -struct blk_mq_ctx *ctx =blk_mq_get_ctx (hctx->queue);struct kyber_ctx_queue *kcq = &khd->kcqs[ctx->index_hw[hctx->type]];unsigned int sched_domain =kyber_sched_domain (bio->bi_opf);struct list_head *rq_list = &kcq->rq_list[sched_domain];
block/mq-deadline.c +1 -2
@@ -461,10 +461,9 @@ static int dd_request_merge(struct request_queue *q, struct request **rq,return ELEVATOR_NO_MERGE ; } -static bool dd_bio_merge (struct blk_mq_hw_ctx *hctx,struct bio *bio, +static bool dd_bio_merge (struct request_queue *q,struct bio *bio,unsigned int nr_segs) { -struct request_queue *q = hctx->queue;struct deadline_data *dd = q->elevator->elevator_data;struct request *free =NULL ;bool ret;
include/linux/elevator.h +1 -1
@@ -34,7 +34,7 @@ struct elevator_mq_ops {void (*depth_updated)(struct blk_mq_hw_ctx *);bool (*allow_merge)(struct request_queue *,struct request *,struct bio *); -bool (*bio_merge)(struct blk_mq_hw_ctx *,struct bio *,unsigned int ); +bool (*bio_merge)(struct request_queue *,struct bio *,unsigned int );int (*request_merge)(struct request_queue *q,struct request **,struct bio *);void (*request_merged)(struct request_queue *,struct request *,enum elv_merge );void (*requests_merged)(struct request_queue *,struct request *,struct request *);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 297/363 nvmet: fix inline bio check for bdev-ns
In reply to Greg Kroah-HartmanFrom: Chaitanya Kulkarni <[email protected]>
[ Upstream commit 608a969046e6e0567d05a166be66c77d2dd8220b ]
When handling rw commands, for inline bio case we only consider transfer size. This works well when req->sg_cnt fits into the req->inline_bvec, but it will result in the warning in __bio_add_page() when req->sg_cnt > NVMET_MAX_INLINE_BVEC.
Consider an I/O size 32768 and first page is not aligned to the page boundary, then I/O is split in following manner :-
[ 2206.256140] nvmet: sg->length 3440 sg->offset 656 [ 2206.256144] nvmet: sg->length 4096 sg->offset 0 [ 2206.256148] nvmet: sg->length 4096 sg->offset 0 [ 2206.256152] nvmet: sg->length 4096 sg->offset 0 [ 2206.256155] nvmet: sg->length 4096 sg->offset 0 [ 2206.256159] nvmet: sg->length 4096 sg->offset 0 [ 2206.256163] nvmet: sg->length 4096 sg->offset 0 [ 2206.256166] nvmet: sg->length 4096 sg->offset 0 [ 2206.256170] nvmet: sg->length 656 sg->offset 0
Now the req->transfer_size == NVMET_MAX_INLINE_DATA_LEN i.e. 32768, but the req->sg_cnt is (9) > NVMET_MAX_INLINE_BIOVEC which is (8). This will result in the following warning message :-
nvmet_bdev_execute_rw()
bio_add_page() __bio_add_page() WARN_ON_ONCE(bio_full(bio, len));
This scenario is very hard to reproduce on the nvme-loop transport only with rw commands issued with the passthru IOCTL interface from the host application and the data buffer is allocated with the malloc() and not the posix_memalign().
--- drivers/nvme/target/io-cmd-bdev.c | 2 +- drivers/nvme/target/nvmet.h | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/nvme/target/io-cmd-bdev.c +1 -1
@@ -258,7 +258,7 @@ static void nvmet_bdev_execute_rw(struct nvmet_req *req) sector =nvmet_lba_to_sect (req->ns, req->cmd->rw.slba); -if (req->transfer_len <=NVMET_MAX_INLINE_DATA_LEN ) { +if (nvmet_use_inline_bvec (req)) { bio = &req->b.inline_bio;bio_init (bio, req->inline_bvec,ARRAY_SIZE (req->inline_bvec)); }else {
drivers/nvme/target/nvmet.h +6 -0
@@ -614,4 +614,10 @@ static inline sector_t nvmet_lba_to_sect(struct nvmet_ns *ns, __le64 lba) return le64_to_cpu(lba) << (ns->blksize_shift - SECTOR_SHIFT); } +static inline bool nvmet_use_inline_bvec (struct nvmet_req *req) +{ +return req->transfer_len <=NVMET_MAX_INLINE_DATA_LEN && + req->sg_cnt <=NVMET_MAX_INLINE_BIOVEC ; +} +#endif /* _NVMET_H */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 298/363 nvmet: fix inline bio check for passthru
In reply to Greg Kroah-HartmanFrom: Chaitanya Kulkarni <[email protected]>
[ Upstream commit ab96de5def854d8fc51280b6a20597e64b14ac31 ]
When handling passthru commands, for inline bio allocation we only consider the transfer size. This works well when req->sg_cnt fits into the req->inline_bvec, but it will result in the early return from bio_add_hw_page() when req->sg_cnt > NVMET_MAX_INLINE_BVEC.
Consider an I/O of size 32768 and first buffer is not aligned to the page boundary, then I/O is split in following manner :-
[ 2206.256140] nvmet: sg->length 3440 sg->offset 656 [ 2206.256144] nvmet: sg->length 4096 sg->offset 0 [ 2206.256148] nvmet: sg->length 4096 sg->offset 0 [ 2206.256152] nvmet: sg->length 4096 sg->offset 0 [ 2206.256155] nvmet: sg->length 4096 sg->offset 0 [ 2206.256159] nvmet: sg->length 4096 sg->offset 0 [ 2206.256163] nvmet: sg->length 4096 sg->offset 0 [ 2206.256166] nvmet: sg->length 4096 sg->offset 0 [ 2206.256170] nvmet: sg->length 656 sg->offset 0
Now the req->transfer_size == NVMET_MAX_INLINE_DATA_LEN i.e. 32768, but the req->sg_cnt is (9) > NVMET_MAX_INLINE_BIOVEC which is (8). This will result in early return in the following code path :-
nvmet_bdev_execute_rw()
bio_add_pc_page() bio_add_hw_page() if (bio_full(bio, len)) return 0;
Use previously introduced helper nvmet_use_inline_bvec() to consider req->sg_cnt when using inline bio. This only affects nvme-loop transport.
--- drivers/nvme/target/passthru.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/target/passthru.c +1 -1
@@ -194,7 +194,7 @@ static int nvmet_passthru_map_sg(struct nvmet_req *req, struct request *rq)if (req->sg_cnt >BIO_MAX_VECS )return -EINVAL ; -if (req->transfer_len <=NVMET_MAX_INLINE_DATA_LEN ) { +if (nvmet_use_inline_bvec (req)) { bio = &req->p.inline_bio;bio_init (bio, req->inline_bvec,ARRAY_SIZE (req->inline_bvec)); }else {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 299/363 nvmet-rdma: Fix NULL deref when SEND is completed with error
In reply to Greg Kroah-HartmanFrom: Michal Kalderon <[email protected]>
[ Upstream commit 8cc365f9559b86802afc0208389f5c8d46b4ad61 ]
When running some traffic and taking down the link on peer, a retry counter exceeded error is received. This leads to nvmet_rdma_error_comp which tried accessing the cq_context to obtain the queue. The cq_context is no longer valid after the fix to use shared CQ mechanism and should be obtained similar to how it is obtained in other functions from the wc->qp.
[ 905.786331] nvmet_rdma: SEND for CQE 0x00000000e3337f90 failed with status transport retry counter exceeded (12). [ 905.832048] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048 [ 905.839919] PGD 0 P4D 0 [ 905.842464] Oops: 0000 1 SMP NOPTI [ 905.846144] CPU: 13 PID: 1557 Comm: kworker/13:1H Kdump: loaded Tainted: G OE --------- - - 4.18.0-304.el8.x86_64 #1 [ 905.872135] RIP: 0010:nvmet_rdma_error_comp+0x5/0x1b [nvmet_rdma] [ 905.878259] Code: 19 4f c0 e8 89 b3 a5 f6 e9 5b e0 ff ff 0f b7 75 14 4c 89 ea 48 c7 c7 08 1a 4f c0 e8 71 b3 a5 f6 e9 4b e0 ff ff 0f 1f 44 00 00 <48> 8b 47 48 48 85 c0 74 08 48 89 c7 e9 98 bf 49 00 e9 c3 e3 ff ff [ 905.897135] RSP: 0018:ffffab601c45fe28 EFLAGS: 00010246 [ 905.902387] RAX: 0000000000000065 RBX: ffff9e729ea2f800 RCX: 0000000000000000 [ 905.909558] RDX: 0000000000000000 RSI: ffff9e72df9567c8 RDI: 0000000000000000 [ 905.916731] RBP: ffff9e729ea2b400 R08: 000000000000074d R09: 0000000000000074 [ 905.923903] R10: 0000000000000000 R11: ffffab601c45fcc0 R12: 0000000000000010 [ 905.931074] R13: 0000000000000000 R14: 0000000000000010 R15: ffff9e729ea2f400 [ 905.938247] FS: 0000000000000000(0000) GS:ffff9e72df940000(0000) knlGS:0000000000000000 [ 905.938249] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 905.950067] nvmet_rdma: SEND for CQE 0x00000000c7356cca failed with status transport retry counter exceeded (12). [ 905.961855] CR2: 0000000000000048 CR3: 000000678d010004 CR4: 00000000007706e0 [ 905.961855] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 905.961856] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 905.961857] PKRU: 55555554 [ 906.010315] Call Trace: [ 906.012778] __ib_process_cq+0x89/0x170 [ib_core] [ 906.017509] ib_cq_poll_work+0x26/0x80 [ib_core] [ 906.022152] process_one_work+0x1a7/0x360 [ 906.026182] ? create_worker+0x1a0/0x1a0 [ 906.030123] worker_thread+0x30/0x390 [ 906.033802] ? create_worker+0x1a0/0x1a0 [ 906.037744] kthread+0x116/0x130 [ 906.040988] ? kthread_flush_work_fn+0x10/0x10 [ 906.045456] ret_from_fork+0x1f/0x40
--- drivers/nvme/target/rdma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/nvme/target/rdma.c +2 -2
@@ -700,7 +700,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc) {struct nvmet_rdma_rsp *rsp = container_of(wc->wr_cqe, struct nvmet_rdma_rsp, send_cqe); -struct nvmet_rdma_queue *queue = cq->cq_context; +struct nvmet_rdma_queue *queue = wc->qp->qp_context;nvmet_rdma_release_rsp (rsp);
@@ -786,7 +786,7 @@ static void nvmet_rdma_write_data_done(struct ib_cq *cq, struct ib_wc *wc) {struct nvmet_rdma_rsp *rsp = container_of(wc->wr_cqe, struct nvmet_rdma_rsp, write_cqe); -struct nvmet_rdma_queue *queue = cq->cq_context; +struct nvmet_rdma_queue *queue = wc->qp->qp_context;struct rdma_cm_id *cm_id = rsp->queue->cm_id;u16 status;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 300/363 f2fs: compress: fix to free compress page correctly
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit a12cc5b423d4f36dc1a1ea3911e49cf9dff43898 ]
In error path of f2fs_write_compressed_pages(), it needs to call f2fs_compress_free_page() to release temporary page.
--- fs/f2fs/compress.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/f2fs/compress.c +2 -1
@@ -1383,7 +1383,8 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,for (i =0 ; i < cc->nr_cpages; i++) {if (!cc->cpages[i])continue ; -f2fs_put_page (cc->cpages[i],1 ); +f2fs_compress_free_page (cc->cpages[i]); + cc->cpages[i] =NULL ; } out_put_cic:kmem_cache_free (cic_entry_slab, cic);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 301/363 f2fs: compress: fix race condition of overwrite vs truncate
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit a949dc5f2c5cfe0c910b664650f45371254c0744 ]
pos_fsstress testcase complains a panic as belew:
------------[ cut here ]------------ kernel BUG at fs/f2fs/compress.c:1082! invalid opcode: 0000 [#1] SMP PTI CPU: 4 PID: 2753477 Comm: kworker/u16:2 Tainted: G OE 5.12.0-rc1-custom #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Workqueue: writeback wb_workfn (flush-252:16) RIP: 0010:prepare_compress_overwrite+0x4c0/0x760 [f2fs] Call Trace: f2fs_prepare_compress_overwrite+0x5f/0x80 [f2fs] f2fs_write_cache_pages+0x468/0x8a0 [f2fs] f2fs_write_data_pages+0x2a4/0x2f0 [f2fs] do_writepages+0x38/0xc0 __writeback_single_inode+0x44/0x2a0 writeback_sb_inodes+0x223/0x4d0 __writeback_inodes_wb+0x56/0xf0 wb_writeback+0x1dd/0x290 wb_workfn+0x309/0x500 process_one_work+0x220/0x3c0 worker_thread+0x53/0x420 kthread+0x12f/0x150 ret_from_fork+0x22/0x30
The root cause is truncate() may race with overwrite as below, so that one reference count left in page can not guarantee the page attaching in mapping tree all the time, after truncation, later find_lock_page() may return NULL pointer.
- prepare_compress_overwrite
- f2fs_pagecache_get_page
- unlock_page
- f2fs_setattr
- truncate_setsize
- truncate_inode_page
- delete_from_page_cache
- find_lock_page
Fix this by avoiding referencing updated page.
--- fs/f2fs/compress.c | 35 ++++++++++++----------------------- 1 file changed, 12 insertions(+), 23 deletions(-)
fs/f2fs/compress.c +12 -23
@@ -123,19 +123,6 @@ static void f2fs_unlock_rpages(struct compress_ctx *cc, int len)f2fs_drop_rpages (cc, len, true); } -static void f2fs_put_rpages_mapping (struct address_space *mapping, -pgoff_t start,int len) -{ -int i; - -for (i =0 ; i < len; i++) { -struct page *page =find_get_page (mapping, start + i); - -put_page (page); -put_page (page); - } -} -static void f2fs_put_rpages_wbc (struct compress_ctx *cc,struct writeback_control *wbc,bool redirty,int unlock) {
@@ -1048,7 +1035,7 @@ static int prepare_compress_overwrite(struct compress_ctx *cc, }if (PageUptodate (page)) -unlock_page (page); +f2fs_put_page (page,1 );else f2fs_compress_ctx_add_page (cc, page); }
@@ -1058,32 +1045,34 @@ static int prepare_compress_overwrite(struct compress_ctx *cc, ret =f2fs_read_multi_pages (cc, &bio, cc->cluster_size, &last_block_in_bio, false, true); +f2fs_put_rpages (cc);f2fs_destroy_compress_ctx (cc);if (ret) - goto release_pages; + goto out;if (bio)f2fs_submit_bio (sbi, bio,DATA ); ret =f2fs_init_compress_ctx (cc);if (ret) - goto release_pages; + goto out; }for (i =0 ; i < cc->cluster_size; i++) {f2fs_bug_on (sbi, cc->rpages[i]); page =find_lock_page (mapping, start_idx + i); -f2fs_bug_on (sbi, !page); +if (!page) { +/* page can be truncated */ + goto release_and_retry; + }f2fs_wait_on_page_writeback (page,DATA , true, true); -f2fs_compress_ctx_add_page (cc, page); -f2fs_put_page (page,0 );if (!PageUptodate (page)) { +release_and_retry: +f2fs_put_rpages (cc);f2fs_unlock_rpages (cc, i +1 ); -f2fs_put_rpages_mapping (mapping, start_idx, - cc->cluster_size);f2fs_destroy_compress_ctx (cc); goto retry; }
@@ -1115,10 +1104,10 @@ static int prepare_compress_overwrite(struct compress_ctx *cc, } unlock_pages: +f2fs_put_rpages (cc);f2fs_unlock_rpages (cc, i); -release_pages: -f2fs_put_rpages_mapping (mapping, start_idx, i);f2fs_destroy_compress_ctx (cc); +out:return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 302/363 f2fs: compress: fix to assign cc.cluster_idx correctly
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 8bfbfb0ddd706b1ce2e89259ecc45f192c0ec2bf ]
In f2fs_destroy_compress_ctx(), after f2fs_destroy_compress_ctx(), cc.cluster_idx will be cleared w/ NULL_CLUSTER, f2fs_cluster_blocks() may check wrong cluster metadata, fix it.
--- fs/f2fs/compress.c | 17 +++++++++-------- fs/f2fs/data.c | 6 +++--- fs/f2fs/f2fs.h | 2 +- 3 files changed, 13 insertions(+), 12 deletions(-)
fs/f2fs/compress.c +9 -8
@@ -151,13 +151,14 @@ int f2fs_init_compress_ctx(struct compress_ctx *cc)return cc->rpages ?0 : -ENOMEM ; } -void f2fs_destroy_compress_ctx (struct compress_ctx *cc) +void f2fs_destroy_compress_ctx (struct compress_ctx *cc,bool reuse) {page_array_free (cc->inode, cc->rpages, cc->cluster_size); cc->rpages =NULL ; cc->nr_rpages =0 ; cc->nr_cpages =0 ; - cc->cluster_idx =NULL_CLUSTER ; +if (!reuse) + cc->cluster_idx =NULL_CLUSTER ; }void f2fs_compress_ctx_add_page (struct compress_ctx *cc,struct page *page)
@@ -1046,7 +1047,7 @@ static int prepare_compress_overwrite(struct compress_ctx *cc, ret =f2fs_read_multi_pages (cc, &bio, cc->cluster_size, &last_block_in_bio, false, true);f2fs_put_rpages (cc); -f2fs_destroy_compress_ctx (cc); +f2fs_destroy_compress_ctx (cc, true);if (ret) goto out;if (bio)
@@ -1073,7 +1074,7 @@ static int prepare_compress_overwrite(struct compress_ctx *cc, release_and_retry:f2fs_put_rpages (cc);f2fs_unlock_rpages (cc, i +1 ); -f2fs_destroy_compress_ctx (cc); +f2fs_destroy_compress_ctx (cc, true); goto retry; } }
@@ -1106,7 +1107,7 @@ static int prepare_compress_overwrite(struct compress_ctx *cc, unlock_pages:f2fs_put_rpages (cc);f2fs_unlock_rpages (cc, i); -f2fs_destroy_compress_ctx (cc); +f2fs_destroy_compress_ctx (cc, true); out:return ret; }
@@ -1142,7 +1143,7 @@ bool f2fs_compress_write_end(struct inode *inode, void *fsdata,set_cluster_dirty (&cc);f2fs_put_rpages_wbc (&cc,NULL , false,1 ); -f2fs_destroy_compress_ctx (&cc); +f2fs_destroy_compress_ctx (&cc, false);return first_index; }
@@ -1361,7 +1362,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,f2fs_put_rpages (cc);page_array_free (cc->inode, cc->cpages, cc->nr_cpages); cc->cpages =NULL ; -f2fs_destroy_compress_ctx (cc); +f2fs_destroy_compress_ctx (cc, false);return 0 ; out_destroy_crypt:
@@ -1523,7 +1524,7 @@ int f2fs_write_multi_pages(struct compress_ctx *cc, err =f2fs_write_raw_pages (cc, submitted, wbc, io_type);f2fs_put_rpages_wbc (cc, wbc, false,0 ); destroy_out: -f2fs_destroy_compress_ctx (cc); +f2fs_destroy_compress_ctx (cc, false);return err; }
fs/f2fs/data.c +3 -3
@@ -2276,7 +2276,7 @@ static int f2fs_mpage_readpages(struct inode *inode, max_nr_pages, &last_block_in_bio, rac != NULL, false); -f2fs_destroy_compress_ctx (&cc); +f2fs_destroy_compress_ctx (&cc, false);if (ret) goto set_error_page; }
@@ -2321,7 +2321,7 @@ static int f2fs_mpage_readpages(struct inode *inode, max_nr_pages, &last_block_in_bio, rac != NULL, false); - f2fs_destroy_compress_ctx(&cc); + f2fs_destroy_compress_ctx(&cc, false); } }#endif
@@ -3022,7 +3022,7 @@ static int f2fs_write_cache_pages(struct address_space *mapping, } }if (f2fs_compressed_file (inode)) -f2fs_destroy_compress_ctx (&cc); +f2fs_destroy_compress_ctx (&cc, false);#endif if (retry) { index =0 ;
fs/f2fs/f2fs.h +1 -1
@@ -3950,7 +3950,7 @@ struct decompress_io_ctx *f2fs_alloc_dic(struct compress_ctx *cc);void f2fs_decompress_end_io (struct decompress_io_ctx *dic,bool failed);void f2fs_put_page_dic (struct page *page);int f2fs_init_compress_ctx (struct compress_ctx *cc); -void f2fs_destroy_compress_ctx (struct compress_ctx *cc); +void f2fs_destroy_compress_ctx (struct compress_ctx *cc,bool reuse);void f2fs_init_compress_info (struct f2fs_sb_info *sbi);int f2fs_init_page_array_cache (struct f2fs_sb_info *sbi);void f2fs_destroy_page_array_cache (struct f2fs_sb_info *sbi);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 303/363 sched/fair: Fix clearing of has_idle_cores flag in select_idle_cpu()
In reply to Greg Kroah-HartmanFrom: Gautham R. Shenoy <[email protected]>
[ Upstream commit 02dbb7246c5bbbbe1607ebdc546ba5c454a664b1 ]
In commit:
9fe1f127b913 ("sched/fair: Merge select_idle_core/cpu()")
in select_idle_cpu(), we check if an idle core is present in the LLC of the target CPU via the flag "has_idle_cores". We look for the idle core in select_idle_cores(). If select_idle_cores() isn't able to find an idle core/CPU, we need to unset the has_idle_cores flag in the LLC of the target to prevent other CPUs from going down this route.
However, the current code is unsetting it in the LLC of the current CPU instead of the target CPU. This patch fixes this issue.
--- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/fair.c +1 -1
@@ -6212,7 +6212,7 @@ static int select_idle_cpu(struct task_struct *p, struct sched_domain *sd, bool }if (has_idle_core) -set_idle_cores (this, false); +set_idle_cores (target, false);if (sched_feat (SIS_PROP ) && !has_idle_core) { time =cpu_clock (this) - time;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 304/363 nbd: Fix NULL pointer in flush_workqueue
In reply to Greg Kroah-HartmanFrom: Sun Ke <[email protected]>
[ Upstream commit 79ebe9110fa458d58f1fceb078e2068d7ad37390 ]
Open /dev/nbdX first, the config_refs will be 1 and the pointers in nbd_device are still null. Disconnect /dev/nbdX, then reference a null recv_workq. The protection by config_refs in nbd_genl_disconnect is useless.
[ 656.366194] BUG: kernel NULL pointer dereference, address: 0000000000000020 [ 656.368943] #PF: supervisor write access in kernel mode [ 656.369844] #PF: error_code(0x0002) - not-present page [ 656.370717] PGD 10cc87067 P4D 10cc87067 PUD 1074b4067 PMD 0 [ 656.371693] Oops: 0002 [#1] SMP [ 656.372242] CPU: 5 PID: 7977 Comm: nbd-client Not tainted 5.11.0-rc5-00040-g76c057c84d28 #1 [ 656.373661] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [ 656.375904] RIP: 0010:mutex_lock+0x29/0x60 [ 656.376627] Code: 00 0f 1f 44 00 00 55 48 89 fd 48 83 05 6f d7 fe 08 01 e8 7a c3 ff ff 48 83 05 6a d7 fe 08 01 31 c0 65 48 8b 14 25 00 6d 01 00 <f0> 48 0f b1 55 d [ 656.378934] RSP: 0018:ffffc900005eb9b0 EFLAGS: 00010246 [ 656.379350] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 656.379915] RDX: ffff888104cf2600 RSI: ffffffffaae8f452 RDI: 0000000000000020 [ 656.380473] RBP: 0000000000000020 R08: 0000000000000000 R09: ffff88813bd6b318 [ 656.381039] R10: 00000000000000c7 R11: fefefefefefefeff R12: ffff888102710b40 [ 656.381599] R13: ffffc900005eb9e0 R14: ffffffffb2930680 R15: ffff88810770ef00 [ 656.382166] FS: 00007fdf117ebb40(0000) GS:ffff88813bd40000(0000) knlGS:0000000000000000 [ 656.382806] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 656.383261] CR2: 0000000000000020 CR3: 0000000100c84000 CR4: 00000000000006e0 [ 656.383819] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 656.384370] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 656.384927] Call Trace: [ 656.385111] flush_workqueue+0x92/0x6c0 [ 656.385395] nbd_disconnect_and_put+0x81/0xd0 [ 656.385716] nbd_genl_disconnect+0x125/0x2a0 [ 656.386034] genl_family_rcv_msg_doit.isra.0+0x102/0x1b0 [ 656.386422] genl_rcv_msg+0xfc/0x2b0 [ 656.386685] ? nbd_ioctl+0x490/0x490 [ 656.386954] ? genl_family_rcv_msg_doit.isra.0+0x1b0/0x1b0 [ 656.387354] netlink_rcv_skb+0x62/0x180 [ 656.387638] genl_rcv+0x34/0x60 [ 656.387874] netlink_unicast+0x26d/0x590 [ 656.388162] netlink_sendmsg+0x398/0x6c0 [ 656.388451] ? netlink_rcv_skb+0x180/0x180 [ 656.388750] ____sys_sendmsg+0x1da/0x320 [ 656.389038] ? ____sys_recvmsg+0x130/0x220 [ 656.389334] ___sys_sendmsg+0x8e/0xf0 [ 656.389605] ? ___sys_recvmsg+0xa2/0xf0 [ 656.389889] ? handle_mm_fault+0x1671/0x21d0 [ 656.390201] __sys_sendmsg+0x6d/0xe0 [ 656.390464] __x64_sys_sendmsg+0x23/0x30 [ 656.390751] do_syscall_64+0x45/0x70 [ 656.391017] entry_SYSCALL_64_after_hwframe+0x44/0xa9
To fix it, just add if (nbd->recv_workq) to nbd_disconnect_and_put().
--- drivers/block/nbd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/block/nbd.c +2 -1
@@ -1980,7 +1980,8 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd)* config ref and try to destroy the workqueue from inside the work * queue. */ -flush_workqueue (nbd->recv_workq); +if (nbd->recv_workq) +flush_workqueue (nbd->recv_workq);if (test_and_clear_bit (NBD_RT_HAS_CONFIG_REF , &nbd->config->runtime_flags))nbd_config_put (nbd);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 305/363 powerpc/64s: Make NMI record implicitly soft-masked code as irqs disabled
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
[ Upstream commit 4ec5feec1ad029bdf7d49bc50ccc0c195eeabe93 ]
scv support introduced the notion of code that implicitly soft-masks irqs due to the instruction addresses. This is required because scv enters the kernel with MSR[EE]=1.
If a NMI (including soft-NMI) interrupt hits when we are implicitly soft-masked then its regs->softe does not reflect this because it is derived from the explicit soft mask state (paca->irq_soft_mask). This makes arch_irq_disabled_regs(regs) return false.
This can trigger a warning in the soft-NMI watchdog code (shown below). Fix it by having NMI interrupts set regs->softe to disabled in case of interrupting an implicit soft-masked region.
------------[ cut here ]------------ WARNING: CPU: 41 PID: 1103 at arch/powerpc/kernel/watchdog.c:259 soft_nmi_interrupt+0x3e4/0x5f0 CPU: 41 PID: 1103 Comm: (spawn) Not tainted NIP: c000000000039534 LR: c000000000039234 CTR: c000000000009a00 REGS: c000007fffbcf940 TRAP: 0700 Not tainted MSR: 9000000000021033 <SF,HV,ME,IR,DR,RI,LE> CR: 22042482 XER: 200400ad CFAR: c000000000039260 IRQMASK: 3 GPR00: c000000000039204 c000007fffbcfbe0 c000000001d6c300 0000000000000003 GPR04: 00007ffffa45d078 0000000000000000 0000000000000008 0000000000000020 GPR08: 0000007ffd4e0000 0000000000000000 c000007ffffceb00 7265677368657265 GPR12: 9000000000009033 c000007ffffceb00 00000f7075bf4480 000000000000002a GPR16: 00000f705745a528 00007ffffa45ddd8 00000f70574d0008 0000000000000000 GPR20: 00000f7075c58d70 00000f7057459c38 0000000000000001 0000000000000040 GPR24: 0000000000000000 0000000000000029 c000000001dae058 0000000000000029 GPR28: 0000000000000000 0000000000000800 0000000000000009 c000007fffbcfd60 NIP [c000000000039534] soft_nmi_interrupt+0x3e4/0x5f0 LR [c000000000039234] soft_nmi_interrupt+0xe4/0x5f0 Call Trace: [c000007fffbcfbe0] [c000000000039204] soft_nmi_interrupt+0xb4/0x5f0 (unreliable) [c000007fffbcfcf0] [c00000000000c0e8] soft_nmi_common+0x138/0x1c4 --- interrupt: 900 at end_real_trampolines+0x0/0x1000 NIP: c000000000003000 LR: 00007ca426adb03c CTR: 900000000280f033 REGS: c000007fffbcfd60 TRAP: 0900 MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 44042482 XER: 200400ad CFAR: 00007ca426946020 IRQMASK: 0 GPR00: 00000000000000ad 00007ffffa45d050 00007ca426b07f00 0000000000000035 GPR04: 00007ffffa45d078 0000000000000000 0000000000000008 0000000000000020 GPR08: 0000000000000000 0000000000100000 0000000010000000 00007ffffa45d110 GPR12: 0000000000000001 00007ca426d4e680 00000f7075bf4480 000000000000002a GPR16: 00000f705745a528 00007ffffa45ddd8 00000f70574d0008 0000000000000000 GPR20: 00000f7075c58d70 00000f7057459c38 0000000000000001 0000000000000040 GPR24: 0000000000000000 00000f7057473f68 0000000000000003 000000000000041b GPR28: 00007ffffa45d4c4 0000000000000035 0000000000000000 00000f7057473f68 NIP [c000000000003000] end_real_trampolines+0x0/0x1000 LR [00007ca426adb03c] 0x7ca426adb03c --- interrupt: 900 Instruction dump: 60000000 60000000 60420000 38600001 482b3ae5 60000000 e93f0138 a36d0008 7daa6b78 71290001 7f7907b4 4082fd34 <0fe00000> 4bfffd2c 60420000 ea6100a8 ---[ end trace dc75f67d819779da ]---
--- arch/powerpc/include/asm/interrupt.h | 7 +++++++ 1 file changed, 7 insertions(+)
arch/powerpc/include/asm/interrupt.h +7 -0
@@ -138,6 +138,13 @@ static inline void interrupt_nmi_enter_prepare(struct pt_regs *regs, struct inte local_paca->irq_soft_mask =IRQS_ALL_DISABLED ; local_paca->irq_happened |=PACA_IRQ_HARD_DIS ; +if (IS_ENABLED (CONFIG_PPC_BOOK3S_64 ) && !(regs->msr &MSR_PR ) && + regs->nip < (unsigned long )__end_interrupts) { +// Kernel code running below __end_interrupts is +// implicitly soft-masked. + regs->softe =IRQS_ALL_DISABLED ; + } +/* Don't do any per-CPU operations until interrupt state is fixed */ #endif /* Allow DEC and PMI to be traced when they are soft-NMI */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 306/363 blk-mq: plug request for shared sbitmap
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit 03f26d8f11403295de445b6e4e0e57ac57755791 ]
In case of shared sbitmap, request won't be held in plug list any more sine commit 32bc15afed04 ("blk-mq: Facilitate a shared sbitmap per tagset"), this way makes request merge from flush plug list & batching submission not possible, so cause performance regression.
Yanhui reports performance regression when running sequential IO test(libaio, 16 jobs, 8 depth for each job) in VM, and the VM disk is emulated with image stored on xfs/megaraid_sas.
Fix the issue by recovering original behavior to allow to hold request in plug list.
--- block/blk-mq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
block/blk-mq.c +3 -2
@@ -2216,8 +2216,9 @@ blk_qc_t blk_mq_submit_bio(struct bio *bio)/* Bypass scheduler for flush requests */ blk_insert_flush (rq);blk_mq_run_hw_queue (data.hctx, true); - }else if (plug && (q->nr_hw_queues ==1 || q->mq_ops->commit_rqs || - !blk_queue_nonrot (q))) { + }else if (plug && (q->nr_hw_queues ==1 || +blk_mq_is_sbitmap_shared (rq->mq_hctx->flags) || + q->mq_ops->commit_rqs || !blk_queue_nonrot (q))) {/* * Use plugging if we have a ->commit_rqs() hook as well, as * we know the driver uses bd->last in a smart fashion.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 307/363 blk-mq: Swap two calls in blk_mq_exit_queue()
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 630ef623ed26c18a457cdc070cf24014e50129c2 ]
If a tag set is shared across request queues (e.g. SCSI LUNs) then the block layer core keeps track of the number of active request queues in tags->active_queues. blk_mq_tag_busy() and blk_mq_tag_idle() update that atomic counter if the hctx flag BLK_MQ_F_TAG_QUEUE_SHARED is set. Make sure that blk_mq_exit_queue() calls blk_mq_tag_idle() before that flag is cleared by blk_mq_del_queue_tag_set().
--- block/blk-mq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
block/blk-mq.c +4 -2
@@ -3270,10 +3270,12 @@ EXPORT_SYMBOL(blk_mq_init_allocated_queue);/* tags can _not_ be used after returning from blk_mq_exit_queue */ void blk_mq_exit_queue (struct request_queue *q) { -struct blk_mq_tag_set *set = q->tag_set; +struct blk_mq_tag_set *set = q->tag_set; -blk_mq_del_queue_tag_set (q); +/* Checks hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED. */ blk_mq_exit_hw_queues (q, set, set->nr_hw_queues); +/* May clear BLK_MQ_F_TAG_QUEUE_SHARED in hctx->flags. */ +blk_mq_del_queue_tag_set (q); }static int __blk_mq_alloc_rq_maps (struct blk_mq_tag_set *set)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 308/363 usb: dwc3: omap: improve extcon initialization
In reply to Greg Kroah-HartmanFrom: Marcel Hamer <[email protected]>
commit e17b02d4970913233d543c79c9c66e72cac05bdd upstream.
When extcon is used in combination with dwc3, it is assumed that the dwc3 registers are untouched and as such are only configured if VBUS is valid or ID is tied to ground.
In case VBUS is not valid or ID is floating, the registers are not configured as such during driver initialization, causing a wrong default state during boot.
If the registers are not in a default state, because they are for instance touched by a boot loader, this can cause for a kernel error.
--- drivers/usb/dwc3/dwc3-omap.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/dwc3/dwc3-omap.c +5 -0
@@ -437,8 +437,13 @@ static int dwc3_omap_extcon_register(strif (extcon_get_state (edev,EXTCON_USB ) == true)dwc3_omap_set_mailbox (omap,OMAP_DWC3_VBUS_VALID ); +else +dwc3_omap_set_mailbox (omap,OMAP_DWC3_VBUS_OFF ); +if (extcon_get_state (edev,EXTCON_USB_HOST ) == true)dwc3_omap_set_mailbox (omap,OMAP_DWC3_ID_GROUND ); +else +dwc3_omap_set_mailbox (omap,OMAP_DWC3_ID_FLOAT ); omap->edev = edev; }
Greg Kroah-Hartman
maintainerPATCH 309/363 usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel Merrifield
In reply to Greg Kroah-HartmanFrom: Ferry Toth <[email protected]>
commit 04357fafea9c7ed34525eb9680c760245c3bb958 upstream.
On Intel Merrifield LPM is causing host to reset port after a timeout. By disabling LPM entirely this is prevented.
--- drivers/usb/dwc3/dwc3-pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/dwc3/dwc3-pci.c +1 -0
@@ -123,6 +123,7 @@ static const struct property_entry dwc3_PROPERTY_ENTRY_STRING ("linux,extcon-name" ,"mrfld_bcove_pwrsrc" ),PROPERTY_ENTRY_BOOL ("snps,dis_u3_susphy_quirk" ),PROPERTY_ENTRY_BOOL ("snps,dis_u2_susphy_quirk" ), +PROPERTY_ENTRY_BOOL ("snps,usb2-gadget-lpm-disable" ), PROPERTY_ENTRY_BOOL("linux,sysdev_is_parent"), {} };
Greg Kroah-Hartman
maintainerPATCH 310/363 usb: xhci: Increase timeout for HC halt
In reply to Greg Kroah-HartmanFrom: Maximilian Luz <[email protected]>
commit ca09b1bea63ab83f4cca3a2ae8bc4f597ec28851 upstream.
On some devices (specifically the SC8180x based Surface Pro X with QCOM04A6) HC halt / xhci_halt() times out during boot. Manually binding the xhci-hcd driver at some point later does not exhibit this behavior. To work around this, double XHCI_MAX_HALT_USEC, which also resolves this issue.
--- drivers/usb/host/xhci-ext-caps.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-ext-caps.h +3 -2
@@ -7,8 +7,9 @@* Author: Sarah Sharp * Some code borrowed from the Linux EHCI driver. */ -/* Up to 16 ms to halt an HC */ -#define XHCI_MAX_HALT_USEC (16*1000) + +/* HC should halt within 16 ms, but use 32 ms as some hosts take longer */ +#define XHCI_MAX_HALT_USEC (32 * 1000)/* HC not running - set to 1 when run/stop bit is cleared. */ #define XHCI_STS_HALT (1<<0)
Greg Kroah-Hartman
maintainerPATCH 311/363 usb: dwc2: Fix gadget DMA unmap direction
In reply to Greg Kroah-HartmanFrom: Phil Elwell <[email protected]>
commit 75a41ce46bae6cbe7d3bb2584eb844291d642874 upstream.
The dwc2 gadget support maps and unmaps DMA buffers as necessary. When mapping and unmapping it uses the direction of the endpoint to select the direction of the DMA transfer, but this fails for Control OUT transfers because the unmap occurs after the endpoint direction has been reversed for the status phase.
A possible solution would be to unmap the buffer before the direction is changed, but a safer, less invasive fix is to remember the buffer direction independently of the endpoint direction.
--- drivers/usb/dwc2/core.h | 2 ++ drivers/usb/dwc2/gadget.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/usb/dwc2/core.h +2 -0
@@ -112,6 +112,7 @@ struct dwc2_hsotg_req;* @debugfs: File entry for debugfs file for this endpoint. * @dir_in: Set to true if this endpoint is of the IN direction, which * means that it is sending data to the Host. +* @map_dir: Set to the value of dir_in when the DMA buffer is mapped. * @index: The index for the endpoint registers. * @mc: Multi Count - number of transactions per microframe * @interval: Interval for periodic endpoints, in frames or microframes.
@@ -161,6 +162,7 @@ struct dwc2_hsotg_ep {unsigned short fifo_index;unsigned char dir_in; +unsigned char map_dir;unsigned char index;unsigned char mc;u16 interval;
drivers/usb/dwc2/gadget.c +2 -1
@@ -422,7 +422,7 @@ static void dwc2_hsotg_unmap_dma(struct {struct usb_request *req = &hs_req->req; -usb_gadget_unmap_request (&hsotg->gadget, req, hs_ep->dir_in); +usb_gadget_unmap_request (&hsotg->gadget, req, hs_ep->map_dir); }/*
@@ -1242,6 +1242,7 @@ static int dwc2_hsotg_map_dma(struct dwc {int ret; + hs_ep->map_dir = hs_ep->dir_in; ret =usb_gadget_map_request (&hsotg->gadget, req, hs_ep->dir_in);if (ret) goto dma_error;
Greg Kroah-Hartman
maintainerPATCH 312/363 usb: core: hub: fix race condition about TRSMRCY of resume
In reply to Greg Kroah-HartmanFrom: Chunfeng Yun <[email protected]>
commit 975f94c7d6c306b833628baa9aec3f79db1eb3a1 upstream.
This may happen if the port becomes resume status exactly when usb_port_resume() gets port status, it still need provide a TRSMCRY time before access the device.
--- drivers/usb/core/hub.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/core/hub.c +3 -3
@@ -3593,9 +3593,6 @@ int usb_port_resume(struct usb_device *u* sequence. */ status =hub_port_status (hub, port1, &portstatus, &portchange); - -/* TRSMRCY = 10 msec */ -msleep (10 ); } SuspendCleared:
@@ -3610,6 +3607,9 @@ int usb_port_resume(struct usb_device *uusb_clear_port_feature (hub->hdev, port1,USB_PORT_FEAT_C_SUSPEND ); } + +/* TRSMRCY = 10 msec */ +msleep (10 ); }if (udev->persist_enabled)
Greg Kroah-Hartman
maintainerPATCH 313/363 usb: dwc3: imx8mp: fix error return code in dwc3_imx8mp_probe()
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
commit 0b2b149e918f6dddb4ea53615551bf7bc131f875 upstream.
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/usb/dwc3/dwc3-imx8mp.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/dwc3/dwc3-imx8mp.c +1 -0
@@ -167,6 +167,7 @@ static int dwc3_imx8mp_probe(struct plat dwc3_np =of_get_child_by_name (node,"dwc3" );if (!dwc3_np) { + err = -ENODEV ;dev_err (dev,"failed to find dwc3 core child\n" ); goto disable_rpm; }
Greg Kroah-Hartman
maintainerPATCH 314/363 usb: dwc3: gadget: Enable suspend events
In reply to Greg Kroah-HartmanFrom: Jack Pham <[email protected]>
commit d1d90dd27254c44d087ad3f8b5b3e4fff0571f45 upstream.
commit 72704f876f50 ("dwc3: gadget: Implement the suspend entry event handler") introduced (nearly 5 years ago!) an interrupt handler for U3/L1-L2 suspend events. The problem is that these events aren't currently enabled in the DEVTEN register so the handler is never even invoked. Fix this simply by enabling the corresponding bit in dwc3_gadget_enable_irq() using the same revision check as found in the handler.
--- drivers/usb/dwc3/gadget.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/dwc3/gadget.c +4 -0
@@ -2302,6 +2302,10 @@ static void dwc3_gadget_enable_irq(struc if (DWC3_VER_IS_PRIOR(DWC3, 250A)) reg |=DWC3_DEVTEN_ULSTCNGEN ; +/* On 2.30a and above this bit enables U3/L2-L1 Suspend Events */ + if (!DWC3_VER_IS_PRIOR(DWC3, 230A)) + reg |=DWC3_DEVTEN_EOPFEN ; +dwc3_writel (dwc->regs,DWC3_DEVTEN , reg); }
Greg Kroah-Hartman
maintainerPATCH 315/363 usb: dwc3: gadget: Return success always for kick transfer in ep queue
In reply to Greg Kroah-HartmanFrom: Wesley Cheng <[email protected]>
commit 18ffa988dbae69cc6e9949cddd9606f6fe533894 upstream.
If an error is received when issuing a start or update transfer command, the error handler will stop all active requests (including the current USB request), and call dwc3_gadget_giveback() to notify function drivers of the requests which have been stopped. Avoid returning an error for kick transfer during EP queue, to remove duplicate cleanup operations on the request being queued.
--- drivers/usb/dwc3/gadget.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/dwc3/gadget.c +3 -1
@@ -1676,7 +1676,9 @@ static int __dwc3_gadget_ep_queue(struct } } -return __dwc3_gadget_kick_transfer (dep); +__dwc3_gadget_kick_transfer (dep); + +return 0 ; } static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
Greg Kroah-Hartman
maintainerPATCH 316/363 usb: typec: tcpm: Fix wrong handling in GET_SINK_CAP
In reply to Greg Kroah-HartmanFrom: Kyle Tso <[email protected]>
commit 2e2b8d15adc2f6ab2d4aa0550e241b9742a436a0 upstream.
After receiving Sink Capabilities Message in GET_SINK_CAP AMS, it is incorrect to call tcpm_pd_handle_state because the Message is expected and the current state is not Ready states. The result of this incorrect operation ends in Soft Reset which is definitely wrong. Simply forwarding to Ready States is enough to finish the AMS.
--- drivers/usb/typec/tcpm/tcpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/tcpm/tcpm.c +1 -1
@@ -2387,7 +2387,7 @@ static void tcpm_pd_data_request(struct port->nr_sink_caps = cnt; port->sink_cap_done = true;if (port->ams ==GET_SINK_CAPABILITIES ) -tcpm_pd_handle_state (port,ready_state (port),NONE_AMS ,0 ); +tcpm_set_state (port,ready_state (port),0 );/* Unexpected Sink Capabilities */ else tcpm_pd_handle_msg(port,
Greg Kroah-Hartman
maintainerPATCH 317/363 usb: typec: ucsi: Retrieve all the PDOs instead of just the first 4
In reply to Greg Kroah-HartmanFrom: Jack Pham <[email protected]>
commit 1f4642b72be79757f050924a9b9673b6a02034bc upstream.
commit 4dbc6a4ef06d ("usb: typec: ucsi: save power data objects in PD mode") introduced retrieval of the PDOs when connected to a PD-capable source. But only the first 4 PDOs are received since that is the maximum number that can be fetched at a time given the MESSAGE_IN length limitation (16 bytes). However, as per the PD spec a connected source may advertise up to a maximum of 7 PDOs.
If such a source is connected it's possible the PPM could have negotiated a power contract with one of the PDOs at index greater than 4, and would be reflected in the request data object's (RDO) object position field. This would result in an out-of-bounds access when the rdo_index() is used to index into the src_pdos array in ucsi_psy_get_voltage_now().
With the help of the UBSAN -fsanitize=array-bounds checker enabled this exact issue is revealed when connecting to a PD source adapter that advertise 5 PDOs and the PPM enters a contract having selected the 5th one.
[ 151.545106][ T70] Unexpected kernel BRK exception at EL1 [ 151.545112][ T70] Internal error: BRK handler: f2005512 [#1] PREEMPT SMP ... [ 151.545499][ T70] pc : ucsi_psy_get_prop+0x208/0x20c [ 151.545507][ T70] lr : power_supply_show_property+0xc0/0x328 ... [ 151.545542][ T70] Call trace: [ 151.545544][ T70] ucsi_psy_get_prop+0x208/0x20c [ 151.545546][ T70] power_supply_uevent+0x1a4/0x2f0 [ 151.545550][ T70] dev_uevent+0x200/0x384 [ 151.545555][ T70] kobject_uevent_env+0x1d4/0x7e8 [ 151.545557][ T70] power_supply_changed_work+0x174/0x31c [ 151.545562][ T70] process_one_work+0x244/0x6f0 [ 151.545564][ T70] worker_thread+0x3e0/0xa64
We can resolve this by instead retrieving and storing up to the maximum of 7 PDOs in the con->src_pdos array. This would involve two calls to the GET_PDOS command.
--- drivers/usb/typec/ucsi/ucsi.c | 41 ++++++++++++++++++++++++++++++++--------- drivers/usb/typec/ucsi/ucsi.h | 6 ++++-- 2 files changed, 36 insertions(+), 11 deletions(-)
drivers/usb/typec/ucsi/ucsi.c +32 -9
@@ -495,7 +495,8 @@ static void ucsi_unregister_altmodes(str } } -static void ucsi_get_pdos (struct ucsi_connector *con,int is_partner) +static int ucsi_get_pdos (struct ucsi_connector *con,int is_partner, +u32 *pdos,int offset,int num_pdos) {struct ucsi *ucsi = con->ucsi;u64 command;
@@ -503,17 +504,39 @@ static void ucsi_get_pdos(struct ucsi_co command =UCSI_COMMAND (UCSI_GET_PDOS ) |UCSI_CONNECTOR_NUMBER (con->num); command |=UCSI_GET_PDOS_PARTNER_PDO (is_partner); - command |=UCSI_GET_PDOS_NUM_PDOS (UCSI_MAX_PDOS -1 ); + command |=UCSI_GET_PDOS_PDO_OFFSET (offset); + command |=UCSI_GET_PDOS_NUM_PDOS (num_pdos -1 ); command |=UCSI_GET_PDOS_SRC_PDOS ; - ret =ucsi_send_command (ucsi, command, con->src_pdos, -sizeof (con->src_pdos)); -if (ret <0 ) { + ret =ucsi_send_command (ucsi, command, pdos + offset, + num_pdos *sizeof (u32)); +if (ret <0 )dev_err (ucsi->dev,"UCSI_GET_PDOS failed (%d)\n" , ret); +if (ret ==0 && offset ==0 ) +dev_warn (ucsi->dev,"UCSI_GET_PDOS returned 0 bytes\n" ); + +return ret; +} + +static void ucsi_get_src_pdos (struct ucsi_connector *con,int is_partner) +{ +int ret; + +/* UCSI max payload means only getting at most 4 PDOs at a time */ + ret =ucsi_get_pdos (con,1 , con->src_pdos,0 ,UCSI_MAX_PDOS ); +if (ret <0 )return ; - } + con->num_pdos = ret /sizeof (u32);/* number of bytes to 32-bit PDOs */ -if (ret ==0 ) -dev_warn (ucsi->dev,"UCSI_GET_PDOS returned 0 bytes\n" ); +if (con->num_pdos <UCSI_MAX_PDOS ) +return ; + +/* get the remaining PDOs, if any */ + ret =ucsi_get_pdos (con,1 , con->src_pdos,UCSI_MAX_PDOS , +PDO_MAX_OBJECTS -UCSI_MAX_PDOS ); +if (ret <0 ) +return ; + + con->num_pdos += ret /sizeof (u32); }static void ucsi_pwr_opmode_change (struct ucsi_connector *con)
@@ -522,7 +545,7 @@ static void ucsi_pwr_opmode_change(struccase UCSI_CONSTAT_PWR_OPMODE_PD : con->rdo = con->status.request_data_obj;typec_set_pwr_opmode (con->port,TYPEC_PWR_MODE_PD ); -ucsi_get_pdos (con,1 ); +ucsi_get_src_pdos (con,1 );break ;case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5 : con->rdo =0 ;
drivers/usb/typec/ucsi/ucsi.h +4 -2
@@ -8,6 +8,7 @@#include <linux/power_supply.h> #include <linux/types.h> #include <linux/usb/typec.h> +#include <linux/usb/pd.h> #include <linux/usb/role.h> /* -------------------------------------------------------------------------- */
@@ -134,7 +135,9 @@ void ucsi_connector_change(struct ucsi */* GET_PDOS command bits */ #define UCSI_GET_PDOS_PARTNER_PDO (_r_) ((u64)(_r_) << 23) +#define UCSI_GET_PDOS_PDO_OFFSET (_r_) ((u64)(_r_) << 24)#define UCSI_GET_PDOS_NUM_PDOS (_r_) ((u64)(_r_) << 32) +#define UCSI_MAX_PDOS (4)#define UCSI_GET_PDOS_SRC_PDOS ((u64)1 << 34)/* -------------------------------------------------------------------------- */
@@ -302,7 +305,6 @@ struct ucsi {#define UCSI_MAX_SVID 5#define UCSI_MAX_ALTMODES (UCSI_MAX_SVID * 6) -#define UCSI_MAX_PDOS (4)#define UCSI_TYPEC_VSAFE5V 5000#define UCSI_TYPEC_1_5_CURRENT 1500
@@ -330,7 +332,7 @@ struct ucsi_connector {struct power_supply *psy;struct power_supply_desc psy_desc;u32 rdo; -u32 src_pdos[UCSI_MAX_PDOS ]; +u32 src_pdos[PDO_MAX_OBJECTS ];int num_pdos;struct usb_role_switch *usb_role_sw;
Greg Kroah-Hartman
maintainerPATCH 318/363 usb: typec: ucsi: Put fwnode in any case during ->probe()
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit b9a0866a5bdf6a4643a52872ada6be6184c6f4f2 upstream.
device_for_each_child_node() bumps a reference counting of a returned variable. We have to balance it whenever we return to the caller.
--- drivers/usb/typec/ucsi/ucsi.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/typec/ucsi/ucsi.c +4 -1
@@ -1022,6 +1022,7 @@ static const struct typec_operations ucs .pr_set = ucsi_pr_swap }; +/* Caller must call fwnode_handle_put() after use */ static struct fwnode_handle *ucsi_find_fwnode (struct ucsi_connector *con) {struct fwnode_handle *fwnode;
@@ -1056,7 +1057,7 @@ static int ucsi_register_port(struct ucs command |=UCSI_CONNECTOR_NUMBER (con->num); ret =ucsi_send_command (ucsi, command, &con->cap,sizeof (con->cap));if (ret <0 ) - goto out; + goto out_unlock;if (con->cap.op_mode &UCSI_CONCAP_OPMODE_DRP ) cap->data =TYPEC_PORT_DRD ;
@@ -1174,6 +1175,8 @@ static int ucsi_register_port(struct ucstrace_ucsi_register_port (con->num, &con->status); out: +fwnode_handle_put (cap->fwnode); +out_unlock:mutex_unlock (&con->lock);return ret; }
Greg Kroah-Hartman
maintainerPATCH 319/363 xhci-pci: Allow host runtime PM as default for Intel Alder Lake xHCI
In reply to Greg Kroah-HartmanFrom: Abhijeet Rao <[email protected]>
commit b813511135e8b84fa741afdfbab4937919100bef upstream.
In the same way as Intel Tiger Lake TCSS (Type-C Subsystem) the Alder Lake TCSS xHCI needs to be runtime suspended whenever possible to allow the TCSS hardware block to enter D3cold and thus save energy.
--- drivers/usb/host/xhci-pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-pci.c +3 -1
@@ -57,6 +57,7 @@#define PCI_DEVICE_ID_INTEL_CML_XHCI 0xa3af#define PCI_DEVICE_ID_INTEL_TIGER_LAKE_XHCI 0x9a13#define PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI 0x1138 +#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI 0x461e#define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9#define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba
@@ -243,7 +244,8 @@ static void xhci_pci_quirks(struct devic pdev->device ==PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_ICE_LAKE_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_TIGER_LAKE_XHCI || - pdev->device == PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI)) + pdev->device ==PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI)) xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
Greg Kroah-Hartman
maintainerPATCH 320/363 xhci: Fix giving back cancelled URBs even if halted endpoint cant reset
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 9b6a126ae58d9edfdde2d5f2e87f7615ea5e0155 upstream.
Commit 9ebf30007858 ("xhci: Fix halted endpoint at stop endpoint command completion") in 5.12 changes how cancelled URBs are given back.
To cancel a URB xhci driver needs to stop the endpoint first. To clear a halted endpoint xhci driver needs to reset the endpoint.
In rare cases when an endpoint halt (error) races with a endpoint stop we need to clear the reset before removing, and giving back the cancelled URB.
The above change in 5.12 takes care of this, but it also relies on the reset endpoint completion handler to give back the cancelled URBs.
There are cases when driver refuses to queue reset endpoint commands, for example when a link suddenly goes to an inactive error state. In this case the cancelled URB is never given back.
Fix this by giving back the URB in the stop endpoint if queuing a reset endpoint command fails.
--- drivers/usb/host/xhci-ring.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/usb/host/xhci-ring.c +11 -5
@@ -863,7 +863,7 @@ done:return ret; } -static void xhci_handle_halted_endpoint (struct xhci_hcd *xhci, +static int xhci_handle_halted_endpoint (struct xhci_hcd *xhci,struct xhci_virt_ep *ep,unsigned int stream_id,struct xhci_td *td,enum xhci_ep_reset_type reset_type)
@@ -876,7 +876,7 @@ static void xhci_handle_halted_endpoint(* Device will be reset soon to recover the link so don't do anything */ if (ep->vdev->flags &VDEV_PORT_ERROR ) -return ; +return -ENODEV ;/* add td to cancelled list and let reset ep handler take care of it */ if (reset_type ==EP_HARD_RESET ) {
@@ -889,16 +889,18 @@ static void xhci_handle_halted_endpoint(if (ep->ep_state &EP_HALTED ) {xhci_dbg (xhci,"Reset ep command already pending\n" ); -return ; +return 0 ; } err =xhci_reset_halted_ep (xhci, slot_id, ep->ep_index, reset_type);if (err) -return ; +return err; ep->ep_state |=EP_HALTED ;xhci_ring_cmd_db (xhci); + +return 0 ; }/*
@@ -1015,6 +1017,7 @@ static void xhci_handle_cmd_stop_ep(strustruct xhci_td *td =NULL ;enum xhci_ep_reset_type reset_type;struct xhci_command *command; +int err;if (unlikely (TRB_TO_SUSPEND_PORT (le32_to_cpu (trb->generic.field[3 ])))) {if (!xhci->devs[slot_id])
@@ -1059,7 +1062,10 @@ static void xhci_handle_cmd_stop_ep(stru td->status = -EPROTO ; }/* reset ep, reset handler cleans up cancelled tds */ -xhci_handle_halted_endpoint (xhci, ep,0 , td, reset_type); + err =xhci_handle_halted_endpoint (xhci, ep,0 , td, + reset_type); +if (err) +break ;xhci_stop_watchdog_timer_in_irq (xhci, ep);return ;case EP_STATE_RUNNING :
Greg Kroah-Hartman
maintainerPATCH 321/363 xhci: Do not use GFP_KERNEL in (potentially) atomic context
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit dda32c00c9a0fa103b5d54ef72c477b7aa993679 upstream.
'xhci_urb_enqueue()' is passed a 'mem_flags' argument, because "URBs may be submitted in interrupt context" (see comment related to 'usb_submit_urb()' in 'drivers/usb/core/urb.c')
So this flag should be used in all the calling chain. Up to now, 'xhci_check_maxpacket()' which is only called from 'xhci_urb_enqueue()', uses GFP_KERNEL.
Be safe and pass the mem_flags to this function as well.
--- drivers/usb/host/xhci.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/host/xhci.c +3 -3
@@ -1514,7 +1514,7 @@ static int xhci_configure_endpoint(struc* we need to issue an evaluate context command and wait on it. */ static int xhci_check_maxpacket (struct xhci_hcd *xhci,unsigned int slot_id, -unsigned int ep_index,struct urb *urb) +unsigned int ep_index,struct urb *urb,gfp_t mem_flags) {struct xhci_container_ctx *out_ctx;struct xhci_input_control_ctx *ctrl_ctx;
@@ -1545,7 +1545,7 @@ static int xhci_check_maxpacket(struct x* changes max packet sizes. */ - command =xhci_alloc_command (xhci, true,GFP_KERNEL ); + command =xhci_alloc_command (xhci, true, mem_flags);if (!command)return -ENOMEM ;
@@ -1639,7 +1639,7 @@ static int xhci_urb_enqueue(struct usb_h*/ if (urb->dev->speed ==USB_SPEED_FULL ) { ret =xhci_check_maxpacket (xhci, slot_id, - ep_index, urb); + ep_index, urb, mem_flags);if (ret <0 ) {xhci_urb_free_priv (urb_priv); urb->hcpriv =NULL ;
Greg Kroah-Hartman
maintainerPATCH 322/363 xhci: Add reset resume quirk for AMD xhci controller.
In reply to Greg Kroah-HartmanFrom: Sandeep Singh <[email protected]>
commit 3c128781d8da463761495aaf8898c9ecb4e71528 upstream.
One of AMD xhci controller require reset on resume. Occasionally AMD xhci controller does not respond to Stop endpoint command.
Once the issue happens controller goes into bad state and in that case controller needs to be reset.
--- drivers/usb/host/xhci-pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-pci.c +3 -1
@@ -167,8 +167,10 @@ static void xhci_pci_quirks(struct devic (pdev->device == 0x15e0 || pdev->device == 0x15e1)) xhci->quirks |= XHCI_SNPS_BROKEN_SUSPEND; -if (pdev->vendor ==PCI_VENDOR_ID_AMD && pdev->device ==0x15e5 ) +if (pdev->vendor ==PCI_VENDOR_ID_AMD && pdev->device ==0x15e5 ) { xhci->quirks |=XHCI_DISABLE_SPARSE ; + xhci->quirks |=XHCI_RESET_ON_RESUME ; + }if (pdev->vendor ==PCI_VENDOR_ID_AMD ) xhci->quirks |=XHCI_TRUST_TX_LENGTH ;
Greg Kroah-Hartman
maintainerPATCH 323/363 iio: core: fix ioctl handlers removal
In reply to Greg Kroah-HartmanFrom: Tomasz Duszynski <[email protected]>
commit 901f84de0e16bde10a72d7eb2f2eb73fcde8fa1a upstream.
Currently ioctl handlers are removed twice. For the first time during iio_device_unregister() then later on inside iio_device_unregister_eventset() and iio_buffers_free_sysfs_and_mask(). Double free leads to kernel panic.
Fix this by not touching ioctl handlers list directly but rather letting code responsible for registration call the matching cleanup routine itself.
--- drivers/iio/industrialio-core.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/iio/industrialio-core.c +0 -6
@@ -1863,9 +1863,6 @@ EXPORT_SYMBOL(__iio_device_register);**/ void iio_device_unregister (struct iio_dev *indio_dev) { -struct iio_dev_opaque *iio_dev_opaque =to_iio_dev_opaque (indio_dev); -struct iio_ioctl_handler *h, *t; -cdev_device_del (&indio_dev->chrdev, &indio_dev->dev);mutex_lock (&indio_dev->info_exist_lock);
@@ -1876,9 +1873,6 @@ void iio_device_unregister(struct iio_de indio_dev->info =NULL ; -list_for_each_entry_safe (h, t, &iio_dev_opaque->ioctl_handlers, entry) -list_del (&h->entry); -iio_device_wakeup_eventset (indio_dev);iio_buffer_wakeup_poll (indio_dev);
Greg Kroah-Hartman
maintainerPATCH 324/363 iio: gyro: mpu3050: Fix reported temperature value
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit f73c730774d88a14d7b60feee6d0e13570f99499 upstream.
The raw temperature value is a 16-bit signed integer. The sign casting is missing in the code, which results in a wrong temperature reported by userspace tools, fix it.
Datasheet: https://www.cdiweb.com/datasheets/invensense/mpu-3000a.pdf
--- drivers/iio/gyro/mpu3050-core.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/iio/gyro/mpu3050-core.c +11 -2
@@ -272,7 +272,16 @@ static int mpu3050_read_raw(struct iio_dcase IIO_CHAN_INFO_OFFSET :switch (chan->type) {case IIO_TEMP : -/* The temperature scaling is (x+23000)/280 Celsius */ +/* +* The temperature scaling is (x+23000)/280 Celsius +* for the "best fit straight line" temperature range +* of -30C..85C. The 23000 includes room temperature +* offset of +35C, 280 is the precision scale and x is +* the 16-bit signed integer reported by hardware. +* +* Temperature value itself represents temperature of +* the sensor die. +*/ *val =23000 ;return IIO_VAL_INT ;default :
@@ -329,7 +338,7 @@ static int mpu3050_read_raw(struct iio_d goto out_read_raw_unlock; } - *val =be16_to_cpu (raw_val); + *val = (s16 )be16_to_cpu (raw_val); ret =IIO_VAL_INT ; goto out_read_raw_unlock;
Greg Kroah-Hartman
maintainerPATCH 325/363 iio: tsl2583: Fix division by a zero lux_val
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit af0e1871d79cfbb91f732d2c6fa7558e45c31038 upstream.
The lux_val returned from tsl2583_get_lux can potentially be zero, so check for this to avoid a division by zero and an overflowed gain_trim_val.
Fixes clang scan-build warning:
drivers/iio/light/tsl2583.c:345:40: warning: Either the condition 'lux_val<0' is redundant or there is division by zero at line 345. [zerodivcond]
--- drivers/iio/light/tsl2583.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/iio/light/tsl2583.c +8 -0
@@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(structreturn lux_val; } +/* Avoid division by zero of lux_value later on */ +if (lux_val ==0 ) { +dev_err (&chip->client->dev, +"%s: lux_val of 0 will produce out of range trim_value\n" , + __func__); +return -ENODATA ; + } + gain_trim_val = (unsigned int )(((chip->als_settings.als_cal_target) * chip->als_settings.als_gain_trim) / lux_val);if ((gain_trim_val <250 ) || (gain_trim_val >4000 )) {
Greg Kroah-Hartman
maintainerPATCH 326/363 cdc-wdm: untangle a circular dependency between callback and softint
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
commit 18abf874367456540846319574864e6ff32752e2 upstream.
We have a cycle of callbacks scheduling works which submit URBs with those callbacks. This needs to be blocked, stopped and unblocked to untangle the circle.
--- drivers/usb/class/cdc-wdm.c | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-)
drivers/usb/class/cdc-wdm.c +22 -8
@@ -321,12 +321,23 @@ exit: } -static void kill_urbs (struct wdm_device *desc) +static void poison_urbs (struct wdm_device *desc) {/* the order here is essential */ -usb_kill_urb (desc->command); -usb_kill_urb (desc->validity); -usb_kill_urb (desc->response); +usb_poison_urb (desc->command); +usb_poison_urb (desc->validity); +usb_poison_urb (desc->response); +} + +static void unpoison_urbs (struct wdm_device *desc) +{ +/* +* the order here is not essential +* it is symmetrical just to be nice +*/ +usb_unpoison_urb (desc->response); +usb_unpoison_urb (desc->validity); +usb_unpoison_urb (desc->command); }static void free_urbs (struct wdm_device *desc)
@@ -741,11 +752,12 @@ static int wdm_release(struct inode *inoif (!desc->count) {if (!test_bit (WDM_DISCONNECTING , &desc->flags)) {dev_dbg (&desc->intf->dev,"wdm_release: cleanup\n" ); -kill_urbs (desc); +poison_urbs (desc);spin_lock_irq (&desc->iuspin); desc->resp_count =0 ;spin_unlock_irq (&desc->iuspin); desc->manage_power (desc->intf,0 ); +unpoison_urbs (desc); }else {/* must avoid dev_printk here as desc->intf is invalid */ pr_debug (KBUILD_MODNAME " %s: device gone - cleaning up\n" , __func__);
@@ -1037,9 +1049,9 @@ static void wdm_disconnect(struct usb_inwake_up_all (&desc->wait);mutex_lock (&desc->rlock);mutex_lock (&desc->wlock); +poison_urbs (desc);cancel_work_sync (&desc->rxwork);cancel_work_sync (&desc->service_outs_intr); -kill_urbs (desc);mutex_unlock (&desc->wlock);mutex_unlock (&desc->rlock);
@@ -1080,9 +1092,10 @@ static int wdm_suspend(struct usb_interfset_bit (WDM_SUSPENDING , &desc->flags);spin_unlock_irq (&desc->iuspin);/* callback submits work - order is essential */ -kill_urbs (desc); +poison_urbs (desc);cancel_work_sync (&desc->rxwork);cancel_work_sync (&desc->service_outs_intr); +unpoison_urbs (desc); }if (!PMSG_IS_AUTO (message)) {mutex_unlock (&desc->wlock);
@@ -1140,7 +1153,7 @@ static int wdm_pre_reset(struct usb_intewake_up_all (&desc->wait);mutex_lock (&desc->rlock);mutex_lock (&desc->wlock); -kill_urbs (desc); +poison_urbs (desc);cancel_work_sync (&desc->rxwork);cancel_work_sync (&desc->service_outs_intr);return 0 ;
@@ -1151,6 +1164,7 @@ static int wdm_post_reset(struct usb_intstruct wdm_device *desc =wdm_find_device (intf);int rv; +unpoison_urbs (desc);clear_bit (WDM_OVERFLOW , &desc->flags);clear_bit (WDM_RESETTING , &desc->flags); rv =recover_from_urb_loss (desc);
Greg Kroah-Hartman
maintainerPATCH 327/363 alarmtimer: Check RTC features instead of ops
In reply to Greg Kroah-HartmanFrom: Alexandre Belloni <[email protected]>
commit e09784a8a751e539dffc94d43bc917b0ac1e934a upstream.
RTC drivers used to leave .set_alarm() NULL in order to signal the RTC device doesn't support alarms. The drivers are now clearing the RTC_FEATURE_ALARM bit for that purpose in order to keep the rtc_class_ops structure const. So now, .set_alarm() is set unconditionally and this possibly causes the alarmtimer code to select an RTC device that doesn't support alarms.
Test RTC_FEATURE_ALARM instead of relying on ops->set_alarm to determine whether alarms are available.
--- kernel/time/alarmtimer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/time/alarmtimer.c +1 -1
@@ -92,7 +92,7 @@ static int alarmtimer_rtc_add_device(strif (rtcdev)return -EBUSY ; -if (!rtc->ops->set_alarm) +if (!test_bit (RTC_FEATURE_ALARM , rtc->features))return -1 ;if (!device_may_wakeup (rtc->dev.parent))return -1 ;
Greg Kroah-Hartman
maintainerPATCH 328/363 xen/gntdev: fix gntdev_mmap() error exit path
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
commit 970655aa9b42461f8394e4457307005bdeee14d9 upstream.
Commit d3eeb1d77c5d0af ("xen/gntdev: use mmu_interval_notifier_insert") introduced an error in gntdev_mmap(): in case the call of mmu_interval_notifier_insert_locked() fails the exit path should not call mmu_interval_notifier_remove(), as this might result in NULL dereferences.
One reason for failure is e.g. a signal pending for the running process.
--- drivers/xen/gntdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/xen/gntdev.c +3 -1
@@ -1017,8 +1017,10 @@ static int gntdev_mmap(struct file *flip err =mmu_interval_notifier_insert_locked ( &map->notifier, vma->vm_mm, vma->vm_start, vma->vm_end - vma->vm_start, &gntdev_mmu_ops); -if (err) +if (err) { + map->vma =NULL ; goto out_unlock_put; + } }mutex_unlock (&priv->lock);
Greg Kroah-Hartman
maintainerPATCH 329/363 KVM: x86: Emulate RDPID only if RDTSCP is supported
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 85d0011264da24be08ae907d7f29983a597ca9b1 upstream.
Do not advertise emulation support for RDPID if RDTSCP is unsupported. RDPID emulation subtly relies on MSR_TSC_AUX to exist in hardware, as both vmx_get_msr() and svm_get_msr() will return an error if the MSR is unsupported, i.e. ctxt->ops->get_msr() will fail and the emulator will inject a #UD.
Note, RDPID emulation also relies on RDTSCP being enabled in the guest, but this is a KVM bug and will eventually be fixed.
Message-Id: <[email protected]>
--- arch/x86/kvm/cpuid.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/kvm/cpuid.c +2 -1
@@ -589,7 +589,8 @@ static int __do_cpuid_func_emulated(strucase 7 : entry->flags |=KVM_CPUID_FLAG_SIGNIFCANT_INDEX ; entry->eax =0 ; - entry->ecx =F (RDPID ); +if (kvm_cpu_cap_has (X86_FEATURE_RDTSCP )) + entry->ecx =F (RDPID ); ++array->nent;default :break ;
Greg Kroah-Hartman
maintainerPATCH 330/363 KVM: x86: Move RDPID emulation intercept to its own enum
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 2183de4161b90bd3851ccd3910c87b2c9adfc6ed upstream.
Add a dedicated intercept enum for RDPID instead of piggybacking RDTSCP. Unlike VMX's ENABLE_RDTSCP, RDPID is not bound to SVM's RDTSCP intercept.
Message-Id: <[email protected]>
--- arch/x86/kvm/emulate.c | 2 +- arch/x86/kvm/kvm_emulate.h | 1 + arch/x86/kvm/vmx/vmx.c | 3 ++- 3 files changed, 4 insertions(+), 2 deletions(-)
arch/x86/kvm/emulate.c +1 -1
@@ -4502,7 +4502,7 @@ static const struct opcode group8[] = {* from the register case of group9. */ static const struct gprefix pfx_0f_c7_7 = { -N ,N ,N ,II (DstMem | ModRM | Op3264 | EmulateOnUD, em_rdpid, rdtscp), +N ,N ,N ,II (DstMem | ModRM | Op3264 | EmulateOnUD, em_rdpid, rdpid), };
arch/x86/kvm/kvm_emulate.h +1 -0
@@ -468,6 +468,7 @@ enum x86_intercept { x86_intercept_clgi, x86_intercept_skinit, x86_intercept_rdtscp, + x86_intercept_rdpid, x86_intercept_icebp, x86_intercept_wbinvd, x86_intercept_monitor,
arch/x86/kvm/vmx/vmx.c +2 -1
@@ -7391,8 +7391,9 @@ static int vmx_check_intercept(struct kv/* * RDPID causes #UD if disabled through secondary execution controls. * Because it is marked as EmulateOnUD, we need to intercept it here. +* Note, RDPID is hidden behind ENABLE_RDTSCP. */ -case x86_intercept_rdtscp: +case x86_intercept_rdpid:if (!nested_cpu_has2 (vmcs12,SECONDARY_EXEC_ENABLE_RDTSCP )) { exception->vector =UD_VECTOR ; exception->error_code_valid = false;
Greg Kroah-Hartman
maintainerPATCH 331/363 KVM: x86: Add support for RDPID without RDTSCP
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 36fa06f9ff39f23e03cd8206dc6bbb7711c23be6 upstream.
Allow userspace to enable RDPID for a guest without also enabling RDTSCP. Aside from checking for RDPID support in the obvious flows, VMX also needs to set ENABLE_RDTSCP=1 when RDPID is exposed.
For the record, there is no known scenario where enabling RDPID without RDTSCP is desirable. But, both AMD and Intel architectures allow for the condition, i.e. this is purely to make KVM more architecturally accurate.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/svm.c | 6 ++++-- arch/x86/kvm/vmx/vmx.c | 27 +++++++++++++++++++++++---- arch/x86/kvm/x86.c | 3 ++- 3 files changed, 29 insertions(+), 7 deletions(-)
arch/x86/kvm/svm/svm.c +4 -2
@@ -2741,7 +2741,8 @@ static int svm_get_msr(struct kvm_vcpu *if (!boot_cpu_has (X86_FEATURE_RDTSCP ))return 1 ;if (!msr_info->host_initiated && - !guest_cpuid_has (vcpu,X86_FEATURE_RDTSCP )) + !guest_cpuid_has (vcpu,X86_FEATURE_RDTSCP ) && + !guest_cpuid_has (vcpu,X86_FEATURE_RDPID ))return 1 ; msr_info->data = svm->tsc_aux;break ;
@@ -2952,7 +2953,8 @@ static int svm_set_msr(struct kvm_vcpu *return 1 ;if (!msr->host_initiated && - !guest_cpuid_has (vcpu,X86_FEATURE_RDTSCP )) + !guest_cpuid_has (vcpu,X86_FEATURE_RDTSCP ) && + !guest_cpuid_has (vcpu,X86_FEATURE_RDPID ))return 1 ;/*
arch/x86/kvm/vmx/vmx.c +23 -4
@@ -1734,7 +1734,8 @@ static void setup_msrs(struct vcpu_vmx *if (update_transition_efer (vmx))vmx_setup_uret_msr (vmx,MSR_EFER ); -if (guest_cpuid_has (&vmx->vcpu,X86_FEATURE_RDTSCP )) +if (guest_cpuid_has (&vmx->vcpu,X86_FEATURE_RDTSCP ) || +guest_cpuid_has (&vmx->vcpu,X86_FEATURE_RDPID ))vmx_setup_uret_msr (vmx,MSR_TSC_AUX );vmx_setup_uret_msr (vmx,MSR_IA32_TSX_CTRL );
@@ -1933,7 +1934,8 @@ static int vmx_get_msr(struct kvm_vcpu *break ;case MSR_TSC_AUX :if (!msr_info->host_initiated && - !guest_cpuid_has (vcpu,X86_FEATURE_RDTSCP )) + !guest_cpuid_has (vcpu,X86_FEATURE_RDTSCP ) && + !guest_cpuid_has (vcpu,X86_FEATURE_RDPID ))return 1 ; goto find_uret_msr;case MSR_IA32_DEBUGCTLMSR :
@@ -2230,7 +2232,8 @@ static int vmx_set_msr(struct kvm_vcpu *break ;case MSR_TSC_AUX :if (!msr_info->host_initiated && - !guest_cpuid_has (vcpu,X86_FEATURE_RDTSCP )) + !guest_cpuid_has (vcpu,X86_FEATURE_RDTSCP ) && + !guest_cpuid_has (vcpu,X86_FEATURE_RDPID ))return 1 ;/* Check reserved bit, higher 32 bits should be zero */ if ((data >>32 ) !=0 )
@@ -4302,7 +4305,23 @@ static void vmx_compute_secondary_exec_c xsaves_enabled, false); } -vmx_adjust_sec_exec_feature (vmx, &exec_control, rdtscp,RDTSCP ); +/* +* RDPID is also gated by ENABLE_RDTSCP, turn on the control if either +* feature is exposed to the guest. This creates a virtualization hole +* if both are supported in hardware but only one is exposed to the +* guest, but letting the guest execute RDTSCP or RDPID when either one +* is advertised is preferable to emulating the advertised instruction +* in KVM on #UD, and obviously better than incorrectly injecting #UD. +*/ +if (cpu_has_vmx_rdtscp ()) { +bool rdpid_or_rdtscp_enabled = +guest_cpuid_has (vcpu,X86_FEATURE_RDTSCP ) || +guest_cpuid_has (vcpu,X86_FEATURE_RDPID ); + +vmx_adjust_secondary_exec_control (vmx, &exec_control, +SECONDARY_EXEC_ENABLE_RDTSCP , + rdpid_or_rdtscp_enabled, false); + }vmx_adjust_sec_exec_feature (vmx, &exec_control, invpcid,INVPCID );vmx_adjust_sec_exec_exiting (vmx, &exec_control, rdrand,RDRAND );
arch/x86/kvm/x86.c +2 -1
@@ -5864,7 +5864,8 @@ static void kvm_init_msr_list(void)continue ;break ;case MSR_TSC_AUX : -if (!kvm_cpu_cap_has (X86_FEATURE_RDTSCP )) +if (!kvm_cpu_cap_has (X86_FEATURE_RDTSCP ) && + !kvm_cpu_cap_has (X86_FEATURE_RDPID ))continue ;break ;case MSR_IA32_UMWAIT_CONTROL :
Greg Kroah-Hartman
maintainerPATCH 332/363 KVM: nVMX: Always make an attempt to map eVMCS after migration
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
commit f5c7e8425f18fdb9bdb7d13340651d7876890329 upstream.
When enlightened VMCS is in use and nested state is migrated with vmx_get_nested_state()/vmx_set_nested_state() KVM can't map evmcs page right away: evmcs gpa is not 'struct kvm_vmx_nested_state_hdr' and we can't read it from VP assist page because userspace may decide to restore HV_X64_MSR_VP_ASSIST_PAGE after restoring nested state (and QEMU, for example, does exactly that). To make sure eVMCS is mapped /vmx_set_nested_state() raises KVM_REQ_GET_NESTED_STATE_PAGES request.
Commit f2c7ef3ba955 ("KVM: nSVM: cancel KVM_REQ_GET_NESTED_STATE_PAGES on nested vmexit") added KVM_REQ_GET_NESTED_STATE_PAGES clearing to nested_vmx_vmexit() to make sure MSR permission bitmap is not switched when an immediate exit from L2 to L1 happens right after migration (caused by a pending event, for example). Unfortunately, in the exact same situation we still need to have eVMCS mapped so nested_sync_vmcs12_to_shadow() reflects changes in VMCS12 to eVMCS.
As a band-aid, restore nested_get_evmcs_page() when clearing KVM_REQ_GET_NESTED_STATE_PAGES in nested_vmx_vmexit(). The 'fix' is far from being ideal as we can't easily propagate possible failures and even if we could, this is most likely already too late to do so. The whole 'KVM_REQ_GET_NESTED_STATE_PAGES' idea for mapping eVMCS after migration seems to be fragile as we diverge too much from the 'native' path when vmptr loading happens on vmx_set_nested_state().
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/nested.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-)
arch/x86/kvm/vmx/nested.c +19 -10
@@ -3100,15 +3100,8 @@ static bool nested_get_evmcs_page(structnested_vmx_handle_enlightened_vmptrld (vcpu, false);if (evmptrld_status ==EVMPTRLD_VMFAIL || - evmptrld_status ==EVMPTRLD_ERROR ) { -pr_debug_ratelimited ("%s: enlightened vmptrld failed\n" , - __func__); - vcpu->run->exit_reason =KVM_EXIT_INTERNAL_ERROR ; - vcpu->run->internal.suberror = -KVM_INTERNAL_ERROR_EMULATION ; - vcpu->run->internal.ndata =0 ; + evmptrld_status ==EVMPTRLD_ERROR )return false; - } }return true;
@@ -3196,8 +3189,16 @@ static bool nested_get_vmcs12_pages(strustatic bool vmx_get_nested_state_pages (struct kvm_vcpu *vcpu) { -if (!nested_get_evmcs_page (vcpu)) +if (!nested_get_evmcs_page (vcpu)) { +pr_debug_ratelimited ("%s: enlightened vmptrld failed\n" , + __func__); + vcpu->run->exit_reason =KVM_EXIT_INTERNAL_ERROR ; + vcpu->run->internal.suberror = +KVM_INTERNAL_ERROR_EMULATION ; + vcpu->run->internal.ndata =0 ; +return false; + }if (is_guest_mode (vcpu) && !nested_get_vmcs12_pages (vcpu))return false;
@@ -4424,7 +4425,15 @@ void nested_vmx_vmexit(struct kvm_vcpu */* trying to cancel vmlaunch/vmresume is a bug */ WARN_ON_ONCE (vmx->nested.nested_run_pending); -kvm_clear_request (KVM_REQ_GET_NESTED_STATE_PAGES , vcpu); +if (kvm_check_request (KVM_REQ_GET_NESTED_STATE_PAGES , vcpu)) { +/* +* KVM_REQ_GET_NESTED_STATE_PAGES is also used to map +* Enlightened VMCS after migration and we still need to +* do that when something is forcing L2->L1 exit prior to +* the first L2 run. +*/ + (void )nested_get_evmcs_page (vcpu); + }/* Service the TLB flush request for L2 before switching to L1. */ if (kvm_check_request (KVM_REQ_TLB_FLUSH_CURRENT , vcpu))
Greg Kroah-Hartman
maintainerPATCH 333/363 KVM: VMX: Do not advertise RDPID if ENABLE_RDTSCP control is unsupported
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 8aec21c04caa2000f91cf8822ae0811e4b0c3971 upstream.
Clear KVM's RDPID capability if the ENABLE_RDTSCP secondary exec control is unsupported. Despite being enumerated in a separate CPUID flag, RDPID is bundled under the same VMCS control as RDTSCP and will #UD in VMX non-root if ENABLE_RDTSCP is not enabled.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx/vmx.c +4 -2
@@ -7352,9 +7352,11 @@ static __init void vmx_set_cpu_caps(voidif (!cpu_has_vmx_xsaves ())kvm_cpu_cap_clear (X86_FEATURE_XSAVES ); -/* CPUID 0x80000001 */ -if (!cpu_has_vmx_rdtscp ()) +/* CPUID 0x80000001 and 0x7 (RDPID) */ +if (!cpu_has_vmx_rdtscp ()) {kvm_cpu_cap_clear (X86_FEATURE_RDTSCP ); +kvm_cpu_cap_clear (X86_FEATURE_RDPID ); + }if (cpu_has_vmx_waitpkg ())kvm_cpu_cap_check_and_set (X86_FEATURE_WAITPKG );
Greg Kroah-Hartman
maintainerPATCH 334/363 KVM: VMX: Disable preemption when probing user return MSRs
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 5104d7ffcf24749939bea7fdb5378d186473f890 upstream.
Disable preemption when probing a user return MSR via RDSMR/WRMSR. If the MSR holds a different value per logical CPU, the WRMSR could corrupt the host's value if KVM is preempted between the RDMSR and WRMSR, and then rescheduled on a different CPU.
Opportunistically land the helper in common x86, SVM will use the helper in a future commit.
Message-Id: <[email protected]>
--- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/vmx/vmx.c | 5 +---- arch/x86/kvm/x86.c | 16 ++++++++++++++++ 3 files changed, 18 insertions(+), 4 deletions(-)
arch/x86/include/asm/kvm_host.h +1 -0
@@ -1753,6 +1753,7 @@ int kvm_pv_send_ipi(struct kvm *kvm, uns unsigned long icr, int op_64_bit);void kvm_define_user_return_msr (unsigned index,u32 msr); +int kvm_probe_user_return_msr (u32 msr);int kvm_set_user_return_msr (unsigned index,u64 val,u64 mask);u64 kvm_scale_tsc (struct kvm_vcpu *vcpu,u64 tsc);
arch/x86/kvm/vmx/vmx.c +1 -4
@@ -6914,12 +6914,9 @@ static int vmx_create_vcpu(struct kvm_vcfor (i =0 ; i <ARRAY_SIZE (vmx_uret_msrs_list); ++i) {u32 index = vmx_uret_msrs_list[i]; -u32 data_low, data_high;int j = vmx->nr_uret_msrs; -if (rdmsr_safe (index, &data_low, &data_high) <0 ) -continue ; -if (wrmsr_safe (index, data_low, data_high) <0 ) +if (kvm_probe_user_return_msr (index))continue ; vmx->guest_uret_msrs[j].slot = i;
arch/x86/kvm/x86.c +16 -0
@@ -335,6 +335,22 @@ static void kvm_on_user_return(struct us } } +int kvm_probe_user_return_msr (u32 msr) +{ +u64 val; +int ret; + +preempt_disable (); + ret =rdmsrl_safe (msr, &val); +if (ret) + goto out; + ret =wrmsrl_safe (msr, val); +out: +preempt_enable (); +return ret; +} +EXPORT_SYMBOL_GPL (kvm_probe_user_return_msr); +void kvm_define_user_return_msr (unsigned slot,u32 msr) {BUG_ON (slot >=KVM_MAX_NR_USER_RETURN_MSRS );
Greg Kroah-Hartman
maintainerPATCH 335/363 mm: fix struct page layout on 32-bit systems
In reply to Greg Kroah-HartmanFrom: Matthew Wilcox (Oracle) <[email protected]>
commit 9ddb3c14afba8bc5950ed297f02d4ae05ff35cd1 upstream.
32-bit architectures which expect 8-byte alignment for 8-byte integers and need 64-bit DMA addresses (arm, mips, ppc) had their struct page inadvertently expanded in 2019. When the dma_addr_t was added, it forced the alignment of the union to 8 bytes, which inserted a 4 byte gap between 'flags' and the union.
Fix this by storing the dma_addr_t in one or two adjacent unsigned longs. This restores the alignment to that of an unsigned long. We always store the low bits in the first word to prevent the PageTail bit from being inadvertently set on a big endian platform. If that happened, get_user_pages_fast() racing against a page which was freed and reallocated to the page_pool could dereference a bogus compound_head(), which would be hard to trace back to this cause.
--- include/linux/mm_types.h | 4 ++-- include/net/page_pool.h | 12 +++++++++++- net/core/page_pool.c | 12 +++++++----- 3 files changed, 20 insertions(+), 8 deletions(-)
include/linux/mm_types.h +2 -2
@@ -97,10 +97,10 @@ struct page { };struct {/* page_pool used by netstack */ /** -* @dma_addr: might require a 64-bit value even on +* @dma_addr: might require a 64-bit value on * 32-bit architectures. */ -dma_addr_t dma_addr; +unsigned long dma_addr[2 ]; }; struct { /* slab, slob and slub */ union {
include/net/page_pool.h +11 -1
@@ -198,7 +198,17 @@ static inline void page_pool_recycle_dirstatic inline dma_addr_t page_pool_get_dma_addr (struct page *page) { -return page->dma_addr; +dma_addr_t ret = page->dma_addr[0 ]; +if (sizeof (dma_addr_t) >sizeof (unsigned long )) + ret |= (dma_addr_t )page->dma_addr[1 ] <<16 <<16 ; +return ret; +} + +static inline void page_pool_set_dma_addr (struct page *page,dma_addr_t addr) +{ + page->dma_addr[0 ] = addr; +if (sizeof (dma_addr_t) >sizeof (unsigned long )) + page->dma_addr[1 ] =upper_32_bits (addr); }static inline bool is_page_pool_compiled_in (void )
net/core/page_pool.c +7 -5
@@ -174,8 +174,10 @@ static void page_pool_dma_sync_for_devicstruct page *page, unsigned int dma_sync_size) { + dma_addr_t dma_addr = page_pool_get_dma_addr(page); + dma_sync_size =min (dma_sync_size, pool->p.max_len); -dma_sync_single_range_for_device (pool->p.dev, page->dma_addr, +dma_sync_single_range_for_device (pool->p.dev, dma_addr, pool->p.offset, dma_sync_size, pool->p.dma_dir); }
@@ -226,7 +228,7 @@ static struct page *__page_pool_alloc_paput_page (page);return NULL ; } - page->dma_addr = dma; +page_pool_set_dma_addr (page, dma);if (pool->p.flags &PP_FLAG_DMA_SYNC_DEV )page_pool_dma_sync_for_device (pool, page, pool->p.max_len);
@@ -294,13 +296,13 @@ void page_pool_release_page(struct page_*/ goto skip_dma_unmap; - dma = page->dma_addr; + dma =page_pool_get_dma_addr (page); -/* When page is unmapped, it cannot be returned our pool */ +/* When page is unmapped, it cannot be returned to our pool */ dma_unmap_page_attrs (pool->p.dev, dma,PAGE_SIZE << pool->p.order, pool->p.dma_dir,DMA_ATTR_SKIP_CPU_SYNC ); - page->dma_addr =0 ; +page_pool_set_dma_addr (page,0 ); skip_dma_unmap:/* This may be the last page returned, releasing the pool, so * it is not safe to reference pool afterwards.
Greg Kroah-Hartman
maintainerPATCH 336/363 MIPS: Reinstate platform `__div64_32 handler
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit c49f71f60754acbff37505e1d16ca796bf8a8140 upstream.
Our current MIPS platform __div64_32' handler is inactive, because it is incorrectly only enabled for 64-bit configurations, for which generic do_div' code does not call it anyway.
The handler is not suitable for being called from there though as it only calculates 32 bits of the quotient under the assumption the 64-bit divident has been suitably reduced. Code for such reduction used to be there, however it has been incorrectly removed with commit c21004cd5b4c ("MIPS: Rewrite <asm/div64.h> to work with gcc 4.4.0."), which should have only updated an obsoleted constraint for an inline asm involving $hi and $lo register outputs, while possibly wiring the original MIPS variant of the do_div' macro as __div64_32' handler for the generic `do_div' implementation
Correct the handler as follows then:
- Revert most of the commit referred, however retaining the current formatting, except for the final two instructions of the inline asm sequence, which the original commit missed. Omit the original 64-bit parts though.
- Rename the original do_div' macro to __div64_32'. Use the combined x' constraint referring to the MD accumulator as a whole, replacing the original individual h' and l' constraints used for $hi and $lo registers respectively, of which h' has been obsoleted with GCC 4.4. Update surrounding code accordingly.
We have since removed support for GCC versions before 4.9, so no need for a special arrangement here; GCC has supported the `x' constraint since forever anyway, or at least going back to 1991.
- Rename the __base' local variable in __div64_32' to __radix' to avoid a conflict with a local variable in do_div'.
- Actually enable this code for 32-bit rather than 64-bit configurations by qualifying it with BITS_PER_LONG being 32 instead of 64. Include <asm/bitsperlong.h> for this macro rather than <linux/types.h> as we don't need anything else.
- Finally include <asm-generic/div64.h> last rather than first.
This has passed correctness verification with test_div64 and reduced the module's average execution time down to 1.0668s and 0.2629s from 2.1529s and 0.5647s respectively for an R3400 CPU @40MHz and a 5Kc CPU @160MHz. For a reference 64-bit `do_div' code where we have the DDIVU instruction available to do the whole calculation right away averages at 0.0660s for the latter CPU.
--- arch/mips/include/asm/div64.h | 57 ++++++++++++++++++++++++++++++------------ 1 file changed, 41 insertions(+), 16 deletions(-)
arch/mips/include/asm/div64.h +41 -16
@@ -1,5 +1,5 @@/* -* Copyright (C) 2000, 2004 Maciej W. Rozycki +* Copyright (C) 2000, 2004, 2021 Maciej W. Rozycki * Copyright (C) 2003, 07 Ralf Baechle ([email protected]) * * This file is subject to the terms and conditions of the GNU General Public
@@ -9,25 +9,18 @@#ifndef __ASM_DIV64_H#define __ASM_DIV64_H -#include <asm-generic/div64.h> - -#if BITS_PER_LONG ==64 +#include <asm/bitsperlong.h> -#include <linux/types.h> +#if BITS_PER_LONG ==32 /* * No traps on overflows for any of these... */ -#define __div64_32 (n, base) \ -({ \ +#define do_div64_32 (res, high, low, base) ({ \ unsigned long __cf, __tmp, __tmp2, __i; \ unsigned long __quot32, __mod32; \ - unsigned long __high, __low; \ - unsigned long long __n; \ \ - __high = *__n >> 32; \ - __low = __n; \ __asm__( \ " .set push \n" \ " .set noat \n" \
@@ -51,18 +44,50 @@" subu %0, %0, %z6 \n" \" addiu %2, %2, 1 \n" \"3: \n" \ - " bnez %4, 0b\n\t" \ - " srl %5, %1, 0x1f\n\t" \ +" bnez %4, 0b \n" \ +" srl %5, %1, 0x1f \n" \" .set pop" \ : "=&r" (__mod32), "=&r" (__tmp), \ "=&r" (__quot32), "=&r" (__cf), \ "=&r" (__i), "=&r" (__tmp2) \ - : "Jr" (base), "0" (__high), "1" (__low)); \ + : "Jr" (base), "0" (high), "1" (low)); \ \ - (__n) = __quot32; \ + (res) = __quot32; \ __mod32; \ }) -#endif /* BITS_PER_LONG == 64 */ +#define __div64_32(n, base) ({ \ +unsigned long __upper, __low, __high, __radix; \ +unsigned long long __modquot; \ +unsigned long long __quot; \ +unsigned long long __div; \ +unsigned long __mod; \ + \ + __div = (*n); \ + __radix = (base); \ + \ + __high = __div >>32 ; \ + __low = __div; \ + __upper = __high; \ + \ +if (__high) { \ + __asm__("divu $0, %z1, %z2" \ + :"=x" (__modquot) \ + :"Jr" (__high),"Jr" (__radix)); \ + __upper = __modquot >>32 ; \ + __high = __modquot; \ + } \ + \ + __mod =do_div64_32 (__low, __upper, __low, __radix); \ + \ + __quot = __high; \ + __quot = __quot <<32 | __low; \ + (*n) = __quot; \ + __mod; \ +}) + +#endif /* BITS_PER_LONG == 32 */ + +#include <asm-generic/div64.h> #endif /* __ASM_DIV64_H */
Greg Kroah-Hartman
maintainerPATCH 337/363 MIPS: Avoid DIVU in `__div64_32 is result would be zero
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit c1d337d45ec0a802299688e17d568c4e3a585895 upstream.
We already check the high part of the divident against zero to avoid the costly DIVU instruction in that case, needed to reduce the high part of the divident, so we may well check against the divisor instead and set the high part of the quotient to zero right away. We need to treat the high part the divident in that case though as the remainder that would be calculated by the DIVU instruction we avoided.
This has passed correctness verification with test_div64 and reduced the module's average execution time down to 1.0445s and 0.2619s from 1.0668s and 0.2629s respectively for an R3400 CPU @40MHz and a 5Kc CPU @160MHz.
--- arch/mips/include/asm/div64.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/mips/include/asm/div64.h +4 -2
@@ -68,9 +68,11 @@ \ __high = __div >>32 ; \ __low = __div; \ - __upper = __high; \ \ -if (__high) { \ +if (__high < __radix) { \ + __upper = __high; \ + __high =0 ; \ + }else { \ __asm__("divu $0, %z1, %z2" \ :"=x" (__modquot) \ :"Jr" (__high),"Jr" (__radix)); \
Greg Kroah-Hartman
maintainerPATCH 338/363 MIPS: Avoid handcoded DIVU in `__div64_32 altogether
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit 25ab14cbe9d1b66fda44c71a2db7582a31b6f5cd upstream.
Remove the inline asm with a DIVU instruction from `__div64_32' and use plain C code for the intended DIVMOD calculation instead. GCC is smart enough to know that both the quotient and the remainder are calculated with single DIVU, so with ISAs up to R5 the same instruction is actually produced with overall similar code.
For R6 compiled code will work, but separate DIVU and MODU instructions will be produced, which are also interlocked, so scalar implementations will likely not perform as well as older ISAs with their asynchronous MD unit. Likely still faster then the generic algorithm though.
This removes a compilation error for R6 however where the original DIVU instruction is not supported anymore and the MDU accumulator registers have been removed and consequently GCC complains as to a constraint it cannot find a register for:
In file included from ./include/linux/math.h:5,
from ./include/linux/kernel.h:13,
from mm/page-writeback.c:15:
./include/linux/math64.h: In function 'div_u64_rem':
./arch/mips/include/asm/div64.h:76:17: error: inconsistent operand constraints in an 'asm'
76 | __asm__("divu $0, %z1, %z2" \
| ^~~~~~~
./include/asm-generic/div64.h:245:25: note: in expansion of macro '__div64_32'
245 | __rem = __div64_32(&(n), __base); \
| ^~~~~~~~~~./include/linux/math64.h:91:22: note: in expansion of macro 'do_div'
91 | *remainder = do_div(dividend, divisor);
| ^~~~~~
This has passed correctness verification with test_div64 and reduced the module's average execution time down to 1.0404s from 1.0445s with R3400 @40MHz. The module's MIPS I machine code has also shrunk by 12 bytes or 3 instructions.
--- arch/mips/include/asm/div64.h | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
arch/mips/include/asm/div64.h +2 -6
@@ -58,7 +58,6 @@#define __div64_32 (n, base) ({ \ unsigned long __upper, __low, __high, __radix; \ - unsigned long long __modquot; \ unsigned long long __quot; \ unsigned long long __div; \ unsigned long __mod; \
@@ -73,11 +72,8 @@ __upper = __high; \ __high =0 ; \ }else { \ - __asm__("divu $0, %z1, %z2" \ - :"=x" (__modquot) \ - :"Jr" (__high),"Jr" (__radix)); \ - __upper = __modquot >>32 ; \ - __high = __modquot; \ + __upper = __high % __radix; \ + __high /= __radix; \ } \ \ __mod =do_div64_32 (__low, __upper, __low, __radix); \
Greg Kroah-Hartman
maintainerPATCH 339/363 clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap issue
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
commit 3efe7a878a11c13b5297057bfc1e5639ce1241ce upstream.
There is a timer wrap issue on dra7 for the ARM architected timer. In a typical clock configuration the timer fails to wrap after 388 days.
To work around the issue, we need to use timer-ti-dm timers instead.
Let's prepare for adding support for percpu timers by adding a common dmtimer_clkevt_init_common() and call it from dmtimer_clockevent_init(). This patch makes no intentional functional changes.
--- drivers/clocksource/timer-ti-dm-systimer.c | 68 ++++++++++++++++++----------- 1 file changed, 44 insertions(+), 24 deletions(-)
drivers/clocksource/timer-ti-dm-systimer.c +44 -24
@@ -530,17 +530,17 @@ static void omap_clockevent_unidle(strucwritel_relaxed (OMAP_TIMER_INT_OVERFLOW , t->base + t->wakeup); } -static int __init dmtimer_clockevent_init (struct device_node *np) +static int __init dmtimer_clkevt_init_common (struct dmtimer_clockevent *clkevt, +struct device_node *np, +unsigned int features, +const struct cpumask *cpumask, +const char *name, +int rating) { -struct dmtimer_clockevent *clkevt;struct clock_event_device *dev;struct dmtimer_systimer *t;int error; - clkevt =kzalloc (sizeof (*clkevt),GFP_KERNEL ); -if (!clkevt) -return -ENOMEM ; - t = &clkevt->t; dev = &clkevt->dev;
@@ -548,25 +548,23 @@ static int __init dmtimer_clockevent_ini* We mostly use cpuidle_coupled with ARM local timers for runtime, * so there's probably no use for CLOCK_EVT_FEAT_DYNIRQ here. */ - dev->features =CLOCK_EVT_FEAT_PERIODIC |CLOCK_EVT_FEAT_ONESHOT ; - dev->rating =300 ; + dev->features = features; + dev->rating = rating; dev->set_next_event = dmtimer_set_next_event; dev->set_state_shutdown = dmtimer_clockevent_shutdown; dev->set_state_periodic = dmtimer_set_periodic; dev->set_state_oneshot = dmtimer_clockevent_shutdown; dev->set_state_oneshot_stopped = dmtimer_clockevent_shutdown; dev->tick_resume = dmtimer_clockevent_shutdown; - dev->cpumask = cpu_possible_mask; + dev->cpumask = cpumask; dev->irq =irq_of_parse_and_map (np,0 ); -if (!dev->irq) { - error = -ENXIO ; - goto err_out_free; - } +if (!dev->irq) +return -ENXIO ; error =dmtimer_systimer_setup (np, &clkevt->t);if (error) - goto err_out_free; +return error; clkevt->period =0xffffffff -DIV_ROUND_CLOSEST (t->rate,HZ );
@@ -578,32 +576,54 @@ static int __init dmtimer_clockevent_iniwritel_relaxed (OMAP_TIMER_CTRL_POSTED , t->base + t->ifctrl); error =request_irq (dev->irq, dmtimer_clockevent_interrupt, -IRQF_TIMER ,"clockevent" , clkevt); +IRQF_TIMER , name, clkevt);if (error) goto err_out_unmap;writel_relaxed (OMAP_TIMER_INT_OVERFLOW , t->base + t->irq_ena);writel_relaxed (OMAP_TIMER_INT_OVERFLOW , t->base + t->wakeup); -pr_info ("TI gptimer clockevent: %s%lu Hz at %pOF\n" , -of_find_property (np,"ti,timer-alwon" ,NULL ) ? +pr_info ("TI gptimer %s: %s%lu Hz at %pOF\n" , + name,of_find_property (np,"ti,timer-alwon" ,NULL ) ?"always-on " :"" , t->rate, np->parent); -clockevents_config_and_register (dev, t->rate, -3 ,/* Timer internal resynch latency */ +return 0 ; + +err_out_unmap: +iounmap (t->base); + +return error; +} + +static int __init dmtimer_clockevent_init (struct device_node *np) +{ +struct dmtimer_clockevent *clkevt; +int error; + + clkevt =kzalloc (sizeof (*clkevt),GFP_KERNEL ); +if (!clkevt) +return -ENOMEM ; + + error =dmtimer_clkevt_init_common (clkevt, np, +CLOCK_EVT_FEAT_PERIODIC | +CLOCK_EVT_FEAT_ONESHOT , + cpu_possible_mask,"clockevent" , +300 ); +if (error) + goto err_out_free; + +clockevents_config_and_register (&clkevt->dev, clkevt->t.rate, +3 ,/* Timer internal resync latency */ 0xffffffff );if (of_machine_is_compatible ("ti,am33xx" ) ||of_machine_is_compatible ("ti,am43" )) { - dev->suspend = omap_clockevent_idle; - dev->resume = omap_clockevent_unidle; + clkevt->dev.suspend = omap_clockevent_idle; + clkevt->dev.resume = omap_clockevent_unidle; }return 0 ; -err_out_unmap: -iounmap (t->base); - err_out_free:kfree (clkevt);
Greg Kroah-Hartman
maintainerPATCH 340/363 clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata i940
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
commit 25de4ce5ed02994aea8bc111d133308f6fd62566 upstream.
There is a timer wrap issue on dra7 for the ARM architected timer. In a typical clock configuration the timer fails to wrap after 388 days.
To work around the issue, we need to use timer-ti-dm percpu timers instead.
Let's configure dmtimer3 and 4 as percpu timers by default, and warn about the issue if the dtb is not configured properly.
Let's do this as a single patch so it can be backported to v5.8 and later kernels easily. Note that this patch depends on earlier timer-ti-dm systimer posted mode fixes, and a preparatory clockevent patch "clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap issue".
For more information, please see the errata for "AM572x Sitara Processors Silicon Revisions 1.1, 2.0":
https://www.ti.com/lit/er/sprz429m/sprz429m.pdf
The concept is based on earlier reference patches done by Tero Kristo and Keerthy.
--- arch/arm/boot/dts/dra7-l4.dtsi | 4 - arch/arm/boot/dts/dra7.dtsi | 20 +++++++ drivers/clocksource/timer-ti-dm-systimer.c | 76 +++++++++++++++++++++++++++++ include/linux/cpuhotplug.h | 1 4 files changed, 99 insertions(+), 2 deletions(-)
arch/arm/boot/dts/dra7-l4.dtsi +2 -2
@@ -1168,7 +1168,7 @@ }; }; - target-module@34000 { /* 0x48034000, ap 7 46.0 */ + timer3_target: target-module@34000 { /* 0x48034000, ap 7 46.0 */ compatible = "ti,sysc-omap4-timer", "ti,sysc"; reg = <0x34000 0x4>, <0x34010 0x4>;
@@ -1195,7 +1195,7 @@ }; }; - target-module@36000 { /* 0x48036000, ap 9 4e.0 */ + timer4_target: target-module@36000 { /* 0x48036000, ap 9 4e.0 */ compatible = "ti,sysc-omap4-timer", "ti,sysc"; reg = <0x36000 0x4>, <0x36010 0x4>;
arch/arm/boot/dts/dra7.dtsi +20 -0
@@ -46,6 +46,7 @@ timer { compatible = "arm,armv7-timer"; + status = "disabled"; /* See ARM architected timer wrap erratum i940 */ interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
@@ -1241,3 +1242,22 @@ assigned-clock-parents = <&sys_32k_ck>; }; }; + +/* Local timers, see ARM architected timer wrap erratum i940 */ +&timer3_target { + ti,no-reset-on-init; + ti,no-idle; + timer@0 { + assigned-clocks = <&l4per_clkctrl DRA7_L4PER_TIMER3_CLKCTRL 24>; + assigned-clock-parents = <&timer_sys_clk_div>; + }; +}; + +&timer4_target { + ti,no-reset-on-init; + ti,no-idle; + timer@0 { + assigned-clocks = <&l4per_clkctrl DRA7_L4PER_TIMER4_CLKCTRL 24>; + assigned-clock-parents = <&timer_sys_clk_div>; + }; +};
drivers/clocksource/timer-ti-dm-systimer.c +76 -0
94 lines not on this page · raw message
include/linux/cpuhotplug.h +1 -0
@@ -135,6 +135,7 @@ enum cpuhp_state {CPUHP_AP_RISCV_TIMER_STARTING ,CPUHP_AP_CLINT_TIMER_STARTING ,CPUHP_AP_CSKY_TIMER_STARTING , +CPUHP_AP_TI_GP_TIMER_STARTING ,CPUHP_AP_HYPERV_TIMER_STARTING ,CPUHP_AP_KVM_STARTING , CPUHP_AP_KVM_ARM_VGIC_INIT_STARTING,
Greg Kroah-Hartman
maintainerPATCH 341/363 usb: typec: tcpm: Fix error while calculating PPS out values
In reply to Greg Kroah-HartmanFrom: Badhri Jagan Sridharan <[email protected]>
commit 374157ff88ae1a7f7927331cbc72c1ec11994e8a upstream.
"usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply" introduced a regression for req_out_volt and req_op_curr calculation.
req_out_volt should consider the newly calculated max voltage instead of previously accepted max voltage by the port partner. Likewise, req_op_curr should consider the newly calculated max current instead of previously accepted max current by the port partner.
--- drivers/usb/typec/tcpm/tcpm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/typec/tcpm/tcpm.c +3 -3
@@ -3145,10 +3145,10 @@ static unsigned int tcpm_pd_select_pps_a port->pps_data.req_max_volt =min (pdo_pps_apdo_max_voltage (src),pdo_pps_apdo_max_voltage (snk)); port->pps_data.req_max_curr =min_pps_apdo_current (src, snk); - port->pps_data.req_out_volt =min (port->pps_data.max_volt, -max (port->pps_data.min_volt, + port->pps_data.req_out_volt =min (port->pps_data.req_max_volt, +max (port->pps_data.req_min_volt, port->pps_data.req_out_volt)); - port->pps_data.req_op_curr =min (port->pps_data.max_curr, + port->pps_data.req_op_curr =min (port->pps_data.req_max_curr, port->pps_data.req_op_curr); }
Greg Kroah-Hartman
maintainerPATCH 342/363 kobject_uevent: remove warning in init_uevent_argv()
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit b4104180a2efb85f55e1ba1407885c9421970338 upstream.
syzbot can trigger the WARN() in init_uevent_argv() which isn't the nicest as the code does properly recover and handle the error. So change the WARN() call to pr_warn() and provide some more information on what the buffer size that was needed.
--- lib/kobject_uevent.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
lib/kobject_uevent.c +5 -4
@@ -251,12 +251,13 @@ static int kobj_usermode_filter(struct kstatic int init_uevent_argv (struct kobj_uevent_env *env,const char *subsystem) { +int buffer_size =sizeof (env->buf) - env->buflen;int len; - len =strlcpy (&env->buf[env->buflen], subsystem, -sizeof (env->buf) - env->buflen); -if (len >= (sizeof (env->buf) - env->buflen)) { -WARN (1 ,KERN_ERR "init_uevent_argv: buffer size too small\n" ); + len =strlcpy (&env->buf[env->buflen], subsystem, buffer_size); +if (len >= buffer_size) { +pr_warn ("init_uevent_argv: buffer size of %d too small, needed %d\n" , + buffer_size, len);return -ENOMEM ; }
Greg Kroah-Hartman
maintainerPATCH 343/363 drm/i915/gt: Fix a double free in gen8_preallocate_top_level_pdp
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
commit ea995218dddba171fecd05496c69617c5ef3c5b8 upstream.
Our code analyzer reported a double free bug.
In gen8_preallocate_top_level_pdp, pde and pde->pt.base are allocated via alloc_pd(vm) with one reference. If pin_pt_dma() failed, pde->pt.base is freed by i915_gem_object_put() with a reference dropped. Then free_pd calls free_px() defined in intel_ppgtt.c, which calls i915_gem_object_put() to put pde->pt.base again.
As pde->pt.base is protected by refcount, so the second put will not free pde->pt.base actually. But, maybe it is better to remove the first put?
--- drivers/gpu/drm/i915/gt/gen8_ppgtt.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/i915/gt/gen8_ppgtt.c +0 -1
@@ -630,7 +630,6 @@ static int gen8_preallocate_top_level_pd err =pin_pt_dma (vm, pde->pt.base);if (err) { -i915_gem_object_put (pde->pt.base);free_pd (vm, pde);return err; }
Greg Kroah-Hartman
maintainerPATCH 344/363 drm/msm/dp: check sink_count before update is_connected status
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
commit d9aa6571b28ba0022de1e48801ff03a1854c7ef2 upstream.
Link status is different from display connected status in the case of something like an Apple dongle where the type-c plug can be connected, and therefore the link is connected, but no sink is connected until an HDMI cable is plugged into the dongle. The sink_count of DPCD of dongle will increase to 1 once an HDMI cable is plugged into the dongle so that display connected status will become true. This checking also apply at pm_resume.
Changes in v4:
-- none
--- drivers/gpu/drm/msm/dp/dp_display.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +8 -7
@@ -595,10 +595,8 @@ static int dp_connect_pending_timeout(stmutex_lock (&dp->event_mutex); state = dp->hpd_state; -if (state ==ST_CONNECT_PENDING ) { -dp_display_enable (dp,0 ); +if (state ==ST_CONNECT_PENDING ) dp->hpd_state =ST_CONNECTED ; - }mutex_unlock (&dp->event_mutex);
@@ -677,10 +675,8 @@ static int dp_disconnect_pending_timeoutmutex_lock (&dp->event_mutex); state = dp->hpd_state; -if (state ==ST_DISCONNECT_PENDING ) { -dp_display_disable (dp,0 ); +if (state ==ST_DISCONNECT_PENDING ) dp->hpd_state =ST_DISCONNECTED ; - }mutex_unlock (&dp->event_mutex);
@@ -1279,7 +1275,12 @@ static int dp_pm_resume(struct device *d status =dp_catalog_link_is_connected (dp->catalog); -if (status) +/* +* can not declared display is connected unless +* HDMI cable is plugged in and sink_count of +* dongle become 1 +*/ +if (status && dp->link->sink_count) dp->dp_display.is_connected = true;else dp->dp_display.is_connected = false;
Greg Kroah-Hartman
maintainerPATCH 345/363 drm/i915: Read C0DRB3/C1DRB3 as 16 bits again
In reply to Greg Kroah-HartmanFrom: Ville Syrjälä <[email protected]>
commit 04d019961fd15de92874575536310243a0d4c5c5 upstream.
We've defined C0DRB3/C1DRB3 as 16 bit registers, so access them as such.
--- drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c +2 -2
@@ -670,8 +670,8 @@ static void detect_bit_6_swizzle(struct* banks of memory are paired and unswizzled on the * uneven portion, so leave that as unknown. */ -if (intel_uncore_read (uncore,C0DRB3 ) == -intel_uncore_read (uncore,C1DRB3 )) { +if (intel_uncore_read16 (uncore,C0DRB3 ) == +intel_uncore_read16 (uncore,C1DRB3 )) { swizzle_x =I915_BIT_6_SWIZZLE_9_10 ; swizzle_y =I915_BIT_6_SWIZZLE_9 ; }
Greg Kroah-Hartman
maintainerPATCH 346/363 drm/i915/overlay: Fix active retire callback alignment
In reply to Greg Kroah-HartmanFrom: Tvrtko Ursulin <[email protected]>
commit a915fe5e9601c632417ef5261af70788d7d23a8a upstream.
__i915_active_call annotation is required on the retire callback to ensure correct function alignment.
--- drivers/gpu/drm/i915/display/intel_overlay.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/display/intel_overlay.c +1 -1
@@ -383,7 +383,7 @@ static void intel_overlay_off_tail(struci830_overlay_clock_gating (dev_priv, true); } -static void +__i915_active_call static voidintel_overlay_last_flip_retire (struct i915_active *active) { struct intel_overlay *overlay =
Greg Kroah-Hartman
maintainerPATCH 347/363 drm/i915: Fix crash in auto_retire
In reply to Greg Kroah-HartmanFrom: Stéphane Marchesin <[email protected]>
commit 402be8a101190969fc7ff122d07e262df86e132b upstream.
The retire logic uses the 2 lower bits of the pointer to the retire function to store flags. However, the auto_retire function is not guaranteed to be aligned to a multiple of 4, which causes crashes as we jump to the wrong address, for example like this:
2021-04-24T18:03:53.804300Z WARNING kernel: [ 516.876901] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI 2021-04-24T18:03:53.804310Z WARNING kernel: [ 516.876906] CPU: 7 PID: 146 Comm: kworker/u16:6 Tainted: G U 5.4.105-13595-g3cd84167b2df #1 2021-04-24T18:03:53.804311Z WARNING kernel: [ 516.876907] Hardware name: Google Volteer2/Volteer2, BIOS Google_Volteer2.13672.76.0 02/22/2021 2021-04-24T18:03:53.804312Z WARNING kernel: [ 516.876911] Workqueue: events_unbound active_work 2021-04-24T18:03:53.804313Z WARNING kernel: [ 516.876914] RIP: 0010:auto_retire+0x1/0x20 2021-04-24T18:03:53.804314Z WARNING kernel: [ 516.876916] Code: e8 01 f2 ff ff eb 02 31 db 48 89 d8 5b 5d c3 0f 1f 44 00 00 55 48 89 e5 f0 ff 87 c8 00 00 00 0f 88 ab 47 4a 00 31 c0 5d c3 0f <1f> 44 00 00 55 48 89 e5 f0 ff 8f c8 00 00 00 0f 88 9a 47 4a 00 74 2021-04-24T18:03:53.804319Z WARNING kernel: [ 516.876918] RSP: 0018:ffff9b4d809fbe38 EFLAGS: 00010286 2021-04-24T18:03:53.804320Z WARNING kernel: [ 516.876919] RAX: 0000000000000007 RBX: ffff927915079600 RCX: 0000000000000007 2021-04-24T18:03:53.804320Z WARNING kernel: [ 516.876921] RDX: ffff9b4d809fbe40 RSI: 0000000000000286 RDI: ffff927915079600 2021-04-24T18:03:53.804321Z WARNING kernel: [ 516.876922] RBP: ffff9b4d809fbe68 R08: 8080808080808080 R09: fefefefefefefeff 2021-04-24T18:03:53.804321Z WARNING kernel: [ 516.876924] R10: 0000000000000010 R11: ffffffff92e44bd8 R12: ffff9279150796a0 2021-04-24T18:03:53.804322Z WARNING kernel: [ 516.876925] R13: ffff92791c368180 R14: ffff927915079640 R15: 000000001c867605 2021-04-24T18:03:53.804323Z WARNING kernel: [ 516.876926] FS: 0000000000000000(0000) GS:ffff92791ffc0000(0000) knlGS:0000000000000000 2021-04-24T18:03:53.804323Z WARNING kernel: [ 516.876928] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 2021-04-24T18:03:53.804324Z WARNING kernel: [ 516.876929] CR2: 0000239514955000 CR3: 00000007f82da001 CR4: 0000000000760ee0 2021-04-24T18:03:53.804325Z WARNING kernel: [ 516.876930] PKRU: 55555554 2021-04-24T18:03:53.804325Z WARNING kernel: [ 516.876931] Call Trace: 2021-04-24T18:03:53.804326Z WARNING kernel: [ 516.876935] __active_retire+0x77/0xcf 2021-04-24T18:03:53.804326Z WARNING kernel: [ 516.876939] process_one_work+0x1da/0x394 2021-04-24T18:03:53.804327Z WARNING kernel: [ 516.876941] worker_thread+0x216/0x375 2021-04-24T18:03:53.804327Z WARNING kernel: [ 516.876944] kthread+0x147/0x156 2021-04-24T18:03:53.804335Z WARNING kernel: [ 516.876946] ? pr_cont_work+0x58/0x58 2021-04-24T18:03:53.804335Z WARNING kernel: [ 516.876948] ? kthread_blkcg+0x2e/0x2e 2021-04-24T18:03:53.804336Z WARNING kernel: [ 516.876950] ret_from_fork+0x1f/0x40 2021-04-24T18:03:53.804336Z WARNING kernel: [ 516.876952] Modules linked in: cdc_mbim cdc_ncm cdc_wdm xt_cgroup rfcomm cmac algif_hash algif_skcipher af_alg xt_MASQUERADE uinput snd_soc_rt5682_sdw snd_soc_rt5682 snd_soc_max98373_sdw snd_soc_max98373 snd_soc_rl6231 regmap_sdw snd_soc_sof_sdw snd_soc_hdac_hdmi snd_soc_dmic snd_hda_codec_hdmi snd_sof_pci snd_sof_intel_hda_common intel_ipu6_psys snd_sof_xtensa_dsp soundwire_intel soundwire_generic_allocation soundwire_cadence snd_sof_intel_hda snd_sof snd_soc_hdac_hda snd_soc_acpi_intel_match snd_soc_acpi snd_hda_ext_core soundwire_bus snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hwdep snd_hda_core intel_ipu6_isys videobuf2_dma_contig videobuf2_v4l2 videobuf2_common videobuf2_memops mei_hdcp intel_ipu6 ov2740 ov8856 at24 sx9310 dw9768 v4l2_fwnode cros_ec_typec intel_pmc_mux roles acpi_als typec fuse iio_trig_sysfs cros_ec_light_prox cros_ec_lid_angle cros_ec_sensors cros_ec_sensors_core industrialio_triggered_buffer cros_ec_sensors_ring kfifo_buf industrialio cros_ec_sensorhub 2021-04-24T18:03:53.804337Z WARNING kernel: [ 516.876972] cdc_ether usbnet iwlmvm lzo_rle lzo_compress iwl7000_mac80211 iwlwifi zram cfg80211 r8152 mii btusb btrtl btintel btbcm bluetooth ecdh_generic ecc joydev 2021-04-24T18:03:53.804337Z EMERG kernel: [ 516.879169] gsmi: Log Shutdown Reason 0x03
This change fixes this by aligning the function.
--- drivers/gpu/drm/i915/i915_active.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/i915_active.c +2 -1
@@ -1156,7 +1156,8 @@ static int auto_active(struct i915_activreturn 0 ; } -static void auto_retire (struct i915_active *ref) +__i915_active_call static void +auto_retire (struct i915_active *ref) {i915_active_put (ref); }
Greg Kroah-Hartman
maintainerPATCH 348/363 clk: exynos7: Mark aclk_fsys1_200 as critical
In reply to Greg Kroah-HartmanFrom: Paweł Chmiel <[email protected]>
commit 34138a59b92c1a30649a18ec442d2e61f3bc34dd upstream.
This clock must be always enabled to allow access to any registers in fsys1 CMU. Until proper solution based on runtime PM is applied (similar to what was done for Exynos5433), mark that clock as critical so it won't be disabled.
It was observed on Samsung Galaxy S6 device (based on Exynos7420), where UFS module is probed before pmic used to power that device. In this case defer probe was happening and that clock was disabled by UFS driver, causing whole boot to hang on next CMU access.
--- drivers/clk/samsung/clk-exynos7.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/clk/samsung/clk-exynos7.c +6 -1
@@ -537,8 +537,13 @@ static const struct samsung_gate_clock tGATE (CLK_ACLK_FSYS0_200 ,"aclk_fsys0_200" ,"dout_aclk_fsys0_200" ,ENABLE_ACLK_TOP13 ,28 ,CLK_SET_RATE_PARENT |CLK_IS_CRITICAL ,0 ), +/* +* This clock is required for the CMU_FSYS1 registers access, keep it +* enabled permanently until proper runtime PM support is added. +*/ GATE (CLK_ACLK_FSYS1_200 ,"aclk_fsys1_200" ,"dout_aclk_fsys1_200" , -ENABLE_ACLK_TOP13 ,24 ,CLK_SET_RATE_PARENT ,0 ), +ENABLE_ACLK_TOP13 ,24 ,CLK_SET_RATE_PARENT | +CLK_IS_CRITICAL ,0 ), GATE(CLK_SCLK_PHY_FSYS1_26M, "sclk_phy_fsys1_26m", "dout_sclk_phy_fsys1_26m", ENABLE_SCLK_TOP1_FSYS11,
Greg Kroah-Hartman
maintainerPATCH 349/363 soc: mediatek: pm-domains: Add a meaningful power domain name
In reply to Greg Kroah-HartmanFrom: Enric Balletbo i Serra <[email protected]>
commit 022b02b4505ecea5eda02b18683531e49f7d8eb7 upstream.
Add the power domains names to the power domain struct so we have meaningful name for every power domain. This also removes the following debugfs error message.
[ 2.242068] debugfs: Directory 'power-domain' with parent 'pm_genpd' already present! [ 2.249949] debugfs: Directory 'power-domain' with parent 'pm_genpd' already present! [ 2.257784] debugfs: Directory 'power-domain' with parent 'pm_genpd' already present! ...
--- drivers/soc/mediatek/mt8173-pm-domains.h | 10 ++++++++++ drivers/soc/mediatek/mtk-pm-domains.c | 6 +++++- drivers/soc/mediatek/mtk-pm-domains.h | 2 ++ 3 files changed, 17 insertions(+), 1 deletion(-)
drivers/soc/mediatek/mt8173-pm-domains.h +10 -0
@@ -12,24 +12,28 @@static const struct scpsys_domain_data scpsys_domain_data_mt8173[] = { [MT8173_POWER_DOMAIN_VDEC ] = { + .name ="vdec" , .sta_mask =PWR_STATUS_VDEC , .ctl_offs =SPM_VDE_PWR_CON , .sram_pdn_bits =GENMASK (11 ,8 ), .sram_pdn_ack_bits =GENMASK (12 ,12 ), }, [MT8173_POWER_DOMAIN_VENC ] = { + .name ="venc" , .sta_mask =PWR_STATUS_VENC , .ctl_offs =SPM_VEN_PWR_CON , .sram_pdn_bits =GENMASK (11 ,8 ), .sram_pdn_ack_bits =GENMASK (15 ,12 ), }, [MT8173_POWER_DOMAIN_ISP ] = { + .name ="isp" , .sta_mask =PWR_STATUS_ISP , .ctl_offs =SPM_ISP_PWR_CON , .sram_pdn_bits =GENMASK (11 ,8 ), .sram_pdn_ack_bits =GENMASK (13 ,12 ), }, [MT8173_POWER_DOMAIN_MM ] = { + .name ="mm" , .sta_mask =PWR_STATUS_DISP , .ctl_offs =SPM_DIS_PWR_CON , .sram_pdn_bits =GENMASK (11 ,8 ),
@@ -40,18 +44,21 @@ static const struct scpsys_domain_data s }, }, [MT8173_POWER_DOMAIN_VENC_LT] = { + .name = "venc_lt", .sta_mask = PWR_STATUS_VENC_LT, .ctl_offs = SPM_VEN2_PWR_CON, .sram_pdn_bits = GENMASK(11, 8), .sram_pdn_ack_bits = GENMASK(15, 12), }, [MT8173_POWER_DOMAIN_AUDIO] = { + .name = "audio", .sta_mask = PWR_STATUS_AUDIO, .ctl_offs = SPM_AUDIO_PWR_CON, .sram_pdn_bits = GENMASK(11, 8), .sram_pdn_ack_bits = GENMASK(15, 12), }, [MT8173_POWER_DOMAIN_USB] = { + .name = "usb", .sta_mask = PWR_STATUS_USB, .ctl_offs = SPM_USB_PWR_CON, .sram_pdn_bits = GENMASK(11, 8),
@@ -59,18 +66,21 @@ static const struct scpsys_domain_data s .caps = MTK_SCPD_ACTIVE_WAKEUP, }, [MT8173_POWER_DOMAIN_MFG_ASYNC] = { + .name = "mfg_async", .sta_mask = PWR_STATUS_MFG_ASYNC, .ctl_offs = SPM_MFG_ASYNC_PWR_CON, .sram_pdn_bits = GENMASK(11, 8), .sram_pdn_ack_bits = 0, }, [MT8173_POWER_DOMAIN_MFG_2D] = { + .name = "mfg_2d", .sta_mask = PWR_STATUS_MFG_2D, .ctl_offs = SPM_MFG_2D_PWR_CON, .sram_pdn_bits = GENMASK(11, 8), .sram_pdn_ack_bits = GENMASK(13, 12), }, [MT8173_POWER_DOMAIN_MFG] = { + .name = "mfg", .sta_mask = PWR_STATUS_MFG, .ctl_offs = SPM_MFG_PWR_CON, .sram_pdn_bits = GENMASK(13, 8),
drivers/soc/mediatek/mtk-pm-domains.c +5 -1
@@ -438,7 +438,11 @@ generic_pm_domain *scpsys_add_one_domain goto err_unprepare_subsys_clocks; } - pd->genpd.name = node->name; +if (!pd->data->name) + pd->genpd.name = node->name; +else + pd->genpd.name = pd->data->name; + pd->genpd.power_off = scpsys_power_off; pd->genpd.power_on = scpsys_power_on;
drivers/soc/mediatek/mtk-pm-domains.h +2 -0
@@ -76,6 +76,7 @@ struct scpsys_bus_prot_data {/** * struct scpsys_domain_data - scp domain data for power on/off flow +* @name: The name of the power domain. * @sta_mask: The mask for power on/off status bit. * @ctl_offs: The offset for main power control register. * @sram_pdn_bits: The mask for sram power control bits.
@@ -85,6 +86,7 @@ struct scpsys_bus_prot_data {* @bp_smi: bus protection for smi subsystem */ struct scpsys_domain_data { +const char *name;u32 sta_mask;int ctl_offs;u32 sram_pdn_bits;
Greg Kroah-Hartman
maintainerPATCH 350/363 soc: mediatek: pm-domains: Add a power domain names for mt8183
In reply to Greg Kroah-HartmanFrom: Enric Balletbo i Serra <[email protected]>
commit e57b8112258ed46dff23b49d6e400f54a8dbf1c3 upstream.
Add the power domains names for the mt8183 SoC. This removes the debugfs errors like the following:
debugfs: Directory 'power-domain' with parent 'pm_genpd' already present!
--- drivers/soc/mediatek/mt8183-pm-domains.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/soc/mediatek/mt8183-pm-domains.h +15 -0
@@ -12,12 +12,14 @@static const struct scpsys_domain_data scpsys_domain_data_mt8183[] = { [MT8183_POWER_DOMAIN_AUDIO ] = { + .name ="audio" , .sta_mask =PWR_STATUS_AUDIO , .ctl_offs =0x0314 , .sram_pdn_bits =GENMASK (11 ,8 ), .sram_pdn_ack_bits =GENMASK (15 ,12 ), }, [MT8183_POWER_DOMAIN_CONN ] = { + .name ="conn" , .sta_mask =PWR_STATUS_CONN , .ctl_offs =0x032c , .sram_pdn_bits =0 ,
@@ -28,12 +30,14 @@ static const struct scpsys_domain_data s }, }, [MT8183_POWER_DOMAIN_MFG_ASYNC] = { + .name = "mfg_async", .sta_mask = PWR_STATUS_MFG_ASYNC, .ctl_offs = 0x0334, .sram_pdn_bits = 0, .sram_pdn_ack_bits = 0, }, [MT8183_POWER_DOMAIN_MFG] = { + .name = "mfg", .sta_mask = PWR_STATUS_MFG, .ctl_offs = 0x0338, .sram_pdn_bits = GENMASK(8, 8),
@@ -41,18 +45,21 @@ static const struct scpsys_domain_data s .caps = MTK_SCPD_DOMAIN_SUPPLY, }, [MT8183_POWER_DOMAIN_MFG_CORE0] = { + .name = "mfg_core0", .sta_mask = BIT(7), .ctl_offs = 0x034c, .sram_pdn_bits = GENMASK(8, 8), .sram_pdn_ack_bits = GENMASK(12, 12), }, [MT8183_POWER_DOMAIN_MFG_CORE1] = { + .name = "mfg_core1", .sta_mask = BIT(20), .ctl_offs = 0x0310, .sram_pdn_bits = GENMASK(8, 8), .sram_pdn_ack_bits = GENMASK(12, 12), }, [MT8183_POWER_DOMAIN_MFG_2D] = { + .name = "mfg_2d", .sta_mask = PWR_STATUS_MFG_2D, .ctl_offs = 0x0348, .sram_pdn_bits = GENMASK(8, 8),
@@ -65,6 +72,7 @@ static const struct scpsys_domain_data s }, }, [MT8183_POWER_DOMAIN_DISP] = { + .name = "disp", .sta_mask = PWR_STATUS_DISP, .ctl_offs = 0x030c, .sram_pdn_bits = GENMASK(8, 8),
@@ -83,6 +91,7 @@ static const struct scpsys_domain_data s }, }, [MT8183_POWER_DOMAIN_CAM] = { + .name = "cam", .sta_mask = BIT(25), .ctl_offs = 0x0344, .sram_pdn_bits = GENMASK(9, 8),
@@ -105,6 +114,7 @@ static const struct scpsys_domain_data s }, }, [MT8183_POWER_DOMAIN_ISP] = { + .name = "isp", .sta_mask = PWR_STATUS_ISP, .ctl_offs = 0x0308, .sram_pdn_bits = GENMASK(9, 8),
@@ -127,6 +137,7 @@ static const struct scpsys_domain_data s }, }, [MT8183_POWER_DOMAIN_VDEC] = { + .name = "vdec", .sta_mask = BIT(31), .ctl_offs = 0x0300, .sram_pdn_bits = GENMASK(8, 8),
@@ -139,6 +150,7 @@ static const struct scpsys_domain_data s }, }, [MT8183_POWER_DOMAIN_VENC] = { + .name = "venc", .sta_mask = PWR_STATUS_VENC, .ctl_offs = 0x0304, .sram_pdn_bits = GENMASK(11, 8),
@@ -151,6 +163,7 @@ static const struct scpsys_domain_data s }, }, [MT8183_POWER_DOMAIN_VPU_TOP] = { + .name = "vpu_top", .sta_mask = BIT(26), .ctl_offs = 0x0324, .sram_pdn_bits = GENMASK(8, 8),
@@ -177,6 +190,7 @@ static const struct scpsys_domain_data s }, }, [MT8183_POWER_DOMAIN_VPU_CORE0] = { + .name = "vpu_core0", .sta_mask = BIT(27), .ctl_offs = 0x33c, .sram_pdn_bits = GENMASK(11, 8),
@@ -194,6 +208,7 @@ static const struct scpsys_domain_data s .caps = MTK_SCPD_SRAM_ISO, }, [MT8183_POWER_DOMAIN_VPU_CORE1] = { + .name = "vpu_core1", .sta_mask = BIT(28), .ctl_offs = 0x0340, .sram_pdn_bits = GENMASK(11, 8),
Greg Kroah-Hartman
maintainerPATCH 351/363 soc: mediatek: pm-domains: Add a power domain names for mt8192
In reply to Greg Kroah-HartmanFrom: Enric Balletbo i Serra <[email protected]>
commit 3edc01bc53c639b1c98f57e7f1c026aae6a25a62 upstream.
Add the power domains names for the mt8192 SoC.
--- drivers/soc/mediatek/mt8192-pm-domains.h | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/soc/mediatek/mt8192-pm-domains.h +21 -0
@@ -12,6 +12,7 @@static const struct scpsys_domain_data scpsys_domain_data_mt8192[] = { [MT8192_POWER_DOMAIN_AUDIO ] = { + .name ="audio" , .sta_mask =BIT (21 ), .ctl_offs =0x0354 , .sram_pdn_bits =GENMASK (8 ,8 ),
@@ -24,6 +25,7 @@ static const struct scpsys_domain_data s }, }, [MT8192_POWER_DOMAIN_CONN] = { + .name = "conn", .sta_mask = PWR_STATUS_CONN, .ctl_offs = 0x0304, .sram_pdn_bits = 0,
@@ -45,12 +47,14 @@ static const struct scpsys_domain_data s .caps = MTK_SCPD_KEEP_DEFAULT_OFF, }, [MT8192_POWER_DOMAIN_MFG0] = { + .name = "mfg0", .sta_mask = BIT(2), .ctl_offs = 0x0308, .sram_pdn_bits = GENMASK(8, 8), .sram_pdn_ack_bits = GENMASK(12, 12), }, [MT8192_POWER_DOMAIN_MFG1] = { + .name = "mfg1", .sta_mask = BIT(3), .ctl_offs = 0x030c, .sram_pdn_bits = GENMASK(8, 8),
@@ -75,36 +79,42 @@ static const struct scpsys_domain_data s }, }, [MT8192_POWER_DOMAIN_MFG2] = { + .name = "mfg2", .sta_mask = BIT(4), .ctl_offs = 0x0310, .sram_pdn_bits = GENMASK(8, 8), .sram_pdn_ack_bits = GENMASK(12, 12), }, [MT8192_POWER_DOMAIN_MFG3] = { + .name = "mfg3", .sta_mask = BIT(5), .ctl_offs = 0x0314, .sram_pdn_bits = GENMASK(8, 8), .sram_pdn_ack_bits = GENMASK(12, 12), }, [MT8192_POWER_DOMAIN_MFG4] = { + .name = "mfg4", .sta_mask = BIT(6), .ctl_offs = 0x0318, .sram_pdn_bits = GENMASK(8, 8), .sram_pdn_ack_bits = GENMASK(12, 12), }, [MT8192_POWER_DOMAIN_MFG5] = { + .name = "mfg5", .sta_mask = BIT(7), .ctl_offs = 0x031c, .sram_pdn_bits = GENMASK(8, 8), .sram_pdn_ack_bits = GENMASK(12, 12), }, [MT8192_POWER_DOMAIN_MFG6] = { + .name = "mfg6", .sta_mask = BIT(8), .ctl_offs = 0x0320, .sram_pdn_bits = GENMASK(8, 8), .sram_pdn_ack_bits = GENMASK(12, 12), }, [MT8192_POWER_DOMAIN_DISP] = { + .name = "disp", .sta_mask = BIT(20), .ctl_offs = 0x0350, .sram_pdn_bits = GENMASK(8, 8),
@@ -133,6 +143,7 @@ static const struct scpsys_domain_data s }, }, [MT8192_POWER_DOMAIN_IPE] = { + .name = "ipe", .sta_mask = BIT(14), .ctl_offs = 0x0338, .sram_pdn_bits = GENMASK(8, 8),
@@ -149,6 +160,7 @@ static const struct scpsys_domain_data s }, }, [MT8192_POWER_DOMAIN_ISP] = { + .name = "isp", .sta_mask = BIT(12), .ctl_offs = 0x0330, .sram_pdn_bits = GENMASK(8, 8),
@@ -165,6 +177,7 @@ static const struct scpsys_domain_data s }, }, [MT8192_POWER_DOMAIN_ISP2] = { + .name = "isp2", .sta_mask = BIT(13), .ctl_offs = 0x0334, .sram_pdn_bits = GENMASK(8, 8),
@@ -181,6 +194,7 @@ static const struct scpsys_domain_data s }, }, [MT8192_POWER_DOMAIN_MDP] = { + .name = "mdp", .sta_mask = BIT(19), .ctl_offs = 0x034c, .sram_pdn_bits = GENMASK(8, 8),
@@ -197,6 +211,7 @@ static const struct scpsys_domain_data s }, }, [MT8192_POWER_DOMAIN_VENC] = { + .name = "venc", .sta_mask = BIT(17), .ctl_offs = 0x0344, .sram_pdn_bits = GENMASK(8, 8),
@@ -213,6 +228,7 @@ static const struct scpsys_domain_data s }, }, [MT8192_POWER_DOMAIN_VDEC] = { + .name = "vdec", .sta_mask = BIT(15), .ctl_offs = 0x033c, .sram_pdn_bits = GENMASK(8, 8),
@@ -229,12 +245,14 @@ static const struct scpsys_domain_data s }, }, [MT8192_POWER_DOMAIN_VDEC2] = { + .name = "vdec2", .sta_mask = BIT(16), .ctl_offs = 0x0340, .sram_pdn_bits = GENMASK(8, 8), .sram_pdn_ack_bits = GENMASK(12, 12), }, [MT8192_POWER_DOMAIN_CAM] = { + .name = "cam", .sta_mask = BIT(23), .ctl_offs = 0x035c, .sram_pdn_bits = GENMASK(8, 8),
@@ -263,18 +281,21 @@ static const struct scpsys_domain_data s }, }, [MT8192_POWER_DOMAIN_CAM_RAWA] = { + .name = "cam_rawa", .sta_mask = BIT(24), .ctl_offs = 0x0360, .sram_pdn_bits = GENMASK(8, 8), .sram_pdn_ack_bits = GENMASK(12, 12), }, [MT8192_POWER_DOMAIN_CAM_RAWB] = { + .name = "cam_rawb", .sta_mask = BIT(25), .ctl_offs = 0x0364, .sram_pdn_bits = GENMASK(8, 8), .sram_pdn_ack_bits = GENMASK(12, 12), }, [MT8192_POWER_DOMAIN_CAM_RAWC] = { + .name = "cam_rawc", .sta_mask = BIT(26), .ctl_offs = 0x0368, .sram_pdn_bits = GENMASK(8, 8),
Greg Kroah-Hartman
maintainerPATCH 352/363 media: rkvdec: Remove of_match_ptr()
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
commit c2357dd9cbafc8ed37156e32c24884cfa8380b2f upstream.
When building with CONFIG_OF not set, the following clang build warning is seen:
Quoted 1 line
Quoted 1 line
drivers/staging/media/rkvdec/rkvdec.c:967:34: warning: unused variable 'of_rkvdec_match' [-Wunused-const-variable]
Fix the warning by removing the unnecessary of_match_ptr().
--- drivers/staging/media/rkvdec/rkvdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/media/rkvdec/rkvdec.c +1 -1
@@ -1072,7 +1072,7 @@ static struct platform_driver rkvdec_dri .remove = rkvdec_remove, .driver = { .name = "rkvdec", - .of_match_table = of_match_ptr(of_rkvdec_match), + .of_match_table = of_rkvdec_match, .pm = &rkvdec_pm_ops, }, };
Greg Kroah-Hartman
maintainerPATCH 353/363 i2c: mediatek: Fix send master code at more than 1MHz
In reply to Greg Kroah-HartmanFrom: Qii Wang <[email protected]>
commit 63ce8e3df8f6deca2da52eaf064751ad4018b46e upstream.
There are some omissions in the previous patch about replacing I2C_MAX_FAST_MODE__FREQ with I2C_MAX_FAST_MODE_PLUS_FREQ and need to fix it.
--- drivers/i2c/busses/i2c-mt65xx.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-mt65xx.c +5 -4
@@ -564,7 +564,7 @@ static const struct i2c_spec_values *mtkstatic int mtk_i2c_max_step_cnt (unsigned int target_speed) { -if (target_speed >I2C_MAX_FAST_MODE_FREQ ) +if (target_speed >I2C_MAX_FAST_MODE_PLUS_FREQ )return MAX_HS_STEP_CNT_DIV ;else return MAX_STEP_CNT_DIV ;
@@ -635,7 +635,7 @@ static int mtk_i2c_check_ac_timing(strucif (sda_min > sda_max)return -3 ; -if (check_speed >I2C_MAX_FAST_MODE_FREQ ) { +if (check_speed >I2C_MAX_FAST_MODE_PLUS_FREQ ) {if (i2c->dev_comp->ltiming_adjust) { i2c->ac_timing.hs =I2C_TIME_DEFAULT_VALUE | (sample_cnt <<12 ) | (high_cnt <<8 );
@@ -850,7 +850,7 @@ static int mtk_i2c_do_transfer(struct mt control_reg =mtk_i2c_readw (i2c,OFFSET_CONTROL ) & ~(I2C_CONTROL_DIR_CHANGE |I2C_CONTROL_RS ); -if ((i2c->speed_hz >I2C_MAX_FAST_MODE_FREQ ) || (left_num >=1 )) +if ((i2c->speed_hz >I2C_MAX_FAST_MODE_PLUS_FREQ ) || (left_num >=1 )) control_reg |=I2C_CONTROL_RS ;if (i2c->op ==I2C_MASTER_WRRD )
@@ -1067,7 +1067,8 @@ static int mtk_i2c_transfer(struct i2c_a } } -if (i2c->auto_restart && num >=2 && i2c->speed_hz >I2C_MAX_FAST_MODE_FREQ ) +if (i2c->auto_restart && num >=2 && + i2c->speed_hz >I2C_MAX_FAST_MODE_PLUS_FREQ )/* ignore the first restart irq after the master code, * otherwise the first transfer will be discarded. */
Greg Kroah-Hartman
maintainerPATCH 355/363 dt-bindings: thermal: rcar-gen3-thermal: Support five TSC nodes on r8a779a0
In reply to Greg Kroah-HartmanFrom: Niklas Söderlund <[email protected]>
commit 9468e7b031876935230182628f8d5f216c071784 upstream.
When adding support for V3U (r8a779a0) it was incorrectly recorded it supports four nodes, while in fact it supports five. The fifth node is named TSC0 and breaks the existing naming schema starting at 1. Work around this by separately defining the reg property for V3U and others.
Restore the maximum number of nodes to three for other compatibles as it was before erroneously increasing it for V3U.
--- Documentation/devicetree/bindings/thermal/rcar-gen3-thermal.yaml | 43 ++++++++-- 1 file changed, 35 insertions(+), 8 deletions(-)
Documentation/devicetree/bindings/thermal/rcar-gen3-thermal.yaml +35 -8
@@ -28,14 +28,7 @@ properties: - renesas,r8a77980-thermal # R-Car V3H - renesas,r8a779a0-thermal # R-Car V3U - reg: - minItems: 2 - maxItems: 4 - items: - - description: TSC1 registers - - description: TSC2 registers - - description: TSC3 registers - - description: TSC4 registers + reg: true interrupts: items:
@@ -71,8 +64,25 @@ if: enum: - renesas,r8a779a0-thermal then: + properties: + reg: + minItems: 2 + maxItems: 3 + items: + - description: TSC1 registers + - description: TSC2 registers + - description: TSC3 registers required: - interrupts +else: + properties: + reg: + items: + - description: TSC0 registers + - description: TSC1 registers + - description: TSC2 registers + - description: TSC3 registers + - description: TSC4 registers additionalProperties: false
@@ -111,3 +121,20 @@ examples: }; }; }; + - | + #include <dt-bindings/clock/r8a779a0-cpg-mssr.h> + #include <dt-bindings/interrupt-controller/arm-gic.h> + #include <dt-bindings/power/r8a779a0-sysc.h> + + tsc_r8a779a0: thermal@e6190000 { + compatible = "renesas,r8a779a0-thermal"; + reg = <0xe6190000 0x200>, + <0xe6198000 0x200>, + <0xe61a0000 0x200>, + <0xe61a8000 0x200>, + <0xe61b0000 0x200>; + clocks = <&cpg CPG_MOD 919>; + power-domains = <&sysc R8A779A0_PD_ALWAYS_ON>; + resets = <&cpg 919>; + #thermal-sensor-cells = <1>; + };
Greg Kroah-Hartman
maintainerPATCH 356/363 arm64: dts: renesas: falcon: Move console config to CPU board DTS
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit e86ff34cc44a49aeae2af74444560b17a0a96c78 upstream.
The serial console is located on the Falcon CPU board. Hence move serial console configuration from the main Falcon DTS file to the DTS file that describes the CPU board.
--- arch/arm64/boot/dts/renesas/r8a779a0-falcon-cpu.dtsi | 8 ++++++++ arch/arm64/boot/dts/renesas/r8a779a0-falcon.dts | 5 ----- 2 files changed, 8 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/renesas/r8a779a0-falcon-cpu.dtsi +8 -0
@@ -12,6 +12,14 @@ model = "Renesas Falcon CPU board"; compatible = "renesas,falcon-cpu", "renesas,r8a779a0"; + aliases { + serial0 = &scif0; + }; + + chosen { + stdout-path = "serial0:115200n8"; + }; + memory@48000000 { device_type = "memory"; /* first 128MB is reserved for secure area. */
arch/arm64/boot/dts/renesas/r8a779a0-falcon.dts +0 -5
@@ -14,11 +14,6 @@ aliases { ethernet0 = &avb0; - serial0 = &scif0; - }; - - chosen { - stdout-path = "serial0:115200n8"; }; };
Greg Kroah-Hartman
maintainerPATCH 357/363 dt-bindings: phy: qcom,qmp-usb3-dp-phy: move usb3 compatibles back to qcom,qmp-phy.yaml
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
commit 94c34600b6173a2b9dd7d9694a42d86fb8768e62 upstream.
The commit 724fabf5df13 ("dt-bindings: phy: qcom,qmp-usb3-dp: Add DP phy information") has support for DP part of USB3+DP combo PHYs. However this change is not backwards compatible, placing additional requirements onto qcom,sc7180-qmp-usb3-phy and qcom,sdm845-qmp-usb3-phy device nodes (to include separate DP part, etc). However the aforementioned nodes do not inclue DP part, they strictly follow the schema defined in the qcom,qmp-phy.yaml file. Move those compatibles, leaving qcom,qmp-usb3-dp-phy.yaml to describe only real "combo" USB3+DP device nodes.
--- Documentation/devicetree/bindings/phy/qcom,qmp-phy.yaml | 2 ++ Documentation/devicetree/bindings/phy/qcom,qmp-usb3-dp-phy.yaml | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/phy/qcom,qmp-phy.yaml +2 -0
@@ -25,11 +25,13 @@ properties: - qcom,msm8998-qmp-pcie-phy - qcom,msm8998-qmp-ufs-phy - qcom,msm8998-qmp-usb3-phy + - qcom,sc7180-qmp-usb3-phy - qcom,sc8180x-qmp-ufs-phy - qcom,sc8180x-qmp-usb3-phy - qcom,sdm845-qhp-pcie-phy - qcom,sdm845-qmp-pcie-phy - qcom,sdm845-qmp-ufs-phy + - qcom,sdm845-qmp-usb3-phy - qcom,sdm845-qmp-usb3-uni-phy - qcom,sm8150-qmp-ufs-phy - qcom,sm8150-qmp-usb3-phy
Documentation/devicetree/bindings/phy/qcom,qmp-usb3-dp-phy.yaml +0 -2
@@ -14,9 +14,7 @@ properties: compatible: enum: - qcom,sc7180-qmp-usb3-dp-phy - - qcom,sc7180-qmp-usb3-phy - qcom,sdm845-qmp-usb3-dp-phy - - qcom,sdm845-qmp-usb3-phy reg: items: - description: Address and length of PHY's USB serdes block.
Greg Kroah-Hartman
maintainerPATCH 358/363 dt-bindings: serial: 8250: Remove duplicated compatible strings
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
commit a7277a73984114b38dcb62c8548850800ffe864e upstream.
The compatible strings "mediatek,*" appears two times, remove one of them.
--- Documentation/devicetree/bindings/serial/8250.yaml | 5 ----- 1 file changed, 5 deletions(-)
Documentation/devicetree/bindings/serial/8250.yaml +0 -5
@@ -94,11 +94,6 @@ properties: - mediatek,mt7623-btif - const: mediatek,mtk-btif - items: - - enum: - - mediatek,mt7622-btif - - mediatek,mt7623-btif - - const: mediatek,mtk-btif - - items: - const: mrvl,mmp-uart - const: intel,xscale-uart - items:
Greg Kroah-Hartman
maintainerPATCH 359/363 dt-bindings: PCI: rcar-pci-host: Document missing R-Car H1 support
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit 62b3b3660aff66433d71f142ab6ed2baaea25025 upstream.
scripts/checkpatch.pl -f drivers/pci/controller/pcie-rcar-host.c:
WARNING: DT compatible string "renesas,pcie-r8a7779" appears un-documented -- check ./Documentation/devicetree/bindings/
#853: FILE: drivers/pci/controller/pcie-rcar-host.c:853:
+ { .compatible = "renesas,pcie-r8a7779",Re-add the compatible value for R-Car H1, which was lost during the json-schema conversion. Make the "resets" property optional on R-Car H1, as it is not present yet on R-Car Gen1 SoCs.
--- Documentation/devicetree/bindings/pci/rcar-pci-host.yaml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
Documentation/devicetree/bindings/pci/rcar-pci-host.yaml +11 -1
@@ -17,6 +17,7 @@ allOf: properties: compatible: oneOf: + - const: renesas,pcie-r8a7779 # R-Car H1 - items: - enum: - renesas,pcie-r8a7742 # RZ/G1H
@@ -74,7 +75,16 @@ required: - clocks - clock-names - power-domains - - resets + +if: + not: + properties: + compatible: + contains: + const: renesas,pcie-r8a7779 +then: + required: + - resets unevaluatedProperties: false
Greg Kroah-Hartman
maintainerPATCH 360/363 debugfs: Make debugfs_allow RO after init
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 312723a0b34d6d110aa4427a982536bb36ab8471 upstream.
Since debugfs_allow is only set at boot time during __init, make it read-only after being set.
--- fs/debugfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/debugfs/inode.c +1 -1
@@ -35,7 +35,7 @@static struct vfsmount *debugfs_mount;static int debugfs_mount_count;static bool debugfs_registered; -static unsigned int debugfs_allow =DEFAULT_DEBUGFS_ALLOW_BITS ; +static unsigned int debugfs_allow__ro_after_init =DEFAULT_DEBUGFS_ALLOW_BITS ;/* * Don't allow access attributes to be changed whilst the kernel is locked down
Greg Kroah-Hartman
maintainerPATCH 361/363 ext4: fix debug format string warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit fcdf3c34b7abdcbb49690c94c7fa6ce224dc9749 upstream.
Using no_printk() for jbd_debug() revealed two warnings:
fs/jbd2/recovery.c: In function 'fc_do_one_pass':fs/jbd2/recovery.c:256:30: error: format '%d' expects a matching 'int' argument [-Werror=format=]
256 | jbd_debug(3, "Processing fast commit blk with seq %d");
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/ext4/fast_commit.c: In function 'ext4_fc_replay_add_range':fs/ext4/fast_commit.c:1732:30: error: format '%d' expects argument of type 'int', but argument 2 has type 'long unsigned int' [-Werror=format=]
1732 | jbd_debug(1, "Converting from %d to %d %lld",
The first one was added incorrectly, and was also missing a few newlines in debug output, and the second one happened when the type of an argument changed.
--- fs/ext4/fast_commit.c | 2 +- fs/jbd2/recovery.c | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-)
fs/ext4/fast_commit.c +1 -1
@@ -1736,7 +1736,7 @@ static int ext4_fc_replay_add_range(stru }/* Range is mapped and needs a state change */ -jbd_debug (1 ,"Converting from %d to %d %lld" , +jbd_debug (1 ,"Converting from %ld to %d %lld" , map.m_flags &EXT4_MAP_UNWRITTEN ,ext4_ext_is_unwritten (ex), map.m_pblk); ret = ext4_ext_replay_update_ex(inode, cur, map.m_len,
fs/jbd2/recovery.c +2 -3
@@ -245,15 +245,14 @@ static int fc_do_one_pass(journal_t *joureturn 0 ;while (next_fc_block <= journal->j_fc_last) { -jbd_debug (3 ,"Fast commit replay: next block %ld" , +jbd_debug (3 ,"Fast commit replay: next block %ld\n" , next_fc_block); err =jread (&bh, journal, next_fc_block);if (err) { -jbd_debug (3 ,"Fast commit replay: read error" ); +jbd_debug (3 ,"Fast commit replay: read error\n" );break ; } -jbd_debug (3 ,"Processing fast commit blk with seq %d" ); err = journal->j_fc_replay_callback (journal, bh, pass, next_fc_block - journal->j_fc_first, expected_commit_id);
Greg Kroah-Hartman
maintainerPATCH 362/363 nvme: do not try to reconfigure APST when the controller is not live
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit 53fe2a30bc168db9700e00206d991ff934973cf1 upstream.
Do not call nvme_configure_apst when the controller is not live, given that nvme_configure_apst will fail due the lack of an admin queue when the controller is being torn down and nvme_set_latency_tolerance is called from dev_pm_qos_hide_latency_tolerance.
--- drivers/nvme/host/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/core.c +2 -1
@@ -2681,7 +2681,8 @@ static void nvme_set_latency_tolerance(sif (ctrl->ps_max_latency_us != latency) { ctrl->ps_max_latency_us = latency; -nvme_configure_apst (ctrl); +if (ctrl->state ==NVME_CTRL_LIVE ) +nvme_configure_apst (ctrl); } }
Greg Kroah-Hartman
maintainerPATCH 363/363 ASoC: rsnd: check all BUSIF status when error
In reply to Greg Kroah-HartmanFrom: Kuninori Morimoto <[email protected]>
commit a4856e15e58b54977f1c0c0299309ad4d1f13365 upstream.
commit 66c705d07d784 ("SoC: rsnd: add interrupt support for SSI BUSIF buffer") adds __rsnd_ssi_interrupt() checks for BUSIF status, but is using "break" at for loop.
This means it is not checking all status. Let's check all BUSIF status.
--- sound/soc/sh/rcar/ssi.c | 2 -- 1 file changed, 2 deletions(-)
sound/soc/sh/rcar/ssi.c +0 -2
@@ -797,7 +797,6 @@ static void __rsnd_ssi_interrupt(structSSI_SYS_STATUS (i *2 ), 0xf << (id * 4)); stop = true; -break ; } }break ;
@@ -815,7 +814,6 @@ static void __rsnd_ssi_interrupt(structSSI_SYS_STATUS ((i *2 ) +1 ), 0xf << 4); stop = true; -break ; } }break ;
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.12.5 release. There are 363 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 19 May 2021 14:02:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.12.5-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.12.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.12.5 release. There are 363 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 19 May 2021 14:02:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.12.5-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.12.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.12:
12 builds: 12 pass, 0 fail
28 boots: 28 pass, 0 fail
104 tests: 104 pass, 0 failLinux version: 5.12.5-rc1-g8c6ba5015aff
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.12.5 release. There are 363 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 19 May 2021 14:02:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.12.5-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.12.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.12.5 release. There are 363 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 19 May 2021 14:02:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.12.5-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.12.y
and the diffstat can be found below.thanks,
greg k-h
5.12.5-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.12.5 release. There are 363 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 19 May 2021 14:02:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.12.5-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.12.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 5.12.5-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-5.12.y
* git commit: 8c6ba5015affe5c570b32cf542f58218e4dfebf1
* git describe: v5.12.4-364-g8c6ba5015aff
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.12.y/build/v5.12.4-364-g8c6ba5015aff
## No regressions (compared to v5.12.4)
## Fixes (compared to v5.12.4)
* mips, build
- clang-10-allnoconfig
- clang-10-defconfig
- clang-10-tinyconfig
- clang-11-allnoconfig
- clang-11-defconfig
- clang-11-tinyconfig
- clang-12-allnoconfig
- clang-12-defconfig
- clang-12-tinyconfig
## Test result summary
total: 76409, pass: 63868, fail: 1049, skip: 10771, xfail: 721,
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 193 total, 193 passed, 0 failed
* arm64: 27 total, 27 passed, 0 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 26 total, 26 passed, 0 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 45 total, 45 passed, 0 failed
* parisc: 9 total, 9 passed, 0 failed
* powerpc: 27 total, 27 passed, 0 failed
* riscv: 21 total, 21 passed, 0 failed
* s390: 18 total, 18 passed, 0 failed
* sh: 18 total, 18 passed, 0 failed
* sparc: 9 total, 9 passed, 0 failed
* x15: 1 total, 0 passed, 1 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 27 total, 27 passed, 0 failed
## Test suites summary
* fwts
* igt-gpu-tools
* install-android-platform-tools-r2600
* kselftest-android
* kselftest-bpf
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* rcutorture
* ssuite
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.12.5 release. There are 363 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 19 May 2021 14:02:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.12.5-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.12.y
and the diffstat can be found below.thanks,
greg k-h
On Tiger Lake x86_64 kernel:
- regression on:
[PATCH 5.12 081/363] net: bridge: propagate error code and extack from br_mc_disabled_update
- remaining tests ok.
Signature · 1 line
Rudi