5.14.4-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.14.4-rc1 review
This is the start of the stable review cycle for the 5.14.4 release. There are 334 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.14.4-rc1
Linus Walleij <[email protected]>
clk: kirkwood: Fix a clocking boot regression
Helge Deller <[email protected]>
parisc: Fix unaligned-access crash in bootloader
Daniel Thompson <[email protected]>
backlight: pwm_bl: Improve bootloader/kernel device handover
Julio Faracco <[email protected]>
bootconfig: Fix missing return check of xbc_node_compose_key function
Niklas Schnelle <[email protected]>
RDMA/mlx5: Fix number of allocated XLT entries
Aubrey Li <[email protected]>
ACPI: PRM: Find PRMT table before parsing it
Tetsuo Handa <[email protected]>
fbmem: don't allow too huge resolutions
THOBY Simon <[email protected]>
IMA: remove the dependency on CRYPTO_MD5
Austin Kim <[email protected]>
IMA: remove -Wmissing-prototypes warning
Miklos Szeredi <[email protected]>
fuse: wait for writepages in syncfs
Miklos Szeredi <[email protected]>
fuse: flush extending writes
Miklos Szeredi <[email protected]>
fuse: truncate pagecache on atomic_o_trunc
Adrian Ratiu <[email protected]>
char: tpm: Kconfig: remove bad i2c cr50 select
Xiao Ni <[email protected]>
md/raid10: Remove unnecessary rcu_dereference in raid10_handle_discard
Jens Axboe <[email protected]>
io-wq: check max_worker limits if a worker transitions bound state
Claudiu Beznea <[email protected]>
ARM: dts: at91: add pinctrl-{names, 0} for all gpios
Marc Zyngier <[email protected]>
KVM: arm64: vgic: Resample HW pending state on deactivation
Marc Zyngier <[email protected]>
KVM: arm64: Unregister HYP sections from kmemleak in protected mode
Sean Christopherson <[email protected]>
KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter
Maxim Levitsky <[email protected]>
KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation
Sean Christopherson <[email protected]>
KVM: x86/mmu: Avoid collision with !PRESENT SPTEs in TDP MMU lpage stats
Paolo Bonzini <[email protected]>
KVM: x86: clamp host mapping level to max_level in kvm_mmu_max_mapping_level
Zelin Deng <[email protected]>
KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted
Halil Pasic <[email protected]>
KVM: s390: index kvm->arch.idle_mask by vcpu_idx
Sean Christopherson <[email protected]>
Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()"
Alexander Antonov <[email protected]>
perf/x86/intel/uncore: Fix IIO cleanup mapping procedure for SNR/ICX
Nguyen Dinh Phi <[email protected]>
tty: Fix data race between tiocsti() and flush_to_ldisc()
Steve French <[email protected]>
smb3: fix posix extensions mount option
Ronnie Sahlberg <[email protected]>
cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED
Guoqing Jiang <[email protected]>
raid1: ensure write behind bio has less than BIO_MAX_VECS sectors
Pavel Begunkov <[email protected]>
bio: fix page leak bio_add_hw_page failure
Pavel Begunkov <[email protected]>
io_uring: fail links of cancelled timeouts
Jens Axboe <[email protected]>
io_uring: io_uring_complete() trace should take an integer
Jens Axboe <[email protected]>
io_uring: IORING_OP_WRITE needs hash_reg_file set
Pavel Begunkov <[email protected]>
io_uring: limit fixed table size by RLIMIT_NOFILE
Lars Poeschel <[email protected]>
auxdisplay: hd44780: Fix oops on module unloading
Lukas Hannen <[email protected]>
time: Handle negative seconds correctly in timespec64_to_ns()
Jaegeuk Kim <[email protected]>
f2fs: guarantee to write dirty data when enabling checkpoint back
Justin M. Forbes <[email protected]>
iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha
Douglas Anderson <[email protected]>
ASoC: rt5682: Remove unused variable in rt5682_i2c_remove()
Eric Dumazet <[email protected]>
ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
Sunil Goutham <[email protected]>
octeontx2-af: Set proper errorcode for IPv4 checksum errors
Subbaraya Sundeep <[email protected]>
octeontx2-af: Fix static code analyzer reported issues
Subbaraya Sundeep <[email protected]>
octeontx2-af: Fix mailbox errors in nix_rss_flowkey_cfg
Subbaraya Sundeep <[email protected]>
octeontx2-af: Fix loop in free and unmap counter
Stefan Wahren <[email protected]>
net: qualcomm: fix QCA7000 checksum handling
Xiyu Yang <[email protected]>
net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
Maxim Mikityanskiy <[email protected]>
sch_htb: Fix inconsistency when leaf qdisc creation fails
Dan Carpenter <[email protected]>
net: qrtr: make checks in qrtr_endpoint_post() stricter
Eric Dumazet <[email protected]>
ipv4: make exception cache less predictible
Eric Dumazet <[email protected]>
ipv6: make exception cache less predictible
Ahmad Fatoum <[email protected]>
brcmfmac: pcie: fix oops on failure to resume and reprobe
Zenghui Yu <[email protected]>
bcma: Fix memory leak for internally-handled cores
Sudarsana Reddy Kalluru <[email protected]>
atlantic: Fix driver resume flow.
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add lowlatency module option
Dan Carpenter <[email protected]>
ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
Vladimir Oltean <[email protected]>
net: phy: marvell10g: fix broken PHY interrupts for anyone after us in the driver probe list
Brett Creeley <[email protected]>
ice: Only lock to update netdev dev_addr
Jacob Keller <[email protected]>
ice: restart periodic outputs around time changes
Jacob Keller <[email protected]>
ice: add lock around Tx timestamp tracker flush
Jacob Keller <[email protected]>
ice: fix Tx queue iteration for Tx timestamp enablement
Mihai Carabas <[email protected]>
misc/pvpanic: fix set driver data
Dmytro Linkin <[email protected]>
net/mlx5e: Use correct eswitch for stack devices with lag
Maor Dickman <[email protected]>
net/mlx5: E-Switch, Set vhca id valid flag when creating indir fwd group
Roi Dayan <[email protected]>
net/mlx5e: Fix possible use-after-free deleting fdb rule
Leon Romanovsky <[email protected]>
net/mlx5: Remove all auxiliary devices at the unregister event
Dima Chumak <[email protected]>
net/mlx5: Lag, fix multipath lag activation
Abhishek Naik <[email protected]>
iwlwifi: skip first element in the WTAS ACPI table
Christophe JAILLET <[email protected]>
ASoC: wcd9335: Disable irq on slave ports in the remove function
Christophe JAILLET <[email protected]>
ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function
Christophe JAILLET <[email protected]>
ASoC: wcd9335: Fix a double irq free in the remove function
Andy Duan <[email protected]>
tty: serial: fsl_lpuart: fix the wrong mapbase value
Christophe JAILLET <[email protected]>
usb: bdc: Fix a resource leak in the error handling path of 'bdc_probe()'
Christophe JAILLET <[email protected]>
usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available
Evgeny Novikov <[email protected]>
usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
Yang Yingliang <[email protected]>
octeontx2-pf: cn10k: Fix error return code in otx2_set_flowkey_cfg()
Sergey Shtylyov <[email protected]>
i2c: xlp9xx: fix main IRQ check
Sergey Shtylyov <[email protected]>
i2c: mt65xx: fix IRQ check
Len Baker <[email protected]>
CIFS: Fix a potencially linear read overflow
Vitaly Kuznetsov <[email protected]>
hv_utils: Set the maximum packet size for VSS driver to the length of the receive buffer
Andrey Ignatov <[email protected]>
bpf: Fix possible out of bound write in narrow load handling
Charles Keepax <[email protected]>
ASoC: wm_adsp: Put debugfs_remove_recursive back in
Tony Lindgren <[email protected]>
mmc: moxart: Fix issue with uninitialized dma_slave_config
Tony Lindgren <[email protected]>
mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
Tony Lindgren <[email protected]>
mmc: sdhci: Fix issue with uninitialized dma_slave_config
Cezary Rojewski <[email protected]>
ASoC: Intel: Skylake: Fix module resource and format selection
Cezary Rojewski <[email protected]>
ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs
Cezary Rojewski <[email protected]>
ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373
Dan Carpenter <[email protected]>
m68k: coldfire: return success for clk_enable(NULL)
Geetha sowjanya <[email protected]>
octeontx2-af: cn10k: Use FLIT0 register instead of FLIT1
Sunil Goutham <[email protected]>
octeontx2-pf: Fix algorithm index in MCAM rules with RSS action
Sunil Goutham <[email protected]>
octeontx2-pf: Don't install VLAN offload rule if netdev is down
Geetha sowjanya <[email protected]>
octeontx2-af: Check capability flag while freeing ipolicer memory
Naveen Mamindlapalli <[email protected]>
octeontx2-pf: send correct vlan priority mask to npc_install_flow_req
Subbaraya Sundeep <[email protected]>
octeontx2-af: cn10k: Fix SDP base channel number
Dan Carpenter <[email protected]>
rsi: fix an error code in rsi_probe()
Dan Carpenter <[email protected]>
rsi: fix error code in rsi_load_9116_firmware()
Wei Yongjun <[email protected]>
drm/exynos: g2d: fix missing unlock on error in g2d_runqueue_worker()
Bob Peterson <[email protected]>
gfs2: init system threads before freeze lock
Sergey Shtylyov <[email protected]>
i2c: hix5hd2: fix IRQ check
Sergey Shtylyov <[email protected]>
i2c: s3c2410: fix IRQ check
Sergey Shtylyov <[email protected]>
i2c: iop3xx: fix deferred probing
Pavel Skripkin <[email protected]>
Bluetooth: add timeout sanity check to hci_inquiry
Kevin Mitchell <[email protected]>
lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ
Xu Yu <[email protected]>
mm/swap: consider max pages in iomap_swapfile_add_extent
Nadezda Lutovinova <[email protected]>
usb: gadget: mv_u3d: request_irq() after initializing UDC
Christophe JAILLET <[email protected]>
firmware: raspberrypi: Fix a leak in 'rpi_firmware_get()'
Shengjiu Wang <[email protected]>
ASoC: fsl_rpmsg: Check -EPROBE_DEFER for getting clocks
Lukas Bulwahn <[email protected]>
hwmon: remove amd_energy driver in Makefile
Chris Packham <[email protected]>
hwmon: (pmbus/bpa-rs600) Don't use rated limits as warn limits
Sergey Shtylyov <[email protected]>
i2c: synquacer: fix deferred probing
Lukas Bulwahn <[email protected]>
clk: staging: correct reference to config IOMEM to config HAS_IOMEM
Pali Rohár <[email protected]>
arm64: dts: marvell: armada-37xx: Extend PCIe MEM space
J. Bruce Fields <[email protected]>
nfsd4: Fix forced-expiry locking
Chuck Lever <[email protected]>
SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency()
Benjamin Coddington <[email protected]>
lockd: Fix invalid lockowner cast after vfs_test_lock
Thomas Gleixner <[email protected]>
locking/local_lock: Add missing owner initialization
Chih-Kang Chang <[email protected]>
mac80211: Fix insufficient headroom issue for AMSDU
Andrii Nakryiko <[email protected]>
libbpf: Re-build libbpf.so when libbpf.map changes
Sergey Shtylyov <[email protected]>
usb: phy: tahvo: add IRQ check
Sergey Shtylyov <[email protected]>
usb: host: ohci-tmio: add IRQ check
Valentin Schneider <[email protected]>
PM: cpu: Make notifier chain use a raw_spinlock_t
Kai-Heng Feng <[email protected]>
Bluetooth: Move shutdown callback before flushing tx and rx queue
Voon Weifeng <[email protected]>
net: stmmac: fix INTR TBU status affecting irq count statistic
Juhee Kang <[email protected]>
samples: pktgen: add missing IPv6 option to pktgen scripts
Leon Romanovsky <[email protected]>
devlink: Clear whole devlink_flash_notify struct
Ilya Leoshkevich <[email protected]>
selftests/bpf: Fix test_core_autosize on big-endian machines
Geert Uytterhoeven <[email protected]>
usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse
Sergey Shtylyov <[email protected]>
usb: phy: twl6030: add IRQ checks
Sergey Shtylyov <[email protected]>
usb: phy: fsl-usb: add IRQ check
Sergey Shtylyov <[email protected]>
usb: misc: brcmstb-usb-pinmap: add IRQ check
Dan Carpenter <[email protected]>
mac80211: remove unnecessary NULL check in ieee80211_register_hw()
Sergey Shtylyov <[email protected]>
usb: gadget: udc: s3c2410: add IRQ check
Sergey Shtylyov <[email protected]>
usb: gadget: udc: at91: add IRQ check
Sergey Shtylyov <[email protected]>
usb: dwc3: qcom: add IRQ check
Sergey Shtylyov <[email protected]>
usb: dwc3: meson-g12a: add IRQ check
Rob Clark <[email protected]>
drm/bridge: ti-sn65dsi86: Avoid creating multiple connectors
Douglas Anderson <[email protected]>
ASoC: rt5682: Properly turn off regulators if wrong device ID
Parav Pandit <[email protected]>
net/mlx5: Fix unpublish devlink parameters
Kuogee Hsieh <[email protected]>
drm/msm/dp: replug event is converted into an unplug followed by an plug events
Christophe JAILLET <[email protected]>
drm/msm/dsi: Fix some reference counted resource leaks
Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: fix repeated calls to sco_sock_kill
Curtis Malainey <[email protected]>
ASoC: Intel: Fix platform ID matching
Waiman Long <[email protected]>
cgroup/cpuset: Fix violation of cpuset locking rule
Waiman Long <[email protected]>
cgroup/cpuset: Miscellaneous code cleanup
William Breathitt Gray <[email protected]>
counter: 104-quad-8: Return error when invalid mode during ceiling_write
Krzysztof Kozlowski <[email protected]>
arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs
Kuogee Hsieh <[email protected]>
drm/msm/dp: update is_connected status base on sink count at dp_pm_resume()
David Heidelberg <[email protected]>
drm/msm/mdp4: move HW revision detection to earlier phase
David Heidelberg <[email protected]>
drm/msm/mdp4: refactor HW revision detection into read_mdp_hw_revision
Wei Li <[email protected]>
drm/msm: Fix error return code in msm_drm_init()
Andy Shevchenko <[email protected]>
leds: lgm-sso: Propagate error codes from callee to caller
Jose Blanquicet <[email protected]>
selftests/bpf: Fix bpf-iter-tcp4 test to print correctly the dest IP
Lukasz Luba <[email protected]>
PM: EM: Increase energy calculation precision
Vladimir Oltean <[email protected]>
net: dsa: don't disable multicast flooding to the CPU even without an IGMP querier
Vladimir Oltean <[email protected]>
net: dsa: mt7530: remove the .port_set_mrouter implementation
Vladimir Oltean <[email protected]>
net: dsa: stop syncing the bridge mcast_router attribute at join time
Vignesh Raghavendra <[email protected]>
net: ti: am65-cpsw-nuss: fix RX IRQ state after .ndo_stop()
Robert Foss <[email protected]>
drm: bridge: it66121: Check drm_bridge_attach retval
Alex Elder <[email protected]>
arm64: dts: qcom: sm8350: fix IPA interconnects
Sibi Sankar <[email protected]>
arm64: dts: qcom: sc7280: Fixup the cpufreq node
Colin Ian King <[email protected]>
Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
Sven Eckelmann <[email protected]>
debugfs: Return error during {full/open}_proxy_open() on rmmod
Vladimir Oltean <[email protected]>
net: dsa: tag_sja1105: optionally build as module when switch driver is module if PTP is enabled
Vladimir Oltean <[email protected]>
net: dsa: build tag_8021q.c as part of DSA core
Stephan Gerhold <[email protected]>
soc: qcom: smsm: Fix missed interrupts if state changes while masked
Matthew Cover <[email protected]>
bpf, samples: Add missing mprog-disable to xdp_redirect_cpu's optstring
Rafael J. Wysocki <[email protected]>
PCI: PM: Enable PME if it can be signaled from D3cold
Rafael J. Wysocki <[email protected]>
PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
CK Hu <[email protected]>
soc: mmsys: mediatek: add mask to mmsys routes
Mansur Alisha Shaik <[email protected]>
media: venus: helper: do not set constrained parameters for UBWC
Colin Ian King <[email protected]>
media: venus: venc: Fix potential null pointer dereference on pointer fmt
Zhen Lei <[email protected]>
media: venus: hfi: fix return value check in sys_get_prop_image_version()
Wei Yongjun <[email protected]>
media: omap3isp: Fix missing unlock in isp_subdev_notifier_complete()
Dongliang Mu <[email protected]>
media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
Hans de Goede <[email protected]>
leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
Andy Shevchenko <[email protected]>
leds: rt8515: Put fwnode in any case during ->probe()
Andy Shevchenko <[email protected]>
leds: lt3593: Put fwnode in any case during ->probe()
Andy Shevchenko <[email protected]>
leds: lgm-sso: Don't spam logs when probe is deferred
Andy Shevchenko <[email protected]>
leds: lgm-sso: Put fwnode in any case during ->probe()
Sergey Shtylyov <[email protected]>
i2c: highlander: add IRQ check
Jiapeng Chong <[email protected]>
net/mlx5: Fix missing return value in mlx5_devlink_eswitch_inline_mode_set()
Douglas Anderson <[email protected]>
drm/bridge: ti-sn65dsi86: Add some 100 us delays
Douglas Anderson <[email protected]>
drm/bridge: ti-sn65dsi86: Fix power off sequence
Laurent Pinchart <[email protected]>
drm/bridge: ti-sn65dsi86: Wrap panel with panel-bridge
Douglas Anderson <[email protected]>
drm/bridge: ti-sn65dsi86: Improve probe errors with dev_err_probe()
Douglas Anderson <[email protected]>
drm/bridge: ti-sn65dsi86: Don't read EDID blob over DDC
Leon Romanovsky <[email protected]>
devlink: Break parameter notification sequence to be before/after unload/load driver
Biju Das <[email protected]>
arm64: dts: renesas: hihope-rzg2-ex: Add EtherAVB internal rx delay
Quentin Monnet <[email protected]>
tools: Free BTF objects at various locations
Quentin Monnet <[email protected]>
libbpf: Return non-null error on failures in libbpf_find_prog_btf_id()
Andy Shevchenko <[email protected]>
lib/test_scanf: Handle n_bits == 0 in random tests
Luben Tuikov <[email protected]>
drm/amd/pm: Fix a bug in semaphore double-lock
Tedd Ho-Jeong An <[email protected]>
Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd
Laurent Pinchart <[email protected]>
drm: rcar-du: Don't put reference to drm_device in rcar_du_remove()
Leon Romanovsky <[email protected]>
net: ti: am65-cpsw-nuss: fix wrong devlink release order
Pavel Skripkin <[email protected]>
net: cipso: fix warnings in netlbl_cipsov4_add_std
Marek Vasut <[email protected]>
drm: mxsfb: Clear FIFO_CLEAR bit
Marek Vasut <[email protected]>
drm: mxsfb: Increase number of outstanding requests on V4 and newer HW
Marek Vasut <[email protected]>
drm: mxsfb: Enable recovery on underflow
Waiman Long <[email protected]>
cgroup/cpuset: Fix a partition bug with hotplug
Maxim Mikityanskiy <[email protected]>
net/mlx5e: Block LRO if firmware asks for tunneled LRO
Maxim Mikityanskiy <[email protected]>
net/mlx5e: Prohibit inner indir TIRs in IPoIB
Anand Moon <[email protected]>
ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties
Anand Moon <[email protected]>
ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties
Anand Moon <[email protected]>
ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties
Martin Blumenstingl <[email protected]>
ARM: dts: meson8: Use a higher default GPU clock frequency
Martin KaFai Lau <[email protected]>
tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
Luben Tuikov <[email protected]>
drm/amd/pm: Fix a bug communicating with the SMU (v5)
Kai-Heng Feng <[email protected]>
drm/amdgpu/acp: Make PM domain really work
Colin Ian King <[email protected]>
6lowpan: iphc: Fix an off-by-one check of array index
Jun Miao <[email protected]>
Bluetooth: btusb: Fix a unspported condition to set available debug features
Dan Carpenter <[email protected]>
Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
Yizhuo <[email protected]>
media: atomisp: fix the uninitialized use and rename "retvalue"
Philipp Zabel <[email protected]>
media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
Dan Carpenter <[email protected]>
media: rockchip/rga: fix error handling in probe
Dan Carpenter <[email protected]>
media: v4l2-subdev: fix some NULL vs IS_ERR() checks
Pavel Skripkin <[email protected]>
media: go7007: remove redundant initialization
Pavel Skripkin <[email protected]>
media: go7007: fix memory leak in go7007_usb_probe
Oleksij Rempel <[email protected]>
net: usb: asix: ax88772: add missing stop
Dongliang Mu <[email protected]>
media: dvb-usb: Fix error handling in dvb_usb_i2c_init
Dongliang Mu <[email protected]>
media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
Dongliang Mu <[email protected]>
media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
Leon Romanovsky <[email protected]>
ionic: cleanly release devlink instance
Zhen Lei <[email protected]>
driver core: Fix error return code in really_probe()
Zhen Lei <[email protected]>
firmware: fix theoretical UAF race with firmware cache and resume
John Fastabend <[email protected]>
bpf, selftests: Fix test_maps now that sockmap supports UDP
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8250: fix usb2 qmp phy node
Colin Ian King <[email protected]>
gfs2: Fix memory leak of object lsi on error return path
Martynas Pumputis <[email protected]>
libbpf: Fix removal of inner map in bpf_object__create_map
Bjorn Andersson <[email protected]>
soc: qcom: rpmhpd: Use corner in power_off
Judy Hsiao <[email protected]>
arm64: dts: qcom: sc7180: Set adau wakeup delay to 80 ms
Stefan Assmann <[email protected]>
i40e: improve locking of mac_filter_hash
Geert Uytterhoeven <[email protected]>
arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties
Andrew Jeffery <[email protected]>
ARM: dts: everest: Add phase corrections for eMMC
Dylan Hung <[email protected]>
ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi
Shuyi Cheng <[email protected]>
libbpf: Fix the possible memory leak on error
Haiyue Wang <[email protected]>
gve: fix the wrong AdminQ buffer overflow check
Steven Price <[email protected]>
drm/of: free the iterator object on failure
He Fengqing <[email protected]>
bpf: Fix potential memleak and UAF in the verifier.
Kuniyuki Iwashima <[email protected]>
bpf: Fix a typo of reuseport map in bpf.h.
Julia Lawall <[email protected]>
drm/of: free the right object
Christophe JAILLET <[email protected]>
media: cxd2880-spi: Fix an error handling path
Geert Uytterhoeven <[email protected]>
soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
Jiapeng Chong <[email protected]>
leds: is31fl32xx: Fix missing error code in is31fl32xx_parse_dt()
Krzysztof Hałasa <[email protected]>
media: TDA1997x: enable EDID support
Eugen Hristev <[email protected]>
media: atmel: atmel-sama5d2-isc: fix YUYV format
Marek Vasut <[email protected]>
ASoC: tlv320aic32x4: Fix TAS2505/TAS2521 channel count
Zhang Qilong <[email protected]>
ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in mt8183_afe_pcm_dev_probe
Zhang Qilong <[email protected]>
ASoC: mediatek: mt8192:Fix Unbalanced pm_runtime_enable in mt8192_afe_pcm_dev_probe
Harshvardhan Jha <[email protected]>
drm/gma500: Fix end of loop tests for list_for_each_entry
Wei Yongjun <[email protected]>
drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init()
Quanyang Wang <[email protected]>
spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible
Chunyan Zhang <[email protected]>
spi: sprd: Fix the wrong WDG_LOAD_VAL
Chen-Yu Tsai <[email protected]>
regulator: vctrl: Avoid lockdep warning in enable/disable ops
Chen-Yu Tsai <[email protected]>
regulator: vctrl: Use locked regulator_get_voltage in probe path
Eric Biggers <[email protected]>
blk-crypto: fix check for too-large dun_bytes
Matija Glavinic Pecotic <[email protected]>
spi: davinci: invoke chipselect callback
Borislav Petkov <[email protected]>
x86/mce: Defer processing of early errors
Qiuxu Zhuo <[email protected]>
EDAC/i10nm: Fix NVDIMM detection
Stefan Berger <[email protected]>
tpm: ibmvtpm: Avoid error message when process gets signal while waiting
Stefan Berger <[email protected]>
certs: Trigger creation of RSA module signing key if it's not an RSA key
Geert Uytterhoeven <[email protected]>
m68k: Fix asm register constraints for atomic ops
Giovanni Cabiddu <[email protected]>
crypto: qat - use proper type for vf_mask
Chen-Yu Tsai <[email protected]>
irqchip/gic-v3: Fix priority comparison when non-secure priorities are used
Sven Peter <[email protected]>
irqchip/apple-aic: Fix irq_disable from within irq handlers
Christophe JAILLET <[email protected]>
spi: coldfire-qspi: Use clk_disable_unprepare in the remove function
Pavel Skripkin <[email protected]>
block: nbd: add sanity check for first_minor
Hou Tao <[email protected]>
nbd: do del_gendisk() asynchronously for NBD_DESTROY_ON_DISCONNECT
Phong Hoang <[email protected]>
clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel
Hongbo Li <[email protected]>
lib/mpi: use kcalloc in mpi_resize
Huacai Chen <[email protected]>
irqchip/loongson-pch-pic: Improve edge triggered interrupt support
Zhen Lei <[email protected]>
genirq/timings: Fix error return code in irq_timings_test_irqs()
Tony Lindgren <[email protected]>
spi: spi-pic32: Fix issue with uninitialized dma_slave_config
Tony Lindgren <[email protected]>
spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
Ming Lei <[email protected]>
block: return ELEVATOR_DISCARD_MERGE if possible
Geert Uytterhoeven <[email protected]>
m68k: Fix invalid RMW_INSNS on CPUs that lack CAS
Yanfei Xu <[email protected]>
rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock
Yanfei Xu <[email protected]>
rcu: Fix to include first blocked task in stall warning
Quentin Perret <[email protected]>
sched: Fix UCLAMP_FLAG_IDLE setting
Mika Penttilä <[email protected]>
sched/numa: Fix is_core_idle()
Mian Yousaf Kaukab <[email protected]>
crypto: ecc - handle unaligned input buffer in ecc_swap_digits
Ard Biesheuvel <[email protected]>
crypto: x86/aes-ni - add missing error checks in XTS code
Pavel Skripkin <[email protected]>
m68k: emu: Fix invalid free in nfeth_cleanup()
Peter Robinson <[email protected]>
power: supply: cw2015: use dev_err_probe to allow deferred probe
Valentin Schneider <[email protected]>
sched/debug: Don't update sched_domain debug directories before sched_debug_init()
Alexander Gordeev <[email protected]>
s390/smp: enable DAT before CPU restart callback is called
Harald Freudenberger <[email protected]>
s390/ap: fix state machine hang after failure to enable irq
Peter Oberparleiter <[email protected]>
s390/debug: fix debug area life cycle
Peter Oberparleiter <[email protected]>
s390/debug: keep debug data on resize
Niklas Schnelle <[email protected]>
s390/pci: fix misleading rc in clp_set_pci_fn()
Alexander Gordeev <[email protected]>
s390/kasan: fix large PMD pages address alignment check
Jens Axboe <[email protected]>
io-wq: remove GFP_ATOMIC allocation off schedule out path
Stian Skjelstad <[email protected]>
udf_get_extendedattr() had no boundary checks.
Desmond Cheong Zhi Xi <[email protected]>
fcntl: fix potential deadlock for &fasync_struct.fa_lock
Desmond Cheong Zhi Xi <[email protected]>
fcntl: fix potential deadlocks for &fown_struct.lock
Tianjia Zhang <[email protected]>
crypto: tcrypt - Fix missing return value check
Kai Ye <[email protected]>
crypto: hisilicon/sec - modify the hardware endian configuration
Kai Ye <[email protected]>
crypto: hisilicon/sec - fix the abnormal exiting process
Giovanni Cabiddu <[email protected]>
crypto: qat - do not export adf_iov_putmsg()
Marco Chiappero <[email protected]>
crypto: qat - fix naming for init/shutdown VF to PF notifications
Marco Chiappero <[email protected]>
crypto: qat - fix reuse of completion variable
Giovanni Cabiddu <[email protected]>
crypto: qat - handle both source of interrupt in VF ISR
Giovanni Cabiddu <[email protected]>
crypto: qat - do not ignore errors from enable_vf2pf_comms()
Ben Hutchings <[email protected]>
crypto: omap - Fix inconsistent locking of device lists
Valentin Schneider <[email protected]>
sched/topology: Skip updating masks for non-online nodes
Damien Le Moal <[email protected]>
libata: fix ata_host_start()
Harald Freudenberger <[email protected]>
s390/zcrypt: fix wrong offset index for APKA master key valid state
Vineeth Vijayan <[email protected]>
s390/cio: add dev_busid sysfs entry for each subchannel
Sebastian Krzyszkowiak <[email protected]>
power: supply: max17042_battery: fix typo in MAx17042_TOFF
Dmitry Osipenko <[email protected]>
power: supply: smb347-charger: Add missing pin control activation
Amit Engel <[email protected]>
nvmet: pass back cntlid on successful completion
Ruozhu Li <[email protected]>
nvme-rdma: don't update queue count when failing to set io queues
Ruozhu Li <[email protected]>
nvme-tcp: don't update queue count when failing to set io queues
Chunguang Xu <[email protected]>
blk-throtl: optimize IOPS throttle for large IO scenarios
Baokun Li <[email protected]>
nbd: add the check to prevent overflow in __nbd_ioctl()
Christoph Hellwig <[email protected]>
bcache: add proper error unwinding in bcache_device_init
Pali Rohár <[email protected]>
isofs: joliet: Fix iocharset=utf8 mount option
Pali Rohár <[email protected]>
udf: Fix iocharset=utf8 mount option
Jan Kara <[email protected]>
udf: Check LVID earlier
Thomas Gleixner <[email protected]>
hrtimer: Ensure timerfd notification for HIGHRES=n
Thomas Gleixner <[email protected]>
hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
Frederic Weisbecker <[email protected]>
posix-cpu-timers: Force next expiration recalc after itimer reset
Smita Koralahalli <[email protected]>
EDAC/mce_amd: Do not load edac_mce_amd module on guests
Sergey Senozhatsky <[email protected]>
rcu/tree: Handle VM stoppage in stall detection
Dietmar Eggemann <[email protected]>
sched/deadline: Fix missing clock update in migrate_task_rq_dl()
Tony Lindgren <[email protected]>
crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
Hans de Goede <[email protected]>
power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
Quentin Perret <[email protected]>
sched/deadline: Fix reset_on_fork reporting of DL tasks
Sean Anderson <[email protected]>
crypto: mxs-dcp - Check for DMA mapping errors
Dmitry Osipenko <[email protected]>
regulator: tps65910: Silence deferred probe error
Jeongtae Park <[email protected]>
regmap: fix the offset of register error log
Peter Zijlstra <[email protected]>
locking/mutex: Fix HANDOFF condition
-------------
Diffstat:
Documentation/fault-injection/provoke-crashes.rst | 2 +- Makefile | 4 +- arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts | 2 +- arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 4 +- arch/arm/boot/dts/at91-sam9x60ek.dts | 16 +- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 29 +++ arch/arm/boot/dts/at91-sama5d4_xplained.dts | 19 ++ arch/arm/boot/dts/meson8.dtsi | 5 + arch/arm/boot/dts/meson8b-ec100.dts | 4 +- arch/arm/boot/dts/meson8b-mxq.dts | 4 +- arch/arm/boot/dts/meson8b-odroidc1.dts | 4 +- arch/arm64/boot/dts/exynos/exynos7.dtsi | 2 +- .../boot/dts/marvell/armada-3720-turris-mox.dts | 17 ++ arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 11 +- .../arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi | 2 +- arch/arm64/boot/dts/qcom/sc7280.dtsi | 6 +- arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +- arch/arm64/boot/dts/qcom/sm8350.dtsi | 8 +- arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi | 1 + arch/arm64/boot/dts/renesas/r8a77995-draak.dts | 4 - arch/arm64/kvm/arm.c | 7 + arch/arm64/kvm/vgic/vgic-v2.c | 36 +-- arch/arm64/kvm/vgic/vgic-v3.c | 36 +-- arch/arm64/kvm/vgic/vgic.c | 38 +++ arch/arm64/kvm/vgic/vgic.h | 2 + arch/m68k/Kconfig.cpu | 8 +- arch/m68k/coldfire/clk.c | 2 +- arch/m68k/emu/nfeth.c | 4 +- arch/m68k/include/asm/atomic.h | 4 +- arch/parisc/boot/compressed/misc.c | 2 +- arch/s390/include/asm/kvm_host.h | 1 + arch/s390/include/asm/lowcore.h | 3 +- arch/s390/include/asm/processor.h | 2 + arch/s390/kernel/asm-offsets.c | 1 + arch/s390/kernel/debug.c | 176 ++++++++----- arch/s390/kernel/entry.S | 11 +- arch/s390/kernel/ipl.c | 3 - arch/s390/kernel/machine_kexec.c | 1 - arch/s390/kernel/setup.c | 9 +- arch/s390/kernel/smp.c | 31 ++- arch/s390/kvm/interrupt.c | 12 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/s390/kvm/kvm-s390.h | 2 +- arch/s390/mm/kasan_init.c | 41 ++- arch/s390/pci/pci.c | 7 +- arch/s390/pci/pci_clp.c | 33 ++- arch/x86/crypto/aesni-intel_glue.c | 5 + arch/x86/events/intel/uncore_snbep.c | 40 ++- arch/x86/include/asm/mce.h | 1 + arch/x86/kernel/cpu/mce/core.c | 11 +- arch/x86/kvm/mmu/mmu.c | 19 +- arch/x86/kvm/mmu/tdp_mmu.c | 20 +- arch/x86/kvm/vmx/nested.c | 7 +- arch/x86/kvm/vmx/vmx.c | 3 + arch/x86/kvm/x86.c | 4 + block/bfq-iosched.c | 3 + block/bio.c | 15 +- block/blk-crypto.c | 2 +- block/blk-merge.c | 18 +- block/blk-throttle.c | 32 +++ block/blk.h | 2 + block/elevator.c | 3 + block/mq-deadline.c | 2 + certs/Makefile | 8 + crypto/ecc.h | 5 +- crypto/tcrypt.c | 29 ++- drivers/acpi/prmt.c | 10 +- drivers/ata/libata-core.c | 2 +- drivers/auxdisplay/hd44780.c | 2 +- drivers/base/dd.c | 16 +- drivers/base/firmware_loader/main.c | 20 +- drivers/base/regmap/regmap.c | 2 +- drivers/bcma/main.c | 6 +- drivers/block/nbd.c | 86 ++++++- drivers/bluetooth/btusb.c | 18 +- drivers/char/tpm/Kconfig | 1 - drivers/char/tpm/tpm_ibmvtpm.c | 26 +- drivers/char/tpm/tpm_ibmvtpm.h | 2 +- drivers/clk/mvebu/kirkwood.c | 1 + drivers/clocksource/sh_cmt.c | 30 ++- drivers/counter/104-quad-8.c | 5 +- drivers/crypto/hisilicon/sec2/sec.h | 5 - drivers/crypto/hisilicon/sec2/sec_main.c | 34 +-- drivers/crypto/mxs-dcp.c | 45 +++- drivers/crypto/omap-aes.c | 8 +- drivers/crypto/omap-des.c | 8 +- drivers/crypto/omap-sham.c | 14 +- .../crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c | 4 +- drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c | 4 +- drivers/crypto/qat/qat_common/adf_common_drv.h | 8 +- drivers/crypto/qat/qat_common/adf_init.c | 5 +- drivers/crypto/qat/qat_common/adf_isr.c | 7 +- drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 3 +- drivers/crypto/qat/qat_common/adf_vf2pf_msg.c | 12 +- drivers/crypto/qat/qat_common/adf_vf_isr.c | 7 +- .../qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c | 4 +- drivers/edac/i10nm_base.c | 6 +- drivers/edac/mce_amd.c | 3 + drivers/firmware/raspberrypi.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 54 ++-- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 286 +++++++++++++++++---- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h | 3 +- drivers/gpu/drm/bridge/ite-it66121.c | 2 + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 97 ++++--- drivers/gpu/drm/drm_of.c | 6 +- drivers/gpu/drm/exynos/exynos_drm_g2d.c | 3 +- drivers/gpu/drm/gma500/oaktrail_lvds.c | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 10 +- drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 68 ++--- drivers/gpu/drm/msm/dp/dp_display.c | 31 ++- drivers/gpu/drm/msm/dsi/dsi.c | 6 +- drivers/gpu/drm/msm/msm_drv.c | 1 + drivers/gpu/drm/mxsfb/mxsfb_drv.c | 3 + drivers/gpu/drm/mxsfb/mxsfb_drv.h | 1 + drivers/gpu/drm/mxsfb/mxsfb_kms.c | 40 +++ drivers/gpu/drm/mxsfb/mxsfb_regs.h | 9 + drivers/gpu/drm/panfrost/panfrost_device.c | 3 +- drivers/gpu/drm/rcar-du/rcar_du_drv.c | 2 - drivers/hv/hv_snapshot.c | 1 + drivers/hwmon/Makefile | 1 - drivers/hwmon/pmbus/bpa-rs600.c | 25 -- drivers/i2c/busses/i2c-highlander.c | 2 +- drivers/i2c/busses/i2c-hix5hd2.c | 2 +- drivers/i2c/busses/i2c-iop3xx.c | 6 +- drivers/i2c/busses/i2c-mt65xx.c | 2 +- drivers/i2c/busses/i2c-s3c2410.c | 2 +- drivers/i2c/busses/i2c-synquacer.c | 2 +- drivers/i2c/busses/i2c-xlp9xx.c | 2 +- drivers/infiniband/hw/mlx5/mr.c | 2 +- drivers/irqchip/irq-apple-aic.c | 2 +- drivers/irqchip/irq-gic-v3.c | 23 +- drivers/irqchip/irq-loongson-pch-pic.c | 19 +- drivers/leds/blink/leds-lgm-sso.c | 23 +- drivers/leds/flash/leds-rt8515.c | 4 +- drivers/leds/leds-is31fl32xx.c | 1 + drivers/leds/leds-lt3593.c | 5 +- drivers/leds/trigger/ledtrig-audio.c | 37 ++- drivers/md/bcache/super.c | 16 +- drivers/md/raid1.c | 19 ++ drivers/md/raid10.c | 14 +- drivers/media/i2c/tda1997x.c | 1 + drivers/media/platform/atmel/atmel-sama5d2-isc.c | 17 ++ drivers/media/platform/coda/coda-bit.c | 18 +- drivers/media/platform/omap3isp/isp.c | 4 +- drivers/media/platform/qcom/venus/helpers.c | 3 + drivers/media/platform/qcom/venus/hfi_msgs.c | 2 +- drivers/media/platform/qcom/venus/venc.c | 2 + drivers/media/platform/rcar-vin/rcar-v4l2.c | 4 +- drivers/media/platform/rockchip/rga/rga.c | 27 +- drivers/media/platform/vsp1/vsp1_entity.c | 4 +- drivers/media/spi/cxd2880-spi.c | 7 +- drivers/media/usb/dvb-usb/dvb-usb-i2c.c | 9 +- drivers/media/usb/dvb-usb/dvb-usb-init.c | 2 +- drivers/media/usb/dvb-usb/nova-t-usb2.c | 6 +- drivers/media/usb/dvb-usb/vp702x.c | 12 +- drivers/media/usb/em28xx/em28xx-input.c | 1 - drivers/media/usb/go7007/go7007-driver.c | 26 -- drivers/media/usb/go7007/go7007-usb.c | 2 +- drivers/misc/lkdtm/core.c | 2 +- drivers/misc/pvpanic/pvpanic.c | 2 + drivers/mmc/host/dw_mmc.c | 1 + drivers/mmc/host/moxart-mmc.c | 1 + drivers/mmc/host/sdhci.c | 1 + drivers/net/dsa/b53/b53_common.c | 10 - drivers/net/dsa/b53/b53_priv.h | 2 - drivers/net/dsa/bcm_sf2.c | 1 - drivers/net/dsa/mt7530.c | 13 - drivers/net/dsa/mv88e6xxx/chip.c | 18 -- .../net/ethernet/aquantia/atlantic/aq_pci_func.c | 3 + drivers/net/ethernet/google/gve/gve_adminq.c | 6 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 23 +- drivers/net/ethernet/intel/ice/ice_main.c | 13 +- drivers/net/ethernet/intel/ice/ice_ptp.c | 55 +++- drivers/net/ethernet/marvell/octeontx2/af/common.h | 2 - .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 35 ++- .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 9 +- .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 22 +- .../net/ethernet/marvell/octeontx2/af/rvu_reg.h | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 16 +- .../ethernet/marvell/octeontx2/nic/otx2_common.h | 3 + .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/dev.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/en/fs.h | 6 - drivers/net/ethernet/mellanox/mlx5/core/en/qos.c | 15 +- drivers/net/ethernet/mellanox/mlx5/core/en/qos.h | 4 +- .../ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 18 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 18 ++ .../ethernet/mellanox/mlx5/core/esw/indir_table.c | 1 + .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 5 +- .../net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 18 +- drivers/net/ethernet/mellanox/mlx5/core/lag.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c | 8 + drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h | 2 + .../net/ethernet/pensando/ionic/ionic_devlink.c | 14 +- drivers/net/ethernet/qualcomm/qca_spi.c | 2 +- drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c | 5 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 47 ++-- drivers/net/ethernet/ti/am65-cpsw-nuss.h | 2 + drivers/net/phy/marvell10g.c | 8 + drivers/net/usb/asix_devices.c | 1 + drivers/net/wireless/ath/ath6kl/wmi.c | 4 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 14 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 + drivers/net/wireless/rsi/rsi_91x_hal.c | 4 +- drivers/net/wireless/rsi/rsi_91x_usb.c | 1 + drivers/nvme/host/rdma.c | 4 +- drivers/nvme/host/tcp.c | 4 +- drivers/nvme/target/fabrics-cmd.c | 9 +- drivers/pci/pci.c | 25 +- drivers/power/supply/axp288_fuel_gauge.c | 4 +- drivers/power/supply/cw2015_battery.c | 4 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/power/supply/smb347-charger.c | 10 + drivers/regulator/tps65910-regulator.c | 10 +- drivers/regulator/vctrl-regulator.c | 73 +++--- drivers/s390/cio/css.c | 17 ++ drivers/s390/crypto/ap_bus.c | 25 +- drivers/s390/crypto/ap_bus.h | 10 +- drivers/s390/crypto/ap_queue.c | 20 +- drivers/s390/crypto/zcrypt_ccamisc.c | 8 +- drivers/soc/mediatek/mt8183-mmsys.h | 21 +- drivers/soc/mediatek/mtk-mmsys.c | 7 +- drivers/soc/mediatek/mtk-mmsys.h | 133 +++++++--- drivers/soc/qcom/rpmhpd.c | 5 +- drivers/soc/qcom/smsm.c | 11 +- drivers/soc/rockchip/Kconfig | 4 +- drivers/spi/spi-coldfire-qspi.c | 2 +- drivers/spi/spi-davinci.c | 8 +- drivers/spi/spi-fsl-dspi.c | 1 + drivers/spi/spi-pic32.c | 1 + drivers/spi/spi-sprd-adi.c | 2 +- drivers/spi/spi-zynq-qspi.c | 8 +- drivers/staging/clocking-wizard/Kconfig | 2 +- .../staging/media/atomisp/i2c/atomisp-mt9m114.c | 11 +- drivers/staging/media/tegra-video/vi.c | 4 +- drivers/tty/serial/fsl_lpuart.c | 2 +- drivers/tty/tty_io.c | 4 +- drivers/usb/dwc3/dwc3-meson-g12a.c | 2 + drivers/usb/dwc3/dwc3-qcom.c | 4 + drivers/usb/gadget/udc/at91_udc.c | 4 +- drivers/usb/gadget/udc/bdc/bdc_core.c | 30 +-- drivers/usb/gadget/udc/mv_u3d_core.c | 19 +- drivers/usb/gadget/udc/renesas_usb3.c | 17 +- drivers/usb/gadget/udc/s3c2410_udc.c | 4 + drivers/usb/host/ehci-orion.c | 8 +- drivers/usb/host/ohci-tmio.c | 3 + drivers/usb/misc/brcmstb-usb-pinmap.c | 2 + drivers/usb/phy/phy-fsl-usb.c | 2 + drivers/usb/phy/phy-tahvo.c | 4 +- drivers/usb/phy/phy-twl6030-usb.c | 5 + drivers/video/backlight/pwm_bl.c | 54 ++-- drivers/video/fbdev/core/fbmem.c | 6 + fs/cifs/cifs_unicode.c | 9 +- fs/cifs/fs_context.c | 11 +- fs/cifs/readdir.c | 23 +- fs/debugfs/file.c | 8 +- fs/f2fs/file.c | 5 +- fs/f2fs/super.c | 11 +- fs/fcntl.c | 18 +- fs/fuse/file.c | 30 ++- fs/fuse/fuse_i.h | 19 ++ fs/fuse/inode.c | 60 +++++ fs/gfs2/ops_fstype.c | 43 ++++ fs/gfs2/super.c | 61 +---- fs/io-wq.c | 105 +++++--- fs/io_uring.c | 5 + fs/iomap/swapfile.c | 6 + fs/isofs/inode.c | 27 +- fs/isofs/isofs.h | 1 - fs/isofs/joliet.c | 4 +- fs/lockd/svclock.c | 2 +- fs/nfsd/nfs4state.c | 4 +- fs/udf/misc.c | 13 +- fs/udf/super.c | 75 +++--- fs/udf/udf_sb.h | 2 - fs/udf/unicode.c | 4 +- include/linux/blkdev.h | 16 ++ include/linux/energy_model.h | 16 ++ include/linux/hrtimer.h | 5 - include/linux/local_lock_internal.h | 42 +-- include/linux/mlx5/mlx5_ifc.h | 3 +- include/linux/power/max17042_battery.h | 2 +- include/linux/sunrpc/svc.h | 1 + include/linux/time64.h | 9 +- include/net/dsa.h | 2 - include/net/pkt_cls.h | 3 +- include/trace/events/io_uring.h | 6 +- include/trace/events/sunrpc.h | 8 +- include/uapi/linux/bpf.h | 2 +- kernel/bpf/verifier.c | 31 ++- kernel/cgroup/cpuset.c | 95 ++++--- kernel/cpu_pm.c | 50 +++- kernel/irq/timings.c | 2 + kernel/locking/mutex.c | 15 +- kernel/power/energy_model.c | 4 +- kernel/rcu/tree_stall.h | 26 +- kernel/sched/core.c | 25 +- kernel/sched/deadline.c | 8 +- kernel/sched/debug.c | 7 + kernel/sched/fair.c | 2 +- kernel/sched/sched.h | 2 + kernel/sched/topology.c | 65 +++++ kernel/time/hrtimer.c | 92 +++++-- kernel/time/posix-cpu-timers.c | 2 - kernel/time/tick-internal.h | 3 + lib/mpi/mpiutil.c | 2 +- lib/test_scanf.c | 4 +- net/6lowpan/debugfs.c | 3 +- net/bluetooth/cmtp/cmtp.h | 2 +- net/bluetooth/hci_core.c | 22 +- net/bluetooth/mgmt.c | 2 +- net/bluetooth/sco.c | 11 +- net/core/devlink.c | 36 ++- net/dsa/Kconfig | 13 +- net/dsa/Makefile | 3 +- net/dsa/dsa_priv.h | 2 - net/dsa/port.c | 21 -- net/dsa/slave.c | 6 - net/dsa/tag_8021q.c | 2 - net/ipv4/route.c | 48 ++-- net/ipv4/tcp_ipv4.c | 5 +- net/ipv6/route.c | 5 +- net/mac80211/main.c | 2 +- net/mac80211/tx.c | 4 +- net/netlabel/netlabel_cipso_v4.c | 8 +- net/qrtr/qrtr.c | 8 +- net/sched/sch_cbq.c | 2 +- net/sched/sch_htb.c | 97 ++++--- net/sunrpc/svc.c | 15 ++ samples/bpf/xdp_redirect_cpu_user.c | 2 +- samples/pktgen/pktgen_sample04_many_flows.sh | 12 +- samples/pktgen/pktgen_sample05_flow_per_thread.sh | 12 +- security/integrity/ima/Kconfig | 1 - security/integrity/ima/ima_mok.c | 2 +- sound/soc/codecs/rt5682-i2c.c | 15 +- sound/soc/codecs/tlv320aic32x4.c | 2 +- sound/soc/codecs/wcd9335.c | 23 +- sound/soc/codecs/wm_adsp.c | 2 + sound/soc/fsl/fsl_rpmsg.c | 20 +- sound/soc/intel/boards/kbl_da7219_max98927.c | 55 +--- sound/soc/intel/common/soc-acpi-intel-cml-match.c | 2 +- sound/soc/intel/common/soc-acpi-intel-kbl-match.c | 2 +- sound/soc/intel/skylake/skl-topology.c | 25 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 43 ++-- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 27 +- sound/usb/card.c | 4 + sound/usb/pcm.c | 3 +- sound/usb/usbaudio.h | 1 + tools/bootconfig/main.c | 4 +- tools/bpf/bpftool/prog.c | 5 +- tools/include/uapi/linux/bpf.h | 2 +- tools/lib/bpf/Makefile | 10 +- tools/lib/bpf/libbpf.c | 20 +- tools/perf/util/bpf-event.c | 4 +- tools/perf/util/bpf_counter.c | 3 +- tools/testing/selftests/bpf/prog_tests/btf.c | 1 + tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c | 2 +- .../selftests/bpf/progs/test_core_autosize.c | 20 +- tools/testing/selftests/bpf/test_maps.c | 4 +- 365 files changed, 3272 insertions(+), 1796 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/334 locking/mutex: Fix HANDOFF condition
From: Peter Zijlstra <[email protected]>
[ Upstream commit 048661a1f963e9517630f080687d48af79ed784c ]
Yanfei reported that setting HANDOFF should not depend on recomputing @first, only on @first state. Which would then give:
if (ww_ctx || !first)
first = __mutex_waiter_is_first(lock, &waiter);
if (first)
__mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);But because 'ww_ctx || !first' is basically 'always' and the test for first is relatively cheap, omit that first branch entirely.
--- kernel/locking/mutex.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-)
kernel/locking/mutex.c +5 -10
@@ -928,7 +928,6 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclas struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx) { struct mutex_waiter waiter; -bool first = false;struct ww_mutex *ww;int ret;
@@ -1007,6 +1006,8 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclasset_current_state (state);for (;;) { +bool first; +/* * Once we hold wait_lock, we're serialized against * mutex_unlock() handing the lock off to us, do a trylock
@@ -1035,15 +1036,9 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclasspin_unlock (&lock->wait_lock);schedule_preempt_disabled (); -/* -* ww_mutex needs to always recheck its position since its waiter -* list is not FIFO ordered. -*/ -if (ww_ctx || !first) { - first =__mutex_waiter_is_first (lock, &waiter); -if (first) -__mutex_set_flag (lock,MUTEX_FLAG_HANDOFF ); - } + first =__mutex_waiter_is_first (lock, &waiter); +if (first) +__mutex_set_flag (lock,MUTEX_FLAG_HANDOFF );set_current_state (state);/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 2/334 regmap: fix the offset of register error log
In reply to Greg Kroah-HartmanFrom: Jeongtae Park <[email protected]>
[ Upstream commit 1852f5ed358147095297a09cc3c6f160208a676d ]
This patch fixes the offset of register error log
by using regmap_get_offset().
--- drivers/base/regmap/regmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap.c +1 -1
@@ -1667,7 +1667,7 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg,if (ret) {dev_err (map->dev,"Error in caching of register: %x ret: %d\n" , - reg + i, ret); + reg +regmap_get_offset (map, i), ret);return ret; } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 3/334 regulator: tps65910: Silence deferred probe error
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit e301df76472cc929fa62d923bc3892931f7ad71d ]
The TPS65910 regulator now gets a deferred probe until supply regulator is registered. Silence noisy error message about the deferred probe.
--- drivers/regulator/tps65910-regulator.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/regulator/tps65910-regulator.c +4 -6
@@ -1211,12 +1211,10 @@ static int tps65910_probe(struct platform_device *pdev) rdev =devm_regulator_register (&pdev->dev, &pmic->desc[i], &config); -if (IS_ERR (rdev)) { -dev_err (tps65910->dev, -"failed to register %s regulator\n" , - pdev->name); -return PTR_ERR (rdev); - } +if (IS_ERR (rdev)) +return dev_err_probe (tps65910->dev,PTR_ERR (rdev), +"failed to register %s regulator\n" , + pdev->name);/* Save regulator for cleanup */ pmic->rdev[i] = rdev;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 4/334 crypto: mxs-dcp - Check for DMA mapping errors
In reply to Greg Kroah-HartmanFrom: Sean Anderson <[email protected]>
[ Upstream commit df6313d707e575a679ada3313358289af24454c0 ]
After calling dma_map_single(), we must also call dma_mapping_error(). This fixes the following warning when compiling with CONFIG_DMA_API_DEBUG:
[ 311.241478] WARNING: CPU: 0 PID: 428 at kernel/dma/debug.c:1027 check_unmap+0x79c/0x96c [ 311.249547] DMA-API: mxs-dcp 2280000.crypto: device driver failed to check map error[device address=0x00000000860cb080] [size=32 bytes] [mapped as single]
--- drivers/crypto/mxs-dcp.c | 45 +++++++++++++++++++++++++++++++--------- 1 file changed, 35 insertions(+), 10 deletions(-)
drivers/crypto/mxs-dcp.c +35 -10
@@ -170,15 +170,19 @@ static struct dcp *global_sdcp;static int mxs_dcp_start_dma (struct dcp_async_ctx *actx) { +int dma_err;struct dcp *sdcp = global_sdcp;const int chan = actx->chan;uint32_t stat;unsigned long ret;struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan]; -dma_addr_t desc_phys =dma_map_single (sdcp->dev, desc,sizeof (*desc),DMA_TO_DEVICE ); + dma_err =dma_mapping_error (sdcp->dev, desc_phys); +if (dma_err) +return dma_err; +reinit_completion (&sdcp->completion[chan]);/* Clear status register. */
@@ -216,18 +220,29 @@ static int mxs_dcp_start_dma(struct dcp_async_ctx *actx)static int mxs_dcp_run_aes (struct dcp_async_ctx *actx,struct skcipher_request *req,int init) { +dma_addr_t key_phys, src_phys, dst_phys;struct dcp *sdcp = global_sdcp;struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];struct dcp_aes_req_ctx *rctx =skcipher_request_ctx (req);int ret; -dma_addr_t key_phys =dma_map_single (sdcp->dev, sdcp->coh->aes_key, -2 *AES_KEYSIZE_128 , -DMA_TO_DEVICE ); -dma_addr_t src_phys =dma_map_single (sdcp->dev, sdcp->coh->aes_in_buf, -DCP_BUF_SZ ,DMA_TO_DEVICE ); -dma_addr_t dst_phys =dma_map_single (sdcp->dev, sdcp->coh->aes_out_buf, -DCP_BUF_SZ ,DMA_FROM_DEVICE ); + key_phys =dma_map_single (sdcp->dev, sdcp->coh->aes_key, +2 *AES_KEYSIZE_128 ,DMA_TO_DEVICE ); + ret =dma_mapping_error (sdcp->dev, key_phys); +if (ret) +return ret; + + src_phys =dma_map_single (sdcp->dev, sdcp->coh->aes_in_buf, +DCP_BUF_SZ ,DMA_TO_DEVICE ); + ret =dma_mapping_error (sdcp->dev, src_phys); +if (ret) + goto err_src; + + dst_phys =dma_map_single (sdcp->dev, sdcp->coh->aes_out_buf, +DCP_BUF_SZ ,DMA_FROM_DEVICE ); + ret =dma_mapping_error (sdcp->dev, dst_phys); +if (ret) + goto err_dst;if (actx->fill %AES_BLOCK_SIZE ) {dev_err (sdcp->dev,"Invalid block size!\n" );
@@ -265,10 +280,12 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx, ret =mxs_dcp_start_dma (actx); aes_done_run: +dma_unmap_single (sdcp->dev, dst_phys,DCP_BUF_SZ ,DMA_FROM_DEVICE ); +err_dst: +dma_unmap_single (sdcp->dev, src_phys,DCP_BUF_SZ ,DMA_TO_DEVICE ); +err_src:dma_unmap_single (sdcp->dev, key_phys,2 *AES_KEYSIZE_128 ,DMA_TO_DEVICE ); -dma_unmap_single (sdcp->dev, src_phys,DCP_BUF_SZ ,DMA_TO_DEVICE ); -dma_unmap_single (sdcp->dev, dst_phys,DCP_BUF_SZ ,DMA_FROM_DEVICE );return ret; }
@@ -557,6 +574,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)dma_addr_t buf_phys =dma_map_single (sdcp->dev, sdcp->coh->sha_in_buf,DCP_BUF_SZ ,DMA_TO_DEVICE ); + ret =dma_mapping_error (sdcp->dev, buf_phys); +if (ret) +return ret; +/* Fill in the DMA descriptor. */ desc->control0 =MXS_DCP_CONTROL0_DECR_SEMAPHORE | MXS_DCP_CONTROL0_INTERRUPT |
@@ -589,6 +610,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)if (rctx->fini) { digest_phys =dma_map_single (sdcp->dev, sdcp->coh->sha_out_buf,DCP_SHA_PAY_SZ ,DMA_FROM_DEVICE ); + ret =dma_mapping_error (sdcp->dev, digest_phys); +if (ret) + goto done_run; + desc->control0 |=MXS_DCP_CONTROL0_HASH_TERM ; desc->payload = digest_phys; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 5/334 sched/deadline: Fix reset_on_fork reporting of DL tasks
In reply to Greg Kroah-HartmanFrom: Quentin Perret <[email protected]>
[ Upstream commit f95091536f78971b269ec321b057b8d630b0ad8a ]
It is possible for sched_getattr() to incorrectly report the state of the reset_on_fork flag when called on a deadline task.
Indeed, if the flag was set on a deadline task using sched_setattr() with flags (SCHED_FLAG_RESET_ON_FORK | SCHED_FLAG_KEEP_PARAMS), then p->sched_reset_on_fork will be set, but __setscheduler() will bail out early, which means that the dl_se->flags will not get updated by __setscheduler_params()->__setparam_dl(). Consequently, if sched_getattr() is then called on the task, __getparam_dl() will override kattr.sched_flags with the now out-of-date copy in dl_se->flags and report the stale value to userspace.
To fix this, make sure to only copy the flags that are relevant to sched_deadline to and from the dl_se->flags field.
--- kernel/sched/deadline.c | 7 ++++--- kernel/sched/sched.h | 2 ++ 2 files changed, 6 insertions(+), 3 deletions(-)
kernel/sched/deadline.c +4 -3
@@ -2741,7 +2741,7 @@ void __setparam_dl(struct task_struct *p, const struct sched_attr *attr) dl_se->dl_runtime = attr->sched_runtime; dl_se->dl_deadline = attr->sched_deadline; dl_se->dl_period = attr->sched_period ?: dl_se->dl_deadline; - dl_se->flags = attr->sched_flags; + dl_se->flags = attr->sched_flags &SCHED_DL_FLAGS ; dl_se->dl_bw =to_ratio (dl_se->dl_period, dl_se->dl_runtime); dl_se->dl_density =to_ratio (dl_se->dl_deadline, dl_se->dl_runtime); }
@@ -2754,7 +2754,8 @@ void __getparam_dl(struct task_struct *p, struct sched_attr *attr) attr->sched_runtime = dl_se->dl_runtime; attr->sched_deadline = dl_se->dl_deadline; attr->sched_period = dl_se->dl_period; - attr->sched_flags = dl_se->flags; + attr->sched_flags &= ~SCHED_DL_FLAGS ; + attr->sched_flags |= dl_se->flags; }/*
@@ -2851,7 +2852,7 @@ bool dl_param_changed(struct task_struct *p, const struct sched_attr *attr)if (dl_se->dl_runtime != attr->sched_runtime || dl_se->dl_deadline != attr->sched_deadline || dl_se->dl_period != attr->sched_period || - dl_se->flags != attr->sched_flags) + dl_se->flags != (attr->sched_flags &SCHED_DL_FLAGS ))return true;return false;
kernel/sched/sched.h +2 -0
@@ -227,6 +227,8 @@ static inline void update_avg(u64 *avg, u64 sample)*/ #define SCHED_FLAG_SUGOV 0x10000000 +#define SCHED_DL_FLAGS (SCHED_FLAG_RECLAIM | SCHED_FLAG_DL_OVERRUN | SCHED_FLAG_SUGOV) +static inline bool dl_entity_is_special (struct sched_dl_entity *dl_se) {#ifdef CONFIG_CPU_FREQ_GOV_SCHEDUTIL
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 6/334 power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit caa534c3ba40c6e8352b42cbbbca9ba481814ac8 ]
When fuel_gauge_reg_readb()/_writeb() fails, report which register we were trying to read / write when the error happened.
Also reword the message a bit:
- Drop the axp288 prefix, dev_err() already prints this
- Switch from telegram / abbreviated style to a normal sentence, aligning the message with those from fuel_gauge_read_*bit_word()
--- drivers/power/supply/axp288_fuel_gauge.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/power/supply/axp288_fuel_gauge.c +2 -2
@@ -147,7 +147,7 @@ static int fuel_gauge_reg_readb(struct axp288_fg_info *info, int reg) }if (ret <0 ) { -dev_err (&info->pdev->dev,"axp288 reg read err:%d\n" , ret); +dev_err (&info->pdev->dev,"Error reading reg 0x%02x err: %d\n" , reg, ret);return ret; }
@@ -161,7 +161,7 @@ static int fuel_gauge_reg_writeb(struct axp288_fg_info *info, int reg, u8 val) ret =regmap_write (info->regmap, reg, (unsigned int )val);if (ret <0 ) -dev_err (&info->pdev->dev,"axp288 reg write err:%d\n" , ret); +dev_err (&info->pdev->dev,"Error writing reg 0x%02x err: %d\n" , reg, ret);return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 7/334 crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit fe28140b3393b0ba1eb95cc109f974a7e58b26fd ]
We should not clear FLAGS_DMA_ACTIVE before omap_sham_update_dma_stop() is done calling dma_unmap_sg(). We already clear FLAGS_DMA_ACTIVE at the end of omap_sham_update_dma_stop().
The early clearing of FLAGS_DMA_ACTIVE is not causing issues as we do not need to defer anything based on FLAGS_DMA_ACTIVE currently. So this can be applied as clean-up.
--- drivers/crypto/omap-sham.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/omap-sham.c +1 -1
@@ -1736,7 +1736,7 @@ static void omap_sham_done_task(unsigned long data)if (test_and_clear_bit (FLAGS_OUTPUT_READY , &dd->flags)) goto finish; }else if (test_bit (FLAGS_DMA_READY , &dd->flags)) { -if (test_and_clear_bit (FLAGS_DMA_ACTIVE , &dd->flags)) { +if (test_bit (FLAGS_DMA_ACTIVE , &dd->flags)) {omap_sham_update_dma_stop (dd);if (dd->err) { err = dd->err;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 8/334 sched/deadline: Fix missing clock update in migrate_task_rq_dl()
In reply to Greg Kroah-HartmanFrom: Dietmar Eggemann <[email protected]>
[ Upstream commit b4da13aa28d4fd0071247b7b41c579ee8a86c81a ]
A missing clock update is causing the following warning:
rq->clock_update_flags < RQCF_ACT_SKIP
WARNING: CPU: 112 PID: 2041 at kernel/sched/sched.h:1453 sub_running_bw.isra.0+0x190/0x1a0 ... CPU: 112 PID: 2041 Comm: sugov:112 Tainted: G W 5.14.0-rc1 #1 Hardware name: WIWYNN Mt.Jade Server System B81.030Z1.0007/Mt.Jade Motherboard, BIOS 1.6.20210526 (SCP: 1.06.20210526) 2021/05/26 ... Call trace: sub_running_bw.isra.0+0x190/0x1a0 migrate_task_rq_dl+0xf8/0x1e0 set_task_cpu+0xa8/0x1f0 try_to_wake_up+0x150/0x3d4 wake_up_q+0x64/0xc0 __up_write+0xd0/0x1c0 up_write+0x4c/0x2b0 cppc_set_perf+0x120/0x2d0 cppc_cpufreq_set_target+0xe0/0x1a4 [cppc_cpufreq] __cpufreq_driver_target+0x74/0x140 sugov_work+0x64/0x80 kthread_worker_fn+0xe0/0x230 kthread+0x138/0x140 ret_from_fork+0x10/0x18
The task causing this is the cppc_fie DL task introduced by commit 1eb5dde674f5 ("cpufreq: CPPC: Add support for frequency invariance").
With CONFIG_ACPI_CPPC_CPUFREQ_FIE=y and schedutil cpufreq governor on slow-switching system (like on this Ampere Altra WIWYNN Mt. Jade Arm Server):
DL task curr=sugov:112 lets p=cppc_fie migrate and since the latter is in non_contending state, migrate_task_rq_dl() calls
sub_running_bw()->__sub_running_bw()->cpufreq_update_util()-> rq_clock()->assert_clock_updated()
on p.
Fix this by updating the clock for a non_contending task in migrate_task_rq_dl() before calling sub_running_bw().
--- kernel/sched/deadline.c | 1 + 1 file changed, 1 insertion(+)
kernel/sched/deadline.c +1 -0
@@ -1733,6 +1733,7 @@ static void migrate_task_rq_dl(struct task_struct *p, int new_cpu __maybe_unused*/ raw_spin_rq_lock (rq);if (p->dl.dl_non_contending) { +update_rq_clock (rq);sub_running_bw (&p->dl, &rq->dl); p->dl.dl_non_contending =0 ;/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 9/334 rcu/tree: Handle VM stoppage in stall detection
In reply to Greg Kroah-HartmanFrom: Sergey Senozhatsky <[email protected]>
[ Upstream commit ccfc9dd6914feaa9a81f10f9cce56eb0f7712264 ]
The soft watchdog timer function checks if a virtual machine was suspended and hence what looks like a lockup in fact is a false positive.
This is what kvm_check_and_clear_guest_paused() does: it tests guest PVCLOCK_GUEST_STOPPED (which is set by the host) and if it's set then we need to touch all watchdogs and bail out.
Watchdog timer function runs from IRQ, so PVCLOCK_GUEST_STOPPED check works fine.
There is, however, one more watchdog that runs from IRQ, so watchdog timer fn races with it, and that watchdog is not aware of PVCLOCK_GUEST_STOPPED - RCU stall detector.
apic_timer_interrupt()
smp_apic_timer_interrupt()
hrtimer_interrupt()
__hrtimer_run_queues()
tick_sched_timer()
tick_sched_handle()
update_process_times()
rcu_sched_clock_irq()
This triggers RCU stalls on our devices during VM resume.
If tick_sched_handle()->rcu_sched_clock_irq() runs on a VCPU before watchdog_timer_fn()->kvm_check_and_clear_guest_paused() then there is nothing on this VCPU that touches watchdogs and RCU reads stale gp stall timestamp and new jiffies value, which makes it think that RCU has stalled.
Make RCU stall watchdog aware of PVCLOCK_GUEST_STOPPED and don't report RCU stalls when we resume the VM.
--- kernel/rcu/tree_stall.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
kernel/rcu/tree_stall.h +18 -0
@@ -7,6 +7,8 @@* Author: Paul E. McKenney <[email protected]> */ +#include <linux/kvm_para.h> +////////////////////////////////////////////////////////////////////////////// // // Controlling CPU stall warnings, including delay calculation.
@@ -696,6 +698,14 @@ static void check_cpu_stall(struct rcu_data *rdp) (READ_ONCE(rnp->qsmask) & rdp->grpmask) && cmpxchg(&rcu_state.jiffies_stall, js, jn) == js) { +/* +* If a virtual machine is stopped by the host it can look to +* the watchdog like an RCU stall. Check to see if the host +* stopped the vm. +*/ +if (kvm_check_and_clear_guest_paused ()) +return ; +/* We haven't checked in, so go dump stack. */ print_cpu_stall (gps);if (READ_ONCE (rcu_cpu_stall_ftrace_dump))
@@ -705,6 +715,14 @@ static void check_cpu_stall(struct rcu_data *rdp) ULONG_CMP_GE(j, js + RCU_STALL_RAT_DELAY) && cmpxchg(&rcu_state.jiffies_stall, js, jn) == js) { +/* +* If a virtual machine is stopped by the host it can look to +* the watchdog like an RCU stall. Check to see if the host +* stopped the vm. +*/ +if (kvm_check_and_clear_guest_paused ()) +return ; +/* They had a few time units to dump stack, so complain. */ print_other_cpu_stall (gs2, gps);if (READ_ONCE (rcu_cpu_stall_ftrace_dump))
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 10/334 EDAC/mce_amd: Do not load edac_mce_amd module on guests
In reply to Greg Kroah-HartmanFrom: Smita Koralahalli <[email protected]>
[ Upstream commit 767f4b620edadac579c9b8b6660761d4285fa6f9 ]
Hypervisors likely do not expose the SMCA feature to the guest and loading this module leads to false warnings. This module should not be loaded in guests to begin with, but people tend to do so, especially when testing kernels in VMs. And then they complain about those false warnings.
Do the practical thing and do not load this module when running as a guest to avoid all that complaining.
[ bp: Rewrite commit message. ]
--- drivers/edac/mce_amd.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/edac/mce_amd.c +3 -0
@@ -1246,6 +1246,9 @@ static int __init mce_amd_init(void) c->x86_vendor != X86_VENDOR_HYGON)return -ENODEV ; +if (cpu_feature_enabled (X86_FEATURE_HYPERVISOR )) +return -ENODEV ; +if (boot_cpu_has (X86_FEATURE_SMCA )) { xec_mask =0x3f ; goto out;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 11/334 posix-cpu-timers: Force next expiration recalc after itimer reset
In reply to Greg Kroah-HartmanFrom: Frederic Weisbecker <[email protected]>
[ Upstream commit 406dd42bd1ba0c01babf9cde169bb319e52f6147 ]
When an itimer deactivates a previously armed expiration, it simply doesn't do anything. As a result the process wide cputime counter keeps running and the tick dependency stays set until it reaches the old ghost expiration value.
This can be reproduced with the following snippet:
void trigger_process_counter(void)
{
struct itimerval n = {};
n.it_value.tv_sec = 100;
setitimer(ITIMER_VIRTUAL, &n, NULL);
n.it_value.tv_sec = 0;
setitimer(ITIMER_VIRTUAL, &n, NULL);
}Fix this with resetting the relevant base expiration. This is similar to disarming a timer.
--- kernel/time/posix-cpu-timers.c | 2 -- 1 file changed, 2 deletions(-)
kernel/time/posix-cpu-timers.c +0 -2
@@ -1346,8 +1346,6 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clkid, } } -if (!*newval) -return ; *newval += now; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 12/334 hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
[ Upstream commit 627ef5ae2df8eeccb20d5af0e4cfa4df9e61ed28 ]
If __hrtimer_start_range_ns() is invoked with an already armed hrtimer then the timer has to be canceled first and then added back. If the timer is the first expiring timer then on removal the clockevent device is reprogrammed to the next expiring timer to avoid that the pending expiry fires needlessly.
If the new expiry time ends up to be the first expiry again then the clock event device has to reprogrammed again.
Avoid this by checking whether the timer is the first to expire and in that case, keep the timer on the current CPU and delay the reprogramming up to the point where the timer has been enqueued again.
--- kernel/time/hrtimer.c | 60 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 53 insertions(+), 7 deletions(-)
kernel/time/hrtimer.c +53 -7
@@ -1030,12 +1030,13 @@ static void __remove_hrtimer(struct hrtimer *timer,* remove hrtimer, called with base lock held */ static inline int -remove_hrtimer (struct hrtimer *timer,struct hrtimer_clock_base *base,bool restart) +remove_hrtimer (struct hrtimer *timer,struct hrtimer_clock_base *base, +bool restart,bool keep_local) {u8 state = timer->state;if (state &HRTIMER_STATE_ENQUEUED ) { -int reprogram; +bool reprogram;/* * Remove the timer and force reprogramming when high
@@ -1048,8 +1049,16 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restdebug_deactivate (timer); reprogram = base->cpu_base ==this_cpu_ptr (&hrtimer_bases); +/* +* If the timer is not restarted then reprogramming is +* required if the timer is local. If it is local and about +* to be restarted, avoid programming it twice (on removal +* and a moment later when it's requeued). +*/ if (!restart) state =HRTIMER_STATE_INACTIVE ; +else + reprogram &= !keep_local;__remove_hrtimer (timer, base, state, reprogram);return 1 ;
@@ -1103,9 +1112,31 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, struct hrtimer_clock_base *base) {struct hrtimer_clock_base *new_base; +bool force_local, first; -/* Remove an active timer from the queue: */ -remove_hrtimer (timer, base, true); +/* +* If the timer is on the local cpu base and is the first expiring +* timer then this might end up reprogramming the hardware twice +* (on removal and on enqueue). To avoid that by prevent the +* reprogram on removal, keep the timer local to the current CPU +* and enforce reprogramming after it is queued no matter whether +* it is the new first expiring timer again or not. +*/ + force_local = base->cpu_base ==this_cpu_ptr (&hrtimer_bases); + force_local &= base->cpu_base->next_timer == timer; + +/* +* Remove an active timer from the queue. In case it is not queued +* on the current CPU, make sure that remove_hrtimer() updates the +* remote data correctly. +* +* If it's on the current CPU and the first expiring timer, then +* skip reprogramming, keep the timer local and enforce +* reprogramming later if it was the first expiring timer. This +* avoids programming the underlying clock event twice (once at +* removal and once after enqueue). +*/ +remove_hrtimer (timer, base, true, force_local);if (mode &HRTIMER_MODE_REL ) tim =ktime_add_safe (tim, base->get_time ());
@@ -1115,9 +1146,24 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,hrtimer_set_expires_range_ns (timer, tim, delta_ns);/* Switch the timer base, if necessary: */ - new_base =switch_hrtimer_base (timer, base, mode &HRTIMER_MODE_PINNED ); +if (!force_local) { + new_base =switch_hrtimer_base (timer, base, + mode &HRTIMER_MODE_PINNED ); + }else { + new_base = base; + } + + first =enqueue_hrtimer (timer, new_base, mode); +if (!force_local) +return first; -return enqueue_hrtimer (timer, new_base, mode); +/* +* Timer was forced to stay on the current CPU to avoid +* reprogramming on removal and enqueue. Force reprogram the +* hardware by evaluating the new first expiring timer. +*/ +hrtimer_force_reprogram (new_base->cpu_base,1 ); +return 0 ; }/**
@@ -1183,7 +1229,7 @@ int hrtimer_try_to_cancel(struct hrtimer *timer) base =lock_hrtimer_base (timer, &flags);if (!hrtimer_callback_running (timer)) - ret =remove_hrtimer (timer, base, false); + ret =remove_hrtimer (timer, base, false, false);unlock_hrtimer_base (timer, &flags);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 13/334 hrtimer: Ensure timerfd notification for HIGHRES=n
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
[ Upstream commit 8c3b5e6ec0fee18bc2ce38d1dfe913413205f908 ]
If high resolution timers are disabled the timerfd notification about a clock was set event is not happening for all cases which use clock_was_set_delayed() because that's a NOP for HIGHRES=n, which is wrong.
Make clock_was_set_delayed() unconditially available to fix that.
--- include/linux/hrtimer.h | 5 ----- kernel/time/hrtimer.c | 32 ++++++++++++++++---------------- kernel/time/tick-internal.h | 3 +++ 3 files changed, 19 insertions(+), 21 deletions(-)
include/linux/hrtimer.h +0 -5
@@ -318,16 +318,12 @@ struct clock_event_device;extern void hrtimer_interrupt (struct clock_event_device *dev); -extern void clock_was_set_delayed (void ); -extern unsigned int hrtimer_resolution;#else #define hrtimer_resolution (unsigned int)LOW_RES_NSEC -static inline void clock_was_set_delayed (void ) { } -#endif static inline ktime_t
@@ -351,7 +347,6 @@ hrtimer_expires_remaining_adjusted(const struct hrtimer *timer) timer->base->get_time()); } -extern void clock_was_set (void );#ifdef CONFIG_TIMERFD extern void timerfd_clock_was_set (void );#else
kernel/time/hrtimer.c +16 -16
@@ -758,22 +758,6 @@ static void hrtimer_switch_to_hres(void) retrigger_next_event(NULL); } -static void clock_was_set_work (struct work_struct *work) -{ -clock_was_set (); -} - -static DECLARE_WORK(hrtimer_work, clock_was_set_work); - -/* -* Called from timekeeping and resume code to reprogram the hrtimer -* interrupt device on all cpus. -*/ -void clock_was_set_delayed (void ) -{ -schedule_work (&hrtimer_work); -} -#else static inline int hrtimer_is_hres_enabled (void ) {return 0 ; }
@@ -891,6 +875,22 @@ void clock_was_set(void)timerfd_clock_was_set (); } +static void clock_was_set_work (struct work_struct *work) +{ +clock_was_set (); +} + +static DECLARE_WORK(hrtimer_work, clock_was_set_work); + +/* +* Called from timekeeping and resume code to reprogram the hrtimer +* interrupt device on all cpus and to notify timerfd. +*/ +void clock_was_set_delayed (void ) +{ +schedule_work (&hrtimer_work); +} +/* * During resume we might have to reprogram the high resolution timer * interrupt on all online CPUs. However, all other CPUs will be
kernel/time/tick-internal.h +3 -0
@@ -165,3 +165,6 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);extern u64 get_next_timer_interrupt (unsigned long basej,u64 basem);void timer_clear_idle (void ); + +void clock_was_set (void ); +void clock_was_set_delayed (void );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 14/334 udf: Check LVID earlier
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit 781d2a9a2fc7d0be53a072794dc03ef6de770f3d ]
We were checking validity of LVID entries only when getting implementation use information from LVID in udf_sb_lvidiu(). However if the LVID is suitably corrupted, it can cause problems also to code such as udf_count_free() which doesn't use udf_sb_lvidiu(). So check validity of LVID already when loading it from the disk and just disable LVID altogether when it is not valid.
--- fs/udf/super.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
fs/udf/super.c +16 -9
@@ -108,16 +108,10 @@ struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb)return NULL ; lvid = (struct logicalVolIntegrityDesc *)UDF_SB (sb)->s_lvid_bh->b_data; partnum =le32_to_cpu (lvid->numOfPartitions); -if ((sb->s_blocksize -sizeof (struct logicalVolIntegrityDescImpUse ) - - offsetof(struct logicalVolIntegrityDesc , impUse)) / - (2 *sizeof (uint32_t )) < partnum) { -udf_err (sb,"Logical volume integrity descriptor corrupted " -"(numOfPartitions = %u)!\n" , partnum); -return NULL ; - }/* The offset is to skip freeSpaceTable and sizeTable arrays */ offset = partnum *2 *sizeof (uint32_t ); -return (struct logicalVolIntegrityDescImpUse *)&(lvid->impUse[offset]); +return (struct logicalVolIntegrityDescImpUse *) + (((uint8_t *)(lvid +1 )) + offset); }/* UDF filesystem type */
@@ -1542,6 +1536,7 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_struct udf_sb_info *sbi =UDF_SB (sb);struct logicalVolIntegrityDesc *lvid;int indirections =0 ; +u32 parts, impuselen;while (++indirections <=UDF_MAX_LVID_NESTING ) { final_bh =NULL ;
@@ -1568,15 +1563,27 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_ lvid = (struct logicalVolIntegrityDesc *)final_bh->b_data;if (lvid->nextIntegrityExt.extLength ==0 ) -return ; + goto check; loc =leea_to_cpu (lvid->nextIntegrityExt); }udf_warn (sb,"Too many LVID indirections (max %u), ignoring.\n" ,UDF_MAX_LVID_NESTING ); +out_err:brelse (sbi->s_lvid_bh); sbi->s_lvid_bh =NULL ; +return ; +check: + parts =le32_to_cpu (lvid->numOfPartitions); + impuselen =le32_to_cpu (lvid->lengthOfImpUse); +if (parts >= sb->s_blocksize || impuselen >= sb->s_blocksize || +sizeof (struct logicalVolIntegrityDesc ) + impuselen + +2 * parts *sizeof (u32) > sb->s_blocksize) { +udf_warn (sb,"Corrupted LVID (parts=%u, impuselen=%u), " +"ignoring.\n" , parts, impuselen); + goto out_err; + } }/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 15/334 udf: Fix iocharset=utf8 mount option
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit b645333443712d2613e4e863f81090d5dc509657 ]
Currently iocharset=utf8 mount option is broken. To use UTF-8 as iocharset, it is required to use utf8 mount option.
Fix iocharset=utf8 mount option to use be equivalent to the utf8 mount option.
If UTF-8 as iocharset is used then s_nls_map is set to NULL. So simplify code around, remove UDF_FLAG_NLS_MAP and UDF_FLAG_UTF8 flags as to distinguish between UTF-8 and non-UTF-8 it is needed just to check if s_nls_map set to NULL or not.
--- fs/udf/super.c | 50 ++++++++++++++++++------------------------------ fs/udf/udf_sb.h | 2 -- fs/udf/unicode.c | 4 ++-- 3 files changed, 21 insertions(+), 35 deletions(-)
fs/udf/super.c +19 -31
@@ -343,10 +343,10 @@ static int udf_show_options(struct seq_file *seq, struct dentry *root)seq_printf (seq,",lastblock=%u" , sbi->s_last_block);if (sbi->s_anchor !=0 )seq_printf (seq,",anchor=%u" , sbi->s_anchor); -if (UDF_QUERY_FLAG (sb,UDF_FLAG_UTF8 )) -seq_puts (seq,",utf8" ); -if (UDF_QUERY_FLAG (sb,UDF_FLAG_NLS_MAP ) && sbi->s_nls_map) +if (sbi->s_nls_map)seq_printf (seq,",iocharset=%s" , sbi->s_nls_map->charset); +else +seq_puts (seq,",iocharset=utf8" );return 0 ; }
@@ -552,19 +552,24 @@ static int udf_parse_options(char *options, struct udf_options *uopt,/* Ignored (never implemented properly) */ break ;case Opt_utf8: - uopt->flags |= (1 <<UDF_FLAG_UTF8 ); +if (!remount) { +unload_nls (uopt->nls_map); + uopt->nls_map =NULL ; + }break ;case Opt_iocharset:if (!remount) { -if (uopt->nls_map) -unload_nls (uopt->nls_map); -/* -* load_nls() failure is handled later in -* udf_fill_super() after all options are -* parsed. -*/ +unload_nls (uopt->nls_map); + uopt->nls_map =NULL ; + } +/* When nls_map is not loaded then UTF-8 is used */ +if (!remount &&strcmp (args[0 ].from,"utf8" ) !=0 ) { uopt->nls_map =load_nls (args[0 ].from); - uopt->flags |= (1 <<UDF_FLAG_NLS_MAP ); +if (!uopt->nls_map) { +pr_err ("iocharset %s not found\n" , + args[0 ].from); +return 0 ; + } }break ;case Opt_uforget:
@@ -2146,21 +2151,6 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)if (!udf_parse_options ((char *)options, &uopt, false)) goto parse_options_failure; -if (uopt.flags & (1 <<UDF_FLAG_UTF8 ) && - uopt.flags & (1 <<UDF_FLAG_NLS_MAP )) { -udf_err (sb,"utf8 cannot be combined with iocharset\n" ); - goto parse_options_failure; - } -if ((uopt.flags & (1 <<UDF_FLAG_NLS_MAP )) && !uopt.nls_map) { - uopt.nls_map =load_nls_default (); -if (!uopt.nls_map) - uopt.flags &= ~(1 <<UDF_FLAG_NLS_MAP ); -else -udf_debug ("Using default NLS map\n" ); - } -if (!(uopt.flags & (1 <<UDF_FLAG_NLS_MAP ))) - uopt.flags |= (1 <<UDF_FLAG_UTF8 ); - fileset.logicalBlockNum =0xFFFFFFFF ; fileset.partitionReferenceNum =0xFFFF ;
@@ -2315,8 +2305,7 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) error_out:iput (sbi->s_vat_inode); parse_options_failure: -if (uopt.nls_map) -unload_nls (uopt.nls_map); +unload_nls (uopt.nls_map);if (lvid_open)udf_close_lvid (sb);brelse (sbi->s_lvid_bh);
@@ -2366,8 +2355,7 @@ static void udf_put_super(struct super_block *sb) sbi =UDF_SB (sb);iput (sbi->s_vat_inode); -if (UDF_QUERY_FLAG (sb,UDF_FLAG_NLS_MAP )) -unload_nls (sbi->s_nls_map); +unload_nls (sbi->s_nls_map);if (!sb_rdonly (sb))udf_close_lvid (sb);brelse (sbi->s_lvid_bh);
fs/udf/udf_sb.h +0 -2
@@ -20,8 +20,6 @@#define UDF_FLAG_UNDELETE 6#define UDF_FLAG_UNHIDE 7#define UDF_FLAG_VARCONV 8 -#define UDF_FLAG_NLS_MAP 9 -#define UDF_FLAG_UTF8 10#define UDF_FLAG_UID_FORGET 11/* save -1 for uid to disk */ #define UDF_FLAG_GID_FORGET 12#define UDF_FLAG_UID_SET 13
fs/udf/unicode.c +2 -2
@@ -177,7 +177,7 @@ static int udf_name_from_CS0(struct super_block *sb,return 0 ; } -if (UDF_QUERY_FLAG (sb,UDF_FLAG_NLS_MAP )) +if (UDF_SB (sb)->s_nls_map) conv_f =UDF_SB (sb)->s_nls_map->uni2char;else conv_f =NULL ;
@@ -285,7 +285,7 @@ static int udf_name_to_CS0(struct super_block *sb,if (ocu_max_len <=0 )return 0 ; -if (UDF_QUERY_FLAG (sb,UDF_FLAG_NLS_MAP )) +if (UDF_SB (sb)->s_nls_map) conv_f =UDF_SB (sb)->s_nls_map->char2uni;else conv_f =NULL ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 16/334 isofs: joliet: Fix iocharset=utf8 mount option
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit 28ce50f8d96ec9035f60c9348294ea26b94db944 ]
Currently iocharset=utf8 mount option is broken. To use UTF-8 as iocharset, it is required to use utf8 mount option.
Fix iocharset=utf8 mount option to use be equivalent to the utf8 mount option.
If UTF-8 as iocharset is used then s_nls_iocharset is set to NULL. So simplify code around, remove s_utf8 field as to distinguish between UTF-8 and non-UTF-8 it is needed just to check if s_nls_iocharset is set to NULL or not.
--- fs/isofs/inode.c | 27 +++++++++++++-------------- fs/isofs/isofs.h | 1 - fs/isofs/joliet.c | 4 +--- 3 files changed, 14 insertions(+), 18 deletions(-)
fs/isofs/inode.c +13 -14
@@ -155,7 +155,6 @@ struct iso9660_options{ unsigned int overriderockperm:1; unsigned int uid_set:1; unsigned int gid_set:1; - unsigned int utf8:1;unsigned char map;unsigned char check;unsigned int blocksize;
@@ -356,7 +355,6 @@ static int parse_options(char *options, struct iso9660_options *popt) popt->gid =GLOBAL_ROOT_GID ; popt->uid =GLOBAL_ROOT_UID ; popt->iocharset =NULL ; - popt->utf8 =0 ; popt->overriderockperm =0 ; popt->session=-1 ; popt->sbsector=-1 ;
@@ -389,10 +387,13 @@ static int parse_options(char *options, struct iso9660_options *popt)case Opt_cruft: popt->cruft =1 ;break ; +#ifdef CONFIG_JOLIET case Opt_utf8: - popt->utf8 =1 ; +kfree (popt->iocharset); + popt->iocharset =kstrdup ("utf8" ,GFP_KERNEL ); +if (!popt->iocharset) +return 0 ;break ; -#ifdef CONFIG_JOLIET case Opt_iocharset:kfree (popt->iocharset); popt->iocharset =match_strdup (&args[0 ]);
@@ -495,7 +496,6 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)if (sbi->s_nocompress)seq_puts (m,",nocompress" );if (sbi->s_overriderockperm)seq_puts (m,",overriderockperm" );if (sbi->s_showassoc)seq_puts (m,",showassoc" ); -if (sbi->s_utf8)seq_puts (m,",utf8" );if (sbi->s_check)seq_printf (m,",check=%c" , sbi->s_check);if (sbi->s_mapping)seq_printf (m,",map=%c" , sbi->s_mapping);
@@ -518,9 +518,10 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)seq_printf (m,",fmode=%o" , sbi->s_fmode);#ifdef CONFIG_JOLIET -if (sbi->s_nls_iocharset && -strcmp (sbi->s_nls_iocharset->charset,CONFIG_NLS_DEFAULT ) !=0 ) +if (sbi->s_nls_iocharset)seq_printf (m,",iocharset=%s" , sbi->s_nls_iocharset->charset); +else +seq_puts (m,",iocharset=utf8" );#endif return 0 ; }
@@ -863,14 +864,13 @@ root_found: sbi->s_nls_iocharset =NULL ;#ifdef CONFIG_JOLIET -if (joliet_level && opt.utf8 ==0 ) { +if (joliet_level) {char *p = opt.iocharset ? opt.iocharset :CONFIG_NLS_DEFAULT ; - sbi->s_nls_iocharset =load_nls (p); -if (! sbi->s_nls_iocharset) { -/* Fail only if explicit charset specified */ -if (opt.iocharset) +if (strcmp (p,"utf8" ) !=0 ) { + sbi->s_nls_iocharset = opt.iocharset ? +load_nls (opt.iocharset) :load_nls_default (); +if (!sbi->s_nls_iocharset) goto out_freesbi; - sbi->s_nls_iocharset =load_nls_default (); } }#endif
@@ -886,7 +886,6 @@ root_found: sbi->s_gid = opt.gid; sbi->s_uid_set = opt.uid_set; sbi->s_gid_set = opt.gid_set; - sbi->s_utf8 = opt.utf8; sbi->s_nocompress = opt.nocompress; sbi->s_overriderockperm = opt.overriderockperm;/*
fs/isofs/isofs.h +0 -1
@@ -44,7 +44,6 @@ struct isofs_sb_info {unsigned char s_session; unsigned int s_high_sierra:1; unsigned int s_rock:2; - unsigned int s_utf8:1; unsigned int s_cruft:1; /* Broken disks with high byte of length* containing junk */ unsigned int s_nocompress:1;
fs/isofs/joliet.c +1 -3
@@ -41,14 +41,12 @@ uni16_to_x8(unsigned char *ascii, __be16 *uni, int len, struct nls_table *nls)int get_joliet_filename (struct iso_directory_record * de,unsigned char *outname,struct inode * inode) { -unsigned char utf8;struct nls_table *nls;unsigned char len =0 ; - utf8 =ISOFS_SB (inode->i_sb)->s_utf8; nls =ISOFS_SB (inode->i_sb)->s_nls_iocharset; -if (utf8) { +if (!nls) { len =utf16s_to_utf8s ((const wchar_t *) de->name, de->name_len[0 ] >>1 ,UTF16_BIG_ENDIAN , outname,PAGE_SIZE );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 17/334 bcache: add proper error unwinding in bcache_device_init
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 224b0683228c5f332f9cee615d85e75e9a347170 ]
Except for the IDA none of the allocations in bcache_device_init is unwound on error, fix that.
--- drivers/md/bcache/super.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/md/bcache/super.c +11 -5
@@ -931,20 +931,20 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, n =BITS_TO_LONGS (d->nr_stripes) *sizeof (unsigned long ); d->full_dirty_stripes =kvzalloc (n,GFP_KERNEL );if (!d->full_dirty_stripes) -return -ENOMEM ; + goto out_free_stripe_sectors_dirty; idx =ida_simple_get (&bcache_device_idx,0 ,BCACHE_DEVICE_IDX_MAX ,GFP_KERNEL );if (idx <0 ) -return idx; + goto out_free_full_dirty_stripes;if (bioset_init (&d->bio_split,4 , offsetof(struct bbio , bio),BIOSET_NEED_BVECS |BIOSET_NEED_RESCUER )) - goto err; + goto out_ida_remove; d->disk =blk_alloc_disk (NUMA_NO_NODE );if (!d->disk) - goto err; + goto out_bioset_exit;set_capacity (d->disk, sectors);snprintf (d->disk->disk_name,DISK_NAME_LEN ,"bcache%i" , idx);
@@ -987,8 +987,14 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size,return 0 ; -err: +out_bioset_exit: +bioset_exit (&d->bio_split); +out_ida_remove:ida_simple_remove (&bcache_device_idx, idx); +out_free_full_dirty_stripes: +kvfree (d->full_dirty_stripes); +out_free_stripe_sectors_dirty: +kvfree (d->stripe_sectors_dirty);return -ENOMEM ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 18/334 nbd: add the check to prevent overflow in __nbd_ioctl()
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
[ Upstream commit fad7cd3310db3099f95dd34312c77740fbc455e5 ]
If user specify a large enough value of NBD blocks option, it may trigger signed integer overflow which may lead to nbd->config->bytesize becomes a large or small value, zero in particular.
UBSAN: Undefined behaviour in drivers/block/nbd.c:325:31 signed integer overflow: 1024 * 4611686155866341414 cannot be represented in type 'long long int' [...] Call trace: [...] handle_overflow+0x188/0x1dc lib/ubsan.c:192 __ubsan_handle_mul_overflow+0x34/0x44 lib/ubsan.c:213 nbd_size_set drivers/block/nbd.c:325 [inline] __nbd_ioctl drivers/block/nbd.c:1342 [inline] nbd_ioctl+0x998/0xa10 drivers/block/nbd.c:1395 __blkdev_driver_ioctl block/ioctl.c:311 [inline]
[...]
Although it is not a big deal, still silence the UBSAN by limit the input value.
--- drivers/block/nbd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/block/nbd.c +4 -2
@@ -1388,6 +1388,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, unsigned int cmd, unsigned long arg) {struct nbd_config *config = nbd->config; +loff_t bytesize;switch (cmd) {case NBD_DISCONNECT :
@@ -1402,8 +1403,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,case NBD_SET_SIZE :return nbd_set_size (nbd, arg, config->blksize);case NBD_SET_SIZE_BLOCKS : -return nbd_set_size (nbd, arg * config->blksize, - config->blksize); +if (check_mul_overflow ((loff_t )arg, config->blksize, &bytesize)) +return -EINVAL ; +return nbd_set_size (nbd, bytesize, config->blksize);case NBD_SET_TIMEOUT :nbd_set_cmd_timeout (nbd, arg);return 0 ;
Signature · 1 line
2.30.2
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 51 lines · Greg Kroah-Hartman
From: Baokun Li <[email protected]>
[ Upstream commit
fad7cd3310db3099f95dd34312c77740fbc455e5]If user specify a large enough value of NBD blocks option, it may trigger signed integer overflow which may lead to
nbd->config->bytesizebecomes a large or small value, zero in particular.UBSAN: Undefined behaviour in drivers/block/nbd.c:325:31 signed integer overflow: 1024 * 4611686155866341414 cannot be represented in type 'long long int' [...] Call trace: [...] handle_overflow+0x188/0x1dc lib/ubsan.c:192 __ubsan_handle_mul_overflow+0x34/0x44 lib/ubsan.c:213 nbd_size_set drivers/block/nbd.c:325 [inline] __nbd_ioctl drivers/block/nbd.c:1342 [inline] nbd_ioctl+0x998/0xa10 drivers/block/nbd.c:1395 __blkdev_driver_ioctl block/ioctl.c:311 [inline][...]
Although it is not a big deal, still silence the UBSAN by limit the input value.
Reported-by Hulk Robot <[email protected]>Signed-off-by Baokun Li <[email protected]>Reviewed-by Josef Bacik <[email protected]>[axboe: dropped unlikely()]Signed-off-by Jens Axboe <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/block/nbd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)drivers/block/nbd.c +1
-0@@ -1388,6 +1388,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, unsigned int cmd, unsigned long arg) {struct nbd_config *config = nbd->config; +loff_t bytesize;switch (cmd) {case NBD_DISCONNECT :@@ -1402,8 +1403,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,case NBD_SET_SIZE :
drivers/block/nbd.c static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, · line 1411
Quoted 10 lines
drivers/block/nbd.c +3
-2return nbd_set_size (nbd, arg, config->blksize);case NBD_SET_SIZE_BLOCKS : -return nbd_set_size (nbd, arg * config->blksize, - config->blksize); +if (check_mul_overflow ((loff_t )arg, config->blksize, &bytesize)) +return -EINVAL ; +return nbd_set_size (nbd, bytesize, config->blksize);case NBD_SET_TIMEOUT :nbd_set_cmd_timeout (nbd, arg);return 0 ;
arm clang-10, clang-11, clang-12 and clang-13 builds failed. due to this commit on 5.14 and 5.13 on following configs,
- footbridge_defconfig
- mini2440_defconfig
- s3c2410_defconfig
This was already reported on the mailing list.
ERROR: modpost: "__mulodi4" [drivers/block/nbd.ko] undefined! #1438
https://github.com/ClangBuiltLinux/linux/issues/1438
[PATCH 00/10] raise minimum GCC version to 5.1
https://lore.kernel.org/lkml/[email protected]/
linux-next: build failure while building Linus' tree
https://lore.kernel.org/all/[email protected]/
Full build log,
https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc/-/jobs/1585407346#L1111
--
Linaro LKFT
https://lkft.linaro.org
Greg Kroah-Hartman
maintainerRe: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 75 lines · Naresh Kamboju
Quoted 51 lines · Greg Kroah-Hartman
From: Baokun Li <[email protected]>
[ Upstream commit
fad7cd3310db3099f95dd34312c77740fbc455e5]If user specify a large enough value of NBD blocks option, it may trigger signed integer overflow which may lead to
nbd->config->bytesizebecomes a large or small value, zero in particular.UBSAN: Undefined behaviour in drivers/block/nbd.c:325:31 signed integer overflow: 1024 * 4611686155866341414 cannot be represented in type 'long long int' [...] Call trace: [...] handle_overflow+0x188/0x1dc lib/ubsan.c:192 __ubsan_handle_mul_overflow+0x34/0x44 lib/ubsan.c:213 nbd_size_set drivers/block/nbd.c:325 [inline] __nbd_ioctl drivers/block/nbd.c:1342 [inline] nbd_ioctl+0x998/0xa10 drivers/block/nbd.c:1395 __blkdev_driver_ioctl block/ioctl.c:311 [inline][...]
Although it is not a big deal, still silence the UBSAN by limit the input value.
Reported-by Hulk Robot <[email protected]>Signed-off-by Baokun Li <[email protected]>Reviewed-by Josef Bacik <[email protected]>[axboe: dropped unlikely()]Signed-off-by Jens Axboe <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/block/nbd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)drivers/block/nbd.c +1
-0@@ -1388,6 +1388,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, unsigned int cmd, unsigned long arg) {struct nbd_config *config = nbd->config; +loff_t bytesize;switch (cmd) {case NBD_DISCONNECT :@@ -1402,8 +1403,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,case NBD_SET_SIZE :drivers/block/nbd.c static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, · line 1411
Quoted 10 lines
drivers/block/nbd.c +3
-2return nbd_set_size (nbd, arg, config->blksize);case NBD_SET_SIZE_BLOCKS : -return nbd_set_size (nbd, arg * config->blksize, - config->blksize); +if (check_mul_overflow ((loff_t )arg, config->blksize, &bytesize)) +return -EINVAL ; +return nbd_set_size (nbd, bytesize, config->blksize);case NBD_SET_TIMEOUT :nbd_set_cmd_timeout (nbd, arg);return 0 ;arm clang-10, clang-11, clang-12 and clang-13 builds failed. due to this commit on 5.14 and 5.13 on following configs,
-footbridge_defconfig
-mini2440_defconfig
-s3c2410_defconfigThis was already reported on the mailing list.
ERROR: modpost: "
__mulodi4" [drivers/block/nbd.ko] undefined! #1438
https://github.com/ClangBuiltLinux/linux/issues/1438
Quoted 8 lines
[PATCH 00/10] raise minimum GCC version to 5.1
https://lore.kernel.org/lkml/[email protected]/linux-next: build failure while building Linus' tree
https://lore.kernel.org/all/[email protected]/Full build log,
https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc/-/jobs/1585407346#L1111
Has anyone submitted a fix for this upstream yet? I can't seem to find one :(
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 7 lines · Greg Kroah-Hartman
Quoted 2 lines · Naresh Kamboju
[PATCH 00/10] raise minimum GCC version to 5.1
https://lore.kernel.org/lkml/[email protected]/Has anyone submitted a fix for this upstream yet? I can't seem to find one :(
That lore link has a series to address this, though that's maybe something we don't want to backport to stable.
I thought about this all weekend; I think I might be able to work around the one concern I had with my other approach, using __builtin_choose_expr().
There's an issue with my alternative approach
(https://gist.github.com/nickdesaulniers/2479818f4983bbf2d688cebbab435863)
with declaring the local variable z in div_64() since either operand could be 64b, which result in an unwanted truncation if the dividend is 32b (or less, and divisor is 64b). I think (what I realized this weekend) is that we might be able to replace the if with __builtin_choose_expr, then have that whole expression be the final statement and thus the "return value" of the statement expression.
I need to play with that idea more; maybe that could be a more manageable patch for stable. But I also need to eat lunch, and I've been in the Rust for Linux conference, and trying to organize 3 other conferences for the next two weeks...
Signature · 2 lines
Thanks, ~Nick Desaulniers
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 18 lines · Nick Desaulniers
Quoted 7 lines · Greg Kroah-Hartman
Quoted 2 lines · Naresh Kamboju
[PATCH 00/10] raise minimum GCC version to 5.1
https://lore.kernel.org/lkml/[email protected]/Has anyone submitted a fix for this upstream yet? I can't seem to find one :(
That lore link has a series to address this, though that's maybe something we don't want to backport to stable.
I thought about this all weekend; I think I might be able to work around the one concern I had with my other approach, using
__builtin_choose_expr().
Quoted 8 lines
There's an issue with my alternative approach
(https://gist.github.com/nickdesaulniers/2479818f4983bbf2d688cebbab435863)
with declaring the local variable z indiv_64()since either operand could be 64b, which result in an unwanted truncation if the dividend is 32b (or less, and divisor is 64b). I think (what I realized this weekend) is that we might be able to replace theifwith__builtin_choose_expr, then have that whole expression be the final statement and thus the "return value" of the statement expression.
Christ...that...works? Though, did Linus just merge my patches for gcc 5.1?
Anyways, I'll send something like this for stable:
---
include/linux/math64.h +26 -0
@@ -11,6 +11,9 @@#define div64_long (x, y) div64_s64((x), (y))#define div64_ul (x, y) div64_u64((x), (y)) +#ifndef is_signed_type +#define is_signed_type (type) (((type)(-1)) < (type)1) +#endif /** * div_u64_rem - unsigned 64bit divide with 32bit divisor with remainder
@@ -112,6 +115,15 @@ extern s64 div64_s64(s64 dividend, s64 divisor);#endif /* BITS_PER_LONG */ +#define div64_x64 (dividend, divisor) ({ \ + BUILD_BUG_ON_MSG(sizeof(dividend) < sizeof(u64),\ + "prefer div_x64"); \ + __builtin_choose_expr( \ + is_signed_type(typeof(dividend)), \ + div64_s64(dividend, divisor), \ + div64_u64(dividend, divisor)); \ +}) +/** * div_u64 - unsigned 64bit divide with 32bit divisor * @dividend: unsigned 64bit dividend
@@ -142,6 +154,28 @@ static inline s64 div_s64(s64 dividend, s32 divisor) }#endif +#define div_x64 (dividend, divisor) ({ \ + BUILD_BUG_ON_MSG(sizeof(dividend) > sizeof(u32),\ + "prefer div64_x64"); \ + __builtin_choose_expr( \ + is_signed_type(typeof(dividend)), \ + div_s64(dividend, divisor), \ + div_u64(dividend, divisor)); \ +}) + +// TODO: what if divisor is 128b? +#define div_64 (dividend, divisor) ({ \ + __builtin_choose_expr( \ + __builtin_types_compatible_p(typeof(dividend), s64) || \ + __builtin_types_compatible_p(typeof(dividend), u64),
\
+ __builtin_choose_expr(
\+ __builtin_types_compatible_p(typeof(divisor),
s64) || \
+ __builtin_types_compatible_p(typeof(divisor),
u64), \
+ div64_x64(dividend, divisor),
\
+ div_x64(dividend, divisor)),
\
+ dividend / divisor);
\+})
+
u32 iter_div_u64_rem(u64 dividend, u32 divisor, u64 *remainder);
#ifndef mul_u32_u32
---
Signature · 2 lines
Thanks, ~Nick Desaulniers
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 30 lines · Nick Desaulniers' via Clang Built Linux
Quoted 18 lines · Nick Desaulniers
Quoted 7 lines · Greg Kroah-Hartman
Quoted 2 lines · Naresh Kamboju
[PATCH 00/10] raise minimum GCC version to 5.1
https://lore.kernel.org/lkml/[email protected]/Has anyone submitted a fix for this upstream yet? I can't seem to find one :(
That lore link has a series to address this, though that's maybe something we don't want to backport to stable.
I thought about this all weekend; I think I might be able to work around the one concern I had with my other approach, using
__builtin_choose_expr().Quoted 8 lines
There's an issue with my alternative approach
(https://gist.github.com/nickdesaulniers/2479818f4983bbf2d688cebbab435863)
with declaring the local variable z indiv_64()since either operand could be 64b, which result in an unwanted truncation if the dividend is 32b (or less, and divisor is 64b). I think (what I realized this weekend) is that we might be able to replace theifwith__builtin_choose_expr, then have that whole expression be the final statement and thus the "return value" of the statement expression.
Quoted 2 lines
Christ...that...works? Though, did Linus just merge my patches for gcc 5.1?
"Merge branch 'gcc-min-version-5.1' (make gcc-5.1 the minimum version)"
- Sedat -
https://git.kernel.org/linus/316346243be6df12799c0b64b788e06bad97c30b
Quoted 81 lines
Anyways, I'll send something like this for stable:
---include/linux/math64.h +28
-0@@ -11,6 +11,9 @@#define div64_long (x, y) div64_s64((x), (y))#define div64_ul (x, y) div64_u64((x), (y)) +#ifndef is_signed_type +#define is_signed_type (type) (((type)(-1)) < (type)1) +#endif /** * div_u64_rem - unsigned 64bit divide with 32bit divisor with remainder @@ -112,6 +115,15 @@ extern s64 div64_s64(s64 dividend, s64 divisor);#endif /* BITS_PER_LONG */ +#define div64_x64 (dividend, divisor) ({ \ + BUILD_BUG_ON_MSG(sizeof(dividend) < sizeof(u64),\ + "prefer div_x64"); \ + __builtin_choose_expr( \ + is_signed_type(typeof(dividend)), \ + div64_s64(dividend, divisor), \ + div64_u64(dividend, divisor)); \ +}) +/** * div_u64 - unsigned 64bit divide with 32bit divisor * @dividend: unsigned 64bit dividend @@ -142,6 +154,28 @@ static inline s64 div_s64(s64 dividend, s32 divisor) }#endif +#define div_x64 (dividend, divisor) ({ \ + BUILD_BUG_ON_MSG(sizeof(dividend) > sizeof(u32),\ + "prefer div64_x64"); \ + __builtin_choose_expr( \ + is_signed_type(typeof(dividend)), \ + div_s64(dividend, divisor), \ + div_u64(dividend, divisor)); \ +}) + +// TODO: what if divisor is 128b? +#define div_64 (dividend, divisor) ({ \ + __builtin_choose_expr( \ + __builtin_types_compatible_p(typeof(dividend), s64) || \ + __builtin_types_compatible_p(typeof(dividend), u64), \ + __builtin_choose_expr( \ + __builtin_types_compatible_p(typeof(divisor),s64) || \
+ __builtin_types_compatible_p(typeof(divisor),
u64), \include/linux/math64.h +5
-2+ div64_x64(dividend, divisor), \ + div_x64(dividend, divisor)), \ + dividend / divisor); \ +}) +u32 iter_div_u64_rem (u64 dividend,u32 divisor,u64 *remainder);#ifndef mul_u32_u32 --- --Thanks,
~Nick Desaulniers--
You received this message because you are subscribed to the Google Groups "Clang Built Linux" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/clang-built-linux/CAKwvOdmCS5Q7AzUL5nziYVU7RrtRjoE9JjOXfVBWagO1Bzbsew%40mail.gmail.com.
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 16 lines · Sedat Dilek
Quoted 13 lines · Nick Desaulniers' via Clang Built Linux
Quoted 9 lines · Nick Desaulniers
There's an issue with my alternative approach
(https://gist.github.com/nickdesaulniers/2479818f4983bbf2d688cebbab435863)
with declaring the local variable z indiv_64()since either operand could be 64b, which result in an unwanted truncation if the dividend is 32b (or less, and divisor is 64b). I think (what I realized this weekend) is that we might be able to replace theifwith__builtin_choose_expr, then have that whole expression be the final statement and thus the "return value" of the statement expression.
Quoted 4 lines
Quoted 2 lines
Christ...that...works? Though, did Linus just merge my patches for gcc 5.1?
"Merge branch 'gcc-min-version-5.1' (make gcc-5.1 the minimum version)"
Ha! I pulled+rebased and this code disappeared...I thought I had rebased on the wrong branch or committed work to master accidentally. Patch to stable-only inbound.
Signature · 2 lines
Thanks, ~Nick Desaulniers
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 4 lines · Nick Desaulniers
Ha! I pulled+rebased and this code disappeared...I thought I had rebased on the wrong branch or committed work to master accidentally. Patch to stable-only inbound.
Side note: for stable, can you look into using _Generic() instead of __builtin_choose_expression() with typeof, or some __builtin_types_compatible_p() magic?
Yes, yes, we use __builtin_choose_expression() elsewhere, but we've started using _Generic(), and it's really the more natural model - in addition to being the standard C one.
Of course, there may be some reason why _Generic() doesn't work, but it _is_ the natural fit for any "for type X, do Y" kind of thing.
No?
Linus
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 12 lines · Linus Torvalds
Quoted 4 lines · Nick Desaulniers
Ha! I pulled+rebased and this code disappeared...I thought I had rebased on the wrong branch or committed work to master accidentally. Patch to stable-only inbound.
Side note: for stable, can you look into using
_Generic()instead of__builtin_choose_expression()with typeof, or some__builtin_types_compatible_p()magic?
Quoted 8 lines
Yes, yes, we use
__builtin_choose_expression()elsewhere, but we've started using_Generic(), and it's really the more natural model - in addition to being the standard C one.Of course, there may be some reason why
_Generic()doesn't work, but it _is_ the natural fit for any "for type X, do Y" kind of thing.No?
Man, c'mon, I just got the __builtin_choose_expression() working! It's not...too bad...ish. (Besides, I'd actually have to learn how to use _Generic...I've never quite gotten anything I've written trying to use it to actually compile).
Do we have access to _Generic in GCC 4.9?
Signature · 2 lines
Thanks, ~Nick Desaulniers
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 22 lines · Nick Desaulniers
Quoted 19 lines · Linus Torvalds
Quoted 4 lines · Nick Desaulniers
Ha! I pulled+rebased and this code disappeared...I thought I had rebased on the wrong branch or committed work to master accidentally. Patch to stable-only inbound.
Side note: for stable, can you look into using
_Generic()instead of__builtin_choose_expression()with typeof, or some__builtin_types_compatible_p()magic?Yes, yes, we use
__builtin_choose_expression()elsewhere, but we've started using_Generic(), and it's really the more natural model - in addition to being the standard C one.Of course, there may be some reason why
_Generic()doesn't work, but it _is_ the natural fit for any "for type X, do Y" kind of thing.
Quoted 8 lines
Quoted 1 line
No?
Man, c'mon, I just got the
__builtin_choose_expression()working! It's not...too bad...ish. (Besides, I'd actually have to learn how to use _Generic...I've never quite gotten anything I've written trying to use it to actually compile).Do we have access to
_Genericin GCC 4.9?
Follow up thread, sorry/not sorry for not taking the full cc list:
https://lore.kernel.org/stable/[email protected]/
Signature · 2 lines
Thanks, ~Nick Desaulniers
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
In reply to Nick DesaulniersQuoted 2 lines · Nick Desaulniers
Do we have access to
_Genericin GCC 4.9?
We've ended up using it unconditionally since last year, so yes.
In fact, the compiler version tests got removed when we raised the gcc version requirement to 4.9 in commit 6ec4476ac825 ("Raise gcc version requirement to 4.9"):
"In particular, raising the minimum to 4.9 means that we can now just
assume _Generic() exists, which is likely the much better replacement for a lot of very convoluted built-time magic with conditionals on sizeof and/or __builtin_choose_expr() with same_type() etc"
but we haven't used it much since.
The "seqprop" code for picking the right lock for seqlock is perhaps the main example, and staring at that code will make you go blind, so look away.
Linus
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 7 lines · Linus Torvalds
Quoted 2 lines · Nick Desaulniers
Do we have access to
_Genericin GCC 4.9?We've ended up using it unconditionally since last year, so yes.
Sorry, grepping would have taken < 1s. I'm very lazy.
http://threevirtues.com/
Quoted 10 lines
In fact, the compiler version tests got removed when we raised the gcc version requirement to 4.9 in commit
6ec4476ac825("Raise gcc version requirement to 4.9"):"In particular, raising the minimum to 4.9 means that we can now just
assume_Generic()exists, which is likely the much better replacement for a lot of very convoluted built-time magic with conditionals on sizeof and/or__builtin_choose_expr()withsame_type()etc"
Quoted 5 lines
but we haven't used it much since.
The "seqprop" code for picking the right lock for seqlock is perhaps the main example, and staring at that code will make you go blind, so look away.
Looking at my patch:
https://lore.kernel.org/stable/[email protected]/
I don't think _Generic helps us in the case of dispatching based on the result of is_signed_type() (the operands could undergo type promotion, so we'd need lots of cases that are more concisely covered by is_signed_type()). It could replace the nested checks in div_64 with nested _Generics, I think. Not sure it's a huge win for readability. Maybe cut the number of expansions of the parameters in half though. Let me give it a try just to see what it looks like.
Signature · 2 lines
Thanks, ~Nick Desaulniers
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 30 lines · Nick Desaulniers
Quoted 7 lines · Linus Torvalds
Quoted 2 lines · Nick Desaulniers
Do we have access to
_Genericin GCC 4.9?We've ended up using it unconditionally since last year, so yes.
Sorry, grepping would have taken < 1s. I'm very lazy.
http://threevirtues.com/Quoted 10 lines
In fact, the compiler version tests got removed when we raised the gcc version requirement to 4.9 in commit
6ec4476ac825("Raise gcc version requirement to 4.9"):"In particular, raising the minimum to 4.9 means that we can now just
assume_Generic()exists, which is likely the much better replacement for a lot of very convoluted built-time magic with conditionals on sizeof and/or__builtin_choose_expr()withsame_type()etc"Quoted 5 lines
but we haven't used it much since.
The "seqprop" code for picking the right lock for seqlock is perhaps the main example, and staring at that code will make you go blind, so look away.
Quoted 9 lines
Looking at my patch:
https://lore.kernel.org/stable/[email protected]/
I don't think_Generichelps us in the case of dispatching based on the result ofis_signed_type()(the operands could undergo type promotion, so we'd need lots of cases that are more concisely covered byis_signed_type()). It could replace the nested checks indiv_64with nested_Generics, I think. Not sure it's a huge win for readability. Maybe cut the number of expansions of the parameters in half though. Let me give it a try just to see what it looks like.
Is this more readable? Same line count. I'm not sure if there's such a thing as "fallthrough" between the "cases" of _Generic to minimize duplication, or whether this could be factored further. Needs lots more () around macro param use and tab'ed out line endings...
include/linux/math64.h +6 -6
@@ -162,17 +162,17 @@ static inline s64 div_s64(s64 dividend, s32 divisor) div_u64(dividend, divisor)); \ }) -#define __div_64 (dividend) _Generic((divisor), \ - s64: div64_x64, \ - u64: div64_x64, \ - default: div_x64) +#define __div_64 (dividend, divisor) _Generic((divisor), \ + s64: div64_x64(dividend, divisor), \ + u64: div64_x64(dividend, divisor), \ + default: div_x64(dividend, divisor))#define div_64 (dividend, divisor) ({ \BUILD_BUG_ON_MSG (sizeof (dividend) >sizeof (u64), \"128b div unsupported" ); \ _Generic((dividend), \ - s64: __div_64(dividend)(dividend, divisor), \ - u64: __div_64(dividend)(dividend, divisor), \ + s64: __div_64(dividend, divisor), \ + u64: __div_64(dividend, divisor), \
default: dividend / divisor); \
})
Signature · 2 lines
Thanks, ~Nick Desaulniers
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 43 lines · Nick Desaulniers
Quoted 30 lines · Nick Desaulniers
Quoted 7 lines · Linus Torvalds
Quoted 2 lines · Nick Desaulniers
Do we have access to
_Genericin GCC 4.9?We've ended up using it unconditionally since last year, so yes.
Sorry, grepping would have taken < 1s. I'm very lazy.
http://threevirtues.com/Quoted 10 lines
In fact, the compiler version tests got removed when we raised the gcc version requirement to 4.9 in commit
6ec4476ac825("Raise gcc version requirement to 4.9"):"In particular, raising the minimum to 4.9 means that we can now just
assume_Generic()exists, which is likely the much better replacement for a lot of very convoluted built-time magic with conditionals on sizeof and/or__builtin_choose_expr()withsame_type()etc"Quoted 5 lines
but we haven't used it much since.
The "seqprop" code for picking the right lock for seqlock is perhaps the main example, and staring at that code will make you go blind, so look away.
Quoted 9 lines
Looking at my patch:
https://lore.kernel.org/stable/[email protected]/
I don't think_Generichelps us in the case of dispatching based on the result ofis_signed_type()(the operands could undergo type promotion, so we'd need lots of cases that are more concisely covered byis_signed_type()). It could replace the nested checks indiv_64with nested_Generics, I think. Not sure it's a huge win for readability. Maybe cut the number of expansions of the parameters in half though. Let me give it a try just to see what it looks like.
Quoted 4 lines
Is this more readable? Same line count. I'm not sure if there's such a thing as "fallthrough" between the "cases" of
_Genericto minimize duplication, or whether this could be factored further. Needs lots more () around macro param use and tab'ed out line endings...
Sorry wrong diff:
include/linux/math64.h +5 -5
@@ -162,18 +162,18 @@ static inline s64 div_s64(s64 dividend, s32 divisor) div_u64(dividend, divisor)); \ }) +#define __div_64 (dividend, divisor) _Generic((divisor), \ + s64: div64_x64(dividend, divisor), \ + u64: div64_x64(dividend, divisor), \ + default: div_x64(dividend, divisor)) +#define div_64 (dividend, divisor) ({ \BUILD_BUG_ON_MSG (sizeof (dividend) >sizeof (u64), \"128b div unsupported" ); \ - __builtin_choose_expr( \ - __builtin_types_compatible_p(typeof(dividend), s64) || \ - __builtin_types_compatible_p(typeof(dividend), u64), \ - __builtin_choose_expr( \ - __builtin_types_compatible_p(typeof(divisor),
s64) || \
- __builtin_types_compatible_p(typeof(divisor),
u64), \
- div64_x64(dividend, divisor),
\
- div_x64(dividend, divisor)),
\
- dividend / divisor);
\
+ _Generic((dividend), \
+ s64: __div_64(dividend, divisor), \
+ u64: __div_64(dividend, divisor), \
+ default: dividend / divisor); \})
Signature · 2 lines
Thanks, ~Nick Desaulniers
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 2 lines · Nick Desaulniers
Sorry wrong diff:
Well, this second diff was seriously whitespace-damaged and hard to read, but while it seems to be the same number of lines, it sure looks a lot more readable in this format.
Except I think that
default: dividend / divisor);
should really have parentheses around both of those macro arguments.
That's a preexisting problem, but it should be fixed while at it.
I'm also not sure why that (again, preexisting) BUILD_BUG_ON_MSG() only checks the size of the dividend, not the divisor. Very strange. But probably not worth worrying about.
Linus
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 10 lines · Linus Torvalds
Quoted 2 lines · Nick Desaulniers
Sorry wrong diff:
Well, this second diff was seriously whitespace-damaged and hard to read, but while it seems to be the same number of lines, it sure looks a lot more readable in this format.
Quoted 7 lines
Except I think that
default: dividend / divisor);should really have parentheses around both of those macro arguments.
That's a preexisting problem, but it should be fixed while at it.
Ok, I'll send a revised v2 based on _Generic; Rasmus can help review when he's awake.
Quoted 3 lines
I'm also not sure why that (again, preexisting)
BUILD_BUG_ON_MSG()only checks the size of the dividend, not the divisor. Very strange. But probably not worth worrying about.
I sent a not-yet-applied diff of my not-yet-applied diff. I was playing with this last week, and IIRC we had divisors that were less than 32b being promoted to int. But I'll test it some more.
Signature · 2 lines
Thanks, ~Nick Desaulniers
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 19 lines · Nick Desaulniers
Quoted 7 lines · Linus Torvalds
Quoted 1 line · Nick Desaulniers
Sorry wrong diff:
Well, this second diff was seriously whitespace-damaged and hard to read, but while it seems to be the same number of lines, it sure looks a lot more readable in this format.
Quoted 7 lines
Except I think that
default: dividend / divisor);should really have parentheses around both of those macro arguments.
That's a preexisting problem, but it should be fixed while at it.
Ok, I'll send a revised v2 based on
_Generic; Rasmus can help review when he's awake.
Quoted 6 lines
Quoted 3 lines
I'm also not sure why that (again, preexisting)
BUILD_BUG_ON_MSG()only checks the size of the dividend, not the divisor. Very strange. But probably not worth worrying about.I sent a not-yet-applied diff of my not-yet-applied diff. I was playing with this last week, and IIRC we had divisors that were less than 32b being promoted to int. But I'll test it some more.
How about deleting the check_mul_overflow in the __nbd_ioctl as follows?
drivers/block/nbd.c +0 -0
@@ -1393,7 +1393,6 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
unsigned int cmd, unsigned long arg) {
struct nbd_config *config = nbd->config;
- loff_t bytesize;
switch (cmd) {
case NBD_DISCONNECT:
@@ -1408,9 +1407,10 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, case NBD_SET_SIZE:
return nbd_set_size(nbd, arg, config->blksize);
case NBD_SET_SIZE_BLOCKS:
- if (check_mul_overflow((loff_t)arg, config->blksize, &bytesize)) + if (arg && (LLONG_MAX / arg <= config->blksize))
return -EINVAL;
- return nbd_set_size(nbd, bytesize, config->blksize);
+ return nbd_set_size(nbd, arg * config->blksize,
+ config->blksize);
case NBD_SET_TIMEOUT:
nbd_set_cmd_timeout(nbd, arg);
return 0;
--
2.31.1
Signature · 2 lines
With Best Regards, Baokun Li
Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Quoted 44 lines · libaokun (A)
Quoted 19 lines · Nick Desaulniers
Quoted 7 lines · Linus Torvalds
Quoted 1 line · Nick Desaulniers
Sorry wrong diff:
Well, this second diff was seriously whitespace-damaged and hard to read, but while it seems to be the same number of lines, it sure looks a lot more readable in this format.
Quoted 7 lines
Except I think that
default: dividend / divisor);should really have parentheses around both of those macro arguments.
That's a preexisting problem, but it should be fixed while at it.
Ok, I'll send a revised v2 based on
_Generic; Rasmus can help review when he's awake.Quoted 6 lines
Quoted 3 lines
I'm also not sure why that (again, preexisting)
BUILD_BUG_ON_MSG()only checks the size of the dividend, not the divisor. Very strange. But probably not worth worrying about.I sent a not-yet-applied diff of my not-yet-applied diff. I was playing with this last week, and IIRC we had divisors that were less than 32b being promoted to int. But I'll test it some more.
How about deleting the
check_mul_overflowin the__nbd_ioctlas follows?drivers/block/nbd.c +0
-1@@ -1393,7 +1393,6 @@ static int __nbd_ioctl(struct block_device *bdev,struct nbd_device *nbd, unsigned int cmd, unsigned long arg) { struct nbd_config *config = nbd->config; -loff_t bytesize;switch (cmd) {case
NBD_DISCONNECT:
drivers/block/nbd.c static int __nbd_ioctl(struct block_device *bdev, · line 1413
Quoted 8 lines
drivers/block/nbd.c +1
-1@@ -1408,9 +1407,10 @@ static int __nbd_ioctl(struct block_device *bdev,struct nbd_device *nbd, case NBD_SET_SIZE: return nbd_set_size(nbd, arg, config->blksize);case NBD_SET_SIZE_BLOCKS : -if (check_mul_overflow ((loff_t )arg, config->blksize, &bytesize)) +if (arg && (LLONG_MAX / arg <= config->blksize))return -EINVAL ;
64b division is going to need do_div(), yeah? Besides, this is likely to pop up again for other callers of check_mul_overflow(), might as well fix it.
Quoted 15 lines
drivers/block/nbd.c +2
-1-return nbd_set_size (nbd, bytesize, config->blksize); +return nbd_set_size (nbd, arg * config->blksize, + config->blksize);case NBD_SET_TIMEOUT :nbd_set_cmd_timeout(nbd, arg); return 0;--
2.31.1--
With Best Regards,
Baokun Li
Signature · 2 lines
Thanks, ~Nick Desaulniers
RE: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
In reply to libaokun (A)...
Quoted 10 lines
case
NBD_SET_SIZE:
returnnbd_set_size(nbd, arg, config->blksize); caseNBD_SET_SIZE_BLOCKS:
- if (check_mul_overflow((loff_t)arg, config->blksize, &bytesize))
+ if (arg && (LLONG_MAX/ arg <=config->blksize))
return-EINVAL;
- returnnbd_set_size(nbd, bytesize, config->blksize); + return nbd_set_size(nbd, arg *config->blksize, +config->blksize);
Shouldn't there just be sanity bound checks on 'config->blksize' and 'arg' so that the product is never going to overflow?
It isn't as though any values near the overflow limit are sane.
I suspect you could check config->blksize <= 64k && arg <= 32k and even that would be generous.
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
Greg Kroah-Hartman
maintainerPATCH 19/334 blk-throtl: optimize IOPS throttle for large IO scenarios
In reply to Greg Kroah-HartmanFrom: Chunguang Xu <[email protected]>
[ Upstream commit 4f1e9630afe6332de7286820fedd019f19eac057 ]
After patch 54efd50 (block: make generic_make_request handle arbitrarily sized bios), the IO through io-throttle may be larger, and these IOs may be further split into more small IOs. However, IOPS throttle does not seem to be aware of this change, which makes the calculation of IOPS of large IOs incomplete, resulting in disk-side IOPS that does not meet expectations. Maybe we should fix this problem.
We can reproduce it by set max_sectors_kb of disk to 128, set blkio.write_iops_throttle to 100, run a dd instance inside blkio and use iostat to watch IOPS:
dd if=/dev/zero of=/dev/sdb bs=1M count=1000 oflag=direct
As a result, without this change the average IOPS is 1995, with this change the IOPS is 98.
--- block/blk-merge.c | 2 ++ block/blk-throttle.c | 32 ++++++++++++++++++++++++++++++++ block/blk.h | 2 ++ 3 files changed, 36 insertions(+)
block/blk-merge.c +2 -0
@@ -348,6 +348,8 @@ void __blk_queue_split(struct bio **bio, unsigned int *nr_segs)trace_block_split (split, (*bio)->bi_iter.bi_sector);submit_bio_noacct (*bio); *bio = split; + +blk_throtl_charge_bio_split (*bio); } }
block/blk-throttle.c +32 -0
@@ -178,6 +178,9 @@ struct throtl_grp {unsigned int bad_bio_cnt;/* bios exceeding latency threshold */ unsigned long bio_cnt_reset_time; +atomic_t io_split_cnt[2 ]; +atomic_t last_io_split_cnt[2 ]; +struct blkg_rwstat stat_bytes;struct blkg_rwstat stat_ios; };
@@ -777,6 +780,8 @@ static inline void throtl_start_new_slice_with_credit(struct throtl_grp *tg, tg->bytes_disp[rw] =0 ; tg->io_disp[rw] =0 ; +atomic_set (&tg->io_split_cnt[rw],0 ); +/* * Previous slice has expired. We must have trimmed it after last * bio dispatch. That means since start of last slice, we never used
@@ -799,6 +804,9 @@ static inline void throtl_start_new_slice(struct throtl_grp *tg, bool rw) tg->io_disp[rw] =0 ; tg->slice_start[rw] = jiffies; tg->slice_end[rw] = jiffies + tg->td->throtl_slice; + +atomic_set (&tg->io_split_cnt[rw],0 ); + throtl_log(&tg->service_queue, "[%c] new slice start=%lu end=%lu jiffies=%lu", rw == READ ? 'R' : 'W', tg->slice_start[rw],
@@ -1031,6 +1039,9 @@ static bool tg_may_dispatch(struct throtl_grp *tg, struct bio *bio, jiffies + tg->td->throtl_slice); } +if (iops_limit !=UINT_MAX ) + tg->io_disp[rw] +=atomic_xchg (&tg->io_split_cnt[rw],0 ); +if (tg_with_in_bps_limit (tg, bio, bps_limit, &bps_wait) &&tg_with_in_iops_limit (tg, bio, iops_limit, &iops_wait)) {if (wait)
@@ -2052,12 +2063,14 @@ static void throtl_downgrade_check(struct throtl_grp *tg) }if (tg->iops[READ ][LIMIT_LOW ]) { + tg->last_io_disp[READ ] +=atomic_xchg (&tg->last_io_split_cnt[READ ],0 ); iops = tg->last_io_disp[READ ] *HZ / elapsed_time;if (iops >= tg->iops[READ ][LIMIT_LOW ]) tg->last_low_overflow_time[READ ] = now; }if (tg->iops[WRITE ][LIMIT_LOW ]) { + tg->last_io_disp[WRITE ] +=atomic_xchg (&tg->last_io_split_cnt[WRITE ],0 ); iops = tg->last_io_disp[WRITE ] *HZ / elapsed_time;if (iops >= tg->iops[WRITE ][LIMIT_LOW ]) tg->last_low_overflow_time[WRITE ] = now;
@@ -2176,6 +2189,25 @@ static inline void throtl_update_latency_buckets(struct throtl_data *td) }#endif +void blk_throtl_charge_bio_split (struct bio *bio) +{ +struct blkcg_gq *blkg = bio->bi_blkg; +struct throtl_grp *parent =blkg_to_tg (blkg); +struct throtl_service_queue *parent_sq; +bool rw =bio_data_dir (bio); + +do { +if (!parent->has_rules[rw]) +break ; + +atomic_inc (&parent->io_split_cnt[rw]); +atomic_inc (&parent->last_io_split_cnt[rw]); + + parent_sq = parent->service_queue.parent_sq; + parent =sq_to_tg (parent_sq); + }while (parent); +} +bool blk_throtl_bio (struct bio *bio) {struct request_queue *q = bio->bi_bdev->bd_disk->queue;
block/blk.h +2 -0
@@ -289,11 +289,13 @@ int create_task_io_context(struct task_struct *task, gfp_t gfp_mask, int node);extern int blk_throtl_init (struct request_queue *q);extern void blk_throtl_exit (struct request_queue *q);extern void blk_throtl_register_queue (struct request_queue *q); +extern void blk_throtl_charge_bio_split (struct bio *bio);bool blk_throtl_bio (struct bio *bio);#else /* CONFIG_BLK_DEV_THROTTLING */ static inline int blk_throtl_init (struct request_queue *q) {return 0 ; }static inline void blk_throtl_exit (struct request_queue *q) { }static inline void blk_throtl_register_queue (struct request_queue *q) { } +static inline void blk_throtl_charge_bio_split (struct bio *bio) { }static inline bool blk_throtl_bio (struct bio *bio) {return false; }#endif /* CONFIG_BLK_DEV_THROTTLING */ #ifdef CONFIG_BLK_DEV_THROTTLING_LOW
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 20/334 nvme-tcp: dont update queue count when failing to set io queues
In reply to Greg Kroah-HartmanFrom: Ruozhu Li <[email protected]>
[ Upstream commit 664227fde63844d69e9ec9e90a8a7801e6ff072d ]
We update ctrl->queue_count and schedule another reconnect when io queue count is zero.But we will never try to create any io queue in next reco- nnection, because ctrl->queue_count already set to zero.We will end up having an admin-only session in Live state, which is exactly what we try to avoid in the original patch.
Update ctrl->queue_count after queue_count zero checking to fix it.
--- drivers/nvme/host/tcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/nvme/host/tcp.c +2 -2
@@ -1769,13 +1769,13 @@ static int nvme_tcp_alloc_io_queues(struct nvme_ctrl *ctrl)if (ret)return ret; - ctrl->queue_count = nr_io_queues +1 ; -if (ctrl->queue_count <2 ) { +if (nr_io_queues ==0 ) {dev_err (ctrl->device,"unable to set any I/O queues\n" );return -ENOMEM ; } + ctrl->queue_count = nr_io_queues +1 ;dev_info (ctrl->device,"creating %d I/O queues.\n" , nr_io_queues);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 21/334 nvme-rdma: dont update queue count when failing to set io queues
In reply to Greg Kroah-HartmanFrom: Ruozhu Li <[email protected]>
[ Upstream commit 85032874f80ba17bf187de1d14d9603bf3f582b8 ]
We update ctrl->queue_count and schedule another reconnect when io queue count is zero.But we will never try to create any io queue in next reco- nnection, because ctrl->queue_count already set to zero.We will end up having an admin-only session in Live state, which is exactly what we try to avoid in the original patch.
Update ctrl->queue_count after queue_count zero checking to fix it.
--- drivers/nvme/host/rdma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/nvme/host/rdma.c +2 -2
@@ -735,13 +735,13 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl)if (ret)return ret; - ctrl->ctrl.queue_count = nr_io_queues +1 ; -if (ctrl->ctrl.queue_count <2 ) { +if (nr_io_queues ==0 ) {dev_err (ctrl->ctrl.device,"unable to set any I/O queues\n" );return -ENOMEM ; } + ctrl->ctrl.queue_count = nr_io_queues +1 ;dev_info (ctrl->ctrl.device,"creating %d I/O queues.\n" , nr_io_queues);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 22/334 nvmet: pass back cntlid on successful completion
In reply to Greg Kroah-HartmanFrom: Amit Engel <[email protected]>
[ Upstream commit e804d5abe2d74cfe23f5f83be580d1cdc9307111 ]
According to the NVMe specification, the response dword 0 value of the Connect command is based on status code: return cntlid for successful compeltion return IPO and IATTR for connect invalid parameters. Fix a missing error information for a zero sized queue, and return the cntlid also for I/O queue Connect commands.
--- drivers/nvme/target/fabrics-cmd.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/nvme/target/fabrics-cmd.c +5 -4
@@ -120,6 +120,7 @@ static u16 nvmet_install_queue(struct nvmet_ctrl *ctrl, struct nvmet_req *req)if (!sqsize) {pr_warn ("queue size zero!\n" ); req->error_loc = offsetof(struct nvmf_connect_command , sqsize); + req->cqe->result.u32 =IPO_IATTR_CONNECT_SQE (sqsize); ret =NVME_SC_CONNECT_INVALID_PARAM |NVME_SC_DNR ; goto err; }
@@ -260,11 +261,11 @@ static void nvmet_execute_io_connect(struct nvmet_req *req) } status =nvmet_install_queue (ctrl, req); -if (status) { -/* pass back cntlid that had the issue of installing queue */ - req->cqe->result.u16 =cpu_to_le16 (ctrl->cntlid); +if (status) goto out_ctrl_put; - } + +/* pass back cntlid for successful completion */ + req->cqe->result.u16 =cpu_to_le16 (ctrl->cntlid);pr_debug ("adding queue %d to ctrl %d.\n" , qid, ctrl->cntlid);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 23/334 power: supply: smb347-charger: Add missing pin control activation
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit efe2175478d5237949e33c84d9a722fc084b218c ]
Pin control needs to be activated by setting the enable bit, otherwise hardware rejects all pin changes. Previously this stayed unnoticed on Nexus 7 because pin control was enabled by default after rebooting from downstream kernel, which uses driver that enables the bit and charger registers are non-volatile until power supply (battery) is disconnected. Configure the pin control enable bit. This fixes the potentially never-enabled charging on devices that use pin control.
--- drivers/power/supply/smb347-charger.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/power/supply/smb347-charger.c +10 -0
@@ -55,6 +55,7 @@#define CFG_PIN_EN_CTRL_ACTIVE_LOW 0x60#define CFG_PIN_EN_APSD_IRQ BIT(1)#define CFG_PIN_EN_CHARGER_ERROR BIT(2) +#define CFG_PIN_EN_CTRL BIT(4)#define CFG_THERM 0x07#define CFG_THERM_SOFT_HOT_COMPENSATION_MASK 0x03#define CFG_THERM_SOFT_HOT_COMPENSATION_SHIFT 0
@@ -724,6 +725,15 @@ static int smb347_hw_init(struct smb347_charger *smb)if (ret <0 ) goto fail; +/* Activate pin control, making it writable. */ +switch (smb->enable_control) { +case SMB3XX_CHG_ENABLE_PIN_ACTIVE_LOW : +case SMB3XX_CHG_ENABLE_PIN_ACTIVE_HIGH : + ret =regmap_set_bits (smb->regmap,CFG_PIN ,CFG_PIN_EN_CTRL ); +if (ret <0 ) + goto fail; + } +/* * Make the charging functionality controllable by a write to the * command register unless pin control is specified in the platform
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 24/334 power: supply: max17042_battery: fix typo in MAx17042_TOFF
In reply to Greg Kroah-HartmanFrom: Sebastian Krzyszkowiak <[email protected]>
[ Upstream commit ed0d0a0506025f06061325cedae1bbebd081620a ]
--- drivers/power/supply/max17042_battery.c | 2 +- include/linux/power/max17042_battery.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/power/supply/max17042_battery.c +1 -1
@@ -748,7 +748,7 @@ static inline void max17042_override_por_values(struct max17042_chip *chip)struct max17042_config_data *config = chip->pdata->config_data;max17042_override_por (map,MAX17042_TGAIN , config->tgain); -max17042_override_por (map, MAx17042_TOFF, config->toff); +max17042_override_por (map,MAX17042_TOFF , config->toff);max17042_override_por (map,MAX17042_CGAIN , config->cgain);max17042_override_por (map,MAX17042_COFF , config->coff);
include/linux/power/max17042_battery.h +1 -1
@@ -69,7 +69,7 @@ enum max17042_register { MAX17042_RelaxCFG =0x2A , MAX17042_MiscCFG =0x2B ,MAX17042_TGAIN =0x2C , - MAx17042_TOFF =0x2D , +MAX17042_TOFF =0x2D ,MAX17042_CGAIN =0x2E , MAX17042_COFF = 0x2F,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 25/334 s390/cio: add dev_busid sysfs entry for each subchannel
In reply to Greg Kroah-HartmanFrom: Vineeth Vijayan <[email protected]>
[ Upstream commit d3683c055212bf910d4e318f7944910ce10dbee6 ]
Introduce dev_busid, which exports the device-id associated with the io-subchannel (and message-subchannel). The dev_busid indicates that of the device which may be physically installed on the corrosponding subchannel. The dev_busid value "none" indicates that the subchannel is not valid, there is no I/O device currently associated with the subchannel.
The dev_busid information would be helpful to write device-specific udev-rules associated with the subchannel. The dev_busid interface would be available even when the sch is not bound to any driver or if there is no operational device connected on it. Hence this attribute can be used to write udev-rules which are specific to the device associated with the subchannel.
--- drivers/s390/cio/css.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/s390/cio/css.c +17 -0
@@ -430,9 +430,26 @@ static ssize_t pimpampom_show(struct device *dev, }static DEVICE_ATTR_RO (pimpampom); +static ssize_t dev_busid_show (struct device *dev, +struct device_attribute *attr, +char *buf) +{ +struct subchannel *sch =to_subchannel (dev); +struct pmcw *pmcw = &sch->schib.pmcw; + +if ((pmcw->st ==SUBCHANNEL_TYPE_IO || + pmcw->st ==SUBCHANNEL_TYPE_MSG ) && pmcw->dnv) +return sysfs_emit (buf,"0.%x.%04x\n" , sch->schid.ssid, + pmcw->dev); +else +return sysfs_emit (buf,"none\n" ); +} +static DEVICE_ATTR_RO (dev_busid); +static struct attribute *io_subchannel_type_attrs[] = { &dev_attr_chpids.attr, &dev_attr_pimpampom.attr, + &dev_attr_dev_busid.attr,NULL , };ATTRIBUTE_GROUPS (io_subchannel_type);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 26/334 s390/zcrypt: fix wrong offset index for APKA master key valid state
In reply to Greg Kroah-HartmanFrom: Harald Freudenberger <[email protected]>
[ Upstream commit 8617bb74006252cb2286008afe7d6575a6425857 ]
Tests showed a mismatch between what the CCA tool reports about the APKA master key state and what's displayed by the zcrypt dd in sysfs. After some investigation, we found out that the documentation which was the source for the zcrypt dd implementation lacks the listing of 3 fields. So this patch now moves the evaluation of the APKA master key state to the correct offset.
--- drivers/s390/crypto/zcrypt_ccamisc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/s390/crypto/zcrypt_ccamisc.c +4 -4
@@ -1724,10 +1724,10 @@ static int fetch_cca_info(u16 cardnr, u16 domain, struct cca_info *ci) rlen = vlen =PAGE_SIZE /2 ; rc =cca_query_crypto_facility (cardnr, domain,"STATICSB" , rarray, &rlen, varray, &vlen); -if (rc ==0 && rlen >=10 *8 && vlen >=240 ) { - ci->new_apka_mk_state = (char ) rarray[7 *8 ]; - ci->cur_apka_mk_state = (char ) rarray[8 *8 ]; - ci->old_apka_mk_state = (char ) rarray[9 *8 ]; +if (rc ==0 && rlen >=13 *8 && vlen >=240 ) { + ci->new_apka_mk_state = (char ) rarray[10 *8 ]; + ci->cur_apka_mk_state = (char ) rarray[11 *8 ]; + ci->old_apka_mk_state = (char ) rarray[12 *8 ];if (ci->old_apka_mk_state =='2' )memcpy (&ci->old_apka_mkvp, varray +208 ,8 );if (ci->cur_apka_mk_state =='2' )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 27/334 libata: fix ata_host_start()
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit 355a8031dc174450ccad2a61c513ad7222d87a97 ]
The loop on entry of ata_host_start() may not initialize host->ops to a non NULL value. The test on the host_stop field of host->ops must then be preceded by a check that host->ops is not NULL.
--- drivers/ata/libata-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/libata-core.c +1 -1
@@ -5573,7 +5573,7 @@ int ata_host_start(struct ata_host *host) have_stop =1 ; } -if (host->ops->host_stop) +if (host->ops && host->ops->host_stop) have_stop =1 ;if (have_stop) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 28/334 sched/topology: Skip updating masks for non-online nodes
In reply to Greg Kroah-HartmanFrom: Valentin Schneider <[email protected]>
[ Upstream commit 0083242c93759dde353a963a90cb351c5c283379 ]
The scheduler currently expects NUMA node distances to be stable from init onwards, and as a consequence builds the related data structures once-and-for-all at init (see sched_init_numa()).
Unfortunately, on some architectures node distance is unreliable for offline nodes and may very well change upon onlining.
Skip over offline nodes during sched_init_numa(). Track nodes that have been onlined at least once, and trigger a build of a node's NUMA masks when it is first onlined post-init.
--- kernel/sched/topology.c | 65 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+)
kernel/sched/topology.c +65 -0
@@ -1482,6 +1482,8 @@ int sched_max_numa_distance;static int *sched_domains_numa_distance;static struct cpumask ***sched_domains_numa_masks;int __read_mostly node_reclaim_distance =RECLAIM_DISTANCE ; + +static unsigned long __read_mostly *sched_numa_onlined_nodes;#endif /*
@@ -1833,6 +1835,16 @@ void sched_init_numa(void) sched_domains_numa_masks[i][j] = mask;for_each_node (k) { +/* +* Distance information can be unreliable for +* offline nodes, defer building the node +* masks to its bringup. +* This relies on all unique distance values +* still being visible at init time. +*/ +if (!node_online (j)) +continue ; +if (sched_debug () && (node_distance (j, k) !=node_distance (k, j)))sched_numa_warn ("Node-distance not symmetric" );
@@ -1886,6 +1898,53 @@ void sched_init_numa(void) sched_max_numa_distance = sched_domains_numa_distance[nr_levels -1 ];init_numa_topology_type (); + + sched_numa_onlined_nodes =bitmap_alloc (nr_node_ids,GFP_KERNEL ); +if (!sched_numa_onlined_nodes) +return ; + +bitmap_zero (sched_numa_onlined_nodes, nr_node_ids); +for_each_online_node (i) +bitmap_set (sched_numa_onlined_nodes, i,1 ); +} + +static void __sched_domains_numa_masks_set (unsigned int node) +{ +int i, j; + +/* +* NUMA masks are not built for offline nodes in sched_init_numa(). +* Thus, when a CPU of a never-onlined-before node gets plugged in, +* adding that new CPU to the right NUMA masks is not sufficient: the +* masks of that CPU's node must also be updated. +*/ +if (test_bit (node, sched_numa_onlined_nodes)) +return ; + +bitmap_set (sched_numa_onlined_nodes, node,1 ); + +for (i =0 ; i < sched_domains_numa_levels; i++) { +for (j =0 ; j < nr_node_ids; j++) { +if (!node_online (j) || node == j) +continue ; + +if (node_distance (j, node) > sched_domains_numa_distance[i]) +continue ; + +/* Add remote nodes in our masks */ +cpumask_or (sched_domains_numa_masks[i][node], + sched_domains_numa_masks[i][node], + sched_domains_numa_masks[0 ][j]); + } + } + +/* +* A new node has been brought up, potentially changing the topology +* classification. +* +* Note that this is racy vs any use of sched_numa_topology_type :/ +*/ +init_numa_topology_type (); }void sched_domains_numa_masks_set (unsigned int cpu)
@@ -1893,8 +1952,14 @@ void sched_domains_numa_masks_set(unsigned int cpu)int node =cpu_to_node (cpu);int i, j; +__sched_domains_numa_masks_set (node); +for (i =0 ; i < sched_domains_numa_levels; i++) {for (j =0 ; j < nr_node_ids; j++) { +if (!node_online (j)) +continue ; + +/* Set ourselves in the remote node's masks */ if (node_distance (j, node) <= sched_domains_numa_distance[i])cpumask_set_cpu (cpu, sched_domains_numa_masks[i][j]); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 29/334 crypto: omap - Fix inconsistent locking of device lists
In reply to Greg Kroah-HartmanFrom: Ben Hutchings <[email protected]>
[ Upstream commit fe4d55773b879c785ae61da9b1c2160f0110f67e ]
lockdep complains that in omap-aes, the list_lock is taken both with softirqs enabled at probe time, and also in softirq context, which could lead to a deadlock:
================================
WARNING: inconsistent lock state
5.14.0-rc1-00035-gc836005b01c5-dirty #69 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
ksoftirqd/0/7 [HC0[0]:SC1[3]:HE1:SE0] takes:
bf00e014 (list_lock){+.?.}-{2:2}, at: omap_aes_find_dev+0x18/0x54 [omap_aes_driver]
{SOFTIRQ-ON-W} state was registered at:
_raw_spin_lock+0x40/0x50
omap_aes_probe+0x1d4/0x664 [omap_aes_driver]
platform_probe+0x58/0xb8
really_probe+0xbc/0x314
__driver_probe_device+0x80/0xe4
driver_probe_device+0x30/0xc8
__driver_attach+0x70/0xf4
bus_for_each_dev+0x70/0xb4
bus_add_driver+0xf0/0x1d4
driver_register+0x74/0x108
do_one_initcall+0x84/0x2e4
do_init_module+0x5c/0x240
load_module+0x221c/0x2584
sys_finit_module+0xb0/0xec
ret_fast_syscall+0x0/0x2c
0xbed90b30
irq event stamp: 111800
hardirqs last enabled at (111800): [<c02a21e4>] __kmalloc+0x484/0x5ec
hardirqs last disabled at (111799): [<c02a21f0>] __kmalloc+0x490/0x5ec
softirqs last enabled at (111776): [<c01015f0>] __do_softirq+0x2b8/0x4d0
softirqs last disabled at (111781): [<c0135948>] run_ksoftirqd+0x34/0x50
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(list_lock);
<Interrupt>
lock(list_lock);
*** DEADLOCK ***
2 locks held by ksoftirqd/0/7:
#0: c0f5e8c8 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb+0x6c/0x260
#1: c0f5e8c8 (rcu_read_lock){....}-{1:2}, at: ip_local_deliver_finish+0x2c/0xdc
stack backtrace:
CPU: 0 PID: 7 Comm: ksoftirqd/0 Not tainted 5.14.0-rc1-00035-gc836005b01c5-dirty #69
Hardware name: Generic AM43 (Flattened Device Tree)
[<c010e6e0>] (unwind_backtrace) from [<c010b9d0>] (show_stack+0x10/0x14)
[<c010b9d0>] (show_stack) from [<c017c640>] (mark_lock.part.17+0x5bc/0xd04)
[<c017c640>] (mark_lock.part.17) from [<c017d9e4>] (__lock_acquire+0x960/0x2fa4)
[<c017d9e4>] (__lock_acquire) from [<c0180980>] (lock_acquire+0x10c/0x358)
[<c0180980>] (lock_acquire) from [<c093d324>] (_raw_spin_lock_bh+0x44/0x58)
[<c093d324>] (_raw_spin_lock_bh) from [<bf00b258>] (omap_aes_find_dev+0x18/0x54 [omap_aes_driver])
[<bf00b258>] (omap_aes_find_dev [omap_aes_driver]) from [<bf00b328>] (omap_aes_crypt+0x94/0xd4 [omap_aes_driver])
[<bf00b328>] (omap_aes_crypt [omap_aes_driver]) from [<c08ac6d0>] (esp_input+0x1b0/0x2c8)
[<c08ac6d0>] (esp_input) from [<c08c9e90>] (xfrm_input+0x410/0x1290)
[<c08c9e90>] (xfrm_input) from [<c08b6374>] (xfrm4_esp_rcv+0x54/0x11c)
[<c08b6374>] (xfrm4_esp_rcv) from [<c0838840>] (ip_protocol_deliver_rcu+0x48/0x3bc)
[<c0838840>] (ip_protocol_deliver_rcu) from [<c0838c50>] (ip_local_deliver_finish+0x9c/0xdc)
[<c0838c50>] (ip_local_deliver_finish) from [<c0838dd8>] (ip_local_deliver+0x148/0x1b0)
[<c0838dd8>] (ip_local_deliver) from [<c0838f5c>] (ip_rcv+0x11c/0x180)
[<c0838f5c>] (ip_rcv) from [<c077e3a4>] (__netif_receive_skb_one_core+0x54/0x74)
[<c077e3a4>] (__netif_receive_skb_one_core) from [<c077e588>] (netif_receive_skb+0xa8/0x260)
[<c077e588>] (netif_receive_skb) from [<c068d6d4>] (cpsw_rx_handler+0x224/0x2fc)
[<c068d6d4>] (cpsw_rx_handler) from [<c0688ccc>] (__cpdma_chan_process+0xf4/0x188)
[<c0688ccc>] (__cpdma_chan_process) from [<c068a0c0>] (cpdma_chan_process+0x3c/0x5c)
[<c068a0c0>] (cpdma_chan_process) from [<c0690e14>] (cpsw_rx_mq_poll+0x44/0x98)
[<c0690e14>] (cpsw_rx_mq_poll) from [<c0780810>] (__napi_poll+0x28/0x268)
[<c0780810>] (__napi_poll) from [<c0780c64>] (net_rx_action+0xcc/0x204)
[<c0780c64>] (net_rx_action) from [<c0101478>] (__do_softirq+0x140/0x4d0)
[<c0101478>] (__do_softirq) from [<c0135948>] (run_ksoftirqd+0x34/0x50)
[<c0135948>] (run_ksoftirqd) from [<c01583b8>] (smpboot_thread_fn+0xf4/0x1d8)
[<c01583b8>] (smpboot_thread_fn) from [<c01546dc>] (kthread+0x14c/0x174)
[<c01546dc>] (kthread) from [<c010013c>] (ret_from_fork+0x14/0x38)
...The omap-des and omap-sham drivers appear to have a similar issue.
Fix this by using spin_{,un}lock_bh() around device list access in all the probe and remove functions.
--- drivers/crypto/omap-aes.c | 8 ++++---- drivers/crypto/omap-des.c | 8 ++++---- drivers/crypto/omap-sham.c | 12 ++++++------ 3 files changed, 14 insertions(+), 14 deletions(-)
drivers/crypto/omap-aes.c +4 -4
@@ -1175,9 +1175,9 @@ static int omap_aes_probe(struct platform_device *pdev)spin_lock_init (&dd->lock);INIT_LIST_HEAD (&dd->list); -spin_lock (&list_lock); +spin_lock_bh (&list_lock);list_add_tail (&dd->list, &dev_list); -spin_unlock (&list_lock); +spin_unlock_bh (&list_lock);/* Initialize crypto engine */ dd->engine =crypto_engine_alloc_init (dev,1 );
@@ -1264,9 +1264,9 @@ static int omap_aes_remove(struct platform_device *pdev)if (!dd)return -ENODEV ; -spin_lock (&list_lock); +spin_lock_bh (&list_lock);list_del (&dd->list); -spin_unlock (&list_lock); +spin_unlock_bh (&list_lock);for (i = dd->pdata->algs_info_size -1 ; i >=0 ; i--)for (j = dd->pdata->algs_info[i].registered -1 ; j >=0 ; j--) {
drivers/crypto/omap-des.c +4 -4
@@ -1033,9 +1033,9 @@ static int omap_des_probe(struct platform_device *pdev)INIT_LIST_HEAD (&dd->list); -spin_lock (&list_lock); +spin_lock_bh (&list_lock);list_add_tail (&dd->list, &dev_list); -spin_unlock (&list_lock); +spin_unlock_bh (&list_lock);/* Initialize des crypto engine */ dd->engine =crypto_engine_alloc_init (dev,1 );
@@ -1094,9 +1094,9 @@ static int omap_des_remove(struct platform_device *pdev)if (!dd)return -ENODEV ; -spin_lock (&list_lock); +spin_lock_bh (&list_lock);list_del (&dd->list); -spin_unlock (&list_lock); +spin_unlock_bh (&list_lock);for (i = dd->pdata->algs_info_size -1 ; i >=0 ; i--)for (j = dd->pdata->algs_info[i].registered -1 ; j >=0 ; j--)
drivers/crypto/omap-sham.c +6 -6
@@ -2144,9 +2144,9 @@ static int omap_sham_probe(struct platform_device *pdev) (rev & dd->pdata->major_mask) >> dd->pdata->major_shift, (rev & dd->pdata->minor_mask) >> dd->pdata->minor_shift); -spin_lock (&sham.lock); +spin_lock_bh (&sham.lock);list_add_tail (&dd->list, &sham.dev_list); -spin_unlock (&sham.lock); +spin_unlock_bh (&sham.lock); dd->engine =crypto_engine_alloc_init (dev,1 );if (!dd->engine) {
@@ -2194,9 +2194,9 @@ err_algs: err_engine_start:crypto_engine_exit (dd->engine); err_engine: -spin_lock (&sham.lock); +spin_lock_bh (&sham.lock);list_del (&dd->list); -spin_unlock (&sham.lock); +spin_unlock_bh (&sham.lock); err_pm:pm_runtime_disable (dev);if (!dd->polling_mode)
@@ -2215,9 +2215,9 @@ static int omap_sham_remove(struct platform_device *pdev) dd =platform_get_drvdata (pdev);if (!dd)return -ENODEV ; -spin_lock (&sham.lock); +spin_lock_bh (&sham.lock);list_del (&dd->list); -spin_unlock (&sham.lock); +spin_unlock_bh (&sham.lock);for (i = dd->pdata->algs_info_size -1 ; i >=0 ; i--)for (j = dd->pdata->algs_info[i].registered -1 ; j >=0 ; j--) { crypto_unregister_ahash(
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 30/334 crypto: qat - do not ignore errors from enable_vf2pf_comms()
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 5147f0906d50a9d26f2b8698cd06b5680e9867ff ]
The function adf_dev_init() ignores the error code reported by enable_vf2pf_comms(). If the latter fails, e.g. the VF is not compatible with the pf, then the load of the VF driver progresses.
This patch changes adf_dev_init() so that the error code from enable_vf2pf_comms() is returned to the caller.
--- drivers/crypto/qat/qat_common/adf_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/crypto/qat/qat_common/adf_init.c +3 -2
@@ -61,6 +61,7 @@ int adf_dev_init(struct adf_accel_dev *accel_dev)struct service_hndl *service;struct list_head *list_itr;struct adf_hw_device_data *hw_data = accel_dev->hw_device; +int ret;if (!hw_data) { dev_err(&GET_DEV(accel_dev),
@@ -127,9 +128,9 @@ int adf_dev_init(struct adf_accel_dev *accel_dev) } hw_data->enable_error_correction (accel_dev); - hw_data->enable_vf2pf_comms (accel_dev); + ret = hw_data->enable_vf2pf_comms (accel_dev); -return 0 ; +return ret; }EXPORT_SYMBOL_GPL (adf_dev_init);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 31/334 crypto: qat - handle both source of interrupt in VF ISR
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 0a73c762e1eee33a5e5dc0e3488f1b7cd17249b3 ]
The top half of the VF drivers handled only a source at the time. If an interrupt for PF2VF and bundle occurred at the same time, the ISR scheduled only the bottom half for PF2VF.
This patch fixes the VF top half so that if both sources of interrupt trigger at the same time, both bottom halves are scheduled.
This patch is based on earlier work done by Conor McLoughlin.
--- drivers/crypto/qat/qat_common/adf_vf_isr.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/crypto/qat/qat_common/adf_vf_isr.c +4 -3
@@ -160,6 +160,7 @@ static irqreturn_t adf_isr(int irq, void *privdata)struct adf_bar *pmisc = &GET_BARS (accel_dev)[hw_data->get_misc_bar_id (hw_data)];void __iomem *pmisc_bar_addr = pmisc->virt_addr; +bool handled = false;u32 v_int;/* Read VF INT source CSR to determine the source of VF interrupt */
@@ -172,7 +173,7 @@ static irqreturn_t adf_isr(int irq, void *privdata)/* Schedule tasklet to handle interrupt BH */ tasklet_hi_schedule (&accel_dev->vf.pf2vf_bh_tasklet); -return IRQ_HANDLED ; + handled = true; }/* Check bundle interrupt */
@@ -184,10 +185,10 @@ static irqreturn_t adf_isr(int irq, void *privdata) csr_ops->write_csr_int_flag_and_col (bank->csr_addr, bank->bank_number,0 );tasklet_hi_schedule (&bank->resp_handler); -return IRQ_HANDLED ; + handled = true; } -return IRQ_NONE ; +return handled ?IRQ_HANDLED :IRQ_NONE ; }static int adf_request_msi_irq (struct adf_accel_dev *accel_dev)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 32/334 crypto: qat - fix reuse of completion variable
In reply to Greg Kroah-HartmanFrom: Marco Chiappero <[email protected]>
[ Upstream commit 3d655732b0199562267a05c7ff69ecdd11632939 ]
Use reinit_completion() to set to a clean state a completion variable, used to coordinate the VF to PF request-response flow, before every new VF request.
--- drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +2 -0
@@ -316,6 +316,8 @@ static int adf_vf2pf_request_version(struct adf_accel_dev *accel_dev) msg |=ADF_PFVF_COMPATIBILITY_VERSION <<ADF_VF2PF_COMPAT_VER_REQ_SHIFT ;BUILD_BUG_ON (ADF_PFVF_COMPATIBILITY_VERSION >255 ); +reinit_completion (&accel_dev->vf.iov_msg_completion); +/* Send request from VF to PF */ ret =adf_iov_putmsg (accel_dev, msg,0 );if (ret) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 33/334 crypto: qat - fix naming for init/shutdown VF to PF notifications
In reply to Greg Kroah-HartmanFrom: Marco Chiappero <[email protected]>
[ Upstream commit b90c1c4d3fa8cd90f4e8245b13564380fd0bfad1 ]
At start and shutdown, VFs notify the PF about their state. These notifications are carried out through a message exchange using the PFVF protocol.
Function names lead to believe they do perform init or shutdown logic. This is to fix the naming to better reflect their purpose.
--- drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c | 4 ++-- drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c | 4 ++-- drivers/crypto/qat/qat_common/adf_common_drv.h | 8 ++++---- drivers/crypto/qat/qat_common/adf_vf2pf_msg.c | 12 ++++++------ .../qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c | 4 ++-- 5 files changed, 16 insertions(+), 16 deletions(-)
drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c +2 -2
@@ -81,10 +81,10 @@ void adf_init_hw_data_c3xxxiov(struct adf_hw_device_data *hw_data) hw_data->enable_error_correction = adf_vf_void_noop; hw_data->init_admin_comms = adf_vf_int_noop; hw_data->exit_admin_comms = adf_vf_void_noop; - hw_data->send_admin_init = adf_vf2pf_init; + hw_data->send_admin_init = adf_vf2pf_notify_init; hw_data->init_arb = adf_vf_int_noop; hw_data->exit_arb = adf_vf_void_noop; - hw_data->disable_iov = adf_vf2pf_shutdown; + hw_data->disable_iov = adf_vf2pf_notify_shutdown; hw_data->get_accel_mask = get_accel_mask; hw_data->get_ae_mask = get_ae_mask; hw_data->get_num_accels = get_num_accels;
drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c +2 -2
@@ -81,10 +81,10 @@ void adf_init_hw_data_c62xiov(struct adf_hw_device_data *hw_data) hw_data->enable_error_correction = adf_vf_void_noop; hw_data->init_admin_comms = adf_vf_int_noop; hw_data->exit_admin_comms = adf_vf_void_noop; - hw_data->send_admin_init = adf_vf2pf_init; + hw_data->send_admin_init = adf_vf2pf_notify_init; hw_data->init_arb = adf_vf_int_noop; hw_data->exit_arb = adf_vf_void_noop; - hw_data->disable_iov = adf_vf2pf_shutdown; + hw_data->disable_iov = adf_vf2pf_notify_shutdown; hw_data->get_accel_mask = get_accel_mask; hw_data->get_ae_mask = get_ae_mask; hw_data->get_num_accels = get_num_accels;
drivers/crypto/qat/qat_common/adf_common_drv.h +4 -4
@@ -198,8 +198,8 @@ void adf_enable_vf2pf_interrupts(struct adf_accel_dev *accel_dev,void adf_enable_pf2vf_interrupts (struct adf_accel_dev *accel_dev);void adf_disable_pf2vf_interrupts (struct adf_accel_dev *accel_dev); -int adf_vf2pf_init (struct adf_accel_dev *accel_dev); -void adf_vf2pf_shutdown (struct adf_accel_dev *accel_dev); +int adf_vf2pf_notify_init (struct adf_accel_dev *accel_dev); +void adf_vf2pf_notify_shutdown (struct adf_accel_dev *accel_dev);int adf_init_pf_wq (void );void adf_exit_pf_wq (void );int adf_init_vf_wq (void );
@@ -222,12 +222,12 @@ static inline void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev) { } -static inline int adf_vf2pf_init (struct adf_accel_dev *accel_dev) +static inline int adf_vf2pf_notify_init (struct adf_accel_dev *accel_dev) {return 0 ; } -static inline void adf_vf2pf_shutdown (struct adf_accel_dev *accel_dev) +static inline void adf_vf2pf_notify_shutdown (struct adf_accel_dev *accel_dev) { }
drivers/crypto/qat/qat_common/adf_vf2pf_msg.c +6 -6
@@ -5,14 +5,14 @@#include "adf_pf2vf_msg.h" /** -* adf_vf2pf_init() - send init msg to PF +* adf_vf2pf_notify_init() - send init msg to PF * @accel_dev: Pointer to acceleration VF device. * * Function sends an init message from the VF to a PF * * Return: 0 on success, error code otherwise. */ -int adf_vf2pf_init (struct adf_accel_dev *accel_dev) +int adf_vf2pf_notify_init (struct adf_accel_dev *accel_dev) {u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM | (ADF_VF2PF_MSGTYPE_INIT <<ADF_VF2PF_MSGTYPE_SHIFT ));
@@ -25,17 +25,17 @@ int adf_vf2pf_init(struct adf_accel_dev *accel_dev)set_bit (ADF_STATUS_PF_RUNNING , &accel_dev->status);return 0 ; } -EXPORT_SYMBOL_GPL (adf_vf2pf_init); +EXPORT_SYMBOL_GPL (adf_vf2pf_notify_init);/** -* adf_vf2pf_shutdown() - send shutdown msg to PF +* adf_vf2pf_notify_shutdown() - send shutdown msg to PF * @accel_dev: Pointer to acceleration VF device. * * Function sends a shutdown message from the VF to a PF * * Return: void */ -void adf_vf2pf_shutdown (struct adf_accel_dev *accel_dev) +void adf_vf2pf_notify_shutdown (struct adf_accel_dev *accel_dev) {u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM | (ADF_VF2PF_MSGTYPE_SHUTDOWN <<ADF_VF2PF_MSGTYPE_SHIFT ));
@@ -45,4 +45,4 @@ void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)dev_err (&GET_DEV (accel_dev),"Failed to send Shutdown event to PF\n" ); } -EXPORT_SYMBOL_GPL (adf_vf2pf_shutdown); +EXPORT_SYMBOL_GPL (adf_vf2pf_notify_shutdown);
drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c +2 -2
@@ -81,10 +81,10 @@ void adf_init_hw_data_dh895xcciov(struct adf_hw_device_data *hw_data) hw_data->enable_error_correction = adf_vf_void_noop; hw_data->init_admin_comms = adf_vf_int_noop; hw_data->exit_admin_comms = adf_vf_void_noop; - hw_data->send_admin_init = adf_vf2pf_init; + hw_data->send_admin_init = adf_vf2pf_notify_init; hw_data->init_arb = adf_vf_int_noop; hw_data->exit_arb = adf_vf_void_noop; - hw_data->disable_iov = adf_vf2pf_shutdown; + hw_data->disable_iov = adf_vf2pf_notify_shutdown; hw_data->get_accel_mask = get_accel_mask; hw_data->get_ae_mask = get_ae_mask; hw_data->get_num_accels = get_num_accels;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 34/334 crypto: qat - do not export adf_iov_putmsg()
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 645ae0af1840199086c33e4f841892ebee73f615 ]
The function adf_iov_putmsg() is only used inside the intel_qat module therefore should not be exported.
Remove EXPORT_SYMBOL for the function adf_iov_putmsg().
--- drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 1 - 1 file changed, 1 deletion(-)
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +0 -1
@@ -186,7 +186,6 @@ int adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)return ret; } -EXPORT_SYMBOL_GPL (adf_iov_putmsg);void adf_vf2pf_req_hndl (struct adf_accel_vf_info *vf_info) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 35/334 crypto: hisilicon/sec - fix the abnormal exiting process
In reply to Greg Kroah-HartmanFrom: Kai Ye <[email protected]>
[ Upstream commit 90367a027a22c3a9ca8b8bac15df34d9e859fc11 ]
Because the algs registration process has added a judgment. So need to add the judgment for the abnormal exiting process.
--- drivers/crypto/hisilicon/sec2/sec_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/crypto/hisilicon/sec2/sec_main.c +2 -1
@@ -984,7 +984,8 @@ static int sec_probe(struct pci_dev *pdev, const struct pci_device_id *id)return 0 ; err_alg_unregister: -hisi_qm_alg_unregister (qm, &sec_devices); +if (qm->qp_num >= ctx_q_num) +hisi_qm_alg_unregister (qm, &sec_devices); err_qm_stop:sec_debugfs_exit (qm);hisi_qm_stop (qm,QM_NORMAL );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 36/334 crypto: hisilicon/sec - modify the hardware endian configuration
In reply to Greg Kroah-HartmanFrom: Kai Ye <[email protected]>
[ Upstream commit a52626106d6f7edf3d106c065e13a0313cfeb82f ]
When the endian configuration of the hardware is abnormal, it will cause the SEC engine is faulty that reports empty message. And it will affect the normal function of the hardware. Currently the soft configuration method can't restore the faulty device. The endian needs to be configured according to the system properties. So fix it.
--- drivers/crypto/hisilicon/sec2/sec.h | 5 ---- drivers/crypto/hisilicon/sec2/sec_main.c | 31 +++++++----------------- 2 files changed, 9 insertions(+), 27 deletions(-)
drivers/crypto/hisilicon/sec2/sec.h +0 -5
@@ -157,11 +157,6 @@ struct sec_ctx {struct device *dev; }; -enum sec_endian { -SEC_LE =0 , -SEC_32BE , -SEC_64BE -};enum sec_debug_file_index {SEC_CLEAR_ENABLE ,
drivers/crypto/hisilicon/sec2/sec_main.c +9 -22
@@ -312,31 +312,20 @@ static const struct pci_device_id sec_dev_ids[] = { };MODULE_DEVICE_TABLE (pci, sec_dev_ids); -static u8 sec_get_endian (struct hisi_qm *qm) +static void sec_set_endian (struct hisi_qm *qm) {u32 reg; -/* -* As for VF, it is a wrong way to get endian setting by -* reading a register of the engine -*/ -if (qm->pdev->is_virtfn) { -dev_err_ratelimited (&qm->pdev->dev, -"cannot access a register in VF!\n" ); -return SEC_LE ; - } reg =readl_relaxed (qm->io_base +SEC_CONTROL_REG ); -/* BD little endian mode */ -if (!(reg &BIT (0 ))) -return SEC_LE ; + reg &= ~(BIT (1 ) |BIT (0 )); +if (!IS_ENABLED (CONFIG_64BIT )) + reg |=BIT (1 ); -/* BD 32-bits big endian mode */ -else if (!(reg &BIT (1 ))) -return SEC_32BE ; -/* BD 64-bits big endian mode */ -else -return SEC_64BE ; +if (!IS_ENABLED (CONFIG_CPU_LITTLE_ENDIAN )) + reg |=BIT (0 ); + +writel_relaxed (reg, qm->io_base +SEC_CONTROL_REG ); }static void sec_open_sva_prefetch (struct hisi_qm *qm)
@@ -429,9 +418,7 @@ static int sec_engine_init(struct hisi_qm *qm) qm->io_base + SEC_BD_ERR_CHK_EN_REG3);/* config endian */ - reg =readl_relaxed (qm->io_base +SEC_CONTROL_REG ); - reg |=sec_get_endian (qm); -writel_relaxed (reg, qm->io_base +SEC_CONTROL_REG ); +sec_set_endian (qm);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 37/334 crypto: tcrypt - Fix missing return value check
In reply to Greg Kroah-HartmanFrom: Tianjia Zhang <[email protected]>
[ Upstream commit 7b3d52683b3a47c0ba1dfd6b5994a3a795b06972 ]
There are several places where the return value check of crypto_aead_setkey and crypto_aead_setauthsize were lost. It is necessary to add these checks.
At the same time, move the crypto_aead_setauthsize() call out of the loop, and only need to call it once after load transform.
Fixee: 53f52d7aecb4 ("crypto: tcrypt - Added speed tests for AEAD crypto alogrithms in tcrypt test suite")
--- crypto/tcrypt.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-)
crypto/tcrypt.c +19 -10
@@ -290,6 +290,11 @@ static void test_mb_aead_speed(const char *algo, int enc, int secs, } ret =crypto_aead_setauthsize (tfm, authsize); +if (ret) { +pr_err ("alg: aead: Failed to setauthsize for %s: %d\n" , algo, + ret); + goto out_free_tfm; + }for (i =0 ; i < num_mb; ++i)if (testmgr_alloc_buf (data[i].xbuf)) {
@@ -315,7 +320,7 @@ static void test_mb_aead_speed(const char *algo, int enc, int secs,for (i =0 ; i < num_mb; ++i) { data[i].req =aead_request_alloc (tfm,GFP_KERNEL );if (!data[i].req) { -pr_err ("alg: skcipher: Failed to allocate request for %s\n" , +pr_err ("alg: aead: Failed to allocate request for %s\n" , algo);while (i--)aead_request_free (data[i].req);
@@ -567,13 +572,19 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs, sgout = &sg[9 ]; tfm =crypto_alloc_aead (algo,0 ,0 ); -if (IS_ERR (tfm)) {pr_err ("alg: aead: Failed to load transform for %s: %ld\n" , algo,PTR_ERR (tfm)); goto out_notfm; } + ret =crypto_aead_setauthsize (tfm, authsize); +if (ret) { +pr_err ("alg: aead: Failed to setauthsize for %s: %d\n" , algo, + ret); + goto out_noreq; + } +crypto_init_wait (&wait);printk (KERN_INFO "\ntesting speed of %s (%s) %s\n" , algo,get_driver_name (crypto_aead, tfm), e);
@@ -611,8 +622,13 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs,break ; } } + ret =crypto_aead_setkey (tfm, key, *keysize); - ret =crypto_aead_setauthsize (tfm, authsize); +if (ret) { +pr_err ("setkey() failed flags=%x: %d\n" , +crypto_aead_get_flags (tfm), ret); + goto out; + } iv_len =crypto_aead_ivsize (tfm);if (iv_len)
@@ -622,15 +638,8 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs,printk (KERN_INFO "test %u (%d bit key, %d byte blocks): " , i, *keysize *8 , bs); -memset (tvmem[0 ],0xff ,PAGE_SIZE ); -if (ret) { -pr_err ("setkey() failed flags=%x\n" , -crypto_aead_get_flags (tfm)); - goto out; - } -sg_init_aead (sg, xbuf, bs + (enc ?0 : authsize), assoc, aad_size);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 38/334 fcntl: fix potential deadlocks for &fown_struct.lock
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
[ Upstream commit f671a691e299f58835d4660d642582bf0e8f6fda ]
Syzbot reports a potential deadlock in do_fcntl:
========================================================
WARNING: possible irq lock inversion dependency detected
5.12.0-syzkaller #0 Not tainted
--------------------------------------------------------
syz-executor132/8391 just changed the state of lock:ffff888015967bf8 (&f->f_owner.lock){.+..}-{2:2}, at: f_getown_ex fs/fcntl.c:211 [inline] ffff888015967bf8 (&f->f_owner.lock){.+..}-{2:2}, at: do_fcntl+0x8b4/0x1200 fs/fcntl.c:395 but this lock was taken by another, HARDIRQ-safe lock in the past:
(&dev->event_lock){-...}-{2:2}
and interrupts could create inverse lock ordering between them.
other info that might help us debug this:
Chain exists of: &dev->event_lock --> &new->fa_lock --> &f->f_owner.lock
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&f->f_owner.lock);
local_irq_disable();
lock(&dev->event_lock);
lock(&new->fa_lock);
<Interrupt>
lock(&dev->event_lock);*** DEADLOCK ***
This happens because there is a lock hierarchy of &dev->event_lock --> &new->fa_lock --> &f->f_owner.lock from the following call chain:
input_inject_event():
spin_lock_irqsave(&dev->event_lock,...);
input_handle_event():
input_pass_values():
input_to_handler():
evdev_events():
evdev_pass_values():
spin_lock(&client->buffer_lock);
__pass_event():
kill_fasync():
kill_fasync_rcu():
read_lock(&fa->fa_lock);
send_sigio():
read_lock_irqsave(&fown->lock,...);However, since &dev->event_lock is HARDIRQ-safe, interrupts have to be disabled while grabbing &f->f_owner.lock, otherwise we invert the lock hierarchy.
Hence, we replace calls to read_lock/read_unlock on &f->f_owner.lock, with read_lock_irq/read_unlock_irq.
--- fs/fcntl.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
fs/fcntl.c +7 -6
@@ -150,7 +150,8 @@ void f_delown(struct file *filp)pid_t f_getown (struct file *filp) {pid_t pid =0 ; -read_lock (&filp->f_owner.lock); + +read_lock_irq (&filp->f_owner.lock);rcu_read_lock ();if (pid_task (filp->f_owner.pid, filp->f_owner.pid_type)) { pid =pid_vnr (filp->f_owner.pid);
@@ -158,7 +159,7 @@ pid_t f_getown(struct file *filp) pid = -pid; }rcu_read_unlock (); -read_unlock (&filp->f_owner.lock); +read_unlock_irq (&filp->f_owner.lock);return pid; }
@@ -208,7 +209,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg)struct f_owner_ex owner = {};int ret =0 ; -read_lock (&filp->f_owner.lock); +read_lock_irq (&filp->f_owner.lock);rcu_read_lock ();if (pid_task (filp->f_owner.pid, filp->f_owner.pid_type)) owner.pid =pid_vnr (filp->f_owner.pid);
@@ -231,7 +232,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg) ret = -EINVAL ;break ; } -read_unlock (&filp->f_owner.lock); +read_unlock_irq (&filp->f_owner.lock);if (!ret) { ret =copy_to_user (owner_p, &owner,sizeof (owner));
@@ -249,10 +250,10 @@ static int f_getowner_uids(struct file *filp, unsigned long arg)uid_t src[2 ];int err; -read_lock (&filp->f_owner.lock); +read_lock_irq (&filp->f_owner.lock); src[0 ] =from_kuid (user_ns, filp->f_owner.uid); src[1 ] =from_kuid (user_ns, filp->f_owner.euid); -read_unlock (&filp->f_owner.lock); +read_unlock_irq (&filp->f_owner.lock); err =put_user (src[0 ], &dst[0 ]); err |=put_user (src[1 ], &dst[1 ]);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 39/334 fcntl: fix potential deadlock for &fasync_struct.fa_lock
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
[ Upstream commit 2f488f698fda820f8e6fa0407630154eceb145d6 ]
There is an existing lock hierarchy of &dev->event_lock --> &fasync_struct.fa_lock --> &f->f_owner.lock from the following call chain:
input_inject_event():
spin_lock_irqsave(&dev->event_lock,...);
input_handle_event():
input_pass_values():
input_to_handler():
evdev_events():
evdev_pass_values():
spin_lock(&client->buffer_lock);
__pass_event():
kill_fasync():
kill_fasync_rcu():
read_lock(&fa->fa_lock);
send_sigio():
read_lock_irqsave(&fown->lock,...);&dev->event_lock is HARDIRQ-safe, so interrupts have to be disabled while grabbing &fasync_struct.fa_lock, otherwise we invert the lock hierarchy. However, since kill_fasync which calls kill_fasync_rcu is an exported symbol, it may not necessarily be called with interrupts disabled.
As kill_fasync_rcu may be called with interrupts disabled (for example, in the call chain above), we replace calls to read_lock/read_unlock on &fasync_struct.fa_lock in kill_fasync_rcu with read_lock_irqsave/read_unlock_irqrestore.
--- fs/fcntl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/fcntl.c +3 -2
@@ -1004,13 +1004,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band) {while (fa) {struct fown_struct *fown; +unsigned long flags;if (fa->magic !=FASYNC_MAGIC ) {printk (KERN_ERR "kill_fasync: bad magic number in " "fasync_struct!\n" );return ; } -read_lock (&fa->fa_lock); +read_lock_irqsave (&fa->fa_lock, flags);if (fa->fa_file) { fown = &fa->fa_file->f_owner;/* Don't send SIGURG to processes which have not set a
@@ -1019,7 +1020,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)if (!(sig ==SIGURG && fown->signum ==0 ))send_sigio (fown, fa->fa_fd, band); } -read_unlock (&fa->fa_lock); +read_unlock_irqrestore (&fa->fa_lock, flags); fa =rcu_dereference (fa->fa_next); } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 40/334 udf_get_extendedattr() had no boundary checks.
In reply to Greg Kroah-HartmanFrom: Stian Skjelstad <[email protected]>
[ Upstream commit 58bc6d1be2f3b0ceecb6027dfa17513ec6aa2abb ]
When parsing the ExtendedAttr data, malicous or corrupt attribute length could cause kernel hangs and buffer overruns in some special cases.
--- fs/udf/misc.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
fs/udf/misc.c +11 -2
@@ -173,13 +173,22 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type,else offset =le32_to_cpu (eahd->appAttrLocation); -while (offset < iinfo->i_lenEAttr) { +while (offset +sizeof (*gaf) < iinfo->i_lenEAttr) { +uint32_t attrLength; + gaf = (struct genericFormat *)&ea[offset]; + attrLength =le32_to_cpu (gaf->attrLength); + +/* Detect undersized elements and buffer overflows */ +if ((attrLength <sizeof (*gaf)) || + (attrLength > (iinfo->i_lenEAttr - offset))) +break ; +if (le32_to_cpu (gaf->attrType) == type && gaf->attrSubtype == subtype)return gaf;else - offset +=le32_to_cpu (gaf->attrLength); + offset += attrLength; } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 41/334 io-wq: remove GFP_ATOMIC allocation off schedule out path
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
[ Upstream commit d3e9f732c415cf22faa33d6f195e291ad82dc92e ]
Daniel reports that the v5.14-rc4-rt4 kernel throws a BUG when running stress-ng:
| [ 90.202543] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:35 | [ 90.202549] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 2047, name: iou-wrk-2041 | [ 90.202555] CPU: 5 PID: 2047 Comm: iou-wrk-2041 Tainted: G W 5.14.0-rc4-rt4+ #89 | [ 90.202559] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 | [ 90.202561] Call Trace: | [ 90.202577] dump_stack_lvl+0x34/0x44 | [ 90.202584] ___might_sleep.cold+0x87/0x94 | [ 90.202588] rt_spin_lock+0x19/0x70 | [ 90.202593] ___slab_alloc+0xcb/0x7d0 | [ 90.202598] ? newidle_balance.constprop.0+0xf5/0x3b0 | [ 90.202603] ? dequeue_entity+0xc3/0x290 | [ 90.202605] ? io_wqe_dec_running.isra.0+0x98/0xe0 | [ 90.202610] ? pick_next_task_fair+0xb9/0x330 | [ 90.202612] ? __schedule+0x670/0x1410 | [ 90.202615] ? io_wqe_dec_running.isra.0+0x98/0xe0 | [ 90.202618] kmem_cache_alloc_trace+0x79/0x1f0 | [ 90.202621] io_wqe_dec_running.isra.0+0x98/0xe0 | [ 90.202625] io_wq_worker_sleeping+0x37/0x50 | [ 90.202628] schedule+0x30/0xd0 | [ 90.202630] schedule_timeout+0x8f/0x1a0 | [ 90.202634] ? __bpf_trace_tick_stop+0x10/0x10 | [ 90.202637] io_wqe_worker+0xfd/0x320 | [ 90.202641] ? finish_task_switch.isra.0+0xd3/0x290 | [ 90.202644] ? io_worker_handle_work+0x670/0x670 | [ 90.202646] ? io_worker_handle_work+0x670/0x670 | [ 90.202649] ret_from_fork+0x22/0x30
which is due to the RT kernel not liking a GFP_ATOMIC allocation inside a raw spinlock. Besides that not working on RT, doing any kind of allocation from inside schedule() is kind of nasty and should be avoided if at all possible.
This particular path happens when an io-wq worker goes to sleep, and we need a new worker to handle pending work. We currently allocate a small data item to hold the information we need to create a new worker, but we can instead include this data in the io_worker struct itself and just protect it with a single bit lock. We only really need one per worker anyway, as we will have run pending work between to sleep cycles.
https://lore.kernel.org/lkml/[email protected]/
--- fs/io-wq.c | 72 ++++++++++++++++++++++++++++++------------------------ 1 file changed, 40 insertions(+), 32 deletions(-)
fs/io-wq.c +40 -32
@@ -51,6 +51,10 @@ struct io_worker {struct completion ref_done; +unsigned long create_state; +struct callback_head create_work; +int create_index; +struct rcu_head rcu; };
@@ -272,24 +276,18 @@ static void io_wqe_inc_running(struct io_worker *worker)atomic_inc (&acct->nr_running); } -struct create_worker_data { -struct callback_head work; -struct io_wqe *wqe; -int index; -}; -static void create_worker_cb (struct callback_head *cb) { -struct create_worker_data *cwd; +struct io_worker *worker;struct io_wq *wq;struct io_wqe *wqe;struct io_wqe_acct *acct;bool do_create = false, first = false; - cwd = container_of(cb, struct create_worker_data, work); - wqe = cwd->wqe; + worker = container_of(cb, struct io_worker, create_work); + wqe = worker->wqe; wq = wqe->wq; - acct = &wqe->acct[cwd->index]; + acct = &wqe->acct[worker->create_index];raw_spin_lock_irq (&wqe->lock);if (acct->nr_workers < acct->max_workers) {if (!acct->nr_workers)
@@ -299,33 +297,42 @@ static void create_worker_cb(struct callback_head *cb) }raw_spin_unlock_irq (&wqe->lock);if (do_create) { -create_io_worker (wq, wqe, cwd->index, first); +create_io_worker (wq, wqe, worker->create_index, first); }else {atomic_dec (&acct->nr_running);io_worker_ref_put (wq); } -kfree (cwd); +clear_bit_unlock (0 , &worker->create_state); +io_worker_release (worker); } -static void io_queue_worker_create (struct io_wqe *wqe,struct io_wqe_acct *acct) +static void io_queue_worker_create (struct io_wqe *wqe,struct io_worker *worker, +struct io_wqe_acct *acct) { -struct create_worker_data *cwd;struct io_wq *wq = wqe->wq;/* raced with exit, just ignore create call */ if (test_bit (IO_WQ_BIT_EXIT , &wq->state)) goto fail; +if (!io_worker_get (worker)) + goto fail; +/* +* create_state manages ownership of create_work/index. We should +* only need one entry per worker, as the worker going to sleep +* will trigger the condition, and waking will clear it once it +* runs the task_work. +*/ +if (test_bit (0 , &worker->create_state) || +test_and_set_bit_lock (0 , &worker->create_state)) + goto fail_release; - cwd =kmalloc (sizeof (*cwd),GFP_ATOMIC ); -if (cwd) { -init_task_work (&cwd->work, create_worker_cb); - cwd->wqe = wqe; - cwd->index = acct->index; -if (!task_work_add (wq->task, &cwd->work,TWA_SIGNAL )) -return ; - -kfree (cwd); - } +init_task_work (&worker->create_work, create_worker_cb); + worker->create_index = acct->index; +if (!task_work_add (wq->task, &worker->create_work,TWA_SIGNAL )) +return ; +clear_bit_unlock (0 , &worker->create_state); +fail_release: +io_worker_release (worker); fail:atomic_dec (&acct->nr_running);io_worker_ref_put (wq);
@@ -343,7 +350,7 @@ static void io_wqe_dec_running(struct io_worker *worker)if (atomic_dec_and_test (&acct->nr_running) &&io_wqe_run_queue (wqe)) {atomic_inc (&acct->nr_running);atomic_inc (&wqe->wq->worker_refs); -io_queue_worker_create (wqe, acct); +io_queue_worker_create (wqe, worker, acct); } }
@@ -1004,12 +1011,12 @@ err_wq:static bool io_task_work_match (struct callback_head *cb,void *data) { -struct create_worker_data *cwd; +struct io_worker *worker;if (cb->func != create_worker_cb)return false; - cwd = container_of(cb, struct create_worker_data, work); -return cwd->wqe->wq == data; + worker = container_of(cb, struct io_worker, create_work); +return worker->wqe->wq == data; }void io_wq_exit_start (struct io_wq *wq)
@@ -1026,12 +1033,13 @@ static void io_wq_exit_workers(struct io_wq *wq)return ;while ((cb =task_work_cancel_match (wq->task, io_task_work_match, wq)) !=NULL ) { -struct create_worker_data *cwd; +struct io_worker *worker; - cwd = container_of(cb, struct create_worker_data, work); -atomic_dec (&cwd->wqe->acct[cwd->index].nr_running); + worker = container_of(cb, struct io_worker, create_work); +atomic_dec (&worker->wqe->acct[worker->create_index].nr_running);io_worker_ref_put (wq); -kfree (cwd); +clear_bit_unlock (0 , &worker->create_state); +io_worker_release (worker); }rcu_read_lock ();
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 42/334 s390/kasan: fix large PMD pages address alignment check
In reply to Greg Kroah-HartmanFrom: Alexander Gordeev <[email protected]>
[ Upstream commit ddd63c85ef67ea9ea7282ad35eafb6568047126e ]
It is currently possible to initialize a large PMD page when the address is not aligned on page boundary.
--- arch/s390/mm/kasan_init.c | 41 +++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 21 deletions(-)
arch/s390/mm/kasan_init.c +20 -21
@@ -107,6 +107,9 @@ static void __init kasan_early_pgtable_populate(unsigned long address, sgt_prot &= ~_SEGMENT_ENTRY_NOEXEC; } +/* +* The first 1MB of 1:1 mapping is mapped with 4KB pages +*/ while (address < end) { pg_dir =pgd_offset_k (address);if (pgd_none (*pg_dir)) {
@@ -157,30 +160,26 @@ static void __init kasan_early_pgtable_populate(unsigned long address, pm_dir =pmd_offset (pu_dir, address);if (pmd_none (*pm_dir)) { -if (mode ==POPULATE_ZERO_SHADOW && -IS_ALIGNED (address,PMD_SIZE ) && +if (IS_ALIGNED (address,PMD_SIZE ) && end - address >=PMD_SIZE ) { -pmd_populate (&init_mm, pm_dir, - kasan_early_shadow_pte); - address = (address +PMD_SIZE ) &PMD_MASK ; -continue ; - } -/* the first megabyte of 1:1 is mapped with 4k pages */ -if (has_edat && address && end - address >=PMD_SIZE && - mode !=POPULATE_ZERO_SHADOW ) { -void *page; - -if (mode ==POPULATE_ONE2ONE ) { - page = (void *)address; - }else { - page =kasan_early_alloc_segment (); -memset (page,0 , _SEGMENT_SIZE); +if (mode ==POPULATE_ZERO_SHADOW ) { +pmd_populate (&init_mm, pm_dir, kasan_early_shadow_pte); + address = (address +PMD_SIZE ) &PMD_MASK ; +continue ; + }else if (has_edat && address) { +void *page; + +if (mode ==POPULATE_ONE2ONE ) { + page = (void *)address; + }else { + page =kasan_early_alloc_segment (); +memset (page,0 , _SEGMENT_SIZE); + } +pmd_val (*pm_dir) =__pa (page) | sgt_prot; + address = (address +PMD_SIZE ) &PMD_MASK ; +continue ; } -pmd_val (*pm_dir) =__pa (page) | sgt_prot; - address = (address +PMD_SIZE ) &PMD_MASK ; -continue ; } - pt_dir =kasan_early_pte_alloc ();pmd_populate (&init_mm, pm_dir, pt_dir); }else if (pmd_large (*pm_dir)) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 43/334 s390/pci: fix misleading rc in clp_set_pci_fn()
In reply to Greg Kroah-HartmanFrom: Niklas Schnelle <[email protected]>
[ Upstream commit f7addcdd527a6dddfebe20c358b87bdb95624612 ]
Currently clp_set_pci_fn() always returns 0 as long as the CLP request itself succeeds even if the operation itself returns a response code other than CLP_RC_OK or CLP_RC_SETPCIFN_ALRDY. This is highly misleading because calling code assumes that a zero rc means that the operation was successful.
Fix this by returning the response code or cc on failure with the exception of the special handling for CLP_RC_SETPCIFN_ALRDY. Also let's not assume that the returned function handle for CLP_RC_SETPCIFN_ALRDY is 0, we don't need it anyway.
--- arch/s390/pci/pci.c | 7 ++++--- arch/s390/pci/pci_clp.c | 33 ++++++++++++++++----------------- 2 files changed, 20 insertions(+), 20 deletions(-)
arch/s390/pci/pci.c +4 -3
@@ -661,9 +661,10 @@ int zpci_enable_device(struct zpci_dev *zdev) {int rc; - rc =clp_enable_fh (zdev,ZPCI_NR_DMA_SPACES ); -if (rc) +if (clp_enable_fh (zdev,ZPCI_NR_DMA_SPACES )) { + rc = -EIO ; goto out; + } rc =zpci_dma_init_device (zdev);if (rc)
@@ -684,7 +685,7 @@ int zpci_disable_device(struct zpci_dev *zdev)* The zPCI function may already be disabled by the platform, this is * detected in clp_disable_fh() which becomes a no-op. */ -return clp_disable_fh (zdev); +return clp_disable_fh (zdev) ? -EIO :0 ; }/**
arch/s390/pci/pci_clp.c +16 -17
@@ -213,15 +213,19 @@ out: }static int clp_refresh_fh (u32 fid); -/* -* Enable/Disable a given PCI function and update its function handle if -* necessary +/** +* clp_set_pci_fn() - Execute a command on a PCI function +* @zdev: Function that will be affected +* @nr_dma_as: DMA address space number +* @command: The command code to execute +* +* Returns: 0 on success, < 0 for Linux errors (e.g. -ENOMEM), and +* > 0 for non-success platform responses */ static int clp_set_pci_fn (struct zpci_dev *zdev,u8 nr_dma_as,u8 command) {struct clp_req_rsp_set_pci *rrb;int rc, retries =100 ; -u32 fid = zdev->fid; rrb =clp_alloc_block (GFP_KERNEL );if (!rrb)
@@ -245,17 +249,16 @@ static int clp_set_pci_fn(struct zpci_dev *zdev, u8 nr_dma_as, u8 command) } }while (rrb->response.hdr.rsp ==CLP_RC_SETPCIFN_BUSY ); -if (rc || rrb->response.hdr.rsp !=CLP_RC_OK ) { -zpci_err ("Set PCI FN:\n" ); -zpci_err_clp (rrb->response.hdr.rsp, rc); - } -if (!rc && rrb->response.hdr.rsp ==CLP_RC_OK ) { zdev->fh = rrb->response.fh; - }else if (!rc && rrb->response.hdr.rsp ==CLP_RC_SETPCIFN_ALRDY && - rrb->response.fh ==0 ) { + }else if (!rc && rrb->response.hdr.rsp ==CLP_RC_SETPCIFN_ALRDY ) {/* Function is already in desired state - update handle */ - rc =clp_refresh_fh (fid); + rc =clp_refresh_fh (zdev->fid); + }else { +zpci_err ("Set PCI FN:\n" ); +zpci_err_clp (rrb->response.hdr.rsp, rc); +if (!rc) + rc = rrb->response.hdr.rsp; }clp_free_block (rrb);return rc;
@@ -301,17 +304,13 @@ int clp_enable_fh(struct zpci_dev *zdev, u8 nr_dma_as) rc =clp_set_pci_fn (zdev, nr_dma_as,CLP_SET_ENABLE_PCI_FN );zpci_dbg (3 ,"ena fid:%x, fh:%x, rc:%d\n" , zdev->fid, zdev->fh, rc); -if (rc) - goto out; - -if (zpci_use_mio (zdev)) { +if (!rc &&zpci_use_mio (zdev)) { rc =clp_set_pci_fn (zdev, nr_dma_as,CLP_SET_ENABLE_MIO );zpci_dbg (3 ,"ena mio fid:%x, fh:%x, rc:%d\n" , zdev->fid, zdev->fh, rc);if (rc)clp_disable_fh (zdev); } -out:return rc; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 44/334 s390/debug: keep debug data on resize
In reply to Greg Kroah-HartmanFrom: Peter Oberparleiter <[email protected]>
[ Upstream commit 1204777867e8486a88dbb4793fe256b31ea05eeb ]
Any previously recorded s390dbf debug data is reset when a debug area is resized using the 'pages' sysfs attribute. This can make live-debugging unnecessarily complex.
Fix this by copying existing debug data to the newly allocated debug area when resizing.
--- arch/s390/kernel/debug.c | 74 ++++++++++++++++++++++++++++------------ 1 file changed, 53 insertions(+), 21 deletions(-)
arch/s390/kernel/debug.c +53 -21
@@ -24,6 +24,7 @@#include <linux/export.h> #include <linux/init.h> #include <linux/fs.h> +#include <linux/minmax.h> #include <linux/debugfs.h> #include <asm/debug.h>
@@ -92,6 +93,8 @@ static int debug_hex_ascii_format_fn(debug_info_t *id, struct debug_view *view, char *out_buf, const char *in_buf);static int debug_sprintf_format_fn (debug_info_t *id,struct debug_view *view,char *out_buf,debug_sprintf_entry_t *curr_event); +static void debug_areas_swap (debug_info_t *a,debug_info_t *b); +static void debug_events_append (debug_info_t *dest,debug_info_t *src);/* globals */
@@ -726,35 +729,28 @@ EXPORT_SYMBOL(debug_unregister);*/ static int debug_set_size (debug_info_t *id,int nr_areas,int pages_per_area) { -debug_entry_t ***new_areas; +debug_info_t *new_id;unsigned long flags; -int rc =0 ;if (!id || (nr_areas <=0 ) || (pages_per_area <0 ))return -EINVAL ; -if (pages_per_area >0 ) { - new_areas =debug_areas_alloc (pages_per_area, nr_areas); -if (!new_areas) { -pr_info ("Allocating memory for %i pages failed\n" , - pages_per_area); - rc = -ENOMEM ; - goto out; - } - }else { - new_areas =NULL ; + + new_id =debug_info_alloc ("" , pages_per_area, nr_areas, id->buf_size, + id->level,ALL_AREAS ); +if (!new_id) { +pr_info ("Allocating memory for %i pages failed\n" , + pages_per_area); +return -ENOMEM ; } +spin_lock_irqsave (&id->lock, flags); -debug_areas_free (id); - id->areas = new_areas; - id->nr_areas = nr_areas; - id->pages_per_area = pages_per_area; - id->active_area =0 ; -memset (id->active_entries,0 ,sizeof (int )*id->nr_areas); -memset (id->active_pages,0 ,sizeof (int )*id->nr_areas); +debug_events_append (new_id, id); +debug_areas_swap (new_id, id); +debug_info_free (new_id);spin_unlock_irqrestore (&id->lock, flags);pr_info ("%s: set new size (%i pages)\n" , id->name, pages_per_area); -out: -return rc; + +return 0 ; }/**
@@ -821,6 +817,42 @@ static inline debug_entry_t *get_active_entry(debug_info_t *id) id->active_entries[id->active_area]); } +/* Swap debug areas of a and b. */ +static void debug_areas_swap (debug_info_t *a,debug_info_t *b) +{ +swap (a->nr_areas, b->nr_areas); +swap (a->pages_per_area, b->pages_per_area); +swap (a->areas, b->areas); +swap (a->active_area, b->active_area); +swap (a->active_pages, b->active_pages); +swap (a->active_entries, b->active_entries); +} + +/* Append all debug events in active area from source to destination log. */ +static void debug_events_append (debug_info_t *dest,debug_info_t *src) +{ +debug_entry_t *from, *to, *last; + +if (!src->areas || !dest->areas) +return ; + +/* Loop over all entries in src, starting with oldest. */ + from =get_active_entry (src); + last = from; +do { +if (from->clock !=0LL ) { + to =get_active_entry (dest); +memset (to,0 , dest->entry_size); +memcpy (to, from,min (src->entry_size, + dest->entry_size)); +proceed_active_entry (dest); + } + +proceed_active_entry (src); + from =get_active_entry (src); + }while (from != last); +} +/* * debug_finish_entry: * - set timestamp, caller address, cpu number etc.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 45/334 s390/debug: fix debug area life cycle
In reply to Greg Kroah-HartmanFrom: Peter Oberparleiter <[email protected]>
[ Upstream commit 9372a82892c2caa6bccab9a4081166fa769699f8 ]
Currently allocation and registration of s390dbf debug areas are tied together. As a result, a debug area cannot be unregistered and re-registered while any process has an associated debugfs file open.
Fix this by splitting alloc/release from register/unregister.
--- arch/s390/kernel/debug.c | 102 +++++++++++++++++++++------------------ 1 file changed, 56 insertions(+), 46 deletions(-)
arch/s390/kernel/debug.c +56 -46
@@ -314,24 +314,6 @@ static debug_info_t *debug_info_create(const char *name, int pages_per_area, goto out; rc->mode = mode & ~S_IFMT ; - -/* create root directory */ - rc->debugfs_root_entry =debugfs_create_dir (rc->name, - debug_debugfs_root_entry); - -/* append new element to linked list */ -if (!debug_area_first) { -/* first element in list */ - debug_area_first = rc; - rc->prev =NULL ; - }else { -/* append element to end of list */ - debug_area_last->next = rc; - rc->prev = debug_area_last; - } - debug_area_last = rc; - rc->next =NULL ; -refcount_set (&rc->ref_count,1 ); out:return rc;
@@ -391,27 +373,10 @@ static void debug_info_get(debug_info_t *db_info)*/ static void debug_info_put (debug_info_t *db_info) { -int i; -if (!db_info)return ; -if (refcount_dec_and_test (&db_info->ref_count)) { -for (i =0 ; i <DEBUG_MAX_VIEWS ; i++) { -if (!db_info->views[i]) -continue ; -debugfs_remove (db_info->debugfs_entries[i]); - } -debugfs_remove (db_info->debugfs_root_entry); -if (db_info == debug_area_first) - debug_area_first = db_info->next; -if (db_info == debug_area_last) - debug_area_last = db_info->prev; -if (db_info->prev) - db_info->prev->next = db_info->next; -if (db_info->next) - db_info->next->prev = db_info->prev; +if (refcount_dec_and_test (&db_info->ref_count))debug_info_free (db_info); - } }/*
@@ -635,6 +600,31 @@ static int debug_close(struct inode *inode, struct file *file)return 0 ;/* success */ } +/* Create debugfs entries and add to internal list. */ +static void _debug_register (debug_info_t *id) +{ +/* create root directory */ + id->debugfs_root_entry =debugfs_create_dir (id->name, + debug_debugfs_root_entry); + +/* append new element to linked list */ +if (!debug_area_first) { +/* first element in list */ + debug_area_first = id; + id->prev =NULL ; + }else { +/* append element to end of list */ + debug_area_last->next = id; + id->prev = debug_area_last; + } + debug_area_last = id; + id->next =NULL ; + +debug_register_view (id, &debug_level_view); +debug_register_view (id, &debug_flush_view); +debug_register_view (id, &debug_pages_view); +} +/** * debug_register_mode() - creates and initializes debug area. *
@@ -664,19 +654,16 @@ debug_info_t *debug_register_mode(const char *name, int pages_per_area,if ((uid !=0 ) || (gid !=0 ))pr_warn ("Root becomes the owner of all s390dbf files in sysfs\n" );BUG_ON (!initialized); -mutex_lock (&debug_mutex);/* create new debug_info */ rc =debug_info_create (name, pages_per_area, nr_areas, buf_size, mode); -if (!rc) - goto out; -debug_register_view (rc, &debug_level_view); -debug_register_view (rc, &debug_flush_view); -debug_register_view (rc, &debug_pages_view); -out: -if (!rc) +if (rc) { +mutex_lock (&debug_mutex); +_debug_register (rc); +mutex_unlock (&debug_mutex); + }else {pr_err ("Registering debug feature %s failed\n" , name); -mutex_unlock (&debug_mutex); + }return rc; }EXPORT_SYMBOL (debug_register_mode);
@@ -705,6 +692,27 @@ debug_info_t *debug_register(const char *name, int pages_per_area, }EXPORT_SYMBOL (debug_register); +/* Remove debugfs entries and remove from internal list. */ +static void _debug_unregister (debug_info_t *id) +{ +int i; + +for (i =0 ; i <DEBUG_MAX_VIEWS ; i++) { +if (!id->views[i]) +continue ; +debugfs_remove (id->debugfs_entries[i]); + } +debugfs_remove (id->debugfs_root_entry); +if (id == debug_area_first) + debug_area_first = id->next; +if (id == debug_area_last) + debug_area_last = id->prev; +if (id->prev) + id->prev->next = id->next; +if (id->next) + id->next->prev = id->prev; +} +/** * debug_unregister() - give back debug area. *
@@ -718,8 +726,10 @@ void debug_unregister(debug_info_t *id)if (!id)return ;mutex_lock (&debug_mutex); -debug_info_put (id); +_debug_unregister (id);mutex_unlock (&debug_mutex); + +debug_info_put (id); }EXPORT_SYMBOL (debug_unregister);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 46/334 s390/ap: fix state machine hang after failure to enable irq
In reply to Greg Kroah-HartmanFrom: Harald Freudenberger <[email protected]>
[ Upstream commit cabebb697c98fb1f05cc950a747a9b6ec61a5b01 ]
If for any reason the interrupt enable for an ap queue fails the state machine run for the queue returned wrong return codes to the caller. So the caller assumed interrupt support for this queue in enabled and thus did not re-establish the high resolution timer used for polling. In the end this let to a hang for the user space process waiting "forever" for the reply.
This patch reworks these return codes to return correct indications for the caller to re-establish the timer when a queue runs without interrupt support.
Please note that this is fixing a wrong behavior after a first failure (enable interrupt support for the queue) failed. However, looks like this occasionally happens on KVM systems.
--- drivers/s390/crypto/ap_bus.c | 25 ++++++++----------------- drivers/s390/crypto/ap_bus.h | 10 ++-------- drivers/s390/crypto/ap_queue.c | 20 +++++++++++--------- 3 files changed, 21 insertions(+), 34 deletions(-)
drivers/s390/crypto/ap_bus.c +8 -17
@@ -127,22 +127,13 @@ static struct bus_type ap_bus_type;/* Adapter interrupt definitions */ static void ap_interrupt_handler (struct airq_struct *airq,bool floating); -static int ap_airq_flag; +static bool ap_irq_flag;static struct airq_struct ap_airq = { .handler = ap_interrupt_handler, .isc =AP_ISC , }; -/** -* ap_using_interrupts() - Returns non-zero if interrupt support is -* available. -*/ -static inline int ap_using_interrupts (void ) -{ -return ap_airq_flag; -} -/** * ap_airq_ptr() - Get the address of the adapter interrupt indicator *
@@ -152,7 +143,7 @@ static inline int ap_using_interrupts(void)*/ void *ap_airq_ptr (void ) { -if (ap_using_interrupts ()) +if (ap_irq_flag)return ap_airq.lsi_ptr;return NULL ; }
@@ -396,7 +387,7 @@ void ap_wait(enum ap_sm_wait wait)switch (wait) {case AP_SM_WAIT_AGAIN :case AP_SM_WAIT_INTERRUPT : -if (ap_using_interrupts ()) +if (ap_irq_flag)break ;if (ap_poll_kthread) {wake_up (&ap_poll_wait);
@@ -471,7 +462,7 @@ static void ap_tasklet_fn(unsigned long dummy)* be received. Doing it in the beginning of the tasklet is therefor * important that no requests on any AP get lost. */ -if (ap_using_interrupts ()) +if (ap_irq_flag)xchg (ap_airq.lsi_ptr,0 );spin_lock_bh (&ap_queues_lock);
@@ -541,7 +532,7 @@ static int ap_poll_thread_start(void) {int rc; -if (ap_using_interrupts () || ap_poll_kthread) +if (ap_irq_flag || ap_poll_kthread)return 0 ;mutex_lock (&ap_poll_thread_mutex); ap_poll_kthread =kthread_run (ap_poll_thread,NULL ,"appoll" );
@@ -1187,7 +1178,7 @@ static BUS_ATTR_RO(ap_adapter_mask);static ssize_t ap_interrupts_show (struct bus_type *bus,char *buf) {return scnprintf (buf,PAGE_SIZE ,"%d\n" , -ap_using_interrupts () ?1 :0 ); + ap_irq_flag ?1 :0 ); }static BUS_ATTR_RO (ap_interrupts);
@@ -1912,7 +1903,7 @@ static int __init ap_module_init(void)/* enable interrupts if available */ if (ap_interrupts_available ()) { rc =register_adapter_interrupt (&ap_airq); - ap_airq_flag = (rc ==0 ); + ap_irq_flag = (rc ==0 ); }/* Create /sys/bus/ap. */
@@ -1956,7 +1947,7 @@ out_work: out_bus:bus_unregister (&ap_bus_type); out: -if (ap_using_interrupts ()) +if (ap_irq_flag)unregister_adapter_interrupt (&ap_airq);kfree (ap_qci_info);return rc;
drivers/s390/crypto/ap_bus.h +2 -8
@@ -80,12 +80,6 @@ static inline int ap_test_bit(unsigned int *ptr, unsigned int nr)#define AP_FUNC_EP11 5#define AP_FUNC_APXA 6 -/* -* AP interrupt states -*/ -#define AP_INTR_DISABLED 0/* AP interrupt disabled */ -#define AP_INTR_ENABLED 1/* AP interrupt enabled */ -/* * AP queue state machine states */
@@ -112,7 +106,7 @@ enum ap_sm_event {* AP queue state wait behaviour */ enum ap_sm_wait { -AP_SM_WAIT_AGAIN ,/* retry immediately */ +AP_SM_WAIT_AGAIN =0 ,/* retry immediately */ AP_SM_WAIT_TIMEOUT ,/* wait for timeout */ AP_SM_WAIT_INTERRUPT ,/* wait for thin interrupt (if available) */ AP_SM_WAIT_NONE ,/* no wait */
@@ -186,7 +180,7 @@ struct ap_queue {enum ap_dev_state dev_state;/* queue device state */ bool config;/* configured state */ ap_qid_t qid;/* AP queue id. */ -int interrupt;/* indicate if interrupts are enabled */ +bool interrupt;/* indicate if interrupts are enabled */ int queue_count;/* # messages currently on AP queue. */ int pendingq_count;/* # requests on pendingq list. */ int requestq_count;/* # requests on requestq list. */
drivers/s390/crypto/ap_queue.c +11 -9
@@ -19,7 +19,7 @@static void __ap_flush_queue (struct ap_queue *aq);/** -* ap_queue_enable_interruption(): Enable interruption on an AP queue. +* ap_queue_enable_irq(): Enable interrupt support on this AP queue. * @qid: The AP queue number * @ind: the notification indicator byte *
@@ -27,7 +27,7 @@ static void __ap_flush_queue(struct ap_queue *aq);* value it waits a while and tests the AP queue if interrupts * have been switched on using ap_test_queue(). */ -static int ap_queue_enable_interruption (struct ap_queue *aq,void *ind) +static int ap_queue_enable_irq (struct ap_queue *aq,void *ind) {struct ap_queue_status status;struct ap_qirq_ctrl qirqctrl = {0 };
@@ -218,7 +218,8 @@ static enum ap_sm_wait ap_sm_read(struct ap_queue *aq)return AP_SM_WAIT_NONE ;case AP_RESPONSE_NO_PENDING_REPLY :if (aq->queue_count >0 ) -return AP_SM_WAIT_INTERRUPT ; +return aq->interrupt ? +AP_SM_WAIT_INTERRUPT :AP_SM_WAIT_TIMEOUT ; aq->sm_state =AP_SM_STATE_IDLE ;return AP_SM_WAIT_NONE ;default :
@@ -272,7 +273,8 @@ static enum ap_sm_wait ap_sm_write(struct ap_queue *aq) fallthrough;case AP_RESPONSE_Q_FULL : aq->sm_state =AP_SM_STATE_QUEUE_FULL ; -return AP_SM_WAIT_INTERRUPT ; +return aq->interrupt ? +AP_SM_WAIT_INTERRUPT :AP_SM_WAIT_TIMEOUT ;case AP_RESPONSE_RESET_IN_PROGRESS : aq->sm_state =AP_SM_STATE_RESET_WAIT ;return AP_SM_WAIT_TIMEOUT ;
@@ -322,7 +324,7 @@ static enum ap_sm_wait ap_sm_reset(struct ap_queue *aq)case AP_RESPONSE_NORMAL :case AP_RESPONSE_RESET_IN_PROGRESS : aq->sm_state =AP_SM_STATE_RESET_WAIT ; - aq->interrupt =AP_INTR_DISABLED ; + aq->interrupt = false;return AP_SM_WAIT_TIMEOUT ;default : aq->dev_state =AP_DEV_STATE_ERROR ;
@@ -355,7 +357,7 @@ static enum ap_sm_wait ap_sm_reset_wait(struct ap_queue *aq)switch (status.response_code) {case AP_RESPONSE_NORMAL : lsi_ptr =ap_airq_ptr (); -if (lsi_ptr &&ap_queue_enable_interruption (aq, lsi_ptr) ==0 ) +if (lsi_ptr &&ap_queue_enable_irq (aq, lsi_ptr) ==0 ) aq->sm_state =AP_SM_STATE_SETIRQ_WAIT ;else aq->sm_state = (aq->queue_count > 0) ?
@@ -396,7 +398,7 @@ static enum ap_sm_wait ap_sm_setirq_wait(struct ap_queue *aq)if (status.irq_enabled ==1 ) {/* Irqs are now enabled */ - aq->interrupt =AP_INTR_ENABLED ; + aq->interrupt = true; aq->sm_state = (aq->queue_count >0 ) ?AP_SM_STATE_WORKING :AP_SM_STATE_IDLE ; }
@@ -586,7 +588,7 @@ static ssize_t interrupt_show(struct device *dev,spin_lock_bh (&aq->lock);if (aq->sm_state ==AP_SM_STATE_SETIRQ_WAIT ) rc =scnprintf (buf,PAGE_SIZE ,"Enable Interrupt pending.\n" ); -else if (aq->interrupt ==AP_INTR_ENABLED ) +else if (aq->interrupt) rc =scnprintf (buf,PAGE_SIZE ,"Interrupts enabled.\n" );else rc =scnprintf (buf,PAGE_SIZE ,"Interrupts disabled.\n" );
@@ -767,7 +769,7 @@ struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type) aq->ap_dev.device.type = &ap_queue_type; aq->ap_dev.device_type = device_type; aq->qid = qid; - aq->interrupt =AP_INTR_DISABLED ; + aq->interrupt = false;spin_lock_init (&aq->lock);INIT_LIST_HEAD (&aq->pendingq);INIT_LIST_HEAD (&aq->requestq);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 47/334 s390/smp: enable DAT before CPU restart callback is called
In reply to Greg Kroah-HartmanFrom: Alexander Gordeev <[email protected]>
[ Upstream commit 915fea04f9320d0f4ab6ecbb6bf759eebcd2c41d ]
The restart interrupt is triggered whenever a secondary CPU is brought online, a remote function call dispatched from another CPU or a manual PSW restart is initiated and causes the system to kdump. The handling routine is always called with DAT turned off. It then initializes the stack frame and invokes a callback.
The existing callbacks handle DAT as follows:
* __do_restart() and __machine_kexec() turn in on upon entry;
* __ipl_run(), __reipl_run() and __dump_run() do not turn it right away, but all of them call diag308() - which turns DAT on, but only if kasan is enabled;
In addition to the described complexity all callbacks (and the functions they call) should avoid kasan instrumentation while DAT is off.
This update enables DAT in the assembler restart handler and relieves any callbacks (which are mostly C functions) from dealing with DAT altogether.
There are four types of CPU restart that initialize control registers in different ways:
1. Start of secondary CPU on boot - control registers are
inherited from the IPL CPU;
2. Restart of online CPU - control registers of the CPU being
restarted are kept;
3. Hotplug of offline CPU - control registers are inherited
from the starting CPU; 4. Start of offline CPU triggered by manual PSW restart - the control registers are read from the absolute lowcore and contain the boot time IPL CPU values updated with all follow-up calls of smp_ctl_set_bit() and smp_ctl_clear_bit() routines;
In first three cases contents of the control registers is the most recent. In the latter case control registers are good enough to facilitate successful completion of kdump operation.
--- arch/s390/include/asm/lowcore.h | 3 ++- arch/s390/include/asm/processor.h | 2 ++ arch/s390/kernel/asm-offsets.c | 1 + arch/s390/kernel/entry.S | 11 +++++++---- arch/s390/kernel/ipl.c | 3 --- arch/s390/kernel/machine_kexec.c | 1 - arch/s390/kernel/setup.c | 9 ++++++++- arch/s390/kernel/smp.c | 31 ++++++++++++++++++++++--------- 8 files changed, 42 insertions(+), 19 deletions(-)
arch/s390/include/asm/lowcore.h +2 -1
@@ -124,7 +124,8 @@ struct lowcore {/* Restart function and parameter. */ __u64 restart_fn;/* 0x0370 */ __u64 restart_data;/* 0x0378 */ -__u64 restart_source;/* 0x0380 */ +__u32 restart_source;/* 0x0380 */ +__u32 restart_flags;/* 0x0384 */ /* Address space pointer. */ __u64 kernel_asce;/* 0x0388 */
arch/s390/include/asm/processor.h +2 -0
@@ -26,6 +26,8 @@#define _CIF_MCCK_GUEST BIT(CIF_MCCK_GUEST)#define _CIF_DEDICATED_CPU BIT(CIF_DEDICATED_CPU) +#define RESTART_FLAG_CTLREGS _AC(1 << 0, U) +#ifndef __ASSEMBLY__#include <linux/cpumask.h>
arch/s390/kernel/asm-offsets.c +1 -0
@@ -116,6 +116,7 @@ int main(void)OFFSET (__LC_RESTART_FN, lowcore, restart_fn);OFFSET (__LC_RESTART_DATA, lowcore, restart_data);OFFSET (__LC_RESTART_SOURCE, lowcore, restart_source); +OFFSET (__LC_RESTART_FLAGS, lowcore, restart_flags);OFFSET (__LC_KERNEL_ASCE, lowcore, kernel_asce);OFFSET (__LC_USER_ASCE, lowcore, user_asce);OFFSET (__LC_LPP, lowcore, lpp);
arch/s390/kernel/entry.S +7 -4
@@ -624,12 +624,15 @@ ENTRY(mcck_int_handler) 4: j 4b ENDPROC(mcck_int_handler) -# -# PSW restart interrupt handler -# ENTRY(restart_int_handler) ALTERNATIVE "", ".insn s,0xb2800000,_LPP_OFFSET", 40 stg %r15,__LC_SAVE_AREA_RESTART + TSTMSK __LC_RESTART_FLAGS,RESTART_FLAG_CTLREGS,4 + jz 0f + la %r15,4095 + lctlg %c0,%c15,__LC_CREGS_SAVE_AREA-4095(%r15) +0: larl %r15,.Lstosm_tmp + stosm 0(%r15),0x04 # turn dat on, keep irqs off lg %r15,__LC_RESTART_STACK xc STACK_FRAME_OVERHEAD(__PT_SIZE,%r15),STACK_FRAME_OVERHEAD(%r15) stmg %r0,%r14,STACK_FRAME_OVERHEAD+__PT_R0(%r15)
@@ -638,7 +641,7 @@ ENTRY(restart_int_handler) xc 0(STACK_FRAME_OVERHEAD,%r15),0(%r15) lg %r1,__LC_RESTART_FN # load fn, parm & source cpu lg %r2,__LC_RESTART_DATA - lg %r3,__LC_RESTART_SOURCE + lgf %r3,__LC_RESTART_SOURCE ltgr %r3,%r3 # test source cpu address jm 1f # negative -> skip source stop 0: sigp %r4,%r3,SIGP_SENSE # sigp sense to source cpu
arch/s390/kernel/ipl.c +0 -3
@@ -179,8 +179,6 @@ static inline int __diag308(unsigned long subcode, void *addr)int diag308 (unsigned long subcode,void *addr) { -if (IS_ENABLED (CONFIG_KASAN )) -__arch_local_irq_stosm (0x04 );/* enable DAT */ diag_stat_inc (DIAG_STAT_X308 );return __diag308 (subcode, addr); }
@@ -1843,7 +1841,6 @@ static struct kobj_attribute on_restart_attr = __ATTR_RW(on_restart);static void __do_restart (void *ignore) { -__arch_local_irq_stosm (0x04 );/* enable DAT */ smp_send_stop ();#ifdef CONFIG_CRASH_DUMP crash_kexec (NULL );
arch/s390/kernel/machine_kexec.c +0 -1
@@ -263,7 +263,6 @@ static void __do_machine_kexec(void *data)*/ static void __machine_kexec (void *data) { -__arch_local_irq_stosm (0x04 );/* enable DAT */ pfault_fini ();tracing_off ();debug_locks_off ();
arch/s390/kernel/setup.c +8 -1
@@ -421,7 +421,7 @@ static void __init setup_lowcore_dat_off(void) lc->restart_stack = (unsigned long ) restart_stack; lc->restart_fn = (unsigned long ) do_restart; lc->restart_data =0 ; - lc->restart_source =-1UL ; + lc->restart_source =-1U ; mcck_stack = (unsigned long )memblock_alloc (THREAD_SIZE ,THREAD_SIZE );if (!mcck_stack)
@@ -450,12 +450,19 @@ static void __init setup_lowcore_dat_off(void)static void __init setup_lowcore_dat_on (void ) { +struct lowcore *lc = lowcore_ptr[0 ]; +__ctl_clear_bit (0 ,28 ); S390_lowcore.external_new_psw.mask |=PSW_MASK_DAT ; S390_lowcore.svc_new_psw.mask |=PSW_MASK_DAT ; S390_lowcore.program_new_psw.mask |=PSW_MASK_DAT ; S390_lowcore.io_new_psw.mask |=PSW_MASK_DAT ; +__ctl_store (S390_lowcore.cregs_save_area,0 ,15 );__ctl_set_bit (0 ,28 ); +mem_assign_absolute (S390_lowcore.restart_flags,RESTART_FLAG_CTLREGS ); +mem_assign_absolute (S390_lowcore.program_new_psw, lc->program_new_psw); +memcpy_absolute (&S390_lowcore.cregs_save_area, lc->cregs_save_area, +sizeof (S390_lowcore.cregs_save_area)); }static struct resource code_resource = {
arch/s390/kernel/smp.c +22 -9
@@ -252,6 +252,7 @@ static void pcpu_prepare_secondary(struct pcpu *pcpu, int cpu)cpumask_set_cpu (cpu, &init_mm.context.cpu_attach_mask);cpumask_set_cpu (cpu,mm_cpumask (&init_mm)); lc->cpu_nr = cpu; + lc->restart_flags =RESTART_FLAG_CTLREGS ; lc->spinlock_lockval =arch_spin_lockval (cpu); lc->spinlock_index =0 ; lc->percpu_offset = __per_cpu_offset[cpu];
@@ -297,7 +298,7 @@ static void pcpu_start_fn(struct pcpu *pcpu, void (*func)(void *), void *data) lc->restart_stack = lc->nodat_stack; lc->restart_fn = (unsigned long ) func; lc->restart_data = (unsigned long ) data; - lc->restart_source =-1UL ; + lc->restart_source =-1U ;pcpu_sigp_retry (pcpu,SIGP_RESTART ,0 ); }
@@ -311,12 +312,12 @@ static void __pcpu_delegate(pcpu_delegate_fn *func, void *data)func (data);/* should not return */ } -static void __no_sanitize_address pcpu_delegate(struct pcpu *pcpu, -pcpu_delegate_fn *func, -void *data,unsigned long stack) +static void pcpu_delegate (struct pcpu *pcpu, +pcpu_delegate_fn *func, +void *data,unsigned long stack) {struct lowcore *lc = lowcore_ptr[pcpu - pcpu_devices]; -unsigned long source_cpu =stap (); +unsigned int source_cpu =stap ();__load_psw_mask (PSW_KERNEL_BITS |PSW_MASK_DAT );if (pcpu->address == source_cpu) {
@@ -569,6 +570,9 @@ static void smp_ctl_bit_callback(void *info)__ctl_load (cregs,0 ,15 ); } +static DEFINE_SPINLOCK (ctl_lock); +static unsigned long ctlreg; +/* * Set a bit in a control register of all cpus */
@@ -576,6 +580,11 @@ void smp_ctl_set_bit(int cr, int bit) {struct ec_creg_mask_parms parms = {1UL << bit,-1UL , cr }; +spin_lock (&ctl_lock); +memcpy_absolute (&ctlreg, &S390_lowcore.cregs_save_area[cr],sizeof (ctlreg)); +__set_bit (bit, &ctlreg); +memcpy_absolute (&S390_lowcore.cregs_save_area[cr], &ctlreg,sizeof (ctlreg)); +spin_unlock (&ctl_lock);on_each_cpu (smp_ctl_bit_callback, &parms,1 ); }EXPORT_SYMBOL (smp_ctl_set_bit);
@@ -587,6 +596,11 @@ void smp_ctl_clear_bit(int cr, int bit) {struct ec_creg_mask_parms parms = {0 , ~(1UL << bit), cr }; +spin_lock (&ctl_lock); +memcpy_absolute (&ctlreg, &S390_lowcore.cregs_save_area[cr],sizeof (ctlreg)); +__clear_bit (bit, &ctlreg); +memcpy_absolute (&S390_lowcore.cregs_save_area[cr], &ctlreg,sizeof (ctlreg)); +spin_unlock (&ctl_lock);on_each_cpu (smp_ctl_bit_callback, &parms,1 ); }EXPORT_SYMBOL (smp_ctl_clear_bit);
@@ -895,14 +909,13 @@ static void smp_init_secondary(void)/* * Activate a secondary processor. */ -static void __no_sanitize_address smp_start_secondary(void *cpuvoid) +static void smp_start_secondary (void *cpuvoid) { S390_lowcore.restart_stack = (unsigned long ) restart_stack; S390_lowcore.restart_fn = (unsigned long ) do_restart; S390_lowcore.restart_data =0 ; - S390_lowcore.restart_source =-1UL ; -__ctl_load (S390_lowcore.cregs_save_area,0 ,15 ); -__load_psw_mask (PSW_KERNEL_BITS |PSW_MASK_DAT ); + S390_lowcore.restart_source =-1U ; + S390_lowcore.restart_flags =0 ;call_on_stack_noreturn (smp_init_secondary, S390_lowcore.kernel_stack); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 48/334 sched/debug: Dont update sched_domain debug directories before sched_debug_init()
In reply to Greg Kroah-HartmanFrom: Valentin Schneider <[email protected]>
[ Upstream commit 459b09b5a3254008b63382bf41a9b36d0b590f57 ]
Since CPU capacity asymmetry can stem purely from maximum frequency differences (e.g. Pixel 1), a rebuild of the scheduler topology can be issued upon loading cpufreq, see:
arch_topology.c::init_cpu_capacity_callback()
Turns out that if this rebuild happens *before* sched_debug_init() is run (which is a late initcall), we end up messing up the sched_domain debug
directory: passing a NULL parent to debugfs_create_dir() ends up creating the directory at the debugfs root, which in this case creates /sys/kernel/debug/domains (instead of /sys/kernel/debug/sched/domains).
This currently doesn't happen on asymmetric systems which use cpufreq-scpi or cpufreq-dt drivers, as those are loaded via deferred_probe_initcall() (it is also a late initcall, but appears to be ordered *after* sched_debug_init()).
Ionela has been working on detecting maximum frequency asymmetry via ACPI, and that actually happens via a *device* initcall, thus before sched_debug_init(), and causes the aforementionned debugfs mayhem.
One option would be to punt sched_debug_init() down to fs_initcall_sync(). Preventing update_sched_domain_debugfs() from running before sched_debug_init() appears to be the safer option.
--- kernel/sched/debug.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/sched/debug.c +7 -0
@@ -388,6 +388,13 @@ void update_sched_domain_debugfs(void) {int cpu, i; +/* +* This can unfortunately be invoked before sched_debug_init() creates +* the debug directory. Don't touch sd_sysctl_cpus until then. +*/ +if (!debugfs_sched) +return ; +if (!cpumask_available (sd_sysctl_cpus)) {if (!alloc_cpumask_var (&sd_sysctl_cpus,GFP_KERNEL ))return ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 49/334 power: supply: cw2015: use dev_err_probe to allow deferred probe
In reply to Greg Kroah-HartmanFrom: Peter Robinson <[email protected]>
[ Upstream commit ad1abe476995d97bfe7546ea91bb4f3dcdfbf3ab ]
Deal with deferred probe using dev_err_probe so the error is handled and avoid logging lots probe defer information like the following:
[ 9.125121] cw2015 4-0062: Failed to register power supply [ 9.211131] cw2015 4-0062: Failed to register power supply
--- drivers/power/supply/cw2015_battery.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/power/supply/cw2015_battery.c +3 -1
@@ -679,7 +679,9 @@ static int cw_bat_probe(struct i2c_client *client) &cw2015_bat_desc, &psy_cfg);if (IS_ERR (cw_bat->rk_bat)) { -dev_err (cw_bat->dev,"Failed to register power supply\n" ); +/* try again if this happens */ +dev_err_probe (&client->dev,PTR_ERR (cw_bat->rk_bat), +"Failed to register power supply\n" );return PTR_ERR (cw_bat->rk_bat); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 50/334 m68k: emu: Fix invalid free in nfeth_cleanup()
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 761608f5cf70e8876c2f0e39ca54b516bdcb7c12 ]
In the for loop all nfeth_dev array members should be freed, not only the first one. Freeing only the first array member can cause double-free bugs and memory leaks.
--- arch/m68k/emu/nfeth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/m68k/emu/nfeth.c +2 -2
@@ -254,8 +254,8 @@ static void __exit nfeth_cleanup(void)for (i =0 ; i <MAX_UNIT ; i++) {if (nfeth_dev[i]) { -unregister_netdev (nfeth_dev[0 ]); -free_netdev (nfeth_dev[0 ]); +unregister_netdev (nfeth_dev[i]); +free_netdev (nfeth_dev[i]); } }free_irq (nfEtherIRQ, nfeth_interrupt);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 51/334 crypto: x86/aes-ni - add missing error checks in XTS code
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
[ Upstream commit 821720b9f34ec54106ebf012a712ba73bbcf47c2 ]
The updated XTS code fails to check the return code of skcipher_walk_virt, which may lead to skcipher_walk_abort() or skcipher_walk_done() being called while the walk argument is in an inconsistent state.
So check the return value after each such call, and bail on errors.
--- arch/x86/crypto/aesni-intel_glue.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/x86/crypto/aesni-intel_glue.c +5 -0
@@ -849,6 +849,8 @@ static int xts_crypt(struct skcipher_request *req, bool encrypt)return -EINVAL ; err =skcipher_walk_virt (&walk, req, false); +if (err) +return err;if (unlikely (tail >0 && walk.nbytes < walk.total)) {int blocks =DIV_ROUND_UP (req->cryptlen,AES_BLOCK_SIZE ) -2 ;
@@ -862,7 +864,10 @@ static int xts_crypt(struct skcipher_request *req, bool encrypt)skcipher_request_set_crypt (&subreq, req->src, req->dst, blocks *AES_BLOCK_SIZE , req->iv); req = &subreq; + err =skcipher_walk_virt (&walk, req, false); +if (err) +return err; }else { tail =0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 52/334 crypto: ecc - handle unaligned input buffer in ecc_swap_digits
In reply to Greg Kroah-HartmanFrom: Mian Yousaf Kaukab <[email protected]>
[ Upstream commit 0469dede0eeeefe12a9a2fd76078f4a266513457 ]
ecdsa_set_pub_key() makes an u64 pointer at 1 byte offset of the key. This results in an unaligned u64 pointer. This pointer is passed to ecc_swap_digits() which assumes natural alignment.
This causes a kernel crash on an armv7 platform:
[ 0.409022] Unhandled fault: alignment exception (0x001) at 0xc2a0a6a9 ... [ 0.416982] PC is at ecdsa_set_pub_key+0xdc/0x120 ... [ 0.491492] Backtrace: [ 0.492059] [<c07c266c>] (ecdsa_set_pub_key) from [<c07c75d4>] (test_akcipher_one+0xf4/0x6c0)
Handle unaligned input buffer in ecc_swap_digits() by replacing be64_to_cpu() to get_unaligned_be64(). Change type of in pointer to void to reflect it doesn’t necessarily need to be aligned.
--- crypto/ecc.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
crypto/ecc.h +3 -2
@@ -27,6 +27,7 @@#define _CRYPTO_ECC_H#include <crypto/ecc_curve.h> +#include <asm/unaligned.h> /* One digit is u64 qword. */ #define ECC_CURVE_NIST_P192_DIGITS 3
@@ -46,13 +47,13 @@* @out: Output array * @ndigits: Number of digits to copy */ -static inline void ecc_swap_digits (const u64 *in,u64 *out,unsigned int ndigits) +static inline void ecc_swap_digits (const void *in,u64 *out,unsigned int ndigits) {const __be64 *src = (__force __be64 *)in;int i;for (i =0 ; i < ndigits; i++) - out[i] =be64_to_cpu (src[ndigits -1 - i]); + out[i] =get_unaligned_be64 (&src[ndigits -1 - i]); }/**
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 53/334 sched/numa: Fix is_core_idle()
In reply to Greg Kroah-HartmanFrom: Mika Penttilä <[email protected]>
[ Upstream commit 1c6829cfd3d5124b125e6df41158665aea413b35 ]
Use the loop variable instead of the function argument to test the other SMT siblings for idle.
--- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/fair.c +1 -1
@@ -1486,7 +1486,7 @@ static inline bool is_core_idle(int cpu)if (cpu == sibling)continue ; -if (!idle_cpu (cpu)) +if (!idle_cpu (sibling)) return false; }#endif
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 54/334 sched: Fix UCLAMP_FLAG_IDLE setting
In reply to Greg Kroah-HartmanFrom: Quentin Perret <[email protected]>
[ Upstream commit ca4984a7dd863f3e1c0df775ae3e744bff24c303 ]
The UCLAMP_FLAG_IDLE flag is set on a runqueue when dequeueing the last uclamp active task (that is, when buckets.tasks reaches 0 for all buckets) to maintain the last uclamp.max and prevent blocked util from suddenly becoming visible.
However, there is an asymmetry in how the flag is set and cleared which can lead to having the flag set whilst there are active tasks on the rq. Specifically, the flag is cleared in the uclamp_rq_inc() path, which is called at enqueue time, but set in uclamp_rq_dec_id() which is called both when dequeueing a task _and_ in the update_uclamp_active() path. As a result, when both uclamp_rq_{dec,ind}_id() are called from update_uclamp_active(), the flag ends up being set but not cleared, hence leaving the runqueue in a broken state.
Fix this by clearing the flag in update_uclamp_active() as well.
--- kernel/sched/core.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
kernel/sched/core.c +19 -6
@@ -1633,6 +1633,23 @@ static inline void uclamp_rq_dec(struct rq *rq, struct task_struct *p)uclamp_rq_dec_id (rq, p, clamp_id); } +static inline void uclamp_rq_reinc_id (struct rq *rq,struct task_struct *p, +enum uclamp_id clamp_id) +{ +if (!p->uclamp[clamp_id].active) +return ; + +uclamp_rq_dec_id (rq, p, clamp_id); +uclamp_rq_inc_id (rq, p, clamp_id); + +/* +* Make sure to clear the idle flag if we've transiently reached 0 +* active tasks on rq. +*/ +if (clamp_id ==UCLAMP_MAX && (rq->uclamp_flags &UCLAMP_FLAG_IDLE )) + rq->uclamp_flags &= ~UCLAMP_FLAG_IDLE ; +} +static inline void uclamp_update_active (struct task_struct *p) {
@@ -1656,12 +1673,8 @@ uclamp_update_active(struct task_struct *p)* affecting a valid clamp bucket, the next time it's enqueued, * it will already see the updated clamp bucket value. */ -for_each_clamp_id (clamp_id) { -if (p->uclamp[clamp_id].active) { -uclamp_rq_dec_id (rq, p, clamp_id); -uclamp_rq_inc_id (rq, p, clamp_id); - } - } +for_each_clamp_id (clamp_id) +uclamp_rq_reinc_id (rq, p, clamp_id);task_rq_unlock (rq, p, &rf); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 55/334 rcu: Fix to include first blocked task in stall warning
In reply to Greg Kroah-HartmanFrom: Yanfei Xu <[email protected]>
[ Upstream commit e6a901a44f76878ed1653626c9ff4cfc5a3f58f8 ]
The for loop in rcu_print_task_stall() always omits ts[0], which points to the first task blocking the stalled grace period. This in turn fails to count this first task, which means that ndetected will be equal to zero when all CPUs have passed through their quiescent states and only one task is blocking the stalled grace period. This zero value for ndetected will in turn result in an incorrect "All QSes seen" message:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-1 rcu_node (CPUs 12-23):
(detected by 15, t=6504 jiffies, g=164777, q=9011209)
rcu: All QSes seen, last rcu_preempt kthread activity 1 (4295252379-4295252378), jiffies_till_next_fqs=1, root ->qsmask 0x2
BUG: sleeping function called from invalid context at include/linux/uaccess.h:156
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 70613, name: msgstress04
INFO: lockdep is turned off.
Preemption disabled at:
[<ffff8000104031a4>] create_object.isra.0+0x204/0x4b0
CPU: 15 PID: 70613 Comm: msgstress04 Kdump: loaded Not tainted
5.12.2-yoctodev-standard #1
Hardware name: Marvell OcteonTX CN96XX board (DT)
Call trace:
dump_backtrace+0x0/0x2cc
show_stack+0x24/0x30
dump_stack+0x110/0x188
___might_sleep+0x214/0x2d0
__might_sleep+0x7c/0xe0This commit therefore fixes the loop to include ts[0].
--- kernel/rcu/tree_stall.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/rcu/tree_stall.h +2 -2
@@ -282,8 +282,8 @@ static int rcu_print_task_stall(struct rcu_node *rnp, unsigned long flags)break ; }raw_spin_unlock_irqrestore_rcu_node (rnp, flags); -for (i--; i; i--) { - t = ts[i]; +while (i) { + t = ts[--i];if (!try_invoke_on_locked_down_task (t, check_slow_task, &rscr))pr_cont (" P%d" , t->pid);else
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 56/334 rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock
In reply to Greg Kroah-HartmanFrom: Yanfei Xu <[email protected]>
[ Upstream commit dc87740c8a6806bd2162bfb441770e4e53be5601 ]
If rcu_print_task_stall() is invoked on an rcu_node structure that does not contain any tasks blocking the current grace period, it takes an early exit that fails to release that rcu_node structure's lock. This results in a self-deadlock, which is detected by lockdep.
To reproduce this bug:
tools/testing/selftests/rcutorture/bin/kvm.sh --allcpus --duration 3 --trust-make --configs "TREE03" --kconfig "CONFIG_PROVE_LOCKING=y" --bootargs "rcutorture.stall_cpu=30 rcutorture.stall_cpu_block=1 rcutorture.fwd_progress=0 rcutorture.test_boost=0"
This will also result in other complaints, including RCU's scheduler hook complaining about blocking rather than preemption and an rcutorture writer stall.
Only a partial RCU CPU stall warning message will be printed because of the self-deadlock.
This commit therefore releases the lock on the rcu_print_task_stall() function's early exit path.
--- kernel/rcu/tree_stall.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/rcu/tree_stall.h +3 -1
@@ -269,8 +269,10 @@ static int rcu_print_task_stall(struct rcu_node *rnp, unsigned long flags)struct task_struct *ts[8 ];lockdep_assert_irqs_disabled (); -if (!rcu_preempt_blocked_readers_cgp (rnp)) +if (!rcu_preempt_blocked_readers_cgp (rnp)) { +raw_spin_unlock_irqrestore_rcu_node (rnp, flags);return 0 ; + }pr_err ("\tTasks blocked on level-%d rcu_node (CPUs %d-%d):" , rnp->level, rnp->grplo, rnp->grphi); t = list_entry(rnp->gp_tasks->prev,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 57/334 m68k: Fix invalid RMW_INSNS on CPUs that lack CAS
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 2189e928b62e91d8efbc9826ae7c0968f0d55790 ]
When enabling CONFIG_RMW_INSNS in e.g. a Coldfire build:
{standard input}:3068: Error: invalid instruction for this architecture; needs 68020 or higher (68020 [68k, 68ec020], 68030 [68ec030], 68040 [68ec040], 68060 [68ec060]) -- statement `casl %d4,%d0,(%a6)' ignoredFix this by (a) adding a new config symbol to track if support for any CPU that lacks the CAS instruction is enabled, and (b) making CONFIG_RMW_INSNS depend on the new symbol not being set.
--- arch/m68k/Kconfig.cpu | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
arch/m68k/Kconfig.cpu +7 -1
@@ -26,6 +26,7 @@ config COLDFIRE bool "Coldfire CPU family support" select ARCH_HAVE_CUSTOM_GPIO_H select CPU_HAS_NO_BITFIELDS + select CPU_HAS_NO_CAS select CPU_HAS_NO_MULDIV64 select GENERIC_CSUM select GPIOLIB
@@ -39,6 +40,7 @@ config M68000 bool depends on !MMU select CPU_HAS_NO_BITFIELDS + select CPU_HAS_NO_CAS select CPU_HAS_NO_MULDIV64 select CPU_HAS_NO_UNALIGNED select GENERIC_CSUM
@@ -54,6 +56,7 @@ config M68000 config MCPU32 bool select CPU_HAS_NO_BITFIELDS + select CPU_HAS_NO_CAS select CPU_HAS_NO_UNALIGNED select CPU_NO_EFFICIENT_FFS help
@@ -383,7 +386,7 @@ config ADVANCED config RMW_INSNS bool "Use read-modify-write instructions" - depends on ADVANCED + depends on ADVANCED && !CPU_HAS_NO_CAS help This allows to use certain instructions that work with indivisible read-modify-write bus cycles. While this is faster than the
@@ -450,6 +453,9 @@ config M68K_L2_CACHE config CPU_HAS_NO_BITFIELDS bool +config CPU_HAS_NO_CAS + bool + config CPU_HAS_NO_MULDIV64 bool
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 58/334 block: return ELEVATOR_DISCARD_MERGE if possible
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit 866663b7b52d2da267b28e12eed89ee781b8fed1 ]
When merging one bio to request, if they are discard IO and the queue supports multi-range discard, we need to return ELEVATOR_DISCARD_MERGE because both block core and related drivers(nvme, virtio-blk) doesn't handle mixed discard io merge(traditional IO merge together with discard merge) well.
Fix the issue by returning ELEVATOR_DISCARD_MERGE in this situation, so both blk-mq and drivers just need to handle multi-range discard.
--- block/bfq-iosched.c | 3 +++ block/blk-merge.c | 16 ---------------- block/elevator.c | 3 +++ block/mq-deadline.c | 2 ++ include/linux/blkdev.h | 16 ++++++++++++++++ 5 files changed, 24 insertions(+), 16 deletions(-)
block/bfq-iosched.c +3 -0
@@ -2361,6 +2361,9 @@ static int bfq_request_merge(struct request_queue *q, struct request **req, __rq =bfq_find_rq_fmerge (bfqd, bio, q);if (__rq &&elv_bio_merge_ok (__rq, bio)) { *req = __rq; + +if (blk_discard_mergable (__rq)) +return ELEVATOR_DISCARD_MERGE ;return ELEVATOR_FRONT_MERGE ; }
block/blk-merge.c +0 -16
@@ -707,22 +707,6 @@ static void blk_account_io_merge_request(struct request *req) } } -/* -* Two cases of handling DISCARD merge: -* If max_discard_segments > 1, the driver takes every bio -* as a range and send them to controller together. The ranges -* needn't to be contiguous. -* Otherwise, the bios/requests will be handled as same as -* others which should be contiguous. -*/ -static inline bool blk_discard_mergable (struct request *req) -{ -if (req_op (req) ==REQ_OP_DISCARD && -queue_max_discard_segments (req->q) >1 ) -return true; -return false; -} -static enum elv_merge blk_try_req_merge (struct request *req,struct request *next) {
block/elevator.c +3 -0
@@ -336,6 +336,9 @@ enum elv_merge elv_merge(struct request_queue *q, struct request **req, __rq =elv_rqhash_find (q, bio->bi_iter.bi_sector);if (__rq &&elv_bio_merge_ok (__rq, bio)) { *req = __rq; + +if (blk_discard_mergable (__rq)) +return ELEVATOR_DISCARD_MERGE ;return ELEVATOR_BACK_MERGE ; }
block/mq-deadline.c +2 -0
@@ -629,6 +629,8 @@ static int dd_request_merge(struct request_queue *q, struct request **rq,if (elv_bio_merge_ok (__rq, bio)) { *rq = __rq; +if (blk_discard_mergable (__rq)) +return ELEVATOR_DISCARD_MERGE ;return ELEVATOR_FRONT_MERGE ; } }
include/linux/blkdev.h +16 -0
@@ -1521,6 +1521,22 @@ static inline int queue_limit_discard_alignment(struct queue_limits *lim, sectorreturn offset <<SECTOR_SHIFT ; } +/* +* Two cases of handling DISCARD merge: +* If max_discard_segments > 1, the driver takes every bio +* as a range and send them to controller together. The ranges +* needn't to be contiguous. +* Otherwise, the bios/requests will be handled as same as +* others which should be contiguous. +*/ +static inline bool blk_discard_mergable (struct request *req) +{ +if (req_op (req) ==REQ_OP_DISCARD && +queue_max_discard_segments (req->q) >1 ) +return true; +return false; +} +static inline int bdev_discard_alignment (struct block_device *bdev) {struct request_queue *q =bdev_get_queue (bdev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 59/334 spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit 209ab223ad5b18e437289235e3bde12593b94ac4 ]
Depending on the DMA driver being used, the struct dma_slave_config may need to be initialized to zero for the unused data.
For example, we have three DMA drivers using src_port_window_size and dst_port_window_size. If these are left uninitialized, it can cause DMA failures.
For spi-fsl-dspi, this is probably not currently an issue but is still good to fix though.
--- drivers/spi/spi-fsl-dspi.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-fsl-dspi.c +1 -0
@@ -530,6 +530,7 @@ static int dspi_request_dma(struct fsl_dspi *dspi, phys_addr_t phy_addr) goto err_rx_dma_buf; } +memset (&cfg,0 ,sizeof (cfg)); cfg.src_addr = phy_addr +SPI_POPR ; cfg.dst_addr = phy_addr +SPI_PUSHR ; cfg.src_addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 60/334 spi: spi-pic32: Fix issue with uninitialized dma_slave_config
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit 976c1de1de147bb7f4e0d87482f375221c05aeaf ]
Depending on the DMA driver being used, the struct dma_slave_config may need to be initialized to zero for the unused data.
For example, we have three DMA drivers using src_port_window_size and dst_port_window_size. If these are left uninitialized, it can cause DMA failures.
For spi-pic32, this is probably not currently an issue but is still good to fix though.
--- drivers/spi/spi-pic32.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-pic32.c +1 -0
@@ -361,6 +361,7 @@ static int pic32_spi_dma_config(struct pic32_spi *pic32s, u32 dma_width)struct dma_slave_config cfg;int ret; +memset (&cfg,0 ,sizeof (cfg)); cfg.device_fc = true; cfg.src_addr = pic32s->dma_base + buf_offset; cfg.dst_addr = pic32s->dma_base + buf_offset;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 61/334 genirq/timings: Fix error return code in irq_timings_test_irqs()
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
[ Upstream commit 290fdc4b7ef14e33d0e30058042b0e9bfd02b89b ]
Return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- kernel/irq/timings.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/irq/timings.c +2 -0
@@ -799,12 +799,14 @@ static int __init irq_timings_test_irqs(struct timings_intervals *ti)__irq_timings_store (irq, irqs, ti->intervals[i]);if (irqs->circ_timings[i &IRQ_TIMINGS_MASK ] != index) { + ret = -EBADSLT ;pr_err ("Failed to store in the circular buffer\n" ); goto out; } }if (irqs->count != ti->count) { + ret = -ERANGE ;pr_err ("Count differs\n" ); goto out; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 62/334 irqchip/loongson-pch-pic: Improve edge triggered interrupt support
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
[ Upstream commit e5dec38ac5d05d17a7110c8045aa101015281e4d ]
Edge-triggered mode and level-triggered mode need different handlers, and edge-triggered mode need a specific ack operation. So improve it.
--- drivers/irqchip/irq-loongson-pch-pic.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
drivers/irqchip/irq-loongson-pch-pic.c +18 -1
@@ -92,18 +92,22 @@ static int pch_pic_set_type(struct irq_data *d, unsigned int type)case IRQ_TYPE_EDGE_RISING :pch_pic_bitset (priv,PCH_PIC_EDGE , d->hwirq);pch_pic_bitclr (priv,PCH_PIC_POL , d->hwirq); +irq_set_handler_locked (d, handle_edge_irq);break ;case IRQ_TYPE_EDGE_FALLING :pch_pic_bitset (priv,PCH_PIC_EDGE , d->hwirq);pch_pic_bitset (priv,PCH_PIC_POL , d->hwirq); +irq_set_handler_locked (d, handle_edge_irq);break ;case IRQ_TYPE_LEVEL_HIGH :pch_pic_bitclr (priv,PCH_PIC_EDGE , d->hwirq);pch_pic_bitclr (priv,PCH_PIC_POL , d->hwirq); +irq_set_handler_locked (d, handle_level_irq);break ;case IRQ_TYPE_LEVEL_LOW :pch_pic_bitclr (priv,PCH_PIC_EDGE , d->hwirq);pch_pic_bitset (priv,PCH_PIC_POL , d->hwirq); +irq_set_handler_locked (d, handle_level_irq);break ;default : ret = -EINVAL ;
@@ -113,11 +117,24 @@ static int pch_pic_set_type(struct irq_data *d, unsigned int type)return ret; } +static void pch_pic_ack_irq (struct irq_data *d) +{ +unsigned int reg; +struct pch_pic *priv =irq_data_get_irq_chip_data (d); + + reg =readl (priv->base +PCH_PIC_EDGE +PIC_REG_IDX (d->hwirq) *4 ); +if (reg &BIT (PIC_REG_BIT (d->hwirq))) { +writel (BIT (PIC_REG_BIT (d->hwirq)), + priv->base +PCH_PIC_CLR +PIC_REG_IDX (d->hwirq) *4 ); + } +irq_chip_ack_parent (d); +} +static struct irq_chip pch_pic_irq_chip = { .name ="PCH PIC" , .irq_mask = pch_pic_mask_irq, .irq_unmask = pch_pic_unmask_irq, - .irq_ack = irq_chip_ack_parent, + .irq_ack = pch_pic_ack_irq, .irq_set_affinity = irq_chip_set_affinity_parent, .irq_set_type = pch_pic_set_type, };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 63/334 lib/mpi: use kcalloc in mpi_resize
In reply to Greg Kroah-HartmanFrom: Hongbo Li <[email protected]>
[ Upstream commit b6f756726e4dfe75be1883f6a0202dcecdc801ab ]
We should set the additional space to 0 in mpi_resize(). So use kcalloc() instead of kmalloc_array().
In lib/mpi/ec.c:
/****************
* Resize the array of A to NLIMBS. the additional space is cleared
* (set to 0) [done by m_realloc()]
*/
int mpi_resize(MPI a, unsigned nlimbs)
Like the comment of kernel's mpi_resize() said, the additional space need to be set to 0, but when a->d is not NULL, it does not set.
The kernel's mpi lib is from libgcrypt, the mpi resize in libgcrypt is _gcry_mpi_resize() which set the additional space to 0.
This bug may cause mpi api which use mpi_resize() get wrong result under the condition of using the additional space without initiation. If this condition is not met, the bug would not be triggered. Currently in kernel, rsa, sm2 and dh use mpi lib, and they works well, so the bug is not triggered in these cases.
add_points_edwards() use the additional space directly, so it will get a wrong result.
--- lib/mpi/mpiutil.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/mpi/mpiutil.c +1 -1
@@ -148,7 +148,7 @@ int mpi_resize(MPI a, unsigned nlimbs)return 0 ;/* no need to do it */ if (a->d) { - p =kmalloc_array (nlimbs,sizeof (mpi_limb_t),GFP_KERNEL ); + p =kcalloc (nlimbs,sizeof (mpi_limb_t),GFP_KERNEL );if (!p)return -ENOMEM ;memcpy (p, a->d, a->alloced *sizeof (mpi_limb_t));
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 64/334 clocksource/drivers/sh_cmt: Fix wrong setting if dont request IRQ for clock source channel
In reply to Greg Kroah-HartmanFrom: Phong Hoang <[email protected]>
[ Upstream commit be83c3b6e7b8ff22f72827a613bf6f3aa5afadbb ]
If CMT instance has at least two channels, one channel will be used as a clock source and another one used as a clock event device. In that case, IRQ is not requested for clock source channel so sh_cmt_clock_event_program_verify() might work incorrectly. Besides, when a channel is only used for clock source, don't need to re-set the next match_value since it should be maximum timeout as it still is.
On the other hand, due to no IRQ, total_cycles is not counted up when reaches compare match time (timer counter resets to zero), so sh_cmt_clocksource_read() returns unexpected value. Therefore, use 64-bit clocksoure's mask for 32-bit or 16-bit variants will also lead to wrong delta calculation. Hence, this mask should correspond to timer counter width, and above function just returns the raw value of timer counter register.
--- drivers/clocksource/sh_cmt.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-)
drivers/clocksource/sh_cmt.c +18 -12
@@ -579,7 +579,8 @@ static int sh_cmt_start(struct sh_cmt_channel *ch, unsigned long flag) ch->flags |= flag;/* setup timeout if no clockevent */ -if ((flag ==FLAG_CLOCKSOURCE ) && (!(ch->flags &FLAG_CLOCKEVENT ))) +if (ch->cmt->num_channels ==1 && + flag ==FLAG_CLOCKSOURCE && (!(ch->flags &FLAG_CLOCKEVENT )))__sh_cmt_set_next (ch, ch->max_match_value); out:raw_spin_unlock_irqrestore (&ch->lock, flags);
@@ -621,20 +622,25 @@ static struct sh_cmt_channel *cs_to_sh_cmt(struct clocksource *cs)static u64 sh_cmt_clocksource_read (struct clocksource *cs) {struct sh_cmt_channel *ch =cs_to_sh_cmt (cs); -unsigned long flags;u32 has_wrapped; -u64 value; -u32 raw; -raw_spin_lock_irqsave (&ch->lock, flags); - value = ch->total_cycles; - raw =sh_cmt_get_counter (ch, &has_wrapped); +if (ch->cmt->num_channels ==1 ) { +unsigned long flags; +u64 value; +u32 raw; -if (unlikely (has_wrapped)) - raw += ch->match_value +1 ; -raw_spin_unlock_irqrestore (&ch->lock, flags); +raw_spin_lock_irqsave (&ch->lock, flags); + value = ch->total_cycles; + raw =sh_cmt_get_counter (ch, &has_wrapped); + +if (unlikely (has_wrapped)) + raw += ch->match_value +1 ; +raw_spin_unlock_irqrestore (&ch->lock, flags); + +return value + raw; + } -return value + raw; +return sh_cmt_get_counter (ch, &has_wrapped); }static int sh_cmt_clocksource_enable (struct clocksource *cs)
@@ -697,7 +703,7 @@ static int sh_cmt_register_clocksource(struct sh_cmt_channel *ch, cs->disable = sh_cmt_clocksource_disable; cs->suspend = sh_cmt_clocksource_suspend; cs->resume = sh_cmt_clocksource_resume; - cs->mask =CLOCKSOURCE_MASK (sizeof (u64) *8 ); + cs->mask =CLOCKSOURCE_MASK (ch->cmt->info->width); cs->flags =CLOCK_SOURCE_IS_CONTINUOUS ; dev_info(&ch->cmt->pdev->dev, "ch%u: used as clock source\n",
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 65/334 nbd: do del_gendisk() asynchronously for NBD_DESTROY_ON_DISCONNECT
In reply to Greg Kroah-HartmanFrom: Hou Tao <[email protected]>
[ Upstream commit 68c9417b193d0d174b0ada013602272177e61303 ]
Now open_mutex is used to synchronize partition operations (e.g, blk_drop_partitions() and blkdev_reread_part()), however it makes nbd driver broken, because nbd may call del_gendisk() in nbd_release() or nbd_genl_disconnect() if NBD_CFLAG_DESTROY_ON_DISCONNECT is enabled, and deadlock occurs, as shown below:
// AB-BA dead-locknbd_genl_disconnect blkdev_open
nbd_disconnect_and_put
lock bd_mutex
// last ref
nbd_put
lock nbd_index_mutex
del_gendisk
nbd_open
try lock nbd_index_mutex
try lock bd_mutex
or
// AA dead-locknbd_release
lock bd_mutex
nbd_put
try lock bd_mutex
Instead of fixing block layer (e.g, introduce another lock), fixing the nbd driver to call del_gendisk() in a kworker when NBD_DESTROY_ON_DISCONNECT is enabled. When NBD_DESTROY_ON_DISCONNECT is disabled, nbd device will always be destroy through module removal, and there is no risky of deadlock.
To ensure the reuse of nbd index succeeds, moving the calling of idr_remove() after del_gendisk(), so if the reused index is not found in nbd_index_idr, the old disk must have been deleted. And reusing the existing destroy_complete mechanism to ensure nbd_genl_connect() will wait for the completion of del_gendisk().
Also adding a new workqueue for nbd removal, so nbd_cleanup() can ensure all removals complete before exits.
--- drivers/block/nbd.c | 70 +++++++++++++++++++++++++++++++++++++++------ 1 file changed, 61 insertions(+), 9 deletions(-)
drivers/block/nbd.c +61 -9
@@ -49,6 +49,7 @@static DEFINE_IDR (nbd_index_idr);static DEFINE_MUTEX (nbd_index_mutex); +static struct workqueue_struct *nbd_del_wq;static int nbd_total_devices =0 ;struct nbd_sock {
@@ -113,6 +114,7 @@ struct nbd_device {struct mutex config_lock;struct gendisk *disk;struct workqueue_struct *recv_workq; +struct work_struct remove_work;struct list_head list;struct task_struct *task_recv;
@@ -233,7 +235,7 @@ static const struct device_attribute backend_attr = { .show = backend_show, }; -static void nbd_dev_remove (struct nbd_device *nbd) +static void nbd_del_disk (struct nbd_device *nbd) {struct gendisk *disk = nbd->disk;
@@ -242,24 +244,60 @@ static void nbd_dev_remove(struct nbd_device *nbd)blk_cleanup_disk (disk);blk_mq_free_tag_set (&nbd->tag_set); } +} +/* +* Place this in the last just before the nbd is freed to +* make sure that the disk and the related kobject are also +* totally removed to avoid duplicate creation of the same +* one. +*/ +static void nbd_notify_destroy_completion (struct nbd_device *nbd) +{ +if (test_bit (NBD_DESTROY_ON_DISCONNECT , &nbd->flags) && + nbd->destroy_complete) +complete (nbd->destroy_complete); +} + +static void nbd_dev_remove_work (struct work_struct *work) +{ +struct nbd_device *nbd = + container_of(work, struct nbd_device, remove_work); + +nbd_del_disk (nbd); + +mutex_lock (&nbd_index_mutex);/* -* Place this in the last just before the nbd is freed to -* make sure that the disk and the related kobject are also -* totally removed to avoid duplicate creation of the same -* one. +* Remove from idr after del_gendisk() completes, +* so if the same id is reused, the following +* add_disk() will succeed. */ -if (test_bit (NBD_DESTROY_ON_DISCONNECT , &nbd->flags) && nbd->destroy_complete) -complete (nbd->destroy_complete); +idr_remove (&nbd_index_idr, nbd->index); + +nbd_notify_destroy_completion (nbd); +mutex_unlock (&nbd_index_mutex);kfree (nbd); } +static void nbd_dev_remove (struct nbd_device *nbd) +{ +/* Call del_gendisk() asynchrounously to prevent deadlock */ +if (test_bit (NBD_DESTROY_ON_DISCONNECT , &nbd->flags)) { +queue_work (nbd_del_wq, &nbd->remove_work); +return ; + } + +nbd_del_disk (nbd); +idr_remove (&nbd_index_idr, nbd->index); +nbd_notify_destroy_completion (nbd); +kfree (nbd); +} +static void nbd_put (struct nbd_device *nbd) {if (refcount_dec_and_mutex_lock (&nbd->refs, &nbd_index_mutex)) { -idr_remove (&nbd_index_idr, nbd->index);nbd_dev_remove (nbd);mutex_unlock (&nbd_index_mutex); }
@@ -1685,6 +1723,7 @@ static int nbd_dev_add(int index) nbd->tag_set.flags =BLK_MQ_F_SHOULD_MERGE |BLK_MQ_F_BLOCKING ; nbd->tag_set.driver_data = nbd; +INIT_WORK (&nbd->remove_work, nbd_dev_remove_work); nbd->destroy_complete =NULL ; nbd->backend =NULL ;
@@ -2426,7 +2465,14 @@ static int __init nbd_init(void)if (register_blkdev (NBD_MAJOR ,"nbd" ))return -EIO ; + nbd_del_wq =alloc_workqueue ("nbd-del" ,WQ_UNBOUND ,0 ); +if (!nbd_del_wq) { +unregister_blkdev (NBD_MAJOR ,"nbd" ); +return -ENOMEM ; + } +if (genl_register_family (&nbd_genl_family)) { +destroy_workqueue (nbd_del_wq);unregister_blkdev (NBD_MAJOR ,"nbd" );return -EINVAL ; }
@@ -2444,7 +2490,10 @@ static int nbd_exit_cb(int id, void *ptr, void *data)struct list_head *list = (struct list_head *)data;struct nbd_device *nbd = ptr; -list_add_tail (&nbd->list, list); +/* Skip nbd that is being removed asynchronously */ +if (refcount_read (&nbd->refs)) +list_add_tail (&nbd->list, list); +return 0 ; }
@@ -2467,6 +2516,9 @@ static void __exit nbd_cleanup(void)nbd_put (nbd); } +/* Also wait for nbd_dev_remove_work() completes */ +destroy_workqueue (nbd_del_wq); +idr_destroy (&nbd_index_idr);genl_unregister_family (&nbd_genl_family);unregister_blkdev (NBD_MAJOR ,"nbd" );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 66/334 block: nbd: add sanity check for first_minor
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit b1a811633f7321cf1ae2bb76a66805b7720e44c9 ]
Syzbot hit WARNING in internal_create_group(). The problem was in too big disk->first_minor.
disk->first_minor is initialized by value, which comes from userspace and there wasn't any sanity checks about value correctness. It can cause duplicate creation of sysfs files/links, because disk->first_minor will be passed to MKDEV() which causes truncation to byte. Since maximum minor value is 0xff, let's check if first_minor is correct minor number.
NOTE: the root case of the reported warning was in wrong error handling in register_disk(), but we can avoid passing knowingly wrong values to sysfs API, because sysfs error messages can confuse users. For example:
user passed 1048576 as index, but sysfs complains about duplicate creation of /dev/block/43:0. It's not obvious how 1048576 becomes 0. Log and reproducer for above example can be found on syzkaller bug report page.
--- drivers/block/nbd.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/block/nbd.c +10 -0
@@ -1770,7 +1770,17 @@ static int nbd_dev_add(int index)refcount_set (&nbd->refs,1 );INIT_LIST_HEAD (&nbd->list); disk->major =NBD_MAJOR ; + +/* Too big first_minor can cause duplicate creation of +* sysfs files/links, since first_minor will be truncated to +* byte in __device_add_disk(). +*/ disk->first_minor = index << part_shift; +if (disk->first_minor >0xff ) { + err = -EINVAL ; + goto out_free_idr; + } + disk->minors =1 << part_shift; disk->fops = &nbd_fops; disk->private_data = nbd;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 67/334 spi: coldfire-qspi: Use clk_disable_unprepare in the remove function
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit d68f4c73d729245a47e70eb216fa24bc174ed2e2 ]
'clk_prepare_enable()' is used in the probe, so 'clk_disable_unprepare()' should be used in the remove function to be consistent.
--- drivers/spi/spi-coldfire-qspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-coldfire-qspi.c +1 -1
@@ -444,7 +444,7 @@ static int mcfqspi_remove(struct platform_device *pdev)mcfqspi_wr_qmr (mcfqspi,MCFQSPI_QMR_MSTR );mcfqspi_cs_teardown (mcfqspi); -clk_disable (mcfqspi->clk); +clk_disable_unprepare (mcfqspi->clk);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 68/334 irqchip/apple-aic: Fix irq_disable from within irq handlers
In reply to Greg Kroah-HartmanFrom: Sven Peter <[email protected]>
[ Upstream commit 60a1cd10b222e004f860d14651e80089c77e8e6b ]
When disable_irq_nosync for an interrupt is called from within its interrupt handler, this interrupt is only marked as disabled with the intention to mask it when it triggers again.
The AIC hardware however automatically masks the interrupt when it is read. aic_irq_eoi then unmasks it again if it's not disabled *and* not masked. This results in a state mismatch between the hardware state and the state kept in irq_data: The hardware interrupt is masked but IRQD_IRQ_MASKED is not set. Any further calls to unmask_irq will directly return and the interrupt can never be enabled again.
Fix this by keeping the hardware and irq_data state in sync by unmasking in aic_irq_eoi if and only if the irq_data state also assumes the interrupt to be unmasked.
--- drivers/irqchip/irq-apple-aic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/irq-apple-aic.c +1 -1
@@ -226,7 +226,7 @@ static void aic_irq_eoi(struct irq_data *d)* Reading the interrupt reason automatically acknowledges and masks * the IRQ, so we just unmask it here if needed. */ -if (!irqd_irq_disabled (d) && !irqd_irq_masked (d)) +if (!irqd_irq_masked (d))aic_irq_unmask (d); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 69/334 irqchip/gic-v3: Fix priority comparison when non-secure priorities are used
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
[ Upstream commit 8d474deaba2c4dd33a5e2f5be82e6798ffa6b8a5 ]
When non-secure priorities are used, compared to the raw priority set, the value read back from RPR is also right-shifted by one and the highest bit set.
Add a macro to do the modifications to the raw priority when doing the comparison against the RPR value. This corrects the pseudo-NMI behavior when non-secure priorities in the GIC are used. Tested on 5.10 with the "IPI as pseudo-NMI" series [1] applied on MT8195.
[1] https://lore.kernel.org/linux-arm-kernel/[email protected]/
--- drivers/irqchip/irq-gic-v3.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-)
drivers/irqchip/irq-gic-v3.c +22 -1
@@ -100,6 +100,27 @@ EXPORT_SYMBOL(gic_pmr_sync);DEFINE_STATIC_KEY_FALSE (gic_nonsecure_priorities);EXPORT_SYMBOL (gic_nonsecure_priorities); +/* +* When the Non-secure world has access to group 0 interrupts (as a +* consequence of SCR_EL3.FIQ == 0), reading the ICC_RPR_EL1 register will +* return the Distributor's view of the interrupt priority. +* +* When GIC security is enabled (GICD_CTLR.DS == 0), the interrupt priority +* written by software is moved to the Non-secure range by the Distributor. +* +* If both are true (which is when gic_nonsecure_priorities gets enabled), +* we need to shift down the priority programmed by software to match it +* against the value returned by ICC_RPR_EL1. +*/ +#define GICD_INT_RPR_PRI (priority) \ + ({ \ + u32 __priority = (priority); \ + if (static_branch_unlikely(&gic_nonsecure_priorities)) \ + __priority = 0x80 | (__priority >> 1); \ + \ + __priority; \ + }) +/* ppi_nmi_refs[n] == number of cpus having ppi[n + 16] set as NMI */ static refcount_t *ppi_nmi_refs;
@@ -687,7 +708,7 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regsreturn ;if (gic_supports_nmi () && -unlikely (gic_read_rpr () ==GICD_INT_NMI_PRI )) { +unlikely (gic_read_rpr () ==GICD_INT_RPR_PRI (GICD_INT_NMI_PRI ))) {gic_handle_nmi (irqnr, regs);return ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 70/334 crypto: qat - use proper type for vf_mask
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 462354d986b6a89c6449b85f17aaacf44e455216 ]
Replace vf_mask type with unsigned long to avoid a stack-out-of-bound.
This is to fix the following warning reported by KASAN the first time adf_msix_isr_ae() gets called.
[ 692.091987] BUG: KASAN: stack-out-of-bounds in find_first_bit+0x28/0x50
[ 692.092017] Read of size 8 at addr ffff88afdf789e60 by task swapper/32/0
[ 692.092076] Call Trace:
[ 692.092089] <IRQ>
[ 692.092101] dump_stack+0x9c/0xcf
[ 692.092132] print_address_description.constprop.0+0x18/0x130
[ 692.092164] ? find_first_bit+0x28/0x50
[ 692.092185] kasan_report.cold+0x7f/0x111
[ 692.092213] ? static_obj+0x10/0x80
[ 692.092234] ? find_first_bit+0x28/0x50
[ 692.092262] find_first_bit+0x28/0x50
[ 692.092288] adf_msix_isr_ae+0x16e/0x230 [intel_qat]--- drivers/crypto/qat/qat_common/adf_isr.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/crypto/qat/qat_common/adf_isr.c +4 -3
@@ -15,6 +15,8 @@#include "adf_transport_access_macros.h" #include "adf_transport_internal.h" +#define ADF_MAX_NUM_VFS 32 +static int adf_enable_msix (struct adf_accel_dev *accel_dev) {struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev;
@@ -72,7 +74,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)struct adf_bar *pmisc = &GET_BARS (accel_dev)[hw_data->get_misc_bar_id (hw_data)];void __iomem *pmisc_bar_addr = pmisc->virt_addr; -u32 vf_mask; +unsigned long vf_mask;/* Get the interrupt sources triggered by VFs */ vf_mask = ((ADF_CSR_RD(pmisc_bar_addr, ADF_ERRSOU5) &
@@ -93,8 +95,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)* unless the VF is malicious and is attempting to * flood the host OS with VF2PF interrupts. */ -for_each_set_bit (i, (const unsigned long *)&vf_mask, - (sizeof (vf_mask) *BITS_PER_BYTE )) { +for_each_set_bit (i, &vf_mask,ADF_MAX_NUM_VFS ) { vf_info = accel_dev->pf.vf_info + i;if (!__ratelimit (&vf_info->vf2pf_ratelimit)) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 71/334 m68k: Fix asm register constraints for atomic ops
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 87d93029fe83e326d5b906e12e95600b157d2c0d ]
Depending on register assignment by the compiler:
{standard input}:3084: Error: operands mismatch -- statement andl %a1,%d1' ignored {standard input}:3145: Error: operands mismatch -- statement orl %a1,%d1' ignored {standard input}:3195: Error: operands mismatch -- statement `eorl %a1,%d1' ignored
Indeed, the first operand must not be an address register. However, it can be an immediate value. Fix this by adjusting the register constraint from "g" (general purpose register) to "di" (data register or immediate).
--- arch/m68k/include/asm/atomic.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/m68k/include/asm/atomic.h +2 -2
@@ -48,7 +48,7 @@ static inline int arch_atomic_##op##_return(int i, atomic_t *v) \ " casl %2,%1,%0\n" \ " jne 1b" \ : "+m" (*v), "=&d" (t), "=&d" (tmp) \ - : "g" (i), "2" (arch_atomic_read(v))); \ + : "di" (i), "2" (arch_atomic_read(v))); \return t; \ }
@@ -63,7 +63,7 @@ static inline int arch_atomic_fetch_##op(int i, atomic_t *v) \ " casl %2,%1,%0\n" \ " jne 1b" \ : "+m" (*v), "=&d" (t), "=&d" (tmp) \ - : "g" (i), "2" (arch_atomic_read(v))); \ + : "di" (i), "2" (arch_atomic_read(v))); \return tmp; \ }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 72/334 certs: Trigger creation of RSA module signing key if its not an RSA key
In reply to Greg Kroah-HartmanFrom: Stefan Berger <[email protected]>
[ Upstream commit ea35e0d5df6c92fa2e124bb1b91d09b2240715ba ]
Address a kbuild issue where a developer created an ECDSA key for signing kernel modules and then builds an older version of the kernel, when bi- secting the kernel for example, that does not support ECDSA keys.
If openssl is installed, trigger the creation of an RSA module signing key if it is not an RSA key.
--- certs/Makefile | 8 ++++++++ 1 file changed, 8 insertions(+)
certs/Makefile +8 -0
@@ -57,11 +57,19 @@ endif redirect_openssl = 2>&1 quiet_redirect_openssl = 2>&1 silent_redirect_openssl = 2>/dev/null +openssl_available = $(shell openssl help 2>/dev/null && echo yes) # We do it this way rather than having a boolean option for enabling an # external private key, because 'make randconfig' might enable such a # boolean option and we unfortunately can't make it depend on !RANDCONFIG. ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") + +ifeq ($(openssl_available),yes) +X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null) + +$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem")) +endif + $(obj)/signing_key.pem: $(obj)/x509.genkey @$(kecho) "###" @$(kecho) "### Now generating an X.509 key pair to be used for signing modules."
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 73/334 tpm: ibmvtpm: Avoid error message when process gets signal while waiting
In reply to Greg Kroah-HartmanFrom: Stefan Berger <[email protected]>
[ Upstream commit 047d4226b0bca1cda5267dc68bc8291cce5364ac ]
When rngd is run as root then lots of these types of message will appear in the kernel log if the TPM has been configured to provide random bytes:
[ 7406.275163] tpm tpm0: tpm_transmit: tpm_recv: error -4
The issue is caused by the following call that is interrupted while waiting for the TPM's response.
sig = wait_event_interruptible(ibmvtpm->wq, !ibmvtpm->tpm_processing_cmd);
Rather than waiting for the response in the low level driver, have it use the polling loop in tpm_try_transmit() that uses a command's duration to poll until a result has been returned by the TPM, thus ending when the timeout has occurred but not responding to signals and ctrl-c anymore. To stay in this polling loop extend tpm_ibmvtpm_status() to return 'true' for as long as the vTPM is indicated as being busy in tpm_processing_cmd. Since the loop requires the TPM's timeouts, get them now using tpm_get_timeouts() after setting the TPM2 version flag on the chip.
To recreat the resolved issue start rngd like this:
sudo rngd -r /dev/hwrng -t
sudo rngd -r /dev/tpm0 -t
--- drivers/char/tpm/tpm_ibmvtpm.c | 26 +++++++++++++++----------- drivers/char/tpm/tpm_ibmvtpm.h | 2 +- 2 files changed, 16 insertions(+), 12 deletions(-)
drivers/char/tpm/tpm_ibmvtpm.c +15 -11
@@ -106,17 +106,12 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count) {struct ibmvtpm_dev *ibmvtpm =dev_get_drvdata (&chip->dev);u16 len; -int sig;if (!ibmvtpm->rtce_buf) {dev_err (ibmvtpm->dev,"ibmvtpm device is not ready\n" );return 0 ; } - sig =wait_event_interruptible (ibmvtpm->wq, !ibmvtpm->tpm_processing_cmd); -if (sig) -return -EINTR ; - len = ibmvtpm->res_len;if (count < len) {
@@ -237,7 +232,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)* set the processing flag before the Hcall, since we may get the * result (interrupt) before even being able to check rc. */ - ibmvtpm->tpm_processing_cmd = true; + ibmvtpm->tpm_processing_cmd =1 ; again: rc = ibmvtpm_send_crq(ibmvtpm->vdev,
@@ -255,7 +250,7 @@ again: goto again; }dev_err (ibmvtpm->dev,"tpm_ibmvtpm_send failed rc=%d\n" , rc); - ibmvtpm->tpm_processing_cmd = false; + ibmvtpm->tpm_processing_cmd =0 ; }spin_unlock (&ibmvtpm->rtce_lock);
@@ -269,7 +264,9 @@ static void tpm_ibmvtpm_cancel(struct tpm_chip *chip)static u8 tpm_ibmvtpm_status (struct tpm_chip *chip) { -return 0 ; +struct ibmvtpm_dev *ibmvtpm =dev_get_drvdata (&chip->dev); + +return ibmvtpm->tpm_processing_cmd; }/**
@@ -457,7 +454,7 @@ static const struct tpm_class_ops tpm_ibmvtpm = { .send = tpm_ibmvtpm_send, .cancel = tpm_ibmvtpm_cancel, .status = tpm_ibmvtpm_status, - .req_complete_mask = 0, + .req_complete_mask = 1, .req_complete_val = 0, .req_canceled = tpm_ibmvtpm_req_canceled, };
@@ -550,7 +547,7 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq,case VTPM_TPM_COMMAND_RES :/* len of the data in rtce buffer */ ibmvtpm->res_len =be16_to_cpu (crq->len); - ibmvtpm->tpm_processing_cmd = false; + ibmvtpm->tpm_processing_cmd =0 ;wake_up_interruptible (&ibmvtpm->wq);return ;default :
@@ -688,8 +685,15 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, goto init_irq_cleanup; } -if (!strcmp (id->compat,"IBM,vtpm20" )) { + +if (!strcmp (id->compat,"IBM,vtpm20" )) chip->flags |=TPM_CHIP_FLAG_TPM2 ; + + rc =tpm_get_timeouts (chip); +if (rc) + goto init_irq_cleanup; + +if (chip->flags &TPM_CHIP_FLAG_TPM2 ) { rc =tpm2_get_cc_attrs_tbl (chip);if (rc) goto init_irq_cleanup;
drivers/char/tpm/tpm_ibmvtpm.h +1 -1
@@ -41,7 +41,7 @@ struct ibmvtpm_dev {wait_queue_head_t wq;u16 res_len;u32 vtpm_version; -bool tpm_processing_cmd; +u8 tpm_processing_cmd; };#define CRQ_RES_BUF_SIZE PAGE_SIZE
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 74/334 EDAC/i10nm: Fix NVDIMM detection
In reply to Greg Kroah-HartmanFrom: Qiuxu Zhuo <[email protected]>
[ Upstream commit 2294a7299f5e51667b841f63c6d69474491753fb ]
MCDDRCFG is a per-channel register and uses bit{0,1} to indicate the NVDIMM presence on DIMM slot{0,1}. Current i10nm_edac driver wrongly uses MCDDRCFG as per-DIMM register and fails to detect the NVDIMM.
Fix it by reading MCDDRCFG as per-channel register and using its bit{0,1} to check whether the NVDIMM is populated on DIMM slot{0,1}.
--- drivers/edac/i10nm_base.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/edac/i10nm_base.c +3 -3
@@ -33,9 +33,9 @@#define I10NM_GET_DIMMMTR (m, i, j) \ readl((m)->mbase + ((m)->hbm_mc ? 0x80c : 0x2080c) + \ (i) * (m)->chan_mmio_sz + (j) * 4) -#define I10NM_GET_MCDDRTCFG (m, i, j) \ +#define I10NM_GET_MCDDRTCFG (m, i) \ readl((m)->mbase + ((m)->hbm_mc ? 0x970 : 0x20970) + \ - (i) * (m)->chan_mmio_sz + (j) * 4) + (i) * (m)->chan_mmio_sz)#define I10NM_GET_MCMTR (m, i) \ readl((m)->mbase + ((m)->hbm_mc ? 0xef8 : 0x20ef8) + \ (i) * (m)->chan_mmio_sz)
@@ -321,10 +321,10 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci, ndimms =0 ; amap =I10NM_GET_AMAP (imc, i); + mcddrtcfg =I10NM_GET_MCDDRTCFG (imc, i);for (j =0 ; j < imc->num_dimms; j++) { dimm =edac_get_dimm (mci, i, j,0 ); mtr =I10NM_GET_DIMMMTR (imc, i, j); - mcddrtcfg =I10NM_GET_MCDDRTCFG (imc, i, j);edac_dbg (1 ,"dimmmtr 0x%x mcddrtcfg 0x%x (mc%d ch%d dimm%d)\n" , mtr, mcddrtcfg, imc->mc, i, j);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 75/334 x86/mce: Defer processing of early errors
In reply to Greg Kroah-HartmanFrom: Borislav Petkov <[email protected]>
[ Upstream commit 3bff147b187d5dfccfca1ee231b0761a89f1eff5 ]
When a fatal machine check results in a system reset, Linux does not clear the error(s) from machine check bank(s) - hardware preserves the machine check banks across a warm reset.
During initialization of the kernel after the reboot, Linux reads, logs, and clears all machine check banks.
But there is a problem. In:
5de97c9f6d85 ("x86/mce: Factor out and deprecate the /dev/mcelog driver")
the call to mce_register_decode_chain() moved later in the boot sequence. This means that /dev/mcelog doesn't see those early error logs.
This was partially fixed by:
cd9c57cad3fe ("x86/MCE: Dump MCE to dmesg if no consumers")
which made sure that the logs were not lost completely by printing to the console. But parsing console logs is error prone. Users of /dev/mcelog should expect to find any early errors logged to standard places.
Add a new flag MCP_QUEUE_LOG to machine_check_poll() to be used in early machine check initialization to indicate that any errors found should just be queued to genpool. When mcheck_late_init() is called it will call mce_schedule_work() to actually log and flush any errors queued in the genpool.
[ Based on an original patch, commit message by and completely
productized by Tony Luck. ]
--- arch/x86/include/asm/mce.h | 1 + arch/x86/kernel/cpu/mce/core.c | 11 ++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-)
arch/x86/include/asm/mce.h +1 -0
@@ -265,6 +265,7 @@ enum mcp_flags {MCP_TIMESTAMP =BIT (0 ),/* log time stamp */ MCP_UC =BIT (1 ),/* log uncorrected errors */ MCP_DONTLOG =BIT (2 ),/* only clear, don't log */ + MCP_QUEUE_LOG = BIT(3), /* only queue to genpool */ };bool machine_check_poll (enum mcp_flags flags,mce_banks_t *b);
arch/x86/kernel/cpu/mce/core.c +8 -3
@@ -817,7 +817,10 @@ log_it:if (mca_cfg.dont_log_ce && !mce_usable_address (&m)) goto clear_it; -mce_log (&m); +if (flags &MCP_QUEUE_LOG ) +mce_gen_pool_add (&m); +else +mce_log (&m); clear_it:/*
@@ -1639,10 +1642,12 @@ static void __mcheck_cpu_init_generic(void) m_fl =MCP_DONTLOG ;/* -* Log the machine checks left over from the previous reset. +* Log the machine checks left over from the previous reset. Log them +* only, do not start processing them. That will happen in mcheck_late_init() +* when all consumers have been registered on the notifier chain. */ bitmap_fill (all_banks,MAX_NR_BANKS ); -machine_check_poll (MCP_UC | m_fl, &all_banks); +machine_check_poll (MCP_UC |MCP_QUEUE_LOG | m_fl, &all_banks);cr4_set_bits (X86_CR4_MCE );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 76/334 spi: davinci: invoke chipselect callback
In reply to Greg Kroah-HartmanFrom: Matija Glavinic Pecotic <[email protected]>
[ Upstream commit ea4ab99cb58cc9f8d64c0961ff9a059825f304cf ]
Davinci needs to configure chipselect on transfer.
--- drivers/spi/spi-davinci.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/spi/spi-davinci.c +1 -7
@@ -213,12 +213,6 @@ static void davinci_spi_chipselect(struct spi_device *spi, int value)* line for the controller */ if (spi->cs_gpiod) { -/* -* FIXME: is this code ever executed? This host does not -* set SPI_MASTER_GPIO_SS so this chipselect callback should -* not get called from the SPI core when we are using -* GPIOs for chip select. -*/ if (value ==BITBANG_CS_ACTIVE )gpiod_set_value (spi->cs_gpiod,1 );else
@@ -945,7 +939,7 @@ static int davinci_spi_probe(struct platform_device *pdev) master->bus_num = pdev->id; master->num_chipselect = pdata->num_chipselect; master->bits_per_word_mask =SPI_BPW_RANGE_MASK (2 ,16 ); - master->flags =SPI_MASTER_MUST_RX ; + master->flags =SPI_MASTER_MUST_RX |SPI_MASTER_GPIO_SS ; master->setup = davinci_spi_setup; master->cleanup = davinci_spi_cleanup; master->can_dma = davinci_spi_can_dma;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 77/334 blk-crypto: fix check for too-large dun_bytes
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit cc40b7225151f611ef837f6403cfaeadc7af214a ]
dun_bytes needs to be less than or equal to the IV size of the encryption mode, not just less than or equal to BLK_CRYPTO_MAX_IV_SIZE.
Currently this doesn't matter since blk_crypto_init_key() is never actually passed invalid values, but we might as well fix this.
--- block/blk-crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/blk-crypto.c +1 -1
@@ -332,7 +332,7 @@ int blk_crypto_init_key(struct blk_crypto_key *blk_key, const u8 *raw_key,if (mode->keysize ==0 )return -EINVAL ; -if (dun_bytes ==0 || dun_bytes >BLK_CRYPTO_MAX_IV_SIZE ) +if (dun_bytes ==0 || dun_bytes > mode->ivsize)return -EINVAL ;if (!is_power_of_2 (data_unit_size))
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 78/334 regulator: vctrl: Use locked regulator_get_voltage in probe path
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
[ Upstream commit 98e47570ba985f2310586c80409238200fa3170f ]
In commit e9153311491d ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage"), all calls to get/set the voltage of the control regulator were switched to unlocked versions to avoid deadlocks. However, the call in the probe path is done without regulator locks held. In this case the locked version should be used.
Switch back to the locked regulator_get_voltage() in the probe path to avoid any mishaps.
--- drivers/regulator/vctrl-regulator.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/regulator/vctrl-regulator.c +2 -1
@@ -490,7 +490,8 @@ static int vctrl_probe(struct platform_device *pdev)if (ret)return ret; - ctrl_uV =regulator_get_voltage_rdev (vctrl->ctrl_reg->rdev); +/* Use locked consumer API when not in regulator framework */ + ctrl_uV =regulator_get_voltage (vctrl->ctrl_reg);if (ctrl_uV <0 ) {dev_err (&pdev->dev,"failed to get control voltage\n" );return ctrl_uV;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 79/334 regulator: vctrl: Avoid lockdep warning in enable/disable ops
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
[ Upstream commit 21e39809fd7c4b8ff3662f23e0168e87594c8ca8 ]
vctrl_enable() and vctrl_disable() call regulator_enable() and regulator_disable(), respectively. However, vctrl_* are regulator ops and should not be calling the locked regulator APIs. Doing so results in a lockdep warning.
Instead of exporting more internal regulator ops, model the ctrl supply as an actual supply to vctrl-regulator. At probe time this driver still needs to use the consumer API to fetch its constraints, but otherwise lets the regulator core handle the upstream supply for it.
The enable/disable/is_enabled ops are not removed, but now only track state internally. This preserves the original behavior with the ops being available, but one could argue that the original behavior was already incorrect: the internal state would not match the upstream supply if that supply had another consumer that enabled the supply, while vctrl-regulator was not enabled.
The lockdep warning is as follows:
WARNING: possible circular locking dependency detected
5.14.0-rc6 #2 Not tainted
------------------------------------------------------
swapper/0/1 is trying to acquire lock:
ffffffc011306d00 (regulator_list_mutex){+.+.}-{3:3}, at:
regulator_lock_dependent (arch/arm64/include/asm/current.h:19
include/linux/ww_mutex.h:111
drivers/regulator/core.c:329)
but task is already holding lock:
ffffff8004a77160 (regulator_ww_class_mutex){+.+.}-{3:3}, at:
regulator_lock_recursive (drivers/regulator/core.c:156
drivers/regulator/core.c:263)
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (regulator_ww_class_mutex){+.+.}-{3:3}:
__mutex_lock_common (include/asm-generic/atomic-instrumented.h:606
include/asm-generic/atomic-long.h:29
kernel/locking/mutex.c:103
kernel/locking/mutex.c:144
kernel/locking/mutex.c:963)
ww_mutex_lock (kernel/locking/mutex.c:1199)
regulator_lock_recursive (drivers/regulator/core.c:156
drivers/regulator/core.c:263)
regulator_lock_dependent (drivers/regulator/core.c:343)
regulator_enable (drivers/regulator/core.c:2808)
set_machine_constraints (drivers/regulator/core.c:1536)
regulator_register (drivers/regulator/core.c:5486)
devm_regulator_register (drivers/regulator/devres.c:196)
reg_fixed_voltage_probe (drivers/regulator/fixed.c:289)
platform_probe (drivers/base/platform.c:1427)
[...]
-> #1 (regulator_ww_class_acquire){+.+.}-{0:0}:
regulator_lock_dependent (include/linux/ww_mutex.h:129
drivers/regulator/core.c:329)
regulator_enable (drivers/regulator/core.c:2808)
set_machine_constraints (drivers/regulator/core.c:1536)
regulator_register (drivers/regulator/core.c:5486)
devm_regulator_register (drivers/regulator/devres.c:196)
reg_fixed_voltage_probe (drivers/regulator/fixed.c:289)
[...]
-> #0 (regulator_list_mutex){+.+.}-{3:3}:
__lock_acquire (kernel/locking/lockdep.c:3052 (discriminator 4)
kernel/locking/lockdep.c:3174 (discriminator 4)
kernel/locking/lockdep.c:3789 (discriminator 4)
kernel/locking/lockdep.c:5015 (discriminator 4))
lock_acquire (arch/arm64/include/asm/percpu.h:39
kernel/locking/lockdep.c:438
kernel/locking/lockdep.c:5627)
__mutex_lock_common (include/asm-generic/atomic-instrumented.h:606
include/asm-generic/atomic-long.h:29
kernel/locking/mutex.c:103
kernel/locking/mutex.c:144
kernel/locking/mutex.c:963)
mutex_lock_nested (kernel/locking/mutex.c:1125)
regulator_lock_dependent (arch/arm64/include/asm/current.h:19
include/linux/ww_mutex.h:111
drivers/regulator/core.c:329)
regulator_enable (drivers/regulator/core.c:2808)
vctrl_enable (drivers/regulator/vctrl-regulator.c:400)
_regulator_do_enable (drivers/regulator/core.c:2617)
_regulator_enable (drivers/regulator/core.c:2764)
regulator_enable (drivers/regulator/core.c:308
drivers/regulator/core.c:2809)
_set_opp (drivers/opp/core.c:819 drivers/opp/core.c:1072)
dev_pm_opp_set_rate (drivers/opp/core.c:1164)
set_target (drivers/cpufreq/cpufreq-dt.c:62)
__cpufreq_driver_target (drivers/cpufreq/cpufreq.c:2216
drivers/cpufreq/cpufreq.c:2271)
cpufreq_online (drivers/cpufreq/cpufreq.c:1488 (discriminator 2))
cpufreq_add_dev (drivers/cpufreq/cpufreq.c:1563)
subsys_interface_register (drivers/base/bus.c:?)
cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2819)
dt_cpufreq_probe (drivers/cpufreq/cpufreq-dt.c:344)
[...]
other info that might help us debug this:
Chain exists of:
regulator_list_mutex --> regulator_ww_class_acquire --> regulator_ww_class_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(regulator_ww_class_mutex);
lock(regulator_ww_class_acquire);
lock(regulator_ww_class_mutex);
lock(regulator_list_mutex);
*** DEADLOCK ***
6 locks held by swapper/0/1:
#0: ffffff8002d32188 (&dev->mutex){....}-{3:3}, at:
__device_driver_lock (drivers/base/dd.c:1030)
#1: ffffffc0111a0520 (cpu_hotplug_lock){++++}-{0:0}, at:
cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2792 (discriminator 2))
#2: ffffff8002a8d918 (subsys mutex#9){+.+.}-{3:3}, at:
subsys_interface_register (drivers/base/bus.c:1033)
#3: ffffff800341bb90 (&policy->rwsem){+.+.}-{3:3}, at:
cpufreq_online (include/linux/bitmap.h:285
include/linux/cpumask.h:405
drivers/cpufreq/cpufreq.c:1399)
#4: ffffffc011f0b7b8 (regulator_ww_class_acquire){+.+.}-{0:0}, at:
regulator_enable (drivers/regulator/core.c:2808)
#5: ffffff8004a77160 (regulator_ww_class_mutex){+.+.}-{3:3}, at:
regulator_lock_recursive (drivers/regulator/core.c:156
drivers/regulator/core.c:263)
stack backtrace:
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.14.0-rc6 #2 7c8f8996d021ed0f65271e6aeebf7999de74a9fa
Hardware name: Google Scarlet (DT)
Call trace:
dump_backtrace (arch/arm64/kernel/stacktrace.c:161)
show_stack (arch/arm64/kernel/stacktrace.c:218)
dump_stack_lvl (lib/dump_stack.c:106 (discriminator 2))
dump_stack (lib/dump_stack.c:113)
print_circular_bug (kernel/locking/lockdep.c:?)
check_noncircular (kernel/locking/lockdep.c:?)
__lock_acquire (kernel/locking/lockdep.c:3052 (discriminator 4)
kernel/locking/lockdep.c:3174 (discriminator 4)
kernel/locking/lockdep.c:3789 (discriminator 4)
kernel/locking/lockdep.c:5015 (discriminator 4))
lock_acquire (arch/arm64/include/asm/percpu.h:39
kernel/locking/lockdep.c:438
kernel/locking/lockdep.c:5627)
__mutex_lock_common (include/asm-generic/atomic-instrumented.h:606
include/asm-generic/atomic-long.h:29
kernel/locking/mutex.c:103
kernel/locking/mutex.c:144
kernel/locking/mutex.c:963)
mutex_lock_nested (kernel/locking/mutex.c:1125)
regulator_lock_dependent (arch/arm64/include/asm/current.h:19
include/linux/ww_mutex.h:111
drivers/regulator/core.c:329)
regulator_enable (drivers/regulator/core.c:2808)
vctrl_enable (drivers/regulator/vctrl-regulator.c:400)
_regulator_do_enable (drivers/regulator/core.c:2617)
_regulator_enable (drivers/regulator/core.c:2764)
regulator_enable (drivers/regulator/core.c:308
drivers/regulator/core.c:2809)
_set_opp (drivers/opp/core.c:819 drivers/opp/core.c:1072)
dev_pm_opp_set_rate (drivers/opp/core.c:1164)
set_target (drivers/cpufreq/cpufreq-dt.c:62)
__cpufreq_driver_target (drivers/cpufreq/cpufreq.c:2216
drivers/cpufreq/cpufreq.c:2271)
cpufreq_online (drivers/cpufreq/cpufreq.c:1488 (discriminator 2))
cpufreq_add_dev (drivers/cpufreq/cpufreq.c:1563)
subsys_interface_register (drivers/base/bus.c:?)
cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2819)
dt_cpufreq_probe (drivers/cpufreq/cpufreq-dt.c:344)
[...]--- drivers/regulator/vctrl-regulator.c | 72 +++++++++++++++++------------ 1 file changed, 42 insertions(+), 30 deletions(-)
drivers/regulator/vctrl-regulator.c +42 -30
@@ -37,7 +37,6 @@ struct vctrl_voltage_table {struct vctrl_data {struct regulator_dev *rdev;struct regulator_desc desc; -struct regulator *ctrl_reg;bool enabled;unsigned int min_slew_down_rate;unsigned int ovp_threshold;
@@ -82,7 +81,12 @@ static int vctrl_calc_output_voltage(struct vctrl_data *vctrl, int ctrl_uV)static int vctrl_get_voltage (struct regulator_dev *rdev) {struct vctrl_data *vctrl =rdev_get_drvdata (rdev); -int ctrl_uV =regulator_get_voltage_rdev (vctrl->ctrl_reg->rdev); +int ctrl_uV; + +if (!rdev->supply) +return -EPROBE_DEFER ; + + ctrl_uV =regulator_get_voltage_rdev (rdev->supply->rdev);return vctrl_calc_output_voltage (vctrl, ctrl_uV); }
@@ -92,14 +96,19 @@ static int vctrl_set_voltage(struct regulator_dev *rdev, unsigned int *selector) {struct vctrl_data *vctrl =rdev_get_drvdata (rdev); -struct regulator *ctrl_reg = vctrl->ctrl_reg; -int orig_ctrl_uV =regulator_get_voltage_rdev (ctrl_reg->rdev); -int uV =vctrl_calc_output_voltage (vctrl, orig_ctrl_uV); +int orig_ctrl_uV; +int uV;int ret; +if (!rdev->supply) +return -EPROBE_DEFER ; + + orig_ctrl_uV =regulator_get_voltage_rdev (rdev->supply->rdev); + uV =vctrl_calc_output_voltage (vctrl, orig_ctrl_uV); +if (req_min_uV >= uV || !vctrl->ovp_threshold)/* voltage rising or no OVP */ -return regulator_set_voltage_rdev (ctrl_reg->rdev, +return regulator_set_voltage_rdev (rdev->supply->rdev,vctrl_calc_ctrl_voltage (vctrl, req_min_uV),vctrl_calc_ctrl_voltage (vctrl, req_max_uV),PM_SUSPEND_ON );
@@ -117,7 +126,7 @@ static int vctrl_set_voltage(struct regulator_dev *rdev, next_uV =max_t (int, req_min_uV, uV - max_drop_uV); next_ctrl_uV =vctrl_calc_ctrl_voltage (vctrl, next_uV); - ret =regulator_set_voltage_rdev (ctrl_reg->rdev, + ret =regulator_set_voltage_rdev (rdev->supply->rdev, next_ctrl_uV, next_ctrl_uV,PM_SUSPEND_ON );
@@ -134,7 +143,7 @@ static int vctrl_set_voltage(struct regulator_dev *rdev, err:/* Try to go back to original voltage */ -regulator_set_voltage_rdev (ctrl_reg->rdev, orig_ctrl_uV, orig_ctrl_uV, +regulator_set_voltage_rdev (rdev->supply->rdev, orig_ctrl_uV, orig_ctrl_uV,PM_SUSPEND_ON );return ret;
@@ -151,16 +160,18 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev, unsigned int selector) {struct vctrl_data *vctrl =rdev_get_drvdata (rdev); -struct regulator *ctrl_reg = vctrl->ctrl_reg;unsigned int orig_sel = vctrl->sel;int ret; +if (!rdev->supply) +return -EPROBE_DEFER ; +if (selector >= rdev->desc->n_voltages)return -EINVAL ;if (selector >= vctrl->sel || !vctrl->ovp_threshold) {/* voltage rising or no OVP */ - ret =regulator_set_voltage_rdev (ctrl_reg->rdev, + ret =regulator_set_voltage_rdev (rdev->supply->rdev, vctrl->vtable[selector].ctrl, vctrl->vtable[selector].ctrl,PM_SUSPEND_ON );
@@ -179,7 +190,7 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev,else next_sel = vctrl->vtable[vctrl->sel].ovp_min_sel; - ret =regulator_set_voltage_rdev (ctrl_reg->rdev, + ret =regulator_set_voltage_rdev (rdev->supply->rdev, vctrl->vtable[next_sel].ctrl, vctrl->vtable[next_sel].ctrl,PM_SUSPEND_ON );
@@ -202,7 +213,7 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev, err:if (vctrl->sel != orig_sel) {/* Try to go back to original voltage */ -if (!regulator_set_voltage_rdev (ctrl_reg->rdev, +if (!regulator_set_voltage_rdev (rdev->supply->rdev, vctrl->vtable[orig_sel].ctrl, vctrl->vtable[orig_sel].ctrl,PM_SUSPEND_ON ))
@@ -234,10 +245,6 @@ static int vctrl_parse_dt(struct platform_device *pdev,u32 pval;u32 vrange_ctrl[2 ]; - vctrl->ctrl_reg =devm_regulator_get (&pdev->dev,"ctrl" ); -if (IS_ERR (vctrl->ctrl_reg)) -return PTR_ERR (vctrl->ctrl_reg); - ret =of_property_read_u32 (np,"ovp-threshold-percent" , &pval);if (!ret) { vctrl->ovp_threshold = pval;
@@ -315,11 +322,11 @@ static int vctrl_cmp_ctrl_uV(const void *a, const void *b)return at->ctrl - bt->ctrl; } -static int vctrl_init_vtable (struct platform_device *pdev) +static int vctrl_init_vtable (struct platform_device *pdev, +struct regulator *ctrl_reg) {struct vctrl_data *vctrl =platform_get_drvdata (pdev);struct regulator_desc *rdesc = &vctrl->desc; -struct regulator *ctrl_reg = vctrl->ctrl_reg;struct vctrl_voltage_range *vrange_ctrl = &vctrl->vrange.ctrl;int n_voltages;int ctrl_uV;
@@ -395,23 +402,19 @@ static int vctrl_init_vtable(struct platform_device *pdev)static int vctrl_enable (struct regulator_dev *rdev) {struct vctrl_data *vctrl =rdev_get_drvdata (rdev); -int ret =regulator_enable (vctrl->ctrl_reg); -if (!ret) - vctrl->enabled = true; + vctrl->enabled = true; -return ret; +return 0 ; }static int vctrl_disable (struct regulator_dev *rdev) {struct vctrl_data *vctrl =rdev_get_drvdata (rdev); -int ret =regulator_disable (vctrl->ctrl_reg); -if (!ret) - vctrl->enabled = false; + vctrl->enabled = false; -return ret; +return 0 ; }static int vctrl_is_enabled (struct regulator_dev *rdev)
@@ -447,6 +450,7 @@ static int vctrl_probe(struct platform_device *pdev)struct regulator_desc *rdesc;struct regulator_config cfg = { };struct vctrl_voltage_range *vrange_ctrl; +struct regulator *ctrl_reg;int ctrl_uV;int ret;
@@ -461,15 +465,20 @@ static int vctrl_probe(struct platform_device *pdev)if (ret)return ret; + ctrl_reg =devm_regulator_get (&pdev->dev,"ctrl" ); +if (IS_ERR (ctrl_reg)) +return PTR_ERR (ctrl_reg); + vrange_ctrl = &vctrl->vrange.ctrl; rdesc = &vctrl->desc; rdesc->name ="vctrl" ; rdesc->type =REGULATOR_VOLTAGE ; rdesc->owner =THIS_MODULE ; + rdesc->supply_name ="ctrl" ; -if ((regulator_get_linear_step (vctrl->ctrl_reg) ==1 ) || - (regulator_count_voltages (vctrl->ctrl_reg) == -EINVAL )) { +if ((regulator_get_linear_step (ctrl_reg) ==1 ) || + (regulator_count_voltages (ctrl_reg) == -EINVAL )) { rdesc->continuous_voltage_range = true; rdesc->ops = &vctrl_ops_cont; }else {
@@ -486,12 +495,12 @@ static int vctrl_probe(struct platform_device *pdev) cfg.init_data = init_data;if (!rdesc->continuous_voltage_range) { - ret =vctrl_init_vtable (pdev); + ret =vctrl_init_vtable (pdev, ctrl_reg);if (ret)return ret;/* Use locked consumer API when not in regulator framework */ - ctrl_uV =regulator_get_voltage (vctrl->ctrl_reg); + ctrl_uV =regulator_get_voltage (ctrl_reg);if (ctrl_uV <0 ) {dev_err (&pdev->dev,"failed to get control voltage\n" );return ctrl_uV;
@@ -514,6 +523,9 @@ static int vctrl_probe(struct platform_device *pdev) } } +/* Drop ctrl-supply here in favor of regulator core managed supply */ +devm_regulator_put (ctrl_reg); + vctrl->rdev =devm_regulator_register (&pdev->dev, rdesc, &cfg);if (IS_ERR (vctrl->rdev)) { ret =PTR_ERR (vctrl->rdev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 80/334 spi: sprd: Fix the wrong WDG_LOAD_VAL
In reply to Greg Kroah-HartmanFrom: Chunyan Zhang <[email protected]>
[ Upstream commit 245ca2cc212bb2a078332ec99afbfbb202f44c2d ]
Use 50ms as default timeout value and the time clock is 32768HZ. The original value of WDG_LOAD_VAL is not correct, so this patch fixes it.
--- drivers/spi/spi-sprd-adi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-sprd-adi.c +1 -1
@@ -103,7 +103,7 @@#define HWRST_STATUS_WATCHDOG 0xf0/* Use default timeout 50 ms that converts to watchdog values */ -#define WDG_LOAD_VAL ((50 * 1000) / 32768) +#define WDG_LOAD_VAL ((50 * 32768) / 1000)#define WDG_LOAD_MASK GENMASK(15, 0)#define WDG_UNLOCK_KEY 0xe551
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 81/334 spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible
In reply to Greg Kroah-HartmanFrom: Quanyang Wang <[email protected]>
[ Upstream commit 26cfc0dbe43aae60dc03af27077775244f26c167 ]
The function wait_for_completion_interruptible_timeout will return -ERESTARTSYS immediately when receiving SIGKILL signal which is sent by "jffs2_gcd_mtd" during umounting jffs2. This will break the SPI memory operation because the data transmitting may begin before the command or address transmitting completes. Use wait_for_completion_timeout to prevent the process from being interruptible.
--- drivers/spi/spi-zynq-qspi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/spi/spi-zynq-qspi.c +4 -4
@@ -545,7 +545,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,zynq_qspi_write_op (xqspi,ZYNQ_QSPI_FIFO_DEPTH , true);zynq_qspi_write (xqspi,ZYNQ_QSPI_IEN_OFFSET ,ZYNQ_QSPI_IXR_RXTX_MASK ); -if (!wait_for_completion_interruptible_timeout (&xqspi->data_completion, +if (!wait_for_completion_timeout (&xqspi->data_completion,msecs_to_jiffies (1000 ))) err = -ETIMEDOUT ; }
@@ -563,7 +563,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,zynq_qspi_write_op (xqspi,ZYNQ_QSPI_FIFO_DEPTH , true);zynq_qspi_write (xqspi,ZYNQ_QSPI_IEN_OFFSET ,ZYNQ_QSPI_IXR_RXTX_MASK ); -if (!wait_for_completion_interruptible_timeout (&xqspi->data_completion, +if (!wait_for_completion_timeout (&xqspi->data_completion,msecs_to_jiffies (1000 ))) err = -ETIMEDOUT ; }
@@ -579,7 +579,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,zynq_qspi_write_op (xqspi,ZYNQ_QSPI_FIFO_DEPTH , true);zynq_qspi_write (xqspi,ZYNQ_QSPI_IEN_OFFSET ,ZYNQ_QSPI_IXR_RXTX_MASK ); -if (!wait_for_completion_interruptible_timeout (&xqspi->data_completion, +if (!wait_for_completion_timeout (&xqspi->data_completion,msecs_to_jiffies (1000 ))) err = -ETIMEDOUT ;
@@ -603,7 +603,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,zynq_qspi_write_op (xqspi,ZYNQ_QSPI_FIFO_DEPTH , true);zynq_qspi_write (xqspi,ZYNQ_QSPI_IEN_OFFSET ,ZYNQ_QSPI_IXR_RXTX_MASK ); -if (!wait_for_completion_interruptible_timeout (&xqspi->data_completion, +if (!wait_for_completion_timeout (&xqspi->data_completion,msecs_to_jiffies (1000 ))) err = -ETIMEDOUT ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 82/334 drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit f42498705965bd4b026953c1892c686d8b1138e4 ]
Fix the missing clk_disable_unprepare() before return from panfrost_clk_init() in the error handling case.
--- drivers/gpu/drm/panfrost/panfrost_device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/panfrost/panfrost_device.c +2 -1
@@ -54,7 +54,8 @@ static int panfrost_clk_init(struct panfrost_device *pfdev)if (IS_ERR (pfdev->bus_clock)) {dev_err (pfdev->dev,"get bus_clock failed %ld\n" ,PTR_ERR (pfdev->bus_clock)); -return PTR_ERR (pfdev->bus_clock); + err =PTR_ERR (pfdev->bus_clock); + goto disable_clock; }if (pfdev->bus_clock) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 83/334 drm/gma500: Fix end of loop tests for list_for_each_entry
In reply to Greg Kroah-HartmanFrom: Harshvardhan Jha <[email protected]>
[ Upstream commit ea9a897b8affa0f7b4c90182b785dded74e434aa ]
The list_for_each_entry() iterator, "connector" in this code, can never be NULL. If we exit the loop without finding the correct connector then "connector" points invalid memory that is an offset from the list head. This will eventually lead to memory corruption and presumably a kernel crash.
--- drivers/gpu/drm/gma500/oaktrail_lvds.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/gma500/oaktrail_lvds.c +1 -1
@@ -117,7 +117,7 @@ static void oaktrail_lvds_mode_set(struct drm_encoder *encoder,continue ; } -if (!connector) { +if (list_entry_is_head (connector, &mode_config->connector_list, head)) {DRM_ERROR ("Couldn't find connector when setting mode" );gma_power_end (dev);return ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 84/334 ASoC: mediatek: mt8192:Fix Unbalanced pm_runtime_enable in mt8192_afe_pcm_dev_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 2af2f861edd21c1456ef7dbec52122ce1b581568 ]
Add missing pm_runtime_disable() when probe error out. It could avoid pm_runtime implementation complains when removing and probing again the driver.
--- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 27 ++++++++++++++-------- 1 file changed, 17 insertions(+), 10 deletions(-)
sound/soc/mediatek/mt8192/mt8192-afe-pcm.c +17 -10
@@ -2229,12 +2229,13 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev) afe->regmap =syscon_node_to_regmap (dev->parent->of_node);if (IS_ERR (afe->regmap)) {dev_err (dev,"could not get regmap from parent\n" ); -return PTR_ERR (afe->regmap); + ret =PTR_ERR (afe->regmap); + goto err_pm_disable; } ret =regmap_attach_dev (dev, afe->regmap, &mt8192_afe_regmap_config);if (ret) {dev_warn (dev,"regmap_attach_dev fail, ret %d\n" , ret); -return ret; + goto err_pm_disable; }/* enable clock for regcache get default value from hw */
@@ -2244,7 +2245,7 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev) ret =regmap_reinit_cache (afe->regmap, &mt8192_afe_regmap_config);if (ret) {dev_err (dev,"regmap_reinit_cache fail, ret %d\n" , ret); -return ret; + goto err_pm_disable; }pm_runtime_put_sync (&pdev->dev);
@@ -2257,8 +2258,10 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev) afe->memif_size =MT8192_MEMIF_NUM ; afe->memif =devm_kcalloc (dev, afe->memif_size,sizeof (*afe->memif),GFP_KERNEL ); -if (!afe->memif) -return -ENOMEM ; +if (!afe->memif) { + ret = -ENOMEM ; + goto err_pm_disable; + }for (i =0 ; i < afe->memif_size; i++) { afe->memif[i].data = &memif_data[i];
@@ -2272,22 +2275,26 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev) afe->irqs_size =MT8192_IRQ_NUM ; afe->irqs =devm_kcalloc (dev, afe->irqs_size,sizeof (*afe->irqs),GFP_KERNEL ); -if (!afe->irqs) -return -ENOMEM ; +if (!afe->irqs) { + ret = -ENOMEM ; + goto err_pm_disable; + }for (i =0 ; i < afe->irqs_size; i++) afe->irqs[i].irq_data = &irq_data[i];/* request irq */ irq_id =platform_get_irq (pdev,0 ); -if (irq_id <0 ) -return irq_id; +if (irq_id <0 ) { + ret = irq_id; + goto err_pm_disable; + } ret =devm_request_irq (dev, irq_id, mt8192_afe_irq_handler,IRQF_TRIGGER_NONE ,"asys-isr" , (void *)afe);if (ret) {dev_err (dev,"could not request_irq for Afe_ISR_Handle\n" ); -return ret; + goto err_pm_disable; }/* init sub_dais */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 85/334 ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in mt8183_afe_pcm_dev_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 19f479c37f76e926a6c0bec974a4d09826e32fc6 ]
Add missing pm_runtime_disable() when probe error out. It could avoid pm_runtime implementation complains when removing and probing again the driver.
--- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 43 ++++++++++++++-------- 1 file changed, 27 insertions(+), 16 deletions(-)
sound/soc/mediatek/mt8183/mt8183-afe-pcm.c +27 -16
@@ -1119,25 +1119,26 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) afe->regmap =syscon_node_to_regmap (dev->parent->of_node);if (IS_ERR (afe->regmap)) {dev_err (dev,"could not get regmap from parent\n" ); -return PTR_ERR (afe->regmap); + ret =PTR_ERR (afe->regmap); + goto err_pm_disable; } ret =regmap_attach_dev (dev, afe->regmap, &mt8183_afe_regmap_config);if (ret) {dev_warn (dev,"regmap_attach_dev fail, ret %d\n" , ret); -return ret; + goto err_pm_disable; } rstc =devm_reset_control_get (dev,"audiosys" );if (IS_ERR (rstc)) { ret =PTR_ERR (rstc);dev_err (dev,"could not get audiosys reset:%d\n" , ret); -return ret; + goto err_pm_disable; } ret =reset_control_reset (rstc);if (ret) {dev_err (dev,"failed to trigger audio reset:%d\n" , ret); -return ret; + goto err_pm_disable; }/* enable clock for regcache get default value from hw */
@@ -1147,7 +1148,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) ret =regmap_reinit_cache (afe->regmap, &mt8183_afe_regmap_config);if (ret) {dev_err (dev,"regmap_reinit_cache fail, ret %d\n" , ret); -return ret; + goto err_pm_disable; }pm_runtime_put_sync (&pdev->dev);
@@ -1160,8 +1161,10 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) afe->memif_size =MT8183_MEMIF_NUM ; afe->memif =devm_kcalloc (dev, afe->memif_size,sizeof (*afe->memif),GFP_KERNEL ); -if (!afe->memif) -return -ENOMEM ; +if (!afe->memif) { + ret = -ENOMEM ; + goto err_pm_disable; + }for (i =0 ; i < afe->memif_size; i++) { afe->memif[i].data = &memif_data[i];
@@ -1178,22 +1181,26 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) afe->irqs_size =MT8183_IRQ_NUM ; afe->irqs =devm_kcalloc (dev, afe->irqs_size,sizeof (*afe->irqs),GFP_KERNEL ); -if (!afe->irqs) -return -ENOMEM ; +if (!afe->irqs) { + ret = -ENOMEM ; + goto err_pm_disable; + }for (i =0 ; i < afe->irqs_size; i++) afe->irqs[i].irq_data = &irq_data[i];/* request irq */ irq_id =platform_get_irq (pdev,0 ); -if (irq_id <0 ) -return irq_id; +if (irq_id <0 ) { + ret = irq_id; + goto err_pm_disable; + } ret =devm_request_irq (dev, irq_id, mt8183_afe_irq_handler,IRQF_TRIGGER_NONE ,"asys-isr" , (void *)afe);if (ret) {dev_err (dev,"could not request_irq for asys-isr\n" ); -return ret; + goto err_pm_disable; }/* init sub_dais */
@@ -1204,7 +1211,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)if (ret) {dev_warn (afe->dev,"dai register i %d fail, ret %d\n" , i, ret); -return ret; + goto err_pm_disable; } }
@@ -1213,7 +1220,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)if (ret) {dev_warn (afe->dev,"mtk_afe_combine_sub_dai fail, ret %d\n" , ret); -return ret; + goto err_pm_disable; } afe->mtk_afe_hardware = &mt8183_afe_hardware;
@@ -1229,7 +1236,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) NULL, 0);if (ret) {dev_warn (dev,"err_platform\n" ); -return ret; + goto err_pm_disable; } ret = devm_snd_soc_register_component(afe->dev,
@@ -1238,10 +1245,14 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) afe->num_dai_drivers);if (ret) {dev_warn (dev,"err_dai_component\n" ); -return ret; + goto err_pm_disable; }return ret; + +err_pm_disable: +pm_runtime_disable (&pdev->dev); +return ret; }static int mt8183_afe_pcm_dev_remove (struct platform_device *pdev)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 86/334 ASoC: tlv320aic32x4: Fix TAS2505/TAS2521 channel count
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 3694f996be5cb8374bd224f4e5462c945d359843 ]
The TAS2505/TAS2521 does support up to two channels, LEFT and RIGHT, which are being alternated on the audio data bus by Word Clock, WCLK. This is documented in TI slau472 2.7.1 Digital Audio Interface. Note that both the LEFT and RIGHT channels are only used for audio INPUT, while only the LEFT channel is used for audio OUTPUT.
--- sound/soc/codecs/tlv320aic32x4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/tlv320aic32x4.c +1 -1
@@ -1131,7 +1131,7 @@ static struct snd_soc_dai_driver aic32x4_tas2505_dai = { .playback = { .stream_name = "Playback", .channels_min = 1, - .channels_max = 1, + .channels_max = 2, .rates = SNDRV_PCM_RATE_8000_96000, .formats = AIC32X4_FORMATS,}, .ops = &aic32x4_ops,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 87/334 media: atmel: atmel-sama5d2-isc: fix YUYV format
In reply to Greg Kroah-HartmanFrom: Eugen Hristev <[email protected]>
[ Upstream commit 123aaf816b952e5b6ee754335596b01ba1f6c830 ]
SAMA5D2 does not have the YCYC field for the RLP (rounding, limiting, packaging) module.
The YCYC field is supposed to work with interleaved YUV formats like YUYV. In SAMA5D2, we have to use YYCC field, which is used for both planar formats like YUV420 and interleaved formats like YUYV.
Fix the according rlp callback to replace the generic YCYC field (which makes more sense from a logical point of view) with the required YYCC field.
--- .../media/platform/atmel/atmel-sama5d2-isc.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/media/platform/atmel/atmel-sama5d2-isc.c +17 -0
@@ -255,6 +255,23 @@ static void isc_sama5d2_config_rlp(struct isc_device *isc)struct regmap *regmap = isc->regmap;u32 rlp_mode = isc->config.rlp_cfg_mode; +/* +* In sama5d2, the YUV planar modes and the YUYV modes are treated +* in the same way in RLP register. +* Normally, YYCC mode should be Luma(n) - Color B(n) - Color R (n) +* and YCYC should be Luma(n + 1) - Color B (n) - Luma (n) - Color R (n) +* but in sama5d2, the YCYC mode does not exist, and YYCC must be +* selected for both planar and interleaved modes, as in fact +* both modes are supported. +* +* Thus, if the YCYC mode is selected, replace it with the +* sama5d2-compliant mode which is YYCC . +*/ +if ((rlp_mode &ISC_RLP_CFG_MODE_YCYC ) ==ISC_RLP_CFG_MODE_YCYC ) { + rlp_mode &= ~ISC_RLP_CFG_MODE_MASK ; + rlp_mode |=ISC_RLP_CFG_MODE_YYCC ; + } +regmap_update_bits (regmap,ISC_RLP_CFG + isc->offsets.rlp,ISC_RLP_CFG_MODE_MASK , rlp_mode); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 88/334 media: TDA1997x: enable EDID support
In reply to Greg Kroah-HartmanFrom: Krzysztof Hałasa <[email protected]>
[ Upstream commit ea3e1c36e38810427485f06c2becc1f29e54521d ]
Without this patch, the TDA19971 chip's EDID is inactive. EDID never worked with this driver, it was all tested with HDMI signal sources which don't need EDID support.
--- drivers/media/i2c/tda1997x.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/i2c/tda1997x.c +1 -0
@@ -2233,6 +2233,7 @@ static int tda1997x_core_init(struct v4l2_subdev *sd)/* get initial HDMI status */ state->hdmi_status =io_read (sd,REG_HDMI_FLAGS ); +io_write (sd,REG_EDID_ENABLE ,EDID_ENABLE_A_EN |EDID_ENABLE_B_EN );return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 89/334 leds: is31fl32xx: Fix missing error code in is31fl32xx_parse_dt()
In reply to Greg Kroah-HartmanFrom: Jiapeng Chong <[email protected]>
[ Upstream commit e642197562cd9781453f835e1406cfe0feeb917e ]
The error code is missing in this code scenario, add the error code '-EINVAL' to the return value 'ret'.
Eliminate the follow smatch warning:
drivers/leds/leds-is31fl32xx.c:388 is31fl32xx_parse_dt() warn: missing error code 'ret'.
--- drivers/leds/leds-is31fl32xx.c | 1 + 1 file changed, 1 insertion(+)
drivers/leds/leds-is31fl32xx.c +1 -0
@@ -386,6 +386,7 @@ static int is31fl32xx_parse_dt(struct device *dev,dev_err (dev,"Node %pOF 'reg' conflicts with another LED\n" , child); + ret = -EINVAL ; goto err; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 90/334 soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 2a1c55d4762dd34a8b0f2e36fb01b7b16b60735b ]
Merely enabling CONFIG_COMPILE_TEST should not enable additional code. To fix this, restrict the automatic enabling of ROCKCHIP_GRF to ARCH_ROCKCHIP, and ask the user in case of compile-testing.
--- drivers/soc/rockchip/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/soc/rockchip/Kconfig +2 -2
@@ -6,8 +6,8 @@ if ARCH_ROCKCHIP || COMPILE_TEST # config ROCKCHIP_GRF - bool - default y + bool "Rockchip General Register Files support" if COMPILE_TEST + default y if ARCH_ROCKCHIP help The General Register Files are a central component providing special additional settings registers for a lot of soc-components.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 91/334 media: cxd2880-spi: Fix an error handling path
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit dcb0145821017e929a733e2271c85c6f82b9c9f8 ]
If an error occurs after a successful 'regulator_enable()' call, 'regulator_disable()' must be called.
Fix the error handling path of the probe accordingly.
--- drivers/media/spi/cxd2880-spi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/media/spi/cxd2880-spi.c +5 -2
@@ -524,13 +524,13 @@ cxd2880_spi_probe(struct spi_device *spi)if (IS_ERR (dvb_spi->vcc_supply)) {if (PTR_ERR (dvb_spi->vcc_supply) == -EPROBE_DEFER ) { ret = -EPROBE_DEFER ; - goto fail_adapter; + goto fail_regulator; } dvb_spi->vcc_supply =NULL ; }else { ret =regulator_enable (dvb_spi->vcc_supply);if (ret) - goto fail_adapter; + goto fail_regulator; } dvb_spi->spi = spi;
@@ -618,6 +618,9 @@ fail_frontend: fail_attach:dvb_unregister_adapter (&dvb_spi->adapter); fail_adapter: +if (!dvb_spi->vcc_supply) +regulator_disable (dvb_spi->vcc_supply); +fail_regulator:kfree (dvb_spi);return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 92/334 drm/of: free the right object
In reply to Greg Kroah-HartmanFrom: Julia Lawall <[email protected]>
[ Upstream commit b557a5f8da5798d27370ed6b73e673aae33efd55 ]
There is no need to free a NULL value. Instead, free the object that is leaking due to the iterator.
The semantic patch that finds this problem is as follows:
// <smpl>
@@
expression x,e;
identifier f;
@@
x = f(...);
if (x == NULL) {
... when any
when != x = e
* of_node_put(x);
... }
// </smpl>
--- drivers/gpu/drm/drm_of.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_of.c +1 -1
@@ -315,7 +315,7 @@ static int drm_of_lvds_get_remote_pixels_type( remote_port =of_graph_get_remote_port (endpoint);if (!remote_port) { -of_node_put (remote_port); +of_node_put (endpoint);return -EPIPE ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 93/334 bpf: Fix a typo of reuseport map in bpf.h.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit f170acda7ffaf0473d06e1e17c12cd9fd63904f5 ]
Fix s/BPF_MAP_TYPE_REUSEPORT_ARRAY/BPF_MAP_TYPE_REUSEPORT_SOCKARRAY/ typo in bpf.h.
--- include/uapi/linux/bpf.h | 2 +- tools/include/uapi/linux/bpf.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
include/uapi/linux/bpf.h +1 -1
@@ -3249,7 +3249,7 @@ union bpf_attr {* long bpf_sk_select_reuseport(struct sk_reuseport_md *reuse, struct bpf_map *map, void *key, u64 flags) * Description * Select a **SO_REUSEPORT** socket from a -* **BPF_MAP_TYPE_REUSEPORT_ARRAY** *map*. +* **BPF_MAP_TYPE_REUSEPORT_SOCKARRAY** *map*. * It checks the selected socket is matching the incoming * request in the socket buffer. * Return
tools/include/uapi/linux/bpf.h +1 -1
@@ -3249,7 +3249,7 @@ union bpf_attr {* long bpf_sk_select_reuseport(struct sk_reuseport_md *reuse, struct bpf_map *map, void *key, u64 flags) * Description * Select a **SO_REUSEPORT** socket from a -* **BPF_MAP_TYPE_REUSEPORT_ARRAY** *map*. +* **BPF_MAP_TYPE_REUSEPORT_SOCKARRAY** *map*. * It checks the selected socket is matching the incoming * request in the socket buffer. * Return
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 94/334 bpf: Fix potential memleak and UAF in the verifier.
In reply to Greg Kroah-HartmanFrom: He Fengqing <[email protected]>
[ Upstream commit 75f0fc7b48ad45a2e5736bcf8de26c8872fe8695 ]
In bpf_patch_insn_data(), we first use the bpf_patch_insn_single() to insert new instructions, then use adjust_insn_aux_data() to adjust insn_aux_data. If the old env->prog have no enough room for new inserted instructions, we use bpf_prog_realloc to construct new_prog and free the old env->prog.
There have two errors here. First, if adjust_insn_aux_data() return ENOMEM, we should free the new_prog. Second, if adjust_insn_aux_data() return ENOMEM, bpf_patch_insn_data() will return NULL, and env->prog has been freed in bpf_prog_realloc, but we will use it in bpf_check().
So in this patch, we make the adjust_insn_aux_data() never fails. In bpf_patch_insn_data(), we first pre-malloc memory for the new insn_aux_data, then call bpf_patch_insn_single() to insert new instructions, at last call adjust_insn_aux_data() to adjust insn_aux_data.
--- kernel/bpf/verifier.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-)
kernel/bpf/verifier.c +16 -11
@@ -11414,10 +11414,11 @@ static void convert_pseudo_ld_imm64(struct bpf_verifier_env *env)* insni[off, off + cnt). Adjust corresponding insn_aux_data by copying * [0, off) and [off, end) to new locations, so the patched range stays zero */ -static int adjust_insn_aux_data (struct bpf_verifier_env *env, -struct bpf_prog *new_prog,u32 off,u32 cnt) +static void adjust_insn_aux_data (struct bpf_verifier_env *env, +struct bpf_insn_aux_data *new_data, +struct bpf_prog *new_prog,u32 off,u32 cnt) { -struct bpf_insn_aux_data *new_data, *old_data = env->insn_aux_data; +struct bpf_insn_aux_data *old_data = env->insn_aux_data;struct bpf_insn *insn = new_prog->insnsi;u32 old_seen = old_data[off].seen;u32 prog_len;
@@ -11430,12 +11431,9 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env, old_data[off].zext_dst =insn_has_def32 (env, insn + off + cnt -1 );if (cnt ==1 ) -return 0 ; +return ; prog_len = new_prog->len; - new_data =vzalloc (array_size (prog_len, -sizeof (struct bpf_insn_aux_data ))); -if (!new_data) -return -ENOMEM ; +memcpy (new_data, old_data,sizeof (struct bpf_insn_aux_data ) * off);memcpy (new_data + off + cnt -1 , old_data + off,sizeof (struct bpf_insn_aux_data ) * (prog_len - off - cnt +1 ));
@@ -11446,7 +11444,6 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env, } env->insn_aux_data = new_data;vfree (old_data); -return 0 ; }static void adjust_subprog_starts (struct bpf_verifier_env *env,u32 off,u32 len)
@@ -11481,6 +11478,14 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of const struct bpf_insn *patch, u32 len) {struct bpf_prog *new_prog; +struct bpf_insn_aux_data *new_data =NULL ; + +if (len >1 ) { + new_data =vzalloc (array_size (env->prog->len + len -1 , +sizeof (struct bpf_insn_aux_data ))); +if (!new_data) +return NULL ; + } new_prog =bpf_patch_insn_single (env->prog, off, patch, len);if (IS_ERR (new_prog)) {
@@ -11488,10 +11493,10 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 ofverbose (env,"insn %d cannot be patched due to 16-bit range\n" , env->insn_aux_data[off].orig_idx); +vfree (new_data);return NULL ; } -if (adjust_insn_aux_data (env, new_prog, off, len)) -return NULL ; +adjust_insn_aux_data (env, new_data, new_prog, off, len);adjust_subprog_starts (env, off, len);adjust_poke_descs (new_prog, off, len);return new_prog;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 95/334 drm/of: free the iterator object on failure
In reply to Greg Kroah-HartmanFrom: Steven Price <[email protected]>
[ Upstream commit 6f9223a56fabc840836b49de27dc7b27642c6a32 ]
When bailing out due to the sanity check the iterator value needs to be freed because the early return prevents for_each_child_of_node() from doing the dereference itself.
--- drivers/gpu/drm/drm_of.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_of.c +3 -1
@@ -331,8 +331,10 @@ static int drm_of_lvds_get_remote_pixels_type(* configurations by passing the endpoints explicitly to * drm_of_lvds_get_dual_link_pixel_order(). */ -if (!current_pt || pixels_type != current_pt) +if (!current_pt || pixels_type != current_pt) { +of_node_put (endpoint);return -EINVAL ; + } }return pixels_type;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 96/334 gve: fix the wrong AdminQ buffer overflow check
In reply to Greg Kroah-HartmanFrom: Haiyue Wang <[email protected]>
[ Upstream commit 63a9192b8fa1ea55efeba1f18fad52bb24d9bf12 ]
The 'tail' pointer is also free-running count, so it needs to be masked as 'adminq_prod_cnt' does, to become an index value of AdminQ buffer.
--- drivers/net/ethernet/google/gve/gve_adminq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/google/gve/gve_adminq.c +4 -2
@@ -322,7 +322,8 @@ static int gve_adminq_issue_cmd(struct gve_priv *priv, tail =ioread32be (&priv->reg_bar0->adminq_event_counter);// Check if next command will overflow the buffer. -if (((priv->adminq_prod_cnt +1 ) & priv->adminq_mask) == tail) { +if (((priv->adminq_prod_cnt +1 ) & priv->adminq_mask) == + (tail & priv->adminq_mask)) {int err;// Flush existing commands to make room.
@@ -332,7 +333,8 @@ static int gve_adminq_issue_cmd(struct gve_priv *priv,// Retry. tail =ioread32be (&priv->reg_bar0->adminq_event_counter); -if (((priv->adminq_prod_cnt +1 ) & priv->adminq_mask) == tail) { +if (((priv->adminq_prod_cnt +1 ) & priv->adminq_mask) == + (tail & priv->adminq_mask)) {// This should never happen. We just flushed the // command queue so there should be enough space. return -ENOMEM ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 97/334 libbpf: Fix the possible memory leak on error
In reply to Greg Kroah-HartmanFrom: Shuyi Cheng <[email protected]>
[ Upstream commit 18353c87e0e0440d4c7c746ed740738bbc1b538e ]
If the strdup() fails then we need to call bpf_object__close(obj) to avoid a resource leak.
--- tools/lib/bpf/libbpf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/lib/bpf/libbpf.c +4 -2
@@ -7588,8 +7588,10 @@ __bpf_object__open(const char *path, const void *obj_buf, size_t obj_buf_sz, kconfig =OPTS_GET (opts, kconfig,NULL );if (kconfig) { obj->kconfig =strdup (kconfig); -if (!obj->kconfig) -return ERR_PTR (-ENOMEM ); +if (!obj->kconfig) { + err = -ENOMEM ; + goto out; + } } err =bpf_object__elf_init (obj);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 98/334 ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi
In reply to Greg Kroah-HartmanFrom: Dylan Hung <[email protected]>
[ Upstream commit 8c295b7f3d01359ff4336fcb6e406e6ed37957d6 ]
The HVI3C shall be a group of I3C function, not an independent function. Correct the function name from "HVI3C" to "I3C".
--- arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi +2 -2
@@ -208,12 +208,12 @@ }; pinctrl_hvi3c3_default: hvi3c3_default { - function = "HVI3C3"; + function = "I3C3"; groups = "HVI3C3"; }; pinctrl_hvi3c4_default: hvi3c4_default { - function = "HVI3C4"; + function = "I3C4"; groups = "HVI3C4"; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 99/334 ARM: dts: everest: Add phase corrections for eMMC
In reply to Greg Kroah-HartmanFrom: Andrew Jeffery <[email protected]>
[ Upstream commit ded3e2864c735f33ba5abbbe2d7b1c6605242f9b ]
The values were determined via scope measurements.
With the patch we can write and read data without issue where as booting the system without the patch failed at the point of mounting the rootfs.
--- arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts +1 -1
@@ -2832,7 +2832,7 @@ &emmc { status = "okay"; - clk-phase-mmc-hs200 = <180>, <180>; + clk-phase-mmc-hs200 = <210>, <228>; }; &fsim0 {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 100/334 arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 4ec82a7bb3db8c6005e715c63224c32d458917a2 ]
The "max-clock" and "min-vrefresh" properties fail to validate with commit cfe34bb7a770c5d8 ("dt-bindings: drm: bridge: adi,adv7511.txt:
convert to yaml"). Drop them, as they are parts of an out-of-tree workaround that is not needed upstream.
--- arch/arm64/boot/dts/renesas/r8a77995-draak.dts | 4 ---- 1 file changed, 4 deletions(-)
arch/arm64/boot/dts/renesas/r8a77995-draak.dts +0 -4
@@ -277,10 +277,6 @@ interrupt-parent = <&gpio1>; interrupts = <28 IRQ_TYPE_LEVEL_LOW>; - /* Depends on LVDS */ - max-clock = <135000000>; - min-vrefresh = <50>; - adi,input-depth = <8>; adi,input-colorspace = "rgb"; adi,input-clock = "1x";
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 101/334 i40e: improve locking of mac_filter_hash
In reply to Greg Kroah-HartmanFrom: Stefan Assmann <[email protected]>
[ Upstream commit 8b4b06919fd66caf49fdf4fe59f9d6312cf7956d ]
i40e_config_vf_promiscuous_mode() calls i40e_getnum_vf_vsi_vlan_filters() without acquiring the mac_filter_hash_lock spinlock.
This is unsafe because mac_filter_hash may get altered in another thread while i40e_getnum_vf_vsi_vlan_filters() traverses the hashes.
Simply adding the spinlock in i40e_getnum_vf_vsi_vlan_filters() is not possible as it already gets called in i40e_get_vlan_list_sync() with the spinlock held. Therefore adding a wrapper that acquires the spinlock and call the correct function where appropriate.
--- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 23 ++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +20 -3
@@ -1160,12 +1160,12 @@ static int i40e_quiesce_vf_pci(struct i40e_vf *vf) }/** -* i40e_getnum_vf_vsi_vlan_filters +* __i40e_getnum_vf_vsi_vlan_filters * @vsi: pointer to the vsi * * called to get the number of VLANs offloaded on this VF **/ -static int i40e_getnum_vf_vsi_vlan_filters (struct i40e_vsi *vsi) +static int __i40e_getnum_vf_vsi_vlan_filters (struct i40e_vsi *vsi) {struct i40e_mac_filter *f;u16 num_vlans =0 , bkt;
@@ -1178,6 +1178,23 @@ static int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi)return num_vlans; } +/** +* i40e_getnum_vf_vsi_vlan_filters +* @vsi: pointer to the vsi +* +* wrapper for __i40e_getnum_vf_vsi_vlan_filters() with spinlock held +**/ +static int i40e_getnum_vf_vsi_vlan_filters (struct i40e_vsi *vsi) +{ +int num_vlans; + +spin_lock_bh (&vsi->mac_filter_hash_lock); + num_vlans =__i40e_getnum_vf_vsi_vlan_filters (vsi); +spin_unlock_bh (&vsi->mac_filter_hash_lock); + +return num_vlans; +} +/** * i40e_get_vlan_list_sync * @vsi: pointer to the VSI
@@ -1195,7 +1212,7 @@ static void i40e_get_vlan_list_sync(struct i40e_vsi *vsi, u16 *num_vlans,int bkt;spin_lock_bh (&vsi->mac_filter_hash_lock); - *num_vlans =i40e_getnum_vf_vsi_vlan_filters (vsi); + *num_vlans =__i40e_getnum_vf_vsi_vlan_filters (vsi); *vlan_list =kcalloc (*num_vlans,sizeof (**vlan_list),GFP_ATOMIC );if (!(*vlan_list)) goto err;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 102/334 arm64: dts: qcom: sc7180: Set adau wakeup delay to 80 ms
In reply to Greg Kroah-HartmanFrom: Judy Hsiao <[email protected]>
[ Upstream commit a8c7f3100e708d5f55692f0607ca80c5dcd21ce8 ]
Set audu wakeup delay to 80 ms for fixing pop noise during capture begin.
--- arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi +1 -1
@@ -23,7 +23,7 @@ ap_h1_spi: &spi0 {}; adau7002: audio-codec-1 { compatible = "adi,adau7002"; IOVDD-supply = <&pp1800_l15a>; - wakeup-delay-ms = <15>; + wakeup-delay-ms = <80>; #sound-dai-cells = <0>; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 103/334 soc: qcom: rpmhpd: Use corner in power_off
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit d43b3a989bc8c06fd4bbb69a7500d180db2d68e8 ]
rpmhpd_aggregate_corner() takes a corner as parameter, but in rpmhpd_power_off() the code requests the level of the first corner instead.
In all (known) current cases the first corner has level 0, so this change should be a nop, but in case that there's a power domain with a non-zero lowest level this makes sure that rpmhpd_power_off() actually requests the lowest level - which is the closest to "power off" we can get.
While touching the code, also skip the unnecessary zero-initialization of "ret".
--- drivers/soc/qcom/rpmhpd.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/soc/qcom/rpmhpd.c +2 -3
@@ -403,12 +403,11 @@ static int rpmhpd_power_on(struct generic_pm_domain *domain)static int rpmhpd_power_off (struct generic_pm_domain *domain) {struct rpmhpd *pd =domain_to_rpmhpd (domain); -int ret =0 ; +int ret;mutex_lock (&rpmhpd_lock); - ret =rpmhpd_aggregate_corner (pd, pd->level[0 ]); - + ret =rpmhpd_aggregate_corner (pd,0 );if (!ret) pd->enabled = false;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 104/334 libbpf: Fix removal of inner map in bpf_object__create_map
In reply to Greg Kroah-HartmanFrom: Martynas Pumputis <[email protected]>
[ Upstream commit a21ab4c59e09c2a9994a6e393b7484e3b3f78a99 ]
If creating an outer map of a BTF-defined map-in-map fails (via bpf_object__create_map()), then the previously created its inner map won't be destroyed.
Fix this by ensuring that the destroy routines are not bypassed in the case of a failure.
--- tools/lib/bpf/libbpf.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
tools/lib/bpf/libbpf.c +4 -6
@@ -4479,6 +4479,7 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b {struct bpf_create_map_attr create_attr;struct bpf_map_def *def = &map->def; +int err =0 ;memset (&create_attr,0 ,sizeof (create_attr));
@@ -4521,8 +4522,6 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, bif (bpf_map_type__is_map_in_map (def->type)) {if (map->inner_map) { -int err; - err =bpf_object__create_map (obj, map->inner_map, true);if (err) { pr_warn("map '%s': failed to create inner map: %d\n",
@@ -4547,8 +4546,8 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, bif (map->fd <0 && (create_attr.btf_key_type_id || create_attr.btf_value_type_id)) {char *cp, errmsg[STRERR_BUFSIZE ]; -int err = -errno; + err = -errno; cp =libbpf_strerror_r (err, errmsg,sizeof (errmsg));pr_warn ("Error in bpf_create_map_xattr(%s):%s(%d). Retrying without BTF.\n" , map->name, cp, err);
@@ -4560,8 +4559,7 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b map->fd =bpf_create_map_xattr (&create_attr); } -if (map->fd <0 ) -return -errno; + err = map->fd <0 ? -errno :0 ;if (bpf_map_type__is_map_in_map (def->type) && map->inner_map) {if (obj->gen_loader)
@@ -4570,7 +4568,7 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, bzfree (&map->inner_map); } -return 0 ; +return err; }static int init_map_slots (struct bpf_object *obj,struct bpf_map *map)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 105/334 gfs2: Fix memory leak of object lsi on error return path
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit a6579cbfd7216b071008db13360c322a6b21400b ]
In the case where IS_ERR(lsi->si_sc_inode) is true the error exit path to free_local does not kfree the allocated object lsi leading to a memory leak. Fix this by kfree'ing lst before taking the error exit path.
Addresses-Coverity: ("Resource leak")
--- fs/gfs2/ops_fstype.c | 1 + 1 file changed, 1 insertion(+)
fs/gfs2/ops_fstype.c +1 -0
@@ -677,6 +677,7 @@ static int init_statfs(struct gfs2_sbd *sdp) error =PTR_ERR (lsi->si_sc_inode);fs_err (sdp,"can't find local \"sc\" file#%u: %d\n" , jd->jd_jid, error); +kfree (lsi); goto free_local; } lsi->si_jid = jd->jd_jid;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 106/334 arm64: dts: qcom: sm8250: fix usb2 qmp phy node
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 63fa4322469648ae1023bb92a8b0d6a2f4bdaf2c ]
Use 'lanes' as SuperSpeed lanes device node instead of just 'lane' to fix issues with TypeC support.
--- arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm8250.dtsi +1 -1
@@ -2210,7 +2210,7 @@ <&gcc GCC_USB3_PHY_SEC_BCR>; reset-names = "phy", "common"; - usb_2_ssphy: lane@88eb200 { + usb_2_ssphy: lanes@88eb200 { reg = <0 0x088eb200 0 0x200>, <0 0x088eb400 0 0x200>, <0 0x088eb800 0 0x800>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 107/334 bpf, selftests: Fix test_maps now that sockmap supports UDP
In reply to Greg Kroah-HartmanFrom: John Fastabend <[email protected]>
[ Upstream commit c39aa21599748f3845a47645f482d94099b11460 ]
UDP socket support was added recently so testing UDP insert failure is no longer correct and causes test_maps failure. The fix is easy though, we simply need to test that UDP is correctly added instead of blocked.
--- tools/testing/selftests/bpf/test_maps.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/bpf/test_maps.c +2 -2
@@ -764,8 +764,8 @@ static void test_sockmap(unsigned int tasks, void *data) udp =socket (AF_INET ,SOCK_DGRAM ,0 ); i =0 ; err =bpf_map_update_elem (fd, &i, &udp,BPF_ANY ); -if (!err) { -printf ("Failed socket SOCK_DGRAM allowed '%i:%i'\n" , +if (err) { +printf ("Failed socket update SOCK_DGRAM '%i:%i'\n" , i, udp); goto out_sockmap; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 108/334 firmware: fix theoretical UAF race with firmware cache and resume
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
[ Upstream commit 3ecc8cb7c092b2f50e21d2aaaae35b8221ee7214 ]
This race was discovered when I carefully analyzed the code to locate another firmware-related UAF issue. It can be triggered only when the firmware load operation is executed during suspend. This possibility is almost impossible because there are few firmware load and suspend actions in the actual environment.
CPU0 CPU1 __device_uncache_fw_images(): assign_fw(): fw_cache_piggyback_on_request() <----- P0 spin_lock(&fwc->name_lock); ... list_del(&fce->list); spin_unlock(&fwc->name_lock); uncache_firmware(fce->name); <----- P1 kref_get(&fw_priv->ref);
If CPU1 is interrupted at position P0, the new 'fce' has been added to the list fwc->fw_names by the fw_cache_piggyback_on_request(). In this case, CPU0 executes __device_uncache_fw_images() and will be able to see it when it traverses list fwc->fw_names. Before CPU1 executes kref_get() at P1, if CPU0 further executes uncache_firmware(), the count of fw_priv->ref may decrease to 0, causing fw_priv to be released in advance.
Move kref_get() to the lock protection range of fwc->name_lock to fix it.
--- drivers/base/firmware_loader/main.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-)
drivers/base/firmware_loader/main.c +8 -12
@@ -165,7 +165,7 @@ static inline int fw_state_wait(struct fw_priv *fw_priv)return __fw_state_wait_common (fw_priv,MAX_SCHEDULE_TIMEOUT ); } -static int fw_cache_piggyback_on_request (const char *name); +static void fw_cache_piggyback_on_request (struct fw_priv *fw_priv); static struct fw_priv *__allocate_fw_priv(const char *fw_name, struct firmware_cache *fwc,
@@ -707,10 +707,8 @@ int assign_fw(struct firmware *fw, struct device *device)* on request firmware. */ if (!(fw_priv->opt_flags &FW_OPT_NOCACHE ) && - fw_priv->fwc->state ==FW_LOADER_START_CACHE ) { -if (fw_cache_piggyback_on_request (fw_priv->fw_name)) -kref_get (&fw_priv->ref); - } + fw_priv->fwc->state ==FW_LOADER_START_CACHE ) +fw_cache_piggyback_on_request (fw_priv);/* pass the pages buffer to driver at the last minute */ fw_set_page_data (fw_priv, fw);
@@ -1259,11 +1257,11 @@ static int __fw_entry_found(const char *name)return 0 ; } -static int fw_cache_piggyback_on_request (const char *name) +static void fw_cache_piggyback_on_request (struct fw_priv *fw_priv) { -struct firmware_cache *fwc = &fw_cache; +const char *name = fw_priv->fw_name; +struct firmware_cache *fwc = fw_priv->fwc;struct fw_cache_entry *fce; -int ret =0 ;spin_lock (&fwc->name_lock);if (__fw_entry_found (name))
@@ -1271,13 +1269,12 @@ static int fw_cache_piggyback_on_request(const char *name) fce =alloc_fw_cache_entry (name);if (fce) { - ret =1 ;list_add (&fce->list, &fwc->fw_names); +kref_get (&fw_priv->ref);pr_debug ("%s: fw: %s\n" , __func__, name); } found:spin_unlock (&fwc->name_lock); -return ret; }static void free_fw_cache_entry (struct fw_cache_entry *fce)
@@ -1508,9 +1505,8 @@ static inline void unregister_fw_pm_ops(void) unregister_pm_notifier(&fw_cache.pm_notify); }#else -static int fw_cache_piggyback_on_request (const char *name) +static void fw_cache_piggyback_on_request (struct fw_priv *fw_priv) { -return 0 ; }static inline int register_fw_pm_ops (void ) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 109/334 driver core: Fix error return code in really_probe()
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
[ Upstream commit f04948dea236b000da09c466a7ec931ecd8d7867 ]
In the case of error handling, the error code returned by the subfunction should be propagated instead of 0.
--- drivers/base/dd.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/base/dd.c +10 -6
@@ -580,7 +580,8 @@ re_probe: goto probe_failed; } -if (driver_sysfs_add (dev)) { + ret =driver_sysfs_add (dev); +if (ret) {pr_err ("%s: driver_sysfs_add(%s) failed\n" , __func__,dev_name (dev)); goto probe_failed;
@@ -602,15 +603,18 @@ re_probe: goto probe_failed; } -if (device_add_groups (dev, drv->dev_groups)) { + ret =device_add_groups (dev, drv->dev_groups); +if (ret) {dev_err (dev,"device_add_groups() failed\n" ); goto dev_groups_failed; } -if (dev_has_sync_state (dev) && -device_create_file (dev, &dev_attr_state_synced)) { -dev_err (dev,"state_synced sysfs add failed\n" ); - goto dev_sysfs_state_synced_failed; +if (dev_has_sync_state (dev)) { + ret =device_create_file (dev, &dev_attr_state_synced); +if (ret) { +dev_err (dev,"state_synced sysfs add failed\n" ); + goto dev_sysfs_state_synced_failed; + } }if (test_remove) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 110/334 ionic: cleanly release devlink instance
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit c2255ff47768c94a0ebc3968f007928bb47ea43b ]
The failure to register devlink will leave the system with dangled devlink resource, which is not cleaned if devlink_port_register() fails.
In order to remove access to ".registered" field of struct devlink_port, require both devlink_register and devlink_port_register to success and check it through device pointer.
--- .../net/ethernet/pensando/ionic/ionic_devlink.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_devlink.c +7 -7
@@ -91,20 +91,20 @@ int ionic_devlink_register(struct ionic *ionic) attrs.flavour =DEVLINK_PORT_FLAVOUR_PHYSICAL ;devlink_port_attrs_set (&ionic->dl_port, &attrs); err =devlink_port_register (dl, &ionic->dl_port,0 ); -if (err) +if (err) {dev_err (ionic->dev,"devlink_port_register failed: %d\n" , err); -else -devlink_port_type_eth_set (&ionic->dl_port, - ionic->lif->netdev); +devlink_unregister (dl); +return err; + } -return err; +devlink_port_type_eth_set (&ionic->dl_port, ionic->lif->netdev); +return 0 ; }void ionic_devlink_unregister (struct ionic *ionic) {struct devlink *dl =priv_to_devlink (ionic); -if (ionic->dl_port.registered) -devlink_port_unregister (&ionic->dl_port); +devlink_port_unregister (&ionic->dl_port);devlink_unregister (dl); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 111/334 media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit c5453769f77ce19a5b03f1f49946fd3f8a374009 ]
If dibusb_read_eeprom_byte fails, the mac address is not initialized. And nova_t_read_mac_address does not handle this failure, which leads to the uninit-value in dvb_usb_adapter_dvb_init.
Fix this by handling the failure of dibusb_read_eeprom_byte.
--- drivers/media/usb/dvb-usb/nova-t-usb2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/usb/dvb-usb/nova-t-usb2.c +4 -2
@@ -130,7 +130,7 @@ ret:static int nova_t_read_mac_address (struct dvb_usb_device *d,u8 mac[6 ]) { -int i; +int i, ret;u8 b; mac[0 ] =0x00 ;
@@ -139,7 +139,9 @@ static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])/* this is a complete guess, but works for my box */ for (i =136 ; i <139 ; i++) { -dibusb_read_eeprom_byte (d,i, &b); + ret =dibusb_read_eeprom_byte (d, i, &b); +if (ret) +return ret; mac[5 - (i -136 )] = b; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 112/334 media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit 797c061ad715a9a1480eb73f44b6939fbe3209ed ]
If vp702x_usb_in_op fails, the mac address is not initialized. And vp702x_read_mac_addr does not handle this failure, which leads to the uninit-value in dvb_usb_adapter_dvb_init.
Fix this by handling the failure of vp702x_usb_in_op.
--- drivers/media/usb/dvb-usb/vp702x.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/media/usb/dvb-usb/vp702x.c +9 -3
@@ -291,16 +291,22 @@ static int vp702x_rc_query(struct dvb_usb_device *d, u32 *event, int *state)static int vp702x_read_mac_addr (struct dvb_usb_device *d,u8 mac[6 ]) {u8 i, *buf; +int ret;struct vp702x_device_state *st = d->priv;mutex_lock (&st->buf_mutex); buf = st->buf; -for (i =6 ; i <12 ; i++) -vp702x_usb_in_op (d,READ_EEPROM_REQ , i,1 , &buf[i -6 ],1 ); +for (i =6 ; i <12 ; i++) { + ret =vp702x_usb_in_op (d,READ_EEPROM_REQ , i,1 , + &buf[i -6 ],1 ); +if (ret <0 ) + goto err; + }memcpy (mac, buf,6 ); +err:mutex_unlock (&st->buf_mutex); -return 0 ; +return ret; }static int vp702x_frontend_attach (struct dvb_usb_adapter *adap)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 113/334 media: dvb-usb: Fix error handling in dvb_usb_i2c_init
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit 131ae388b88e3daf4cb0721ed4b4cb8bfc201465 ]
In dvb_usb_i2c_init, if i2c_add_adapter fails, it only prints an error message, and then continues to set DVB_USB_STATE_I2C. This affects the logic of dvb_usb_i2c_exit, which leads to that, the deletion of i2c_adap even if the i2c_add_adapter fails.
Fix this by returning at the failure of i2c_add_adapter and then move dvb_usb_i2c_exit out of the error handling code of dvb_usb_i2c_init.
--- drivers/media/usb/dvb-usb/dvb-usb-i2c.c | 9 +++++++-- drivers/media/usb/dvb-usb/dvb-usb-init.c | 2 +- 2 files changed, 8 insertions(+), 3 deletions(-)
drivers/media/usb/dvb-usb/dvb-usb-i2c.c +7 -2
@@ -17,7 +17,8 @@ int dvb_usb_i2c_init(struct dvb_usb_device *d)if (d->props.i2c_algo ==NULL ) {err ("no i2c algorithm specified" ); -return -EINVAL ; + ret = -EINVAL ; + goto err; }strscpy (d->i2c_adap.name, d->desc->name,sizeof (d->i2c_adap.name));
@@ -27,11 +28,15 @@ int dvb_usb_i2c_init(struct dvb_usb_device *d)i2c_set_adapdata (&d->i2c_adap, d); -if ((ret =i2c_add_adapter (&d->i2c_adap)) <0 ) + ret =i2c_add_adapter (&d->i2c_adap); +if (ret <0 ) {err ("could not add i2c adapter" ); + goto err; + } d->state |=DVB_USB_STATE_I2C ; +err:return ret; }
drivers/media/usb/dvb-usb/dvb-usb-init.c +1 -1
@@ -194,8 +194,8 @@ static int dvb_usb_init(struct dvb_usb_device *d, short *adapter_nums) err_adapter_init:dvb_usb_adapter_exit (d); -err_i2c_init:dvb_usb_i2c_exit (d); +err_i2c_init:if (d->priv && d->props.priv_destroy) d->props.priv_destroy (d); err_priv_init:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 114/334 net: usb: asix: ax88772: add missing stop
In reply to Greg Kroah-HartmanFrom: Oleksij Rempel <[email protected]>
[ Upstream commit 9c2670951ed03f8fc6c701d66f5c765929cf1f23 ]
Add missing stop and let phylib framework suspend attached PHY.
--- drivers/net/usb/asix_devices.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/asix_devices.c +1 -0
@@ -1220,6 +1220,7 @@ static const struct driver_info ax88772b_info = { .unbind = ax88772_unbind, .status = asix_status, .reset = ax88772_reset, + .stop = ax88772_stop, .flags =FLAG_ETHER |FLAG_FRAMING_AX |FLAG_LINK_INTR | FLAG_MULTI_PACKET, .rx_fixup = asix_rx_fixup_common,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 115/334 media: go7007: fix memory leak in go7007_usb_probe
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 47d94dad8e64b2fc1d8f66ce7acf714f9462c60f ]
In commit 137641287eb4 ("go7007: add sanity checking for endpoints") endpoint sanity check was introduced, but if check fails it simply returns with leaked pointers.
Cutted log from my local syzbot instance:
BUG: memory leak
unreferenced object 0xffff8880209f0000 (size 8192):
comm "kworker/0:4", pid 4916, jiffies 4295263583 (age 29.310s)
hex dump (first 32 bytes):
30 b0 27 22 80 88 ff ff 75 73 62 2d 64 75 6d 6d 0.'"....usb-dumm
79 5f 68 63 64 2e 33 2d 31 00 00 00 00 00 00 00 y_hcd.3-1.......
backtrace:
[<ffffffff860ca856>] kmalloc include/linux/slab.h:556 [inline]
[<ffffffff860ca856>] kzalloc include/linux/slab.h:686 [inline]
[<ffffffff860ca856>] go7007_alloc+0x46/0xb40 drivers/media/usb/go7007/go7007-driver.c:696
[<ffffffff860de74e>] go7007_usb_probe+0x13e/0x2200 drivers/media/usb/go7007/go7007-usb.c:1114
[<ffffffff854a5f74>] usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396
[<ffffffff845a7151>] really_probe+0x291/0xf60 drivers/base/dd.c:576
BUG: memory leak
unreferenced object 0xffff88801e2f2800 (size 512):
comm "kworker/0:4", pid 4916, jiffies 4295263583 (age 29.310s)
hex dump (first 32 bytes):
00 87 40 8a ff ff ff ff 00 00 00 00 00 00 00 00 ..@.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff860de794>] kmalloc include/linux/slab.h:556 [inline]
[<ffffffff860de794>] kzalloc include/linux/slab.h:686 [inline]
[<ffffffff860de794>] go7007_usb_probe+0x184/0x2200 drivers/media/usb/go7007/go7007-usb.c:1118
[<ffffffff854a5f74>] usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396
[<ffffffff845a7151>] really_probe+0x291/0xf60 drivers/base/dd.c:576--- drivers/media/usb/go7007/go7007-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/go7007/go7007-usb.c +1 -1
@@ -1134,7 +1134,7 @@ static int go7007_usb_probe(struct usb_interface *intf, ep = usb->usbdev->ep_in[4 ];if (!ep) -return -ENODEV ; + goto allocfail;/* Allocate the URB and buffer for receiving incoming interrupts */ usb->intr_urb =usb_alloc_urb (0 ,GFP_KERNEL );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 116/334 media: go7007: remove redundant initialization
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 6f5885a7750545973bf1a942d2f0f129aef0aa06 ]
In go7007_alloc() kzalloc() is used for struct go7007 allocation. It means that there is no need in zeroing any members, because kzalloc will take care of it.
Removing these reduntant initialization steps increases execution speed a lot:
Before:
+ 86.802 us | go7007_alloc();
After:
+ 29.595 us | go7007_alloc();
--- drivers/media/usb/go7007/go7007-driver.c | 26 ------------------------ 1 file changed, 26 deletions(-)
drivers/media/usb/go7007/go7007-driver.c +0 -26
@@ -691,49 +691,23 @@ struct go7007 *go7007_alloc(const struct go7007_board_info *board, struct device *dev) {struct go7007 *go; -int i; go =kzalloc (sizeof (struct go7007 ),GFP_KERNEL );if (go ==NULL )return NULL ; go->dev = dev; go->board_info = board; - go->board_id =0 ; go->tuner_type =-1 ; - go->channel_number =0 ; - go->name[0 ] =0 ;mutex_init (&go->hw_lock);init_waitqueue_head (&go->frame_waitq);spin_lock_init (&go->spinlock); go->status =STATUS_INIT ; -memset (&go->i2c_adapter,0 ,sizeof (go->i2c_adapter)); - go->i2c_adapter_online =0 ; - go->interrupt_available =0 ;init_waitqueue_head (&go->interrupt_waitq); - go->input =0 ;go7007_update_board (go); - go->encoder_h_halve =0 ; - go->encoder_v_halve =0 ; - go->encoder_subsample =0 ; go->format =V4L2_PIX_FMT_MJPEG ; go->bitrate =1500000 ; go->fps_scale =1 ; - go->pali =0 ; go->aspect_ratio =GO7007_RATIO_1_1 ; - go->gop_size =0 ; - go->ipb =0 ; - go->closed_gop =0 ; - go->repeat_seqhead =0 ; - go->seq_header_enable =0 ; - go->gop_header_enable =0 ; - go->dvd_mode =0 ; - go->interlace_coding =0 ; -for (i =0 ; i <4 ; ++i) - go->modet[i].enable =0 ; -for (i =0 ; i <1624 ; ++i) - go->modet_map[i] =0 ; - go->audio_deliver =NULL ; - go->audio_enabled =0 ;return go; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 117/334 media: v4l2-subdev: fix some NULL vs IS_ERR() checks
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit ba7a93e507f88306d7a19a1dcb53b857b790cfb8 ]
The v4l2_subdev_alloc_state() function returns error pointers, it doesn't return NULL.
--- drivers/media/platform/rcar-vin/rcar-v4l2.c | 4 ++-- drivers/media/platform/vsp1/vsp1_entity.c | 4 ++-- drivers/staging/media/tegra-video/vi.c | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-)
drivers/media/platform/rcar-vin/rcar-v4l2.c +2 -2
@@ -253,8 +253,8 @@ static int rvin_try_format(struct rvin_dev *vin, u32 which,int ret; sd_state =v4l2_subdev_alloc_state (sd); -if (sd_state ==NULL ) -return -ENOMEM ; +if (IS_ERR (sd_state)) +return PTR_ERR (sd_state);if (!rvin_format_from_pixel (vin, pix->pixelformat)) pix->pixelformat =RVIN_DEFAULT_FORMAT ;
drivers/media/platform/vsp1/vsp1_entity.c +2 -2
@@ -676,9 +676,9 @@ int vsp1_entity_init(struct vsp1_device *vsp1, struct vsp1_entity *entity,* rectangles. */ entity->config =v4l2_subdev_alloc_state (&entity->subdev); -if (entity->config ==NULL ) { +if (IS_ERR (entity->config)) {media_entity_cleanup (&entity->subdev.entity); -return -ENOMEM ; +return PTR_ERR (entity->config); }return 0 ;
drivers/staging/media/tegra-video/vi.c +2 -2
@@ -508,8 +508,8 @@ static int __tegra_channel_try_format(struct tegra_vi_channel *chan,return -ENODEV ; sd_state =v4l2_subdev_alloc_state (subdev); -if (!sd_state) -return -ENOMEM ; +if (IS_ERR (sd_state)) +return PTR_ERR (sd_state);/* * Retrieve the format information and if requested format isn't * supported, keep the current format.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 118/334 media: rockchip/rga: fix error handling in probe
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit e58430e1d4fd01b74475d2fbe2e25b5817b729a9 ]
There are a few bugs in this code. 1) No checks for whether dma_alloc_attrs() or __get_free_pages() failed. 2) If video_register_device() fails it doesn't clean up the dma attrs or the free pages. 3) The video_device_release() function frees "vfd" which leads to a use after free on the next line. The call to video_unregister_device() is not required so I have just removed that.
--- drivers/media/platform/rockchip/rga/rga.c | 27 ++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-)
drivers/media/platform/rockchip/rga/rga.c +22 -5
@@ -863,12 +863,12 @@ static int rga_probe(struct platform_device *pdev)if (IS_ERR (rga->m2m_dev)) {v4l2_err (&rga->v4l2_dev,"Failed to init mem2mem device\n" ); ret =PTR_ERR (rga->m2m_dev); - goto unreg_video_dev; + goto rel_vdev; } ret =pm_runtime_resume_and_get (rga->dev);if (ret <0 ) - goto unreg_video_dev; + goto rel_vdev; rga->version.major = (rga_read (rga,RGA_VERSION_INFO ) >>24 ) &0xFF ; rga->version.minor = (rga_read (rga,RGA_VERSION_INFO ) >>20 ) &0x0F ;
@@ -882,11 +882,23 @@ static int rga_probe(struct platform_device *pdev) rga->cmdbuf_virt =dma_alloc_attrs (rga->dev,RGA_CMDBUF_SIZE , &rga->cmdbuf_phy,GFP_KERNEL ,DMA_ATTR_WRITE_COMBINE ); +if (!rga->cmdbuf_virt) { + ret = -ENOMEM ; + goto rel_vdev; + } rga->src_mmu_pages = (unsigned int *)__get_free_pages (GFP_KERNEL | __GFP_ZERO,3 ); +if (!rga->src_mmu_pages) { + ret = -ENOMEM ; + goto free_dma; + } rga->dst_mmu_pages = (unsigned int *)__get_free_pages (GFP_KERNEL | __GFP_ZERO,3 ); +if (rga->dst_mmu_pages) { + ret = -ENOMEM ; + goto free_src_pages; + } def_frame.stride = (def_frame.width * def_frame.fmt->depth) >>3 ; def_frame.size = def_frame.stride * def_frame.height;
@@ -894,7 +906,7 @@ static int rga_probe(struct platform_device *pdev) ret =video_register_device (vfd,VFL_TYPE_VIDEO ,-1 );if (ret) {v4l2_err (&rga->v4l2_dev,"Failed to register video device\n" ); - goto rel_vdev; + goto free_dst_pages; } v4l2_info(&rga->v4l2_dev, "Registered %s as /dev/%s\n",
@@ -902,10 +914,15 @@ static int rga_probe(struct platform_device *pdev)return 0 ; +free_dst_pages: +free_pages ((unsigned long )rga->dst_mmu_pages,3 ); +free_src_pages: +free_pages ((unsigned long )rga->src_mmu_pages,3 ); +free_dma: +dma_free_attrs (rga->dev,RGA_CMDBUF_SIZE , rga->cmdbuf_virt, + rga->cmdbuf_phy,DMA_ATTR_WRITE_COMBINE ); rel_vdev:video_device_release (vfd); -unreg_video_dev: -video_unregister_device (rga->vfd); unreg_v4l2_dev:v4l2_device_unregister (&rga->v4l2_dev); err_put_clk:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 119/334 media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
In reply to Greg Kroah-HartmanFrom: Philipp Zabel <[email protected]>
[ Upstream commit 44693d74f5653f82cd7ca0fe730eed0f6b83306a ]
The frame memory control register value is currently determined before userspace selects the final capture format and never corrected. Update ctx->frame_mem_ctrl in __coda_start_decoding() to fix decoding into YUV420 or YVU420 capture buffers.
--- drivers/media/platform/coda/coda-bit.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/media/platform/coda/coda-bit.c +13 -5
@@ -2053,17 +2053,25 @@ static int __coda_start_decoding(struct coda_ctx *ctx)u32 src_fourcc, dst_fourcc;int ret; + q_data_src =get_q_data (ctx,V4L2_BUF_TYPE_VIDEO_OUTPUT ); + q_data_dst =get_q_data (ctx,V4L2_BUF_TYPE_VIDEO_CAPTURE ); + src_fourcc = q_data_src->fourcc; + dst_fourcc = q_data_dst->fourcc; +if (!ctx->initialized) { ret =__coda_decoder_seq_init (ctx);if (ret <0 )return ret; + }else { + ctx->frame_mem_ctrl &= ~(CODA_FRAME_CHROMA_INTERLEAVE | (0x3 <<9 ) | +CODA9_FRAME_TILED2LINEAR ); +if (dst_fourcc ==V4L2_PIX_FMT_NV12 || dst_fourcc ==V4L2_PIX_FMT_YUYV ) + ctx->frame_mem_ctrl |=CODA_FRAME_CHROMA_INTERLEAVE ; +if (ctx->tiled_map_type ==GDI_TILED_FRAME_MB_RASTER_MAP ) + ctx->frame_mem_ctrl |= (0x3 <<9 ) | + ((ctx->use_vdoa) ?0 :CODA9_FRAME_TILED2LINEAR ); } - q_data_src =get_q_data (ctx,V4L2_BUF_TYPE_VIDEO_OUTPUT ); - q_data_dst =get_q_data (ctx,V4L2_BUF_TYPE_VIDEO_CAPTURE ); - src_fourcc = q_data_src->fourcc; - dst_fourcc = q_data_dst->fourcc; -coda_write (dev, ctx->parabuf.paddr,CODA_REG_BIT_PARA_BUF_ADDR ); ret =coda_alloc_framebuffers (ctx, q_data_dst, src_fourcc);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 120/334 media: atomisp: fix the uninitialized use and rename "retvalue"
In reply to Greg Kroah-HartmanFrom: Yizhuo <[email protected]>
[ Upstream commit c275e5d349b0d2b1143607d28b9c7c14a8a0a9b4 ]
Inside function mt9m114_detect(), variable "retvalue" could be uninitialized if mt9m114_read_reg() returns error, however, it is used in the later if statement, which is potentially unsafe.
The local variable "retvalue" is renamed to "model" to avoid confusion.
--- drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c +7 -4
@@ -1545,16 +1545,19 @@ static struct v4l2_ctrl_config mt9m114_controls[] = {static int mt9m114_detect (struct mt9m114_device *dev,struct i2c_client *client) {struct i2c_adapter *adapter = client->adapter; -u32 retvalue; +u32 model; +int ret;if (!i2c_check_functionality (adapter,I2C_FUNC_I2C )) {dev_err (&client->dev,"%s: i2c error" , __func__);return -ENODEV ; } -mt9m114_read_reg (client,MISENSOR_16BIT , (u32 )MT9M114_PID , &retvalue); - dev->real_model_id = retvalue; + ret =mt9m114_read_reg (client,MISENSOR_16BIT ,MT9M114_PID , &model); +if (ret) +return ret; + dev->real_model_id = model; -if (retvalue !=MT9M114_MOD_ID ) { +if (model !=MT9M114_MOD_ID ) {dev_err (&client->dev,"%s: failed: client->addr = %x\n" , __func__, client->addr);return -ENODEV ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 121/334 Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 59da0b38bc2ea570ede23a3332ecb3e7574ce6b2 ]
Smatch complains that some of these struct members are not initialized leading to a stack information disclosure:
net/bluetooth/sco.c:778 sco_conn_defer_accept() warn:
check that 'cp.retrans_effort' doesn't leak information
This seems like a valid warning. I've added a default case to fix this issue.
--- net/bluetooth/sco.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bluetooth/sco.c +5 -0
@@ -773,6 +773,11 @@ static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting) cp.max_latency =cpu_to_le16 (0xffff ); cp.retrans_effort =0xff ;break ; +default : +/* use CVSD settings as fallback */ + cp.max_latency =cpu_to_le16 (0xffff ); + cp.retrans_effort =0xff ; +break ; } hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 122/334 Bluetooth: btusb: Fix a unspported condition to set available debug features
In reply to Greg Kroah-HartmanFrom: Jun Miao <[email protected]>
[ Upstream commit 20a831f04f1526f2c3442efd3dece8630216b5d2 ]
When reading the support debug features failed, there are not available features init. Continue to set the debug features is illogical, we should skip btintel_set_debug_features(), even if check it by "if (!features)".
--- drivers/bluetooth/btusb.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/bluetooth/btusb.c +10 -8
@@ -2921,10 +2921,11 @@ static int btusb_setup_intel_new(struct hci_dev *hdev)/* Read the Intel supported features and if new exception formats * supported, need to load the additional DDC config to enable. */ -btintel_read_debug_features (hdev, &features); - -/* Set DDC mask for available debug features */ -btintel_set_debug_features (hdev, &features); + err =btintel_read_debug_features (hdev, &features); +if (!err) { +/* Set DDC mask for available debug features */ +btintel_set_debug_features (hdev, &features); + }/* Read the Intel version information after loading the FW */ err =btintel_read_version (hdev, &ver);
@@ -3017,10 +3018,11 @@ static int btusb_setup_intel_newgen(struct hci_dev *hdev)/* Read the Intel supported features and if new exception formats * supported, need to load the additional DDC config to enable. */ -btintel_read_debug_features (hdev, &features); - -/* Set DDC mask for available debug features */ -btintel_set_debug_features (hdev, &features); + err =btintel_read_debug_features (hdev, &features); +if (!err) { +/* Set DDC mask for available debug features */ +btintel_set_debug_features (hdev, &features); + }/* Read the Intel version information after loading the FW */ err =btintel_read_version_tlv (hdev, &version);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 123/334 6lowpan: iphc: Fix an off-by-one check of array index
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 9af417610b6142e826fd1ee8ba7ff3e9a2133a5a ]
The bounds check of id is off-by-one and the comparison should be >= rather >. Currently the WARN_ON_ONCE check does not stop the out of range indexing of &ldev->ctx.table[id] so also add a return path if the bounds are out of range.
Addresses-Coverity: ("Illegal address computation").
--- net/6lowpan/debugfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/6lowpan/debugfs.c +2 -1
@@ -170,7 +170,8 @@ static void lowpan_dev_debugfs_ctx_init(struct net_device *dev,struct dentry *root;char buf[32 ]; -WARN_ON_ONCE (id >LOWPAN_IPHC_CTX_TABLE_SIZE ); +if (WARN_ON_ONCE (id >=LOWPAN_IPHC_CTX_TABLE_SIZE )) +return ;sprintf (buf,"%d" , id);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 124/334 drm/amdgpu/acp: Make PM domain really work
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit aff890288de2d818e4f83ec40c9315e2d735df07 ]
Devices created by mfd_add_hotplug_devices() don't really increase the index of its name, so get_mfd_cell_dev() cannot find any device, hence a NULL dev is passed to pm_genpd_add_device():
[ 56.974926] (NULL device *): amdgpu: device acp_audio_dma.0.auto added to pm domain [ 56.974933] (NULL device *): amdgpu: Failed to add dev to genpd [ 56.974941] [drm:amdgpu_device_ip_init [amdgpu]] *ERROR* hw_init of IP block <acp_ip> failed -22 [ 56.975810] amdgpu 0000:00:01.0: amdgpu: amdgpu_device_ip_init failed [ 56.975839] amdgpu 0000:00:01.0: amdgpu: Fatal error during GPU init [ 56.977136] ------------[ cut here ]------------ [ 56.977143] kernel BUG at mm/slub.c:4206! [ 56.977158] invalid opcode: 0000 [#1] SMP NOPTI [ 56.977167] CPU: 1 PID: 1648 Comm: modprobe Not tainted 5.12.0-051200rc8-generic #202104182230 [ 56.977175] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./FM2A68M-HD+, BIOS P5.20 02/13/2019 [ 56.977180] RIP: 0010:kfree+0x3bf/0x410 [ 56.977195] Code: 89 e7 48 d3 e2 f7 da e8 5f 0d 02 00 80 e7 02 75 3e 44 89 ee 4c 89 e7 e8 ef 5f fd ff e9 fa fe ff ff 49 8b 44 24 08 a8 01 75 b7 <0f> 0b 4c 8b 4d b0 48 8b 4d a8 48 89 da 4c 89 e6 41 b8 01 00 00 00 [ 56.977202] RSP: 0018:ffffa48640ff79f0 EFLAGS: 00010246 [ 56.977210] RAX: 0000000000000000 RBX: ffff9286127d5608 RCX: 0000000000000000 [ 56.977215] RDX: 0000000000000000 RSI: ffffffffc099d0fb RDI: ffff9286127d5608 [ 56.977220] RBP: ffffa48640ff7a48 R08: 0000000000000001 R09: 0000000000000001 [ 56.977224] R10: 0000000000000000 R11: ffff9286087d8458 R12: fffff3ae0449f540 [ 56.977229] R13: 0000000000000000 R14: dead000000000122 R15: dead000000000100 [ 56.977234] FS: 00007f9de5929540(0000) GS:ffff928612e80000(0000) knlGS:0000000000000000 [ 56.977240] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 56.977245] CR2: 00007f697dd97160 CR3: 00000001110f0000 CR4: 00000000001506e0 [ 56.977251] Call Trace: [ 56.977261] amdgpu_dm_encoder_destroy+0x1b/0x30 [amdgpu] [ 56.978056] drm_mode_config_cleanup+0x4f/0x2e0 [drm] [ 56.978147] ? kfree+0x3dd/0x410 [ 56.978157] ? drm_managed_release+0xc8/0x100 [drm] [ 56.978232] drm_mode_config_init_release+0xe/0x10 [drm] [ 56.978311] drm_managed_release+0x9d/0x100 [drm] [ 56.978388] devm_drm_dev_init_release+0x4d/0x70 [drm] [ 56.978450] devm_action_release+0x15/0x20 [ 56.978459] release_nodes+0x77/0xc0 [ 56.978469] devres_release_all+0x3f/0x50 [ 56.978477] really_probe+0x245/0x460 [ 56.978485] driver_probe_device+0xe9/0x160 [ 56.978492] device_driver_attach+0xab/0xb0 [ 56.978499] __driver_attach+0x8f/0x150 [ 56.978506] ? device_driver_attach+0xb0/0xb0 [ 56.978513] bus_for_each_dev+0x7e/0xc0 [ 56.978521] driver_attach+0x1e/0x20 [ 56.978528] bus_add_driver+0x135/0x1f0 [ 56.978534] driver_register+0x91/0xf0 [ 56.978540] __pci_register_driver+0x54/0x60 [ 56.978549] amdgpu_init+0x77/0x1000 [amdgpu] [ 56.979246] ? 0xffffffffc0dbc000 [ 56.979254] do_one_initcall+0x48/0x1d0 [ 56.979265] ? kmem_cache_alloc_trace+0x120/0x230 [ 56.979274] ? do_init_module+0x28/0x280 [ 56.979282] do_init_module+0x62/0x280 [ 56.979288] load_module+0x71c/0x7a0 [ 56.979296] __do_sys_finit_module+0xc2/0x120 [ 56.979305] __x64_sys_finit_module+0x1a/0x20 [ 56.979311] do_syscall_64+0x38/0x90 [ 56.979319] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 56.979328] RIP: 0033:0x7f9de54f989d [ 56.979335] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c3 f5 0c 00 f7 d8 64 89 01 48 [ 56.979342] RSP: 002b:00007ffe3c395a28 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 56.979350] RAX: ffffffffffffffda RBX: 0000560df3ef4330 RCX: 00007f9de54f989d [ 56.979355] RDX: 0000000000000000 RSI: 0000560df3a07358 RDI: 000000000000000f [ 56.979360] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000000 [ 56.979365] R10: 000000000000000f R11: 0000000000000246 R12: 0000560df3a07358 [ 56.979369] R13: 0000000000000000 R14: 0000560df3ef4460 R15: 0000560df3ef4330 [ 56.979377] Modules linked in: amdgpu(+) iommu_v2 gpu_sched drm_ttm_helper ttm drm_kms_helper cec rc_core i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt nft_counter xt_tcpudp ipt_REJECT nf_reject_ipv4 xt_conntrack iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security ip_set nf_tables libcrc32c nfnetlink ip6_tables iptable_filter bpfilter input_leds binfmt_misc edac_mce_amd kvm_amd ccp kvm snd_hda_codec_realtek snd_hda_codec_generic crct10dif_pclmul snd_hda_codec_hdmi ledtrig_audio ghash_clmulni_intel aesni_intel snd_hda_intel snd_intel_dspcfg snd_seq_midi crypto_simd snd_intel_sdw_acpi cryptd snd_hda_codec snd_seq_midi_event snd_rawmidi snd_hda_core snd_hwdep snd_seq fam15h_power k10temp snd_pcm snd_seq_device snd_timer snd mac_hid soundcore sch_fq_codel nct6775 hwmon_vid drm ip_tables x_tables autofs4 dm_mirror dm_region_hash dm_log hid_generic usbhid hid uas usb_storage r8169 crc32_pclmul realtek ahci xhci_pci i2c_piix4 [ 56.979521] xhci_pci_renesas libahci video [ 56.979541] ---[ end trace cb8f6a346f18da7b ]---
Instead of finding MFD hotplugged device by its name, simply iterate over the child devices to avoid the issue.
Squash in unused variable removal (Alex)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 54 ++++++++++++------------- 1 file changed, 26 insertions(+), 28 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c +26 -28
@@ -160,17 +160,28 @@ static int acp_poweron(struct generic_pm_domain *genpd)return 0 ; } -static struct device *get_mfd_cell_dev (const char *device_name,int r) +static int acp_genpd_add_device (struct device *dev,void *data) { -char auto_dev_name[25 ]; -struct device *dev; +struct generic_pm_domain *gpd = data; +int ret; -snprintf (auto_dev_name,sizeof (auto_dev_name), -"%s.%d.auto" , device_name, r); - dev =bus_find_device_by_name (&platform_bus_type,NULL , auto_dev_name); -dev_info (dev,"device %s added to pm domain\n" , auto_dev_name); + ret =pm_genpd_add_device (gpd, dev); +if (ret) +dev_err (dev,"Failed to add dev to genpd %d\n" , ret); -return dev; +return ret; +} + +static int acp_genpd_remove_device (struct device *dev,void *data) +{ +int ret; + + ret =pm_genpd_remove_device (dev); +if (ret) +dev_err (dev,"Failed to remove dev from genpd %d\n" , ret); + +/* Continue to remove */ +return 0 ; }/**
@@ -181,11 +192,10 @@ static struct device *get_mfd_cell_dev(const char *device_name, int r)*/ static int acp_hw_init (void *handle) { -int r, i; +int r;uint64_t acp_base;u32 val =0 ;u32 count =0 ; -struct device *dev;struct i2s_platform_data *i2s_pdata =NULL ;struct amdgpu_device *adev = (struct amdgpu_device *)handle;
@@ -341,15 +351,10 @@ static int acp_hw_init(void *handle)if (r) goto failure; -for (i =0 ; i <ACP_DEVS ; i++) { - dev =get_mfd_cell_dev (adev->acp.acp_cell[i].name, i); - r =pm_genpd_add_device (&adev->acp.acp_genpd->gpd, dev); -if (r) { -dev_err (dev,"Failed to add dev to genpd\n" ); - goto failure; - } - } - + r =device_for_each_child (adev->acp.parent, &adev->acp.acp_genpd->gpd, + acp_genpd_add_device); +if (r) + goto failure;/* Assert Soft reset of ACP */ val =cgs_read_register (adev->acp.cgs_device, mmACP_SOFT_RESET);
@@ -410,10 +415,8 @@ failure:*/ static int acp_hw_fini (void *handle) { -int i, ret;u32 val =0 ;u32 count =0 ; -struct device *dev;struct amdgpu_device *adev = (struct amdgpu_device *)handle;/* return early if no ACP */
@@ -458,13 +461,8 @@ static int acp_hw_fini(void *handle)udelay (100 ); } -for (i =0 ; i <ACP_DEVS ; i++) { - dev =get_mfd_cell_dev (adev->acp.acp_cell[i].name, i); - ret =pm_genpd_remove_device (dev); -/* If removal fails, dont giveup and try rest */ -if (ret) -dev_err (dev,"remove dev from genpd failed\n" ); - } +device_for_each_child (adev->acp.parent,NULL , + acp_genpd_remove_device);mfd_remove_devices (adev->acp.parent);kfree (adev->acp.acp_res);
Signature · 1 line
2.30.2