5.13.17-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainerPATCH 149/300 media: venus: helper: do not set constrained parameters for UBWC
In reply to Greg Kroah-HartmanFrom: Mansur Alisha Shaik <[email protected]>
[ Upstream commit 1ac61faf6ebbce59fccbb53d7faf25576e9897ab ]
Plane constraints firmware interface is to override the default alignment for a given color format. By default venus hardware has alignments as 128x32, but NV12 was defined differently to meet various usecases. Compressed NV12 has always been aligned as 128x32, hence not needed to override the default alignment.
--- drivers/media/platform/qcom/venus/helpers.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/platform/qcom/venus/helpers.c +3 -0
@@ -1138,6 +1138,9 @@ int venus_helper_set_format_constraints(struct venus_inst *inst)if (!IS_V6 (inst->core))return 0 ; +if (inst->opb_fmt ==HFI_COLOR_FORMAT_NV12_UBWC ) +return 0 ; + pconstraint.buffer_type =HFI_BUFFER_OUTPUT2 ; pconstraint.num_planes =2 ; pconstraint.plane_format[0 ].stride_multiples =128 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 150/300 soc: mmsys: mediatek: add mask to mmsys routes
In reply to Greg Kroah-HartmanFrom: CK Hu <[email protected]>
[ Upstream commit 7bdcead7a75e3eab5e711c2da78c2a0360e7f2a4 ]
SOUT has many bits and need to be cleared before set new value. Write only could do the clear, but for MOUT, it clears bits that should not be cleared. So use a mask to reset only the needed bits.
this fixes HDMI issues on MT7623/BPI-R2 since 5.13
--- drivers/soc/mediatek/mt8183-mmsys.h | 21 +++-- drivers/soc/mediatek/mtk-mmsys.c | 7 +- drivers/soc/mediatek/mtk-mmsys.h | 133 +++++++++++++++++++--------- 3 files changed, 112 insertions(+), 49 deletions(-)
drivers/soc/mediatek/mt8183-mmsys.h +14 -7
@@ -28,25 +28,32 @@static const struct mtk_mmsys_routes mmsys_mt8183_routing_table[] = { {DDP_COMPONENT_OVL0 ,DDP_COMPONENT_OVL_2L0 , -MT8183_DISP_OVL0_MOUT_EN ,MT8183_OVL0_MOUT_EN_OVL0_2L +MT8183_DISP_OVL0_MOUT_EN ,MT8183_OVL0_MOUT_EN_OVL0_2L , +MT8183_OVL0_MOUT_EN_OVL0_2L }, {DDP_COMPONENT_OVL_2L0 ,DDP_COMPONENT_RDMA0 , -MT8183_DISP_OVL0_2L_MOUT_EN ,MT8183_OVL0_2L_MOUT_EN_DISP_PATH0 +MT8183_DISP_OVL0_2L_MOUT_EN ,MT8183_OVL0_2L_MOUT_EN_DISP_PATH0 , +MT8183_OVL0_2L_MOUT_EN_DISP_PATH0 }, {DDP_COMPONENT_OVL_2L1 ,DDP_COMPONENT_RDMA1 , -MT8183_DISP_OVL1_2L_MOUT_EN ,MT8183_OVL1_2L_MOUT_EN_RDMA1 +MT8183_DISP_OVL1_2L_MOUT_EN ,MT8183_OVL1_2L_MOUT_EN_RDMA1 , +MT8183_OVL1_2L_MOUT_EN_RDMA1 }, {DDP_COMPONENT_DITHER ,DDP_COMPONENT_DSI0 , -MT8183_DISP_DITHER0_MOUT_EN ,MT8183_DITHER0_MOUT_IN_DSI0 +MT8183_DISP_DITHER0_MOUT_EN ,MT8183_DITHER0_MOUT_IN_DSI0 , +MT8183_DITHER0_MOUT_IN_DSI0 }, {DDP_COMPONENT_OVL_2L0 ,DDP_COMPONENT_RDMA0 , -MT8183_DISP_PATH0_SEL_IN ,MT8183_DISP_PATH0_SEL_IN_OVL0_2L +MT8183_DISP_PATH0_SEL_IN ,MT8183_DISP_PATH0_SEL_IN_OVL0_2L , +MT8183_DISP_PATH0_SEL_IN_OVL0_2L }, {DDP_COMPONENT_RDMA1 ,DDP_COMPONENT_DPI0 , -MT8183_DISP_DPI0_SEL_IN ,MT8183_DPI0_SEL_IN_RDMA1 +MT8183_DISP_DPI0_SEL_IN ,MT8183_DPI0_SEL_IN_RDMA1 , +MT8183_DPI0_SEL_IN_RDMA1 }, {DDP_COMPONENT_RDMA0 ,DDP_COMPONENT_COLOR0 , -MT8183_DISP_RDMA0_SOUT_SEL_IN ,MT8183_RDMA0_SOUT_COLOR0 +MT8183_DISP_RDMA0_SOUT_SEL_IN ,MT8183_RDMA0_SOUT_COLOR0 , +MT8183_RDMA0_SOUT_COLOR0 } };
drivers/soc/mediatek/mtk-mmsys.c +5 -2
@@ -68,7 +68,9 @@ void mtk_mmsys_ddp_connect(struct device *dev,for (i =0 ; i < mmsys->data->num_routes; i++)if (cur == routes[i].from_comp && next == routes[i].to_comp) { - reg =readl_relaxed (mmsys->regs + routes[i].addr) | routes[i].val; + reg =readl_relaxed (mmsys->regs + routes[i].addr); + reg &= ~routes[i].mask; + reg |= routes[i].val;writel_relaxed (reg, mmsys->regs + routes[i].addr); } }
@@ -85,7 +87,8 @@ void mtk_mmsys_ddp_disconnect(struct device *dev,for (i =0 ; i < mmsys->data->num_routes; i++)if (cur == routes[i].from_comp && next == routes[i].to_comp) { - reg =readl_relaxed (mmsys->regs + routes[i].addr) & ~routes[i].val; + reg =readl_relaxed (mmsys->regs + routes[i].addr); + reg &= ~routes[i].mask;writel_relaxed (reg, mmsys->regs + routes[i].addr); } }
drivers/soc/mediatek/mtk-mmsys.h +93 -40
258 lines not on this page · raw message
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 151/300 PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit da9f2150684ea684a7ddd6d7f0e38b2bdf43dcd8 ]
It is inconsistent to return PCI_D0 from pci_target_state() instead of the original target state if 'wakeup' is true and the device cannot signal PME from D0.
This only happens when the device cannot signal PME from the original target state and any shallower power states (including D0) and that case is effectively equivalent to the one in which PME singaling is not supported at all. Since the original target state is returned in the latter case, make the function do that in the former one too.
--- drivers/pci/pci.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/pci/pci.c +10 -6
@@ -2599,16 +2599,20 @@ static pci_power_t pci_target_state(struct pci_dev *dev, bool wakeup)if (dev->current_state == PCI_D3cold) target_state = PCI_D3cold; -if (wakeup) { +if (wakeup && dev->pme_support) { +pci_power_t state = target_state; +/* * Find the deepest state from which the device can generate * PME#. */ -if (dev->pme_support) { -while (target_state - && !(dev->pme_support & (1 << target_state))) - target_state--; - } +while (state && !(dev->pme_support & (1 << state))) + state--; + +if (state) +return state; +else if (dev->pme_support &1 ) +return PCI_D0 ; }return target_state;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 152/300 PCI: PM: Enable PME if it can be signaled from D3cold
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit 0e00392a895c95c6d12d42158236c8862a2f43f2 ]
PME signaling is only enabled by __pci_enable_wake() if the target device can signal PME from the given target power state (to avoid pointless reconfiguration of the device), but if the hierarchy above the device goes into D3cold, the device itself will end up in D3cold too, so if it can signal PME from D3cold, it should be enabled to do so in __pci_enable_wake().
[Note that if the device does not end up in D3cold and it cannot
signal PME from the original target power state, it will not signal PME, so in that case the behavior does not change.]
--- drivers/pci/pci.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/pci/pci.c +8 -1
@@ -2495,7 +2495,14 @@ static int __pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enableif (enable) {int error; -if (pci_pme_capable (dev, state)) +/* +* Enable PME signaling if the device can signal PME from +* D3cold regardless of whether or not it can signal PME from +* the current target state, because that will allow it to +* signal PME when the hierarchy above it goes into D3cold and +* the device itself ends up in D3cold as a result of that. +*/ +if (pci_pme_capable (dev, state) ||pci_pme_capable (dev, PCI_D3cold))pci_pme_active (dev, true);else ret =1 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 153/300 bpf, samples: Add missing mprog-disable to xdp_redirect_cpus optstring
In reply to Greg Kroah-HartmanFrom: Matthew Cover <[email protected]>
[ Upstream commit 34ad6d9d8c27293e1895b448af7d6cf5d351ad8d ]
Commit ce4dade7f12a ("samples/bpf: xdp_redirect_cpu: Load a eBPF program on cpumap") added the following option, but missed adding it to optstring:
- mprog-disable: disable loading XDP program on cpumap entries
Fix it and add the missing option character.
--- samples/bpf/xdp_redirect_cpu_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
samples/bpf/xdp_redirect_cpu_user.c +1 -1
@@ -831,7 +831,7 @@ int main(int argc, char **argv)memset (cpu,0 , n_cpus *sizeof (int ));/* Parse commands line args */ -while ((opt =getopt_long (argc, argv,"hSd:s:p:q:c:xzFf:e:r:m:" , +while ((opt =getopt_long (argc, argv,"hSd:s:p:q:c:xzFf:e:r:m:n" , long_options, &longindex)) !=-1 ) {switch (opt) {case 'd' :
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 154/300 soc: qcom: smsm: Fix missed interrupts if state changes while masked
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
[ Upstream commit e3d4571955050736bbf3eda0a9538a09d9fcfce8 ]
The SMSM driver detects interrupt edges by tracking the last state it has seen (and has triggered the interrupt handler for). This works fine, but only if the interrupt does not change state while masked.
For example, if an interrupt is unmasked while the state is HIGH, the stored last_value for that interrupt might still be LOW. Then, when the remote processor triggers smsm_intr() we assume that nothing has changed, even though the state might have changed from HIGH to LOW.
Attempt to fix this by checking the current remote state before unmasking an IRQ. Use atomic operations to avoid the interrupt handler from interfering with the unmask function.
This fixes modem crashes in some edge cases with the BAM-DMUX driver. Specifically, the BAM-DMUX interrupt handler is not called for the HIGH -> LOW smsm state transition if the BAM-DMUX driver is loaded (and therefore unmasks the interrupt) after the modem was already started:
qcom-q6v5-mss 4080000.remoteproc: fatal error received: a2_task.c:3188:
Assert FALSE failed: A2 DL PER deadlock timer expired waiting for Apps ACK
--- drivers/soc/qcom/smsm.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/soc/qcom/smsm.c +8 -3
@@ -109,7 +109,7 @@ struct smsm_entry {DECLARE_BITMAP (irq_enabled,32 );DECLARE_BITMAP (irq_rising,32 );DECLARE_BITMAP (irq_falling,32 ); -u32 last_value; +unsigned long last_value;u32 *remote_state;u32 *subscription;
@@ -204,8 +204,7 @@ static irqreturn_t smsm_intr(int irq, void *data)u32 val; val =readl (entry->remote_state); - changed = val ^ entry->last_value; - entry->last_value = val; + changed = val ^xchg (&entry->last_value, val);for_each_set_bit (i, entry->irq_enabled,32 ) {if (!(changed &BIT (i)))
@@ -264,6 +263,12 @@ static void smsm_unmask_irq(struct irq_data *irqd)struct qcom_smsm *smsm = entry->smsm;u32 val; +/* Make sure our last cached state is up-to-date */ +if (readl (entry->remote_state) &BIT (irq)) +set_bit (irq, &entry->last_value); +else +clear_bit (irq, &entry->last_value); +set_bit (irq, entry->irq_enabled);if (entry->subscription) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 155/300 debugfs: Return error during {full/open}_proxy_open() on rmmod
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
[ Upstream commit 112cedc8e600b668688eb809bf11817adec58ddc ]
If a kernel module gets unloaded then it printed report about a leak before commit 275678e7a9be ("debugfs: Check module state before warning in {full/open}_proxy_open()"). An additional check was added in this commit to avoid this printing. But it was forgotten that the function must return an error in this case because it was not actually opened.
As result, the systems started to crash or to hang when a module was unloaded while something was trying to open a file.
--- fs/debugfs/file.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/debugfs/file.c +6 -2
@@ -179,8 +179,10 @@ static int open_proxy_open(struct inode *inode, struct file *filp)if (!fops_get (real_fops)) {#ifdef CONFIG_MODULES if (real_fops->owner && - real_fops->owner->state ==MODULE_STATE_GOING ) + real_fops->owner->state ==MODULE_STATE_GOING ) { + r = -ENXIO ; goto out; + }#endif /* Huh? Module did not clean up after itself at exit? */
@@ -314,8 +316,10 @@ static int full_proxy_open(struct inode *inode, struct file *filp)if (!fops_get (real_fops)) {#ifdef CONFIG_MODULES if (real_fops->owner && - real_fops->owner->state ==MODULE_STATE_GOING ) + real_fops->owner->state ==MODULE_STATE_GOING ) { + r = -ENXIO ; goto out; + }#endif /* Huh? Module did not cleanup after itself at exit? */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 156/300 Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 713baf3dae8f45dc8ada4ed2f5fdcbf94a5c274d ]
An earlier commit replaced using batostr to using %pMR sprintf for the construction of session->name. Static analysis detected that this new method can use a total of 21 characters (including the trailing '\0') so we need to increase the BTNAMSIZ from 18 to 21 to fix potential buffer overflows.
Addresses-Coverity: ("Out-of-bounds write")
--- net/bluetooth/cmtp/cmtp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/cmtp/cmtp.h +1 -1
@@ -26,7 +26,7 @@#include <linux/types.h> #include <net/bluetooth/bluetooth.h> -#define BTNAMSIZ 18 +#define BTNAMSIZ 21/* CMTP ioctl defines */ #define CMTPCONNADD _IOW('C', 200, int)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 157/300 net: ti: am65-cpsw-nuss: fix RX IRQ state after .ndo_stop()
In reply to Greg Kroah-HartmanFrom: Vignesh Raghavendra <[email protected]>
[ Upstream commit 47bfc4d128dedd9e828e33b70b87b591a6d59edf ]
On TI K3 am64x platform the issue with RX IRQ is observed - it's become disabled forever after .ndo_stop(). The K3 CPSW driver manipulates RX IRQ by using standard Linux enable_irq()/disable_irq_nosync() API as there is no IRQ enable/disable options in CPSW HW itself, as result during .ndo_stop() following sequence happens
phy_stop()
teardown TX/RX channels
wait for TX tdown complete
napi_disable(TX)
clean up TX channels
(a)
napi_disable(RX)
At point (a) it's not possible to predict if RX IRQ was triggered or not. if RX IRQ was triggered then it also not possible to definitely say if RX NAPI was run or only scheduled and immediately canceled by napi_disable(RX). Actually the last case causes RX IRQ to be permanently disabled.
Another observed issue is that RX IRQ enable counter become unbalanced if (gro_flush_timeout =! 0) while (napi_defer_hard_irqs == 0):
Unbalanced enable for IRQ 44
WARNING: CPU: 0 PID: 10 at ../kernel/irq/manage.c:776 __enable_irq+0x38/0x80 __enable_irq+0x38/0x80 enable_irq+0x54/0xb0 am65_cpsw_nuss_rx_poll+0x2f4/0x368 __napi_poll+0x34/0x1b8 net_rx_action+0xe4/0x220 _stext+0x11c/0x284 run_ksoftirqd+0x4c/0x60
To avoid above issues introduce flag indicating if RX was actually disabled before enabling it in am65_cpsw_nuss_rx_poll() and restore RX IRQ state in .ndo_open()
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 13 +++++++++++-- drivers/net/ethernet/ti/am65-cpsw-nuss.h | 2 ++ 2 files changed, 13 insertions(+), 2 deletions(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +11 -2
@@ -518,6 +518,10 @@ static int am65_cpsw_nuss_common_open(struct am65_cpsw_common *common, }napi_enable (&common->napi_rx); +if (common->rx_irq_disabled) { + common->rx_irq_disabled = false; +enable_irq (common->rx_chns.irq); + }dev_dbg (common->dev,"cpsw_nuss started\n" );return 0 ;
@@ -871,8 +875,12 @@ static int am65_cpsw_nuss_rx_poll(struct napi_struct *napi_rx, int budget)dev_dbg (common->dev,"%s num_rx:%d %d\n" , __func__, num_rx, budget); -if (num_rx < budget &&napi_complete_done (napi_rx, num_rx)) -enable_irq (common->rx_chns.irq); +if (num_rx < budget &&napi_complete_done (napi_rx, num_rx)) { +if (common->rx_irq_disabled) { + common->rx_irq_disabled = false; +enable_irq (common->rx_chns.irq); + } + }return num_rx; }
@@ -1090,6 +1098,7 @@ static irqreturn_t am65_cpsw_nuss_rx_irq(int irq, void *dev_id) {struct am65_cpsw_common *common = dev_id; + common->rx_irq_disabled = true;disable_irq_nosync (irq);napi_schedule (&common->napi_rx);
drivers/net/ethernet/ti/am65-cpsw-nuss.h +2 -0
@@ -126,6 +126,8 @@ struct am65_cpsw_common {struct am65_cpsw_rx_chn rx_chns;struct napi_struct napi_rx; +bool rx_irq_disabled; +u32 nuss_ver;u32 cpsw_ver;unsigned long bus_freq;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 158/300 net: dsa: stop syncing the bridge mcast_router attribute at join time
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 7df4e7449489d82cee6813dccbb4ae4f3f26ef7b ]
Qingfang points out that when a bridge with the default settings is created and a port joins it:
ip link add br0 type bridge
ip link set swp0 master br0
DSA calls br_multicast_router() on the bridge to see if the br0 device is a multicast router port, and if it is, it enables multicast flooding to the CPU port, otherwise it disables it.
If we look through the multicast_router_show() sysfs or at the IFLA_BR_MCAST_ROUTER netlink attribute, we see that the default mrouter attribute for the bridge device is "1" (MDB_RTR_TYPE_TEMP_QUERY).
However, br_multicast_router() will return "0" (MDB_RTR_TYPE_DISABLED), because an mrouter port in the MDB_RTR_TYPE_TEMP_QUERY state may not be actually _active_ until it receives an actual IGMP query. So, the br_multicast_router() function should really have been called br_multicast_router_active() perhaps.
When/if an IGMP query is received, the bridge device will transition via br_multicast_mark_router() into the active state until the ip4_mc_router_timer expires after an multicast_querier_interval.
Of course, this does not happen if the bridge is created with an mcast_router attribute of "2" (MDB_RTR_TYPE_PERM).
The point is that in lack of any IGMP query messages, and in the default bridge configuration, unregistered multicast packets will not be able to reach the CPU port through flooding, and this breaks many use cases (most obviously, IPv6 ND, with its ICMP6 neighbor solicitation multicast messages).
Leave the multicast flooding setting towards the CPU port down to a driver level decision.
--- net/dsa/port.c | 10 ---------- 1 file changed, 10 deletions(-)
net/dsa/port.c +0 -10
@@ -186,10 +186,6 @@ static int dsa_port_switchdev_sync(struct dsa_port *dp,if (err && err != -EOPNOTSUPP )return err; - err =dsa_port_mrouter (dp->cpu_dp,br_multicast_router (br), extack); -if (err && err != -EOPNOTSUPP ) -return err; - err =dsa_port_ageing_time (dp,br_get_ageing_time (br));if (err && err != -EOPNOTSUPP )return err;
@@ -235,12 +231,6 @@ static void dsa_port_switchdev_unsync(struct dsa_port *dp)/* VLAN filtering is handled by dsa_switch_bridge_leave */ -/* Some drivers treat the notification for having a local multicast -* router by allowing multicast to be flooded to the CPU, so we should -* allow this in standalone mode too. -*/ -dsa_port_mrouter (dp->cpu_dp, true,NULL ); -/* Ageing time may be global to the switch chip, so don't change it * here because we have no good reason (or value) to change it to. */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 159/300 net: dsa: mt7530: remove the .port_set_mrouter implementation
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit cbbf09b5771e6e9da268bc0d2fb6e428afa787bc ]
DSA's idea of optimizing out multicast flooding to the CPU port leaves quite a few holes open, so it should be reverted.
The mt7530 driver is the only new driver which added a .port_set_mrouter implementation after the reorg from commit a8b659e7ff75 ("net: dsa: act as passthrough for bridge port flags"), so it needs to be reverted separately so that the other revert commit can go a bit further down the git history.
--- drivers/net/dsa/mt7530.c | 13 ------------- 1 file changed, 13 deletions(-)
drivers/net/dsa/mt7530.c +0 -13
@@ -1172,18 +1172,6 @@ mt7530_port_bridge_flags(struct dsa_switch *ds, int port,return 0 ; } -static int -mt7530_port_set_mrouter (struct dsa_switch *ds,int port,bool mrouter, -struct netlink_ext_ack *extack) -{ -struct mt7530_priv *priv = ds->priv; - -mt7530_rmw (priv,MT7530_MFC ,UNM_FFP (BIT (port)), - mrouter ?UNM_FFP (BIT (port)) :0 ); - -return 0 ; -} -static int mt7530_port_bridge_join (struct dsa_switch *ds,int port,struct net_device *bridge)
@@ -2847,7 +2835,6 @@ static const struct dsa_switch_ops mt7530_switch_ops = { .port_stp_state_set = mt7530_stp_state_set, .port_pre_bridge_flags = mt7530_port_pre_bridge_flags, .port_bridge_flags = mt7530_port_bridge_flags, - .port_set_mrouter = mt7530_port_set_mrouter, .port_bridge_join = mt7530_port_bridge_join, .port_bridge_leave = mt7530_port_bridge_leave, .port_fdb_add = mt7530_port_fdb_add,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 160/300 net: dsa: dont disable multicast flooding to the CPU even without an IGMP querier
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit c73c57081b3d59aa99093fbedced32ea02620cd3 ]
Commit 08cc83cc7fd8 ("net: dsa: add support for BRIDGE_MROUTER attribute") added an option for users to turn off multicast flooding towards the CPU if they turn off the IGMP querier on a bridge which already has enslaved ports (echo 0 > /sys/class/net/br0/bridge/multicast_router).
And commit a8b659e7ff75 ("net: dsa: act as passthrough for bridge port flags") simply papered over that issue, because it moved the decision to flood the CPU with multicast (or not) from the DSA core down to individual drivers, instead of taking a more radical position then.
The truth is that disabling multicast flooding to the CPU is simply something we are not prepared to do now, if at all. Some reasons:
- ICMP6 neighbor solicitation messages are unregistered multicast packets as far as the bridge is concerned. So if we stop flooding multicast, the outside world cannot ping the bridge device's IPv6 link-local address.
- There might be foreign interfaces bridged with our DSA switch ports (sending a packet towards the host does not necessarily equal termination, but maybe software forwarding). So if there is no one interested in that multicast traffic in the local network stack, that doesn't mean nobody is.
- PTP over L4 (IPv4, IPv6) is multicast, but is unregistered as far as the bridge is concerned. This should reach the CPU port.
- The switch driver might not do FDB partitioning. And since we don't even bother to do more fine-grained flood disabling (such as "disable flooding _from_port_N_ towards the CPU port" as opposed to "disable flooding _from_any_port_ towards the CPU port"), this breaks standalone ports, or even multiple bridges where one has an IGMP querier and one doesn't.
Reverting the logic makes all of the above work.
--- drivers/net/dsa/b53/b53_common.c | 10 ---------- drivers/net/dsa/b53/b53_priv.h | 2 -- drivers/net/dsa/bcm_sf2.c | 1 - drivers/net/dsa/mv88e6xxx/chip.c | 18 ------------------ include/net/dsa.h | 2 -- net/dsa/dsa_priv.h | 2 -- net/dsa/port.c | 11 ----------- net/dsa/slave.c | 6 ------ 8 files changed, 52 deletions(-)
drivers/net/dsa/b53/b53_common.c +0 -10
@@ -1993,15 +1993,6 @@ int b53_br_flags(struct dsa_switch *ds, int port, }EXPORT_SYMBOL (b53_br_flags); -int b53_set_mrouter (struct dsa_switch *ds,int port,bool mrouter, -struct netlink_ext_ack *extack) -{ -b53_port_set_mcast_flood (ds->priv, port, mrouter); - -return 0 ; -} -EXPORT_SYMBOL (b53_set_mrouter); -static bool b53_possible_cpu_port (struct dsa_switch *ds,int port) {/* Broadcom switches will accept enabling Broadcom tags on the
@@ -2245,7 +2236,6 @@ static const struct dsa_switch_ops b53_switch_ops = { .port_bridge_leave = b53_br_leave, .port_pre_bridge_flags = b53_br_flags_pre, .port_bridge_flags = b53_br_flags, - .port_set_mrouter = b53_set_mrouter, .port_stp_state_set = b53_br_set_stp_state, .port_fast_age = b53_br_fast_age, .port_vlan_filtering = b53_vlan_filtering,
drivers/net/dsa/b53/b53_priv.h +0 -2
@@ -328,8 +328,6 @@ int b53_br_flags_pre(struct dsa_switch *ds, int port,int b53_br_flags (struct dsa_switch *ds,int port,struct switchdev_brport_flags flags,struct netlink_ext_ack *extack); -int b53_set_mrouter (struct dsa_switch *ds,int port,bool mrouter, -struct netlink_ext_ack *extack);int b53_setup_devlink_resources (struct dsa_switch *ds);void b53_port_event (struct dsa_switch *ds,int port); void b53_phylink_validate(struct dsa_switch *ds, int port,
drivers/net/dsa/bcm_sf2.c +0 -1
@@ -1199,7 +1199,6 @@ static const struct dsa_switch_ops bcm_sf2_ops = { .port_pre_bridge_flags = b53_br_flags_pre, .port_bridge_flags = b53_br_flags, .port_stp_state_set = b53_br_set_stp_state, - .port_set_mrouter = b53_set_mrouter, .port_fast_age = b53_br_fast_age, .port_vlan_filtering = b53_vlan_filtering, .port_vlan_add = b53_vlan_add,
drivers/net/dsa/mv88e6xxx/chip.c +0 -18
@@ -5781,23 +5781,6 @@ out:return err; } -static int mv88e6xxx_port_set_mrouter (struct dsa_switch *ds,int port, -bool mrouter, -struct netlink_ext_ack *extack) -{ -struct mv88e6xxx_chip *chip = ds->priv; -int err; - -if (!chip->info->ops->port_set_mcast_flood) -return -EOPNOTSUPP ; - -mv88e6xxx_reg_lock (chip); - err = chip->info->ops->port_set_mcast_flood (chip, port, mrouter); -mv88e6xxx_reg_unlock (chip); - -return err; -} -static bool mv88e6xxx_lag_can_offload (struct dsa_switch *ds,struct net_device *lag,struct netdev_lag_upper_info *info)
@@ -6099,7 +6082,6 @@ static const struct dsa_switch_ops mv88e6xxx_switch_ops = { .port_bridge_leave = mv88e6xxx_port_bridge_leave, .port_pre_bridge_flags = mv88e6xxx_port_pre_bridge_flags, .port_bridge_flags = mv88e6xxx_port_bridge_flags, - .port_set_mrouter = mv88e6xxx_port_set_mrouter, .port_stp_state_set = mv88e6xxx_port_stp_state_set, .port_fast_age = mv88e6xxx_port_fast_age, .port_vlan_filtering = mv88e6xxx_port_vlan_filtering,
include/net/dsa.h +0 -2
@@ -643,8 +643,6 @@ struct dsa_switch_ops {int (*port_bridge_flags)(struct dsa_switch *ds,int port,struct switchdev_brport_flags flags,struct netlink_ext_ack *extack); -int (*port_set_mrouter)(struct dsa_switch *ds,int port,bool mrouter, -struct netlink_ext_ack *extack);/* * VLAN support
net/dsa/dsa_priv.h +0 -2
@@ -211,8 +211,6 @@ int dsa_port_pre_bridge_flags(const struct dsa_port *dp,int dsa_port_bridge_flags (const struct dsa_port *dp,struct switchdev_brport_flags flags,struct netlink_ext_ack *extack); -int dsa_port_mrouter (struct dsa_port *dp,bool mrouter, -struct netlink_ext_ack *extack);int dsa_port_vlan_add (struct dsa_port *dp,const struct switchdev_obj_port_vlan *vlan,struct netlink_ext_ack *extack);
net/dsa/port.c +0 -11
@@ -545,17 +545,6 @@ int dsa_port_bridge_flags(const struct dsa_port *dp,return ds->ops->port_bridge_flags (ds, dp->index, flags, extack); } -int dsa_port_mrouter (struct dsa_port *dp,bool mrouter, -struct netlink_ext_ack *extack) -{ -struct dsa_switch *ds = dp->ds; - -if (!ds->ops->port_set_mrouter) -return -EOPNOTSUPP ; - -return ds->ops->port_set_mrouter (ds, dp->index, mrouter, extack); -} -int dsa_port_mtu_change (struct dsa_port *dp,int new_mtu,bool propagate_upstream) {
net/dsa/slave.c +0 -6
@@ -311,12 +311,6 @@ static int dsa_slave_port_attr_set(struct net_device *dev, ret =dsa_port_bridge_flags (dp, attr->u.brport_flags, extack);break ; -case SWITCHDEV_ATTR_ID_BRIDGE_MROUTER : -if (!dsa_port_offloads_bridge (dp, attr->orig_dev)) -return -EOPNOTSUPP ; - - ret =dsa_port_mrouter (dp->cpu_dp, attr->u.mrouter, extack); -break ;default : ret = -EOPNOTSUPP ;break ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 161/300 PM: EM: Increase energy calculation precision
In reply to Greg Kroah-HartmanFrom: Lukasz Luba <[email protected]>
[ Upstream commit 7fcc17d0cb12938d2b3507973a6f93fc9ed2c7a1 ]
The Energy Model (EM) provides useful information about device power in each performance state to other subsystems like: Energy Aware Scheduler (EAS). The energy calculation in EAS does arithmetic operation based on the EM em_cpu_energy(). Current implementation of that function uses em_perf_state::cost as a pre-computed cost coefficient equal to:
cost = power * max_frequency / frequency.
The 'power' is expressed in milli-Watts (or in abstract scale).
There are corner cases when the EAS energy calculation for two Performance Domains (PDs) return the same value. The EAS compares these values to choose smaller one. It might happen that this values are equal due to rounding error. In such scenario, we need better resolution, e.g. 1000 times better. To provide this possibility increase the resolution in the em_perf_state::cost for 64-bit architectures. The cost of increasing resolution on 32-bit is pretty high (64-bit division) and is not justified since there are no new 32bit big.LITTLE EAS systems expected which would benefit from this higher resolution.
This patch allows to avoid the rounding to milli-Watt errors, which might occur in EAS energy estimation for each PD. The rounding error is common for small tasks which have small utilization value.
There are two places in the code where it makes a difference:
1. In the find_energy_efficient_cpu() where we are searching for best_delta. We might suffer there when two PDs return the same result, like in the example below.
Scenario:
Low utilized system e.g. ~200 sum_util for PD0 and ~220 for PD1. There are quite a few small tasks ~10-15 util. These tasks would suffer for the rounding error. These utilization values are typical when running games on Android. One of our partners has reported 5..10mA less battery drain when running with increased resolution.
Some details:
We have two PDs: PD0 (big) and PD1 (little)
Let's compare w/o patch set ('old') and w/ patch set ('new') We are comparing energy w/ task and w/o task placed in the PDs
a) 'old' w/o patch set, PD0task_util = 13
cost = 480
sum_util_w/o_task = 215sum_util_w_task = 228scale_cpu = 1024
energy_w/o_task = 480 * 215 / 1024 = 100.78 => 100 energy_w_task = 480 * 228 / 1024 = 106.87 => 106 energy_diff = 106 - 100 = 6
(this is equal to 'old' PD1's energy_diff in 'c)')
b) 'new' w/ patch set, PD0task_util = 13
cost = 480 * 1000 = 480000
sum_util_w/o_task = 215sum_util_w_task = 228
energy_w/o_task = 480000 * 215 / 1024 = 100781 energy_w_task = 480000 * 228 / 1024 = 106875 energy_diff = 106875 - 100781 = 6094
(this is not equal to 'new' PD1's energy_diff in 'd)')
c) 'old' w/o patch set, PD1task_util = 13
cost = 160
sum_util_w/o_task = 283sum_util_w_task = 293scale_cpu = 355
energy_w/o_task = 160 * 283 / 355 = 127.55 => 127 energy_w_task = 160 * 296 / 355 = 133.41 => 133 energy_diff = 133 - 127 = 6
(this is equal to 'old' PD0's energy_diff in 'a)')
d) 'new' w/ patch set, PD1task_util = 13
cost = 160 * 1000 = 160000
sum_util_w/o_task = 283sum_util_w_task = 293scale_cpu = 355
energy_w/o_task = 160000 * 283 / 355 = 127549energy_w_task = 160000 * 296 / 355 = 133408energy_diff = 133408 - 127549 = 5859
(this is not equal to 'new' PD0's energy_diff in 'b)')
2. Difference in the 6% energy margin filter at the end of find_energy_efficient_cpu(). With this patch the margin comparison also has better resolution, so it's possible to have better task placement thanks to that.
--- include/linux/energy_model.h | 16 ++++++++++++++++ kernel/power/energy_model.c | 4 +++- 2 files changed, 19 insertions(+), 1 deletion(-)
include/linux/energy_model.h +16 -0
@@ -53,6 +53,22 @@ struct em_perf_domain {#ifdef CONFIG_ENERGY_MODEL #define EM_MAX_POWER 0xFFFF +/* +* Increase resolution of energy estimation calculations for 64-bit +* architectures. The extra resolution improves decision made by EAS for the +* task placement when two Performance Domains might provide similar energy +* estimation values (w/o better resolution the values could be equal). +* +* We increase resolution only if we have enough bits to allow this increased +* resolution (i.e. 64-bit). The costs for increasing resolution when 32-bit +* are pretty high and the returns do not justify the increased costs. +*/ +#ifdef CONFIG_64BIT +#define em_scale_power (p) ((p) * 1000) +#else +#define em_scale_power (p) (p) +#endif + struct em_data_callback {/** * active_power() - Provide power at the next performance state of
kernel/power/energy_model.c +3 -1
@@ -170,7 +170,9 @@ static int em_create_perf_table(struct device *dev, struct em_perf_domain *pd,/* Compute the cost of each performance state. */ fmax = (u64 ) table[nr_states -1 ].frequency;for (i =0 ; i < nr_states; i++) { - table[i].cost =div64_u64 (fmax * table[i].power, +unsigned long power_res =em_scale_power (table[i].power); + + table[i].cost =div64_u64 (fmax * power_res, table[i].frequency); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 162/300 selftests/bpf: Fix bpf-iter-tcp4 test to print correctly the dest IP
In reply to Greg Kroah-HartmanFrom: Jose Blanquicet <[email protected]>
[ Upstream commit 277b134057036df8c657079ca92c3e5e7d10aeaf ]
Currently, this test is incorrectly printing the destination port in place of the destination IP.
--- tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c +1 -1
@@ -122,7 +122,7 @@ static int dump_tcp_sock(struct seq_file *seq, struct tcp_sock *tp, }BPF_SEQ_PRINTF (seq,"%4d: %08X:%04X %08X:%04X " , - seq_num, src, srcp, destp, destp); + seq_num, src, srcp, dest, destp); BPF_SEQ_PRINTF(seq, "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d ", state, tp->write_seq - tp->snd_una, rx_queue,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 163/300 leds: lgm-sso: Propagate error codes from callee to caller
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 9cbc861095375793a69858f91f3ac4e817f320f0 ]
The one of the latest change to the driver reveals the problem that the error codes from callee aren't propagated to the caller of __sso_led_dt_parse(). Fix this accordingly.
--- drivers/leds/blink/leds-lgm-sso.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/leds/blink/leds-lgm-sso.c +8 -4
@@ -643,7 +643,7 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled) fwnode_child, GPIOD_ASIS, NULL);if (IS_ERR (led->gpiod)) { -dev_err_probe (dev,PTR_ERR (led->gpiod),"led: get gpio fail!\n" ); + ret =dev_err_probe (dev,PTR_ERR (led->gpiod),"led: get gpio fail!\n" ); goto __dt_err; }
@@ -663,8 +663,11 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled) desc->panic_indicator =1 ; ret =fwnode_property_read_u32 (fwnode_child,"reg" , &prop); -if (ret !=0 || prop >=SSO_LED_MAX_NUM ) { +if (ret) + goto __dt_err; +if (prop >=SSO_LED_MAX_NUM ) {dev_err (dev,"invalid LED pin:%u\n" , prop); + ret = -EINVAL ; goto __dt_err; } desc->pin = prop;
@@ -700,7 +703,8 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled) desc->brightness =LED_FULL ; } -if (sso_create_led (priv, led, fwnode_child)) + ret =sso_create_led (priv, led, fwnode_child); +if (ret) goto __dt_err; }
@@ -714,7 +718,7 @@ __dt_err:sso_led_shutdown (led); } -return -EINVAL ; +return ret; }static int sso_led_dt_parse (struct sso_led_priv *priv)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 164/300 drm/msm/mdp4: refactor HW revision detection into read_mdp_hw_revision
In reply to Greg Kroah-HartmanFrom: David Heidelberg <[email protected]>
[ Upstream commit 4d319afe666b0fc9a9855ba9bdf9ae3710ecf431 ]
Inspired by MDP5 code.
Also use DRM_DEV_INFO for MDP version as MDP5 does.
Cosmetic change: uint32_t -> u32 - checkpatch suggestion.
--- drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 27 ++++++++++++++++-------- 1 file changed, 18 insertions(+), 9 deletions(-)
drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +18 -9
@@ -19,20 +19,13 @@ static int mdp4_hw_init(struct msm_kms *kms) {struct mdp4_kms *mdp4_kms =to_mdp4_kms (to_mdp_kms (kms));struct drm_device *dev = mdp4_kms->dev; -uint32_t version, major, minor, dmap_cfg, vg_cfg; +u32 major, minor, dmap_cfg, vg_cfg;unsigned long clk;int ret =0 ;pm_runtime_get_sync (dev->dev); -mdp4_enable (mdp4_kms); - version =mdp4_read (mdp4_kms,REG_MDP4_VERSION ); -mdp4_disable (mdp4_kms); - - major =FIELD (version,MDP4_VERSION_MAJOR ); - minor =FIELD (version,MDP4_VERSION_MINOR ); - -DBG ("found MDP4 version v%d.%d" , major, minor); +read_mdp_hw_revision (mdp4_kms, &major, &minor);if (major !=4 ) { DRM_DEV_ERROR(dev->dev, "unexpected MDP version: v%d.%d\n",
@@ -411,6 +404,22 @@ fail:return ret; } +static void read_mdp_hw_revision (struct mdp4_kms *mdp4_kms, +u32 *major,u32 *minor) +{ +struct drm_device *dev = mdp4_kms->dev; +u32 version; + +mdp4_enable (mdp4_kms); + version =mdp4_read (mdp4_kms,REG_MDP4_VERSION ); +mdp4_disable (mdp4_kms); + + *major =FIELD (version,MDP4_VERSION_MAJOR ); + *minor =FIELD (version,MDP4_VERSION_MINOR ); + +DRM_DEV_INFO (dev->dev,"MDP4 version v%d.%d" , *major, *minor); +} +struct msm_kms *mdp4_kms_init (struct drm_device *dev) {struct platform_device *pdev =to_platform_device (dev->dev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 165/300 drm/msm/mdp4: move HW revision detection to earlier phase
In reply to Greg Kroah-HartmanFrom: David Heidelberg <[email protected]>
[ Upstream commit 4af4fc92939dc811ef291c0673946555aa4fb71f ]
Fixes if condition, which never worked inside mdp4_kms_init, since HW detection has been done later in mdp4_hw_init.
--- drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 45 ++++++++++++------------ 1 file changed, 22 insertions(+), 23 deletions(-)
drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +22 -23
@@ -19,23 +19,12 @@ static int mdp4_hw_init(struct msm_kms *kms) {struct mdp4_kms *mdp4_kms =to_mdp4_kms (to_mdp_kms (kms));struct drm_device *dev = mdp4_kms->dev; -u32 major, minor, dmap_cfg, vg_cfg; +u32 dmap_cfg, vg_cfg;unsigned long clk;int ret =0 ;pm_runtime_get_sync (dev->dev); -read_mdp_hw_revision (mdp4_kms, &major, &minor); - -if (major !=4 ) { -DRM_DEV_ERROR (dev->dev,"unexpected MDP version: v%d.%d\n" , - major, minor); - ret = -ENXIO ; - goto out; - } - - mdp4_kms->rev = minor; -if (mdp4_kms->rev >1 ) {mdp4_write (mdp4_kms,REG_MDP4_CS_CONTROLLER0 ,0x0707ffff );mdp4_write (mdp4_kms,REG_MDP4_CS_CONTROLLER1 ,0x03073f3f );
@@ -81,7 +70,6 @@ static int mdp4_hw_init(struct msm_kms *kms)if (mdp4_kms->rev >1 )mdp4_write (mdp4_kms,REG_MDP4_RESET_STATUS ,1 ); -out:pm_runtime_put_sync (dev->dev);return ret;
@@ -428,6 +416,7 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev)struct msm_kms *kms =NULL ;struct msm_gem_address_space *aspace;int irq, ret; +u32 major, minor; mdp4_kms =kzalloc (sizeof (*mdp4_kms),GFP_KERNEL );if (!mdp4_kms) {
@@ -488,15 +477,6 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev)if (IS_ERR (mdp4_kms->pclk)) mdp4_kms->pclk =NULL ; -if (mdp4_kms->rev >=2 ) { - mdp4_kms->lut_clk =devm_clk_get (&pdev->dev,"lut_clk" ); -if (IS_ERR (mdp4_kms->lut_clk)) { -DRM_DEV_ERROR (dev->dev,"failed to get lut_clk\n" ); - ret =PTR_ERR (mdp4_kms->lut_clk); - goto fail; - } - } - mdp4_kms->axi_clk =devm_clk_get (&pdev->dev,"bus_clk" );if (IS_ERR (mdp4_kms->axi_clk)) {DRM_DEV_ERROR (dev->dev,"failed to get axi_clk\n" );
@@ -505,8 +485,27 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev) }clk_set_rate (mdp4_kms->clk, config->max_clk); -if (mdp4_kms->lut_clk) + +read_mdp_hw_revision (mdp4_kms, &major, &minor); + +if (major !=4 ) { +DRM_DEV_ERROR (dev->dev,"unexpected MDP version: v%d.%d\n" , + major, minor); + ret = -ENXIO ; + goto fail; + } + + mdp4_kms->rev = minor; + +if (mdp4_kms->rev >=2 ) { + mdp4_kms->lut_clk =devm_clk_get (&pdev->dev,"lut_clk" ); +if (IS_ERR (mdp4_kms->lut_clk)) { +DRM_DEV_ERROR (dev->dev,"failed to get lut_clk\n" ); + ret =PTR_ERR (mdp4_kms->lut_clk); + goto fail; + }clk_set_rate (mdp4_kms->lut_clk, config->max_clk); + }pm_runtime_enable (dev->dev); mdp4_kms->rpm_enabled = true;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 166/300 drm/msm/dp: update is_connected status base on sink count at dp_pm_resume()
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit e8a767e04dbc7b201cb17ab99dca723a3488b6d4 ]
Currently at dp_pm_resume() is_connected state is decided base on hpd connection status only. This will put is_connected in wrongly "true" state at the scenario that dongle attached to DUT but without hmdi cable connecting to it. Fix this problem by adding read sink count from dongle and decided is_connected state base on both sink count and hpd connection status.
Changes in v2:
-- remove dp_get_sink_count() cand call drm_dp_read_sink_count()
Changes in v3:
-- delete status local variable from dp_pm_resume()
Changes in v4:
-- delete un necessary comment at dp_pm_resume()
--- drivers/gpu/drm/msm/dp/dp_display.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +14 -3
@@ -1286,7 +1286,7 @@ static int dp_pm_resume(struct device *dev)struct platform_device *pdev =to_platform_device (dev);struct msm_dp *dp_display =platform_get_drvdata (pdev);struct dp_display_private *dp; -u32 status; +int sink_count =0 ; dp = container_of(dp_display, struct dp_display_private, dp_display);
@@ -1300,14 +1300,25 @@ static int dp_pm_resume(struct device *dev)dp_catalog_ctrl_hpd_config (dp->catalog); - status =dp_catalog_link_is_connected (dp->catalog); +/* +* set sink to normal operation mode -- D0 +* before dpcd read +*/ +dp_link_psm_config (dp->link, &dp->panel->link_info, false); + +if (dp_catalog_link_is_connected (dp->catalog)) { + sink_count =drm_dp_read_sink_count (dp->aux); +if (sink_count <0 ) + sink_count =0 ; + } + dp->link->sink_count = sink_count;/* * can not declared display is connected unless * HDMI cable is plugged in and sink_count of * dongle become 1 */ -if (status && dp->link->sink_count) +if (dp->link->sink_count) dp->dp_display.is_connected = true;else dp->dp_display.is_connected = false;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 167/300 drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit a41cdb693595ae1904dd793fc15d6954f4295e27 ]
dpu_hw_ctl_clear_all_blendstages() clears settings for the few first LMs instead of mixers actually used for the CTL. Change it to clear necessary data, using provided mixer ids.
--- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c +6 -4
@@ -345,10 +345,12 @@ static void dpu_hw_ctl_clear_all_blendstages(struct dpu_hw_ctl *ctx)int i;for (i =0 ; i < ctx->mixer_count; i++) { -DPU_REG_WRITE (c,CTL_LAYER (LM_0 + i),0 ); -DPU_REG_WRITE (c,CTL_LAYER_EXT (LM_0 + i),0 ); -DPU_REG_WRITE (c,CTL_LAYER_EXT2 (LM_0 + i),0 ); -DPU_REG_WRITE (c,CTL_LAYER_EXT3 (LM_0 + i),0 ); +enum dpu_lm mixer_id = ctx->mixer_hw_caps[i].id; + +DPU_REG_WRITE (c,CTL_LAYER (mixer_id),0 ); +DPU_REG_WRITE (c,CTL_LAYER_EXT (mixer_id),0 ); +DPU_REG_WRITE (c,CTL_LAYER_EXT2 (mixer_id),0 ); +DPU_REG_WRITE (c,CTL_LAYER_EXT3 (mixer_id),0 ); }DPU_REG_WRITE (c,CTL_FETCH_PIPE_ACTIVE ,0 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 168/300 arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 01c72cad790cb6cd3ccbe4c1402b6cb6c6bbffd0 ]
The GIC-400 CPU interfaces address range is defined as 0x2000-0x3FFF (by ARM).
--- arch/arm64/boot/dts/exynos/exynos7.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/exynos/exynos7.dtsi +1 -1
@@ -102,7 +102,7 @@ #address-cells = <0>; interrupt-controller; reg = <0x11001000 0x1000>, - <0x11002000 0x1000>, + <0x11002000 0x2000>, <0x11004000 0x2000>, <0x11006000 0x2000>; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 169/300 counter: 104-quad-8: Return error when invalid mode during ceiling_write
In reply to Greg Kroah-HartmanFrom: William Breathitt Gray <[email protected]>
[ Upstream commit 728246e8f7269ecd35a2c6e6795323e6d8f48db7 ]
The 104-QUAD-8 only has two count modes where a ceiling value makes
sense: Range Limit and Modulo-N. Outside of these two modes, setting a ceiling value is an invalid operation -- so let's report it as such by returning -EINVAL.
--- drivers/counter/104-quad-8.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/counter/104-quad-8.c +3 -2
@@ -715,12 +715,13 @@ static ssize_t quad8_count_ceiling_write(struct counter_device *counter,case 1 :case 3 :quad8_preset_register_set (priv, count->id, ceiling); -break ; +mutex_unlock (&priv->lock); +return len; }mutex_unlock (&priv->lock); -return len; +return -EINVAL ; } static ssize_t quad8_count_preset_enable_read(struct counter_device *counter,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 170/300 cgroup/cpuset: Miscellaneous code cleanup
In reply to Greg Kroah-HartmanFrom: Waiman Long <[email protected]>
[ Upstream commit 0f3adb8a1e5f36e792598c1d77a2cfac9c90a4f9 ]
Use more descriptive variable names for update_prstate(), remove unnecessary code and fix some typos. There is no functional change.
--- kernel/cgroup/cpuset.c | 40 +++++++++++++++++++--------------------- 1 file changed, 19 insertions(+), 21 deletions(-)
kernel/cgroup/cpuset.c +19 -21
@@ -1114,7 +1114,7 @@ enum subparts_cmd {* cpus_allowed can be granted or an error code will be returned. * * For partcmd_disable, the cpuset is being transofrmed from a partition -* root back to a non-partition root. any CPUs in cpus_allowed that are in +* root back to a non-partition root. Any CPUs in cpus_allowed that are in * parent's subparts_cpus will be taken away from that cpumask and put back * into parent's effective_cpus. 0 should always be returned. *
@@ -1225,7 +1225,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,/* * partcmd_update w/o newmask: * -* addmask = cpus_allowed & parent->effectiveb_cpus +* addmask = cpus_allowed & parent->effective_cpus * * Note that parent's subparts_cpus may have been * pre-shrunk in case there is a change in the cpu list.
@@ -1365,12 +1365,12 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)case PRS_DISABLED :/* * If parent is not a partition root or an -* invalid partition root, clear the state -* state and the CS_CPU_EXCLUSIVE flag. +* invalid partition root, clear its state +* and its CS_CPU_EXCLUSIVE flag. */ WARN_ON_ONCE (cp->partition_root_state !=PRS_ERROR ); - cp->partition_root_state =0 ; + cp->partition_root_state =PRS_DISABLED ;/* * clear_bit() is an atomic operation and
@@ -1937,30 +1937,28 @@ out:/* * update_prstate - update partititon_root_state -* cs: the cpuset to update -* val: 0 - disabled, 1 - enabled +* cs: the cpuset to update +* new_prs: new partition root state * * Call with cpuset_mutex held. */ -static int update_prstate (struct cpuset *cs,int val) +static int update_prstate (struct cpuset *cs,int new_prs) {int err;struct cpuset *parent =parent_cs (cs); -struct tmpmasks tmp; +struct tmpmasks tmpmask; -if ((val !=0 ) && (val !=1 )) -return -EINVAL ; -if (val == cs->partition_root_state) +if (new_prs == cs->partition_root_state)return 0 ;/* * Cannot force a partial or invalid partition root to a full * partition root. */ -if (val && cs->partition_root_state) +if (new_prs && (cs->partition_root_state <0 ))return -EINVAL ; -if (alloc_cpumasks (NULL , &tmp)) +if (alloc_cpumasks (NULL , &tmpmask))return -ENOMEM ; err = -EINVAL ;
@@ -1978,7 +1976,7 @@ static int update_prstate(struct cpuset *cs, int val) goto out; err =update_parent_subparts_cpumask (cs, partcmd_enable, -NULL , &tmp); +NULL , &tmpmask);if (err) {update_flag (CS_CPU_EXCLUSIVE , cs,0 ); goto out;
@@ -1990,18 +1988,18 @@ static int update_prstate(struct cpuset *cs, int val)* CS_CPU_EXCLUSIVE bit. */ if (cs->partition_root_state ==PRS_ERROR ) { - cs->partition_root_state =0 ; + cs->partition_root_state =PRS_DISABLED ;update_flag (CS_CPU_EXCLUSIVE , cs,0 ); err =0 ; goto out; } err =update_parent_subparts_cpumask (cs, partcmd_disable, -NULL , &tmp); +NULL , &tmpmask);if (err) goto out; - cs->partition_root_state =0 ; + cs->partition_root_state =PRS_DISABLED ;/* Turning off CS_CPU_EXCLUSIVE will not return error */ update_flag (CS_CPU_EXCLUSIVE , cs,0 );
@@ -2015,11 +2013,11 @@ static int update_prstate(struct cpuset *cs, int val)update_tasks_cpumask (parent);if (parent->child_ecpus_count) -update_sibling_cpumasks (parent, cs, &tmp); +update_sibling_cpumasks (parent, cs, &tmpmask);rebuild_sched_domains_locked (); out: -free_cpumasks (NULL , &tmp); +free_cpumasks (NULL , &tmpmask);return err; }
@@ -3060,7 +3058,7 @@ retry: goto retry; } - parent =parent_cs (cs); + parent =parent_cs (cs);compute_effective_cpumask (&new_cpus, cs, parent);nodes_and (new_mems, cs->mems_allowed, parent->effective_mems);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 171/300 cgroup/cpuset: Fix violation of cpuset locking rule
In reply to Greg Kroah-HartmanFrom: Waiman Long <[email protected]>
[ Upstream commit 6ba34d3c73674e46d9e126e4f0cee79e5ef2481c ]
The cpuset fields that manage partition root state do not strictly follow the cpuset locking rule that update to cpuset has to be done with both the callback_lock and cpuset_mutex held. This is now fixed by making sure that the locking rule is upheld.
--- kernel/cgroup/cpuset.c | 58 +++++++++++++++++++++++++----------------- 1 file changed, 35 insertions(+), 23 deletions(-)
kernel/cgroup/cpuset.c +35 -23
@@ -1148,6 +1148,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,struct cpuset *parent =parent_cs (cpuset);int adding;/* Moving cpus from effective_cpus to subparts_cpus */ int deleting;/* Moving cpus from subparts_cpus to effective_cpus */ +int new_prs;bool part_error = false;/* Partition error? */ percpu_rwsem_assert_held (&cpuset_rwsem);
@@ -1183,6 +1184,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,* A cpumask update cannot make parent's effective_cpus become empty. */ adding = deleting = false; + new_prs = cpuset->partition_root_state;if (cmd == partcmd_enable) {cpumask_copy (tmp->addmask, cpuset->cpus_allowed); adding = true;
@@ -1247,11 +1249,11 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,switch (cpuset->partition_root_state) {case PRS_ENABLED :if (part_error) - cpuset->partition_root_state =PRS_ERROR ; + new_prs =PRS_ERROR ;break ;case PRS_ERROR :if (!part_error) - cpuset->partition_root_state =PRS_ENABLED ; + new_prs =PRS_ENABLED ;break ; }/*
@@ -1260,10 +1262,10 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd, part_error = (prev_prs ==PRS_ERROR ); } -if (!part_error && (cpuset->partition_root_state ==PRS_ERROR )) +if (!part_error && (new_prs ==PRS_ERROR ))return 0 ;/* Nothing need to be done */ -if (cpuset->partition_root_state ==PRS_ERROR ) { +if (new_prs ==PRS_ERROR ) {/* * Remove all its cpus from parent's subparts_cpus. */
@@ -1272,7 +1274,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd, parent->subparts_cpus); } -if (!adding && !deleting) +if (!adding && !deleting && (new_prs == cpuset->partition_root_state))return 0 ;/*
@@ -1299,6 +1301,9 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd, } parent->nr_subparts_cpus =cpumask_weight (parent->subparts_cpus); + +if (cpuset->partition_root_state != new_prs) + cpuset->partition_root_state = new_prs;spin_unlock_irq (&callback_lock);return cmd == partcmd_update;
@@ -1321,6 +1326,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)struct cpuset *cp;struct cgroup_subsys_state *pos_css;bool need_rebuild_sched_domains = false; +int new_prs;rcu_read_lock ();cpuset_for_each_descendant_pre (cp, pos_css, cs) {
@@ -1360,7 +1366,8 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)* update_tasks_cpumask() again for tasks in the parent * cpuset if the parent's subparts_cpus changes. */ -if ((cp != cs) && cp->partition_root_state) { + new_prs = cp->partition_root_state; +if ((cp != cs) && new_prs) {switch (parent->partition_root_state) {case PRS_DISABLED :/*
@@ -1370,7 +1377,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)*/ WARN_ON_ONCE (cp->partition_root_state !=PRS_ERROR ); - cp->partition_root_state =PRS_DISABLED ; + new_prs =PRS_DISABLED ;/* * clear_bit() is an atomic operation and
@@ -1391,11 +1398,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)/* * When parent is invalid, it has to be too. */ - cp->partition_root_state =PRS_ERROR ; -if (cp->nr_subparts_cpus) { - cp->nr_subparts_cpus =0 ; -cpumask_clear (cp->subparts_cpus); - } + new_prs =PRS_ERROR ;break ; } }
@@ -1407,8 +1410,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)spin_lock_irq (&callback_lock);cpumask_copy (cp->effective_cpus, tmp->new_cpus); -if (cp->nr_subparts_cpus && - (cp->partition_root_state !=PRS_ENABLED )) { +if (cp->nr_subparts_cpus && (new_prs !=PRS_ENABLED )) { cp->nr_subparts_cpus =0 ;cpumask_clear (cp->subparts_cpus); }else if (cp->nr_subparts_cpus) {
@@ -1435,6 +1437,10 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp) = cpumask_weight(cp->subparts_cpus); } } + +if (new_prs != cp->partition_root_state) + cp->partition_root_state = new_prs; +spin_unlock_irq (&callback_lock); WARN_ON(!is_in_v2_mode() &&
@@ -1944,25 +1950,25 @@ out:*/ static int update_prstate (struct cpuset *cs,int new_prs) { -int err; +int err, old_prs = cs->partition_root_state;struct cpuset *parent =parent_cs (cs);struct tmpmasks tmpmask; -if (new_prs == cs->partition_root_state) +if (old_prs == new_prs)return 0 ;/* * Cannot force a partial or invalid partition root to a full * partition root. */ -if (new_prs && (cs->partition_root_state <0 )) +if (new_prs && (old_prs ==PRS_ERROR ))return -EINVAL ;if (alloc_cpumasks (NULL , &tmpmask))return -ENOMEM ; err = -EINVAL ; -if (!cs->partition_root_state) { +if (!old_prs) {/* * Turning on partition root requires setting the * CS_CPU_EXCLUSIVE bit implicitly as well and cpus_allowed
@@ -1981,14 +1987,12 @@ static int update_prstate(struct cpuset *cs, int new_prs)update_flag (CS_CPU_EXCLUSIVE , cs,0 ); goto out; } - cs->partition_root_state =PRS_ENABLED ; }else {/* * Turning off partition root will clear the * CS_CPU_EXCLUSIVE bit. */ -if (cs->partition_root_state ==PRS_ERROR ) { - cs->partition_root_state =PRS_DISABLED ; +if (old_prs ==PRS_ERROR ) {update_flag (CS_CPU_EXCLUSIVE , cs,0 ); err =0 ; goto out;
@@ -1999,8 +2003,6 @@ static int update_prstate(struct cpuset *cs, int new_prs)if (err) goto out; - cs->partition_root_state =PRS_DISABLED ; -/* Turning off CS_CPU_EXCLUSIVE will not return error */ update_flag (CS_CPU_EXCLUSIVE , cs,0 ); }
@@ -2017,6 +2019,12 @@ static int update_prstate(struct cpuset *cs, int new_prs)rebuild_sched_domains_locked (); out: +if (!err) { +spin_lock_irq (&callback_lock); + cs->partition_root_state = new_prs; +spin_unlock_irq (&callback_lock); + } +free_cpumasks (NULL , &tmpmask);return err; }
@@ -3080,8 +3088,10 @@ retry:if (is_partition_root (cs) && (cpumask_empty (&new_cpus) || (parent->partition_root_state ==PRS_ERROR ))) {if (cs->nr_subparts_cpus) { +spin_lock_irq (&callback_lock); cs->nr_subparts_cpus =0 ;cpumask_clear (cs->subparts_cpus); +spin_unlock_irq (&callback_lock);compute_effective_cpumask (&new_cpus, cs, parent); }
@@ -3095,7 +3105,9 @@ retry: cpumask_empty(&new_cpus)) {update_parent_subparts_cpumask (cs, partcmd_disable,NULL , tmp); +spin_lock_irq (&callback_lock); cs->partition_root_state =PRS_ERROR ; +spin_unlock_irq (&callback_lock); }cpuset_force_rebuild (); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 172/300 ASoC: Intel: Fix platform ID matching
In reply to Greg Kroah-HartmanFrom: Curtis Malainey <[email protected]>
[ Upstream commit f4eeaed04e861b95f1f2c911263f2fcaa959c078 ]
Sparse warnings triggered truncating the IDs of some platform device tables. Unfortunately some of the IDs in the match tables were missed which breaks audio. The KBL change has been verified to fix audio, the CML change was not tested as it was found through grepping the broken changes and found to match the same situation in anticipation that it should also be fixed.
--- sound/soc/intel/common/soc-acpi-intel-cml-match.c | 2 +- sound/soc/intel/common/soc-acpi-intel-kbl-match.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
sound/soc/intel/common/soc-acpi-intel-cml-match.c +1 -1
@@ -75,7 +75,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_cml_machines[] = { }, { .id = "DLGS7219", - .drv_name = "cml_da7219_max98357a", + .drv_name = "cml_da7219_mx98357a", .machine_quirk = snd_soc_acpi_codec_list, .quirk_data = &max98390_spk_codecs, .sof_fw_filename = "sof-cml.ri",
sound/soc/intel/common/soc-acpi-intel-kbl-match.c +1 -1
@@ -87,7 +87,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_kbl_machines[] = { }, { .id = "DLGS7219", - .drv_name = "kbl_da7219_max98357a", + .drv_name = "kbl_da7219_mx98357a", .fw_filename = "intel/dsp_fw_kbl.bin", .machine_quirk = snd_soc_acpi_codec_list, .quirk_data = &kbl_7219_98357_codecs,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 173/300 Bluetooth: fix repeated calls to sco_sock_kill
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
[ Upstream commit e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 ]
In commit 4e1a720d0312 ("Bluetooth: avoid killing an already killed socket"), a check was added to sco_sock_kill to skip killing a socket if the SOCK_DEAD flag was set.
This was done after a trace for a use-after-free bug showed that the same sock pointer was being killed twice.
Unfortunately, this check prevents sco_sock_kill from running on any socket. sco_sock_kill kills a socket only if it's zapped and orphaned, however sock_orphan announces that the socket is dead before detaching it. i.e., orphaned sockets have the SOCK_DEAD flag set.
To fix this, we remove the check for SOCK_DEAD, and avoid repeated calls to sco_sock_kill by removing incorrect calls in:
1. sco_sock_timeout. The socket should not be killed on timeout as further processing is expected to be done. For example, sco_sock_connect sets the timer then waits for the socket to be connected or for an error to be returned.
2. sco_conn_del. This function should clean up resources for the connection, but the socket itself should be cleaned up in sco_sock_release.
3. sco_sock_close. Calls to sco_sock_close in sco_sock_cleanup_listen and sco_sock_release are followed by sco_sock_kill. Hence the duplicated call should be removed.
--- net/bluetooth/sco.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/bluetooth/sco.c +1 -5
@@ -85,7 +85,6 @@ static void sco_sock_timeout(struct timer_list *t) sk->sk_state_change (sk);bh_unlock_sock (sk); -sco_sock_kill (sk);sock_put (sk); }
@@ -177,7 +176,6 @@ static void sco_conn_del(struct hci_conn *hcon, int err)sco_sock_clear_timer (sk);sco_chan_del (sk, err);bh_unlock_sock (sk); -sco_sock_kill (sk);sock_put (sk); }
@@ -394,8 +392,7 @@ static void sco_sock_cleanup_listen(struct sock *parent)*/ static void sco_sock_kill (struct sock *sk) { -if (!sock_flag (sk,SOCK_ZAPPED ) || sk->sk_socket || -sock_flag (sk,SOCK_DEAD )) +if (!sock_flag (sk,SOCK_ZAPPED ) || sk->sk_socket)return ;BT_DBG ("sk %p state %d" , sk, sk->sk_state);
@@ -447,7 +444,6 @@ static void sco_sock_close(struct sock *sk)lock_sock (sk);__sco_sock_close (sk);release_sock (sk); -sco_sock_kill (sk); } static void sco_skb_put_cmsg(struct sk_buff *skb, struct msghdr *msg,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 174/300 drm/msm/dsi: Fix some reference counted resource leaks
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 6977cc89c87506ff17e6c05f0e37f46752256e82 ]
'of_find_device_by_node()' takes a reference that must be released when not needed anymore.
This is expected to be done in 'dsi_destroy()'.
However, there are 2 issues in 'dsi_get_phy()'.
First, if 'of_find_device_by_node()' succeeds but 'platform_get_drvdata()' returns NULL, 'msm_dsi->phy_dev' will still be NULL, and the reference won't be released in 'dsi_destroy()'.
Secondly, as 'of_find_device_by_node()' already takes a reference, there is no need for an additional 'get_device()'.
Move the assignment to 'msm_dsi->phy_dev' a few lines above and remove the unneeded 'get_device()' to solve both issues.
--- drivers/gpu/drm/msm/dsi/dsi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/msm/dsi/dsi.c +3 -3
@@ -26,8 +26,10 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi) } phy_pdev =of_find_device_by_node (phy_node); -if (phy_pdev) +if (phy_pdev) { msm_dsi->phy =platform_get_drvdata (phy_pdev); + msm_dsi->phy_dev = &phy_pdev->dev; + }of_node_put (phy_node);
@@ -36,8 +38,6 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi)return -EPROBE_DEFER ; } - msm_dsi->phy_dev =get_device (&phy_pdev->dev); -return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 175/300 drm/msm/dp: replug event is converted into an unplug followed by an plug events
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit 7e10bf427850f2d7133fd091999abd5fc1755cdb ]
Remove special handling of replug interrupt and instead treat replug event as a sequential unplug followed by a plugin event. This is needed to meet the requirements of DP Link Layer CTS test case 4.2.1.3.
Changes in V2:
-- add fixes statement
Changes in V3:
-- delete EV_HPD_REPLUG_INT
--- drivers/gpu/drm/msm/dp/dp_display.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +5 -9
@@ -55,7 +55,6 @@ enum {EV_HPD_INIT_SETUP ,EV_HPD_PLUG_INT ,EV_IRQ_HPD_INT , -EV_HPD_REPLUG_INT ,EV_HPD_UNPLUG_INT ,EV_USER_NOTIFICATION , EV_CONNECT_PENDING_TIMEOUT,
@@ -1119,9 +1118,6 @@ static int hpd_event_thread(void *data)case EV_IRQ_HPD_INT :dp_irq_hpd_handle (dp_priv, todo->data);break ; -case EV_HPD_REPLUG_INT : -/* do nothing */ -break ;case EV_USER_NOTIFICATION :dp_display_send_hpd_notification (dp_priv, todo->data);
@@ -1165,10 +1161,8 @@ static irqreturn_t dp_display_irq_handler(int irq, void *dev_id)if (hpd_isr_status &0x0F ) {/* hpd related interrupts */ -if (hpd_isr_status &DP_DP_HPD_PLUG_INT_MASK || - hpd_isr_status &DP_DP_HPD_REPLUG_INT_MASK ) { +if (hpd_isr_status &DP_DP_HPD_PLUG_INT_MASK )dp_add_event (dp,EV_HPD_PLUG_INT ,0 ,0 ); - }if (hpd_isr_status &DP_DP_IRQ_HPD_INT_MASK ) {/* stop sentinel connect pending checking */
@@ -1176,8 +1170,10 @@ static irqreturn_t dp_display_irq_handler(int irq, void *dev_id)dp_add_event (dp,EV_IRQ_HPD_INT ,0 ,0 ); } -if (hpd_isr_status &DP_DP_HPD_REPLUG_INT_MASK ) -dp_add_event (dp,EV_HPD_REPLUG_INT ,0 ,0 ); +if (hpd_isr_status &DP_DP_HPD_REPLUG_INT_MASK ) { +dp_add_event (dp,EV_HPD_UNPLUG_INT ,0 ,0 ); +dp_add_event (dp,EV_HPD_PLUG_INT ,0 ,3 ); + }if (hpd_isr_status &DP_DP_HPD_UNPLUG_INT_MASK )dp_add_event (dp,EV_HPD_UNPLUG_INT ,0 ,0 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 176/300 net/mlx5: Fix unpublish devlink parameters
In reply to Greg Kroah-HartmanFrom: Parav Pandit <[email protected]>
[ Upstream commit 6f35723864b42ec9e9bb95a503449633395c4975 ]
Cleanup routine missed to unpublish the parameters. Add it.
--- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/devlink.c +1 -0
@@ -664,6 +664,7 @@ params_reg_err:void mlx5_devlink_unregister (struct devlink *devlink) {mlx5_devlink_traps_unregister (devlink); +devlink_params_unpublish (devlink);devlink_params_unregister (devlink, mlx5_devlink_params,ARRAY_SIZE (mlx5_devlink_params));devlink_unregister (devlink);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 177/300 ASoC: rt5682: Implement remove callback
In reply to Greg Kroah-HartmanFrom: Stephen Boyd <[email protected]>
[ Upstream commit 87b42abae99d3d851aec64cd4d0f7def8113950e ]
Let's implement a remove callback for this driver that's similar to the shutdown hook, but also disables the regulators before they're put by devm code.
--- sound/soc/codecs/rt5682-i2c.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
sound/soc/codecs/rt5682-i2c.c +11 -0
@@ -280,6 +280,16 @@ static void rt5682_i2c_shutdown(struct i2c_client *client)rt5682_reset (rt5682); } +static int rt5682_i2c_remove (struct i2c_client *client) +{ +struct rt5682_priv *rt5682 =i2c_get_clientdata (client); + +rt5682_i2c_shutdown (client); +regulator_bulk_disable (ARRAY_SIZE (rt5682->supplies), rt5682->supplies); + +return 0 ; +} +static const struct of_device_id rt5682_of_match[] = { {.compatible ="realtek,rt5682i" }, {},
@@ -306,6 +316,7 @@ static struct i2c_driver rt5682_i2c_driver = { .probe_type = PROBE_PREFER_ASYNCHRONOUS, }, .probe = rt5682_i2c_probe, + .remove = rt5682_i2c_remove, .shutdown = rt5682_i2c_shutdown, .id_table = rt5682_i2c_id, };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 178/300 ASoC: rt5682: Properly turn off regulators if wrong device ID
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
[ Upstream commit 772d44526e203c062171786e514373f129616278 ]
When I booted up on a board that had a slightly different codec stuffed on it, I got this message at bootup:
rt5682 9-001a: Device with ID register 6749 is not rt5682
That's normal/expected, but what wasn't normal was the splat that I got after:
WARNING: CPU: 7 PID: 176 at drivers/regulator/core.c:2151 _regulator_put+0x150/0x158 pc : _regulator_put+0x150/0x158 ... Call trace: _regulator_put+0x150/0x158 regulator_bulk_free+0x48/0x70 devm_regulator_bulk_release+0x20/0x2c release_nodes+0x1cc/0x244 devres_release_all+0x44/0x60 really_probe+0x17c/0x378 ...
This is because the error paths don't turn off the regulator. Let's fix that.
--- sound/soc/codecs/rt5682-i2c.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
sound/soc/codecs/rt5682-i2c.c +12 -1
@@ -117,6 +117,13 @@ static struct snd_soc_dai_driver rt5682_dai[] = { }, }; +static void rt5682_i2c_disable_regulators (void *data) +{ +struct rt5682_priv *rt5682 = data; + +regulator_bulk_disable (ARRAY_SIZE (rt5682->supplies), rt5682->supplies); +} +static int rt5682_i2c_probe (struct i2c_client *i2c,const struct i2c_device_id *id) {
@@ -157,6 +164,11 @@ static int rt5682_i2c_probe(struct i2c_client *i2c,return ret; } + ret =devm_add_action_or_reset (&i2c->dev, rt5682_i2c_disable_regulators, + rt5682); +if (ret) +return ret; + ret =regulator_bulk_enable (ARRAY_SIZE (rt5682->supplies), rt5682->supplies);if (ret) {
@@ -285,7 +297,6 @@ static int rt5682_i2c_remove(struct i2c_client *client)struct rt5682_priv *rt5682 =i2c_get_clientdata (client);rt5682_i2c_shutdown (client); -regulator_bulk_disable (ARRAY_SIZE (rt5682->supplies), rt5682->supplies);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 179/300 usb: dwc3: meson-g12a: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit baa2986bda3f7b2386607587a4185e3dff8f98df ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_threaded_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_threaded_irq() with the invalid IRQ #s.
--- drivers/usb/dwc3/dwc3-meson-g12a.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/dwc3/dwc3-meson-g12a.c +2 -0
@@ -598,6 +598,8 @@ static int dwc3_meson_g12a_otg_init(struct platform_device *pdev, USB_R5_ID_DIG_IRQ, 0); irq =platform_get_irq (pdev,0 ); +if (irq <0 ) +return irq; ret =devm_request_threaded_irq (&pdev->dev, irq,NULL , dwc3_meson_g12a_irq_thread,IRQF_ONESHOT , pdev->name, priv);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 180/300 usb: dwc3: qcom: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 175006956740f70ca23394c58f8d7804776741bd ]
In dwc3_qcom_acpi_register_core(), the driver neglects to check the result of platform_get_irq()'s call and blithely assigns the negative error codes to the allocated child device's IRQ resource and then passing this resource to platform_device_add_resources() and later causing dwc3_otg_get_irq() to fail anyway. Stop calling platform_device_add_resources() with the invalid IRQ #s, so that there's less complexity in the IRQ error checking.
--- drivers/usb/dwc3/dwc3-qcom.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/dwc3/dwc3-qcom.c +4 -0
@@ -614,6 +614,10 @@ static int dwc3_qcom_acpi_register_core(struct platform_device *pdev) qcom->acpi_pdata->dwc3_core_base_size; irq =platform_get_irq (pdev_irq,0 ); +if (irq <0 ) { + ret = irq; + goto out; + } child_res[1 ].flags =IORESOURCE_IRQ ; child_res[1 ].start = child_res[1 ].end = irq;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 181/300 usb: gadget: udc: at91: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 50855c31573b02963f0aa2aacfd4ea41c31ae0e0 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with the invalid IRQ #s.
--- drivers/usb/gadget/udc/at91_udc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/gadget/udc/at91_udc.c +3 -1
@@ -1876,7 +1876,9 @@ static int at91udc_probe(struct platform_device *pdev)clk_disable (udc->iclk);/* request UDC and maybe VBUS irqs */ - udc->udp_irq =platform_get_irq (pdev,0 ); + udc->udp_irq = retval =platform_get_irq (pdev,0 ); +if (retval <0 ) + goto err_unprepare_iclk; retval =devm_request_irq (dev, udc->udp_irq, at91_udc_irq,0 , driver_name, udc);if (retval) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 182/300 usb: gadget: udc: s3c2410: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit ecff88e819e31081d41cd05bb199b9bd10e13e90 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling request_irq() with the invalid IRQ #s.
--- drivers/usb/gadget/udc/s3c2410_udc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/gadget/udc/s3c2410_udc.c +4 -0
@@ -1784,6 +1784,10 @@ static int s3c2410_udc_probe(struct platform_device *pdev)s3c2410_udc_reinit (udc); irq_usbd =platform_get_irq (pdev,0 ); +if (irq_usbd <0 ) { + retval = irq_usbd; + goto err_udc_clk; + }/* irq setup after old hardware state is cleaned up */ retval = request_irq(irq_usbd, s3c2410_udc_irq,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 183/300 usb: misc: brcmstb-usb-pinmap: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 711087f342914e831269438ff42cf59bb0142c71 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with the invalid IRQ #s.
--- drivers/usb/misc/brcmstb-usb-pinmap.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/misc/brcmstb-usb-pinmap.c +2 -0
@@ -293,6 +293,8 @@ static int __init brcmstb_usb_pinmap_probe(struct platform_device *pdev)/* Enable interrupt for out pins */ irq =platform_get_irq (pdev,0 ); +if (irq <0 ) +return irq; err = devm_request_irq(&pdev->dev, irq, brcmstb_usb_pinmap_ovr_isr, IRQF_TRIGGER_RISING,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 184/300 usb: phy: fsl-usb: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit ecc2f30dbb25969908115c81ec23650ed982b004 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling request_irq() with the invalid IRQ #s.
--- drivers/usb/phy/phy-fsl-usb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/phy/phy-fsl-usb.c +2 -0
@@ -873,6 +873,8 @@ int usb_otg_start(struct platform_device *pdev)/* request irq */ p_otg->irq =platform_get_irq (pdev,0 ); +if (p_otg->irq <0 ) +return p_otg->irq; status =request_irq (p_otg->irq, fsl_otg_isr,IRQF_SHARED , driver_name, p_otg);if (status) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 185/300 usb: phy: twl6030: add IRQ checks
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 0881e22c06e66af0b64773c91c8868ead3d01aa1 ]
The driver neglects to check the result of platform_get_irq()'s calls and blithely passes the negative error codes to request_threaded_irq() (which takes *unsigned* IRQ #), causing them both to fail with -EINVAL, overriding an original error code. Stop calling request_threaded_irq() with the invalid IRQ #s.
--- drivers/usb/phy/phy-twl6030-usb.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/phy/phy-twl6030-usb.c +5 -0
@@ -348,6 +348,11 @@ static int twl6030_usb_probe(struct platform_device *pdev) twl->irq2 =platform_get_irq (pdev,1 ); twl->linkstat =MUSB_UNKNOWN ; +if (twl->irq1 <0 ) +return twl->irq1; +if (twl->irq2 <0 ) +return twl->irq2; + twl->comparator.set_vbus = twl6030_set_vbus; twl->comparator.start_srp = twl6030_start_srp;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 186/300 usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit cea45a3bd2dd4d9c35581328f571afd32b3c9f48 ]
soc_device_match() is intended as a last resort, to handle e.g. quirks that cannot be handled by matching based on a compatible value.
As the device nodes for the Renesas USB 3.0 Peripheral Controller on R-Car E3 and RZ/G2E do have SoC-specific compatible values, the latter can and should be used to match against these devices.
This also fixes support for the USB 3.0 Peripheral Controller on the R-Car E3e (R8A779M6) SoC, which is a different grading of the R-Car E3 (R8A77990) SoC, using the same SoC-specific compatible value.
--- drivers/usb/gadget/udc/renesas_usb3.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-)
drivers/usb/gadget/udc/renesas_usb3.c +7 -10
@@ -2707,10 +2707,15 @@ static const struct renesas_usb3_priv renesas_usb3_priv_r8a77990 = {static const struct of_device_id usb3_of_match[] = { { + .compatible ="renesas,r8a774c0-usb3-peri" , + .data = &renesas_usb3_priv_r8a77990, + }, { .compatible ="renesas,r8a7795-usb3-peri" , .data = &renesas_usb3_priv_gen3, - }, - { + }, { + .compatible ="renesas,r8a77990-usb3-peri" , + .data = &renesas_usb3_priv_r8a77990, + }, { .compatible ="renesas,rcar-gen3-usb3-peri" , .data = &renesas_usb3_priv_gen3, },
@@ -2719,18 +2724,10 @@ static const struct of_device_id usb3_of_match[] = {MODULE_DEVICE_TABLE (of, usb3_of_match);static const struct soc_device_attribute renesas_usb3_quirks_match[] = { - { - .soc_id ="r8a774c0" , - .data = &renesas_usb3_priv_r8a77990, - }, { .soc_id ="r8a7795" , .revision ="ES1.*" , .data = &renesas_usb3_priv_r8a7795_es1, }, - { - .soc_id ="r8a77990" , - .data = &renesas_usb3_priv_r8a77990, - }, {/* sentinel */ }, };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 187/300 selftests/bpf: Fix test_core_autosize on big-endian machines
In reply to Greg Kroah-HartmanFrom: Ilya Leoshkevich <[email protected]>
[ Upstream commit d164dd9a5c08c16a883b3de97d13948c7be7fa4d ]
The "probed" part of test_core_autosize copies an integer using bpf_core_read() into an integer of a potentially different size. On big-endian machines a destination offset is required for this to produce a sensible result.
--- .../selftests/bpf/progs/test_core_autosize.c | 20 ++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
tools/testing/selftests/bpf/progs/test_core_autosize.c +15 -5
@@ -125,6 +125,16 @@ int handle_downsize(void *ctx)return 0 ; } +#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ +#define bpf_core_read_int bpf_core_read +#else +#define bpf_core_read_int(dst, sz, src) ({ \ + /* Prevent "subtraction from stack pointer prohibited" */ \ + volatile long __off = sizeof(*dst) - (sz); \ + bpf_core_read((char *)(dst) + __off, sz, src); \ +}) +#endif + SEC("raw_tp/sys_enter")int handle_probed (void *ctx) {
@@ -132,23 +142,23 @@ int handle_probed(void *ctx)__u64 tmp; tmp =0 ; -bpf_core_read (&tmp,bpf_core_field_size (in->ptr), &in->ptr); +bpf_core_read_int (&tmp,bpf_core_field_size (in->ptr), &in->ptr); ptr_probed = tmp; tmp =0 ; -bpf_core_read (&tmp,bpf_core_field_size (in->val1), &in->val1); +bpf_core_read_int (&tmp,bpf_core_field_size (in->val1), &in->val1); val1_probed = tmp; tmp =0 ; -bpf_core_read (&tmp,bpf_core_field_size (in->val2), &in->val2); +bpf_core_read_int (&tmp,bpf_core_field_size (in->val2), &in->val2); val2_probed = tmp; tmp =0 ; -bpf_core_read (&tmp,bpf_core_field_size (in->val3), &in->val3); +bpf_core_read_int (&tmp,bpf_core_field_size (in->val3), &in->val3); val3_probed = tmp; tmp =0 ; -bpf_core_read (&tmp,bpf_core_field_size (in->val4), &in->val4); +bpf_core_read_int (&tmp,bpf_core_field_size (in->val4), &in->val4); val4_probed = tmp;return 0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 188/300 devlink: Clear whole devlink_flash_notify struct
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit ed43fbac717882165a2a4bd64f7b1f56f7467bb7 ]
The { 0 } doesn't clear all fields in the struct, but tells to the compiler to set all fields to zero and doesn't touch any sub-fields if they exists.
The {} is an empty initialiser that instructs to fully initialize whole struct including sub-fields, which is error-prone for future devlink_flash_notify extensions.
--- net/core/devlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/core/devlink.c +2 -2
@@ -3607,7 +3607,7 @@ out_free_msg:static void devlink_flash_update_begin_notify (struct devlink *devlink) { -struct devlink_flash_notify params = {0 }; +struct devlink_flash_notify params = {}; __devlink_flash_update_notify(devlink, DEVLINK_CMD_FLASH_UPDATE,
@@ -3616,7 +3616,7 @@ static void devlink_flash_update_begin_notify(struct devlink *devlink)static void devlink_flash_update_end_notify (struct devlink *devlink) { -struct devlink_flash_notify params = {0 }; +struct devlink_flash_notify params = {}; __devlink_flash_update_notify(devlink, DEVLINK_CMD_FLASH_UPDATE_END,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 189/300 samples: pktgen: add missing IPv6 option to pktgen scripts
In reply to Greg Kroah-HartmanFrom: Juhee Kang <[email protected]>
[ Upstream commit 0f0c4f1b72e090b23131700bb155944cc28b2a7b ]
Currently, "sample04" and "sample05" are not working properly when running with an IPv6 option("-6"). The commit 0f06a6787e05 ("samples:
Add an IPv6 "-6" option to the pktgen scripts") has omitted the addition of this option at "sample04" and "sample05".
In order to support IPv6 option, this commit adds logic related to IPv6 option.
--- samples/pktgen/pktgen_sample04_many_flows.sh | 12 +++++++----- samples/pktgen/pktgen_sample05_flow_per_thread.sh | 12 +++++++----- 2 files changed, 14 insertions(+), 10 deletions(-)
samples/pktgen/pktgen_sample04_many_flows.sh +7 -5
@@ -13,13 +13,15 @@ root_check_run_with_sudo "$@" # Parameter parsing via include source ${basedir}/parameters.sh # Set some default params, if they didn't get set -[ -z "$DEST_IP" ] && DEST_IP="198.18.0.42" +if [ -z "$DEST_IP" ]; then + [ -z "$IP6" ] && DEST_IP="198.18.0.42" || DEST_IP="FD00::1" +fi [ -z "$DST_MAC" ] && DST_MAC="90:e2:ba:ff:ff:ff" [ -z "$CLONE_SKB" ] && CLONE_SKB="0" [ -z "$COUNT" ] && COUNT="0" # Zero means indefinitely if [ -n "$DEST_IP" ]; then - validate_addr $DEST_IP - read -r DST_MIN DST_MAX <<< $(parse_addr $DEST_IP) + validate_addr${IP6} $DEST_IP + read -r DST_MIN DST_MAX <<< $(parse_addr${IP6} $DEST_IP) fi if [ -n "$DST_PORT" ]; then read -r UDP_DST_MIN UDP_DST_MAX <<< $(parse_ports $DST_PORT)
@@ -62,8 +64,8 @@ for ((thread = $F_THREAD; thread <= $L_THREAD; thread++)); do # Single destination pg_set $dev "dst_mac $DST_MAC" - pg_set $dev "dst_min $DST_MIN" - pg_set $dev "dst_max $DST_MAX" + pg_set $dev "dst${IP6}_min $DST_MIN" + pg_set $dev "dst${IP6}_max $DST_MAX" if [ -n "$DST_PORT" ]; then # Single destination port or random port range
samples/pktgen/pktgen_sample05_flow_per_thread.sh +7 -5
@@ -17,14 +17,16 @@ root_check_run_with_sudo "$@" # Parameter parsing via include source ${basedir}/parameters.sh # Set some default params, if they didn't get set -[ -z "$DEST_IP" ] && DEST_IP="198.18.0.42" +if [ -z "$DEST_IP" ]; then + [ -z "$IP6" ] && DEST_IP="198.18.0.42" || DEST_IP="FD00::1" +fi [ -z "$DST_MAC" ] && DST_MAC="90:e2:ba:ff:ff:ff" [ -z "$CLONE_SKB" ] && CLONE_SKB="0" [ -z "$BURST" ] && BURST=32 [ -z "$COUNT" ] && COUNT="0" # Zero means indefinitely if [ -n "$DEST_IP" ]; then - validate_addr $DEST_IP - read -r DST_MIN DST_MAX <<< $(parse_addr $DEST_IP) + validate_addr${IP6} $DEST_IP + read -r DST_MIN DST_MAX <<< $(parse_addr${IP6} $DEST_IP) fi if [ -n "$DST_PORT" ]; then read -r UDP_DST_MIN UDP_DST_MAX <<< $(parse_ports $DST_PORT)
@@ -52,8 +54,8 @@ for ((thread = $F_THREAD; thread <= $L_THREAD; thread++)); do # Single destination pg_set $dev "dst_mac $DST_MAC" - pg_set $dev "dst_min $DST_MIN" - pg_set $dev "dst_max $DST_MAX" + pg_set $dev "dst${IP6}_min $DST_MIN" + pg_set $dev "dst${IP6}_max $DST_MAX" if [ -n "$DST_PORT" ]; then # Single destination port or random port range
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 190/300 net: stmmac: fix INTR TBU status affecting irq count statistic
In reply to Greg Kroah-HartmanFrom: Voon Weifeng <[email protected]>
[ Upstream commit 1975df880b959e30f28d66148a12d77b458abd76 ]
DMA channel status "Transmit buffer unavailable(TBU)" bit is not considered as a successful dma tx. Hence, it should not affect all the irq count statistic.
--- drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c +3 -2
@@ -172,11 +172,12 @@ int dwmac4_dma_interrupt(void __iomem *ioaddr, x->rx_normal_irq_n++; ret |= handle_rx; } -if (likely (intr_status & (DMA_CHAN_STATUS_TI | -DMA_CHAN_STATUS_TBU ))) { +if (likely (intr_status &DMA_CHAN_STATUS_TI )) { x->tx_normal_irq_n++; ret |= handle_tx; } +if (unlikely (intr_status &DMA_CHAN_STATUS_TBU )) + ret |= handle_tx;if (unlikely (intr_status &DMA_CHAN_STATUS_ERI )) x->rx_early_irq++;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 191/300 Bluetooth: Move shutdown callback before flushing tx and rx queue
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit 0ea53674d07fb6db2dd7a7ec2fdc85a12eb246c2 ]
Commit 0ea9fd001a14 ("Bluetooth: Shutdown controller after workqueues are flushed or cancelled") introduced a regression that makes mtkbtsdio driver stops working:
[ 36.593956] Bluetooth: hci0: Firmware already downloaded [ 46.814613] Bluetooth: hci0: Execution of wmt command timed out [ 46.814619] Bluetooth: hci0: Failed to send wmt func ctrl (-110)
The shutdown callback depends on the result of hdev->rx_work, so we should call it before flushing rx_work:
-> btmtksdio_shutdown()
-> mtk_hci_wmt_sync()
-> __hci_cmd_send()
-> wait for BTMTKSDIO_TX_WAIT_VND_EVT gets cleared
-> btmtksdio_recv_event()
-> hci_recv_frame()
-> queue_work(hdev->workqueue, &hdev->rx_work)
-> clears BTMTKSDIO_TX_WAIT_VND_EVT
So move the shutdown callback before flushing TX/RX queue to resolve the issue.
--- net/bluetooth/hci_core.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/bluetooth/hci_core.c +8 -0
@@ -1734,6 +1734,14 @@ int hci_dev_do_close(struct hci_dev *hdev)hci_request_cancel_all (hdev);hci_req_sync_lock (hdev); +if (!hci_dev_test_flag (hdev,HCI_UNREGISTER ) && + !hci_dev_test_flag (hdev,HCI_USER_CHANNEL ) && +test_bit (HCI_UP , &hdev->flags)) { +/* Execute vendor specific shutdown routine */ +if (hdev->shutdown) + hdev->shutdown (hdev); + } +if (!test_and_clear_bit (HCI_UP , &hdev->flags)) {cancel_delayed_work_sync (&hdev->cmd_timer);hci_req_sync_unlock (hdev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 192/300 PM: cpu: Make notifier chain use a raw_spinlock_t
In reply to Greg Kroah-HartmanFrom: Valentin Schneider <[email protected]>
[ Upstream commit b2f6662ac08d0e7c25574ce53623c71bdae9dd78 ]
Invoking atomic_notifier_chain_notify() requires acquiring a spinlock_t, which can block under CONFIG_PREEMPT_RT. Notifications for members of the cpu_pm notification chain will be issued by the idle task, which can never block.
Making *all* atomic_notifiers use a raw_spinlock is too big of a hammer, as only notifications issued by the idle task are problematic.
Special-case cpu_pm_notifier_chain by kludging a raw_notifier and raw_spinlock_t together, matching the atomic_notifier behavior with a raw_spinlock_t.
--- kernel/cpu_pm.c | 50 +++++++++++++++++++++++++++++++++++++------------ 1 file changed, 38 insertions(+), 12 deletions(-)
kernel/cpu_pm.c +38 -12
@@ -13,19 +13,32 @@#include <linux/spinlock.h> #include <linux/syscore_ops.h> -static ATOMIC_NOTIFIER_HEAD (cpu_pm_notifier_chain); +/* +* atomic_notifiers use a spinlock_t, which can block under PREEMPT_RT. +* Notifications for cpu_pm will be issued by the idle task itself, which can +* never block, IOW it requires using a raw_spinlock_t. +*/ +static struct { +struct raw_notifier_head chain; +raw_spinlock_t lock; +} cpu_pm_notifier = { + .chain =RAW_NOTIFIER_INIT (cpu_pm_notifier.chain), + .lock =__RAW_SPIN_LOCK_UNLOCKED (cpu_pm_notifier.lock), +};static int cpu_pm_notify (enum cpu_pm_event event) {int ret;/* -* atomic_notifier_call_chain has a RCU read critical section, which -* could be disfunctional in cpu idle. Copy RCU_NONIDLE code to let -* RCU know this. +* This introduces a RCU read critical section, which could be +* disfunctional in cpu idle. Copy RCU_NONIDLE code to let RCU know +* this. */ rcu_irq_enter_irqson (); - ret =atomic_notifier_call_chain (&cpu_pm_notifier_chain, event,NULL ); +rcu_read_lock (); + ret =raw_notifier_call_chain (&cpu_pm_notifier.chain, event,NULL ); +rcu_read_unlock ();rcu_irq_exit_irqson ();return notifier_to_errno (ret);
@@ -33,10 +46,13 @@ static int cpu_pm_notify(enum cpu_pm_event event)static int cpu_pm_notify_robust (enum cpu_pm_event event_up,enum cpu_pm_event event_down) { +unsigned long flags;int ret;rcu_irq_enter_irqson (); - ret =atomic_notifier_call_chain_robust (&cpu_pm_notifier_chain, event_up, event_down,NULL ); +raw_spin_lock_irqsave (&cpu_pm_notifier.lock, flags); + ret =raw_notifier_call_chain_robust (&cpu_pm_notifier.chain, event_up, event_down,NULL ); +raw_spin_unlock_irqrestore (&cpu_pm_notifier.lock, flags);rcu_irq_exit_irqson ();return notifier_to_errno (ret);
@@ -49,12 +65,17 @@ static int cpu_pm_notify_robust(enum cpu_pm_event event_up, enum cpu_pm_event ev* Add a driver to a list of drivers that are notified about * CPU and CPU cluster low power entry and exit. * -* This function may sleep, and has the same return conditions as -* raw_notifier_chain_register. +* This function has the same return conditions as raw_notifier_chain_register. */ int cpu_pm_register_notifier (struct notifier_block *nb) { -return atomic_notifier_chain_register (&cpu_pm_notifier_chain, nb); +unsigned long flags; +int ret; + +raw_spin_lock_irqsave (&cpu_pm_notifier.lock, flags); + ret =raw_notifier_chain_register (&cpu_pm_notifier.chain, nb); +raw_spin_unlock_irqrestore (&cpu_pm_notifier.lock, flags); +return ret; }EXPORT_SYMBOL_GPL (cpu_pm_register_notifier);
@@ -64,12 +85,17 @@ EXPORT_SYMBOL_GPL(cpu_pm_register_notifier);* * Remove a driver from the CPU PM notifier list. * -* This function may sleep, and has the same return conditions as -* raw_notifier_chain_unregister. +* This function has the same return conditions as raw_notifier_chain_unregister. */ int cpu_pm_unregister_notifier (struct notifier_block *nb) { -return atomic_notifier_chain_unregister (&cpu_pm_notifier_chain, nb); +unsigned long flags; +int ret; + +raw_spin_lock_irqsave (&cpu_pm_notifier.lock, flags); + ret =raw_notifier_chain_unregister (&cpu_pm_notifier.chain, nb); +raw_spin_unlock_irqrestore (&cpu_pm_notifier.lock, flags); +return ret; }EXPORT_SYMBOL_GPL (cpu_pm_unregister_notifier);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 193/300 usb: host: ohci-tmio: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 4ac5132e8a4300637a2da8f5d6bc7650db735b8a ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to usb_add_hcd() (which takes *unsigned* IRQ #), causing request_irq() that it calls to fail with -EINVAL, overriding an original error code. Stop calling usb_add_hcd() with the invalid IRQ #s.
--- drivers/usb/host/ohci-tmio.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/host/ohci-tmio.c +3 -0
@@ -202,6 +202,9 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev)if (!cell)return -EINVAL ; +if (irq <0 ) +return irq; + hcd =usb_create_hcd (&ohci_tmio_hc_driver, &dev->dev,dev_name (&dev->dev));if (!hcd) { ret = -ENOMEM ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 194/300 usb: phy: tahvo: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 0d45a1373e669880b8beaecc8765f44cb0241e47 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to request_threaded_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling request_threaded_irq() with the invalid IRQ #s.
--- drivers/usb/phy/phy-tahvo.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/phy/phy-tahvo.c +3 -1
@@ -393,7 +393,9 @@ static int tahvo_usb_probe(struct platform_device *pdev)dev_set_drvdata (&pdev->dev, tu); - tu->irq =platform_get_irq (pdev,0 ); + tu->irq = ret =platform_get_irq (pdev,0 ); +if (ret <0 ) +return ret; ret =request_threaded_irq (tu->irq,NULL , tahvo_usb_vbus_interrupt,IRQF_ONESHOT ,"tahvo-vbus" , tu);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 195/300 libbpf: Re-build libbpf.so when libbpf.map changes
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 61c7aa5020e98ac2fdcf07d07eec1baf2e9f0a08 ]
Ensure libbpf.so is re-built whenever libbpf.map is modified. Without this, changes to libbpf.map are not detected and versioned symbols mismatch error will be reported until make clean && make is used, which is a suboptimal developer experience.
--- tools/lib/bpf/Makefile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
tools/lib/bpf/Makefile +5 -5
@@ -4,8 +4,9 @@ RM ?= rm srctree = $(abs_srctree) +VERSION_SCRIPT := libbpf.map LIBBPF_VERSION := $(shell \ - grep -oE '^LIBBPF_([0-9.]+)' libbpf.map | \ + grep -oE '^LIBBPF_([0-9.]+)' $(VERSION_SCRIPT) | \ sort -rV | head -n1 | cut -d'_' -f2) LIBBPF_MAJOR_VERSION := $(firstword $(subst ., ,$(LIBBPF_VERSION)))
@@ -110,7 +111,6 @@ SHARED_OBJDIR := $(OUTPUT)sharedobjs/ STATIC_OBJDIR := $(OUTPUT)staticobjs/ BPF_IN_SHARED := $(SHARED_OBJDIR)libbpf-in.o BPF_IN_STATIC := $(STATIC_OBJDIR)libbpf-in.o -VERSION_SCRIPT := libbpf.map BPF_HELPER_DEFS := $(OUTPUT)bpf_helper_defs.h LIB_TARGET := $(addprefix $(OUTPUT),$(LIB_TARGET))
@@ -163,10 +163,10 @@ $(BPF_HELPER_DEFS): $(srctree)/tools/include/uapi/linux/bpf.h $(OUTPUT)libbpf.so: $(OUTPUT)libbpf.so.$(LIBBPF_VERSION) -$(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN_SHARED) +$(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN_SHARED) $(VERSION_SCRIPT) $(QUIET_LINK)$(CC) $(LDFLAGS) \ --shared -Wl,-soname,libbpf.so.$(LIBBPF_MAJOR_VERSION) \ - -Wl,--version-script=$(VERSION_SCRIPT) $^ -lelf -lz -o $@ + -Wl,--version-script=$(VERSION_SCRIPT) $< -lelf -lz -o $@ @ln -sf $(@F) $(OUTPUT)libbpf.so @ln -sf $(@F) $(OUTPUT)libbpf.so.$(LIBBPF_MAJOR_VERSION)
@@ -181,7 +181,7 @@ $(OUTPUT)libbpf.pc: check: check_abi -check_abi: $(OUTPUT)libbpf.so +check_abi: $(OUTPUT)libbpf.so $(VERSION_SCRIPT) @if [ "$(GLOBAL_SYM_COUNT)" != "$(VERSIONED_SYM_COUNT)" ]; then \ echo "Warning: Num of global symbols in $(BPF_IN_SHARED)" \ "($(GLOBAL_SYM_COUNT)) does NOT match with num of" \
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 196/300 mac80211: Fix insufficient headroom issue for AMSDU
In reply to Greg Kroah-HartmanFrom: Chih-Kang Chang <[email protected]>
[ Upstream commit f50d2ff8f016b79a2ff4acd5943a1eda40c545d4 ]
ieee80211_amsdu_realloc_pad() fails to account for extra_tx_headroom, the original reserved headroom might be eaten. Add the necessary extra_tx_headroom.
--- net/mac80211/tx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/mac80211/tx.c +3 -1
@@ -3210,7 +3210,9 @@ static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,if (info->control.flags &IEEE80211_TX_CTRL_AMSDU )return true; -if (!ieee80211_amsdu_realloc_pad (local, skb,sizeof (*amsdu_hdr))) +if (!ieee80211_amsdu_realloc_pad (local, skb, +sizeof (*amsdu_hdr) + + local->hw.extra_tx_headroom))return false; data =skb_push (skb,sizeof (*amsdu_hdr));
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 197/300 locking/local_lock: Add missing owner initialization
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
[ Upstream commit d8bbd97ad0b99a9394f2cd8410b884c48e218cf0 ]
If CONFIG_DEBUG_LOCK_ALLOC=y is enabled then local_lock_t has an 'owner' member which is checked for consistency, but nothing initialized it to zero explicitly.
The static initializer does so implicit, and the run time allocated per CPU storage is usually zero initialized as well, but relying on that is not really good practice.
--- include/linux/local_lock_internal.h | 42 ++++++++++++++++------------- 1 file changed, 23 insertions(+), 19 deletions(-)
include/linux/local_lock_internal.h +23 -19
@@ -14,29 +14,14 @@ typedef struct { } local_lock_t;#ifdef CONFIG_DEBUG_LOCK_ALLOC -# define LL_DEP_MAP_INIT (lockname) \ +# define LOCAL_LOCK_DEBUG_INIT (lockname) \ .dep_map = { \ .name = #lockname, \ .wait_type_inner = LD_WAIT_CONFIG, \ - .lock_type = LD_LOCK_PERCPU, \ - } -#else -# define LL_DEP_MAP_INIT (lockname) -#endif - -#define INIT_LOCAL_LOCK (lockname) { LL_DEP_MAP_INIT(lockname) } - -#define __local_lock_init (lock) \ -do { \ - static struct lock_class_key __key; \ - \ - debug_check_no_locks_freed((void *)lock, sizeof(*lock));\ - lockdep_init_map_type(&(lock)->dep_map, #lock, &__key, 0, \ - LD_WAIT_CONFIG, LD_WAIT_INV, \ - LD_LOCK_PERCPU); \ -} while (0) + .lock_type = LD_LOCK_PERCPU, \ + }, \ + .owner = NULL, -#ifdef CONFIG_DEBUG_LOCK_ALLOC static inline void local_lock_acquire (local_lock_t *l) {lock_map_acquire (&l->dep_map);
@@ -51,11 +36,30 @@ static inline void local_lock_release(local_lock_t *l)lock_map_release (&l->dep_map); } +static inline void local_lock_debug_init (local_lock_t *l) +{ + l->owner =NULL ; +}#else /* CONFIG_DEBUG_LOCK_ALLOC */ +# define LOCAL_LOCK_DEBUG_INIT (lockname)static inline void local_lock_acquire (local_lock_t *l) { }static inline void local_lock_release (local_lock_t *l) { } +static inline void local_lock_debug_init (local_lock_t *l) { }#endif /* !CONFIG_DEBUG_LOCK_ALLOC */ +#define INIT_LOCAL_LOCK (lockname) { LOCAL_LOCK_DEBUG_INIT(lockname) } + +#define __local_lock_init (lock) \ +do { \ + static struct lock_class_key __key; \ + \ + debug_check_no_locks_freed((void *)lock, sizeof(*lock));\ + lockdep_init_map_type(&(lock)->dep_map, #lock, &__key, \ + 0, LD_WAIT_CONFIG, LD_WAIT_INV, \ + LD_LOCK_PERCPU); \ + local_lock_debug_init(lock); \ +} while (0) +#define __local_lock (lock) \ do { \ preempt_disable(); \
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 198/300 lockd: Fix invalid lockowner cast after vfs_test_lock
In reply to Greg Kroah-HartmanFrom: Benjamin Coddington <[email protected]>
[ Upstream commit cd2d644ddba183ec7b451b7c20d5c7cc06fcf0d7 ]
After calling vfs_test_lock() the pointer to a conflicting lock can be returned, and that lock is not guarunteed to be owned by nlm. In that case, we cannot cast it to struct nlm_lockowner. Instead return the pid of that conflicting lock.
--- fs/lockd/svclock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/lockd/svclock.c +1 -1
@@ -634,7 +634,7 @@ nlmsvc_testlock(struct svc_rqst *rqstp, struct nlm_file *file, conflock->caller ="somehost" ;/* FIXME */ conflock->len =strlen (conflock->caller); conflock->oh.len =0 ;/* don't return OH info */ - conflock->svid = ((struct nlm_lockowner *)lock->fl.fl_owner)->pid; + conflock->svid = lock->fl.fl_pid; conflock->fl.fl_type = lock->fl.fl_type; conflock->fl.fl_start = lock->fl.fl_start; conflock->fl.fl_end = lock->fl.fl_end;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 199/300 SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency()
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
[ Upstream commit 5c11720767f70d34357d00a15ba5a0ad052c40fe ]
Some paths through svc_process() leave rqst->rq_procinfo set to NULL, which triggers a crash if tracing happens to be enabled.
--- include/linux/sunrpc/svc.h | 1 + include/trace/events/sunrpc.h | 8 ++++---- net/sunrpc/svc.c | 15 +++++++++++++++ 3 files changed, 20 insertions(+), 4 deletions(-)
include/linux/sunrpc/svc.h +1 -0
@@ -523,6 +523,7 @@ void svc_wake_up(struct svc_serv *);void svc_reserve (struct svc_rqst *rqstp,int space);struct svc_pool *svc_pool_for_cpu (struct svc_serv *serv,int cpu);char *svc_print_addr (struct svc_rqst *,char *,size_t ); +const char *svc_proc_name (const struct svc_rqst *rqstp);int svc_encode_result_payload (struct svc_rqst *rqstp,unsigned int offset,unsigned int length);
include/trace/events/sunrpc.h +4 -4
@@ -1642,7 +1642,7 @@ TRACE_EVENT(svc_process, __field(u32, vers) __field(u32, proc) __string(service, name) - __string(procedure, rqst->rq_procinfo->pc_name) + __string(procedure, svc_proc_name(rqst))__string (addr, rqst->rq_xprt ? rqst->rq_xprt->xpt_remotebuf :"(null)" ) ),
@@ -1652,7 +1652,7 @@ TRACE_EVENT(svc_process, __entry->vers = rqst->rq_vers; __entry->proc = rqst->rq_proc;__assign_str (service, name); -__assign_str (procedure, rqst->rq_procinfo->pc_name); +__assign_str (procedure,svc_proc_name (rqst));__assign_str (addr, rqst->rq_xprt ? rqst->rq_xprt->xpt_remotebuf :"(null)" ); ),
@@ -1918,7 +1918,7 @@ TRACE_EVENT(svc_stats_latency,TP_STRUCT__entry (__field (u32 ,xid ) __field(unsigned long, execute) - __string(procedure, rqst->rq_procinfo->pc_name) +__string (procedure,svc_proc_name (rqst)) __string(addr, rqst->rq_xprt->xpt_remotebuf) ),
@@ -1926,7 +1926,7 @@ TRACE_EVENT(svc_stats_latency, __entry->xid =be32_to_cpu (rqst->rq_xid); __entry->execute =ktime_to_us (ktime_sub (ktime_get (), rqst->rq_stime)); -__assign_str (procedure, rqst->rq_procinfo->pc_name); +__assign_str (procedure,svc_proc_name (rqst));__assign_str (addr, rqst->rq_xprt->xpt_remotebuf); ),
net/sunrpc/svc.c +15 -0
@@ -1629,6 +1629,21 @@ u32 svc_max_payload(const struct svc_rqst *rqstp) }EXPORT_SYMBOL_GPL (svc_max_payload); +/** +* svc_proc_name - Return RPC procedure name in string form +* @rqstp: svc_rqst to operate on +* +* Return value: +* Pointer to a NUL-terminated string +*/ +const char *svc_proc_name (const struct svc_rqst *rqstp) +{ +if (rqstp && rqstp->rq_procinfo) +return rqstp->rq_procinfo->pc_name; +return "unknown" ; +} + +/** * svc_encode_result_payload - mark a range of bytes as a result payload * @rqstp: svc_rqst to operate on
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 200/300 nfsd4: Fix forced-expiry locking
In reply to Greg Kroah-HartmanFrom: J. Bruce Fields <[email protected]>
[ Upstream commit f7104cc1a9159cd0d3e8526cb638ae0301de4b61 ]
This should use the network-namespace-wide client_lock, not the per-client cl_lock.
You shouldn't see any bugs unless you're actually using the forced-expiry interface introduced by 89c905beccbb.
--- fs/nfsd/nfs4state.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfsd/nfs4state.c +2 -2
@@ -2665,9 +2665,9 @@ static void force_expire_client(struct nfs4_client *clp)struct nfsd_net *nn =net_generic (clp->net, nfsd_net_id);bool already_expired; -spin_lock (&clp->cl_lock); +spin_lock (&nn->client_lock); clp->cl_time =0 ; -spin_unlock (&clp->cl_lock); +spin_unlock (&nn->client_lock);wait_event (expiry_wq,atomic_read (&clp->cl_rpc_users) ==0 );spin_lock (&nn->client_lock);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 201/300 arm64: dts: marvell: armada-37xx: Extend PCIe MEM space
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit 514ef1e62d6521c2199d192b1c71b79d2aa21d5a ]
Current PCIe MEM space of size 16 MB is not enough for some combination of PCIe cards (e.g. NVMe disk together with ath11k wifi card). ARM Trusted Firmware for Armada 3700 platform already assigns 128 MB for PCIe window, so extend PCIe MEM space to the end of 128 MB PCIe window which allows to allocate more PCIe BARs for more PCIe cards.
Without this change some combination of PCIe cards cannot be used and kernel show error messages in dmesg during initialization:
pci 0000:00:00.0: BAR 8: no space for [mem size 0x01800000]
pci 0000:00:00.0: BAR 8: failed to assign [mem size 0x01800000]
pci 0000:00:00.0: BAR 6: assigned [mem 0xe8000000-0xe80007ff pref]
pci 0000:01:00.0: BAR 8: no space for [mem size 0x01800000]
pci 0000:01:00.0: BAR 8: failed to assign [mem size 0x01800000]
pci 0000:02:03.0: BAR 8: no space for [mem size 0x01000000]
pci 0000:02:03.0: BAR 8: failed to assign [mem size 0x01000000]
pci 0000:02:07.0: BAR 8: no space for [mem size 0x00100000]
pci 0000:02:07.0: BAR 8: failed to assign [mem size 0x00100000]
pci 0000:03:00.0: BAR 0: no space for [mem size 0x01000000 64bit]
pci 0000:03:00.0: BAR 0: failed to assign [mem size 0x01000000 64bit]Due to bugs in U-Boot port for Turris Mox, the second range in Turris Mox kernel DTS file for PCIe must start at 16 MB offset. Otherwise U-Boot crashes during loading of kernel DTB file. This bug is present only in U-Boot code for Turris Mox and therefore other Armada 3700 devices are not affected by this bug. Bug is fixed in U-Boot version 2021.07.
To not break booting new kernels on existing versions of U-Boot on Turris Mox, use first 16 MB range for IO and second range with rest of PCIe window for MEM.
--- .../boot/dts/marvell/armada-3720-turris-mox.dts | 17 +++++++++++++++++ arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 11 +++++++++-- 2 files changed, 26 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +17 -0
@@ -135,6 +135,23 @@ pinctrl-0 = <&pcie_reset_pins &pcie_clkreq_pins>; status = "okay"; reset-gpios = <&gpiosb 3 GPIO_ACTIVE_LOW>; + /* + * U-Boot port for Turris Mox has a bug which always expects that "ranges" DT property + * contains exactly 2 ranges with 3 (child) address cells, 2 (parent) address cells and + * 2 size cells and also expects that the second range starts at 16 MB offset. If these + * conditions are not met then U-Boot crashes during loading kernel DTB file. PCIe address + * space is 128 MB long, so the best split between MEM and IO is to use fixed 16 MB window + * for IO and the rest 112 MB (64+32+16) for MEM, despite that maximal IO size is just 64 kB. + * This bug is not present in U-Boot ports for other Armada 3700 devices and is fixed in + * U-Boot version 2021.07. See relevant U-Boot commits (the last one contains fix): + * https://source.denx.de/u-boot/u-boot/-/commit/cb2ddb291ee6fcbddd6d8f4ff49089dfe580f5d7 + * https://source.denx.de/u-boot/u-boot/-/commit/c64ac3b3185aeb3846297ad7391fc6df8ecd73bf + * https://source.denx.de/u-boot/u-boot/-/commit/4a82fca8e330157081fc132a591ebd99ba02ee33 + */ + #address-cells = <3>; + #size-cells = <2>; + ranges = <0x81000000 0 0xe8000000 0 0xe8000000 0 0x01000000 /* Port 0 IO */ + 0x82000000 0 0xe9000000 0 0xe9000000 0 0x07000000>; /* Port 0 MEM */ /* enabled by U-Boot if PCIe module is present */ status = "disabled";
arch/arm64/boot/dts/marvell/armada-37xx.dtsi +9 -2
@@ -489,8 +489,15 @@ #interrupt-cells = <1>; msi-parent = <&pcie0>; msi-controller; - ranges = <0x82000000 0 0xe8000000 0 0xe8000000 0 0x1000000 /* Port 0 MEM */ - 0x81000000 0 0xe9000000 0 0xe9000000 0 0x10000>; /* Port 0 IO*/ + /* + * The 128 MiB address range [0xe8000000-0xf0000000] is + * dedicated for PCIe and can be assigned to 8 windows + * with size a power of two. Use one 64 KiB window for + * IO at the end and the remaining seven windows + * (totaling 127 MiB) for MEM. + */ + ranges = <0x82000000 0 0xe8000000 0 0xe8000000 0 0x07f00000 /* Port 0 MEM */ + 0x81000000 0 0xefff0000 0 0xefff0000 0 0x00010000>; /* Port 0 IO */ interrupt-map-mask = <0 0 0 7>; interrupt-map = <0 0 0 1 &pcie_intc 0>, <0 0 0 2 &pcie_intc 1>,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 202/300 clk: staging: correct reference to config IOMEM to config HAS_IOMEM
In reply to Greg Kroah-HartmanFrom: Lukas Bulwahn <[email protected]>
[ Upstream commit cbfa6f33e3a685c329d78e06b0cf1dcb23c9d849 ]
Commit 0a0a66c984b3 ("clk: staging: Specify IOMEM dependency for Xilinx Clocking Wizard driver") introduces a dependency on the non-existing config IOMEM, which basically makes it impossible to include this driver into any build. Fortunately, ./scripts/checkkconfigsymbols.py warns:
IOMEM
Referencing files: drivers/staging/clocking-wizard/Kconfig
The config for IOMEM support is called HAS_IOMEM. Correct this reference to the intended config.
--- drivers/staging/clocking-wizard/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/clocking-wizard/Kconfig +1 -1
@@ -5,6 +5,6 @@ config COMMON_CLK_XLNX_CLKWZRD tristate "Xilinx Clocking Wizard" - depends on COMMON_CLK && OF && IOMEM + depends on COMMON_CLK && OF && HAS_IOMEM help Support for the Xilinx Clocking Wizard IP core clock generator.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 203/300 i2c: synquacer: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 8d744da241b81f4211f4813b0d3c1981326fa9ca ]
The driver overrides the error codes returned by platform_get_irq() to -ENODEV, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream.
--- drivers/i2c/busses/i2c-synquacer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-synquacer.c +1 -1
@@ -578,7 +578,7 @@ static int synquacer_i2c_probe(struct platform_device *pdev) i2c->irq =platform_get_irq (pdev,0 );if (i2c->irq <0 ) -return -ENODEV ; +return i2c->irq; ret =devm_request_irq (&pdev->dev, i2c->irq, synquacer_i2c_isr,0 ,dev_name (&pdev->dev), i2c);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 204/300 hwmon: (pmbus/bpa-rs600) Dont use rated limits as warn limits
In reply to Greg Kroah-HartmanFrom: Chris Packham <[email protected]>
[ Upstream commit 7a8c68c57fd09541377f6971f25efdeb9a926c37 ]
In the initial implementation a number of PMBUS_x_WARN_LIMITs were mapped to MFR fields. This was incorrect as these MFR limits reflect the rated limit as opposed to a limit which will generate warning. Instead return -ENXIO like we were already doing for other WARN_LIMITs.
Subsequently these rated limits have been exposed generically as new fields in the sysfs ABI so the values are still available.
--- drivers/hwmon/pmbus/bpa-rs600.c | 25 ------------------------- 1 file changed, 25 deletions(-)
drivers/hwmon/pmbus/bpa-rs600.c +0 -25
@@ -12,15 +12,6 @@#include <linux/pmbus.h> #include "pmbus.h" -#define BPARS600_MFR_VIN_MIN 0xa0 -#define BPARS600_MFR_VIN_MAX 0xa1 -#define BPARS600_MFR_IIN_MAX 0xa2 -#define BPARS600_MFR_PIN_MAX 0xa3 -#define BPARS600_MFR_VOUT_MIN 0xa4 -#define BPARS600_MFR_VOUT_MAX 0xa5 -#define BPARS600_MFR_IOUT_MAX 0xa6 -#define BPARS600_MFR_POUT_MAX 0xa7 -static int bpa_rs600_read_byte_data (struct i2c_client *client,int page,int reg) {int ret;
@@ -81,29 +72,13 @@ static int bpa_rs600_read_word_data(struct i2c_client *client, int page, int phaswitch (reg) {case PMBUS_VIN_UV_WARN_LIMIT : - ret =pmbus_read_word_data (client,0 ,0xff ,BPARS600_MFR_VIN_MIN ); -break ;case PMBUS_VIN_OV_WARN_LIMIT : - ret =pmbus_read_word_data (client,0 ,0xff ,BPARS600_MFR_VIN_MAX ); -break ;case PMBUS_VOUT_UV_WARN_LIMIT : - ret =pmbus_read_word_data (client,0 ,0xff ,BPARS600_MFR_VOUT_MIN ); -break ;case PMBUS_VOUT_OV_WARN_LIMIT : - ret =pmbus_read_word_data (client,0 ,0xff ,BPARS600_MFR_VOUT_MAX ); -break ;case PMBUS_IIN_OC_WARN_LIMIT : - ret =pmbus_read_word_data (client,0 ,0xff ,BPARS600_MFR_IIN_MAX ); -break ;case PMBUS_IOUT_OC_WARN_LIMIT : - ret =pmbus_read_word_data (client,0 ,0xff ,BPARS600_MFR_IOUT_MAX ); -break ;case PMBUS_PIN_OP_WARN_LIMIT : - ret =pmbus_read_word_data (client,0 ,0xff ,BPARS600_MFR_PIN_MAX ); -break ;case PMBUS_POUT_OP_WARN_LIMIT : - ret =pmbus_read_word_data (client,0 ,0xff ,BPARS600_MFR_POUT_MAX ); -break ;case PMBUS_VIN_UV_FAULT_LIMIT :case PMBUS_VIN_OV_FAULT_LIMIT :case PMBUS_VOUT_UV_FAULT_LIMIT :
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 205/300 hwmon: remove amd_energy driver in Makefile
In reply to Greg Kroah-HartmanFrom: Lukas Bulwahn <[email protected]>
[ Upstream commit b3a7ab2d4376726178909e27b6956c012277ac4e ]
Commit 9049572fb145 ("hwmon: Remove amd_energy driver") removes the driver, but misses to adjust the Makefile.
Hence, ./scripts/checkkconfigsymbols.py warns:
SENSORS_AMD_ENERGY
Referencing files: drivers/hwmon/Makefile
Remove the missing piece of this driver removal.
--- drivers/hwmon/Makefile | 1 - 1 file changed, 1 deletion(-)
drivers/hwmon/Makefile +0 -1
@@ -45,7 +45,6 @@ obj-$(CONFIG_SENSORS_ADT7462) += adt7462.o obj-$(CONFIG_SENSORS_ADT7470) += adt7470.o obj-$(CONFIG_SENSORS_ADT7475) += adt7475.o obj-$(CONFIG_SENSORS_AHT10) += aht10.o -obj-$(CONFIG_SENSORS_AMD_ENERGY) += amd_energy.o obj-$(CONFIG_SENSORS_APPLESMC) += applesmc.o obj-$(CONFIG_SENSORS_ARM_SCMI) += scmi-hwmon.o obj-$(CONFIG_SENSORS_ARM_SCPI) += scpi-hwmon.o
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 206/300 ASoC: fsl_rpmsg: Check -EPROBE_DEFER for getting clocks
In reply to Greg Kroah-HartmanFrom: Shengjiu Wang <[email protected]>
[ Upstream commit 2fbbcffea5b6adbfe90ffc842a6b3eb2d7e381ed ]
The devm_clk_get() may return -EPROBE_DEFER, then clocks will be assigned to NULL wrongly. As the clocks are optional so we can use devm_clk_get_optional() instead of devm_clk_get().
--- sound/soc/fsl/fsl_rpmsg.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
sound/soc/fsl/fsl_rpmsg.c +10 -10
@@ -165,25 +165,25 @@ static int fsl_rpmsg_probe(struct platform_device *pdev) }/* Get the optional clocks */ - rpmsg->ipg =devm_clk_get (&pdev->dev,"ipg" ); + rpmsg->ipg =devm_clk_get_optional (&pdev->dev,"ipg" );if (IS_ERR (rpmsg->ipg)) - rpmsg->ipg =NULL ; +return PTR_ERR (rpmsg->ipg); - rpmsg->mclk =devm_clk_get (&pdev->dev,"mclk" ); + rpmsg->mclk =devm_clk_get_optional (&pdev->dev,"mclk" );if (IS_ERR (rpmsg->mclk)) - rpmsg->mclk =NULL ; +return PTR_ERR (rpmsg->mclk); - rpmsg->dma =devm_clk_get (&pdev->dev,"dma" ); + rpmsg->dma =devm_clk_get_optional (&pdev->dev,"dma" );if (IS_ERR (rpmsg->dma)) - rpmsg->dma =NULL ; +return PTR_ERR (rpmsg->dma); - rpmsg->pll8k =devm_clk_get (&pdev->dev,"pll8k" ); + rpmsg->pll8k =devm_clk_get_optional (&pdev->dev,"pll8k" );if (IS_ERR (rpmsg->pll8k)) - rpmsg->pll8k =NULL ; +return PTR_ERR (rpmsg->pll8k); - rpmsg->pll11k =devm_clk_get (&pdev->dev,"pll11k" ); + rpmsg->pll11k =devm_clk_get_optional (&pdev->dev,"pll11k" );if (IS_ERR (rpmsg->pll11k)) - rpmsg->pll11k =NULL ; +return PTR_ERR (rpmsg->pll11k);platform_set_drvdata (pdev, rpmsg);pm_runtime_enable (&pdev->dev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 207/300 firmware: raspberrypi: Fix a leak in rpi_firmware_get()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 09cbd1df7d2615c19e40facbe31fdcb5f1ebfa96 ]
The reference taken by 'of_find_device_by_node()' must be released when not needed anymore.
Add the corresponding 'put_device()' in the normal and error handling paths.
--- drivers/firmware/raspberrypi.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/firmware/raspberrypi.c +8 -2
@@ -329,12 +329,18 @@ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node) fw =platform_get_drvdata (pdev);if (!fw) -return NULL ; + goto err_put_device;if (!kref_get_unless_zero (&fw->consumers)) -return NULL ; + goto err_put_device; + +put_device (&pdev->dev);return fw; + +err_put_device: +put_device (&pdev->dev); +return NULL ; }EXPORT_SYMBOL_GPL (rpi_firmware_get);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 208/300 usb: gadget: mv_u3d: request_irq() after initializing UDC
In reply to Greg Kroah-HartmanFrom: Nadezda Lutovinova <[email protected]>
[ Upstream commit 2af0c5ffadaf9d13eca28409d4238b4e672942d3 ]
If IRQ occurs between calling request_irq() and mv_u3d_eps_init(), then null pointer dereference occurs since u3d->eps[] wasn't initialized yet but used in mv_u3d_nuke().
The patch puts registration of the interrupt handler after initializing of neccesery data.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/usb/gadget/udc/mv_u3d_core.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/usb/gadget/udc/mv_u3d_core.c +10 -9
@@ -1921,14 +1921,6 @@ static int mv_u3d_probe(struct platform_device *dev) goto err_get_irq; } u3d->irq = r->start; -if (request_irq (u3d->irq, mv_u3d_irq, -IRQF_SHARED , driver_name, u3d)) { - u3d->irq =0 ; -dev_err (&dev->dev,"Request irq %d for u3d failed\n" , - u3d->irq); - retval = -ENODEV ; - goto err_request_irq; - }/* initialize gadget structure */ u3d->gadget.ops = &mv_u3d_ops;/* usb_gadget_ops */
@@ -1941,6 +1933,15 @@ static int mv_u3d_probe(struct platform_device *dev)mv_u3d_eps_init (u3d); +if (request_irq (u3d->irq, mv_u3d_irq, +IRQF_SHARED , driver_name, u3d)) { + u3d->irq =0 ; +dev_err (&dev->dev,"Request irq %d for u3d failed\n" , + u3d->irq); + retval = -ENODEV ; + goto err_request_irq; + } +/* external vbus detection */ if (u3d->vbus) { u3d->clock_gating =1 ;
@@ -1964,8 +1965,8 @@ static int mv_u3d_probe(struct platform_device *dev) err_unregister:free_irq (u3d->irq, u3d); -err_request_irq: err_get_irq: +err_request_irq:kfree (u3d->status_req); err_alloc_status_req:kfree (u3d->eps);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 209/300 mm/swap: consider max pages in iomap_swapfile_add_extent
In reply to Greg Kroah-HartmanFrom: Xu Yu <[email protected]>
[ Upstream commit 36ca7943ac18aebf8aad4c50829eb2ea5ec847df ]
When the max pages (last_page in the swap header + 1) is smaller than the total pages (inode size) of the swapfile, iomap_swapfile_activate overwrites sis->max with total pages.
However, frontswap_map is a swap page state bitmap allocated using the initial sis->max page count read from the swap header. If swapfile activation increases sis->max, it's possible for the frontswap code to walk off the end of the bitmap, thereby corrupting kernel memory.
[djwong: modify the description a bit; the original paragraph reads:
"However, frontswap_map is allocated using max pages. When test and clear the sis offset, which is larger than max pages, of frontswap_map in __frontswap_invalidate_page(), neighbors of frontswap_map may be overwritten, i.e., slab is polluted."
Note also that this bug resulted in a behavioral change: activating a swap file that was formatted and later extended results in all pages being activated, not the number of pages recorded in the swap header.]
This fixes the issue by considering the limitation of max pages of swap info in iomap_swapfile_add_extent().
To reproduce the case, compile kernel with slub RED ZONE, then run test:
$ sudo stress-ng -a 1 -x softlockup,resources -t 72h --metrics --times \ --verify -v -Y /root/tmpdir/stress-ng/stress-statistic-12.yaml \ --log-file /root/tmpdir/stress-ng/stress-logfile-12.txt \ --temp-path /root/tmpdir/stress-ng/
We'll get the error log as below:
[ 1151.015141] ============================================================================= [ 1151.016489] BUG kmalloc-16 (Not tainted): Right Redzone overwritten [ 1151.017486] ----------------------------------------------------------------------------- [ 1151.017486] [ 1151.018997] Disabling lock debugging due to kernel taint [ 1151.019873] INFO: 0x0000000084e43932-0x0000000098d17cae @offset=7392. First byte 0x0 instead of 0xcc [ 1151.021303] INFO: Allocated in __do_sys_swapon+0xcf6/0x1170 age=43417 cpu=9 pid=3816 [ 1151.022538] __slab_alloc+0xe/0x20 [ 1151.023069] __kmalloc_node+0xfd/0x4b0 [ 1151.023704] __do_sys_swapon+0xcf6/0x1170 [ 1151.024346] do_syscall_64+0x33/0x40 [ 1151.024925] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1151.025749] INFO: Freed in put_cred_rcu+0xa1/0xc0 age=43424 cpu=3 pid=2041 [ 1151.026889] kfree+0x276/0x2b0 [ 1151.027405] put_cred_rcu+0xa1/0xc0 [ 1151.027949] rcu_do_batch+0x17d/0x410 [ 1151.028566] rcu_core+0x14e/0x2b0 [ 1151.029084] __do_softirq+0x101/0x29e [ 1151.029645] asm_call_irq_on_stack+0x12/0x20 [ 1151.030381] do_softirq_own_stack+0x37/0x40 [ 1151.031037] do_softirq.part.15+0x2b/0x30 [ 1151.031710] __local_bh_enable_ip+0x4b/0x50 [ 1151.032412] copy_fpstate_to_sigframe+0x111/0x360 [ 1151.033197] __setup_rt_frame+0xce/0x480 [ 1151.033809] arch_do_signal+0x1a3/0x250 [ 1151.034463] exit_to_user_mode_prepare+0xcf/0x110 [ 1151.035242] syscall_exit_to_user_mode+0x27/0x190 [ 1151.035970] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1151.036795] INFO: Slab 0x000000003b9de4dc objects=44 used=9 fp=0x00000000539e349e flags=0xfffffc0010201 [ 1151.038323] INFO: Object 0x000000004855ba01 @offset=7376 fp=0x0000000000000000 [ 1151.038323] [ 1151.039683] Redzone 000000008d0afd3d: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ [ 1151.041180] Object 000000004855ba01: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1151.042714] Redzone 0000000084e43932: 00 00 00 c0 cc cc cc cc ........ [ 1151.044120] Padding 000000000864c042: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ [ 1151.045615] CPU: 5 PID: 3816 Comm: stress-ng Tainted: G B 5.10.50+ #7 [ 1151.046846] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 1151.048633] Call Trace: [ 1151.049072] dump_stack+0x57/0x6a [ 1151.049585] check_bytes_and_report+0xed/0x110 [ 1151.050320] check_object+0x1eb/0x290 [ 1151.050924] ? __x64_sys_swapoff+0x39a/0x540 [ 1151.051646] free_debug_processing+0x151/0x350 [ 1151.052333] __slab_free+0x21a/0x3a0 [ 1151.052938] ? _cond_resched+0x2d/0x40 [ 1151.053529] ? __vunmap+0x1de/0x220 [ 1151.054139] ? __x64_sys_swapoff+0x39a/0x540 [ 1151.054796] ? kfree+0x276/0x2b0 [ 1151.055307] kfree+0x276/0x2b0 [ 1151.055832] __x64_sys_swapoff+0x39a/0x540 [ 1151.056466] do_syscall_64+0x33/0x40 [ 1151.057084] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1151.057866] RIP: 0033:0x150340b0ffb7 [ 1151.058481] Code: Unable to access opcode bytes at RIP 0x150340b0ff8d. [ 1151.059537] RSP: 002b:00007fff7f4ee238 EFLAGS: 00000246 ORIG_RAX: 00000000000000a8 [ 1151.060768] RAX: ffffffffffffffda RBX: 00007fff7f4ee66c RCX: 0000150340b0ffb7 [ 1151.061904] RDX: 000000000000000a RSI: 0000000000018094 RDI: 00007fff7f4ee860 [ 1151.063033] RBP: 00007fff7f4ef980 R08: 0000000000000000 R09: 0000150340a672bd [ 1151.064135] R10: 00007fff7f4edca0 R11: 0000000000000246 R12: 0000000000018094 [ 1151.065253] R13: 0000000000000005 R14: 000000000160d930 R15: 00007fff7f4ee66c [ 1151.066413] FIX kmalloc-16: Restoring 0x0000000084e43932-0x0000000098d17cae=0xcc [ 1151.066413] [ 1151.067890] FIX kmalloc-16: Object at 0x000000004855ba01 not freed
--- fs/iomap/swapfile.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/iomap/swapfile.c +6 -0
@@ -31,11 +31,16 @@ static int iomap_swapfile_add_extent(struct iomap_swapfile_info *isi) {struct iomap *iomap = &isi->iomap;unsigned long nr_pages; +unsigned long max_pages;uint64_t first_ppage;uint64_t first_ppage_reported;uint64_t next_ppage;int error; +if (unlikely (isi->nr_pages >= isi->sis->max)) +return 0 ; + max_pages = isi->sis->max - isi->nr_pages; +/* * Round the start up and the end down so that the physical * extent aligns to a page boundary.
@@ -48,6 +53,7 @@ static int iomap_swapfile_add_extent(struct iomap_swapfile_info *isi)if (first_ppage >= next_ppage)return 0 ; nr_pages = next_ppage - first_ppage; + nr_pages =min (nr_pages, max_pages);/* * Calculate how much swap space we're adding; the first page contains
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 210/300 lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ
In reply to Greg Kroah-HartmanFrom: Kevin Mitchell <[email protected]>
[ Upstream commit d1f278da6b11585f05b2755adfc8851cbf14a1ec ]
When scsi_dispatch_cmd was moved to scsi_lib.c and made static, some compilers (i.e., at least gcc 8.4.0) decided to compile this inline. This is a problem for lkdtm.ko, which inserted a kprobe on this function for the SCSI_DISPATCH_CMD crashpoint.
Move this crashpoint one function up the call chain to scsi_queue_rq. Though this is also a static function, it should never be inlined because it is assigned as a structure entry. Therefore, kprobe_register should always be able to find it.
--- Documentation/fault-injection/provoke-crashes.rst | 2 +- drivers/misc/lkdtm/core.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
Documentation/fault-injection/provoke-crashes.rst +1 -1
@@ -29,7 +29,7 @@ recur_count cpoint_name Where in the kernel to trigger the action. It can be one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY, - FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_DISPATCH_CMD, + FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, IDE_CORE_CP, or DIRECT cpoint_type
drivers/misc/lkdtm/core.c +1 -1
@@ -81,7 +81,7 @@ static struct crashpoint crashpoints[] = {CRASHPOINT ("FS_DEVRW" ,"ll_rw_block" ),CRASHPOINT ("MEM_SWAPOUT" ,"shrink_inactive_list" ),CRASHPOINT ("TIMERADD" ,"hrtimer_start" ), -CRASHPOINT ("SCSI_DISPATCH_CMD" ,"scsi_dispatch_cmd" ), +CRASHPOINT ("SCSI_QUEUE_RQ" ,"scsi_queue_rq" ), CRASHPOINT("IDE_CORE_CP", "generic_ide_ioctl"), #endif };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 211/300 Bluetooth: add timeout sanity check to hci_inquiry
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit f41a4b2b5eb7872109723dab8ae1603bdd9d9ec1 ]
Syzbot hit "task hung" bug in hci_req_sync(). The problem was in unreasonable huge inquiry timeout passed from userspace. Fix it by adding sanity check for timeout value to hci_inquiry().
Since hci_inquiry() is the only user of hci_req_sync() with user controlled timeout value, it makes sense to check timeout value in hci_inquiry() and don't touch hci_req_sync().
--- net/bluetooth/hci_core.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/bluetooth/hci_core.c +6 -0
@@ -1343,6 +1343,12 @@ int hci_inquiry(void __user *arg) goto done; } +/* Restrict maximum inquiry length to 60 seconds */ +if (ir.length >60 ) { + err = -EINVAL ; + goto done; + } +hci_dev_lock (hdev);if (inquiry_cache_age (hdev) >INQUIRY_CACHE_AGE_MAX ||inquiry_cache_empty (hdev) || ir.flags &IREQ_CACHE_FLUSH ) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 212/300 i2c: iop3xx: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit a1299505162ad00def3573260c2c68b9c8e8d697 ]
When adding the code to handle platform_get_irq*() errors in the commit 489447380a29 ("handle errors returned by platform_get_irq*()"), the actual error code was enforced to be -ENXIO in the driver for some strange reason. This didn't matter much until the deferred probing was introduced -- which requires an actual error code to be propagated upstream from the failure site.
While fixing this, also stop overriding the errors from request_irq() to -EIO (done since the pre-git era).
--- drivers/i2c/busses/i2c-iop3xx.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-iop3xx.c +2 -4
@@ -469,16 +469,14 @@ iop3xx_i2c_probe(struct platform_device *pdev) irq =platform_get_irq (pdev,0 );if (irq <0 ) { - ret = -ENXIO ; + ret = irq; goto unmap; } ret =request_irq (irq, iop3xx_i2c_irq_handler,0 , pdev->name, adapter_data); -if (ret) { - ret = -EIO ; +if (ret) goto unmap; - }memcpy (new_adapter->name, pdev->name,strlen (pdev->name)); new_adapter->owner =THIS_MODULE ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 213/300 i2c: s3c2410: fix IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit d6840a5e370b7ea4fde16ce2caf431bcc87f9a75 ]
Iff platform_get_irq() returns 0, the driver's probe() method will return 0 early (as if the method's call was successful). Let's consider IRQ0 valid for simplicity -- devm_request_irq() can always override that decision...
--- drivers/i2c/busses/i2c-s3c2410.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-s3c2410.c +1 -1
@@ -1137,7 +1137,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)*/ if (!(i2c->quirks &QUIRK_POLL )) { i2c->irq = ret =platform_get_irq (pdev,0 ); -if (ret <=0 ) { +if (ret <0 ) {dev_err (&pdev->dev,"cannot find IRQ\n" );clk_unprepare (i2c->clk);return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 214/300 i2c: hix5hd2: fix IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit f9b459c2ba5edfe247e86b45ad5dea8da542f3ea ]
Iff platform_get_irq() returns 0, the driver's probe() method will return 0 early (as if the method's call was successful). Let's consider IRQ0 valid for simplicity -- devm_request_irq() can always override that decision...
--- drivers/i2c/busses/i2c-hix5hd2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-hix5hd2.c +1 -1
@@ -413,7 +413,7 @@ static int hix5hd2_i2c_probe(struct platform_device *pdev)return PTR_ERR (priv->regs); irq =platform_get_irq (pdev,0 ); -if (irq <=0 ) +if (irq <0 )return irq; priv->clk =devm_clk_get (&pdev->dev,NULL );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 215/300 gfs2: init system threads before freeze lock
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit a28dc123fa66ba7f3eca7cffc4b01d96bfd35c27 ]
Patch 96b1454f2e ("gfs2: move freeze glock outside the make_fs_rw and _ro functions") changed the gfs2 mount sequence so that it holds the freeze lock before calling gfs2_make_fs_rw. Before this patch, gfs2_make_fs_rw called init_threads to initialize the quotad and logd threads. That is a problem if the system needs to withdraw due to IO errors early in the mount sequence, for example, while initializing the system statfs inode:
1. An IO error causes the statfs glock to not sync properly after recovery, and leaves items on the ail list.
2. The leftover items on the ail list causes its do_xmote call to fail, which makes it want to withdraw. But since the glock code cannot withdraw (because the withdraw sequence uses glocks) it relies upon the logd daemon to initiate the withdraw.
3. The withdraw can never be performed by the logd daemon because all this takes place before the logd daemon is started.
This patch moves function init_threads from super.c to ops_fstype.c and it changes gfs2_fill_super to start its threads before holding the freeze lock, and if there's an error, stop its threads after releasing it. This allows the logd to run unblocked by the freeze lock. Thus, the logd daemon can perform its withdraw sequence properly.
--- fs/gfs2/ops_fstype.c | 42 ++++++++++++++++++++++++++++++ fs/gfs2/super.c | 61 +++++--------------------------------------- 2 files changed, 48 insertions(+), 55 deletions(-)
fs/gfs2/ops_fstype.c +42 -0
@@ -1089,6 +1089,34 @@ void gfs2_online_uevent(struct gfs2_sbd *sdp)kobject_uevent_env (&sdp->sd_kobj,KOBJ_ONLINE , envp); } +static int init_threads (struct gfs2_sbd *sdp) +{ +struct task_struct *p; +int error =0 ; + + p =kthread_run (gfs2_logd, sdp,"gfs2_logd" ); +if (IS_ERR (p)) { + error =PTR_ERR (p); +fs_err (sdp,"can't start logd thread: %d\n" , error); +return error; + } + sdp->sd_logd_process = p; + + p =kthread_run (gfs2_quotad, sdp,"gfs2_quotad" ); +if (IS_ERR (p)) { + error =PTR_ERR (p); +fs_err (sdp,"can't start quotad thread: %d\n" , error); + goto fail; + } + sdp->sd_quotad_process = p; +return 0 ; + +fail: +kthread_stop (sdp->sd_logd_process); + sdp->sd_logd_process =NULL ; +return error; +} +/** * gfs2_fill_super - Read in superblock * @sb: The VFS superblock
@@ -1217,6 +1245,14 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc) goto fail_per_node; } +if (!sb_rdonly (sb)) { + error =init_threads (sdp); +if (error) { +gfs2_withdraw_delayed (sdp); + goto fail_per_node; + } + } + error =gfs2_freeze_lock (sdp, &freeze_gh,0 );if (error) goto fail_per_node;
@@ -1226,6 +1262,12 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)gfs2_freeze_unlock (&freeze_gh);if (error) { +if (sdp->sd_quotad_process) +kthread_stop (sdp->sd_quotad_process); + sdp->sd_quotad_process =NULL ; +if (sdp->sd_logd_process) +kthread_stop (sdp->sd_logd_process); + sdp->sd_logd_process =NULL ;fs_err (sdp,"can't make FS RW: %d\n" , error); goto fail_per_node; }
fs/gfs2/super.c +6 -55
86 lines not on this page · raw message
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 216/300 rsi: fix error code in rsi_load_9116_firmware()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit d0f8430332a16c7baa80ce2886339182c5d85f37 ]
This code returns success if the kmemdup() fails, but obviously it should return -ENOMEM instead.
--- drivers/net/wireless/rsi/rsi_91x_hal.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/rsi/rsi_91x_hal.c +3 -1
@@ -1038,8 +1038,10 @@ static int rsi_load_9116_firmware(struct rsi_hw *adapter) } ta_firmware =kmemdup (fw_entry->data, fw_entry->size,GFP_KERNEL ); -if (!ta_firmware) +if (!ta_firmware) { + status = -ENOMEM ; goto fail_release_fw; + } fw_p = ta_firmware; instructions_sz = fw_entry->size;rsi_dbg (INFO_ZONE ,"FW Length = %d bytes\n" , instructions_sz);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 217/300 rsi: fix an error code in rsi_probe()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 9adcdf6758d7c4c9bdaf22d78eb9fcae260ed113 ]
Return -ENODEV instead of success for unsupported devices.
--- drivers/net/wireless/rsi/rsi_91x_usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/rsi/rsi_91x_usb.c +1 -0
@@ -816,6 +816,7 @@ static int rsi_probe(struct usb_interface *pfunction, }else {rsi_dbg (ERR_ZONE ,"%s: Unsupported RSI device id 0x%x\n" , __func__, id->idProduct); + status = -ENODEV ; goto err1; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 218/300 octeontx2-af: cn10k: Fix SDP base channel number
In reply to Greg Kroah-HartmanFrom: Subbaraya Sundeep <[email protected]>
[ Upstream commit 477b53f3f95ba5341b4320f8b7a92cedc5a67650 ]
As per hardware the base channel number configured for programmable channels of a block must be multiple of number of channels of that block. This condition is not met for SDP base channel currently. Hence this patch ensures all the base channel numbers of all blocks are multiple of number of channels present in the blocks. Also instead of hardcoding SDP number of channels the same is read from the NIX_AF_CONST1 register.
--- .../ethernet/marvell/octeontx2/af/common.h | 2 -- .../ethernet/marvell/octeontx2/af/rvu_cn10k.c | 31 +++++++++++++------ 2 files changed, 22 insertions(+), 11 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/common.h +0 -2
@@ -195,8 +195,6 @@ enum nix_scheduler {#define NIX_CHAN_LBK_CHX (a, b) (0 + 0x100 * (a) + (b))#define NIX_CHAN_SDP_CH_START (0x700ull) -#define SDP_CHANNELS 256 -/* NIX LSO format indices. * As of now TSO is the only one using, so statically assigning indices. */
drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c +22 -9
@@ -12,9 +12,10 @@int rvu_set_channels_base (struct rvu *rvu) { +u16 nr_lbk_chans, nr_sdp_chans, nr_cgx_chans, nr_cpt_chans; +u16 sdp_chan_base, cgx_chan_base, cpt_chan_base;struct rvu_hwinfo *hw = rvu->hw; -u16 cpt_chan_base; -u64 nix_const; +u64 nix_const, nix_const1;int blkaddr; blkaddr =rvu_get_blkaddr (rvu,BLKTYPE_NIX ,0 );
@@ -22,6 +23,7 @@ int rvu_set_channels_base(struct rvu *rvu)return blkaddr; nix_const =rvu_read64 (rvu, blkaddr,NIX_AF_CONST ); + nix_const1 =rvu_read64 (rvu, blkaddr,NIX_AF_CONST1 ); hw->cgx = (nix_const >>12 ) &0xFULL ; hw->lmac_per_cgx = (nix_const >>8 ) &0xFULL ;
@@ -44,14 +46,24 @@ int rvu_set_channels_base(struct rvu *rvu)* channels such that all channel numbers are contiguous * leaving no holes. This way the new CPT channels can be * accomodated. The order of channel numbers assigned is -* LBK, SDP, CGX and CPT. +* LBK, SDP, CGX and CPT. Also the base channel number +* of a block must be multiple of number of channels +* of the block. */ - hw->sdp_chan_base = hw->lbk_chan_base + hw->lbk_links * - ((nix_const >>16 ) &0xFFULL ); - hw->cgx_chan_base = hw->sdp_chan_base + hw->sdp_links *SDP_CHANNELS ; + nr_lbk_chans = (nix_const >>16 ) &0xFFULL ; + nr_sdp_chans = nix_const1 &0xFFFULL ; + nr_cgx_chans = nix_const &0xFFULL ; + nr_cpt_chans = (nix_const >>32 ) &0xFFFULL ; - cpt_chan_base = hw->cgx_chan_base + hw->cgx_links * - (nix_const &0xFFULL ); + sdp_chan_base = hw->lbk_chan_base + hw->lbk_links * nr_lbk_chans; +/* Round up base channel to multiple of number of channels */ + hw->sdp_chan_base =ALIGN (sdp_chan_base, nr_sdp_chans); + + cgx_chan_base = hw->sdp_chan_base + hw->sdp_links * nr_sdp_chans; + hw->cgx_chan_base =ALIGN (cgx_chan_base, nr_cgx_chans); + + cpt_chan_base = hw->cgx_chan_base + hw->cgx_links * nr_cgx_chans; + hw->cpt_chan_base =ALIGN (cpt_chan_base, nr_cpt_chans);/* Out of 4096 channels start CPT from 2048 so * that MSB for CPT channels is always set
@@ -155,6 +167,7 @@ err_put:static void __rvu_nix_set_channels (struct rvu *rvu,int blkaddr) { +u64 nix_const1 =rvu_read64 (rvu, blkaddr,NIX_AF_CONST1 );u64 nix_const =rvu_read64 (rvu, blkaddr,NIX_AF_CONST );u16 cgx_chans, lbk_chans, sdp_chans, cpt_chans;struct rvu_hwinfo *hw = rvu->hw;
@@ -164,7 +177,7 @@ static void __rvu_nix_set_channels(struct rvu *rvu, int blkaddr) cgx_chans = nix_const &0xFFULL ; lbk_chans = (nix_const >>16 ) &0xFFULL ; - sdp_chans =SDP_CHANNELS ; + sdp_chans = nix_const1 &0xFFFULL ; cpt_chans = (nix_const >>32 ) &0xFFFULL ; start = hw->cgx_chan_base;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 219/300 octeontx2-pf: send correct vlan priority mask to npc_install_flow_req
In reply to Greg Kroah-HartmanFrom: Naveen Mamindlapalli <[email protected]>
[ Upstream commit 10df5a13ac6785b409ad749c4b10d4b220cc7e71 ]
This patch corrects the erroneous vlan priority mask field that was send to npc_install_flow_req.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c +2 -2
@@ -385,8 +385,8 @@ static int otx2_tc_prepare_flow(struct otx2_nic *nic, match.key->vlan_priority <<13 ; vlan_tci_mask = match.mask->vlan_id | - match.key->vlan_dei <<12 | - match.key->vlan_priority <<13 ; + match.mask->vlan_dei <<12 | + match.mask->vlan_priority <<13 ; flow_spec->vlan_tci =htons (vlan_tci); flow_mask->vlan_tci =htons (vlan_tci_mask);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 220/300 octeontx2-pf: Dont install VLAN offload rule if netdev is down
In reply to Greg Kroah-HartmanFrom: Sunil Goutham <[email protected]>
[ Upstream commit 05209e3570e452cdaa644e8398a8875b6a91051d ]
Whenever user changes interface MAC address both default DMAC based MCAM rule and VLAN offload (for strip) rules are updated with new MAC address. To update or install VLAN offload rule PF driver needs interface's receive channel info, which is retrieved from admin function at the time of NIXLF initialization.
If user changes MAC address before interface is UP, VLAN offload rule installation will fail and throw error as receive channel is not valid. To avoid this, skip VLAN offload rule installation if netdev is not UP. This rule will anyway be reinslatted as part of open() call.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +2 -1
@@ -208,7 +208,8 @@ int otx2_set_mac_address(struct net_device *netdev, void *p)if (!otx2_hw_set_mac_addr (pfvf, addr->sa_data)) {memcpy (netdev->dev_addr, addr->sa_data, netdev->addr_len);/* update dmac field in vlan offload rule */ -if (pfvf->flags &OTX2_FLAG_RX_VLAN_SUPPORT ) +if (netif_running (netdev) && + pfvf->flags &OTX2_FLAG_RX_VLAN_SUPPORT )otx2_install_rxvlan_offload_flow (pfvf); }else {return -EPERM ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 221/300 octeontx2-pf: Fix algorithm index in MCAM rules with RSS action
In reply to Greg Kroah-HartmanFrom: Sunil Goutham <[email protected]>
[ Upstream commit e7938365459f3a6d4edf212f435c4ad635621450 ]
Otherthan setting action as RSS in NPC MCAM entry, RSS flowkey algorithm index also needs to be set. Otherwise whatever algorithm is defined at flowkey index '0' will be considered by HW and pkt flows will be distributed as such.
Fix this by saving the flowkey index sent by admin function while initializing RSS and then use it when framing MCAM rules.
--- .../net/ethernet/marvell/octeontx2/nic/otx2_common.c | 11 +++++++++++ .../net/ethernet/marvell/octeontx2/nic/otx2_common.h | 3 +++ .../net/ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 + 3 files changed, 15 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +11 -0
@@ -266,6 +266,7 @@ unlock:int otx2_set_flowkey_cfg (struct otx2_nic *pfvf) {struct otx2_rss_info *rss = &pfvf->hw.rss_info; +struct nix_rss_flowkey_cfg_rsp *rsp;struct nix_rss_flowkey_cfg *req;int err;
@@ -280,6 +281,16 @@ int otx2_set_flowkey_cfg(struct otx2_nic *pfvf) req->group =DEFAULT_RSS_CONTEXT_GROUP ; err =otx2_sync_mbox_msg (&pfvf->mbox); +if (err) + goto fail; + + rsp = (struct nix_rss_flowkey_cfg_rsp *) +otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) + goto fail; + + pfvf->hw.flowkey_alg_idx = rsp->alg_idx; +fail:mutex_unlock (&pfvf->mbox.lock);return err; }
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +3 -0
@@ -195,6 +195,9 @@ struct otx2_hw {u8 lso_udpv4_idx;u8 lso_udpv6_idx; +/* RSS */ +u8 flowkey_alg_idx; +/* MSI-X */ u8 cint_cnt;/* CQ interrupt count */ u16 npa_msixoff;/* Offset of NPA vectors */
drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c +1 -0
@@ -682,6 +682,7 @@ static int otx2_add_flow_msg(struct otx2_nic *pfvf, struct otx2_flow *flow)if (flow->flow_spec.flow_type &FLOW_RSS ) { req->op =NIX_RX_ACTIONOP_RSS ; req->index = flow->rss_ctx_id; + req->flow_key_alg = pfvf->hw.flowkey_alg_idx; }else { req->op =NIX_RX_ACTIONOP_UCAST ; req->index =ethtool_get_flow_spec_ring (ring_cookie);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 222/300 m68k: coldfire: return success for clk_enable(NULL)
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit f6a4f0b424df957d84fa7b9f2d02981234ff5828 ]
The clk_enable is supposed work when CONFIG_HAVE_CLK is false, but it returns -EINVAL. That means some drivers fail during probe.
[ 1.680000] flexcan: probe of flexcan.0 failed with error -22
--- arch/m68k/coldfire/clk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/coldfire/clk.c +1 -1
@@ -92,7 +92,7 @@ int clk_enable(struct clk *clk)unsigned long flags;if (!clk) -return -EINVAL ; +return 0 ;spin_lock_irqsave (&clk_lock, flags);if ((clk->enabled++ ==0 ) && clk->clk_ops)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 223/300 ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373
In reply to Greg Kroah-HartmanFrom: Cezary Rojewski <[email protected]>
[ Upstream commit 6d41bbf2fd3615c56dbf2b67f6cbf9e83d14a2e2 ]
Contrary to what is said in board's file, topology targeting kbl_da7219_max98373 expects format 16b, not 24/32b. Partially revert changes added in 'ASoC: Intel: Boards: Add Maxim98373 support' to bring old behavior back, aligning with topology expectations.
--- sound/soc/intel/boards/kbl_da7219_max98927.c | 55 +++----------------- 1 file changed, 7 insertions(+), 48 deletions(-)
sound/soc/intel/boards/kbl_da7219_max98927.c +7 -48
@@ -199,7 +199,7 @@ static int kabylake_ssp0_hw_params(struct snd_pcm_substream *substream, }if (!strcmp (codec_dai->component->name,MAX98373_DEV0_NAME )) { ret =snd_soc_dai_set_tdm_slot (codec_dai, -0x03 ,3 ,8 ,24 ); +0x30 ,3 ,8 ,16 );if (ret <0 ) {dev_err (runtime->dev,"DEV0 TDM slot err:%d\n" , ret);
@@ -208,10 +208,10 @@ static int kabylake_ssp0_hw_params(struct snd_pcm_substream *substream, }if (!strcmp (codec_dai->component->name,MAX98373_DEV1_NAME )) { ret =snd_soc_dai_set_tdm_slot (codec_dai, -0x0C ,3 ,8 ,24 ); +0xC0 ,3 ,8 ,16 );if (ret <0 ) {dev_err (runtime->dev, -"DEV0 TDM slot err:%d\n" , ret); +"DEV1 TDM slot err:%d\n" , ret);return ret; } }
@@ -311,24 +311,6 @@ static int kabylake_ssp_fixup(struct snd_soc_pcm_runtime *rtd,* The above 2 loops are mutually exclusive based on the stream direction, * thus rtd_dpcm variable will never be overwritten */ -/* -* Topology for kblda7219m98373 & kblmax98373 supports only S24_LE, -* where as kblda7219m98927 & kblmax98927 supports S16_LE by default. -* Skipping the port wise FE and BE configuration for kblda7219m98373 & -* kblmax98373 as the topology (FE & BE) supports S24_LE only. -*/ - -if (!strcmp (rtd->card->name,"kblda7219m98373" ) || - !strcmp (rtd->card->name,"kblmax98373" )) { -/* The ADSP will convert the FE rate to 48k, stereo */ - rate->min = rate->max =48000 ; - chan->min = chan->max =DUAL_CHANNEL ; - -/* set SSP to 24 bit */ -snd_mask_none (fmt); -snd_mask_set_format (fmt,SNDRV_PCM_FORMAT_S24_LE ); -return 0 ; - }/* * The ADSP will convert the FE rate to 48k, stereo, 24 bit
@@ -479,31 +461,20 @@ static struct snd_pcm_hw_constraint_list constraints_channels_quad = {static int kbl_fe_startup (struct snd_pcm_substream *substream) {struct snd_pcm_runtime *runtime = substream->runtime; -struct snd_soc_pcm_runtime *soc_rt =asoc_substream_to_rtd (substream);/* * On this platform for PCM device we support, * 48Khz * stereo +* 16 bit audio */ runtime->hw.channels_max =DUAL_CHANNEL ;snd_pcm_hw_constraint_list (runtime,0 ,SNDRV_PCM_HW_PARAM_CHANNELS , &constraints_channels); -/* -* Setup S24_LE (32 bit container and 24 bit valid data) for -* kblda7219m98373 & kblmax98373. For kblda7219m98927 & -* kblmax98927 keeping it as 16/16 due to topology FW dependency. -*/ -if (!strcmp (soc_rt->card->name,"kblda7219m98373" ) || - !strcmp (soc_rt->card->name,"kblmax98373" )) { - runtime->hw.formats =SNDRV_PCM_FMTBIT_S24_LE ; -snd_pcm_hw_constraint_msbits (runtime,0 ,32 ,24 ); - - }else { - runtime->hw.formats =SNDRV_PCM_FMTBIT_S16_LE ; -snd_pcm_hw_constraint_msbits (runtime,0 ,16 ,16 ); - } + + runtime->hw.formats =SNDRV_PCM_FMTBIT_S16_LE ; +snd_pcm_hw_constraint_msbits (runtime,0 ,16 ,16 );snd_pcm_hw_constraint_list (runtime,0 ,SNDRV_PCM_HW_PARAM_RATE , &constraints_rates);
@@ -536,23 +507,11 @@ static int kabylake_dmic_fixup(struct snd_soc_pcm_runtime *rtd,static int kabylake_dmic_startup (struct snd_pcm_substream *substream) {struct snd_pcm_runtime *runtime = substream->runtime; -struct snd_soc_pcm_runtime *soc_rt =asoc_substream_to_rtd (substream); runtime->hw.channels_min = runtime->hw.channels_max =QUAD_CHANNEL ;snd_pcm_hw_constraint_list (runtime,0 ,SNDRV_PCM_HW_PARAM_CHANNELS , &constraints_channels_quad); -/* -* Topology for kblda7219m98373 & kblmax98373 supports only S24_LE. -* The DMIC also configured for S24_LE. Forcing the DMIC format to -* S24_LE due to the topology FW dependency. -*/ -if (!strcmp (soc_rt->card->name,"kblda7219m98373" ) || - !strcmp (soc_rt->card->name,"kblmax98373" )) { - runtime->hw.formats =SNDRV_PCM_FMTBIT_S24_LE ; -snd_pcm_hw_constraint_msbits (runtime,0 ,32 ,24 ); - } -return snd_pcm_hw_constraint_list (substream->runtime,0 ,SNDRV_PCM_HW_PARAM_RATE , &constraints_rates); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 224/300 ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs
In reply to Greg Kroah-HartmanFrom: Cezary Rojewski <[email protected]>
[ Upstream commit 126b3422adc80f29d2129db7f61e0113a8a526c6 ]
Advancing pointer initially fixed issue for some users but caused regression for others. Leave data as it to make it easier for end users to adjust their topology files if needed.
--- sound/soc/intel/skylake/skl-topology.c | 6 ------ 1 file changed, 6 deletions(-)
sound/soc/intel/skylake/skl-topology.c +0 -6
@@ -1463,12 +1463,6 @@ static int skl_tplg_tlv_control_set(struct snd_kcontrol *kcontrol,struct skl_dev *skl =get_skl_ctx (w->dapm->dev);if (ac->params) { -/* -* Widget data is expected to be stripped of T and L -*/ - size -=2 *sizeof (unsigned int ); - data +=2 ; -if (size > ac->max)return -EINVAL ; ac->size = size;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 225/300 ASoC: Intel: Skylake: Fix module resource and format selection
In reply to Greg Kroah-HartmanFrom: Cezary Rojewski <[email protected]>
[ Upstream commit e8b374b649afe756c2470e0e6668022e90bf8518 ]
Module configuration may differ between its instances depending on resources required and input and output audio format. Available parameters to select from are stored in module resource and interface (format) lists. These come from topology, together with description of each of pipe's modules.
Ignoring index value provided by topology and relying always on 0th entry leads to unexpected module behavior due to under/overbudged resources assigned or impropper format selection. Fix by taking entry at index specified by topology.
--- sound/soc/intel/skylake/skl-topology.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
sound/soc/intel/skylake/skl-topology.c +10 -9
@@ -113,7 +113,7 @@ static int is_skl_dsp_widget_type(struct snd_soc_dapm_widget *w,static void skl_dump_mconfig (struct skl_dev *skl,struct skl_module_cfg *mcfg) { -struct skl_module_iface *iface = &mcfg->module->formats[0 ]; +struct skl_module_iface *iface = &mcfg->module->formats[mcfg->fmt_idx];dev_dbg (skl->dev,"Dumping config\n" );dev_dbg (skl->dev,"Input Format:\n" );
@@ -195,8 +195,8 @@ static void skl_tplg_update_params_fixup(struct skl_module_cfg *m_cfg,struct skl_module_fmt *in_fmt, *out_fmt;/* Fixups will be applied to pin 0 only */ - in_fmt = &m_cfg->module->formats[0 ].inputs[0 ].fmt; - out_fmt = &m_cfg->module->formats[0 ].outputs[0 ].fmt; + in_fmt = &m_cfg->module->formats[m_cfg->fmt_idx].inputs[0 ].fmt; + out_fmt = &m_cfg->module->formats[m_cfg->fmt_idx].outputs[0 ].fmt;if (params->stream ==SNDRV_PCM_STREAM_PLAYBACK ) {if (is_fe) {
@@ -239,9 +239,9 @@ static void skl_tplg_update_buffer_size(struct skl_dev *skl,/* Since fixups is applied to pin 0 only, ibs, obs needs * change for pin 0 only */ - res = &mcfg->module->resources[0 ]; - in_fmt = &mcfg->module->formats[0 ].inputs[0 ].fmt; - out_fmt = &mcfg->module->formats[0 ].outputs[0 ].fmt; + res = &mcfg->module->resources[mcfg->res_idx]; + in_fmt = &mcfg->module->formats[mcfg->fmt_idx].inputs[0 ].fmt; + out_fmt = &mcfg->module->formats[mcfg->fmt_idx].outputs[0 ].fmt;if (mcfg->m_type ==SKL_MODULE_TYPE_SRCINT ) multiplier =5 ;
@@ -1631,11 +1631,12 @@ int skl_tplg_update_pipe_params(struct device *dev,struct skl_module_cfg *mconfig, struct skl_pipe_params *params) { - struct skl_module_res *res = &mconfig->module->resources[0]; + struct skl_module_res *res;struct skl_dev *skl =get_skl_ctx (dev);struct skl_module_fmt *format =NULL ;u8 cfg_idx = mconfig->pipe->cur_config_idx; + res = &mconfig->module->resources[mconfig->res_idx];skl_tplg_fill_dma_id (mconfig, params); mconfig->fmt_idx = mconfig->mod_cfg[cfg_idx].fmt_idx; mconfig->res_idx = mconfig->mod_cfg[cfg_idx].res_idx;
@@ -1644,9 +1645,9 @@ int skl_tplg_update_pipe_params(struct device *dev,return 0 ;if (params->stream ==SNDRV_PCM_STREAM_PLAYBACK ) - format = &mconfig->module->formats[0 ].inputs[0 ].fmt; + format = &mconfig->module->formats[mconfig->fmt_idx].inputs[0 ].fmt;else - format = &mconfig->module->formats[0 ].outputs[0 ].fmt; + format = &mconfig->module->formats[mconfig->fmt_idx].outputs[0 ].fmt;/* set the hw_params */ format->s_freq = params->s_freq;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 226/300 mmc: sdhci: Fix issue with uninitialized dma_slave_config
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit 522654d534d315d540710124c57b49ca22ac5f72 ]
Depending on the DMA driver being used, the struct dma_slave_config may need to be initialized to zero for the unused data.
For example, we have three DMA drivers using src_port_window_size and dst_port_window_size. If these are left uninitialized, it can cause DMA failures at least if external TI SDMA is ever configured for sdhci.
For other external DMA cases, this is probably not currently an issue but is still good to fix though.
--- drivers/mmc/host/sdhci.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/sdhci.c +1 -0
@@ -1222,6 +1222,7 @@ static int sdhci_external_dma_setup(struct sdhci_host *host,if (!host->mapbase)return -EINVAL ; +memset (&cfg,0 ,sizeof (cfg)); cfg.src_addr = host->mapbase +SDHCI_BUFFER ; cfg.dst_addr = host->mapbase +SDHCI_BUFFER ; cfg.src_addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 227/300 mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit c3ff0189d3bc9c03845fe37472c140f0fefd0c79 ]
Depending on the DMA driver being used, the struct dma_slave_config may need to be initialized to zero for the unused data.
For example, we have three DMA drivers using src_port_window_size and dst_port_window_size. If these are left uninitialized, it can cause DMA failures.
For dw_mmc, this is probably not currently an issue but is still good to fix though.
--- drivers/mmc/host/dw_mmc.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/dw_mmc.c +1 -0
@@ -782,6 +782,7 @@ static int dw_mci_edmac_start_dma(struct dw_mci *host,int ret =0 ;/* Set external dma config: burst size, burst width */ +memset (&cfg,0 ,sizeof (cfg)); cfg.dst_addr = host->phy_regs + fifo_offset; cfg.src_addr = cfg.dst_addr; cfg.dst_addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 228/300 mmc: moxart: Fix issue with uninitialized dma_slave_config
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit ee5165354d498e5bceb0b386e480ac84c5f8c28c ]
Depending on the DMA driver being used, the struct dma_slave_config may need to be initialized to zero for the unused data.
For example, we have three DMA drivers using src_port_window_size and dst_port_window_size. If these are left uninitialized, it can cause DMA failures.
For moxart, this is probably not currently an issue but is still good to fix though.
--- drivers/mmc/host/moxart-mmc.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/moxart-mmc.c +1 -0
@@ -628,6 +628,7 @@ static int moxart_probe(struct platform_device *pdev) host->dma_chan_tx, host->dma_chan_rx); host->have_dma = true; +memset (&cfg,0 ,sizeof (cfg)); cfg.src_addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ; cfg.dst_addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 229/300 bpf: Fix possible out of bound write in narrow load handling
In reply to Greg Kroah-HartmanFrom: Andrey Ignatov <[email protected]>
[ Upstream commit d7af7e497f0308bc97809cc48b58e8e0f13887e1 ]
Fix a verifier bug found by smatch static checker in [0].
This problem has never been seen in prod to my best knowledge. Fixing it still seems to be a good idea since it's hard to say for sure whether it's possible or not to have a scenario where a combination of convert_ctx_access() and a narrow load would lead to an out of bound write.
When narrow load is handled, one or two new instructions are added to insn_buf array, but before it was only checked that
cnt >= ARRAY_SIZE(insn_buf)
And it's safe to add a new instruction to insn_buf[cnt++] only once. The second try will lead to out of bound write. And this is what can happen if shift is set.
Fix it by making sure that if the BPF_RSH instruction has to be added in addition to BPF_AND then there is enough space for two more instructions in insn_buf.
The full report [0] is below:
kernel/bpf/verifier.c:12304 convert_ctx_accesses() warn: offset 'cnt' incremented past end of array kernel/bpf/verifier.c:12311 convert_ctx_accesses() warn: offset 'cnt' incremented past end of array
kernel/bpf/verifier.c
12282
12283 insn->off = off & ~(size_default - 1);
12284 insn->code = BPF_LDX | BPF_MEM | size_code;
12285 }
12286
12287 target_size = 0;
12288 cnt = convert_ctx_access(type, insn, insn_buf, env->prog,
12289 &target_size);
12290 if (cnt == 0 || cnt >= ARRAY_SIZE(insn_buf) ||
^^^^^^^^^^^^^^^^^^^^^^^^^^^Bounds check.
12291 (ctx_field_size && !target_size)) {
12292 verbose(env, "bpf verifier is misconfigured\n");
12293 return -EINVAL;
12294 }
12295
12296 if (is_narrower_load && size < target_size) {
12297 u8 shift = bpf_ctx_narrow_access_offset(
12298 off, size, size_default) * 8;
12299 if (ctx_field_size <= 4) {
12300 if (shift)
12301 insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH,
^^^^^increment beyond end of array
12302 insn->dst_reg,
12303 shift);
--> 12304 insn_buf[cnt++] = BPF_ALU32_IMM(BPF_AND, insn->dst_reg,
^^^^^out of bounds write
12305 (1 << size * 8) - 1);
12306 } else {
12307 if (shift)
12308 insn_buf[cnt++] = BPF_ALU64_IMM(BPF_RSH,
12309 insn->dst_reg,
12310 shift);
12311 insn_buf[cnt++] = BPF_ALU64_IMM(BPF_AND, insn->dst_reg,
^^^^^^^^^^^^^^^Same.
12312 (1ULL << size * 8) - 1);
12313 }
12314 }
12315
12316 new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
12317 if (!new_prog)
12318 return -ENOMEM;
12319
12320 delta += cnt - 1;
12321
12322 /* keep walking new program and skip insns we just inserted */
12323 env->prog = new_prog;
12324 insn = new_prog->insnsi + i + delta;
12325 }
12326
12327 return 0;
12328 }[0] https://lore.kernel.org/bpf/20210817050843.GA21456@kili/
v1->v2:
- clarify that problem was only seen by static checker but not in prod;
--- kernel/bpf/verifier.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/bpf/verifier.c +4 -0
@@ -11982,6 +11982,10 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)if (is_narrower_load && size < target_size) {u8 shift =bpf_ctx_narrow_access_offset ( off, size, size_default) *8 ; +if (shift && cnt +1 >=ARRAY_SIZE (insn_buf)) { +verbose (env,"bpf verifier narrow ctx load misconfigured\n" ); +return -EINVAL ; + }if (ctx_field_size <=4 ) {if (shift) insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 230/300 CIFS: Fix a potencially linear read overflow
In reply to Greg Kroah-HartmanFrom: Len Baker <[email protected]>
[ Upstream commit f980d055a0f858d73d9467bb0b570721bbfcdfb8 ]
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated.
Also, the strnlen() call does not avoid the read overflow in the strlcpy function when a not NUL-terminated string is passed.
So, replace this block by a call to kstrndup() that avoids this type of overflow and does the same.
--- fs/cifs/cifs_unicode.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
fs/cifs/cifs_unicode.c +2 -7
@@ -358,14 +358,9 @@ cifs_strndup_from_utf16(const char *src, const int maxlen,if (!dst)return NULL ;cifs_from_utf16 (dst, (__le16 *) src, len, maxlen, codepage, -NO_MAP_UNI_RSVD ); +NO_MAP_UNI_RSVD ); }else { - len =strnlen (src, maxlen); - len++; - dst =kmalloc (len,GFP_KERNEL ); -if (!dst) -return NULL ; -strlcpy (dst, src, len); + dst =kstrndup (src, maxlen,GFP_KERNEL ); }return dst;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 231/300 i2c: mt65xx: fix IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 58fb7c643d346e2364404554f531cfa6a1a3917c ]
Iff platform_get_irq() returns 0, the driver's probe() method will return 0 early (as if the method's call was successful). Let's consider IRQ0 valid for simplicity -- devm_request_irq() can always override that decision...
--- drivers/i2c/busses/i2c-mt65xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-mt65xx.c +1 -1
@@ -1211,7 +1211,7 @@ static int mtk_i2c_probe(struct platform_device *pdev)return PTR_ERR (i2c->pdmabase); irq =platform_get_irq (pdev,0 ); -if (irq <=0 ) +if (irq <0 )return irq;init_completion (&i2c->msg_complete);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 232/300 i2c: xlp9xx: fix main IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 661e8a88e8317eb9ffe69c69d6cb4876370fe7e2 ]
Iff platform_get_irq() returns 0 for the main IRQ, the driver's probe() method will return 0 early (as if the method's call was successful). Let's consider IRQ0 valid for simplicity -- devm_request_irq() can always override that decision...
--- drivers/i2c/busses/i2c-xlp9xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-xlp9xx.c +1 -1
@@ -517,7 +517,7 @@ static int xlp9xx_i2c_probe(struct platform_device *pdev)return PTR_ERR (priv->base); priv->irq =platform_get_irq (pdev,0 ); -if (priv->irq <=0 ) +if (priv->irq <0 )return priv->irq;/* SMBAlert irq */ priv->alert_data.irq =platform_get_irq (pdev,1 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 233/300 octeontx2-pf: cn10k: Fix error return code in otx2_set_flowkey_cfg()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 5e8243e66b4d80eeaf9ed8cb0235ff133630a014 ]
If otx2_mbox_get_rsp() fails, otx2_set_flowkey_cfg() need return an error code.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +3 -1
@@ -286,8 +286,10 @@ int otx2_set_flowkey_cfg(struct otx2_nic *pfvf) rsp = (struct nix_rss_flowkey_cfg_rsp *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); -if (IS_ERR (rsp)) +if (IS_ERR (rsp)) { + err =PTR_ERR (rsp); goto fail; + } pfvf->hw.flowkey_alg_idx = rsp->alg_idx; fail:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 234/300 usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit 4720f1bf4ee4a784d9ece05420ba33c9222a3004 ]
ehci_orion_drv_probe() did not account for possible errors of clk_prepare_enable() that in particular could cause invocation of clk_disable_unprepare() on clocks that were not prepared/enabled yet, e.g. in remove or on handling errors of usb_add_hcd() in probe. Though, there were several patches fixing different issues with clocks in this driver, they did not solve this problem.
Add handling of errors of clk_prepare_enable() in ehci_orion_drv_probe() to avoid calls of clk_disable_unprepare() without previous successful invocation of clk_prepare_enable().
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/usb/host/ehci-orion.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/usb/host/ehci-orion.c +6 -2
@@ -264,8 +264,11 @@ static int ehci_orion_drv_probe(struct platform_device *pdev)* the clock does not exists. */ priv->clk =devm_clk_get (&pdev->dev,NULL ); -if (!IS_ERR (priv->clk)) -clk_prepare_enable (priv->clk); +if (!IS_ERR (priv->clk)) { + err =clk_prepare_enable (priv->clk); +if (err) + goto err_put_hcd; + } priv->phy =devm_phy_optional_get (&pdev->dev,"usb" );if (IS_ERR (priv->phy)) {
@@ -311,6 +314,7 @@ static int ehci_orion_drv_probe(struct platform_device *pdev) err_dis_clk:if (!IS_ERR (priv->clk))clk_disable_unprepare (priv->clk); +err_put_hcd:usb_put_hcd (hcd); err: dev_err(&pdev->dev, "init %s fail, %d\n",
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 235/300 usb: bdc: Fix an error handling path in bdc_probe() when no suitable DMA config is available
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit d2f42e09393c774ab79088d8e3afcc62b3328fc9 ]
If no suitable DMA configuration is available, a previous 'bdc_phy_init()' call must be undone by a corresponding 'bdc_phy_exit()' call.
Branch to the existing error handling path instead of returning directly.
--- drivers/usb/gadget/udc/bdc/bdc_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/gadget/udc/bdc/bdc_core.c +2 -1
@@ -560,7 +560,8 @@ static int bdc_probe(struct platform_device *pdev)if (ret) {dev_err (dev,"No suitable DMA config available, abort\n" ); -return -ENOTSUPP ; + ret = -ENOTSUPP ; + goto phycleanup; }dev_dbg (dev,"Using 32-bit address\n" ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 236/300 usb: bdc: Fix a resource leak in the error handling path of bdc_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 6f15a2a09cecb7a2faba4a75bbd101f6f962294b ]
If an error occurs after a successful 'clk_prepare_enable()' call, it must be undone by a corresponding 'clk_disable_unprepare()' call. This call is already present in the remove function.
Add this call in the error handling path and reorder the code so that the 'clk_prepare_enable()' call happens later in the function.
The goal is to have as much managed resources functions as possible before the 'clk_prepare_enable()' call in order to keep the error handling path simple.
While at it, remove the now unneeded 'clk' variable.
--- drivers/usb/gadget/udc/bdc/bdc_core.c | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-)
drivers/usb/gadget/udc/bdc/bdc_core.c +13 -14
@@ -488,27 +488,14 @@ static int bdc_probe(struct platform_device *pdev)int irq;u32 temp;struct device *dev = &pdev->dev; -struct clk *clk;int phy_num;dev_dbg (dev,"%s()\n" , __func__); - clk =devm_clk_get_optional (dev,"sw_usbd" ); -if (IS_ERR (clk)) -return PTR_ERR (clk); - - ret =clk_prepare_enable (clk); -if (ret) { -dev_err (dev,"could not enable clock\n" ); -return ret; - } - bdc =devm_kzalloc (dev,sizeof (*bdc),GFP_KERNEL );if (!bdc)return -ENOMEM ; - bdc->clk = clk; - bdc->regs =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (bdc->regs))return PTR_ERR (bdc->regs);
@@ -545,10 +532,20 @@ static int bdc_probe(struct platform_device *pdev) } } + bdc->clk =devm_clk_get_optional (dev,"sw_usbd" ); +if (IS_ERR (bdc->clk)) +return PTR_ERR (bdc->clk); + + ret =clk_prepare_enable (bdc->clk); +if (ret) { +dev_err (dev,"could not enable clock\n" ); +return ret; + } + ret =bdc_phy_init (bdc);if (ret) {dev_err (bdc->dev,"BDC phy init failure:%d\n" , ret); -return ret; + goto disable_clk; } temp =bdc_readl (bdc->regs,BDC_BDCCAP1 );
@@ -581,6 +578,8 @@ cleanup:bdc_hw_exit (bdc); phycleanup:bdc_phy_exit (bdc); +disable_clk: +clk_disable_unprepare (bdc->clk);return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 237/300 tty: serial: fsl_lpuart: fix the wrong mapbase value
In reply to Greg Kroah-HartmanFrom: Andy Duan <[email protected]>
[ Upstream commit d5c38948448abc2bb6b36dbf85a554bf4748885e ]
Register offset needs to be applied on mapbase also. dma_tx/rx_request use the physical address of UARTDATA. Register offset is currently only applied to membase (the corresponding virtual addr) but not on mapbase.
--- drivers/tty/serial/fsl_lpuart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/fsl_lpuart.c +1 -1
@@ -2595,7 +2595,7 @@ static int lpuart_probe(struct platform_device *pdev)return PTR_ERR (sport->port.membase); sport->port.membase += sdata->reg_off; - sport->port.mapbase = res->start; + sport->port.mapbase = res->start + sdata->reg_off; sport->port.dev = &pdev->dev; sport->port.type =PORT_LPUART ; sport->devtype = sdata->devtype;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 238/300 ASoC: wcd9335: Fix a double irq free in the remove function
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 7a6a723e98aa45f393e6add18f7309dfffa1b0e2 ]
There is no point in calling 'free_irq()' explicitly for 'WCD9335_IRQ_SLIMBUS' in the remove function.
The irqs are requested in 'wcd9335_setup_irqs()' using a resource managed function (i.e. 'devm_request_threaded_irq()'). 'wcd9335_setup_irqs()' requests all what is defined in the 'wcd9335_irqs' structure.
This structure has only one entry for 'WCD9335_IRQ_SLIMBUS'.
So 'devm_request...irq()' + explicit 'free_irq()' would lead to a double free.
Remove the unneeded 'free_irq()' from the remove function.
Message-Id: <0614d63bc00edd7e81dd367504128f3d84f72efa.1629091028.git.christophe.jaillet@wanadoo.fr>
--- sound/soc/codecs/wcd9335.c | 1 - 1 file changed, 1 deletion(-)
sound/soc/codecs/wcd9335.c +0 -1
@@ -4869,7 +4869,6 @@ static void wcd9335_codec_remove(struct snd_soc_component *comp)struct wcd9335_codec *wcd =dev_get_drvdata (comp->dev);wcd_clsh_ctrl_free (wcd->clsh_ctrl); -free_irq (regmap_irq_get_virq (wcd->irq_data,WCD9335_IRQ_SLIMBUS ), wcd); } static int wcd9335_codec_set_sysclk(struct snd_soc_component *comp,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 239/300 ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit fc6fc81caa63900cef9ebb8b2e365c3ed5a9effb ]
If 'wcd9335_setup_irqs()' fails, me must release the memory allocated in 'wcd_clsh_ctrl_alloc()', as already done in the remove function.
Add an error handling path and the missing 'wcd_clsh_ctrl_free()' call.
Message-Id: <6dc12372f09fabb70bf05941dbe6a1382dc93e43.1629091028.git.christophe.jaillet@wanadoo.fr>
--- sound/soc/codecs/wcd9335.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
sound/soc/codecs/wcd9335.c +10 -1
@@ -4844,6 +4844,7 @@ static void wcd9335_codec_init(struct snd_soc_component *component)static int wcd9335_codec_probe (struct snd_soc_component *component) {struct wcd9335_codec *wcd =dev_get_drvdata (component->dev); +int ret;int i;snd_soc_component_init_regmap (component, wcd->regmap);
@@ -4861,7 +4862,15 @@ static int wcd9335_codec_probe(struct snd_soc_component *component)for (i =0 ; i <NUM_CODEC_DAIS ; i++)INIT_LIST_HEAD (&wcd->dai[i].slim_ch_list); -return wcd9335_setup_irqs (wcd); + ret =wcd9335_setup_irqs (wcd); +if (ret) + goto free_clsh_ctrl; + +return 0 ; + +free_clsh_ctrl: +wcd_clsh_ctrl_free (wcd->clsh_ctrl); +return ret; }static void wcd9335_codec_remove (struct snd_soc_component *comp)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 240/300 ASoC: wcd9335: Disable irq on slave ports in the remove function
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit d3efd26af2e044ff2b48d38bb871630282d77e60 ]
The probe calls 'wcd9335_setup_irqs()' to enable interrupts on all slave ports.
This must be undone in the remove function.
Add a 'wcd9335_teardown_irqs()' function that undoes 'wcd9335_setup_irqs()' function, and call it from the remove function.
Message-Id: <8f761244d79bd4c098af8a482be9121d3a486d1b.1629091028.git.christophe.jaillet@wanadoo.fr>
--- sound/soc/codecs/wcd9335.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
sound/soc/codecs/wcd9335.c +11 -0
@@ -4076,6 +4076,16 @@ static int wcd9335_setup_irqs(struct wcd9335_codec *wcd)return ret; } +static void wcd9335_teardown_irqs (struct wcd9335_codec *wcd) +{ +int i; + +/* disable interrupts on all slave ports */ +for (i =0 ; i <WCD9335_SLIM_NUM_PORT_REG ; i++) +regmap_write (wcd->if_regmap,WCD9335_SLIM_PGD_PORT_INT_EN0 + i, +0x00 ); +} +static void wcd9335_cdc_sido_ccl_enable (struct wcd9335_codec *wcd,bool ccl_flag) {
@@ -4878,6 +4888,7 @@ static void wcd9335_codec_remove(struct snd_soc_component *comp)struct wcd9335_codec *wcd =dev_get_drvdata (comp->dev);wcd_clsh_ctrl_free (wcd->clsh_ctrl); +wcd9335_teardown_irqs (wcd); } static int wcd9335_codec_set_sysclk(struct snd_soc_component *comp,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 241/300 iwlwifi: skip first element in the WTAS ACPI table
In reply to Greg Kroah-HartmanFrom: Abhishek Naik <[email protected]>
[ Upstream commit 19426d54302e199b3fd2d575f926a13af66be2b9 ]
By mistake we were considering the first element of the WTAS wifi package as part of the data we want to rid, but that element is the wifi package signature (always 0x07), so it should be skipped.
Change the code to read the data starting from element 1 instead.
--- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/wireless/intel/iwlwifi/fw/acpi.c +7 -7
@@ -243,7 +243,7 @@ int iwl_acpi_get_tas(struct iwl_fw_runtime *fwrt, goto out_free; } - enabled = !!wifi_pkg->package.elements[0 ].integer.value; + enabled = !!wifi_pkg->package.elements[1 ].integer.value;if (!enabled) { *block_list_size =-1 ;
@@ -252,15 +252,15 @@ int iwl_acpi_get_tas(struct iwl_fw_runtime *fwrt, goto out_free; } -if (wifi_pkg->package.elements[1 ].type !=ACPI_TYPE_INTEGER || - wifi_pkg->package.elements[1 ].integer.value > +if (wifi_pkg->package.elements[2 ].type !=ACPI_TYPE_INTEGER || + wifi_pkg->package.elements[2 ].integer.value >APCI_WTAS_BLACK_LIST_MAX ) {IWL_DEBUG_RADIO (fwrt,"TAS invalid array size %llu\n" , wifi_pkg->package.elements[1 ].integer.value); ret = -EINVAL ; goto out_free; } - *block_list_size = wifi_pkg->package.elements[1 ].integer.value; + *block_list_size = wifi_pkg->package.elements[2 ].integer.value;IWL_DEBUG_RADIO (fwrt,"TAS array size %d\n" , *block_list_size);if (*block_list_size >APCI_WTAS_BLACK_LIST_MAX ) {
@@ -273,15 +273,15 @@ int iwl_acpi_get_tas(struct iwl_fw_runtime *fwrt,for (i =0 ; i < *block_list_size; i++) {u32 country; -if (wifi_pkg->package.elements[2 + i].type != +if (wifi_pkg->package.elements[3 + i].type !=ACPI_TYPE_INTEGER ) {IWL_DEBUG_RADIO (fwrt, -"TAS invalid array elem %d\n" ,2 + i); +"TAS invalid array elem %d\n" ,3 + i); ret = -EINVAL ; goto out_free; } - country = wifi_pkg->package.elements[2 + i].integer.value; + country = wifi_pkg->package.elements[3 + i].integer.value; block_list_array[i] =cpu_to_le32 (country);IWL_DEBUG_RADIO (fwrt,"TAS block list country %d\n" , country); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 242/300 net/mlx5: Remove all auxiliary devices at the unregister event
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit 8e7e2e8ed0e251138926838b7933f8eb6dd56b12 ]
The call to mlx5_unregister_device() means that mlx5_core driver is removed. In such scenario, we need to disregard all other flags like attach/detach and forcibly remove all auxiliary devices.
--- drivers/net/ethernet/mellanox/mlx5/core/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/dev.c +1 -1
@@ -397,7 +397,7 @@ int mlx5_register_device(struct mlx5_core_dev *dev)void mlx5_unregister_device (struct mlx5_core_dev *dev) {mutex_lock (&mlx5_intf_mutex); - dev->priv.flags |=MLX5_PRIV_FLAGS_DISABLE_ALL_ADEV ; + dev->priv.flags =MLX5_PRIV_FLAGS_DISABLE_ALL_ADEV ;mlx5_rescan_drivers_locked (dev);mutex_unlock (&mlx5_intf_mutex); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 243/300 net/mlx5e: Fix possible use-after-free deleting fdb rule
In reply to Greg Kroah-HartmanFrom: Roi Dayan <[email protected]>
[ Upstream commit 9a5f9cc794e17cf6ed2a5bb215d2e8b6832db444 ]
After neigh-update-add failure we are still with a slow path rule but the driver always assume the rule is an fdb rule.
Fix neigh-update-del by checking slow path tc flag on the flow. Also fix neigh-update-add for when neigh-update-del fails the same.
--- drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c +2 -2
@@ -143,7 +143,7 @@ void mlx5e_tc_encap_flows_add(struct mlx5e_priv *priv,mlx5e_rep_queue_neigh_stats_work (priv);list_for_each_entry (flow, flow_list, tmp_list) { -if (!mlx5e_is_offloaded_flow (flow)) +if (!mlx5e_is_offloaded_flow (flow) || !flow_flag_test (flow,SLOW ))continue ; attr = flow->attr; esw_attr = attr->esw_attr;
@@ -184,7 +184,7 @@ void mlx5e_tc_encap_flows_del(struct mlx5e_priv *priv,int err;list_for_each_entry (flow, flow_list, tmp_list) { -if (!mlx5e_is_offloaded_flow (flow)) +if (!mlx5e_is_offloaded_flow (flow) ||flow_flag_test (flow,SLOW ))continue ; attr = flow->attr; esw_attr = attr->esw_attr;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 244/300 net/mlx5: E-Switch, Set vhca id valid flag when creating indir fwd group
In reply to Greg Kroah-HartmanFrom: Maor Dickman <[email protected]>
[ Upstream commit ca6891f9b27db7764bba0798202b0a21d0dc909c ]
When indirect forward group is created, flow is added with vhca id but without setting vhca id valid flag which violates the PRM.
Fix by setting the missing flag, vhca id valid.
--- drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c +1 -0
@@ -364,6 +364,7 @@ static int mlx5_create_indir_fwd_group(struct mlx5_eswitch *esw, dest.type =MLX5_FLOW_DESTINATION_TYPE_VPORT ; dest.vport.num = e->vport; dest.vport.vhca_id =MLX5_CAP_GEN (esw->dev, vhca_id); + dest.vport.flags =MLX5_FLOW_DEST_VPORT_VHCA_ID ; e->fwd_rule =mlx5_add_flow_rules (e->ft, spec, &flow_act, &dest,1 );if (IS_ERR (e->fwd_rule)) {mlx5_destroy_flow_group (e->fwd_grp);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 245/300 net/mlx5e: Use correct eswitch for stack devices with lag
In reply to Greg Kroah-HartmanFrom: Dmytro Linkin <[email protected]>
[ Upstream commit f9d196bd632b8b79261ec3366c30ec3923ea9a02 ]
If link aggregation is used within stack devices driver rejects encap rules if PF of the VF tunnel device is down. This happens because route resolved for other PF and its eswitch instance is used to determine correct vport.
To fix that use devcom feature to retrieve other eswitch instance if failed to find vport for the 1st eswitch and LAG is active.
--- .../net/ethernet/mellanox/mlx5/core/en_tc.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +18 -0
@@ -1310,6 +1310,7 @@ bool mlx5e_tc_is_vf_tunnel(struct net_device *out_dev, struct net_device *route_int mlx5e_tc_query_route_vport (struct net_device *out_dev,struct net_device *route_dev,u16 *vport) {struct mlx5e_priv *out_priv, *route_priv; +struct mlx5_devcom *devcom =NULL ;struct mlx5_core_dev *route_mdev;struct mlx5_eswitch *esw;u16 vhca_id;
@@ -1321,7 +1322,24 @@ int mlx5e_tc_query_route_vport(struct net_device *out_dev, struct net_device *ro route_mdev = route_priv->mdev; vhca_id =MLX5_CAP_GEN (route_mdev, vhca_id); +if (mlx5_lag_is_active (out_priv->mdev)) { +/* In lag case we may get devices from different eswitch instances. +* If we failed to get vport num, it means, mostly, that we on the wrong +* eswitch. +*/ + err =mlx5_eswitch_vhca_id_to_vport (esw, vhca_id, vport); +if (err != -ENOENT ) +return err; + + devcom = out_priv->mdev->priv.devcom; + esw =mlx5_devcom_get_peer_data (devcom,MLX5_DEVCOM_ESW_OFFLOADS ); +if (!esw) +return -ENODEV ; + } + err =mlx5_eswitch_vhca_id_to_vport (esw, vhca_id, vport); +if (devcom) +mlx5_devcom_release_peer_data (devcom,MLX5_DEVCOM_ESW_OFFLOADS );return err; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 246/300 ice: Only lock to update netdev dev_addr
In reply to Greg Kroah-HartmanFrom: Brett Creeley <[email protected]>
[ Upstream commit b357d9717be7f95fde2c6c4650b186a995b71e59 ]
commit 3ba7f53f8bf1 ("ice: don't remove netdev->dev_addr from uc sync list") introduced calls to netif_addr_lock_bh() and netif_addr_unlock_bh() in the driver's ndo_set_mac() callback. This is fine since the driver is updated the netdev's dev_addr, but since this is a spinlock, the driver cannot sleep when the lock is held. Unfortunately the functions to add/delete MAC filters depend on a mutex. This was causing a trace with the lock debug kernel config options enabled when changing the mac address via iproute.
[ 203.273059] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:281 [ 203.273065] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6698, name: ip [ 203.273068] Preemption disabled at: [ 203.273068] [<ffffffffc04aaeab>] ice_set_mac_address+0x8b/0x1c0 [ice] [ 203.273097] CPU: 31 PID: 6698 Comm: ip Tainted: G S W I 5.14.0-rc4 #2 [ 203.273100] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020 [ 203.273102] Call Trace: [ 203.273107] dump_stack_lvl+0x33/0x42 [ 203.273113] ? ice_set_mac_address+0x8b/0x1c0 [ice] [ 203.273124] ___might_sleep.cold.150+0xda/0xea [ 203.273131] mutex_lock+0x1c/0x40 [ 203.273136] ice_remove_mac+0xe3/0x180 [ice] [ 203.273155] ? ice_fltr_add_mac_list+0x20/0x20 [ice] [ 203.273175] ice_fltr_prepare_mac+0x43/0xa0 [ice] [ 203.273194] ice_set_mac_address+0xab/0x1c0 [ice] [ 203.273206] dev_set_mac_address+0xb8/0x120 [ 203.273210] dev_set_mac_address_user+0x2c/0x50 [ 203.273212] do_setlink+0x1dd/0x10e0 [ 203.273217] ? __nla_validate_parse+0x12d/0x1a0 [ 203.273221] __rtnl_newlink+0x530/0x910 [ 203.273224] ? __kmalloc_node_track_caller+0x17f/0x380 [ 203.273230] ? preempt_count_add+0x68/0xa0 [ 203.273236] ? _raw_spin_lock_irqsave+0x1f/0x30 [ 203.273241] ? kmem_cache_alloc_trace+0x4d/0x440 [ 203.273244] rtnl_newlink+0x43/0x60 [ 203.273245] rtnetlink_rcv_msg+0x13a/0x380 [ 203.273248] ? rtnl_calcit.isra.40+0x130/0x130 [ 203.273250] netlink_rcv_skb+0x4e/0x100 [ 203.273256] netlink_unicast+0x1a2/0x280 [ 203.273258] netlink_sendmsg+0x242/0x490 [ 203.273260] sock_sendmsg+0x58/0x60 [ 203.273263] ____sys_sendmsg+0x1ef/0x260 [ 203.273265] ? copy_msghdr_from_user+0x5c/0x90 [ 203.273268] ? ____sys_recvmsg+0xe6/0x170 [ 203.273270] ___sys_sendmsg+0x7c/0xc0 [ 203.273272] ? copy_msghdr_from_user+0x5c/0x90 [ 203.273274] ? ___sys_recvmsg+0x89/0xc0 [ 203.273276] ? __netlink_sendskb+0x50/0x50 [ 203.273278] ? mod_objcg_state+0xee/0x310 [ 203.273282] ? __dentry_kill+0x114/0x170 [ 203.273286] ? get_max_files+0x10/0x10 [ 203.273288] __sys_sendmsg+0x57/0xa0 [ 203.273290] do_syscall_64+0x37/0x80 [ 203.273295] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 203.273296] RIP: 0033:0x7f8edf96e278 [ 203.273298] Code: 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 25 63 2c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 41 89 d4 55 [ 203.273300] RSP: 002b:00007ffcb8bdac08 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 203.273303] RAX: ffffffffffffffda RBX: 000000006115e0ae RCX: 00007f8edf96e278 [ 203.273304] RDX: 0000000000000000 RSI: 00007ffcb8bdac70 RDI: 0000000000000003 [ 203.273305] RBP: 0000000000000000 R08: 0000000000000001 R09: 00007ffcb8bda5b0 [ 203.273306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 203.273306] R13: 0000555e10092020 R14: 0000000000000000 R15: 0000000000000005
Fix this by only locking when changing the netdev->dev_addr. Also, make sure to restore the old netdev->dev_addr on any failures.
--- drivers/net/ethernet/intel/ice/ice_main.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_main.c +9 -4
@@ -4911,6 +4911,7 @@ static int ice_set_mac_address(struct net_device *netdev, void *pi)struct ice_hw *hw = &pf->hw;struct sockaddr *addr = pi;enum ice_status status; +u8 old_mac[ETH_ALEN ];u8 flags =0 ;int err =0 ;u8 *mac;
@@ -4933,8 +4934,13 @@ static int ice_set_mac_address(struct net_device *netdev, void *pi) }netif_addr_lock_bh (netdev); +ether_addr_copy (old_mac, netdev->dev_addr); +/* change the netdev's MAC address */ +memcpy (netdev->dev_addr, mac, netdev->addr_len); +netif_addr_unlock_bh (netdev); +/* Clean up old MAC filter. Not an error if old filter doesn't exist */ - status =ice_fltr_remove_mac (vsi, netdev->dev_addr,ICE_FWD_TO_VSI ); + status =ice_fltr_remove_mac (vsi, old_mac,ICE_FWD_TO_VSI );if (status && status !=ICE_ERR_DOES_NOT_EXIST ) { err = -EADDRNOTAVAIL ; goto err_update_filters;
@@ -4957,13 +4963,12 @@ err_update_filters:if (err) {netdev_err (netdev,"can't set MAC %pM. filter update failed\n" , mac); +netif_addr_lock_bh (netdev); +ether_addr_copy (netdev->dev_addr, old_mac);netif_addr_unlock_bh (netdev);return err; } -/* change the netdev's MAC address */ -memcpy (netdev->dev_addr, mac, netdev->addr_len); -netif_addr_unlock_bh (netdev);netdev_dbg (vsi->netdev,"updated MAC address to %pM\n" , netdev->dev_addr);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 247/300 net: phy: marvell10g: fix broken PHY interrupts for anyone after us in the driver probe list
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 0d55649d2ad7296acfda9127e1d05518d025734a ]
Enabling interrupts via device tree for the internal PHYs on the mv88e6390 DSA switch does not work. The driver insists to use poll mode.
Stage one debugging shows that the fwnode_mdiobus_phy_device_register function calls fwnode_irq_get properly, and phy->irq is set to a valid interrupt line initially.
But it is then cleared.
Stage two debugging shows that it is cleared here:
phy_probe:
/* Disable the interrupt if the PHY doesn't support it
* but the interrupt is still a valid one
*/
if (!phy_drv_supports_irq(phydrv) && phy_interrupt_is_valid(phydev))
phydev->irq = PHY_POLL;
Okay, so does the "Marvell 88E6390 Family" PHY driver not have the .config_intr and .handle_interrupt function pointers? Yes it does.
Stage three debugging shows that the PHY device does not attempt a probe against the "Marvell 88E6390 Family" driver, but against the "mv88x3310" driver.
Okay, so why does the "mv88x3310" driver match on a mv88x6390 internal PHY? The PHY IDs (MARVELL_PHY_ID_88E6390_FAMILY vs MARVELL_PHY_ID_88X3310) are way different.
Stage four debugging has us looking through:
phy_device_register
-> device_add
-> bus_probe_device
-> device_initial_probe
-> __device_attach
-> bus_for_each_drv
-> driver_match_device
-> drv->bus->match
-> phy_bus_matchOkay, so as we said, the MII_PHYSID1 of mv88e6390 does not match the mv88x3310 driver's PHY mask & ID, so why would phy_bus_match return...
Ahh, phy_bus_match calls a shortcircuit method, phydrv->match_phy_device, and does not even bother to compare the PHY ID if that is implemented.
So of course, we go inside the marvell10g.c driver and sure enough, it implements .match_phy_device and does not bother to check the PHY ID.
What's interesting though is that at the end of the device_add() from phy_device_register(), the driver for the internal PHYs _is_ the proper "Marvell 88E6390 Family". This is because "mv88x3310" ends up failing to probe after all, and __device_attach_driver(), to quote:
/*
* Ignore errors returned by ->probe so that the next driver can try
* its luck.
*/
The next (and only other) driver that matches is the 6390 driver. For this one, phy_probe doesn't fail, and everything expects to work as normal, EXCEPT phydev->irq has already been cleared by the previous unsuccessful probe of a driver which did not implement PHY interrupts, and therefore cleared that IRQ.
Okay, so it is not just Marvell 6390 that has PHY interrupts broken. Stuff like Atheros, Aquantia, Broadcom, Qualcomm work because they are lexicographically before Marvell, and stuff like NXP, Realtek, Vitesse are broken.
This goes to show how fragile it is to reset phydev->irq = PHY_POLL from the actual beginning of phy_probe itself. That seems like an actual bug of its own too, since phy_probe has side effects which are not restored on probe failure, but the line of thought probably was, the same driver will attempt probe again, so it doesn't matter. Well, looks like it does.
Maybe it would make more sense to move the phydev->irq clearing after the actual device_add() in phy_device_register() completes, and the bound driver is the actual final one.
(also, a bit frightening that drivers are permitted to bypass the MDIO bus matching in such a trivial way and perform PHY reads and writes from the .match_phy_device method, on devices that do not even belong to them. In the general case it might not be guaranteed that the MDIO accesses one driver needs to make to figure out whether to match on a device is safe for all other PHY devices)
--- drivers/net/phy/marvell10g.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/phy/marvell10g.c +8 -0
@@ -987,11 +987,19 @@ static int mv3310_get_number_of_ports(struct phy_device *phydev)static int mv3310_match_phy_device (struct phy_device *phydev) { +if ((phydev->c45_ids.device_ids[MDIO_MMD_PMAPMD ] & +MARVELL_PHY_ID_MASK ) !=MARVELL_PHY_ID_88X3310 ) +return 0 ; +return mv3310_get_number_of_ports (phydev) ==1 ; }static int mv3340_match_phy_device (struct phy_device *phydev) { +if ((phydev->c45_ids.device_ids[MDIO_MMD_PMAPMD ] & +MARVELL_PHY_ID_MASK ) !=MARVELL_PHY_ID_88X3310 ) +return 0 ; +return mv3310_get_number_of_ports (phydev) ==4 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 248/300 ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit fd6729ec534cffbbeb3917761e6d1fe6a412d3fe ]
This error path is unlikely because of it checked for NULL and returned -ENOMEM earlier in the function. But it should return an error code here as well if we ever do hit it because of a race condition or something.
--- drivers/net/wireless/ath/ath6kl/wmi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath6kl/wmi.c +3 -1
@@ -2504,8 +2504,10 @@ static int ath6kl_wmi_sync_point(struct wmi *wmi, u8 if_idx) goto free_data_skb;for (index =0 ; index < num_pri_streams; index++) { -if (WARN_ON (!data_sync_bufs[index].skb)) +if (WARN_ON (!data_sync_bufs[index].skb)) { + ret = -ENOMEM ; goto free_data_skb; + } ep_id = ath6kl_ac2_endpoint_id(wmi->parent_dev, data_sync_bufs[index].
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 249/300 atlantic: Fix driver resume flow.
In reply to Greg Kroah-HartmanFrom: Sudarsana Reddy Kalluru <[email protected]>
[ Upstream commit 57f780f1c43362b86fd23d20bd940e2468237716 ]
Driver crashes when restoring from the Hibernate. In the resume flow, driver need to clean up the older nic/vec objects and re-initialize them.
--- drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +3 -0
@@ -417,6 +417,9 @@ static int atl_resume_common(struct device *dev, bool deep)pci_restore_state (pdev);if (deep) { +/* Reinitialize Nic/Vecs objects */ +aq_nic_deinit (nic, !nic->aq_hw->aq_nic_cfg->wol); + ret =aq_nic_init (nic);if (ret) goto err_exit;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 250/300 bcma: Fix memory leak for internally-handled cores
In reply to Greg Kroah-HartmanFrom: Zenghui Yu <[email protected]>
[ Upstream commit b63aed3ff195130fef12e0af590f4838cf0201d8 ]
kmemleak reported that dev_name() of internally-handled cores were leaked on driver unbinding. Let's use device_initialize() to take refcounts for them and put_device() to properly free the related stuff.
While looking at it, there's another potential issue for those which should be *registered* into driver core. If device_register() failed, we put device once and freed bcma_device structures. In bcma_unregister_cores(), they're treated as unregistered and we hit both UAF and double-free. That smells not good and has also been fixed now.
--- drivers/bcma/main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/bcma/main.c +3 -3
@@ -236,6 +236,7 @@ EXPORT_SYMBOL(bcma_core_irq);void bcma_prepare_core (struct bcma_bus *bus,struct bcma_device *core) { +device_initialize (&core->dev); core->dev.release = bcma_release_core_dev; core->dev.bus = &bcma_bus_type;dev_set_name (&core->dev,"bcma%d:%d" , bus->num, core->core_index);
@@ -277,11 +278,10 @@ static void bcma_register_core(struct bcma_bus *bus, struct bcma_device *core) {int err; - err =device_register (&core->dev); + err =device_add (&core->dev);if (err) {bcma_err (bus,"Could not register dev for core 0x%03X\n" , core->id.id); -put_device (&core->dev);return ; } core->dev_registered = true;
@@ -372,7 +372,7 @@ void bcma_unregister_cores(struct bcma_bus *bus)/* Now noone uses internally-handled cores, we can free them */ list_for_each_entry_safe (core, tmp, &bus->cores, list) {list_del (&core->list); -kfree (core); +put_device (&core->dev); } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 251/300 brcmfmac: pcie: fix oops on failure to resume and reprobe
In reply to Greg Kroah-HartmanFrom: Ahmad Fatoum <[email protected]>
[ Upstream commit d745ca4f2c4ae9f1bd8cf7d8ac6e22d739bffd19 ]
When resuming from suspend, brcmf_pcie_pm_leave_D3 will first attempt a hot resume and then fall back to removing the PCI device and then reprobing. If this probe fails, the kernel will oops, because brcmf_err, which is called to report the failure will dereference the stale bus pointer. Open code and use the default bus-less brcmf_err to avoid this.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +1 -1
@@ -2075,7 +2075,7 @@ cleanup: err =brcmf_pcie_probe (pdev,NULL );if (err) -brcmf_err (bus,"probe after resume failed, err=%d\n" , err); +__brcmf_err (NULL , __func__,"probe after resume failed, err=%d\n" , err);return err; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 252/300 ipv6: make exception cache less predictible
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit a00df2caffed3883c341d5685f830434312e4a43 ]
Even after commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()"), an attacker can still use brute force to learn some secrets from a victim linux host.
One way to defeat these attacks is to make the max depth of the hash table bucket a random value.
Before this patch, each bucket of the hash table used to store exceptions could contain 6 items under attack.
After the patch, each bucket would contains a random number of items, between 6 and 10. The attacker can no longer infer secrets.
This is slightly increasing memory size used by the hash table, we do not expect this to be a problem.
Following patch is dealing with the same issue in IPv4.
--- net/ipv6/route.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/ipv6/route.c +4 -1
@@ -1657,6 +1657,7 @@ static int rt6_insert_exception(struct rt6_info *nrt,struct in6_addr *src_key =NULL ;struct rt6_exception *rt6_ex;struct fib6_nh *nh = res->nh; +int max_depth;int err =0 ;spin_lock_bh (&rt6_exception_lock);
@@ -1711,7 +1712,9 @@ static int rt6_insert_exception(struct rt6_info *nrt, bucket->depth++; net->ipv6.rt6_stats->fib_rt_cache++; -if (bucket->depth >FIB6_MAX_DEPTH ) +/* Randomize max depth to avoid some side channels attacks. */ + max_depth =FIB6_MAX_DEPTH +prandom_u32_max (FIB6_MAX_DEPTH ); +while (bucket->depth > max_depth)rt6_exception_remove_oldest (bucket); out:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 253/300 ipv4: make exception cache less predictible
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 67d6d681e15b578c1725bad8ad079e05d1c48a8e ]
Even after commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in fnhe_hashfun()"), an attacker can still use brute force to learn some secrets from a victim linux host.
One way to defeat these attacks is to make the max depth of the hash table bucket a random value.
Before this patch, each bucket of the hash table used to store exceptions could contain 6 items under attack.
After the patch, each bucket would contains a random number of items, between 6 and 10. The attacker can no longer infer secrets.
This is slightly increasing memory size used by the hash table, by 50% in average, we do not expect this to be a problem.
This patch is more complex than the prior one (IPv6 equivalent), because IPv4 was reusing the oldest entry.
Since we need to be able to evict more than one entry per update_or_create_fnhe() call, I had to replace fnhe_oldest() with fnhe_remove_oldest().
Also note that we will queue extra kfree_rcu() calls under stress, which hopefully wont be a too big issue.
--- net/ipv4/route.c | 46 ++++++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 16 deletions(-)
net/ipv4/route.c +30 -16
@@ -586,18 +586,25 @@ static void fnhe_flush_routes(struct fib_nh_exception *fnhe) } } -static struct fib_nh_exception *fnhe_oldest (struct fnhe_hash_bucket *hash) +static void fnhe_remove_oldest (struct fnhe_hash_bucket *hash) { -struct fib_nh_exception *fnhe, *oldest; +struct fib_nh_exception __rcu **fnhe_p, **oldest_p; +struct fib_nh_exception *fnhe, *oldest =NULL ; - oldest =rcu_dereference (hash->chain); -for (fnhe =rcu_dereference (oldest->fnhe_next); fnhe; - fnhe =rcu_dereference (fnhe->fnhe_next)) { -if (time_before (fnhe->fnhe_stamp, oldest->fnhe_stamp)) +for (fnhe_p = &hash->chain; ; fnhe_p = &fnhe->fnhe_next) { + fnhe =rcu_dereference_protected (*fnhe_p, +lockdep_is_held (&fnhe_lock)); +if (!fnhe) +break ; +if (!oldest || +time_before (fnhe->fnhe_stamp, oldest->fnhe_stamp)) { oldest = fnhe; + oldest_p = fnhe_p; + } }fnhe_flush_routes (oldest); -return oldest; + *oldest_p = oldest->fnhe_next; +kfree_rcu (oldest, rcu); }static u32 fnhe_hashfun (__be32 daddr)
@@ -676,16 +683,21 @@ static void update_or_create_fnhe(struct fib_nh_common *nhc, __be32 daddr,if (rt)fill_route_from_fnhe (rt, fnhe); }else { -if (depth >FNHE_RECLAIM_DEPTH ) - fnhe =fnhe_oldest (hash); -else { - fnhe =kzalloc (sizeof (*fnhe),GFP_ATOMIC ); -if (!fnhe) - goto out_unlock; - - fnhe->fnhe_next = hash->chain; -rcu_assign_pointer (hash->chain, fnhe); +/* Randomize max depth to avoid some side channels attacks. */ +int max_depth =FNHE_RECLAIM_DEPTH + +prandom_u32_max (FNHE_RECLAIM_DEPTH ); + +while (depth > max_depth) { +fnhe_remove_oldest (hash); + depth--; } + + fnhe =kzalloc (sizeof (*fnhe),GFP_ATOMIC ); +if (!fnhe) + goto out_unlock; + + fnhe->fnhe_next = hash->chain; + fnhe->fnhe_genid = genid; fnhe->fnhe_daddr = daddr; fnhe->fnhe_gw = gw;
@@ -693,6 +705,8 @@ static void update_or_create_fnhe(struct fib_nh_common *nhc, __be32 daddr, fnhe->fnhe_mtu_locked = lock; fnhe->fnhe_expires =max (1UL , expires); +rcu_assign_pointer (hash->chain, fnhe); +/* Exception created; mark the cached routes for the nexthop * stale, so anyone caching it rechecks if this exception * applies to them.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 254/300 net: qrtr: make checks in qrtr_endpoint_post() stricter
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit aaa8e4922c887ff47ad66ef918193682bccc1905 ]
These checks are still not strict enough. The main problem is that if "cb->type == QRTR_TYPE_NEW_SERVER" is true then "len - hdrlen" is guaranteed to be 4 but we need to be at least 16 bytes. In fact, we can reject everything smaller than sizeof(*pkt) which is 20 bytes.
Also I don't like the ALIGN(size, 4). It's better to just insist that data is needs to be aligned at the start.
--- net/qrtr/qrtr.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/qrtr/qrtr.c +6 -2
@@ -493,7 +493,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) goto err; } -if (!size || len !=ALIGN (size,4 ) + hdrlen) +if (!size || size &3 || len != size + hdrlen) goto err; if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA &&
@@ -506,8 +506,12 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)if (cb->type ==QRTR_TYPE_NEW_SERVER ) {/* Remote node endpoint can bridge other distant nodes */ -const struct qrtr_ctrl_pkt *pkt = data + hdrlen; +const struct qrtr_ctrl_pkt *pkt; +if (size <sizeof (*pkt)) + goto err; + + pkt = data + hdrlen;qrtr_node_assign (node,le32_to_cpu (pkt->server.node)); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 255/300 sch_htb: Fix inconsistency when leaf qdisc creation fails
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit ca49bfd90a9dde175d2929dc1544b54841e33804 ]
In HTB offload mode, qdiscs of leaf classes are grafted to netdev queues. sch_htb expects the dev_queue field of these qdiscs to point to the corresponding queues. However, qdisc creation may fail, and in that case noop_qdisc is used instead. Its dev_queue doesn't point to the right queue, so sch_htb can lose track of used netdev queues, which will cause internal inconsistencies.
This commit fixes this bug by keeping track of the netdev queue inside struct htb_class. All reads of cl->leaf.q->dev_queue are replaced by the new field, the two values are synced on writes, and WARNs are added to assert equality of the two values.
The driver API has changed: when TC_HTB_LEAF_DEL needs to move a queue, the driver used to pass the old and new queue IDs to sch_htb. Now that there is a new field (offload_queue) in struct htb_class that needs to be updated on this operation, the driver will pass the old class ID to sch_htb instead (it already knows the new class ID).
--- .../net/ethernet/mellanox/mlx5/core/en/qos.c | 15 ++- .../net/ethernet/mellanox/mlx5/core/en/qos.h | 4 +- .../net/ethernet/mellanox/mlx5/core/en_main.c | 3 +- include/net/pkt_cls.h | 3 +- net/sched/sch_htb.c | 97 ++++++++++++------- 5 files changed, 72 insertions(+), 50 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/qos.c +6 -9
@@ -733,8 +733,8 @@ static void mlx5e_reset_qdisc(struct net_device *dev, u16 qid)spin_unlock_bh (qdisc_lock (qdisc)); } -int mlx5e_htb_leaf_del (struct mlx5e_priv *priv,u16 classid,u16 *old_qid, -u16 *new_qid,struct netlink_ext_ack *extack) +int mlx5e_htb_leaf_del (struct mlx5e_priv *priv,u16 *classid, +struct netlink_ext_ack *extack) {struct mlx5e_qos_node *node;struct netdev_queue *txq;
@@ -742,11 +742,9 @@ int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid,bool opened;int err; -qos_dbg (priv->mdev,"TC_HTB_LEAF_DEL classid %04x\n" , classid); - - *old_qid = *new_qid =0 ; +qos_dbg (priv->mdev,"TC_HTB_LEAF_DEL classid %04x\n" , *classid); - node =mlx5e_sw_node_find (priv, classid); + node =mlx5e_sw_node_find (priv, *classid);if (!node)return -ENOENT ;
@@ -764,7 +762,7 @@ int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid, err =mlx5_qos_destroy_node (priv->mdev, node->hw_id);if (err)/* Not fatal. */ qos_warn (priv->mdev,"Failed to destroy leaf node %u (class %04x), err = %d\n" , - node->hw_id, classid, err); + node->hw_id, *classid, err);mlx5e_sw_node_delete (priv, node);
@@ -826,8 +824,7 @@ int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid,if (opened)mlx5e_reactivate_qos_sq (priv, moved_qid, txq); - *old_qid =mlx5e_qid_from_qos (&priv->channels, moved_qid); - *new_qid =mlx5e_qid_from_qos (&priv->channels, qid); + *classid = node->classid;return 0 ; }
drivers/net/ethernet/mellanox/mlx5/core/en/qos.h +2 -2
@@ -34,8 +34,8 @@ int mlx5e_htb_leaf_alloc_queue(struct mlx5e_priv *priv, u16 classid, struct netlink_ext_ack *extack);int mlx5e_htb_leaf_to_inner (struct mlx5e_priv *priv,u16 classid,u16 child_classid,u64 rate,u64 ceil,struct netlink_ext_ack *extack); -int mlx5e_htb_leaf_del (struct mlx5e_priv *priv,u16 classid,u16 *old_qid, -u16 *new_qid,struct netlink_ext_ack *extack); +int mlx5e_htb_leaf_del (struct mlx5e_priv *priv,u16 *classid, +struct netlink_ext_ack *extack);int mlx5e_htb_leaf_del_last (struct mlx5e_priv *priv,u16 classid,bool force,struct netlink_ext_ack *extack); int mlx5e_htb_node_modify(struct mlx5e_priv *priv, u16 classid, u64 rate, u64 ceil,
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +1 -2
@@ -3447,8 +3447,7 @@ static int mlx5e_setup_tc_htb(struct mlx5e_priv *priv, struct tc_htb_qopt_offloareturn mlx5e_htb_leaf_to_inner (priv, htb->parent_classid, htb->classid, htb->rate, htb->ceil, htb->extack);case TC_HTB_LEAF_DEL : -return mlx5e_htb_leaf_del (priv, htb->classid, &htb->moved_qid, &htb->qid, - htb->extack); +return mlx5e_htb_leaf_del (priv, &htb->classid, htb->extack);case TC_HTB_LEAF_DEL_LAST :case TC_HTB_LEAF_DEL_LAST_FORCE : return mlx5e_htb_leaf_del_last(priv, htb->classid,
include/net/pkt_cls.h +1 -2
@@ -820,10 +820,9 @@ enum tc_htb_command {struct tc_htb_qopt_offload {struct netlink_ext_ack *extack;enum tc_htb_command command; -u16 classid;u32 parent_classid; +u16 classid;u16 qid; -u16 moved_qid;u64 rate;u64 ceil; };
net/sched/sch_htb.c +62 -35
170 lines not on this page · raw message
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 256/300 net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
In reply to Greg Kroah-HartmanFrom: Xiyu Yang <[email protected]>
[ Upstream commit c66070125837900163b81a03063ddd657a7e9bfb ]
The reference counting issue happens in one exception handling path of cbq_change_class(). When failing to get tcf_block, the function forgets to decrease the refcount of "rtab" increased by qdisc_put_rtab(), causing a refcount leak.
Fix this issue by jumping to "failure" label when get tcf_block failed.
--- net/sched/sch_cbq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_cbq.c +1 -1
@@ -1614,7 +1614,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t err =tcf_block_get (&cl->block, &cl->filter_list, sch, extack);if (err) {kfree (cl); -return err; + goto failure; }if (tca[TCA_RATE ]) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 257/300 net: qualcomm: fix QCA7000 checksum handling
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit 429205da6c834447a57279af128bdd56ccd5225e ]
Based on tests the QCA7000 doesn't support checksum offloading. So assume ip_summed is CHECKSUM_NONE and let the kernel take care of the checksum handling. This fixes data transfer issues in noisy environments.
--- drivers/net/ethernet/qualcomm/qca_spi.c | 2 +- drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/qualcomm/qca_spi.c +1 -1
@@ -434,7 +434,7 @@ qcaspi_receive(struct qcaspi *qca)skb_put (qca->rx_skb, retcode); qca->rx_skb->protocol =eth_type_trans ( qca->rx_skb, qca->rx_skb->dev); - qca->rx_skb->ip_summed =CHECKSUM_UNNECESSARY ; +skb_checksum_none_assert (qca->rx_skb);netif_rx_ni (qca->rx_skb); qca->rx_skb =netdev_alloc_skb_ip_align (net_dev, net_dev->mtu +VLAN_ETH_HLEN );
drivers/net/ethernet/qualcomm/qca_uart.c +1 -1
@@ -107,7 +107,7 @@ qca_tty_receive(struct serdev_device *serdev, const unsigned char *data,skb_put (qca->rx_skb, retcode); qca->rx_skb->protocol =eth_type_trans ( qca->rx_skb, qca->rx_skb->dev); - qca->rx_skb->ip_summed =CHECKSUM_UNNECESSARY ; +skb_checksum_none_assert (qca->rx_skb);netif_rx_ni (qca->rx_skb); qca->rx_skb = netdev_alloc_skb_ip_align(netdev, netdev->mtu +
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 258/300 octeontx2-af: Fix loop in free and unmap counter
In reply to Greg Kroah-HartmanFrom: Subbaraya Sundeep <[email protected]>
[ Upstream commit 6537e96d743b89294b397b4865c6c061abae31b0 ]
When the given counter does not belong to the entry then code ends up in infinite loop because the loop cursor, entry is not getting updated further. This patch fixes that by updating entry for every iteration.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +2 -1
@@ -2567,10 +2567,11 @@ int rvu_mbox_handler_npc_mcam_unmap_counter(struct rvu *rvu, index =find_next_bit (mcam->bmap, mcam->bmap_entries, entry);if (index >= mcam->bmap_entries)break ; + entry = index +1 ; +if (mcam->entry2cntr_map[index] != req->cntr)continue ; - entry = index +1 ;npc_unmap_mcam_entry_and_cntr (rvu, mcam, blkaddr, index, req->cntr); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 259/300 octeontx2-af: Fix mailbox errors in nix_rss_flowkey_cfg
In reply to Greg Kroah-HartmanFrom: Subbaraya Sundeep <[email protected]>
[ Upstream commit f2e4568ec95166605c77577953b2787c7f909978 ]
In npc_update_vf_flow_entry function the loop cursor 'index' is being changed inside the loop causing the loop to spin forever. This in turn hogs the kworker thread forever and no other mbox message is processed by AF driver after that. Fix this by using another variable in the loop.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +3 -3
@@ -823,7 +823,7 @@ void rvu_npc_enable_bcast_entry(struct rvu *rvu, u16 pcifunc, bool enable)static void npc_update_vf_flow_entry (struct rvu *rvu,struct npc_mcam *mcam,int blkaddr,u16 pcifunc,u64 rx_action) { -int actindex, index, bank; +int actindex, index, bank, entry;bool enable;if (!(pcifunc &RVU_PFVF_FUNC_MASK ))
@@ -834,7 +834,7 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam,if (mcam->entry2target_pffunc[index] == pcifunc) { bank =npc_get_bank (mcam, index); actindex = index; - index &= (mcam->banksize -1 ); + entry = index & (mcam->banksize -1 );/* read vf flow entry enable status */ enable = is_mcam_entry_enabled(rvu, mcam, blkaddr,
@@ -844,7 +844,7 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam, false);/* update 'action' */ rvu_write64 (rvu, blkaddr, -NPC_AF_MCAMEX_BANKX_ACTION (index, bank), +NPC_AF_MCAMEX_BANKX_ACTION (entry, bank), rx_action);if (enable) npc_enable_mcam_entry(rvu, mcam, blkaddr,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 260/300 octeontx2-af: Fix static code analyzer reported issues
In reply to Greg Kroah-HartmanFrom: Subbaraya Sundeep <[email protected]>
[ Upstream commit 698a82ebfb4b2f2014baf31b7324b328a2a6366e ]
This patch fixes the static code analyzer reported issues in rvu_npc.c. The reported errors are different sizes of operands in bitops and returning uninitialized values.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +3 -3
@@ -23,7 +23,7 @@#define RSVD_MCAM_ENTRIES_PER_NIXLF 1/* Ucast for LFs */ #define NPC_PARSE_RESULT_DMAC_OFFSET 8 -#define NPC_HW_TSTAMP_OFFSET 8 +#define NPC_HW_TSTAMP_OFFSET 8ULL#define NPC_KEX_CHAN_MASK 0xFFFULL#define NPC_KEX_PF_FUNC_MASK 0xFFFFULL
@@ -1751,7 +1751,7 @@ static void npc_unmap_mcam_entry_and_cntr(struct rvu *rvu, int blkaddr, u16 entry, u16 cntr) { u16 index = entry & (mcam->banksize - 1); -u16 bank =npc_get_bank (mcam, entry); +u32 bank =npc_get_bank (mcam, entry);/* Remove mapping and reduce counter's refcnt */ mcam->entry2cntr_map[entry] =NPC_MCAM_INVALID_MAP ;
@@ -2365,8 +2365,8 @@ int rvu_mbox_handler_npc_mcam_shift_entry(struct rvu *rvu,struct npc_mcam *mcam = &rvu->hw->mcam;u16 pcifunc = req->hdr.pcifunc;u16 old_entry, new_entry; +int blkaddr, rc =0 ;u16 index, cntr; -int blkaddr, rc; blkaddr =rvu_get_blkaddr (rvu,BLKTYPE_NPC ,0 );if (blkaddr <0 )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 261/300 octeontx2-af: Set proper errorcode for IPv4 checksum errors
In reply to Greg Kroah-HartmanFrom: Sunil Goutham <[email protected]>
[ Upstream commit 1e4428b6dba9b683dc2ec0a56ed7879de3200cce ]
With current config, for packets with IPv4 checksum errors, errorcode is being set to UNKNOWN. Hence added a separate errorcodes for outer and inner IPv4 checksum and changed NPC configuration accordingly.
Also turn on L2 multicast address check in NPC protocol check block.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +4 -3
@@ -1619,14 +1619,15 @@ int rvu_npc_init(struct rvu *rvu)/* Enable below for Rx pkts. * - Outer IPv4 header checksum validation. -* - Detect outer L2 broadcast address and set NPC_RESULT_S[L2M]. +* - Detect outer L2 broadcast address and set NPC_RESULT_S[L2B]. +* - Detect outer L2 multicast address and set NPC_RESULT_S[L2M]. * - Inner IPv4 header checksum validation. * - Set non zero checksum error code value */ rvu_write64 (rvu, blkaddr,NPC_AF_PCK_CFG ,rvu_read64 (rvu, blkaddr,NPC_AF_PCK_CFG ) | -BIT_ULL (32 ) |BIT_ULL (24 ) |BIT_ULL (6 ) | -BIT_ULL (2 ) |BIT_ULL (1 )); + ((u64 )NPC_EC_OIP4_CSUM <<32 ) | (NPC_EC_IIP4_CSUM <<24 ) | +BIT_ULL (7 ) |BIT_ULL (6 ) |BIT_ULL (2 ) |BIT_ULL (1 ));rvu_npc_setup_interfaces (rvu, blkaddr);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 262/300 ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 92548b0ee220e000d81c27ac9a80e0ede895a881 ]
The UDP length field should be in network order.
This removes the following sparse error:
net/ipv4/route.c:3173:27: warning: incorrect type in assignment (different base types)net/ipv4/route.c:3173:27: expected restricted __be16 [usertype] lennet/ipv4/route.c:3173:27: got unsigned long
--- net/ipv4/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/route.c +1 -1
@@ -3061,7 +3061,7 @@ static struct sk_buff *inet_rtm_getroute_build_skb(__be32 src, __be32 dst, udph =skb_put_zero (skb,sizeof (struct udphdr )); udph->source = sport; udph->dest = dport; - udph->len =sizeof (struct udphdr ); + udph->len =htons (sizeof (struct udphdr )); udph->check =0 ;break ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 263/300 amdgpu/pm: add extra info to SMU msg pre-check failed message
In reply to Greg Kroah-HartmanFrom: Darren Powell <[email protected]>
[ Upstream commit 1e4a53de01c68d4ec9800b9a0f6efe9f26184a77 ]
Insert the value of the response to error message emitted when the SMU msg pre-check failes
--- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +2 -2
@@ -104,8 +104,8 @@ int smu_cmn_send_msg_without_waiting(struct smu_context *smu, ret =smu_cmn_wait_for_response (smu);if (ret !=0x1 ) { -dev_err (adev->dev,"Msg issuing pre-check failed and " -"SMU may be not in the right state!\n" ); +dev_err (adev->dev,"Msg issuing pre-check failed(0x%x) and " +"SMU may be not in the right state!\n" , ret);if (ret != -ETIME ) ret = -EIO ;return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 264/300 ASoC: rt5682: Remove unused variable in rt5682_i2c_remove()
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
commit a1ea05723c27a6f77894a60038a7b2b12fcec9a7 upstream.
In commit 772d44526e20 ("ASoC: rt5682: Properly turn off regulators if wrong device ID") I deleted code but forgot to delete a variable that's now unused. Delete it.
--- sound/soc/codecs/rt5682-i2c.c | 2 -- 1 file changed, 2 deletions(-)
sound/soc/codecs/rt5682-i2c.c +0 -2
@@ -294,8 +294,6 @@ static void rt5682_i2c_shutdown(struct istatic int rt5682_i2c_remove (struct i2c_client *client) { -struct rt5682_priv *rt5682 =i2c_get_clientdata (client); -rt5682_i2c_shutdown (client);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 265/300 iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha
In reply to Greg Kroah-HartmanFrom: Justin M. Forbes <[email protected]>
commit 2f32c147a3816d789722c0bd242a9431332ec3ed upstream.
The Samsung Galaxy Book Flex2 Alpha uses an ax201 with the ID a0f0/6074. This works fine with the existing driver once it knows to claim it. Simple patch to add the device.
--- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +1 -0
@@ -556,6 +556,7 @@ static const struct iwl_dev_info iwl_devIWL_DEV_INFO (0xA0F0 ,0x1652 , killer1650i_2ax_cfg_qu_b0_hr_b0,NULL ),IWL_DEV_INFO (0xA0F0 ,0x2074 , iwl_ax201_cfg_qu_hr,NULL ),IWL_DEV_INFO (0xA0F0 ,0x4070 , iwl_ax201_cfg_qu_hr,NULL ), +IWL_DEV_INFO (0xA0F0 ,0x6074 , iwl_ax201_cfg_qu_hr,NULL ),IWL_DEV_INFO (0x02F0 ,0x0070 , iwl_ax201_cfg_quz_hr,NULL ),IWL_DEV_INFO (0x02F0 ,0x0074 , iwl_ax201_cfg_quz_hr,NULL ), IWL_DEV_INFO(0x02F0, 0x6074, iwl_ax201_cfg_quz_hr, NULL),
Greg Kroah-Hartman
maintainerPATCH 266/300 f2fs: guarantee to write dirty data when enabling checkpoint back
In reply to Greg Kroah-HartmanFrom: Jaegeuk Kim <[email protected]>
commit dddd3d65293a52c2c3850c19b1e5115712e534d8 upstream.
We must flush all the dirty data when enabling checkpoint back. Let's guarantee that first by adding a retry logic on sync_inodes_sb(). In addition to that, this patch adds to flush data in fsync when checkpoint is disabled, which can mitigate the sync_inodes_sb() failures in advance.
--- fs/f2fs/file.c | 5 ++--- fs/f2fs/super.c | 11 ++++++++++- 2 files changed, 12 insertions(+), 4 deletions(-)
fs/f2fs/file.c +2 -3
@@ -263,8 +263,7 @@ static int f2fs_do_sync_file(struct file };unsigned int seq_id =0 ; -if (unlikely (f2fs_readonly (inode->i_sb) || -is_sbi_flag_set (sbi,SBI_CP_DISABLED ))) +if (unlikely (f2fs_readonly (inode->i_sb)))return 0 ;trace_f2fs_sync_file_enter (inode);
@@ -278,7 +277,7 @@ static int f2fs_do_sync_file(struct file ret =file_write_and_wait_range (file, start, end);clear_inode_flag (inode,FI_NEED_IPU ); -if (ret) { +if (ret ||is_sbi_flag_set (sbi,SBI_CP_DISABLED )) {trace_f2fs_sync_file_exit (inode, cp_reason, datasync, ret);return ret; }
fs/f2fs/super.c +10 -1
@@ -1923,8 +1923,17 @@ restore_flag:static void f2fs_enable_checkpoint (struct f2fs_sb_info *sbi) { +int retry =DEFAULT_RETRY_IO_COUNT ; +/* we should flush all the data to keep data consistency */ -sync_inodes_sb (sbi->sb); +do { +sync_inodes_sb (sbi->sb); +cond_resched (); +congestion_wait (BLK_RW_ASYNC ,DEFAULT_IO_TIMEOUT ); + }while (get_pages (sbi,F2FS_DIRTY_DATA ) && retry--); + +if (unlikely (retry <0 )) +f2fs_warn (sbi,"checkpoint=enable has some unwritten data." );down_write (&sbi->gc_lock);f2fs_dirty_to_prefree (sbi);
Greg Kroah-Hartman
maintainerPATCH 267/300 time: Handle negative seconds correctly in timespec64_to_ns()
In reply to Greg Kroah-HartmanFrom: Lukas Hannen <[email protected]>
commit 39ff83f2f6cc5cc1458dfcea9697f96338210beb upstream.
timespec64_ns() prevents multiplication overflows by comparing the seconds value of the timespec to KTIME_SEC_MAX. If the value is greater or equal it returns KTIME_MAX.
But that check casts the signed seconds value to unsigned which makes the comparision true for all negative values and therefore return wrongly KTIME_MAX.
Negative second values are perfectly valid and required in some places, e.g. ptp_clock_adjtime().
Remove the cast and add a check for the negative boundary which is required to prevent undefined behaviour due to multiplication underflow.
--- include/linux/time64.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
include/linux/time64.h +7 -2
@@ -25,7 +25,9 @@ struct itimerspec64 {#define TIME64_MIN (-TIME64_MAX - 1)#define KTIME_MAX ((s64)~((u64)1 << 63)) +#define KTIME_MIN (-KTIME_MAX - 1)#define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC) +#define KTIME_SEC_MIN (KTIME_MIN / NSEC_PER_SEC)/* * Limits for settimeofday():
@@ -124,10 +126,13 @@ static inline bool timespec64_valid_sett*/ static inline s64 timespec64_to_ns (const struct timespec64 *ts) { -/* Prevent multiplication overflow */ -if ((unsigned long long )ts->tv_sec >=KTIME_SEC_MAX ) +/* Prevent multiplication overflow / underflow */ +if (ts->tv_sec >=KTIME_SEC_MAX )return KTIME_MAX ; +if (ts->tv_sec <=KTIME_SEC_MIN ) +return KTIME_MIN ; +return ((s64 ) ts->tv_sec *NSEC_PER_SEC ) + ts->tv_nsec; }
Greg Kroah-Hartman
maintainerPATCH 268/300 auxdisplay: hd44780: Fix oops on module unloading
In reply to Greg Kroah-HartmanFrom: Lars Poeschel <[email protected]>
commit 333ff32d54cdefc2e479892e7f15ac91e026b57d upstream.
--- drivers/auxdisplay/hd44780.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/auxdisplay/hd44780.c +1 -1
@@ -323,8 +323,8 @@ static int hd44780_remove(struct platfor {struct charlcd *lcd =platform_get_drvdata (pdev); -kfree (lcd->drvdata);charlcd_unregister (lcd); +kfree (lcd->drvdata);kfree (lcd);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 269/300 io_uring: limit fixed table size by RLIMIT_NOFILE
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
commit 3a1b8a4e843f96b636431450d8d79061605cf74b upstream.
Limit the number of files in io_uring fixed tables by RLIMIT_NOFILE, that's the first and the simpliest restriction that we should impose.
--- fs/io_uring.c | 2 ++ 1 file changed, 2 insertions(+)
fs/io_uring.c +2 -0
@@ -7669,6 +7669,8 @@ static int io_sqe_files_register(structreturn -EINVAL ;if (nr_args >IORING_MAX_FIXED_FILES )return -EMFILE ; +if (nr_args >rlimit (RLIMIT_NOFILE )) +return -EMFILE ; ret =io_rsrc_node_switch_start (ctx);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 270/300 io_uring: IORING_OP_WRITE needs hash_reg_file set
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit 7b3188e7ed54102a5dcc73d07727f41fb528f7c8 upstream.
During some testing, it became evident that using IORING_OP_WRITE doesn't hash buffered writes like the other writes commands do. That's simply an oversight, and can cause performance regressions when doing buffered writes with this command.
Correct that and add the flag, so that buffered writes are correctly hashed when using the non-iovec based write command.
--- fs/io_uring.c | 1 + 1 file changed, 1 insertion(+)
fs/io_uring.c +1 -0
@@ -990,6 +990,7 @@ static const struct io_op_def io_op_defs }, [IORING_OP_WRITE] = { .needs_file = 1, + .hash_reg_file = 1, .unbound_nonreg_file = 1, .pollout = 1, .plug = 1,
Greg Kroah-Hartman
maintainerPATCH 271/300 io_uring: io_uring_complete() trace should take an integer
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit 2fc2a7a62eb58650e71b4550cf6fa6cc0a75b2d2 upstream.
It currently takes a long, and while that's normally OK, the io_uring limit is an int. Internally in io_uring it's an int, but sometimes it's passed as a long. That can yield confusing results where a completions seems to generate a huge result:
ou-sqp-1297-1298 [001] ...1 788.056371: io_uring_complete: ring 000000000e98e046, user_data 0x0, result 4294967171, cflags 0
which is due to -ECANCELED being stored in an unsigned, and then passed in as a long. Using the right int type, the trace looks correct:
iou-sqp-338-339 [002] ...1 15.633098: io_uring_complete: ring 00000000e0ac60cf, user_data 0x0, result -125, cflags 0
--- include/trace/events/io_uring.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
include/trace/events/io_uring.h +3 -3
@@ -295,14 +295,14 @@ TRACE_EVENT(io_uring_fail_link,*/ TRACE_EVENT(io_uring_complete, - TP_PROTO(void *ctx, u64 user_data, long res, unsigned cflags), + TP_PROTO(void *ctx, u64 user_data, int res, unsigned cflags), TP_ARGS(ctx, user_data, res, cflags), TP_STRUCT__entry ( __field( void *, ctx ) __field( u64, user_data ) - __field( long, res ) + __field( int, res ) __field( unsigned, cflags ) ),
@@ -313,7 +313,7 @@ TRACE_EVENT(io_uring_complete, __entry->cflags = cflags; ), -TP_printk ("ring %p, user_data 0x%llx, result %ld, cflags %x" , +TP_printk ("ring %p, user_data 0x%llx, result %d, cflags %x" , __entry->ctx, (unsigned long long )__entry->user_data, __entry->res, __entry->cflags) );
Greg Kroah-Hartman
maintainerPATCH 272/300 bio: fix page leak bio_add_hw_page failure
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
commit d9cf3bd531844ffbfe94b16e417037a16efc988d upstream.
__bio_iov_append_get_pages() doesn't put not appended pages on bio_add_hw_page() failure, so potentially leaking them, fix it. Also, do the same for __bio_iov_iter_get_pages(), even though it looks like it can't be triggered by userspace in this case.
--- block/bio.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
block/bio.c +13 -2
@@ -979,6 +979,14 @@ static int bio_iov_bvec_set_append(strucreturn 0 ; } +static void bio_put_pages (struct page **pages,size_t size,size_t off) +{ +size_t i, nr =DIV_ROUND_UP (size + (off & ~PAGE_MASK ),PAGE_SIZE ); + +for (i =0 ; i < nr; i++) +put_page (pages[i]); +} +#define PAGE_PTRS_PER_BVEC (sizeof(struct bio_vec) / sizeof(struct page *))/**
@@ -1023,8 +1031,10 @@ static int __bio_iov_iter_get_pages(struif (same_page)put_page (page); }else { -if (WARN_ON_ONCE (bio_full (bio, len))) -return -EINVAL ; +if (WARN_ON_ONCE (bio_full (bio, len))) { +bio_put_pages (pages + i, left, offset); +return -EINVAL ; + }__bio_add_page (bio, page, len, offset); } offset =0 ;
@@ -1069,6 +1079,7 @@ static int __bio_iov_append_get_pages(st len =min_t (size_t,PAGE_SIZE - offset, left);if (bio_add_hw_page (q, bio, page, len, offset, max_append_sectors, &same_page) != len) { +bio_put_pages (pages + i, left, offset); ret = -EINVAL ;break ; }
Greg Kroah-Hartman
maintainerPATCH 273/300 raid1: ensure write behind bio has less than BIO_MAX_VECS sectors
In reply to Greg Kroah-HartmanFrom: Guoqing Jiang <[email protected]>
commit 6607cd319b6b91bff94e90f798a61c031650b514 upstream.
We can't split write behind bio with more than BIO_MAX_VECS sectors, otherwise the below call trace was triggered because we could allocate oversized write behind bio later.
[ 8.097936] bvec_alloc+0x90/0xc0 [ 8.098934] bio_alloc_bioset+0x1b3/0x260 [ 8.099959] raid1_make_request+0x9ce/0xc50 [raid1] [ 8.100988] ? __bio_clone_fast+0xa8/0xe0 [ 8.102008] md_handle_request+0x158/0x1d0 [md_mod] [ 8.103050] md_submit_bio+0xcd/0x110 [md_mod] [ 8.104084] submit_bio_noacct+0x139/0x530 [ 8.105127] submit_bio+0x78/0x1d0 [ 8.106163] ext4_io_submit+0x48/0x60 [ext4] [ 8.107242] ext4_writepages+0x652/0x1170 [ext4] [ 8.108300] ? do_writepages+0x41/0x100 [ 8.109338] ? __ext4_mark_inode_dirty+0x240/0x240 [ext4] [ 8.110406] do_writepages+0x41/0x100 [ 8.111450] __filemap_fdatawrite_range+0xc5/0x100 [ 8.112513] file_write_and_wait_range+0x61/0xb0 [ 8.113564] ext4_sync_file+0x73/0x370 [ext4] [ 8.114607] __x64_sys_fsync+0x33/0x60 [ 8.115635] do_syscall_64+0x33/0x40 [ 8.116670] entry_SYSCALL_64_after_hwframe+0x44/0xae
Thanks for the comment from Christoph.
[1]. https://bugs.archlinux.org/task/70992
--- drivers/md/raid1.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/md/raid1.c +19 -0
@@ -1324,6 +1324,7 @@ static void raid1_write_request(struct mstruct raid1_plug_cb *plug =NULL ;int first_clone;int max_sectors; +bool write_behind = false;if (mddev_is_clustered (mddev) && md_cluster_ops->area_resyncing(mddev, WRITE,
@@ -1376,6 +1377,15 @@ static void raid1_write_request(struct m max_sectors = r1_bio->sectors;for (i =0 ; i < disks; i++) {struct md_rdev *rdev =rcu_dereference (conf->mirrors[i].rdev); + +/* +* The write-behind io is only attempted on drives marked as +* write-mostly, which means we could allocate write behind +* bio later. +*/ +if (rdev &&test_bit (WriteMostly, &rdev->flags)) + write_behind = true; +if (rdev &&unlikely (test_bit (Blocked, &rdev->flags))) {atomic_inc (&rdev->nr_pending); blocked_rdev = rdev;
@@ -1449,6 +1459,15 @@ static void raid1_write_request(struct m goto retry_write; } +/* +* When using a bitmap, we may call alloc_behind_master_bio below. +* alloc_behind_master_bio allocates a copy of the data payload a page +* at a time and thus needs a new bio that can fit the whole payload +* this bio in page sized chunks. +*/ +if (write_behind && bitmap) + max_sectors =min_t (int, max_sectors, +BIO_MAX_VECS * (PAGE_SIZE >>9 ));if (max_sectors <bio_sectors (bio)) {struct bio *split =bio_split (bio, max_sectors,GFP_NOIO , &conf->bio_split);
Greg Kroah-Hartman
maintainerPATCH 274/300 cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED
In reply to Greg Kroah-HartmanFrom: Ronnie Sahlberg <[email protected]>
commit 3998f0b8bc49ec784990971dc1f16bf367b19078 upstream.
RHBZ: 1994393
If we hit a STATUS_USER_SESSION_DELETED for the Create part in the Create/QueryDirectory compound that starts a directory scan
we will leak EDEADLK back to userspace and surprise glibc and the application.
Pick this up initiate_cifs_search() and retry a small number of tries before we return an error to userspace.
--- fs/cifs/readdir.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-)
fs/cifs/readdir.c +22 -1
@@ -381,7 +381,7 @@ int get_symlink_reparse_path(char *full_*/ static int -initiate_cifs_search (const unsigned int xid,struct file *file, +_initiate_cifs_search (const unsigned int xid,struct file *file,const char *full_path) {__u16 search_flags;
@@ -463,6 +463,27 @@ error_exit:return rc; } +static int +initiate_cifs_search (const unsigned int xid,struct file *file, +const char *full_path) +{ +int rc, retry_count =0 ; + +do { + rc =_initiate_cifs_search (xid, file, full_path); +/* +* If we don't have enough credits to start reading the +* directory just try again after short wait. +*/ +if (rc != -EDEADLK ) +break ; + +usleep_range (512 ,2048 ); + }while (retry_count++ <5 ); + +return rc; +} +/* return length of unicode string in bytes */ static int cifs_unicode_bytelen (const char *str) {
Greg Kroah-Hartman
maintainerPATCH 275/300 smb3: fix posix extensions mount option
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
commit 7321be2663da5922343cc121f1ff04924cee2e76 upstream.
We were incorrectly initializing the posix extensions in the conversion to the new mount API.
--- fs/cifs/fs_context.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
fs/cifs/fs_context.c +9 -2
@@ -1259,10 +1259,17 @@ static int smb3_fs_context_parse_param(s ctx->posix_paths =1 ;break ;case Opt_unix: -if (result.negated) +if (result.negated) { +if (ctx->linux_ext ==1 ) +pr_warn_once ("conflicting posix mount options specified\n" ); ctx->linux_ext =0 ; -else ctx->no_linux_ext =1 ; + }else { +if (ctx->no_linux_ext ==1 ) +pr_warn_once ("conflicting posix mount options specified\n" ); + ctx->linux_ext =1 ; + ctx->no_linux_ext =0 ; + }break ;case Opt_nocase: ctx->nocase =1 ;
Greg Kroah-Hartman
maintainerPATCH 276/300 tty: Fix data race between tiocsti() and flush_to_ldisc()
In reply to Greg Kroah-HartmanFrom: Nguyen Dinh Phi <[email protected]>
commit bb2853a6a421a052268eee00fd5d3f6b3504b2b1 upstream.
The ops->receive_buf() may be accessed concurrently from these two functions. If the driver flushes data to the line discipline receive_buf() method while tiocsti() is waiting for the ops->receive_buf() to finish its work, the data race will happen.
For example:tty_ioctl |tty_ldisc_receive_buf
->tioctsi | ->tty_port_default_receive_buf
| ->tty_ldisc_receive_buf
->hci_uart_tty_receive | ->hci_uart_tty_receive
->h4_recv | ->h4_recvIn this case, the h4 receive buffer will be overwritten by the latecomer, and we will lost the data.
Hence, change tioctsi() function to use the exclusive lock interface from tty_buffer to avoid the data race.
--- drivers/tty/tty_io.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/tty_io.c +2 -2
@@ -2294,8 +2294,6 @@ static int tty_fasync(int fd, struct fil* Locking: * Called functions take tty_ldiscs_lock * current->signal->tty check is safe without locks -* -* FIXME: may race normal receive processing */ static int tiocsti (struct tty_struct *tty,char __user *p)
@@ -2311,8 +2309,10 @@ static int tiocsti(struct tty_struct *tt ld =tty_ldisc_ref_wait (tty);if (!ld)return -EIO ; +tty_buffer_lock_exclusive (tty->port);if (ld->ops->receive_buf) ld->ops->receive_buf (tty, &ch, &mbz,1 ); +tty_buffer_unlock_exclusive (tty->port);tty_ldisc_deref (ld);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 277/300 x86/efi: Restore Firmware IDT before calling ExitBootServices()
In reply to Greg Kroah-HartmanFrom: Joerg Roedel <[email protected]>
commit 22aa45cb465be474e97666b3f7587ccb06ee411b upstream.
Commit
79419e13e808 ("x86/boot/compressed/64: Setup IDT in startup_32 boot path")
introduced an IDT into the 32-bit boot path of the decompressor stub. But the IDT is set up before ExitBootServices() is called, and some UEFI firmwares rely on their own IDT.
Save the firmware IDT on boot and restore it before calling into EFI functions to fix boot failures introduced by above commit.
--- arch/x86/boot/compressed/efi_thunk_64.S | 30 +++++++++++++++++++++--------- arch/x86/boot/compressed/head_64.S | 3 +++ 2 files changed, 24 insertions(+), 9 deletions(-)
arch/x86/boot/compressed/efi_thunk_64.S +21 -9
@@ -5,9 +5,8 @@ * Early support for invoking 32-bit EFI services from a 64-bit kernel. * * Because this thunking occurs before ExitBootServices() we have to - * restore the firmware's 32-bit GDT before we make EFI service calls, - * since the firmware's 32-bit IDT is still currently installed and it - * needs to be able to service interrupts. + * restore the firmware's 32-bit GDT and IDT before we make EFI service + * calls. * * On the plus side, we don't have to worry about mangling 64-bit * addresses into 32-bits because we're executing with an identity
@@ -39,7 +38,7 @@ SYM_FUNC_START(__efi64_thunk) /* * Convert x86-64 ABI params to i386 ABI */ - subq $32, %rsp + subq $64, %rsp movl %esi, 0x0(%rsp) movl %edx, 0x4(%rsp) movl %ecx, 0x8(%rsp)
@@ -49,14 +48,19 @@ SYM_FUNC_START(__efi64_thunk) leaq 0x14(%rsp), %rbx sgdt (%rbx) + addq $16, %rbx + sidt (%rbx) + /* - * Switch to gdt with 32-bit segments. This is the firmware GDT - * that was installed when the kernel started executing. This - * pointer was saved at the EFI stub entry point in head_64.S. + * Switch to IDT and GDT with 32-bit segments. This is the firmware GDT + * and IDT that was installed when the kernel started executing. The + * pointers were saved at the EFI stub entry point in head_64.S. * * Pass the saved DS selector to the 32-bit code, and use far return to * restore the saved CS selector. */ + leaq efi32_boot_idt(%rip), %rax + lidt (%rax) leaq efi32_boot_gdt(%rip), %rax lgdt (%rax)
@@ -67,7 +71,7 @@ SYM_FUNC_START(__efi64_thunk) pushq %rax lretq -1: addq $32, %rsp +1: addq $64, %rsp movq %rdi, %rax pop %rbx
@@ -128,10 +132,13 @@ SYM_FUNC_START_LOCAL(efi_enter32) /* * Some firmware will return with interrupts enabled. Be sure to - * disable them before we switch GDTs. + * disable them before we switch GDTs and IDTs. */ cli + lidtl (%ebx) + subl $16, %ebx + lgdtl (%ebx) movl %cr4, %eax
@@ -166,6 +173,11 @@ SYM_DATA_START(efi32_boot_gdt) .quad 0 SYM_DATA_END(efi32_boot_gdt) +SYM_DATA_START(efi32_boot_idt) + .word 0 + .quad 0 +SYM_DATA_END(efi32_boot_idt) + SYM_DATA_START(efi32_boot_cs) .word 0 SYM_DATA_END(efi32_boot_cs)
arch/x86/boot/compressed/head_64.S +3 -0
@@ -319,6 +319,9 @@ SYM_INNER_LABEL(efi32_pe_stub_entry, SYM movw %cs, rva(efi32_boot_cs)(%ebp) movw %ds, rva(efi32_boot_ds)(%ebp) + /* Store firmware IDT descriptor */ + sidtl rva(efi32_boot_idt)(%ebp) + /* Disable paging */ movl %cr0, %eax btrl $X86_CR0_PG_BIT, %eax
Greg Kroah-Hartman
maintainerPATCH 278/300 perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op
In reply to Greg Kroah-HartmanFrom: Kim Phillips <[email protected]>
commit f11dd0d80555cdc8eaf5cfc9e19c9e198217f9f1 upstream.
Commit:
2ff40250691e ("perf/core, arch/x86: Use PERF_PMU_CAP_NO_EXCLUDE for exclusion incapable PMUs")
neglected to do so.
--- arch/x86/events/amd/ibs.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/events/amd/ibs.c +1 -0
@@ -571,6 +571,7 @@ static struct perf_ibs perf_ibs_op = { .start = perf_ibs_start, .stop = perf_ibs_stop, .read = perf_ibs_read, + .capabilities = PERF_PMU_CAP_NO_EXCLUDE, }, .msr = MSR_AMD64_IBSOPCTL, .config_mask = IBS_OP_CONFIG_MASK,
Greg Kroah-Hartman
maintainerPATCH 279/300 x86/resctrl: Fix a maybe-uninitialized build warning treated as error
In reply to Greg Kroah-HartmanFrom: Babu Moger <[email protected]>
commit 527f721478bce3f49b513a733bacd19d6f34b08c upstream.
The recent commit
064855a69003 ("x86/resctrl: Fix default monitoring groups reporting")
caused a RHEL build failure with an uninitialized variable warning treated as an error because it removed the default case snippet.
The RHEL Makefile uses '-Werror=maybe-uninitialized' to force possibly uninitialized variable warnings to be treated as errors. This is also reported by smatch via the 0day robot.
The error from the RHEL build is:
arch/x86/kernel/cpu/resctrl/monitor.c: In function ‘__mon_event_count’:
arch/x86/kernel/cpu/resctrl/monitor.c:261:12: error: ‘m’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
m->chunks += chunks;
^~The upstream Makefile does not build using '-Werror=maybe-uninitialized'. So, the problem is not seen there. Fix the problem by putting back the default case snippet.
[ bp: note that there's nothing wrong with the code and other compilers
do not trigger this warning - this is being done just so the RHEL compiler is happy. ]
--- arch/x86/kernel/cpu/resctrl/monitor.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/x86/kernel/cpu/resctrl/monitor.c +6 -0
@@ -304,6 +304,12 @@ static u64 __mon_event_count(u32 rmid, scase QOS_L3_MBM_LOCAL_EVENT_ID : m = &rr->d->mbm_local[rmid];break ; +default : +/* +* Code would never reach here because an invalid +* event id would fail the __rmid_read. +*/ +return RMID_VAL_ERROR ; }if (rr->first) {
Greg Kroah-Hartman
maintainerPATCH 280/300 Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()"
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit e7177339d7b5f9594b316842122b5fda9513d5e2 upstream.
Revert a misguided illegal GPA check when "translating" a non-nested GPA. The check is woefully incomplete as it does not fill in @exception as expected by all callers, which leads to KVM attempting to inject a bogus exception, potentially exposing kernel stack information in the process.
WARNING: CPU: 0 PID: 8469 at arch/x86/kvm/x86.c:525 exception_type+0x98/0xb0 arch/x86/kvm/x86.c:525 CPU: 1 PID: 8469 Comm: syz-executor531 Not tainted 5.14.0-rc7-syzkaller #0 RIP: 0010:exception_type+0x98/0xb0 arch/x86/kvm/x86.c:525 Call Trace: x86_emulate_instruction+0xef6/0x1460 arch/x86/kvm/x86.c:7853 kvm_mmu_page_fault+0x2f0/0x1810 arch/x86/kvm/mmu/mmu.c:5199 handle_ept_misconfig+0xdf/0x3e0 arch/x86/kvm/vmx/vmx.c:5336 __vmx_handle_exit arch/x86/kvm/vmx/vmx.c:6021 [inline] vmx_handle_exit+0x336/0x1800 arch/x86/kvm/vmx/vmx.c:6038 vcpu_enter_guest+0x2a1c/0x4430 arch/x86/kvm/x86.c:9712 vcpu_run arch/x86/kvm/x86.c:9779 [inline] kvm_arch_vcpu_ioctl_run+0x47d/0x1b20 arch/x86/kvm/x86.c:10010 kvm_vcpu_ioctl+0x49e/0xe50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3652
The bug has escaped notice because practically speaking the GPA check is useless. The GPA check in question only comes into play when KVM is walking guest page tables (or "translating" CR3), and KVM already handles illegal GPA checks by setting reserved bits in rsvd_bits_mask for each PxE, or in the case of CR3 for loading PTDPTRs, manually checks for an illegal CR3. This particular failure doesn't hit the existing reserved bits checks because syzbot sets guest.MAXPHYADDR=1, and IA32 architecture simply doesn't allow for such an absurd MAXPHYADDR, e.g. 32-bit paging doesn't define any reserved PA bits checks, which KVM emulates by only incorporating the reserved PA bits into the "high" bits, i.e. bits 63:32.
Simply remove the bogus check. There is zero meaningful value and no architectural justification for supporting guest.MAXPHYADDR < 32, and properly filling the exception would introduce non-trivial complexity.
This reverts commit ec7771ab471ba6a945350353617e2e3385d0e013.
Message-Id: <[email protected]>
--- arch/x86/kvm/mmu/mmu.c | 6 ------ 1 file changed, 6 deletions(-)
arch/x86/kvm/mmu/mmu.c +0 -6
@@ -257,12 +257,6 @@ static bool check_mmio_spte(struct kvm_vstatic gpa_t translate_gpa (struct kvm_vcpu *vcpu,gpa_t gpa,u32 access,struct x86_exception *exception) { -/* Check if guest physical address doesn't exceed guest maximum */ -if (kvm_vcpu_is_illegal_gpa (vcpu, gpa)) { - exception->error_code |=PFERR_RSVD_MASK ; -return UNMAPPED_GVA ; - } -return gpa; }
Greg Kroah-Hartman
maintainerPATCH 281/300 KVM: s390: index kvm->arch.idle_mask by vcpu_idx
In reply to Greg Kroah-HartmanFrom: Halil Pasic <[email protected]>
commit a3e03bc1368c1bc16e19b001fc96dc7430573cc8 upstream.
While in practice vcpu->vcpu_idx == vcpu->vcp_id is often true, it may not always be, and we must not rely on this. Reason is that KVM decides the vcpu_idx, userspace decides the vcpu_id, thus the two might not match.
Currently kvm->arch.idle_mask is indexed by vcpu_id, which implies that code like
for_each_set_bit(vcpu_id, kvm->arch.idle_mask, online_vcpus) {
vcpu = kvm_get_vcpu(kvm, vcpu_id);
do_stuff(vcpu);
}is not legit. Reason is that kvm_get_vcpu expects an vcpu_idx, not an vcpu_id. The trouble is, we do actually use kvm->arch.idle_mask like this. To fix this problem we have two options. Either use kvm_get_vcpu_by_id(vcpu_id), which would loop to find the right vcpu_id, or switch to indexing via vcpu_idx. The latter is preferable for obvious reasons.
Let us make switch from indexing kvm->arch.idle_mask by vcpu_id to indexing it by vcpu_idx. To keep gisa_int.kicked_mask indexed by the same index as idle_mask lets make the same change for it as well.
--- arch/s390/include/asm/kvm_host.h | 1 + arch/s390/kvm/interrupt.c | 12 ++++++------ arch/s390/kvm/kvm-s390.c | 2 +- arch/s390/kvm/kvm-s390.h | 2 +- 4 files changed, 9 insertions(+), 8 deletions(-)
arch/s390/include/asm/kvm_host.h +1 -0
@@ -962,6 +962,7 @@ struct kvm_arch{atomic64_t cmma_dirty_pages;/* subset of available cpu features enabled by user space */ DECLARE_BITMAP (cpu_feat,KVM_S390_VM_CPU_FEAT_NR_BITS ); +/* indexed by vcpu_idx */ DECLARE_BITMAP (idle_mask,KVM_MAX_VCPUS );struct kvm_s390_gisa_interrupt gisa_int;struct kvm_s390_pv pv;
arch/s390/kvm/interrupt.c +6 -6
@@ -419,13 +419,13 @@ static unsigned long deliverable_irqs(ststatic void __set_cpu_idle (struct kvm_vcpu *vcpu) {kvm_s390_set_cpuflags (vcpu,CPUSTAT_WAIT ); -set_bit (vcpu->vcpu_id, vcpu->kvm->arch.idle_mask); +set_bit (kvm_vcpu_get_idx (vcpu), vcpu->kvm->arch.idle_mask); }static void __unset_cpu_idle (struct kvm_vcpu *vcpu) {kvm_s390_clear_cpuflags (vcpu,CPUSTAT_WAIT ); -clear_bit (vcpu->vcpu_id, vcpu->kvm->arch.idle_mask); +clear_bit (kvm_vcpu_get_idx (vcpu), vcpu->kvm->arch.idle_mask); }static void __reset_intercept_indicators (struct kvm_vcpu *vcpu)
@@ -3050,18 +3050,18 @@ int kvm_s390_get_irq_state(struct kvm_vcstatic void __airqs_kick_single_vcpu (struct kvm *kvm,u8 deliverable_mask) { -int vcpu_id, online_vcpus =atomic_read (&kvm->online_vcpus); +int vcpu_idx, online_vcpus =atomic_read (&kvm->online_vcpus);struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;struct kvm_vcpu *vcpu; -for_each_set_bit (vcpu_id, kvm->arch.idle_mask, online_vcpus) { - vcpu =kvm_get_vcpu (kvm, vcpu_id); +for_each_set_bit (vcpu_idx, kvm->arch.idle_mask, online_vcpus) { + vcpu =kvm_get_vcpu (kvm, vcpu_idx);if (psw_ioint_disabled (vcpu))continue ; deliverable_mask &= (u8)(vcpu->arch.sie_block->gcr[6 ] >>24 );if (deliverable_mask) {/* lately kicked but not yet running */ -if (test_and_set_bit (vcpu_id, gi->kicked_mask)) +if (test_and_set_bit (vcpu_idx, gi->kicked_mask))return ;kvm_s390_vcpu_wakeup (vcpu);return ;
arch/s390/kvm/kvm-s390.c +1 -1
@@ -4020,7 +4020,7 @@ static int vcpu_pre_run(struct kvm_vcpukvm_s390_patch_guest_per_regs (vcpu); } -clear_bit (vcpu->vcpu_id, vcpu->kvm->arch.gisa_int.kicked_mask); +clear_bit (kvm_vcpu_get_idx (vcpu), vcpu->kvm->arch.gisa_int.kicked_mask); vcpu->arch.sie_block->icptcode =0 ; cpuflags =atomic_read (&vcpu->arch.sie_block->cpuflags);
arch/s390/kvm/kvm-s390.h +1 -1
@@ -79,7 +79,7 @@ static inline int is_vcpu_stopped(structstatic inline int is_vcpu_idle (struct kvm_vcpu *vcpu) { -return test_bit (vcpu->vcpu_id, vcpu->kvm->arch.idle_mask); +return test_bit (kvm_vcpu_get_idx (vcpu), vcpu->kvm->arch.idle_mask); }static inline int kvm_is_ucontrol (struct kvm *kvm)
Greg Kroah-Hartman
maintainerPATCH 282/300 KVM: x86: Update vCPUs hv_clock before back to guest when tsc_offset is adjusted
In reply to Greg Kroah-HartmanFrom: Zelin Deng <[email protected]>
commit d9130a2dfdd4b21736c91b818f87dbc0ccd1e757 upstream.
When MSR_IA32_TSC_ADJUST is written by guest due to TSC ADJUST feature especially there's a big tsc warp (like a new vCPU is hot-added into VM which has been up for a long time), tsc_offset is added by a large value then go back to guest. This causes system time jump as tsc_timestamp is not adjusted in the meantime and pvclock monotonic character. To fix this, just notify kvm to update vCPU's guest time before back to guest.
Message-Id: <[email protected]>
--- arch/x86/kvm/x86.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/kvm/x86.c +4 -0
@@ -3223,6 +3223,10 @@ int kvm_set_msr_common(struct kvm_vcpu *if (!msr_info->host_initiated) {s64 adj = data - vcpu->arch.ia32_tsc_adjust_msr;adjust_tsc_offset_guest (vcpu, adj); +/* Before back to guest, tsc_timestamp must be adjusted +* as well, otherwise guest's percpu pvclock time could jump. +*/ +kvm_make_request (KVM_REQ_CLOCK_UPDATE , vcpu); } vcpu->arch.ia32_tsc_adjust_msr = data; }
Greg Kroah-Hartman
maintainerPATCH 283/300 KVM: x86: clamp host mapping level to max_level in kvm_mmu_max_mapping_level
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit ec607a564f70519b340f7eb4cfc0f4a6b55285ac upstream.
This change started as a way to make kvm_mmu_hugepage_adjust a bit simpler, but it does fix two bugs as well.
One bug is in zapping collapsible PTEs. If a large page size is disallowed but not all of them, kvm_mmu_max_mapping_level will return the host mapping level and the small PTEs will be zapped up to that level. However, if e.g. 1GB are prohibited, we can still zap 4KB mapping and preserve the 2MB ones. This can happen for example when NX huge pages are in use.
The second would happen when userspace backs guest memory with a 1gb hugepage but only assign a subset of the page to the guest. 1gb pages would be disallowed by the memslot, but not 2mb. kvm_mmu_max_mapping_level() would fall through to the host_pfn_mapping_level() logic, see the 1gb hugepage, and map the whole thing into the guest.
--- arch/x86/kvm/mmu/mmu.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
arch/x86/kvm/mmu/mmu.c +5 -8
@@ -2754,6 +2754,7 @@ int kvm_mmu_max_mapping_level(struct kvm kvm_pfn_t pfn, int max_level) {struct kvm_lpage_info *linfo; +int host_level; max_level =min (max_level, max_huge_page_level);for ( ; max_level >PG_LEVEL_4K ; max_level--) {
@@ -2765,7 +2766,8 @@ int kvm_mmu_max_mapping_level(struct kvmif (max_level ==PG_LEVEL_4K )return PG_LEVEL_4K ; -return host_pfn_mapping_level (kvm, gfn, pfn, slot); + host_level =host_pfn_mapping_level (kvm, gfn, pfn, slot); +return min (host_level, max_level); } int kvm_mmu_hugepage_adjust(struct kvm_vcpu *vcpu, gfn_t gfn,
@@ -2789,17 +2791,12 @@ int kvm_mmu_hugepage_adjust(struct kvm_vif (!slot)return PG_LEVEL_4K ; - level =kvm_mmu_max_mapping_level (vcpu->kvm, slot, gfn, pfn, max_level); -if (level ==PG_LEVEL_4K ) -return level; - - *req_level = level =min (level, max_level); -/* * Enforce the iTLB multihit workaround after capturing the requested * level, which will be used to do precise, accurate accounting. */ -if (huge_page_disallowed) + *req_level = level =kvm_mmu_max_mapping_level (vcpu->kvm, slot, gfn, pfn, max_level); +if (level ==PG_LEVEL_4K || huge_page_disallowed)return PG_LEVEL_4K ;/*
Greg Kroah-Hartman
maintainerPATCH 284/300 KVM: x86/mmu: Avoid collision with !PRESENT SPTEs in TDP MMU lpage stats
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 088acd23526647844aec1c39db4ad02552c86c7b upstream.
Factor in whether or not the old/new SPTEs are shadow-present when adjusting the large page stats in the TDP MMU. A modified MMIO SPTE can toggle the page size bit, as bit 7 is used to store the MMIO generation, i.e. is_large_pte() can get a false positive when called on a MMIO SPTE. Ditto for nuking SPTEs with REMOVED_SPTE, which sets bit 7 in its magic value.
Opportunistically move the logic below the check to verify at least one of the old/new SPTEs is shadow present.
Use is/was_leaf even though is/was_present would suffice. The code generation is roughly equivalent since all flags need to be computed prior to the code in question, and using the *_leaf flags will minimize the diff in a future enhancement to account all pages, i.e. will change the check to "is_leaf != was_leaf".
Message-Id: <[email protected]>
--- arch/x86/kvm/mmu/tdp_mmu.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
arch/x86/kvm/mmu/tdp_mmu.c +13 -7
@@ -410,6 +410,7 @@ static void __handle_changed_spte(structbool was_leaf = was_present &&is_last_spte (old_spte, level);bool is_leaf = is_present &&is_last_spte (new_spte, level);bool pfn_changed =spte_to_pfn (old_spte) !=spte_to_pfn (new_spte); +bool was_large, is_large;WARN_ON (level >PT64_ROOT_MAX_LEVEL );WARN_ON (level <PG_LEVEL_4K );
@@ -443,13 +444,6 @@ static void __handle_changed_spte(structtrace_kvm_tdp_mmu_spte_changed (as_id, gfn, level, old_spte, new_spte); -if (is_large_pte (old_spte) !=is_large_pte (new_spte)) { -if (is_large_pte (old_spte)) -atomic64_sub (1 , (atomic64_t *)&kvm->stat.lpages); -else -atomic64_add (1 , (atomic64_t *)&kvm->stat.lpages); - } -/* * The only times a SPTE should be changed from a non-present to * non-present state is when an MMIO entry is installed/modified/
@@ -475,6 +469,18 @@ static void __handle_changed_spte(structreturn ; } +/* +* Update large page stats if a large page is being zapped, created, or +* is replacing an existing shadow page. +*/ + was_large = was_leaf &&is_large_pte (old_spte); + is_large = is_leaf &&is_large_pte (new_spte); +if (was_large != is_large) { +if (was_large) +atomic64_sub (1 , (atomic64_t *)&kvm->stat.lpages); +else +atomic64_add (1 , (atomic64_t *)&kvm->stat.lpages); + }if (was_leaf &&is_dirty_spte (old_spte) && (!is_present || !is_dirty_spte (new_spte) || pfn_changed))
Greg Kroah-Hartman
maintainerPATCH 285/300 KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation
In reply to Greg Kroah-HartmanFrom: Maxim Levitsky <[email protected]>
commit 81b4b56d4f8130bbb99cf4e2b48082e5b4cfccb9 upstream.
If we are emulating an invalid guest state, we don't have a correct exit reason, and thus we shouldn't do anything in this function.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kvm/vmx/vmx.c +3 -0
@@ -6452,6 +6452,9 @@ static void vmx_handle_exit_irqoff(struc {struct vcpu_vmx *vmx =to_vmx (vcpu); +if (vmx->emulation_required) +return ; +if (vmx->exit_reason.basic ==EXIT_REASON_EXTERNAL_INTERRUPT )handle_external_interrupt_irqoff (vcpu);else if (vmx->exit_reason.basic ==EXIT_REASON_EXCEPTION_NMI )
Greg Kroah-Hartman
maintainerPATCH 286/300 KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit f7782bb8d818d8f47c26b22079db10599922787a upstream.
Clear nested.pi_pending on nested VM-Enter even if L2 will run without posted interrupts enabled. If nested.pi_pending is left set from a previous L2, vmx_complete_nested_posted_interrupt() will pick up the stale flag and exit to userspace with an "internal emulation error" due the new L2 not having a valid nested.pi_desc.
Arguably, vmx_complete_nested_posted_interrupt() should first check for posted interrupts being enabled, but it's also completely reasonable that KVM wouldn't screw up a fundamental flag. Not to mention that the mere existence of nested.pi_pending is a long-standing bug as KVM shouldn't move the posted interrupt out of the IRR until it's actually processed, e.g. KVM effectively drops an interrupt when it performs a nested VM-Exit with a "pending" posted interrupt. Fixing the mess is a future problem.
Prior to vmx_complete_nested_posted_interrupt() interpreting a null PI descriptor as an error, this was a benign bug as the null PI descriptor effectively served as a check on PI not being enabled. Even then, the new flow did not become problematic until KVM started checking the result of kvm_check_nested_events().
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/nested.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
arch/x86/kvm/vmx/nested.c +3 -4
@@ -2226,12 +2226,11 @@ static void prepare_vmcs02_early(struct ~PIN_BASED_VMX_PREEMPTION_TIMER);/* Posted interrupts setting is only taken from vmcs12. */ -if (nested_cpu_has_posted_intr (vmcs12)) { + vmx->nested.pi_pending = false; +if (nested_cpu_has_posted_intr (vmcs12)) vmx->nested.posted_intr_nv = vmcs12->posted_intr_nv; - vmx->nested.pi_pending = false; - }else { +else exec_control &= ~PIN_BASED_POSTED_INTR ; - }pin_controls_set (vmx, exec_control);/*
Greg Kroah-Hartman
maintainerPATCH 287/300 KVM: arm64: Unregister HYP sections from kmemleak in protected mode
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit 47e6223c841e029bfc23c3ce594dac5525cebaf8 upstream.
Booting a KVM host in protected mode with kmemleak quickly results in a pretty bad crash, as kmemleak doesn't know that the HYP sections have been taken away. This is specially true for the BSS section, which is part of the kernel BSS section and registered at boot time by kmemleak itself.
Unregister the HYP part of the BSS before making that section HYP-private. The rest of the HYP-specific data is obtained via the page allocator or lives in other sections, none of which is subjected to kmemleak.
--- arch/arm64/kvm/arm.c | 7 +++++++ 1 file changed, 7 insertions(+)
arch/arm64/kvm/arm.c +7 -0
@@ -15,6 +15,7 @@#include <linux/fs.h> #include <linux/mman.h> #include <linux/sched.h> +#include <linux/kmemleak.h> #include <linux/kvm.h> #include <linux/kvm_irqfd.h> #include <linux/irqbypass.h>
@@ -1957,6 +1958,12 @@ static int finalize_hyp_mode(void)if (ret)return ret; +/* +* Exclude HYP BSS from kmemleak so that it doesn't get peeked +* at, which would end badly once the section is inaccessible. +* None of other sections should ever be introspected. +*/ +kmemleak_free_part (__hyp_bss_start, __hyp_bss_end - __hyp_bss_start); ret =pkvm_mark_hyp_section (__hyp_bss);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 288/300 ARM: dts: at91: add pinctrl-{names, 0} for all gpios
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
commit bf781869e5cf3e4ec1a47dad69b6f0df97629cbd upstream.
Add pinctrl-names and pinctrl-0 properties on controllers that claims to use pins to avoid failures due to
commit 2ab73c6d8323 ("gpio: Support GPIO controllers without pin-ranges") and also to avoid using pins that may be claimed my other IPs.
--- arch/arm/boot/dts/at91-sam9x60ek.dts | 16 ++++++++++++++- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 29 ++++++++++++++++++++++++++++ arch/arm/boot/dts/at91-sama5d4_xplained.dts | 19 ++++++++++++++++++ 3 files changed, 63 insertions(+), 1 deletion(-)
arch/arm/boot/dts/at91-sam9x60ek.dts +15 -1
@@ -92,6 +92,8 @@ leds { compatible = "gpio-leds"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_gpio_leds>; status = "okay"; /* Conflict with pwm0. */ red {
@@ -537,6 +539,10 @@ AT91_PIOA 19 AT91_PERIPH_A (AT91_PINCTRL_PULL_UP | AT91_PINCTRL_DRIVE_STRENGTH_HI) /* PA19 DAT2 periph A with pullup */ AT91_PIOA 20 AT91_PERIPH_A (AT91_PINCTRL_PULL_UP | AT91_PINCTRL_DRIVE_STRENGTH_HI)>; /* PA20 DAT3 periph A with pullup */ }; + pinctrl_sdmmc0_cd: sdmmc0_cd { + atmel,pins = + <AT91_PIOA 23 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>; + }; }; sdmmc1 {
@@ -569,6 +575,14 @@ AT91_PIOD 16 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>; }; }; + + leds { + pinctrl_gpio_leds: gpio_leds { + atmel,pins = <AT91_PIOB 11 AT91_PERIPH_GPIO AT91_PINCTRL_NONE + AT91_PIOB 12 AT91_PERIPH_GPIO AT91_PINCTRL_NONE + AT91_PIOB 13 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>; + }; + }; }; /* pinctrl */ &pwm0 {
@@ -580,7 +594,7 @@ &sdmmc0 { bus-width = <4>; pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_sdmmc0_default>; + pinctrl-0 = <&pinctrl_sdmmc0_default &pinctrl_sdmmc0_cd>; status = "okay"; cd-gpios = <&pioA 23 GPIO_ACTIVE_LOW>; disable-wp;
arch/arm/boot/dts/at91-sama5d3_xplained.dts +29 -0
@@ -57,6 +57,8 @@ }; spi0: spi@f0004000 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_spi0_cs>; cs-gpios = <&pioD 13 0>, <0>, <0>, <&pioD 16 0>; status = "okay"; };
@@ -169,6 +171,8 @@ }; spi1: spi@f8008000 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_spi1_cs>; cs-gpios = <&pioC 25 0>; status = "okay"; };
@@ -248,6 +252,26 @@ <AT91_PIOE 3 AT91_PERIPH_GPIO AT91_PINCTRL_NONE AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>; }; + + pinctrl_gpio_leds: gpio_leds_default { + atmel,pins = + <AT91_PIOE 23 AT91_PERIPH_GPIO AT91_PINCTRL_NONE + AT91_PIOE 24 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>; + }; + + pinctrl_spi0_cs: spi0_cs_default { + atmel,pins = + <AT91_PIOD 13 AT91_PERIPH_GPIO AT91_PINCTRL_NONE + AT91_PIOD 16 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>; + }; + + pinctrl_spi1_cs: spi1_cs_default { + atmel,pins = <AT91_PIOC 25 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>; + }; + + pinctrl_vcc_mmc0_reg_gpio: vcc_mmc0_reg_gpio_default { + atmel,pins = <AT91_PIOE 2 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>; + }; }; }; };
@@ -339,6 +363,8 @@ vcc_mmc0_reg: fixedregulator_mmc0 { compatible = "regulator-fixed"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_vcc_mmc0_reg_gpio>; gpio = <&pioE 2 GPIO_ACTIVE_LOW>; regulator-name = "mmc0-card-supply"; regulator-min-microvolt = <3300000>;
@@ -362,6 +388,9 @@ leds { compatible = "gpio-leds"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_gpio_leds>; + status = "okay"; d2 { label = "d2";
arch/arm/boot/dts/at91-sama5d4_xplained.dts +19 -0
@@ -90,6 +90,8 @@ }; spi1: spi@fc018000 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_spi0_cs>; cs-gpios = <&pioB 21 0>; status = "okay"; };
@@ -147,6 +149,19 @@ atmel,pins = <AT91_PIOE 1 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>; }; + pinctrl_spi0_cs: spi0_cs_default { + atmel,pins = + <AT91_PIOB 21 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>; + }; + pinctrl_gpio_leds: gpio_leds_default { + atmel,pins = + <AT91_PIOD 30 AT91_PERIPH_GPIO AT91_PINCTRL_NONE + AT91_PIOE 15 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>; + }; + pinctrl_vcc_mmc1_reg: vcc_mmc1_reg { + atmel,pins = + <AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>; + }; }; }; };
@@ -252,6 +267,8 @@ leds { compatible = "gpio-leds"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_gpio_leds>; status = "okay"; d8 {
@@ -278,6 +295,8 @@ vcc_mmc1_reg: fixedregulator_mmc1 { compatible = "regulator-fixed"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_vcc_mmc1_reg>; gpio = <&pioE 4 GPIO_ACTIVE_LOW>; regulator-name = "VDD MCI1"; regulator-min-microvolt = <3300000>;
Greg Kroah-Hartman
maintainerPATCH 289/300 io-wq: check max_worker limits if a worker transitions bound state
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit ecc53c48c13d995e6fe5559e30ffee48d92784fd upstream.
For the two places where new workers are created, we diligently check if we are allowed to create a new worker. If we're currently at the limit of how many workers of a given type we can have, then we don't create any new ones.
If you have a mixed workload with various types of bound and unbounded work, then it can happen that a worker finishes one type of work and is then transitioned to the other type. For this case, we don't check if we are actually allowed to do so. This can cause io-wq to temporarily exceed the allowed number of workers for a given type.
When retrieving work, check that the types match. If they don't, check if we are allowed to transition to the other type. If not, then don't handle the new work.
--- fs/io-wq.c | 33 ++++++++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-)
fs/io-wq.c +30 -3
@@ -424,7 +424,28 @@ static void io_wait_on_hash(struct io_wqspin_unlock (&wq->hash->wait.lock); } -static struct io_wq_work *io_get_next_work (struct io_wqe *wqe) +/* +* We can always run the work if the worker is currently the same type as +* the work (eg both are bound, or both are unbound). If they are not the +* same, only allow it if incrementing the worker count would be allowed. +*/ +static bool io_worker_can_run_work (struct io_worker *worker, +struct io_wq_work *work) +{ +struct io_wqe_acct *acct; + +if (!(worker->flags &IO_WORKER_F_BOUND ) != + !(work->flags &IO_WQ_WORK_UNBOUND )) +return true; + +/* not the same type, check if we'd go over the limit */ + acct =io_work_get_acct (worker->wqe, work); +return acct->nr_workers < acct->max_workers; +} + +static struct io_wq_work *io_get_next_work (struct io_wqe *wqe, +struct io_worker *worker, +bool *stalled) __must_hold(wqe->lock) {struct io_wq_work_node *node, *prev;
@@ -436,6 +457,9 @@ static struct io_wq_work *io_get_next_wo work = container_of(node, struct io_wq_work, list); +if (!io_worker_can_run_work (worker, work)) +break ; +/* not hashed, can run anytime */ if (!io_wq_is_hashed (work)) {wq_list_del (&wqe->work_list, node, prev);
@@ -462,6 +486,7 @@ static struct io_wq_work *io_get_next_woraw_spin_unlock (&wqe->lock);io_wait_on_hash (wqe, stall_hash);raw_spin_lock (&wqe->lock); + *stalled = true; }return NULL ;
@@ -501,6 +526,7 @@ static void io_worker_handle_work(struct do { struct io_wq_work *work; + bool stalled; get_next: /* * If we got some work, mark us as busy. If we didn't, but
@@ -509,10 +535,11 @@ get_next:* can't make progress, any work completion or insertion will * clear the stalled flag. */ - work =io_get_next_work (wqe); + stalled = false; + work =io_get_next_work (wqe, worker, &stalled);if (work)__io_worker_busy (wqe, worker, work); -else if (!wq_list_empty (&wqe->work_list)) +else if (stalled) wqe->flags |=IO_WQE_FLAG_STALLED ;raw_spin_unlock_irq (&wqe->lock);
Greg Kroah-Hartman
maintainerPATCH 290/300 md/raid10: Remove unnecessary rcu_dereference in raid10_handle_discard
In reply to Greg Kroah-HartmanFrom: Xiao Ni <[email protected]>
commit 46d4703b1db4c86ab5acb2331b10df999f005e8e upstream.
We are seeing the following warning in raid10_handle_discard.
[ 695.110751] ============================= [ 695.131439] WARNING: suspicious RCU usage [ 695.151389] 4.18.0-319.el8.x86_64+debug #1 Not tainted [ 695.174413] ----------------------------- [ 695.192603] drivers/md/raid10.c:1776 suspicious rcu_dereference_check() usage! [ 695.225107] other info that might help us debug this: [ 695.260940] rcu_scheduler_active = 2, debug_locks = 1 [ 695.290157] no locks held by mkfs.xfs/10186.
In the first loop of function raid10_handle_discard. It already determines which disk need to handle discard request and add the rdev reference count rdev->nr_pending. So the conf->mirrors will not change until all bios come back from underlayer disks. It doesn't need to use rcu_dereference to get rdev.
--- drivers/md/raid10.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/md/raid10.c +10 -4
@@ -1706,6 +1706,11 @@ retry_discard: }else r10_bio->master_bio = (struct bio *)first_r10bio; +/* +* first select target devices under rcu_lock and +* inc refcount on their rdev. Record them by setting +* bios[x] to bio +*/ rcu_read_lock ();for (disk =0 ; disk < geo->raid_disks; disk++) {struct md_rdev *rdev =rcu_dereference (conf->mirrors[disk].rdev);
@@ -1737,9 +1742,6 @@ retry_discard:for (disk =0 ; disk < geo->raid_disks; disk++) {sector_t dev_start, dev_end;struct bio *mbio, *rbio =NULL ; -struct md_rdev *rdev =rcu_dereference (conf->mirrors[disk].rdev); -struct md_rdev *rrdev =rcu_dereference ( - conf->mirrors[disk].replacement);/* * Now start to calculate the start and end address for each disk.
@@ -1769,9 +1771,12 @@ retry_discard:/* * It only handles discard bio which size is >= stripe size, so -* dev_end > dev_start all the time +* dev_end > dev_start all the time. +* It doesn't need to use rcu lock to get rdev here. We already +* add rdev->nr_pending in the first loop. */ if (r10_bio->devs[disk].bio) { +struct md_rdev *rdev = conf->mirrors[disk].rdev; mbio =bio_clone_fast (bio,GFP_NOIO , &mddev->bio_set); mbio->bi_end_io = raid10_end_discard_request; mbio->bi_private = r10_bio;
@@ -1784,6 +1789,7 @@ retry_discard:bio_endio (mbio); }if (r10_bio->devs[disk].repl_bio) { +struct md_rdev *rrdev = conf->mirrors[disk].replacement; rbio =bio_clone_fast (bio,GFP_NOIO , &mddev->bio_set); rbio->bi_end_io = raid10_end_discard_request; rbio->bi_private = r10_bio;
Greg Kroah-Hartman
maintainerPATCH 291/300 char: tpm: Kconfig: remove bad i2c cr50 select
In reply to Greg Kroah-HartmanFrom: Adrian Ratiu <[email protected]>
commit 847fdae1579f4ee930b01f24a7847b8043bf468c upstream.
This fixes a minor bug which went unnoticed during the initial driver upstreaming review: TCG_CR50 does not exist in mainline kernels, so remove it.
--- drivers/char/tpm/Kconfig | 1 - 1 file changed, 1 deletion(-)
drivers/char/tpm/Kconfig +0 -1
@@ -89,7 +89,6 @@ config TCG_TIS_SYNQUACER config TCG_TIS_I2C_CR50 tristate "TPM Interface Specification 2.0 Interface (I2C - CR50)" depends on I2C - select TCG_CR50 help This is a driver for the Google cr50 I2C TPM interface which is a custom microcontroller and requires a custom i2c protocol interface
Greg Kroah-Hartman
maintainerPATCH 292/300 fuse: truncate pagecache on atomic_o_trunc
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit 76224355db7570cbe6b6f75c8929a1558828dd55 upstream.
fuse_finish_open() will be called with FUSE_NOWRITE in case of atomic O_TRUNC. This can deadlock with fuse_wait_on_page_writeback() in fuse_launder_page() triggered by invalidate_inode_pages2().
Fix by replacing invalidate_inode_pages2() in fuse_finish_open() with a truncate_pagecache() call. This makes sense regardless of FOPEN_KEEP_CACHE or fc->writeback cache, so do it unconditionally.
--- fs/fuse/file.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/fuse/file.c +5 -2
@@ -198,12 +198,11 @@ void fuse_finish_open(struct inode *inodstruct fuse_file *ff = file->private_data;struct fuse_conn *fc =get_fuse_conn (inode); -if (!(ff->open_flags &FOPEN_KEEP_CACHE )) -invalidate_inode_pages2 (inode->i_mapping);if (ff->open_flags &FOPEN_STREAM )stream_open (inode, file);else if (ff->open_flags &FOPEN_NONSEEKABLE )nonseekable_open (inode, file); +if (fc->atomic_o_trunc && (file->f_flags &O_TRUNC )) {struct fuse_inode *fi =get_fuse_inode (inode);
@@ -211,10 +210,14 @@ void fuse_finish_open(struct inode *inod fi->attr_version =atomic64_inc_return (&fc->attr_version);i_size_write (inode,0 );spin_unlock (&fi->lock); +truncate_pagecache (inode,0 );fuse_invalidate_attr (inode);if (fc->writeback_cache)file_update_time (file); + }else if (!(ff->open_flags &FOPEN_KEEP_CACHE )) { +invalidate_inode_pages2 (inode->i_mapping); } +if ((file->f_mode &FMODE_WRITE ) && fc->writeback_cache)fuse_link_write_file (file); }
Greg Kroah-Hartman
maintainerPATCH 293/300 fuse: flush extending writes
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit 59bda8ecee2ffc6a602b7bf2b9e43ca669cdbdcd upstream.
Callers of fuse_writeback_range() assume that the file is ready for modification by the server in the supplied byte range after the call returns.
If there's a write that extends the file beyond the end of the supplied range, then the file needs to be extended to at least the end of the range, but currently that's not done.
There are at least two cases where this can cause problems:
- copy_file_range() will return short count if the file is not extended up to end of the source range.
- FALLOC_FL_ZERO_RANGE | FALLOC_FL_KEEP_SIZE will not extend the file, hence the region may not be fully allocated.
Fix by flushing writes from the start of the range up to the end of the file. This could be optimized if the writes are non-extending, etc, but it's probably not worth the trouble.
--- fs/fuse/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/fuse/file.c +1 -1
@@ -2886,7 +2886,7 @@ fuse_direct_IO(struct kiocb *iocb, strucstatic int fuse_writeback_range (struct inode *inode,loff_t start,loff_t end) { -int err =filemap_write_and_wait_range (inode->i_mapping, start, end); +int err =filemap_write_and_wait_range (inode->i_mapping, start,-1 );if (!err)fuse_sync_writes (inode);
Greg Kroah-Hartman
maintainerPATCH 294/300 fuse: wait for writepages in syncfs
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit 660585b56e63ca034ad506ea53c807c5cdca3196 upstream.
In case of fuse the MM subsystem doesn't guarantee that page writeback completes by the time ->sync_fs() is called. This is because fuse completes page writeback immediately to prevent DoS of memory reclaim by the userspace file server.
This means that fuse itself must ensure that writes are synced before sending the SYNCFS request to the server.
Introduce sync buckets, that hold a counter for the number of outstanding write requests. On syncfs replace the current bucket with a new one and wait until the old bucket's counter goes down to zero.
It is possible to have multiple syncfs calls in parallel, in which case there could be more than one waited-on buckets. Descendant buckets must not complete until the parent completes. Add a count to the child (new) bucket until the (parent) old bucket completes.
Use RCU protection to dereference the current bucket and to wake up an emptied bucket. Use fc->lock to protect against parallel assignments to the current bucket.
This leaves just the counter to be a possible scalability issue. The fc->num_waiting counter has a similar issue, so both should be addressed at the same time.
--- fs/fuse/file.c | 21 +++++++++++++++++++ fs/fuse/fuse_i.h | 19 +++++++++++++++++ fs/fuse/inode.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 100 insertions(+)
fs/fuse/file.c +21 -0
@@ -392,6 +392,7 @@ struct fuse_writepage_args {struct list_head queue_entry;struct fuse_writepage_args *next;struct inode *inode; +struct fuse_sync_bucket *bucket; }; static struct fuse_writepage_args *fuse_find_writeback(struct fuse_inode *fi,
@@ -1613,6 +1614,9 @@ static void fuse_writepage_free(struct fstruct fuse_args_pages *ap = &wpa->ia.ap;int i; +if (wpa->bucket) +fuse_sync_bucket_dec (wpa->bucket); +for (i =0 ; i < ap->num_pages; i++)__free_page (ap->pages[i]);
@@ -1876,6 +1880,20 @@ static struct fuse_writepage_args *fuse_ } +static void fuse_writepage_add_to_bucket (struct fuse_conn *fc, +struct fuse_writepage_args *wpa) +{ +if (!fc->sync_fs) +return ; + +rcu_read_lock (); +/* Prevent resurrection of dead bucket in unlikely race with syncfs */ +do { + wpa->bucket =rcu_dereference (fc->curr_bucket); + }while (unlikely (!atomic_inc_not_zero (&wpa->bucket->count))); +rcu_read_unlock (); +} +static int fuse_writepage_locked (struct page *page) {struct address_space *mapping = page->mapping;
@@ -1903,6 +1921,7 @@ static int fuse_writepage_locked(structif (!wpa->ia.ff) goto err_nofile; +fuse_writepage_add_to_bucket (fc, wpa);fuse_write_args_fill (&wpa->ia, wpa->ia.ff,page_offset (page),0 );copy_highpage (tmp_page, page);
@@ -2153,6 +2172,8 @@ static int fuse_writepages_fill(struct p__free_page (tmp_page); goto out_unlock; } +fuse_writepage_add_to_bucket (fc, wpa); + data->max_pages =1 ; ap = &wpa->ia.ap;
fs/fuse/fuse_i.h +19 -0
@@ -515,6 +515,13 @@ struct fuse_fs_context {void **fudptr; }; +struct fuse_sync_bucket { +/* count is a possible scalability bottleneck */ +atomic_t count; +wait_queue_head_t waitq; +struct rcu_head rcu; +}; +/** * A Fuse connection. *
@@ -807,6 +814,9 @@ struct fuse_conn {/** List of filesystems using this connection */ struct list_head mounts; + +/* New writepages go into this bucket */ +struct fuse_sync_bucket __rcu *curr_bucket; };/*
@@ -910,6 +920,15 @@ static inline void fuse_page_descs_lengt descs[i].length =PAGE_SIZE - descs[i].offset; } +static inline void fuse_sync_bucket_dec (struct fuse_sync_bucket *bucket) +{ +/* Need RCU protection to prevent use after free after the decrement */ +rcu_read_lock (); +if (atomic_dec_and_test (&bucket->count)) +wake_up (&bucket->waitq); +rcu_read_unlock (); +} +/** Device operations */ extern const struct file_operations fuse_dev_operations;
fs/fuse/inode.c +60 -0
90 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 295/300 IMA: remove -Wmissing-prototypes warning
In reply to Greg Kroah-HartmanFrom: Austin Kim <[email protected]>
commit a32ad90426a9c8eb3915eed26e08ce133bd9e0da upstream.
With W=1 build, the compiler throws warning message as below:
security/integrity/ima/ima_mok.c:24:12: warning:
no previous prototype for ‘ima_mok_init’ [-Wmissing-prototypes]
__init int ima_mok_init(void)
Silence the warning by adding static keyword to ima_mok_init().
--- security/integrity/ima/ima_mok.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/integrity/ima/ima_mok.c +1 -1
@@ -21,7 +21,7 @@ struct key *ima_blacklist_keyring;/* * Allocate the IMA blacklist keyring */ -__init int ima_mok_init (void ) +static __init int ima_mok_init (void ) {struct key_restriction *restriction;
Greg Kroah-Hartman
maintainerPATCH 296/300 IMA: remove the dependency on CRYPTO_MD5
In reply to Greg Kroah-HartmanFrom: THOBY Simon <[email protected]>
commit 8510505d55e194d3f6c9644c9f9d12c4f6b0395a upstream.
MD5 is a weak digest algorithm that shouldn't be used for cryptographic operation. It hinders the efficiency of a patch set that aims to limit the digests allowed for the extended file attribute namely security.ima. MD5 is no longer a requirement for IMA, nor should it be used there.
The sole place where we still use the MD5 algorithm inside IMA is setting the ima_hash algorithm to MD5, if the user supplies 'ima_hash=md5' parameter on the command line. With commit ab60368ab6a4 ("ima: Fallback to the builtin hash algorithm"), setting "ima_hash=md5" fails gracefully when CRYPTO_MD5 is not set:
ima: Can not allocate md5 (reason: -2)
ima: Allocating md5 failed, going to use default hash algorithm sha256
Remove the CRYPTO_MD5 dependency for IMA.
[[email protected]: include commit number in patch description for stable.]
--- security/integrity/ima/Kconfig | 1 - 1 file changed, 1 deletion(-)
security/integrity/ima/Kconfig +0 -1
@@ -6,7 +6,6 @@ config IMA select SECURITYFS select CRYPTO select CRYPTO_HMAC - select CRYPTO_MD5 select CRYPTO_SHA1 select CRYPTO_HASH_INFO select TCG_TPM if HAS_IOMEM && !UML
Greg Kroah-Hartman
maintainerPATCH 297/300 fbmem: dont allow too huge resolutions
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit 8c28051cdcbe9dfcec6bd0a4709d67a09df6edae upstream.
syzbot is reporting page fault at vga16fb_fillrect() [1], for vga16fb_check_var() is failing to detect multiplication overflow.
if (vxres * vyres > maxmem) {
vyres = maxmem / vxres;
if (vyres < yres)
return -ENOMEM;
}Since no module would accept too huge resolutions where multiplication overflow happens, let's reject in the common path.
--- drivers/video/fbdev/core/fbmem.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/video/fbdev/core/fbmem.c +6 -0
@@ -962,6 +962,7 @@ fb_set_var(struct fb_info *info, structstruct fb_var_screeninfo old_var;struct fb_videomode mode;struct fb_event event; +u32 unused;if (var->activate &FB_ACTIVATE_INV_MODE ) {struct fb_videomode mode1, mode2;
@@ -1008,6 +1009,11 @@ fb_set_var(struct fb_info *info, structif (var->xres <8 || var->yres <8 )return -EINVAL ; +/* Too huge resolution causes multiplication overflow. */ +if (check_mul_overflow (var->xres, var->yres, &unused) || +check_mul_overflow (var->xres_virtual, var->yres_virtual, &unused)) +return -EINVAL ; + ret = info->fbops->fb_check_var (var, info);if (ret)
Greg Kroah-Hartman
maintainerPATCH 298/300 RDMA/mlx5: Fix number of allocated XLT entries
In reply to Greg Kroah-HartmanFrom: Niklas Schnelle <[email protected]>
commit 9660dcbe0d9186976917c94bce4e69dbd8d7a974 upstream.
In commit 8010d74b9965b ("RDMA/mlx5: Split the WR setup out of mlx5_ib_update_xlt()") the allocation logic was split out of mlx5_ib_update_xlt() and the logic was changed to enable better OOM handling. Sadly this change introduced a miscalculation of the number of entries that were actually allocated when under memory pressure where it can actually become 0 which on s390 lets dma_map_single() fail.
It can also lead to corruption of the free pages list when the wrong number of entries is used in the calculation of sg->length which is used as argument for free_pages().
Fix this by using the allocation size instead of misusing get_order(size).
--- drivers/infiniband/hw/mlx5/mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/mr.c +1 -1
@@ -1022,7 +1022,7 @@ static void *mlx5_ib_alloc_xlt(size_t *nif (size >MLX5_SPARE_UMR_CHUNK ) { size =MLX5_SPARE_UMR_CHUNK ; - *nents =get_order (size) / ent_size; + *nents = size / ent_size; res = (void *)__get_free_pages (gfp_mask | __GFP_NOWARN,get_order (size));if (res)
Greg Kroah-Hartman
maintainerPATCH 299/300 backlight: pwm_bl: Improve bootloader/kernel device handover
In reply to Greg Kroah-HartmanFrom: Daniel Thompson <[email protected]>
commit 79fad92f2e596f5a8dd085788a24f540263ef887 upstream.
Currently there are (at least) two problems in the way pwm_bl starts managing the enable_gpio pin. Both occur when the backlight is initially off and the driver finds the pin not already in output mode and, as a result, unconditionally switches it to output-mode and asserts the signal.
Problem 1: This could cause the backlight to flicker since, at this stage in driver initialisation, we have no idea what the PWM and regulator are doing (an unconfigured PWM could easily "rest" at 100% duty cycle).
Problem 2: This will cause us not to correctly honour the post_pwm_on_delay (which also risks flickers).
Fix this by moving the code to configure the GPIO output mode until after we have examines the handover state. That allows us to initialize enable_gpio to off if the backlight is currently off and on if the backlight is on.
--- drivers/video/backlight/pwm_bl.c | 54 ++++++++++++++++++++------------------- 1 file changed, 28 insertions(+), 26 deletions(-)
drivers/video/backlight/pwm_bl.c +28 -26
@@ -409,6 +409,33 @@ static bool pwm_backlight_is_linear(strustatic int pwm_backlight_initial_power_state (const struct pwm_bl_data *pb) {struct device_node *node = pb->dev->of_node; +bool active = true; + +/* +* If the enable GPIO is present, observable (either as input +* or output) and off then the backlight is not currently active. +* */ +if (pb->enable_gpio &&gpiod_get_value_cansleep (pb->enable_gpio) ==0 ) + active = false; + +if (!regulator_is_enabled (pb->power_supply)) + active = false; + +if (!pwm_is_enabled (pb->pwm)) + active = false; + +/* +* Synchronize the enable_gpio with the observed state of the +* hardware. +*/ +if (pb->enable_gpio) +gpiod_direction_output (pb->enable_gpio, active); + +/* +* Do not change pb->enabled here! pb->enabled essentially +* tells us if we own one of the regulator's use counts and +* right now we do not. +*/ /* Not booted with device tree or no phandle link to the node */ if (!node || !node->phandle)
@@ -420,20 +447,7 @@ static int pwm_backlight_initial_power_s* assume that another driver will enable the backlight at the * appropriate time. Therefore, if it is disabled, keep it so. */ - -/* if the enable GPIO is disabled, do not enable the backlight */ -if (pb->enable_gpio &&gpiod_get_value_cansleep (pb->enable_gpio) ==0 ) -return FB_BLANK_POWERDOWN ; - -/* The regulator is disabled, do not enable the backlight */ -if (!regulator_is_enabled (pb->power_supply)) -return FB_BLANK_POWERDOWN ; - -/* The PWM is disabled, keep it like this */ -if (!pwm_is_enabled (pb->pwm)) -return FB_BLANK_POWERDOWN ; - -return FB_BLANK_UNBLANK ; +return active ?FB_BLANK_UNBLANK :FB_BLANK_POWERDOWN ; }static int pwm_backlight_probe (struct platform_device *pdev)
@@ -486,18 +500,6 @@ static int pwm_backlight_probe(struct pl goto err_alloc; } -/* -* If the GPIO is not known to be already configured as output, that -* is, if gpiod_get_direction returns either 1 or -EINVAL, change the -* direction to output and set the GPIO as active. -* Do not force the GPIO to active when it was already output as it -* could cause backlight flickering or we would enable the backlight too -* early. Leave the decision of the initial backlight state for later. -*/ -if (pb->enable_gpio && -gpiod_get_direction (pb->enable_gpio) !=0 ) -gpiod_direction_output (pb->enable_gpio,1 ); - pb->power_supply =devm_regulator_get (&pdev->dev,"power" );if (IS_ERR (pb->power_supply)) { ret =PTR_ERR (pb->power_supply);
Greg Kroah-Hartman
maintainerPATCH 300/300 clk: kirkwood: Fix a clocking boot regression
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
commit aaedb9e00e5400220a8871180d23a83e67f29f63 upstream.
Since a few kernel releases the Pogoplug 4 has crashed like this during boot:
Unable to handle kernel NULL pointer dereference at virtual address 00000002
(...)
[<c04116ec>] (strlen) from [<c00ead80>] (kstrdup+0x1c/0x4c)
[<c00ead80>] (kstrdup) from [<c04591d8>] (__clk_register+0x44/0x37c)
[<c04591d8>] (__clk_register) from [<c04595ec>] (clk_hw_register+0x20/0x44)
[<c04595ec>] (clk_hw_register) from [<c045bfa8>] (__clk_hw_register_mux+0x198/0x1e4) [<c045bfa8>] (__clk_hw_register_mux) from [<c045c050>] (clk_register_mux_table+0x5c/0x6c) [<c045c050>] (clk_register_mux_table) from [<c0acf3e0>] (kirkwood_clk_muxing_setup.constprop.0+0x13c/0x1ac) [<c0acf3e0>] (kirkwood_clk_muxing_setup.constprop.0) from [<c0aceae0>] (of_clk_init+0x12c/0x214) [<c0aceae0>] (of_clk_init) from [<c0ab576c>] (time_init+0x20/0x2c)
[<c0ab576c>] (time_init) from [<c0ab3d18>] (start_kernel+0x3dc/0x56c)
[<c0ab3d18>] (start_kernel) from [<00000000>] (0x0)
Code: e3130020 1afffffb e12fff1e c08a1078 (e5d03000)
This is because the "powersave" mux clock 0 was provided in an unterminated array, which is required by the loop in the driver:
/* Count, allocate, and register clock muxes */
for (n = 0; desc[n].name;)
n++;Here n will go out of bounds and then call clk_register_mux() on random memory contents after the mux clock.
Fix this by terminating the array with a blank entry.
--- drivers/clk/mvebu/kirkwood.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/mvebu/kirkwood.c +1 -0
@@ -265,6 +265,7 @@ static const char *powersave_parents[] =static const struct clk_muxing_soc_desc kirkwood_mux_desc[]__initconst = { {"powersave" , powersave_parents,ARRAY_SIZE (powersave_parents),11 ,1 ,0 }, + { } }; static struct clk *clk_muxing_get_src(
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.13.17 release. There are 300 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.13.17-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.13.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB, using 32-bit and 64-bit ARM kernels:
Signature · 1 line
Florian
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.13.17 release. There are 300 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.13.17-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.13.y
and the diffstat can be found below.thanks,
greg k-h
arm clang-10, clang-11, clang-12 and clang-13 builds failed. on 5.14 and 5.13 on following configs,
- footbridge_defconfig
- mini2440_defconfig
- s3c2410_defconfig
This was already reported on the mailing list.
ERROR: modpost: "__mulodi4" [drivers/block/nbd.ko] undefined! #1438
https://github.com/ClangBuiltLinux/linux/issues/1438
[PATCH 00/10] raise minimum GCC version to 5.1
https://lore.kernel.org/lkml/[email protected]/
linux-next: build failure while building Linus' tree
https://lore.kernel.org/all/[email protected]/
Full build log,
https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc/-/jobs/1585407346#L1111
--
Linaro LKFT
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.13.17 release. There are 300 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.13.17-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.13.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.13.17 release. There are 300 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.13.17-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.13.y
and the diffstat can be found below.thanks,
greg k-h
5.13.17-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.13.17 release. There are 300 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.13.17-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.13.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.13:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
110 tests: 110 pass, 0 failLinux version: 5.13.17-rc1-gdaeb634aa75f
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.13.17 release. There are 300 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.13.17-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.13.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
Regressions on arm.
ERROR: modpost: __mulodi4 [drivers/block/nbd.ko] undefined!
arm clang-10, clang-11, clang-12 and clang-13 builds failed on stable rc 5.14 and 5.13 with following arm configs,
- footbridge_defconfig
- mini2440_defconfig
- s3c2410_defconfig
## Build
* kernel: 5.13.17-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-5.13.y
* git commit: daeb634aa75fbff920be96c86c18510120951cd0
* git describe: v5.13.16-301-gdaeb634aa75f
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.13.y/build/v5.13.16-301-gdaeb634aa75f
## Regressions (compared to v5.13.16-264-ga06d976ecf87)
arm clang-10, clang-11, clang-12 and clang-13 builds failed on stable rc 5.14 and 5.13 with following arm configs,
- footbridge_defconfig
- mini2440_defconfig
- s3c2410_defconfig
## No fixes (compared to v5.13.16-264-ga06d976ecf87)
## Test result summary
total: 89815, pass: 75073, fail: 999, skip: 12693, xfail: 1050
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 289 total, 277 passed, 12 failed
* arm64: 39 total, 39 passed, 0 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 38 total, 38 passed, 0 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 51 total, 51 passed, 0 failed
* parisc: 12 total, 12 passed, 0 failed
* powerpc: 36 total, 35 passed, 1 failed
* riscv: 30 total, 30 passed, 0 failed
* s390: 18 total, 18 passed, 0 failed
* sh: 24 total, 24 passed, 0 failed
* sparc: 12 total, 12 passed, 0 failed
* x15: 1 total, 0 passed, 1 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 39 total, 39 passed, 0 failed
## Test suites summary
* fwts
* igt-gpu-tools
* install-android-platform-tools-r2600
* kselftest-android
* kselftest-arm64
* kselftest-arm64/arm64.btitest.bti_c_func
* kselftest-arm64/arm64.btitest.bti_j_func
* kselftest-arm64/arm64.btitest.bti_jc_func
* kselftest-arm64/arm64.btitest.bti_none_func
* kselftest-arm64/arm64.btitest.nohint_func
* kselftest-arm64/arm64.btitest.paciasp_func
* kselftest-arm64/arm64.nobtitest.bti_c_func
* kselftest-arm64/arm64.nobtitest.bti_j_func
* kselftest-arm64/arm64.nobtitest.bti_jc_func
* kselftest-arm64/arm64.nobtitest.bti_none_func
* kselftest-arm64/arm64.nobtitest.nohint_func
* kselftest-arm64/arm64.nobtitest.paciasp_func
* kselftest-bpf
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-l[
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* rcutorture
* ssuite
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.13.17 release. There are 300 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000. Anything received after that time might be too late.
Build results:
total: 154 pass: 154 fail: 0 Qemu test results: total: 480 pass: 480 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.13.17 release. There are 300 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.13.17-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.13.y
and the diffstat can be found below.thanks,
greg k-h
Tested rc1 against the Fedora build system (aarch64, armv7, ppc64le, s390x, x86_64), and boot tested x86_64. No regressions noted.