5.10.67-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 5.10.67-rc1 review
This is the start of the stable review cycle for the 5.10.67 release. There are 306 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 18 Sep 2021 15:57:06 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.67-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.67-rc1
Amir Goldstein <[email protected]>
fanotify: limit number of event merge attempts
Alyssa Rosenzweig <[email protected]>
drm/panfrost: Clamp lock region to Bifrost minimum
Alyssa Rosenzweig <[email protected]>
drm/panfrost: Use u64 for size in lock_region
Alyssa Rosenzweig <[email protected]>
drm/panfrost: Simplify lock_region calculation
Jerry (Fangzhi) Zuo <[email protected]>
drm/amd/display: Update bounding box states (v2)
Aurabindo Pillai <[email protected]>
drm/amd/display: Update number of DCN3 clock states
Andrey Grodzovsky <[email protected]>
drm/amdgpu: Fix BUG_ON assert
Boris Brezillon <[email protected]>
drm/panfrost: Make sure MMU context lifetime is not bound to panfrost_priv
Rajkumar Subbiah <[email protected]>
drm/dp_mst: Fix return code on sideband message failure
David Heidelberg <[email protected]>
drm/msi/mdp4: populate priv->kms in mdp4_kms_init
Thomas Zimmermann <[email protected]>
drm/mgag200: Select clock in PLL update functions
Jan Hoffmann <[email protected]>
net: dsa: lantiq_gswip: fix maximum frame length
Kees Cook <[email protected]>
lib/test_stackinit: Fix static initializer test
Patryk Duda <[email protected]>
platform/chrome: cros_ec_proto: Send command again when timeout occurs
sumiyawang <[email protected]>
libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind
Vasily Averin <[email protected]>
memcg: enable accounting for pids in nested pid namespaces
Rik van Riel <[email protected]>
mm,vmscan: fix divide by zero in get_scan_count
Liu Zixian <[email protected]>
mm/hugetlb: initialize hugetlb_usage in mm_init
Li Zhijian <[email protected]>
mm/hmm: bypass devmap pte when all pfn requested flags are fulfilled
Mike Kravetz <[email protected]>
hugetlb: fix hugetlb cgroup refcounting during vma split
Halil Pasic <[email protected]>
s390/pv: fix the forcing of the swiotlb
Pratik R. Sampat <[email protected]>
cpufreq: powernv: Fix init_chip_info initialization in numa=off
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Sync queue idx with queue_pair_map idx
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Changes to support kdump kernel
Maciej W. Rozycki <[email protected]>
scsi: BusLogic: Fix missing pr_cont() use
chenying <[email protected]>
ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup()
Mikulas Patocka <[email protected]>
parisc: fix crash with signals and alloca
Pavel Begunkov <[email protected]>
io_uring: remove duplicated io_size from rw
David Laight <[email protected]>
fs/io_uring Don't use the return value from import_iovec().
Guojia Liao <[email protected]>
net: hns3: clean up a type mismatch warning
Yang Yingliang <[email protected]>
net: w5100: check return value after calling platform_get_resource()
Haimin Zhang <[email protected]>
fix array-index-out-of-bounds in taprio_change
王贇 <[email protected]>
net: fix NULL pointer reference in cipso_v4_doi_free
Miaoqing Pan <[email protected]>
ath9k: fix sleeping in atomic context
Zekun Shen <[email protected]>
ath9k: fix OOB read ar9300_eeprom_restore_internal
Loic Poulain <[email protected]>
wcn36xx: Fix missing frame timestamp for beacon/probe-resp
Chengfeng Ye <[email protected]>
selftests/bpf: Fix potential unreleased lock
Colin Ian King <[email protected]>
parport: remove non-zero check on count
Yevgeny Kliteynik <[email protected]>
net/mlx5: DR, Enable QP retransmission
Wentao_Liang <[email protected]>
net/mlx5: DR, fix a potential use-after-free bug
Ilan Peer <[email protected]>
iwlwifi: mvm: Fix scan channel flags settings
Johannes Berg <[email protected]>
iwlwifi: fw: correctly limit to monitor dump
Johannes Berg <[email protected]>
iwlwifi: mvm: fix access to BSS elements
Johannes Berg <[email protected]>
iwlwifi: mvm: avoid static queue number aliasing
Zhang Qilong <[email protected]>
iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed
Johannes Berg <[email protected]>
iwlwifi: pcie: free RBs during configure
J. Bruce Fields <[email protected]>
nfsd: fix crash on LOCKT on reexported NFSv3
Sean Keely <[email protected]>
drm/amdkfd: Account for SH/SE count when setting up cu masks.
Xiaotan Luo <[email protected]>
ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B
Sugar Zhang <[email protected]>
ASoC: rockchip: i2s: Fix regmap_ops hang
Shuah Khan <[email protected]>
usbip:vhci_hcd USB port can get stuck in the disabled state
Anirudh Rayabharam <[email protected]>
usbip: give back URBs for unsent unlink requests during cleanup
Nadezda Lutovinova <[email protected]>
usb: musb: musb_dsps: request_irq() after initializing musb
Mathias Nyman <[email protected]>
Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set"
Ding Hui <[email protected]>
cifs: fix wrong release in sess_alloc_buffer() failed path
Nishad Kamdar <[email protected]>
mmc: core: Return correct emmc response in case of ioctl error
Li Zhijian <[email protected]>
selftests/bpf: Enlarge select() timeout for test_maps
Thomas Hebb <[email protected]>
mmc: rtsx_pci: Fix long reads when clock is prescaled
Manish Narani <[email protected]>
mmc: sdhci-of-arasan: Check return value of non-void funtions
Manish Narani <[email protected]>
mmc: sdhci-of-arasan: Modified SD default speed to 19MHz for ZynqMP
Marc Zyngier <[email protected]>
of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS
Gustaw Lewandowski <[email protected]>
ASoC: Intel: Skylake: Fix passing loadable flag for module
Cezary Rojewski <[email protected]>
ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER
Pierre-Louis Bossart <[email protected]>
soundwire: intel: fix potential race condition during power down
Marcos Paulo de Souza <[email protected]>
btrfs: tree-log: check btrfs_lookup_data_extent return value
Arnd Bergmann <[email protected]>
m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch
Subbaraya Sundeep <[email protected]>
octeontx2-pf: Fix NIX1_RX interface backpressure
Chin-Yen Lee <[email protected]>
rtw88: wow: fix size access error of probe request
Ping-Ke Shih <[email protected]>
rtw88: wow: build wow function only if CONFIG_PM is on
Chin-Yen Lee <[email protected]>
rtw88: use read_poll_timeout instead of fixed sleep
Chris Chiu <[email protected]>
rtl8xxxu: Fix the handling of TX A-MPDU aggregation
Nathan Chancellor <[email protected]>
drm/exynos: Always initialize mapping in exynos_drm_register_dma()
J. Bruce Fields <[email protected]>
lockd: lockd server-side shouldn't set fl_ops
Li Jun <[email protected]>
usb: chipidea: host: fix port index underflow and UBSAN complains
Bob Peterson <[email protected]>
gfs2: Don't call dlm after protocol is unmounted
Mark Brown <[email protected]>
kselftest/arm64: pac: Fix skipping of tests on systems without PAC
Mark Brown <[email protected]>
kselftest/arm64: mte: Fix misleading output when skipping tests
Eli Cohen <[email protected]>
net: Fix offloading indirect devices dependency on qdisc order creation
Kees Cook <[email protected]>
staging: rts5208: Fix get_ms_information() heap buffer size
Brandon Wyman <[email protected]>
hwmon: (pmbus/ibm-cffps) Fix write bits for LED control
Yonghong Song <[email protected]>
selftests/bpf: Fix flaky send_signal test
J. Bruce Fields <[email protected]>
rpc: fix gss_svc_init cleanup on failure
Luke Hsiao <[email protected]>
tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD
Darrick J. Wong <[email protected]>
iomap: pass writeback errors to the mapping
Ulrich Hecht <[email protected]>
serial: sh-sci: fix break handling for sysrq
Rajendra Nayak <[email protected]>
opp: Don't print an error if required-opps is missing
Luiz Augusto von Dentz <[email protected]>
Bluetooth: Fix handling of LE Enhanced Connection Complete
Sagi Grimberg <[email protected]>
nvme: code command_id with a genctr for use-after-free validation
Sagi Grimberg <[email protected]>
nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data
Raag Jadav <[email protected]>
arm64: dts: ls1046a: fix eeprom entries
Thierry Reding <[email protected]>
arm64: tegra: Fix compatible string for Tegra132 CPUs
Andreas Obergschwandtner <[email protected]>
ARM: tegra: tamonten: Fix UART pad setting
Dmitry Osipenko <[email protected]>
ARM: tegra: acer-a500: Remove bogus USB VBUS regulators
Johan Almbladh <[email protected]>
mac80211: Fix monitor MTU limit so that A-MSDUs get through
Tuo Li <[email protected]>
drm/display: fix possible null-pointer dereference in dcn10_set_clock()
Tuo Li <[email protected]>
gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()
Eran Ben Elisha <[email protected]>
net/mlx5: Fix variable type to match 64bit
Kuogee Hsieh <[email protected]>
drm/msm/dp: return correct edid checksum after corrupted edid checksum read
Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: avoid circular locks in sco_sock_connect
Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: schedule SCO timeouts with delayed_work
Desmond Cheong Zhi Xi <[email protected]>
drm/vmwgfx: fix potential UAF in vmwgfx_surface.c
Jussi Maki <[email protected]>
selftests/bpf: Fix xdp_tx.c prog section name
Roy Chan <[email protected]>
drm/amd/display: fix incorrect CM/TF programming sequence in dwb
Roy Chan <[email protected]>
drm/amd/display: fix missing writeback disablement if plane is removed
Sanjay R Mehta <[email protected]>
thunderbolt: Fix port linking by checking all adapters
Quanyang Wang <[email protected]>
drm: xlnx: zynqmp: release reset to DP controller before accessing DP registers
Quanyang Wang <[email protected]>
drm: xlnx: zynqmp_dpsub: Call pm_runtime_get_sync before setting pixel clock
Konrad Dybcio <[email protected]>
drm/msm/dsi: Fix DSI and DSI PHY regulator config from SDM660
David Heidelberg <[email protected]>
drm/msm: mdp4: drop vblank get/put from prepare/complete_commit
Nathan Chancellor <[email protected]>
net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe()
Rajendra Nayak <[email protected]>
nvmem: qfprom: Fix up qfprom_disable_fuse_blowing() ordering
Georgi Djakov <[email protected]>
arm64: dts: qcom: sm8250: Fix epss_l3 unit address
Vinod Koul <[email protected]>
arm64: dts: qcom: msm8996: don't use underscore in node name
Vinod Koul <[email protected]>
arm64: dts: qcom: msm8994: don't use underscore in node name
Vinod Koul <[email protected]>
arm64: dts: qcom: sdm630: don't use underscore in node name
Vinod Koul <[email protected]>
arm64: dts: qcom: ipq6018: drop '0x' from unit address
Vinod Koul <[email protected]>
arm64: dts: qcom: sdm660: use reg value for memory node
Vinod Koul <[email protected]>
arm64: dts: qcom: ipq8074: fix pci node reg property
Sebastian Reichel <[email protected]>
ARM: dts: imx53-ppd: Fix ACHC entry
Tony Lindgren <[email protected]>
serial: 8250_omap: Handle optional overrun-throttle-ms property
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: qcom: sdm630: Fix TLMM node and pinctrl configuration
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: qcom: sdm630: Rewrite memory map
Bob Peterson <[email protected]>
gfs2: Fix glock recursion in freeze_go_xmote_bh
Evgeny Novikov <[email protected]>
media: tegra-cec: Handle errors of clk_prepare_enable()
Krzysztof Hałasa <[email protected]>
media: TDA1997x: fix tda1997x_query_dv_timings() return value
Hans Verkuil <[email protected]>
media: v4l2-dv-timings.c: fix wrong condition in two for-loops
Umang Jain <[email protected]>
media: imx258: Limit the max analogue gain to 480
Laurent Pinchart <[email protected]>
media: imx258: Rectify mismatch of VTS value
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: update sof_pcm512x quirks
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output
Vidya Sagar <[email protected]>
arm64: tegra: Fix Tegra194 PCIe EP compatible string
Nicolas Ferre <[email protected]>
ARM: dts: at91: use the right property for shutdown controller
Yufeng Mo <[email protected]>
bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler()
Marek Vasut <[email protected]>
ARM: dts: stm32: Update AV96 adv7513 node per dtbs_check
Marek Vasut <[email protected]>
ARM: dts: stm32: Set {bitclock,frame}-master phandles on ST DKx
Marek Vasut <[email protected]>
ARM: dts: stm32: Set {bitclock,frame}-master phandles on DHCOM SoM
Zhen Lei <[email protected]>
workqueue: Fix possible memory leaks in wq_numa_init()
Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: skip invalid hci_sync_conn_complete_evt
Andy Shevchenko <[email protected]>
ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()
Martynas Pumputis <[email protected]>
libbpf: Fix race when pinning maps in parallel
Juhee Kang <[email protected]>
samples: bpf: Fix tracex7 error raised on the missing argument
Christophe JAILLET <[email protected]>
staging: ks7010: Fix the initialization of the 'sleep_status' structure
Greg Kroah-Hartman <[email protected]>
serial: 8250_pci: make setup_port() parameters explicitly unsigned
Jiri Slaby <[email protected]>
hvsi: don't panic on tty_register_driver failure
Jiri Slaby <[email protected]>
xtensa: ISS: don't panic in rs_init
Maciej W. Rozycki <[email protected]>
serial: 8250: Define RX trigger levels for OxSemi 950 devices
Niklas Schnelle <[email protected]>
s390: make PCI mio support a machine flag
Heiko Carstens <[email protected]>
s390/jump_label: print real address in a case of a jump label bug
Gustavo A. R. Silva <[email protected]>
flow_dissector: Fix out-of-bounds warnings
Gustavo A. R. Silva <[email protected]>
ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
Zheyu Ma <[email protected]>
video: fbdev: riva: Error out if 'pixclock' equals zero
Zheyu Ma <[email protected]>
video: fbdev: kyro: Error out if 'pixclock' equals zero
Zheyu Ma <[email protected]>
video: fbdev: asiliantfb: Error out if 'pixclock' equals zero
Jernej Skrabec <[email protected]>
arm64: dts: allwinner: h6: tanix-tx6: Fix regulator node names
Geert Uytterhoeven <[email protected]>
drm/bridge: nwl-dsi: Avoid potential multiplication overflow on 32-bit
Johan Almbladh <[email protected]>
bpf/tests: Do not PASS tests without actually testing the result
Johan Almbladh <[email protected]>
bpf/tests: Fix copy-and-paste error in double word test
Anson Jacob <[email protected]>
drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex
Oak Zeng <[email protected]>
drm/amdgpu: Fix a printing message
Arnd Bergmann <[email protected]>
ethtool: improve compat ioctl handling
Niklas Söderlund <[email protected]>
nfp: fix return statement in nfp_net_parse_meta()
Yang Yingliang <[email protected]>
media: atomisp: pci: fix error return code in atomisp_pci_probe()
Dinghao Liu <[email protected]>
media: atomisp: Fix runtime PM imbalance in atomisp_pci_probe
Evgeny Novikov <[email protected]>
media: platform: stm32: unprepare clocks at handling errors in probe
Ezequiel Garcia <[email protected]>
media: hantro: vp8: Move noisy WARN_ON to vpu_debug
Oliver Logush <[email protected]>
drm/amd/display: Fix timer_per_pixel unit error
Shuah Khan <[email protected]>
selftests: firmware: Fix ignored return val of asprintf() warn
Laurentiu Tudor <[email protected]>
bus: fsl-mc: fix mmio base address for child DPRCs
Zheyu Ma <[email protected]>
tty: serial: jsm: hold port lock when reporting modem line changes
Geert Uytterhoeven <[email protected]>
staging: board: Fix uninitialized spinlock when attaching genpd
Jack Pham <[email protected]>
usb: gadget: composite: Allow bMaxPower=0 if self-powered
Evgeny Novikov <[email protected]>
USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable()
Maciej Żenczykowski <[email protected]>
usb: gadget: u_ether: fix a potential null pointer dereference
Kelly Devilliv <[email protected]>
usb: host: fotg210: fix the actual_length of an iso packet
Kelly Devilliv <[email protected]>
usb: host: fotg210: fix the endpoint's transactional opportunities calculation
Sasha Neftin <[email protected]>
igc: Check if num of q_vectors is smaller than max before array access
Zhouyi Zhou <[email protected]>
rcu: Fix macro name CONFIG_TASKS_RCU_TRACE
Desmond Cheong Zhi Xi <[email protected]>
drm: protect drm_master pointers in drm_lease.c
Desmond Cheong Zhi Xi <[email protected]>
drm: serialize drm_file.master with a new spinlock
Desmond Cheong Zhi Xi <[email protected]>
drm: avoid blocking in drm_clients_info's rcu section
Tianjia Zhang <[email protected]>
Smack: Fix wrong semantics in smk_access_entry()
Yajun Deng <[email protected]>
netlink: Deal with ESRCH error in nlmsg_notify()
Zheyu Ma <[email protected]>
video: fbdev: kyro: fix a DoS bug by restricting user input
David Heidelberg <[email protected]>
ARM: dts: qcom: apq8064: correct clock names
Stefan Assmann <[email protected]>
iavf: fix locking of critical sections
Stefan Assmann <[email protected]>
iavf: do not override the adapter state in the watchdog task
Jonathan Cameron <[email protected]>
iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
Marek Vasut <[email protected]>
net: phy: Fix data type in DP83822 dp8382x_disable_wol()
Xin Long <[email protected]>
tipc: keep the skb in rcv queue until the whole data is read
Rafael J. Wysocki <[email protected]>
PCI: Use pci_update_current_state() in pci_enable_device_flags()
Sean Anderson <[email protected]>
crypto: mxs-dcp - Use sg_mapping_iter to copy data
Ani Sinha <[email protected]>
x86/hyperv: fix for unwanted manipulation of sched_clock when TSC marked unstable
Martynas Pumputis <[email protected]>
libbpf: Fix reuse of pinned map on older kernel
Mauro Carvalho Chehab <[email protected]>
media: dib8000: rewrite the init prbs logic
Randy Dunlap <[email protected]>
ASoC: atmel: ATMEL drivers don't need HAS_DMA
Luben Tuikov <[email protected]>
drm/amdgpu: Fix amdgpu_ras_eeprom_init()
Dom Cobley <[email protected]>
drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET
Nadav Amit <[email protected]>
userfaultfd: prevent concurrent API initialization
Masahiro Yamada <[email protected]>
kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y
Oleksij Rempel <[email protected]>
MIPS: Malta: fix alignment of the devicetree buffer
Jaegeuk Kim <[email protected]>
f2fs: should put a page beyond EOF when preparing a write
Jaegeuk Kim <[email protected]>
f2fs: deallocate compressed pages when error happens
Chao Yu <[email protected]>
f2fs: fix to unmap pages from userspace process in punch_hole()
Chao Yu <[email protected]>
f2fs: fix unexpected ENOENT comes from f2fs_map_blocks()
Chao Yu <[email protected]>
f2fs: fix to account missing .skipped_gc_rwsem
Yongqiang Niu <[email protected]>
soc: mediatek: cmdq: add address shift in jump
Alexey Kardashevskiy <[email protected]>
KVM: PPC: Fix clearing never mapped TCEs in realmode
Codrin Ciubotariu <[email protected]>
clk: at91: clk-generated: Limit the requested rate to our range
David Howells <[email protected]>
fscache: Fix cookie key hashing
Wenpeng Liang <[email protected]>
RDMA/hns: Fix QP's resp incomplete assignment
Srikar Dronamraju <[email protected]>
powerpc/smp: Update cpu_core_map on all PowerPc systems
Hans de Goede <[email protected]>
platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call
Nicholas Piggin <[email protected]>
KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live
Alim Akhtar <[email protected]>
scsi: ufs: ufs-exynos: Fix static checker warning
Fabiano Rosas <[email protected]>
KVM: PPC: Book3S HV: Fix copy_tofrom_guest routines
Ahmad Fatoum <[email protected]>
clk: imx8m: fix clock tree update of TF-A managed clocks
Jim Broadus <[email protected]>
HID: i2c-hid: Fix Elan touchpad regression
Lu Baolu <[email protected]>
iommu/vt-d: Update the virtual command related registers
Joel Stanley <[email protected]>
powerpc/config: Renable MTD_PHYSMAP_OF
Dan Carpenter <[email protected]>
scsi: qedf: Fix error codes in qedf_alloc_global_queues()
Dan Carpenter <[email protected]>
scsi: qedi: Fix error codes in qedi_alloc_global_queues()
Dan Carpenter <[email protected]>
scsi: smartpqi: Fix an error code in pqi_get_raid_map()
Laurent Dufour <[email protected]>
powerpc/numa: Consider the max NUMA node for migratable LPAR
Zhen Lei <[email protected]>
pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
Wei Li <[email protected]>
scsi: fdomain: Fix error return code in fdomain_probe()
Anna Schumaker <[email protected]>
sunrpc: Fix return value of get_srcport()
Olga Kornievskaia <[email protected]>
SUNRPC query transport's source port
Trond Myklebust <[email protected]>
SUNRPC/xprtrdma: Fix reconnection locking
Trond Myklebust <[email protected]>
SUNRPC: Fix potential memory corruption
Trond Myklebust <[email protected]>
NFSv4/pnfs: The layout barrier indicate a minimal value for the seqid
Trond Myklebust <[email protected]>
NFSv4/pNFS: Always allow update of a zero valued layout barrier
Trond Myklebust <[email protected]>
NFSv4/pNFS: Fix a layoutget livelock loop
Anthony Iliopoulos <[email protected]>
dma-debug: fix debugfs initialization order
Randy Dunlap <[email protected]>
openrisc: don't printk() unconditionally
Yangtao Li <[email protected]>
f2fs: reduce the scope of setting fsck tag when de->name_len is zero
Nathan Chancellor <[email protected]>
cpuidle: pseries: Mark pseries_idle_proble() as __init
Leon Romanovsky <[email protected]>
RDMA/mlx5: Delete not-available udata check
Leon Romanovsky <[email protected]>
RDMA/efa: Remove double QP type assignment
Michal Suchanek <[email protected]>
powerpc/stacktrace: Include linux/delay.h
Gautham R. Shenoy <[email protected]>
cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards
Bart Van Assche <[email protected]>
scsi: ufs: Fix memory corruption by ufshcd_read_desc_param()
Jason Gunthorpe <[email protected]>
vfio: Use config not menuconfig for VFIO_NOIOMMU
Jaehyoung Choi <[email protected]>
pinctrl: samsung: Fix pinctrl bank pin count
Colin Ian King <[email protected]>
scsi: BusLogic: Use %X for u32 sized integer rather than %lX
Leon Romanovsky <[email protected]>
docs: Fix infiniband uverbs minor number
Leon Romanovsky <[email protected]>
RDMA/iwcm: Release resources if iw_cm module initialization fails
Mike Marciniszyn <[email protected]>
IB/hfi1: Adjust pkey entry in index 0
Peter Geis <[email protected]>
clk: rockchip: drop GRF dependency for rk3328/rk3036 pll types
Christoph Hellwig <[email protected]>
scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND
Marek Behún <[email protected]>
pinctrl: armada-37xx: Correct PWM pins definitions
Zhaoyu Liu <[email protected]>
pinctrl: remove empty lines in pinctrl subsystem
Chao Yu <[email protected]>
f2fs: quota: fix potential deadlock
Dmitry Torokhov <[email protected]>
HID: input: do not report stylus battery state as "full"
Pali Rohár <[email protected]>
PCI: aardvark: Fix masking and unmasking legacy INTx interrupts
Evan Wang <[email protected]>
PCI: aardvark: Fix checking for PIO status
Jianjun Wang <[email protected]>
PCI: Export pci_pio_to_address() for module use
Pali Rohár <[email protected]>
PCI: aardvark: Configure PCIe resources from 'ranges' DT property
Hyun Kwon <[email protected]>
PCI: xilinx-nwl: Enable the clock through CCF
Krzysztof Wilczyński <[email protected]>
PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
Marek Behún <[email protected]>
PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
Stuart Hayes <[email protected]>
PCI/portdrv: Enable Bandwidth Notification only if port supports it
Chao Yu <[email protected]>
f2fs: fix to do sanity check for sb/cp fields correctly
David Heidelberg <[email protected]>
ARM: 9105/1: atags_to_fdt: don't warn about stack size
Hans de Goede <[email protected]>
libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
Robin Gong <[email protected]>
dmaengine: imx-sdma: remove duplicated sdma_load_context
Robin Gong <[email protected]>
Revert "dmaengine: imx-sdma: refine to load context only once"
Julian Wiedmann <[email protected]>
s390/qdio: cancel the ESTABLISH ccw after timeout
Julian Wiedmann <[email protected]>
s390/qdio: fix roll-back after timeout on ESTABLISH ccw
Sean Young <[email protected]>
media: rc-loopback: return number of emitters rather than error
Mauro Carvalho Chehab <[email protected]>
media: uvc: don't do DMA on stack
Wang Hai <[email protected]>
VMCI: fix NULL pointer dereference when unmapping queue pair
Brijesh Singh <[email protected]>
crypto: ccp - shutdown SEV firmware on kexec
Arne Welzel <[email protected]>
dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()
Kevin Hao <[email protected]>
cpufreq: schedutil: Use kobject release() method to free sugov_tunables
Krzysztof Kozlowski <[email protected]>
power: supply: max17042: handle fails of reading status register
Damien Le Moal <[email protected]>
block: bfq: fix bfq_set_next_ioprio_data()
zhenwei pi <[email protected]>
crypto: public_key: fix overflow during implicit conversion
Joseph Gates <[email protected]>
wcn36xx: Ensure finish scan is not requested before start scan
Nuno Sá <[email protected]>
iio: ltc2983: fix device probe
Mark Rutland <[email protected]>
arm64: head: avoid over-mapping in map_memory
Will Deacon <[email protected]>
arm64: mm: Fix TLBI vs ASID rollover
Iwona Winiarska <[email protected]>
soc: aspeed: p2a-ctrl: Fix boundary check for mmap
Iwona Winiarska <[email protected]>
soc: aspeed: lpc-ctrl: Fix boundary check for mmap
Manivannan Sadhasivam <[email protected]>
soc: qcom: aoss: Fix the out of bound usage of cooling_devs
Paul Cercueil <[email protected]>
pinctrl: ingenic: Fix incorrect pull up/down info
Marc Zyngier <[email protected]>
pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast
Dinh Nguyen <[email protected]>
clk: socfpga: agilex: add the bypass register for s2f_usr0 clock
Dinh Nguyen <[email protected]>
clk: socfpga: agilex: fix up s2f_user0_clk representation
Dinh Nguyen <[email protected]>
clk: socfpga: agilex: fix the parents of the psi_ref_clk
Rolf Eike Beer <[email protected]>
tools/thermal/tmon: Add cross compiling support
Steven Rostedt (VMware) <[email protected]>
selftests/ftrace: Fix requirement check of README file
Colin Ian King <[email protected]>
ceph: fix dereference of null pointer cf
Harshvardhan Jha <[email protected]>
9p/xen: Fix end of loop tests for list_for_each_entry
Juergen Gross <[email protected]>
xen: fix setting of max_pfn in shared_info
Kajol Jain <[email protected]>
powerpc/perf/hv-gpci: Fix counter value parsing
Marek Marczykowski-Górecki <[email protected]>
PCI/MSI: Skip masking MSI-X on Xen PV
Niklas Cassel <[email protected]>
blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
Niklas Cassel <[email protected]>
blk-zoned: allow zone management send operations without CAP_SYS_ADMIN
Desmond Cheong Zhi Xi <[email protected]>
btrfs: reset replace target device to allocation state on close
Josef Bacik <[email protected]>
btrfs: wake up async_delalloc_pages waiters after submit
Jens Axboe <[email protected]>
io-wq: fix wakeup race when adding new work
Pavel Begunkov <[email protected]>
io_uring: fail links of cancelled timeouts
Pavel Begunkov <[email protected]>
io_uring: add ->splice_fd_in checks
Pavel Begunkov <[email protected]>
io_uring: place fixed tables under memcg limits
Pavel Begunkov <[email protected]>
io_uring: limit fixed table size by RLIMIT_NOFILE
Dmitry Osipenko <[email protected]>
rtc: tps65910: Correct driver module alias
-------------
Diffstat:
Documentation/admin-guide/devices.txt | 6 +- .../pinctrl/marvell,armada-37xx-pinctrl.txt | 8 +- Makefile | 4 +- arch/arm/boot/compressed/Makefile | 2 + arch/arm/boot/dts/at91-kizbox3_common.dtsi | 2 +- arch/arm/boot/dts/at91-sam9x60ek.dts | 2 +- arch/arm/boot/dts/at91-sama5d27_som1_ek.dts | 2 +- arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts | 2 +- arch/arm/boot/dts/at91-sama5d2_icp.dts | 2 +- arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts | 2 +- arch/arm/boot/dts/at91-sama5d2_xplained.dts | 2 +- arch/arm/boot/dts/imx53-ppd.dts | 23 +- arch/arm/boot/dts/qcom-apq8064.dtsi | 6 +- arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 8 +- arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 6 +- arch/arm/boot/dts/stm32mp15xx-dkx.dtsi | 8 +- arch/arm/boot/dts/tegra20-acer-a500-picasso.dts | 25 +- arch/arm/boot/dts/tegra20-tamonten.dtsi | 14 +- .../boot/dts/allwinner/sun50i-h6-tanix-tx6.dts | 4 +- arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts | 8 +- arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts | 7 +- arch/arm64/boot/dts/nvidia/tegra132.dtsi | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 6 +- arch/arm64/boot/dts/qcom/ipq6018.dtsi | 2 +- arch/arm64/boot/dts/qcom/ipq8074-hk01.dts | 2 +- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 16 +- arch/arm64/boot/dts/qcom/msm8994.dtsi | 6 +- arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 +- arch/arm64/boot/dts/qcom/sdm630.dtsi | 257 ++++++++++++-------- arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +- arch/arm64/include/asm/kernel-pgtable.h | 4 +- arch/arm64/include/asm/mmu.h | 29 ++- arch/arm64/include/asm/tlbflush.h | 11 +- arch/arm64/kernel/head.S | 11 +- arch/m68k/Kconfig.bus | 2 +- arch/mips/mti-malta/malta-dtshim.c | 2 +- arch/openrisc/kernel/entry.S | 2 + arch/parisc/kernel/signal.c | 6 + arch/powerpc/configs/mpc885_ads_defconfig | 1 + arch/powerpc/include/asm/pmc.h | 7 + arch/powerpc/kernel/smp.c | 11 +- arch/powerpc/kernel/stacktrace.c | 1 + arch/powerpc/kvm/book3s_64_mmu_radix.c | 6 +- arch/powerpc/kvm/book3s_64_vio_hv.c | 9 +- arch/powerpc/kvm/book3s_hv.c | 20 ++ arch/powerpc/mm/numa.c | 13 +- arch/powerpc/perf/hv-gpci.c | 2 +- arch/s390/include/asm/setup.h | 2 + arch/s390/kernel/early.c | 4 + arch/s390/kernel/jump_label.c | 2 +- arch/s390/mm/init.c | 2 +- arch/s390/pci/pci.c | 5 +- arch/x86/kernel/cpu/mshyperv.c | 9 +- arch/x86/xen/p2m.c | 4 +- arch/xtensa/platforms/iss/console.c | 17 +- block/bfq-iosched.c | 2 +- block/blk-zoned.c | 6 - block/bsg.c | 5 +- drivers/ata/libata-core.c | 4 + drivers/ata/sata_dwc_460ex.c | 12 +- drivers/bus/fsl-mc/fsl-mc-bus.c | 24 +- drivers/clk/at91/clk-generated.c | 6 + drivers/clk/imx/clk-composite-8m.c | 3 +- drivers/clk/imx/clk-imx8mm.c | 7 +- drivers/clk/imx/clk-imx8mn.c | 7 +- drivers/clk/imx/clk-imx8mq.c | 7 +- drivers/clk/imx/clk.h | 16 +- drivers/clk/rockchip/clk-pll.c | 2 +- drivers/clk/socfpga/clk-agilex.c | 19 +- drivers/cpufreq/powernv-cpufreq.c | 16 +- drivers/cpuidle/cpuidle-pseries.c | 18 +- drivers/crypto/ccp/sev-dev.c | 49 ++-- drivers/crypto/ccp/sp-pci.c | 12 + drivers/crypto/mxs-dcp.c | 36 +-- drivers/dma/imx-sdma.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 2 +- drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 2 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 84 +++++-- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h | 1 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 16 +- .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 11 +- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 14 +- .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +- .../gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c | 90 +++++-- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 12 +- .../gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 42 +++- drivers/gpu/drm/bridge/nwl-dsi.c | 2 +- drivers/gpu/drm/drm_auth.c | 42 +++- drivers/gpu/drm/drm_debugfs.c | 3 +- drivers/gpu/drm/drm_dp_mst_topology.c | 10 +- drivers/gpu/drm/drm_file.c | 1 + drivers/gpu/drm/drm_lease.c | 81 +++++-- drivers/gpu/drm/exynos/exynos_drm_dma.c | 2 + drivers/gpu/drm/mgag200/mgag200_drv.h | 16 ++ drivers/gpu/drm/mgag200/mgag200_mode.c | 20 +- drivers/gpu/drm/mgag200/mgag200_reg.h | 9 +- drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 17 +- drivers/gpu/drm/msm/dp/dp_panel.c | 9 +- drivers/gpu/drm/msm/dsi/dsi_cfg.c | 1 - drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 2 +- drivers/gpu/drm/panfrost/panfrost_device.h | 8 +- drivers/gpu/drm/panfrost/panfrost_drv.c | 50 +--- drivers/gpu/drm/panfrost/panfrost_gem.c | 20 +- drivers/gpu/drm/panfrost/panfrost_job.c | 4 +- drivers/gpu/drm/panfrost/panfrost_mmu.c | 191 +++++++++------ drivers/gpu/drm/panfrost/panfrost_mmu.h | 5 +- drivers/gpu/drm/panfrost/panfrost_regs.h | 2 + drivers/gpu/drm/vc4/vc4_hdmi.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 +- drivers/gpu/drm/xlnx/zynqmp_disp.c | 3 +- drivers/gpu/drm/xlnx/zynqmp_dp.c | 22 +- drivers/hid/hid-input.c | 2 - drivers/hid/i2c-hid/i2c-hid-core.c | 5 +- drivers/hwmon/pmbus/ibm-cffps.c | 6 +- drivers/iio/dac/ad5624r_spi.c | 18 +- drivers/iio/temperature/ltc2983.c | 30 ++- drivers/infiniband/core/iwcm.c | 19 +- drivers/infiniband/hw/efa/efa_verbs.c | 1 - drivers/infiniband/hw/hfi1/init.c | 7 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 3 +- drivers/infiniband/hw/mlx5/qp.c | 3 - drivers/iommu/intel/pasid.h | 10 +- drivers/mailbox/mtk-cmdq-mailbox.c | 3 +- drivers/md/dm-crypt.c | 7 +- drivers/media/cec/platform/stm32/stm32-cec.c | 26 +- drivers/media/cec/platform/tegra/tegra_cec.c | 10 +- drivers/media/dvb-frontends/dib8000.c | 58 +++-- drivers/media/i2c/imx258.c | 4 +- drivers/media/i2c/tda1997x.c | 5 +- drivers/media/rc/rc-loopback.c | 2 +- drivers/media/usb/uvc/uvc_v4l2.c | 34 ++- drivers/media/v4l2-core/v4l2-dv-timings.c | 4 +- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +- drivers/mmc/core/block.c | 3 +- drivers/mmc/host/rtsx_pci_sdmmc.c | 36 ++- drivers/mmc/host/sdhci-of-arasan.c | 36 ++- drivers/net/bonding/bond_main.c | 3 +- drivers/net/dsa/lantiq_gswip.c | 3 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 9 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 58 ++++- drivers/net/ethernet/intel/igc/igc_main.c | 9 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 15 ++ drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 8 +- .../ethernet/mellanox/mlx5/core/steering/dr_rule.c | 2 +- .../ethernet/mellanox/mlx5/core/steering/dr_send.c | 1 + .../net/ethernet/netronome/nfp/nfp_net_common.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 18 +- drivers/net/ethernet/wiznet/w5100.c | 2 + drivers/net/phy/dp83822.c | 8 +- drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 3 +- drivers/net/wireless/ath/ath9k/hw.c | 12 +- drivers/net/wireless/ath/wcn36xx/main.c | 5 +- drivers/net/wireless/ath/wcn36xx/txrx.c | 4 + drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 + drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 4 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 +- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 24 +- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 30 ++- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 5 +- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 2 + .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 33 ++- drivers/net/wireless/realtek/rtw88/Makefile | 2 +- drivers/net/wireless/realtek/rtw88/fw.c | 8 +- drivers/net/wireless/realtek/rtw88/fw.h | 1 + drivers/net/wireless/realtek/rtw88/wow.c | 21 +- drivers/nvdimm/pmem.c | 4 +- drivers/nvme/host/core.c | 3 +- drivers/nvme/host/nvme.h | 47 +++- drivers/nvme/host/pci.c | 2 +- drivers/nvme/host/rdma.c | 4 +- drivers/nvme/host/tcp.c | 38 ++- drivers/nvme/target/loop.c | 4 +- drivers/nvmem/qfprom.c | 6 +- drivers/of/kobj.c | 2 +- drivers/opp/of.c | 12 +- drivers/parport/ieee1284_ops.c | 2 +- drivers/pci/controller/pci-aardvark.c | 266 ++++++++++++++++++++- drivers/pci/controller/pcie-xilinx-nwl.c | 12 + drivers/pci/msi.c | 3 + drivers/pci/pci.c | 7 +- drivers/pci/pcie/portdrv_core.c | 9 +- drivers/pci/quirks.c | 1 + drivers/pci/syscall.c | 4 +- drivers/pinctrl/actions/pinctrl-owl.c | 1 - drivers/pinctrl/core.c | 1 - drivers/pinctrl/freescale/pinctrl-imx1-core.c | 1 - drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 17 +- drivers/pinctrl/pinctrl-at91.c | 1 - drivers/pinctrl/pinctrl-ingenic.c | 6 +- drivers/pinctrl/pinctrl-single.c | 1 + drivers/pinctrl/pinctrl-st.c | 1 - drivers/pinctrl/pinctrl-stmfx.c | 6 +- drivers/pinctrl/pinctrl-sx150x.c | 1 - drivers/pinctrl/qcom/pinctrl-sdm845.c | 1 - drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c | 1 - drivers/pinctrl/renesas/pfc-r8a77950.c | 1 - drivers/pinctrl/renesas/pfc-r8a77951.c | 1 - drivers/pinctrl/renesas/pfc-r8a7796.c | 1 - drivers/pinctrl/renesas/pfc-r8a77965.c | 1 - drivers/pinctrl/samsung/pinctrl-samsung.c | 2 +- drivers/platform/chrome/cros_ec_proto.c | 9 + drivers/platform/x86/dell-smbios-wmi.c | 1 + drivers/power/supply/max17042_battery.c | 6 +- drivers/rtc/rtc-tps65910.c | 2 +- drivers/s390/cio/qdio_main.c | 82 ++++--- drivers/scsi/BusLogic.c | 6 +- drivers/scsi/pcmcia/fdomain_cs.c | 4 +- drivers/scsi/qedf/qedf_main.c | 10 +- drivers/scsi/qedi/qedi_main.c | 14 +- drivers/scsi/qla2xxx/qla_nvme.c | 5 +- drivers/scsi/qla2xxx/qla_os.c | 6 + drivers/scsi/smartpqi/smartpqi_init.c | 1 + drivers/scsi/ufs/ufs-exynos.c | 4 +- drivers/scsi/ufs/ufs-exynos.h | 2 +- drivers/scsi/ufs/ufshcd.c | 8 +- drivers/soc/aspeed/aspeed-lpc-ctrl.c | 2 +- drivers/soc/aspeed/aspeed-p2a-ctrl.c | 2 +- drivers/soc/qcom/qcom_aoss.c | 8 +- drivers/soundwire/intel.c | 23 +- drivers/staging/board/board.c | 7 +- drivers/staging/ks7010/ks7010_sdio.c | 2 +- drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 4 +- drivers/staging/media/hantro/hantro_g1_vp8_dec.c | 13 +- .../staging/media/hantro/rk3399_vpu_hw_vp8_dec.c | 13 +- drivers/staging/rts5208/rtsx_scsi.c | 10 +- drivers/thunderbolt/switch.c | 2 +- drivers/tty/hvc/hvsi.c | 19 +- drivers/tty/serial/8250/8250_omap.c | 25 +- drivers/tty/serial/8250/8250_pci.c | 2 +- drivers/tty/serial/8250/8250_port.c | 3 +- drivers/tty/serial/jsm/jsm_neo.c | 2 + drivers/tty/serial/jsm/jsm_tty.c | 3 + drivers/tty/serial/sh-sci.c | 7 +- drivers/usb/chipidea/host.c | 14 +- drivers/usb/gadget/composite.c | 8 +- drivers/usb/gadget/function/u_ether.c | 5 +- drivers/usb/host/ehci-mv.c | 23 +- drivers/usb/host/fotg210-hcd.c | 41 ++-- drivers/usb/host/fotg210.h | 5 - drivers/usb/host/xhci.c | 24 +- drivers/usb/musb/musb_dsps.c | 13 +- drivers/usb/usbip/vhci_hcd.c | 32 ++- drivers/vfio/Kconfig | 2 +- drivers/video/fbdev/asiliantfb.c | 3 + drivers/video/fbdev/kyro/fbdev.c | 8 + drivers/video/fbdev/riva/fbdev.c | 3 + fs/btrfs/inode.c | 10 +- fs/btrfs/tree-log.c | 4 +- fs/btrfs/volumes.c | 3 + fs/ceph/caps.c | 3 + fs/cifs/sess.c | 2 +- fs/f2fs/compress.c | 12 +- fs/f2fs/data.c | 16 ++ fs/f2fs/dir.c | 14 +- fs/f2fs/file.c | 4 +- fs/f2fs/gc.c | 4 +- fs/f2fs/super.c | 106 ++++---- fs/fscache/cookie.c | 14 +- fs/fscache/internal.h | 2 + fs/fscache/main.c | 39 +++ fs/gfs2/glops.c | 17 +- fs/gfs2/lock_dlm.c | 5 + fs/io-wq.c | 8 +- fs/io_uring.c | 70 +++--- fs/iomap/buffered-io.c | 2 +- fs/lockd/svclock.c | 30 +-- fs/nfs/pnfs.c | 16 +- fs/nfsd/nfs4state.c | 5 +- fs/notify/fanotify/fanotify.c | 6 + fs/overlayfs/dir.c | 6 +- fs/userfaultfd.c | 91 ++++--- include/crypto/public_key.h | 4 +- include/drm/drm_auth.h | 1 + include/drm/drm_file.h | 18 +- include/linux/ethtool.h | 4 - include/linux/hugetlb.h | 9 + include/linux/hugetlb_cgroup.h | 12 + include/linux/intel-iommu.h | 6 +- include/linux/rcupdate.h | 2 +- include/linux/sunrpc/xprt.h | 1 + include/linux/sunrpc/xprtsock.h | 1 + include/net/flow_offload.h | 1 + include/uapi/linux/serial_reg.h | 1 + kernel/dma/debug.c | 7 +- kernel/fork.c | 1 + kernel/pid_namespace.c | 3 +- kernel/rcu/tree_plugin.h | 8 +- kernel/sched/cpufreq_schedutil.c | 16 +- kernel/workqueue.c | 12 +- lib/test_bpf.c | 13 +- lib/test_stackinit.c | 20 +- mm/hmm.c | 5 +- mm/hugetlb.c | 4 +- mm/vmscan.c | 2 +- net/9p/trans_xen.c | 4 +- net/bluetooth/hci_event.c | 108 ++++++--- net/bluetooth/sco.c | 74 +++--- net/core/flow_dissector.c | 12 +- net/core/flow_offload.c | 89 ++++++- net/ethtool/ioctl.c | 136 +++++++++-- net/ipv4/ip_output.c | 5 +- net/ipv4/tcp_fastopen.c | 3 +- net/mac80211/iface.c | 11 +- net/netfilter/nf_flow_table_offload.c | 1 + net/netfilter/nf_tables_offload.c | 1 + net/netlabel/netlabel_cipso_v4.c | 4 +- net/netlink/af_netlink.c | 4 +- net/sched/cls_api.c | 1 + net/sched/sch_taprio.c | 4 +- net/socket.c | 125 +--------- net/sunrpc/auth_gss/svcauth_gss.c | 2 +- net/sunrpc/xprt.c | 8 +- net/sunrpc/xprtrdma/transport.c | 11 +- net/sunrpc/xprtsock.c | 7 + net/tipc/socket.c | 36 ++- samples/bpf/test_override_return.sh | 1 + samples/bpf/tracex7_user.c | 5 + scripts/gen_ksymdeps.sh | 8 +- security/smack/smack_access.c | 17 +- sound/soc/atmel/Kconfig | 1 - sound/soc/intel/boards/bytcr_rt5640.c | 9 +- sound/soc/intel/boards/sof_pcm512x.c | 13 +- sound/soc/intel/skylake/skl-messages.c | 11 +- sound/soc/intel/skylake/skl-pcm.c | 25 +- sound/soc/rockchip/rockchip_i2s.c | 35 ++- tools/lib/bpf/libbpf.c | 63 ++++- .../testing/selftests/arm64/mte/mte_common_util.c | 2 +- tools/testing/selftests/arm64/pauth/pac.c | 10 +- .../testing/selftests/bpf/prog_tests/send_signal.c | 16 ++ .../selftests/bpf/prog_tests/sockopt_inherit.c | 4 +- tools/testing/selftests/bpf/progs/xdp_tx.c | 2 +- tools/testing/selftests/bpf/test_maps.c | 2 +- tools/testing/selftests/bpf/test_xdp_veth.sh | 2 +- tools/testing/selftests/firmware/fw_namespace.c | 3 +- tools/testing/selftests/ftrace/test.d/functions | 2 +- tools/thermal/tmon/Makefile | 2 +- 344 files changed, 3181 insertions(+), 1644 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/306 rtc: tps65910: Correct driver module alias
From: Dmitry Osipenko <[email protected]>
commit 8d448fa0a8bb1c8d94eef7647edffe9ac81a281e upstream.
The TPS65910 RTC driver module doesn't auto-load because of the wrong module alias that doesn't match the device name, fix it.
--- drivers/rtc/rtc-tps65910.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-tps65910.c +1 -1
@@ -469,6 +469,6 @@ static struct platform_driver tps65910_r };module_platform_driver (tps65910_rtc_driver); -MODULE_ALIAS ("platform:rtc-tps65910" ); +MODULE_ALIAS ("platform:tps65910-rtc" );MODULE_AUTHOR ("Venu Byravarasu <[email protected]>" );MODULE_LICENSE ("GPL" );
Greg Kroah-Hartman
maintainerPATCH 2/306 io_uring: limit fixed table size by RLIMIT_NOFILE
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
Limit the number of files in io_uring fixed tables by RLIMIT_NOFILE, that's the first and the simpliest restriction that we should impose.
--- fs/io_uring.c | 2 ++ 1 file changed, 2 insertions(+)
fs/io_uring.c +2 -0
@@ -7579,6 +7579,8 @@ static int io_sqe_files_register(structreturn -EINVAL ;if (nr_args >IORING_MAX_FIXED_FILES )return -EMFILE ; +if (nr_args >rlimit (RLIMIT_NOFILE )) +return -EMFILE ; file_data =kzalloc (sizeof (*ctx->file_data),GFP_KERNEL );if (!file_data)
Re: [PATCH 5.10 002/306] io_uring: limit fixed table size by RLIMIT_NOFILE
Hi!
Quoted 6 lines
From: Pavel Begunkov <[email protected]>
Limit the number of files in
io_uringfixed tables byRLIMIT_NOFILE, that's the first and the simpliest restriction that we should impose.
5.13 and 5.14 backports do have "upstream" marking, but this one does not. It is commit 3a1b8a4e843f96b636431450d8d79061605cf74b upstream. But I guess it is too late to fix that.
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerPATCH 3/306 io_uring: place fixed tables under memcg limits
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
commit 0bea96f59ba40e63c0ae93ad6a02417b95f22f4d upstream.
Fixed tables may be large enough, place all of them together with allocated tags under memcg limits.
--- fs/io_uring.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/io_uring.c +3 -3
@@ -7383,7 +7383,7 @@ static int io_sqe_alloc_file_tables(stru this_files =min (nr_files,IORING_MAX_FILES_TABLE ); table->files =kcalloc (this_files,sizeof (struct file *), -GFP_KERNEL ); +GFP_KERNEL_ACCOUNT );if (!table->files)break ; nr_files -= this_files;
@@ -7582,7 +7582,7 @@ static int io_sqe_files_register(structif (nr_args >rlimit (RLIMIT_NOFILE ))return -EMFILE ; - file_data =kzalloc (sizeof (*ctx->file_data),GFP_KERNEL ); + file_data =kzalloc (sizeof (*ctx->file_data),GFP_KERNEL_ACCOUNT );if (!file_data)return -ENOMEM ; file_data->ctx = ctx;
@@ -7592,7 +7592,7 @@ static int io_sqe_files_register(struct nr_tables =DIV_ROUND_UP (nr_args,IORING_MAX_FILES_TABLE ); file_data->table =kcalloc (nr_tables,sizeof (*file_data->table), -GFP_KERNEL ); +GFP_KERNEL_ACCOUNT );if (!file_data->table) goto out_free;
Greg Kroah-Hartman
maintainerPATCH 4/306 io_uring: add ->splice_fd_in checks
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
commit 26578cda3db983b17cabe4e577af26306beb9987 upstream.
->splice_fd_in is used only by splice/tee, but no other request checks it for validity. Add the check for most of request types excluding reads/writes/sends/recvs, we don't want overhead for them and can leave them be as is until the field is actually used.
--- fs/io_uring.c | 40 ++++++++++++++++++++++++---------------- 1 file changed, 24 insertions(+), 16 deletions(-)
fs/io_uring.c +24 -16
@@ -3746,7 +3746,8 @@ static int io_prep_fsync(struct io_kiocbif (unlikely (ctx->flags &IORING_SETUP_IOPOLL ))return -EINVAL ; -if (unlikely (sqe->addr || sqe->ioprio || sqe->buf_index)) +if (unlikely (sqe->addr || sqe->ioprio || sqe->buf_index || + sqe->splice_fd_in))return -EINVAL ; req->sync.flags =READ_ONCE (sqe->fsync_flags);
@@ -3779,7 +3780,8 @@ static int io_fsync(struct io_kiocb *reqstatic int io_fallocate_prep (struct io_kiocb *req,const struct io_uring_sqe *sqe) { -if (sqe->ioprio || sqe->buf_index || sqe->rw_flags) +if (sqe->ioprio || sqe->buf_index || sqe->rw_flags || + sqe->splice_fd_in)return -EINVAL ;if (unlikely (req->ctx->flags &IORING_SETUP_IOPOLL ))return -EINVAL ;
@@ -3810,7 +3812,7 @@ static int __io_openat_prep(struct io_kiconst char __user *fname;int ret; -if (unlikely (sqe->ioprio || sqe->buf_index)) +if (unlikely (sqe->ioprio || sqe->buf_index || sqe->splice_fd_in))return -EINVAL ;if (unlikely (req->flags &REQ_F_FIXED_FILE ))return -EBADF ;
@@ -3926,7 +3928,8 @@ static int io_remove_buffers_prep(structstruct io_provide_buf *p = &req->pbuf;u64 tmp; -if (sqe->ioprio || sqe->rw_flags || sqe->addr || sqe->len || sqe->off) +if (sqe->ioprio || sqe->rw_flags || sqe->addr || sqe->len || sqe->off || + sqe->splice_fd_in)return -EINVAL ; tmp =READ_ONCE (sqe->fd);
@@ -4002,7 +4005,7 @@ static int io_provide_buffers_prep(strucstruct io_provide_buf *p = &req->pbuf;u64 tmp; -if (sqe->ioprio || sqe->rw_flags) +if (sqe->ioprio || sqe->rw_flags || sqe->splice_fd_in)return -EINVAL ; tmp =READ_ONCE (sqe->fd);
@@ -4095,7 +4098,7 @@ static int io_epoll_ctl_prep(struct io_k const struct io_uring_sqe *sqe) {#if defined(CONFIG_EPOLL ) -if (sqe->ioprio || sqe->buf_index) +if (sqe->ioprio || sqe->buf_index || sqe->splice_fd_in)return -EINVAL ;if (unlikely (req->ctx->flags & (IORING_SETUP_IOPOLL |IORING_SETUP_SQPOLL )))return -EINVAL ;
@@ -4141,7 +4144,7 @@ static int io_epoll_ctl(struct io_kiocbstatic int io_madvise_prep (struct io_kiocb *req,const struct io_uring_sqe *sqe) {#if defined(CONFIG_ADVISE_SYSCALLS ) && defined(CONFIG_MMU ) -if (sqe->ioprio || sqe->buf_index || sqe->off) +if (sqe->ioprio || sqe->buf_index || sqe->off || sqe->splice_fd_in)return -EINVAL ;if (unlikely (req->ctx->flags &IORING_SETUP_IOPOLL ))return -EINVAL ;
@@ -4176,7 +4179,7 @@ static int io_madvise(struct io_kiocb *rstatic int io_fadvise_prep (struct io_kiocb *req,const struct io_uring_sqe *sqe) { -if (sqe->ioprio || sqe->buf_index || sqe->addr) +if (sqe->ioprio || sqe->buf_index || sqe->addr || sqe->splice_fd_in)return -EINVAL ;if (unlikely (req->ctx->flags &IORING_SETUP_IOPOLL ))return -EINVAL ;
@@ -4214,7 +4217,7 @@ static int io_statx_prep(struct io_kiocb {if (unlikely (req->ctx->flags & (IORING_SETUP_IOPOLL |IORING_SETUP_SQPOLL )))return -EINVAL ; -if (sqe->ioprio || sqe->buf_index) +if (sqe->ioprio || sqe->buf_index || sqe->splice_fd_in)return -EINVAL ;if (req->flags &REQ_F_FIXED_FILE )return -EBADF ;
@@ -4261,7 +4264,7 @@ static int io_close_prep(struct io_kiocbif (unlikely (req->ctx->flags & (IORING_SETUP_IOPOLL |IORING_SETUP_SQPOLL )))return -EINVAL ;if (sqe->ioprio || sqe->off || sqe->addr || sqe->len || - sqe->rw_flags || sqe->buf_index) + sqe->rw_flags || sqe->buf_index || sqe->splice_fd_in)return -EINVAL ;if (req->flags &REQ_F_FIXED_FILE )return -EBADF ;
@@ -4317,7 +4320,8 @@ static int io_prep_sfr(struct io_kiocb *if (unlikely (ctx->flags &IORING_SETUP_IOPOLL ))return -EINVAL ; -if (unlikely (sqe->addr || sqe->ioprio || sqe->buf_index)) +if (unlikely (sqe->addr || sqe->ioprio || sqe->buf_index || + sqe->splice_fd_in))return -EINVAL ; req->sync.off =READ_ONCE (sqe->off);
@@ -4760,7 +4764,7 @@ static int io_accept_prep(struct io_kiocif (unlikely (req->ctx->flags & (IORING_SETUP_IOPOLL |IORING_SETUP_SQPOLL )))return -EINVAL ; -if (sqe->ioprio || sqe->len || sqe->buf_index) +if (sqe->ioprio || sqe->len || sqe->buf_index || sqe->splice_fd_in)return -EINVAL ; accept->addr =u64_to_user_ptr (READ_ONCE (sqe->addr));
@@ -4801,7 +4805,8 @@ static int io_connect_prep(struct io_kioif (unlikely (req->ctx->flags & (IORING_SETUP_IOPOLL |IORING_SETUP_SQPOLL )))return -EINVAL ; -if (sqe->ioprio || sqe->len || sqe->buf_index || sqe->rw_flags) +if (sqe->ioprio || sqe->len || sqe->buf_index || sqe->rw_flags || + sqe->splice_fd_in)return -EINVAL ; conn->addr =u64_to_user_ptr (READ_ONCE (sqe->addr));
@@ -5553,7 +5558,8 @@ static int io_timeout_remove_prep(structreturn -EINVAL ;if (unlikely (req->flags & (REQ_F_FIXED_FILE |REQ_F_BUFFER_SELECT )))return -EINVAL ; -if (sqe->ioprio || sqe->buf_index || sqe->len || sqe->timeout_flags) +if (sqe->ioprio || sqe->buf_index || sqe->len || sqe->timeout_flags | + sqe->splice_fd_in)return -EINVAL ; req->timeout_rem.addr =READ_ONCE (sqe->addr);
@@ -5590,7 +5596,8 @@ static int io_timeout_prep(struct io_kioif (unlikely (req->ctx->flags &IORING_SETUP_IOPOLL ))return -EINVAL ; -if (sqe->ioprio || sqe->buf_index || sqe->len !=1 ) +if (sqe->ioprio || sqe->buf_index || sqe->len !=1 || + sqe->splice_fd_in)return -EINVAL ;if (off && is_timeout_link)return -EINVAL ;
@@ -5734,7 +5741,8 @@ static int io_async_cancel_prep(struct ireturn -EINVAL ;if (unlikely (req->flags & (REQ_F_FIXED_FILE |REQ_F_BUFFER_SELECT )))return -EINVAL ; -if (sqe->ioprio || sqe->off || sqe->len || sqe->cancel_flags) +if (sqe->ioprio || sqe->off || sqe->len || sqe->cancel_flags || + sqe->splice_fd_in)return -EINVAL ; req->cancel.addr =READ_ONCE (sqe->addr);
Greg Kroah-Hartman
maintainerPATCH 5/306 io_uring: fail links of cancelled timeouts
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
commit 2ae2eb9dde18979b40629dd413b9adbd6c894cdf upstream.
When we cancel a timeout we should mark it with REQ_F_FAIL, so linked requests are cancelled as well, but not queued for further execution.
--- fs/io_uring.c | 2 ++ 1 file changed, 2 insertions(+)
fs/io_uring.c +2 -0
@@ -1498,6 +1498,8 @@ static void io_kill_timeout(struct io_ki ret =hrtimer_try_to_cancel (&io->timer);if (ret !=-1 ) { +if (status) +req_set_fail_links (req);atomic_set (&req->ctx->cq_timeouts,atomic_read (&req->ctx->cq_timeouts) +1 );list_del_init (&req->timeout.list);
Greg Kroah-Hartman
maintainerPATCH 6/306 io-wq: fix wakeup race when adding new work
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit 87df7fb922d18e96992aa5e824aa34b2065fef59 upstream.
When new work is added, io_wqe_enqueue() checks if we need to wake or create a new worker. But that check is done outside the lock that otherwise synchronizes us with a worker going to sleep, so we can end up in the following situation:
CPU0 CPU1
lock
insert work
unlockatomic_read(nr_running) != 0
lock atomic_dec(nr_running)
no wakeup needed
Hold the wqe lock around the "need to wakeup" check. Then we can also get rid of the temporary work_flags variable, as we know the work will remain valid as long as we hold the lock.
--- fs/io-wq.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/io-wq.c +4 -4
@@ -895,7 +895,7 @@ append:static void io_wqe_enqueue (struct io_wqe *wqe,struct io_wq_work *work) {struct io_wqe_acct *acct =io_work_get_acct (wqe, work); -int work_flags; +bool do_wake;unsigned long flags;/*
@@ -909,14 +909,14 @@ static void io_wqe_enqueue(struct io_wqereturn ; } - work_flags = work->flags;raw_spin_lock_irqsave (&wqe->lock, flags);io_wqe_insert_work (wqe, work); wqe->flags &= ~IO_WQE_FLAG_STALLED ; + do_wake = (work->flags &IO_WQ_WORK_CONCURRENT ) || + !atomic_read (&acct->nr_running);raw_spin_unlock_irqrestore (&wqe->lock, flags); -if ((work_flags &IO_WQ_WORK_CONCURRENT ) || - !atomic_read (&acct->nr_running)) +if (do_wake)io_wqe_wake_worker (wqe, acct); }
Greg Kroah-Hartman
maintainerPATCH 7/306 btrfs: wake up async_delalloc_pages waiters after submit
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit ac98141d140444fe93e26471d3074c603b70e2ca upstream.
We use the async_delalloc_pages mechanism to make sure that we've completed our async work before trying to continue our delalloc flushing. The reason for this is we need to see any ordered extents that were created by our delalloc flushing. However we're waking up before we do the submit work, which is before we create the ordered extents. This is a pretty wide race window where we could potentially think there are no ordered extents and thus exit shrink_delalloc prematurely. Fix this by waking us up after we've done the work to create ordered extents.
--- fs/btrfs/inode.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
fs/btrfs/inode.c +5 -5
@@ -1202,11 +1202,6 @@ static noinline void async_cow_submit(st nr_pages = (async_chunk->end - async_chunk->start +PAGE_SIZE ) >>PAGE_SHIFT ; -/* atomic_sub_return implies a barrier */ -if (atomic_sub_return (nr_pages, &fs_info->async_delalloc_pages) < -5 *SZ_1M ) -cond_wake_up_nomb (&fs_info->async_submit_wait); -/* * ->inode could be NULL if async_chunk_start has failed to compress, * in which case we don't have anything to submit, yet we need to
@@ -1215,6 +1210,11 @@ static noinline void async_cow_submit(st*/ if (async_chunk->inode)submit_compressed_extents (async_chunk); + +/* atomic_sub_return implies a barrier */ +if (atomic_sub_return (nr_pages, &fs_info->async_delalloc_pages) < +5 *SZ_1M ) +cond_wake_up_nomb (&fs_info->async_submit_wait); } static noinline void async_cow_free(struct btrfs_work *work)
Greg Kroah-Hartman
maintainerPATCH 8/306 btrfs: reset replace target device to allocation state on close
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
commit 0d977e0eba234e01a60bdde27314dc21374201b3 upstream.
This crash was observed with a failed assertion on device close:
BTRFS: Transaction aborted (error -28)
WARNING: CPU: 1 PID: 3902 at fs/btrfs/extent-tree.c:2150 btrfs_run_delayed_refs+0x1d2/0x1e0 [btrfs] Modules linked in: btrfs blake2b_generic libcrc32c crc32c_intel xor zstd_decompress zstd_compress xxhash lzo_compress lzo_decompress raid6_pq loop CPU: 1 PID: 3902 Comm: kworker/u8:4 Not tainted 5.14.0-rc5-default+ #1532 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014 Workqueue: events_unbound btrfs_async_reclaim_metadata_space [btrfs] RIP: 0010:btrfs_run_delayed_refs+0x1d2/0x1e0 [btrfs] RSP: 0018:ffffb7a5452d7d80 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffffabee13c4 RDI: 00000000ffffffff RBP: ffff97834176a378 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000001 R12: ffff97835195d388 R13: 0000000005b08000 R14: ffff978385484000 R15: 000000000000016c FS: 0000000000000000(0000) GS:ffff9783bd800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056190d003fe8 CR3: 000000002a81e005 CR4: 0000000000170ea0 Call Trace: flush_space+0x197/0x2f0 [btrfs] btrfs_async_reclaim_metadata_space+0x139/0x300 [btrfs] process_one_work+0x262/0x5e0 worker_thread+0x4c/0x320 ? process_one_work+0x5e0/0x5e0 kthread+0x144/0x170 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30 irq event stamp: 19334989 hardirqs last enabled at (19334997): [<ffffffffab0e0c87>] console_unlock+0x2b7/0x400 hardirqs last disabled at (19335006): [<ffffffffab0e0d0d>] console_unlock+0x33d/0x400 softirqs last enabled at (19334900): [<ffffffffaba0030d>] __do_softirq+0x30d/0x574 softirqs last disabled at (19334893): [<ffffffffab0721ec>] irq_exit_rcu+0x12c/0x140 ---[ end trace 45939e308e0dd3c7 ]--- BTRFS: error (device vdd) in btrfs_run_delayed_refs:2150: errno=-28 No space left BTRFS info (device vdd): forced readonly BTRFS warning (device vdd): failed setting block group ro: -30 BTRFS info (device vdd): suspending dev_replace for unmount assertion failed: !test_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state), in fs/btrfs/volumes.c:1150 ------------[ cut here ]------------ kernel BUG at fs/btrfs/ctree.h:3431! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 3982 Comm: umount Tainted: G W 5.14.0-rc5-default+ #1532 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014 RIP: 0010:assertfail.constprop.0+0x18/0x1a [btrfs] RSP: 0018:ffffb7a5454c7db8 EFLAGS: 00010246 RAX: 0000000000000068 RBX: ffff978364b91c00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffffabee13c4 RDI: 00000000ffffffff RBP: ffff9783523a4c00 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000001 R12: ffff9783523a4d18 R13: 0000000000000000 R14: 0000000000000004 R15: 0000000000000003 FS: 00007f61c8f42800(0000) GS:ffff9783bd800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056190cffa810 CR3: 0000000030b96002 CR4: 0000000000170ea0 Call Trace: btrfs_close_one_device.cold+0x11/0x55 [btrfs] close_fs_devices+0x44/0xb0 [btrfs] btrfs_close_devices+0x48/0x160 [btrfs] generic_shutdown_super+0x69/0x100 kill_anon_super+0x14/0x30 btrfs_kill_super+0x12/0x20 [btrfs] deactivate_locked_super+0x2c/0xa0 cleanup_mnt+0x144/0x1b0 task_work_run+0x59/0xa0 exit_to_user_mode_loop+0xe7/0xf0 exit_to_user_mode_prepare+0xaf/0xf0 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x4a/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
This happens when close_ctree is called while a dev_replace hasn't completed. In close_ctree, we suspend the dev_replace, but keep the replace target around so that we can resume the dev_replace procedure when we mount the root again. This is the call trace:
close_ctree():
btrfs_dev_replace_suspend_for_unmount();
btrfs_close_devices():
btrfs_close_fs_devices():
btrfs_close_one_device():
ASSERT(!test_bit(BTRFS_DEV_STATE_REPLACE_TGT,
&device->dev_state));However, since the replace target sticks around, there is a device with BTRFS_DEV_STATE_REPLACE_TGT set on close, and we fail the assertion in btrfs_close_one_device.
To fix this, if we come across the replace target device when closing, we should properly reset it back to allocation state. This fix also ensures that if a non-target device has a corrupted state and has the BTRFS_DEV_STATE_REPLACE_TGT bit set, the assertion will still catch the error.
--- fs/btrfs/volumes.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/volumes.c +3 -0
@@ -1129,6 +1129,9 @@ static void btrfs_close_one_device(struc fs_devices->rw_devices--; } +if (device->devid ==BTRFS_DEV_REPLACE_DEVID ) +clear_bit (BTRFS_DEV_STATE_REPLACE_TGT , &device->dev_state); +if (test_bit (BTRFS_DEV_STATE_MISSING , &device->dev_state)) fs_devices->missing_devices--;
Greg Kroah-Hartman
maintainerPATCH 9/306 blk-zoned: allow zone management send operations without CAP_SYS_ADMIN
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
commit ead3b768bb51259e3a5f2287ff5fc9041eb6f450 upstream.
Zone management send operations (BLKRESETZONE, BLKOPENZONE, BLKCLOSEZONE and BLKFINISHZONE) should be allowed under the same permissions as write(). (write() does not require CAP_SYS_ADMIN).
Additionally, other ioctls like BLKSECDISCARD and BLKZEROOUT only check if the fd was successfully opened with FMODE_WRITE.
(They do not require CAP_SYS_ADMIN).
Currently, zone management send operations require both CAP_SYS_ADMIN and that the fd was successfully opened with FMODE_WRITE.
Remove the CAP_SYS_ADMIN requirement, so that zone management send operations match the access control requirement of write(), BLKSECDISCARD and BLKZEROOUT.
--- block/blk-zoned.c | 3 --- 1 file changed, 3 deletions(-)
block/blk-zoned.c +0 -3
@@ -357,9 +357,6 @@ int blkdev_zone_mgmt_ioctl(struct block_if (!blk_queue_is_zoned (q))return -ENOTTY ; -if (!capable (CAP_SYS_ADMIN )) -return -EACCES ; -if (!(mode &FMODE_WRITE ))return -EBADF ;
Greg Kroah-Hartman
maintainerPATCH 10/306 blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
commit 4d643b66089591b4769bcdb6fd1bfeff2fe301b8 upstream.
A user space process should not need the CAP_SYS_ADMIN capability set in order to perform a BLKREPORTZONE ioctl.
Getting the zone report is required in order to get the write pointer. Neither read() nor write() requires CAP_SYS_ADMIN, so it is reasonable that a user space process that can read/write from/to the device, also can get the write pointer. (Since e.g. writes have to be at the write pointer.)
--- block/blk-zoned.c | 3 --- 1 file changed, 3 deletions(-)
block/blk-zoned.c +0 -3
@@ -296,9 +296,6 @@ int blkdev_report_zones_ioctl(struct bloif (!blk_queue_is_zoned (q))return -ENOTTY ; -if (!capable (CAP_SYS_ADMIN )) -return -EACCES ; -if (copy_from_user (&rep, argp,sizeof (struct blk_zone_report )))return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 11/306 PCI/MSI: Skip masking MSI-X on Xen PV
In reply to Greg Kroah-HartmanFrom: Marek Marczykowski-Górecki <[email protected]>
commit 1a519dc7a73c977547d8b5108d98c6e769c89f4b upstream.
When running as Xen PV guest, masking MSI-X is a responsibility of the hypervisor. The guest has no write access to the relevant BAR at all - when it tries to, it results in a crash like this:
BUG: unable to handle page fault for address: ffffc9004069100c
#PF: supervisor write access in kernel mode
#PF: error_code(0x0003) - permissions violation
RIP: e030:__pci_enable_msix_range.part.0+0x26b/0x5f0
e1000e_set_interrupt_capability+0xbf/0xd0 [e1000e]
e1000_probe+0x41f/0xdb0 [e1000e]
local_pci_probe+0x42/0x80
(...)The recently introduced function msix_mask_all() does not check the global variable pci_msi_ignore_mask which is set by XEN PV to bypass the masking of MSI[-X] interrupts.
Add the check to make this function XEN PV compatible.
--- drivers/pci/msi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pci/msi.c +3 -0
@@ -783,6 +783,9 @@ static void msix_mask_all(void __iomem *u32 ctrl =PCI_MSIX_ENTRY_CTRL_MASKBIT ;int i; +if (pci_msi_ignore_mask) +return ; +for (i =0 ; i < tsize; i++, base +=PCI_MSIX_ENTRY_SIZE )writel (ctrl, base +PCI_MSIX_ENTRY_VECTOR_CTRL ); }
Greg Kroah-Hartman
maintainerPATCH 12/306 powerpc/perf/hv-gpci: Fix counter value parsing
In reply to Greg Kroah-HartmanFrom: Kajol Jain <[email protected]>
commit f9addd85fbfacf0d155e83dbee8696d6df5ed0c7 upstream.
H_GetPerformanceCounterInfo (0xF080) hcall returns the counter data in the result buffer. Result buffer has specific format defined in the PAPR specification. One of the fields is counter offset and width of the counter data returned.
Counter data are returned in a unsigned char array in big endian byte order. To get the final counter data, the values must be left shifted byte at a time. But commit 220a0c609ad17 ("powerpc/perf: Add support for the hv gpci (get performance counter info) interface") made the shifting bitwise and also assumed little endian order. Because of that, hcall counters values are reported incorrectly.
In particular this can lead to counters go backwards which messes up the counter prev vs now calculation and leads to huge counter value reporting:
#: perf stat -e hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
-C 0 -I 1000
time counts unit events
1.000078854 18,446,744,073,709,535,232 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
2.000213293 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
3.000320107 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
4.000428392 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
5.000537864 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
6.000649087 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
7.000760312 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
8.000865218 16,448 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
9.000978985 18,446,744,073,709,535,232 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
10.001088891 16,384 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
11.001201435 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
12.001307937 18,446,744,073,709,535,232 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
Fix the shifting logic to correct match the format, ie. read bytes in big endian order.
--- arch/powerpc/perf/hv-gpci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/perf/hv-gpci.c +1 -1
@@ -175,7 +175,7 @@ static unsigned long single_gpci_request*/ count =0 ;for (i = offset; i < offset + length; i++) - count |= arg->bytes[i] << (i - offset); + count |= (u64)(arg->bytes[i]) << ((length -1 - (i - offset)) *8 ); *value = count; out:
Greg Kroah-Hartman
maintainerPATCH 13/306 xen: fix setting of max_pfn in shared_info
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
commit 4b511d5bfa74b1926daefd1694205c7f1bcf677f upstream.
Xen PV guests are specifying the highest used PFN via the max_pfn field in shared_info. This value is used by the Xen tools when saving or migrating the guest.
Unfortunately this field is misnamed, as in reality it is specifying the number of pages (including any memory holes) of the guest, so it is the highest used PFN + 1. Renaming isn't possible, as this is a public Xen hypervisor interface which needs to be kept stable.
The kernel will set the value correctly initially at boot time, but when adding more pages (e.g. due to memory hotplug or ballooning) a real PFN number is stored in max_pfn. This is done when expanding the p2m array, and the PFN stored there is even possibly wrong, as it should be the last possible PFN of the just added P2M frame, and not one which led to the P2M expansion.
Fix that by setting shared_info->max_pfn to the last possible PFN + 1.
--- arch/x86/xen/p2m.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/xen/p2m.c +2 -2
@@ -618,8 +618,8 @@ int xen_alloc_p2m_entry(unsigned long pf }/* Expanded the p2m? */ -if (pfn > xen_p2m_last_pfn) { - xen_p2m_last_pfn = pfn; +if (pfn >= xen_p2m_last_pfn) { + xen_p2m_last_pfn =ALIGN (pfn +1 ,P2M_PER_PAGE ); HYPERVISOR_shared_info->arch.max_pfn = xen_p2m_last_pfn; }
Greg Kroah-Hartman
maintainerPATCH 14/306 9p/xen: Fix end of loop tests for list_for_each_entry
In reply to Greg Kroah-HartmanFrom: Harshvardhan Jha <[email protected]>
commit 732b33d0dbf17e9483f0b50385bf606f724f50a2 upstream.
This patch addresses the following problems:
- priv can never be NULL, so this part of the check is useless
- if the loop ran through the whole list, priv->client is invalid and
it is more appropriate and sufficient to check for the end of list_for_each_entry loop condition.
--- net/9p/trans_xen.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/9p/trans_xen.c +2 -2
@@ -138,7 +138,7 @@ static bool p9_xen_write_todo(struct xenstatic int p9_xen_request (struct p9_client *client,struct p9_req_t *p9_req) { -struct xen_9pfs_front_priv *priv =NULL ; +struct xen_9pfs_front_priv *priv;RING_IDX cons, prod, masked_cons, masked_prod;unsigned long flags;u32 size = p9_req->tc.size;
@@ -151,7 +151,7 @@ static int p9_xen_request(struct p9_cliebreak ; }read_unlock (&xen_9pfs_lock); -if (!priv || priv->client != client) +if (list_entry_is_head (priv, &xen_9pfs_devs, list))return -EINVAL ; num = p9_req->tc.tag % priv->num_rings;
Greg Kroah-Hartman
maintainerPATCH 15/306 ceph: fix dereference of null pointer cf
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit 05a444d3f90a3c3e6362e88a1bf13e1a60f8cace upstream.
Currently in the case where kmem_cache_alloc fails the null pointer cf is dereferenced when assigning cf->is_capsnap = false. Fix this by adding a null pointer check and return path.
Cc: [email protected]
Addresses-Coverity: ("Dereference null return")
--- fs/ceph/caps.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ceph/caps.c +3 -0
@@ -1755,6 +1755,9 @@ struct ceph_cap_flush *ceph_alloc_cap_flstruct ceph_cap_flush *cf; cf =kmem_cache_alloc (ceph_cap_flush_cachep,GFP_KERNEL ); +if (!cf) +return NULL ; + cf->is_capsnap = false;return cf; }
Greg Kroah-Hartman
maintainerPATCH 16/306 selftests/ftrace: Fix requirement check of README file
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 210f9df02611cbe641ced3239122b270fd907d86 upstream.
The selftest for ftrace checks some features by checking if the README has text that states the feature is supported by that kernel. Unfortunately, this check gives false positives because it many not be checked if there's spaces in the string to check. This is due to the compare between the required variable with the ":README" string stripped, because neither has quotes around them.
--- tools/testing/selftests/ftrace/test.d/functions | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/ftrace/test.d/functions +1 -1
@@ -115,7 +115,7 @@ check_requires() { # Check required file echo "Required tracer $t is not configured." exit_unsupported fi - elif [ $r != $i ]; then + elif [ "$r" != "$i" ]; then if ! grep -Fq "$r" README ; then echo "Required feature pattern \"$r\" is not in README." exit_unsupported
Greg Kroah-Hartman
maintainerPATCH 17/306 tools/thermal/tmon: Add cross compiling support
In reply to Greg Kroah-HartmanFrom: Rolf Eike Beer <[email protected]>
commit b5f7912bb604b47a0fe024560488a7556dce8ee7 upstream.
Default to prefixed pkg-config when crosscompiling, this matches what other parts of the tools/ directory already do.
[dlezcano] : Reworked description
--- tools/thermal/tmon/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/thermal/tmon/Makefile +1 -1
@@ -10,7 +10,7 @@ override CFLAGS+= $(call cc-option,-O3,- # Add "-fstack-protector" only if toolchain supports it. override CFLAGS+= $(call cc-option,-fstack-protector-strong) CC?= $(CROSS_COMPILE)gcc -PKG_CONFIG?= pkg-config +PKG_CONFIG?= $(CROSS_COMPILE)pkg-config override CFLAGS+=-D VERSION=\"$(VERSION)\" LDFLAGS+=
Greg Kroah-Hartman
maintainerPATCH 18/306 clk: socfpga: agilex: fix the parents of the psi_ref_clk
In reply to Greg Kroah-HartmanFrom: Dinh Nguyen <[email protected]>
commit 9d563236cca43fc4fe190b3be173444bd48e2a3b upstream.
The psi_ref_clk comes from the C2 node of the main_pll and periph_pll, not the C3.
--- drivers/clk/socfpga/clk-agilex.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/clk/socfpga/clk-agilex.c +4 -4
@@ -107,10 +107,10 @@ static const struct clk_parent_data gpio };static const struct clk_parent_data psi_ref_free_mux[] = { - { .fw_name ="main_pll_c3" , - .name ="main_pll_c3" , }, - { .fw_name ="peri_pll_c3" , - .name ="peri_pll_c3" , }, + { .fw_name ="main_pll_c2" , + .name ="main_pll_c2" , }, + { .fw_name ="peri_pll_c2" , + .name ="peri_pll_c2" , }, { .fw_name ="osc1" , .name ="osc1" , }, { .fw_name ="cb-intosc-hs-div2-clk" ,
Greg Kroah-Hartman
maintainerPATCH 19/306 clk: socfpga: agilex: fix up s2f_user0_clk representation
In reply to Greg Kroah-HartmanFrom: Dinh Nguyen <[email protected]>
commit f817c132db679d492d96c60993fa2f2c67ab18d0 upstream.
Correct the s2f_user0_mux clock representation.
--- drivers/clk/socfpga/clk-agilex.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/clk/socfpga/clk-agilex.c +9 -0
@@ -193,6 +193,13 @@ static const struct clk_parent_data sdmm .name = "boot_clk", }, }; +static const struct clk_parent_data s2f_user0_mux[] = { + { .fw_name ="s2f_user0_free_clk" , + .name ="s2f_user0_free_clk" , }, + { .fw_name ="boot_clk" , + .name ="boot_clk" , }, +}; +static const struct clk_parent_data s2f_user1_mux[] = { { .fw_name ="s2f_user1_free_clk" , .name = "s2f_user1_free_clk", },
@@ -306,6 +313,8 @@ static const struct stratix10_gate_clock 4, 0x98, 0, 16, 0x88, 3, 0}, {AGILEX_SDMMC_CLK ,"sdmmc_clk" ,NULL , sdmmc_mux,ARRAY_SIZE (sdmmc_mux),0 ,0x7C , 5, 0, 0, 0, 0x88, 4, 4}, + { AGILEX_S2F_USER0_CLK, "s2f_user0_clk", NULL, s2f_user0_mux, ARRAY_SIZE(s2f_user0_mux), 0, 0x24, + 6, 0, 0, 0, 0x30, 2, 0}, { AGILEX_S2F_USER1_CLK, "s2f_user1_clk", NULL, s2f_user1_mux, ARRAY_SIZE(s2f_user1_mux), 0, 0x7C, 6, 0, 0, 0, 0x88, 5, 0}, { AGILEX_PSI_REF_CLK, "psi_ref_clk", NULL, psi_mux, ARRAY_SIZE(psi_mux), 0, 0x7C,
Greg Kroah-Hartman
maintainerPATCH 20/306 clk: socfpga: agilex: add the bypass register for s2f_usr0 clock
In reply to Greg Kroah-HartmanFrom: Dinh Nguyen <[email protected]>
commit d17929eb1066d1c1653aae9bb4396a9f1d6602ac upstream.
Add the bypass register for the s2f_user0_clk.
--- drivers/clk/socfpga/clk-agilex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/socfpga/clk-agilex.c +1 -1
@@ -267,7 +267,7 @@ static const struct stratix10_perip_cnt_ {AGILEX_SDMMC_FREE_CLK ,"sdmmc_free_clk" ,NULL , sdmmc_free_mux, ARRAY_SIZE(sdmmc_free_mux), 0, 0xE4, 0, 0, 0}, { AGILEX_S2F_USER0_FREE_CLK, "s2f_user0_free_clk", NULL, s2f_usr0_free_mux, - ARRAY_SIZE(s2f_usr0_free_mux), 0, 0xE8, 0, 0, 0}, + ARRAY_SIZE(s2f_usr0_free_mux), 0, 0xE8, 0, 0x30, 2}, { AGILEX_S2F_USER1_FREE_CLK, "s2f_user1_free_clk", NULL, s2f_usr1_free_mux, ARRAY_SIZE(s2f_usr1_free_mux), 0, 0xEC, 0, 0x88, 5}, { AGILEX_PSI_REF_FREE_CLK, "psi_ref_free_clk", NULL, psi_ref_free_mux,
Greg Kroah-Hartman
maintainerPATCH 21/306 pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit 1b73e588f47397dee6e4bdfd953e0306c60b5fe5 upstream.
Casting a small array of u8 to an unsigned long is *never* OK:
- it does funny thing when the array size is less than that of a long, as it accesses random places in the stack
- it makes everything even more fun with a BE kernel
Fix this by building the unsigned long used as a bitmap byte by byte, in a way that works across endianess and has no undefined behaviours.
An extra BUILD_BUG_ON() catches the unlikely case where the array would be larger than a single unsigned long.
--- drivers/pinctrl/pinctrl-stmfx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/pinctrl/pinctrl-stmfx.c +4 -2
@@ -566,7 +566,7 @@ static irqreturn_t stmfx_pinctrl_irq_thru8 pending[NR_GPIO_REGS ];u8 src[NR_GPIO_REGS ] = {0 ,0 ,0 };unsigned long n, status; -int ret; +int i, ret; ret =regmap_bulk_read (pctl->stmfx->map,STMFX_REG_IRQ_GPI_PENDING , &pending,NR_GPIO_REGS );
@@ -576,7 +576,9 @@ static irqreturn_t stmfx_pinctrl_irq_thrregmap_bulk_write (pctl->stmfx->map,STMFX_REG_IRQ_GPI_SRC , src,NR_GPIO_REGS ); - status = *(unsigned long *)pending; +BUILD_BUG_ON (NR_GPIO_REGS >sizeof (status)); +for (i =0 , status =0 ; i <NR_GPIO_REGS ; i++) + status |= (unsigned long )pending[i] << (i *8 );for_each_set_bit (n, &status, gc->ngpio) {handle_nested_irq (irq_find_mapping (gc->irq.domain, n));stmfx_pinctrl_irq_toggle_trigger (pctl, n);
Greg Kroah-Hartman
maintainerPATCH 22/306 pinctrl: ingenic: Fix incorrect pull up/down info
In reply to Greg Kroah-HartmanFrom: Paul Cercueil <[email protected]>
commit d5e931403942b3af39212960c2592b5ba741b2bf upstream.
Fix the pull up/down info for both the JZ4760 and JZ4770 SoCs, as the previous values sometimes contradicted what's written in the programming manual.
--- drivers/pinctrl/pinctrl-ingenic.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pinctrl/pinctrl-ingenic.c +3 -3
@@ -363,7 +363,7 @@ static const struct ingenic_chip_info jz };static const u32 jz4760_pull_ups[6 ] = { -0xffffffff ,0xfffcf3ff ,0xffffffff ,0xffffcfff ,0xfffffb7c ,0xfffff00f , +0xffffffff ,0xfffcf3ff ,0xffffffff ,0xffffcfff ,0xfffffb7c ,0x0000000f , };static const u32 jz4760_pull_downs[6 ] = {
@@ -618,11 +618,11 @@ static const struct ingenic_chip_info jz };static const u32 jz4770_pull_ups[6 ] = { -0x3fffffff ,0xfff0030c ,0xffffffff ,0xffff4fff ,0xfffffb7c ,0xffa7f00f , +0x3fffffff ,0xfff0f3fc ,0xffffffff ,0xffff4fff ,0xfffffb7c ,0x0024f00f , };static const u32 jz4770_pull_downs[6 ] = { -0x00000000 ,0x000f0c03 ,0x00000000 ,0x0000b000 ,0x00000483 ,0x00580ff0 , +0x00000000 ,0x000f0c03 ,0x00000000 ,0x0000b000 ,0x00000483 ,0x005b0ff0 , };static int jz4770_uart0_data_pins[] = {0xa0 ,0xa3 , };
Greg Kroah-Hartman
maintainerPATCH 23/306 soc: qcom: aoss: Fix the out of bound usage of cooling_devs
In reply to Greg Kroah-HartmanFrom: Manivannan Sadhasivam <[email protected]>
commit a89f355e469dcda129c2522be4fdba00c1c74c83 upstream.
In "qmp_cooling_devices_register", the count value is initially QMP_NUM_COOLING_RESOURCES, which is 2. Based on the initial count value, the memory for cooling_devs is allocated. Then while calling the "qmp_cooling_device_add" function, count value is post-incremented for each child node.
This makes the out of bound access to the cooling_dev array. Fix it by passing the QMP_NUM_COOLING_RESOURCES definition to devm_kzalloc() and initializing the count to 0.
While at it, let's also free the memory allocated to cooling_dev if no cooling device is found in DT and during unroll phase.
--- drivers/soc/qcom/qcom_aoss.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/soc/qcom/qcom_aoss.c +6 -2
@@ -476,12 +476,12 @@ static int qmp_cooling_device_add(structstatic int qmp_cooling_devices_register (struct qmp *qmp) {struct device_node *np, *child; -int count =QMP_NUM_COOLING_RESOURCES ; +int count =0 ;int ret; np = qmp->dev->of_node; - qmp->cooling_devs =devm_kcalloc (qmp->dev, count, + qmp->cooling_devs =devm_kcalloc (qmp->dev,QMP_NUM_COOLING_RESOURCES ,sizeof (*qmp->cooling_devs),GFP_KERNEL );
@@ -497,12 +497,16 @@ static int qmp_cooling_devices_register( goto unroll; } +if (!count) +devm_kfree (qmp->dev, qmp->cooling_devs); +return 0 ; unroll:while (--count >=0 )thermal_cooling_device_unregister (qmp->cooling_devs[count].cdev); +devm_kfree (qmp->dev, qmp->cooling_devs);return ret; }
Greg Kroah-Hartman
maintainerPATCH 24/306 soc: aspeed: lpc-ctrl: Fix boundary check for mmap
In reply to Greg Kroah-HartmanFrom: Iwona Winiarska <[email protected]>
commit b49a0e69a7b1a68c8d3f64097d06dabb770fec96 upstream.
The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one side of the comparison, and uses resource address (rather than just the resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and map pages that are located outside memory-region reserved by the driver.
--- drivers/soc/aspeed/aspeed-lpc-ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/aspeed/aspeed-lpc-ctrl.c +1 -1
@@ -46,7 +46,7 @@ static int aspeed_lpc_ctrl_mmap(struct funsigned long vsize = vma->vm_end - vma->vm_start;pgprot_t prot = vma->vm_page_prot; -if (vma->vm_pgoff + vsize > lpc_ctrl->mem_base + lpc_ctrl->mem_size) +if (vma->vm_pgoff +vma_pages (vma) > lpc_ctrl->mem_size >>PAGE_SHIFT )return -EINVAL ;/* ast2400/2500 AHB accesses are not cache coherent */
Greg Kroah-Hartman
maintainerPATCH 25/306 soc: aspeed: p2a-ctrl: Fix boundary check for mmap
In reply to Greg Kroah-HartmanFrom: Iwona Winiarska <[email protected]>
commit 8b07e990fb254fcbaa919616ac77f981cb48c73d upstream.
The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one side of the comparison, and uses resource address (rather than just the resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and map pages that are located outside memory-region reserved by the driver.
--- drivers/soc/aspeed/aspeed-p2a-ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/aspeed/aspeed-p2a-ctrl.c +1 -1
@@ -110,7 +110,7 @@ static int aspeed_p2a_mmap(struct file * vsize = vma->vm_end - vma->vm_start; prot = vma->vm_page_prot; -if (vma->vm_pgoff + vsize > ctrl->mem_base + ctrl->mem_size) +if (vma->vm_pgoff +vma_pages (vma) > ctrl->mem_size >>PAGE_SHIFT )return -EINVAL ;/* ast2400/2500 AHB accesses are not cache coherent */
Greg Kroah-Hartman
maintainerPATCH 26/306 arm64: mm: Fix TLBI vs ASID rollover
In reply to Greg Kroah-HartmanFrom: Will Deacon <[email protected]>
commit 5e10f9887ed85d4f59266d5c60dd09be96b5dbd4 upstream.
When switching to an 'mm_struct' for the first time following an ASID rollover, a new ASID may be allocated and assigned to 'mm->context.id'. This reassignment can happen concurrently with other operations on the mm, such as unmapping pages and subsequently issuing TLB invalidation.
Consequently, we need to ensure that (a) accesses to 'mm->context.id' are atomic and (b) all page-table updates made prior to a TLBI using the old ASID are guaranteed to be visible to CPUs running with the new ASID.
This was found by inspection after reviewing the VMID changes from Shameer but it looks like a real (yet hard to hit) bug.
--- arch/arm64/include/asm/mmu.h | 29 +++++++++++++++++++++++++---- arch/arm64/include/asm/tlbflush.h | 11 ++++++----- 2 files changed, 31 insertions(+), 9 deletions(-)
arch/arm64/include/asm/mmu.h +25 -4
@@ -30,11 +30,32 @@ typedef struct { } mm_context_t;/* -* This macro is only used by the TLBI and low-level switch_mm() code, -* neither of which can race with an ASID change. We therefore don't -* need to reload the counter using atomic64_read(). +* We use atomic64_read() here because the ASID for an 'mm_struct' can +* be reallocated when scheduling one of its threads following a +* rollover event (see new_context() and flush_context()). In this case, +* a concurrent TLBI (e.g. via try_to_unmap_one() and ptep_clear_flush()) +* may use a stale ASID. This is fine in principle as the new ASID is +* guaranteed to be clean in the TLB, but the TLBI routines have to take +* care to handle the following race: +* +* CPU 0 CPU 1 CPU 2 +* +* // ptep_clear_flush(mm) +* xchg_relaxed(pte, 0) +* DSB ISHST +* old = ASID(mm) +* | <rollover> +* | new = new_context(mm) +* \-----------------> atomic_set(mm->context.id, new) +* cpu_switch_mm(mm) +* // Hardware walk of pte using new ASID +* TLBI(old) +* +* In this scenario, the barrier on CPU 0 and the dependency on CPU 1 +* ensure that the page-table walker on CPU 1 *must* see the invalid PTE +* written by CPU 0. */ -#define ASID (mm) ((mm)->context.id.counter & 0xffff) +#define ASID (mm) (atomic64_read(&(mm)->context.id) & 0xffff)static inline bool arm64_kernel_unmapped_at_el0 (void ) {
arch/arm64/include/asm/tlbflush.h +6 -5
@@ -245,9 +245,10 @@ static inline void flush_tlb_all(void)static inline void flush_tlb_mm (struct mm_struct *mm) { -unsigned long asid =__TLBI_VADDR (0 ,ASID (mm)); +unsigned long asid;dsb (ishst); + asid =__TLBI_VADDR (0 ,ASID (mm));__tlbi (aside1is, asid);__tlbi_user (aside1is, asid);dsb (ish);
@@ -256,9 +257,10 @@ static inline void flush_tlb_mm(struct mstatic inline void flush_tlb_page_nosync (struct vm_area_struct *vma,unsigned long uaddr) { -unsigned long addr =__TLBI_VADDR (uaddr,ASID (vma->vm_mm)); +unsigned long addr;dsb (ishst); + addr =__TLBI_VADDR (uaddr,ASID (vma->vm_mm));__tlbi (vale1is, addr);__tlbi_user (vale1is, addr); }
@@ -283,9 +285,7 @@ static inline void __flush_tlb_range(str {int num =0 ;int scale =0 ; -unsigned long asid =ASID (vma->vm_mm); -unsigned long addr; -unsigned long pages; +unsigned long asid, addr, pages; start =round_down (start, stride); end =round_up (end, stride);
@@ -305,6 +305,7 @@ static inline void __flush_tlb_range(str }dsb (ishst); + asid =ASID (vma->vm_mm);/* * When the CPU does not support TLB range operations, flush the TLB
Greg Kroah-Hartman
maintainerPATCH 27/306 arm64: head: avoid over-mapping in map_memory
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
commit 90268574a3e8a6b883bd802d702a2738577e1006 upstream.
The compute_indices and populate_entries macros operate on inclusive bounds, and thus the map_memory macro which uses them also operates on inclusive bounds.
We pass _end and _idmap_text_end to map_memory, but these are exclusive bounds, and if one of these is sufficiently aligned (as a result of kernel configuration, physical placement, and KASLR), then:
* In compute_indices, the computed iend will be in the page/block *after* the final byte of the intended mapping.
* In populate_entries, an unnecessary entry will be created at the end of each level of table. At the leaf level, this entry will map up to SWAPPER_BLOCK_SIZE bytes of physical addresses that we did not intend to map.
As we may map up to SWAPPER_BLOCK_SIZE bytes more than intended, we may violate the boot protocol and map physical address past the 2MiB-aligned end address we are permitted to map. As we map these with Normal memory attributes, this may result in further problems depending on what these physical addresses correspond to.
The final entry at each level may require an additional table at that level. As EARLY_ENTRIES() calculates an inclusive bound, we allocate enough memory for this.
Avoid the extraneous mapping by having map_memory convert the exclusive end address to an inclusive end address by subtracting one, and do likewise in EARLY_ENTRIES() when calculating the number of required tables. For clarity, comments are updated to more clearly document which boundaries the macros operate on. For consistency with the other macros, the comments in map_memory are also updated to describe vstart and vend as virtual addresses.
--- arch/arm64/include/asm/kernel-pgtable.h | 4 ++-- arch/arm64/kernel/head.S | 11 ++++++----- 2 files changed, 8 insertions(+), 7 deletions(-)
arch/arm64/include/asm/kernel-pgtable.h +2 -2
@@ -65,8 +65,8 @@#define EARLY_KASLR (0)#endif -#define EARLY_ENTRIES (vstart, vend, shift) (((vend) >> (shift)) \ - - ((vstart) >> (shift)) + 1 + EARLY_KASLR) +#define EARLY_ENTRIES (vstart, vend, shift) \ + ((((vend) - 1) >> (shift)) - ((vstart) >> (shift)) + 1 + EARLY_KASLR)#define EARLY_PGDS (vstart, vend) (EARLY_ENTRIES(vstart, vend, PGDIR_SHIFT))
arch/arm64/kernel/head.S +6 -5
@@ -191,7 +191,7 @@ SYM_CODE_END(preserve_boot_args) * to be composed of multiple pages. (This effectively scales the end index). * * vstart: virtual address of start of range - * vend: virtual address of end of range + * vend: virtual address of end of range - we map [vstart, vend] * shift: shift used to transform virtual address into index * ptrs: number of entries in page table * istart: index in table corresponding to vstart
@@ -228,17 +228,18 @@ SYM_CODE_END(preserve_boot_args) * * tbl: location of page table * rtbl: address to be used for first level page table entry (typically tbl + PAGE_SIZE) - * vstart: start address to map - * vend: end address to map - we map [vstart, vend] + * vstart: virtual address of start of range + * vend: virtual address of end of range - we map [vstart, vend - 1] * flags: flags to use to map last level entries * phys: physical address corresponding to vstart - physical memory is contiguous * pgds: the number of pgd entries * * Temporaries: istart, iend, tmp, count, sv - these need to be different registers - * Preserves: vstart, vend, flags - * Corrupts: tbl, rtbl, istart, iend, tmp, count, sv + * Preserves: vstart, flags + * Corrupts: tbl, rtbl, vend, istart, iend, tmp, count, sv */ .macro map_memory, tbl, rtbl, vstart, vend, flags, phys, pgds, istart, iend, tmp, count, sv + sub \vend, \vend, #1 add \rtbl, \tbl, #PAGE_SIZE mov \sv, \rtbl mov \count, #0
Greg Kroah-Hartman
maintainerPATCH 28/306 iio: ltc2983: fix device probe
In reply to Greg Kroah-HartmanFrom: Nuno Sá <[email protected]>
commit b76d26d69ecc97ebb24aaf40427a13c808a4f488 upstream.
There is no reason to assume that the IRQ rising edge (indicating that the device start up phase is done) will happen after we request the IRQ. If the device is already up by the time we request it, the call to 'wait_for_completion_timeout()' will timeout and we will fail the device probe even though there's nothing wrong.
Fix it by just polling the status register until we get the indication that the device is up and running. As a side effect of this fix, requesting the IRQ is also moved to after the setup function.
--- drivers/iio/temperature/ltc2983.c | 30 ++++++++++++++---------------- 1 file changed, 14 insertions(+), 16 deletions(-)
drivers/iio/temperature/ltc2983.c +14 -16
@@ -89,6 +89,8 @@#define LTC2983_STATUS_START_MASK BIT(7)#define LTC2983_STATUS_START (x) FIELD_PREP(LTC2983_STATUS_START_MASK, x) +#define LTC2983_STATUS_UP_MASK GENMASK(7, 6) +#define LTC2983_STATUS_UP (reg) FIELD_GET(LTC2983_STATUS_UP_MASK, reg)#define LTC2983_STATUS_CHAN_SEL_MASK GENMASK(4, 0)#define LTC2983_STATUS_CHAN_SEL (x) \
@@ -1362,17 +1364,16 @@ put_child:static int ltc2983_setup (struct ltc2983_data *st,bool assign_iio) { -u32 iio_chan_t =0 , iio_chan_v =0 , chan, iio_idx =0 ; +u32 iio_chan_t =0 , iio_chan_v =0 , chan, iio_idx =0 , status;int ret; -unsigned long time; - -/* make sure the device is up */ - time =wait_for_completion_timeout (&st->completion, -msecs_to_jiffies (250 )); -if (!time) { +/* make sure the device is up: start bit (7) is 0 and done bit (6) is 1 */ + ret =regmap_read_poll_timeout (st->regmap,LTC2983_STATUS_REG , status, +LTC2983_STATUS_UP (status) ==1 ,25000 , +25000 *10 ); +if (ret) {dev_err (&st->spi->dev,"Device startup timed out\n" ); -return -ETIMEDOUT ; +return ret; } st->iio_chan = devm_kzalloc(&st->spi->dev,
@@ -1492,10 +1493,11 @@ static int ltc2983_probe(struct spi_devi ret =ltc2983_parse_dt (st);if (ret)return ret; -/* -* let's request the irq now so it is used to sync the device -* startup in ltc2983_setup() -*/ + + ret =ltc2983_setup (st, true); +if (ret) +return ret; + ret =devm_request_irq (&spi->dev, spi->irq, ltc2983_irq_handler,IRQF_TRIGGER_RISING , name, st);if (ret) {
@@ -1503,10 +1505,6 @@ static int ltc2983_probe(struct spi_devireturn ret; } - ret =ltc2983_setup (st, true); -if (ret) -return ret; - indio_dev->name = name; indio_dev->num_channels = st->iio_channels; indio_dev->channels = st->iio_chan;
Greg Kroah-Hartman
maintainerPATCH 29/306 wcn36xx: Ensure finish scan is not requested before start scan
In reply to Greg Kroah-HartmanFrom: Joseph Gates <[email protected]>
commit d195d7aac09bddabc2c8326fb02fcec2b0a2de02 upstream.
If the operating channel is the first in the scan list, it was seen that a finish scan request would be sent before a start scan request was sent, causing the firmware to fail all future scans. Track the current channel being scanned to avoid requesting the scan finish before it starts.
--- drivers/net/wireless/ath/wcn36xx/main.c | 5 ++++- drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 + 2 files changed, 5 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/wcn36xx/main.c +4 -1
@@ -405,13 +405,14 @@ static int wcn36xx_config(struct ieee802wcn36xx_dbg (WCN36XX_DBG_MAC ,"wcn36xx_config channel switch=%d\n" , ch); -if (wcn->sw_scan_opchannel == ch) { +if (wcn->sw_scan_opchannel == ch && wcn->sw_scan_channel) {/* If channel is the initial operating channel, we may * want to receive/transmit regular data packets, then * simply stop the scan session and exit PS mode. */ wcn36xx_smd_finish_scan (wcn,HAL_SYS_MODE_SCAN , wcn->sw_scan_vif); + wcn->sw_scan_channel =0 ; }else if (wcn->sw_scan) {/* A scan is ongoing, do not change the operating * channel, but start a scan session on the channel.
@@ -419,6 +420,7 @@ static int wcn36xx_config(struct ieee802wcn36xx_smd_init_scan (wcn,HAL_SYS_MODE_SCAN , wcn->sw_scan_vif);wcn36xx_smd_start_scan (wcn, ch); + wcn->sw_scan_channel = ch; }else {wcn36xx_change_opchannel (wcn, ch); }
@@ -699,6 +701,7 @@ static void wcn36xx_sw_scan_start(struct wcn->sw_scan = true; wcn->sw_scan_vif = vif; + wcn->sw_scan_channel =0 ;if (vif_priv->sta_assoc) wcn->sw_scan_opchannel =WCN36XX_HW_CHANNEL (wcn);else
drivers/net/wireless/ath/wcn36xx/wcn36xx.h +1 -0
@@ -232,6 +232,7 @@ struct wcn36xx {struct cfg80211_scan_request *scan_req;bool sw_scan;u8 sw_scan_opchannel; +u8 sw_scan_channel;struct ieee80211_vif *sw_scan_vif;struct mutex scan_lock;bool scan_aborted;
Greg Kroah-Hartman
maintainerPATCH 30/306 crypto: public_key: fix overflow during implicit conversion
In reply to Greg Kroah-HartmanFrom: zhenwei pi <[email protected]>
commit f985911b7bc75d5c98ed24d8aaa8b94c590f7c6a upstream.
Hit kernel warning like this, it can be reproduced by verifying 256 bytes datafile by keyctl command, run script:
RAWDATA=rawdata
SIGDATA=sigdata
modprobe pkcs8_key_parser
rm -rf *.der *.pem *.pfx
rm -rf $RAWDATA
dd if=/dev/random of=$RAWDATA bs=256 count=1
openssl req -nodes -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem \
-subj "/C=CN/ST=GD/L=SZ/O=vihoo/OU=dev/CN=xx.com/[email protected]"
KEY_ID=`openssl pkcs8 -in key.pem -topk8 -nocrypt -outform DER | keyctl \
padd asymmetric 123 @s`
keyctl pkey_sign $KEY_ID 0 $RAWDATA enc=pkcs1 hash=sha1 > $SIGDATA keyctl pkey_verify $KEY_ID 0 $RAWDATA $SIGDATA enc=pkcs1 hash=sha1
Then the kernel reports:
WARNING: CPU: 5 PID: 344556 at crypto/rsa-pkcs1pad.c:540 pkcs1pad_verify+0x160/0x190 ... Call Trace: public_key_verify_signature+0x282/0x380 ? software_key_query+0x12d/0x180 ? keyctl_pkey_params_get+0xd6/0x130 asymmetric_key_verify_signature+0x66/0x80 keyctl_pkey_verify+0xa5/0x100 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae
The reason of this issue, in function 'asymmetric_key_verify_signature':
'.digest_size(u8) = params->in_len(u32)' leads overflow of an u8 value, so use u32 instead of u8 for digest_size field. And reorder struct public_key_signature, it saves 8 bytes on a 64-bit machine.
--- include/crypto/public_key.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/crypto/public_key.h +2 -2
@@ -39,9 +39,9 @@ extern void public_key_free(struct publistruct public_key_signature {struct asymmetric_key_id *auth_ids[2 ];u8 *s;/* Signature */ -u32 s_size;/* Number of bytes in signature */ u8 *digest; -u8 digest_size;/* Number of bytes in digest */ +u32 s_size;/* Number of bytes in signature */ +u32 digest_size;/* Number of bytes in digest */ const char *pkey_algo;const char *hash_algo;const char *encoding;
Greg Kroah-Hartman
maintainerPATCH 31/306 block: bfq: fix bfq_set_next_ioprio_data()
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
commit a680dd72ec336b81511e3bff48efac6dbfa563e7 upstream.
For a request that has a priority level equal to or larger than IOPRIO_BE_NR, bfq_set_next_ioprio_data() prints a critical warning but defaults to setting the request new_ioprio field to IOPRIO_BE_NR. This is not consistent with the warning and the allowed values for priority levels. Fix this by setting the request new_ioprio field to IOPRIO_BE_NR - 1, the lowest priority level allowed.
--- block/bfq-iosched.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/bfq-iosched.c +1 -1
@@ -5011,7 +5011,7 @@ bfq_set_next_ioprio_data(struct bfq_queuif (bfqq->new_ioprio >=IOPRIO_BE_NR ) {pr_crit ("bfq_set_next_ioprio_data: new_ioprio %d\n" , bfqq->new_ioprio); - bfqq->new_ioprio =IOPRIO_BE_NR ; + bfqq->new_ioprio =IOPRIO_BE_NR -1 ; } bfqq->entity.new_weight =bfq_ioprio_to_weight (bfqq->new_ioprio);
Greg Kroah-Hartman
maintainerPATCH 32/306 power: supply: max17042: handle fails of reading status register
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 54784ffa5b267f57161eb8fbb811499f22a0a0bf upstream.
Reading status register can fail in the interrupt handler. In such case, the regmap_read() will not store anything useful under passed 'val' variable and random stack value will be used to determine type of interrupt.
Handle the regmap_read() failure to avoid handling interrupt type and triggering changed power supply event based on random stack value.
--- drivers/power/supply/max17042_battery.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/power/supply/max17042_battery.c +5 -1
@@ -859,8 +859,12 @@ static irqreturn_t max17042_thread_handl {struct max17042_chip *chip = dev;u32 val; +int ret; + + ret =regmap_read (chip->regmap,MAX17042_STATUS , &val); +if (ret) +return IRQ_HANDLED ; -regmap_read (chip->regmap,MAX17042_STATUS , &val);if ((val &STATUS_INTR_SOCMIN_BIT ) || (val &STATUS_INTR_SOCMAX_BIT )) {dev_info (&chip->client->dev,"SOC threshold INTR\n" );
Greg Kroah-Hartman
maintainerPATCH 33/306 cpufreq: schedutil: Use kobject release() method to free sugov_tunables
In reply to Greg Kroah-HartmanFrom: Kevin Hao <[email protected]>
commit e5c6b312ce3cc97e90ea159446e6bfa06645364d upstream.
The struct sugov_tunables is protected by the kobject, so we can't free
it directly. Otherwise we would get a call trace like this:
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x30
WARNING: CPU: 3 PID: 720 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100 Modules linked in: CPU: 3 PID: 720 Comm: a.sh Tainted: G W 5.14.0-rc1-next-20210715-yocto-standard+ #507 Hardware name: Marvell OcteonTX CN96XX board (DT) pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--) pc : debug_print_object+0xb8/0x100 lr : debug_print_object+0xb8/0x100 sp : ffff80001ecaf910 x29: ffff80001ecaf910 x28: ffff00011b10b8d0 x27: ffff800011043d80 x26: ffff00011a8f0000 x25: ffff800013cb3ff0 x24: 0000000000000000 x23: ffff80001142aa68 x22: ffff800011043d80 x21: ffff00010de46f20 x20: ffff800013c0c520 x19: ffff800011d8f5b0 x18: 0000000000000010 x17: 6e6968207473696c x16: 5f72656d6974203a x15: 6570797420746365 x14: 6a626f2029302065 x13: 303378302f307830 x12: 2b6e665f72656d69 x11: ffff8000124b1560 x10: ffff800012331520 x9 : ffff8000100ca6b0 x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 0000000000000001 x5 : ffff800011d8c000 x4 : ffff800011d8c740 x3 : 0000000000000000 x2 : ffff0001108301c0 x1 : ab3c90eedf9c0f00 x0 : 0000000000000000 Call trace: debug_print_object+0xb8/0x100 __debug_check_no_obj_freed+0x1c0/0x230 debug_check_no_obj_freed+0x20/0x88 slab_free_freelist_hook+0x154/0x1c8 kfree+0x114/0x5d0 sugov_exit+0xbc/0xc0 cpufreq_exit_governor+0x44/0x90 cpufreq_set_policy+0x268/0x4a8 store_scaling_governor+0xe0/0x128 store+0xc0/0xf0 sysfs_kf_write+0x54/0x80 kernfs_fop_write_iter+0x128/0x1c0 new_sync_write+0xf0/0x190 vfs_write+0x2d4/0x478 ksys_write+0x74/0x100 __arm64_sys_write+0x24/0x30 invoke_syscall.constprop.0+0x54/0xe0 do_el0_svc+0x64/0x158 el0_svc+0x2c/0xb0 el0t_64_sync_handler+0xb0/0xb8 el0t_64_sync+0x198/0x19c irq event stamp: 5518 hardirqs last enabled at (5517): [<ffff8000100cbd7c>] console_unlock+0x554/0x6c8 hardirqs last disabled at (5518): [<ffff800010fc0638>] el1_dbg+0x28/0xa0 softirqs last enabled at (5504): [<ffff8000100106e0>] __do_softirq+0x4d0/0x6c0 softirqs last disabled at (5483): [<ffff800010049548>] irq_exit+0x1b0/0x1b8
So split the original sugov_tunables_free() into two functions, sugov_clear_global_tunables() is just used to clear the global_tunables and the new sugov_tunables_free() is used as kobj_type::release to release the sugov_tunables safely.
--- kernel/sched/cpufreq_schedutil.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
kernel/sched/cpufreq_schedutil.c +11 -5
@@ -610,9 +610,17 @@ static struct attribute *sugov_attrs[] = };ATTRIBUTE_GROUPS (sugov); +static void sugov_tunables_free (struct kobject *kobj) +{ + struct gov_attr_set *attr_set = container_of(kobj, struct gov_attr_set, kobj); + +kfree (to_sugov_tunables (attr_set)); +} +static struct kobj_type sugov_tunables_ktype = { .default_groups = sugov_groups, .sysfs_ops = &governor_sysfs_ops, + .release = &sugov_tunables_free, };/********************** cpufreq governor interface *********************/
@@ -712,12 +720,10 @@ static struct sugov_tunables *sugov_tunareturn tunables; } -static void sugov_tunables_free (struct sugov_tunables *tunables) +static void sugov_clear_global_tunables (void ) {if (!have_governor_per_policy ()) global_tunables =NULL ; - -kfree (tunables); }static int sugov_init (struct cpufreq_policy *policy)
@@ -780,7 +786,7 @@ out: fail:kobject_put (&tunables->attr_set.kobj); policy->governor_data =NULL ; -sugov_tunables_free (tunables); +sugov_clear_global_tunables (); stop_kthread:sugov_kthread_stop (sg_policy);
@@ -807,7 +813,7 @@ static void sugov_exit(struct cpufreq_po count =gov_attr_set_put (&tunables->attr_set, &sg_policy->tunables_hook); policy->governor_data =NULL ;if (!count) -sugov_tunables_free (tunables); +sugov_clear_global_tunables ();mutex_unlock (&global_tunables_lock);
Re: [PATCH 5.10 033/306] cpufreq: schedutil: Use kobject release() method to free sugov_tunables
Quoted 114 lines · Greg Kroah-Hartman
From: Kevin Hao <[email protected]>
commit
e5c6b312ce3cc97e90ea159446e6bfa06645364dupstream.The struct
sugov_tunablesis protected by the kobject, so we can't free it directly. Otherwise we would get a call trace like this:ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x30 WARNING: CPU: 3 PID: 720 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100 Modules linked in: CPU: 3 PID: 720 Comm: a.sh Tainted: G W 5.14.0-rc1-next-20210715-yocto-standard+ #507 Hardware name: Marvell OcteonTX CN96XX board (DT) pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--) pc : debug_print_object+0xb8/0x100 lr : debug_print_object+0xb8/0x100 sp : ffff80001ecaf910 x29: ffff80001ecaf910 x28: ffff00011b10b8d0 x27: ffff800011043d80 x26: ffff00011a8f0000 x25: ffff800013cb3ff0 x24: 0000000000000000 x23: ffff80001142aa68 x22: ffff800011043d80 x21: ffff00010de46f20 x20: ffff800013c0c520 x19: ffff800011d8f5b0 x18: 0000000000000010 x17: 6e6968207473696c x16: 5f72656d6974203a x15: 6570797420746365 x14: 6a626f2029302065 x13: 303378302f307830 x12: 2b6e665f72656d69 x11: ffff8000124b1560 x10: ffff800012331520 x9 : ffff8000100ca6b0 x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 0000000000000001 x5 : ffff800011d8c000 x4 : ffff800011d8c740 x3 : 0000000000000000 x2 : ffff0001108301c0 x1 : ab3c90eedf9c0f00 x0 : 0000000000000000 Call trace: debug_print_object+0xb8/0x100 __debug_check_no_obj_freed+0x1c0/0x230 debug_check_no_obj_freed+0x20/0x88 slab_free_freelist_hook+0x154/0x1c8 kfree+0x114/0x5d0 sugov_exit+0xbc/0xc0 cpufreq_exit_governor+0x44/0x90 cpufreq_set_policy+0x268/0x4a8 store_scaling_governor+0xe0/0x128 store+0xc0/0xf0 sysfs_kf_write+0x54/0x80 kernfs_fop_write_iter+0x128/0x1c0 new_sync_write+0xf0/0x190 vfs_write+0x2d4/0x478 ksys_write+0x74/0x100 __arm64_sys_write+0x24/0x30 invoke_syscall.constprop.0+0x54/0xe0 do_el0_svc+0x64/0x158 el0_svc+0x2c/0xb0 el0t_64_sync_handler+0xb0/0xb8 el0t_64_sync+0x198/0x19c irq event stamp: 5518 hardirqs last enabled at (5517): [<ffff8000100cbd7c>] console_unlock+0x554/0x6c8 hardirqs last disabled at (5518): [<ffff800010fc0638>] el1_dbg+0x28/0xa0 softirqs last enabled at (5504): [<ffff8000100106e0>] __do_softirq+0x4d0/0x6c0 softirqs last disabled at (5483): [<ffff800010049548>] irq_exit+0x1b0/0x1b8So split the original
sugov_tunables_free()into two functions,sugov_clear_global_tunables()is just used to clear theglobal_tunablesand the newsugov_tunables_free()is used askobj_type::releaseto release thesugov_tunablessafely.Fixes 9bdcb44e391d ("cpufreq: schedutil: New governor based on scheduler utilization data")Cc 4.7+ <[email protected]> # 4.7+Signed-off-by Kevin Hao <[email protected]>Acked-by Viresh Kumar <[email protected]>Signed-off-by Rafael J. Wysocki <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- kernel/sched/cpufreq_schedutil.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)kernel/sched/cpufreq_schedutil.c +10
-4@@ -610,9 +610,17 @@ static struct attribute *sugov_attrs[] = };ATTRIBUTE_GROUPS (sugov); +static void sugov_tunables_free (struct kobject *kobj) +{ + struct gov_attr_set *attr_set = container_of(kobj, struct gov_attr_set, kobj); + +kfree (to_sugov_tunables (attr_set)); +} +static struct kobj_type sugov_tunables_ktype = { .default_groups = sugov_groups, .sysfs_ops = &governor_sysfs_ops, + .release = &sugov_tunables_free, };/********************** cpufreq governor interface *********************/ @@ -712,12 +720,10 @@ static struct sugov_tunables *sugov_tunareturn tunables; } -static void sugov_tunables_free (struct sugov_tunables *tunables) +static void sugov_clear_global_tunables (void ) {if (!have_governor_per_policy ()) global_tunables =NULL ; - -kfree (tunables); }static int sugov_init (struct cpufreq_policy *policy)@@ -780,7 +786,7 @@ out: fail:kobject_put (&tunables->attr_set.kobj); policy->governor_data =NULL ; -sugov_tunables_free (tunables); +sugov_clear_global_tunables (); stop_kthread:sugov_kthread_stop (sg_policy);
kernel/sched/cpufreq_schedutil.c static void sugov_exit(struct cpufreq_po · line 819
Quoted 8 lines
kernel/sched/cpufreq_schedutil.c +1
-1@@ -807,7 +813,7 @@ static void sugov_exit(struct cpufreq_po count =gov_attr_set_put (&tunables->attr_set, &sg_policy->tunables_hook); policy->governor_data =NULL ;if (!count) -sugov_tunables_free (tunables); +sugov_clear_global_tunables ();mutex_unlock (&global_tunables_lock);
Please defer this one.
It uncovers a bug in cpufreq that needs to be fixed separately.
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 033/306] cpufreq: schedutil: Use kobject release() method to free sugov_tunables
Quoted 118 lines · Rafael J. Wysocki
Quoted 107 lines · Greg Kroah-Hartman
From: Kevin Hao <[email protected]>
commit
e5c6b312ce3cc97e90ea159446e6bfa06645364dupstream.The struct
sugov_tunablesis protected by the kobject, so we can't free it directly. Otherwise we would get a call trace like this:ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x30 WARNING: CPU: 3 PID: 720 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100 Modules linked in: CPU: 3 PID: 720 Comm: a.sh Tainted: G W 5.14.0-rc1-next-20210715-yocto-standard+ #507 Hardware name: Marvell OcteonTX CN96XX board (DT) pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--) pc : debug_print_object+0xb8/0x100 lr : debug_print_object+0xb8/0x100 sp : ffff80001ecaf910 x29: ffff80001ecaf910 x28: ffff00011b10b8d0 x27: ffff800011043d80 x26: ffff00011a8f0000 x25: ffff800013cb3ff0 x24: 0000000000000000 x23: ffff80001142aa68 x22: ffff800011043d80 x21: ffff00010de46f20 x20: ffff800013c0c520 x19: ffff800011d8f5b0 x18: 0000000000000010 x17: 6e6968207473696c x16: 5f72656d6974203a x15: 6570797420746365 x14: 6a626f2029302065 x13: 303378302f307830 x12: 2b6e665f72656d69 x11: ffff8000124b1560 x10: ffff800012331520 x9 : ffff8000100ca6b0 x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 0000000000000001 x5 : ffff800011d8c000 x4 : ffff800011d8c740 x3 : 0000000000000000 x2 : ffff0001108301c0 x1 : ab3c90eedf9c0f00 x0 : 0000000000000000 Call trace: debug_print_object+0xb8/0x100 __debug_check_no_obj_freed+0x1c0/0x230 debug_check_no_obj_freed+0x20/0x88 slab_free_freelist_hook+0x154/0x1c8 kfree+0x114/0x5d0 sugov_exit+0xbc/0xc0 cpufreq_exit_governor+0x44/0x90 cpufreq_set_policy+0x268/0x4a8 store_scaling_governor+0xe0/0x128 store+0xc0/0xf0 sysfs_kf_write+0x54/0x80 kernfs_fop_write_iter+0x128/0x1c0 new_sync_write+0xf0/0x190 vfs_write+0x2d4/0x478 ksys_write+0x74/0x100 __arm64_sys_write+0x24/0x30 invoke_syscall.constprop.0+0x54/0xe0 do_el0_svc+0x64/0x158 el0_svc+0x2c/0xb0 el0t_64_sync_handler+0xb0/0xb8 el0t_64_sync+0x198/0x19c irq event stamp: 5518 hardirqs last enabled at (5517): [<ffff8000100cbd7c>] console_unlock+0x554/0x6c8 hardirqs last disabled at (5518): [<ffff800010fc0638>] el1_dbg+0x28/0xa0 softirqs last enabled at (5504): [<ffff8000100106e0>] __do_softirq+0x4d0/0x6c0 softirqs last disabled at (5483): [<ffff800010049548>] irq_exit+0x1b0/0x1b8So split the original
sugov_tunables_free()into two functions,sugov_clear_global_tunables()is just used to clear theglobal_tunablesand the newsugov_tunables_free()is used askobj_type::releaseto release thesugov_tunablessafely.Fixes 9bdcb44e391d ("cpufreq: schedutil: New governor based on scheduler utilization data")Cc 4.7+ <[email protected]> # 4.7+Signed-off-by Kevin Hao <[email protected]>Acked-by Viresh Kumar <[email protected]>Signed-off-by Rafael J. Wysocki <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- kernel/sched/cpufreq_schedutil.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)kernel/sched/cpufreq_schedutil.c +10
-4@@ -610,9 +610,17 @@ static struct attribute *sugov_attrs[] = };ATTRIBUTE_GROUPS (sugov); +static void sugov_tunables_free (struct kobject *kobj) +{ + struct gov_attr_set *attr_set = container_of(kobj, struct gov_attr_set, kobj); + +kfree (to_sugov_tunables (attr_set)); +} +static struct kobj_type sugov_tunables_ktype = { .default_groups = sugov_groups, .sysfs_ops = &governor_sysfs_ops, + .release = &sugov_tunables_free, };/********************** cpufreq governor interface *********************/ @@ -712,12 +720,10 @@ static struct sugov_tunables *sugov_tunareturn tunables; } -static void sugov_tunables_free (struct sugov_tunables *tunables) +static void sugov_clear_global_tunables (void ) {if (!have_governor_per_policy ()) global_tunables =NULL ; - -kfree (tunables); }static int sugov_init (struct cpufreq_policy *policy)@@ -780,7 +786,7 @@ out: fail:kobject_put (&tunables->attr_set.kobj); policy->governor_data =NULL ; -sugov_tunables_free (tunables); +sugov_clear_global_tunables (); stop_kthread:sugov_kthread_stop (sg_policy);kernel/sched/cpufreq_schedutil.c static void sugov_exit(struct cpufreq_po · line 819
Quoted 8 lines
kernel/sched/cpufreq_schedutil.c +1
-1@@ -807,7 +813,7 @@ static void sugov_exit(struct cpufreq_po count =gov_attr_set_put (&tunables->attr_set, &sg_policy->tunables_hook); policy->governor_data =NULL ;if (!count) -sugov_tunables_free (tunables); +sugov_clear_global_tunables ();mutex_unlock (&global_tunables_lock);Please defer this one.
Quoted 1 line
It uncovers a bug in cpufreq that needs to be fixed separately.
Now dropped from all queues, thanks!
greg k-h
Re: [PATCH 5.10 033/306] cpufreq: schedutil: Use kobject release() method to free sugov_tunables
Quoted 119 lines · Greg Kroah-Hartman
Quoted 118 lines · Rafael J. Wysocki
Quoted 107 lines · Greg Kroah-Hartman
From: Kevin Hao <[email protected]>
commit
e5c6b312ce3cc97e90ea159446e6bfa06645364dupstream.The struct
sugov_tunablesis protected by the kobject, so we can't free it directly. Otherwise we would get a call trace like this:ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x30 WARNING: CPU: 3 PID: 720 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100 Modules linked in: CPU: 3 PID: 720 Comm: a.sh Tainted: G W 5.14.0-rc1-next-20210715-yocto-standard+ #507 Hardware name: Marvell OcteonTX CN96XX board (DT) pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--) pc : debug_print_object+0xb8/0x100 lr : debug_print_object+0xb8/0x100 sp : ffff80001ecaf910 x29: ffff80001ecaf910 x28: ffff00011b10b8d0 x27: ffff800011043d80 x26: ffff00011a8f0000 x25: ffff800013cb3ff0 x24: 0000000000000000 x23: ffff80001142aa68 x22: ffff800011043d80 x21: ffff00010de46f20 x20: ffff800013c0c520 x19: ffff800011d8f5b0 x18: 0000000000000010 x17: 6e6968207473696c x16: 5f72656d6974203a x15: 6570797420746365 x14: 6a626f2029302065 x13: 303378302f307830 x12: 2b6e665f72656d69 x11: ffff8000124b1560 x10: ffff800012331520 x9 : ffff8000100ca6b0 x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 0000000000000001 x5 : ffff800011d8c000 x4 : ffff800011d8c740 x3 : 0000000000000000 x2 : ffff0001108301c0 x1 : ab3c90eedf9c0f00 x0 : 0000000000000000 Call trace: debug_print_object+0xb8/0x100 __debug_check_no_obj_freed+0x1c0/0x230 debug_check_no_obj_freed+0x20/0x88 slab_free_freelist_hook+0x154/0x1c8 kfree+0x114/0x5d0 sugov_exit+0xbc/0xc0 cpufreq_exit_governor+0x44/0x90 cpufreq_set_policy+0x268/0x4a8 store_scaling_governor+0xe0/0x128 store+0xc0/0xf0 sysfs_kf_write+0x54/0x80 kernfs_fop_write_iter+0x128/0x1c0 new_sync_write+0xf0/0x190 vfs_write+0x2d4/0x478 ksys_write+0x74/0x100 __arm64_sys_write+0x24/0x30 invoke_syscall.constprop.0+0x54/0xe0 do_el0_svc+0x64/0x158 el0_svc+0x2c/0xb0 el0t_64_sync_handler+0xb0/0xb8 el0t_64_sync+0x198/0x19c irq event stamp: 5518 hardirqs last enabled at (5517): [<ffff8000100cbd7c>] console_unlock+0x554/0x6c8 hardirqs last disabled at (5518): [<ffff800010fc0638>] el1_dbg+0x28/0xa0 softirqs last enabled at (5504): [<ffff8000100106e0>] __do_softirq+0x4d0/0x6c0 softirqs last disabled at (5483): [<ffff800010049548>] irq_exit+0x1b0/0x1b8So split the original
sugov_tunables_free()into two functions,sugov_clear_global_tunables()is just used to clear theglobal_tunablesand the newsugov_tunables_free()is used askobj_type::releaseto release thesugov_tunablessafely.Fixes 9bdcb44e391d ("cpufreq: schedutil: New governor based on scheduler utilization data")Cc 4.7+ <[email protected]> # 4.7+Signed-off-by Kevin Hao <[email protected]>Acked-by Viresh Kumar <[email protected]>Signed-off-by Rafael J. Wysocki <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- kernel/sched/cpufreq_schedutil.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)kernel/sched/cpufreq_schedutil.c +10
-4@@ -610,9 +610,17 @@ static struct attribute *sugov_attrs[] = };ATTRIBUTE_GROUPS (sugov); +static void sugov_tunables_free (struct kobject *kobj) +{ + struct gov_attr_set *attr_set = container_of(kobj, struct gov_attr_set, kobj); + +kfree (to_sugov_tunables (attr_set)); +} +static struct kobj_type sugov_tunables_ktype = { .default_groups = sugov_groups, .sysfs_ops = &governor_sysfs_ops, + .release = &sugov_tunables_free, };/********************** cpufreq governor interface *********************/ @@ -712,12 +720,10 @@ static struct sugov_tunables *sugov_tunareturn tunables; } -static void sugov_tunables_free (struct sugov_tunables *tunables) +static void sugov_clear_global_tunables (void ) {if (!have_governor_per_policy ()) global_tunables =NULL ; - -kfree (tunables); }static int sugov_init (struct cpufreq_policy *policy)@@ -780,7 +786,7 @@ out: fail:kobject_put (&tunables->attr_set.kobj); policy->governor_data =NULL ; -sugov_tunables_free (tunables); +sugov_clear_global_tunables (); stop_kthread:sugov_kthread_stop (sg_policy);kernel/sched/cpufreq_schedutil.c static void sugov_exit(struct cpufreq_po · line 819
Quoted 8 lines
kernel/sched/cpufreq_schedutil.c +1
-1@@ -807,7 +813,7 @@ static void sugov_exit(struct cpufreq_po count =gov_attr_set_put (&tunables->attr_set, &sg_policy->tunables_hook); policy->governor_data =NULL ;if (!count) -sugov_tunables_free (tunables); +sugov_clear_global_tunables ();mutex_unlock (&global_tunables_lock);Please defer this one.
Quoted 6 lines
Quoted 1 line
It uncovers a bug in cpufreq that needs to be fixed separately.
Now dropped from all queues, thanks!
greg k-h
Hi Greg,
I am trying to get familiar with stable release process, because we would like to start testing stable release candidates. But I cannot get all the nuances how to get automatically information regarding rc code ready to be tested.
Also I wonder how we could automatically detect situations when stable release is expected to became diverged from the rc, e.g. like [PATCH 5.10 033/306] cpufreq: schedutil: Use kobject release() method to free sugov_tunables
was dropped from 5.10.67 without announcing the 5.10.67-rc2?
Any suggestions are appreciated.
Best regards,
Alexey Khoroshilov,
Linux Verification Center, ISPRAS
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 033/306] cpufreq: schedutil: Use kobject release() method to free sugov_tunables
Quoted 6 lines · Alexey Khoroshilov
Hi Greg,
I am trying to get familiar with stable release process, because we would like to start testing stable release candidates. But I cannot get all the nuances how to get automatically information regarding rc code ready to be tested.
You might want to start a new thread and not bury it down in a response to a specific commit in order to make sure that people see it.
What specifically have you tried that did not work for detecting the -rc releases?
Quoted 5 lines
Also I wonder how we could automatically detect situations when stable release is expected to became diverged from the rc, e.g. like [PATCH 5.10 033/306] cpufreq: schedutil: Use kobject
release()method to freesugov_tunables
was dropped from 5.10.67 without announcing the 5.10.67-rc2?
Look at the stable queue tree, that has all of the information in it, right?
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 34/306 dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()
In reply to Greg Kroah-HartmanFrom: Arne Welzel <[email protected]>
commit 528b16bfc3ae5f11638e71b3b63a81f9999df727 upstream.
On systems with many cores using dm-crypt, heavy spinlock contention in percpu_counter_compare() can be observed when the page allocation limit for a given device is reached or close to be reached. This is due to percpu_counter_compare() taking a spinlock to compute an exact result on potentially many CPUs at the same time.
Switch to non-exact comparison of allocated and allowed pages by using the value returned by percpu_counter_read_positive() to avoid taking the percpu_counter spinlock.
This may over/under estimate the actual number of allocated pages by at most (batch-1) * num_online_cpus().
Currently, batch is bounded by 32. The system on which this issue was first observed has 256 CPUs and 512GB of RAM. With a 4k page size, this change may over/under estimate by 31MB. With ~10G (2%) allowed dm-crypt allocations, this seems an acceptable error. Certainly preferred over running into the spinlock contention.
This behavior was reproduced on an EC2 c5.24xlarge instance with 96 CPUs and 192GB RAM as follows, but can be provoked on systems with less CPUs as well.
* Disable swap
* Tune vm settings to promote regular writeback
$ echo 50 > /proc/sys/vm/dirty_expire_centisecs
$ echo 25 > /proc/sys/vm/dirty_writeback_centisecs
$ echo $((128 * 1024 * 1024)) > /proc/sys/vm/dirty_background_bytes * Create 8 dmcrypt devices based on files on a tmpfs
* Create and mount an ext4 filesystem on each crypt devices
* Run stress-ng --hdd 8 within one of above filesystems
Total %system usage collected from sysstat goes to ~35%. Write throughput on the underlying loop device is ~2GB/s. perf profiling an individual kworker kcryptd thread shows the following profile, indicating spinlock contention in percpu_counter_compare():
99.98% 0.00% kworker/u193:46 [kernel.kallsyms] [k] ret_from_fork
|
--ret_from_fork
kthread
worker_thread
|
--99.92%--process_one_work
|
|--80.52%--kcryptd_crypt
| |
| |--62.58%--mempool_alloc
| | |
| | --62.24%--crypt_page_alloc
| | |
| | --61.51%--__percpu_counter_compare
| | |
| | --61.34%--__percpu_counter_sum
| | |
| | |--58.68%--_raw_spin_lock_irqsave
| | | |
| | | --58.30%--native_queued_spin_lock_slowpath
| | |
| | --0.69%--cpumask_next
| | |
| | --0.51%--_find_next_bit
| |
| |--10.61%--crypt_convert
| | |
| | |--6.05%--xts_crypt
...After applying this patch and running the same test, %system usage is lowered to ~7% and write throughput on the loop device increases to ~2.7GB/s. perf report shows mempool_alloc() as ~8% rather than ~62% in the profile and not hitting the percpu_counter() spinlock anymore.
|--8.15%--mempool_alloc
| |
| |--3.93%--crypt_page_alloc
| | |
| | --3.75%--__alloc_pages
| | |
| | --3.62%--get_page_from_freelist
| | |
| | --3.22%--rmqueue_bulk
| | |
| | --2.59%--_raw_spin_lock
| | |
| | --2.57%--native_queued_spin_lock_slowpath
| |
| --3.05%--_raw_spin_lock_irqsave
| |
| --2.49%--native_queued_spin_lock_slowpath--- drivers/md/dm-crypt.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/md/dm-crypt.c +6 -1
@@ -2643,7 +2643,12 @@ static void *crypt_page_alloc(gfp_t gfp_struct crypt_config *cc = pool_data;struct page *page; -if (unlikely (percpu_counter_compare (&cc->n_allocated_pages, dm_crypt_pages_per_client) >=0 ) && +/* +* Note, percpu_counter_read_positive() may over (and under) estimate +* the current usage by at most (batch - 1) * num_online_cpus() pages, +* but avoids potential spinlock contention of an exact result. +*/ +if (unlikely (percpu_counter_read_positive (&cc->n_allocated_pages) >= dm_crypt_pages_per_client) &&likely (gfp_mask & __GFP_NORETRY))return NULL ;
Greg Kroah-Hartman
maintainerPATCH 35/306 crypto: ccp - shutdown SEV firmware on kexec
In reply to Greg Kroah-HartmanFrom: Brijesh Singh <[email protected]>
commit 5441a07a127f106c9936e4f9fa1a8a93e3f31828 upstream.
The commit 97f9ac3db6612 ("crypto: ccp - Add support for SEV-ES to the PSP driver") added support to allocate Trusted Memory Region (TMR) used during the SEV-ES firmware initialization. The TMR gets locked during the firmware initialization and unlocked during the shutdown. While the TMR is locked, access to it is disallowed.
Currently, the CCP driver does not shutdown the firmware during the kexec reboot, leaving the TMR memory locked.
Register a callback to shutdown the SEV firmware on the kexec boot.
--- drivers/crypto/ccp/sev-dev.c | 49 ++++++++++++++++++++----------------------- drivers/crypto/ccp/sp-pci.c | 12 ++++++++++ 2 files changed, 35 insertions(+), 26 deletions(-)
drivers/crypto/ccp/sev-dev.c +23 -26
@@ -278,6 +278,9 @@ static int __sev_platform_shutdown_lockestruct sev_device *sev = psp_master->sev_data;int ret; +if (sev->state ==SEV_STATE_UNINIT ) +return 0 ; + ret =__sev_do_cmd_locked (SEV_CMD_SHUTDOWN ,NULL , error);if (ret)return ret;
@@ -1018,6 +1021,20 @@ e_err:return ret; } +static void sev_firmware_shutdown (struct sev_device *sev) +{ +sev_platform_shutdown (NULL ); + +if (sev_es_tmr) { +/* The TMR area was encrypted, flush it from the cache */ +wbinvd_on_all_cpus (); + +free_pages ((unsigned long )sev_es_tmr, +get_order (SEV_ES_TMR_SIZE )); + sev_es_tmr =NULL ; + } +} +void sev_dev_destroy (struct psp_device *psp) {struct sev_device *sev = psp->sev_data;
@@ -1025,6 +1042,8 @@ void sev_dev_destroy(struct psp_device *if (!sev)return ; +sev_firmware_shutdown (sev); +if (sev->misc)kref_put (&misc_dev->refcount, sev_exit);
@@ -1055,21 +1074,6 @@ void sev_pci_init(void)if (sev_get_api_version ()) goto err; -/* -* If platform is not in UNINIT state then firmware upgrade and/or -* platform INIT command will fail. These command require UNINIT state. -* -* In a normal boot we should never run into case where the firmware -* is not in UNINIT state on boot. But in case of kexec boot, a reboot -* may not go through a typical shutdown sequence and may leave the -* firmware in INIT or WORKING state. -*/ - -if (sev->state !=SEV_STATE_UNINIT ) { -sev_platform_shutdown (NULL ); - sev->state =SEV_STATE_UNINIT ; - } -if (sev_version_greater_or_equal (0 ,15 ) &&sev_update_firmware (sev->dev) ==0 )sev_get_api_version ();
@@ -1114,17 +1118,10 @@ err:void sev_pci_exit (void ) { -if (!psp_master->sev_data) -return ; - -sev_platform_shutdown (NULL ); +struct sev_device *sev = psp_master->sev_data; -if (sev_es_tmr) { -/* The TMR area was encrypted, flush it from the cache */ -wbinvd_on_all_cpus (); +if (!sev) +return ; -free_pages ((unsigned long )sev_es_tmr, -get_order (SEV_ES_TMR_SIZE )); - sev_es_tmr =NULL ; - } +sev_firmware_shutdown (sev); }
drivers/crypto/ccp/sp-pci.c +12 -0
@@ -241,6 +241,17 @@ e_err:return ret; } +static void sp_pci_shutdown (struct pci_dev *pdev) +{ +struct device *dev = &pdev->dev; +struct sp_device *sp =dev_get_drvdata (dev); + +if (!sp) +return ; + +sp_destroy (sp); +} +static void sp_pci_remove (struct pci_dev *pdev) {struct device *dev = &pdev->dev;
@@ -370,6 +381,7 @@ static struct pci_driver sp_pci_driver = .id_table = sp_pci_table, .probe = sp_pci_probe, .remove = sp_pci_remove, + .shutdown = sp_pci_shutdown, .driver.pm = &sp_pci_pm_ops, };
Greg Kroah-Hartman
maintainerPATCH 36/306 VMCI: fix NULL pointer dereference when unmapping queue pair
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
commit a30dc6cf0dc51419021550152e435736aaef8799 upstream.
I got a NULL pointer dereference report when doing fuzz test:
Call Trace: qp_release_pages+0xae/0x130 qp_host_unregister_user_memory.isra.25+0x2d/0x80 vmci_qp_broker_unmap+0x191/0x320 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 vmci_host_unlocked_ioctl+0x59f/0xd50 ? do_vfs_ioctl+0x14b/0xa10 ? tomoyo_file_ioctl+0x28/0x30 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 __x64_sys_ioctl+0xea/0x120 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae
When a queue pair is created by the following call, it will not register the user memory if the page_store is NULL, and the entry->state will be set to VMCIQPB_CREATED_NO_MEM.
vmci_host_unlocked_ioctl
vmci_host_do_alloc_queuepair
vmci_qp_broker_alloc
qp_broker_alloc
qp_broker_create // set entry->state = VMCIQPB_CREATED_NO_MEM;When unmapping this queue pair, qp_host_unregister_user_memory() will be called to unregister the non-existent user memory, which will result in a null pointer reference. It will also change VMCIQPB_CREATED_NO_MEM to VMCIQPB_CREATED_MEM, which should not be present in this operation.
Only when the qp broker has mem, it can unregister the user memory when unmapping the qp broker.
Only when the qp broker has no mem, it can register the user memory when mapping the qp broker.
--- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/misc/vmw_vmci/vmci_queue_pair.c +4 -2
@@ -2238,7 +2238,8 @@ int vmci_qp_broker_map(struct vmci_handl result =VMCI_SUCCESS ; -if (context_id !=VMCI_HOST_CONTEXT_ID ) { +if (context_id !=VMCI_HOST_CONTEXT_ID && + !QPBROKERSTATE_HAS_MEM (entry)) {struct vmci_qp_page_store page_store; page_store.pages = guest_mem;
@@ -2345,7 +2346,8 @@ int vmci_qp_broker_unmap(struct vmci_han goto out; } -if (context_id !=VMCI_HOST_CONTEXT_ID ) { +if (context_id !=VMCI_HOST_CONTEXT_ID && +QPBROKERSTATE_HAS_MEM (entry)) {qp_acquire_queue_mutex (entry->produce_q); result =qp_save_headers (entry);if (result <VMCI_SUCCESS )
Greg Kroah-Hartman
maintainerPATCH 37/306 media: uvc: dont do DMA on stack
In reply to Greg Kroah-HartmanFrom: Mauro Carvalho Chehab <[email protected]>
commit 1a10d7fdb6d0e235e9d230916244cc2769d3f170 upstream.
As warned by smatch:
drivers/media/usb/uvc/uvc_v4l2.c:911 uvc_ioctl_g_input() error: doing dma on the stack (&i) drivers/media/usb/uvc/uvc_v4l2.c:943 uvc_ioctl_s_input() error: doing dma on the stack (&i)
those two functions call uvc_query_ctrl passing a pointer to a data at the DMA stack. those are used to send URBs via usb_control_msg(). Using DMA stack is not supported and should not work anymore on modern Linux versions.
So, use a kmalloc'ed buffer.
--- drivers/media/usb/uvc/uvc_v4l2.c | 34 +++++++++++++++++++++++----------- 1 file changed, 23 insertions(+), 11 deletions(-)
drivers/media/usb/uvc/uvc_v4l2.c +23 -11
@@ -898,8 +898,8 @@ static int uvc_ioctl_g_input(struct file {struct uvc_fh *handle = fh;struct uvc_video_chain *chain = handle->chain; +u8 *buf;int ret; -u8 i;if (chain->selector ==NULL || (chain->dev->quirks &UVC_QUIRK_IGNORE_SELECTOR_UNIT )) {
@@ -907,22 +907,27 @@ static int uvc_ioctl_g_input(struct filereturn 0 ; } + buf =kmalloc (1 ,GFP_KERNEL ); +if (!buf) +return -ENOMEM ; + ret =uvc_query_ctrl (chain->dev,UVC_GET_CUR , chain->selector->id, chain->dev->intfnum,UVC_SU_INPUT_SELECT_CONTROL , - &i,1 ); -if (ret <0 ) -return ret; + buf,1 ); +if (!ret) + *input = *buf -1 ; - *input = i -1 ; -return 0 ; +kfree (buf); + +return ret; }static int uvc_ioctl_s_input (struct file *file,void *fh,unsigned int input) {struct uvc_fh *handle = fh;struct uvc_video_chain *chain = handle->chain; +u8 *buf;int ret; -u32 i; ret =uvc_acquire_privileges (handle);if (ret <0 )
@@ -938,10 +943,17 @@ static int uvc_ioctl_s_input(struct fileif (input >= chain->selector->bNrInPins)return -EINVAL ; - i = input +1 ; -return uvc_query_ctrl (chain->dev,UVC_SET_CUR , chain->selector->id, - chain->dev->intfnum,UVC_SU_INPUT_SELECT_CONTROL , - &i,1 ); + buf =kmalloc (1 ,GFP_KERNEL ); +if (!buf) +return -ENOMEM ; + + *buf = input +1 ; + ret =uvc_query_ctrl (chain->dev,UVC_SET_CUR , chain->selector->id, + chain->dev->intfnum,UVC_SU_INPUT_SELECT_CONTROL , + buf,1 ); +kfree (buf); + +return ret; } static int uvc_ioctl_queryctrl(struct file *file, void *fh,
Greg Kroah-Hartman
maintainerPATCH 38/306 media: rc-loopback: return number of emitters rather than error
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit 6b7f554be8c92319d7e6df92fd247ebb9beb4a45 upstream.
The LIRC_SET_TRANSMITTER_MASK ioctl should return the number of emitters if an invalid list was set.
--- drivers/media/rc/rc-loopback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/rc/rc-loopback.c +1 -1
@@ -42,7 +42,7 @@ static int loop_set_tx_mask(struct rc_deif ((mask & (RXMASK_REGULAR |RXMASK_LEARNING )) != mask) {dprintk ("invalid tx mask: %u\n" , mask); -return -EINVAL ; +return 2 ; }dprintk ("setting tx mask: %u\n" , mask);
Greg Kroah-Hartman
maintainerPATCH 39/306 s390/qdio: fix roll-back after timeout on ESTABLISH ccw
In reply to Greg Kroah-HartmanFrom: Julian Wiedmann <[email protected]>
commit 2c197870e4701610ec3b1143808d4e31152caf30 upstream.
When qdio_establish() times out while waiting for the ESTABLISH ccw to complete, it calls qdio_shutdown() to roll back all of its previous actions. But at this point the qdio_irq's state is still QDIO_IRQ_STATE_INACTIVE, so qdio_shutdown() will exit immediately without doing any actual work.
Which means that eg. the qdio_irq's thinint-indicator stays registered, and cdev->handler isn't restored to its old value. And since commit 954d6235be41 ("s390/qdio: make thinint registration symmetric") the qdio_irq also stays on the tiq_list, so on the next qdio_establish() we might get a helpful BUG from the list-debugging code:
...
[ 4633.512591] list_add double add: new=00000000005a4110, prev=00000001b357db78, next=00000000005a4110. [ 4633.512621] ------------[ cut here ]------------ [ 4633.512623] kernel BUG at lib/list_debug.c:29! ... [ 4633.512796] [<00000001b2c6ee9a>] __list_add_valid+0x82/0xa0 [ 4633.512798] ([<00000001b2c6ee96>] __list_add_valid+0x7e/0xa0) [ 4633.512800] [<00000001b2fcecce>] qdio_establish_thinint+0x116/0x190 [ 4633.512805] [<00000001b2fcbe58>] qdio_establish+0x128/0x498
...
Fix this by extracting a goto-chain from the existing error exits in qdio_establish(), and check the return value of the wait_event_...() to detect the timeout condition.
--- drivers/s390/cio/qdio_main.c | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-)
drivers/s390/cio/qdio_main.c +19 -12
@@ -1243,6 +1243,7 @@ int qdio_establish(struct ccw_device *cd {struct qdio_irq *irq_ptr = cdev->private->qdio_data;struct subchannel_id schid; +long timeout;int rc;ccw_device_get_schid (cdev, &schid);
@@ -1268,11 +1269,8 @@ int qdio_establish(struct ccw_device *cdqdio_setup_irq (irq_ptr, init_data); rc =qdio_establish_thinint (irq_ptr); -if (rc) { -qdio_shutdown_irq (irq_ptr); -mutex_unlock (&irq_ptr->setup_mutex); -return rc; - } +if (rc) + goto err_thinint;/* establish q */ irq_ptr->ccw.cmd_code = irq_ptr->equeue.cmd;
@@ -1288,15 +1286,16 @@ int qdio_establish(struct ccw_device *cdif (rc) {DBF_ERROR ("%4x est IO ERR" , irq_ptr->schid.sch_no);DBF_ERROR ("rc:%4x" , rc); -qdio_shutdown_thinint (irq_ptr); -qdio_shutdown_irq (irq_ptr); -mutex_unlock (&irq_ptr->setup_mutex); -return rc; + goto err_ccw_start; } -wait_event_interruptible_timeout (cdev->private->wait_q, - irq_ptr->state ==QDIO_IRQ_STATE_ESTABLISHED || - irq_ptr->state ==QDIO_IRQ_STATE_ERR ,HZ ); + timeout =wait_event_interruptible_timeout (cdev->private->wait_q, + irq_ptr->state ==QDIO_IRQ_STATE_ESTABLISHED || + irq_ptr->state ==QDIO_IRQ_STATE_ERR ,HZ ); +if (timeout <=0 ) { + rc = (timeout == -ERESTARTSYS ) ? -EINTR : -ETIME ; + goto err_ccw_timeout; + }if (irq_ptr->state !=QDIO_IRQ_STATE_ESTABLISHED ) {mutex_unlock (&irq_ptr->setup_mutex);
@@ -1315,6 +1314,14 @@ int qdio_establish(struct ccw_device *cdqdio_print_subchannel_info (irq_ptr);qdio_setup_debug_entries (irq_ptr);return 0 ; + +err_ccw_timeout: +err_ccw_start: +qdio_shutdown_thinint (irq_ptr); +err_thinint: +qdio_shutdown_irq (irq_ptr); +mutex_unlock (&irq_ptr->setup_mutex); +return rc; }EXPORT_SYMBOL_GPL (qdio_establish);
Greg Kroah-Hartman
maintainerPATCH 40/306 s390/qdio: cancel the ESTABLISH ccw after timeout
In reply to Greg Kroah-HartmanFrom: Julian Wiedmann <[email protected]>
commit 1c1dc8bda3a05c60877a6649775894db5343bdea upstream.
When the ESTABLISH ccw does not complete within the specified timeout, try our best to cancel the ccw program that is still active on the device. Otherwise the IO subsystem might be accessing it even after the driver eg. called qdio_free().
--- drivers/s390/cio/qdio_main.c | 51 +++++++++++++++++++++++++------------------ 1 file changed, 30 insertions(+), 21 deletions(-)
drivers/s390/cio/qdio_main.c +30 -21
@@ -1025,6 +1025,33 @@ static void qdio_shutdown_queues(struct } } +static int qdio_cancel_ccw (struct qdio_irq *irq,int how) +{ +struct ccw_device *cdev = irq->cdev; +int rc; + +spin_lock_irq (get_ccwdev_lock (cdev)); +qdio_set_state (irq,QDIO_IRQ_STATE_CLEANUP ); +if (how &QDIO_FLAG_CLEANUP_USING_CLEAR ) + rc =ccw_device_clear (cdev,QDIO_DOING_CLEANUP ); +else +/* default behaviour is halt */ + rc =ccw_device_halt (cdev,QDIO_DOING_CLEANUP ); +spin_unlock_irq (get_ccwdev_lock (cdev)); +if (rc) { +DBF_ERROR ("%4x SHUTD ERR" , irq->schid.sch_no); +DBF_ERROR ("rc:%4d" , rc); +return rc; + } + +wait_event_interruptible_timeout (cdev->private->wait_q, + irq->state ==QDIO_IRQ_STATE_INACTIVE || + irq->state ==QDIO_IRQ_STATE_ERR , +10 *HZ ); + +return 0 ; +} +/** * qdio_shutdown - shut down a qdio subchannel * @cdev: associated ccw device
@@ -1063,27 +1090,7 @@ int qdio_shutdown(struct ccw_device *cdeqdio_shutdown_queues (irq_ptr);qdio_shutdown_debug_entries (irq_ptr); -/* cleanup subchannel */ -spin_lock_irq (get_ccwdev_lock (cdev)); -qdio_set_state (irq_ptr,QDIO_IRQ_STATE_CLEANUP ); -if (how &QDIO_FLAG_CLEANUP_USING_CLEAR ) - rc =ccw_device_clear (cdev,QDIO_DOING_CLEANUP ); -else -/* default behaviour is halt */ - rc =ccw_device_halt (cdev,QDIO_DOING_CLEANUP ); -spin_unlock_irq (get_ccwdev_lock (cdev)); -if (rc) { -DBF_ERROR ("%4x SHUTD ERR" , irq_ptr->schid.sch_no); -DBF_ERROR ("rc:%4d" , rc); - goto no_cleanup; - } - -wait_event_interruptible_timeout (cdev->private->wait_q, - irq_ptr->state ==QDIO_IRQ_STATE_INACTIVE || - irq_ptr->state ==QDIO_IRQ_STATE_ERR , -10 *HZ ); - -no_cleanup: + rc =qdio_cancel_ccw (irq_ptr, how);qdio_shutdown_thinint (irq_ptr);qdio_shutdown_irq (irq_ptr);
@@ -1316,10 +1323,12 @@ int qdio_establish(struct ccw_device *cdreturn 0 ; err_ccw_timeout: +qdio_cancel_ccw (irq_ptr,QDIO_FLAG_CLEANUP_USING_CLEAR ); err_ccw_start:qdio_shutdown_thinint (irq_ptr); err_thinint:qdio_shutdown_irq (irq_ptr); +qdio_set_state (irq_ptr,QDIO_IRQ_STATE_INACTIVE );mutex_unlock (&irq_ptr->setup_mutex);return rc; }
Greg Kroah-Hartman
maintainerPATCH 41/306 Revert "dmaengine: imx-sdma: refine to load context only once"
In reply to Greg Kroah-HartmanFrom: Robin Gong <[email protected]>
commit 8592f02464d52776c5cfae4627c6413b0ae7602d upstream.
This reverts commit ad0d92d7ba6aecbe2705907c38ff8d8be4da1e9c, because in spi-imx case, burst length may be changed dynamically.
--- drivers/dma/imx-sdma.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/dma/imx-sdma.c +0 -8
@@ -379,7 +379,6 @@ struct sdma_channel {unsigned long watermark_level;u32 shp_addr, per_addr;enum dma_status status; -bool context_loaded;struct imx_dma_data data;struct work_struct terminate_worker; };
@@ -985,9 +984,6 @@ static int sdma_load_context(struct sdmaint ret;unsigned long flags; -if (sdmac->context_loaded) -return 0 ; -if (sdmac->direction ==DMA_DEV_TO_MEM ) load_address = sdmac->pc_from_device;else if (sdmac->direction ==DMA_DEV_TO_DEV )
@@ -1030,8 +1026,6 @@ static int sdma_load_context(struct sdmaspin_unlock_irqrestore (&sdma->channel_0_lock, flags); - sdmac->context_loaded = true; -return ret; }
@@ -1070,7 +1064,6 @@ static void sdma_channel_terminate_work(vchan_get_all_descriptors (&sdmac->vc, &head);spin_unlock_irqrestore (&sdmac->vc.lock, flags);vchan_dma_desc_free_list (&sdmac->vc, &head); - sdmac->context_loaded = false; }static int sdma_terminate_all (struct dma_chan *chan)
@@ -1338,7 +1331,6 @@ static void sdma_free_chan_resources(str sdmac->event_id0 =0 ; sdmac->event_id1 =0 ; - sdmac->context_loaded = false;sdma_set_channel_priority (sdmac,0 );
Greg Kroah-Hartman
maintainerPATCH 42/306 dmaengine: imx-sdma: remove duplicated sdma_load_context
In reply to Greg Kroah-HartmanFrom: Robin Gong <[email protected]>
commit e555a03b112838883fdd8185d613c35d043732f2 upstream.
Since sdma_transfer_init() will do sdma_load_context before any sdma transfer, no need once more in sdma_config_channel().
--- drivers/dma/imx-sdma.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/dma/imx-sdma.c +1 -4
@@ -1138,7 +1138,6 @@ static void sdma_set_watermarklevel_for_static int sdma_config_channel (struct dma_chan *chan) {struct sdma_channel *sdmac =to_sdma_chan (chan); -int ret;sdma_disable_channel (chan);
@@ -1178,9 +1177,7 @@ static int sdma_config_channel(struct dm sdmac->watermark_level =0 ;/* FIXME: M3_BASE_ADDRESS */ } - ret =sdma_load_context (sdmac); - -return ret; +return 0 ; } static int sdma_set_channel_priority(struct sdma_channel *sdmac,
Greg Kroah-Hartman
maintainerPATCH 43/306 libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 8a6430ab9c9c87cb64c512e505e8690bbaee190b upstream.
Commit ca6bfcb2f6d9 ("libata: Enable queued TRIM for Samsung SSD 860") limited the existing ATA_HORKAGE_NO_NCQ_TRIM quirk from "Samsung SSD 8*", covering all Samsung 800 series SSDs, to only apply to "Samsung SSD 840*" and "Samsung SSD 850*" series based on information from Samsung.
But there is a large number of users which is still reporting issues with the Samsung 860 and 870 SSDs combined with Intel, ASmedia or Marvell SATA controllers and all reporters also report these problems going away when disabling queued trims.
Note that with AMD SATA controllers users are reporting even worse issues and only completely disabling NCQ helps there, this will be addressed in a separate patch.
--- drivers/ata/libata-core.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/ata/libata-core.c +4 -0
@@ -3950,6 +3950,10 @@ static const struct ata_blacklist_entry ATA_HORKAGE_ZERO_AFTER_TRIM, }, {"Samsung SSD 850*" ,NULL ,ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Samsung SSD 860*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Samsung SSD 870*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, { "FCCT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM, },
Greg Kroah-Hartman
maintainerPATCH 44/306 ARM: 9105/1: atags_to_fdt: dont warn about stack size
In reply to Greg Kroah-HartmanFrom: David Heidelberg <[email protected]>
commit b30d0289de72c62516df03fdad8d53f552c69839 upstream.
The merge_fdt_bootargs() function by definition consumes more than 1024 bytes of stack because it has a 1024 byte command line on the stack, meaning that we always get a warning when building this file:
arch/arm/boot/compressed/atags_to_fdt.c: In function 'merge_fdt_bootargs':arch/arm/boot/compressed/atags_to_fdt.c:98:1: warning: the frame size of 1032 bytes is larger than 1024 bytes [-Wframe-larger-than=]
However, as this is the decompressor and we know that it has a very shallow call chain, and we do not actually risk overflowing the kernel stack at runtime here.
This just shuts up the warning by disabling the warning flag for this file.
Tested on Nexus 7 2012 builds.
--- arch/arm/boot/compressed/Makefile | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/compressed/Makefile +2 -0
@@ -84,6 +84,8 @@ compress-$(CONFIG_KERNEL_LZ4) = lz4 libfdt_objs := fdt_rw.o fdt_ro.o fdt_wip.o fdt.o ifeq ($(CONFIG_ARM_ATAG_DTB_COMPAT),y) +CFLAGS_REMOVE_atags_to_fdt.o += -Wframe-larger-than=${CONFIG_FRAME_WARN} +CFLAGS_atags_to_fdt.o += -Wframe-larger-than=1280 OBJS += $(libfdt_objs) atags_to_fdt.o endif
Greg Kroah-Hartman
maintainerPATCH 45/306 f2fs: fix to do sanity check for sb/cp fields correctly
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
commit 65ddf6564843890a58ee3b18bb46ce67d96333fb upstream.
This patch fixes below problems of sb/cp sanity check:
- in sanity_check_raw_superi(), it missed to consider log header blocks while cp_payload check.
- in f2fs_sanity_check_ckpt(), it missed to check nat_bits_blocks.
--- fs/f2fs/super.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
fs/f2fs/super.c +18 -4
@@ -2898,11 +2898,13 @@ static int sanity_check_raw_super(structreturn -EFSCORRUPTED ; } -if (le32_to_cpu (raw_super->cp_payload) > - (blocks_per_seg -F2FS_CP_PACKS )) { -f2fs_info (sbi,"Insane cp_payload (%u > %u)" , +if (le32_to_cpu (raw_super->cp_payload) >= + (blocks_per_seg -F2FS_CP_PACKS - +NR_CURSEG_PERSIST_TYPE )) { +f2fs_info (sbi,"Insane cp_payload (%u >= %u)" ,le32_to_cpu (raw_super->cp_payload), - blocks_per_seg -F2FS_CP_PACKS ); + blocks_per_seg -F2FS_CP_PACKS - +NR_CURSEG_PERSIST_TYPE );return -EFSCORRUPTED ; }
@@ -2938,6 +2940,7 @@ int f2fs_sanity_check_ckpt(struct f2fs_sunsigned int cp_pack_start_sum, cp_payload;block_t user_block_count, valid_user_blocks;block_t avail_node_count, valid_node_count; +unsigned int nat_blocks, nat_bits_bytes, nat_bits_blocks;int i, j; total =le32_to_cpu (raw_super->segment_count);
@@ -3058,6 +3061,17 @@ int f2fs_sanity_check_ckpt(struct f2fs_sreturn 1 ; } + nat_blocks = nat_segs << log_blocks_per_seg; + nat_bits_bytes = nat_blocks /BITS_PER_BYTE ; + nat_bits_blocks =F2FS_BLK_ALIGN ((nat_bits_bytes <<1 ) +8 ); +if (__is_set_ckpt_flags (ckpt,CP_NAT_BITS_FLAG ) && + (cp_payload +F2FS_CP_PACKS + +NR_CURSEG_PERSIST_TYPE + nat_bits_blocks >= blocks_per_seg)) { +f2fs_warn (sbi,"Insane cp_payload: %u, nat_bits_blocks: %u)" , + cp_payload, nat_bits_blocks); +return -EFSCORRUPTED ; + } +if (unlikely (f2fs_cp_error (sbi))) {f2fs_err (sbi,"A bug case: need to run fsck" );return 1 ;
Re: [PATCH 5.10 045/306] f2fs: fix to do sanity check for sb/cp fields correctly
Hi!
This code looks quite confused: part of function returns 1 on corruption, part returns -errno. The problem is not stable-specific.
Best regards,
Pavel
Quoted 19 lines
fs/f2fs/super.c +11
-0@@ -3058,6 +3061,17 @@ int f2fs_sanity_check_ckpt(struct f2fs_sreturn 1 ; } + nat_blocks = nat_segs << log_blocks_per_seg; + nat_bits_bytes = nat_blocks /BITS_PER_BYTE ; + nat_bits_blocks =F2FS_BLK_ALIGN ((nat_bits_bytes <<1 ) +8 ); +if (__is_set_ckpt_flags (ckpt,CP_NAT_BITS_FLAG ) && + (cp_payload +F2FS_CP_PACKS + +NR_CURSEG_PERSIST_TYPE + nat_bits_blocks >= blocks_per_seg)) { +f2fs_warn (sbi,"Insane cp_payload: %u, nat_bits_blocks: %u)" , + cp_payload, nat_bits_blocks); +return -EFSCORRUPTED ; + } +if (unlikely (f2fs_cp_error (sbi))) {f2fs_err (sbi,"A bug case: need to run fsck" );return 1 ;
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerPATCH 46/306 PCI/portdrv: Enable Bandwidth Notification only if port supports it
In reply to Greg Kroah-HartmanFrom: Stuart Hayes <[email protected]>
commit 00823dcbdd415c868390feaca16f0265101efab4 upstream.
Previously we assumed that all Root Ports and Switch Downstream Ports supported Link Bandwidth Notification. Per spec, this is only required for Ports supporting Links wider than x1 and/or multiple Link speeds (PCIe r5.0, sec 7.5.3.6).
Because we assumed all Ports supported it, we tried to set up a Bandwidth Notification IRQ, which failed for devices that don't support IRQs at all, which meant pcieport didn't attach to the Port at all.
Check the Link Bandwidth Notification Capability bit and enable the service only when the Port supports it.
--- drivers/pci/pcie/portdrv_core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/pci/pcie/portdrv_core.c +7 -2
@@ -260,8 +260,13 @@ static int get_port_device_capability(st services |=PCIE_PORT_SERVICE_DPC ;if (pci_pcie_type (dev) ==PCI_EXP_TYPE_DOWNSTREAM || -pci_pcie_type (dev) ==PCI_EXP_TYPE_ROOT_PORT ) - services |=PCIE_PORT_SERVICE_BWNOTIF ; +pci_pcie_type (dev) ==PCI_EXP_TYPE_ROOT_PORT ) { +u32 linkcap; + +pcie_capability_read_dword (dev,PCI_EXP_LNKCAP , &linkcap); +if (linkcap &PCI_EXP_LNKCAP_LBNC ) + services |=PCIE_PORT_SERVICE_BWNOTIF ; + }return services; }
Greg Kroah-Hartman
maintainerPATCH 47/306 PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
commit b12d93e9958e028856cbcb061b6e64728ca07755 upstream.
The ASMedia ASM1062 SATA controller advertises Max_Payload_Size_Supported of 512, but in fact it cannot handle incoming TLPs with payload size of 512.
We discovered this issue on PCIe controllers capable of MPS = 512 (Aardvark and DesignWare), where the issue presents itself as an External Abort. Bjorn Helgaas says:
Probably ASM1062 reports a Malformed TLP error when it receives a data payload of 512 bytes, and Aardvark, DesignWare, etc convert this to an arm64 External Abort. [1]
To avoid this problem, limit the ASM1062 Max Payload Size Supported to 256 bytes, so we set the Max Payload Size of devices that may send TLPs to the ASM1062 to 256 or less.
[1] https://lore.kernel.org/linux-pci/20210601170907.GA1949035@bjorn-Precision-5520/
--- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/quirks.c +1 -0
@@ -3252,6 +3252,7 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SO PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_SOLARFLARE ,PCI_DEVICE_ID_SOLARFLARE_SFC4000B , fixup_mpss_256); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_ASMEDIA ,0x0612 , fixup_mpss_256);/* * Intel 5000 and 5100 Memory controllers have an erratum with read completion
Greg Kroah-Hartman
maintainerPATCH 48/306 PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
In reply to Greg Kroah-HartmanFrom: Krzysztof Wilczyński <[email protected]>
commit a8bd29bd49c4156ea0ec5a97812333e2aeef44e7 upstream.
The pciconfig_read() syscall reads PCI configuration space using hardware-dependent config accessors.
If the read fails on PCI, most accessors don't return an error; they pretend the read was successful and got ~0 data from the device, so the syscall returns success with ~0 data in the buffer.
When the accessor does return an error, pciconfig_read() normally fills the user's buffer with ~0 and returns an error in errno. But after e4585da22ad0 ("pci syscall.c: Switch to refcounting API"), we don't fill the buffer with ~0 for the EPERM "user lacks CAP_SYS_ADMIN" error.
Userspace may rely on the ~0 data to detect errors, but after e4585da22ad0, that would not detect CAP_SYS_ADMIN errors.
Restore the original behaviour of filling the buffer with ~0 when the CAP_SYS_ADMIN check fails.
[bhelgaas: commit log, fold in Nathan's fix
https://lore.kernel.org/r/[email protected]]
--- drivers/pci/syscall.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pci/syscall.c +3 -1
@@ -22,8 +22,10 @@ SYSCALL_DEFINE5(pciconfig_read, unsignedlong err;int cfg_ret; + err = -EPERM ; + dev =NULL ;if (!capable (CAP_SYS_ADMIN )) -return -EPERM ; + goto error; err = -ENODEV ; dev =pci_get_domain_bus_and_slot (0 , bus, dfn);
Greg Kroah-Hartman
maintainerPATCH 49/306 PCI: xilinx-nwl: Enable the clock through CCF
In reply to Greg Kroah-HartmanFrom: Hyun Kwon <[email protected]>
commit de0a01f5296651d3a539f2d23d0db8f359483696 upstream.
Enable PCIe reference clock. There is no remove function that's why this should be enough for simple operation.
Normally this clock is enabled by default by firmware but there are usecases where this clock should be enabled by driver itself. It is also good that PCIe clock is recorded in a clock framework.
--- drivers/pci/controller/pcie-xilinx-nwl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/pci/controller/pcie-xilinx-nwl.c +12 -0
@@ -6,6 +6,7 @@* (C) Copyright 2014 - 2015, Xilinx, Inc. */ +#include <linux/clk.h> #include <linux/delay.h> #include <linux/interrupt.h> #include <linux/irq.h>
@@ -168,6 +169,7 @@ struct nwl_pcie {u8 last_busno;struct nwl_msi msi;struct irq_domain *legacy_irq_domain; +struct clk *clk;raw_spinlock_t leg_mask_lock; };
@@ -825,6 +827,16 @@ static int nwl_pcie_probe(struct platforreturn err; } + pcie->clk =devm_clk_get (dev,NULL ); +if (IS_ERR (pcie->clk)) +return PTR_ERR (pcie->clk); + + err =clk_prepare_enable (pcie->clk); +if (err) { +dev_err (dev,"can't enable PCIe ref clock\n" ); +return err; + } + err =nwl_pcie_bridge_init (pcie);if (err) {dev_err (dev,"HW Initialization failed\n" );
Greg Kroah-Hartman
maintainerPATCH 50/306 PCI: aardvark: Configure PCIe resources from ranges DT property
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
commit 64f160e19e9264a7f6d89c516baae1473b6f8359 upstream.
In commit 6df6ba974a55 ("PCI: aardvark: Remove PCIe outbound window configuration") was removed aardvark PCIe outbound window configuration and commit description said that was recommended solution by HW designers.
But that commit completely removed support for configuring PCIe IO resources without removing PCIe IO 'ranges' from DTS files. After that commit PCIe IO space started to be treated as PCIe MEM space and accessing it just caused kernel crash.
Moreover implementation of PCIe outbound windows prior that commit was incorrect. It completely ignored offset between CPU address and PCIe bus address and expected that in DTS is CPU address always same as PCIe bus address without doing any checks. Also it completely ignored size of every PCIe resource specified in 'ranges' DTS property and expected that every PCIe resource has size 128 MB (also for PCIe IO range). Again without any check. Apparently none of PCIe resource has in DTS specified size of 128 MB. So it was completely broken and thanks to how aardvark mask works, configuration was completely ignored.
This patch reverts back support for PCIe outbound window configuration but implementation is a new without issues mentioned above. PCIe outbound window is required when DTS specify in 'ranges' property non-zero offset between CPU and PCIe address space. To address recommendation by HW designers as specified in commit description of 6df6ba974a55, set default outbound parameters as PCIe MEM access without translation and therefore for this PCIe 'ranges' it is not needed to configure PCIe outbound window. For PCIe IO space is needed to configure aardvark PCIe outbound window.
This patch fixes kernel crash when trying to access PCIe IO space.
--- drivers/pci/controller/pci-aardvark.c | 195 +++++++++++++++++++++++++++++++++- 1 file changed, 194 insertions(+), 1 deletion(-)
drivers/pci/controller/pci-aardvark.c +194 -1
@@ -117,6 +117,46 @@#define PCIE_MSI_MASK_REG (CONTROL_BASE_ADDR + 0x5C)#define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C) +/* PCIe window configuration */ +#define OB_WIN_BASE_ADDR 0x4c00 +#define OB_WIN_BLOCK_SIZE 0x20 +#define OB_WIN_COUNT 8 +#define OB_WIN_REG_ADDR (win, offset) (OB_WIN_BASE_ADDR + \ + OB_WIN_BLOCK_SIZE * (win) + \ + (offset)) +#define OB_WIN_MATCH_LS (win) OB_WIN_REG_ADDR(win, 0x00) +#define OB_WIN_ENABLE BIT(0) +#define OB_WIN_MATCH_MS (win) OB_WIN_REG_ADDR(win, 0x04) +#define OB_WIN_REMAP_LS (win) OB_WIN_REG_ADDR(win, 0x08) +#define OB_WIN_REMAP_MS (win) OB_WIN_REG_ADDR(win, 0x0c) +#define OB_WIN_MASK_LS (win) OB_WIN_REG_ADDR(win, 0x10) +#define OB_WIN_MASK_MS (win) OB_WIN_REG_ADDR(win, 0x14) +#define OB_WIN_ACTIONS (win) OB_WIN_REG_ADDR(win, 0x18) +#define OB_WIN_DEFAULT_ACTIONS (OB_WIN_ACTIONS(OB_WIN_COUNT-1) + 0x4) +#define OB_WIN_FUNC_NUM_MASK GENMASK(31, 24) +#define OB_WIN_FUNC_NUM_SHIFT 24 +#define OB_WIN_FUNC_NUM_ENABLE BIT(23) +#define OB_WIN_BUS_NUM_BITS_MASK GENMASK(22, 20) +#define OB_WIN_BUS_NUM_BITS_SHIFT 20 +#define OB_WIN_MSG_CODE_ENABLE BIT(22) +#define OB_WIN_MSG_CODE_MASK GENMASK(21, 14) +#define OB_WIN_MSG_CODE_SHIFT 14 +#define OB_WIN_MSG_PAYLOAD_LEN BIT(12) +#define OB_WIN_ATTR_ENABLE BIT(11) +#define OB_WIN_ATTR_TC_MASK GENMASK(10, 8) +#define OB_WIN_ATTR_TC_SHIFT 8 +#define OB_WIN_ATTR_RELAXED BIT(7) +#define OB_WIN_ATTR_NOSNOOP BIT(6) +#define OB_WIN_ATTR_POISON BIT(5) +#define OB_WIN_ATTR_IDO BIT(4) +#define OB_WIN_TYPE_MASK GENMASK(3, 0) +#define OB_WIN_TYPE_SHIFT 0 +#define OB_WIN_TYPE_MEM 0x0 +#define OB_WIN_TYPE_IO 0x4 +#define OB_WIN_TYPE_CONFIG_TYPE0 0x8 +#define OB_WIN_TYPE_CONFIG_TYPE1 0x9 +#define OB_WIN_TYPE_MSG 0xc +/* LMI registers base address and register offsets */ #define LMI_BASE_ADDR 0x6000#define CFG_REG (LMI_BASE_ADDR + 0x0)
@@ -187,6 +227,13 @@struct advk_pcie {struct platform_device *pdev;void __iomem *base; +struct { +phys_addr_t match; +phys_addr_t remap; +phys_addr_t mask; +u32 actions; + } wins[OB_WIN_COUNT ]; +u8 wins_count;struct irq_domain *irq_domain;struct irq_chip irq_chip;struct irq_domain *msi_domain;
@@ -366,9 +413,39 @@ err:dev_err (dev,"link never came up\n" ); } +/* +* Set PCIe address window register which could be used for memory +* mapping. +*/ +static void advk_pcie_set_ob_win (struct advk_pcie *pcie,u8 win_num, +phys_addr_t match,phys_addr_t remap, +phys_addr_t mask,u32 actions) +{ +advk_writel (pcie,OB_WIN_ENABLE | +lower_32_bits (match),OB_WIN_MATCH_LS (win_num)); +advk_writel (pcie,upper_32_bits (match),OB_WIN_MATCH_MS (win_num)); +advk_writel (pcie,lower_32_bits (remap),OB_WIN_REMAP_LS (win_num)); +advk_writel (pcie,upper_32_bits (remap),OB_WIN_REMAP_MS (win_num)); +advk_writel (pcie,lower_32_bits (mask),OB_WIN_MASK_LS (win_num)); +advk_writel (pcie,upper_32_bits (mask),OB_WIN_MASK_MS (win_num)); +advk_writel (pcie, actions,OB_WIN_ACTIONS (win_num)); +} + +static void advk_pcie_disable_ob_win (struct advk_pcie *pcie,u8 win_num) +{ +advk_writel (pcie,0 ,OB_WIN_MATCH_LS (win_num)); +advk_writel (pcie,0 ,OB_WIN_MATCH_MS (win_num)); +advk_writel (pcie,0 ,OB_WIN_REMAP_LS (win_num)); +advk_writel (pcie,0 ,OB_WIN_REMAP_MS (win_num)); +advk_writel (pcie,0 ,OB_WIN_MASK_LS (win_num)); +advk_writel (pcie,0 ,OB_WIN_MASK_MS (win_num)); +advk_writel (pcie,0 ,OB_WIN_ACTIONS (win_num)); +} +static void advk_pcie_setup_hw (struct advk_pcie *pcie) {u32 reg; +int i;/* Enable TX */ reg =advk_readl (pcie,PCIE_CORE_REF_CLK_REG );
@@ -447,15 +524,51 @@ static void advk_pcie_setup_hw(struct ad reg =PCIE_IRQ_ALL_MASK & (~PCIE_IRQ_ENABLE_INTS_MASK );advk_writel (pcie, reg,HOST_CTRL_INT_MASK_REG ); +/* +* Enable AXI address window location generation: +* When it is enabled, the default outbound window +* configurations (Default User Field: 0xD0074CFC) +* are used to transparent address translation for +* the outbound transactions. Thus, PCIe address +* windows are not required for transparent memory +* access when default outbound window configuration +* is set for memory access. +*/ reg =advk_readl (pcie,PCIE_CORE_CTRL2_REG ); reg |=PCIE_CORE_CTRL2_OB_WIN_ENABLE ;advk_writel (pcie, reg,PCIE_CORE_CTRL2_REG ); -/* Bypass the address window mapping for PIO */ +/* +* Set memory access in Default User Field so it +* is not required to configure PCIe address for +* transparent memory access. +*/ +advk_writel (pcie,OB_WIN_TYPE_MEM ,OB_WIN_DEFAULT_ACTIONS ); + +/* +* Bypass the address window mapping for PIO: +* Since PIO access already contains all required +* info over AXI interface by PIO registers, the +* address window is not required. +*/ reg =advk_readl (pcie,PIO_CTRL ); reg |=PIO_CTRL_ADDR_WIN_DISABLE ;advk_writel (pcie, reg,PIO_CTRL ); +/* +* Configure PCIe address windows for non-memory or +* non-transparent access as by default PCIe uses +* transparent memory access. +*/ +for (i =0 ; i < pcie->wins_count; i++) +advk_pcie_set_ob_win (pcie, i, + pcie->wins[i].match, pcie->wins[i].remap, + pcie->wins[i].mask, pcie->wins[i].actions); + +/* Disable remaining PCIe outbound windows */ +for (i = pcie->wins_count; i <OB_WIN_COUNT ; i++) +advk_pcie_disable_ob_win (pcie, i); +advk_pcie_train_link (pcie);/*
@@ -1162,6 +1275,7 @@ static int advk_pcie_probe(struct platfostruct device *dev = &pdev->dev;struct advk_pcie *pcie;struct pci_host_bridge *bridge; +struct resource_entry *entry;int ret, irq; bridge =devm_pci_alloc_host_bridge (dev,sizeof (struct advk_pcie ));
@@ -1172,6 +1286,80 @@ static int advk_pcie_probe(struct platfo pcie->pdev = pdev;platform_set_drvdata (pdev, pcie); +resource_list_for_each_entry (entry, &bridge->windows) { +resource_size_t start = entry->res->start; +resource_size_t size =resource_size (entry->res); +unsigned long type =resource_type (entry->res); +u64 win_size; + +/* +* Aardvark hardware allows to configure also PCIe window +* for config type 0 and type 1 mapping, but driver uses +* only PIO for issuing configuration transfers which does +* not use PCIe window configuration. +*/ +if (type !=IORESOURCE_MEM && type !=IORESOURCE_MEM_64 && + type !=IORESOURCE_IO ) +continue ; + +/* +* Skip transparent memory resources. Default outbound access +* configuration is set to transparent memory access so it +* does not need window configuration. +*/ +if ((type ==IORESOURCE_MEM || type ==IORESOURCE_MEM_64 ) && + entry->offset ==0 ) +continue ; + +/* +* The n-th PCIe window is configured by tuple (match, remap, mask) +* and an access to address A uses this window if A matches the +* match with given mask. +* So every PCIe window size must be a power of two and every start +* address must be aligned to window size. Minimal size is 64 KiB +* because lower 16 bits of mask must be zero. Remapped address +* may have set only bits from the mask. +*/ +while (pcie->wins_count <OB_WIN_COUNT && size >0 ) { +/* Calculate the largest aligned window size */ + win_size = (1ULL << (fls64 (size)-1 )) | + (start ? (1ULL <<__ffs64 (start)) :0 ); + win_size =1ULL <<__ffs64 (win_size); +if (win_size <0x10000 ) +break ; + +dev_dbg (dev, +"Configuring PCIe window %d: [0x%llx-0x%llx] as %lu\n" , + pcie->wins_count, (unsigned long long )start, + (unsigned long long )start + win_size, type); + +if (type ==IORESOURCE_IO ) { + pcie->wins[pcie->wins_count].actions =OB_WIN_TYPE_IO ; + pcie->wins[pcie->wins_count].match =pci_pio_to_address (start); + }else { + pcie->wins[pcie->wins_count].actions =OB_WIN_TYPE_MEM ; + pcie->wins[pcie->wins_count].match = start; + } + pcie->wins[pcie->wins_count].remap = start - entry->offset; + pcie->wins[pcie->wins_count].mask = ~(win_size -1 ); + +if (pcie->wins[pcie->wins_count].remap & (win_size -1 )) +break ; + + start += win_size; + size -= win_size; + pcie->wins_count++; + } + +if (size >0 ) { +dev_err (&pcie->pdev->dev, +"Invalid PCIe region [0x%llx-0x%llx]\n" , + (unsigned long long )entry->res->start, + (unsigned long long )entry->res->end +1 ); +return -EINVAL ; + } + } + pcie->base =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (pcie->base))return PTR_ERR (pcie->base);
@@ -1252,6 +1440,7 @@ static int advk_pcie_remove(struct platf {struct advk_pcie *pcie =platform_get_drvdata (pdev);struct pci_host_bridge *bridge =pci_host_bridge_from_priv (pcie); +int i;pci_lock_rescan_remove ();pci_stop_root_bus (bridge->bus);
@@ -1261,6 +1450,10 @@ static int advk_pcie_remove(struct platfadvk_pcie_remove_msi_irq_domain (pcie);advk_pcie_remove_irq_domain (pcie); +/* Disable outbound address windows mapping */ +for (i =0 ; i <OB_WIN_COUNT ; i++) +advk_pcie_disable_ob_win (pcie, i); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 51/306 PCI: Export pci_pio_to_address() for module use
In reply to Greg Kroah-HartmanFrom: Jianjun Wang <[email protected]>
commit 9cc742078c9a90cdd4cf131e9f760e6965df9048 upstream.
This interface will be used by PCI host drivers for PIO translation, export it to support compiling those drivers as kernel modules.
--- drivers/pci/pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/pci.c +1 -0
@@ -4043,6 +4043,7 @@ phys_addr_t pci_pio_to_address(unsignedreturn address; } +EXPORT_SYMBOL_GPL (pci_pio_to_address);unsigned long __weak pci_address_to_pio (phys_addr_t address) {
Greg Kroah-Hartman
maintainerPATCH 52/306 PCI: aardvark: Fix checking for PIO status
In reply to Greg Kroah-HartmanFrom: Evan Wang <[email protected]>
commit fcb461e2bc8b83b7eaca20cb2221e8b940f2189c upstream.
There is an issue that when PCIe switch is connected to an Armada 3700 board, there will be lots of warnings about PIO errors when reading the config space. According to Aardvark PIO read and write sequence in HW specification, the current way to check PIO status has the following issues:
1) For PIO read operation, it reports the error message, which should be avoided according to HW specification.
2) For PIO read and write operations, it only checks PIO operation complete status, which is not enough, and error status should also be checked.
This patch aligns the code with Aardvark PIO read and write sequence in HW specification on PIO status check and fix the warnings when reading config space.
[pali: Fix CRS handling when CRSSVE is not enabled]
--- drivers/pci/controller/pci-aardvark.c | 62 +++++++++++++++++++++++++++++----- 1 file changed, 54 insertions(+), 8 deletions(-)
drivers/pci/controller/pci-aardvark.c +54 -8
@@ -57,6 +57,7 @@#define PIO_COMPLETION_STATUS_CRS 2#define PIO_COMPLETION_STATUS_CA 4#define PIO_NON_POSTED_REQ BIT(10) +#define PIO_ERR_STATUS BIT(11)#define PIO_ADDR_LS (PIO_BASE_ADDR + 0x8)#define PIO_ADDR_MS (PIO_BASE_ADDR + 0xc)#define PIO_WR_DATA (PIO_BASE_ADDR + 0x10)
@@ -585,7 +586,7 @@ static void advk_pcie_setup_hw(struct adadvk_writel (pcie, reg,PCIE_CORE_CMD_STATUS_REG ); } -static void advk_pcie_check_pio_status (struct advk_pcie *pcie) +static int advk_pcie_check_pio_status (struct advk_pcie *pcie,u32 *val) {struct device *dev = &pcie->pdev->dev;u32 reg;
@@ -596,14 +597,49 @@ static void advk_pcie_check_pio_status(s status = (reg &PIO_COMPLETION_STATUS_MASK ) >>PIO_COMPLETION_STATUS_SHIFT ; -if (!status) -return ; - +/* +* According to HW spec, the PIO status check sequence as below: +* 1) even if COMPLETION_STATUS(bit9:7) indicates successful, +* it still needs to check Error Status(bit11), only when this bit +* indicates no error happen, the operation is successful. +* 2) value Unsupported Request(1) of COMPLETION_STATUS(bit9:7) only +* means a PIO write error, and for PIO read it is successful with +* a read value of 0xFFFFFFFF. +* 3) value Completion Retry Status(CRS) of COMPLETION_STATUS(bit9:7) +* only means a PIO write error, and for PIO read it is successful +* with a read value of 0xFFFF0001. +* 4) value Completer Abort (CA) of COMPLETION_STATUS(bit9:7) means +* error for both PIO read and PIO write operation. +* 5) other errors are indicated as 'unknown'. +*/ switch (status) { +case PIO_COMPLETION_STATUS_OK : +if (reg &PIO_ERR_STATUS ) { + strcomp_status ="COMP_ERR" ; +break ; + } +/* Get the read result */ +if (val) + *val =advk_readl (pcie,PIO_RD_DATA ); +/* No error */ + strcomp_status =NULL ; +break ;case PIO_COMPLETION_STATUS_UR : strcomp_status ="UR" ;break ;case PIO_COMPLETION_STATUS_CRS : +/* PCIe r4.0, sec 2.3.2, says: +* If CRS Software Visibility is not enabled, the Root Complex +* must re-issue the Configuration Request as a new Request. +* A Root Complex implementation may choose to limit the number +* of Configuration Request/CRS Completion Status loops before +* determining that something is wrong with the target of the +* Request and taking appropriate action, e.g., complete the +* Request to the host as a failed transaction. +* +* To simplify implementation do not re-issue the Configuration +* Request and complete the Request as a failed transaction. +*/ strcomp_status ="CRS" ;break ;case PIO_COMPLETION_STATUS_CA :
@@ -614,6 +650,9 @@ static void advk_pcie_check_pio_status(sbreak ; } +if (!strcomp_status) +return 0 ; +if (reg &PIO_NON_POSTED_REQ ) str_posted ="Non-posted" ;else
@@ -621,6 +660,8 @@ static void advk_pcie_check_pio_status(sdev_err (dev,"%s PIO Response Status: %s, %#x @ %#x\n" , str_posted, strcomp_status, reg,advk_readl (pcie,PIO_ADDR_LS )); + +return -EFAULT ; }static int advk_pcie_wait_pio (struct advk_pcie *pcie)
@@ -858,10 +899,13 @@ static int advk_pcie_rd_conf(struct pci_return PCIBIOS_SET_FAILED ; } -advk_pcie_check_pio_status (pcie); +/* Check PIO status and get the read result */ + ret =advk_pcie_check_pio_status (pcie, val); +if (ret <0 ) { + *val =0xffffffff ; +return PCIBIOS_SET_FAILED ; + } -/* Get the read result */ - *val =advk_readl (pcie,PIO_RD_DATA );if (size ==1 ) *val = (*val >> (8 * (where &3 ))) &0xff ;else if (size ==2 )
@@ -925,7 +969,9 @@ static int advk_pcie_wr_conf(struct pci_if (ret <0 )return PCIBIOS_SET_FAILED ; -advk_pcie_check_pio_status (pcie); + ret =advk_pcie_check_pio_status (pcie,NULL ); +if (ret <0 ) +return PCIBIOS_SET_FAILED ;return PCIBIOS_SUCCESSFUL ; }
Greg Kroah-Hartman
maintainerPATCH 53/306 PCI: aardvark: Fix masking and unmasking legacy INTx interrupts
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
commit d212dcee27c1f89517181047e5485fcbba4a25c2 upstream.
irq_mask and irq_unmask callbacks need to be properly guarded by raw spin locks as masking/unmasking procedure needs atomic read-modify-write operation on hardware register.
--- drivers/pci/controller/pci-aardvark.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/pci/controller/pci-aardvark.c +9 -0
@@ -237,6 +237,7 @@ struct advk_pcie {u8 wins_count;struct irq_domain *irq_domain;struct irq_chip irq_chip; +raw_spinlock_t irq_lock;struct irq_domain *msi_domain;struct irq_domain *msi_inner_domain;struct irq_chip msi_bottom_irq_chip;
@@ -1045,22 +1046,28 @@ static void advk_pcie_irq_mask(struct ir {struct advk_pcie *pcie = d->domain->host_data;irq_hw_number_t hwirq =irqd_to_hwirq (d); +unsigned long flags;u32 mask; +raw_spin_lock_irqsave (&pcie->irq_lock, flags); mask =advk_readl (pcie,PCIE_ISR1_MASK_REG ); mask |=PCIE_ISR1_INTX_ASSERT (hwirq);advk_writel (pcie, mask,PCIE_ISR1_MASK_REG ); +raw_spin_unlock_irqrestore (&pcie->irq_lock, flags); }static void advk_pcie_irq_unmask (struct irq_data *d) {struct advk_pcie *pcie = d->domain->host_data;irq_hw_number_t hwirq =irqd_to_hwirq (d); +unsigned long flags;u32 mask; +raw_spin_lock_irqsave (&pcie->irq_lock, flags); mask =advk_readl (pcie,PCIE_ISR1_MASK_REG ); mask &= ~PCIE_ISR1_INTX_ASSERT (hwirq);advk_writel (pcie, mask,PCIE_ISR1_MASK_REG ); +raw_spin_unlock_irqrestore (&pcie->irq_lock, flags); } static int advk_pcie_irq_map(struct irq_domain *h,
@@ -1144,6 +1151,8 @@ static int advk_pcie_init_irq_domain(strstruct irq_chip *irq_chip;int ret =0 ; +raw_spin_lock_init (&pcie->irq_lock); + pcie_intc_node =of_get_next_child (node,NULL );if (!pcie_intc_node) {dev_err (dev,"No PCIe Intc node found\n" );
Greg Kroah-Hartman
maintainerPATCH 54/306 HID: input: do not report stylus battery state as "full"
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
[ Upstream commit f4abaa9eebde334045ed6ac4e564d050f1df3013 ]
The power supply states of discharging, charging, full, etc, represent state of charging, not the capacity level of the battery (for which we have a separate property). Current HID usage tables to not allow for expressing charging state of the batteries found in generic styli, so we should simply assume that the battery is discharging even if current capacity is at 100% when battery strength reporting is done via HID interface. In fact, we were doing just that before commit 581c4484769e.
This change helps UIs to not mis-represent fully charged batteries in styli as being charging/topping-off.
--- drivers/hid/hid-input.c | 2 -- 1 file changed, 2 deletions(-)
drivers/hid/hid-input.c +0 -2
@@ -415,8 +415,6 @@ static int hidinput_get_battery_property(struct power_supply *psy,if (dev->battery_status ==HID_BATTERY_UNKNOWN ) val->intval =POWER_SUPPLY_STATUS_UNKNOWN ; -else if (dev->battery_capacity ==100 ) - val->intval =POWER_SUPPLY_STATUS_FULL ;else val->intval =POWER_SUPPLY_STATUS_DISCHARGING ;break ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 55/306 f2fs: quota: fix potential deadlock
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 9de71ede81e6d1a111fdd868b2d78d459fa77f80 ]
xfstest generic/587 reports a deadlock issue as below:
======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc1 #69 Not tainted
------------------------------------------------------
repquota/8606 is trying to acquire lock:ffff888022ac9320 (&sb->s_type->i_mutex_key#18){+.+.}-{3:3}, at: f2fs_quota_sync+0x207/0x300 [f2fs]
but task is already holding lock:ffff8880084bcde8 (&sbi->quota_sem){.+.+}-{3:3}, at: f2fs_quota_sync+0x59/0x300 [f2fs]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&sbi->quota_sem){.+.+}-{3:3}:
__lock_acquire+0x648/0x10b0
lock_acquire+0x128/0x470
down_read+0x3b/0x2a0
f2fs_quota_sync+0x59/0x300 [f2fs]
f2fs_quota_on+0x48/0x100 [f2fs]
do_quotactl+0x5e3/0xb30
__x64_sys_quotactl+0x23a/0x4e0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae-> #1 (&sbi->cp_rwsem){++++}-{3:3}:
__lock_acquire+0x648/0x10b0
lock_acquire+0x128/0x470
down_read+0x3b/0x2a0
f2fs_unlink+0x353/0x670 [f2fs]
vfs_unlink+0x1c7/0x380
do_unlinkat+0x413/0x4b0
__x64_sys_unlinkat+0x50/0xb0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae-> #0 (&sb->s_type->i_mutex_key#18){+.+.}-{3:3}:
check_prev_add+0xdc/0xb30
validate_chain+0xa67/0xb20
__lock_acquire+0x648/0x10b0
lock_acquire+0x128/0x470
down_write+0x39/0xc0
f2fs_quota_sync+0x207/0x300 [f2fs]
do_quotactl+0xaff/0xb30
__x64_sys_quotactl+0x23a/0x4e0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xaeother info that might help us debug this:
Chain exists of: &sb->s_type->i_mutex_key#18 --> &sbi->cp_rwsem --> &sbi->quota_sem Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&sbi->quota_sem);
lock(&sbi->cp_rwsem);
lock(&sbi->quota_sem); lock(&sb->s_type->i_mutex_key#18);
*** DEADLOCK ***
3 locks held by repquota/8606:
#0: ffff88801efac0e0 (&type->s_umount_key#53){++++}-{3:3}, at: user_get_super+0xd9/0x190 #1: ffff8880084bc380 (&sbi->cp_rwsem){++++}-{3:3}, at: f2fs_quota_sync+0x3e/0x300 [f2fs] #2: ffff8880084bcde8 (&sbi->quota_sem){.+.+}-{3:3}, at: f2fs_quota_sync+0x59/0x300 [f2fs]
stack backtrace: CPU: 6 PID: 8606 Comm: repquota Not tainted 5.14.0-rc1 #69 Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 Call Trace: dump_stack_lvl+0xce/0x134 dump_stack+0x17/0x20 print_circular_bug.isra.0.cold+0x239/0x253 check_noncircular+0x1be/0x1f0 check_prev_add+0xdc/0xb30 validate_chain+0xa67/0xb20 __lock_acquire+0x648/0x10b0 lock_acquire+0x128/0x470 down_write+0x39/0xc0 f2fs_quota_sync+0x207/0x300 [f2fs] do_quotactl+0xaff/0xb30 __x64_sys_quotactl+0x23a/0x4e0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f883b0b4efe
The root cause is ABBA deadlock of inode lock and cp_rwsem, reorder locks in f2fs_quota_sync() as below to fix this issue:
- lock inode
- lock cp_rwsem
- lock quota_sem
--- fs/f2fs/super.c | 84 ++++++++++++++++++++++++++++--------------------- 1 file changed, 48 insertions(+), 36 deletions(-)
fs/f2fs/super.c +48 -36
@@ -2206,6 +2206,33 @@ static int f2fs_enable_quotas(struct super_block *sb)return 0 ; } +static int f2fs_quota_sync_file (struct f2fs_sb_info *sbi,int type) +{ +struct quota_info *dqopt =sb_dqopt (sbi->sb); +struct address_space *mapping = dqopt->files[type]->i_mapping; +int ret =0 ; + + ret =dquot_writeback_dquots (sbi->sb, type); +if (ret) + goto out; + + ret =filemap_fdatawrite (mapping); +if (ret) + goto out; + +/* if we are using journalled quota */ +if (is_journalled_quota (sbi)) + goto out; + + ret =filemap_fdatawait (mapping); + +truncate_inode_pages (&dqopt->files[type]->i_data,0 ); +out: +if (ret) +set_sbi_flag (sbi,SBI_QUOTA_NEED_REPAIR ); +return ret; +} +int f2fs_quota_sync (struct super_block *sb,int type) {struct f2fs_sb_info *sbi =F2FS_SB (sb);
@@ -2213,57 +2240,42 @@ int f2fs_quota_sync(struct super_block *sb, int type)int cnt;int ret; -/* -* do_quotactl -* f2fs_quota_sync -* down_read(quota_sem) -* dquot_writeback_dquots() -* f2fs_dquot_commit -* block_operation -* down_read(quota_sem) -*/ -f2fs_lock_op (sbi); - -down_read (&sbi->quota_sem); - ret =dquot_writeback_dquots (sb, type); -if (ret) - goto out; -/* * Now when everything is written we can discard the pagecache so * that userspace sees the changes. */ for (cnt =0 ; cnt <MAXQUOTAS ; cnt++) { -struct address_space *mapping;if (type !=-1 && cnt != type)continue ; -if (!sb_has_quota_active (sb, cnt)) -continue ; - mapping = dqopt->files[cnt]->i_mapping; +if (!sb_has_quota_active (sb, type)) +return 0 ; - ret =filemap_fdatawrite (mapping); -if (ret) - goto out; +inode_lock (dqopt->files[cnt]); -/* if we are using journalled quota */ -if (is_journalled_quota (sbi)) -continue ; +/* +* do_quotactl +* f2fs_quota_sync +* down_read(quota_sem) +* dquot_writeback_dquots() +* f2fs_dquot_commit +* block_operation +* down_read(quota_sem) +*/ +f2fs_lock_op (sbi); +down_read (&sbi->quota_sem); - ret =filemap_fdatawait (mapping); -if (ret) -set_sbi_flag (F2FS_SB (sb),SBI_QUOTA_NEED_REPAIR ); + ret =f2fs_quota_sync_file (sbi, cnt); + +up_read (&sbi->quota_sem); +f2fs_unlock_op (sbi); -inode_lock (dqopt->files[cnt]); -truncate_inode_pages (&dqopt->files[cnt]->i_data,0 );inode_unlock (dqopt->files[cnt]); + +if (ret) +break ; } -out: -if (ret) -set_sbi_flag (F2FS_SB (sb),SBI_QUOTA_NEED_REPAIR ); -up_read (&sbi->quota_sem); -f2fs_unlock_op (sbi);return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 56/306 pinctrl: remove empty lines in pinctrl subsystem
In reply to Greg Kroah-HartmanFrom: Zhaoyu Liu <[email protected]>
[ Upstream commit 43878eb7c83d3335af7737dcce1fa79071065dfe ]
Remove all empty lines at the end of functions in pinctrl subsystem, and make the code neat.
--- drivers/pinctrl/actions/pinctrl-owl.c | 1 - drivers/pinctrl/core.c | 1 - drivers/pinctrl/freescale/pinctrl-imx1-core.c | 1 - drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 1 - drivers/pinctrl/pinctrl-at91.c | 1 - drivers/pinctrl/pinctrl-st.c | 1 - drivers/pinctrl/pinctrl-sx150x.c | 1 - drivers/pinctrl/qcom/pinctrl-sdm845.c | 1 - drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c | 1 - drivers/pinctrl/renesas/pfc-r8a77950.c | 1 - drivers/pinctrl/renesas/pfc-r8a77951.c | 1 - drivers/pinctrl/renesas/pfc-r8a7796.c | 1 - drivers/pinctrl/renesas/pfc-r8a77965.c | 1 - 13 files changed, 13 deletions(-)
drivers/pinctrl/actions/pinctrl-owl.c +0 -1
@@ -444,7 +444,6 @@ static int owl_group_config_get(struct pinctrl_dev *pctrldev, *config =pinconf_to_config_packed (param, arg);return ret; - } static int owl_group_config_set(struct pinctrl_dev *pctrldev,
drivers/pinctrl/core.c +0 -1
@@ -2119,7 +2119,6 @@ struct pinctrl_dev *pinctrl_register(struct pinctrl_desc *pctldesc,return ERR_PTR (error);return pctldev; - }EXPORT_SYMBOL_GPL (pinctrl_register);
drivers/pinctrl/freescale/pinctrl-imx1-core.c +0 -1
@@ -290,7 +290,6 @@ static const struct pinctrl_ops imx1_pctrl_ops = { .pin_dbg_show = imx1_pin_dbg_show, .dt_node_to_map = imx1_dt_node_to_map, .dt_free_map = imx1_dt_free_map, - }; static int imx1_pmx_set(struct pinctrl_dev *pctldev, unsigned selector,
drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +0 -1
@@ -188,7 +188,6 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = {PIN_GRP_GPIO_2 ("led1_od" ,12 ,1 ,BIT (21 ),BIT (21 ),0 ,"led" ),PIN_GRP_GPIO_2 ("led2_od" ,13 ,1 ,BIT (22 ),BIT (22 ),0 ,"led" ), PIN_GRP_GPIO_2("led3_od", 14, 1, BIT(23), BIT(23), 0, "led"), - }; static struct armada_37xx_pin_group armada_37xx_sb_groups[] = {
drivers/pinctrl/pinctrl-at91.c +0 -1
@@ -733,7 +733,6 @@ static const struct at91_pinctrl_mux_ops sam9x60_ops = { .get_slewrate = at91_mux_sam9x60_get_slewrate, .set_slewrate = at91_mux_sam9x60_set_slewrate, .irq_type = alt_gpio_irq_type, - };static struct at91_pinctrl_mux_ops sama5d3_ops = {
drivers/pinctrl/pinctrl-st.c +0 -1
@@ -541,7 +541,6 @@ static void st_pinconf_set_retime_packed(struct st_pinctrl *info,st_regmap_field_bit_set_clear_pin (rt_p->delay_0, delay &0x1 , pin);/* 2 bit delay, msb */ st_regmap_field_bit_set_clear_pin (rt_p->delay_1, delay &0x2 , pin); - } static void st_pinconf_set_retime_dedicated(struct st_pinctrl *info,
drivers/pinctrl/pinctrl-sx150x.c +0 -1
@@ -443,7 +443,6 @@ static void sx150x_gpio_set(struct gpio_chip *chip, unsigned int offset,sx150x_gpio_oscio_set (pctl, value); else__sx150x_gpio_set (pctl ,offset ,value ); - } static void sx150x_gpio_set_multiple(struct gpio_chip *chip,
drivers/pinctrl/qcom/pinctrl-sdm845.c +0 -1
@@ -1310,7 +1310,6 @@ static const struct msm_pinctrl_soc_data sdm845_pinctrl = { .ngpios = 151, .wakeirq_map = sdm845_pdc_map, .nwakeirq_map = ARRAY_SIZE(sdm845_pdc_map), - };static const struct msm_pinctrl_soc_data sdm845_acpi_pinctrl = {
drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c +0 -1
@@ -617,7 +617,6 @@ static void pm8xxx_mpp_dbg_show_one(struct seq_file *s, }break ; } - }static void pm8xxx_mpp_dbg_show (struct seq_file *s,struct gpio_chip *chip)
drivers/pinctrl/renesas/pfc-r8a77950.c +0 -1
@@ -1668,7 +1668,6 @@ static const unsigned int avb_mii_pins[] = {PIN_AVB_RX_CTL ,PIN_AVB_RXC ,PIN_AVB_RD0 ,PIN_AVB_RD1 ,PIN_AVB_RD2 ,PIN_AVB_RD3 , PIN_AVB_TXCREFCLK, - };static const unsigned int avb_mii_mux[] = { AVB_TX_CTL_MARK, AVB_TXC_MARK, AVB_TD0_MARK,
drivers/pinctrl/renesas/pfc-r8a77951.c +0 -1
@@ -1727,7 +1727,6 @@ static const unsigned int avb_mii_pins[] = {PIN_AVB_RX_CTL ,PIN_AVB_RXC ,PIN_AVB_RD0 ,PIN_AVB_RD1 ,PIN_AVB_RD2 ,PIN_AVB_RD3 , PIN_AVB_TXCREFCLK, - };static const unsigned int avb_mii_mux[] = { AVB_TX_CTL_MARK, AVB_TXC_MARK, AVB_TD0_MARK,
drivers/pinctrl/renesas/pfc-r8a7796.c +0 -1
@@ -1732,7 +1732,6 @@ static const unsigned int avb_mii_pins[] = {PIN_AVB_RX_CTL ,PIN_AVB_RXC ,PIN_AVB_RD0 ,PIN_AVB_RD1 ,PIN_AVB_RD2 ,PIN_AVB_RD3 , PIN_AVB_TXCREFCLK, - };static const unsigned int avb_mii_mux[] = { AVB_TX_CTL_MARK, AVB_TXC_MARK, AVB_TD0_MARK,
drivers/pinctrl/renesas/pfc-r8a77965.c +0 -1
@@ -1736,7 +1736,6 @@ static const unsigned int avb_mii_pins[] = {PIN_AVB_RX_CTL ,PIN_AVB_RXC ,PIN_AVB_RD0 ,PIN_AVB_RD1 ,PIN_AVB_RD2 ,PIN_AVB_RD3 , PIN_AVB_TXCREFCLK, - };static const unsigned int avb_mii_mux[] = { AVB_TX_CTL_MARK, AVB_TXC_MARK, AVB_TD0_MARK,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 57/306 pinctrl: armada-37xx: Correct PWM pins definitions
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
[ Upstream commit baf8d6899b1e8906dc076ef26cc633e96a8bb0c3 ]
The PWM pins on North Bridge on Armada 37xx can be configured into PWM or GPIO functions. When in PWM function, each pin can also be configured to drive low on 0 and tri-state on 1 (LED mode).
The current definitions handle this by declaring two pin groups for each pin:
- group "pwmN" with functions "pwm" and "gpio"
- group "ledN_od" ("od" for open drain) with functions "led" and "gpio"
This is semantically incorrect. The correct definition for each pin should be one group with three functions: "pwm", "led" and "gpio".
Change the "pwmN" groups to support "led" function.
Remove "ledN_od" groups. This cannot break backwards compatibility with older device trees: no device tree uses it since there is no PWM driver for this SOC yet. Also "ledN_od" groups are not even documented.
--- .../pinctrl/marvell,armada-37xx-pinctrl.txt | 8 ++++---- drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-)
Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt +4 -4
@@ -43,19 +43,19 @@ group emmc_nb group pwm0 - pin 11 (GPIO1-11) - - functions pwm, gpio + - functions pwm, led, gpio group pwm1 - pin 12 - - functions pwm, gpio + - functions pwm, led, gpio group pwm2 - pin 13 - - functions pwm, gpio + - functions pwm, led, gpio group pwm3 - pin 14 - - functions pwm, gpio + - functions pwm, led, gpio group pmic1 - pin 7
drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +8 -8
@@ -167,10 +167,14 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = {PIN_GRP_GPIO ("jtag" ,20 ,5 ,BIT (0 ),"jtag" ),PIN_GRP_GPIO ("sdio0" ,8 ,3 ,BIT (1 ),"sdio" ),PIN_GRP_GPIO ("emmc_nb" ,27 ,9 ,BIT (2 ),"emmc" ), -PIN_GRP_GPIO ("pwm0" ,11 ,1 ,BIT (3 ),"pwm" ), -PIN_GRP_GPIO ("pwm1" ,12 ,1 ,BIT (4 ),"pwm" ), -PIN_GRP_GPIO ("pwm2" ,13 ,1 ,BIT (5 ),"pwm" ), -PIN_GRP_GPIO ("pwm3" ,14 ,1 ,BIT (6 ),"pwm" ), +PIN_GRP_GPIO_3 ("pwm0" ,11 ,1 ,BIT (3 ) |BIT (20 ),0 ,BIT (20 ),BIT (3 ), +"pwm" ,"led" ), +PIN_GRP_GPIO_3 ("pwm1" ,12 ,1 ,BIT (4 ) |BIT (21 ),0 ,BIT (21 ),BIT (4 ), +"pwm" ,"led" ), +PIN_GRP_GPIO_3 ("pwm2" ,13 ,1 ,BIT (5 ) |BIT (22 ),0 ,BIT (22 ),BIT (5 ), +"pwm" ,"led" ), +PIN_GRP_GPIO_3 ("pwm3" ,14 ,1 ,BIT (6 ) |BIT (23 ),0 ,BIT (23 ),BIT (6 ), +"pwm" ,"led" ),PIN_GRP_GPIO ("pmic1" ,7 ,1 ,BIT (7 ),"pmic" ),PIN_GRP_GPIO ("pmic0" ,6 ,1 ,BIT (8 ),"pmic" ), PIN_GRP_GPIO("i2c2", 2, 2, BIT(9), "i2c"),
@@ -184,10 +188,6 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = {PIN_GRP_EXTRA ("uart2" ,9 ,2 ,BIT (1 ) |BIT (13 ) |BIT (14 ) |BIT (19 ),BIT (1 ) |BIT (13 ) |BIT (14 ),BIT (1 ) |BIT (19 ), 18, 2, "gpio", "uart"), -PIN_GRP_GPIO_2 ("led0_od" ,11 ,1 ,BIT (20 ),BIT (20 ),0 ,"led" ), -PIN_GRP_GPIO_2 ("led1_od" ,12 ,1 ,BIT (21 ),BIT (21 ),0 ,"led" ), -PIN_GRP_GPIO_2 ("led2_od" ,13 ,1 ,BIT (22 ),BIT (22 ),0 ,"led" ), - PIN_GRP_GPIO_2("led3_od", 14, 1, BIT(23), BIT(23), 0, "led"), };static struct armada_37xx_pin_group armada_37xx_sb_groups[] = {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 58/306 scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit beec64d0c9749afedf51c3c10cf52de1d9a89cc0 ]
SCSI_IOCTL_SEND_COMMAND has been deprecated longer than bsg exists and has been warning for just as long. More importantly it harcodes SCSI CDBs and thus will do the wrong thing on non-SCSI bsg nodes.
--- block/bsg.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
block/bsg.c +4 -1
@@ -371,10 +371,13 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)case SG_GET_RESERVED_SIZE :case SG_SET_RESERVED_SIZE :case SG_EMULATED_HOST : -case SCSI_IOCTL_SEND_COMMAND :return scsi_cmd_ioctl (bd->queue,NULL , file->f_mode, cmd, uarg);case SG_IO :return bsg_sg_io (bd->queue, file->f_mode, uarg); +case SCSI_IOCTL_SEND_COMMAND : +pr_warn_ratelimited ("%s: calling unsupported SCSI_IOCTL_SEND_COMMAND\n" , + current->comm); +return -EINVAL ;default :return -ENOTTY ; }
Signature · 1 line
2.30.2
Re: [PATCH 5.10 058/306] scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND
Hi!
Quoted 7 lines
From: Christoph Hellwig <[email protected]>
[ Upstream commit
beec64d0c9749afedf51c3c10cf52de1d9a89cc0]
SCSI_IOCTL_SEND_COMMANDhas been deprecated longer than bsg exists and has been warning for just as long. More importantly it harcodes SCSI CDBs and thus will do the wrong thing on non-SCSI bsg nodes.
I see removing deprecated stuff is good idea in mainline, but do we want to do that in -stable?
Best regads,
Pavel
Quoted 16 lines
+++
b/block/bsg.cblock/bsg.c +4
-1@@ -371,10 +371,13 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)case SG_GET_RESERVED_SIZE :case SG_SET_RESERVED_SIZE :case SG_EMULATED_HOST : -case SCSI_IOCTL_SEND_COMMAND :return scsi_cmd_ioctl (bd->queue,NULL , file->f_mode, cmd, uarg);case SG_IO :return bsg_sg_io (bd->queue, file->f_mode, uarg); +case SCSI_IOCTL_SEND_COMMAND : +pr_warn_ratelimited ("%s: calling unsupported SCSI_IOCTL_SEND_COMMAND\n" , + current->comm); +return -EINVAL ;default :return -ENOTTY ; }
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerPATCH 59/306 clk: rockchip: drop GRF dependency for rk3328/rk3036 pll types
In reply to Greg Kroah-HartmanFrom: Peter Geis <[email protected]>
[ Upstream commit 6fffe52fb336ec2063270a7305652a93ea677ca1 ]
The rk3036/rk3328 pll types were converted to checking the lock status via the internal register in january 2020, so don't need the grf reference since then.
But it was forgotten to remove grf check when deciding between the pll rate ops (read-only vs. read-write), so a clock driver without the needed grf reference might've been put into the read-only mode just because the grf reference was missing.
This affected the rk356x that needs to reclock certain plls at boot.
Fix this by removing the check for the grf for selecting the utilized operations.
--- drivers/clk/rockchip/clk-pll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/rockchip/clk-pll.c +1 -1
@@ -940,7 +940,7 @@ struct clk *rockchip_clk_register_pll(struct rockchip_clk_provider *ctx,switch (pll_type) {case pll_rk3036:case pll_rk3328: -if (!pll->rate_table ||IS_ERR (ctx->grf)) +if (!pll->rate_table) init.ops = &rockchip_rk3036_pll_clk_norate_ops;else init.ops = &rockchip_rk3036_pll_clk_ops;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 60/306 IB/hfi1: Adjust pkey entry in index 0
In reply to Greg Kroah-HartmanFrom: Mike Marciniszyn <[email protected]>
[ Upstream commit 62004871e1fa7f9a60797595c03477af5b5ec36f ]
It is possible for the primary IPoIB network device associated with any RDMA device to fail to join certain multicast groups preventing IPv6 neighbor discovery and possibly other network ULPs from working correctly. The IPv4 broadcast group is not affected as the IPoIB network device handles joining that multicast group directly.
This is because the primary IPoIB network device uses the pkey at ndex 0 in the associated RDMA device's pkey table. Anytime the pkey value of index 0 changes, the primary IPoIB network device automatically modifies it's broadcast address (i.e. /sys/class/net/[ib0]/broadcast), since the broadcast address includes the pkey value, and then bounces carrier. This includes initial pkey assignment, such as when the pkey at index 0 transitions from the opa default of invalid (0x0000) to some value such as the OPA default pkey for Virtual Fabric 0: 0x8001 or when the fabric manager is restarted with a configuration change causing the pkey at index 0 to change. Many network ULPs are not sensitive to the carrier bounce and are not expecting the broadcast address to change including the linux IPv6 stack. This problem does not affect IPoIB child network devices as their pkey value is constant for all time.
To mitigate this issue, change the default pkey in at index 0 to 0x8001 to cover the predominant case and avoid issues as ipoib comes up and the FM sweeps.
At some point, ipoib multicast support should automatically fix non-broadcast addresses as it does with the primary broadcast address.
--- drivers/infiniband/hw/hfi1/init.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/infiniband/hw/hfi1/init.c +1 -6
@@ -650,12 +650,7 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd, ppd->pkeys[default_pkey_idx] =DEFAULT_P_KEY ; ppd->part_enforce |=HFI1_PART_ENFORCE_IN ; - -if (loopback) { -dd_dev_err (dd,"Faking data partition 0x8001 in idx %u\n" , - !default_pkey_idx); - ppd->pkeys[!default_pkey_idx] =0x8001 ; - } + ppd->pkeys[0 ] =0x8001 ;INIT_WORK (&ppd->link_vc_work, handle_verify_cap);INIT_WORK (&ppd->link_up_work, handle_link_up);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 61/306 RDMA/iwcm: Release resources if iw_cm module initialization fails
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit e677b72a0647249370f2635862bf0241c86f66ad ]
The failure during iw_cm module initialization partially left the system with unreleased memory and other resources. Rewrite the module init/exit routines in such way that netlink commands will be opened only after successful initialization.
--- drivers/infiniband/core/iwcm.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
drivers/infiniband/core/iwcm.c +12 -7
@@ -1187,29 +1187,34 @@ static int __init iw_cm_init(void) ret =iwpm_init (RDMA_NL_IWCM );if (ret) -pr_err ("iw_cm: couldn't init iwpm\n" ); -else -rdma_nl_register (RDMA_NL_IWCM , iwcm_nl_cb_table); +return ret; + iwcm_wq =alloc_ordered_workqueue ("iw_cm_wq" ,0 );if (!iwcm_wq) -return -ENOMEM ; + goto err_alloc; iwcm_ctl_table_hdr =register_net_sysctl (&init_net,"net/iw_cm" , iwcm_ctl_table);if (!iwcm_ctl_table_hdr) {pr_err ("iw_cm: couldn't register sysctl paths\n" ); -destroy_workqueue (iwcm_wq); -return -ENOMEM ; + goto err_sysctl; } +rdma_nl_register (RDMA_NL_IWCM , iwcm_nl_cb_table);return 0 ; + +err_sysctl: +destroy_workqueue (iwcm_wq); +err_alloc: +iwpm_exit (RDMA_NL_IWCM ); +return -ENOMEM ; } static void __exit iw_cm_cleanup(void) { +rdma_nl_unregister (RDMA_NL_IWCM );unregister_net_sysctl_table (iwcm_ctl_table_hdr);destroy_workqueue (iwcm_wq); -rdma_nl_unregister (RDMA_NL_IWCM );iwpm_exit (RDMA_NL_IWCM ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 62/306 docs: Fix infiniband uverbs minor number
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit 8d7e415d55610d503fdb8815344846b72d194a40 ]
Starting from the beginning of infiniband subsystem, the uverbs char devices start from 192 as a minor number, see
commit bc38a6abdd5a ("[PATCH] IB uverbs: core implementation").
This patch updates the admin guide documentation to reflect it.
--- Documentation/admin-guide/devices.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
Documentation/admin-guide/devices.txt +3 -3
@@ -3003,10 +3003,10 @@ 65 = /dev/infiniband/issm1 Second InfiniBand IsSM device ... 127 = /dev/infiniband/issm63 63rd InfiniBand IsSM device - 128 = /dev/infiniband/uverbs0 First InfiniBand verbs device - 129 = /dev/infiniband/uverbs1 Second InfiniBand verbs device + 192 = /dev/infiniband/uverbs0 First InfiniBand verbs device + 193 = /dev/infiniband/uverbs1 Second InfiniBand verbs device ... - 159 = /dev/infiniband/uverbs31 31st InfiniBand verbs device + 223 = /dev/infiniband/uverbs31 31st InfiniBand verbs device 232 char Biometric Devices 0 = /dev/biometric/sensor0/fingerprint first fingerprint sensor on first device
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 63/306 scsi: BusLogic: Use %X for u32 sized integer rather than %lX
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 2127cd21fb78c6e22d92944253afd967b0ff774d ]
An earlier fix changed the print format specifier for adapter->bios_addr to use %lX. However, the integer is a u32 so the fix was wrong. Fix this by using the correct %X format specifier.
Addresses-Coverity: ("Invalid type in argument")
--- drivers/scsi/BusLogic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/BusLogic.c +1 -1
@@ -1845,7 +1845,7 @@ static bool __init blogic_reportconfig(struct blogic_adapter *adapter)else blogic_info ("None, " , adapter);if (adapter->bios_addr >0 ) -blogic_info ("BIOS Address: 0x%lX, " , adapter, +blogic_info ("BIOS Address: 0x%X, " , adapter, adapter->bios_addr);else blogic_info ("BIOS Address: None, " , adapter);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 64/306 pinctrl: samsung: Fix pinctrl bank pin count
In reply to Greg Kroah-HartmanFrom: Jaehyoung Choi <[email protected]>
[ Upstream commit 70115558ab02fe8d28a6634350b3491a542aaa02 ]
Commit 1abd18d1a51a ("pinctrl: samsung: Register pinctrl before GPIO") changes the order of GPIO and pinctrl registration: now pinctrl is registered before GPIO. That means gpio_chip->ngpio is not set when samsung_pinctrl_register() called, and one cannot rely on that value anymore. Use pin_bank->nr_pins' instead of pin_bank->gpio_chip.ngpio' to fix mentioned inconsistency.
--- drivers/pinctrl/samsung/pinctrl-samsung.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/samsung/pinctrl-samsung.c +1 -1
@@ -918,7 +918,7 @@ static int samsung_pinctrl_register(struct platform_device *pdev, pin_bank->grange.pin_base = drvdata->pin_base + pin_bank->pin_base; pin_bank->grange.base = pin_bank->grange.pin_base; - pin_bank->grange.npins = pin_bank->gpio_chip.ngpio; + pin_bank->grange.npins = pin_bank->nr_pins; pin_bank->grange.gc = &pin_bank->gpio_chip;pinctrl_add_gpio_range (drvdata->pctl_dev, &pin_bank->grange); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 65/306 vfio: Use config not menuconfig for VFIO_NOIOMMU
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
[ Upstream commit 26c22cfde5dd6e63f25c48458b0185dcb0fbb2fd ]
VFIO_NOIOMMU is supposed to be an element in the VFIO menu, not start a new menu. Correct this copy-paste mistake.
--- drivers/vfio/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/vfio/Kconfig +1 -1
@@ -29,7 +29,7 @@ menuconfig VFIO If you don't know what to do here, say N. -menuconfig VFIO_NOIOMMU +config VFIO_NOIOMMU bool "VFIO No-IOMMU support" depends on VFIO help
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 66/306 scsi: ufs: Fix memory corruption by ufshcd_read_desc_param()
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit d3d9c4570285090b533b00946b72647361f0345b ]
If param_offset > buff_len then the memcpy() statement in ufshcd_read_desc_param() corrupts memory since it copies 256 + buff_len - param_offset bytes into a buffer with size buff_len. Since param_offset < 256 this results in writing past the bound of the output buffer.
--- drivers/scsi/ufs/ufshcd.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/scsi/ufs/ufshcd.c +5 -3
@@ -3249,9 +3249,11 @@ int ufshcd_read_desc_param(struct ufs_hba *hba,if (is_kmalloc) {/* Make sure we don't copy more data than available */ -if (param_offset + param_size > buff_len) - param_size = buff_len - param_offset; -memcpy (param_read_buf, &desc_buf[param_offset], param_size); +if (param_offset >= buff_len) + ret = -EINVAL ; +else +memcpy (param_read_buf, &desc_buf[param_offset], +min_t (u32, param_size, buff_len - param_offset)); } out:if (is_kmalloc)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 67/306 cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards
In reply to Greg Kroah-HartmanFrom: Gautham R. Shenoy <[email protected]>
[ Upstream commit 50741b70b0cbbafbd9199f5180e66c0c53783a4a ]
Commit d947fb4c965c ("cpuidle: pseries: Fixup exit latency for CEDE(0)") sets the exit latency of CEDE(0) based on the latency values of the Extended CEDE states advertised by the platform
On POWER9 LPARs, the firmwares advertise a very low value of 2us for CEDE1 exit latency on a Dedicated LPAR. The latency advertized by the PHYP hypervisor corresponds to the latency required to wakeup from the underlying hardware idle state. However the wakeup latency from the LPAR perspective should include
1. The time taken to transition the CPU from the Hypervisor into the LPAR post wakeup from platform idle state
2. Time taken to send the IPI from the source CPU (waker) to the idle target CPU (wakee).
1. can be measured via timer idle test, where we queue a timer, say for 1ms, and enter the CEDE state. When the timer fires, in the timer handler we compute how much extra timer over the expected 1ms have we consumed. On a a POWER9 LPAR the numbers are
CEDE latency measured using a timer (numbers in ns)
N Min Median Avg 90%ile 99%ile Max Stddev 400 2601 5677 5668.74 5917 6413 9299 455.01
1. and 2. combined can be determined by an IPI latency test where we send an IPI to an idle CPU and in the handler compute the time difference between when the IPI was sent and when the handler ran. We see the following numbers on POWER9 LPAR.
CEDE latency measured using an IPI (numbers in ns)
N Min Median Avg 90%ile 99%ile Max Stddev 400 711 7564 7369.43 8559 9514 9698 1200.01
Suppose, we consider the 99th percentile latency value measured using the IPI to be the wakeup latency, the value would be 9.5us This is in the ballpark of the default value of 10us.
Hence, use the exit latency of CEDE(0) based on the latency values advertized by platform only from POWER10 onwards. The values advertized on POWER10 platforms is more realistic and informed by the latency measurements. For earlier platforms stick to the default value of 10us. The fix was suggested by Michael Ellerman.
--- drivers/cpuidle/cpuidle-pseries.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/cpuidle/cpuidle-pseries.c +15 -1
@@ -419,7 +419,21 @@ static int pseries_idle_probe(void) cpuidle_state_table = shared_states; max_idle_state =ARRAY_SIZE (shared_states); }else { -fixup_cede0_latency (); +/* +* Use firmware provided latency values +* starting with POWER10 platforms. In the +* case that we are running on a POWER10 +* platform but in an earlier compat mode, we +* can still use the firmware provided values. +* +* However, on platforms prior to POWER10, we +* cannot rely on the accuracy of the firmware +* provided latency values. On such platforms, +* go with the conservative default estimate +* of 10us. +*/ +if (cpu_has_feature (CPU_FTR_ARCH_31 ) ||pvr_version_is (PVR_POWER10 )) +fixup_cede0_latency (); cpuidle_state_table = dedicated_states; max_idle_state =NR_DEDICATED_STATES ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 68/306 powerpc/stacktrace: Include linux/delay.h
In reply to Greg Kroah-HartmanFrom: Michal Suchanek <[email protected]>
[ Upstream commit a6cae77f1bc89368a4e2822afcddc45c3062d499 ]
commit 7c6986ade69e ("powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi()") introduces udelay() call without including the linux/delay.h header.
This may happen to work on master but the header that declares the functionshould be included nonetheless.
--- arch/powerpc/kernel/stacktrace.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/kernel/stacktrace.c +1 -0
@@ -8,6 +8,7 @@* Copyright 2018 Nick Piggin, Michael Ellerman, IBM Corp. */ +#include <linux/delay.h> #include <linux/export.h> #include <linux/kallsyms.h> #include <linux/module.h>
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 69/306 RDMA/efa: Remove double QP type assignment
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit f9193d266347fe9bed5c173e7a1bf96268142a79 ]
The QP type is set by the IB/core and shouldn't be set in the driver.
--- drivers/infiniband/hw/efa/efa_verbs.c | 1 - 1 file changed, 1 deletion(-)
drivers/infiniband/hw/efa/efa_verbs.c +0 -1
@@ -717,7 +717,6 @@ struct ib_qp *efa_create_qp(struct ib_pd *ibpd, qp->qp_handle = create_qp_resp.qp_handle; qp->ibqp.qp_num = create_qp_resp.qp_num; - qp->ibqp.qp_type = init_attr->qp_type; qp->max_send_wr = init_attr->cap.max_send_wr; qp->max_recv_wr = init_attr->cap.max_recv_wr; qp->max_send_sge = init_attr->cap.max_send_sge;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 70/306 RDMA/mlx5: Delete not-available udata check
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit 5f6bb7e32283b8e3339b7adc00638234ac199cc4 ]
XRC_TGT QPs are created through kernel verbs and don't have udata at all.
--- drivers/infiniband/hw/mlx5/qp.c | 3 --- 1 file changed, 3 deletions(-)
drivers/infiniband/hw/mlx5/qp.c +0 -3
@@ -1842,7 +1842,6 @@ static int get_atomic_mode(struct mlx5_ib_dev *dev,static int create_xrc_tgt_qp (struct mlx5_ib_dev *dev,struct mlx5_ib_qp *qp,struct mlx5_create_qp_params *params) { -struct mlx5_ib_create_qp *ucmd = params->ucmd;struct ib_qp_init_attr *attr = params->attr;u32 uidx = params->uidx;struct mlx5_ib_resources *devr = &dev->devr;
@@ -1862,8 +1861,6 @@ static int create_xrc_tgt_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,if (!in)return -ENOMEM ; -if (MLX5_CAP_GEN (mdev, ece_support) && ucmd) -MLX5_SET (create_qp_in, in, ece, ucmd->ece_options); qpc =MLX5_ADDR_OF (create_qp_in, in, qpc);MLX5_SET (qpc, qpc, st,MLX5_QP_ST_XRC );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 71/306 cpuidle: pseries: Mark pseries_idle_proble() as __init
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit d04691d373e75c83424b85c0e68e4a3f9370c10d ]
After commit 7cbd631d4dec ("cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards"), pseries_idle_probe() is no longer inlined when compiling with clang, which causes a modpost warning:
WARNING: modpost: vmlinux.o(.text+0xc86a54): Section mismatch in reference from the function pseries_idle_probe() to the function .init.text:fixup_cede0_latency()
The function pseries_idle_probe() references
the function __init fixup_cede0_latency().
This is often because pseries_idle_probe lacks a __init annotation or the annotation of fixup_cede0_latency is wrong.
pseries_idle_probe() is a non-init function, which calls fixup_cede0_latency(), which is an init function, explaining the mismatch. pseries_idle_probe() is only called from pseries_processor_idle_init(), which is an init function, so mark pseries_idle_probe() as __init so there is no more warning.
--- drivers/cpuidle/cpuidle-pseries.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpuidle/cpuidle-pseries.c +1 -1
@@ -402,7 +402,7 @@ static void __init fixup_cede0_latency(void)* pseries_idle_probe() * Choose state table for shared versus dedicated partition */ -static int pseries_idle_probe (void ) +static int __init pseries_idle_probe (void ) {if (cpuidle_disable !=IDLE_NO_OVERRIDE )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 72/306 f2fs: reduce the scope of setting fsck tag when de->name_len is zero
In reply to Greg Kroah-HartmanFrom: Yangtao Li <[email protected]>
[ Upstream commit d4bf15a7ce172d186d400d606adf4f34a59130d6 ]
I recently found a case where de->name_len is 0 in f2fs_fill_dentries() easily reproduced, and finally set the fsck flag.
Thread A Thread B
- f2fs_readdir
- f2fs_read_inline_dir
- ctx->pos = d.max
- f2fs_add_dentry
- f2fs_add_inline_entry
- do_convert_inline_dir
- f2fs_add_regular_entry
- f2fs_readdir
- f2fs_fill_dentries
- set_sbi_flag(sbi, SBI_NEED_FSCK)
Process A opens the folder, and has been reading without closing it. During this period, Process B created a file under the folder (occupying multiple f2fs_dir_entry, exceeding the d.max of the inline dir). After creation, process A uses the d.max of inline dir to read it again, and it will read that de->name_len is 0.
And Chao pointed out that w/o inline conversion, the race condition still can happen as below:
dir_entry1: Adir_entry2: Bdir_entry3: C
free slot: _ctx->pos: ^
Thread A is traversing directory,
ctx-pos moves to below position after readdir() by thread A:AAAABBBB___
^
Then thread B delete dir_entry2, and create dir_entry3.
Thread A calls readdir() to lookup dirents starting from middle of new dirent slots as below:AAAACCCCCC_
^
In these scenarios, the file system is not damaged, and it's hard to avoid it. But we can bypass tagging FSCK flag if:
a) bit_pos (:= ctx->pos % d->max) is non-zero and
b) before bit_pos moves to first valid dir_entry.
--- fs/f2fs/dir.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
fs/f2fs/dir.c +9 -5
@@ -938,6 +938,7 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,struct f2fs_sb_info *sbi =F2FS_I_SB (d->inode);struct blk_plug plug;bool readdir_ra = sbi->readdir_ra ==1 ; +bool found_valid_dirent = false;int err =0 ; bit_pos = ((unsigned long )ctx->pos % d->max);
@@ -952,13 +953,15 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, de = &d->dentry[bit_pos];if (de->name_len ==0 ) { +if (found_valid_dirent || !bit_pos) { +printk_ratelimited ( +"%sF2FS-fs (%s): invalid namelen(0), ino:%u, run fsck to fix." , +KERN_WARNING , sbi->sb->s_id, +le32_to_cpu (de->ino)); +set_sbi_flag (sbi,SBI_NEED_FSCK ); + } bit_pos++; ctx->pos = start_pos + bit_pos; -printk_ratelimited ( -"%sF2FS-fs (%s): invalid namelen(0), ino:%u, run fsck to fix." , -KERN_WARNING , sbi->sb->s_id, -le32_to_cpu (de->ino)); -set_sbi_flag (sbi,SBI_NEED_FSCK );continue ; }
@@ -1001,6 +1004,7 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,f2fs_ra_node_page (sbi,le32_to_cpu (de->ino)); ctx->pos = start_pos + bit_pos; + found_valid_dirent = true; } out:if (readdir_ra)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 73/306 openrisc: dont printk() unconditionally
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 946e1052cdcc7e585ee5d1e72528ca49fb295243 ]
Don't call printk() when CONFIG_PRINTK is not set. Fixes the following build errors:
or1k-linux-ld: arch/openrisc/kernel/entry.o: in function `_external_irq_handler':
(.text+0x804): undefined reference to `printk'
(.text+0x804): relocation truncated to fit: R_OR1K_INSN_REL_26 against undefined symbol `printk'
--- arch/openrisc/kernel/entry.S | 2 ++ 1 file changed, 2 insertions(+)
arch/openrisc/kernel/entry.S +2 -0
@@ -547,6 +547,7 @@ EXCEPTION_ENTRY(_external_irq_handler) l.bnf 1f // ext irq enabled, all ok. l.nop +#ifdef CONFIG_PRINTK l.addi r1,r1,-0x8 l.movhi r3,hi(42f) l.ori r3,r3,lo(42f)
@@ -560,6 +561,7 @@ EXCEPTION_ENTRY(_external_irq_handler) .string "\n\rESR interrupt bug: in _external_irq_handler (ESR %x)\n\r" .align 4 .previous +#endif l.ori r4,r4,SPR_SR_IEE // fix the bug // l.sw PT_SR(r1),r4
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 74/306 dma-debug: fix debugfs initialization order
In reply to Greg Kroah-HartmanFrom: Anthony Iliopoulos <[email protected]>
[ Upstream commit 173735c346c412d9f084825ecb04f24ada0e2986 ]
Due to link order, dma_debug_init is called before debugfs has a chance to initialize (via debugfs_init which also happens in the core initcall stage), so the directories for dma-debug are never created.
Decouple dma_debug_fs_init from dma_debug_init and defer its init until core_initcall_sync (after debugfs has been initialized) while letting dma-debug initialization occur as soon as possible to catch any early mappings, as suggested in [1].
[1] https://lore.kernel.org/linux-iommu/YIgGa6yF%[email protected]/
--- kernel/dma/debug.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
kernel/dma/debug.c +4 -3
@@ -794,7 +794,7 @@ static int dump_show(struct seq_file *seq, void *v) }DEFINE_SHOW_ATTRIBUTE (dump); -static void dma_debug_fs_init (void ) +static int __init dma_debug_fs_init (void ) {struct dentry *dentry =debugfs_create_dir ("dma-api" ,NULL );
@@ -807,7 +807,10 @@ static void dma_debug_fs_init(void)debugfs_create_u32 ("nr_total_entries" ,0444 , dentry, &nr_total_entries);debugfs_create_file ("driver_filter" ,0644 , dentry,NULL , &filter_fops);debugfs_create_file ("dump" ,0444 , dentry,NULL , &dump_fops); + +return 0 ; } +core_initcall_sync (dma_debug_fs_init);static int device_dma_allocations (struct device *dev,struct dma_debug_entry **out_entry) {
@@ -892,8 +895,6 @@ static int dma_debug_init(void)spin_lock_init (&dma_entry_hash[i].lock); } -dma_debug_fs_init (); - nr_pages =DIV_ROUND_UP (nr_prealloc_entries,DMA_DEBUG_DYNAMIC_ENTRIES );for (i =0 ; i < nr_pages; ++i)dma_debug_create_entries (GFP_KERNEL );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 75/306 NFSv4/pNFS: Fix a layoutget livelock loop
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit e20772cbdf463c12088837e5a08bde1b876bfd25 ]
If NFS_LAYOUT_RETURN_REQUESTED is set, but there is no value set for the layout plh_return_seq, we can end up in a livelock loop in which every layout segment retrieved by a new call to layoutget is immediately invalidated by pnfs_layout_need_return().
To get around this, we should just set plh_return_seq to the current value of the layout stateid's seqid.
--- fs/nfs/pnfs.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
fs/nfs/pnfs.c +8 -4
@@ -347,11 +347,15 @@ pnfs_set_plh_return_info(struct pnfs_layout_hdr *lo, enum pnfs_iomode iomode, iomode =IOMODE_ANY ; lo->plh_return_iomode = iomode;set_bit (NFS_LAYOUT_RETURN_REQUESTED , &lo->plh_flags); -if (seq !=0 ) { -WARN_ON_ONCE (lo->plh_return_seq !=0 && lo->plh_return_seq != seq); +/* +* We must set lo->plh_return_seq to avoid livelocks with +* pnfs_layout_need_return() +*/ +if (seq ==0 ) + seq =be32_to_cpu (lo->plh_stateid.seqid); +if (!lo->plh_return_seq ||pnfs_seqid_is_newer (seq, lo->plh_return_seq)) lo->plh_return_seq = seq; -pnfs_barrier_update (lo, seq); - } +pnfs_barrier_update (lo, seq); } static void
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 76/306 NFSv4/pNFS: Always allow update of a zero valued layout barrier
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit 45baadaad7bf9183651fb74f4ed1200da48505a5 ]
A zero value for the layout barrier indicates that it has been cleared (since seqid '0' is an illegal value), so we should always allow it to be updated.
--- fs/nfs/pnfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/pnfs.c +1 -1
@@ -335,7 +335,7 @@ static bool pnfs_seqid_is_newer(u32 s1, u32 s2)static void pnfs_barrier_update (struct pnfs_layout_hdr *lo,u32 newseq) { -if (pnfs_seqid_is_newer (newseq, lo->plh_barrier)) +if (pnfs_seqid_is_newer (newseq, lo->plh_barrier) || !lo->plh_barrier) lo->plh_barrier = newseq; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 77/306 NFSv4/pnfs: The layout barrier indicate a minimal value for the seqid
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit d6236a98b3bab07c0a1455fd1ab46f79c3978cdc ]
The intention of the layout barrier is to ensure that we do not update the layout to match an older value than the current expectation. Fix the test in pnfs_layout_stateid_blocked() to reflect that it is legal for the seqid of the stateid to match that of the barrier.
--- fs/nfs/pnfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/pnfs.c +1 -1
@@ -1004,7 +1004,7 @@ pnfs_layout_stateid_blocked(const struct pnfs_layout_hdr *lo, {u32 seqid =be32_to_cpu (stateid->seqid); -return !pnfs_seqid_is_newer (seqid, lo->plh_barrier) && lo->plh_barrier; +return lo->plh_barrier &&pnfs_seqid_is_newer (lo->plh_barrier, seqid); }/* lget is set to 1 if called from inside send_layoutget call chain */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 78/306 SUNRPC: Fix potential memory corruption
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit c2dc3e5fad13aca5d7bdf4bcb52b1a1d707c8555 ]
We really should not call rpc_wake_up_queued_task_set_status() with xprt->snd_task as an argument unless we are certain that is actually an rpc_task.
--- include/linux/sunrpc/xprt.h | 1 + net/sunrpc/xprt.c | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-)
include/linux/sunrpc/xprt.h +1 -0
@@ -421,6 +421,7 @@ void xprt_unlock_connect(struct rpc_xprt *, void *);#define XPRT_CONGESTED (9)#define XPRT_CWND_WAIT (10)#define XPRT_WRITE_SPACE (11) +#define XPRT_SND_IS_COOKIE (12)static inline void xprt_set_connected (struct rpc_xprt *xprt) {
net/sunrpc/xprt.c +4 -2
@@ -746,9 +746,9 @@ void xprt_force_disconnect(struct rpc_xprt *xprt)/* Try to schedule an autoclose RPC call */ if (test_and_set_bit (XPRT_LOCKED , &xprt->state) ==0 )queue_work (xprtiod_workqueue, &xprt->task_cleanup); -else if (xprt->snd_task) +else if (xprt->snd_task && !test_bit (XPRT_SND_IS_COOKIE , &xprt->state))rpc_wake_up_queued_task_set_status (&xprt->pending, - xprt->snd_task, -ENOTCONN ); + xprt->snd_task, -ENOTCONN );spin_unlock (&xprt->transport_lock); }EXPORT_SYMBOL_GPL (xprt_force_disconnect);
@@ -837,6 +837,7 @@ bool xprt_lock_connect(struct rpc_xprt *xprt, goto out;if (xprt->snd_task != task) goto out; +set_bit (XPRT_SND_IS_COOKIE , &xprt->state); xprt->snd_task = cookie; ret = true; out:
@@ -852,6 +853,7 @@ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie)if (!test_bit (XPRT_LOCKED , &xprt->state)) goto out; xprt->snd_task =NULL ; +clear_bit (XPRT_SND_IS_COOKIE , &xprt->state); xprt->ops->release_xprt (xprt,NULL );xprt_schedule_autodisconnect (xprt); out:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 79/306 SUNRPC/xprtrdma: Fix reconnection locking
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit f99fa50880f5300fbbb3c0754ddc7f8738d24fe7 ]
The xprtrdma client code currently relies on the task that initiated the connect to hold the XPRT_LOCK for the duration of the connection attempt. If the task is woken early, due to some other event, then that lock could get released early.
Avoid races by using the same mechanism that the socket code uses of transferring lock ownership to the RDMA connect worker itself. That frees us to call rpcrdma_xprt_disconnect() directly since we're now guaranteed exclusion w.r.t. other callers.
--- net/sunrpc/xprt.c | 2 ++ net/sunrpc/xprtrdma/transport.c | 11 +++++------ 2 files changed, 7 insertions(+), 6 deletions(-)
net/sunrpc/xprt.c +2 -0
@@ -844,6 +844,7 @@ bool xprt_lock_connect(struct rpc_xprt *xprt,spin_unlock (&xprt->transport_lock);return ret; } +EXPORT_SYMBOL_GPL (xprt_lock_connect);void xprt_unlock_connect (struct rpc_xprt *xprt,void *cookie) {
@@ -860,6 +861,7 @@ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie)spin_unlock (&xprt->transport_lock);wake_up_bit (&xprt->state,XPRT_LOCKED ); } +EXPORT_SYMBOL_GPL (xprt_unlock_connect);/** * xprt_connect - schedule a transport connect operation
net/sunrpc/xprtrdma/transport.c +5 -6
@@ -249,12 +249,9 @@ xprt_rdma_connect_worker(struct work_struct *work) xprt->stat.connect_start;xprt_set_connected (xprt); rc = -EAGAIN ; - }else { -/* Force a call to xprt_rdma_close to clean up */ -spin_lock (&xprt->transport_lock); -set_bit (XPRT_CLOSE_WAIT , &xprt->state); -spin_unlock (&xprt->transport_lock); - } + }else +rpcrdma_xprt_disconnect (r_xprt); +xprt_unlock_connect (xprt, r_xprt);xprt_wake_pending_tasks (xprt, rc); }
@@ -487,6 +484,8 @@ xprt_rdma_connect(struct rpc_xprt *xprt, struct rpc_task *task)struct rpcrdma_ep *ep = r_xprt->rx_ep;unsigned long delay; +WARN_ON_ONCE (!xprt_lock_connect (xprt, task, r_xprt)); + delay =0 ;if (ep && ep->re_connect_status !=0 ) { delay =xprt_reconnect_delay (xprt);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 80/306 SUNRPC query transports source port
In reply to Greg Kroah-HartmanFrom: Olga Kornievskaia <[email protected]>
[ Upstream commit a8482488a7d6d320f63a9ee1912dbb5ae5b80a61 ]
Provide ability to query transport's source port.
--- include/linux/sunrpc/xprtsock.h | 1 + net/sunrpc/xprtsock.c | 7 +++++++ 2 files changed, 8 insertions(+)
include/linux/sunrpc/xprtsock.h +1 -0
@@ -10,6 +10,7 @@int init_socket_xprt (void );void cleanup_socket_xprt (void ); +unsigned short get_srcport (struct rpc_xprt *);#define RPC_MIN_RESVPORT (1U)#define RPC_MAX_RESVPORT (65535U)
net/sunrpc/xprtsock.c +7 -0
@@ -1639,6 +1639,13 @@ static int xs_get_srcport(struct sock_xprt *transport)return port; } +unsigned short get_srcport (struct rpc_xprt *xprt) +{ + struct sock_xprt *sock = container_of(xprt, struct sock_xprt, xprt); +return sock->srcport; +} +EXPORT_SYMBOL (get_srcport); +static unsigned short xs_next_srcport (struct sock_xprt *transport,unsigned short port) {if (transport->srcport !=0 )
Signature · 1 line
2.30.2
Re: [PATCH 5.10 080/306] SUNRPC query transports source port
Hi!
Quoted 3 lines
[ Upstream commit
a8482488a7d6d320f63a9ee1912dbb5ae5b80a61]Provide ability to query transport's source port.
This adds unused function to 5.10 kernel. Next patch fixes it up, but user does not show up. Do we want it in 5.10-stable?
Best regards,
Pavel
Quoted 15 lines
+++
b/net/sunrpc/xprtsock.cnet/sunrpc/xprtsock.c +7
-0@@ -1639,6 +1639,13 @@ static int xs_get_srcport(struct sock_xprt *transport)return port; } +unsigned short get_srcport (struct rpc_xprt *xprt) +{ + struct sock_xprt *sock = container_of(xprt, struct sock_xprt, xprt); +return sock->srcport; +} +EXPORT_SYMBOL (get_srcport); +static unsigned short xs_next_srcport (struct sock_xprt *transport,unsigned short port) {if (transport->srcport !=0 )
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerPATCH 81/306 sunrpc: Fix return value of get_srcport()
In reply to Greg Kroah-HartmanFrom: Anna Schumaker <[email protected]>
[ Upstream commit 5d46dd04cb68771f77ba66dbf6fd323a4a2ce00d ]
Since bc1c56e9bbe9 transport->srcport may by unset, causing get_srcport() to return 0 when called. Fix this by querying the port from the underlying socket instead of the transport.
--- net/sunrpc/xprtsock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sunrpc/xprtsock.c +1 -1
@@ -1642,7 +1642,7 @@ static int xs_get_srcport(struct sock_xprt *transport)unsigned short get_srcport (struct rpc_xprt *xprt) { struct sock_xprt *sock = container_of(xprt, struct sock_xprt, xprt); -return sock->srcport; +return xs_sock_getport (sock->sock); }EXPORT_SYMBOL (get_srcport);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 82/306 scsi: fdomain: Fix error return code in fdomain_probe()
In reply to Greg Kroah-HartmanFrom: Wei Li <[email protected]>
[ Upstream commit 632c4ae6da1d629eddf9da1e692d7617c568c256 ]
If request_region() fails the return value is not set. Return -EBUSY on error.
--- drivers/scsi/pcmcia/fdomain_cs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/pcmcia/fdomain_cs.c +3 -1
@@ -45,8 +45,10 @@ static int fdomain_probe(struct pcmcia_device *link) goto fail_disable;if (!request_region (link->resource[0 ]->start,FDOMAIN_REGION_SIZE , -"fdomain_cs" )) +"fdomain_cs" )) { + ret = -EBUSY ; goto fail_disable; + } sh =fdomain_create (link->resource[0 ]->start, link->irq,7 , &link->dev);if (!sh) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 83/306 pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
[ Upstream commit d789a490d32fdf0465275e3607f8a3bc87d3f3ba ]
Fix to return -ENOTSUPP instead of 0 when PCS_HAS_PINCONF is true, which is the same as that returned in pcs_parse_pinconf().
--- drivers/pinctrl/pinctrl-single.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/pinctrl-single.c +1 -0
@@ -1222,6 +1222,7 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs,if (PCS_HAS_PINCONF ) {dev_err (pcs->dev,"pinconf not supported\n" ); + res = -ENOTSUPP ; goto free_pingroups; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 84/306 powerpc/numa: Consider the max NUMA node for migratable LPAR
In reply to Greg Kroah-HartmanFrom: Laurent Dufour <[email protected]>
[ Upstream commit 9c7248bb8de31f51c693bfa6a6ea53b1c07e0fa8 ]
When a LPAR is migratable, we should consider the maximum possible NUMA node instead of the number of NUMA nodes from the actual system.
The DT property 'ibm,current-associativity-domains' defines the maximum number of nodes the LPAR can see when running on that box. But if the LPAR is being migrated on another box, it may see up to the nodes defined by 'ibm,max-associativity-domains'. So if a LPAR is migratable, that value should be used.
Unfortunately, there is no easy way to know if an LPAR is migratable or not. The hypervisor exports the property 'ibm,migratable-partition' in the case it set to migrate partition, but that would not mean that the current partition is migratable.
Without this patch, when a LPAR is started on a 2 node box and then migrated to a 3 node box, the hypervisor may spread the LPAR's CPUs on the 3rd node. In that case if a CPU from that 3rd node is added to the LPAR, it will be wrongly assigned to the node because the kernel has been set to use up to 2 nodes (the configuration of the departure node). With this patch applies, the CPU is correctly added to the 3rd node.
--- arch/powerpc/mm/numa.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
arch/powerpc/mm/numa.c +10 -3
@@ -893,7 +893,7 @@ static void __init setup_node_data(int nid, u64 start_pfn, u64 end_pfn)static void __init find_possible_nodes (void ) {struct device_node *rtas; -const __be32 *domains; +const __be32 *domains =NULL ;int prop_length, max_nodes;u32 i;
@@ -909,9 +909,14 @@ static void __init find_possible_nodes(void)* it doesn't exist, then fallback on ibm,max-associativity-domains. * Current denotes what the platform can support compared to max * which denotes what the Hypervisor can support. +* +* If the LPAR is migratable, new nodes might be activated after a LPM, +* so we should consider the max number in that case. */ - domains =of_get_property (rtas,"ibm,current-associativity-domains" , - &prop_length); +if (!of_get_property (of_root,"ibm,migratable-partition" ,NULL )) + domains =of_get_property (rtas, +"ibm,current-associativity-domains" , + &prop_length);if (!domains) { domains =of_get_property (rtas,"ibm,max-associativity-domains" , &prop_length);
@@ -920,6 +925,8 @@ static void __init find_possible_nodes(void) } max_nodes =of_read_number (&domains[min_common_depth],1 ); +pr_info ("Partition configured for %d NUMA nodes.\n" , max_nodes); +for (i =0 ; i < max_nodes; i++) {if (!node_possible (i))node_set (i, node_possible_map);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 85/306 scsi: smartpqi: Fix an error code in pqi_get_raid_map()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit d1f6581a6796c4e9fd8a4a24e8b77463d18f0df1 ]
Return -EINVAL on failure instead of success.
--- drivers/scsi/smartpqi/smartpqi_init.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/smartpqi/smartpqi_init.c +1 -0
@@ -1207,6 +1207,7 @@ static int pqi_get_raid_map(struct pqi_ctrl_info *ctrl_info,"Requested %d bytes, received %d bytes" , raid_map_size, get_unaligned_le32(&raid_map->structure_size)); + rc = -EINVAL ; goto error; } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 86/306 scsi: qedi: Fix error codes in qedi_alloc_global_queues()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 4dbe57d46d54a847875fa33e7d05877bb341585e ]
This function had some left over code that returned 1 on error instead negative error codes. Convert everything to use negative error codes. The caller treats all non-zero returns the same so this does not affect run time.
A couple places set "rc" instead of "status" so those error paths ended up returning success by mistake. Get rid of the "rc" variable and use "status" everywhere.
Remove the bogus "status = 0" initialization, as a future proofing measure so the compiler will warn about uninitialized error codes.
--- drivers/scsi/qedi/qedi_main.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/scsi/qedi/qedi_main.c +7 -7
@@ -1623,7 +1623,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi) {u32 *list;int i; -int status =0 , rc; +int status;u32 *pbl;dma_addr_t page;int num_pages;
@@ -1634,14 +1634,14 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)*/ if (!qedi->num_queues) {QEDI_ERR (&qedi->dbg_ctx,"No MSI-X vectors available!\n" ); -return 1 ; +return -ENOMEM ; }/* Make sure we allocated the PBL that will contain the physical * addresses of our queues */ if (!qedi->p_cpuq) { - status =1 ; + status = -EINVAL ; goto mem_alloc_failure; }
@@ -1656,13 +1656,13 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi) "qedi->global_queues=%p.\n", qedi->global_queues);/* Allocate DMA coherent buffers for BDQ */ - rc =qedi_alloc_bdq (qedi); -if (rc) + status =qedi_alloc_bdq (qedi); +if (status) goto mem_alloc_failure;/* Allocate DMA coherent buffers for NVM_ISCSI_CFG */ - rc =qedi_alloc_nvm_iscsi_cfg (qedi); -if (rc) + status =qedi_alloc_nvm_iscsi_cfg (qedi); +if (status) goto mem_alloc_failure;/* Allocate a CQ and an associated PBL for each MSI-X
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 87/306 scsi: qedf: Fix error codes in qedf_alloc_global_queues()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit ccc89737aa6b9f248cf1623014038beb6c2b7f56 ]
This driver has some left over "return 1" on failure style code mixed with "return negative error codes" style code. The caller doesn't care so we should just convert everything to return negative error codes.
Then there was a problem that there were two variables used to store error codes which just resulted in confusion. If qedf_alloc_bdq() returned a negative error code, we accidentally returned success instead of propagating the error code. So get rid of the "rc" variable and use "status" every where.
Also remove the "status = 0" initialization so that these sorts of bugs will be detected by the compiler in the future.
--- drivers/scsi/qedf/qedf_main.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/scsi/qedf/qedf_main.c +5 -5
@@ -3000,7 +3000,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf) {u32 *list;int i; -int status =0 , rc; +int status;u32 *pbl;dma_addr_t page;int num_pages;
@@ -3012,7 +3012,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)*/ if (!qedf->num_queues) {QEDF_ERR (&(qedf->dbg_ctx),"No MSI-X vectors available!\n" ); -return 1 ; +return -ENOMEM ; }/*
@@ -3020,7 +3020,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)* addresses of our queues */ if (!qedf->p_cpuq) { - status =1 ; + status = -EINVAL ;QEDF_ERR (&qedf->dbg_ctx,"p_cpuq is NULL.\n" ); goto mem_alloc_failure; }
@@ -3036,8 +3036,8 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf) "qedf->global_queues=%p.\n", qedf->global_queues);/* Allocate DMA coherent buffers for BDQ */ - rc =qedf_alloc_bdq (qedf); -if (rc) { + status =qedf_alloc_bdq (qedf); +if (status) {QEDF_ERR (&qedf->dbg_ctx,"Unable to allocate bdq.\n" ); goto mem_alloc_failure; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 88/306 powerpc/config: Renable MTD_PHYSMAP_OF
In reply to Greg Kroah-HartmanFrom: Joel Stanley <[email protected]>
[ Upstream commit d0e28a6145c3455b69991245e7f6147eb914b34a ]
CONFIG_MTD_PHYSMAP_OF is not longer enabled as it depends on MTD_PHYSMAP which is not enabled.
This is a regression from commit 642b1e8dbed7 ("mtd: maps: Merge physmap_of.c into physmap-core.c"), which added the extra dependency. Add CONFIG_MTD_PHYSMAP=y so this stays in the config, as Christophe said it is useful for build coverage.
--- arch/powerpc/configs/mpc885_ads_defconfig | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/configs/mpc885_ads_defconfig +1 -0
@@ -34,6 +34,7 @@ CONFIG_MTD_CFI_GEOMETRY=y # CONFIG_MTD_CFI_I2 is not set CONFIG_MTD_CFI_I4=y CONFIG_MTD_CFI_AMDSTD=y +CONFIG_MTD_PHYSMAP=y CONFIG_MTD_PHYSMAP_OF=y # CONFIG_BLK_DEV is not set CONFIG_NETDEVICES=y
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 89/306 iommu/vt-d: Update the virtual command related registers
In reply to Greg Kroah-HartmanFrom: Lu Baolu <[email protected]>
[ Upstream commit 4d99efb229e63928c6b03a756a2e38cd4777fbe8 ]
The VT-d spec Revision 3.3 updated the virtual command registers, virtual command opcode B register, virtual command response register and virtual command capability register (Section 10.4.43, 10.4.44, 10.4.45, 10.4.46). This updates the virtual command interface implementation in the Intel IOMMU driver accordingly.
--- drivers/iommu/intel/pasid.h | 10 +++++----- include/linux/intel-iommu.h | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-)
drivers/iommu/intel/pasid.h +5 -5
@@ -28,12 +28,12 @@#define VCMD_CMD_ALLOC 0x1#define VCMD_CMD_FREE 0x2#define VCMD_VRSP_IP 0x1 -#define VCMD_VRSP_SC (e) (((e) >> 1) & 0x3) +#define VCMD_VRSP_SC (e) (((e) & 0xff) >> 1)#define VCMD_VRSP_SC_SUCCESS 0 -#define VCMD_VRSP_SC_NO_PASID_AVAIL 2 -#define VCMD_VRSP_SC_INVALID_PASID 2 -#define VCMD_VRSP_RESULT_PASID (e) (((e) >> 8) & 0xfffff) -#define VCMD_CMD_OPERAND (e) ((e) << 8) +#define VCMD_VRSP_SC_NO_PASID_AVAIL 16 +#define VCMD_VRSP_SC_INVALID_PASID 16 +#define VCMD_VRSP_RESULT_PASID (e) (((e) >> 16) & 0xfffff) +#define VCMD_CMD_OPERAND (e) ((e) << 16)/* * Domain ID reserved for pasid entries programmed for first-level * only and pass-through transfer modes.
include/linux/intel-iommu.h +3 -3
@@ -122,9 +122,9 @@#define DMAR_MTRR_PHYSMASK8_REG 0x208#define DMAR_MTRR_PHYSBASE9_REG 0x210#define DMAR_MTRR_PHYSMASK9_REG 0x218 -#define DMAR_VCCAP_REG 0xe00/* Virtual command capability register */ -#define DMAR_VCMD_REG 0xe10/* Virtual command register */ -#define DMAR_VCRSP_REG 0xe20/* Virtual command response register */ +#define DMAR_VCCAP_REG 0xe30/* Virtual command capability register */ +#define DMAR_VCMD_REG 0xe00/* Virtual command register */ +#define DMAR_VCRSP_REG 0xe10/* Virtual command response register */ #define OFFSET_STRIDE (9)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 90/306 HID: i2c-hid: Fix Elan touchpad regression
In reply to Greg Kroah-HartmanFrom: Jim Broadus <[email protected]>
[ Upstream commit 786537063bbfb3a7ebc6fc21b2baf37fb91df401 ]
A quirk was recently added for Elan devices that has same device match as an entry earlier in the list. The i2c_hid_lookup_quirk function will always return the last match in the list, so the new entry shadows the old entry. The quirk in the previous entry, I2C_HID_QUIRK_BOGUS_IRQ, silenced a flood of messages which have reappeared in the 5.13 kernel.
This change moves the two quirk flags into the same entry.
--- drivers/hid/i2c-hid/i2c-hid-core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/hid/i2c-hid/i2c-hid-core.c +2 -3
@@ -176,8 +176,6 @@ static const struct i2c_hid_quirks { I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, {I2C_VENDOR_ID_RAYDIUM ,I2C_PRODUCT_ID_RAYDIUM_3118 , I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, - { USB_VENDOR_ID_ELAN, HID_ANY_ID, - I2C_HID_QUIRK_BOGUS_IRQ }, { USB_VENDOR_ID_ALPS_JP, HID_ANY_ID, I2C_HID_QUIRK_RESET_ON_RESUME }, { I2C_VENDOR_ID_SYNAPTICS, I2C_PRODUCT_ID_SYNAPTICS_SYNA2393,
@@ -188,7 +186,8 @@ static const struct i2c_hid_quirks {* Sending the wakeup after reset actually break ELAN touchscreen controller */ {USB_VENDOR_ID_ELAN ,HID_ANY_ID , - I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET }, +I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET | + I2C_HID_QUIRK_BOGUS_IRQ }, { 0, 0 } };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 91/306 clk: imx8m: fix clock tree update of TF-A managed clocks
In reply to Greg Kroah-HartmanFrom: Ahmad Fatoum <[email protected]>
[ Upstream commit d36207b848a6490e14664e2197a1c8ab51d8148e ]
On the i.MX8M*, the TF-A exposes a SiP (Silicon Provider) service for DDR frequency scaling. The imx8m-ddrc-devfreq driver calls the SiP and then does clk_set_parent on the DDR muxes to synchronize the clock tree.
Since 936c383673b9 ("clk: imx: fix composite peripheral flags"), these TF-A managed muxes have SET_PARENT_GATE set, which results in imx8m-ddrc-devfreq's clk_set_parent after SiP failing with -EBUSY:
echo 25000000 > userspace/set_freq imx8m-ddrc-devfreq 3d400000.memory-controller: failed to set
dram_apb parent: -16
Fix this by adding a new i.MX composite flag for firmware managed clocks, which clears SET_PARENT_GATE.
This is safe to do, because updating the Linux clock tree to reflect reality will always be glitch-free.
--- drivers/clk/imx/clk-composite-8m.c | 3 ++- drivers/clk/imx/clk-imx8mm.c | 7 ++++--- drivers/clk/imx/clk-imx8mn.c | 7 ++++--- drivers/clk/imx/clk-imx8mq.c | 7 ++++--- drivers/clk/imx/clk.h | 16 ++++++++++++++-- 5 files changed, 28 insertions(+), 12 deletions(-)
drivers/clk/imx/clk-composite-8m.c +2 -1
@@ -216,7 +216,8 @@ struct clk_hw *imx8m_clk_hw_composite_flags(const char *name, div->width =PCG_PREDIV_WIDTH ; divider_ops = &imx8m_clk_composite_divider_ops; mux_ops = &clk_mux_ops; - flags |=CLK_SET_PARENT_GATE ; +if (!(composite_flags &IMX_COMPOSITE_FW_MANAGED )) + flags |=CLK_SET_PARENT_GATE ; } div->lock = &imx_ccm_lock;
drivers/clk/imx/clk-imx8mm.c +4 -3
@@ -458,10 +458,11 @@ static int imx8mm_clocks_probe(struct platform_device *pdev)/* * DRAM clocks are manipulated from TF-A outside clock framework. -* Mark with GET_RATE_NOCACHE to always read div value from hardware +* The fw_managed helper sets GET_RATE_NOCACHE and clears SET_PARENT_GATE +* as div value should always be read from hardware */ - hws[IMX8MM_CLK_DRAM_ALT ] =__imx8m_clk_hw_composite ("dram_alt" , imx8mm_dram_alt_sels, base +0xa000 ,CLK_GET_RATE_NOCACHE ); - hws[IMX8MM_CLK_DRAM_APB ] =__imx8m_clk_hw_composite ("dram_apb" , imx8mm_dram_apb_sels, base +0xa080 ,CLK_IS_CRITICAL |CLK_GET_RATE_NOCACHE ); + hws[IMX8MM_CLK_DRAM_ALT ] =imx8m_clk_hw_fw_managed_composite ("dram_alt" , imx8mm_dram_alt_sels, base +0xa000 ); + hws[IMX8MM_CLK_DRAM_APB ] =imx8m_clk_hw_fw_managed_composite_critical ("dram_apb" , imx8mm_dram_apb_sels, base +0xa080 );/* IP */ hws[IMX8MM_CLK_VPU_G1 ] =imx8m_clk_hw_composite ("vpu_g1" , imx8mm_vpu_g1_sels, base +0xa100 );
drivers/clk/imx/clk-imx8mn.c +4 -3
@@ -441,10 +441,11 @@ static int imx8mn_clocks_probe(struct platform_device *pdev)/* * DRAM clocks are manipulated from TF-A outside clock framework. -* Mark with GET_RATE_NOCACHE to always read div value from hardware +* The fw_managed helper sets GET_RATE_NOCACHE and clears SET_PARENT_GATE +* as div value should always be read from hardware */ - hws[IMX8MN_CLK_DRAM_ALT ] =__imx8m_clk_hw_composite ("dram_alt" , imx8mn_dram_alt_sels, base +0xa000 ,CLK_GET_RATE_NOCACHE ); - hws[IMX8MN_CLK_DRAM_APB ] =__imx8m_clk_hw_composite ("dram_apb" , imx8mn_dram_apb_sels, base +0xa080 ,CLK_IS_CRITICAL |CLK_GET_RATE_NOCACHE ); + hws[IMX8MN_CLK_DRAM_ALT ] =imx8m_clk_hw_fw_managed_composite ("dram_alt" , imx8mn_dram_alt_sels, base +0xa000 ); + hws[IMX8MN_CLK_DRAM_APB ] =imx8m_clk_hw_fw_managed_composite_critical ("dram_apb" , imx8mn_dram_apb_sels, base +0xa080 ); hws[IMX8MN_CLK_DISP_PIXEL ] =imx8m_clk_hw_composite ("disp_pixel" , imx8mn_disp_pixel_sels, base +0xa500 ); hws[IMX8MN_CLK_SAI2 ] =imx8m_clk_hw_composite ("sai2" , imx8mn_sai2_sels, base +0xa600 );
drivers/clk/imx/clk-imx8mq.c +4 -3
@@ -427,11 +427,12 @@ static int imx8mq_clocks_probe(struct platform_device *pdev)/* * DRAM clocks are manipulated from TF-A outside clock framework. -* Mark with GET_RATE_NOCACHE to always read div value from hardware +* The fw_managed helper sets GET_RATE_NOCACHE and clears SET_PARENT_GATE +* as div value should always be read from hardware */ hws[IMX8MQ_CLK_DRAM_CORE ] =imx_clk_hw_mux2_flags ("dram_core_clk" , base +0x9800 ,24 ,1 , imx8mq_dram_core_sels,ARRAY_SIZE (imx8mq_dram_core_sels),CLK_IS_CRITICAL ); - hws[IMX8MQ_CLK_DRAM_ALT ] =__imx8m_clk_hw_composite ("dram_alt" , imx8mq_dram_alt_sels, base +0xa000 ,CLK_GET_RATE_NOCACHE ); - hws[IMX8MQ_CLK_DRAM_APB ] =__imx8m_clk_hw_composite ("dram_apb" , imx8mq_dram_apb_sels, base +0xa080 ,CLK_IS_CRITICAL |CLK_GET_RATE_NOCACHE ); + hws[IMX8MQ_CLK_DRAM_ALT ] =imx8m_clk_hw_fw_managed_composite ("dram_alt" , imx8mq_dram_alt_sels, base +0xa000 ); + hws[IMX8MQ_CLK_DRAM_APB ] =imx8m_clk_hw_fw_managed_composite_critical ("dram_apb" , imx8mq_dram_apb_sels, base +0xa080 );/* IP */ hws[IMX8MQ_CLK_VPU_G1 ] =imx8m_clk_hw_composite ("vpu_g1" , imx8mq_vpu_g1_sels, base +0xa100 );
drivers/clk/imx/clk.h +14 -2
@@ -533,8 +533,9 @@ struct clk_hw *imx_clk_hw_cpu(const char *name, const char *parent_name, struct clk *div, struct clk *mux, struct clk *pll, struct clk *step); -#define IMX_COMPOSITE_CORE BIT(0) -#define IMX_COMPOSITE_BUS BIT(1) +#define IMX_COMPOSITE_CORE BIT(0) +#define IMX_COMPOSITE_BUS BIT(1) +#define IMX_COMPOSITE_FW_MANAGED BIT(2) struct clk_hw *imx8m_clk_hw_composite_flags(const char *name, const char * const *parent_names,
@@ -570,6 +571,17 @@ struct clk_hw *imx8m_clk_hw_composite_flags(const char *name, ARRAY_SIZE(parent_names), reg, 0, \ flags | CLK_SET_RATE_NO_REPARENT | CLK_OPS_PARENT_ENABLE) +#define __imx8m_clk_hw_fw_managed_composite (name, parent_names, reg, flags) \ + imx8m_clk_hw_composite_flags(name, parent_names, \ + ARRAY_SIZE(parent_names), reg, IMX_COMPOSITE_FW_MANAGED, \ + flags | CLK_GET_RATE_NOCACHE | CLK_SET_RATE_NO_REPARENT | CLK_OPS_PARENT_ENABLE) + +#define imx8m_clk_hw_fw_managed_composite (name, parent_names, reg) \ + __imx8m_clk_hw_fw_managed_composite(name, parent_names, reg, 0) + +#define imx8m_clk_hw_fw_managed_composite_critical (name, parent_names, reg) \ + __imx8m_clk_hw_fw_managed_composite(name, parent_names, reg, CLK_IS_CRITICAL) +#define __imx8m_clk_composite (name, parent_names, reg, flags) \ to_clk(__imx8m_clk_hw_composite(name, parent_names, reg, flags))
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 92/306 KVM: PPC: Book3S HV: Fix copy_tofrom_guest routines
In reply to Greg Kroah-HartmanFrom: Fabiano Rosas <[email protected]>
[ Upstream commit 5d7d6dac8fe99ed59eee2300e4a03370f94d5222 ]
The __kvmhv_copy_tofrom_guest_radix function was introduced along with nested HV guest support. It uses the platform's Radix MMU quadrants to provide a nested hypervisor with fast access to its nested guests memory (H_COPY_TOFROM_GUEST hypercall). It has also since been added as a fast path for the kvmppc_ld/st routines which are used during instruction emulation.
The commit def0bfdbd603 ("powerpc: use probe_user_read() and probe_user_write()") changed the low level copy function from raw_copy_from_user to probe_user_read, which adds a check to access_ok. In powerpc that is:
static inline bool __access_ok(unsigned long addr, unsigned long size)
{
return addr < TASK_SIZE_MAX && size <= TASK_SIZE_MAX - addr;}
and TASK_SIZE_MAX is 0x0010000000000000UL for 64-bit, which means that setting the two MSBs of the effective address (which correspond to the quadrant) now cause access_ok to reject the access.
This was not caught earlier because the most common code path via kvmppc_ld/st contains a fallback (kvm_read_guest) that is likely to succeed for L1 guests. For nested guests there is no fallback.
Another issue is that probe_user_read (now __copy_from_user_nofault) does not return the number of bytes not copied in case of failure, so the destination memory is not being cleared anymore in kvmhv_copy_from_guest_radix:
ret = kvmhv_copy_tofrom_guest_radix(vcpu, eaddr, to, NULL, n);
if (ret > 0) <-- always false!
memset(to + (n - ret), 0, ret);
This patch fixes both issues by skipping access_ok and open-coding the low level __copy_to/from_user_inatomic.
--- arch/powerpc/kvm/book3s_64_mmu_radix.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/powerpc/kvm/book3s_64_mmu_radix.c +4 -2
@@ -64,10 +64,12 @@ unsigned long __kvmhv_copy_tofrom_guest_radix(int lpid, int pid, }isync (); +pagefault_disable ();if (is_load) - ret =copy_from_user_nofault (to, (const void __user *)from, n); + ret =__copy_from_user_inatomic (to, (const void __user *)from, n);else - ret =copy_to_user_nofault ((void __user *)to, from, n); + ret =__copy_to_user_inatomic ((void __user *)to, from, n); +pagefault_enable ();/* switch the pid first to avoid running host with unallocated pid */ if (quadrant ==1 && pid != old_pid)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 93/306 scsi: ufs: ufs-exynos: Fix static checker warning
In reply to Greg Kroah-HartmanFrom: Alim Akhtar <[email protected]>
[ Upstream commit 313bf281f2091552f509fd05a74172c70ce7572f ]
clk_get_rate() returns unsigned long and currently this driver stores the return value in u32 type, resulting the below warning:
Fixed smatch warnings:
drivers/scsi/ufs/ufs-exynos.c:286 exynos_ufs_get_clk_info()
warn: wrong type for 'ufs->mclk_rate' (should be 'ulong')
drivers/scsi/ufs/ufs-exynos.c:287 exynos_ufs_get_clk_info()
warn: wrong type for 'pclk_rate' (should be 'ulong')--- drivers/scsi/ufs/ufs-exynos.c | 4 ++-- drivers/scsi/ufs/ufs-exynos.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/ufs/ufs-exynos.c +2 -2
@@ -259,7 +259,7 @@ static int exynos_ufs_get_clk_info(struct exynos_ufs *ufs)struct ufs_hba *hba = ufs->hba;struct list_head *head = &hba->clk_list_head;struct ufs_clk_info *clki; -u32 pclk_rate; +unsigned long pclk_rate;u32 f_min, f_max;u8 div =0 ;int ret =0 ;
@@ -298,7 +298,7 @@ static int exynos_ufs_get_clk_info(struct exynos_ufs *ufs) }if (unlikely (pclk_rate < f_min || pclk_rate > f_max)) { -dev_err (hba->dev,"not available pclk range %d\n" , pclk_rate); +dev_err (hba->dev,"not available pclk range %lu\n" , pclk_rate); ret = -EINVAL ; goto out; }
drivers/scsi/ufs/ufs-exynos.h +1 -1
@@ -197,7 +197,7 @@ struct exynos_ufs {u32 pclk_div;u32 pclk_avail_min;u32 pclk_avail_max; -u32 mclk_rate; +unsigned long mclk_rate;int avail_ln_rx;int avail_ln_tx;int rx_sel_idx;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 94/306 KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
[ Upstream commit 1782663897945a5cf28e564ba5eed730098e9aa4 ]
After the L1 saves its PMU SPRs but before loading the L2's PMU SPRs, switch the pmcregs_in_use field in the L1 lppaca to the value advertised by the L2 in its VPA. On the way out of the L2, set it back after saving the L2 PMU registers (if they were in-use).
This transfers the PMU liveness indication between the L1 and L2 at the points where the registers are not live.
This fixes the nested HV bug for which a workaround was added to the L0 HV by commit 63279eeb7f93a ("KVM: PPC: Book3S HV: Always save guest pmu for guest capable of nesting"), which explains the problem in detail. That workaround is no longer required for guests that include this bug fix.
--- arch/powerpc/include/asm/pmc.h | 7 +++++++ arch/powerpc/kvm/book3s_hv.c | 20 ++++++++++++++++++++ 2 files changed, 27 insertions(+)
arch/powerpc/include/asm/pmc.h +7 -0
@@ -34,6 +34,13 @@ static inline void ppc_set_pmu_inuse(int inuse)#endif } +#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE +static inline int ppc_get_pmu_inuse (void ) +{ +return get_paca ()->pmcregs_in_use; +} +#endif +extern void power4_enable_pmcs (void );#else /* CONFIG_PPC64 */
arch/powerpc/kvm/book3s_hv.c +20 -0
@@ -58,6 +58,7 @@#include <asm/kvm_book3s.h> #include <asm/mmu_context.h> #include <asm/lppaca.h> +#include <asm/pmc.h> #include <asm/processor.h> #include <asm/cputhreads.h> #include <asm/page.h>
@@ -3619,6 +3620,18 @@ static int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit, cpu_has_feature(CPU_FTR_P9_TM_HV_ASSIST))kvmppc_restore_tm_hv (vcpu, vcpu->arch.shregs.msr, true); +#ifdef CONFIG_PPC_PSERIES +if (kvmhv_on_pseries ()) { +barrier (); +if (vcpu->arch.vpa.pinned_addr) { +struct lppaca *lp = vcpu->arch.vpa.pinned_addr; +get_lppaca ()->pmcregs_in_use = lp->pmcregs_in_use; + }else { +get_lppaca ()->pmcregs_in_use =1 ; + } +barrier (); + } +#endif kvmhv_load_guest_pmu (vcpu);msr_check_and_set (MSR_FP |MSR_VEC |MSR_VSX );
@@ -3756,6 +3769,13 @@ static int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit, save_pmu |=nesting_enabled (vcpu->kvm);kvmhv_save_guest_pmu (vcpu, save_pmu); +#ifdef CONFIG_PPC_PSERIES +if (kvmhv_on_pseries ()) { +barrier (); +get_lppaca ()->pmcregs_in_use =ppc_get_pmu_inuse (); +barrier (); + } +#endif vc->entry_exit_map =0x101 ; vc->in_guest =0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 95/306 platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 0487d4fc42d7f31a56cfd9e2237f9ebd889e6112 ]
As pointed out be Kees Cook if we return -EIO because the obj->type != ACPI_TYPE_BUFFER, then we must kfree the output buffer before the return.
--- drivers/platform/x86/dell-smbios-wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/dell-smbios-wmi.c +1 -0
@@ -69,6 +69,7 @@ static int run_smbios_call(struct wmi_device *wdev)if (obj->type ==ACPI_TYPE_INTEGER )dev_dbg (&wdev->dev,"SMBIOS call failed: %llu\n" , obj->integer.value); +kfree (output.pointer);return -EIO ; }memcpy (&priv->buf->std, obj->buffer.pointer, obj->buffer.length);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 96/306 powerpc/smp: Update cpu_core_map on all PowerPc systems
In reply to Greg Kroah-HartmanFrom: Srikar Dronamraju <[email protected]>
[ Upstream commit b8b928030332a0ca16d42433eb2c3085600d8704 ]
lscpu() uses core_siblings to list the number of sockets in the system. core_siblings is set using topology_core_cpumask.
While optimizing the powerpc bootup path, Commit 4ca234a9cbd7 ("powerpc/smp: Stop updating cpu_core_mask"). it was found that updating cpu_core_mask() ended up taking a lot of time. It was thought that on Powerpc, cpu_core_mask() would always be same as cpu_cpu_mask() i.e number of sockets will always be equal to number of nodes. As an optimization, cpu_core_mask() was made a snapshot of cpu_cpu_mask().
However that was found to be false with PowerPc KVM guests, where each node could have more than one socket. So with Commit c47f892d7aa6 ("powerpc/smp: Reintroduce cpu_core_mask"), cpu_core_mask was updated based on chip_id but in an optimized way using some mask manipulations and chip_id caching.
However on non-PowerNV and non-pseries KVM guests (i.e not implementing cpu_to_chip_id(), continued to use a copy of cpu_cpu_mask().
There are two issues that were noticed on such systems
1. lscpu would report one extra socket.
On a IBM,9009-42A (aka zz system) which has only 2 chips/ sockets/ nodes, lscpu would report
Architecture: ppc64le Byte Order: Little Endian CPU(s): 160 On-line CPU(s) list: 0-159 Thread(s) per core: 8 Core(s) per socket: 6 Socket(s): 3 <-------------- NUMA node(s): 2 Model: 2.2 (pvr 004e 0202) Model name: POWER9 (architected), altivec supported Hypervisor vendor: pHyp Virtualization type: para L1d cache: 32K L1i cache: 32K L2 cache: 512K L3 cache: 10240K NUMA node0 CPU(s): 0-79 NUMA node1 CPU(s): 80-159
2. Currently cpu_cpu_mask is updated when a core is added/removed. However its not updated when smt mode switching or on CPUs are explicitly offlined. However all other percpu masks are updated to ensure only active/online CPUs are in the masks. This results in build_sched_domain traces since there will be CPUs in cpu_cpu_mask() but those CPUs are not present in SMT / CACHE / MC / NUMA domains. A loop of threads running smt mode switching and core add/remove will soon show this trace.
Hence cpu_cpu_mask has to be update at smt mode switch.
This will have impact on cpu_core_mask(). cpu_core_mask() is a snapshot of cpu_cpu_mask. Different CPUs within the same socket will end up having different cpu_core_masks since they are snapshots at different points of time. This means when lscpu will start reporting many more sockets than the actual number of sockets/ nodes / chips.
Different ways to handle this problem:
A. Update the snapshot aka cpu_core_mask for all CPUs whenever
cpu_cpu_mask is updated. This would a non-optimal solution.
B. Instead of a cpumask_var_t, make cpu_core_map a cpumask pointer
pointing to cpu_cpu_mask. However percpu cpumask pointer is frowned upon and we need a clean way to handle PowerPc KVM guest which is not a snapshot.
C. Update cpu_core_masks all PowerPc systems like in PowerPc KVM guests using mask manipulations. This approach is relatively simple and unifies with the existing code.
D. On top of 3, we could also resurrect get_physical_package_id which
could return a nid for the said CPU. However this is not needed at this time.
Option C is the preferred approach for now.
While this is somewhat a revert of Commit 4ca234a9cbd7 ("powerpc/smp:
Stop updating cpu_core_mask").
1. Plain revert has some conflicts
2. For chip_id == -1, the cpu_core_mask is made identical to cpu_cpu_mask, unlike previously where cpu_core_mask was set to a core if chip_id doesn't exist.
This goes by the principle that if chip_id is not exposed, then sockets / chip / node share the same set of CPUs.
With the fix, lscpu o/p would be
Architecture: ppc64le Byte Order: Little Endian CPU(s): 160 On-line CPU(s) list: 0-159 Thread(s) per core: 8 Core(s) per socket: 6 Socket(s): 2 <-------------- NUMA node(s): 2 Model: 2.2 (pvr 004e 0202) Model name: POWER9 (architected), altivec supported Hypervisor vendor: pHyp Virtualization type: para L1d cache: 32K L1i cache: 32K L2 cache: 512K L3 cache: 10240K NUMA node0 CPU(s): 0-79 NUMA node1 CPU(s): 80-159
--- arch/powerpc/kernel/smp.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
arch/powerpc/kernel/smp.c +5 -6
@@ -1385,6 +1385,7 @@ static void add_cpu_to_masks(int cpu)* add it to it's own thread sibling mask. */ cpumask_set_cpu (cpu,cpu_sibling_mask (cpu)); +cpumask_set_cpu (cpu,cpu_core_mask (cpu));for (i = first_thread; i < first_thread + threads_per_core; i++)if (cpu_online (i))
@@ -1399,11 +1400,6 @@ static void add_cpu_to_masks(int cpu)if (has_coregroup_support ())update_coregroup_mask (cpu, &mask); -if (chip_id ==-1 || !ret) { -cpumask_copy (per_cpu (cpu_core_map, cpu),cpu_cpu_mask (cpu)); - goto out; - } -if (shared_caches) submask_fn = cpu_l2_cache_mask;
@@ -1413,6 +1409,10 @@ static void add_cpu_to_masks(int cpu)/* Skip all CPUs already part of current CPU core mask */ cpumask_andnot (mask, cpu_online_mask,cpu_core_mask (cpu)); +/* If chip_id is -1; limit the cpu_core_mask to within DIE*/ +if (chip_id ==-1 ) +cpumask_and (mask, mask,cpu_cpu_mask (cpu)); +for_each_cpu (i, mask) {if (chip_id ==cpu_to_chip_id (i)) {or_cpumasks_related (cpu, i, submask_fn, cpu_core_mask);
@@ -1422,7 +1422,6 @@ static void add_cpu_to_masks(int cpu) } } -out:free_cpumask_var (mask); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 97/306 RDMA/hns: Fix QPs resp incomplete assignment
In reply to Greg Kroah-HartmanFrom: Wenpeng Liang <[email protected]>
[ Upstream commit d2e0ccffcdd7209fc9881c8970d2a7e28dcb43b9 ]
The resp passed to the user space represents the enable flag of qp, incomplete assignment will cause some features of the user space to be disabled.
--- drivers/infiniband/hw/hns/hns_roce_qp.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/infiniband/hw/hns/hns_roce_qp.c +1 -2
@@ -740,7 +740,6 @@ static int alloc_qp_db(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp, goto err_out; } hr_qp->en_flags |=HNS_ROCE_QP_CAP_SQ_RECORD_DB ; - resp->cap_flags |=HNS_ROCE_QP_CAP_SQ_RECORD_DB ; }if (user_qp_has_rdb (hr_dev, init_attr, udata, resp)) {
@@ -752,7 +751,6 @@ static int alloc_qp_db(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp, goto err_sdb; } hr_qp->en_flags |=HNS_ROCE_QP_CAP_RQ_RECORD_DB ; - resp->cap_flags |=HNS_ROCE_QP_CAP_RQ_RECORD_DB ; } }else {/* QP doorbell register address */
@@ -959,6 +957,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev, }if (udata) { + resp.cap_flags = hr_qp->en_flags; ret =ib_copy_to_udata (udata, &resp,min (udata->outlen,sizeof (resp)));if (ret) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 98/306 fscache: Fix cookie key hashing
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 35b72573e977ed6b18b094136a4fa3e0ffb13603 ]
The current hash algorithm used for hashing cookie keys is really bad, producing almost no dispersion (after a test kernel build, ~30000 files were split over just 18 out of the 32768 hash buckets).
Borrow the full_name_hash() hash function into fscache to do the hashing for cookie keys and, in the future, volume keys.
I don't want to use full_name_hash() as-is because I want the hash value to be consistent across arches and over time as the hash value produced may get used on disk.
I can also optimise parts of it away as the key will always be a padded array of aligned 32-bit words.
--- fs/fscache/cookie.c | 14 +------------- fs/fscache/internal.h | 2 ++ fs/fscache/main.c | 39 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 42 insertions(+), 13 deletions(-)
fs/fscache/cookie.c +1 -13
@@ -74,10 +74,8 @@ void fscache_free_cookie(struct fscache_cookie *cookie)static int fscache_set_key (struct fscache_cookie *cookie,const void *index_key,size_t index_key_len) { -unsigned long long h;u32 *buf;int bufs; -int i; bufs =DIV_ROUND_UP (index_key_len,sizeof (*buf));
@@ -91,17 +89,7 @@ static int fscache_set_key(struct fscache_cookie *cookie, }memcpy (buf, index_key, index_key_len); - -/* Calculate a hash and combine this with the length in the first word -* or first half word -*/ - h = (unsigned long )cookie->parent; - h += index_key_len + cookie->type; - -for (i =0 ; i < bufs; i++) - h += buf[i]; - - cookie->key_hash = h ^ (h >>32 ); + cookie->key_hash =fscache_hash (0 , buf, bufs);return 0 ; }
fs/fscache/internal.h +2 -0
@@ -97,6 +97,8 @@ extern struct workqueue_struct *fscache_object_wq;extern struct workqueue_struct *fscache_op_wq;DECLARE_PER_CPU (wait_queue_head_t, fscache_object_cong_wait); +extern unsigned int fscache_hash (unsigned int salt,unsigned int *data,unsigned int n); +static inline bool fscache_object_congested (void ) {return workqueue_congested (WORK_CPU_UNBOUND , fscache_object_wq);
fs/fscache/main.c +39 -0
@@ -93,6 +93,45 @@ static struct ctl_table fscache_sysctls_root[] = { };#endif +/* +* Mixing scores (in bits) for (7,20): +* Input delta: 1-bit 2-bit +* 1 round: 330.3 9201.6 +* 2 rounds: 1246.4 25475.4 +* 3 rounds: 1907.1 31295.1 +* 4 rounds: 2042.3 31718.6 +* Perfect: 2048 31744 +* (32*64) (32*31/2 * 64) +*/ +#define HASH_MIX (x, y, a) \ + ( x ^= (a), \ + y ^= x, x = rol32(x, 7),\ + x += y, y = rol32(y,20),\ + y *= 9 ) + +static inline unsigned int fold_hash (unsigned long x,unsigned long y) +{ +/* Use arch-optimized multiply if one exists */ +return __hash_32 (y ^__hash_32 (x)); +} + +/* +* Generate a hash. This is derived from full_name_hash(), but we want to be +* sure it is arch independent and that it doesn't change as bits of the +* computed hash value might appear on disk. The caller also guarantees that +* the hashed data will be a series of aligned 32-bit words. +*/ +unsigned int fscache_hash (unsigned int salt,unsigned int *data,unsigned int n) +{ +unsigned int a, x =0 , y = salt; + +for (; n; n--) { + a = *data++; +HASH_MIX (x, y, a); + } +return fold_hash (x, y); +} +/* * initialise the fs caching module */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 99/306 clk: at91: clk-generated: Limit the requested rate to our range
In reply to Greg Kroah-HartmanFrom: Codrin Ciubotariu <[email protected]>
[ Upstream commit af7651e67b9d5f7e63ea23b118e3672ac662244a ]
On clk_generated_determine_rate(), the requested rate could be outside of clk's range. Limit the rate to the clock's range to not return an error.
--- drivers/clk/at91/clk-generated.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/clk/at91/clk-generated.c +6 -0
@@ -128,6 +128,12 @@ static int clk_generated_determine_rate(struct clk_hw *hw,int i;u32 div; +/* do not look for a rate that is outside of our range */ +if (gck->range.max && req->rate > gck->range.max) + req->rate = gck->range.max; +if (gck->range.min && req->rate < gck->range.min) + req->rate = gck->range.min; +for (i =0 ; i <clk_hw_get_num_parents (hw); i++) {if (gck->chg_pid == i)continue ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 100/306 KVM: PPC: Fix clearing never mapped TCEs in realmode
In reply to Greg Kroah-HartmanFrom: Alexey Kardashevskiy <[email protected]>
[ Upstream commit 1d78dfde33a02da1d816279c2e3452978b7abd39 ]
Since commit e1a1ef84cd07 ("KVM: PPC: Book3S: Allocate guest TCEs on demand too"), pages for TCE tables for KVM guests are allocated only when needed. This allows skipping any update when clearing TCEs. This works mostly fine as TCE updates are handled when the MMU is enabled. The realmode handlers fail with H_TOO_HARD when pages are not yet allocated, except when clearing a TCE in which case KVM prints a warning and proceeds to dereference a NULL pointer, which crashes the host OS.
This has not been caught so far as the change in commit e1a1ef84cd07 is reasonably new, and POWER9 runs mostly radix which does not use realmode handlers. With hash, the default TCE table is memset() by QEMU when the machine is reset which triggers page faults and the KVM TCE device's kvm_spapr_tce_fault() handles those with MMU on. And the huge DMA windows are not cleared by VMs which instead successfully create a DMA window big enough to map the VM memory 1:1 and then VMs just map everything without clearing.
This started crashing now as commit 381ceda88c4c ("powerpc/pseries/iommu:
Make use of DDW for indirect mapping") added a mode when a dymanic DMA window not big enough to map the VM memory 1:1 but it is used anyway, and the VM now is the first (i.e. not QEMU) to clear a just created table. Note that upstream QEMU needs to be modified to trigger the VM to trigger the host OS crash.
This replaces WARN_ON_ONCE_RM() with a check and return, and adds another warning if TCE is not being cleared.
--- arch/powerpc/kvm/book3s_64_vio_hv.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
arch/powerpc/kvm/book3s_64_vio_hv.c +6 -3
@@ -173,10 +173,13 @@ static void kvmppc_rm_tce_put(struct kvmppc_spapr_tce_table *stt, idx -= stt->offset; page = stt->pages[idx /TCES_PER_PAGE ];/* -* page must not be NULL in real mode, -* kvmppc_rm_ioba_validate() must have taken care of this. +* kvmppc_rm_ioba_validate() allows pages not be allocated if TCE is +* being cleared, otherwise it returns H_TOO_HARD and we skip this. */ -WARN_ON_ONCE_RM (!page); +if (!page) { +WARN_ON_ONCE_RM (tce !=0 ); +return ; + } tbl =kvmppc_page_address (page); tbl[idx %TCES_PER_PAGE ] = tce;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 101/306 soc: mediatek: cmdq: add address shift in jump
In reply to Greg Kroah-HartmanFrom: Yongqiang Niu <[email protected]>
[ Upstream commit 8b60ed2b1674b78ebc433a11efa7d48821229037 ]
Add address shift when compose jump instruction
to compatible with 35bit format.
--- drivers/mailbox/mtk-cmdq-mailbox.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mailbox/mtk-cmdq-mailbox.c +2 -1
@@ -168,7 +168,8 @@ static void cmdq_task_insert_into_thread(struct cmdq_task *task)dma_sync_single_for_cpu (dev, prev_task->pa_base, prev_task->pkt->cmd_buf_size,DMA_TO_DEVICE ); prev_task_base[CMDQ_NUM_CMD (prev_task->pkt) -1 ] = - (u64 )CMDQ_JUMP_BY_PA <<32 | task->pa_base; + (u64 )CMDQ_JUMP_BY_PA <<32 | + (task->pa_base >> task->cmdq->shift_pa);dma_sync_single_for_device (dev, prev_task->pa_base, prev_task->pkt->cmd_buf_size,DMA_TO_DEVICE );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 102/306 f2fs: fix to account missing .skipped_gc_rwsem
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit ad126ebddecbf696e0cf214ff56c7b170fa9f0f7 ]
There is a missing place we forgot to account .skipped_gc_rwsem, fix it.
--- fs/f2fs/gc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/f2fs/gc.c +3 -1
@@ -1477,8 +1477,10 @@ static int gc_data_segment(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,int err;if (S_ISREG (inode->i_mode)) { -if (!down_write_trylock (&fi->i_gc_rwsem[READ ])) +if (!down_write_trylock (&fi->i_gc_rwsem[READ ])) { + sbi->skipped_gc_rwsem++;continue ; + }if (!down_write_trylock ( &fi->i_gc_rwsem[WRITE ])) { sbi->skipped_gc_rwsem++;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 103/306 f2fs: fix unexpected ENOENT comes from f2fs_map_blocks()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit adf9ea89c719c1d23794e363f631e376b3ff8cbc ]
In below path, it will return ENOENT if filesystem is shutdown:
- f2fs_map_blocks
- f2fs_get_dnode_of_data
- f2fs_get_node_page
- __get_node_page
- read_node_page
- is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN)
return -ENOENT
- force return value from ENOENT to 0
It should be fine for read case, since it indicates a hole condition, and caller could use .m_next_pgofs to skip the hole and continue the lookup.
However it may cause confusing for write case, since leaving a hole there, and said nothing was wrong doesn't help.
There is at least one case from dax_iomap_actor() will complain that, so fix this in prior to supporting dax in f2fs.
xfstest generic/388 reports below warning:
ubuntu godown: xfstests-induced forced shutdown of /mnt/scratch_f2fs:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 485833 at fs/dax.c:1127 dax_iomap_actor+0x339/0x370 Call Trace: iomap_apply+0x1c4/0x7b0 ? dax_iomap_rw+0x1c0/0x1c0 dax_iomap_rw+0xad/0x1c0 ? dax_iomap_rw+0x1c0/0x1c0 f2fs_file_write_iter+0x5ab/0x970 [f2fs] do_iter_readv_writev+0x273/0x2e0 do_iter_write+0xab/0x1f0 vfs_iter_write+0x21/0x40 iter_file_splice_write+0x287/0x540 do_splice+0x37c/0xa60 __x64_sys_splice+0x15f/0x3a0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
ubuntu godown: xfstests-induced forced shutdown of /mnt/scratch_f2fs:
------------[ cut here ]------------ RIP: 0010:dax_iomap_pte_fault.isra.0+0x72e/0x14a0 Call Trace: dax_iomap_fault+0x44/0x70 f2fs_dax_huge_fault+0x155/0x400 [f2fs] f2fs_dax_fault+0x18/0x30 [f2fs] __do_fault+0x4e/0x120 do_fault+0x3cf/0x7a0 __handle_mm_fault+0xa8c/0xf20 ? find_held_lock+0x39/0xd0 handle_mm_fault+0x1b6/0x480 do_user_addr_fault+0x320/0xcd0 ? rcu_read_lock_sched_held+0x67/0xc0 exc_page_fault+0x77/0x3f0 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30
--- fs/f2fs/data.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/f2fs/data.c +14 -0
@@ -1550,7 +1550,21 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,if (err) {if (flag ==F2FS_GET_BLOCK_BMAP ) map->m_pblk =0 ; +if (err == -ENOENT ) { +/* +* There is one exceptional case that read_node_page() +* may return -ENOENT due to filesystem has been +* shutdown or cp_error, so force to convert error +* number to EIO for such case. +*/ +if (map->m_may_create && + (is_sbi_flag_set (sbi,SBI_IS_SHUTDOWN ) || +f2fs_cp_error (sbi))) { + err = -EIO ; + goto unlock_out; + } + err =0 ;if (map->m_next_pgofs) *map->m_next_pgofs =
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 104/306 f2fs: fix to unmap pages from userspace process in punch_hole()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit c8dc3047c48540183744f959412d44b08c5435e1 ]
We need to unmap pages from userspace process before removing pagecache in punch_hole() like we did in f2fs_setattr().
Similar change:
commit 5e44f8c374dc ("ext4: hole-punch use truncate_pagecache_range")
--- fs/f2fs/file.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/f2fs/file.c +1 -3
@@ -1080,7 +1080,6 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len) }if (pg_start < pg_end) { -struct address_space *mapping = inode->i_mapping;loff_t blk_start, blk_end;struct f2fs_sb_info *sbi =F2FS_I_SB (inode);
@@ -1092,8 +1091,7 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len)down_write (&F2FS_I (inode)->i_gc_rwsem[WRITE ]);down_write (&F2FS_I (inode)->i_mmap_sem); -truncate_inode_pages_range (mapping, blk_start, - blk_end -1 ); +truncate_pagecache_range (inode, blk_start, blk_end -1 );f2fs_lock_op (sbi); ret =f2fs_truncate_hole (inode, pg_start, pg_end);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 105/306 f2fs: deallocate compressed pages when error happens
In reply to Greg Kroah-HartmanFrom: Jaegeuk Kim <[email protected]>
[ Upstream commit 827f02842e40ea2e00f401e8f4cb1bccf3b8cd86 ]
In f2fs_write_multi_pages(), f2fs_compress_pages() allocates pages for compression work in cc->cpages[]. Then, f2fs_write_compressed_pages() initiates bio submission. But, if there's any error before submitting the IOs like early f2fs_cp_error(), previously it didn't free cpages by f2fs_compress_free_page(). Let's fix memory leak by putting that just before deallocating cc->cpages.
--- fs/f2fs/compress.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
fs/f2fs/compress.c +6 -6
@@ -1308,12 +1308,6 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,for (--i; i >=0 ; i--)fscrypt_finalize_bounce_page (&cc->cpages[i]); -for (i =0 ; i < cc->nr_cpages; i++) { -if (!cc->cpages[i]) -continue ; -f2fs_compress_free_page (cc->cpages[i]); - cc->cpages[i] =NULL ; - } out_put_cic:kmem_cache_free (cic_entry_slab, cic); out_put_dnode:
@@ -1324,6 +1318,12 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,else f2fs_unlock_op (sbi); out_free: +for (i =0 ; i < cc->nr_cpages; i++) { +if (!cc->cpages[i]) +continue ; +f2fs_compress_free_page (cc->cpages[i]); + cc->cpages[i] =NULL ; + }page_array_free (cc->inode, cc->cpages, cc->nr_cpages); cc->cpages =NULL ;return -EAGAIN ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 106/306 f2fs: should put a page beyond EOF when preparing a write
In reply to Greg Kroah-HartmanFrom: Jaegeuk Kim <[email protected]>
[ Upstream commit 9605f75cf36e0bcc0f4ada07b5be712d30107607 ]
The prepare_compress_overwrite() gets/locks a page to prepare a read, and calls f2fs_read_multi_pages() which checks EOF first. If there's any page beyond EOF, we unlock the page and set cc->rpages[i] = NULL, which we can't put the page anymore. This makes page leak, so let's fix by putting that page.
--- fs/f2fs/data.c | 2 ++ 1 file changed, 2 insertions(+)
fs/f2fs/data.c +2 -0
@@ -2219,6 +2219,8 @@ int f2fs_read_multi_pages(struct compress_ctx *cc, struct bio **bio_ret,continue ; }unlock_page (page); +if (for_write) +put_page (page); cc->rpages[i] =NULL ; cc->nr_rpages--; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 107/306 MIPS: Malta: fix alignment of the devicetree buffer
In reply to Greg Kroah-HartmanFrom: Oleksij Rempel <[email protected]>
[ Upstream commit bea6a94a279bcbe6b2cde348782b28baf12255a5 ]
Starting with following patch MIPS Malta is not able to boot:
| commit 79edff12060fe7772af08607eff50c0e2486c5ba | Author: Rob Herring <[email protected]> | scripts/dtc: Update to upstream version v1.6.0-51-g183df9e9c2b9
The reason is the alignment test added to the fdt_ro_probe_(). To fix this issue, we need to make sure that fdt_buf is aligned.
Since the dtc patch was designed to uncover potential issue, I handle initial MIPS Malta patch as initial bug.
--- arch/mips/mti-malta/malta-dtshim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/mti-malta/malta-dtshim.c +1 -1
@@ -22,7 +22,7 @@#define ROCIT_CONFIG_GEN1_MEMMAP_SHIFT 8#define ROCIT_CONFIG_GEN1_MEMMAP_MASK (0xf << 8) -static unsigned char fdt_buf[16 <<10 ]__initdata ; +static unsigned char fdt_buf[16 <<10 ]__initdata __aligned(8) ;/* determined physical memory size, not overridden by command line args */ extern unsigned long physical_memsize;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 108/306 kbuild: Fix no symbols warning when CONFIG_TRIM_UNUSD_KSYMS=y
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
[ Upstream commit 52d83df682c82055961531853c066f4f16e234ea ]
When CONFIG_TRIM_UNUSED_KSYMS is enabled, I see some warnings like this:
nm: arch/x86/entry/vdso/vdso32/note.o: no symbols
$NM (both GNU nm and llvm-nm) warns when no symbol is found in the object. Suppress the stderr.
Fangrui Song mentioned binutils>=2.37 nm -q can be used to suppress "no symbols" [1], and llvm-nm>=13.0.0 supports -q as well.
We cannot use it for now, but note it as a TODO.
[1]: https://sourceware.org/bugzilla/show_bug.cgi?id=27408
--- scripts/gen_ksymdeps.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
scripts/gen_ksymdeps.sh +7 -1
@@ -4,7 +4,13 @@ set -e # List of exported symbols -ksyms=$($NM $1 | sed -n 's/.*__ksym_marker_\(.*\)/\1/p' | tr A-Z a-z) +# +# If the object has no symbol, $NM warns 'no symbols'. +# Suppress the stderr. +# TODO: +# Use -q instead of 2>/dev/null when we upgrade the minimum version of +# binutils to 2.37, llvm to 13.0.0. +ksyms=$($NM $1 2>/dev/null | sed -n 's/.*__ksym_marker_\(.*\)/\1/p' | tr A-Z a-z) if [ -z "$ksyms" ]; then exit 0
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 109/306 userfaultfd: prevent concurrent API initialization
In reply to Greg Kroah-HartmanFrom: Nadav Amit <[email protected]>
[ Upstream commit 22e5fe2a2a279d9a6fcbdfb4dffe73821bef1c90 ]
userfaultfd assumes that the enabled features are set once and never changed after UFFDIO_API ioctl succeeded.
However, currently, UFFDIO_API can be called concurrently from two different threads, succeed on both threads and leave userfaultfd's features in non-deterministic state. Theoretically, other uffd operations (ioctl's and page-faults) can be dispatched while adversely affected by such changes of features.
Moreover, the writes to ctx->state and ctx->features are not ordered, which can - theoretically, again - let userfaultfd_ioctl() think that userfaultfd API completed, while the features are still not initialized.
To avoid races, it is arguably best to get rid of ctx->state. Since there are only 2 states, record the API initialization in ctx->features as the uppermost bit and remove ctx->state.
--- fs/userfaultfd.c | 91 +++++++++++++++++++++++------------------------- 1 file changed, 44 insertions(+), 47 deletions(-)
fs/userfaultfd.c +44 -47
@@ -32,11 +32,6 @@ int sysctl_unprivileged_userfaultfd __read_mostly = 1;static struct kmem_cache *userfaultfd_ctx_cachep__read_mostly ; -enum userfaultfd_state { -UFFD_STATE_WAIT_API , -UFFD_STATE_RUNNING , -}; -/* * Start with fault_pending_wqh and fault_wqh so they're more likely * to be in the same cacheline.
@@ -68,8 +63,6 @@ struct userfaultfd_ctx {unsigned int flags;/* features requested from the userspace */ unsigned int features; -/* state machine */ -enum userfaultfd_state state;/* released */ bool released;/* memory mappings are changing because of non-cooperative event */
@@ -103,6 +96,14 @@ struct userfaultfd_wake_range {unsigned long len; }; +/* internal indication that UFFD_API ioctl was successfully executed */ +#define UFFD_FEATURE_INITIALIZED (1u << 31) + +static bool userfaultfd_is_initialized (struct userfaultfd_ctx *ctx) +{ +return ctx->features &UFFD_FEATURE_INITIALIZED ; +} +static int userfaultfd_wake_function (wait_queue_entry_t *wq,unsigned mode,int wake_flags,void *key) {
@@ -659,7 +660,6 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct list_head *fcs)refcount_set (&ctx->refcount,1 ); ctx->flags = octx->flags; - ctx->state =UFFD_STATE_RUNNING ; ctx->features = octx->features; ctx->released = false; ctx->mmap_changing = false;
@@ -936,38 +936,33 @@ static __poll_t userfaultfd_poll(struct file *file, poll_table *wait)poll_wait (file, &ctx->fd_wqh, wait); -switch (ctx->state) { -case UFFD_STATE_WAIT_API : +if (!userfaultfd_is_initialized (ctx))return EPOLLERR ; -case UFFD_STATE_RUNNING : -/* -* poll() never guarantees that read won't block. -* userfaults can be waken before they're read(). -*/ -if (unlikely (!(file->f_flags &O_NONBLOCK ))) -return EPOLLERR ; -/* -* lockless access to see if there are pending faults -* __pollwait last action is the add_wait_queue but -* the spin_unlock would allow the waitqueue_active to -* pass above the actual list_add inside -* add_wait_queue critical section. So use a full -* memory barrier to serialize the list_add write of -* add_wait_queue() with the waitqueue_active read -* below. -*/ - ret =0 ; -smp_mb (); -if (waitqueue_active (&ctx->fault_pending_wqh)) - ret =EPOLLIN ; -else if (waitqueue_active (&ctx->event_wqh)) - ret =EPOLLIN ; -return ret; -default : -WARN_ON_ONCE (1 ); +/* +* poll() never guarantees that read won't block. +* userfaults can be waken before they're read(). +*/ +if (unlikely (!(file->f_flags &O_NONBLOCK )))return EPOLLERR ; - } +/* +* lockless access to see if there are pending faults +* __pollwait last action is the add_wait_queue but +* the spin_unlock would allow the waitqueue_active to +* pass above the actual list_add inside +* add_wait_queue critical section. So use a full +* memory barrier to serialize the list_add write of +* add_wait_queue() with the waitqueue_active read +* below. +*/ + ret =0 ; +smp_mb (); +if (waitqueue_active (&ctx->fault_pending_wqh)) + ret =EPOLLIN ; +else if (waitqueue_active (&ctx->event_wqh)) + ret =EPOLLIN ; + +return ret; }static const struct file_operations userfaultfd_fops;
@@ -1161,7 +1156,7 @@ static ssize_t userfaultfd_read(struct file *file, char __user *buf,struct uffd_msg msg;int no_wait = file->f_flags &O_NONBLOCK ; -if (ctx->state ==UFFD_STATE_WAIT_API ) +if (!userfaultfd_is_initialized (ctx))return -EINVAL ;for (;;) {
@@ -1816,9 +1811,10 @@ static int userfaultfd_writeprotect(struct userfaultfd_ctx *ctx,static inline unsigned int uffd_ctx_features (__u64 user_features) {/* -* For the current set of features the bits just coincide +* For the current set of features the bits just coincide. Set +* UFFD_FEATURE_INITIALIZED to mark the features as enabled. */ -return (unsigned int )user_features; +return (unsigned int )user_features |UFFD_FEATURE_INITIALIZED ; }/*
@@ -1831,12 +1827,10 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, {struct uffdio_api uffdio_api;void __user *buf = (void __user *)arg; +unsigned int ctx_features;int ret;__u64 features; - ret = -EINVAL ; -if (ctx->state !=UFFD_STATE_WAIT_API ) - goto out; ret = -EFAULT ;if (copy_from_user (&uffdio_api, buf,sizeof (uffdio_api))) goto out;
@@ -1853,9 +1847,13 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, ret = -EFAULT ;if (copy_to_user (buf, &uffdio_api,sizeof (uffdio_api))) goto out; - ctx->state =UFFD_STATE_RUNNING ; +/* only enable the requested features for this uffd context */ - ctx->features =uffd_ctx_features (features); + ctx_features =uffd_ctx_features (features); + ret = -EINVAL ; +if (cmpxchg (&ctx->features,0 , ctx_features) !=0 ) + goto err_out; + ret =0 ; out:return ret;
@@ -1872,7 +1870,7 @@ static long userfaultfd_ioctl(struct file *file, unsigned cmd,int ret = -EINVAL ;struct userfaultfd_ctx *ctx = file->private_data; -if (cmd !=UFFDIO_API && ctx->state ==UFFD_STATE_WAIT_API ) +if (cmd !=UFFDIO_API && !userfaultfd_is_initialized (ctx))return -EINVAL ;switch (cmd) {
@@ -1976,7 +1974,6 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)refcount_set (&ctx->refcount,1 ); ctx->flags = flags; ctx->features =0 ; - ctx->state =UFFD_STATE_WAIT_API ; ctx->released = false; ctx->mmap_changing = false; ctx->mm = current->mm;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 110/306 drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET
In reply to Greg Kroah-HartmanFrom: Dom Cobley <[email protected]>
[ Upstream commit 1698ecb218eb82587dbfc71a2e26ded66e5ecf59 ]
Symptom is random switching of speakers when using multichannel.
Repeatedly running speakertest -c8 occasionally starts with channels jumbled. This is fixed with HD_CTL_WHOLSMP.
The other bit looks beneficial and apears harmless in testing so I'd suggest adding it too.
Documentation says: HD_CTL_WHILSMP_SET
Wait for whole sample. When this bit is set MAI transmit will start only when there is at least one whole sample available in the fifo.
Documentation says: HD_CTL_CHALIGN_SET
Channel Align When Overflow. This bit is used to realign the audio channels in case of an overflow.
If this bit is set, after the detection of an overflow, equal amount of dummy words to the missing words will be written to fifo, filling up the broken sample and maintaining alignment.
--- drivers/gpu/drm/vc4/vc4_hdmi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/vc4/vc4_hdmi.c +3 -1
@@ -1074,7 +1074,9 @@ static int vc4_hdmi_audio_trigger(struct snd_pcm_substream *substream, int cmd,HDMI_WRITE (HDMI_MAI_CTL ,VC4_SET_FIELD (vc4_hdmi->audio.channels,VC4_HD_MAI_CTL_CHNUM ) | -VC4_HD_MAI_CTL_ENABLE ); +VC4_HD_MAI_CTL_WHOLSMP | +VC4_HD_MAI_CTL_CHALIGN | +VC4_HD_MAI_CTL_ENABLE );break ;case SNDRV_PCM_TRIGGER_STOP : HDMI_WRITE(HDMI_MAI_CTL,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 111/306 drm/amdgpu: Fix amdgpu_ras_eeprom_init()
In reply to Greg Kroah-HartmanFrom: Luben Tuikov <[email protected]>
[ Upstream commit dce4400e6516d18313d23de45b5be8a18980b00e ]
No need to account for the 2 bytes of EEPROM address--this is now well abstracted away by the fixes the the lower layers.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c +1 -1
@@ -305,7 +305,7 @@ int amdgpu_ras_eeprom_init(struct amdgpu_ras_eeprom_control *control,return ret; } -__decode_table_header_from_buff (hdr, &buff[2 ]); +__decode_table_header_from_buff (hdr, buff);if (hdr->header ==EEPROM_TABLE_HDR_VAL ) { control->num_recs = (hdr->tbl_size - EEPROM_TABLE_HEADER_SIZE) /
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 112/306 ASoC: atmel: ATMEL drivers dont need HAS_DMA
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 6c5c659dfe3f02e08054a6c20019e3886618b512 ]
On a config (such as arch/sh/) which does not set HAS_DMA when MMU is not set, several ATMEL ASoC drivers select symbols that cause kconfig warnings. There is one "depends on HAS_DMA" which is no longer needed. Dropping it eliminates the kconfig warnings and still builds with no problems reported.
Fix the following kconfig warnings:
WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_PDC
Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && HAS_DMA [=n] Selected by [m]:
- SND_ATMEL_SOC_SSC [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m]
- SND_ATMEL_SOC_SSC_PDC [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m]
WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_SSC_PDC
Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m] && HAS_DMA [=n]
Selected by [m]:
- SND_AT91_SOC_SAM9G20_WM8731 [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && (ARCH_AT91 || COMPILE_TEST [=y]) && ATMEL_SSC [=m] && SND_SOC_I2C_AND_SPI [=m]
WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_SSC
Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && HAS_DMA [=n] Selected by [m]:
- SND_ATMEL_SOC_SSC_DMA [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m]
WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_SSC_DMA
Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m] && HAS_DMA [=n]
Selected by [m]:
- SND_ATMEL_SOC_WM8904 [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && (ARCH_AT91 || COMPILE_TEST [=y]) && ATMEL_SSC [=m] && I2C [=m]
- SND_AT91_SOC_SAM9X5_WM8731 [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && (ARCH_AT91 || COMPILE_TEST [=y]) && ATMEL_SSC [=m] && SND_SOC_I2C_AND_SPI [=m]
--- sound/soc/atmel/Kconfig | 1 - 1 file changed, 1 deletion(-)
sound/soc/atmel/Kconfig +0 -1
@@ -11,7 +11,6 @@ if SND_ATMEL_SOC config SND_ATMEL_SOC_PDC bool - depends on HAS_DMA config SND_ATMEL_SOC_DMA bool
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 113/306 media: dib8000: rewrite the init prbs logic
In reply to Greg Kroah-HartmanFrom: Mauro Carvalho Chehab <[email protected]>
[ Upstream commit 8db11aebdb8f93f46a8513c22c9bd52fa23263aa ]
The logic at dib8000_get_init_prbs() has a few issues:
1. the tables used there has an extra unused value at the beginning;
2. the dprintk() message doesn't write the right value when transmission mode is not 8K;
3. the array overflow validation is done by the callers.
Rewrite the code to fix such issues.
This should also shut up those smatch warnings:
drivers/media/dvb-frontends/dib8000.c:2125 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_8k' 14 <= 14 drivers/media/dvb-frontends/dib8000.c:2129 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_2k' 14 <= 14 drivers/media/dvb-frontends/dib8000.c:2131 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_4k' 14 <= 14 drivers/media/dvb-frontends/dib8000.c:2134 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_8k' 14 <= 14
--- drivers/media/dvb-frontends/dib8000.c | 58 +++++++++++++++++++-------- 1 file changed, 41 insertions(+), 17 deletions(-)
drivers/media/dvb-frontends/dib8000.c +41 -17
@@ -2107,32 +2107,55 @@ static void dib8000_load_ana_fe_coefs(struct dib8000_state *state, const s16 *andib8000_write_word (state,117 + mode, ana_fe[mode]); } -static const u16 lut_prbs_2k[14 ] = { -0 ,0x423 ,0x009 ,0x5C7 ,0x7A6 ,0x3D8 ,0x527 ,0x7FF ,0x79B ,0x3D6 ,0x3A2 ,0x53B ,0x2F4 ,0x213 +static const u16 lut_prbs_2k[13 ] = { +0x423 ,0x009 ,0x5C7 , +0x7A6 ,0x3D8 ,0x527 , +0x7FF ,0x79B ,0x3D6 , +0x3A2 ,0x53B ,0x2F4 , +0x213 }; -static const u16 lut_prbs_4k[14 ] = { -0 ,0x208 ,0x0C3 ,0x7B9 ,0x423 ,0x5C7 ,0x3D8 ,0x7FF ,0x3D6 ,0x53B ,0x213 ,0x029 ,0x0D0 ,0x48E + +static const u16 lut_prbs_4k[13 ] = { +0x208 ,0x0C3 ,0x7B9 , +0x423 ,0x5C7 ,0x3D8 , +0x7FF ,0x3D6 ,0x53B , +0x213 ,0x029 ,0x0D0 , +0x48E }; -static const u16 lut_prbs_8k[14 ] = { -0 ,0x740 ,0x069 ,0x7DD ,0x208 ,0x7B9 ,0x5C7 ,0x7FF ,0x53B ,0x029 ,0x48E ,0x4C4 ,0x367 ,0x684 + +static const u16 lut_prbs_8k[13 ] = { +0x740 ,0x069 ,0x7DD , +0x208 ,0x7B9 ,0x5C7 , +0x7FF ,0x53B ,0x029 , +0x48E ,0x4C4 ,0x367 , +0x684 };static u16 dib8000_get_init_prbs (struct dib8000_state *state,u16 subchannel) {int sub_channel_prbs_group =0 ; +int prbs_group; - sub_channel_prbs_group = (subchannel /3 ) +1 ; -dprintk ("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n" , sub_channel_prbs_group, subchannel, lut_prbs_8k[sub_channel_prbs_group]); + sub_channel_prbs_group = subchannel /3 ; +if (sub_channel_prbs_group >=ARRAY_SIZE (lut_prbs_2k)) +return 0 ;switch (state->fe[0 ]->dtv_property_cache.transmission_mode) {case TRANSMISSION_MODE_2K : -return lut_prbs_2k[sub_channel_prbs_group]; + prbs_group = lut_prbs_2k[sub_channel_prbs_group]; +break ;case TRANSMISSION_MODE_4K : -return lut_prbs_4k[sub_channel_prbs_group]; + prbs_group = lut_prbs_4k[sub_channel_prbs_group]; +break ;default :case TRANSMISSION_MODE_8K : -return lut_prbs_8k[sub_channel_prbs_group]; + prbs_group = lut_prbs_8k[sub_channel_prbs_group]; } + +dprintk ("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n" , + sub_channel_prbs_group, subchannel, prbs_group); + +return prbs_group; }static void dib8000_set_13seg_channel (struct dib8000_state *state)
@@ -2409,10 +2432,8 @@ static void dib8000_set_isdbt_common_channel(struct dib8000_state *state, u8 seq/* TSB or ISDBT ? apply it now */ if (c->isdbt_sb_mode) {dib8000_set_sb_channel (state); -if (c->isdbt_sb_subchannel <14 ) - init_prbs =dib8000_get_init_prbs (state, c->isdbt_sb_subchannel); -else - init_prbs =0 ; + init_prbs =dib8000_get_init_prbs (state, + c->isdbt_sb_subchannel); }else {dib8000_set_13seg_channel (state); init_prbs =0xfff ;
@@ -3004,6 +3025,7 @@ static int dib8000_tune(struct dvb_frontend *fe)unsigned long *timeout = &state->timeout;unsigned long now = jiffies; +u16 init_prbs;#ifdef DIB8000_AGC_FREEZE u16 agc1, agc2;#endif
@@ -3302,8 +3324,10 @@ static int dib8000_tune(struct dvb_frontend *fe)break ;case CT_DEMOD_STEP_11 :/* 41 : init prbs autosearch */ -if (state->subchannel <=41 ) { -dib8000_set_subchannel_prbs (state,dib8000_get_init_prbs (state, state->subchannel)); + init_prbs =dib8000_get_init_prbs (state, state->subchannel); + +if (init_prbs) { +dib8000_set_subchannel_prbs (state, init_prbs); *tune_state =CT_DEMOD_STEP_9 ; }else { *tune_state =CT_DEMOD_STOP ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 114/306 libbpf: Fix reuse of pinned map on older kernel
In reply to Greg Kroah-HartmanFrom: Martynas Pumputis <[email protected]>
[ Upstream commit 97eb31384af943d6b97eb5947262cee4ef25cb87 ]
When loading a BPF program with a pinned map, the loader checks whether the pinned map can be reused, i.e. their properties match. To derive such of the pinned map, the loader invokes BPF_OBJ_GET_INFO_BY_FD and then does the comparison.
Unfortunately, on < 4.12 kernels the BPF_OBJ_GET_INFO_BY_FD is not available, so loading the program fails with the following error:
libbpf: failed to get map info for map FD 5: Invalid argument
libbpf: couldn't reuse pinned map at
'/sys/fs/bpf/tc/globals/cilium_call_policy': parameter mismatch"
libbpf: map 'cilium_call_policy': error reusing pinned map
libbpf: map 'cilium_call_policy': failed to create:
Invalid argument(-22)
libbpf: failed to load object 'bpf_overlay.o'
To fix this, fallback to derivation of the map properties via /proc/$PID/fdinfo/$MAP_FD if BPF_OBJ_GET_INFO_BY_FD fails with EINVAL, which can be used as an indicator that the kernel doesn't support the latter.
--- tools/lib/bpf/libbpf.c | 48 +++++++++++++++++++++++++++++++++++++++--- 1 file changed, 45 insertions(+), 3 deletions(-)
tools/lib/bpf/libbpf.c +45 -3
@@ -3613,6 +3613,42 @@ static int bpf_map_find_btf_info(struct bpf_object *obj, struct bpf_map *map)return 0 ; } +static int bpf_get_map_info_from_fdinfo (int fd,struct bpf_map_info *info) +{ +char file[PATH_MAX ], buff[4096 ]; +FILE *fp; +__u32 val; +int err; + +snprintf (file,sizeof (file),"/proc/%d/fdinfo/%d" ,getpid (), fd); +memset (info,0 ,sizeof (*info)); + + fp =fopen (file,"r" ); +if (!fp) { + err = -errno; +pr_warn ("failed to open %s: %d. No procfs support?\n" , file, + err); +return err; + } + +while (fgets (buff,sizeof (buff), fp)) { +if (sscanf (buff,"map_type:\t%u" , &val) ==1 ) + info->type = val; +else if (sscanf (buff,"key_size:\t%u" , &val) ==1 ) + info->key_size = val; +else if (sscanf (buff,"value_size:\t%u" , &val) ==1 ) + info->value_size = val; +else if (sscanf (buff,"max_entries:\t%u" , &val) ==1 ) + info->max_entries = val; +else if (sscanf (buff,"map_flags:\t%i" , &val) ==1 ) + info->map_flags = val; + } + +fclose (fp); + +return 0 ; +} +int bpf_map__reuse_fd (struct bpf_map *map,int fd) {struct bpf_map_info info = {};
@@ -3621,6 +3657,8 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd)char *new_name; err =bpf_obj_get_info_by_fd (fd, &info, &len); +if (err && errno ==EINVAL ) + err =bpf_get_map_info_from_fdinfo (fd, &info);if (err)return err;
@@ -4032,12 +4070,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)struct bpf_map_info map_info = {};char msg[STRERR_BUFSIZE ];__u32 map_info_len; +int err; map_info_len =sizeof (map_info); -if (bpf_obj_get_info_by_fd (map_fd, &map_info, &map_info_len)) { -pr_warn ("failed to get map info for map FD %d: %s\n" , - map_fd,libbpf_strerror_r (errno, msg,sizeof (msg))); + err =bpf_obj_get_info_by_fd (map_fd, &map_info, &map_info_len); +if (err && errno ==EINVAL ) + err =bpf_get_map_info_from_fdinfo (map_fd, &map_info); +if (err) { +pr_warn ("failed to get map info for map FD %d: %s\n" , map_fd, +libbpf_strerror_r (errno, msg,sizeof (msg)));return false; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 115/306 x86/hyperv: fix for unwanted manipulation of sched_clock when TSC marked unstable
In reply to Greg Kroah-HartmanFrom: Ani Sinha <[email protected]>
[ Upstream commit c445535c3efbfb8cb42d098e624d46ab149664b7 ]
Marking TSC as unstable has a side effect of marking sched_clock as unstable when TSC is still being used as the sched_clock. This is not desirable. Hyper-V ultimately uses a paravirtualized clock source that provides a stable scheduler clock even on systems without TscInvariant CPU capability. Hence, mark_tsc_unstable() call should be called _after_ scheduler clock has been changed to the paravirtualized clocksource. This will prevent any unwanted manipulation of the sched_clock. Only TSC will be correctly marked as unstable.
--- arch/x86/kernel/cpu/mshyperv.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/mshyperv.c +7 -2
@@ -322,8 +322,6 @@ static void __init ms_hyperv_init_platform(void)if (ms_hyperv.features &HV_ACCESS_TSC_INVARIANT ) {wrmsrl (HV_X64_MSR_TSC_INVARIANT_CONTROL ,0x1 );setup_force_cpu_cap (X86_FEATURE_TSC_RELIABLE ); - }else { -mark_tsc_unstable ("running on Hyper-V" ); }/*
@@ -382,6 +380,13 @@ static void __init ms_hyperv_init_platform(void)/* Register Hyper-V specific clocksource */ hv_init_clocksource ();#endif +/* +* TSC should be marked as unstable only after Hyper-V +* clocksource has been initialized. This ensures that the +* stability of the sched_clock is not altered. +*/ +if (!(ms_hyperv.features &HV_ACCESS_TSC_INVARIANT )) +mark_tsc_unstable ("running on Hyper-V" ); }const __initconst struct hypervisor_x86 x86_hyper_ms_hyperv = {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 116/306 crypto: mxs-dcp - Use sg_mapping_iter to copy data
In reply to Greg Kroah-HartmanFrom: Sean Anderson <[email protected]>
[ Upstream commit 2e6d793e1bf07fe5e20cfbbdcec9e1af7e5097eb ]
This uses the sg_pcopy_from_buffer to copy data, instead of doing it ourselves.
In addition to reducing code size, this fixes the following oops resulting from failing to kmap the page:
[ 68.896381] Unable to handle kernel NULL pointer dereference at virtual address 00000ab8 [ 68.904539] pgd = 3561adb3 [ 68.907475] [00000ab8] *pgd=00000000 [ 68.911153] Internal error: Oops: 805 [#1] ARM [ 68.915618] Modules linked in: cfg80211 rfkill des_generic libdes arc4 libarc4 cbc ecb algif_skcipher sha256_generic libsha256 sha1_generic hmac aes_generic libaes cmac sha512_generic md5 md4 algif_hash af_alg i2c_imx i2c_core ci_hdrc_imx ci_hdrc mxs_dcp ulpi roles udc_core imx_sdma usbmisc_imx usb_common firmware_class virt_dma phy_mxs_usb nf_tables nfnetlink ip_tables x_tables ipv6 autofs4 [ 68.950741] CPU: 0 PID: 139 Comm: mxs_dcp_chan/ae Not tainted 5.10.34 #296 [ 68.958501] Hardware name: Freescale i.MX6 Ultralite (Device Tree) [ 68.964710] PC is at memcpy+0xa8/0x330 [ 68.968479] LR is at 0xd7b2bc9d [ 68.971638] pc : [<c053e7c8>] lr : [<d7b2bc9d>] psr: 000f0013 [ 68.977920] sp : c2cbbee4 ip : 00000010 fp : 00000010 [ 68.983159] r10: 00000000 r9 : c3283a40 r8 : 1a5a6f08 [ 68.988402] r7 : 4bfe0ecc r6 : 76d8a220 r5 : c32f9050 r4 : 00000001 [ 68.994945] r3 : 00000ab8 r2 : fffffff0 r1 : c32f9050 r0 : 00000ab8 [ 69.001492] Flags: nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 69.008646] Control: 10c53c7d Table: 83664059 DAC: 00000051 [ 69.014414] Process mxs_dcp_chan/ae (pid: 139, stack limit = 0x667b57ab) [ 69.021133] Stack: (0xc2cbbee4 to 0xc2cbc000) [ 69.025519] bee0: c32f9050 c3235408 00000010 00000010 00000ab8 00000001 bf10406c [ 69.033720] bf00: 00000000 00000000 00000010 00000000 c32355d0 832fb080 00000000 c13de2fc [ 69.041921] bf20: c3628010 00000010 c33d5780 00000ab8 bf1067e8 00000002 c21e5010 c2cba000 [ 69.050125] bf40: c32f8040 00000000 bf106a40 c32f9040 c3283a80 00000001 bf105240 c3234040 [ 69.058327] bf60: ffffe000 c3204100 c2c69800 c2cba000 00000000 bf103b84 00000000 c2eddc54 [ 69.066530] bf80: c3204144 c0140d1c c2cba000 c2c69800 c0140be8 00000000 00000000 00000000 [ 69.074730] bfa0: 00000000 00000000 00000000 c0100114 00000000 00000000 00000000 00000000 [ 69.082932] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 69.091131] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 [ 69.099364] [<c053e7c8>] (memcpy) from [<bf10406c>] (dcp_chan_thread_aes+0x4e8/0x840 [mxs_dcp]) [ 69.108117] [<bf10406c>] (dcp_chan_thread_aes [mxs_dcp]) from [<c0140d1c>] (kthread+0x134/0x160) [ 69.116941] [<c0140d1c>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20) [ 69.124178] Exception stack(0xc2cbbfb0 to 0xc2cbbff8) [ 69.129250] bfa0: 00000000 00000000 00000000 00000000 [ 69.137450] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 69.145648] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 69.152289] Code: e320f000 e4803004 e4804004 e4805004 (e4806004)
--- drivers/crypto/mxs-dcp.c | 36 +++++++++--------------------------- 1 file changed, 9 insertions(+), 27 deletions(-)
drivers/crypto/mxs-dcp.c +9 -27
@@ -299,21 +299,20 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)struct scatterlist *dst = req->dst;struct scatterlist *src = req->src; -const int nents =sg_nents (req->src); +int dst_nents =sg_nents (dst);const int out_off =DCP_BUF_SZ ;uint8_t *in_buf = sdcp->coh->aes_in_buf;uint8_t *out_buf = sdcp->coh->aes_out_buf; -uint8_t *out_tmp, *src_buf, *dst_buf =NULL ;uint32_t dst_off =0 ; +uint8_t *src_buf =NULL ;uint32_t last_out_len =0 ;uint8_t *key = sdcp->coh->aes_key;int ret =0 ; -int split =0 ; -unsigned int i, len, clen, rem =0 , tlen =0 ; +unsigned int i, len, clen, tlen =0 ;int init =0 ;bool limit_hit = false;
@@ -331,7 +330,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)memset (key +AES_KEYSIZE_128 ,0 ,AES_KEYSIZE_128 ); } -for_each_sg (req->src, src, nents, i) { +for_each_sg (req->src, src,sg_nents (src), i) { src_buf =sg_virt (src); len =sg_dma_len (src); tlen += len;
@@ -356,34 +355,17 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)* submit the buffer. */ if (actx->fill == out_off ||sg_is_last (src) || - limit_hit) { + limit_hit) { ret =mxs_dcp_run_aes (actx, req, init);if (ret)return ret; init =0 ; - out_tmp = out_buf; +sg_pcopy_from_buffer (dst, dst_nents, out_buf, + actx->fill, dst_off); + dst_off += actx->fill; last_out_len = actx->fill; -while (dst && actx->fill) { -if (!split) { - dst_buf =sg_virt (dst); - dst_off =0 ; - } - rem =min (sg_dma_len (dst) - dst_off, - actx->fill); - -memcpy (dst_buf + dst_off, out_tmp, rem); - out_tmp += rem; - dst_off += rem; - actx->fill -= rem; - -if (dst_off ==sg_dma_len (dst)) { - dst =sg_next (dst); - split =0 ; - }else { - split =1 ; - } - } + actx->fill =0 ; } }while (len);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 117/306 PCI: Use pci_update_current_state() in pci_enable_device_flags()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit 14858dcc3b3587f4bb5c48e130ee7d68fc2b0a29 ]
Updating the current_state field of struct pci_dev the way it is done in pci_enable_device_flags() before calling do_pci_enable_device() may not work. For example, if the given PCI device depends on an ACPI power resource whose _STA method initially returns 0 ("off"), but the config space of the PCI device is accessible and the power state retrieved from the PCI_PM_CTRL register is D0, the current_state field in the struct pci_dev representing that device will get out of sync with the power.state of its ACPI companion object and that will lead to power management issues going forward.
To avoid such issues, make pci_enable_device_flags() call pci_update_current_state() which takes ACPI device power management into account, if present, to retrieve the current power state of the device.
--- drivers/pci/pci.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/pci/pci.c +1 -5
@@ -1880,11 +1880,7 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags)* so that things like MSI message writing will behave as expected * (e.g. if the device really is in D0 at enable time). */ -if (dev->pm_cap) { -u16 pmcsr; -pci_read_config_word (dev, dev->pm_cap +PCI_PM_CTRL , &pmcsr); - dev->current_state = (pmcsr &PCI_PM_CTRL_STATE_MASK ); - } +pci_update_current_state (dev, dev->current_state);if (atomic_inc_return (&dev->enable_cnt) >1 )return 0 ;/* already enabled */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 118/306 tipc: keep the skb in rcv queue until the whole data is read
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit f4919ff59c2828064b4156e3c3600a169909bcf4 ]
Currently, when userspace reads a datagram with a buffer that is smaller than this datagram, the data will be truncated and only part of it can be received by users. It doesn't seem right that users don't know the datagram size and have to use a huge buffer to read it to avoid the truncation.
This patch to fix it by keeping the skb in rcv queue until the whole data is read by users. Only the last msg of the datagram will be marked with MSG_EOR, just as TCP/SCTP does.
Note that this will work as above only when MSG_EOR is set in the flags parameter of recvmsg(), so that it won't break any old user applications.
--- net/tipc/socket.c | 36 +++++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 9 deletions(-)
net/tipc/socket.c +27 -9
@@ -1887,6 +1887,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,bool connected = !tipc_sk_type_connectionless (sk);struct tipc_sock *tsk =tipc_sk (sk);int rc, err, hlen, dlen, copy; +struct tipc_skb_cb *skb_cb;struct sk_buff_head xmitq;struct tipc_msg *hdr;struct sk_buff *skb;
@@ -1910,6 +1911,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,if (unlikely (rc)) goto exit; skb =skb_peek (&sk->sk_receive_queue); + skb_cb =TIPC_SKB_CB (skb); hdr =buf_msg (skb); dlen =msg_data_sz (hdr); hlen =msg_hdr_sz (hdr);
@@ -1929,18 +1931,33 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,/* Capture data if non-error msg, otherwise just set return value */ if (likely (!err)) { - copy =min_t (int, dlen, buflen); -if (unlikely (copy != dlen)) - m->msg_flags |=MSG_TRUNC ; - rc =skb_copy_datagram_msg (skb, hlen, m, copy); +int offset = skb_cb->bytes_read; + + copy =min_t (int, dlen - offset, buflen); + rc =skb_copy_datagram_msg (skb, hlen + offset, m, copy); +if (unlikely (rc)) + goto exit; +if (unlikely (offset + copy < dlen)) { +if (flags &MSG_EOR ) { +if (!(flags &MSG_PEEK )) + skb_cb->bytes_read = offset + copy; + }else { + m->msg_flags |=MSG_TRUNC ; + skb_cb->bytes_read =0 ; + } + }else { +if (flags &MSG_EOR ) + m->msg_flags |=MSG_EOR ; + skb_cb->bytes_read =0 ; + } }else { copy =0 ; rc =0 ; -if (err !=TIPC_CONN_SHUTDOWN && connected && !m->msg_control) +if (err !=TIPC_CONN_SHUTDOWN && connected && !m->msg_control) { rc = -ECONNRESET ; + goto exit; + } } -if (unlikely (rc)) - goto exit;/* Mark message as group event if applicable */ if (unlikely (grp_evt)) {
@@ -1963,9 +1980,10 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,tipc_node_distr_xmit (sock_net (sk), &xmitq); } -tsk_advance_rx_queue (sk); +if (!skb_cb->bytes_read) +tsk_advance_rx_queue (sk); -if (likely (!connected)) +if (likely (!connected) || skb_cb->bytes_read) goto exit;/* Send connection flow control advertisement when applicable */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 119/306 net: phy: Fix data type in DP83822 dp8382x_disable_wol()
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 0d6835ffe50c9c1f098b5704394331710b67af48 ]
The last argument of phy_clear_bits_mmd(..., u16 val); is u16 and not int, just inline the value into the function call arguments.
No functional change.
--- drivers/net/phy/dp83822.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/net/phy/dp83822.c +3 -5
@@ -305,11 +305,9 @@ static int dp83822_config_intr(struct phy_device *phydev)static int dp8382x_disable_wol (struct phy_device *phydev) { -int value =DP83822_WOL_EN |DP83822_WOL_MAGIC_EN | -DP83822_WOL_SECURE_ON ; - -return phy_clear_bits_mmd (phydev,DP83822_DEVADDR , -MII_DP83822_WOL_CFG , value); +return phy_clear_bits_mmd (phydev,DP83822_DEVADDR ,MII_DP83822_WOL_CFG , +DP83822_WOL_EN |DP83822_WOL_MAGIC_EN | +DP83822_WOL_SECURE_ON ); }static int dp83822_read_status (struct phy_device *phydev)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 120/306 iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
[ Upstream commit 97683c851f9cdbd3ea55697cbe2dcb6af4287bbd ]
The naming of the regulator is problematic. VCC is usually a supply voltage whereas these devices have a separate VREF pin.
Secondly, the regulator core might have provided a stub regulator if a real regulator wasn't provided. That would in turn have failed to provide a voltage when queried. So reality was that there was no way to use the internal reference.
In order to avoid breaking any dts out in the wild, make sure to fallback to the original vcc naming if vref is not available.
--- drivers/iio/dac/ad5624r_spi.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/iio/dac/ad5624r_spi.c +17 -1
@@ -229,7 +229,7 @@ static int ad5624r_probe(struct spi_device *spi)if (!indio_dev)return -ENOMEM ; st =iio_priv (indio_dev); - st->reg =devm_regulator_get (&spi->dev,"vcc" ); + st->reg =devm_regulator_get_optional (&spi->dev,"vref" );if (!IS_ERR (st->reg)) { ret =regulator_enable (st->reg);if (ret)
@@ -240,6 +240,22 @@ static int ad5624r_probe(struct spi_device *spi) goto error_disable_reg; voltage_uv = ret; + }else { +if (PTR_ERR (st->reg) != -ENODEV ) +return PTR_ERR (st->reg); +/* Backwards compatibility. This naming is not correct */ + st->reg =devm_regulator_get_optional (&spi->dev,"vcc" ); +if (!IS_ERR (st->reg)) { + ret =regulator_enable (st->reg); +if (ret) +return ret; + + ret =regulator_get_voltage (st->reg); +if (ret <0 ) + goto error_disable_reg; + + voltage_uv = ret; + } }spi_set_drvdata (spi, indio_dev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 121/306 iavf: do not override the adapter state in the watchdog task
In reply to Greg Kroah-HartmanFrom: Stefan Assmann <[email protected]>
[ Upstream commit 22c8fd71d3a5e6fe584ccc2c1e8760e5baefd5aa ]
The iavf watchdog task overrides adapter->state to __IAVF_RESETTING when it detects a pending reset. Then schedules iavf_reset_task() which takes care of the reset.
The reset task is capable of handling the reset without changing adapter->state. In fact we lose the state information when the watchdog task prematurely changes the adapter state. This may lead to a crash if instead of the reset task the iavf_remove() function gets called before the reset task.
In that case (if we were in state __IAVF_RUNNING previously) the iavf_remove() function triggers iavf_close() which fails to close the device because of the incorrect state information.
This may result in a crash due to pending interrupts. kernel BUG at drivers/pci/msi.c:357!
[...]
Call Trace: [<ffffffffbddf24dd>] pci_disable_msix+0x3d/0x50 [<ffffffffc08d2a63>] iavf_reset_interrupt_capability+0x23/0x40 [iavf] [<ffffffffc08d312a>] iavf_remove+0x10a/0x350 [iavf] [<ffffffffbddd3359>] pci_device_remove+0x39/0xc0 [<ffffffffbdeb492f>] __device_release_driver+0x7f/0xf0 [<ffffffffbdeb49c3>] device_release_driver+0x23/0x30 [<ffffffffbddcabb4>] pci_stop_bus_device+0x84/0xa0 [<ffffffffbddcacc2>] pci_stop_and_remove_bus_device+0x12/0x20 [<ffffffffbddf361f>] pci_iov_remove_virtfn+0xaf/0x160 [<ffffffffbddf3bcc>] sriov_disable+0x3c/0xf0 [<ffffffffbddf3ca3>] pci_disable_sriov+0x23/0x30 [<ffffffffc0667365>] i40e_free_vfs+0x265/0x2d0 [i40e] [<ffffffffc0667624>] i40e_pci_sriov_configure+0x144/0x1f0 [i40e] [<ffffffffbddd5307>] sriov_numvfs_store+0x177/0x1d0 Code: 00 00 e8 3c 25 e3 ff 49 c7 86 88 08 00 00 00 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 8b 7b 28 e8 0d 44 RIP [<ffffffffbbbf1068>] free_msi_irqs+0x188/0x190
The solution is to not touch the adapter->state in iavf_watchdog_task() and let the reset task handle the state transition.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +0 -1
@@ -1951,7 +1951,6 @@ static void iavf_watchdog_task(struct work_struct *work)/* check for hw reset */ reg_val =rd32 (hw,IAVF_VF_ARQLEN1 ) &IAVF_VF_ARQLEN1_ARQENABLE_MASK ;if (!reg_val) { - adapter->state = __IAVF_RESETTING; adapter->flags |=IAVF_FLAG_RESET_PENDING ; adapter->aq_required =0 ; adapter->current_op =VIRTCHNL_OP_UNKNOWN ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 122/306 iavf: fix locking of critical sections
In reply to Greg Kroah-HartmanFrom: Stefan Assmann <[email protected]>
[ Upstream commit 226d528512cfac890a1619aea4301f3dd314fe60 ]
To avoid races between iavf_init_task(), iavf_reset_task(), iavf_watchdog_task(), iavf_adminq_task() as well as the shutdown and remove functions more locking is required.
The current protection by __IAVF_IN_CRITICAL_TASK is needed in additional places.
- The reset task performs state transitions, therefore needs locking.
- The adminq task acts on replies from the PF in iavf_virtchnl_completion() which may alter the states.
- The init task is not only run during probe but also if a VF gets stuck to reinitialize it.
- The shutdown function performs a state transition.
- The remove function performs a state transition and also free's resources.
iavf_lock_timeout() is introduced to avoid waiting infinitely and cause a deadlock. Rather unlock and print a warning.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 57 ++++++++++++++++++--- 1 file changed, 50 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +50 -7
@@ -131,6 +131,30 @@ enum iavf_status iavf_free_virt_mem_d(struct iavf_hw *hw,return 0 ; } +/** +* iavf_lock_timeout - try to set bit but give up after timeout +* @adapter: board private structure +* @bit: bit to set +* @msecs: timeout in msecs +* +* Returns 0 on success, negative on failure +**/ +static int iavf_lock_timeout (struct iavf_adapter *adapter, +enum iavf_critical_section_t bit, +unsigned int msecs) +{ +unsigned int wait, delay =10 ; + +for (wait =0 ; wait < msecs; wait += delay) { +if (!test_and_set_bit (bit, &adapter->crit_section)) +return 0 ; + +msleep (delay); + } + +return -1 ; +} +/** * iavf_schedule_reset - Set the flags and schedule a reset event * @adapter: board private structure
@@ -2064,6 +2088,10 @@ static void iavf_reset_task(struct work_struct *work)if (test_bit (__IAVF_IN_REMOVE_TASK, &adapter->crit_section))return ; +if (iavf_lock_timeout (adapter, __IAVF_IN_CRITICAL_TASK,200 )) { +schedule_work (&adapter->reset_task); +return ; + }while (test_and_set_bit (__IAVF_IN_CLIENT_TASK, &adapter->crit_section))usleep_range (500 ,1000 );
@@ -2278,6 +2306,8 @@ static void iavf_adminq_task(struct work_struct *work)if (!event.msg_buf) goto out; +if (iavf_lock_timeout (adapter, __IAVF_IN_CRITICAL_TASK,200 )) + goto freedom; do { ret = iavf_clean_arq_element(hw, &event, &pending); v_op = (enum virtchnl_ops)le32_to_cpu(event.desc.cookie_high);
@@ -2291,6 +2321,7 @@ static void iavf_adminq_task(struct work_struct *work)if (pending !=0 )memset (event.msg_buf,0 ,IAVF_MAX_AQ_BUF_SIZE ); }while (pending); +clear_bit (__IAVF_IN_CRITICAL_TASK, &adapter->crit_section); if ((adapter->flags & (IAVF_FLAG_RESET_PENDING | IAVF_FLAG_RESET_NEEDED)) ||
@@ -3593,6 +3624,10 @@ static void iavf_init_task(struct work_struct *work) init_task.work);struct iavf_hw *hw = &adapter->hw; +if (iavf_lock_timeout (adapter, __IAVF_IN_CRITICAL_TASK,5000 )) { +dev_warn (&adapter->pdev->dev,"failed to set __IAVF_IN_CRITICAL_TASK in %s\n" , __FUNCTION__); +return ; + }switch (adapter->state) {case __IAVF_STARTUP:if (iavf_startup (adapter) <0 )
@@ -3605,14 +3640,14 @@ static void iavf_init_task(struct work_struct *work)case __IAVF_INIT_GET_RESOURCES:if (iavf_init_get_resources (adapter) <0 ) goto init_failed; -return ; + goto out;default : goto init_failed; }queue_delayed_work (iavf_wq, &adapter->init_task,msecs_to_jiffies (30 )); -return ; + goto out; init_failed:if (++adapter->aq_wait_count >IAVF_AQ_MAX_ERR ) { dev_err(&adapter->pdev->dev,
@@ -3621,9 +3656,11 @@ static void iavf_init_task(struct work_struct *work)iavf_shutdown_adminq (hw); adapter->state = __IAVF_STARTUP;queue_delayed_work (iavf_wq, &adapter->init_task,HZ *5 ); -return ; + goto out; }queue_delayed_work (iavf_wq, &adapter->init_task,HZ ); +out: +clear_bit (__IAVF_IN_CRITICAL_TASK, &adapter->crit_section); }/**
@@ -3640,9 +3677,12 @@ static void iavf_shutdown(struct pci_dev *pdev)if (netif_running (netdev))iavf_close (netdev); +if (iavf_lock_timeout (adapter, __IAVF_IN_CRITICAL_TASK,5000 )) +dev_warn (&adapter->pdev->dev,"failed to set __IAVF_IN_CRITICAL_TASK in %s\n" , __FUNCTION__);/* Prevent the watchdog from running. */ adapter->state = __IAVF_REMOVE; adapter->aq_required =0 ; +clear_bit (__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);#ifdef CONFIG_PM pci_save_state (pdev);
@@ -3870,10 +3910,6 @@ static void iavf_remove(struct pci_dev *pdev) err); } -/* Shut down all the garbage mashers on the detention level */ - adapter->state = __IAVF_REMOVE; - adapter->aq_required =0 ; - adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED ;iavf_request_reset (adapter);msleep (50 );/* If the FW isn't responding, kick it once, but only once. */
@@ -3881,6 +3917,13 @@ static void iavf_remove(struct pci_dev *pdev)iavf_request_reset (adapter);msleep (50 ); } +if (iavf_lock_timeout (adapter, __IAVF_IN_CRITICAL_TASK,5000 )) +dev_warn (&adapter->pdev->dev,"failed to set __IAVF_IN_CRITICAL_TASK in %s\n" , __FUNCTION__); + +/* Shut down all the garbage mashers on the detention level */ + adapter->state = __IAVF_REMOVE; + adapter->aq_required =0 ; + adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED ;iavf_free_all_tx_resources (adapter);iavf_free_all_rx_resources (adapter);iavf_misc_irq_disable (adapter);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 123/306 ARM: dts: qcom: apq8064: correct clock names
In reply to Greg Kroah-HartmanFrom: David Heidelberg <[email protected]>
[ Upstream commit 0dc6c59892ead17a9febd11202c9f6794aac1895 ]
Since new code doesn't take old clk names in account, it does fixes error:
msm_dsi 4700000.mdss_dsi: dev_pm_opp_set_clkname: Couldn't find clock: -2
and following kernel oops introduced byb0530eb1191 ("drm/msm/dpu: Use OPP API to set clk/perf state").
Also removes warning about deprecated clock names.
Tested against linux-5.10.y LTS on Nexus 7 2013.
--- arch/arm/boot/dts/qcom-apq8064.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/qcom-apq8064.dtsi +3 -3
@@ -1262,9 +1262,9 @@ dsi0: mdss_dsi@4700000 { <&mmcc DSI1_BYTE_CLK>, <&mmcc DSI_PIXEL_CLK>, <&mmcc DSI1_ESC_CLK>; - clock-names = "iface_clk", "bus_clk", "core_mmss_clk", - "src_clk", "byte_clk", "pixel_clk", - "core_clk"; + clock-names = "iface", "bus", "core_mmss", + "src", "byte", "pixel", + "core"; assigned-clocks = <&mmcc DSI1_BYTE_SRC>, <&mmcc DSI1_ESC_SRC>,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 124/306 video: fbdev: kyro: fix a DoS bug by restricting user input
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 98a65439172dc69cb16834e62e852afc2adb83ed ]
The user can pass in any value to the driver through the 'ioctl' interface. The driver dost not check, which may cause DoS bugs.
The following log reveals it:
divide error: 0000 [#1] PREEMPT SMP KASAN PTI
RIP: 0010:SetOverlayViewPort+0x133/0x5f0 drivers/video/fbdev/kyro/STG4000OverlayDevice.c:476 Call Trace: kyro_dev_overlay_viewport_set drivers/video/fbdev/kyro/fbdev.c:378 [inline] kyrofb_ioctl+0x2eb/0x330 drivers/video/fbdev/kyro/fbdev.c:603 do_fb_ioctl+0x1f3/0x700 drivers/video/fbdev/core/fbmem.c:1171 fb_ioctl+0xeb/0x130 drivers/video/fbdev/core/fbmem.c:1185 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19b/0x220 fs/ioctl.c:739 do_syscall_64+0x32/0x80 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae
--- drivers/video/fbdev/kyro/fbdev.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/video/fbdev/kyro/fbdev.c +5 -0
@@ -372,6 +372,11 @@ static int kyro_dev_overlay_viewport_set(u32 x, u32 y, u32 ulWidth, u32 ulHeight/* probably haven't called CreateOverlay yet */ return -EINVAL ; +if (ulWidth ==0 || ulWidth ==0xffffffff || + ulHeight ==0 || ulHeight ==0xffffffff || + (x <2 && ulWidth +2 ==0 )) +return -EINVAL ; +/* Stop Ramdac Output */ DisableRamdacOutput (deviceInfo.pSTGReg);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 125/306 netlink: Deal with ESRCH error in nlmsg_notify()
In reply to Greg Kroah-HartmanFrom: Yajun Deng <[email protected]>
[ Upstream commit fef773fc8110d8124c73a5e6610f89e52814637d ]
Yonghong Song report:
The bpf selftest tc_bpf failed with latest bpf-next. The following is the command to run and the result:
$ ./test_progs -n 132 [ 40.947571] bpf_testmod: loading out-of-tree module taints kernel. test_tc_bpf:PASS:test_tc_bpf__open_and_load 0 nsec test_tc_bpf:PASS:bpf_tc_hook_create(BPF_TC_INGRESS) 0 nsec test_tc_bpf:PASS:bpf_tc_hook_create invalid hook.attach_point 0 nsec test_tc_bpf_basic:PASS:bpf_obj_get_info_by_fd 0 nsec test_tc_bpf_basic:PASS:bpf_tc_attach 0 nsec test_tc_bpf_basic:PASS:handle set 0 nsec test_tc_bpf_basic:PASS:priority set 0 nsec test_tc_bpf_basic:PASS:prog_id set 0 nsec test_tc_bpf_basic:PASS:bpf_tc_attach replace mode 0 nsec test_tc_bpf_basic:PASS:bpf_tc_query 0 nsec test_tc_bpf_basic:PASS:handle set 0 nsec test_tc_bpf_basic:PASS:priority set 0 nsec test_tc_bpf_basic:PASS:prog_id set 0 nsec libbpf: Kernel error message: Failed to send filter delete notification test_tc_bpf_basic:FAIL:bpf_tc_detach unexpected error: -3 (errno 3) test_tc_bpf:FAIL:test_tc_internal ingress unexpected error: -3 (errno 3)
The failure seems due to the commit
cfdf0d9ae75b ("rtnetlink: use nlmsg_notify() in rtnetlink_send()")
Deal with ESRCH error in nlmsg_notify() even the report variable is zero.
--- net/netlink/af_netlink.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/netlink/af_netlink.c +3 -1
@@ -2537,13 +2537,15 @@ int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,/* errors reported via destination sk->sk_err, but propagate * delivery errors if NETLINK_BROADCAST_ERROR flag is set */ err =nlmsg_multicast (sk, skb, exclude_portid, group, flags); +if (err == -ESRCH ) + err =0 ; }if (report) {int err2; err2 =nlmsg_unicast (sk, skb, portid); -if (!err || err == -ESRCH ) +if (!err) err = err2; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 126/306 Smack: Fix wrong semantics in smk_access_entry()
In reply to Greg Kroah-HartmanFrom: Tianjia Zhang <[email protected]>
[ Upstream commit 6d14f5c7028eea70760df284057fe198ce7778dd ]
In the smk_access_entry() function, if no matching rule is found in the rust_list, a negative error code will be used to perform bit operations with the MAY_ enumeration value. This is semantically wrong. This patch fixes this issue.
--- security/smack/smack_access.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
security/smack/smack_access.c +8 -9
@@ -81,23 +81,22 @@ int log_policy = SMACK_AUDIT_DENIED;int smk_access_entry (char *subject_label,char *object_label,struct list_head *rule_list) { -int may = -ENOENT ;struct smack_rule *srp;list_for_each_entry_rcu (srp, rule_list, list) {if (srp->smk_object->smk_known == object_label && srp->smk_subject->smk_known == subject_label) { - may = srp->smk_access; -break ; +int may = srp->smk_access; +/* +* MAY_WRITE implies MAY_LOCK. +*/ +if ((may &MAY_WRITE ) ==MAY_WRITE ) + may |=MAY_LOCK ; +return may; } } -/* -* MAY_WRITE implies MAY_LOCK. -*/ -if ((may &MAY_WRITE ) ==MAY_WRITE ) - may |=MAY_LOCK ; -return may; +return -ENOENT ; }/**
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 127/306 drm: avoid blocking in drm_clients_infos rcu section
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
[ Upstream commit 5eff9585de220cdd131237f5665db5e6c6bdf590 ]
Inside drm_clients_info, the rcu_read_lock is held to lock pid_task()->comm. However, within this protected section, a call to drm_is_current_master is made, which involves a mutex lock in a future patch. However, this is illegal because the mutex lock might block while in the RCU read-side critical section.
Since drm_is_current_master isn't protected by rcu_read_lock, we avoid this by moving it out of the RCU critical section.
The following report came from intel-gfx ci's
igt@debugfs_test@read_all_entries testcase:
=============================
[ BUG: Invalid wait context ]
5.13.0-CI-Patchwork_20515+ #1 Tainted: G W
-----------------------------
debugfs_test/1101 is trying to lock:ffff888132d901a8 (&dev->master_mutex){+.+.}-{3:3}, at:drm_is_current_master+0x1e/0x50
other info that might help us debug this:
context-{4:4}
3 locks held by debugfs_test/1101:
#0: ffff88810fdffc90 (&p->lock){+.+.}-{3:3}, at:
seq_read_iter+0x53/0x3b0
#1: ffff888132d90240 (&dev->filelist_mutex){+.+.}-{3:3}, at:
drm_clients_info+0x63/0x2a0
#2: ffffffff82734220 (rcu_read_lock){....}-{1:2}, at:
drm_clients_info+0x1b1/0x2a0
stack backtrace:
CPU: 8 PID: 1101 Comm: debugfs_test Tainted: G W
5.13.0-CI-Patchwork_20515+ #1
Hardware name: Intel Corporation CometLake Client Platform/CometLake S
UDIMM (ERB/CRB), BIOS CMLSFWR1.R00.1263.D00.1906260926 06/26/2019
Call Trace:
dump_stack+0x7f/0xad
__lock_acquire.cold.78+0x2af/0x2ca
lock_acquire+0xd3/0x300
? drm_is_current_master+0x1e/0x50
? __mutex_lock+0x76/0x970
? lockdep_hardirqs_on+0xbf/0x130
__mutex_lock+0xab/0x970
? drm_is_current_master+0x1e/0x50
? drm_is_current_master+0x1e/0x50
? drm_is_current_master+0x1e/0x50
drm_is_current_master+0x1e/0x50
drm_clients_info+0x107/0x2a0
seq_read_iter+0x178/0x3b0
seq_read+0x104/0x150
full_proxy_read+0x4e/0x80
vfs_read+0xa5/0x1b0
ksys_read+0x5a/0xd0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae--- drivers/gpu/drm/drm_debugfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_debugfs.c +2 -1
@@ -91,6 +91,7 @@ static int drm_clients_info(struct seq_file *m, void *data)mutex_lock (&dev->filelist_mutex);list_for_each_entry_reverse (priv, &dev->filelist, lhead) {struct task_struct *task; +bool is_current_master =drm_is_current_master (priv);rcu_read_lock ();/* locks pid_task()->comm */ task =pid_task (priv->pid,PIDTYPE_PID );
@@ -99,7 +100,7 @@ static int drm_clients_info(struct seq_file *m, void *data) task ? task->comm :"<unknown>" ,pid_vnr (priv->pid), priv->minor->index, -drm_is_current_master (priv) ?'y' :'n' , + is_current_master ?'y' :'n' , priv->authenticated ?'y' :'n' ,from_kuid_munged (seq_user_ns (m), uid), priv->magic);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 128/306 drm: serialize drm_file.master with a new spinlock
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
[ Upstream commit 0b0860a3cf5eccf183760b1177a1dcdb821b0b66 ]
Currently, drm_file.master pointers should be protected by drm_device.master_mutex when being dereferenced. This is because drm_file.master is not invariant for the lifetime of drm_file. If drm_file is not the creator of master, then drm_file.is_master is false, and a call to drm_setmaster_ioctl will invoke drm_new_set_master, which then allocates a new master for drm_file and puts the old master.
Thus, without holding drm_device.master_mutex, the old value of drm_file.master could be freed while it is being used by another concurrent process.
However, it is not always possible to lock drm_device.master_mutex to dereference drm_file.master. Through the fbdev emulation code, this might occur in a deep nest of other locks. But drm_device.master_mutex is also the outermost lock in the nesting hierarchy, so this leads to potential deadlocks.
To address this, we introduce a new spin lock at the bottom of the lock hierarchy that only serializes drm_file.master. With this change, the value of drm_file.master changes only when both drm_device.master_mutex and drm_file.master_lookup_lock are held. Hence, any process holding either of those locks can ensure that the value of drm_file.master will not change concurrently.
Since no lock depends on the new drm_file.master_lookup_lock, when drm_file.master is dereferenced, but drm_device.master_mutex cannot be held, we can safely protect the master pointer with drm_file.master_lookup_lock.
--- drivers/gpu/drm/drm_auth.c | 17 +++++++++++------ drivers/gpu/drm/drm_file.c | 1 + include/drm/drm_file.h | 12 +++++++++--- 3 files changed, 21 insertions(+), 9 deletions(-)
drivers/gpu/drm/drm_auth.c +11 -6
@@ -135,16 +135,18 @@ static void drm_set_master(struct drm_device *dev, struct drm_file *fpriv,static int drm_new_set_master (struct drm_device *dev,struct drm_file *fpriv) {struct drm_master *old_master; +struct drm_master *new_master;lockdep_assert_held_once (&dev->master_mutex);WARN_ON (fpriv->is_master); old_master = fpriv->master; - fpriv->master =drm_master_create (dev); -if (!fpriv->master) { - fpriv->master = old_master; + new_master =drm_master_create (dev); +if (!new_master)return -ENOMEM ; - } +spin_lock (&fpriv->master_lookup_lock); + fpriv->master = new_master; +spin_unlock (&fpriv->master_lookup_lock); fpriv->is_master =1 ; fpriv->authenticated =1 ;
@@ -302,10 +304,13 @@ int drm_master_open(struct drm_file *file_priv)/* if there is no current master make this fd it, but do not create * any master object for render clients */ mutex_lock (&dev->master_mutex); -if (!dev->master) +if (!dev->master) { ret =drm_new_set_master (dev, file_priv); -else + }else { +spin_lock (&file_priv->master_lookup_lock); file_priv->master =drm_master_get (dev->master); +spin_unlock (&file_priv->master_lookup_lock); + }mutex_unlock (&dev->master_mutex);return ret;
drivers/gpu/drm/drm_file.c +1 -0
@@ -177,6 +177,7 @@ struct drm_file *drm_file_alloc(struct drm_minor *minor)init_waitqueue_head (&file->event_wait); file->event_space =4096 ;/* set aside 4k for event buffer */ +spin_lock_init (&file->master_lookup_lock);mutex_init (&file->event_read_lock);if (drm_core_check_feature (dev,DRIVER_GEM ))
include/drm/drm_file.h +9 -3
@@ -226,15 +226,21 @@ struct drm_file {/** * @master: * -* Master this node is currently associated with. Only relevant if -* drm_is_primary_client() returns true. Note that this only -* matches &drm_device.master if the master is the currently active one. +* Master this node is currently associated with. Protected by struct +* &drm_device.master_mutex, and serialized by @master_lookup_lock. +* +* Only relevant if drm_is_primary_client() returns true. Note that +* this only matches &drm_device.master if the master is the currently +* active one. * * See also @authentication and @is_master and the :ref:`section on * primary nodes and authentication <drm_primary_node>`. */ struct drm_master *master; +/** @master_lock: Serializes @master. */ +spinlock_t master_lookup_lock; +/** @pid: Process that opened this file. */ struct pid *pid;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 129/306 drm: protect drm_master pointers in drm_lease.c
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
[ Upstream commit 56f0729a510f92151682ff6c89f69724d5595d6e ]
drm_file->master pointers should be protected by drm_device.master_mutex or drm_file.master_lookup_lock when being dereferenced.
However, in drm_lease.c, there are multiple instances where drm_file->master is accessed and dereferenced while neither lock is held. This makes drm_lease.c vulnerable to use-after-free bugs.
We address this issue in 2 ways:
1. Add a new drm_file_get_master() function that calls drm_master_get on drm_file->master while holding on to drm_file.master_lookup_lock. Since drm_master_get increments the reference count of master, this prevents master from being freed until we unreference it with drm_master_put.
2. In each case where drm_file->master is directly accessed and eventually dereferenced in drm_lease.c, we wrap the access in a call to the new drm_file_get_master function, then unreference the master pointer once we are done using it.
--- drivers/gpu/drm/drm_auth.c | 25 ++++++++++++ drivers/gpu/drm/drm_lease.c | 81 ++++++++++++++++++++++++++++--------- include/drm/drm_auth.h | 1 + include/drm/drm_file.h | 6 +++ 4 files changed, 93 insertions(+), 20 deletions(-)
drivers/gpu/drm/drm_auth.c +25 -0
@@ -376,6 +376,31 @@ struct drm_master *drm_master_get(struct drm_master *master) }EXPORT_SYMBOL (drm_master_get); +/** +* drm_file_get_master - reference &drm_file.master of @file_priv +* @file_priv: DRM file private +* +* Increments the reference count of @file_priv's &drm_file.master and returns +* the &drm_file.master. If @file_priv has no &drm_file.master, returns NULL. +* +* Master pointers returned from this function should be unreferenced using +* drm_master_put(). +*/ +struct drm_master *drm_file_get_master (struct drm_file *file_priv) +{ +struct drm_master *master =NULL ; + +spin_lock (&file_priv->master_lookup_lock); +if (!file_priv->master) + goto unlock; + master =drm_master_get (file_priv->master); + +unlock: +spin_unlock (&file_priv->master_lookup_lock); +return master; +} +EXPORT_SYMBOL (drm_file_get_master); +static void drm_master_destroy (struct kref *kref) { struct drm_master *master = container_of(kref, struct drm_master, refcount);
drivers/gpu/drm/drm_lease.c +61 -20
214 lines not on this page · raw message
include/drm/drm_auth.h +1 -0
@@ -107,6 +107,7 @@ struct drm_master { };struct drm_master *drm_master_get (struct drm_master *master); +struct drm_master *drm_file_get_master (struct drm_file *file_priv);void drm_master_put (struct drm_master **master);bool drm_is_current_master (struct drm_file *fpriv);
include/drm/drm_file.h +6 -0
@@ -233,6 +233,12 @@ struct drm_file {* this only matches &drm_device.master if the master is the currently * active one. * +* When dereferencing this pointer, either hold struct +* &drm_device.master_mutex for the duration of the pointer's use, or +* use drm_file_get_master() if struct &drm_device.master_mutex is not +* currently held and there is no other need to hold it. This prevents +* @master from being freed during use. +* * See also @authentication and @is_master and the :ref:`section on * primary nodes and authentication <drm_primary_node>`. */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 130/306 rcu: Fix macro name CONFIG_TASKS_RCU_TRACE
In reply to Greg Kroah-HartmanFrom: Zhouyi Zhou <[email protected]>
[ Upstream commit fed31a4dd3adb5455df7c704de2abb639a1dc1c0 ]
This commit fixes several typos where CONFIG_TASKS_RCU_TRACE should instead be CONFIG_TASKS_TRACE_RCU. Among other things, these typos could cause CONFIG_TASKS_TRACE_RCU_READ_MB=y kernels to suffer from memory-ordering bugs that could result in false-positive quiescent states and too-short grace periods.
--- include/linux/rcupdate.h | 2 +- kernel/rcu/tree_plugin.h | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-)
include/linux/rcupdate.h +1 -1
@@ -163,7 +163,7 @@ void synchronize_rcu_tasks(void);# define synchronize_rcu_tasks synchronize_rcu# endif -# ifdef CONFIG_TASKS_RCU_TRACE +# ifdef CONFIG_TASKS_TRACE_RCU # define rcu_tasks_trace_qs (t) \ do { \ if (!likely(READ_ONCE((t)->trc_reader_checked)) && \
kernel/rcu/tree_plugin.h +4 -4
@@ -2591,17 +2591,17 @@ static void noinstr rcu_dynticks_task_exit(void)/* Turn on heavyweight RCU tasks trace readers on idle/user entry. */ static void rcu_dynticks_task_trace_enter (void ) { -#ifdef CONFIG_TASKS_RCU_TRACE +#ifdef CONFIG_TASKS_TRACE_RCU if (IS_ENABLED (CONFIG_TASKS_TRACE_RCU_READ_MB )) current->trc_reader_special.b.need_mb = true; -#endif /* #ifdef CONFIG_TASKS_RCU_TRACE */ +#endif /* #ifdef CONFIG_TASKS_TRACE_RCU */ }/* Turn off heavyweight RCU tasks trace readers on idle/user exit. */ static void rcu_dynticks_task_trace_exit (void ) { -#ifdef CONFIG_TASKS_RCU_TRACE +#ifdef CONFIG_TASKS_TRACE_RCU if (IS_ENABLED (CONFIG_TASKS_TRACE_RCU_READ_MB )) current->trc_reader_special.b.need_mb = false; -#endif /* #ifdef CONFIG_TASKS_RCU_TRACE */ +#endif /* #ifdef CONFIG_TASKS_TRACE_RCU */ }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 131/306 igc: Check if num of q_vectors is smaller than max before array access
In reply to Greg Kroah-HartmanFrom: Sasha Neftin <[email protected]>
[ Upstream commit 373e2829e7c2e1e606503cdb5c97749f512a4be9 ]
Ensure that the adapter->q_vector[MAX_Q_VECTORS] array isn't accessed beyond its size. It was fixed by using a local variable num_q_vectors as a limit for loop index, and ensure that num_q_vectors is not bigger than MAX_Q_VECTORS.
--- drivers/net/ethernet/intel/igc/igc_main.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/igc/igc_main.c +8 -1
@@ -4083,6 +4083,7 @@ static irqreturn_t igc_msix_ring(int irq, void *data)*/ static int igc_request_msix (struct igc_adapter *adapter) { +unsigned int num_q_vectors = adapter->num_q_vectors;int i =0 , err =0 , vector =0 , free_vector =0 ;struct net_device *netdev = adapter->netdev;
@@ -4091,7 +4092,13 @@ static int igc_request_msix(struct igc_adapter *adapter)if (err) goto err_out; -for (i =0 ; i < adapter->num_q_vectors; i++) { +if (num_q_vectors >MAX_Q_VECTORS ) { + num_q_vectors =MAX_Q_VECTORS ; +dev_warn (&adapter->pdev->dev, +"The number of queue vectors (%d) is higher than max allowed (%d)\n" , + adapter->num_q_vectors,MAX_Q_VECTORS ); + } +for (i =0 ; i < num_q_vectors; i++) {struct igc_q_vector *q_vector = adapter->q_vector[i]; vector++;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 132/306 usb: host: fotg210: fix the endpoints transactional opportunities calculation
In reply to Greg Kroah-HartmanFrom: Kelly Devilliv <[email protected]>
[ Upstream commit c2e898764245c852bc8ee4857613ba4f3a6d761d ]
Now that usb_endpoint_maxp() only returns the lowest 11 bits from wMaxPacketSize, we should make use of the usb_endpoint_* helpers instead and remove the unnecessary max_packet()/hb_mult() macro.
--- drivers/usb/host/fotg210-hcd.c | 36 ++++++++++++++++------------------ 1 file changed, 17 insertions(+), 19 deletions(-)
drivers/usb/host/fotg210-hcd.c +17 -19
@@ -2509,11 +2509,6 @@ static unsigned qh_completions(struct fotg210_hcd *fotg210,return count; } -/* high bandwidth multiplier, as encoded in highspeed endpoint descriptors */ -#define hb_mult (wMaxPacketSize) (1 + (((wMaxPacketSize) >> 11) & 0x03)) -/* ... and packet size, for any kind of endpoint descriptor */ -#define max_packet (wMaxPacketSize) ((wMaxPacketSize) & 0x07ff) -/* reverse of qh_urb_transaction: free a list of TDs. * used for cleanup after errors, before HC sees an URB's TDs. */
@@ -2599,7 +2594,7 @@ static struct list_head *qh_urb_transaction(struct fotg210_hcd *fotg210, token |= (1 /* "in" */ <<8 );/* else it's already initted to "out" pid (0 << 8) */ - maxpacket =max_packet (usb_maxpacket (urb->dev, urb->pipe, !is_input)); + maxpacket =usb_maxpacket (urb->dev, urb->pipe, !is_input);/* * buffer gets wrapped in one or more qtds;
@@ -2713,9 +2708,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, gfp_t flags) {struct fotg210_qh *qh =fotg210_qh_alloc (fotg210, flags); +struct usb_host_endpoint *ep;u32 info1 =0 , info2 =0 ;int is_input, type;int maxp =0 ; +int mult;struct usb_tt *tt = urb->dev->tt;struct fotg210_qh_hw *hw;
@@ -2730,14 +2727,15 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, is_input =usb_pipein (urb->pipe); type =usb_pipetype (urb->pipe); - maxp =usb_maxpacket (urb->dev, urb->pipe, !is_input); + ep =usb_pipe_endpoint (urb->dev, urb->pipe); + maxp =usb_endpoint_maxp (&ep->desc); + mult =usb_endpoint_maxp_mult (&ep->desc);/* 1024 byte maxpacket is a hardware ceiling. High bandwidth * acts like up to 3KB, but is built from smaller packets. */ -if (max_packet (maxp) >1024 ) { -fotg210_dbg (fotg210,"bogus qh maxpacket %d\n" , -max_packet (maxp)); +if (maxp >1024 ) { +fotg210_dbg (fotg210,"bogus qh maxpacket %d\n" , maxp); goto done; }
@@ -2751,8 +2749,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,*/ if (type ==PIPE_INTERRUPT ) { qh->usecs =NS_TO_US (usb_calc_bus_time (USB_SPEED_HIGH , - is_input,0 , -hb_mult (maxp) *max_packet (maxp))); + is_input,0 , mult * maxp)); qh->start =NO_FRAME ;if (urb->dev->speed ==USB_SPEED_HIGH ) {
@@ -2789,7 +2786,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, think_time = tt ? tt->think_time :0 ; qh->tt_usecs =NS_TO_US (think_time +usb_calc_bus_time (urb->dev->speed, - is_input,0 ,max_packet (maxp))); + is_input,0 , maxp)); qh->period = urb->interval;if (qh->period > fotg210->periodic_size) { qh->period = fotg210->periodic_size;
@@ -2852,11 +2849,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,* to help them do so. So now people expect to use * such nonconformant devices with Linux too; sigh. */ - info1 |=max_packet (maxp) <<16 ; + info1 |= maxp <<16 ; info2 |= (FOTG210_TUNE_MULT_HS <<30 ); }else {/* PIPE_INTERRUPT */ - info1 |=max_packet (maxp) <<16 ; - info2 |=hb_mult (maxp) <<30 ; + info1 |= maxp <<16 ; + info2 |= mult <<30 ; }break ;default :
@@ -3926,6 +3923,7 @@ static void iso_stream_init(struct fotg210_hcd *fotg210,int is_input;long bandwidth;unsigned multi; +struct usb_host_endpoint *ep;/* * this might be a "high bandwidth" highspeed endpoint,
@@ -3933,14 +3931,14 @@ static void iso_stream_init(struct fotg210_hcd *fotg210,*/ epnum =usb_pipeendpoint (pipe); is_input =usb_pipein (pipe) ?USB_DIR_IN :0 ; - maxp =usb_maxpacket (dev, pipe, !is_input); + ep =usb_pipe_endpoint (dev, pipe); + maxp =usb_endpoint_maxp (&ep->desc);if (is_input) buf1 = (1 <<11 );else buf1 =0 ; - maxp =max_packet (maxp); - multi =hb_mult (maxp); + multi =usb_endpoint_maxp_mult (&ep->desc); buf1 |= maxp; maxp *= multi;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 133/306 usb: host: fotg210: fix the actual_length of an iso packet
In reply to Greg Kroah-HartmanFrom: Kelly Devilliv <[email protected]>
[ Upstream commit 091cb2f782f32ab68c6f5f326d7868683d3d4875 ]
We should acquire the actual_length of an iso packet from the iTD directly using FOTG210_ITD_LENGTH() macro.
--- drivers/usb/host/fotg210-hcd.c | 5 ++--- drivers/usb/host/fotg210.h | 5 ----- 2 files changed, 2 insertions(+), 8 deletions(-)
drivers/usb/host/fotg210-hcd.c +2 -3
@@ -4459,13 +4459,12 @@ static bool itd_complete(struct fotg210_hcd *fotg210, struct fotg210_itd *itd)/* HC need not update length with this error */ if (!(t &FOTG210_ISOC_BABBLE )) { - desc->actual_length = -fotg210_itdlen (urb, desc, t); + desc->actual_length =FOTG210_ITD_LENGTH (t); urb->actual_length += desc->actual_length; } }else if (likely ((t &FOTG210_ISOC_ACTIVE ) ==0 )) { desc->status =0 ; - desc->actual_length =fotg210_itdlen (urb, desc, t); + desc->actual_length =FOTG210_ITD_LENGTH (t); urb->actual_length += desc->actual_length; }else {/* URB was too late */
drivers/usb/host/fotg210.h +0 -5
@@ -686,11 +686,6 @@ static inline unsigned fotg210_read_frame_index(struct fotg210_hcd *fotg210) return fotg210_readl(fotg210, &fotg210->regs->frame_index); } -#define fotg210_itdlen (urb, desc, t) ({ \ - usb_pipein((urb)->pipe) ? \ - (desc)->length - FOTG210_ITD_LENGTH(t) : \ - FOTG210_ITD_LENGTH(t); \ -})/*-------------------------------------------------------------------------*/ #endif /* __LINUX_FOTG210_H */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 134/306 usb: gadget: u_ether: fix a potential null pointer dereference
In reply to Greg Kroah-HartmanFrom: Maciej Żenczykowski <[email protected]>
[ Upstream commit 8ae01239609b29ec2eff55967c8e0fe3650cfa09 ]
f_ncm tx timeout can call us with null skb to flush a pending frame. In this case skb is NULL to begin with but ceases to be null after dev->wrap() completes.
In such a case in->maxpacket will be read, even though we've failed to check that 'in' is not NULL.
Though I've never observed this fail in practice, however the 'flush operation' simply does not make sense with a null usb IN endpoint - there's nowhere to flush to... (note that we're the gadget/device, and IN is from the point
of view of the host, so here IN actually means outbound...)
--- drivers/usb/gadget/function/u_ether.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/u_ether.c +3 -2
@@ -491,8 +491,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, }spin_unlock_irqrestore (&dev->lock, flags); -if (skb && !in) { -dev_kfree_skb_any (skb); +if (!in) { +if (skb) +dev_kfree_skb_any (skb);return NETDEV_TX_OK ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 135/306 USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable()
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit 61136a12cbed234374ec6f588af57c580b20b772 ]
mv_ehci_enable() did not disable and unprepare clocks in case of failures of phy_init(). Besides, it did not take into account failures of ehci_clock_enable() (in effect, failures of clk_prepare_enable()). The patch fixes both issues and gets rid of redundant wrappers around clk_prepare_enable() and clk_disable_unprepare() to simplify this a bit.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/usb/host/ehci-mv.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-)
drivers/usb/host/ehci-mv.c +11 -12
@@ -42,26 +42,25 @@ struct ehci_hcd_mv {int (*set_vbus)(unsigned int vbus); }; -static void ehci_clock_enable (struct ehci_hcd_mv *ehci_mv) +static int mv_ehci_enable (struct ehci_hcd_mv *ehci_mv) { -clk_prepare_enable (ehci_mv->clk); -} +int retval; -static void ehci_clock_disable (struct ehci_hcd_mv *ehci_mv) -{ -clk_disable_unprepare (ehci_mv->clk); -} + retval =clk_prepare_enable (ehci_mv->clk); +if (retval) +return retval; -static int mv_ehci_enable (struct ehci_hcd_mv *ehci_mv) -{ -ehci_clock_enable (ehci_mv); -return phy_init (ehci_mv->phy); + retval =phy_init (ehci_mv->phy); +if (retval) +clk_disable_unprepare (ehci_mv->clk); + +return retval; }static void mv_ehci_disable (struct ehci_hcd_mv *ehci_mv) {phy_exit (ehci_mv->phy); -ehci_clock_disable (ehci_mv); +clk_disable_unprepare (ehci_mv->clk); }static int mv_ehci_reset (struct usb_hcd *hcd)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 136/306 usb: gadget: composite: Allow bMaxPower=0 if self-powered
In reply to Greg Kroah-HartmanFrom: Jack Pham <[email protected]>
[ Upstream commit bcacbf06c891374e7fdd7b72d11cda03b0269b43 ]
Currently the composite driver encodes the MaxPower field of the configuration descriptor by reading the c->MaxPower of the usb_configuration only if it is non-zero, otherwise it falls back to using the value hard-coded in CONFIG_USB_GADGET_VBUS_DRAW. However, there are cases when a configuration must explicitly set bMaxPower to 0, particularly if its bmAttributes also has the Self-Powered bit set, which is a valid combination.
This is specifically called out in the USB PD specification section 9.1, in which a PDUSB device "shall report zero in the bMaxPower field after negotiating a mutually agreeable Contract", and also verified by the USB Type-C Functional Test TD.4.10.2 Sink Power Precedence Test.
The fix allows the c->MaxPower to be used for encoding the bMaxPower even if it is 0, if the self-powered bit is also set. An example usage of this would be for a ConfigFS gadget to be dynamically updated by userspace when the Type-C connection is determined to be operating in Power Delivery mode.
--- drivers/usb/gadget/composite.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/usb/gadget/composite.c +6 -2
@@ -481,7 +481,7 @@ static u8 encode_bMaxPower(enum usb_device_speed speed, {unsigned val; -if (c->MaxPower) +if (c->MaxPower || (c->bmAttributes &USB_CONFIG_ATT_SELFPOWER )) val = c->MaxPower;else val =CONFIG_USB_GADGET_VBUS_DRAW ;
@@ -905,7 +905,11 @@ static int set_config(struct usb_composite_dev *cdev, }/* when we return, be sure our power usage is valid */ - power = c->MaxPower ? c->MaxPower :CONFIG_USB_GADGET_VBUS_DRAW ; +if (c->MaxPower || (c->bmAttributes &USB_CONFIG_ATT_SELFPOWER )) + power = c->MaxPower; +else + power =CONFIG_USB_GADGET_VBUS_DRAW ; +if (gadget->speed <USB_SPEED_SUPER ) power =min (power,500U );else
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 137/306 staging: board: Fix uninitialized spinlock when attaching genpd
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit df00609821bf17f50a75a446266d19adb8339d84 ]
On Armadillo-800-EVA with CONFIG_DEBUG_SPINLOCK=y:
BUG: spinlock bad magic on CPU#0, swapper/1
lock: lcdc0_device+0x10c/0x308, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
CPU: 0 PID: 1 Comm: swapper Not tainted 5.11.0-rc5-armadillo-00036-gbbca04be7a80-dirty #287
Hardware name: Generic R8A7740 (Flattened Device Tree)
[<c010c3c8>] (unwind_backtrace) from [<c010a49c>] (show_stack+0x10/0x14)
[<c010a49c>] (show_stack) from [<c0159534>] (do_raw_spin_lock+0x20/0x94)
[<c0159534>] (do_raw_spin_lock) from [<c040858c>] (dev_pm_get_subsys_data+0x8c/0x11c)
[<c040858c>] (dev_pm_get_subsys_data) from [<c05fbcac>] (genpd_add_device+0x78/0x2b8)
[<c05fbcac>] (genpd_add_device) from [<c0412db4>] (of_genpd_add_device+0x34/0x4c)
[<c0412db4>] (of_genpd_add_device) from [<c0a1ea74>] (board_staging_register_device+0x11c/0x148)
[<c0a1ea74>] (board_staging_register_device) from [<c0a1eac4>] (board_staging_register_devices+0x24/0x28)of_genpd_add_device() is called before platform_device_register(), as it needs to attach the genpd before the device is probed. But the spinlock is only initialized when the device is registered.
Fix this by open-coding the spinlock initialization, cfr. device_pm_init_common() in the internal drivers/base code, and in the SuperH early platform code.
--- drivers/staging/board/board.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/staging/board/board.c +6 -1
@@ -136,6 +136,7 @@ int __init board_staging_register_clock(const struct board_staging_clk *bsc)static int board_staging_add_dev_domain (struct platform_device *pdev,const char *domain) { +struct device *dev = &pdev->dev;struct of_phandle_args pd_args;struct device_node *np;
@@ -148,7 +149,11 @@ static int board_staging_add_dev_domain(struct platform_device *pdev, pd_args.np = np; pd_args.args_count =0 ; -return of_genpd_add_device (&pd_args, &pdev->dev); +/* Initialization similar to device_pm_init_common() */ +spin_lock_init (&dev->power.lock); + dev->power.early_init = true; + +return of_genpd_add_device (&pd_args, dev); }#else static inline int board_staging_add_dev_domain(struct platform_device *pdev,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 138/306 tty: serial: jsm: hold port lock when reporting modem line changes
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 240e126c28df084222f0b661321e8e3ecb0d232e ]
uart_handle_dcd_change() requires a port lock to be held and will emit a warning when lockdep is enabled.
Held corresponding lock to fix the following warnings.
[ 132.528648] WARNING: CPU: 5 PID: 11600 at drivers/tty/serial/serial_core.c:3046 uart_handle_dcd_change+0xf4/0x120 [ 132.530482] Modules linked in: [ 132.531050] CPU: 5 PID: 11600 Comm: jsm Not tainted 5.14.0-rc1-00003-g7fef2edf7cc7-dirty #31 [ 132.535268] RIP: 0010:uart_handle_dcd_change+0xf4/0x120 [ 132.557100] Call Trace: [ 132.557562] ? __free_pages+0x83/0xb0 [ 132.558213] neo_parse_modem+0x156/0x220 [ 132.558897] neo_param+0x399/0x840 [ 132.559495] jsm_tty_open+0x12f/0x2d0 [ 132.560131] uart_startup.part.18+0x153/0x340 [ 132.560888] ? lock_is_held_type+0xe9/0x140 [ 132.561660] uart_port_activate+0x7f/0xe0 [ 132.562351] ? uart_startup.part.18+0x340/0x340 [ 132.563003] tty_port_open+0x8d/0xf0 [ 132.563523] ? uart_set_options+0x1e0/0x1e0 [ 132.564125] uart_open+0x24/0x40 [ 132.564604] tty_open+0x15c/0x630
--- drivers/tty/serial/jsm/jsm_neo.c | 2 ++ drivers/tty/serial/jsm/jsm_tty.c | 3 +++ 2 files changed, 5 insertions(+)
drivers/tty/serial/jsm/jsm_neo.c +2 -0
@@ -815,7 +815,9 @@ static void neo_parse_isr(struct jsm_board *brd, u32 port)/* Parse any modem signal changes */ jsm_dbg (INTR , &ch->ch_bd->pci_dev,"MOD_STAT: sending to parse_modem_sigs\n" ); +spin_lock_irqsave (&ch->uart_port.lock, lock_flags);neo_parse_modem (ch,readb (&ch->ch_neo_uart->msr)); +spin_unlock_irqrestore (&ch->uart_port.lock, lock_flags); } }
drivers/tty/serial/jsm/jsm_tty.c +3 -0
@@ -187,6 +187,7 @@ static void jsm_tty_break(struct uart_port *port, int break_state)static int jsm_tty_open (struct uart_port *port) { +unsigned long lock_flags;struct jsm_board *brd;struct jsm_channel *channel = container_of(port, struct jsm_channel, uart_port);
@@ -240,6 +241,7 @@ static int jsm_tty_open(struct uart_port *port) channel->ch_cached_lsr =0 ; channel->ch_stops_sent =0 ; +spin_lock_irqsave (&port->lock, lock_flags); termios = &port->state->port.tty->termios; channel->ch_c_cflag = termios->c_cflag; channel->ch_c_iflag = termios->c_iflag;
@@ -259,6 +261,7 @@ static int jsm_tty_open(struct uart_port *port)jsm_carrier (channel); channel->ch_open_count++; +spin_unlock_irqrestore (&port->lock, lock_flags);jsm_dbg (OPEN , &channel->ch_bd->pci_dev,"finish\n" );return 0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 139/306 bus: fsl-mc: fix mmio base address for child DPRCs
In reply to Greg Kroah-HartmanFrom: Laurentiu Tudor <[email protected]>
[ Upstream commit 8990f96a012f42543005b07d9e482694192e9309 ]
Some versions of the MC firmware wrongly report 0 for register base address of the DPMCP associated with child DPRC objects thus rendering them unusable. This is particularly troublesome in ACPI boot scenarios where the legacy way of extracting this base address from the device tree does not apply.
Given that DPMCPs share the same base address, workaround this by using the base address extracted from the root DPRC container.
--- drivers/bus/fsl-mc/fsl-mc-bus.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
drivers/bus/fsl-mc/fsl-mc-bus.c +22 -2
@@ -64,6 +64,8 @@ struct fsl_mc_addr_translation_range {#define MC_FAPR_PL BIT(18)#define MC_FAPR_BMT BIT(17) +static phys_addr_t mc_portal_base_phys_addr; +/** * fsl_mc_bus_match - device to driver matching callback * @dev: the fsl-mc device to match against
@@ -597,14 +599,30 @@ static int fsl_mc_device_get_mmio_regions(struct fsl_mc_device *mc_dev,* If base address is in the region_desc use it otherwise * revert to old mechanism */ -if (region_desc.base_address) +if (region_desc.base_address) { regions[i].start = region_desc.base_address + region_desc.base_offset; -else + }else { error =translate_mc_addr (mc_dev, mc_region_type, region_desc.base_offset, ®ions[i].start); +/* +* Some versions of the MC firmware wrongly report +* 0 for register base address of the DPMCP associated +* with child DPRC objects thus rendering them unusable. +* This is particularly troublesome in ACPI boot +* scenarios where the legacy way of extracting this +* base address from the device tree does not apply. +* Given that DPMCPs share the same base address, +* workaround this by using the base address extracted +* from the root DPRC container. +*/ +if (is_fsl_mc_bus_dprc (mc_dev) && + regions[i].start == region_desc.base_offset) + regions[i].start += mc_portal_base_phys_addr; + } +if (error <0 ) { dev_err(parent_dev, "Invalid MC offset: %#x (for %s.%d\'s region %d)\n",
@@ -996,6 +1014,8 @@ static int fsl_mc_bus_probe(struct platform_device *pdev) plat_res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); mc_portal_phys_addr = plat_res->start; mc_portal_size =resource_size (plat_res); + mc_portal_base_phys_addr = mc_portal_phys_addr & ~0x3ffffff ; + error =fsl_create_mc_io (&pdev->dev, mc_portal_phys_addr, mc_portal_size,NULL ,FSL_MC_IO_ATOMIC_CONTEXT_PORTAL , &mc_io);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 140/306 selftests: firmware: Fix ignored return val of asprintf() warn
In reply to Greg Kroah-HartmanFrom: Shuah Khan <[email protected]>
[ Upstream commit fe968ca2cac91888310b143a483123c84906e3fc ]
Fix the following ingonred return val of asprintf() warn during build:
cc -Wall -O2 fw_namespace.c -o ../tools/testing/selftests/firmware/fw_namespacefw_namespace.c: In function ‘main’:
fw_namespace.c:132:2: warning: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
132 | asprintf(&fw_path, "/lib/firmware/%s", fw_name);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~--- tools/testing/selftests/firmware/fw_namespace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/firmware/fw_namespace.c +2 -1
@@ -129,7 +129,8 @@ int main(int argc, char **argv)die ("mounting tmpfs to /lib/firmware failed\n" ); sys_path = argv[1 ]; -asprintf (&fw_path,"/lib/firmware/%s" , fw_name); +if (asprintf (&fw_path,"/lib/firmware/%s" , fw_name) <0 ) +die ("error: failed to build full fw_path\n" );setup_fw (fw_path);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 141/306 drm/amd/display: Fix timer_per_pixel unit error
In reply to Greg Kroah-HartmanFrom: Oliver Logush <[email protected]>
[ Upstream commit 23e55639b87fb16a9f0f66032ecb57060df6c46c ]
[why]
The units of the time_per_pixel variable were incorrect, this had to be changed for the code to properly function.
[how]
The change was very straightforward, only required one line of code to be changed where the calculation was done.
--- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +1 -1
@@ -2455,7 +2455,7 @@ void dcn20_set_mcif_arb_params( wb_arb_params->cli_watermark[k] =get_wm_writeback_urgent (&context->bw_ctx.dml, pipes, pipe_cnt) *1000 ; wb_arb_params->pstate_watermark[k] =get_wm_writeback_dram_clock_change (&context->bw_ctx.dml, pipes, pipe_cnt) *1000 ; } - wb_arb_params->time_per_pixel =16.0 / context->res_ctx.pipe_ctx[i].stream->phy_pix_clk;/* 4 bit fraction, ms */ + wb_arb_params->time_per_pixel =16.0 *1000 / (context->res_ctx.pipe_ctx[i].stream->phy_pix_clk /1000 );/* 4 bit fraction, ms */ wb_arb_params->slice_lines =32 ; wb_arb_params->arbitration_slice =2 ; wb_arb_params->max_scaled_time = dcn20_calc_max_scaled_time(wb_arb_params->time_per_pixel,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 142/306 media: hantro: vp8: Move noisy WARN_ON to vpu_debug
In reply to Greg Kroah-HartmanFrom: Ezequiel Garcia <[email protected]>
[ Upstream commit 6ad61a7847da09b6261824accb539d05bcdfef65 ]
When the VP8 decoders can't find a reference frame, the driver falls back to the current output frame.
This will probably produce some undesirable results, leading to frame corruption, but shouldn't cause noisy warnings.
--- drivers/staging/media/hantro/hantro_g1_vp8_dec.c | 13 ++++++++++--- .../staging/media/hantro/rk3399_vpu_hw_vp8_dec.c | 13 ++++++++++--- 2 files changed, 20 insertions(+), 6 deletions(-)
drivers/staging/media/hantro/hantro_g1_vp8_dec.c +10 -3
@@ -377,12 +377,17 @@ static void cfg_ref(struct hantro_ctx *ctx, vb2_dst =hantro_get_dst_buf (ctx); ref =hantro_get_ref (ctx, hdr->last_frame_ts); -if (!ref) +if (!ref) { +vpu_debug (0 ,"failed to find last frame ts=%llu\n" , + hdr->last_frame_ts); ref =vb2_dma_contig_plane_dma_addr (&vb2_dst->vb2_buf,0 ); + }vdpu_write_relaxed (vpu, ref,G1_REG_ADDR_REF (0 )); ref =hantro_get_ref (ctx, hdr->golden_frame_ts); -WARN_ON (!ref && hdr->golden_frame_ts); +if (!ref && hdr->golden_frame_ts) +vpu_debug (0 ,"failed to find golden frame ts=%llu\n" , + hdr->golden_frame_ts);if (!ref) ref =vb2_dma_contig_plane_dma_addr (&vb2_dst->vb2_buf,0 );if (hdr->flags &V4L2_VP8_FRAME_HEADER_FLAG_SIGN_BIAS_GOLDEN )
@@ -390,7 +395,9 @@ static void cfg_ref(struct hantro_ctx *ctx,vdpu_write_relaxed (vpu, ref,G1_REG_ADDR_REF (4 )); ref =hantro_get_ref (ctx, hdr->alt_frame_ts); -WARN_ON (!ref && hdr->alt_frame_ts); +if (!ref && hdr->alt_frame_ts) +vpu_debug (0 ,"failed to find alt frame ts=%llu\n" , + hdr->alt_frame_ts);if (!ref) ref =vb2_dma_contig_plane_dma_addr (&vb2_dst->vb2_buf,0 );if (hdr->flags &V4L2_VP8_FRAME_HEADER_FLAG_SIGN_BIAS_ALT )
drivers/staging/media/hantro/rk3399_vpu_hw_vp8_dec.c +10 -3
@@ -454,12 +454,17 @@ static void cfg_ref(struct hantro_ctx *ctx, vb2_dst =hantro_get_dst_buf (ctx); ref =hantro_get_ref (ctx, hdr->last_frame_ts); -if (!ref) +if (!ref) { +vpu_debug (0 ,"failed to find last frame ts=%llu\n" , + hdr->last_frame_ts); ref =vb2_dma_contig_plane_dma_addr (&vb2_dst->vb2_buf,0 ); + }vdpu_write_relaxed (vpu, ref,VDPU_REG_VP8_ADDR_REF0 ); ref =hantro_get_ref (ctx, hdr->golden_frame_ts); -WARN_ON (!ref && hdr->golden_frame_ts); +if (!ref && hdr->golden_frame_ts) +vpu_debug (0 ,"failed to find golden frame ts=%llu\n" , + hdr->golden_frame_ts);if (!ref) ref =vb2_dma_contig_plane_dma_addr (&vb2_dst->vb2_buf,0 );if (hdr->flags &V4L2_VP8_FRAME_HEADER_FLAG_SIGN_BIAS_GOLDEN )
@@ -467,7 +472,9 @@ static void cfg_ref(struct hantro_ctx *ctx,vdpu_write_relaxed (vpu, ref,VDPU_REG_VP8_ADDR_REF2_5 (2 )); ref =hantro_get_ref (ctx, hdr->alt_frame_ts); -WARN_ON (!ref && hdr->alt_frame_ts); +if (!ref && hdr->alt_frame_ts) +vpu_debug (0 ,"failed to find alt frame ts=%llu\n" , + hdr->alt_frame_ts);if (!ref) ref =vb2_dma_contig_plane_dma_addr (&vb2_dst->vb2_buf,0 );if (hdr->flags &V4L2_VP8_FRAME_HEADER_FLAG_SIGN_BIAS_ALT )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 143/306 media: platform: stm32: unprepare clocks at handling errors in probe
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit 055d2db28ec2fa3ab5c527c5604f1b32b89fa13a ]
stm32_cec_probe() did not unprepare clocks on error handling paths. The patch fixes that.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/media/cec/platform/stm32/stm32-cec.c | 26 ++++++++++++++------ 1 file changed, 18 insertions(+), 8 deletions(-)
drivers/media/cec/platform/stm32/stm32-cec.c +18 -8
@@ -305,14 +305,16 @@ static int stm32_cec_probe(struct platform_device *pdev) cec->clk_hdmi_cec =devm_clk_get (&pdev->dev,"hdmi-cec" );if (IS_ERR (cec->clk_hdmi_cec) && -PTR_ERR (cec->clk_hdmi_cec) == -EPROBE_DEFER ) -return -EPROBE_DEFER ; +PTR_ERR (cec->clk_hdmi_cec) == -EPROBE_DEFER ) { + ret = -EPROBE_DEFER ; + goto err_unprepare_cec_clk; + }if (!IS_ERR (cec->clk_hdmi_cec)) { ret =clk_prepare (cec->clk_hdmi_cec);if (ret) {dev_err (&pdev->dev,"Can't prepare hdmi-cec clock\n" ); -return ret; + goto err_unprepare_cec_clk; } }
@@ -324,19 +326,27 @@ static int stm32_cec_probe(struct platform_device *pdev) CEC_NAME, caps, CEC_MAX_LOG_ADDRS); ret =PTR_ERR_OR_ZERO (cec->adap);if (ret) -return ret; + goto err_unprepare_hdmi_cec_clk; ret =cec_register_adapter (cec->adap, &pdev->dev); -if (ret) { -cec_delete_adapter (cec->adap); -return ret; - } +if (ret) + goto err_delete_adapter;cec_hw_init (cec);platform_set_drvdata (pdev, cec);return 0 ; + +err_delete_adapter: +cec_delete_adapter (cec->adap); + +err_unprepare_hdmi_cec_clk: +clk_unprepare (cec->clk_hdmi_cec); + +err_unprepare_cec_clk: +clk_unprepare (cec->clk_cec); +return ret; }static int stm32_cec_remove (struct platform_device *pdev)
Signature · 1 line
2.30.2