5.14.12-rc1 review
Subsystems (9)
Greg Kroah-Hartman
maintainercover 5.14.12-rc1 review
This is the start of the stable review cycle for the 5.14.12 release. There are 151 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 13 Oct 2021 13:44:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.12-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.14.12-rc1
Andrew Lunn <[email protected]>
dsa: tag_dsa: Fix mask for trunked packets
Thomas Gleixner <[email protected]>
x86/hpet: Use another crystalball to evaluate HPET usability
Vegard Nossum <[email protected]>
x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n
Lukas Bulwahn <[email protected]>
x86/entry: Correct reference to intended CONFIG_64_BIT
Borislav Petkov <[email protected]>
x86/fpu: Restore the masking out of reserved MXCSR bits
Tom Lendacky <[email protected]>
x86/sev: Return an error on a returned non-zero SW_EXITINFO1[31:0]
Lukas Bulwahn <[email protected]>
x86/Kconfig: Correct reference to MWINCHIP3D
Lukas Bulwahn <[email protected]>
x86/platform/olpc: Correct ifdef symbol to intended CONFIG_OLPC_XO15_SCI
Mahesh Salgaonkar <[email protected]>
pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init
Christophe Leroy <[email protected]>
powerpc/32s: Fix kuap_kernel_restore()
Nicholas Piggin <[email protected]>
powerpc/64s: Fix unrecoverable MCE calling async handler from NMI
Nicholas Piggin <[email protected]>
powerpc/traps: do not enable irqs in _exception
Nicholas Piggin <[email protected]>
powerpc/64s: fix program check interrupt emergency stack path
Naveen N. Rao <[email protected]>
powerpc/bpf ppc32: Fix BPF_SUB when imm == 0x80000000
Naveen N. Rao <[email protected]>
powerpc/bpf ppc32: Do not emit zero extend instruction for 64-bit BPF_END
Naveen N. Rao <[email protected]>
powerpc/bpf ppc32: Fix JMP32_JSET_K
Naveen N. Rao <[email protected]>
powerpc/bpf ppc32: Fix ALU32 BPF_ARSH operation
Naveen N. Rao <[email protected]>
powerpc/bpf: Fix BPF_SUB when imm == 0x80000000
Naveen N. Rao <[email protected]>
powerpc/bpf: Fix BPF_MOD when imm == 1
Joe Lawrence <[email protected]>
objtool: Make .altinstructions section entry size consistent
Josh Poimboeuf <[email protected]>
objtool: Remove reloc symbol type checks in get_alt_entry()
Mike Christie <[email protected]>
scsi: iscsi: Fix iscsi_task use after free
Palmer Dabbelt <[email protected]>
RISC-V: Include clone3() on rv32
Vadim Pasternak <[email protected]>
i2c: mlxcpld: Modify register setting for 400KHz frequency
Vadim Pasternak <[email protected]>
i2c: mlxcpld: Fix criteria for frequency setting
Tiezhu Yang <[email protected]>
bpf, s390: Fix potential memory leak about jit_data
Tong Tiangen <[email protected]>
riscv/vdso: make arch_setup_additional_pages wait for mmap_sem for write killable
Tong Tiangen <[email protected]>
riscv/vdso: Move vdso data page up front
Tong Tiangen <[email protected]>
riscv/vdso: Refactor asm/vdso.h
Palmer Dabbelt <[email protected]>
RISC-V: Fix VDSO build for !MMU
Saleem Abdulrasool <[email protected]>
riscv: explicitly use symbol offsets for VDSO
Kewei Xu <[email protected]>
i2c: mediatek: Add OFFSET_EXT_CONF setting back
Jamie Iles <[email protected]>
i2c: acpi: fix resource leak in reconfiguration device addition
Alexey Kardashevskiy <[email protected]>
powerpc/iommu: Report the correct most efficient DMA mask for PCI devices
Mike Manning <[email protected]>
net: prefer socket bound to interface when not in VRF
Stefan Assmann <[email protected]>
iavf: fix double unlock of crit_lock
Sylwester Dziedziuch <[email protected]>
i40e: Fix freeing of uninitialized misc IRQ vector
Jiri Benc <[email protected]>
i40e: fix endless loop under rtnl
Eric Dumazet <[email protected]>
gve: report 64bit tx_bytes counter from gve_handle_report_stats()
Eric Dumazet <[email protected]>
gve: fix gve_get_stats()
Eric Dumazet <[email protected]>
rtnetlink: fix if_nlmsg_stats_size() under estimation
Catherine Sullivan <[email protected]>
gve: Properly handle errors in gve_assign_qpl
Tao Liu <[email protected]>
gve: Avoid freeing NULL pointer
Catherine Sullivan <[email protected]>
gve: Correct available tx qpl check
Wong Vee Khee <[email protected]>
net: stmmac: trigger PCS EEE to turn off on link down
Wong Vee Khee <[email protected]>
net: pcs: xpcs: fix incorrect steps on disable EEE
Yang Yingliang <[email protected]>
drm/nouveau/debugfs: fix file release memory leak
Yang Yingliang <[email protected]>
drm/nouveau/kms/nv50-: fix file release memory leak
Jeremy Cline <[email protected]>
drm/nouveau: avoid a use-after-free when BO init fails
Mark Brown <[email protected]>
video: fbdev: gbefb: Only instantiate device when built for IP32
Christophe Branchereau <[email protected]>
drm/panel: abt-y030xx067a: yellow tint fix
Ben Skeggs <[email protected]>
drm/nouveau/fifo/ga102: initialise chid on return from channel creation
Jernej Skrabec <[email protected]>
drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup
Tony Lindgren <[email protected]>
bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
Like Xu <[email protected]>
perf jevents: Free the sys_event_tables list after processing entries
Guchun Chen <[email protected]>
drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
Lang Yu <[email protected]>
drm/amdkfd: fix a potential ttm->sg memory leak
Linus Walleij <[email protected]>
ARM: defconfig: gemini: Restore framebuffer
Eric Dumazet <[email protected]>
netlink: annotate data races around nlk->bound
Wong Vee Khee <[email protected]>
net: pcs: xpcs: fix incorrect CL37 AN sequence
Sean Anderson <[email protected]>
net: sfp: Fix typo in state machine debug string
Eric Dumazet <[email protected]>
net/sched: sch_taprio: properly cancel timer from taprio_destroy()
Eric Dumazet <[email protected]>
net: bridge: fix under estimation in br_get_linkxstats_size()
Eric Dumazet <[email protected]>
net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size()
David Howells <[email protected]>
afs: Fix afs_launder_page() to set correct start file position
David Howells <[email protected]>
netfs: Fix READ/WRITE confusion when calling iov_iter_xarray()
Lukasz Majczak <[email protected]>
drm/i915/bdb: Fix version check
Imre Deak <[email protected]>
drm/i915/tc: Fix TypeC port init/resume time sanitization
Tejas Upadhyay <[email protected]>
drm/i915/jsl: Add W/A 1409054076 for JSL
Kai-Heng Feng <[email protected]>
drm/i915/audio: Use BIOS provided value for RKL HDA link
Oleksij Rempel <[email protected]>
ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence
Geert Uytterhoeven <[email protected]>
dt-bindings: drm/bridge: ti-sn65dsi86: Fix reg value
Michael Walle <[email protected]>
arm64: dts: ls1028a: fix eSDHC2 node
Heiko Thiery <[email protected]>
arm64: dts: imx8mm-kontron-n801x-som: do not allow to switch off buck2
Haibo Chen <[email protected]>
arm64: dts: imx8: change the spi-nor tx
Haibo Chen <[email protected]>
ARM: dts: imx: change the spi-nor tx
Andy Shevchenko <[email protected]>
ptp_pch: Load module automatically if ID matches
Pali Rohár <[email protected]>
powerpc/fsl/dts: Fix phy-connection-type for fm1mac3
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: honor NLM_F_CREATE and NLM_F_EXCL in event notification
Ilya Lipnitskiy <[email protected]>
MIPS: Revert "add support for buggy MT7621S core detection"
Punit Agrawal <[email protected]>
net: stmmac: dwmac-rk: Fix ethernet on rk3399 based devices
Vladimir Oltean <[email protected]>
net: mscc: ocelot: fix VCAP filters remaining active after being deleted
Eric Dumazet <[email protected]>
net_sched: fix NULL deref in fifo_set_limit()
Andrii Nakryiko <[email protected]>
libbpf: Fix memory leak in strset
Pavel Skripkin <[email protected]>
phy: mdio: fix memory leak
Kumar Kartikeya Dwivedi <[email protected]>
libbpf: Fix segfault in light skeleton for objects without BTF
Lama Kayal <[email protected]>
net/mlx5e: Fix the presented RQ index in PTP stats
Shay Drory <[email protected]>
net/mlx5: Fix setting number of EQs of SFs
Shay Drory <[email protected]>
net/mlx5: Fix length of irq_index in chars
Aya Levin <[email protected]>
net/mlx5: Avoid generating event after PPS out in Real time mode
Aya Levin <[email protected]>
net/mlx5: Force round second at 1PPS out start time
Moshe Shemesh <[email protected]>
net/mlx5: E-Switch, Fix double allocation of acl flow counter
Tariq Toukan <[email protected]>
net/mlx5e: Keep the value for maximum number of channels in-sync
Raed Salem <[email protected]>
net/mlx5e: IPSEC RX, enable checksum complete
Tatsuhiko Yasumatsu <[email protected]>
bpf: Fix integer overflow in prealloc_elems_and_freelist()
Tony Lindgren <[email protected]>
soc: ti: omap-prm: Fix external abort for am335x pruss
Johan Almbladh <[email protected]>
bpf, arm: Fix register clobbering in div/mod implementation
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reverse order in rule replacement expansion
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: add position handle in event notification
Florian Westphal <[email protected]>
netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1
Vladimir Zapolskiy <[email protected]>
iwlwifi: pcie: add configuration of a Wi-Fi adapter on Dell XPS 15
Max Filippov <[email protected]>
xtensa: call irqchip_init only when CONFIG_USE_OF is selected
Randy Dunlap <[email protected]>
xtensa: use CONFIG_USE_OF instead of CONFIG_OF
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: pm8150: use qcom,pm8998-pon binding
Arnd Bergmann <[email protected]>
ath5k: fix building with LEDS=m
Long Li <[email protected]>
PCI: hv: Fix sleep while in non-sleep context when removing child devices from the bus
Fabio Estevam <[email protected]>
ARM: dts: imx6qdl-pico: Fix Ethernet support
Marek Vasut <[email protected]>
ARM: dts: imx: Fix USB host power regulator polarity on M53Menlo
Marek Vasut <[email protected]>
ARM: dts: imx: Add missing pinctrl-names for panel on M53Menlo
Shawn Guo <[email protected]>
soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment
Ilan Peer <[email protected]>
iwlwifi: mvm: Fix possible NULL dereference
Claudiu Beznea <[email protected]>
ARM: at91: pm: do not panic if ram controllers are not enabled
Douglas Anderson <[email protected]>
Revert "arm64: dts: qcom: sc7280: Fixup the cpufreq node"
Marijn Suijten <[email protected]>
ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI PLL reference
Antonio Martorana <[email protected]>
soc: qcom: socinfo: Fixed argument passed to platform_set_data()
Nathan Chancellor <[email protected]>
bus: ti-sysc: Add break in switch statement in sysc_init_soc()
Alexandre Ghiti <[email protected]>
riscv: Flush current cpu icache before other cpus
Adrian Hunter <[email protected]>
scsi: ufs: core: Fix task management completion
David Heidelberg <[email protected]>
ARM: dts: qcom: apq8064: use compatible which contains chipid
Michal Vokáč <[email protected]>
ARM: dts: imx6dl-yapp4: Fix lp5562 LED driver probe
Roger Quadros <[email protected]>
ARM: dts: omap3430-sdp: Fix NAND device node
Juergen Gross <[email protected]>
xen/balloon: fix cancelled balloon action
J. Bruce Fields <[email protected]>
SUNRPC: fix sign error causing rpcsec_gss drops
Trond Myklebust <[email protected]>
nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero
Patrick Ho <[email protected]>
nfsd: fix error handling of register_pernet_subsys() in init_nfsd()
Miklos Szeredi <[email protected]>
ovl: fix IOCB_DIRECT if underlying fs doesn't support direct IO
Zheng Liang <[email protected]>
ovl: fix missing negative dentry check in ovl_rename()
Arnd Bergmann <[email protected]>
fbdev: simplefb: fix Kconfig dependencies
Claudiu Beznea <[email protected]>
mmc: sdhci-of-at91: replace while loop with read_poll_timeout
Claudiu Beznea <[email protected]>
mmc: sdhci-of-at91: wait for calibration done before proceed
Neil Armstrong <[email protected]>
mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk
Jan Beulich <[email protected]>
xen/privcmd: fix error handling in mmap-resource processing
Ville Syrjälä <[email protected]>
drm/i915: Extend the async flip VT-d w/a to skl/bxt
Maarten Lankhorst <[email protected]>
drm/i915: Fix runtime pm handling in i915_gem_shrink
Liu, Zhan <[email protected]>
drm/amd/display: Fix DCN3 B0 DP Alt Mapping
Hansen <[email protected]>
drm/amd/display: Fix detection of 4 lane for DPALT
Nikola Cornij <[email protected]>
drm/amd/display: Limit display scaling to up to 4k for DCN 3.1
Ben Skeggs <[email protected]>
drm/nouveau/ga102-: support ttm buffer moves via copy engine
Ben Skeggs <[email protected]>
drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows
Lijo Lazar <[email protected]>
drm/amdgpu: During s0ix don't wait to signal GFXOFF
Jude Shih <[email protected]>
drm/amd/display: USB4 bring up set correct address
Liu, Zhan <[email protected]>
drm/amd/display: Fix B0 USB-C DP Alt mode
Heikki Krogerus <[email protected]>
usb: typec: tipd: Remove dependency on "connector" child fwnode
Xu Yang <[email protected]>
usb: typec: tcpm: handle SRC_STARTUP state if cc changes
Xu Yang <[email protected]>
usb: typec: tcpci: don't handle vSafe0V event if it's not enabled
Johan Hovold <[email protected]>
USB: cdc-acm: fix break reporting
Johan Hovold <[email protected]>
USB: cdc-acm: fix racy tty buffer accesses
Pavel Hofman <[email protected]>
usb: gadget: f_uac2: fixed EP-IN wMaxPacketSize
Fabio Estevam <[email protected]>
usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle
Rikard Falkeborn <[email protected]>
usb: cdc-wdm: Fix check for WWAN
Ben Hutchings <[email protected]>
Partially revert "usb: Kconfig: using select for USB_COMMON dependency"
-------------
Diffstat:
.../bindings/display/bridge/ti,sn65dsi86.yaml | 2 +- Makefile | 4 +- arch/arm/boot/dts/imx53-m53menlo.dts | 4 +- arch/arm/boot/dts/imx6dl-yapp4-common.dtsi | 5 + arch/arm/boot/dts/imx6qdl-pico.dtsi | 11 + arch/arm/boot/dts/imx6sx-sdb.dts | 4 +- arch/arm/boot/dts/imx6ul-14x14-evk.dtsi | 2 +- arch/arm/boot/dts/omap3430-sdp.dts | 2 +- arch/arm/boot/dts/qcom-apq8064.dtsi | 7 +- arch/arm/configs/gemini_defconfig | 1 + arch/arm/mach-at91/pm.c | 58 +++- arch/arm/mach-imx/pm-imx6.c | 2 + arch/arm/mach-omap2/omap_hwmod.c | 2 + arch/arm/net/bpf_jit_32.c | 19 ++ arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 4 +- .../boot/dts/freescale/imx8mm-beacon-som.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mm-evk.dts | 2 +- .../dts/freescale/imx8mm-kontron-n801x-som.dtsi | 1 + .../boot/dts/freescale/imx8mn-beacon-som.dtsi | 2 +- .../boot/dts/freescale/imx8mp-phycore-som.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq-evk.dts | 2 + .../dts/freescale/imx8mq-kontron-pitx-imx8m.dts | 2 +- arch/arm64/boot/dts/qcom/pm8150.dtsi | 2 +- arch/arm64/boot/dts/qcom/sc7280.dtsi | 6 +- arch/mips/include/asm/mips-cps.h | 23 +- arch/powerpc/boot/dts/fsl/t1023rdb.dts | 2 +- arch/powerpc/include/asm/book3s/32/kup.h | 8 + arch/powerpc/include/asm/interrupt.h | 5 +- arch/powerpc/kernel/dma-iommu.c | 9 + arch/powerpc/kernel/exceptions-64s.S | 25 +- arch/powerpc/kernel/traps.c | 43 +-- arch/powerpc/net/bpf_jit_comp32.c | 8 +- arch/powerpc/net/bpf_jit_comp64.c | 37 ++- arch/powerpc/platforms/pseries/eeh_pseries.c | 4 + arch/riscv/Makefile | 6 + arch/riscv/include/asm/syscall.h | 1 + arch/riscv/include/asm/vdso.h | 37 +-- arch/riscv/include/uapi/asm/unistd.h | 3 +- arch/riscv/kernel/syscall_table.c | 1 - arch/riscv/kernel/vdso.c | 53 ++-- arch/riscv/kernel/vdso/Makefile | 25 +- arch/riscv/kernel/vdso/gen_vdso_offsets.sh | 5 + arch/riscv/kernel/vdso/so2s.sh | 6 - arch/riscv/kernel/vdso/vdso.lds.S | 3 +- arch/riscv/mm/cacheflush.c | 2 + arch/s390/net/bpf_jit_comp.c | 2 +- arch/x86/Kconfig | 2 +- arch/x86/include/asm/entry-common.h | 2 +- arch/x86/kernel/cpu/common.c | 1 + arch/x86/kernel/early-quirks.c | 6 - arch/x86/kernel/fpu/signal.c | 11 +- arch/x86/kernel/hpet.c | 81 ++++++ arch/x86/kernel/sev-shared.c | 2 + arch/x86/platform/olpc/olpc.c | 2 +- arch/xtensa/include/asm/kmem_layout.h | 2 +- arch/xtensa/kernel/irq.c | 2 +- arch/xtensa/kernel/setup.c | 12 +- arch/xtensa/mm/mmu.c | 2 +- drivers/bus/ti-sysc.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 14 +- .../drm/amd/display/dc/dcn10/dcn10_link_encoder.h | 1 + .../amd/display/dc/dcn31/dcn31_dio_link_encoder.c | 66 ++++- .../amd/display/dc/dcn31/dcn31_dio_link_encoder.h | 14 +- .../gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 8 +- drivers/gpu/drm/amd/display/include/dal_asic_id.h | 2 +- .../amd/include/asic_reg/dpcs/dpcs_4_2_0_offset.h | 27 ++ drivers/gpu/drm/i915/display/icl_dsi.c | 48 ++++ drivers/gpu/drm/i915/display/intel_audio.c | 5 +- drivers/gpu/drm/i915/display/intel_bios.c | 22 +- drivers/gpu/drm/i915/display/intel_ddi.c | 8 +- drivers/gpu/drm/i915/display/intel_display.c | 20 +- drivers/gpu/drm/i915/display/intel_vbt_defs.h | 5 + drivers/gpu/drm/i915/gem/i915_gem_shrinker.c | 7 +- drivers/gpu/drm/i915/i915_reg.h | 6 + drivers/gpu/drm/i915/intel_pm.c | 12 + drivers/gpu/drm/nouveau/dispnv50/crc.c | 1 + drivers/gpu/drm/nouveau/dispnv50/head.c | 2 +- drivers/gpu/drm/nouveau/include/nvif/class.h | 2 + drivers/gpu/drm/nouveau/include/nvkm/engine/fifo.h | 1 + drivers/gpu/drm/nouveau/nouveau_bo.c | 1 + drivers/gpu/drm/nouveau/nouveau_chan.c | 6 +- drivers/gpu/drm/nouveau/nouveau_debugfs.c | 1 + drivers/gpu/drm/nouveau/nouveau_drm.c | 4 + drivers/gpu/drm/nouveau/nouveau_gem.c | 4 +- drivers/gpu/drm/nouveau/nv84_fence.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 3 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/Kbuild | 1 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c | 311 +++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/top/ga100.c | 7 +- drivers/gpu/drm/panel/panel-abt-y030xx067a.c | 4 +- drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 7 +- drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h | 4 +- drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 97 ++++--- drivers/i2c/busses/i2c-mlxcpld.c | 4 +- drivers/i2c/busses/i2c-mt65xx.c | 11 +- drivers/i2c/i2c-core-acpi.c | 1 + drivers/mmc/host/meson-gx-mmc.c | 73 ++++- drivers/mmc/host/sdhci-of-at91.c | 22 +- drivers/net/ethernet/google/gve/gve.h | 2 +- drivers/net/ethernet/google/gve/gve_main.c | 45 +-- drivers/net/ethernet/google/gve/gve_rx.c | 8 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/en.h | 11 +- .../ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c | 6 +- drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h | 2 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 59 ++-- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 7 +- drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 11 +- .../mellanox/mlx5/core/esw/acl/egress_lgcy.c | 12 +- .../mellanox/mlx5/core/esw/acl/ingress_lgcy.c | 4 +- .../net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 4 +- .../net/ethernet/mellanox/mlx5/core/lib/clock.c | 37 ++- drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 9 +- drivers/net/ethernet/mscc/ocelot_vcap.c | 4 +- drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 5 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +- drivers/net/pcs/pcs-xpcs.c | 45 ++- drivers/net/phy/mdio_bus.c | 7 + drivers/net/phy/sfp.c | 2 +- drivers/net/wireless/ath/ath5k/Kconfig | 4 +- drivers/net/wireless/ath/ath5k/led.c | 10 +- .../net/wireless/intel/iwlwifi/mvm/time-event.c | 3 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 + drivers/of/base.c | 1 + drivers/pci/controller/pci-hyperv.c | 13 +- drivers/ptp/ptp_pch.c | 1 + drivers/scsi/libiscsi.c | 15 +- drivers/scsi/ufs/ufshcd.c | 52 ++-- drivers/scsi/ufs/ufshcd.h | 1 + drivers/soc/qcom/mdt_loader.c | 2 +- drivers/soc/qcom/socinfo.c | 2 +- drivers/soc/ti/omap_prm.c | 27 +- drivers/usb/chipidea/ci_hdrc_imx.c | 15 +- drivers/usb/class/cdc-acm.c | 8 + drivers/usb/class/cdc-wdm.c | 6 +- drivers/usb/common/Kconfig | 3 +- drivers/usb/gadget/function/f_uac2.c | 14 +- drivers/usb/typec/tcpm/tcpci.c | 2 +- drivers/usb/typec/tcpm/tcpm.c | 1 + drivers/usb/typec/tipd/core.c | 8 +- drivers/video/fbdev/Kconfig | 5 +- drivers/video/fbdev/gbefb.c | 2 +- drivers/xen/balloon.c | 21 +- drivers/xen/privcmd.c | 7 +- fs/afs/write.c | 3 +- fs/netfs/read_helper.c | 2 +- fs/nfsd/nfs4xdr.c | 19 +- fs/nfsd/nfsctl.c | 2 +- fs/overlayfs/dir.c | 10 +- fs/overlayfs/file.c | 15 +- include/net/netfilter/ipv6/nf_defrag_ipv6.h | 1 - include/net/netfilter/nf_tables.h | 2 +- include/net/netns/netfilter.h | 6 + include/soc/mscc/ocelot_vcap.h | 4 +- kernel/bpf/stackmap.c | 3 +- net/bridge/br_netlink.c | 3 +- net/core/rtnetlink.c | 2 +- net/dsa/tag_dsa.c | 2 +- net/ipv4/inet_hashtables.c | 4 +- net/ipv4/netfilter/nf_defrag_ipv4.c | 30 +- net/ipv4/udp.c | 3 +- net/ipv6/inet6_hashtables.c | 2 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 25 +- net/ipv6/udp.c | 3 +- net/netfilter/nf_tables_api.c | 91 ++++-- net/netfilter/nft_quota.c | 2 +- net/netlink/af_netlink.c | 14 +- net/sched/sch_fifo.c | 3 + net/sched/sch_taprio.c | 4 + net/sunrpc/auth_gss/svcauth_gss.c | 2 +- tools/lib/bpf/libbpf.c | 3 +- tools/lib/bpf/strset.c | 1 + tools/objtool/arch/x86/decode.c | 2 +- tools/objtool/special.c | 36 +-- tools/perf/pmu-events/jevents.c | 2 + 182 files changed, 1620 insertions(+), 633 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/151 Partially revert "usb: Kconfig: using select for USB_COMMON dependency"
From: Ben Hutchings <[email protected]>
commit 4d1aa9112c8e6995ef2c8a76972c9671332ccfea upstream.
This reverts commit cb9c1cfc86926d0e86d19c8e34f6c23458cd3478 for USB_LED_TRIG. This config symbol has bool type and enables extra code in usb_common itself, not a separate driver. Enabling it should not force usb_common to be built-in!
--- drivers/usb/common/Kconfig | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/common/Kconfig +1 -2
@@ -6,8 +6,7 @@ config USB_COMMON config USB_LED_TRIG bool "USB LED Triggers" - depends on LEDS_CLASS && LEDS_TRIGGERS - select USB_COMMON + depends on LEDS_CLASS && USB_COMMON && LEDS_TRIGGERS help This option adds LED triggers for USB host and/or gadget activity.
Greg Kroah-Hartman
maintainerPATCH 2/151 usb: cdc-wdm: Fix check for WWAN
In reply to Greg Kroah-HartmanFrom: Rikard Falkeborn <[email protected]>
commit 04d2b75537085cb0c85d73a2e0e50317bffa883f upstream.
CONFIG_WWAN_CORE was with CONFIG_WWAN in commit 89212e160b81 ("net: wwan:
Fix WWAN config symbols"), but did not update all users of it. Change it back to use CONFIG_WWAN instead.
--- drivers/usb/class/cdc-wdm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/class/cdc-wdm.c +3 -3
@@ -824,7 +824,7 @@ static struct usb_class_driver wdm_class };/* --- WWAN framework integration --- */ -#ifdef CONFIG_WWAN_CORE +#ifdef CONFIG_WWAN static int wdm_wwan_port_start (struct wwan_port *port) {struct wdm_device *desc =wwan_port_get_drvdata (port);
@@ -963,11 +963,11 @@ static void wdm_wwan_rx(struct wdm_devic/* inbuf has been copied, it is safe to check for outstanding data */ schedule_work(&desc->service_outs_intr); } -#else /* CONFIG_WWAN_CORE */ +#else /* CONFIG_WWAN */ static void wdm_wwan_init (struct wdm_device *desc) {}static void wdm_wwan_deinit (struct wdm_device *desc) {}static void wdm_wwan_rx (struct wdm_device *desc,int length) {} -#endif /* CONFIG_WWAN_CORE */ +#endif /* CONFIG_WWAN */ /* --- error handling --- */ static void wdm_rxwork (struct work_struct *work)
Greg Kroah-Hartman
maintainerPATCH 3/151 usb: chipidea: ci_hdrc_imx: Also search for phys phandle
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
commit 8253a34bfae3278baca52fc1209b7c29270486ca upstream.
When passing 'phys' in the devicetree to describe the USB PHY phandle (which is the recommended way according to Documentation/devicetree/bindings/usb/ci-hdrc-usb2.txt) the following NULL pointer dereference is observed on i.MX7 and i.MX8MM:
[ 1.489344] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 [ 1.498170] Mem abort info: [ 1.500966] ESR = 0x96000044 [ 1.504030] EC = 0x25: DABT (current EL), IL = 32 bits [ 1.509356] SET = 0, FnV = 0 [ 1.512416] EA = 0, S1PTW = 0 [ 1.515569] FSC = 0x04: level 0 translation fault [ 1.520458] Data abort info: [ 1.523349] ISV = 0, ISS = 0x00000044 [ 1.527196] CM = 0, WnR = 1 [ 1.530176] [0000000000000098] user address but active_mm is swapper [ 1.536544] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 1.542125] Modules linked in: [ 1.545190] CPU: 3 PID: 7 Comm: kworker/u8:0 Not tainted 5.14.0-dirty #3 [ 1.551901] Hardware name: Kontron i.MX8MM N801X S (DT) [ 1.557133] Workqueue: events_unbound deferred_probe_work_func [ 1.562984] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) [ 1.568998] pc : imx7d_charger_detection+0x3f0/0x510 [ 1.573973] lr : imx7d_charger_detection+0x22c/0x510
This happens because the charger functions check for the phy presence inside the imx_usbmisc_data structure (data->usb_phy), but the chipidea core populates the usb_phy passed via 'phys' inside 'struct ci_hdrc' (ci->usb_phy) instead.
This causes the NULL pointer dereference inside imx7d_charger_detection().
Fix it by also searching for 'phys' in case 'fsl,usbphy' is not found.
Tested on a imx7s-warp board.
--- drivers/usb/chipidea/ci_hdrc_imx.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/usb/chipidea/ci_hdrc_imx.c +10 -5
@@ -420,11 +420,16 @@ static int ci_hdrc_imx_probe(struct plat data->phy =devm_usb_get_phy_by_phandle (dev,"fsl,usbphy" ,0 );if (IS_ERR (data->phy)) { ret =PTR_ERR (data->phy); -/* Return -EINVAL if no usbphy is available */ -if (ret == -ENODEV ) - data->phy =NULL ; -else - goto err_clk; +if (ret == -ENODEV ) { + data->phy =devm_usb_get_phy_by_phandle (dev,"phys" ,0 ); +if (IS_ERR (data->phy)) { + ret =PTR_ERR (data->phy); +if (ret == -ENODEV ) + data->phy =NULL ; +else + goto err_clk; + } + } } pdata.usb_phy = data->phy;
Greg Kroah-Hartman
maintainerPATCH 4/151 usb: gadget: f_uac2: fixed EP-IN wMaxPacketSize
In reply to Greg Kroah-HartmanFrom: Pavel Hofman <[email protected]>
commit 0560c9c552c1815e7b480bc11fd785fefc82bb27 upstream.
Async feedback patches broke enumeration on Windows 10 previously fixed by commit 789ea77310f0 ("usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot").
While the existing calculation for EP OUT capture for async mode yields size+1 frame due to uac2_opts->fb_max > 0, playback side lost the +1 feature. Therefore the +1 frame addition must be re-introduced for playback. Win10 enumerates the device only when both EP IN and EP OUT max packet sizes are (at least) +1 frame.
--- drivers/usb/gadget/function/f_uac2.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/usb/gadget/function/f_uac2.c +10 -4
@@ -593,11 +593,17 @@ static int set_ep_max_packet_size(const ssize = uac2_opts->c_ssize; } -if (!is_playback && (uac2_opts->c_sync ==USB_ENDPOINT_SYNC_ASYNC )) +if (!is_playback && (uac2_opts->c_sync ==USB_ENDPOINT_SYNC_ASYNC )) { +// Win10 requires max packet size + 1 frame srate = srate * (1000 + uac2_opts->fb_max) /1000 ; - - max_size_bw =num_channels (chmask) * ssize * -DIV_ROUND_UP (srate, factor / (1 << (ep_desc->bInterval -1 ))); +// updated srate is always bigger, therefore DIV_ROUND_UP always yields +1 + max_size_bw =num_channels (chmask) * ssize * + (DIV_ROUND_UP (srate, factor / (1 << (ep_desc->bInterval -1 )))); + }else { +// adding 1 frame provision for Win10 + max_size_bw =num_channels (chmask) * ssize * + (DIV_ROUND_UP (srate, factor / (1 << (ep_desc->bInterval -1 ))) +1 ); + } ep_desc->wMaxPacketSize =cpu_to_le16 (min_t (u16, max_size_bw, max_size_ep));
Greg Kroah-Hartman
maintainerPATCH 5/151 USB: cdc-acm: fix racy tty buffer accesses
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 65a205e6113506e69a503b61d97efec43fc10fd7 upstream.
A recent change that started reporting break events to the line discipline caused the tty-buffer insertions to no longer be serialised by inserting events also from the completion handler for the interrupt endpoint.
Completion calls for distinct endpoints are not guaranteed to be serialised. For example, in case a host-controller driver uses bottom-half completion, the interrupt and bulk-in completion handlers can end up running in parallel on two CPUs (high-and low-prio tasklets, respectively) thereby breaking the tty layer's single producer assumption.
Fix this by holding the read lock also when inserting characters from the bulk endpoint.
--- drivers/usb/class/cdc-acm.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/class/cdc-acm.c +5 -0
@@ -475,11 +475,16 @@ static int acm_submit_read_urbs(struct astatic void acm_process_read_urb (struct acm *acm,struct urb *urb) { +unsigned long flags; +if (!urb->actual_length)return ; +spin_lock_irqsave (&acm->read_lock, flags);tty_insert_flip_string (&acm->port, urb->transfer_buffer, urb->actual_length); +spin_unlock_irqrestore (&acm->read_lock, flags); +tty_flip_buffer_push (&acm->port); }
Greg Kroah-Hartman
maintainerPATCH 6/151 USB: cdc-acm: fix break reporting
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 58fc1daa4d2e9789b9ffc880907c961ea7c062cc upstream.
A recent change that started reporting break events forgot to push the event to the line discipline, which meant that a detected break would not be reported until further characters had been receive (the port could even have been closed and reopened in between).
--- drivers/usb/class/cdc-acm.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/class/cdc-acm.c +3 -0
@@ -340,6 +340,9 @@ static void acm_process_notification(str acm->iocount.overrun++;spin_unlock_irqrestore (&acm->read_lock, flags); +if (newctrl &ACM_CTRL_BRK ) +tty_flip_buffer_push (&acm->port); +if (difference)wake_up_all (&acm->wioctl);
Greg Kroah-Hartman
maintainerPATCH 7/151 usb: typec: tcpci: dont handle vSafe0V event if its not enabled
In reply to Greg Kroah-HartmanFrom: Xu Yang <[email protected]>
commit 05300871c0e21c288bd5c30ac6f9b1da6ddeed22 upstream.
USB TCPCI Spec, 4.4.3 Mask Registers:
"A masked register will still indicate in the ALERT register, but shall not set the Alert# pin low."
Thus, the Extended Status will still indicate in ALERT register if vSafe0V is detected by TCPC even though being masked. In current code, howerer, this event will not be handled in detection time. Rather it will be handled when next ALERT event coming(CC evnet, PD event, etc).
Tcpm might transition to a wrong state in this situation. Thus, the vSafe0V event should not be handled when it's masked.
--- drivers/usb/typec/tcpm/tcpci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/tcpm/tcpci.c +1 -1
@@ -696,7 +696,7 @@ irqreturn_t tcpci_irq(struct tcpci *tcpctcpm_pd_receive (tcpci->port, &msg); } -if (status &TCPC_ALERT_EXTENDED_STATUS ) { +if (tcpci->data->vbus_vsafe0v && (status &TCPC_ALERT_EXTENDED_STATUS )) { ret =regmap_read (tcpci->regmap,TCPC_EXTENDED_STATUS , &raw);if (!ret && (raw &TCPC_EXTENDED_STATUS_VSAFE0V ))tcpm_vbus_change (tcpci->port);
Greg Kroah-Hartman
maintainerPATCH 8/151 usb: typec: tcpm: handle SRC_STARTUP state if cc changes
In reply to Greg Kroah-HartmanFrom: Xu Yang <[email protected]>
commit 6d91017a295e9790eec02c4e43f020cdb55f5d98 upstream.
TCPM for DRP should do the same action as SRC_ATTACHED when cc changes in SRC_STARTUP state. Otherwise, TCPM will transition to SRC_UNATTACHED state which is not satisfied with the Type-C spec.
Per Type-C spec:
DRP port should move to Unattached.SNK instead of Unattached.SRC if sink removed.
--- drivers/usb/typec/tcpm/tcpm.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/typec/tcpm/tcpm.c +1 -0
@@ -4846,6 +4846,7 @@ static void _tcpm_cc_change(struct tcpm_tcpm_set_state (port,SRC_ATTACH_WAIT ,0 );break ;case SRC_ATTACHED : +case SRC_STARTUP :case SRC_SEND_CAPABILITIES :case SRC_READY : if (tcpm_port_is_disconnected(port) ||
Greg Kroah-Hartman
maintainerPATCH 9/151 usb: typec: tipd: Remove dependency on "connector" child fwnode
In reply to Greg Kroah-HartmanFrom: Heikki Krogerus <[email protected]>
commit b87d8d0d4c43c29ccdc57d15b2ebc1df886a34b4 upstream.
There is no "connector" child node available on every platform, so the driver can't fail to probe when it's missing.
--- drivers/usb/typec/tipd/core.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/usb/typec/tipd/core.c +3 -5
@@ -625,10 +625,6 @@ static int tps6598x_probe(struct i2c_cliif (ret <0 )return ret; - fwnode =device_get_named_child_node (&client->dev,"connector" ); -if (!fwnode) -return -ENODEV ; -/* * This fwnode has a "compatible" property, but is never populated as a * struct device. Instead we simply parse it to read the properties.
@@ -636,7 +632,9 @@ static int tps6598x_probe(struct i2c_cli* with existing DT files, we work around this by deleting any * fwnode_links to/from this fwnode. */ -fw_devlink_purge_absent_suppliers (fwnode); + fwnode =device_get_named_child_node (&client->dev,"connector" ); +if (fwnode) +fw_devlink_purge_absent_suppliers (fwnode); tps->role_sw =fwnode_usb_role_switch_get (fwnode);if (IS_ERR (tps->role_sw)) {
Greg Kroah-Hartman
maintainerPATCH 10/151 drm/amd/display: Fix B0 USB-C DP Alt mode
In reply to Greg Kroah-HartmanFrom: Liu, Zhan <[email protected]>
commit 45d65c0f09aaa6cdd21fe0743f317d4bbdfd1466 upstream.
[Why]
Starting from B0, along with RDPCSTX, RDPCSPIPE registers are also used.
[How]
Make sure RDPCSPIPE registers are programmed correctly.
--- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_link_encoder.h | 1 drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c | 33 +++++++++- drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.h | 11 +++ drivers/gpu/drm/amd/include/asic_reg/dpcs/dpcs_4_2_0_offset.h | 27 ++++++++ 4 files changed, 70 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_link_encoder.h +1 -0
@@ -118,6 +118,7 @@ struct dcn10_link_enc_registers {uint32_t RDPCSTX_PHY_CNTL4 ;uint32_t RDPCSTX_PHY_CNTL5 ;uint32_t RDPCSTX_PHY_CNTL6 ; +uint32_t RDPCSPIPE_PHY_CNTL6 ;uint32_t RDPCSTX_PHY_CNTL7 ;uint32_t RDPCSTX_PHY_CNTL8 ;uint32_t RDPCSTX_PHY_CNTL9 ;
drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c +32 -1
@@ -37,6 +37,7 @@#include "link_enc_cfg.h" #include "dc_dmub_srv.h" +#include "dal_asic_id.h" #define CTX \ enc10->base.ctx
@@ -215,7 +216,7 @@ static const struct link_encoder_funcs d .fec_is_active = enc2_fec_is_active, .get_dig_frontend = dcn10_get_dig_frontend, .get_dig_mode = dcn10_get_dig_mode, - .is_in_alt_mode = dcn20_link_encoder_is_in_alt_mode, + .is_in_alt_mode = dcn31_link_encoder_is_in_alt_mode, .get_max_link_cap = dcn20_link_encoder_get_max_link_cap, .set_dio_phy_mux = dcn31_link_encoder_set_dio_phy_mux, };
@@ -404,3 +405,33 @@ void dcn31_link_encoder_disable_output( } } +bool dcn31_link_encoder_is_in_alt_mode (struct link_encoder *enc) +{ +struct dcn10_link_encoder *enc10 =TO_DCN10_LINK_ENC (enc); +uint32_t dp_alt_mode_disable; +bool is_usb_c_alt_mode = false; + +if (enc->features.flags.bits.DP_IS_USB_C) { +if (enc->ctx->asic_id.hw_internal_rev !=YELLOW_CARP_B0 ) { +// [Note] no need to check hw_internal_rev once phy mux selection is ready +REG_GET (RDPCSTX_PHY_CNTL6 ,RDPCS_PHY_DPALT_DISABLE , &dp_alt_mode_disable); + }else { +/* +* B0 phys use a new set of registers to check whether alt mode is disabled. +* if value == 1 alt mode is disabled, otherwise it is enabled. +*/ +if ((enc10->base.transmitter ==TRANSMITTER_UNIPHY_A ) + || (enc10->base.transmitter ==TRANSMITTER_UNIPHY_B ) + || (enc10->base.transmitter ==TRANSMITTER_UNIPHY_E )) { +REG_GET (RDPCSTX_PHY_CNTL6 ,RDPCS_PHY_DPALT_DISABLE , &dp_alt_mode_disable); + }else { +// [Note] need to change TRANSMITTER_UNIPHY_C/D to F/G once phy mux selection is ready +REG_GET (RDPCSPIPE_PHY_CNTL6 ,RDPCS_PHY_DPALT_DISABLE , &dp_alt_mode_disable); + } + } + + is_usb_c_alt_mode = (dp_alt_mode_disable ==0 ); + } + +return is_usb_c_alt_mode; +}
drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.h +10 -1
@@ -69,6 +69,7 @@SRI (RDPCSTX_PHY_CNTL4 ,RDPCSTX , id), \SRI (RDPCSTX_PHY_CNTL5 ,RDPCSTX , id), \SRI (RDPCSTX_PHY_CNTL6 ,RDPCSTX , id), \ +SRI (RDPCSPIPE_PHY_CNTL6 ,RDPCSPIPE , id), \SRI (RDPCSTX_PHY_CNTL7 ,RDPCSTX , id), \SRI (RDPCSTX_PHY_CNTL8 ,RDPCSTX , id), \ SRI(RDPCSTX_PHY_CNTL9, RDPCSTX, id), \
@@ -115,7 +116,9 @@LE_SF (RDPCSTX0_RDPCSTX_PHY_CNTL6 ,RDPCS_PHY_DP_TX2_MPLL_EN , mask_sh),\LE_SF (RDPCSTX0_RDPCSTX_PHY_CNTL6 ,RDPCS_PHY_DP_TX3_MPLL_EN , mask_sh),\LE_SF (RDPCSTX0_RDPCSTX_PHY_CNTL6 ,RDPCS_PHY_DPALT_DP4 , mask_sh),\ -LE_SF (RDPCSTX0_RDPCSTX_PHY_CNTL6 ,RDPCS_PHY_DPALT_DISABLE , mask_sh),\ +LE_SF (RDPCSPIPE0_RDPCSPIPE_PHY_CNTL6 ,RDPCS_PHY_DPALT_DP4 , mask_sh),\ +LE_SF (RDPCSPIPE0_RDPCSPIPE_PHY_CNTL6 ,RDPCS_PHY_DPALT_DISABLE , mask_sh),\ +LE_SF (RDPCSPIPE0_RDPCSPIPE_PHY_CNTL6 ,RDPCS_PHY_DPALT_DISABLE_ACK , mask_sh),\LE_SF (RDPCSTX0_RDPCSTX_PHY_CNTL7 ,RDPCS_PHY_DP_MPLLB_FRACN_QUOT , mask_sh),\LE_SF (RDPCSTX0_RDPCSTX_PHY_CNTL7 ,RDPCS_PHY_DP_MPLLB_FRACN_DEN , mask_sh),\ LE_SF(RDPCSTX0_RDPCSTX_PHY_CNTL8, RDPCS_PHY_DP_MPLLB_SSC_PEAK, mask_sh),\
@@ -243,4 +246,10 @@ void dcn31_link_encoder_disable_output(struct link_encoder *enc, enum signal_type signal); +/* +* Check whether USB-C DP Alt mode is disabled +*/ +bool dcn31_link_encoder_is_in_alt_mode ( +struct link_encoder *enc); +#endif /* __DC_LINK_ENCODER__DCN31_H__ */
drivers/gpu/drm/amd/include/asic_reg/dpcs/dpcs_4_2_0_offset.h +27 -0
@@ -11932,5 +11932,32 @@#define ixDPCSSYS_CR4_RAWLANEX_DIG_PCS_XF_RX_OVRD_OUT_2 0xe0c7#define ixDPCSSYS_CR4_RAWLANEX_DIG_PCS_XF_TX_OVRD_IN_2 0xe0c8 +//RDPCSPIPE0_RDPCSPIPE_PHY_CNTL6 +#define RDPCSPIPE0_RDPCSPIPE_PHY_CNTL6__RDPCS_PHY_DPALT_DP4__SHIFT 0x10 +#define RDPCSPIPE0_RDPCSPIPE_PHY_CNTL6__RDPCS_PHY_DPALT_DISABLE__SHIFT 0x11 +#define RDPCSPIPE0_RDPCSPIPE_PHY_CNTL6__RDPCS_PHY_DPALT_DISABLE_ACK__SHIFT 0x12 +#define RDPCSPIPE0_RDPCSPIPE_PHY_CNTL6__RDPCS_PHY_DPALT_DP4_MASK 0x00010000L +#define RDPCSPIPE0_RDPCSPIPE_PHY_CNTL6__RDPCS_PHY_DPALT_DISABLE_MASK 0x00020000L +#define RDPCSPIPE0_RDPCSPIPE_PHY_CNTL6__RDPCS_PHY_DPALT_DISABLE_ACK_MASK 0x00040000L + +//RDPCSPIPE1_RDPCSPIPE_PHY_CNTL6 +#define RDPCSPIPE1_RDPCSPIPE_PHY_CNTL6__RDPCS_PHY_DPALT_DP4__SHIFT 0x10 +#define RDPCSPIPE1_RDPCSPIPE_PHY_CNTL6__RDPCS_PHY_DPALT_DISABLE__SHIFT 0x11 +#define RDPCSPIPE1_RDPCSPIPE_PHY_CNTL6__RDPCS_PHY_DPALT_DISABLE_ACK__SHIFT 0x12 +#define RDPCSPIPE1_RDPCSPIPE_PHY_CNTL6__RDPCS_PHY_DPALT_DP4_MASK 0x00010000L +#define RDPCSPIPE1_RDPCSPIPE_PHY_CNTL6__RDPCS_PHY_DPALT_DISABLE_MASK 0x00020000L +#define RDPCSPIPE1_RDPCSPIPE_PHY_CNTL6__RDPCS_PHY_DPALT_DISABLE_ACK_MASK 0x00040000L + +//[Note] Hack. RDPCSPIPE only has 2 instances. +#define regRDPCSPIPE0_RDPCSPIPE_PHY_CNTL6 0x2d73 +#define regRDPCSPIPE0_RDPCSPIPE_PHY_CNTL6_BASE_IDX 2 +#define regRDPCSPIPE1_RDPCSPIPE_PHY_CNTL6 0x2e4b +#define regRDPCSPIPE1_RDPCSPIPE_PHY_CNTL6_BASE_IDX 2 +#define regRDPCSPIPE2_RDPCSPIPE_PHY_CNTL6 0x2d73 +#define regRDPCSPIPE2_RDPCSPIPE_PHY_CNTL6_BASE_IDX 2 +#define regRDPCSPIPE3_RDPCSPIPE_PHY_CNTL6 0x2e4b +#define regRDPCSPIPE3_RDPCSPIPE_PHY_CNTL6_BASE_IDX 2 +#define regRDPCSPIPE4_RDPCSPIPE_PHY_CNTL6 0x2d73 +#define regRDPCSPIPE4_RDPCSPIPE_PHY_CNTL6_BASE_IDX 2#endif
Greg Kroah-Hartman
maintainerPATCH 11/151 drm/amd/display: USB4 bring up set correct address
In reply to Greg Kroah-HartmanFrom: Jude Shih <[email protected]>
commit 7ab0965079bbc0e39fe0e1df4dcdf931c9d25372 upstream.
[Why]YELLOW_CARP_B0 address was not correct
[How]
Set YELLOW_CARP_B0 to 0x1A.
--- drivers/gpu/drm/amd/display/include/dal_asic_id.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/include/dal_asic_id.h +1 -1
@@ -227,7 +227,7 @@ enum {#define FAMILY_YELLOW_CARP 146#define YELLOW_CARP_A0 0x01 -#define YELLOW_CARP_B0 0x02 // TODO: DCN31 - update with correct B0 ID +#define YELLOW_CARP_B0 0x1A#define YELLOW_CARP_UNKNOWN 0xFF#ifndef ASICREV_IS_YELLOW_CARP
Greg Kroah-Hartman
maintainerPATCH 12/151 drm/amdgpu: During s0ix dont wait to signal GFXOFF
In reply to Greg Kroah-HartmanFrom: Lijo Lazar <[email protected]>
commit 1d617c029fd9c960f8ba7a8d1a10699d820bd6b9 upstream.
In the rare event when GFX IP suspend coincides with a s0ix entry, don't schedule a delayed work, instead signal PMFW immediately to allow GFXOFF entry. GFXOFF is a prerequisite for s0ix entry. PMFW needs to be signaled about GFXOFF status before amd-pmc module passes OS HINT to PMFW telling that everything is ready for a safe s0ix entry.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +12 -2
@@ -31,6 +31,8 @@/* delay 0.1 second to enable gfx off feature */ #define GFX_OFF_DELAY_ENABLE msecs_to_jiffies(100) +#define GFX_OFF_NO_DELAY 0 +/* * GPU GFX IP block helpers function. */
@@ -558,6 +560,8 @@ int amdgpu_gfx_enable_kcq(struct amdgpu_void amdgpu_gfx_off_ctrl (struct amdgpu_device *adev,bool enable) { +unsigned long delay =GFX_OFF_DELAY_ENABLE ; +if (!(adev->pm.pp_feature &PP_GFXOFF_MASK ))return ;
@@ -573,8 +577,14 @@ void amdgpu_gfx_off_ctrl(struct amdgpu_d adev->gfx.gfx_off_req_count--; -if (adev->gfx.gfx_off_req_count ==0 && !adev->gfx.gfx_off_state) -schedule_delayed_work (&adev->gfx.gfx_off_delay_work,GFX_OFF_DELAY_ENABLE ); +if (adev->gfx.gfx_off_req_count ==0 && + !adev->gfx.gfx_off_state) { +/* If going to s2idle, no need to wait */ +if (adev->in_s0ix) + delay =GFX_OFF_NO_DELAY ; +schedule_delayed_work (&adev->gfx.gfx_off_delay_work, + delay); + } }else {if (adev->gfx.gfx_off_req_count ==0 ) {cancel_delayed_work_sync (&adev->gfx.gfx_off_delay_work);
Greg Kroah-Hartman
maintainerPATCH 13/151 drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows
In reply to Greg Kroah-HartmanFrom: Ben Skeggs <[email protected]>
commit f732e2e34aa08493fdd762f3daa4e5f16bbf1e45 upstream.
Prevent NVD core channel error code 67 occuring and hanging display, managed to reproduce on GA102 while testing suspend/resume scenarios.
Required extension of earlier commit to fix interactions with EFI.
--- drivers/gpu/drm/nouveau/dispnv50/head.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/dispnv50/head.c +1 -1
@@ -52,6 +52,7 @@ nv50_head_flush_clr(struct nv50_head *hevoid nv50_head_flush_set_wndw (struct nv50_head *head,struct nv50_head_atom *asyh) { +if (asyh->set.curs ) head->func->curs_set (head, asyh);if (asyh->set.olut ) { asyh->olut.offset = nv50_lut_load(&head->olut, asyh->olut.buffer,
@@ -67,7 +68,6 @@ nv50_head_flush_set(struct nv50_head *heif (asyh->set.view ) head->func->view (head, asyh);if (asyh->set.mode ) head->func->mode (head, asyh);if (asyh->set.core ) head->func->core_set (head, asyh); -if (asyh->set.curs ) head->func->curs_set (head, asyh);if (asyh->set.base ) head->func->base (head, asyh);if (asyh->set.ovly ) head->func->ovly (head, asyh);if (asyh->set.dither ) head->func->dither (head, asyh);
Greg Kroah-Hartman
maintainerPATCH 14/151 drm/nouveau/ga102-: support ttm buffer moves via copy engine
In reply to Greg Kroah-HartmanFrom: Ben Skeggs <[email protected]>
commit 49b2dfc081826874705b27f7970631319628ee7f upstream.
We don't currently have any kind of real acceleration on Ampere GPUs, but the TTM memcpy() fallback paths aren't really designed to handle copies between different devices, such as on Optimus systems, and result in a kernel OOPS.
A few options were investigated to try and fix this, but didn't work out, and likely would have resulted in a very unpleasant experience for users anyway.
This commit adds just enough support for setting up a single channel connected to a copy engine, which the kernel can use to accelerate the buffer copies between devices. Userspace has no access to this incomplete channel support, but it's suitable for TTM's needs.
A more complete implementation of host(fifo) for Ampere GPUs is in the works, but the required changes are far too invasive that they would be unsuitable to backport to fix this issue on current kernels.
v2: fix GPFIFO length in RAMFC (reported by Karol)
--- drivers/gpu/drm/nouveau/include/nvif/class.h | 2 drivers/gpu/drm/nouveau/include/nvkm/engine/fifo.h | 1 drivers/gpu/drm/nouveau/nouveau_bo.c | 1 drivers/gpu/drm/nouveau/nouveau_chan.c | 6 drivers/gpu/drm/nouveau/nouveau_drm.c | 4 drivers/gpu/drm/nouveau/nv84_fence.c | 2 drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 3 drivers/gpu/drm/nouveau/nvkm/engine/fifo/Kbuild | 1 drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c | 308 +++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/top/ga100.c | 7 10 files changed, 329 insertions(+), 6 deletions(-) create mode 100644 drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c
drivers/gpu/drm/nouveau/include/nvif/class.h +2 -0
@@ -71,6 +71,7 @@#define PASCAL_CHANNEL_GPFIFO_A /* cla06f.h */ 0x0000c06f#define VOLTA_CHANNEL_GPFIFO_A /* clc36f.h */ 0x0000c36f#define TURING_CHANNEL_GPFIFO_A /* clc36f.h */ 0x0000c46f +#define AMPERE_CHANNEL_GPFIFO_B /* clc36f.h */ 0x0000c76f#define NV50_DISP /* cl5070.h */ 0x00005070#define G82_DISP /* cl5070.h */ 0x00008270
@@ -200,6 +201,7 @@#define PASCAL_DMA_COPY_B 0x0000c1b5#define VOLTA_DMA_COPY_A 0x0000c3b5#define TURING_DMA_COPY_A 0x0000c5b5 +#define AMPERE_DMA_COPY_B 0x0000c7b5#define FERMI_DECOMPRESS 0x000090b8
drivers/gpu/drm/nouveau/include/nvkm/engine/fifo.h +1 -0
@@ -77,4 +77,5 @@ int gp100_fifo_new(struct nvkm_device *,int gp10b_fifo_new (struct nvkm_device *,enum nvkm_subdev_type ,int inst,struct nvkm_fifo **);int gv100_fifo_new (struct nvkm_device *,enum nvkm_subdev_type ,int inst,struct nvkm_fifo **);int tu102_fifo_new (struct nvkm_device *,enum nvkm_subdev_type ,int inst,struct nvkm_fifo **); +int ga102_fifo_new (struct nvkm_device *,enum nvkm_subdev_type ,int inst,struct nvkm_fifo **);#endif
drivers/gpu/drm/nouveau/nouveau_bo.c +1 -0
@@ -844,6 +844,7 @@ nouveau_bo_move_init(struct nouveau_drm struct ttm_resource *, struct ttm_resource *);int (*init)(struct nouveau_channel *,u32 handle); } _methods[] = { + { "COPY", 4, 0xc7b5, nve0_bo_move_copy, nve0_bo_move_init }, { "COPY", 4, 0xc5b5, nve0_bo_move_copy, nve0_bo_move_init }, { "GRCE", 0, 0xc5b5, nve0_bo_move_copy, nvc0_bo_move_init }, { "COPY", 4, 0xc3b5, nve0_bo_move_copy, nve0_bo_move_init },
drivers/gpu/drm/nouveau/nouveau_chan.c +4 -2
@@ -250,7 +250,8 @@ static int nouveau_channel_ind(struct nouveau_drm *drm, struct nvif_device *device, u64 runlist, bool priv, struct nouveau_channel **pchan) { - static const u16 oclasses[] = { TURING_CHANNEL_GPFIFO_A, + static const u16 oclasses[] = { AMPERE_CHANNEL_GPFIFO_B, + TURING_CHANNEL_GPFIFO_A, VOLTA_CHANNEL_GPFIFO_A, PASCAL_CHANNEL_GPFIFO_A, MAXWELL_CHANNEL_GPFIFO_A,
@@ -386,7 +387,8 @@ nouveau_channel_init(struct nouveau_channvif_object_map (&chan->user,NULL ,0 ); -if (chan->user.oclass >=FERMI_CHANNEL_GPFIFO ) { +if (chan->user.oclass >=FERMI_CHANNEL_GPFIFO && + chan->user.oclass <AMPERE_CHANNEL_GPFIFO_B ) { ret = nvif_notify_ctor(&chan->user, "abi16ChanKilled", nouveau_channel_killed, true, NV906F_V0_NTFY_KILLED,
drivers/gpu/drm/nouveau/nouveau_drm.c +4 -0
@@ -345,6 +345,9 @@ nouveau_accel_gr_init(struct nouveau_drmu32 arg0, arg1;int ret; +if (device->info.family >=NV_DEVICE_INFO_V0_AMPERE ) +return ; +/* Allocate channel that has access to the graphics engine. */ if (device->info.family >=NV_DEVICE_INFO_V0_KEPLER ) { arg0 =nvif_fifo_runlist (device,NV_DEVICE_HOST_RUNLIST_ENGINES_GR );
@@ -469,6 +472,7 @@ nouveau_accel_init(struct nouveau_drm *dcase PASCAL_CHANNEL_GPFIFO_A :case VOLTA_CHANNEL_GPFIFO_A :case TURING_CHANNEL_GPFIFO_A : +case AMPERE_CHANNEL_GPFIFO_B : ret =nvc0_fence_create (drm);break ;default :
drivers/gpu/drm/nouveau/nv84_fence.c +1 -1
@@ -204,7 +204,7 @@ nv84_fence_create(struct nouveau_drm *dr priv->base.context_new = nv84_fence_context_new; priv->base.context_del = nv84_fence_context_del; - priv->base.uevent = true; + priv->base.uevent = drm->client.device.info.family <NV_DEVICE_INFO_V0_AMPERE ;mutex_init (&priv->mutex);
drivers/gpu/drm/nouveau/nvkm/engine/device/base.c +3 -0
@@ -2602,6 +2602,7 @@ nv172_chipset = { .top = { 0x00000001, ga100_top_new }, .disp = { 0x00000001, ga102_disp_new }, .dma = { 0x00000001, gv100_dma_new }, + .fifo = { 0x00000001, ga102_fifo_new }, }; static const struct nvkm_device_chip
@@ -2622,6 +2623,7 @@ nv174_chipset = { .top = { 0x00000001, ga100_top_new }, .disp = { 0x00000001, ga102_disp_new }, .dma = { 0x00000001, gv100_dma_new }, + .fifo = { 0x00000001, ga102_fifo_new }, }; static const struct nvkm_device_chip
@@ -2642,6 +2644,7 @@ nv177_chipset = { .top = { 0x00000001, ga100_top_new }, .disp = { 0x00000001, ga102_disp_new }, .dma = { 0x00000001, gv100_dma_new }, + .fifo = { 0x00000001, ga102_fifo_new }, }; static int
drivers/gpu/drm/nouveau/nvkm/engine/fifo/Kbuild +1 -0
@@ -18,6 +18,7 @@ nvkm-y += nvkm/engine/fifo/gp100.o nvkm-y += nvkm/engine/fifo/gp10b.o nvkm-y += nvkm/engine/fifo/gv100.o nvkm-y += nvkm/engine/fifo/tu102.o +nvkm-y += nvkm/engine/fifo/ga102.o nvkm-y += nvkm/engine/fifo/chan.o nvkm-y += nvkm/engine/fifo/channv50.o
drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c new file +308 -0
308 lines not on this page · raw message
drivers/gpu/drm/nouveau/nvkm/subdev/top/ga100.c +4 -3
@@ -54,7 +54,7 @@ ga100_top_oneinit(struct nvkm_top *top) info->reset = (data &0x0000001f );break ;case 2 : - info->runlist = (data &0x0000fc00 ) >>10 ; + info->runlist = (data &0x00fffc00 ); info->engine = (data &0x00000003 );break ;default :
@@ -85,9 +85,10 @@ ga100_top_oneinit(struct nvkm_top *top) }nvkm_debug (subdev,"%02x.%d (%8s): addr %06x fault %2d " -"runlist %2d engine %2d reset %2d\n" , type, inst, +"runlist %6x engine %2d reset %2d\n" , type, inst, info->type ==NVKM_SUBDEV_NR ?"????????" : nvkm_subdev_type[info->type], - info->addr, info->fault, info->runlist, info->engine, info->reset); + info->addr, info->fault, info->runlist <0 ?0 : info->runlist, + info->engine, info->reset); info =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 15/151 drm/amd/display: Limit display scaling to up to 4k for DCN 3.1
In reply to Greg Kroah-HartmanFrom: Nikola Cornij <[email protected]>
commit a7e397b7c45377e20542146be10231b8afa948d1 upstream.
[why]
The existing limit was mistakenly bigger than 4k for DCN 3.1
--- drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +1 -1
@@ -928,7 +928,7 @@ static const struct dc_debug_options deb .disable_dcc = DCC_ENABLE, .vsr_support = true, .performance_trace = false, - .max_downscale_src_width = 7680,/*upto 8K*/ + .max_downscale_src_width = 3840,/*upto 4K*/ .disable_pplib_wm_range = false, .scl_reset_length10 = true, .sanity_checks = false,
Greg Kroah-Hartman
maintainerPATCH 16/151 drm/amd/display: Fix detection of 4 lane for DPALT
In reply to Greg Kroah-HartmanFrom: Hansen <[email protected]>
commit 5a1fef027846e7635b9d320b2cc0b416fd11a3be upstream.
[Why]
DPALT detection for B0 PHY has its own set of RDPCSPIPE registers
[How]
Use RDPCSPIPE registers to detect if DPALT lane is 4 lane
--- drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c | 33 +++++++++- drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.h | 3 2 files changed, 35 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c +32 -1
@@ -63,6 +63,10 @@#define AUX_REG_WRITE (reg_name, val) \ dm_write_reg(CTX, AUX_REG(reg_name), val) +#ifndef MIN +#define MIN (X ,Y ) ((X) < (Y) ? (X) : (Y)) +#endif + void dcn31_link_encoder_set_dio_phy_mux( struct link_encoder *enc, enum encoder_type_select sel,
@@ -217,7 +221,7 @@ static const struct link_encoder_funcs d .get_dig_frontend = dcn10_get_dig_frontend, .get_dig_mode = dcn10_get_dig_mode, .is_in_alt_mode = dcn31_link_encoder_is_in_alt_mode, - .get_max_link_cap = dcn20_link_encoder_get_max_link_cap, + .get_max_link_cap = dcn31_link_encoder_get_max_link_cap, .set_dio_phy_mux = dcn31_link_encoder_set_dio_phy_mux, };
@@ -435,3 +439,30 @@ bool dcn31_link_encoder_is_in_alt_mode(sreturn is_usb_c_alt_mode; } + +void dcn31_link_encoder_get_max_link_cap (struct link_encoder *enc, +struct dc_link_settings *link_settings) +{ +struct dcn10_link_encoder *enc10 =TO_DCN10_LINK_ENC (enc); +uint32_t is_in_usb_c_dp4_mode =0 ; + +dcn10_link_encoder_get_max_link_cap (enc, link_settings); + +/* in usb c dp2 mode, max lane count is 2 */ +if (enc->funcs->is_in_alt_mode && enc->funcs->is_in_alt_mode (enc)) { +if (enc->ctx->asic_id.hw_internal_rev !=YELLOW_CARP_B0 ) { +// [Note] no need to check hw_internal_rev once phy mux selection is ready +REG_GET (RDPCSTX_PHY_CNTL6 ,RDPCS_PHY_DPALT_DP4 , &is_in_usb_c_dp4_mode); + }else { +if ((enc10->base.transmitter ==TRANSMITTER_UNIPHY_A ) + || (enc10->base.transmitter ==TRANSMITTER_UNIPHY_B ) + || (enc10->base.transmitter ==TRANSMITTER_UNIPHY_E )) { +REG_GET (RDPCSTX_PHY_CNTL6 ,RDPCS_PHY_DPALT_DP4 , &is_in_usb_c_dp4_mode); + }else { +REG_GET (RDPCSPIPE_PHY_CNTL6 ,RDPCS_PHY_DPALT_DP4 , &is_in_usb_c_dp4_mode); + } + } +if (!is_in_usb_c_dp4_mode) + link_settings->lane_count =MIN (LANE_COUNT_TWO , link_settings->lane_count); + } +}
drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.h +3 -0
@@ -252,4 +252,7 @@ void dcn31_link_encoder_disable_output(bool dcn31_link_encoder_is_in_alt_mode (struct link_encoder *enc); +void dcn31_link_encoder_get_max_link_cap (struct link_encoder *enc, +struct dc_link_settings *link_settings); +#endif /* __DC_LINK_ENCODER__DCN31_H__ */
Greg Kroah-Hartman
maintainerPATCH 17/151 drm/amd/display: Fix DCN3 B0 DP Alt Mapping
In reply to Greg Kroah-HartmanFrom: Liu, Zhan <[email protected]>
commit 2fe9a0e1173f4805669e7af34ea25af835274426 upstream.
[Why]
DCN3 B0 has a mux, which redirects PHYC and PHYD to PHYF and PHYG.
[How]
Fix DIG mapping.
--- drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +6 -0
@@ -1284,6 +1284,12 @@ static struct stream_encoder *dcn31_streif (!enc1 || !vpg || !afmt)return NULL ; +if (ctx->asic_id.chip_family ==FAMILY_YELLOW_CARP && + ctx->asic_id.hw_internal_rev ==YELLOW_CARP_B0 ) { +if ((eng_id ==ENGINE_ID_DIGC ) || (eng_id ==ENGINE_ID_DIGD )) + eng_id = eng_id +3 ;// For B0 only. C->F, D->G. + } + dcn30_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios, eng_id, vpg, afmt, &stream_enc_regs[eng_id],
Greg Kroah-Hartman
maintainerPATCH 18/151 drm/i915: Fix runtime pm handling in i915_gem_shrink
In reply to Greg Kroah-HartmanFrom: Maarten Lankhorst <[email protected]>
commit 0c94777386495d6e0a9735d48ffd2abb8d680d7f upstream.
We forgot to call intel_runtime_pm_put on error, fix it!
--- drivers/gpu/drm/i915/gem/i915_gem_shrinker.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/gem/i915_gem_shrinker.c +5 -2
@@ -118,7 +118,7 @@ i915_gem_shrink(struct i915_gem_ww_ctx *intel_wakeref_t wakeref =0 ;unsigned long count =0 ;unsigned long scanned =0 ; -int err; +int err =0 ;/* CHV + VTD workaround use stop_machine(); need to trylock vm->mutex */ bool trylock_vm = !ww &&intel_vm_no_concurrent_access_wa (i915);
@@ -242,12 +242,15 @@ skip:list_splice_tail (&still_in_list, phase->list);spin_unlock_irqrestore (&i915->mm.obj_lock, flags);if (err) -return err; +break ; }if (shrink &I915_SHRINK_BOUND )intel_runtime_pm_put (&i915->runtime_pm, wakeref); +if (err) +return err; +if (nr_scanned) *nr_scanned += scanned;return count;
Greg Kroah-Hartman
maintainerPATCH 19/151 drm/i915: Extend the async flip VT-d w/a to skl/bxt
In reply to Greg Kroah-HartmanFrom: Ville Syrjälä <[email protected]>
commit b2d73debfdc16b742e64948dc4461876af3f8c10 upstream.
Looks like skl/bxt/derivatives also need the plane stride stretch w/a when using async flips and VT-d is enabled, or else we get corruption on screen. To my surprise this was even documented in bspec, but only as a note on the CHICHKEN_PIPESL register description rather than on the w/a list.
So very much the same thing as on HSW/BDW, except the bits moved yet again.
--- drivers/gpu/drm/i915/i915_reg.h | 5 +++++ drivers/gpu/drm/i915/intel_pm.c | 12 ++++++++++++ 2 files changed, 17 insertions(+)
drivers/gpu/drm/i915/i915_reg.h +5 -0
@@ -8150,6 +8150,11 @@ enum {#define HSW_SPR_STRETCH_MAX_X1 REG_FIELD_PREP(HSW_SPR_STRETCH_MAX_MASK, 3)#define HSW_FBCQ_DIS (1 << 22)#define BDW_DPRS_MASK_VBLANK_SRD (1 << 0) +#define SKL_PLANE1_STRETCH_MAX_MASK REG_GENMASK(1, 0) +#define SKL_PLANE1_STRETCH_MAX_X8 REG_FIELD_PREP(SKL_PLANE1_STRETCH_MAX_MASK, 0) +#define SKL_PLANE1_STRETCH_MAX_X4 REG_FIELD_PREP(SKL_PLANE1_STRETCH_MAX_MASK, 1) +#define SKL_PLANE1_STRETCH_MAX_X2 REG_FIELD_PREP(SKL_PLANE1_STRETCH_MAX_MASK, 2) +#define SKL_PLANE1_STRETCH_MAX_X1 REG_FIELD_PREP(SKL_PLANE1_STRETCH_MAX_MASK, 3)#define CHICKEN_PIPESL_1 (pipe) _MMIO_PIPE(pipe, _CHICKEN_PIPESL_1_A, _CHICKEN_PIPESL_1_B)#define _CHICKEN_TRANS_A 0x420c0
drivers/gpu/drm/i915/intel_pm.c +12 -0
@@ -76,6 +76,8 @@ struct intel_wm_config {static void gen9_init_clock_gating (struct drm_i915_private *dev_priv) { +enum pipe pipe; +if (HAS_LLC (dev_priv)) {/* * WaCompressedResourceDisplayNewHashMode:skl,kbl
@@ -89,6 +91,16 @@ static void gen9_init_clock_gating(struc SKL_DE_COMPRESSED_HASH_MODE); } +for_each_pipe (dev_priv, pipe) { +/* +* "Plane N strech max must be programmed to 11b (x1) +* when Async flips are enabled on that plane." +*/ +if (!IS_GEMINILAKE (dev_priv) &&intel_vtd_active ()) +intel_uncore_rmw (&dev_priv->uncore,CHICKEN_PIPESL_1 (pipe), +SKL_PLANE1_STRETCH_MAX_MASK ,SKL_PLANE1_STRETCH_MAX_X1 ); + } +/* See Bspec note for PSR2_CTL bit 31, Wa#828:skl,bxt,kbl,cfl */ intel_uncore_write (&dev_priv->uncore,CHICKEN_PAR1_1 ,intel_uncore_read (&dev_priv->uncore,CHICKEN_PAR1_1 ) |SKL_EDP_PSR_FIX_RDWRAP );
Greg Kroah-Hartman
maintainerPATCH 20/151 xen/privcmd: fix error handling in mmap-resource processing
In reply to Greg Kroah-HartmanFrom: Jan Beulich <[email protected]>
commit e11423d6721dd63b23fb41ade5e8d0b448b17780 upstream.
xen_pfn_t is the same size as int only on 32-bit builds (and not even on Arm32). Hence pfns[] can't be used directly to read individual error values returned from xen_remap_domain_mfn_array(); every other error indicator would be skipped/ignored on 64-bit.
--- drivers/xen/privcmd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/xen/privcmd.c +4 -3
@@ -803,11 +803,12 @@ static long privcmd_ioctl_mmap_resource(unsigned int domid = (xdata.flags & XENMEM_rsrc_acq_caller_owned) ?DOMID_SELF : kdata.dom; -int num; +int num, *errs = (int *)pfns; +BUILD_BUG_ON (sizeof (*errs) >sizeof (*pfns)); num =xen_remap_domain_mfn_array (vma, kdata.addr &PAGE_MASK , - pfns, kdata.num, (int *)pfns, + pfns, kdata.num, errs, vma->vm_page_prot, domid, vma->vm_private_data);
@@ -817,7 +818,7 @@ static long privcmd_ioctl_mmap_resource(unsigned int i;for (i =0 ; i < num; i++) { - rc = pfns[i]; + rc = errs[i];if (rc <0 )break ; }
Greg Kroah-Hartman
maintainerPATCH 21/151 mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
commit 8a38a4d51c5055d0201542e5ea3c0cb287f6e223 upstream.
The memory at the end of the controller only accepts 32bit read/write accesses, but the arm64 memcpy_to/fromio implementation only uses 64bit (which will be split into two 32bit access) and 8bit leading to incomplete copies to/from this memory when the buffer is not multiple of 8bytes.
Add a local copy using writel/readl accesses to make sure we use the right memory access width.
The switch to memcpy_to/fromio was done because of 285133040e6c ("arm64: Import latest memcpy()/memmove() implementation"), but using memcpy worked before since it mainly used 32bit memory acceses.
--- drivers/mmc/host/meson-gx-mmc.c | 73 ++++++++++++++++++++++++++++++++-------- 1 file changed, 59 insertions(+), 14 deletions(-)
drivers/mmc/host/meson-gx-mmc.c +59 -14
@@ -746,7 +746,7 @@ static void meson_mmc_desc_chain_transfewritel (start, host->regs +SD_EMMC_START ); } -/* local sg copy to buffer version with _to/fromio usage for dram_access_quirk */ +/* local sg copy for dram_access_quirk */ static void meson_mmc_copy_buffer (struct meson_host *host,struct mmc_data *data,size_t buflen,bool to_buffer) {
@@ -764,21 +764,27 @@ static void meson_mmc_copy_buffer(structsg_miter_start (&miter, sgl, nents, sg_flags);while ((offset < buflen) &&sg_miter_next (&miter)) { -unsigned int len; +unsigned int buf_offset =0 ; +unsigned int len, left; +u32 *buf = miter.addr; len =min (miter.length, buflen - offset); + left = len; -/* When dram_access_quirk, the bounce buffer is a iomem mapping */ -if (host->dram_access_quirk) { -if (to_buffer) -memcpy_toio (host->bounce_iomem_buf + offset, miter.addr, len); -else -memcpy_fromio (miter.addr, host->bounce_iomem_buf + offset, len); +if (to_buffer) { +do { +writel (*buf++, host->bounce_iomem_buf + offset + buf_offset); + + buf_offset +=4 ; + left -=4 ; + }while (left); }else { -if (to_buffer) -memcpy (host->bounce_buf + offset, miter.addr, len); -else -memcpy (miter.addr, host->bounce_buf + offset, len); +do { + *buf++ =readl (host->bounce_iomem_buf + offset + buf_offset); + + buf_offset +=4 ; + left -=4 ; + }while (left); } offset += len;
@@ -830,7 +836,11 @@ static void meson_mmc_start_cmd(struct mif (data->flags &MMC_DATA_WRITE ) { cmd_cfg |=CMD_CFG_DATA_WR ;WARN_ON (xfer_bytes > host->bounce_buf_size); -meson_mmc_copy_buffer (host, data, xfer_bytes, true); +if (host->dram_access_quirk) +meson_mmc_copy_buffer (host, data, xfer_bytes, true); +else +sg_copy_to_buffer (data->sg, data->sg_len, + host->bounce_buf, xfer_bytes);dma_wmb (); }
@@ -849,12 +859,43 @@ static void meson_mmc_start_cmd(struct mwritel (cmd->arg, host->regs +SD_EMMC_CMD_ARG ); } +static int meson_mmc_validate_dram_access (struct mmc_host *mmc,struct mmc_data *data) +{ +struct scatterlist *sg; +int i; + +/* Reject request if any element offset or size is not 32bit aligned */ +for_each_sg (data->sg, sg, data->sg_len, i) { +if (!IS_ALIGNED (sg->offset,sizeof (u32)) || + !IS_ALIGNED (sg->length,sizeof (u32))) { +dev_err (mmc_dev (mmc),"unaligned sg offset %u len %u\n" , + data->sg->offset, data->sg->length); +return -EINVAL ; + } + } + +return 0 ; +} +static void meson_mmc_request (struct mmc_host *mmc,struct mmc_request *mrq) {struct meson_host *host =mmc_priv (mmc);bool needs_pre_post_req = mrq->data && !(mrq->data->host_cookie &SD_EMMC_PRE_REQ_DONE ); +/* +* The memory at the end of the controller used as bounce buffer for +* the dram_access_quirk only accepts 32bit read/write access, +* check the aligment and length of the data before starting the request. +*/ +if (host->dram_access_quirk && mrq->data) { + mrq->cmd->error =meson_mmc_validate_dram_access (mmc, mrq->data); +if (mrq->cmd->error) { +mmc_request_done (mmc, mrq); +return ; + } + } +if (needs_pre_post_req) {meson_mmc_get_transfer_mode (mmc, mrq);if (!meson_mmc_desc_chain_mode (mrq->data))
@@ -999,7 +1040,11 @@ static irqreturn_t meson_mmc_irq_thread(if (meson_mmc_bounce_buf_read (data)) { xfer_bytes = data->blksz * data->blocks;WARN_ON (xfer_bytes > host->bounce_buf_size); -meson_mmc_copy_buffer (host, data, xfer_bytes, false); +if (host->dram_access_quirk) +meson_mmc_copy_buffer (host, data, xfer_bytes, false); +else +sg_copy_from_buffer (data->sg, data->sg_len, + host->bounce_buf, xfer_bytes); } next_cmd =meson_mmc_get_next_command (cmd);
Greg Kroah-Hartman
maintainerPATCH 22/151 mmc: sdhci-of-at91: wait for calibration done before proceed
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
commit af467fad78f03a42de8b72190f6a595366b870db upstream.
Datasheet specifies that at the end of calibration the SDMMC_CALCR_EN bit will be cleared. No commands should be send before calibration is done.
--- drivers/mmc/host/sdhci-of-at91.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/mmc/host/sdhci-of-at91.c +6 -0
@@ -11,6 +11,7 @@#include <linux/delay.h> #include <linux/err.h> #include <linux/io.h> +#include <linux/iopoll.h> #include <linux/kernel.h> #include <linux/mmc/host.h> #include <linux/mmc/slot-gpio.h>
@@ -114,6 +115,7 @@ static void sdhci_at91_reset(struct sdhc {struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct sdhci_at91_priv *priv =sdhci_pltfm_priv (pltfm_host); +unsigned int tmp;sdhci_reset (host, mask);
@@ -126,6 +128,10 @@ static void sdhci_at91_reset(struct sdhcsdhci_writel (host, calcr |SDMMC_CALCR_ALWYSON |SDMMC_CALCR_EN ,SDMMC_CALCR ); + +if (read_poll_timeout (sdhci_readl, tmp, !(tmp &SDMMC_CALCR_EN ), +10 ,20000 , false, host,SDMMC_CALCR )) +dev_err (mmc_dev (host->mmc),"Failed to calibrate\n" ); } }
Greg Kroah-Hartman
maintainerPATCH 23/151 mmc: sdhci-of-at91: replace while loop with read_poll_timeout
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
commit 30d4b990ec644e8bd49ef0a2f074fabc0d189e53 upstream.
Replace while loop with read_poll_timeout().
--- drivers/mmc/host/sdhci-of-at91.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
drivers/mmc/host/sdhci-of-at91.c +5 -11
@@ -62,7 +62,6 @@ static void sdhci_at91_set_force_card_destatic void sdhci_at91_set_clock (struct sdhci_host *host,unsigned int clock) {u16 clk; -unsigned long timeout; host->mmc->actual_clock =0 ;
@@ -87,16 +86,11 @@ static void sdhci_at91_set_clock(structsdhci_writew (host, clk,SDHCI_CLOCK_CONTROL );/* Wait max 20 ms */ - timeout =20 ; -while (!((clk =sdhci_readw (host,SDHCI_CLOCK_CONTROL )) - &SDHCI_CLOCK_INT_STABLE )) { -if (timeout ==0 ) { -pr_err ("%s: Internal clock never stabilised.\n" , -mmc_hostname (host->mmc)); -return ; - } - timeout--; -mdelay (1 ); +if (read_poll_timeout (sdhci_readw, clk, (clk &SDHCI_CLOCK_INT_STABLE ), +1000 ,20000 , false, host,SDHCI_CLOCK_CONTROL )) { +pr_err ("%s: Internal clock never stabilised.\n" , +mmc_hostname (host->mmc)); +return ; } clk |=SDHCI_CLOCK_CARD_EN ;
Greg Kroah-Hartman
maintainerPATCH 24/151 fbdev: simplefb: fix Kconfig dependencies
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit ec7cc3f74b4236860ce612656aa5be7936d1c594 upstream.
Configurations with both CONFIG_FB_SIMPLE=y and CONFIG_DRM_SIMPLEDRM=m are allowed by Kconfig because the 'depends on !DRM_SIMPLEDRM' dependency does not disallow FB_SIMPLE as long as SIMPLEDRM is not built-in. This can however result in a build failure when cfb_fillrect() etc are then also in loadable modules:
x86_64-linux-ld: drivers/video/fbdev/simplefb.o:(.rodata+0x1f8): undefined reference to `cfb_fillrect'
x86_64-linux-ld: drivers/video/fbdev/simplefb.o:(.rodata+0x200): undefined reference to `cfb_copyarea'
x86_64-linux-ld: drivers/video/fbdev/simplefb.o:(.rodata+0x208): undefined reference to `cfb_imageblit'
To work around this, change FB_SIMPLE to be a 'tristate' symbol, which still allows both to be =m together, but not one of them to be =y if the other one is =m. If a distro kernel picks this configuration, it can be determined by local policy which of the two modules gets loaded. The 'of_chosen' export is needed as this is the first loadable module referencing it.
Alternatively, the Kconfig dependency could be changed to 'depends on DRM_SIMPLEDRM=n', which would forbid the configuration with both drivers.
--- drivers/of/base.c | 1 + drivers/video/fbdev/Kconfig | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/of/base.c +1 -0
@@ -36,6 +36,7 @@ LIST_HEAD(aliases_lookup);struct device_node *of_root;EXPORT_SYMBOL (of_root);struct device_node *of_chosen; +EXPORT_SYMBOL (of_chosen);struct device_node *of_aliases;struct device_node *of_stdout;static const char *of_stdout_options;
drivers/video/fbdev/Kconfig +3 -2
@@ -2191,8 +2191,9 @@ config FB_HYPERV This framebuffer driver supports Microsoft Hyper-V Synthetic Video. config FB_SIMPLE - bool "Simple framebuffer support" - depends on (FB = y) && !DRM_SIMPLEDRM + tristate "Simple framebuffer support" + depends on FB + depends on !DRM_SIMPLEDRM select FB_CFB_FILLRECT select FB_CFB_COPYAREA select FB_CFB_IMAGEBLIT
Greg Kroah-Hartman
maintainerPATCH 25/151 ovl: fix missing negative dentry check in ovl_rename()
In reply to Greg Kroah-HartmanFrom: Zheng Liang <[email protected]>
commit a295aef603e109a47af355477326bd41151765b6 upstream.
The following reproducer
mkdir lower upper work merge
touch lower/old
touch lower/new
mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge rm merge/new
mv merge/old merge/new & unlink upper/new
may result in this race:
PROCESS A:
rename("merge/old", "merge/new"); overwrite=true,ovl_lower_positive(old)=true, ovl_dentry_is_whiteout(new)=true -> flags |= RENAME_EXCHANGE
PROCESS B:
unlink("upper/new");
PROCESS A:
lookup newdentry in new_upperdir
call vfs_rename() with negative newdentry and RENAME_EXCHANGE
Fix by adding the missing check for negative newdentry.
--- fs/overlayfs/dir.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/overlayfs/dir.c +7 -3
@@ -1215,9 +1215,13 @@ static int ovl_rename(struct user_namesp goto out_dput; } }else { -if (!d_is_negative (newdentry) && - (!new_opaque || !ovl_is_whiteout (newdentry))) - goto out_dput; +if (!d_is_negative (newdentry)) { +if (!new_opaque || !ovl_is_whiteout (newdentry)) + goto out_dput; + }else { +if (flags &RENAME_EXCHANGE ) + goto out_dput; + } }if (olddentry == trap)
Greg Kroah-Hartman
maintainerPATCH 26/151 ovl: fix IOCB_DIRECT if underlying fs doesnt support direct IO
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit 1dc1eed46f9fa4cb8a07baa24fb44c96d6dd35c9 upstream.
Normally the check at open time suffices, but e.g loop device does set IOCB_DIRECT after doing its own checks (which are not sufficent for overlayfs).
Make sure we don't call the underlying filesystem read/write method with the IOCB_DIRECT if it's not supported.
--- fs/overlayfs/file.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
fs/overlayfs/file.c +14 -1
@@ -296,6 +296,12 @@ static ssize_t ovl_read_iter(struct kiocif (ret)return ret; + ret = -EINVAL ; +if (iocb->ki_flags &IOCB_DIRECT && + (!real.file->f_mapping->a_ops || + !real.file->f_mapping->a_ops->direct_IO)) + goto out_fdput; + old_cred =ovl_override_creds (file_inode (file)->i_sb);if (is_sync_kiocb (iocb)) { ret = vfs_iter_read(real.file, iter, &iocb->ki_pos,
@@ -320,7 +326,7 @@ static ssize_t ovl_read_iter(struct kioc out:revert_creds (old_cred);ovl_file_accessed (file); - +out_fdput:fdput (real);return ret;
@@ -349,6 +355,12 @@ static ssize_t ovl_write_iter(struct kioif (ret) goto out_unlock; + ret = -EINVAL ; +if (iocb->ki_flags &IOCB_DIRECT && + (!real.file->f_mapping->a_ops || + !real.file->f_mapping->a_ops->direct_IO)) + goto out_fdput; +if (!ovl_should_sync (OVL_FS (inode->i_sb))) ifl &= ~(IOCB_DSYNC |IOCB_SYNC );
@@ -384,6 +396,7 @@ static ssize_t ovl_write_iter(struct kio } out:revert_creds (old_cred); +out_fdput:fdput (real); out_unlock:
Greg Kroah-Hartman
maintainerPATCH 27/151 nfsd: fix error handling of register_pernet_subsys() in init_nfsd()
In reply to Greg Kroah-HartmanFrom: Patrick Ho <[email protected]>
commit 1d625050c7c2dd877e108e382b8aaf1ae3cfe1f4 upstream.
init_nfsd() should not unregister pernet subsys if the register fails but should instead unwind from the last successful operation which is register_filesystem().
Unregistering a failed register_pernet_subsys() call can result in a kernel GPF as revealed by programmatically injecting an error in register_pernet_subsys().
Verified the fix handled failure gracefully with no lingering nfsd entry in /proc/filesystems. This change was introduced by the commit bd5ae9288d64 ("nfsd: register pernet ops last, unregister first"), the original error handling logic was correct.
--- fs/nfsd/nfsctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfsctl.c +1 -1
@@ -1545,7 +1545,7 @@ static int __init init_nfsd(void) goto out_free_all;return 0 ; out_free_all: -unregister_pernet_subsys (&nfsd_net_ops); +unregister_filesystem (&nfsd_fs_type); out_free_exports:remove_proc_entry ("fs/nfs/exports" ,NULL );remove_proc_entry ("fs/nfs" ,NULL );
Greg Kroah-Hartman
maintainerPATCH 28/151 nfsd4: Handle the NFSv4 READDIR dircount hint being zero
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit f2e717d655040d632c9015f19aa4275f8b16e7f2 upstream.
RFC3530 notes that the 'dircount' field may be zero, in which case the recommendation is to ignore it, and only enforce the 'maxcount' field. In RFC5661, this recommendation to ignore a zero valued field becomes a requirement.
--- fs/nfsd/nfs4xdr.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
fs/nfsd/nfs4xdr.c +11 -8
@@ -3544,15 +3544,18 @@ nfsd4_encode_dirent(void *ccdv, const ch goto fail; cd->rd_maxcount -= entry_bytes;/* -* RFC 3530 14.2.24 describes rd_dircount as only a "hint", so -* let's always let through the first entry, at least: +* RFC 3530 14.2.24 describes rd_dircount as only a "hint", and +* notes that it could be zero. If it is zero, then the server +* should enforce only the rd_maxcount value. */ -if (!cd->rd_dircount) - goto fail; - name_and_cookie =4 +4 *XDR_QUADLEN (namlen) +8 ; -if (name_and_cookie > cd->rd_dircount && cd->cookie_offset) - goto fail; - cd->rd_dircount -=min (cd->rd_dircount, name_and_cookie); +if (cd->rd_dircount) { + name_and_cookie =4 +4 *XDR_QUADLEN (namlen) +8 ; +if (name_and_cookie > cd->rd_dircount && cd->cookie_offset) + goto fail; + cd->rd_dircount -=min (cd->rd_dircount, name_and_cookie); +if (!cd->rd_dircount) + cd->rd_maxcount =0 ; + } cd->cookie_offset = cookie_offset; skip_entry:
Greg Kroah-Hartman
maintainerPATCH 29/151 SUNRPC: fix sign error causing rpcsec_gss drops
In reply to Greg Kroah-HartmanFrom: J. Bruce Fields <[email protected]>
commit 2ba5acfb34957e8a7fe47cd78c77ca88e9cc2b03 upstream.
If sd_max is unsigned, then sd_max - GSS_SEQ_WIN is a very large number whenever sd_max is less than GSS_SEQ_WIN, and the comparison:
seq_num <= sd->sd_max - GSS_SEQ_WIN
in gss_check_seq_num is pretty much always true, even when that's clearly not what was intended.
This was causing pynfs to hang when using krb5, because pynfs uses zero as the initial gss sequence number. That's perfectly legal, but this logic error causes knfsd to drop the rpc in that case. Out-of-order sequence IDs in the first GSS_SEQ_WIN (128) calls will also cause this.
--- net/sunrpc/auth_gss/svcauth_gss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sunrpc/auth_gss/svcauth_gss.c +1 -1
@@ -643,7 +643,7 @@ static bool gss_check_seq_num(const stru }__set_bit (seq_num %GSS_SEQ_WIN , sd->sd_win); goto ok; - }else if (seq_num <= sd->sd_max -GSS_SEQ_WIN ) { + }else if (seq_num +GSS_SEQ_WIN <= sd->sd_max) { goto toolow; }if (__test_and_set_bit (seq_num %GSS_SEQ_WIN , sd->sd_win))
Greg Kroah-Hartman
maintainerPATCH 30/151 xen/balloon: fix cancelled balloon action
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
commit 319933a80fd4f07122466a77f93e5019d71be74c upstream.
In case a ballooning action is cancelled the new kernel thread handling the ballooning might end up in a busy loop.
Fix that by handling the cancelled action gracefully.
While at it introduce a short wait for the BP_WAIT case.
--- drivers/xen/balloon.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
drivers/xen/balloon.c +15 -6
@@ -491,12 +491,12 @@ static enum bp_state decrease_reservatio }/* -* Stop waiting if either state is not BP_EAGAIN and ballooning action is -* needed, or if the credit has changed while state is BP_EAGAIN. +* Stop waiting if either state is BP_DONE and ballooning action is +* needed, or if the credit has changed while state is not BP_DONE. */ static bool balloon_thread_cond (enum bp_state state,long credit) { -if (state !=BP_EAGAIN ) +if (state ==BP_DONE ) credit =0 ;return current_credit () != credit ||kthread_should_stop ();
@@ -516,10 +516,19 @@ static int balloon_thread(void *unused)set_freezable ();for (;;) { -if (state ==BP_EAGAIN ) - timeout = balloon_stats.schedule_delay *HZ ; -else +switch (state) { +case BP_DONE : +case BP_ECANCELED : timeout =3600 *HZ ; +break ; +case BP_EAGAIN : + timeout = balloon_stats.schedule_delay *HZ ; +break ; +case BP_WAIT : + timeout =HZ ; +break ; + } + credit =current_credit (); wait_event_freezable_timeout(balloon_thread_wq,
Greg Kroah-Hartman
maintainerPATCH 31/151 ARM: dts: omap3430-sdp: Fix NAND device node
In reply to Greg Kroah-HartmanFrom: Roger Quadros <[email protected]>
commit 80d680fdccba214e8106dc1aa33de5207ad75394 upstream.
Nand is on CS1 so reg properties first field should be 1 not 0.
--- arch/arm/boot/dts/omap3430-sdp.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/omap3430-sdp.dts +1 -1
@@ -101,7 +101,7 @@ nand@1,0 { compatible = "ti,omap2-nand"; - reg = <0 0 4>; /* CS0, offset 0, IO size 4 */ + reg = <1 0 4>; /* CS1, offset 0, IO size 4 */ interrupt-parent = <&gpmc>; interrupts = <0 IRQ_TYPE_NONE>, /* fifoevent */ <1 IRQ_TYPE_NONE>; /* termcount */
Greg Kroah-Hartman
maintainerPATCH 32/151 ARM: dts: imx6dl-yapp4: Fix lp5562 LED driver probe
In reply to Greg Kroah-HartmanFrom: Michal Vokáč <[email protected]>
commit 9b663b34c94a78f39fa2c7a8271b1f828b546e16 upstream.
Since the LED multicolor framework support was added in commit 92a81562e695 ("leds: lp55xx: Add multicolor framework support to lp55xx") LEDs on this platform stopped working.
Author of the framework attempted to accommodate this DT to the framework in commit b86d3d21cd4c ("ARM: dts: imx6dl-yapp4: Add reg property to the lp5562 channel node") but that is not sufficient. A color property is now required even if the multicolor framework is not used, otherwise the driver probe fails:
lp5562: probe of 1-0030 failed with error -22
Add the color property to fix this.
--- arch/arm/boot/dts/imx6dl-yapp4-common.dtsi | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm/boot/dts/imx6dl-yapp4-common.dtsi +5 -0
@@ -5,6 +5,7 @@ #include <dt-bindings/gpio/gpio.h> #include <dt-bindings/interrupt-controller/irq.h> #include <dt-bindings/input/input.h> +#include <dt-bindings/leds/common.h> #include <dt-bindings/pwm/pwm.h> / {
@@ -277,6 +278,7 @@ led-cur = /bits/ 8 <0x20>; max-cur = /bits/ 8 <0x60>; reg = <0>; + color = <LED_COLOR_ID_RED>; }; chan@1 {
@@ -284,6 +286,7 @@ led-cur = /bits/ 8 <0x20>; max-cur = /bits/ 8 <0x60>; reg = <1>; + color = <LED_COLOR_ID_GREEN>; }; chan@2 {
@@ -291,6 +294,7 @@ led-cur = /bits/ 8 <0x20>; max-cur = /bits/ 8 <0x60>; reg = <2>; + color = <LED_COLOR_ID_BLUE>; }; chan@3 {
@@ -298,6 +302,7 @@ led-cur = /bits/ 8 <0x0>; max-cur = /bits/ 8 <0x0>; reg = <3>; + color = <LED_COLOR_ID_WHITE>; }; };
Greg Kroah-Hartman
maintainerPATCH 33/151 ARM: dts: qcom: apq8064: use compatible which contains chipid
In reply to Greg Kroah-HartmanFrom: David Heidelberg <[email protected]>
commit f5c03f131dae3f06d08464e6157dd461200f78d9 upstream.
Also resolves these kernel warnings for APQ8064:
adreno 4300000.adreno-3xx: Using legacy qcom,chipid binding! adreno 4300000.adreno-3xx: Use compatible qcom,adreno-320.2 instead.
Tested on Nexus 7 2013, no functional changes.
--- arch/arm/boot/dts/qcom-apq8064.dtsi | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/arm/boot/dts/qcom-apq8064.dtsi +1 -2
@@ -1148,7 +1148,7 @@ }; gpu: adreno-3xx@4300000 { - compatible = "qcom,adreno-3xx"; + compatible = "qcom,adreno-320.2", "qcom,adreno"; reg = <0x04300000 0x20000>; reg-names = "kgsl_3d0_reg_memory"; interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
@@ -1163,7 +1163,6 @@ <&mmcc GFX3D_AHB_CLK>, <&mmcc GFX3D_AXI_CLK>, <&mmcc MMSS_IMEM_AHB_CLK>; - qcom,chipid = <0x03020002>; iommus = <&gfx3d 0 &gfx3d 1
Greg Kroah-Hartman
maintainerPATCH 34/151 scsi: ufs: core: Fix task management completion
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
commit f5ef336fd2e4c36dedae4e7ca66cf5349d6fda62 upstream.
The UFS driver uses blk_mq_tagset_busy_iter() when identifying task management requests to complete, however blk_mq_tagset_busy_iter() doesn't work.
blk_mq_tagset_busy_iter() only iterates requests dispatched by the block layer. That appears as if it might have started since commit 37f4a24c2469 ("blk-mq: centralise related handling into blk_mq_get_driver_tag") which removed 'data->hctx->tags->rqs[rq->tag] = rq' from blk_mq_rq_ctx_init() which gets called:
blk_get_request
blk_mq_alloc_request
__blk_mq_alloc_request
blk_mq_rq_ctx_init
Since UFS task management requests are not dispatched by the block layer, hctx->tags->rqs[rq->tag] remains NULL, and since blk_mq_tagset_busy_iter() relies on finding requests using hctx->tags->rqs[rq->tag], UFS task management requests are never found by blk_mq_tagset_busy_iter().
By using blk_mq_tagset_busy_iter(), the UFS driver was relying on internal details of the block layer, which was fragile and subsequently got broken. Fix by removing the use of blk_mq_tagset_busy_iter() and having the driver keep track of task management requests.
--- drivers/scsi/ufs/ufshcd.c | 52 +++++++++++++++++++--------------------------- drivers/scsi/ufs/ufshcd.h | 1 2 files changed, 23 insertions(+), 30 deletions(-)
drivers/scsi/ufs/ufshcd.c +22 -30
@@ -6365,27 +6365,6 @@ static irqreturn_t ufshcd_check_errors(sreturn retval; } -struct ctm_info { -struct ufs_hba *hba; -unsigned long pending; -unsigned int ncpl; -}; - -static bool ufshcd_compl_tm (struct request *req,void *priv,bool reserved) -{ -struct ctm_info *const ci = priv; -struct completion *c; - -WARN_ON_ONCE (reserved); -if (test_bit (req->tag, &ci->pending)) -return true; - ci->ncpl++; - c = req->end_io_data; -if (c) -complete (c); -return true; -} -/** * ufshcd_tmc_handler - handle task management function completion * @hba: per adapter instance
@@ -6396,18 +6375,24 @@ static bool ufshcd_compl_tm(struct reque*/ static irqreturn_t ufshcd_tmc_handler (struct ufs_hba *hba) { -unsigned long flags; -struct request_queue *q = hba->tmf_queue; -struct ctm_info ci = { - .hba = hba, - }; +unsigned long flags, pending, issued; +irqreturn_t ret =IRQ_NONE ; +int tag; + + pending =ufshcd_readl (hba,REG_UTP_TASK_REQ_DOOR_BELL );spin_lock_irqsave (hba->host->host_lock, flags); - ci.pending =ufshcd_readl (hba,REG_UTP_TASK_REQ_DOOR_BELL ); -blk_mq_tagset_busy_iter (q->tag_set, ufshcd_compl_tm, &ci); + issued = hba->outstanding_tasks & ~pending; +for_each_set_bit (tag, &issued, hba->nutmrs) { +struct request *req = hba->tmf_rqs[tag]; +struct completion *c = req->end_io_data; + +complete (c); + ret =IRQ_HANDLED ; + }spin_unlock_irqrestore (hba->host->host_lock, flags); -return ci.ncpl ?IRQ_HANDLED :IRQ_NONE ; +return ret; }/**
@@ -6530,9 +6515,9 @@ static int __ufshcd_issue_tm_cmd(structufshcd_hold (hba, false);spin_lock_irqsave (host->host_lock, flags); -blk_mq_start_request (req); task_tag = req->tag; + hba->tmf_rqs[req->tag] = req; treq->upiu_req.req_header.dword_0 |=cpu_to_be32 (task_tag);memcpy (hba->utmrdl_base_addr + task_tag, treq,sizeof (*treq));
@@ -6576,6 +6561,7 @@ static int __ufshcd_issue_tm_cmd(struct }spin_lock_irqsave (hba->host->host_lock, flags); + hba->tmf_rqs[req->tag] =NULL ;__clear_bit (task_tag, &hba->outstanding_tasks);spin_unlock_irqrestore (hba->host->host_lock, flags);
@@ -9568,6 +9554,12 @@ int ufshcd_init(struct ufs_hba *hba, voi err =PTR_ERR (hba->tmf_queue); goto free_tmf_tag_set; } + hba->tmf_rqs =devm_kcalloc (hba->dev, hba->nutmrs, +sizeof (*hba->tmf_rqs),GFP_KERNEL ); +if (!hba->tmf_rqs) { + err = -ENOMEM ; + goto free_tmf_queue; + }/* Reset the attached device */ ufshcd_device_reset (hba);
drivers/scsi/ufs/ufshcd.h +1 -0
@@ -780,6 +780,7 @@ struct ufs_hba {struct blk_mq_tag_set tmf_tag_set;struct request_queue *tmf_queue; +struct request **tmf_rqs;struct uic_command *active_uic_cmd;struct mutex uic_cmd_mutex;
Greg Kroah-Hartman
maintainerPATCH 35/151 riscv: Flush current cpu icache before other cpus
In reply to Greg Kroah-HartmanFrom: Alexandre Ghiti <[email protected]>
commit bb8958d5dc79acbd071397abb57b8756375fe1ce upstream.
On SiFive Unmatched, I recently fell onto the following BUG when booting:
[ 0.000000] ftrace: allocating 36610 entries in 144 pages [ 0.000000] Oops - illegal instruction [#1] [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.13.1+ #5 [ 0.000000] Hardware name: SiFive HiFive Unmatched A00 (DT) [ 0.000000] epc : riscv_cpuid_to_hartid_mask+0x6/0xae [ 0.000000] ra : __sbi_rfence_v02+0xc8/0x10a [ 0.000000] epc : ffffffff80007240 ra : ffffffff80009964 sp : ffffffff81803e10 [ 0.000000] gp : ffffffff81a1ea70 tp : ffffffff8180f500 t0 : ffffffe07fe30000 [ 0.000000] t1 : 0000000000000004 t2 : 0000000000000000 s0 : ffffffff81803e60 [ 0.000000] s1 : 0000000000000000 a0 : ffffffff81a22238 a1 : ffffffff81803e10 [ 0.000000] a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000 [ 0.000000] a5 : 0000000000000000 a6 : ffffffff8000989c a7 : 0000000052464e43 [ 0.000000] s2 : ffffffff81a220c8 s3 : 0000000000000000 s4 : 0000000000000000 [ 0.000000] s5 : 0000000000000000 s6 : 0000000200000100 s7 : 0000000000000001 [ 0.000000] s8 : ffffffe07fe04040 s9 : ffffffff81a22c80 s10: 0000000000001000 [ 0.000000] s11: 0000000000000004 t3 : 0000000000000001 t4 : 0000000000000008 [ 0.000000] t5 : ffffffcf04000808 t6 : ffffffe3ffddf188 [ 0.000000] status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000002 [ 0.000000] [<ffffffff80007240>] riscv_cpuid_to_hartid_mask+0x6/0xae [ 0.000000] [<ffffffff80009474>] sbi_remote_fence_i+0x1e/0x26 [ 0.000000] [<ffffffff8000b8f4>] flush_icache_all+0x12/0x1a [ 0.000000] [<ffffffff8000666c>] patch_text_nosync+0x26/0x32 [ 0.000000] [<ffffffff8000884e>] ftrace_init_nop+0x52/0x8c [ 0.000000] [<ffffffff800f051e>] ftrace_process_locs.isra.0+0x29c/0x360 [ 0.000000] [<ffffffff80a0e3c6>] ftrace_init+0x80/0x130 [ 0.000000] [<ffffffff80a00f8c>] start_kernel+0x5c4/0x8f6 [ 0.000000] ---[ end trace f67eb9af4d8d492b ]--- [ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task! [ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
While ftrace is looping over a list of addresses to patch, it always failed when patching the same function: riscv_cpuid_to_hartid_mask. Looking at the backtrace, the illegal instruction is encountered in this same function. However, patch_text_nosync, after patching the instructions, calls flush_icache_range. But looking at what happens in this function:
flush_icache_range -> flush_icache_all
-> sbi_remote_fence_i
-> __sbi_rfence_v02
-> riscv_cpuid_to_hartid_maskThe icache and dcache of the current cpu are never synchronized between the patching of riscv_cpuid_to_hartid_mask and calling this same function.
So fix this by flushing the current cpu's icache before asking for the other cpus to do the same.
--- arch/riscv/mm/cacheflush.c | 2 ++ 1 file changed, 2 insertions(+)
arch/riscv/mm/cacheflush.c +2 -0
@@ -16,6 +16,8 @@ static void ipi_remote_fence_i(void *infvoid flush_icache_all (void ) { +local_flush_icache_all (); +if (IS_ENABLED (CONFIG_RISCV_SBI ))sbi_remote_fence_i (NULL );else
Greg Kroah-Hartman
maintainerPATCH 36/151 bus: ti-sysc: Add break in switch statement in sysc_init_soc()
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit e879f855e590b40fe3c79f2fbd8f65ca3c724120 ]
After commit a6d90e9f2232 ("bus: ti-sysc: AM3: RNG is GP only"), clang with -Wimplicit-fallthrough enabled warns:
drivers/bus/ti-sysc.c:2958:3: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough]
default:
^
drivers/bus/ti-sysc.c:2958:3: note: insert 'break;' to avoid
fall-through
default:
^
break;1 warning generated.
Clang's version of this warning is a little bit more pedantic than GCC's. Add the missing break to satisfy it to match what has been done all over the kernel tree.
--- drivers/bus/ti-sysc.c | 1 + 1 file changed, 1 insertion(+)
drivers/bus/ti-sysc.c +1 -0
@@ -2955,6 +2955,7 @@ static int sysc_init_soc(struct sysc *ddata)break ;case SOC_AM3 :sysc_add_disabled (0x48310000 );/* rng */ +break ;default :break ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 37/151 soc: qcom: socinfo: Fixed argument passed to platform_set_data()
In reply to Greg Kroah-HartmanFrom: Antonio Martorana <[email protected]>
[ Upstream commit 9c5a4ec69bbf5951f84ada9e0db9c6c50de61808 ]
Set qcom_socinfo pointer as data being stored instead of pointer to soc_device structure. Aligns with future calls to platform_get_data() which expects qcom_socinfo pointer.
--- drivers/soc/qcom/socinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/socinfo.c +1 -1
@@ -628,7 +628,7 @@ static int qcom_socinfo_probe(struct platform_device *pdev)/* Feed the soc specific unique data into entropy pool */ add_device_randomness (info, item_size); -platform_set_drvdata (pdev, qs->soc_dev); +platform_set_drvdata (pdev, qs);return 0 ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 38/151 ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI PLL reference
In reply to Greg Kroah-HartmanFrom: Marijn Suijten <[email protected]>
[ Upstream commit f1db21c315f4b4f8c3fbea56aac500673132d317 ]
The 28NM DSI PLL driver for msm8960 calculates with a 27MHz reference clock and should hence use PXO, not CXO which runs at 19.2MHz.
Note that none of the DSI PHY/PLL drivers currently use this "ref" clock; they all rely on (sometimes inexistant) global clock names and usually function normally without a parent clock. This discrepancy will be corrected in a future patch, for which this change needs to be in place first.
--- arch/arm/boot/dts/qcom-apq8064.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/qcom-apq8064.dtsi +2 -2
@@ -198,7 +198,7 @@ clock-frequency = <19200000>; }; - pxo_board { + pxo_board: pxo_board { compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <27000000>;
@@ -1305,7 +1305,7 @@ reg-names = "dsi_pll", "dsi_phy", "dsi_phy_regulator"; clock-names = "iface_clk", "ref"; clocks = <&mmcc DSI_M_AHB_CLK>, - <&cxo_board>; + <&pxo_board>; };
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 39/151 Revert "arm64: dts: qcom: sc7280: Fixup the cpufreq node"
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
[ Upstream commit a48c730a4e0bf480bcde12d795a9cd6f9ef14d1e ]
This reverts commit 11e03d692101e484df9322f892a8b6e111a82bfd.
As per discussion [1] the patch shouldn't have landed. Let's revert.
[1] https://lore.kernel.org/r/[email protected]/
--- arch/arm64/boot/dts/qcom/sc7280.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/qcom/sc7280.dtsi +3 -3
@@ -1437,9 +1437,9 @@ cpufreq_hw: cpufreq@18591000 { compatible = "qcom,cpufreq-epss"; - reg = <0 0x18591100 0 0x900>, - <0 0x18592100 0 0x900>, - <0 0x18593100 0 0x900>; + reg = <0 0x18591000 0 0x1000>, + <0 0x18592000 0 0x1000>, + <0 0x18593000 0 0x1000>; clocks = <&rpmhcc RPMH_CXO_CLK>, <&gcc GCC_GPLL0>; clock-names = "xo", "alternate"; #freq-domain-cells = <1>;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 40/151 ARM: at91: pm: do not panic if ram controllers are not enabled
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit 1605de1b3ca66e3eddbca4b3c353c13c26476fe2 ]
In case PM is enabled but there is no RAM controller information in DT the code will panic. Avoid such scenarios by not initializing platform specific PM code in case RAM controller is not provided via DT.
--- arch/arm/mach-at91/pm.c | 58 +++++++++++++++++++++++++++++++++-------- 1 file changed, 47 insertions(+), 11 deletions(-)
arch/arm/mach-at91/pm.c +47 -11
@@ -514,18 +514,22 @@ static const struct of_device_id ramc_ids[] __initconst = { {/*sentinel*/ } }; -static __init void at91_dt_ramc (void ) +static __init int at91_dt_ramc (void ) {struct device_node *np;const struct of_device_id *of_id;int idx =0 ;void *standby =NULL ;const struct ramc_info *ramc; +int ret;for_each_matching_node_and_match (np, ramc_ids, &of_id) { soc_pm.data.ramc[idx] =of_iomap (np,0 ); -if (!soc_pm.data.ramc[idx]) -panic (pr_fmt ("unable to map ramc[%d] cpu registers\n" ), idx); +if (!soc_pm.data.ramc[idx]) { +pr_err ("unable to map ramc[%d] cpu registers\n" , idx); + ret = -ENOMEM ; + goto unmap_ramc; + } ramc = of_id->data;if (!standby)
@@ -535,15 +539,26 @@ static __init void at91_dt_ramc(void) idx++; } -if (!idx) -panic (pr_fmt ("unable to find compatible ram controller node in dtb\n" )); +if (!idx) { +pr_err ("unable to find compatible ram controller node in dtb\n" ); + ret = -ENODEV ; + goto unmap_ramc; + }if (!standby) {pr_warn ("ramc no standby function available\n" ); -return ; +return 0 ; } at91_cpuidle_device.dev.platform_data = standby; + +return 0 ; + +unmap_ramc: +while (idx) +iounmap (soc_pm.data.ramc[--idx]); + +return ret; }static void at91rm9200_idle (void )
@@ -866,6 +881,8 @@ static void __init at91_pm_init(void (*pm_idle)(void))void __init at91rm9200_pm_init (void ) { +int ret; +if (!IS_ENABLED (CONFIG_SOC_AT91RM9200 ))return ;
@@ -877,7 +894,9 @@ void __init at91rm9200_pm_init(void) soc_pm.data.standby_mode =AT91_PM_STANDBY ; soc_pm.data.suspend_mode =AT91_PM_ULP0 ; -at91_dt_ramc (); + ret =at91_dt_ramc (); +if (ret) +return ;/* * AT91RM9200 SDRAM low-power mode cannot be used with self-refresh.
@@ -892,13 +911,17 @@ void __init sam9x60_pm_init(void)static const int modes[]__initconst = {AT91_PM_STANDBY ,AT91_PM_ULP0 ,AT91_PM_ULP0_FAST ,AT91_PM_ULP1 , }; +int ret;if (!IS_ENABLED (CONFIG_SOC_SAM9X60 ))return ;at91_pm_modes_validate (modes,ARRAY_SIZE (modes));at91_pm_modes_init (); -at91_dt_ramc (); + ret =at91_dt_ramc (); +if (ret) +return ; +at91_pm_init (NULL ); soc_pm.ws_ids = sam9x60_ws_ids;
@@ -907,6 +930,8 @@ void __init sam9x60_pm_init(void)void __init at91sam9_pm_init (void ) { +int ret; +if (!IS_ENABLED (CONFIG_SOC_AT91SAM9 ))return ;
@@ -918,7 +943,10 @@ void __init at91sam9_pm_init(void) soc_pm.data.standby_mode =AT91_PM_STANDBY ; soc_pm.data.suspend_mode =AT91_PM_ULP0 ; -at91_dt_ramc (); + ret =at91_dt_ramc (); +if (ret) +return ; +at91_pm_init (at91sam9_idle); }
@@ -927,12 +955,16 @@ void __init sama5_pm_init(void)static const int modes[]__initconst = {AT91_PM_STANDBY ,AT91_PM_ULP0 ,AT91_PM_ULP0_FAST , }; +int ret;if (!IS_ENABLED (CONFIG_SOC_SAMA5 ))return ;at91_pm_modes_validate (modes,ARRAY_SIZE (modes)); -at91_dt_ramc (); + ret =at91_dt_ramc (); +if (ret) +return ; +at91_pm_init (NULL ); }
@@ -942,13 +974,17 @@ void __init sama5d2_pm_init(void)AT91_PM_STANDBY ,AT91_PM_ULP0 ,AT91_PM_ULP0_FAST ,AT91_PM_ULP1 , AT91_PM_BACKUP, }; +int ret;if (!IS_ENABLED (CONFIG_SOC_SAMA5D2 ))return ;at91_pm_modes_validate (modes,ARRAY_SIZE (modes));at91_pm_modes_init (); -at91_dt_ramc (); + ret =at91_dt_ramc (); +if (ret) +return ; +at91_pm_init (NULL ); soc_pm.ws_ids = sama5d2_ws_ids;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 41/151 iwlwifi: mvm: Fix possible NULL dereference
In reply to Greg Kroah-HartmanFrom: Ilan Peer <[email protected]>
[ Upstream commit 24d5f16e407b75bc59d5419b957a9cab423b2681 ]
In __iwl_mvm_remove_time_event() check that 'te_data->vif' is NULL before dereferencing it.
--- drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +2 -1
@@ -652,12 +652,13 @@ static bool __iwl_mvm_remove_time_event(struct iwl_mvm *mvm, u32 *uid) {u32 id; -struct iwl_mvm_vif *mvmvif =iwl_mvm_vif_from_mac80211 (te_data->vif); +struct iwl_mvm_vif *mvmvif;enum nl80211_iftype iftype;if (!te_data->vif)return false; + mvmvif =iwl_mvm_vif_from_mac80211 (te_data->vif); iftype = te_data->vif->type;/*
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 42/151 soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment
In reply to Greg Kroah-HartmanFrom: Shawn Guo <[email protected]>
[ Upstream commit 833d51d7c66d6708abbc02398892b96b950167b9 ]
PT_LOAD type denotes that the segment should be loaded into the final firmware memory region. Hash segment is not one such, because it's only needed for PAS init and shouldn't be in the final firmware memory region. That's why mdt_phdr_valid() explicitly reject non PT_LOAD segment and hash segment. This actually makes the hash segment type check in qcom_mdt_read_metadata() unnecessary and redundant. For a hash segment, it won't be loaded into firmware memory region anyway, due to the QCOM_MDT_TYPE_HASH check in mdt_phdr_valid(), even if it has a PT_LOAD type for some reason (misusing or abusing?).
Some firmware files on Sony phones are such examples, e.g WCNSS firmware of Sony Xperia M4 Aqua phone. The type of hash segment is just PT_LOAD. Drop the unnecessary hash segment type check in qcom_mdt_read_metadata() to fix firmware loading failure on these phones, while hash segment is still kept away from the final firmware memory region.
--- drivers/soc/qcom/mdt_loader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/mdt_loader.c +1 -1
@@ -98,7 +98,7 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len)if (ehdr->e_phnum <2 )return ERR_PTR (-EINVAL ); -if (phdrs[0 ].p_type ==PT_LOAD || phdrs[1 ].p_type ==PT_LOAD ) +if (phdrs[0 ].p_type ==PT_LOAD )return ERR_PTR (-EINVAL );if ((phdrs[1 ].p_flags &QCOM_MDT_TYPE_MASK ) !=QCOM_MDT_TYPE_HASH )
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 43/151 ARM: dts: imx: Add missing pinctrl-names for panel on M53Menlo
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit c8c1efe14a4aadcfe93a158b1272e48298d2de15 ]
The panel already contains pinctrl-0 phandle, but it is missing the default pinctrl-names property, so the pin configuration is ignored. Fill in the missing pinctrl-names property, so the pin configuration is applied.
--- arch/arm/boot/dts/imx53-m53menlo.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/imx53-m53menlo.dts +1 -0
@@ -56,6 +56,7 @@ panel { compatible = "edt,etm0700g0dh6"; pinctrl-0 = <&pinctrl_display_gpio>; + pinctrl-names = "default"; enable-gpios = <&gpio6 0 GPIO_ACTIVE_HIGH>; port {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 44/151 ARM: dts: imx: Fix USB host power regulator polarity on M53Menlo
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 5c187e2eb3f92daa38cb3d4ab45e1107ea34108e ]
The MIC2025 switch input signal nEN is active low, describe it as such in the DT. The previous change to this regulator polarity was incorrectly influenced by broken quirks in gpiolib-of.c, which is now long fixed. So fix this regulator polarity setting here once and for all.
--- arch/arm/boot/dts/imx53-m53menlo.dts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/arm/boot/dts/imx53-m53menlo.dts +1 -2
@@ -77,8 +77,7 @@ regulator-name = "vbus"; regulator-min-microvolt = <5000000>; regulator-max-microvolt = <5000000>; - gpio = <&gpio1 2 GPIO_ACTIVE_HIGH>; - enable-active-high; + gpio = <&gpio1 2 0>; }; };
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 45/151 ARM: dts: imx6qdl-pico: Fix Ethernet support
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
[ Upstream commit 450e7fe9b1b3c90eeed74a2fe0eeb13a7b57f3da ]
Currently, it is no longer possible to retrieve a DHCP address on the imx6qdl-pico board.
This issue has been exposed by commit f5d9aa79dfdf ("ARM: imx6q:
remove clk-out fixup for the Atheros AR8031 and AR8035 PHYs").
Fix it by describing the qca,clk-out-frequency property as suggested by the commit above.
--- arch/arm/boot/dts/imx6qdl-pico.dtsi | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/arm/boot/dts/imx6qdl-pico.dtsi +11 -0
@@ -176,7 +176,18 @@ pinctrl-0 = <&pinctrl_enet>; phy-mode = "rgmii-id"; phy-reset-gpios = <&gpio1 26 GPIO_ACTIVE_LOW>; + phy-handle = <&phy>; status = "okay"; + + mdio { + #address-cells = <1>; + #size-cells = <0>; + + phy: ethernet-phy@1 { + reg = <1>; + qca,clk-out-frequency = <125000000>; + }; + }; }; &hdmi {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 46/151 PCI: hv: Fix sleep while in non-sleep context when removing child devices from the bus
In reply to Greg Kroah-HartmanFrom: Long Li <[email protected]>
[ Upstream commit 41608b64b10b80fe00dd253cd8326ec8ad85930f ]
In hv_pci_bus_exit, the code is holding a spinlock while calling pci_destroy_slot(), which takes a mutex.
This is not safe for spinlock. Fix this by moving the children to be deleted to a list on the stack, and removing them after spinlock is released.
--- drivers/pci/controller/pci-hyperv.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/pci/controller/pci-hyperv.c +10 -3
@@ -3229,9 +3229,17 @@ static int hv_pci_bus_exit(struct hv_device *hdev, bool keep_devs)return 0 ;if (!keep_devs) { -/* Delete any children which might still exist. */ +struct list_head removed; + +/* Move all present children to the list on stack */ +INIT_LIST_HEAD (&removed);spin_lock_irqsave (&hbus->device_list_lock, flags); -list_for_each_entry_safe (hpdev, tmp, &hbus->children, list_entry) { +list_for_each_entry_safe (hpdev, tmp, &hbus->children, list_entry) +list_move_tail (&hpdev->list_entry, &removed); +spin_unlock_irqrestore (&hbus->device_list_lock, flags); + +/* Remove all children in the list */ +list_for_each_entry_safe (hpdev, tmp, &removed, list_entry) {list_del (&hpdev->list_entry);if (hpdev->pci_slot)pci_destroy_slot (hpdev->pci_slot);
@@ -3239,7 +3247,6 @@ static int hv_pci_bus_exit(struct hv_device *hdev, bool keep_devs)put_pcichild (hpdev);put_pcichild (hpdev); } -spin_unlock_irqrestore (&hbus->device_list_lock, flags); } ret =hv_send_resources_released (hdev);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 47/151 ath5k: fix building with LEDS=m
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit fb8c3a3c52400512fc8b3b61150057b888c30b0d ]
Randconfig builds still show a failure for the ath5k driver, similar to the one that was fixed for ath9k earlier:
WARNING: unmet direct dependencies detected for MAC80211_LEDS
Depends on [n]: NET [=y] && WIRELESS [=y] && MAC80211 [=y] && (LEDS_CLASS [=m]=y || LEDS_CLASS [=m]=MAC80211 [=y]) Selected by [m]:
- ATH5K [=m] && NETDEVICES [=y] && WLAN [=y] && WLAN_VENDOR_ATH [=y] && (PCI [=y] || ATH25) && MAC80211 [=y]net/mac80211/led.c: In function 'ieee80211_alloc_led_names':net/mac80211/led.c:34:22: error: 'struct led_trigger' has no member named 'name'
34 | local->rx_led.name = kasprintf(GFP_KERNEL, "%srx",
| ^
Copying the same logic from my ath9k patch makes this one work as well, stubbing out the calls to the LED subsystem.
--- drivers/net/wireless/ath/ath5k/Kconfig | 4 +--- drivers/net/wireless/ath/ath5k/led.c | 10 ++++++---- 2 files changed, 7 insertions(+), 7 deletions(-)
drivers/net/wireless/ath/ath5k/Kconfig +1 -3
@@ -3,9 +3,7 @@ config ATH5K tristate "Atheros 5xxx wireless cards support" depends on (PCI || ATH25) && MAC80211 select ATH_COMMON - select MAC80211_LEDS - select LEDS_CLASS - select NEW_LEDS + select MAC80211_LEDS if LEDS_CLASS=y || LEDS_CLASS=MAC80211 select ATH5K_AHB if ATH25 select ATH5K_PCI if !ATH25 help
drivers/net/wireless/ath/ath5k/led.c +6 -4
@@ -89,7 +89,8 @@ static const struct pci_device_id ath5k_led_devices[] = {void ath5k_led_enable (struct ath5k_hw *ah) { -if (test_bit (ATH_STAT_LEDSOFT , ah->status)) { +if (IS_ENABLED (CONFIG_MAC80211_LEDS ) && +test_bit (ATH_STAT_LEDSOFT , ah->status)) {ath5k_hw_set_gpio_output (ah, ah->led_pin);ath5k_led_off (ah); }
@@ -104,7 +105,8 @@ static void ath5k_led_on(struct ath5k_hw *ah)void ath5k_led_off (struct ath5k_hw *ah) { -if (!test_bit (ATH_STAT_LEDSOFT , ah->status)) +if (!IS_ENABLED (CONFIG_MAC80211_LEDS ) || + !test_bit (ATH_STAT_LEDSOFT , ah->status))return ;ath5k_hw_set_gpio (ah, ah->led_pin, !ah->led_on); }
@@ -146,7 +148,7 @@ ath5k_register_led(struct ath5k_hw *ah, struct ath5k_led *led,static void ath5k_unregister_led (struct ath5k_led *led) { -if (!led->ah) +if (!IS_ENABLED (CONFIG_MAC80211_LEDS ) || !led->ah)return ;led_classdev_unregister (&led->led_dev);ath5k_led_off (led->ah);
@@ -169,7 +171,7 @@ int ath5k_init_leds(struct ath5k_hw *ah)char name[ATH5K_LED_MAX_NAME_LEN +1 ];const struct pci_device_id *match; -if (!ah->pdev) +if (!IS_ENABLED (CONFIG_MAC80211_LEDS ) || !ah->pdev)return 0 ;#ifdef CONFIG_ATH5K_AHB
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 48/151 arm64: dts: qcom: pm8150: use qcom,pm8998-pon binding
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit a153d317168aa3d61a204fadc85bac3995381d33 ]
Change pm8150 to use the qcom,pm8998-pon compatible string for the pon in order to pass reboot mode properly.
--- arch/arm64/boot/dts/qcom/pm8150.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/pm8150.dtsi +1 -1
@@ -48,7 +48,7 @@ #size-cells = <0>; pon: power-on@800 { - compatible = "qcom,pm8916-pon"; + compatible = "qcom,pm8998-pon"; reg = <0x0800>; pon_pwrkey: pwrkey {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 49/151 xtensa: use CONFIG_USE_OF instead of CONFIG_OF
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit d67ed2510d28a1eb33171010d35cf52178cfcbdd ]
CONFIG_OF can be set by a randconfig or by a user -- without setting the early flattree option (OF_EARLY_FLATTREE). This causes build errors. However, if randconfig or a user sets USE_OF in the Xtensa config, the right kconfig symbols are set to fix the build.
Fixes these build errors:
../arch/xtensa/kernel/setup.c:67:19: error: ‘__dtb_start’ undeclared here (not in a function); did you mean ‘dtb_start’?
67 | void *dtb_start = __dtb_start;
| ^~~~~~~~~~~../arch/xtensa/kernel/setup.c: In function 'xtensa_dt_io_area':../arch/xtensa/kernel/setup.c:201:14: error: implicit declaration of function 'of_flat_dt_is_compatible'; did you mean 'of_machine_is_compatible'? [-Werror=implicit-function-declaration]
201 | if (!of_flat_dt_is_compatible(node, "simple-bus"))../arch/xtensa/kernel/setup.c:204:18: error: implicit declaration of function 'of_get_flat_dt_prop' [-Werror=implicit-function-declaration]
204 | ranges = of_get_flat_dt_prop(node, "ranges", &len);../arch/xtensa/kernel/setup.c:204:16: error: assignment to 'const __be32 *' {aka 'const unsigned int *'} from 'int' makes pointer from integer without a cast [-Werror=int-conversion]
204 | ranges = of_get_flat_dt_prop(node, "ranges", &len);
| ^../arch/xtensa/kernel/setup.c: In function 'early_init_devtree':../arch/xtensa/kernel/setup.c:228:9: error: implicit declaration of function 'early_init_dt_scan'; did you mean 'early_init_devtree'? [-Werror=implicit-function-declaration]
228 | early_init_dt_scan(params);../arch/xtensa/kernel/setup.c:229:9: error: implicit declaration of function 'of_scan_flat_dt' [-Werror=implicit-function-declaration]
229 | of_scan_flat_dt(xtensa_dt_io_area, NULL);
xtensa-elf-ld: arch/xtensa/mm/mmu.o:(.text+0x0): undefined reference to `xtensa_kio_paddr'
--- arch/xtensa/include/asm/kmem_layout.h | 2 +- arch/xtensa/kernel/setup.c | 12 ++++++------ arch/xtensa/mm/mmu.c | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-)
arch/xtensa/include/asm/kmem_layout.h +1 -1
@@ -78,7 +78,7 @@#endif #define XCHAL_KIO_SIZE 0x10000000 -#if (!XCHAL_HAVE_PTP_MMU ||XCHAL_HAVE_SPANNING_WAY ) && defined(CONFIG_OF ) +#if (!XCHAL_HAVE_PTP_MMU ||XCHAL_HAVE_SPANNING_WAY ) && defined(CONFIG_USE_OF )#define XCHAL_KIO_PADDR xtensa_get_kio_paddr()#ifndef __ASSEMBLY__extern unsigned long xtensa_kio_paddr;
arch/xtensa/kernel/setup.c +6 -6
@@ -63,7 +63,7 @@ extern unsigned long initrd_end;extern int initrd_below_start_ok;#endif -#ifdef CONFIG_OF +#ifdef CONFIG_USE_OF void *dtb_start = __dtb_start;#endif
@@ -125,7 +125,7 @@ __tagtable(BP_TAG_INITRD, parse_tag_initrd);#endif /* CONFIG_BLK_DEV_INITRD */ -#ifdef CONFIG_OF +#ifdef CONFIG_USE_OF static int __init parse_tag_fdt (const bp_tag_t *tag) {
@@ -135,7 +135,7 @@ static int __init parse_tag_fdt(const bp_tag_t *tag)__tagtable (BP_TAG_FDT , parse_tag_fdt); -#endif /* CONFIG_OF */ +#endif /* CONFIG_USE_OF */ static int __init parse_tag_cmdline (const bp_tag_t * tag) {
@@ -183,7 +183,7 @@ static int __init parse_bootparam(const bp_tag_t *tag) }#endif -#ifdef CONFIG_OF +#ifdef CONFIG_USE_OF #if !XCHAL_HAVE_PTP_MMU ||XCHAL_HAVE_SPANNING_WAY unsigned long xtensa_kio_paddr =XCHAL_KIO_DEFAULT_PADDR ;
@@ -232,7 +232,7 @@ void __init early_init_devtree(void *params) strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE); } -#endif /* CONFIG_OF */ +#endif /* CONFIG_USE_OF */ /* * Initialize architecture. (Early stage)
@@ -253,7 +253,7 @@ void __init init_arch(bp_tag_t *bp_start)if (bp_start)parse_bootparam (bp_start); -#ifdef CONFIG_OF +#ifdef CONFIG_USE_OF early_init_devtree (dtb_start);#endif
arch/xtensa/mm/mmu.c +1 -1
@@ -101,7 +101,7 @@ void init_mmu(void)void init_kio (void ) { -#if XCHAL_HAVE_PTP_MMU &&XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_OF ) +#if XCHAL_HAVE_PTP_MMU &&XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_USE_OF )/* * Update the IO area mapping in case xtensa_kio_paddr has changed */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 50/151 xtensa: call irqchip_init only when CONFIG_USE_OF is selected
In reply to Greg Kroah-HartmanFrom: Max Filippov <[email protected]>
[ Upstream commit 6489f8d0e1d93a3603d8dad8125797559e4cf2a2 ]
During boot time kernel configured with OF=y but USE_OF=n displays the following warnings and hangs shortly after starting userspace:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at kernel/irq/irqdomain.c:695 irq_create_mapping_affinity+0x29/0xc0 irq_create_mapping_affinity(, 6) called with NULL domain CPU: 0 PID: 0 Comm: swapper Not tainted 5.15.0-rc3-00001-gd67ed2510d28 #30 Call Trace: __warn+0x69/0xc4 warn_slowpath_fmt+0x6c/0x94 irq_create_mapping_affinity+0x29/0xc0 local_timer_setup+0x40/0x88 time_init+0xb1/0xe8 start_kernel+0x31d/0x3f4 _startup+0x13b/0x13b ---[ end trace 1e6630e1c5eda35b ]--- ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at arch/xtensa/kernel/time.c:141 local_timer_setup+0x58/0x88 error: can't map timer irq CPU: 0 PID: 0 Comm: swapper Tainted: G W 5.15.0-rc3-00001-gd67ed2510d28 #30 Call Trace: __warn+0x69/0xc4 warn_slowpath_fmt+0x6c/0x94 local_timer_setup+0x58/0x88 time_init+0xb1/0xe8 start_kernel+0x31d/0x3f4 _startup+0x13b/0x13b ---[ end trace 1e6630e1c5eda35c ]---
Failed to request irq 0 (timer)
Fix that by calling irqchip_init only when CONFIG_USE_OF is selected and calling legacy interrupt controller init otherwise.
--- arch/xtensa/kernel/irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/xtensa/kernel/irq.c +1 -1
@@ -145,7 +145,7 @@ unsigned xtensa_get_ext_irq_no(unsigned irq)void __init init_IRQ (void ) { -#ifdef CONFIG_OF +#ifdef CONFIG_USE_OF irqchip_init ();#else #ifdef CONFIG_HAVE_SMP
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 51/151 iwlwifi: pcie: add configuration of a Wi-Fi adapter on Dell XPS 15
In reply to Greg Kroah-HartmanFrom: Vladimir Zapolskiy <[email protected]>
[ Upstream commit fe5c735d0d47b495be6753d6aea4f8f78c909a0a ]
There is a Killer AX1650 2x2 Wi-Fi 6 and Bluetooth 5.1 wireless adapter found on Dell XPS 15 (9510) laptop, its configuration was present on Linux v5.7, however accidentally it has been removed from the list of supported devices, let's add it back.
The problem is manifested on driver initialization:
Intel(R) Wireless WiFi driver for Linux
iwlwifi 0000:00:14.3: enabling device (0000 -> 0002)
iwlwifi: No config found for PCI dev 43f0/1651, rev=0x354, rfid=0x10a100
iwlwifi: probe of 0000:00:14.3 failed with error -22
--- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +2 -0
@@ -547,6 +547,8 @@ static const struct iwl_dev_info iwl_dev_info_table[] = {IWL_DEV_INFO (0x43F0 ,0x0074 , iwl_ax201_cfg_qu_hr,NULL ),IWL_DEV_INFO (0x43F0 ,0x0078 , iwl_ax201_cfg_qu_hr,NULL ),IWL_DEV_INFO (0x43F0 ,0x007C , iwl_ax201_cfg_qu_hr,NULL ), +IWL_DEV_INFO (0x43F0 ,0x1651 , killer1650s_2ax_cfg_qu_b0_hr_b0, iwl_ax201_killer_1650s_name), +IWL_DEV_INFO (0x43F0 ,0x1652 , killer1650i_2ax_cfg_qu_b0_hr_b0, iwl_ax201_killer_1650i_name),IWL_DEV_INFO (0x43F0 ,0x2074 , iwl_ax201_cfg_qu_hr,NULL ),IWL_DEV_INFO (0x43F0 ,0x4070 , iwl_ax201_cfg_qu_hr,NULL ), IWL_DEV_INFO(0xA0F0, 0x0070, iwl_ax201_cfg_qu_hr, NULL),
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 52/151 netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 339031bafe6b281cf2dcb8364217288b9fdab555 ]
This is a revert of7b1957b049 ("netfilter: nf_defrag_ipv4: use net_generic infra") and a partial revert of8b0adbe3e3 ("netfilter: nf_defrag_ipv6: use net_generic infra").
If conntrack is builtin and kernel is booted with:
nf_conntrack.enable_hooks=1
.... kernel will fail to boot due to a NULL deref in nf_defrag_ipv4_enable(): Its called before the ipv4 defrag initcall is made, so net_generic() returns NULL.
To resolve this, move the user refcount back to struct net so calls to those functions are possible even before their initcalls have run.
--- include/net/netfilter/ipv6/nf_defrag_ipv6.h | 1 - include/net/netns/netfilter.h | 6 +++++ net/ipv4/netfilter/nf_defrag_ipv4.c | 30 +++++++-------------- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 25 +++++++---------- 5 files changed, 25 insertions(+), 39 deletions(-)
include/net/netfilter/ipv6/nf_defrag_ipv6.h +0 -1
@@ -17,7 +17,6 @@ struct inet_frags_ctl;struct nft_ct_frag6_pernet {struct ctl_table_header *nf_frag_frags_hdr;struct fqdir *fqdir; -unsigned int users; };#endif /* _NF_DEFRAG_IPV6_H */
include/net/netns/netfilter.h +6 -0
@@ -28,5 +28,11 @@ struct netns_nf {#if IS_ENABLED (CONFIG_DECNET )struct nf_hook_entries __rcu *hooks_decnet[NF_DN_NUMHOOKS ];#endif +#if IS_ENABLED (CONFIG_NF_DEFRAG_IPV4 ) +unsigned int defrag_ipv4_users; +#endif +#if IS_ENABLED (CONFIG_NF_DEFRAG_IPV6 ) +unsigned int defrag_ipv6_users; +#endif };#endif
net/ipv4/netfilter/nf_defrag_ipv4.c +9 -21
@@ -20,13 +20,8 @@#endif #include <net/netfilter/nf_conntrack_zones.h> -static unsigned int defrag4_pernet_id__read_mostly ;static DEFINE_MUTEX (defrag4_mutex); -struct defrag4_pernet { -unsigned int users; -}; -static int nf_ct_ipv4_gather_frags (struct net *net,struct sk_buff *skb,u_int32_t user) {
@@ -111,19 +106,15 @@ static const struct nf_hook_ops ipv4_defrag_ops[] = { static void __net_exit defrag4_net_exit(struct net *net) { -struct defrag4_pernet *nf_defrag =net_generic (net, defrag4_pernet_id); - -if (nf_defrag->users) { +if (net->nf.defrag_ipv4_users) {nf_unregister_net_hooks (net, ipv4_defrag_ops,ARRAY_SIZE (ipv4_defrag_ops)); - nf_defrag->users =0 ; + net->nf.defrag_ipv4_users =0 ; } }static struct pernet_operations defrag4_net_ops = { .exit = defrag4_net_exit, - .id = &defrag4_pernet_id, - .size =sizeof (struct defrag4_pernet ), };static int __init nf_defrag_init (void )
@@ -138,24 +129,23 @@ static void __exit nf_defrag_fini(void)int nf_defrag_ipv4_enable (struct net *net) { -struct defrag4_pernet *nf_defrag =net_generic (net, defrag4_pernet_id);int err =0 ;mutex_lock (&defrag4_mutex); -if (nf_defrag->users ==UINT_MAX ) { +if (net->nf.defrag_ipv4_users ==UINT_MAX ) { err = -EOVERFLOW ; goto out_unlock; } -if (nf_defrag->users) { - nf_defrag->users++; +if (net->nf.defrag_ipv4_users) { + net->nf.defrag_ipv4_users++; goto out_unlock; } err =nf_register_net_hooks (net, ipv4_defrag_ops,ARRAY_SIZE (ipv4_defrag_ops));if (err ==0 ) - nf_defrag->users =1 ; + net->nf.defrag_ipv4_users =1 ; out_unlock:mutex_unlock (&defrag4_mutex);
@@ -165,12 +155,10 @@ EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable);void nf_defrag_ipv4_disable (struct net *net) { -struct defrag4_pernet *nf_defrag =net_generic (net, defrag4_pernet_id); -mutex_lock (&defrag4_mutex); -if (nf_defrag->users) { - nf_defrag->users--; -if (nf_defrag->users ==0 ) +if (net->nf.defrag_ipv4_users) { + net->nf.defrag_ipv4_users--; +if (net->nf.defrag_ipv4_users ==0 )nf_unregister_net_hooks (net, ipv4_defrag_ops,ARRAY_SIZE (ipv4_defrag_ops)); }
net/ipv6/netfilter/nf_conntrack_reasm.c +1 -1
@@ -33,7 +33,7 @@static const char nf_frags_cache_name[] ="nf-frags" ; -unsigned int nf_frag_pernet_id__read_mostly ; +static unsigned int nf_frag_pernet_id__read_mostly ;static struct inet_frags nf_frags;static struct nft_ct_frag6_pernet *nf_frag_pernet (struct net *net)
net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +9 -16
@@ -25,8 +25,6 @@#include <net/netfilter/nf_conntrack_zones.h> #include <net/netfilter/ipv6/nf_defrag_ipv6.h> -extern unsigned int nf_frag_pernet_id; -static DEFINE_MUTEX (defrag6_mutex); static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
@@ -91,12 +89,10 @@ static const struct nf_hook_ops ipv6_defrag_ops[] = { static void __net_exit defrag6_net_exit(struct net *net) { -struct nft_ct_frag6_pernet *nf_frag =net_generic (net, nf_frag_pernet_id); - -if (nf_frag->users) { +if (net->nf.defrag_ipv6_users) {nf_unregister_net_hooks (net, ipv6_defrag_ops,ARRAY_SIZE (ipv6_defrag_ops)); - nf_frag->users =0 ; + net->nf.defrag_ipv6_users =0 ; } }
@@ -134,24 +130,23 @@ static void __exit nf_defrag_fini(void)int nf_defrag_ipv6_enable (struct net *net) { -struct nft_ct_frag6_pernet *nf_frag =net_generic (net, nf_frag_pernet_id);int err =0 ;mutex_lock (&defrag6_mutex); -if (nf_frag->users ==UINT_MAX ) { +if (net->nf.defrag_ipv6_users ==UINT_MAX ) { err = -EOVERFLOW ; goto out_unlock; } -if (nf_frag->users) { - nf_frag->users++; +if (net->nf.defrag_ipv6_users) { + net->nf.defrag_ipv6_users++; goto out_unlock; } err =nf_register_net_hooks (net, ipv6_defrag_ops,ARRAY_SIZE (ipv6_defrag_ops));if (err ==0 ) - nf_frag->users =1 ; + net->nf.defrag_ipv6_users =1 ; out_unlock:mutex_unlock (&defrag6_mutex);
@@ -161,12 +156,10 @@ EXPORT_SYMBOL_GPL(nf_defrag_ipv6_enable);void nf_defrag_ipv6_disable (struct net *net) { -struct nft_ct_frag6_pernet *nf_frag =net_generic (net, nf_frag_pernet_id); -mutex_lock (&defrag6_mutex); -if (nf_frag->users) { - nf_frag->users--; -if (nf_frag->users ==0 ) +if (net->nf.defrag_ipv6_users) { + net->nf.defrag_ipv6_users--; +if (net->nf.defrag_ipv6_users ==0 )nf_unregister_net_hooks (net, ipv6_defrag_ops,ARRAY_SIZE (ipv6_defrag_ops)); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 53/151 netfilter: nf_tables: add position handle in event notification
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit e189ae161dd784aa5d454b0832f818cacc0e131b ]
Add position handle to allow to identify the rule location from netlink events. Otherwise, userspace cannot incrementally update a userspace cache through monitoring events.
Skip handle dump if the rule has been either inserted (at the beginning of the ruleset) or appended (at the end of the ruleset), the NLM_F_APPEND netlink flag is sufficient in these two cases.
Handle NLM_F_REPLACE as NLM_F_APPEND since the rule replacement expansion appends it after the specified rule handle.
--- net/netfilter/nf_tables_api.c | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-)
net/netfilter/nf_tables_api.c +25 -9
@@ -2866,8 +2866,7 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, u32 flags, int family, const struct nft_table *table, const struct nft_chain *chain, - const struct nft_rule *rule, - const struct nft_rule *prule) + const struct nft_rule *rule, u64 handle) { struct nlmsghdr *nlh;const struct nft_expr *expr, *next;
@@ -2887,9 +2886,8 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, NFTA_RULE_PAD)) goto nla_put_failure; -if (event !=NFT_MSG_DELRULE && prule) { -if (nla_put_be64 (skb,NFTA_RULE_POSITION , -cpu_to_be64 (prule->handle), +if (event !=NFT_MSG_DELRULE && handle) { +if (nla_put_be64 (skb,NFTA_RULE_POSITION ,cpu_to_be64 (handle),NFTA_RULE_PAD )) goto nla_put_failure; }
@@ -2925,7 +2923,10 @@ static void nf_tables_rule_notify(const struct nft_ctx *ctx, const struct nft_rule *rule, int event) {struct nftables_pernet *nft_net =nft_pernet (ctx->net); +const struct nft_rule *prule;struct sk_buff *skb; +u64 handle =0 ; +u16 flags =0 ;int err; if (!ctx->report &&
@@ -2936,9 +2937,18 @@ static void nf_tables_rule_notify(const struct nft_ctx *ctx,if (skb ==NULL ) goto err; +if (event ==NFT_MSG_NEWRULE && + !list_is_first (&rule->list, &ctx->chain->rules) && + !list_is_last (&rule->list, &ctx->chain->rules)) { + prule =list_prev_entry (rule, list); + handle = prule->handle; + } +if (ctx->flags & (NLM_F_APPEND |NLM_F_REPLACE )) + flags |=NLM_F_APPEND ; + err =nf_tables_fill_rule_info (skb, ctx->net, ctx->portid, ctx->seq, - event,0 , ctx->family, ctx->table, - ctx->chain, rule,NULL ); + event, flags, ctx->family, ctx->table, + ctx->chain, rule, handle);if (err <0 ) {kfree_skb (skb); goto err;
@@ -2964,6 +2974,7 @@ static int __nf_tables_dump_rules(struct sk_buff *skb,struct net *net =sock_net (skb->sk);const struct nft_rule *rule, *prule;unsigned int s_idx = cb->args[0 ]; +u64 handle; prule =NULL ;list_for_each_entry_rcu (rule, &chain->rules, list) {
@@ -2975,12 +2986,17 @@ static int __nf_tables_dump_rules(struct sk_buff *skb,memset (&cb->args[1 ],0 ,sizeof (cb->args) -sizeof (cb->args[0 ])); } +if (prule) + handle = prule->handle; +else + handle =0 ; +if (nf_tables_fill_rule_info (skb, net,NETLINK_CB (cb->skb).portid, cb->nlh->nlmsg_seq,NFT_MSG_NEWRULE ,NLM_F_MULTI |NLM_F_APPEND , table->family, - table, chain, rule, prule) <0 ) + table, chain, rule, handle) <0 )return 1 ;nl_dump_check_consistent (cb,nlmsg_hdr (skb));
@@ -3143,7 +3159,7 @@ static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info, err =nf_tables_fill_rule_info (skb2, net,NETLINK_CB (skb).portid, info->nlh->nlmsg_seq,NFT_MSG_NEWRULE ,0 , - family, table, chain, rule,NULL ); + family, table, chain, rule,0 );if (err <0 ) goto err_fill_rule_info;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 54/151 netfilter: nf_tables: reverse order in rule replacement expansion
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 2c964c558641a3bddaee5719c9e6d8805f777812 ]
Deactivate old rule first, then append the new rule, so rule replacement notification via netlink first reports the deletion of the old rule with handle X in first place, then it adds the new rule (reusing the handle X of the replaced old rule).
Note that the abort path releases the transaction that has been created by nft_delrule() on error.
--- net/netfilter/nf_tables_api.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
net/netfilter/nf_tables_api.c +4 -6
@@ -3419,17 +3419,15 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, }if (info->nlh->nlmsg_flags &NLM_F_REPLACE ) { + err =nft_delrule (&ctx, old_rule); +if (err <0 ) + goto err_destroy_flow_rule; + trans =nft_trans_rule_add (&ctx,NFT_MSG_NEWRULE , rule);if (trans ==NULL ) { err = -ENOMEM ; goto err_destroy_flow_rule; } - err =nft_delrule (&ctx, old_rule); -if (err <0 ) { -nft_trans_destroy (trans); - goto err_destroy_flow_rule; - } -list_add_tail_rcu (&rule->list, &old_rule->list); }else { trans =nft_trans_rule_add (&ctx,NFT_MSG_NEWRULE , rule);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 55/151 bpf, arm: Fix register clobbering in div/mod implementation
In reply to Greg Kroah-HartmanFrom: Johan Almbladh <[email protected]>
[ Upstream commit 79e3445b38e0cab94264a3894c0c3d57c930b97e ]
On ARM CPUs that lack div/mod instructions, ALU32 BPF_DIV and BPF_MOD are implemented using a call to a helper function. Before, the emitted code for those function calls failed to preserve caller-saved ARM registers. Since some of those registers happen to be mapped to BPF registers, it resulted in eBPF register values being overwritten.
This patch emits code to push and pop the remaining caller-saved ARM registers r2-r3 into the stack during the div/mod function call. ARM registers r0-r1 are used as arguments and return value, and those were already saved and restored correctly.
--- arch/arm/net/bpf_jit_32.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
arch/arm/net/bpf_jit_32.c +19 -0
@@ -36,6 +36,10 @@* +-----+ * |RSVD | JIT scratchpad * current ARM_SP => +-----+ <= (BPF_FP - STACK_SIZE + SCRATCH_SIZE) +* | ... | caller-saved registers +* +-----+ +* | ... | arguments passed on stack +* ARM_SP during call => +-----| * | | * | ... | Function call stack * | |
@@ -63,6 +67,12 @@* * When popping registers off the stack at the end of a BPF function, we * reference them via the current ARM_FP register. +* +* Some eBPF operations are implemented via a call to a helper function. +* Such calls are "invisible" in the eBPF code, so it is up to the calling +* program to preserve any caller-saved ARM registers during the call. The +* JIT emits code to push and pop those registers onto the stack, immediately +* above the callee stack frame. */ #define CALLEE_MASK (1 << ARM_R4 | 1 << ARM_R5 | 1 << ARM_R6 | \ 1 << ARM_R7 | 1 << ARM_R8 | 1 << ARM_R9 | \
@@ -70,6 +80,8 @@#define CALLEE_PUSH_MASK (CALLEE_MASK | 1 << ARM_LR)#define CALLEE_POP_MASK (CALLEE_MASK | 1 << ARM_PC) +#define CALLER_MASK (1 << ARM_R0 | 1 << ARM_R1 | 1 << ARM_R2 | 1 << ARM_R3) +enum {/* Stack layout - these are offsets from (top of stack - 4) */ BPF_R2_HI ,
@@ -464,6 +476,7 @@ static inline int epilogue_offset(const struct jit_ctx *ctx)static inline void emit_udivmod (u8 rd,u8 rm,u8 rn,struct jit_ctx *ctx,u8 op) { +const int exclude_mask =BIT (ARM_R0 ) |BIT (ARM_R1 );const s8 *tmp = bpf2a32[TMP_REG_1 ];#if __LINUX_ARM_ARCH__ ==7
@@ -495,11 +508,17 @@ static inline void emit_udivmod(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx, u8 op)emit (ARM_MOV_R (ARM_R0 , rm), ctx); } +/* Push caller-saved registers on stack */ +emit (ARM_PUSH (CALLER_MASK & ~exclude_mask), ctx); +/* Call appropriate function */ emit_mov_i (ARM_IP , op ==BPF_DIV ? (u32 )jit_udiv32 : (u32 )jit_mod32, ctx);emit_blx_r (ARM_IP , ctx); +/* Restore caller-saved registers from stack */ +emit (ARM_POP (CALLER_MASK & ~exclude_mask), ctx); +/* Save return value */ if (rd !=ARM_R0 )emit (ARM_MOV_R (rd,ARM_R0 ), ctx);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 56/151 soc: ti: omap-prm: Fix external abort for am335x pruss
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit b232537074fcaf0c2837abbb217429c097bb7598 ]
Starting with v5.15-rc1, we may now see some am335x beaglebone black device produce the following error on pruss probe:
Unhandled fault: external abort on non-linefetch (0x1008) at 0xe0326000
This has started with the enabling of pruss for am335x in the dts files.
Turns out the is caused by the PRM reset handling not waiting for the reset bit to clear. To fix the issue, let's always wait for the reset bit to clear, even if there is a separate reset status register.
We attempted to fix a similar issue for dra7 iva with a udelay() in commit effe89e40037 ("soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva"). There is no longer a need for the udelay() for dra7 iva reset either with the check added for reset bit clearing.
--- drivers/soc/ti/omap_prm.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
drivers/soc/ti/omap_prm.c +15 -12
@@ -825,25 +825,28 @@ static int omap_reset_deassert(struct reset_controller_dev *rcdev,writel_relaxed (v, reset->prm->base + reset->prm->data->rstctrl);spin_unlock_irqrestore (&reset->lock, flags); -if (!has_rstst) - goto exit; +/* wait for the reset bit to clear */ + ret =readl_relaxed_poll_timeout_atomic (reset->prm->base + + reset->prm->data->rstctrl, + v, !(v &BIT (id)),1 , +OMAP_RESET_MAX_WAIT ); +if (ret) +pr_err ("%s: timedout waiting for %s:%lu\n" , __func__, + reset->prm->data->name, id);/* wait for the status to be set */ - ret =readl_relaxed_poll_timeout_atomic (reset->prm->base + +if (has_rstst) { + ret =readl_relaxed_poll_timeout_atomic (reset->prm->base + reset->prm->data->rstst, v, v &BIT (st_bit),1 ,OMAP_RESET_MAX_WAIT ); -if (ret) -pr_err ("%s: timedout waiting for %s:%lu\n" , __func__, - reset->prm->data->name, id); +if (ret) +pr_err ("%s: timedout waiting for %s:%lu\n" , __func__, + reset->prm->data->name, id); + } -exit: -if (reset->clkdm) { -/* At least dra7 iva needs a delay before clkdm idle */ -if (has_rstst) -udelay (1 ); +if (reset->clkdm) pdata->clkdm_allow_idle (reset->clkdm); - }return ret; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 57/151 bpf: Fix integer overflow in prealloc_elems_and_freelist()
In reply to Greg Kroah-HartmanFrom: Tatsuhiko Yasumatsu <[email protected]>
[ Upstream commit 30e29a9a2bc6a4888335a6ede968b75cd329657a ]
In prealloc_elems_and_freelist(), the multiplication to calculate the size passed to bpf_map_area_alloc() could lead to an integer overflow. As a result, out-of-bounds write could occur in pcpu_freelist_populate() as reported by KASAN:
[...]
[ 16.968613] BUG: KASAN: slab-out-of-bounds in pcpu_freelist_populate+0xd9/0x100 [ 16.969408] Write of size 8 at addr ffff888104fc6ea0 by task crash/78 [ 16.970038] [ 16.970195] CPU: 0 PID: 78 Comm: crash Not tainted 5.15.0-rc2+ #1 [ 16.970878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 16.972026] Call Trace: [ 16.972306] dump_stack_lvl+0x34/0x44 [ 16.972687] print_address_description.constprop.0+0x21/0x140 [ 16.973297] ? pcpu_freelist_populate+0xd9/0x100 [ 16.973777] ? pcpu_freelist_populate+0xd9/0x100 [ 16.974257] kasan_report.cold+0x7f/0x11b [ 16.974681] ? pcpu_freelist_populate+0xd9/0x100 [ 16.975190] pcpu_freelist_populate+0xd9/0x100 [ 16.975669] stack_map_alloc+0x209/0x2a0 [ 16.976106] __sys_bpf+0xd83/0x2ce0
[...]
The possibility of this overflow was originally discussed in [0], but was overlooked.
Fix the integer overflow by changing elem_size to u64 from u32.
[0] https://lore.kernel.org/bpf/[email protected]/
--- kernel/bpf/stackmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/bpf/stackmap.c +2 -1
@@ -63,7 +63,8 @@ static inline int stack_map_data_size(struct bpf_map *map)static int prealloc_elems_and_freelist (struct bpf_stack_map *smap) { -u32 elem_size =sizeof (struct stack_map_bucket ) + smap->map.value_size; +u64 elem_size =sizeof (struct stack_map_bucket ) + + (u64 )smap->map.value_size;int err; smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 58/151 net/mlx5e: IPSEC RX, enable checksum complete
In reply to Greg Kroah-HartmanFrom: Raed Salem <[email protected]>
[ Upstream commit f9a10440f0b1f33faa792af26f4e9823a9b8b6a4 ]
Currently in Rx data path IPsec crypto offloaded packets uses csum_none flag, so checksum is handled by the stack, this naturally have some performance/cpu utilization impact on such flows. As Nvidia NIC starting from ConnectX6DX provides checksum complete value out of the box also for such flows there is no sense in taking csum_none path, furthermore the stack (xfrm) have the method to handle checksum complete corrections for such flows i.e. IPsec trailer removal and consequently checksum value adjustment.
Because of the above and in addition the ConnectX6DX is the first HW which supports IPsec crypto offload then it is safe to report csum complete for IPsec offloaded traffic.
--- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +1 -6
@@ -1001,14 +1001,9 @@ static inline void mlx5e_handle_csum(struct net_device *netdev, goto csum_unnecessary;if (likely (is_last_ethertype_ip (skb, &network_depth, &proto))) { -u8 ipproto =get_ip_proto (skb, network_depth, proto); - -if (unlikely (ipproto ==IPPROTO_SCTP )) +if (unlikely (get_ip_proto (skb, network_depth, proto) ==IPPROTO_SCTP )) goto csum_unnecessary; -if (unlikely (mlx5_ipsec_is_rx_flow (cqe))) - goto csum_none; - stats->csum_complete++; skb->ip_summed =CHECKSUM_COMPLETE ; skb->csum =csum_unfold ((__force __sum16 )cqe->check_sum);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 59/151 net/mlx5e: Keep the value for maximum number of channels in-sync
In reply to Greg Kroah-HartmanFrom: Tariq Toukan <[email protected]>
[ Upstream commit 9d758d4a3a039b9d7086d4759ed255b748713eee ]
The value for maximum number of channels is first calculated based on the netdev's profile and current function resources (specifically, number of MSIX vectors, which depends among other things on the number of online cores in the system).
This value is then used to calculate the netdev's number of rxqs/txqs. Once created (by alloc_etherdev_mqs), the number of netdev's rxqs/txqs is constant and we must not exceed it.
To achieve this, keep the maximum number of channels in sync upon any netdevice re-attach.
Use mlx5e_get_max_num_channels() for calculating the number of netdev's rxqs/txqs. After netdev is created, use mlx5e_calc_max_nch() (which coinsiders core device resources, profile, and netdev) to init or update priv->max_nch.
Before this patch, the value of priv->max_nch might get out of sync, mistakenly allowing accesses to out-of-bounds objects, which would crash the system.
Track the number of channels stats structures used in a separate field, as they are persistent to suspend/resume operations. All the collected stats of every channel index that ever existed should be preserved. They are reset only when struct mlx5e_priv is, in mlx5e_priv_cleanup(), which is part of the profile changing flow.
There is no point anymore in blocking a profile change due to max_nch mismatch in mlx5e_netdev_change_profile(). Remove the limitation.
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 11 ++-- .../mellanox/mlx5/core/en/hv_vhca_stats.c | 6 +- .../net/ethernet/mellanox/mlx5/core/en_main.c | 59 ++++++++++++++----- .../net/ethernet/mellanox/mlx5/core/en_rep.c | 3 +- .../ethernet/mellanox/mlx5/core/en_stats.c | 8 +-- .../ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 4 +- 6 files changed, 57 insertions(+), 34 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +4 -7
@@ -863,6 +863,7 @@ struct mlx5e_priv {struct mlx5e_channel_stats channel_stats[MLX5E_MAX_NUM_CHANNELS ];struct mlx5e_channel_stats trap_stats;struct mlx5e_ptp_stats ptp_stats; +u16 stats_nch;u16 max_nch;u8 max_opened_tc;bool tx_ptp_opened;
@@ -1156,12 +1157,6 @@ int mlx5e_ethtool_set_pauseparam(struct mlx5e_priv *priv, struct ethtool_pauseparam *pauseparam);/* mlx5e generic netdev management API */ -static inline unsigned int -mlx5e_calc_max_nch (struct mlx5e_priv *priv,const struct mlx5e_profile *profile) -{ -return priv->netdev->num_rx_queues /max_t (u8, profile->rq_groups,1 ); -} -static inline bool mlx5e_tx_mpwqe_supported (struct mlx5_core_dev *mdev) {
@@ -1170,11 +1165,13 @@ mlx5e_tx_mpwqe_supported(struct mlx5_core_dev *mdev) }int mlx5e_priv_init (struct mlx5e_priv *priv, +const struct mlx5e_profile *profile,struct net_device *netdev,struct mlx5_core_dev *mdev);void mlx5e_priv_cleanup (struct mlx5e_priv *priv);struct net_device * -mlx5e_create_netdev (struct mlx5_core_dev *mdev,unsigned int txqs,unsigned int rxqs); +mlx5e_create_netdev (struct mlx5_core_dev *mdev,const struct mlx5e_profile *profile, +unsigned int txqs,unsigned int rxqs);int mlx5e_attach_netdev (struct mlx5e_priv *priv);void mlx5e_detach_netdev (struct mlx5e_priv *priv);void mlx5e_destroy_netdev (struct mlx5e_priv *priv);
drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c +3 -3
@@ -35,7 +35,7 @@ static void mlx5e_hv_vhca_fill_stats(struct mlx5e_priv *priv, void *data, {int ch, i =0 ; -for (ch =0 ; ch < priv->max_nch; ch++) { +for (ch =0 ; ch < priv->stats_nch; ch++) {void *buf = data + i; if (WARN_ON_ONCE(buf +
@@ -51,7 +51,7 @@ static void mlx5e_hv_vhca_fill_stats(struct mlx5e_priv *priv, void *data,static int mlx5e_hv_vhca_stats_buf_size (struct mlx5e_priv *priv) {return (sizeof (struct mlx5e_hv_vhca_per_ring_stats ) * - priv->max_nch); + priv->stats_nch); }static void mlx5e_hv_vhca_stats_work (struct work_struct *work)
@@ -100,7 +100,7 @@ static void mlx5e_hv_vhca_stats_control(struct mlx5_hv_vhca_agent *agent, sagent = &priv->stats_agent; block->version =MLX5_HV_VHCA_STATS_VERSION ; - block->rings = priv->max_nch; + block->rings = priv->stats_nch;if (!block->command) {cancel_delayed_work_sync (&priv->stats_agent.work);
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +43 -16
133 lines not on this page · raw message
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +1 -2
@@ -561,7 +561,6 @@ static void mlx5e_build_rep_params(struct net_device *netdev) MLX5_CQ_PERIOD_MODE_START_FROM_CQE :MLX5_CQ_PERIOD_MODE_START_FROM_EQE ; - priv->max_nch =mlx5e_calc_max_nch (priv, priv->profile); params = &priv->channels.params; params->num_channels =MLX5E_REP_PARAMS_DEF_NUM_CHANNELS ;
@@ -1151,7 +1150,7 @@ mlx5e_vport_vf_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) nch =mlx5e_get_max_num_channels (dev); txqs = nch * profile->max_tc; rxqs = nch * profile->rq_groups; - netdev =mlx5e_create_netdev (dev, txqs, rxqs); + netdev =mlx5e_create_netdev (dev, profile, txqs, rxqs);if (!netdev) { mlx5_core_warn(dev, "Failed to create representor netdev for vport %d\n",
drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +4 -4
@@ -450,7 +450,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_UPDATE_STATS(sw)memset (s,0 ,sizeof (*s)); -for (i =0 ; i < priv->max_nch; i++) { +for (i =0 ; i < priv->stats_nch; i++) {struct mlx5e_channel_stats *channel_stats = &priv->channel_stats[i];int j;
@@ -2119,7 +2119,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_UPDATE_STATS(ptp) { return; }static MLX5E_DECLARE_STATS_GRP_OP_NUM_STATS (channels) { -int max_nch = priv->max_nch; +int max_nch = priv->stats_nch;return (NUM_RQ_STATS * max_nch) + (NUM_CH_STATS * max_nch) +
@@ -2133,7 +2133,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_NUM_STATS(channels)static MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS (channels) {bool is_xsk = priv->xsk.ever_used; -int max_nch = priv->max_nch; +int max_nch = priv->stats_nch;int i, j, tc;for (i =0 ; i < max_nch; i++)
@@ -2175,7 +2175,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS(channels)static MLX5E_DECLARE_STATS_GRP_OP_FILL_STATS (channels) {bool is_xsk = priv->xsk.ever_used; -int max_nch = priv->max_nch; +int max_nch = priv->stats_nch;int i, j, tc;for (i =0 ; i < max_nch; i++)
drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c +2 -2
@@ -113,7 +113,7 @@ static void mlx5i_grp_sw_update_stats(struct mlx5e_priv *priv)struct mlx5e_sw_stats s = {0 };int i, j; -for (i =0 ; i < priv->max_nch; i++) { +for (i =0 ; i < priv->stats_nch; i++) {struct mlx5e_channel_stats *channel_stats;struct mlx5e_rq_stats *rq_stats;
@@ -729,7 +729,7 @@ static int mlx5_rdma_setup_rn(struct ib_device *ibdev, u32 port_num, goto destroy_ht; } - err =mlx5e_priv_init (epriv, netdev, mdev); + err =mlx5e_priv_init (epriv, prof, netdev, mdev);if (err) goto destroy_mdev_resources;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 60/151 net/mlx5: E-Switch, Fix double allocation of acl flow counter
In reply to Greg Kroah-HartmanFrom: Moshe Shemesh <[email protected]>
[ Upstream commit a586775f83bd729ad60b56352dbe067f4bb0beee ]
Flow counter is allocated in eswitch legacy acl setting functions without checking if already allocated by previous setting. Add a check to avoid such double allocation.
--- .../mellanox/mlx5/core/esw/acl/egress_lgcy.c | 12 ++++++++---- .../mellanox/mlx5/core/esw/acl/ingress_lgcy.c | 4 +++- 2 files changed, 11 insertions(+), 5 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c +8 -4
@@ -79,12 +79,16 @@ int esw_acl_egress_lgcy_setup(struct mlx5_eswitch *esw,int dest_num =0 ;int err =0 ; -if (MLX5_CAP_ESW_EGRESS_ACL (esw->dev, flow_counter)) { +if (vport->egress.legacy.drop_counter) { + drop_counter = vport->egress.legacy.drop_counter; + }else if (MLX5_CAP_ESW_EGRESS_ACL (esw->dev, flow_counter)) { drop_counter =mlx5_fc_create (esw->dev, false); -if (IS_ERR (drop_counter)) +if (IS_ERR (drop_counter)) {esw_warn (esw->dev,"vport[%d] configure egress drop rule counter err(%ld)\n" , vport->vport,PTR_ERR (drop_counter)); + drop_counter =NULL ; + } vport->egress.legacy.drop_counter = drop_counter; }
@@ -123,7 +127,7 @@ int esw_acl_egress_lgcy_setup(struct mlx5_eswitch *esw, flow_act.action =MLX5_FLOW_CONTEXT_ACTION_DROP ;/* Attach egress drop flow counter */ -if (!IS_ERR_OR_NULL (drop_counter)) { +if (drop_counter) { flow_act.action |=MLX5_FLOW_CONTEXT_ACTION_COUNT ; drop_ctr_dst.type =MLX5_FLOW_DESTINATION_TYPE_COUNTER ; drop_ctr_dst.counter_id =mlx5_fc_id (drop_counter);
@@ -162,7 +166,7 @@ void esw_acl_egress_lgcy_cleanup(struct mlx5_eswitch *esw,esw_acl_egress_table_destroy (vport); clean_drop_counter: -if (!IS_ERR_OR_NULL (vport->egress.legacy.drop_counter)) { +if (vport->egress.legacy.drop_counter) {mlx5_fc_destroy (esw->dev, vport->egress.legacy.drop_counter); vport->egress.legacy.drop_counter =NULL ; }
drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c +3 -1
@@ -160,7 +160,9 @@ int esw_acl_ingress_lgcy_setup(struct mlx5_eswitch *esw,esw_acl_ingress_lgcy_rules_destroy (vport); -if (MLX5_CAP_ESW_INGRESS_ACL (esw->dev, flow_counter)) { +if (vport->ingress.legacy.drop_counter) { + counter = vport->ingress.legacy.drop_counter; + }else if (MLX5_CAP_ESW_INGRESS_ACL (esw->dev, flow_counter)) { counter =mlx5_fc_create (esw->dev, false);if (IS_ERR (counter)) { esw_warn(esw->dev,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 61/151 net/mlx5: Force round second at 1PPS out start time
In reply to Greg Kroah-HartmanFrom: Aya Levin <[email protected]>
[ Upstream commit 64728294703e77827cc31a1b164ca867400067f5 ]
Allow configuration of 1PPS start time only with time-stamp representing a round second. Prior to this patch driver allowed setting of a non-round-second which is not supported by the device. Avoid unexpected behavior by restricting start-time configuration to a round-second.
--- .../ethernet/mellanox/mlx5/core/lib/clock.c | 25 ++++++++----------- 1 file changed, 11 insertions(+), 14 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +11 -14
@@ -448,22 +448,20 @@ static u64 find_target_cycles(struct mlx5_core_dev *mdev, s64 target_ns)return cycles_now + cycles_delta; } -static u64 perout_conf_internal_timer (struct mlx5_core_dev *mdev, -s64 sec,u32 nsec) +static u64 perout_conf_internal_timer (struct mlx5_core_dev *mdev,s64 sec) { -struct timespec64 ts; +struct timespec64 ts = {};s64 target_ns; ts.tv_sec = sec; - ts.tv_nsec = nsec; target_ns =timespec64_to_ns (&ts);return find_target_cycles (mdev, target_ns); } -static u64 perout_conf_real_time (s64 sec,u32 nsec) +static u64 perout_conf_real_time (s64 sec) { -return (u64 )nsec | (u64 )sec <<32 ; +return (u64 )sec <<32 ; } static int mlx5_perout_configure(struct ptp_clock_info *ptp,
@@ -501,8 +499,10 @@ static int mlx5_perout_configure(struct ptp_clock_info *ptp,if (on) {bool rt_mode =mlx5_real_time_mode (mdev); -u32 nsec; -s64 sec; +s64 sec = rq->perout.start.sec; + +if (rq->perout.start.nsec) +return -EINVAL ; pin_mode =MLX5_PIN_MODE_OUT ; pattern =MLX5_OUT_PATTERN_PERIODIC ;
@@ -513,14 +513,11 @@ static int mlx5_perout_configure(struct ptp_clock_info *ptp,if ((ns >>1 ) !=500000000LL )return -EINVAL ; - nsec = rq->perout.start.nsec; - sec = rq->perout.start.sec; -if (rt_mode && sec >U32_MAX )return -EINVAL ; - time_stamp = rt_mode ?perout_conf_real_time (sec, nsec) : -perout_conf_internal_timer (mdev, sec, nsec); + time_stamp = rt_mode ?perout_conf_real_time (sec) : +perout_conf_internal_timer (mdev, sec); field_select |=MLX5_MTPPS_FS_PIN_MODE | MLX5_MTPPS_FS_PATTERN |
@@ -717,7 +714,7 @@ static u64 perout_conf_next_event_timer(struct mlx5_core_dev *mdev,ts_next_sec (&ts); target_ns =timespec64_to_ns (&ts); -return rt_mode ?perout_conf_real_time (ts.tv_sec, ts.tv_nsec) : +return rt_mode ?perout_conf_real_time (ts.tv_sec) :find_target_cycles (mdev, target_ns); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 62/151 net/mlx5: Avoid generating event after PPS out in Real time mode
In reply to Greg Kroah-HartmanFrom: Aya Levin <[email protected]>
[ Upstream commit 99b9a678b2e474756770900595cb09c94498bfca ]
When in Real-time mode, HW clock is synced with the PTP daemon. Hence driver should not re-calibrate the next pulse (via MTPPSE repetitive events mechanism).
This patch arms repetitive events only in free-running mode.
--- .../net/ethernet/mellanox/mlx5/core/lib/clock.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +6 -8
@@ -472,6 +472,7 @@ static int mlx5_perout_configure(struct ptp_clock_info *ptp, container_of(ptp, struct mlx5_clock, ptp_info);struct mlx5_core_dev *mdev = container_of(clock, struct mlx5_core_dev, clock); +bool rt_mode =mlx5_real_time_mode (mdev);u32 in[MLX5_ST_SZ_DW (mtpps_reg)] = {0 };struct timespec64 ts;u32 field_select =0 ;
@@ -535,6 +536,9 @@ static int mlx5_perout_configure(struct ptp_clock_info *ptp,if (err)return err; +if (rt_mode) +return 0 ; +return mlx5_set_mtppse (mdev, pin,0 ,MLX5_EVENT_MODE_REPETETIVE & on); }
@@ -702,20 +706,14 @@ static void ts_next_sec(struct timespec64 *ts)static u64 perout_conf_next_event_timer (struct mlx5_core_dev *mdev,struct mlx5_clock *clock) { -bool rt_mode =mlx5_real_time_mode (mdev);struct timespec64 ts;s64 target_ns; -if (rt_mode) - ts =mlx5_ptp_gettimex_real_time (mdev,NULL ); -else -mlx5_ptp_gettimex (&clock->ptp_info, &ts,NULL ); - +mlx5_ptp_gettimex (&clock->ptp_info, &ts,NULL );ts_next_sec (&ts); target_ns =timespec64_to_ns (&ts); -return rt_mode ?perout_conf_real_time (ts.tv_sec) : -find_target_cycles (mdev, target_ns); +return find_target_cycles (mdev, target_ns); } static int mlx5_pps_event(struct notifier_block *nb,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 63/151 net/mlx5: Fix length of irq_index in chars
In reply to Greg Kroah-HartmanFrom: Shay Drory <[email protected]>
[ Upstream commit ac8b7d50ae4c3f5325c599f3d6e939ecef6a585a ]
The maximum irq_index can be 2047, This means irq_name should have 4 characters reserve for the irq_index. Hence, increase it to 4.
--- drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c +2 -2
@@ -13,8 +13,8 @@#endif #define MLX5_MAX_IRQ_NAME (32) -/* max irq_index is 255. three chars */ -#define MLX5_MAX_IRQ_IDX_CHARS (3) +/* max irq_index is 2047, so four chars */ +#define MLX5_MAX_IRQ_IDX_CHARS (4)#define MLX5_SFS_PER_CTRL_IRQ 64#define MLX5_IRQ_CTRL_SF_MAX 8
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 64/151 net/mlx5: Fix setting number of EQs of SFs
In reply to Greg Kroah-HartmanFrom: Shay Drory <[email protected]>
[ Upstream commit f88c4876347400a577598e06f1b230a7b19ee0e9 ]
When setting number of completion EQs of the SF, consider number of online CPUs.
Without this consideration, when number of online cpus are less than 8, unnecessary 8 completion EQs are allocated.
--- drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c +3 -2
@@ -610,8 +610,9 @@ void mlx5_irq_table_destroy(struct mlx5_core_dev *dev)int mlx5_irq_table_get_sfs_vec (struct mlx5_irq_table *table) {if (table->sf_comp_pool) -return table->sf_comp_pool->xa_num_irqs.max - - table->sf_comp_pool->xa_num_irqs.min +1 ; +return min_t (int,num_online_cpus (), + table->sf_comp_pool->xa_num_irqs.max - + table->sf_comp_pool->xa_num_irqs.min +1 );else return mlx5_irq_table_get_num_comp (table); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 65/151 net/mlx5e: Fix the presented RQ index in PTP stats
In reply to Greg Kroah-HartmanFrom: Lama Kayal <[email protected]>
[ Upstream commit dd1979cf3c710398a9eeba4853b908fe16426814 ]
PTP-RQ counters title format contains PTP-RQ identifier, which is mistakenly not passed to sprinft().
This leads to unexpected garbage values instead.
This patch fixes it.
Before applying the patch:
ethtool -S eth3 | grep ptp_rq
ptp_rq15_packets: 0
ptp_rq8_bytes: 0
ptp_rq6_csum_complete: 0
ptp_rq14_csum_complete_tail: 0
ptp_rq3_csum_complete_tail_slow : 0
ptp_rq9_csum_unnecessary: 0
ptp_rq1_csum_unnecessary_inner: 0
ptp_rq7_csum_none: 0
ptp_rq10_xdp_drop: 0
ptp_rq9_xdp_redirect: 0
ptp_rq13_lro_packets: 0
ptp_rq12_lro_bytes: 0
ptp_rq10_ecn_mark: 0
ptp_rq9_removed_vlan_packets: 0
ptp_rq5_wqe_err: 0
ptp_rq8_mpwqe_filler_cqes: 0
ptp_rq2_mpwqe_filler_strides: 0
ptp_rq5_oversize_pkts_sw_drop: 0
ptp_rq6_buff_alloc_err: 0
ptp_rq15_cqe_compress_blks: 0
ptp_rq2_cqe_compress_pkts: 0
ptp_rq2_cache_reuse: 0
ptp_rq12_cache_full: 0
ptp_rq11_cache_empty: 256
ptp_rq12_cache_busy: 0
ptp_rq11_cache_waive: 0
ptp_rq12_congst_umr: 0
ptp_rq11_arfs_err: 0
ptp_rq9_recover: 0After applying the patch:
ethtool -S eth3 | grep ptp_rq
ptp_rq0_packets: 0
ptp_rq0_bytes: 0
ptp_rq0_csum_complete: 0
ptp_rq0_csum_complete_tail: 0
ptp_rq0_csum_complete_tail_slow : 0
ptp_rq0_csum_unnecessary: 0
ptp_rq0_csum_unnecessary_inner: 0
ptp_rq0_csum_none: 0
ptp_rq0_xdp_drop: 0
ptp_rq0_xdp_redirect: 0
ptp_rq0_lro_packets: 0
ptp_rq0_lro_bytes: 0
ptp_rq0_ecn_mark: 0
ptp_rq0_removed_vlan_packets: 0
ptp_rq0_wqe_err: 0
ptp_rq0_mpwqe_filler_cqes: 0
ptp_rq0_mpwqe_filler_strides: 0
ptp_rq0_oversize_pkts_sw_drop: 0
ptp_rq0_buff_alloc_err: 0
ptp_rq0_cqe_compress_blks: 0
ptp_rq0_cqe_compress_pkts: 0
ptp_rq0_cache_reuse: 0
ptp_rq0_cache_full: 0
ptp_rq0_cache_empty: 256
ptp_rq0_cache_busy: 0
ptp_rq0_cache_waive: 0
ptp_rq0_congst_umr: 0
ptp_rq0_arfs_err: 0
ptp_rq0_recover: 0--- drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 3 +-- drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h | 2 ++ drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 3 ++- 3 files changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c +1 -2
@@ -13,8 +13,6 @@ struct mlx5e_ptp_fs {bool valid; }; -#define MLX5E_PTP_CHANNEL_IX 0 -struct mlx5e_ptp_params {struct mlx5e_params params;struct mlx5e_sq_param txq_sq_param;
@@ -505,6 +503,7 @@ static int mlx5e_init_ptp_rq(struct mlx5e_ptp *c, struct mlx5e_params *params, rq->mdev = mdev; rq->hw_mtu =MLX5E_SW2HW_MTU (params, params->sw_mtu); rq->stats = &c->priv->ptp_stats.rq; + rq->ix =MLX5E_PTP_CHANNEL_IX ; rq->ptp_cyc2time =mlx5_rq_ts_translator (mdev); err =mlx5e_rq_set_handlers (rq, params, false);if (err)
drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h +2 -0
@@ -8,6 +8,8 @@#include "en_stats.h" #include <linux/ptp_classify.h> +#define MLX5E_PTP_CHANNEL_IX 0 +struct mlx5e_ptpsq {struct mlx5e_txqsq txqsq;struct mlx5e_cq ts_cq;
drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +2 -1
@@ -34,6 +34,7 @@#include "en.h" #include "en_accel/tls.h" #include "en_accel/en_accel.h" +#include "en/ptp.h" static unsigned int stats_grps_num (struct mlx5e_priv *priv) {
@@ -2076,7 +2077,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS(ptp)if (priv->rx_ptp_opened) {for (i =0 ; i <NUM_PTP_RQ_STATS ; i++)sprintf (data + (idx++) *ETH_GSTRING_LEN , - ptp_rq_stats_desc[i].format); + ptp_rq_stats_desc[i].format,MLX5E_PTP_CHANNEL_IX ); }return idx; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 66/151 libbpf: Fix segfault in light skeleton for objects without BTF
In reply to Greg Kroah-HartmanFrom: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit 4729445b47efebf089da4ccbcd1b116ffa2ad4af ]
When fed an empty BPF object, bpftool gen skeleton -L crashes at btf__set_fd() since it assumes presence of obj->btf, however for the sequence below clang adds no .BTF section (hence no BTF).
Reproducer:
$ touch a.bpf.c $ clang -O2 -g -target bpf -c a.bpf.c $ bpftool gen skeleton -L a.bpf.o /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ /* THIS FILE IS AUTOGENERATED! */
struct a_bpf {
struct bpf_loader_ctx ctx;Segmentation fault (core dumped)
The same occurs for files compiled without BTF info, i.e. without clang's -g flag.
--- tools/lib/bpf/libbpf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/lib/bpf/libbpf.c +2 -1
@@ -8115,7 +8115,8 @@ int bpf_object__load_xattr(struct bpf_object_load_attr *attr)if (obj->gen_loader) {/* reset FDs */ -btf__set_fd (obj->btf,-1 ); +if (obj->btf) +btf__set_fd (obj->btf,-1 );for (i =0 ; i < obj->nr_maps; i++) obj->maps[i].fd =-1 ;if (!err)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 67/151 phy: mdio: fix memory leak
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit ca6e11c337daf7925ff8a2aac8e84490a8691905 ]
Syzbot reported memory leak in MDIO bus interface, the problem was in wrong state logic.
MDIOBUS_ALLOCATED indicates 2 states:
1. Bus is only allocated
2. Bus allocated and __mdiobus_register() fails, but device_register() was called
In case of device_register() has been called we should call put_device() to correctly free the memory allocated for this device, but mdiobus_free() calls just kfree(dev) in case of MDIOBUS_ALLOCATED state
To avoid this behaviour we need to set bus->state to MDIOBUS_UNREGISTERED _before_ calling device_register(), because put_device() should be called even in case of device_register() failure.
--- drivers/net/phy/mdio_bus.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/phy/mdio_bus.c +7 -0
@@ -538,6 +538,13 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) bus->dev.groups =NULL ;dev_set_name (&bus->dev,"%s" , bus->id); +/* We need to set state to MDIOBUS_UNREGISTERED to correctly release +* the device in mdiobus_free() +* +* State will be updated later in this function in case of success +*/ + bus->state =MDIOBUS_UNREGISTERED ; + err =device_register (&bus->dev);if (err) {pr_err ("mii_bus %s failed to register\n" , bus->id);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 68/151 libbpf: Fix memory leak in strset
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit b0e875bac0fab3e7a7431c2eee36a8ccc0c712ac ]
Free struct strset itself, not just its internal parts.
--- tools/lib/bpf/strset.c | 1 + 1 file changed, 1 insertion(+)
tools/lib/bpf/strset.c +1 -0
@@ -88,6 +88,7 @@ void strset__free(struct strset *set)hashmap__free (set->strs_hash);free (set->strs_data); +free (set); }size_t strset__data_size (const struct strset *set)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 69/151 net_sched: fix NULL deref in fifo_set_limit()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 560ee196fe9e5037e5015e2cdb14b3aecb1cd7dc ]
syzbot reported another NULL deref in fifo_set_limit() [1]
I could repro the issue with :
unshare -n
tc qd add dev lo root handle 1:0 tbf limit 200000 burst 70000 rate 100Mbit tc qd replace dev lo parent 1:0 pfifo_fast
tc qd change dev lo root handle 1:0 tbf limit 300000 burst 70000 rate 100Mbit
pfifo_fast does not have a change() operation.
Make fifo_set_limit() more robust about this.
[1]
BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 1cf99067 P4D 1cf99067 PUD 7ca49067 PMD 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 1 PID: 14443 Comm: syz-executor959 Not tainted 5.15.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:0x0 Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. RSP: 0018:ffffc9000e2f7310 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffffff8d6ecc00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff888024c27910 RDI: ffff888071e34000 RBP: ffff888071e34000 R08: 0000000000000001 R09: ffffffff8fcfb947 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888024c27910 R13: ffff888071e34018 R14: 0000000000000000 R15: ffff88801ef74800 FS: 00007f321d897700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000000722c3000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: fifo_set_limit net/sched/sch_fifo.c:242 [inline] fifo_set_limit+0x198/0x210 net/sched/sch_fifo.c:227 tbf_change+0x6ec/0x16d0 net/sched/sch_tbf.c:418 qdisc_change net/sched/sch_api.c:1332 [inline] tc_modify_qdisc+0xd9a/0x1a60 net/sched/sch_api.c:1634 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409 ___sys_sendmsg+0xf3/0x170 net/socket.c:2463 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
--- net/sched/sch_fifo.c | 3 +++ 1 file changed, 3 insertions(+)
net/sched/sch_fifo.c +3 -0
@@ -233,6 +233,9 @@ int fifo_set_limit(struct Qdisc *q, unsigned int limit)if (strncmp (q->ops->id +1 ,"fifo" ,4 ) !=0 )return 0 ; +if (!q->ops->change) +return 0 ; + nla =kmalloc (nla_attr_size (sizeof (struct tc_fifo_qopt )),GFP_KERNEL );if (nla) { nla->nla_type =RTM_NEWQDISC ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 70/151 net: mscc: ocelot: fix VCAP filters remaining active after being deleted
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 019d9329e7481cfaccbd8ed17b1e04ca76970f13 ]
When ocelot_flower.c calls ocelot_vcap_filter_add(), the filter has a given filter->id.cookie. This filter is added to the block->rules list.
However, when ocelot_flower.c calls ocelot_vcap_block_find_filter_by_id() which passes the cookie as argument, the filter is never found by filter->id.cookie when searching through the block->rules list.
This is unsurprising, since the filter->id.cookie is an unsigned long, but the cookie argument provided to ocelot_vcap_block_find_filter_by_id() is a signed int, and the comparison fails.
--- drivers/net/ethernet/mscc/ocelot_vcap.c | 4 ++-- include/soc/mscc/ocelot_vcap.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/mscc/ocelot_vcap.c +2 -2
@@ -998,8 +998,8 @@ ocelot_vcap_block_find_filter_by_index(struct ocelot_vcap_block *block, }struct ocelot_vcap_filter * -ocelot_vcap_block_find_filter_by_id (struct ocelot_vcap_block *block,int cookie, -bool tc_offload) +ocelot_vcap_block_find_filter_by_id (struct ocelot_vcap_block *block, +unsigned long cookie,bool tc_offload) {struct ocelot_vcap_filter *filter;
include/soc/mscc/ocelot_vcap.h +2 -2
@@ -694,7 +694,7 @@ int ocelot_vcap_filter_add(struct ocelot *ocelot,int ocelot_vcap_filter_del (struct ocelot *ocelot,struct ocelot_vcap_filter *rule);struct ocelot_vcap_filter * -ocelot_vcap_block_find_filter_by_id (struct ocelot_vcap_block *block,int id, -bool tc_offload); +ocelot_vcap_block_find_filter_by_id (struct ocelot_vcap_block *block, +unsigned long cookie,bool tc_offload);#endif /* _OCELOT_VCAP_H_ */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 71/151 net: stmmac: dwmac-rk: Fix ethernet on rk3399 based devices
In reply to Greg Kroah-HartmanFrom: Punit Agrawal <[email protected]>
[ Upstream commit aec3f415f7244b7747a7952596971adb0df2f568 ]
Commit 2d26f6e39afb ("net: stmmac: dwmac-rk: fix unbalanced pm_runtime_enable warnings") while getting rid of a runtime PM warning ended up breaking ethernet
on rk3399 based devices. By dropping an extra reference to the device,
the commit ends up enabling suspend / resume of the ethernet device - which appears to be broken.
While the issue with runtime pm is being investigated, partially revert commit 2d26f6e39afb to restore the network on rk3399.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +5 -0
@@ -21,6 +21,7 @@#include <linux/delay.h> #include <linux/mfd/syscon.h> #include <linux/regmap.h> +#include <linux/pm_runtime.h> #include "stmmac_platform.h"
@@ -1528,6 +1529,8 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv)return ret; } +pm_runtime_get_sync (dev); +if (bsp_priv->integrated_phy)rk_gmac_integrated_phy_powerup (bsp_priv);
@@ -1539,6 +1542,8 @@ static void rk_gmac_powerdown(struct rk_priv_data *gmac)if (gmac->integrated_phy)rk_gmac_integrated_phy_powerdown (gmac); +pm_runtime_put_sync (&gmac->pdev->dev); +phy_power_on (gmac, false);gmac_clk_enable (gmac, false); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 72/151 MIPS: Revert "add support for buggy MT7621S core detection"
In reply to Greg Kroah-HartmanFrom: Ilya Lipnitskiy <[email protected]>
[ Upstream commit 740da9d7ca4e25f5d87db9f80d75432681b61305 ]
This reverts commit 6decd1aad15f56b169217789630a0098b496de0e. CPULAUNCH register is not set properly by some bootloaders, causing a regression until a bootloader change is made, which is hard if not impossible on some embedded devices. Revert the change until a more robust core detection mechanism that works on MT7621S routers such as Netgear R6220 as well as platforms like Digi EX15 can be made.
--- arch/mips/include/asm/mips-cps.h | 23 +---------------------- 1 file changed, 1 insertion(+), 22 deletions(-)
arch/mips/include/asm/mips-cps.h +1 -22
@@ -10,8 +10,6 @@#include <linux/io.h> #include <linux/types.h> -#include <asm/mips-boards/launch.h> - extern unsigned long __cps_access_bad_size(void) __compiletime_error("Bad size for CPS accessor");
@@ -167,30 +165,11 @@ static inline uint64_t mips_cps_cluster_config(unsigned int cluster)*/ static inline unsigned int mips_cps_numcores (unsigned int cluster) { -unsigned int ncores; -if (!mips_cm_present ())return 0 ;/* Add one before masking to handle 0xff indicating no cores */ - ncores = (mips_cps_cluster_config (cluster) +1 ) &CM_GCR_CONFIG_PCORES ; - -if (IS_ENABLED (CONFIG_SOC_MT7621 )) { -struct cpulaunch *launch; - -/* -* Ralink MT7621S SoC is single core, but the GCR_CONFIG method -* always reports 2 cores. Check the second core's LAUNCH_FREADY -* flag to detect if the second core is missing. This method -* only works before the core has been started. -*/ - launch = (struct cpulaunch *)CKSEG0ADDR (CPULAUNCH ); - launch +=2 ;/* MT7621 has 2 VPEs per core */ -if (!(launch->flags &LAUNCH_FREADY )) - ncores =1 ; - } - -return ncores; +return (mips_cps_cluster_config (cluster) +1 ) &CM_GCR_CONFIG_PCORES ; }/**
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 73/151 netfilter: nf_tables: honor NLM_F_CREATE and NLM_F_EXCL in event notification
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 6fb721cf781808ee2ca5e737fb0592cc68de3381 ]
Include the NLM_F_CREATE and NLM_F_EXCL flags in netlink event notifications, otherwise userspace cannot distiguish between create and add commands.
--- include/net/netfilter/nf_tables.h | 2 +- net/netfilter/nf_tables_api.c | 47 +++++++++++++++++++++++-------- net/netfilter/nft_quota.c | 2 +- 3 files changed, 37 insertions(+), 14 deletions(-)
include/net/netfilter/nf_tables.h +1 -1
@@ -1202,7 +1202,7 @@ struct nft_object *nft_obj_lookup(const struct net *net,void nft_obj_notify (struct net *net,const struct nft_table *table,struct nft_object *obj,u32 portid,u32 seq, -int event,int family,int report,gfp_t gfp); +int event,u16 flags,int family,int report,gfp_t gfp);/** * struct nft_object_type - stateful object type
net/netfilter/nf_tables_api.c +35 -12
152 lines not on this page · raw message
net/netfilter/nft_quota.c +1 -1
@@ -60,7 +60,7 @@ static void nft_quota_obj_eval(struct nft_object *obj,if (overquota && !test_and_set_bit (NFT_QUOTA_DEPLETED_BIT , &priv->flags))nft_obj_notify (nft_net (pkt), obj->key.table, obj,0 ,0 , -NFT_MSG_NEWOBJ ,nft_pf (pkt),0 ,GFP_ATOMIC ); +NFT_MSG_NEWOBJ ,0 ,nft_pf (pkt),0 ,GFP_ATOMIC ); } static int nft_quota_do_init(const struct nlattr * const tb[],
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 74/151 powerpc/fsl/dts: Fix phy-connection-type for fm1mac3
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit eed183abc0d3b8adb64fd1363b7cea7986cd58d6 ]
Property phy-connection-type contains invalid value "sgmii-2500" per scheme defined in file ethernet-controller.yaml.
Correct phy-connection-type value should be "2500base-x".
--- arch/powerpc/boot/dts/fsl/t1023rdb.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/boot/dts/fsl/t1023rdb.dts +1 -1
@@ -154,7 +154,7 @@ fm1mac3: ethernet@e4000 { phy-handle = <&sgmii_aqr_phy3>; - phy-connection-type = "sgmii-2500"; + phy-connection-type = "2500base-x"; sleep = <&rcpm 0x20000000>; };
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 75/151 ptp_pch: Load module automatically if ID matches
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 7cd8b1542a7ba0720c5a0a85ed414a122015228b ]
The driver can't be loaded automatically because it misses module alias to be provided. Add corresponding MODULE_DEVICE_TABLE() call to the driver.
--- drivers/ptp/ptp_pch.c | 1 + 1 file changed, 1 insertion(+)
drivers/ptp/ptp_pch.c +1 -0
@@ -644,6 +644,7 @@ static const struct pci_device_id pch_ieee1588_pcidev_id[] = { }, {0} }; +MODULE_DEVICE_TABLE (pci, pch_ieee1588_pcidev_id); static SIMPLE_DEV_PM_OPS(pch_pm_ops, pch_suspend, pch_resume);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 76/151 ARM: dts: imx: change the spi-nor tx
In reply to Greg Kroah-HartmanFrom: Haibo Chen <[email protected]>
[ Upstream commit b2a4f4a302b83976ad0d2930abe0f38e6119a144 ]
Before commit 0e30f47232ab5 ("mtd: spi-nor: add support for DTR protocol"), for all PP command, it only support 1-1-1 mode, no matter the tx setting in dts. But after the upper commit, the logic change. It will choose the best mode(fastest mode) which flash device and spi-nor host controller both support.
Though the spi-nor device on imx6sx-sdb/imx6ul(l/z)-14x14-evk board do not support PP-1-4-4/PP-1-1-4, but if tx is 4 in dts file, it will also impact the read mode selection. For the spi-nor device on the upper mentioned boards, they support read 1-4-4 mode and read 1-1-4 mode according to the device internal sfdp register. But qspi host controller do not support read 1-4-4 mode. so need to set the tx to 1, let the common code finally select read 1-1-4 mode, PP-1-1-1 mode.
--- arch/arm/boot/dts/imx6sx-sdb.dts | 4 ++-- arch/arm/boot/dts/imx6ul-14x14-evk.dtsi | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/imx6sx-sdb.dts +2 -2
@@ -114,7 +114,7 @@ compatible = "micron,n25q256a", "jedec,spi-nor"; spi-max-frequency = <29000000>; spi-rx-bus-width = <4>; - spi-tx-bus-width = <4>; + spi-tx-bus-width = <1>; reg = <0>; };
@@ -124,7 +124,7 @@ compatible = "micron,n25q256a", "jedec,spi-nor"; spi-max-frequency = <29000000>; spi-rx-bus-width = <4>; - spi-tx-bus-width = <4>; + spi-tx-bus-width = <1>; reg = <2>; }; };
arch/arm/boot/dts/imx6ul-14x14-evk.dtsi +1 -1
@@ -292,7 +292,7 @@ compatible = "micron,n25q256a", "jedec,spi-nor"; spi-max-frequency = <29000000>; spi-rx-bus-width = <4>; - spi-tx-bus-width = <4>; + spi-tx-bus-width = <1>; reg = <0>; }; };
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 77/151 arm64: dts: imx8: change the spi-nor tx
In reply to Greg Kroah-HartmanFrom: Haibo Chen <[email protected]>
[ Upstream commit 04aa946d57b20c40e541fb4ba2bcb390a22f404c ]
Before commit 0e30f47232ab5 ("mtd: spi-nor: add support for DTR protocol"), for all PP command, it only support 1-1-1 mode, no matter the tx setting in dts. But after the upper commit, the logic change. It will choose the best mode(fastest mode) which flash device and spi-nor host controller both support.
qspi and fspi host controller do not support read 1-4-4 mode. so need to set the tx to 1, let the common code finally select read 1-1-4 mode.
--- arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mm-evk.dts | 2 +- arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mp-phycore-som.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq-evk.dts | 2 ++ arch/arm64/boot/dts/freescale/imx8mq-kontron-pitx-imx8m.dts | 2 +- 6 files changed, 7 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi +1 -1
@@ -91,7 +91,7 @@ #size-cells = <1>; compatible = "jedec,spi-nor"; spi-max-frequency = <80000000>; - spi-tx-bus-width = <4>; + spi-tx-bus-width = <1>; spi-rx-bus-width = <4>; }; };
arch/arm64/boot/dts/freescale/imx8mm-evk.dts +1 -1
@@ -48,7 +48,7 @@ #size-cells = <1>; compatible = "jedec,spi-nor"; spi-max-frequency = <80000000>; - spi-tx-bus-width = <4>; + spi-tx-bus-width = <1>; spi-rx-bus-width = <4>; }; };
arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi +1 -1
@@ -101,7 +101,7 @@ #size-cells = <1>; compatible = "jedec,spi-nor"; spi-max-frequency = <80000000>; - spi-tx-bus-width = <4>; + spi-tx-bus-width = <1>; spi-rx-bus-width = <4>; }; };
arch/arm64/boot/dts/freescale/imx8mp-phycore-som.dtsi +1 -1
@@ -74,7 +74,7 @@ compatible = "jedec,spi-nor"; reg = <0>; spi-max-frequency = <80000000>; - spi-tx-bus-width = <4>; + spi-tx-bus-width = <1>; spi-rx-bus-width = <4>; }; };
arch/arm64/boot/dts/freescale/imx8mq-evk.dts +2 -0
@@ -337,6 +337,8 @@ #size-cells = <1>; compatible = "micron,n25q256a", "jedec,spi-nor"; spi-max-frequency = <29000000>; + spi-tx-bus-width = <1>; + spi-rx-bus-width = <4>; }; };
arch/arm64/boot/dts/freescale/imx8mq-kontron-pitx-imx8m.dts +1 -1
@@ -281,7 +281,7 @@ #address-cells = <1>; #size-cells = <1>; reg = <0>; - spi-tx-bus-width = <4>; + spi-tx-bus-width = <1>; spi-rx-bus-width = <4>; m25p,fast-read; spi-max-frequency = <50000000>;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 78/151 arm64: dts: imx8mm-kontron-n801x-som: do not allow to switch off buck2
In reply to Greg Kroah-HartmanFrom: Heiko Thiery <[email protected]>
[ Upstream commit 9786cca4b477f2b2f9d573d474c929d87579b501 ]
The buck2 output of the PMIC is the VDD core voltage of the cpu. Switching off this will poweroff the CPU. Add the 'regulator-always-on' property to avoid this.
--- arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi +1 -0
@@ -102,6 +102,7 @@ regulator-min-microvolt = <850000>; regulator-max-microvolt = <950000>; regulator-boot-on; + regulator-always-on; regulator-ramp-delay = <3125>; nxp,dvs-run-voltage = <950000>; nxp,dvs-standby-voltage = <850000>;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 79/151 arm64: dts: ls1028a: fix eSDHC2 node
In reply to Greg Kroah-HartmanFrom: Michael Walle <[email protected]>
[ Upstream commit 8b94aa318aa746fbbc668d6b9b3ad812c835230c ]
On the LS1028A this instance of the eSDHC controller is intended for either an eMMC or eSDIO card. It doesn't provide a card detect pin and its IO voltage is fixed at 1.8V.
Remove the bogus broken-cd property, instead add the non-removable property. Fix the voltage-ranges property and set it to 1.8V only.
--- arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +2 -2
@@ -405,9 +405,9 @@ interrupts = <GIC_SPI 63 IRQ_TYPE_LEVEL_HIGH>; clock-frequency = <0>; /* fixed up by bootloader */ clocks = <&clockgen QORIQ_CLK_HWACCEL 1>; - voltage-ranges = <1800 1800 3300 3300>; + voltage-ranges = <1800 1800>; sdhci,auto-cmd12; - broken-cd; + non-removable; little-endian; bus-width = <4>; status = "disabled";
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 80/151 dt-bindings: drm/bridge: ti-sn65dsi86: Fix reg value
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit b2d70c0dbf2731a37d1c7bcc86ab2387954d5f56 ]
make dtbs_check:
arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dt.yaml: bridge@2c: reg:0:0: 45 was expected
According to the datasheet, the I2C address can be either 0x2c or 0x2d, depending on the ADDR control input.
--- .../devicetree/bindings/display/bridge/ti,sn65dsi86.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/display/bridge/ti,sn65dsi86.yaml +1 -1
@@ -18,7 +18,7 @@ properties: const: ti,sn65dsi86 reg: - const: 0x2d + enum: [ 0x2c, 0x2d ] enable-gpios: maxItems: 1
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 81/151 ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence
In reply to Greg Kroah-HartmanFrom: Oleksij Rempel <[email protected]>
[ Upstream commit 783f3db030563f7bcdfe2d26428af98ea1699a8e ]
Any pending interrupt can prevent entering standby based power off state. To avoid it, disable the GIC CPU interface.
--- arch/arm/mach-imx/pm-imx6.c | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/mach-imx/pm-imx6.c +2 -0
@@ -10,6 +10,7 @@#include <linux/io.h> #include <linux/irq.h> #include <linux/genalloc.h> +#include <linux/irqchip/arm-gic.h> #include <linux/mfd/syscon.h> #include <linux/mfd/syscon/imx6q-iomuxc-gpr.h> #include <linux/of.h>
@@ -619,6 +620,7 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdatastatic void imx6_pm_stby_poweroff (void ) { +gic_cpu_if_down (0 );imx6_set_lpm (STOP_POWER_OFF );imx6q_suspend_finish (0 );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 82/151 drm/i915/audio: Use BIOS provided value for RKL HDA link
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit ffac30be2a06b2516b2ce2afa2dcb2cf8af65a52 ]
Commit 989634fb49ad ("drm/i915/audio: set HDA link parameters in driver") makes HDMI audio on Lenovo P350 disappear.
So in addition to TGL, extend the logic to RKL to use BIOS provided value to fix the regression.
--- drivers/gpu/drm/i915/display/intel_audio.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/display/intel_audio.c +3 -2
@@ -1308,8 +1308,9 @@ static void i915_audio_component_init(struct drm_i915_private *dev_priv)else aud_freq = aud_freq_init; -/* use BIOS provided value for TGL unless it is a known bad value */ -if (IS_TIGERLAKE (dev_priv) && aud_freq_init !=AUD_FREQ_TGL_BROKEN ) +/* use BIOS provided value for TGL and RKL unless it is a known bad value */ +if ((IS_TIGERLAKE (dev_priv) ||IS_ROCKETLAKE (dev_priv)) && + aud_freq_init !=AUD_FREQ_TGL_BROKEN ) aud_freq = aud_freq_init; drm_dbg_kms(&dev_priv->drm, "use AUD_FREQ_CNTRL of 0x%x (init value 0x%x)\n",
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 83/151 drm/i915/jsl: Add W/A 1409054076 for JSL
In reply to Greg Kroah-HartmanFrom: Tejas Upadhyay <[email protected]>
[ Upstream commit 544021e3f2aa3c4c6c5aabc58907e8bab69b3762 ]
When pipe A is disabled and MIPI DSI is enabled on pipe B, the AMT KVMR feature will incorrectly see pipe A as enabled. Set 0x42080 bit 23=1 before enabling DSI on pipe B and leave it set while DSI is enabled on pipe B. No impact to setting it all the time.
Changes since V5:
- Added reviewed-by
- Removed redundant braces and debug message format - Imre
Changes since V4:
- Modified function comment Wa_<number>:icl,jsl,ehl - Lucas
- Modified debug message in sync state - Imre
Changes since V3:
- More meaningful name to workaround - Imre
- Remove boolean check clear flag
- Add WA_verify hook in dsi sync_state
Changes since V2:
- Used REG_BIT, ignored pipe A and used sw state check - Jani
- Made function wrapper - Jani
Changes since V1:
- ./dim checkpatch errors addressed
--- drivers/gpu/drm/i915/display/icl_dsi.c | 42 ++++++++++++++++++++++++++ drivers/gpu/drm/i915/i915_reg.h | 1 + 2 files changed, 43 insertions(+)
drivers/gpu/drm/i915/display/icl_dsi.c +42 -0
@@ -1253,15 +1253,36 @@ static void gen11_dsi_pre_enable(struct intel_atomic_state *state,gen11_dsi_set_transcoder_timings (encoder, pipe_config); } +/* +* Wa_1409054076:icl,jsl,ehl +* When pipe A is disabled and MIPI DSI is enabled on pipe B, +* the AMT KVMR feature will incorrectly see pipe A as enabled. +* Set 0x42080 bit 23=1 before enabling DSI on pipe B and leave +* it set while DSI is enabled on pipe B +*/ +static void icl_apply_kvmr_pipe_a_wa (struct intel_encoder *encoder, +enum pipe pipe,bool enable) +{ +struct drm_i915_private *dev_priv =to_i915 (encoder->base.dev); + +if (DISPLAY_VER (dev_priv) ==11 && pipe ==PIPE_B ) +intel_de_rmw (dev_priv,CHICKEN_PAR1_1 , +IGNORE_KVMR_PIPE_A , + enable ?IGNORE_KVMR_PIPE_A :0 ); +}static void gen11_dsi_enable (struct intel_atomic_state *state,struct intel_encoder *encoder,const struct intel_crtc_state *crtc_state,const struct drm_connector_state *conn_state) {struct intel_dsi *intel_dsi =enc_to_intel_dsi (encoder); +struct intel_crtc *crtc =to_intel_crtc (conn_state->crtc);drm_WARN_ON (state->base.dev, crtc_state->has_pch_encoder); +/* Wa_1409054076:icl,jsl,ehl */ +icl_apply_kvmr_pipe_a_wa (encoder, crtc->pipe, true); +/* step6d: enable dsi transcoder */ gen11_dsi_enable_transcoder (encoder);
@@ -1415,6 +1436,7 @@ static void gen11_dsi_disable(struct intel_atomic_state *state, const struct drm_connector_state *old_conn_state) {struct intel_dsi *intel_dsi =enc_to_intel_dsi (encoder); +struct intel_crtc *crtc =to_intel_crtc (old_conn_state->crtc);/* step1: turn off backlight */ intel_dsi_vbt_exec_sequence (intel_dsi,MIPI_SEQ_BACKLIGHT_OFF );
@@ -1423,6 +1445,9 @@ static void gen11_dsi_disable(struct intel_atomic_state *state,/* step2d,e: disable transcoder and wait */ gen11_dsi_disable_transcoder (encoder); +/* Wa_1409054076:icl,jsl,ehl */ +icl_apply_kvmr_pipe_a_wa (encoder, crtc->pipe, false); +/* step2f,g: powerdown panel */ gen11_dsi_powerdown_panel (encoder);
@@ -1548,6 +1573,22 @@ static void gen11_dsi_get_config(struct intel_encoder *encoder, pipe_config->mode_flags |=I915_MODE_FLAG_DSI_PERIODIC_CMD_MODE ; } +static void gen11_dsi_sync_state (struct intel_encoder *encoder, +const struct intel_crtc_state *crtc_state) +{ +struct drm_i915_private *dev_priv =to_i915 (encoder->base.dev); +struct intel_crtc *intel_crtc =to_intel_crtc (crtc_state->uapi.crtc); +enum pipe pipe = intel_crtc->pipe; + +/* wa verify 1409054076:icl,jsl,ehl */ +if (DISPLAY_VER (dev_priv) ==11 && pipe ==PIPE_B && + !(intel_de_read (dev_priv,CHICKEN_PAR1_1 ) &IGNORE_KVMR_PIPE_A )) +drm_dbg_kms (&dev_priv->drm, +"[ENCODER:%d:%s] BIOS left IGNORE_KVMR_PIPE_A cleared with pipe B enabled\n" , + encoder->base.base.id, + encoder->base.name); +} +static int gen11_dsi_dsc_compute_config (struct intel_encoder *encoder,struct intel_crtc_state *crtc_state) {
@@ -1966,6 +2007,7 @@ void icl_dsi_init(struct drm_i915_private *dev_priv) encoder->post_disable = gen11_dsi_post_disable; encoder->port = port; encoder->get_config = gen11_dsi_get_config; + encoder->sync_state = gen11_dsi_sync_state; encoder->update_pipe = intel_panel_update_backlight; encoder->compute_config = gen11_dsi_compute_config; encoder->get_hw_state = gen11_dsi_get_hw_state;
drivers/gpu/drm/i915/i915_reg.h +1 -0
@@ -8113,6 +8113,7 @@ enum {# define CHICKEN3_DGMG_DONE_FIX_DISABLE (1 << 2)#define CHICKEN_PAR1_1 _MMIO(0x42080) +#define IGNORE_KVMR_PIPE_A REG_BIT(23)#define KBL_ARB_FILL_SPARE_22 REG_BIT(22)#define DIS_RAM_BYPASS_PSR2_MAN_TRACK (1 << 16)#define SKL_DE_COMPRESSED_HASH_MODE (1 << 15)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 84/151 drm/i915/tc: Fix TypeC port init/resume time sanitization
In reply to Greg Kroah-HartmanFrom: Imre Deak <[email protected]>
[ Upstream commit a532cde31de3cae6ed60e60d6f9379771f652809 ]
Atm during driver loading and system resume TypeC ports are accessed before their HW/SW state is synced. Move the TypeC port sanitization to the encoder's sync_state hook to fix this.
v2: Handle the encoder disabled case in gen11_dsi_sync_state() as well
(Jose, Jani)
--- drivers/gpu/drm/i915/display/icl_dsi.c | 10 ++++++++-- drivers/gpu/drm/i915/display/intel_ddi.c | 8 +++++++- drivers/gpu/drm/i915/display/intel_display.c | 20 +++++--------------- 3 files changed, 20 insertions(+), 18 deletions(-)
drivers/gpu/drm/i915/display/icl_dsi.c +8 -2
@@ -1577,8 +1577,14 @@ static void gen11_dsi_sync_state(struct intel_encoder *encoder, const struct intel_crtc_state *crtc_state) {struct drm_i915_private *dev_priv =to_i915 (encoder->base.dev); -struct intel_crtc *intel_crtc =to_intel_crtc (crtc_state->uapi.crtc); -enum pipe pipe = intel_crtc->pipe; +struct intel_crtc *intel_crtc; +enum pipe pipe; + +if (!crtc_state) +return ; + + intel_crtc =to_intel_crtc (crtc_state->uapi.crtc); + pipe = intel_crtc->pipe;/* wa verify 1409054076:icl,jsl,ehl */ if (DISPLAY_VER(dev_priv) == 11 && pipe == PIPE_B &&
drivers/gpu/drm/i915/display/intel_ddi.c +7 -1
@@ -3899,7 +3899,13 @@ void hsw_ddi_get_config(struct intel_encoder *encoder,static void intel_ddi_sync_state (struct intel_encoder *encoder,const struct intel_crtc_state *crtc_state) { -if (intel_crtc_has_dp_encoder (crtc_state)) +struct drm_i915_private *i915 =to_i915 (encoder->base.dev); +enum phy phy =intel_port_to_phy (i915, encoder->port); + +if (intel_phy_is_tc (i915, phy)) +intel_tc_port_sanitize (enc_to_dig_port (encoder)); + +if (crtc_state &&intel_crtc_has_dp_encoder (crtc_state))intel_dp_sync_state (encoder, crtc_state); }
drivers/gpu/drm/i915/display/intel_display.c +5 -15
@@ -12933,18 +12933,16 @@ static void intel_modeset_readout_hw_state(struct drm_device *dev)readout_plane_state (dev_priv);for_each_intel_encoder (dev, encoder) { +struct intel_crtc_state *crtc_state =NULL ; + pipe =0 ;if (encoder->get_hw_state (encoder, &pipe)) { -struct intel_crtc_state *crtc_state; - crtc =intel_get_crtc_for_pipe (dev_priv, pipe); crtc_state =to_intel_crtc_state (crtc->base.state); encoder->base.crtc = &crtc->base;intel_encoder_get_config (encoder, crtc_state); -if (encoder->sync_state) - encoder->sync_state (encoder, crtc_state);/* read out to slave crtc as well for bigjoiner */ if (crtc_state->bigjoiner) {
@@ -12959,6 +12957,9 @@ static void intel_modeset_readout_hw_state(struct drm_device *dev) encoder->base.crtc =NULL ; } +if (encoder->sync_state) + encoder->sync_state (encoder, crtc_state); + drm_dbg_kms(&dev_priv->drm, "[ENCODER:%d:%s] hw state readout: %s, pipe %c\n", encoder->base.base.id, encoder->base.name,
@@ -13241,17 +13242,6 @@ intel_modeset_setup_hw_state(struct drm_device *dev,intel_modeset_readout_hw_state (dev);/* HW state is read out, now we need to sanitize this mess. */ - -/* Sanitize the TypeC port mode upfront, encoders depend on this */ -for_each_intel_encoder (dev, encoder) { -enum phy phy =intel_port_to_phy (dev_priv, encoder->port); - -/* We need to sanitize only the MST primary port. */ -if (encoder->type !=INTEL_OUTPUT_DP_MST && -intel_phy_is_tc (dev_priv, phy)) -intel_tc_port_sanitize (enc_to_dig_port (encoder)); - } -get_encoder_power_domains (dev_priv);if (HAS_PCH_IBX (dev_priv))
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 85/151 drm/i915/bdb: Fix version check
In reply to Greg Kroah-HartmanFrom: Lukasz Majczak <[email protected]>
[ Upstream commit fdddf8c3a477f77b3a623f220e78d45e89fc50d5 ]
With patch "drm/i915/vbt: Fix backlight parsing for VBT 234+" the size of bdb_lfp_backlight_data structure has been increased, causing if-statement in the parse_lfp_backlight function that comapres this structure size to the one retrieved from BDB, always to fail for older revisions.
This patch calculates expected size of the structure for a given BDB version and compares it with the value gathered from BDB. Tested on Chromebook Pixelbook (Nocturne) (reports bdb->version = 221)
--- drivers/gpu/drm/i915/display/intel_bios.c | 22 ++++++++++++++----- drivers/gpu/drm/i915/display/intel_vbt_defs.h | 5 +++++ 2 files changed, 21 insertions(+), 6 deletions(-)
drivers/gpu/drm/i915/display/intel_bios.c +16 -6
@@ -451,13 +451,23 @@ parse_lfp_backlight(struct drm_i915_private *i915, } i915->vbt.backlight.type =INTEL_BACKLIGHT_DISPLAY_DDI ; -if (bdb->version >=191 && -get_blocksize (backlight_data) >=sizeof (*backlight_data)) { -const struct lfp_backlight_control_method *method; +if (bdb->version >=191 ) { +size_t exp_size; - method = &backlight_data->backlight_control[panel_type]; - i915->vbt.backlight.type = method->type; - i915->vbt.backlight.controller = method->controller; +if (bdb->version >=236 ) + exp_size =sizeof (struct bdb_lfp_backlight_data ); +else if (bdb->version >=234 ) + exp_size =EXP_BDB_LFP_BL_DATA_SIZE_REV_234 ; +else + exp_size =EXP_BDB_LFP_BL_DATA_SIZE_REV_191 ; + +if (get_blocksize (backlight_data) >= exp_size) { +const struct lfp_backlight_control_method *method; + + method = &backlight_data->backlight_control[panel_type]; + i915->vbt.backlight.type = method->type; + i915->vbt.backlight.controller = method->controller; + } } i915->vbt.backlight.pwm_freq_hz = entry->pwm_freq_hz;
drivers/gpu/drm/i915/display/intel_vbt_defs.h +5 -0
@@ -814,6 +814,11 @@ struct lfp_brightness_level {u16 reserved; } __packed; +#define EXP_BDB_LFP_BL_DATA_SIZE_REV_191 \ + offsetof(struct bdb_lfp_backlight_data, brightness_level) +#define EXP_BDB_LFP_BL_DATA_SIZE_REV_234 \ + offsetof(struct bdb_lfp_backlight_data, brightness_precision_bits) +struct bdb_lfp_backlight_data {u8 entry_size;struct lfp_backlight_data_entry data[16 ];
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 86/151 netfs: Fix READ/WRITE confusion when calling iov_iter_xarray()
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 330de47d14af0c3995db81cc03cf5ca683d94d81 ]
Fix netfs_clear_unread() to pass READ to iov_iter_xarray() instead of WRITE (the flag is about the operation accessing the buffer, not what sort of access it is doing to the buffer).
--- fs/netfs/read_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/netfs/read_helper.c +1 -1
@@ -150,7 +150,7 @@ static void netfs_clear_unread(struct netfs_read_subrequest *subreq) {struct iov_iter iter; -iov_iter_xarray (&iter,WRITE , &subreq->rreq->mapping->i_pages, +iov_iter_xarray (&iter,READ , &subreq->rreq->mapping->i_pages, subreq->start + subreq->transferred, subreq->len - subreq->transferred);iov_iter_zero (iov_iter_count (&iter), &iter);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 87/151 afs: Fix afs_launder_page() to set correct start file position
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 5c0522484eb54b90f2e46a5db8d7a4ff3ff86e5d ]
Fix afs_launder_page() to set the starting position of the StoreData RPC at the offset into the page at which the modified data starts instead of at the beginning of the page (the iov_iter is correctly offset).
The offset got lost during the conversion to passing an iov_iter into afs_store_data().
Changes:
ver #2:
- Use page_offset() rather than manually calculating it[1].
--- fs/afs/write.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/afs/write.c +1 -2
@@ -974,8 +974,7 @@ int afs_launder_page(struct page *page)iov_iter_bvec (&iter,WRITE , bv,1 , bv[0 ].bv_len);trace_afs_page_dirty (vnode,tracepoint_string ("launder" ), page); - ret =afs_store_data (vnode, &iter, (loff_t )page->index *PAGE_SIZE , - true); + ret =afs_store_data (vnode, &iter,page_offset (page) + f, true); }trace_afs_page_dirty (vnode,tracepoint_string ("laundered" ), page);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 88/151 net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit dbe0b88064494b7bb6a9b2aa7e085b14a3112d44 ]
bridge_fill_linkxstats() is using nla_reserve_64bit().
We must use nla_total_size_64bit() instead of nla_total_size() for corresponding data structure.
--- net/bridge/br_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_netlink.c +1 -1
@@ -1657,7 +1657,7 @@ static size_t br_get_linkxstats_size(const struct net_device *dev, int attr) }return numvls *nla_total_size (sizeof (struct bridge_vlan_xstats )) + -nla_total_size (sizeof (struct br_mcast_stats )) + +nla_total_size_64bit (sizeof (struct br_mcast_stats )) +nla_total_size (0 ); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 89/151 net: bridge: fix under estimation in br_get_linkxstats_size()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 0854a0513321cf70bea5fa483ebcaa983cc7c62e ]
Commit de1799667b00 ("net: bridge: add STP xstats") added an additional nla_reserve_64bit() in br_fill_linkxstats(), but forgot to update br_get_linkxstats_size() accordingly.
This can trigger the following in rtnl_stats_get()
WARN_ON(err == -EMSGSIZE);
--- net/bridge/br_netlink.c | 1 + 1 file changed, 1 insertion(+)
net/bridge/br_netlink.c +1 -0
@@ -1658,6 +1658,7 @@ static size_t br_get_linkxstats_size(const struct net_device *dev, int attr)return numvls *nla_total_size (sizeof (struct bridge_vlan_xstats )) +nla_total_size_64bit (sizeof (struct br_mcast_stats )) + + (p ?nla_total_size_64bit (sizeof (p->stp_xstats)) :0 ) +nla_total_size (0 ); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 90/151 net/sched: sch_taprio: properly cancel timer from taprio_destroy()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit a56d447f196fa9973c568f54c0d76d5391c3b0c0 ]
There is a comment in qdisc_create() about us not calling ops->reset() in some cases.
err_out4:
/* * Any broken qdiscs that would require a ops->reset() here? * The qdisc was never in action so it shouldn't be necessary. */
As taprio sets a timer before actually receiving a packet, we need to cancel it from ops->destroy, just in case ops->reset has not been called.
syzbot reported:
ODEBUG: free active (active state 0) object type: hrtimer hint: advance_sched+0x0/0x9a0 arch/x86/include/asm/atomic64_64.h:22
WARNING: CPU: 0 PID: 8441 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505 Modules linked in: CPU: 0 PID: 8441 Comm: syz-executor813 Not tainted 5.14.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505 Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 d3 e3 89 4c 89 ee 48 c7 c7 e0 c7 e3 89 e8 5b 86 11 05 <0f> 0b 83 05 85 03 92 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3 RSP: 0018:ffffc9000130f330 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff88802baeb880 RSI: ffffffff815d87b5 RDI: fffff52000261e58 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815d25ee R11: 0000000000000000 R12: ffffffff898dd020 R13: ffffffff89e3ce20 R14: ffffffff81653630 R15: dffffc0000000000 FS: 0000000000f0d300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffb64b3e000 CR3: 0000000036557000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __debug_check_no_obj_freed lib/debugobjects.c:987 [inline] debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1018 slab_free_hook mm/slub.c:1603 [inline] slab_free_freelist_hook+0x171/0x240 mm/slub.c:1653 slab_free mm/slub.c:3213 [inline] kfree+0xe4/0x540 mm/slub.c:4267 qdisc_create+0xbcf/0x1320 net/sched/sch_api.c:1299 tc_modify_qdisc+0x4c8/0x1a60 net/sched/sch_api.c:1663 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5571 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2403 ___sys_sendmsg+0xf3/0x170 net/socket.c:2457 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
--- net/sched/sch_taprio.c | 4 ++++ 1 file changed, 4 insertions(+)
net/sched/sch_taprio.c +4 -0
@@ -1641,6 +1641,10 @@ static void taprio_destroy(struct Qdisc *sch)list_del (&q->taprio_list);spin_unlock (&taprio_list_lock); +/* Note that taprio_reset() might not be called if an error +* happens in qdisc_create(), after taprio_init() has been called. +*/ +hrtimer_cancel (&q->advance_timer);taprio_disable_offload (dev, q,NULL );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 91/151 net: sfp: Fix typo in state machine debug string
In reply to Greg Kroah-HartmanFrom: Sean Anderson <[email protected]>
[ Upstream commit 25a9da6641f1f66006e93ddbefee13a437efa8c0 ]
The string should be "tx_disable" to match the state enum.
--- drivers/net/phy/sfp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/phy/sfp.c +1 -1
@@ -134,7 +134,7 @@ static const char * const sm_state_strings[] = { [SFP_S_LINK_UP] = "link_up", [SFP_S_TX_FAULT] = "tx_fault", [SFP_S_REINIT] = "reinit", - [SFP_S_TX_DISABLE] = "rx_disable", + [SFP_S_TX_DISABLE] = "tx_disable", };static const char *sm_state_to_str (unsigned short sm_state)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 92/151 net: pcs: xpcs: fix incorrect CL37 AN sequence
In reply to Greg Kroah-HartmanFrom: Wong Vee Khee <[email protected]>
[ Upstream commit e3cf002d5a4452f8adc5543df341cf96fd702fcf ]
According to Synopsys DesignWare Cores Ethernet PCS databook, it is required to disable Clause 37 auto-negotiation by programming bit-12 (AN_ENABLE) to 0 if it is already enabled, before programming various fields of VR_MII_AN_CTRL registers.
After all these programming are done, it is then required to enable Clause 37 auto-negotiation by programming bit-12 (AN_ENABLE) to 1.
--- drivers/net/pcs/pcs-xpcs.c | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-)
drivers/net/pcs/pcs-xpcs.c +27 -5
@@ -693,14 +693,17 @@ EXPORT_SYMBOL_GPL(xpcs_config_eee);static int xpcs_config_aneg_c37_sgmii (struct dw_xpcs *xpcs,unsigned int mode) { -int ret; +int ret, mdio_ctrl;/* For AN for C37 SGMII mode, the settings are :- -* 1) VR_MII_AN_CTRL Bit(2:1)[PCS_MODE] = 10b (SGMII AN) -* 2) VR_MII_AN_CTRL Bit(3) [TX_CONFIG] = 0b (MAC side SGMII) +* 1) VR_MII_MMD_CTRL Bit(12) [AN_ENABLE] = 0b (Disable SGMII AN in case +it is already enabled) +* 2) VR_MII_AN_CTRL Bit(2:1)[PCS_MODE] = 10b (SGMII AN) +* 3) VR_MII_AN_CTRL Bit(3) [TX_CONFIG] = 0b (MAC side SGMII) * DW xPCS used with DW EQoS MAC is always MAC side SGMII. -* 3) VR_MII_DIG_CTRL1 Bit(9) [MAC_AUTO_SW] = 1b (Automatic +* 4) VR_MII_DIG_CTRL1 Bit(9) [MAC_AUTO_SW] = 1b (Automatic * speed/duplex mode change by HW after SGMII AN complete) +* 5) VR_MII_MMD_CTRL Bit(12) [AN_ENABLE] = 1b (Enable SGMII AN) * * Note: Since it is MAC side SGMII, there is no need to set * SR_MII_AN_ADV. MAC side SGMII receives AN Tx Config from
@@ -708,6 +711,17 @@ static int xpcs_config_aneg_c37_sgmii(struct dw_xpcs *xpcs, unsigned int mode)* between PHY and Link Partner. There is also no need to * trigger AN restart for MAC-side SGMII. */ + mdio_ctrl =xpcs_read (xpcs,MDIO_MMD_VEND2 ,DW_VR_MII_MMD_CTRL ); +if (mdio_ctrl <0 ) +return mdio_ctrl; + +if (mdio_ctrl &AN_CL37_EN ) { + ret =xpcs_write (xpcs,MDIO_MMD_VEND2 ,DW_VR_MII_MMD_CTRL , + mdio_ctrl & ~AN_CL37_EN ); +if (ret <0 ) +return ret; + } + ret =xpcs_read (xpcs,MDIO_MMD_VEND2 ,DW_VR_MII_AN_CTRL );if (ret <0 )return ret;
@@ -732,7 +746,15 @@ static int xpcs_config_aneg_c37_sgmii(struct dw_xpcs *xpcs, unsigned int mode)else ret &= ~DW_VR_MII_DIG_CTRL1_MAC_AUTO_SW ; -return xpcs_write (xpcs,MDIO_MMD_VEND2 ,DW_VR_MII_DIG_CTRL1 , ret); + ret =xpcs_write (xpcs,MDIO_MMD_VEND2 ,DW_VR_MII_DIG_CTRL1 , ret); +if (ret <0 ) +return ret; + +if (phylink_autoneg_inband (mode)) + ret =xpcs_write (xpcs,MDIO_MMD_VEND2 ,DW_VR_MII_MMD_CTRL , + mdio_ctrl |AN_CL37_EN ); + +return ret; }static int xpcs_config_2500basex (struct dw_xpcs *xpcs)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 93/151 netlink: annotate data races around nlk->bound
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 7707a4d01a648e4c655101a469c956cb11273655 ]
While existing code is correct, KCSAN is reporting a data-race in netlink_insert / netlink_sendmsg [1]
It is correct to read nlk->bound without a lock, as netlink_autobind() will acquire all needed locks.
[1]
BUG: KCSAN: data-race in netlink_insert / netlink_sendmsg
write to 0xffff8881031c8b30 of 1 bytes by task 18752 on cpu 0:
netlink_insert+0x5cc/0x7f0 net/netlink/af_netlink.c:597 netlink_autobind+0xa9/0x150 net/netlink/af_netlink.c:842 netlink_sendmsg+0x479/0x7c0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:703 [inline] sock_sendmsg net/socket.c:723 [inline] ____sys_sendmsg+0x360/0x4d0 net/socket.c:2392 ___sys_sendmsg net/socket.c:2446 [inline] __sys_sendmsg+0x1ed/0x270 net/socket.c:2475 __do_sys_sendmsg net/socket.c:2484 [inline] __se_sys_sendmsg net/socket.c:2482 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2482 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
read to 0xffff8881031c8b30 of 1 bytes by task 18751 on cpu 1:
netlink_sendmsg+0x270/0x7c0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:703 [inline] sock_sendmsg net/socket.c:723 [inline] __sys_sendto+0x2a8/0x370 net/socket.c:2019 __do_sys_sendto net/socket.c:2031 [inline] __se_sys_sendto net/socket.c:2027 [inline] __x64_sys_sendto+0x74/0x90 net/socket.c:2027 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0x00 -> 0x01
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 18751 Comm: syz-executor.0 Not tainted 5.14.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
--- net/netlink/af_netlink.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
net/netlink/af_netlink.c +10 -4
@@ -594,7 +594,10 @@ static int netlink_insert(struct sock *sk, u32 portid)/* We need to ensure that the socket is hashed and visible. */ smp_wmb (); -nlk_sk (sk)->bound = portid; +/* Paired with lockless reads from netlink_bind(), +* netlink_connect() and netlink_sendmsg(). +*/ +WRITE_ONCE (nlk_sk (sk)->bound, portid); err:release_sock (sk);
@@ -1012,7 +1015,8 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,if (nlk->ngroups <BITS_PER_LONG ) groups &= (1UL << nlk->ngroups) -1 ; - bound = nlk->bound; +/* Paired with WRITE_ONCE() in netlink_insert() */ + bound =READ_ONCE (nlk->bound);if (bound) {/* Ensure nlk->portid is up-to-date. */ smp_rmb ();
@@ -1098,8 +1102,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,/* No need for barriers here as we return to user-space without * using any of the bound attributes. +* Paired with WRITE_ONCE() in netlink_insert(). */ -if (!nlk->bound) +if (!READ_ONCE (nlk->bound)) err =netlink_autobind (sock);if (err ==0 ) {
@@ -1888,7 +1893,8 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) dst_group = nlk->dst_group; } -if (!nlk->bound) { +/* Paired with WRITE_ONCE() in netlink_insert() */ +if (!READ_ONCE (nlk->bound)) { err =netlink_autobind (sock);if (err) goto out;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 94/151 ARM: defconfig: gemini: Restore framebuffer
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
[ Upstream commit a6949059318a064880050c76a9d8fb070156385f ]
The framebuffer is gone on the D-Link DIR-685, restore it.
--- arch/arm/configs/gemini_defconfig | 1 + 1 file changed, 1 insertion(+)
arch/arm/configs/gemini_defconfig +1 -0
@@ -76,6 +76,7 @@ CONFIG_REGULATOR_FIXED_VOLTAGE=y CONFIG_DRM=y CONFIG_DRM_PANEL_ILITEK_IL9322=y CONFIG_DRM_TVE200=y +CONFIG_FB=y CONFIG_LOGO=y CONFIG_USB=y CONFIG_USB_MON=y
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 95/151 drm/amdkfd: fix a potential ttm->sg memory leak
In reply to Greg Kroah-HartmanFrom: Lang Yu <[email protected]>
[ Upstream commit b072ef1215aca33186e3a10109e872e528a9e516 ]
Memory is allocated for ttm->sg by kmalloc in kfd_mem_dmamap_userptr, but isn't freed by kfree in kfd_mem_dmaunmap_userptr. Free it!
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +1 -0
@@ -563,6 +563,7 @@ kfd_mem_dmaunmap_userptr(struct kgd_mem *mem,dma_unmap_sgtable (adev->dev, ttm->sg, direction,0 );sg_free_table (ttm->sg); +kfree (ttm->sg); ttm->sg =NULL ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 96/151 drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
In reply to Greg Kroah-HartmanFrom: Guchun Chen <[email protected]>
[ Upstream commit 248b061689a40f4fed05252ee2c89f87cf26d7d8 ]
In current code, when a PCI error state pci_channel_io_normal is detectd, it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI driver will continue the execution of PCI resume callback report_resume by pci_walk_bridge, and the callback will go into amdgpu_pci_resume finally, where write lock is releasd unconditionally without acquiring such lock first. In this case, a deadlock will happen when other threads start to acquire the read lock.
To fix this, add a member in amdgpu_device strucutre to cache pci_channel_state, and only continue the execution in amdgpu_pci_resume when it's pci_channel_io_frozen.
--- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu.h +1 -0
@@ -1082,6 +1082,7 @@ struct amdgpu_device {bool no_hw_access;struct pci_saved_state *pci_state; +pci_channel_state_t pci_channel_state;struct amdgpu_reset_control *reset_cntl; };
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +6 -0
@@ -5329,6 +5329,8 @@ pci_ers_result_t amdgpu_pci_error_detected(struct pci_dev *pdev, pci_channel_stareturn PCI_ERS_RESULT_DISCONNECT ; } + adev->pci_channel_state = state; +switch (state) {case pci_channel_io_normal:return PCI_ERS_RESULT_CAN_RECOVER ;
@@ -5471,6 +5473,10 @@ void amdgpu_pci_resume(struct pci_dev *pdev)DRM_INFO ("PCI error: resume callback!!\n" ); +/* Only continue execution for the case of pci_channel_io_frozen */ +if (adev->pci_channel_state != pci_channel_io_frozen) +return ; +for (i =0 ; i <AMDGPU_MAX_RINGS ; ++i) {struct amdgpu_ring *ring = adev->rings[i];
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 97/151 perf jevents: Free the sys_event_tables list after processing entries
In reply to Greg Kroah-HartmanFrom: Like Xu <[email protected]>
[ Upstream commit b94729919db2c6737501c36ea6526a36d5d63fa2 ]
The compiler reports that free_sys_event_tables() is dead code.
But according to the semantics, the "LIST_HEAD(sys_event_tables)" should also be released, just like we do with 'arch_std_events' in main().
--- tools/perf/pmu-events/jevents.c | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/pmu-events/jevents.c +2 -0
@@ -1284,6 +1284,7 @@ int main(int argc, char *argv[]) }free_arch_std_events (); +free_sys_event_tables ();free (mapfile);return 0 ;
@@ -1305,6 +1306,7 @@ err_close_eventsfp:create_empty_mapping (output_file); err_out:free_arch_std_events (); +free_sys_event_tables ();free (mapfile);return ret; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 98/151 bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit b13a270ace2e4c70653aa1d1d0394c553905802f ]
Commit 94f6345712b3 ("bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO") should have also added the quirk for dra7 dcan1 in addition to dcan2 for errata i893 handling.
Let's also pass the quirk flag for legacy mode booting for if "ti,hwmods" dts property is used with related dcan hwmod data. This should be only needed if anybody needs to git bisect earlier stable trees though.
--- arch/arm/mach-omap2/omap_hwmod.c | 2 ++ drivers/bus/ti-sysc.c | 3 +++ 2 files changed, 5 insertions(+)
arch/arm/mach-omap2/omap_hwmod.c +2 -0
@@ -3614,6 +3614,8 @@ int omap_hwmod_init_module(struct device *dev, oh->flags |=HWMOD_SWSUP_SIDLE_ACT ;if (data->cfg->quirks &SYSC_QUIRK_SWSUP_MSTANDBY ) oh->flags |=HWMOD_SWSUP_MSTANDBY ; +if (data->cfg->quirks &SYSC_QUIRK_CLKDM_NOAUTO ) + oh->flags |=HWMOD_CLKDM_NOAUTO ; error = omap_hwmod_check_module(dev, oh, data, sysc_fields, rev_offs, sysc_offs, syss_offs,
drivers/bus/ti-sysc.c +3 -0
@@ -1468,6 +1468,9 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = {/* Quirks that need to be set based on detected module */ SYSC_QUIRK ("aess" ,0 ,0 ,0x10 , -ENODEV ,0x40000000 ,0xffffffff ,SYSC_MODULE_QUIRK_AESS ), +/* Errata i893 handling for dra7 dcan1 and 2 */ +SYSC_QUIRK ("dcan" ,0x4ae3c000 ,0x20 , -ENODEV , -ENODEV ,0xa3170504 ,0xffffffff , +SYSC_QUIRK_CLKDM_NOAUTO ),SYSC_QUIRK ("dcan" ,0x48480000 ,0x20 , -ENODEV , -ENODEV ,0xa3170504 ,0xffffffff ,SYSC_QUIRK_CLKDM_NOAUTO ), SYSC_QUIRK("dss", 0x4832a000, 0, 0x10, 0x14, 0x00000020, 0xffffffff,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 99/151 drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup
In reply to Greg Kroah-HartmanFrom: Jernej Skrabec <[email protected]>
[ Upstream commit c64c8e04a12ed3e2238761e26cda78e72550dc98 ]
Recent rework, which made HDMI PHY driver a platform device, inadvertely reversed clock setup order. HW is very touchy about it. Proper way is to handle controllers resets and clocks first and HDMI PHYs second.
Currently, without this fix, first mode set completely fails (nothing on HDMI monitor) on H3 era PHYs. On H6, it still somehow work.
Move HDMI PHY reset & clocks handling to sun8i_hdmi_phy_init() which will assure that code is executed after controllers reset & clocks are handled. Additionally, add sun8i_hdmi_phy_deinit() which will deinit them at controllers driver unload.
Tested on A64, H3, H6 and R40.
--- drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 7 +- drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h | 4 +- drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 97 ++++++++++++++------------ 3 files changed, 61 insertions(+), 47 deletions(-)
drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +5 -2
@@ -216,11 +216,13 @@ static int sun8i_dw_hdmi_bind(struct device *dev, struct device *master, goto err_disable_clk_tmds; } + ret =sun8i_hdmi_phy_init (hdmi->phy); +if (ret) + goto err_disable_clk_tmds; +drm_encoder_helper_add (encoder, &sun8i_dw_hdmi_encoder_helper_funcs);drm_simple_encoder_init (drm, encoder,DRM_MODE_ENCODER_TMDS ); -sun8i_hdmi_phy_init (hdmi->phy); - plat_data->mode_valid = hdmi->quirks->mode_valid; plat_data->use_drm_infoframe = hdmi->quirks->use_drm_infoframe;sun8i_hdmi_phy_set_ops (hdmi->phy, plat_data);
@@ -262,6 +264,7 @@ static void sun8i_dw_hdmi_unbind(struct device *dev, struct device *master,struct sun8i_dw_hdmi *hdmi =dev_get_drvdata (dev);dw_hdmi_unbind (hdmi->hdmi); +sun8i_hdmi_phy_deinit (hdmi->phy);clk_disable_unprepare (hdmi->clk_tmds);reset_control_assert (hdmi->rst_ctrl);gpiod_set_value (hdmi->ddc_en,0 );
drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h +3 -1
@@ -169,6 +169,7 @@ struct sun8i_hdmi_phy {struct clk *clk_phy;struct clk *clk_pll0;struct clk *clk_pll1; +struct device *dev;unsigned int rcal;struct regmap *regs;struct reset_control *rst_phy;
@@ -205,7 +206,8 @@ encoder_to_sun8i_dw_hdmi(struct drm_encoder *encoder)int sun8i_hdmi_phy_get (struct sun8i_dw_hdmi *hdmi,struct device_node *node); -void sun8i_hdmi_phy_init (struct sun8i_hdmi_phy *phy); +int sun8i_hdmi_phy_init (struct sun8i_hdmi_phy *phy); +void sun8i_hdmi_phy_deinit (struct sun8i_hdmi_phy *phy);void sun8i_hdmi_phy_set_ops (struct sun8i_hdmi_phy *phy,struct dw_hdmi_plat_data *plat_data);
drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c +53 -44
127 lines not on this page · raw message
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 100/151 drm/nouveau/fifo/ga102: initialise chid on return from channel creation
In reply to Greg Kroah-HartmanFrom: Ben Skeggs <[email protected]>
[ Upstream commit 0689ea432a85ad1a108f47c3d90b6feae322c7f9 ]
Turns out caller isn't zero-initialised after-all.
--- drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c +3 -0
@@ -179,6 +179,9 @@ ga102_chan_new(struct nvkm_device *device,return -ENODEV ; chan->ctrl.chan =nvkm_rd32 (device, chan->ctrl.runl +0x004 ) &0xfffffff0 ; + + args->chid =0 ; + args->inst =0 ; args->token =nvkm_rd32 (device, chan->ctrl.runl +0x008 ) &0xffff0000 ; ret =nvkm_memory_new (device,NVKM_MEM_TARGET_INST ,0x1000 ,0x1000 , true, &chan->mthd);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 101/151 drm/panel: abt-y030xx067a: yellow tint fix
In reply to Greg Kroah-HartmanFrom: Christophe Branchereau <[email protected]>
[ Upstream commit 413e8d06ad896dae9bbc6f97b0abea5eae5495f1 ]
The previous parameters caused an unbalanced yellow tint.
--- drivers/gpu/drm/panel/panel-abt-y030xx067a.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/panel/panel-abt-y030xx067a.c +2 -2
@@ -146,8 +146,8 @@ static const struct reg_sequence y030xx067a_init_sequence[] = { { 0x09, REG09_SUB_BRIGHT_R(0x20) }, { 0x0a, REG0A_SUB_BRIGHT_B(0x20) }, { 0x0b, REG0B_HD_FREERUN | REG0B_VD_FREERUN }, - { 0x0c, REG0C_CONTRAST_R(0x10) }, - { 0x0d, REG0D_CONTRAST_G(0x10) }, + { 0x0c, REG0C_CONTRAST_R(0x00) }, + { 0x0d, REG0D_CONTRAST_G(0x00) }, { 0x0e, REG0E_CONTRAST_B(0x10) }, { 0x0f, 0 }, { 0x10, REG10_BRIGHT(0x7f) },
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 102/151 video: fbdev: gbefb: Only instantiate device when built for IP32
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
[ Upstream commit 11b8e2bb986d23157e82e267fb8cc6b281dfdee9 ]
The gbefb driver not only registers a driver but also the device for that driver. This is all well and good when run on the IP32 machines that are supported by the driver but since the driver supports building with COMPILE_TEST we might also be building on other platforms which do not have this hardware and will crash instantiating the driver. Add an IS_ENABLED() check so we compile out the device registration if we don't have the Kconfig option for the machine enabled.
--- drivers/video/fbdev/gbefb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/gbefb.c +1 -1
@@ -1267,7 +1267,7 @@ static struct platform_device *gbefb_device;static int __init gbefb_init (void ) {int ret =platform_driver_register (&gbefb_driver); -if (!ret) { +if (IS_ENABLED (CONFIG_SGI_IP32 ) && !ret) { gbefb_device =platform_device_alloc ("gbefb" ,0 );if (gbefb_device) { ret =platform_device_add (gbefb_device);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 103/151 drm/nouveau: avoid a use-after-free when BO init fails
In reply to Greg Kroah-HartmanFrom: Jeremy Cline <[email protected]>
[ Upstream commit bcf34aa5082ee2343574bc3f4d1c126030913e54 ]
nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code back to the caller. On failures, ttm_bo_init() invokes the provided destructor which should de-initialize and free the memory.
Thus, when nouveau_bo_init() returns an error the gem object has already been released and the memory freed by nouveau_bo_del_ttm().
--- drivers/gpu/drm/nouveau/nouveau_gem.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/gpu/drm/nouveau/nouveau_gem.c +1 -3
@@ -247,10 +247,8 @@ nouveau_gem_new(struct nouveau_cli *cli, u64 size, int align, uint32_t domain, } ret =nouveau_bo_init (nvbo, size, align, domain,NULL ,NULL ); -if (ret) { -nouveau_bo_ref (NULL , &nvbo); +if (ret)return ret; - }/* we restrict allowed domains on nv50+ to only the types * that were requested at creation time. not possibly on
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 104/151 drm/nouveau/kms/nv50-: fix file release memory leak
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 0b3d4945cc7e7ea1acd52cb06dfa83bfe265b6d5 ]
When using single_open() for opening, single_release() should be called, otherwise the 'op' allocated in single_open() will be leaked.
--- drivers/gpu/drm/nouveau/dispnv50/crc.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/nouveau/dispnv50/crc.c +1 -0
@@ -704,6 +704,7 @@ static const struct file_operations nv50_crc_flip_threshold_fops = { .open = nv50_crc_debugfs_flip_threshold_open, .read = seq_read, .write = nv50_crc_debugfs_flip_threshold_set, + .release = single_release, };int nv50_head_crc_late_register (struct nv50_head *head)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 105/151 drm/nouveau/debugfs: fix file release memory leak
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit f5a8703a9c418c6fc54eb772712dfe7641e3991c ]
When using single_open() for opening, single_release() should be called, otherwise the 'op' allocated in single_open() will be leaked.
--- drivers/gpu/drm/nouveau/nouveau_debugfs.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/nouveau/nouveau_debugfs.c +1 -0
@@ -207,6 +207,7 @@ static const struct file_operations nouveau_pstate_fops = { .open = nouveau_debugfs_pstate_open, .read = seq_read, .write = nouveau_debugfs_pstate_set, + .release = single_release, };static struct drm_info_list nouveau_debugfs_list[] = {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 106/151 net: pcs: xpcs: fix incorrect steps on disable EEE
In reply to Greg Kroah-HartmanFrom: Wong Vee Khee <[email protected]>
[ Upstream commit 590df78bc7d1d0425196a8e11ce6676d7023fb26 ]
When Energy-Efficient Ethernet(EEE) is disable from the MAC side, we need to clear the DW_VR_MII_EEE_TRN_LPI bit of DW_VR_MII_EEE_MCTRL1 register.
--- drivers/net/pcs/pcs-xpcs.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/net/pcs/pcs-xpcs.c +9 -4
@@ -662,6 +662,10 @@ int xpcs_config_eee(struct dw_xpcs *xpcs, int mult_fact_100ns, int enable) {int ret; + ret =xpcs_read (xpcs,MDIO_MMD_VEND2 ,DW_VR_MII_EEE_MCTRL0 ); +if (ret <0 ) +return ret; +if (enable) {/* Enable EEE */ ret = DW_VR_MII_EEE_LTX_EN | DW_VR_MII_EEE_LRX_EN |
@@ -669,9 +673,6 @@ int xpcs_config_eee(struct dw_xpcs *xpcs, int mult_fact_100ns, int enable)DW_VR_MII_EEE_TX_EN_CTRL |DW_VR_MII_EEE_RX_EN_CTRL | mult_fact_100ns <<DW_VR_MII_EEE_MULT_FACT_100NS_SHIFT ; }else { - ret =xpcs_read (xpcs,MDIO_MMD_VEND2 ,DW_VR_MII_EEE_MCTRL0 ); -if (ret <0 ) -return ret; ret &= ~(DW_VR_MII_EEE_LTX_EN | DW_VR_MII_EEE_LRX_EN | DW_VR_MII_EEE_TX_QUIET_EN | DW_VR_MII_EEE_RX_QUIET_EN | DW_VR_MII_EEE_TX_EN_CTRL | DW_VR_MII_EEE_RX_EN_CTRL |
@@ -686,7 +687,11 @@ int xpcs_config_eee(struct dw_xpcs *xpcs, int mult_fact_100ns, int enable)if (ret <0 )return ret; - ret |=DW_VR_MII_EEE_TRN_LPI ; +if (enable) + ret |=DW_VR_MII_EEE_TRN_LPI ; +else + ret &= ~DW_VR_MII_EEE_TRN_LPI ; +return xpcs_write (xpcs,MDIO_MMD_VEND2 ,DW_VR_MII_EEE_MCTRL1 , ret); }EXPORT_SYMBOL_GPL (xpcs_config_eee);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 107/151 net: stmmac: trigger PCS EEE to turn off on link down
In reply to Greg Kroah-HartmanFrom: Wong Vee Khee <[email protected]>
[ Upstream commit d4aeaed80b0ebb020fadf2073b23462928dbdc17 ]
The current implementation enable PCS EEE feature in the event of link up, but PCS EEE feature is not disabled on link down.
This patch makes sure PCE EEE feature is disabled on link down.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +5 -1
@@ -477,6 +477,10 @@ bool stmmac_eee_init(struct stmmac_priv *priv)stmmac_lpi_entry_timer_config (priv,0 );del_timer_sync (&priv->eee_ctrl_timer);stmmac_set_eee_timer (priv, priv->hw,0 , eee_tw_timer); +if (priv->hw->xpcs) +xpcs_config_eee (priv->hw->xpcs, + priv->plat->mult_fact_100ns, + false); }mutex_unlock (&priv->lock);return false;
@@ -1038,7 +1042,7 @@ static void stmmac_mac_link_down(struct phylink_config *config,stmmac_mac_set (priv, priv->ioaddr, false); priv->eee_active = false; priv->tx_lpi_enabled = false; -stmmac_eee_init (priv); + priv->eee_enabled =stmmac_eee_init (priv);stmmac_set_eee_pls (priv, priv->hw, false);if (priv->dma_cap.fpesel)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 108/151 gve: Correct available tx qpl check
In reply to Greg Kroah-HartmanFrom: Catherine Sullivan <[email protected]>
[ Upstream commit d03477ee10f4bc35d3573cf1823814378ef2dca2 ]
The qpl_map_size is rounded up to a multiple of sizeof(long), but the number of qpls doesn't have to be.
--- drivers/net/ethernet/google/gve/gve.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/google/gve/gve.h +1 -1
@@ -780,7 +780,7 @@ struct gve_queue_page_list *gve_assign_rx_qpl(struct gve_priv *priv) gve_num_tx_qpls(priv));/* we are out of rx qpls */ -if (id == priv->qpl_cfg.qpl_map_size) +if (id ==gve_num_tx_qpls (priv) +gve_num_rx_qpls (priv))return NULL ;set_bit (id, priv->qpl_cfg.qpl_id_map);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 109/151 gve: Avoid freeing NULL pointer
In reply to Greg Kroah-HartmanFrom: Tao Liu <[email protected]>
[ Upstream commit 922aa9bcac92b3ab6a423526a8e785b35a60b441 ]
Prevent possible crashes when cleaning up after unsuccessful initializations.
--- drivers/net/ethernet/google/gve/gve_main.c | 27 ++++++++++++++-------- 1 file changed, 17 insertions(+), 10 deletions(-)
drivers/net/ethernet/google/gve/gve_main.c +17 -10
@@ -82,6 +82,9 @@ static int gve_alloc_counter_array(struct gve_priv *priv)static void gve_free_counter_array (struct gve_priv *priv) { +if (!priv->counter_array) +return ; + dma_free_coherent(&priv->pdev->dev, priv->num_event_counters * sizeof(*priv->counter_array),
@@ -142,6 +145,9 @@ static int gve_alloc_stats_report(struct gve_priv *priv)static void gve_free_stats_report (struct gve_priv *priv) { +if (!priv->stats_report) +return ; +del_timer_sync (&priv->stats_report_timer);dma_free_coherent (&priv->pdev->dev, priv->stats_report_len, priv->stats_report, priv->stats_report_bus);
@@ -370,18 +376,19 @@ static void gve_free_notify_blocks(struct gve_priv *priv) {int i; -if (priv->msix_vectors) { -/* Free the irqs */ -for (i =0 ; i < priv->num_ntfy_blks; i++) { -struct gve_notify_block *block = &priv->ntfy_blocks[i]; -int msix_idx = i; +if (!priv->msix_vectors) +return ; -irq_set_affinity_hint (priv->msix_vectors[msix_idx].vector, -NULL ); -free_irq (priv->msix_vectors[msix_idx].vector, block); - } -free_irq (priv->msix_vectors[priv->mgmt_msix_idx].vector, priv); +/* Free the irqs */ +for (i =0 ; i < priv->num_ntfy_blks; i++) { +struct gve_notify_block *block = &priv->ntfy_blocks[i]; +int msix_idx = i; + +irq_set_affinity_hint (priv->msix_vectors[msix_idx].vector, +NULL ); +free_irq (priv->msix_vectors[msix_idx].vector, block); } +free_irq (priv->msix_vectors[priv->mgmt_msix_idx].vector, priv);dma_free_coherent (&priv->pdev->dev, priv->num_ntfy_blks *sizeof (*priv->ntfy_blocks), priv->ntfy_blocks, priv->ntfy_block_bus);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 110/151 gve: Properly handle errors in gve_assign_qpl
In reply to Greg Kroah-HartmanFrom: Catherine Sullivan <[email protected]>
[ Upstream commit d4b111fda69a01e0a7439d05993f5dad567c93aa ]
Ignored errors would result in crash.
--- drivers/net/ethernet/google/gve/gve_rx.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/ethernet/google/gve/gve_rx.c +7 -1
@@ -104,8 +104,14 @@ static int gve_prefill_rx_pages(struct gve_rx_ring *rx)if (!rx->data.page_info)return -ENOMEM ; -if (!rx->data.raw_addressing) +if (!rx->data.raw_addressing) { rx->data.qpl =gve_assign_rx_qpl (priv); +if (!rx->data.qpl) { +kvfree (rx->data.page_info); + rx->data.page_info =NULL ; +return -ENOMEM ; + } + }for (i =0 ; i < slots; i++) {if (!rx->data.raw_addressing) {struct page *page = rx->data.qpl->pages[i];
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 111/151 rtnetlink: fix if_nlmsg_stats_size() under estimation
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit d34367991933d28bd7331f67a759be9a8c474014 ]
rtnl_fill_statsinfo() is filling skb with one mandatory if_stats_msg structure.
nlmsg_put(skb, pid, seq, type, sizeof(struct if_stats_msg), flags);
But if_nlmsg_stats_size() never considered the needed storage.
This bug did not show up because alloc_skb(X) allocates skb with extra tailroom, because of added alignments. This could very well be changed in the future to have deterministic behavior.
--- net/core/rtnetlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/rtnetlink.c +1 -1
@@ -5265,7 +5265,7 @@ nla_put_failure:static size_t if_nlmsg_stats_size (const struct net_device *dev,u32 filter_mask) { -size_t size =0 ; +size_t size =NLMSG_ALIGN (sizeof (struct if_stats_msg ));if (stats_attr_valid (filter_mask,IFLA_STATS_LINK_64 ,0 )) size +=nla_total_size_64bit (sizeof (struct rtnl_link_stats64 ));
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 112/151 gve: fix gve_get_stats()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 2f57d4975fa027eabd35fdf23a49f8222ef3abf2 ]
gve_get_stats() can report wrong numbers if/when u64_stats_fetch_retry() returns true.
What is needed here is to sample values in temporary variables, and only use them after each loop is ended.
--- drivers/net/ethernet/google/gve/gve_main.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/net/ethernet/google/gve/gve_main.c +9 -4
@@ -41,6 +41,7 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s) {struct gve_priv *priv =netdev_priv (dev);unsigned int start; +u64 packets, bytes;int ring;if (priv->rx) {
@@ -48,10 +49,12 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s)do { start =u64_stats_fetch_begin (&priv->rx[ring].statss); - s->rx_packets += priv->rx[ring].rpackets; - s->rx_bytes += priv->rx[ring].rbytes; + packets = priv->rx[ring].rpackets; + bytes = priv->rx[ring].rbytes; }while (u64_stats_fetch_retry (&priv->rx[ring].statss, start)); + s->rx_packets += packets; + s->rx_bytes += bytes; } }if (priv->tx) {
@@ -59,10 +62,12 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s)do { start =u64_stats_fetch_begin (&priv->tx[ring].statss); - s->tx_packets += priv->tx[ring].pkt_done; - s->tx_bytes += priv->tx[ring].bytes_done; + packets = priv->tx[ring].pkt_done; + bytes = priv->tx[ring].bytes_done; }while (u64_stats_fetch_retry (&priv->tx[ring].statss, start)); + s->tx_packets += packets; + s->tx_bytes += bytes; } } }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 113/151 gve: report 64bit tx_bytes counter from gve_handle_report_stats()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 17c37d748f2b122a95b6d0524d410302ff89a2b1 ]
Each tx queue maintains a 64bit counter for bytes, there is no reason to truncate this to 32bit (or this has not been documented)
--- drivers/net/ethernet/google/gve/gve_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/google/gve/gve_main.c +3 -2
@@ -1197,9 +1197,10 @@ static void gve_handle_reset(struct gve_priv *priv)void gve_handle_report_stats (struct gve_priv *priv) { -int idx, stats_idx =0 , tx_bytes; -unsigned int start =0 ;struct stats *stats = priv->stats_report->stats; +int idx, stats_idx =0 ; +unsigned int start =0 ; +u64 tx_bytes;if (!gve_get_report_stats (priv))return ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 114/151 i40e: fix endless loop under rtnl
In reply to Greg Kroah-HartmanFrom: Jiri Benc <[email protected]>
[ Upstream commit 857b6c6f665cca9828396d9743faf37fd09e9ac3 ]
The loop in i40e_get_capabilities can never end. The problem is that although i40e_aq_discover_capabilities returns with an error if there's a firmware problem, the returned error is not checked. There is a check for pf->hw.aq.asq_last_status but that value is set to I40E_AQ_RC_OK on most firmware problems.
When i40e_aq_discover_capabilities encounters a firmware problem, it will encounter the same problem on its next invocation. As the result, the loop becomes endless. We hit this with I40E_ERR_ADMIN_QUEUE_TIMEOUT but looking at the code, it can happen with a range of other firmware errors.
I don't know what the correct behavior should be: whether the firmware should be retried a few times, or whether pf->hw.aq.asq_last_status should be always set to the encountered firmware error (but then it would be pointless and can be just replaced by the i40e_aq_discover_capabilities return value). However, the current behavior with an endless loop under the rtnl mutex(!) is unacceptable and Intel has not submitted a fix, although we explained the bug to them 7 months ago.
This may not be the best possible fix but it's better than hanging the whole system on a firmware bug.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +1 -1
@@ -10110,7 +10110,7 @@ static int i40e_get_capabilities(struct i40e_pf *pf,if (pf->hw.aq.asq_last_status ==I40E_AQ_RC_ENOMEM ) {/* retry with a larger buffer */ buf_len = data_size; - }else if (pf->hw.aq.asq_last_status !=I40E_AQ_RC_OK ) { + }else if (pf->hw.aq.asq_last_status !=I40E_AQ_RC_OK || err) { dev_info(&pf->pdev->dev, "capability discovery failed, err %s aq_err %s\n", i40e_stat_str(&pf->hw, err),
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 115/151 i40e: Fix freeing of uninitialized misc IRQ vector
In reply to Greg Kroah-HartmanFrom: Sylwester Dziedziuch <[email protected]>
[ Upstream commit 2e5a20573a926302b233b0c2e1077f5debc7ab2e ]
When VSI set up failed in i40e_probe() as part of PF switch set up driver was trying to free misc IRQ vectors in i40e_clear_interrupt_scheme and produced a kernel Oops:
Trying to free already-free IRQ 266
WARNING: CPU: 0 PID: 5 at kernel/irq/manage.c:1731 __free_irq+0x9a/0x300 Workqueue: events work_for_cpu_fn RIP: 0010:__free_irq+0x9a/0x300 Call Trace: ? synchronize_irq+0x3a/0xa0 free_irq+0x2e/0x60 i40e_clear_interrupt_scheme+0x53/0x190 [i40e] i40e_probe.part.108+0x134b/0x1a40 [i40e] ? kmem_cache_alloc+0x158/0x1c0 ? acpi_ut_update_ref_count.part.1+0x8e/0x345 ? acpi_ut_update_object_reference+0x15e/0x1e2 ? strstr+0x21/0x70 ? irq_get_irq_data+0xa/0x20 ? mp_check_pin_attr+0x13/0xc0 ? irq_get_irq_data+0xa/0x20 ? mp_map_pin_to_irq+0xd3/0x2f0 ? acpi_register_gsi_ioapic+0x93/0x170 ? pci_conf1_read+0xa4/0x100 ? pci_bus_read_config_word+0x49/0x70 ? do_pci_enable_device+0xcc/0x100 local_pci_probe+0x41/0x90 work_for_cpu_fn+0x16/0x20 process_one_work+0x1a7/0x360 worker_thread+0x1cf/0x390 ? create_worker+0x1a0/0x1a0 kthread+0x112/0x130 ? kthread_flush_work_fn+0x10/0x10 ret_from_fork+0x1f/0x40
The problem is that at that point misc IRQ vectors were not allocated yet and we get a call trace that driver is trying to free already free IRQ vectors.
Add a check in i40e_clear_interrupt_scheme for __I40E_MISC_IRQ_REQUESTED PF state before calling i40e_free_misc_vector. This state is set only if misc IRQ vectors were properly initialized.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +2 -1
@@ -4868,7 +4868,8 @@ static void i40e_clear_interrupt_scheme(struct i40e_pf *pf) {int i; -i40e_free_misc_vector (pf); +if (test_bit (__I40E_MISC_IRQ_REQUESTED, pf->state)) +i40e_free_misc_vector (pf);i40e_put_lump (pf->irq_pile, pf->iwarp_base_vector,I40E_IWARP_IRQ_PILE_ID );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 116/151 iavf: fix double unlock of crit_lock
In reply to Greg Kroah-HartmanFrom: Stefan Assmann <[email protected]>
[ Upstream commit 54ee39439acd9f8b161703c6ad4f4e1835585277 ]
The crit_lock mutex could be unlocked twice as reported here
https://lists.osuosl.org/pipermail/intel-wired-lan/Week-of-Mon-20210823/025525.html
Remove the superfluous unlock. Technically the problem was already present before 5ac49f3c2702 as that commit only replaced the locking primitive, but no functional change.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +0 -1
@@ -1965,7 +1965,6 @@ static void iavf_watchdog_task(struct work_struct *work) } adapter->aq_required =0 ; adapter->current_op =VIRTCHNL_OP_UNKNOWN ; -mutex_unlock (&adapter->crit_lock);queue_delayed_work (iavf_wq, &adapter->watchdog_task,msecs_to_jiffies (10 ));
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 117/151 net: prefer socket bound to interface when not in VRF
In reply to Greg Kroah-HartmanFrom: Mike Manning <[email protected]>
[ Upstream commit 8d6c414cd2fb74aa6812e9bfec6178f8246c4f3a ]
The commit 6da5b0f027a8 ("net: ensure unbound datagram socket to be chosen when not in a VRF") modified compute_score() so that a device match is always made, not just in the case of an l3mdev skb, then increments the score also for unbound sockets. This ensures that sockets bound to an l3mdev are never selected when not in a VRF. But as unbound and bound sockets are now scored equally, this results in the last opened socket being selected if there are matches in the default VRF for an unbound socket and a socket bound to a dev that is not an l3mdev. However, handling prior to this commit was to always select the bound socket in this case. Reinstate this handling by incrementing the score only for bound sockets. The required isolation due to choosing between an unbound socket and a socket bound to an l3mdev remains in place due to the device match always being made. The same approach is taken for compute_score() for stream sockets.
--- net/ipv4/inet_hashtables.c | 4 +++- net/ipv4/udp.c | 3 ++- net/ipv6/inet6_hashtables.c | 2 +- net/ipv6/udp.c | 3 ++- 4 files changed, 8 insertions(+), 4 deletions(-)
net/ipv4/inet_hashtables.c +3 -1
@@ -242,8 +242,10 @@ static inline int compute_score(struct sock *sk, struct net *net,if (!inet_sk_bound_dev_eq (net, sk->sk_bound_dev_if, dif, sdif))return -1 ; + score = sk->sk_bound_dev_if ?2 :1 ; - score = sk->sk_family ==PF_INET ?2 :1 ; +if (sk->sk_family ==PF_INET ) + score++;if (READ_ONCE (sk->sk_incoming_cpu) ==raw_smp_processor_id ()) score++; }
net/ipv4/udp.c +2 -1
@@ -390,7 +390,8 @@ static int compute_score(struct sock *sk, struct net *net, dif, sdif);if (!dev_match)return -1 ; - score +=4 ; +if (sk->sk_bound_dev_if) + score +=4 ;if (READ_ONCE (sk->sk_incoming_cpu) ==raw_smp_processor_id ()) score++;
net/ipv6/inet6_hashtables.c +1 -1
@@ -106,7 +106,7 @@ static inline int compute_score(struct sock *sk, struct net *net,if (!inet_sk_bound_dev_eq (net, sk->sk_bound_dev_if, dif, sdif))return -1 ; - score =1 ; + score = sk->sk_bound_dev_if ?2 :1 ;if (READ_ONCE (sk->sk_incoming_cpu) ==raw_smp_processor_id ()) score++; }
net/ipv6/udp.c +2 -1
@@ -133,7 +133,8 @@ static int compute_score(struct sock *sk, struct net *net, dev_match =udp_sk_bound_dev_eq (net, sk->sk_bound_dev_if, dif, sdif);if (!dev_match)return -1 ; - score++; +if (sk->sk_bound_dev_if) + score++;if (READ_ONCE (sk->sk_incoming_cpu) ==raw_smp_processor_id ()) score++;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 118/151 powerpc/iommu: Report the correct most efficient DMA mask for PCI devices
In reply to Greg Kroah-HartmanFrom: Alexey Kardashevskiy <[email protected]>
[ Upstream commit 23c216b335d1fbd716076e8263b54a714ea3cf0e ]
According to dma-api.rst, the dma_get_required_mask() helper should return "the mask that the platform requires to operate efficiently". Which in the case of PPC64 means the bypass mask and not a mask from an IOMMU table which is shorter and slower to use due to map/unmap operations (especially expensive on "pseries").
However the existing implementation ignores the possibility of bypassing and returns the IOMMU table mask on the pseries platform which makes some drivers (mpt3sas is one example) choose 32bit DMA even though bypass is supported. The powernv platform sort of handles it by having a bigger default window with a mask >=40 but it only works as drivers choose 63/64bit if the required mask is >32 which is rather pointless.
This reintroduces the bypass capability check to let drivers make a better choice of the DMA mask.
--- arch/powerpc/kernel/dma-iommu.c | 9 +++++++++ 1 file changed, 9 insertions(+)
arch/powerpc/kernel/dma-iommu.c +9 -0
@@ -184,6 +184,15 @@ u64 dma_iommu_get_required_mask(struct device *dev)struct iommu_table *tbl =get_iommu_table_base (dev);u64 mask; +if (dev_is_pci (dev)) { +u64 bypass_mask =dma_direct_get_required_mask (dev); + +if (dma_iommu_dma_supported (dev, bypass_mask)) { +dev_info (dev,"%s: returning bypass mask 0x%llx\n" , __func__, bypass_mask); +return bypass_mask; + } + } +if (!tbl)return 0 ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 119/151 i2c: acpi: fix resource leak in reconfiguration device addition
In reply to Greg Kroah-HartmanFrom: Jamie Iles <[email protected]>
[ Upstream commit 6558b646ce1c2a872fe1c2c7cb116f05a2c1950f ]
acpi_i2c_find_adapter_by_handle() calls bus_find_device() which takes a reference on the adapter which is never released which will result in a reference count leak and render the adapter unremovable. Make sure to put the adapter after creating the client in the same manner that we do for OF.
--- drivers/i2c/i2c-core-acpi.c | 1 + 1 file changed, 1 insertion(+)
drivers/i2c/i2c-core-acpi.c +1 -0
@@ -422,6 +422,7 @@ static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value,break ;i2c_acpi_register_device (adapter, adev, &info); +put_device (&adapter->dev);break ;case ACPI_RECONFIG_DEVICE_REMOVE :if (!acpi_device_enumerated (adev))
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 120/151 i2c: mediatek: Add OFFSET_EXT_CONF setting back
In reply to Greg Kroah-HartmanFrom: Kewei Xu <[email protected]>
[ Upstream commit 3bce7703c7ba648bd9e174dc1413f422b7998833 ]
In the commit be5ce0e97cc7 ("i2c: mediatek: Add i2c ac-timing adjust support"), we miss setting OFFSET_EXT_CONF register if i2c->dev_comp->timing_adjust is false, now add it back.
--- drivers/i2c/busses/i2c-mt65xx.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-mt65xx.c +10 -1
@@ -41,6 +41,8 @@#define I2C_HANDSHAKE_RST 0x0020#define I2C_FIFO_ADDR_CLR 0x0001#define I2C_DELAY_LEN 0x0002 +#define I2C_ST_START_CON 0x8001 +#define I2C_FS_START_CON 0x1800#define I2C_TIME_CLR_VALUE 0x0000#define I2C_TIME_DEFAULT_VALUE 0x0003#define I2C_WRRD_TRANAC_VALUE 0x0002
@@ -480,6 +482,7 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c) {u16 control_reg;u16 intr_stat_reg; +u16 ext_conf_val;mtk_i2c_writew (i2c,I2C_CHN_CLR_FLAG ,OFFSET_START ); intr_stat_reg =mtk_i2c_readw (i2c,OFFSET_INTR_STAT );
@@ -518,8 +521,13 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c)if (i2c->dev_comp->ltiming_adjust)mtk_i2c_writew (i2c, i2c->ltiming_reg,OFFSET_LTIMING ); +if (i2c->speed_hz <=I2C_MAX_STANDARD_MODE_FREQ ) + ext_conf_val =I2C_ST_START_CON ; +else + ext_conf_val =I2C_FS_START_CON ; +if (i2c->dev_comp->timing_adjust) { -mtk_i2c_writew (i2c, i2c->ac_timing.ext,OFFSET_EXT_CONF ); + ext_conf_val = i2c->ac_timing.ext;mtk_i2c_writew (i2c, i2c->ac_timing.inter_clk_div,OFFSET_CLOCK_DIV ); mtk_i2c_writew(i2c, I2C_SCL_MIS_COMP_VALUE,
@@ -544,6 +552,7 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c) OFFSET_HS_STA_STO_AC_TIMING); } } +mtk_i2c_writew (i2c, ext_conf_val,OFFSET_EXT_CONF );/* If use i2c pin from PMIC mt6397 side, need set PATH_DIR first */ if (i2c->have_pmic)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 121/151 riscv: explicitly use symbol offsets for VDSO
In reply to Greg Kroah-HartmanFrom: Saleem Abdulrasool <[email protected]>
[ Upstream commit fde9c59aebafb91caeed816cc510b56f14aa63ae ]
The current implementation of the __rt_sigaction reference computed an absolute offset relative to the mapped base of the VDSO. While this can be handled in the medlow model, the medany model cannot handle this as it is meant to be position independent. The current implementation relied on the BFD linker relaxing the PC-relative relocation into an absolute relocation as it was a near-zero address allowing it to be referenced relative to zero.
We now extract the offsets and create a generated header allowing the build with LLVM and lld to succeed as we no longer depend on the linker rewriting address references near zero. This change was largely modelled after the ARM64 target which does something similar.
--- arch/riscv/Makefile | 4 ++++ arch/riscv/include/asm/vdso.h | 14 ++---------- arch/riscv/kernel/vdso/Makefile | 25 ++++++++++------------ arch/riscv/kernel/vdso/gen_vdso_offsets.sh | 5 +++++ arch/riscv/kernel/vdso/so2s.sh | 6 ------ 5 files changed, 22 insertions(+), 32 deletions(-) create mode 100755 arch/riscv/kernel/vdso/gen_vdso_offsets.sh delete mode 100755 arch/riscv/kernel/vdso/so2s.sh
arch/riscv/Makefile +4 -0
@@ -108,6 +108,10 @@ PHONY += vdso_install vdso_install: $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso $@ +prepare: vdso_prepare +vdso_prepare: prepare0 + $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso include/generated/vdso-offsets.h + ifneq ($(CONFIG_XIP_KERNEL),y) ifeq ($(CONFIG_RISCV_M_MODE)$(CONFIG_SOC_CANAAN),yy) KBUILD_IMAGE := $(boot)/loader.bin
arch/riscv/include/asm/vdso.h +2 -12
@@ -9,25 +9,15 @@#define _ASM_RISCV_VDSO_H#include <linux/types.h> +#include <generated/vdso-offsets.h> #ifndef CONFIG_GENERIC_TIME_VSYSCALL struct vdso_data { };#endif -/* -* The VDSO symbols are mapped into Linux so we can just use regular symbol -* addressing to get their offsets in userspace. The symbols are mapped at an -* offset of 0, but since the linker must support setting weak undefined -* symbols to the absolute address 0 it also happens to support other low -* addresses even when the code model suggests those low addresses would not -* otherwise be availiable. -*/ #define VDSO_SYMBOL (base, name) \ -({ \ - extern const char __vdso_##name[]; \ - (void __user *)((unsigned long)(base) + __vdso_##name); \ -}) + (void __user *)((unsigned long)(base) + __vdso_##name##_offset)asmlinkage long sys_riscv_flush_icache (uintptr_t ,uintptr_t ,uintptr_t );
arch/riscv/kernel/vdso/Makefile +11 -14
@@ -23,10 +23,10 @@ ifneq ($(c-gettimeofday-y),) endif # Build rules -targets := $(obj-vdso) vdso.so vdso.so.dbg vdso.lds vdso-syms.S +targets := $(obj-vdso) vdso.so vdso.so.dbg vdso.lds obj-vdso := $(addprefix $(obj)/, $(obj-vdso)) -obj-y += vdso.o vdso-syms.o +obj-y += vdso.o CPPFLAGS_vdso.lds += -P -C -U$(ARCH) # Disable -pg to prevent insert call site
@@ -43,20 +43,22 @@ $(obj)/vdso.o: $(obj)/vdso.so # link rule for the .so file, .lds has to be first $(obj)/vdso.so.dbg: $(obj)/vdso.lds $(obj-vdso) FORCE $(call if_changed,vdsold) -LDFLAGS_vdso.so.dbg = -shared -s -soname=linux-vdso.so.1 \ +LDFLAGS_vdso.so.dbg = -shared -S -soname=linux-vdso.so.1 \ --build-id=sha1 --hash-style=both --eh-frame-hdr -# We also create a special relocatable object that should mirror the symbol -# table and layout of the linked DSO. With ld --just-symbols we can then -# refer to these symbols in the kernel code rather than hand-coded addresses. -$(obj)/vdso-syms.S: $(obj)/vdso.so FORCE - $(call if_changed,so2s) - # strip rule for the .so file $(obj)/%.so: OBJCOPYFLAGS := -S $(obj)/%.so: $(obj)/%.so.dbg FORCE $(call if_changed,objcopy) +# Generate VDSO offsets using helper script +gen-vdsosym := $(srctree)/$(src)/gen_vdso_offsets.sh +quiet_cmd_vdsosym = VDSOSYM $@ + cmd_vdsosym = $(NM) $< | $(gen-vdsosym) | LC_ALL=C sort > $@ + +include/generated/vdso-offsets.h: $(obj)/vdso.so.dbg FORCE + $(call if_changed,vdsosym) + # actual build commands # The DSO images are built using a special linker script # Make sure only to export the intended __vdso_xxx symbol offsets.
@@ -65,11 +67,6 @@ quiet_cmd_vdsold = VDSOLD $@ $(OBJCOPY) $(patsubst %, -G __vdso_%, $(vdso-syms)) [email protected] $@ && \ rm [email protected] -# Extracts symbol offsets from the VDSO, converting them into an assembly file -# that contains the same symbols at the same offsets. -quiet_cmd_so2s = SO2S $@ - cmd_so2s = $(NM) -D $< | $(srctree)/$(src)/so2s.sh > $@ - # install commands for the unstripped file quiet_cmd_vdso_install = INSTALL $@ cmd_vdso_install = cp $(obj)/[email protected] $(MODLIB)/vdso/$@
arch/riscv/kernel/vdso/gen_vdso_offsets.sh new file +5 -0
@@ -0,0 +1,5 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0 + +LC_ALL=C +sed -n -e 's/^[0]\+\(0[0-9a-fA-F]*\) . \(__vdso_[a-zA-Z0-9_]*\)$/\#define \2_offset\t0x\1/p'
arch/riscv/kernel/vdso/so2s.sh deleted +0 -6
@@ -1,6 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: GPL-2.0+ -# Copyright 2020 Palmer Dabbelt <[email protected]> - -sed 's!\([0-9a-f]*\) T \([a-z0-9_]*\)\(@@LINUX_4.15\)*!.global \2\n.set \2,0x\1!' \ -| grep '^\.'
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 122/151 RISC-V: Fix VDSO build for !MMU
In reply to Greg Kroah-HartmanFrom: Palmer Dabbelt <[email protected]>
[ Upstream commit a290f510a178830a01bfc06e66a54bbe4ece5d2a ]
We don't have a VDSO for the !MMU configurations, so don't try to build one.
--- arch/riscv/Makefile | 2 ++ arch/riscv/include/asm/vdso.h | 9 +++++++++ 2 files changed, 11 insertions(+)
arch/riscv/Makefile +2 -0
@@ -108,9 +108,11 @@ PHONY += vdso_install vdso_install: $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso $@ +ifeq ($(CONFIG_MMU),y) prepare: vdso_prepare vdso_prepare: prepare0 $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso include/generated/vdso-offsets.h +endif ifneq ($(CONFIG_XIP_KERNEL),y) ifeq ($(CONFIG_RISCV_M_MODE)$(CONFIG_SOC_CANAAN),yy)
arch/riscv/include/asm/vdso.h +9 -0
@@ -8,6 +8,13 @@#ifndef _ASM_RISCV_VDSO_H#define _ASM_RISCV_VDSO_H + +/* +* All systems with an MMU have a VDSO, but systems without an MMU don't +* support shared libraries and therefor don't have one. +*/ +#ifdef CONFIG_MMU +#include <linux/types.h> #include <generated/vdso-offsets.h>
@@ -19,6 +26,8 @@ struct vdso_data {#define VDSO_SYMBOL (base, name) \ (void __user *)((unsigned long)(base) + __vdso_##name##_offset) +#endif /* CONFIG_MMU */ +asmlinkage long sys_riscv_flush_icache (uintptr_t ,uintptr_t ,uintptr_t );#endif /* _ASM_RISCV_VDSO_H */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 123/151 riscv/vdso: Refactor asm/vdso.h
In reply to Greg Kroah-HartmanFrom: Tong Tiangen <[email protected]>
[ Upstream commit bb4a23c994aebcd96c567a0be8e964d516bd4a61 ]
The asm/vdso.h will be included in vdso.lds.S in the next patch, the following cleanup is needed to avoid syntax error:
1.the declaration of sys_riscv_flush_icache() is moved into asm/syscall.h. 2.the definition of struct vdso_data is moved into kernel/vdso.c. 2.the definition of VDSO_SYMBOL is placed under "#ifndef __ASSEMBLY__".
Also remove the redundant linux/types.h include.
--- arch/riscv/include/asm/syscall.h | 1 + arch/riscv/include/asm/vdso.h | 16 ++++++++++------ arch/riscv/kernel/syscall_table.c | 1 - arch/riscv/kernel/vdso.c | 5 ++++- 4 files changed, 15 insertions(+), 8 deletions(-)
arch/riscv/include/asm/syscall.h +1 -0
@@ -82,4 +82,5 @@ static inline int syscall_get_arch(struct task_struct *task) #endif } +asmlinkage long sys_riscv_flush_icache (uintptr_t ,uintptr_t ,uintptr_t );#endif /* _ASM_RISCV_SYSCALL_H */
arch/riscv/include/asm/vdso.h +10 -6
@@ -16,18 +16,22 @@#ifdef CONFIG_MMU #include <linux/types.h> -#include <generated/vdso-offsets.h> +/* +* All systems with an MMU have a VDSO, but systems without an MMU don't +* support shared libraries and therefor don't have one. +*/ +#ifdef CONFIG_MMU -#ifndef CONFIG_GENERIC_TIME_VSYSCALL -struct vdso_data { -}; -#endif +#ifndef __ASSEMBLY__ +#include <generated/vdso-offsets.h> #define VDSO_SYMBOL (base, name) \ (void __user *)((unsigned long)(base) + __vdso_##name##_offset)#endif /* CONFIG_MMU */ -asmlinkage long sys_riscv_flush_icache (uintptr_t ,uintptr_t ,uintptr_t ); +#endif /* !__ASSEMBLY__ */ + +#endif /* CONFIG_MMU */ #endif /* _ASM_RISCV_VDSO_H */
arch/riscv/kernel/syscall_table.c +0 -1
@@ -7,7 +7,6 @@#include <linux/linkage.h> #include <linux/syscalls.h> #include <asm-generic/syscalls.h> -#include <asm/vdso.h> #include <asm/syscall.h> #undef __SYSCALL
arch/riscv/kernel/vdso.c +4 -1
@@ -12,10 +12,13 @@#include <linux/binfmts.h> #include <linux/err.h> #include <asm/page.h> +#include <asm/vdso.h> +#ifdef CONFIG_GENERIC_TIME_VSYSCALL #include <vdso/datapage.h> #else -#include <asm/vdso.h> +struct vdso_data { +};#endif extern char vdso_start[], vdso_end[];
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 124/151 riscv/vdso: Move vdso data page up front
In reply to Greg Kroah-HartmanFrom: Tong Tiangen <[email protected]>
[ Upstream commit 78a743cd82a35ca0724179fc22834f06a2151fc2 ]
As commit 601255ae3c98 ("arm64: vdso: move data page before code pages"), the same issue exists on riscv, testcase is shown below, make sure that vdso.so is bigger than page size,
struct timespec tp;
clock_gettime(5, &tp);
printf("tv_sec: %ld, tv_nsec: %ld\n", tp.tv_sec, tp.tv_nsec);without this patch, test result : tv_sec: 0, tv_nsec: 0
with this patch, test result : tv_sec: 1629271537, tv_nsec: 748000000
Move the vdso data page in front of the VDSO area to fix the issue.
--- arch/riscv/include/asm/vdso.h | 2 ++ arch/riscv/kernel/vdso.c | 44 ++++++++++++++++++------------- arch/riscv/kernel/vdso/vdso.lds.S | 3 ++- 3 files changed, 30 insertions(+), 19 deletions(-)
arch/riscv/include/asm/vdso.h +2 -0
@@ -22,6 +22,8 @@*/ #ifdef CONFIG_MMU +#define __VVAR_PAGES 1 +#ifndef __ASSEMBLY__#include <generated/vdso-offsets.h>
arch/riscv/kernel/vdso.c +26 -18
82 lines not on this page · raw message
arch/riscv/kernel/vdso/vdso.lds.S +2 -1
@@ -3,12 +3,13 @@ * Copyright (C) 2012 Regents of the University of California */ #include <asm/page.h> +#include <asm/vdso.h> OUTPUT_ARCH(riscv) SECTIONS { - PROVIDE(_vdso_data = . + PAGE_SIZE); + PROVIDE(_vdso_data = . - __VVAR_PAGES * PAGE_SIZE); . = SIZEOF_HEADERS; .hash : { *(.hash) } :text
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 125/151 riscv/vdso: make arch_setup_additional_pages wait for mmap_sem for write killable
In reply to Greg Kroah-HartmanFrom: Tong Tiangen <[email protected]>
[ Upstream commit 8bb0ab3ae7a4dbe6cf32deb830cf2bdbf5736867 ]
riscv architectures relying on mmap_sem for write in their arch_setup_additional_pages. If the waiting task gets killed by the oom killer it would block oom_reaper from asynchronous address space reclaim and reduce the chances of timely OOM resolving. Wait for the lock in the killable mode and return with EINTR if the task got killed while waiting.
--- arch/riscv/kernel/vdso.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/riscv/kernel/vdso.c +3 -1
@@ -77,7 +77,9 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, vdso_len = (vdso_pages +VVAR_NR_PAGES ) <<PAGE_SHIFT ; -mmap_write_lock (mm); +if (mmap_write_lock_killable (mm)) +return -EINTR ; + vdso_base =get_unmapped_area (NULL ,0 , vdso_len,0 ,0 );if (IS_ERR_VALUE (vdso_base)) { ret = vdso_base;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 126/151 bpf, s390: Fix potential memory leak about jit_data
In reply to Greg Kroah-HartmanFrom: Tiezhu Yang <[email protected]>
[ Upstream commit 686cb8b9f6b46787f035afe8fbd132a74e6b1bdd ]
Make sure to free jit_data through kfree() in the error path.
--- arch/s390/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/net/bpf_jit_comp.c +1 -1
@@ -1826,7 +1826,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) jit.addrs =kvcalloc (fp->len +1 ,sizeof (*jit.addrs),GFP_KERNEL );if (jit.addrs ==NULL ) { fp = orig_fp; - goto out; + goto free_addrs; }/* * Three initial passes:
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 127/151 i2c: mlxcpld: Fix criteria for frequency setting
In reply to Greg Kroah-HartmanFrom: Vadim Pasternak <[email protected]>
[ Upstream commit 52f57396c75acd77ebcdf3d20aed24ed248e9f79 ]
Value for getting frequency capability wrongly has been taken from register offset instead of register value.
--- drivers/i2c/busses/i2c-mlxcpld.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-mlxcpld.c +1 -1
@@ -495,7 +495,7 @@ mlxcpld_i2c_set_frequency(struct mlxcpld_i2c_priv *priv,return err;/* Set frequency only if it is not 100KHz, which is default. */ -switch ((data->reg & data->mask) >> data->bit) { +switch ((regval & data->mask) >> data->bit) {case MLXCPLD_I2C_FREQ_1000KHZ : freq =MLXCPLD_I2C_FREQ_1000KHZ_SET ;break ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 128/151 i2c: mlxcpld: Modify register setting for 400KHz frequency
In reply to Greg Kroah-HartmanFrom: Vadim Pasternak <[email protected]>
[ Upstream commit fa1049135c15b4930ce7ea757a81b1b78908f304 ]
Change setting for 400KHz frequency support by more accurate value.
--- drivers/i2c/busses/i2c-mlxcpld.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-mlxcpld.c +1 -1
@@ -49,7 +49,7 @@#define MLXCPLD_LPCI2C_NACK_IND 2#define MLXCPLD_I2C_FREQ_1000KHZ_SET 0x04 -#define MLXCPLD_I2C_FREQ_400KHZ_SET 0x0f +#define MLXCPLD_I2C_FREQ_400KHZ_SET 0x0c#define MLXCPLD_I2C_FREQ_100KHZ_SET 0x42enum mlxcpld_i2c_frequency {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 129/151 RISC-V: Include clone3() on rv32
In reply to Greg Kroah-HartmanFrom: Palmer Dabbelt <[email protected]>
[ Upstream commit 59a4e0d5511ba61353ea9a4efdb1b86c23ecf134 ]
As far as I can tell this should be enabled on rv32 as well, I'm not sure why it's rv64-only. checksyscalls is complaining about our lack of clone3() on rv32.
--- arch/riscv/include/uapi/asm/unistd.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/riscv/include/uapi/asm/unistd.h +2 -1
@@ -18,9 +18,10 @@#ifdef __LP64__#define __ARCH_WANT_NEW_STAT#define __ARCH_WANT_SET_GET_RLIMIT -#define __ARCH_WANT_SYS_CLONE3#endif /* __LP64__ */ +#define __ARCH_WANT_SYS_CLONE3 +#include <asm-generic/unistd.h> /*
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 130/151 scsi: iscsi: Fix iscsi_task use after free
In reply to Greg Kroah-HartmanFrom: Mike Christie <[email protected]>
[ Upstream commit 258aad75c62146453d03028a44f2f1590d58e1f6 ]
Commit d39df158518c ("scsi: iscsi: Have abort handler get ref to conn") added iscsi_get_conn()/iscsi_put_conn() calls during abort handling but then also changed the handling of the case where we detect an already completed task where we now end up doing a goto to the common put/cleanup code. This results in a iscsi_task use after free, because the common cleanup code will do a put on the iscsi_task.
This reverts the goto and moves the iscsi_get_conn() to after we've checked if the iscsi_task is valid.
--- drivers/scsi/libiscsi.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/scsi/libiscsi.c +9 -6
@@ -2281,11 +2281,6 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)return FAILED ; } - conn = session->leadconn; -iscsi_get_conn (conn->cls_conn); - conn->eh_abort_cnt++; - age = session->age; -spin_lock (&session->back_lock); task = (struct iscsi_task *)sc->SCp.ptr;if (!task || !task->sc) {
@@ -2293,8 +2288,16 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)ISCSI_DBG_EH (session,"sc completed while abort in progress\n" );spin_unlock (&session->back_lock); - goto success; +spin_unlock_bh (&session->frwd_lock); +mutex_unlock (&session->eh_mutex); +return SUCCESS ; } + + conn = session->leadconn; +iscsi_get_conn (conn->cls_conn); + conn->eh_abort_cnt++; + age = session->age; +ISCSI_DBG_EH (session,"aborting [sc %p itt 0x%x]\n" , sc, task->itt);__iscsi_get_task (task);spin_unlock (&session->back_lock);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 131/151 objtool: Remove reloc symbol type checks in get_alt_entry()
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
[ Upstream commit 4d8b35968bbf9e42b6b202eedb510e2c82ad8b38 ]
Converting a special section's relocation reference to a symbol is straightforward. No need for objtool to complain that it doesn't know how to handle it. Just handle it.
This fixes the following warning:
arch/x86/kvm/emulate.o: warning: objtool: __ex_table+0x4: don't know how to handle reloc symbol type: kvm_fastop_exception
--- tools/objtool/special.c | 36 +++++++----------------------------- 1 file changed, 7 insertions(+), 29 deletions(-)
tools/objtool/special.c +7 -29
@@ -58,22 +58,11 @@ void __weak arch_handle_alternative(unsigned short feature, struct special_alt * { } -static bool reloc2sec_off (struct reloc *reloc,struct section **sec,unsigned long *off) +static void reloc_to_sec_off (struct reloc *reloc,struct section **sec, +unsigned long *off) { -switch (reloc->sym->type) { -case STT_FUNC : - *sec = reloc->sym->sec; - *off = reloc->sym->offset + reloc->addend; -return true; - -case STT_SECTION : - *sec = reloc->sym->sec; - *off = reloc->addend; -return true; - -default : -return false; - } + *sec = reloc->sym->sec; + *off = reloc->sym->offset + reloc->addend; } static int get_alt_entry(struct elf *elf, struct special_entry *entry,
@@ -109,13 +98,8 @@ static int get_alt_entry(struct elf *elf, struct special_entry *entry,WARN_FUNC ("can't find orig reloc" , sec, offset + entry->orig);return -1 ; } -if (!reloc2sec_off (orig_reloc, &alt->orig_sec, &alt->orig_off)) { -WARN_FUNC ("don't know how to handle reloc symbol type %d: %s" , - sec, offset + entry->orig, - orig_reloc->sym->type, - orig_reloc->sym->name); -return -1 ; - } + +reloc_to_sec_off (orig_reloc, &alt->orig_sec, &alt->orig_off);if (!entry->group || alt->new_len) { new_reloc =find_reloc_by_dest (elf, sec, offset + entry->new);
@@ -133,13 +117,7 @@ static int get_alt_entry(struct elf *elf, struct special_entry *entry,if (arch_is_retpoline (new_reloc->sym))return 1 ; -if (!reloc2sec_off (new_reloc, &alt->new_sec, &alt->new_off)) { -WARN_FUNC ("don't know how to handle reloc symbol type %d: %s" , - sec, offset + entry->new, - new_reloc->sym->type, - new_reloc->sym->name); -return -1 ; - } +reloc_to_sec_off (new_reloc, &alt->new_sec, &alt->new_off);/* _ASM_EXTABLE_EX hack */ if (alt->new_off >=0x7ffffff0 )
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 132/151 objtool: Make .altinstructions section entry size consistent
In reply to Greg Kroah-HartmanFrom: Joe Lawrence <[email protected]>
[ Upstream commit dc02368164bd0ec603e3f5b3dd8252744a667b8a ]
Commit e31694e0a7a7 ("objtool: Don't make .altinstructions writable") aligned objtool-created and kernel-created .altinstructions section flags, but there remains a minor discrepency in their use of a section entry size: objtool sets one while the kernel build does not.
While sh_entsize of sizeof(struct alt_instr) seems intuitive, this small deviation can cause failures with external tooling (kpatch-build).
Fix this by creating new .altinstructions sections with sh_entsize of 0 and then later updating sec->sh_size as alternatives are added to the section. An added benefit is avoiding the data descriptor and buffer created by elf_create_section(), but previously unused by elf_add_alternative().
--- tools/objtool/arch/x86/decode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/objtool/arch/x86/decode.c +1 -1
@@ -684,7 +684,7 @@ static int elf_add_alternative(struct elf *elf, sec =find_section_by_name (elf,".altinstructions" );if (!sec) { sec =elf_create_section (elf,".altinstructions" , -SHF_ALLOC , size,0 ); +SHF_ALLOC ,0 ,0 );if (!sec) {WARN_ELF ("elf_create_section" );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 133/151 powerpc/bpf: Fix BPF_MOD when imm == 1
In reply to Greg Kroah-HartmanFrom: Naveen N. Rao <[email protected]>
[ Upstream commit 8bbc9d822421d9ac8ff9ed26a3713c9afc69d6c8 ]
Only ignore the operation if dividing by 1.
--- arch/powerpc/net/bpf_jit_comp64.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
arch/powerpc/net/bpf_jit_comp64.c +8 -2
@@ -389,8 +389,14 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context *case BPF_ALU64 |BPF_DIV |BPF_K :/* dst /= imm */ if (imm ==0 )return -EINVAL ; -else if (imm ==1 ) - goto bpf_alu32_trunc; +if (imm ==1 ) { +if (BPF_OP (code) ==BPF_DIV ) { + goto bpf_alu32_trunc; + }else { +EMIT (PPC_RAW_LI (dst_reg,0 )); +break ; + } + }PPC_LI32 (b2p[TMP_REG_1 ], imm);switch (BPF_CLASS (code)) {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 134/151 powerpc/bpf: Fix BPF_SUB when imm == 0x80000000
In reply to Greg Kroah-HartmanFrom: Naveen N. Rao <[email protected]>
[ Upstream commit 5855c4c1f415ca3ba1046e77c0b3d3dfc96c9025 ]
We aren't handling subtraction involving an immediate value of 0x80000000 properly. Fix the same.
--- arch/powerpc/net/bpf_jit_comp64.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
arch/powerpc/net/bpf_jit_comp64.c +17 -10
@@ -328,18 +328,25 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context *EMIT (PPC_RAW_SUB (dst_reg, dst_reg, src_reg)); goto bpf_alu32_trunc;case BPF_ALU |BPF_ADD |BPF_K :/* (u32) dst += (u32) imm */ -case BPF_ALU |BPF_SUB |BPF_K :/* (u32) dst -= (u32) imm */ case BPF_ALU64 |BPF_ADD |BPF_K :/* dst += imm */ +if (!imm) { + goto bpf_alu32_trunc; + }else if (imm >=-32768 && imm <32768 ) { +EMIT (PPC_RAW_ADDI (dst_reg, dst_reg,IMM_L (imm))); + }else { +PPC_LI32 (b2p[TMP_REG_1 ], imm); +EMIT (PPC_RAW_ADD (dst_reg, dst_reg, b2p[TMP_REG_1 ])); + } + goto bpf_alu32_trunc; +case BPF_ALU |BPF_SUB |BPF_K :/* (u32) dst -= (u32) imm */ case BPF_ALU64 |BPF_SUB |BPF_K :/* dst -= imm */ -if (BPF_OP (code) ==BPF_SUB ) - imm = -imm; -if (imm) { -if (imm >=-32768 && imm <32768 ) -EMIT (PPC_RAW_ADDI (dst_reg, dst_reg,IMM_L (imm))); -else { -PPC_LI32 (b2p[TMP_REG_1 ], imm); -EMIT (PPC_RAW_ADD (dst_reg, dst_reg, b2p[TMP_REG_1 ])); - } +if (!imm) { + goto bpf_alu32_trunc; + }else if (imm >-32768 && imm <=32768 ) { +EMIT (PPC_RAW_ADDI (dst_reg, dst_reg,IMM_L (-imm))); + }else { +PPC_LI32 (b2p[TMP_REG_1 ], imm); +EMIT (PPC_RAW_SUB (dst_reg, dst_reg, b2p[TMP_REG_1 ])); } goto bpf_alu32_trunc;case BPF_ALU |BPF_MUL |BPF_X :/* (u32) dst *= (u32) src */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 135/151 powerpc/bpf ppc32: Fix ALU32 BPF_ARSH operation
In reply to Greg Kroah-HartmanFrom: Naveen N. Rao <[email protected]>
[ Upstream commit c9b8da77f22d28348d1f89a6c4d3fec102e9b1c4 ]
Correct the destination register used for ALU32 BPF_ARSH operation.
--- arch/powerpc/net/bpf_jit_comp32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/net/bpf_jit_comp32.c +1 -1
@@ -623,7 +623,7 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context *EMIT (PPC_RAW_LI (dst_reg_h,0 ));break ;case BPF_ALU |BPF_ARSH |BPF_X :/* (s32) dst >>= src */ -EMIT (PPC_RAW_SRAW (dst_reg_h, dst_reg, src_reg)); +EMIT (PPC_RAW_SRAW (dst_reg, dst_reg, src_reg));break ;case BPF_ALU64 |BPF_ARSH |BPF_X :/* (s64) dst >>= src */ bpf_set_seen_register (ctx, tmp_reg);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 136/151 powerpc/bpf ppc32: Fix JMP32_JSET_K
In reply to Greg Kroah-HartmanFrom: Naveen N. Rao <[email protected]>
[ Upstream commit e8278d44443207bb6609c7b064073f353e6f4978 ]
'andi' only takes an unsigned 16-bit value. Correct the imm range used when emitting andi.
--- arch/powerpc/net/bpf_jit_comp32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/net/bpf_jit_comp32.c +1 -1
@@ -1073,7 +1073,7 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context *break ;case BPF_JMP32 |BPF_JSET |BPF_K :/* andi does not sign-extend the immediate */ -if (imm >=-32768 && imm <32768 ) { +if (imm >=0 && imm <32768 ) {/* PPC_ANDI is _only/always_ dot-form */ EMIT (PPC_RAW_ANDI (_R0, dst_reg, imm)); }else {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 137/151 powerpc/bpf ppc32: Do not emit zero extend instruction for 64-bit BPF_END
In reply to Greg Kroah-HartmanFrom: Naveen N. Rao <[email protected]>
[ Upstream commit 48164fccdff6d5cc11308126c050bd25a329df25 ]
Suppress emitting zero extend instruction for 64-bit BPF_END_FROM_[L|B]E operation.
--- arch/powerpc/net/bpf_jit_comp32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/net/bpf_jit_comp32.c +1 -1
@@ -1103,7 +1103,7 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context *return -EOPNOTSUPP ; }if (BPF_CLASS (code) ==BPF_ALU && !fp->aux->verifier_zext && - !insn_is_zext (&insn[i +1 ])) + !insn_is_zext (&insn[i +1 ]) && !(BPF_OP (code) ==BPF_END && imm ==64 ))EMIT (PPC_RAW_LI (dst_reg_h,0 )); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 138/151 powerpc/bpf ppc32: Fix BPF_SUB when imm == 0x80000000
In reply to Greg Kroah-HartmanFrom: Naveen N. Rao <[email protected]>
[ Upstream commit 548b762763b885b81850db676258df47c55dd5f9 ]
Special case handling of the smallest 32-bit negative number for BPF_SUB.
--- arch/powerpc/net/bpf_jit_comp32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/net/bpf_jit_comp32.c +1 -1
@@ -355,7 +355,7 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context *PPC_LI32 (_R0, imm);EMIT (PPC_RAW_ADDC (dst_reg, dst_reg, _R0)); } -if (imm >=0 ) +if (imm >=0 || (BPF_OP (code) ==BPF_SUB && imm ==0x80000000 ))EMIT (PPC_RAW_ADDZE (dst_reg_h, dst_reg_h));else EMIT (PPC_RAW_ADDME (dst_reg_h, dst_reg_h));
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 139/151 powerpc/64s: fix program check interrupt emergency stack path
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
[ Upstream commit 3e607dc4df180b72a38e75030cb0f94d12808712 ]
Emergency stack path was jumping into a 3: label inside the __GEN_COMMON_BODY macro for the normal path after it had finished, rather than jumping over it. By a small miracle this is the correct place to build up a new interrupt frame with the existing stack pointer, so things basically worked okay with an added weird looking 700 trap frame on top (which had the wrong ->nip so it didn't decode bug messages either).
Fix this by avoiding using numeric labels when jumping over non-trivial macros.
Before:
LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
Modules linked in: CPU: 0 PID: 88 Comm: sh Not tainted 5.15.0-rc2-00034-ge057cdade6e5 #2637 NIP: 7265677368657265 LR: c00000000006c0c8 CTR: c0000000000097f0 REGS: c0000000fffb3a50 TRAP: 0700 Not tainted MSR: 9000000000021031 <SF,HV,ME,IR,DR,LE> CR: 00000700 XER: 20040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006c964 c0000000fffb3cf0 c000000001513800 0000000000000000 GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299 GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8 GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001 GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8 GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158 GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300 GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80 NIP [7265677368657265] 0x7265677368657265 LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10 Call Trace: [c0000000fffb3cf0] [c00000000000bdac] soft_nmi_common+0x13c/0x1d0 (unreliable) --- interrupt: 700 at decrementer_common_virt+0xb8/0x230 NIP: c0000000000098b8 LR: c00000000006c0c8 CTR: c0000000000097f0 REGS: c0000000fffb3d60 TRAP: 0700 Not tainted MSR: 9000000000021031 <SF,HV,ME,IR,DR,LE> CR: 22424282 XER: 20040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006c964 0000000000002400 c000000001513800 0000000000000000 GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299 GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8 GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001 GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8 GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158 GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300 GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80 NIP [c0000000000098b8] decrementer_common_virt+0xb8/0x230 LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10 --- interrupt: 700 Instruction dump: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX ---[ end trace 6d28218e0cc3c949 ]---
After:
------------[ cut here ]------------ kernel BUG at arch/powerpc/kernel/exceptions-64s.S:491! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: CPU: 0 PID: 88 Comm: login Not tainted 5.15.0-rc2-00034-ge057cdade6e5-dirty #2638 NIP: c0000000000098b8 LR: c00000000006bf04 CTR: c0000000000097f0 REGS: c0000000fffb3d60 TRAP: 0700 Not tainted MSR: 9000000000021031 <SF,HV,ME,IR,DR,LE> CR: 24482227 XER: 00040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006bf04 0000000000002400 c000000001513800 c000000001271868 GPR04: 00000000100f0d29 0000000042000000 0000000000000007 0000000000000009 GPR08: 00000000100f0d29 0000000024482227 0000000000002710 c000000000181b3c GPR12: 9000000000009033 c0000000016b0000 00000000100f0d29 c000000005b22f00 GPR16: 00000000ffff0000 0000000000000001 0000000000000009 00000000100eed90 GPR20: 00000000100eed90 0000000010000000 000000001000a49c 00000000100f1430 GPR24: c000000001271868 0000000002000000 0000000000000215 0000000000000300 GPR28: c000000001271800 0000000042000000 00000000100f0d29 c000000080647860 NIP [c0000000000098b8] decrementer_common_virt+0xb8/0x230 LR [c00000000006bf04] ___do_page_fault+0x234/0xb10 Call Trace: Instruction dump: 4182000c 39400001 48000008 894d0932 714a0001 39400008 408225fc 718a4000 7c2a0b78 3821fcf0 41c20008 e82d0910 <0981fcf0> f92101a0 f9610170 f9810178 ---[ end trace a5dbd1f5ea4ccc51 ]---
--- arch/powerpc/kernel/exceptions-64s.S | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
arch/powerpc/kernel/exceptions-64s.S +10 -7
@@ -1665,27 +1665,30 @@ EXC_COMMON_BEGIN(program_check_common) */ andi. r10,r12,MSR_PR - bne 2f /* If userspace, go normal path */ + bne .Lnormal_stack /* If userspace, go normal path */ andis. r10,r12,(SRR1_PROGTM)@h - bne 1f /* If TM, emergency */ + bne .Lemergency_stack /* If TM, emergency */ cmpdi r1,-INT_FRAME_SIZE /* check if r1 is in userspace */ - blt 2f /* normal path if not */ + blt .Lnormal_stack /* normal path if not */ /* Use the emergency stack */ -1: andi. r10,r12,MSR_PR /* Set CR0 correctly for label */ +.Lemergency_stack: + andi. r10,r12,MSR_PR /* Set CR0 correctly for label */ /* 3 in EXCEPTION_PROLOG_COMMON */ mr r10,r1 /* Save r1 */ ld r1,PACAEMERGSP(r13) /* Use emergency stack */ subi r1,r1,INT_FRAME_SIZE /* alloc stack frame */ __ISTACK(program_check)=0 __GEN_COMMON_BODY program_check - b 3f -2: + b .Ldo_program_check + +.Lnormal_stack: __ISTACK(program_check)=1 __GEN_COMMON_BODY program_check -3: + +.Ldo_program_check: addi r3,r1,STACK_FRAME_OVERHEAD bl program_check_exception REST_NVGPRS(r1) /* instruction emulation may change GPRs */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 140/151 powerpc/traps: do not enable irqs in _exception
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
[ Upstream commit d0afd44c05f8f4e4c91487c02d43c87a31552462 ]
_exception can be called by machine check handlers when the MCE hits user code (e.g., pseries and powernv). This will enable local irqs because, which is a dicey thing to do in NMI or hard irq context.
This seemed to worked out okay because a userspace MCE can basically be treated like a synchronous interrupt (after async / imprecise MCEs are filtered out). Since NMI and hard irq handlers have started growing nmi_enter / irq_enter, and more irq state sanity checks, this has started to cause problems (or at least trigger warnings).
The Fixes tag to the commit which introduced this rather than try to work out exactly which commit was the first that could possibly cause a problem because that may be difficult to prove.
--- arch/powerpc/kernel/traps.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
arch/powerpc/kernel/traps.c +9 -3
@@ -341,10 +341,16 @@ static bool exception_common(int signr, struct pt_regs *regs, int code,return false; } -show_signal_msg (signr, regs, code, addr); +/* +* Must not enable interrupts even for user-mode exception, because +* this can be called from machine check, which may be a NMI or IRQ +* which don't like interrupts being enabled. Could check for +* in_hardirq || in_nmi perhaps, but there doesn't seem to be a good +* reason why _exception() should enable irqs for an exception handler, +* the handlers themselves do that directly. +*/ -if (arch_irqs_disabled ()) -interrupt_cond_local_irq_enable (regs); +show_signal_msg (signr, regs, code, addr); current->thread.trap_nr = code;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 141/151 powerpc/64s: Fix unrecoverable MCE calling async handler from NMI
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
[ Upstream commit f08fb25bc66986b0952724530a640d9970fa52c1 ]
The machine check handler is not considered NMI on 64s. The early handler is the true NMI handler, and then it schedules the machine_check_exception handler to run when interrupts are enabled.
This works fine except the case of an unrecoverable MCE, where the true NMI is taken when MSR[RI] is clear, it can not recover, so it calls machine_check_exception directly so something might be done about it.
Calling an async handler from NMI context can result in irq state and other things getting corrupted. This can also trigger the BUG at
arch/powerpc/include/asm/interrupt.h:168 BUG_ON(!arch_irq_disabled_regs(regs) && !(regs->msr & MSR_EE));
Fix this by making an _async version of the handler which is called in the normal case, and a NMI version that is called for unrecoverable interrupts.
--- arch/powerpc/include/asm/interrupt.h | 5 ++--- arch/powerpc/kernel/exceptions-64s.S | 8 +++++-- arch/powerpc/kernel/traps.c | 31 ++++++++++++++++------------ 3 files changed, 26 insertions(+), 18 deletions(-)
arch/powerpc/include/asm/interrupt.h +2 -3
@@ -525,10 +525,9 @@ static __always_inline long ____##func(struct pt_regs *regs)/* kernel/traps.c */ DECLARE_INTERRUPT_HANDLER_NMI (system_reset_exception);#ifdef CONFIG_PPC_BOOK3S_64 -DECLARE_INTERRUPT_HANDLER_ASYNC (machine_check_exception); -#else -DECLARE_INTERRUPT_HANDLER_NMI (machine_check_exception); +DECLARE_INTERRUPT_HANDLER_ASYNC (machine_check_exception_async);#endif +DECLARE_INTERRUPT_HANDLER_NMI (machine_check_exception);DECLARE_INTERRUPT_HANDLER (SMIException);DECLARE_INTERRUPT_HANDLER (handle_hmi_exception);DECLARE_INTERRUPT_HANDLER (unknown_exception);
arch/powerpc/kernel/exceptions-64s.S +6 -2
@@ -1243,7 +1243,7 @@ EXC_COMMON_BEGIN(machine_check_common) li r10,MSR_RI mtmsrd r10,1 addi r3,r1,STACK_FRAME_OVERHEAD - bl machine_check_exception + bl machine_check_exception_async b interrupt_return_srr
@@ -1303,7 +1303,11 @@ END_FTR_SECTION_IFSET(CPU_FTR_HVMODE) subi r12,r12,1 sth r12,PACA_IN_MCE(r13) - /* Invoke machine_check_exception to print MCE event and panic. */ + /* + * Invoke machine_check_exception to print MCE event and panic. + * This is the NMI version of the handler because we are called from + * the early handler which is a true NMI. + */ addi r3,r1,STACK_FRAME_OVERHEAD bl machine_check_exception
arch/powerpc/kernel/traps.c +18 -13
@@ -797,24 +797,22 @@ void die_mce(const char *str, struct pt_regs *regs, long err)* do_exit() checks for in_interrupt() and panics in that case, so * exit the irq/nmi before calling die. */ -if (IS_ENABLED (CONFIG_PPC_BOOK3S_64 )) -irq_exit (); -else +if (in_nmi ())nmi_exit (); +else +irq_exit ();die (str, regs, err); }/* -* BOOK3S_64 does not call this handler as a non-maskable interrupt +* BOOK3S_64 does not usually call this handler as a non-maskable interrupt * (it uses its own early real-mode handler to handle the MCE proper * and then raises irq_work to call this handler when interrupts are -* enabled). +* enabled). The only time when this is not true is if the early handler +* is unrecoverable, then it does call this directly to try to get a +* message out. */ -#ifdef CONFIG_PPC_BOOK3S_64 -DEFINE_INTERRUPT_HANDLER_ASYNC(machine_check_exception) -#else -DEFINE_INTERRUPT_HANDLER_NMI(machine_check_exception) -#endif +static void __machine_check_exception (struct pt_regs *regs) {int recover =0 ;
@@ -848,12 +846,19 @@ DEFINE_INTERRUPT_HANDLER_NMI(machine_check_exception)/* Must die if the interrupt is not recoverable */ if (!(regs->msr &MSR_RI ))die_mce ("Unrecoverable Machine check" , regs,SIGBUS ); +}#ifdef CONFIG_PPC_BOOK3S_64 -return ; -#else -return 0 ; +DEFINE_INTERRUPT_HANDLER_ASYNC (machine_check_exception_async) +{ +__machine_check_exception (regs); +}#endif +DEFINE_INTERRUPT_HANDLER_NMI (machine_check_exception) +{ +__machine_check_exception (regs); + +return 0 ; }DEFINE_INTERRUPT_HANDLER (SMIException)/* async? */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 142/151 powerpc/32s: Fix kuap_kernel_restore()
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit d93f9e23744b7bf11a98b2ddb091d129482ae179 ]
At interrupt exit, kuap_kernel_restore() calls kuap_unlock() with the value contained in regs->kuap. However, when regs->kuap contains 0xffffffff it means that KUAP was not unlocked so calling kuap_unlock() is unrelevant and results in jeopardising the contents of kernel space segment registers.
So check that regs->kuap doesn't contain KUAP_NONE before calling kuap_unlock(). In the meantime it also means that if KUAP has not been correcly locked back at interrupt exit, it must be locked before continuing. This is done by checking the content of current->thread.kuap which was returned by kuap_get_and_assert_locked()
--- arch/powerpc/include/asm/book3s/32/kup.h | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/powerpc/include/asm/book3s/32/kup.h +8 -0
@@ -136,6 +136,14 @@ static inline void kuap_kernel_restore(struct pt_regs *regs, unsigned long kuap)if (kuap_is_disabled ())return ; +if (unlikely (kuap !=KUAP_NONE )) { + current->thread.kuap =KUAP_NONE ; +kuap_lock (kuap, false); + } + +if (likely (regs->kuap ==KUAP_NONE )) +return ; + current->thread.kuap = regs->kuap;kuap_unlock (regs->kuap, false);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 143/151 pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init
In reply to Greg Kroah-HartmanFrom: Mahesh Salgaonkar <[email protected]>
[ Upstream commit eb8257a12192f43ffd41bd90932c39dade958042 ]
On pseries LPAR when an empty slot is assigned to partition OR in single LPAR mode, kdump kernel crashes during issuing PHB reset.
In the kdump scenario, we traverse all PHBs and issue reset using the pe_config_addr of the first child device present under each PHB. However the code assumes that none of the PHB slots can be empty and uses list_first_entry() to get the first child device under the PHB. Since list_first_entry() expects the list to be non-empty, it returns an invalid pci_dn entry and ends up accessing NULL phb pointer under pci_dn->phb causing kdump kernel crash.
This patch fixes the below kdump kernel crash by skipping empty slots:
audit: initializing netlink subsys (disabled)
thermal_sys: Registered thermal governor 'fair_share'
thermal_sys: Registered thermal governor 'step_wise'
cpuidle: using governor menu
pstore: Registered nvram as persistent store backend
Issue PHB reset ...
audit: type=2000 audit(1631267818.000:1): state=initialized audit_enabled=0 res=1
BUG: Kernel NULL pointer dereference on read at 0x00000268
Faulting instruction address: 0xc000000008101fb0
Oops: Kernel access of bad area, sig: 7 [#1]
LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
CPU: 7 PID: 1 Comm: swapper/7 Not tainted 5.14.0 #1
NIP: c000000008101fb0 LR: c000000009284ccc CTR: c000000008029d70
REGS: c00000001161b840 TRAP: 0300 Not tainted (5.14.0)
MSR: 8000000002009033 <SF,VEC,EE,ME,IR,DR,RI,LE> CR: 28000224 XER: 20040002
CFAR: c000000008101f0c DAR: 0000000000000268 DSISR: 00080000 IRQMASK: 0
...
NIP pseries_eeh_get_pe_config_addr+0x100/0x1b0
LR __machine_initcall_pseries_eeh_pseries_init+0x2cc/0x350
Call Trace:
0xc00000001161bb80 (unreliable)
__machine_initcall_pseries_eeh_pseries_init+0x2cc/0x350
do_one_initcall+0x60/0x2d0
kernel_init_freeable+0x350/0x3f8
kernel_init+0x3c/0x17c
ret_from_kernel_thread+0x5c/0x64--- arch/powerpc/platforms/pseries/eeh_pseries.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/powerpc/platforms/pseries/eeh_pseries.c +4 -0
@@ -867,6 +867,10 @@ static int __init eeh_pseries_init(void)if (is_kdump_kernel () || reset_devices) {pr_info ("Issue PHB reset ...\n" );list_for_each_entry (phb, &hose_list, list_node) { +// Skip if the slot is empty +if (list_empty (&PCI_DN (phb->dn)->child_list)) +continue ; + pdn = list_first_entry(&PCI_DN(phb->dn)->child_list, struct pci_dn, list); config_addr =pseries_eeh_get_pe_config_addr (pdn);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 144/151 x86/platform/olpc: Correct ifdef symbol to intended CONFIG_OLPC_XO15_SCI
In reply to Greg Kroah-HartmanFrom: Lukas Bulwahn <[email protected]>
commit 4758fd801f919b8b9acad78d2e49a195ec2be46b upstream.
The refactoring in the commit in Fixes introduced an ifdef CONFIG_OLPC_XO1_5_SCI, however the config symbol is actually called "CONFIG_OLPC_XO15_SCI".
Fortunately, ./scripts/checkkconfigsymbols.py warns:
OLPC_XO1_5_SCI
Referencing files: arch/x86/platform/olpc/olpc.c
Correct this ifdef condition to the intended config symbol.
--- arch/x86/platform/olpc/olpc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/platform/olpc/olpc.c +1 -1
@@ -274,7 +274,7 @@ static struct olpc_ec_driver ec_xo1_drivstatic struct olpc_ec_driver ec_xo1_5_driver = { .ec_cmd = olpc_xo1_ec_cmd, -#ifdef CONFIG_OLPC_XO1_5_SCI +#ifdef CONFIG_OLPC_XO15_SCI/* * XO-1.5 EC wakeups are available when olpc-xo15-sci driver is * compiled in
Greg Kroah-Hartman
maintainerPATCH 145/151 x86/Kconfig: Correct reference to MWINCHIP3D
In reply to Greg Kroah-HartmanFrom: Lukas Bulwahn <[email protected]>
commit 225bac2dc5d192e55f2c50123ee539b1edf8a411 upstream.
Commit in Fixes intended to exclude the Winchip series and referred to CONFIG_WINCHIP3D, but the config symbol is called CONFIG_MWINCHIP3D.
Hence, scripts/checkkconfigsymbols.py warns:
WINCHIP3D
Referencing files: arch/x86/Kconfig
Correct the reference to the intended config symbol.
--- arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/Kconfig +1 -1
@@ -1400,7 +1400,7 @@ config HIGHMEM4G config HIGHMEM64G bool "64GB" - depends on !M486SX && !M486 && !M586 && !M586TSC && !M586MMX && !MGEODE_LX && !MGEODEGX1 && !MCYRIXIII && !MELAN && !MWINCHIPC6 && !WINCHIP3D && !MK6 + depends on !M486SX && !M486 && !M586 && !M586TSC && !M586MMX && !MGEODE_LX && !MGEODEGX1 && !MCYRIXIII && !MELAN && !MWINCHIPC6 && !MWINCHIP3D && !MK6 select X86_PAE help Select this if you have a 32-bit processor and more than 4
Greg Kroah-Hartman
maintainerPATCH 146/151 x86/sev: Return an error on a returned non-zero SW_EXITINFO1[31:0]
In reply to Greg Kroah-HartmanFrom: Tom Lendacky <[email protected]>
commit 06f2ac3d4219bbbfd93d79e01966a42053084f11 upstream.
After returning from a VMGEXIT NAE event, SW_EXITINFO1[31:0] is checked for a value of 1, which indicates an error and that SW_EXITINFO2 contains exception information. However, future versions of the GHCB specification may define new values for SW_EXITINFO1[31:0], so really any non-zero value should be treated as an error.
--- arch/x86/kernel/sev-shared.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kernel/sev-shared.c +2 -0
@@ -130,6 +130,8 @@ static enum es_result sev_es_ghcb_hv_cal }else { ret =ES_VMM_ERROR ; } + }else if (ghcb->save.sw_exit_info_1 &0xffffffff ) { + ret =ES_VMM_ERROR ; }else { ret =ES_OK ; }
Greg Kroah-Hartman
maintainerPATCH 147/151 x86/fpu: Restore the masking out of reserved MXCSR bits
In reply to Greg Kroah-HartmanFrom: Borislav Petkov <[email protected]>
commit d298b03506d3e161f7492c440babb0bfae35e650 upstream.
Ser Olmy reported a boot failure:
init[1] bad frame in sigreturn frame:(ptrval) ip:b7c9fbe6 sp:bf933310 orax:ffffffff \ in libc-2.33.so[b7bed000+156000] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b CPU: 0 PID: 1 Comm: init Tainted: G W 5.14.9 #1 Hardware name: Hewlett-Packard HP PC/HP Board, BIOS JD.00.06 12/06/2001 Call Trace: dump_stack_lvl dump_stack panic do_exit.cold do_group_exit get_signal arch_do_signal_or_restart ? force_sig_info_to_task ? force_sig exit_to_user_mode_prepare syscall_exit_to_user_mode do_int80_syscall_32 entry_INT80_32
on an old 32-bit Intel CPU:
vendor_id : GenuineIntel cpu family : 6 model : 6 model name : Celeron (Mendocino) stepping : 5 microcode : 0x3
Ser bisected the problem to the commit in Fixes.
tglx suggested reverting the rejection of invalid MXCSR values which this commit introduced and replacing it with what the old code did - simply masking them out to zero.
Further debugging confirmed his suggestion:
fpu->state.fxsave.mxcsr: 0xb7be13b4, mxcsr_feature_mask: 0xffbf
WARNING: CPU: 0 PID: 1 at arch/x86/kernel/fpu/signal.c:384 __fpu_restore_sig+0x51f/0x540
so restore the original behavior only for 32-bit kernels where you have ancient machines with buggy hardware. For 32-bit programs on 64-bit kernels, user space which supplies wrong MXCSR values is considered malicious so fail the sigframe restoration there.
--- arch/x86/kernel/fpu/signal.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
arch/x86/kernel/fpu/signal.c +8 -3
@@ -379,9 +379,14 @@ static int __fpu_restore_sig(void __user sizeof(fpu->state.fxsave)))return -EFAULT ; -/* Reject invalid MXCSR values. */ -if (fpu->state.fxsave.mxcsr & ~mxcsr_feature_mask) -return -EINVAL ; +if (IS_ENABLED (CONFIG_X86_64 )) { +/* Reject invalid MXCSR values. */ +if (fpu->state.fxsave.mxcsr & ~mxcsr_feature_mask) +return -EINVAL ; + }else { +/* Mask invalid bits out for historical reasons (broken hardware). */ + fpu->state.fxsave.mxcsr &= ~mxcsr_feature_mask; + }/* Enforce XFEATURE_MASK_FPSSE when XSAVE is enabled */ if (use_xsave ())
Greg Kroah-Hartman
maintainerPATCH 148/151 x86/entry: Correct reference to intended CONFIG_64_BIT
In reply to Greg Kroah-HartmanFrom: Lukas Bulwahn <[email protected]>
commit 2c861f2b859385e9eaa6e464a8a7435b5a6bf564 upstream.
Commit in Fixes adds a condition with IS_ENABLED(CONFIG_64_BIT), but the intended config item is called CONFIG_64BIT, as defined in arch/x86/Kconfig.
Fortunately, scripts/checkkconfigsymbols.py warns:
64_BIT
Referencing files: arch/x86/include/asm/entry-common.h
Correct the reference to the intended config symbol.
--- arch/x86/include/asm/entry-common.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/include/asm/entry-common.h +1 -1
@@ -25,7 +25,7 @@ static __always_inline void arch_check_u* For !SMAP hardware we patch out CLAC on entry. */ if (boot_cpu_has (X86_FEATURE_SMAP ) || - (IS_ENABLED (CONFIG_64_BIT ) &&boot_cpu_has (X86_FEATURE_XENPV ))) + (IS_ENABLED (CONFIG_64BIT ) &&boot_cpu_has (X86_FEATURE_XENPV ))) mask |=X86_EFLAGS_AC ;WARN_ON_ONCE (flags & mask);
Greg Kroah-Hartman
maintainerPATCH 149/151 x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n
In reply to Greg Kroah-HartmanFrom: Vegard Nossum <[email protected]>
commit 3958b9c34c2729597e182cc606cc43942fd19f7c upstream.
Commit
3c73b81a9164 ("x86/entry, selftests: Further improve user entry sanity checks")
added a warning if AC is set when in the kernel.
Commit
662a0221893a3d ("x86/entry: Fix AC assertion")
changed the warning to only fire if the CPU supports SMAP.
However, the warning can still trigger on a machine that supports SMAP but where it's disabled in the kernel config and when running the syscall_nt selftest, for example:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 49 at irqentry_enter_from_user_mode CPU: 0 PID: 49 Comm: init Tainted: G T 5.15.0-rc4+ #98 e6202628ee053b4f310759978284bd8bb0ce6905 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 RIP: 0010:irqentry_enter_from_user_mode ... Call Trace: ? irqentry_enter ? exc_general_protection ? asm_exc_general_protection ? asm_exc_general_protectio
IS_ENABLED(CONFIG_X86_SMAP) could be added to the warning condition, but even this would not be enough in case SMAP is disabled at boot time with the "nosmap" parameter.
To be consistent with "nosmap" behaviour, clear X86_FEATURE_SMAP when !CONFIG_X86_SMAP.
Found using entry-fuzz + satrandconfig.
[ bp: Massage commit message. ]
--- arch/x86/kernel/cpu/common.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kernel/cpu/common.c +1 -0
@@ -320,6 +320,7 @@ static __always_inline void setup_smap(s#ifdef CONFIG_X86_SMAP cr4_set_bits (X86_CR4_SMAP );#else +clear_cpu_cap (c,X86_FEATURE_SMAP );cr4_clear_bits (X86_CR4_SMAP );#endif }
Greg Kroah-Hartman
maintainerPATCH 150/151 x86/hpet: Use another crystalball to evaluate HPET usability
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 6e3cd95234dc1eda488f4f487c281bac8fef4d9b upstream.
On recent Intel systems the HPET stops working when the system reaches PC10 idle state.
The approach of adding PCI ids to the early quirks to disable HPET on these systems is a whack a mole game which makes no sense.
Check for PC10 instead and force disable HPET if supported. The check is overbroad as it does not take ACPI, intel_idle enablement and command line parameters into account. That's fine as long as there is at least PMTIMER available to calibrate the TSC frequency. The decision can be overruled by adding "hpet=force" on the kernel command line.
Remove the related early PCI quirks for affected Ice Cake and Coffin Lake systems as they are not longer required. That should also cover all other systems, i.e. Tiger Rag and newer generations, which are most likely affected by this as well.
--- arch/x86/kernel/early-quirks.c | 6 --- arch/x86/kernel/hpet.c | 81 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 81 insertions(+), 6 deletions(-)
arch/x86/kernel/early-quirks.c +0 -6
@@ -714,12 +714,6 @@ static struct chipset early_qrk[] __init*/ {PCI_VENDOR_ID_INTEL ,0x0f00 , PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, - { PCI_VENDOR_ID_INTEL, 0x3e20, - PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, - { PCI_VENDOR_ID_INTEL, 0x3ec4, - PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, - { PCI_VENDOR_ID_INTEL, 0x8a12, - PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet}, { PCI_VENDOR_ID_BROADCOM, 0x4331, PCI_CLASS_NETWORK_OTHER, PCI_ANY_ID, 0, apple_airport_reset}, {}
arch/x86/kernel/hpet.c +81 -0
99 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 151/151 dsa: tag_dsa: Fix mask for trunked packets
In reply to Greg Kroah-HartmanFrom: Andrew Lunn <[email protected]>
commit b44d52a50bc6f191f0ae03f65de8401f3ef039b3 upstream.
A packet received on a trunk will have bit 2 set in Forward DSA tagged frame. Bit 1 can be either 0 or 1 and is otherwise undefined and bit 0 indicates the frame CFI. Masking with 7 thus results in frames as being identified as being from a trunk when in fact they are not. Fix the mask to just look at bit 2.
--- net/dsa/tag_dsa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/dsa/tag_dsa.c +1 -1
@@ -176,7 +176,7 @@ static struct sk_buff *dsa_rcv_ll(structcase DSA_CMD_FORWARD : skb->offload_fwd_mark =1 ; - trunk = !!(dsa_header[1 ] &7 ); + trunk = !!(dsa_header[1 ] &4 );break ;case DSA_CMD_TO_CPU :
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.14.12 release. There are 151 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 13 Oct 2021 13:44:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.14.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.14.12 release. There are 151 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 13 Oct 2021 13:44:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.14.y
and the diffstat can be found below.thanks,
greg k-h
5.14.12-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.14.12 release. There are 151 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 13 Oct 2021 13:44:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
Regression found on arm x15 device.
metadata:
git branch: linux-5.14.y
git repo: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
git commit: d98305d056b808dd938d2ae6bfd0e3ccac00a106
git describe: v5.14.11-152-gd98305d056b8
make_kernelversion: 5.14.12-rc1
kernel-config: https://builds.tuxbuild.com/1zMbwi83MvhJdKpC0LTvxvIh1Fb/config
Crash log,
[ 0.000000] Linux version 5.14.12-rc1 (tuxmake@tuxmake) (arm-linux-gnueabihf-gcc (Debian 11.1.0-1) 11.1.0, GNU ld (GNU Binutils for Debian) 2.36.90.20210705) #1 SMP @1633961260 [ 0.000000] CPU: ARMv7 Processor [412fc0f2] revision 2 (ARMv7), cr=10c5387d <trim> [ 5.403076] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __lock_acquire+0x2520/0x326c [ 5.413574] CPU: 0 PID: 6 Comm: kworker/0:0H Not tainted 5.14.12-rc1 #1 [ 5.420227] Hardware name: Generic DRA74X (Flattened Device Tree) [ 5.426361] Backtrace: [ 5.428863] [<c153b5e8>] (dump_backtrace) from [<c153b9a8>] (show_stack+0x20/0x24) [ 5.436492] r7:c2109acc r6:00000080 r5:c1c3c52c r4:60000193 [ 5.442169] [<c153b988>] (show_stack) from [<c1542cf8>] (dump_stack_lvl+0x60/0x78) [ 5.449798] [<c1542c98>] (dump_stack_lvl) from [<c1542d28>] (dump_stack+0x18/0x1c) [ 5.457427] r7:c2109acc r6:c1c1d4ac r5:00000000 r4:c23a1aa8 [ 5.463104] [<c1542d10>] (dump_stack) from [<c153c800>] (panic+0x13c/0x370) [ 5.470123] [<c153c6c4>] (panic) from [<c1555854>] (lockdep_hardirqs_on+0x0/0x1d0) [ 5.477752] r3:c28033d0 r2:a519091a r1:c03dc7ec r0:c1c1d4ac [ 5.483428] r7:c2109acc [ 5.485992] [<c1555838>] (__stack_chk_fail) from [<c03dc7ec>] (__lock_acquire+0x2520/0x326c) [ 5.494476] [<c03da2cc>] (__lock_acquire) from [<c03ddfe0>] (lock_acquire+0x140/0x414) [ 5.502471] r10:60000193 r9:00000080 r8:2ca87000 r7:c31c4128 r6:c20935e0 r5:c20935e0 [ 5.510345] r4:c31c4000 [ 5.512878] [<c03ddea0>] (lock_acquire) from [<c03a2e1c>] (account_system_index_time+0xf0/0x284) [ 5.521728] r10:c31c4000 r9:eeb1fa40 r8:eeb1a4f0 r7:00000002
r6:c321db80 r5:00000000
Full test log link,
https://lkft.validation.linaro.org/scheduler/job/3719571#L2392
zImage:
https://builds.tuxbuild.com/1zMbwi83MvhJdKpC0LTvxvIh1Fb/zImage
Build link,
https://builds.tuxbuild.com/1zMbwi83MvhJdKpC0LTvxvIh1Fb/
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Hi Greg,
The reported crash on the arm x15 is an intermittent problem. Which is also noticed on Linux next and mainline.
We are investigating this problem.
This reported crash is not specific to this rc review.
- Naresh
Quoted 52 lines · Naresh Kamboju
On Mon, 11 Oct 2021 at 19:28, Greg Kroah-Hartman
Results from Linaro’s test farm.
Regression found on arm x15 device.metadata:
git branch: linux-5.14.y
git repo: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
git commit:d98305d056b808dd938d2ae6bfd0e3ccac00a106
git describe: v5.14.11-152-gd98305d056b8
make_kernelversion: 5.14.12-rc1
kernel-config: https://builds.tuxbuild.com/1zMbwi83MvhJdKpC0LTvxvIh1Fb/configCrash log,
[ 0.000000] Linux version 5.14.12-rc1 (tuxmake@tuxmake) (arm-linux-gnueabihf-gcc (Debian 11.1.0-1) 11.1.0, GNU ld (GNU Binutils for Debian) 2.36.90.20210705) #1 SMP @1633961260 [ 0.000000] CPU: ARMv7 Processor [412fc0f2] revision 2 (ARMv7), cr=10c5387d <trim> [ 5.403076] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __lock_acquire+0x2520/0x326c [ 5.413574] CPU: 0 PID: 6 Comm: kworker/0:0H Not tainted 5.14.12-rc1 #1 [ 5.420227] Hardware name: Generic DRA74X (Flattened Device Tree) [ 5.426361] Backtrace: [ 5.428863] [<c153b5e8>] (dump_backtrace) from [<c153b9a8>] (show_stack+0x20/0x24) [ 5.436492] r7:c2109acc r6:00000080 r5:c1c3c52c r4:60000193 [ 5.442169] [<c153b988>] (show_stack) from [<c1542cf8>] (dump_stack_lvl+0x60/0x78) [ 5.449798] [<c1542c98>] (dump_stack_lvl) from [<c1542d28>] (dump_stack+0x18/0x1c) [ 5.457427] r7:c2109acc r6:c1c1d4ac r5:00000000 r4:c23a1aa8 [ 5.463104] [<c1542d10>] (dump_stack) from [<c153c800>] (panic+0x13c/0x370) [ 5.470123] [<c153c6c4>] (panic) from [<c1555854>] (lockdep_hardirqs_on+0x0/0x1d0) [ 5.477752] r3:c28033d0 r2:a519091a r1:c03dc7ec r0:c1c1d4ac [ 5.483428] r7:c2109acc [ 5.485992] [<c1555838>] (__stack_chk_fail) from [<c03dc7ec>] (__lock_acquire+0x2520/0x326c) [ 5.494476] [<c03da2cc>] (__lock_acquire) from [<c03ddfe0>] (lock_acquire+0x140/0x414) [ 5.502471] r10:60000193 r9:00000080 r8:2ca87000 r7:c31c4128 r6:c20935e0 r5:c20935e0 [ 5.510345] r4:c31c4000 [ 5.512878] [<c03ddea0>] (lock_acquire) from [<c03a2e1c>] (account_system_index_time+0xf0/0x284) [ 5.521728] r10:c31c4000 r9:eeb1fa40 r8:eeb1a4f0 r7:00000002r6:c321db80 r5:00000000
Quoted 8 lines
Full test log link,
https://lkft.validation.linaro.org/scheduler/job/3719571#L2392zImage:
https://builds.tuxbuild.com/1zMbwi83MvhJdKpC0LTvxvIh1Fb/zImageBuild link,
https://builds.tuxbuild.com/1zMbwi83MvhJdKpC0LTvxvIh1Fb/
It looks like a really long backtrace, and there is something about stack corruption, so I wonder if the stack is actually overflowing here. Can you see if the same thing happens with Ard's vmap-stack branch from [1] or if that shows a different output?
[1] https://git.kernel.org/pub/scm/linux/kernel/git/ardb/linux.git/log/?h=arm-vmap-stacks
Arnd
Quoted 6 lines
It looks like a really long backtrace, and there is something about stack corruption, so I wonder if the stack is actually overflowing here. Can you see if the same thing happens with Ard's vmap-stack branch from [1] or if that shows a different output?
[1] https://git.kernel.org/pub/scm/linux/kernel/git/ardb/linux.git/log/?h=arm-vmap-stacks
I do not see any crash on this tree and arm-vmap-stacks branch.
- Naresh
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.14.12 release. There are 151 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 13 Oct 2021 13:44:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.14.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.14.12 release. There are 151 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 13 Oct 2021 13:44:51 +0000. Anything received after that time might be too late.
Build results:
total: 154 pass: 154 fail: 0 Qemu test results: total: 480 pass: 480 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.14.12 release. There are 151 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 13 Oct 2021 13:44:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.14.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.14:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
114 tests: 114 pass, 0 failLinux version: 5.14.12-rc1-gf24b290ad7b9
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.14.12 release. There are 151 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 13 Oct 2021 13:44:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
Regressions detected on arm.
The reported crash on the arm x15 is an intermittent problem. Which is also noticed on Linux next and mainline.
We are investigating this problem.
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __lock_acquire+0x2520/0x326c
URL:
https://lore.kernel.org/stable/CA+G9fYutz0ZgJ=rrg8=Fd7vh9c7G-SJfF2YoH5wZyGzUHu4Dqw@mail.gmail.com/
## Build
* kernel: 5.14.12-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.14.y
* git commit: d98305d056b808dd938d2ae6bfd0e3ccac00a106
* git describe: v5.14.11-152-gd98305d056b8
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.14.y/build/v5.14.11-152-gd98305d056b8
## No regressions (compared to v5.14.11)
## No fixes (compared to v5.14.11)
## Test result summary
total: 94671, pass: 79926, fail: 1186, skip: 12797, xfail: 762
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 289 total, 289 passed, 0 failed
* arm64: 39 total, 39 passed, 0 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 38 total, 38 passed, 0 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 39 total, 39 passed, 0 failed
* parisc: 12 total, 12 passed, 0 failed
* powerpc: 36 total, 36 passed, 0 failed
* riscv: 30 total, 30 passed, 0 failed
* s390: 18 total, 18 passed, 0 failed
* sh: 24 total, 24 passed, 0 failed
* sparc: 12 total, 12 passed, 0 failed
* x15: 1 total, 1 passed, 0 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 39 total, 39 passed, 0 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-arm64
* kselftest-arm64/arm64.btitest.bti_c_func
* kselftest-arm64/arm64.btitest.bti_j_func
* kselftest-arm64/arm64.btitest.bti_jc_func
* kselftest-arm64/arm64.btitest.bti_none_func
* kselftest-arm64/arm64.btitest.nohint_func
* kselftest-arm64/arm64.btitest.paciasp_func
* kselftest-arm64/arm64.nobtitest.bti_c_func
* kselftest-arm64/arm64.nobtitest.bti_j_func
* kselftest-arm64/arm64.nobtitest.bti_jc_func
* kselftest-arm64/arm64.nobtitest.bti_none_func
* kselftest-arm64/arm64.nobtitest.nohint_func
* kselftest-arm64/arm64.nobtitest.paciasp_func
* kselftest-bpf
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* prep-tmp-disk
* rcutorture
* ssuite
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org