5.10.84-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.10.84-rc1 review
This is the start of the stable review cycle for the 5.10.84 release. There are 130 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 08 Dec 2021 14:55:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.84-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.84-rc1
Wei Yongjun <[email protected]>
ipmi: msghandler: Make symbol 'remove_work_wq' static
Tianjia Zhang <[email protected]>
net/tls: Fix authentication failure in CCM mode
Helge Deller <[email protected]>
parisc: Mark cr16 CPU clocksource unstable on all SMP machines
Mordechay Goodstein <[email protected]>
iwlwifi: mvm: retry init flow if failed
Lukas Wunner <[email protected]>
serial: 8250: Fix RTS modem control while in rs485 mode
Jay Dolan <[email protected]>
serial: 8250_pci: rewrite pericom_do_set_divisor()
Jay Dolan <[email protected]>
serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array
Johan Hovold <[email protected]>
serial: core: fix transmit-buffer reset and memleak
Patrik John <[email protected]>
serial: tegra: Change lower tolerance baud rate limit for tegra20 and tegra30
Pierre Gondois <[email protected]>
serial: pl011: Add ACPI SBSA UART match id
Sven Eckelmann <[email protected]>
tty: serial: msm_serial: Deactivate RX DMA for polling support
Joerg Roedel <[email protected]>
x86/64/mm: Map all kernel memory into trampoline_pgd
Feng Tang <[email protected]>
x86/tsc: Disable clocksource watchdog for TSC on qualified platorms
Feng Tang <[email protected]>
x86/tsc: Add a timer to make sure TSC_adjust is always checked
Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
Ole Ernst <[email protected]>
USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub
Mathias Nyman <[email protected]>
xhci: Fix commad ring abort, write all 64 bits to CRCR register.
Maciej W. Rozycki <[email protected]>
vgacon: Propagate console boot parameters before calling `vc_resize'
Helge Deller <[email protected]>
parisc: Fix "make install" on newer debian releases
Helge Deller <[email protected]>
parisc: Fix KBUILD_IMAGE for self-extracting kernel
Lai Jiangshan <[email protected]>
x86/entry: Add a fence for kernel entry SWAPGS in paranoid_entry()
Juergen Gross <[email protected]>
x86/pv: Switch SWAPGS to ALTERNATIVE
Qais Yousef <[email protected]>
sched/uclamp: Fix rq->uclamp_max not set on first enqueue
Lai Jiangshan <[email protected]>
x86/xen: Add xenpv_restore_regs_and_return_to_usermode()
Lai Jiangshan <[email protected]>
x86/entry: Use the correct fence macro after swapgs in kernel CR3
Michael Sterritt <[email protected]>
x86/sev: Fix SEV-ES INS/OUTS instructions for word, dword, and qword
Dan Carpenter <[email protected]>
KVM: VMX: Set failure code in prepare_vmcs02()
Like Xu <[email protected]>
KVM: x86/pmu: Fix reserved bits for AMD PerfEvtSeln register
Sameer Saurabh <[email protected]>
atlantic: Remove warn trace message.
Dmitry Bogdanov <[email protected]>
atlantic: Fix statistics logic for production hardware
Sameer Saurabh <[email protected]>
Remove Half duplex mode speed capabilities.
Nikita Danilov <[email protected]>
atlantic: Add missing DIDs and fix 115c.
Sameer Saurabh <[email protected]>
atlantic: Fix to display FW bundle version instead of FW mac version.
Nikita Danilov <[email protected]>
atlatnic: enable Nbase-t speeds with base-t
Dmitry Bogdanov <[email protected]>
atlantic: Increase delay for fw transactions
Rob Clark <[email protected]>
drm/msm: Do hw_init() before capturing GPU state
Douglas Anderson <[email protected]>
drm/msm/a6xx: Allocate enough space for GMU registers
Tony Lu <[email protected]>
net/smc: Keep smc_close_final rc during active close
William Kucharski <[email protected]>
net/rds: correct socket tunable error in rds_tcp_tune()
Dust Li <[email protected]>
net/smc: fix wrong list_del in smc_lgr_cleanup_early
Eric Dumazet <[email protected]>
ipv4: convert fib_num_tclassid_users to atomic_t
Eric Dumazet <[email protected]>
net: annotate data-races on txq->xmit_lock_owner
Dongliang Mu <[email protected]>
dpaa2-eth: destroy workqueue at the end of remove function
Christophe JAILLET <[email protected]>
net: marvell: mvpp2: Fix the computation of shared CPUs
Sven Schuchmann <[email protected]>
net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ is available
Pierre-Louis Bossart <[email protected]>
ALSA: intel-dsp-config: add quirk for CML devices based on ES8336 codec
Eiichi Tsukata <[email protected]>
rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
Eiichi Tsukata <[email protected]>
rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
Sameer Pujar <[email protected]>
ASoC: tegra: Fix kcontrol put callback in AHUB
Sameer Pujar <[email protected]>
ASoC: tegra: Fix kcontrol put callback in DSPK
Sameer Pujar <[email protected]>
ASoC: tegra: Fix kcontrol put callback in DMIC
Sameer Pujar <[email protected]>
ASoC: tegra: Fix kcontrol put callback in I2S
Sameer Pujar <[email protected]>
ASoC: tegra: Fix kcontrol put callback in ADMAIF
Sameer Pujar <[email protected]>
ASoC: tegra: Fix wrong value type in DSPK
Sameer Pujar <[email protected]>
ASoC: tegra: Fix wrong value type in DMIC
Sameer Pujar <[email protected]>
ASoC: tegra: Fix wrong value type in I2S
Sameer Pujar <[email protected]>
ASoC: tegra: Fix wrong value type in ADMAIF
Lorenzo Bianconi <[email protected]>
mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode
Li Zhijian <[email protected]>
selftests: net: Correct case name
Zhou Qingyang <[email protected]>
net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
Mark Rutland <[email protected]>
arm64: ftrace: add missing BTIs
Arnd Bergmann <[email protected]>
siphash: use _unaligned version by default
Benjamin Poirier <[email protected]>
net: mpls: Fix notifications when deleting a device
Zhou Qingyang <[email protected]>
net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
Paolo Abeni <[email protected]>
tcp: fix page frag corruption on page fault
Randy Dunlap <[email protected]>
natsemi: xtensa: fix section mismatch warnings
Aaro Koskinen <[email protected]>
i2c: cbus-gpio: set atomic transfer callback
Alain Volmat <[email protected]>
i2c: stm32f7: stop dma transfer in case of NACK
Alain Volmat <[email protected]>
i2c: stm32f7: recover the bus on access timeout
Alain Volmat <[email protected]>
i2c: stm32f7: flush TX FIFO upon transfer errors
Gustavo A. R. Silva <[email protected]>
wireguard: ratelimiter: use kvcalloc() instead of kvzalloc()
Jason A. Donenfeld <[email protected]>
wireguard: receive: drop handshakes if queue lock is contended
Jason A. Donenfeld <[email protected]>
wireguard: receive: use ring buffer for incoming handshakes
Jason A. Donenfeld <[email protected]>
wireguard: device: reset peer src endpoint when netns exits
Li Zhijian <[email protected]>
wireguard: selftests: rename DEBUG_PI_LIST to DEBUG_PLIST
Jason A. Donenfeld <[email protected]>
wireguard: selftests: actually test for routing loops
Jason A. Donenfeld <[email protected]>
wireguard: allowedips: add missing __rcu annotation to satisfy sparse
Jason A. Donenfeld <[email protected]>
wireguard: selftests: increase default dmesg log size
Yifan Zhang <[email protected]>
drm/amdkfd: fix boot failure when iommu is disabled in Picasso.
Yifan Zhang <[email protected]>
drm/amdgpu: init iommu after amdkfd device init
James Zhu <[email protected]>
drm/amdgpu: move iommu_resume before ip init/resume
James Zhu <[email protected]>
drm/amdgpu: add amdgpu_amdkfd_resume_iommu
James Zhu <[email protected]>
drm/amdkfd: separate kfd_iommu_resume from kfd_resume
Steven Rostedt (VMware) <[email protected]>
tracing/histograms: String compares should not care about signed values
Lai Jiangshan <[email protected]>
KVM: X86: Use vcpu->arch.walk_mmu for kvm_mmu_invlpg()
Catalin Marinas <[email protected]>
KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 to 1
Paolo Bonzini <[email protected]>
KVM: x86: Use a stable condition around all VT-d PI paths
Sean Christopherson <[email protected]>
KVM: nVMX: Flush current VPID (L1 vs. L2) for KVM_REQ_TLB_FLUSH_GUEST
Sean Christopherson <[email protected]>
KVM: Disallow user memslot with size that exceeds "unsigned long"
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Allow DSC on supported MST branch devices
msizanoen1 <[email protected]>
ipv6: fix memory leak in fib6_rule_suppress
Baokun Li <[email protected]>
sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl
Baokun Li <[email protected]>
sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
Linus Torvalds <[email protected]>
fget: check that the fd still exists after getting a ref to it
Niklas Schnelle <[email protected]>
s390/pci: move pseudo-MMIO to prevent MIO overlap
Xiongfeng Wang <[email protected]>
cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink()
Ioanna Alifieraki <[email protected]>
ipmi: Move remove_work to dedicated workqueue
Stanislaw Gruszka <[email protected]>
rt2x00: do not mark device gone on EPROTO errors during start
Masami Hiramatsu <[email protected]>
kprobes: Limit max data_size of the kretprobe instances
Stephen Suryaputra <[email protected]>
vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
Mario Limonciello <[email protected]>
ACPI: Add stubs for wakeup handler functions
Wen Gu <[email protected]>
net/smc: Avoid warning of possible recursive locking
Ian Rogers <[email protected]>
perf report: Fix memory leaks around perf_tip()
Ian Rogers <[email protected]>
perf hist: Fix memory leak of a perf_hpp_fmt
German Gomez <[email protected]>
perf inject: Fix ARM SPE handling
Teng Qi <[email protected]>
net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock()
zhangyue <[email protected]>
net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound
Jordy Zomer <[email protected]>
ipv6: check return value of ipv6_skip_exthdr
Teng Qi <[email protected]>
ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()
Mario Limonciello <[email protected]>
ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile
Bernard Zhao <[email protected]>
drm/amd/amdgpu: fix potential memleak
shaoyunl <[email protected]>
drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again
Mike Christie <[email protected]>
scsi: iscsi: Unblock session then wake up error handler
Manaf Meethalavalappu Pallikunhi <[email protected]>
thermal: core: Reset previous low and high trip during thermal zone init
Wang Yugui <[email protected]>
btrfs: check-integrity: fix a warning on write caching disabled disk
Vasily Gorbik <[email protected]>
s390/setup: avoid using memblock_enforce_memory_limit
Slark Xiao <[email protected]>
platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep
Jimmy Wang <[email protected]>
platform/x86: thinkpad_acpi: Add support for dual fan control
liuguoqiang <[email protected]>
net: return correct error code
Zekun Shen <[email protected]>
atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait
Wen Gu <[email protected]>
net/smc: Transfer remaining wait queue entries during fallback
Xing Song <[email protected]>
mac80211: do not access the IV when it was stripped
Julian Braha <[email protected]>
drm/sun4i: fix unmet dependency on RESET_CONTROLLER for PHY_SUN6I_MIPI_DPHY
Alexey Kardashevskiy <[email protected]>
powerpc/pseries/ddw: Revert "Extend upper limit for huge DMA window for persistent memory"
Andreas Gruenbacher <[email protected]>
gfs2: Fix length of holes reported at end-of-file
Bob Peterson <[email protected]>
gfs2: release iopen glock early in evict
Miklos Szeredi <[email protected]>
ovl: fix deadlock in splice write
Miklos Szeredi <[email protected]>
ovl: simplify file splice
Zhang Changzhong <[email protected]>
can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
Benjamin Coddington <[email protected]>
NFSv42: Fix pagecache invalidation after COPY/CLONE
-------------
Diffstat:
Makefile | 4 +- arch/arm64/include/asm/kvm_arm.h | 4 +- arch/arm64/kernel/entry-ftrace.S | 6 + arch/parisc/Makefile | 5 + arch/parisc/install.sh | 1 + arch/parisc/kernel/time.c | 24 +- arch/powerpc/platforms/pseries/iommu.c | 9 - arch/s390/include/asm/pci_io.h | 7 +- arch/s390/kernel/setup.c | 3 - arch/x86/entry/entry_64.S | 45 ++-- arch/x86/include/asm/irqflags.h | 20 +- arch/x86/include/asm/paravirt.h | 20 -- arch/x86/include/asm/paravirt_types.h | 2 - arch/x86/kernel/asm-offsets_64.c | 1 - arch/x86/kernel/paravirt.c | 1 - arch/x86/kernel/paravirt_patch.c | 3 - arch/x86/kernel/sev-es.c | 57 ++-- arch/x86/kernel/tsc.c | 28 +- arch/x86/kernel/tsc_sync.c | 41 +++ arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/kvm/svm/pmu.c | 2 +- arch/x86/kvm/vmx/nested.c | 4 +- arch/x86/kvm/vmx/posted_intr.c | 20 +- arch/x86/kvm/vmx/vmx.c | 23 +- arch/x86/realmode/init.c | 12 +- arch/x86/xen/enlighten_pv.c | 3 - arch/x86/xen/xen-asm.S | 20 ++ drivers/ata/ahci.c | 1 + drivers/ata/sata_fsl.c | 20 +- drivers/char/ipmi/ipmi_msghandler.c | 13 +- drivers/cpufreq/cpufreq.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 10 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 + drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 1 + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 15 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 5 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 20 +- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 4 +- drivers/gpu/drm/msm/msm_debugfs.c | 1 + drivers/gpu/drm/sun4i/Kconfig | 1 + drivers/i2c/busses/i2c-cbus-gpio.c | 5 +- drivers/i2c/busses/i2c-stm32f7.c | 31 ++- drivers/net/ethernet/aquantia/atlantic/aq_common.h | 27 +- drivers/net/ethernet/aquantia/atlantic/aq_hw.h | 2 + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 10 +- .../net/ethernet/aquantia/atlantic/aq_pci_func.c | 7 +- drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 3 - .../aquantia/atlantic/hw_atl/hw_atl_utils.c | 25 +- .../aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c | 3 - .../ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c | 22 +- .../ethernet/aquantia/atlantic/hw_atl2/hw_atl2.h | 2 + .../aquantia/atlantic/hw_atl2/hw_atl2_utils.h | 38 ++- .../aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c | 110 ++++++-- drivers/net/ethernet/dec/tulip/de4x5.c | 34 ++- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 2 + drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c | 4 + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 9 +- drivers/net/ethernet/natsemi/xtsonic.c | 2 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 10 +- drivers/net/usb/lan78xx.c | 2 +- drivers/net/vrf.c | 2 + drivers/net/wireguard/allowedips.c | 2 +- drivers/net/wireguard/device.c | 39 +-- drivers/net/wireguard/device.h | 9 +- drivers/net/wireguard/queueing.c | 6 +- drivers/net/wireguard/queueing.h | 2 +- drivers/net/wireguard/ratelimiter.c | 4 +- drivers/net/wireguard/receive.c | 39 +-- drivers/net/wireguard/socket.c | 2 +- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 22 +- drivers/net/wireless/intel/iwlwifi/iwl-drv.h | 3 + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 24 +- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 3 + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 3 + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 +- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 3 + drivers/platform/x86/thinkpad_acpi.c | 13 +- drivers/scsi/scsi_transport_iscsi.c | 6 +- drivers/thermal/thermal_core.c | 2 + drivers/tty/serial/8250/8250_pci.c | 39 ++- drivers/tty/serial/8250/8250_port.c | 7 - drivers/tty/serial/amba-pl011.c | 1 + drivers/tty/serial/msm_serial.c | 3 + drivers/tty/serial/serial-tegra.c | 4 +- drivers/tty/serial/serial_core.c | 18 +- drivers/usb/core/quirks.c | 3 + drivers/usb/host/xhci-ring.c | 21 +- drivers/usb/typec/tcpm/tcpm.c | 4 - drivers/video/console/vgacon.c | 14 +- fs/btrfs/disk-io.c | 14 +- fs/file.c | 4 + fs/gfs2/bmap.c | 2 +- fs/gfs2/super.c | 14 +- fs/nfs/nfs42proc.c | 5 +- fs/overlayfs/file.c | 59 ++-- include/linux/acpi.h | 9 + include/linux/kprobes.h | 2 + include/linux/netdevice.h | 19 +- include/linux/siphash.h | 14 +- include/net/dst_cache.h | 11 + include/net/fib_rules.h | 4 +- include/net/ip_fib.h | 2 +- include/net/netns/ipv4.h | 2 +- include/net/sock.h | 13 +- kernel/kprobes.c | 3 + kernel/sched/core.c | 2 +- kernel/trace/trace_events_hist.c | 2 +- lib/siphash.c | 12 +- net/can/j1939/transport.c | 6 + net/core/dev.c | 5 +- net/core/dst_cache.c | 19 ++ net/core/fib_rules.c | 2 +- net/ipv4/devinet.c | 2 +- net/ipv4/fib_frontend.c | 2 +- net/ipv4/fib_rules.c | 5 +- net/ipv4/fib_semantics.c | 4 +- net/ipv6/esp6.c | 6 + net/ipv6/fib6_rules.c | 4 +- net/mac80211/rx.c | 3 +- net/mpls/af_mpls.c | 68 +++-- net/rds/tcp.c | 2 +- net/rxrpc/conn_client.c | 14 +- net/rxrpc/peer_object.c | 14 +- net/smc/af_smc.c | 14 + net/smc/smc_close.c | 8 +- net/smc/smc_core.c | 7 +- net/tls/tls_sw.c | 4 +- sound/hda/intel-dsp-config.c | 10 + sound/soc/tegra/tegra186_dspk.c | 181 ++++++++++--- sound/soc/tegra/tegra210_admaif.c | 140 +++++++--- sound/soc/tegra/tegra210_ahub.c | 11 +- sound/soc/tegra/tegra210_dmic.c | 184 ++++++++++--- sound/soc/tegra/tegra210_i2s.c | 296 ++++++++++++++++----- tools/perf/builtin-report.c | 15 +- tools/perf/ui/hist.c | 28 +- tools/perf/util/arm-spe.c | 15 ++ tools/perf/util/hist.h | 1 - tools/perf/util/util.c | 14 +- tools/perf/util/util.h | 2 +- tools/testing/selftests/net/fcnal-test.sh | 4 +- tools/testing/selftests/wireguard/netns.sh | 30 ++- .../testing/selftests/wireguard/qemu/debug.config | 2 +- .../testing/selftests/wireguard/qemu/kernel.config | 1 + virt/kvm/kvm_main.c | 3 +- 146 files changed, 1760 insertions(+), 688 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/130 NFSv42: Fix pagecache invalidation after COPY/CLONE
From: Benjamin Coddington <[email protected]>
commit 3f015d89a47cd8855cd92f71fff770095bd885a1 upstream.
The mechanism in use to allow the client to see the results of COPY/CLONE is to drop those pages from the pagecache. This forces the client to read those pages once more from the server. However, truncate_pagecache_range() zeros out partial pages instead of dropping them. Let us instead use invalidate_inode_pages2_range() with full-page offsets to ensure the client properly sees the results of COPY/CLONE operations.
--- fs/nfs/nfs42proc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/nfs/nfs42proc.c +3 -2
@@ -362,8 +362,9 @@ static ssize_t _nfs42_proc_copy(struct f goto out; } -truncate_pagecache_range (dst_inode, pos_dst, - pos_dst + res->write_res.count); +WARN_ON_ONCE (invalidate_inode_pages2_range (dst_inode->i_mapping, + pos_dst >>PAGE_SHIFT , + (pos_dst + res->write_res.count -1 ) >>PAGE_SHIFT ));spin_lock (&dst_inode->i_lock); NFS_I(dst_inode)->cache_validity |= (NFS_INO_REVAL_PAGECACHE | NFS_INO_REVAL_FORCED | NFS_INO_INVALID_SIZE |
Greg Kroah-Hartman
maintainerPATCH 2/130 can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
commit 164051a6ab5445bd97f719f50b16db8b32174269 upstream.
The TP.CM_BAM message must be sent to the global address [1], so add a check to drop TP.CM_BAM sent to a non-global address.
Without this patch, the receiver will treat the following packets as normal RTS/CTS transport:
18EC0102#20090002FF002301
18EB0102#0100000000000000
18EB0102#020000FFFFFFFFFF
[1] SAE-J1939-82 2015 A.3.3 Row 1.
--- net/can/j1939/transport.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/can/j1939/transport.c +6 -0
@@ -2004,6 +2004,12 @@ static void j1939_tp_cmd_recv(struct j19 extd =J1939_ETP ; fallthrough;case J1939_TP_CMD_BAM : +if (cmd ==J1939_TP_CMD_BAM && !j1939_cb_is_broadcast (skcb)) { +netdev_err_once (priv->ndev,"%s: BAM to unicast (%02x), ignoring!\n" , + __func__, skcb->addr.sa); +return ; + } + fallthrough;case J1939_TP_CMD_RTS :/* fall through */ if (skcb->addr.type != extd)return ;
Greg Kroah-Hartman
maintainerPATCH 3/130 ovl: simplify file splice
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit 82a763e61e2b601309d696d4fa514c77d64ee1be upstream.
generic_file_splice_read() and iter_file_splice_write() will call back into f_op->iter_read() and f_op->iter_write() respectively. These already do the real file lookup and cred override. So the code in ovl_splice_read() and ovl_splice_write() is redundant.
In addition the ovl_file_accessed() call in ovl_splice_write() is incorrect, though probably harmless.
Fix by calling generic_file_splice_read() and iter_file_splice_write() directly.
--- fs/overlayfs/file.c | 46 ++-------------------------------------------- 1 file changed, 2 insertions(+), 44 deletions(-)
fs/overlayfs/file.c +2 -44
@@ -422,48 +422,6 @@ out_unlock:return ret; } -static ssize_t ovl_splice_read (struct file *in,loff_t *ppos, -struct pipe_inode_info *pipe,size_t len, -unsigned int flags) -{ -ssize_t ret; -struct fd real; -const struct cred *old_cred; - - ret =ovl_real_fdget (in, &real); -if (ret) -return ret; - - old_cred =ovl_override_creds (file_inode (in)->i_sb); - ret =generic_file_splice_read (real.file, ppos, pipe, len, flags); -revert_creds (old_cred); - -ovl_file_accessed (in); -fdput (real); -return ret; -} - -static ssize_t -ovl_splice_write (struct pipe_inode_info *pipe,struct file *out, -loff_t *ppos,size_t len,unsigned int flags) -{ -struct fd real; -const struct cred *old_cred; -ssize_t ret; - - ret =ovl_real_fdget (out, &real); -if (ret) -return ret; - - old_cred =ovl_override_creds (file_inode (out)->i_sb); - ret =iter_file_splice_write (pipe, real.file, ppos, len, flags); -revert_creds (old_cred); - -ovl_file_accessed (out); -fdput (real); -return ret; -} -static int ovl_fsync (struct file *file,loff_t start,loff_t end,int datasync) {struct fd real;
@@ -772,8 +730,8 @@ const struct file_operations ovl_file_op#ifdef CONFIG_COMPAT .compat_ioctl = ovl_compat_ioctl, #endif - .splice_read = ovl_splice_read, - .splice_write = ovl_splice_write, + .splice_read = generic_file_splice_read, + .splice_write = iter_file_splice_write, .copy_file_range = ovl_copy_file_range, .remap_file_range = ovl_remap_file_range,
Greg Kroah-Hartman
maintainerPATCH 4/130 ovl: fix deadlock in splice write
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit 9b91b6b019fda817eb52f728eb9c79b3579760bc upstream.
There's possibility of an ABBA deadlock in case of a splice write to an overlayfs file and a concurrent splice write to a corresponding real file.
The call chain for splice to an overlay file:
-> do_splice [takes sb_writers on overlay file]
-> do_splice_from
-> iter_file_splice_write [takes pipe->mutex]
-> vfs_iter_write
...
-> ovl_write_iter [takes sb_writers on real file]And the call chain for splice to a real file:
-> do_splice [takes sb_writers on real file]
-> do_splice_from
-> iter_file_splice_write [takes pipe->mutex]
Syzbot successfully bisected this to commit 82a763e61e2b ("ovl: simplify file splice").
Fix by reverting the write part of the above commit and by adding missing bits from ovl_write_iter() into ovl_splice_write().
--- fs/overlayfs/file.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-)
fs/overlayfs/file.c +46 -1
@@ -422,6 +422,51 @@ out_unlock:return ret; } +/* +* Calling iter_file_splice_write() directly from overlay's f_op may deadlock +* due to lock order inversion between pipe->mutex in iter_file_splice_write() +* and file_start_write(real.file) in ovl_write_iter(). +* +* So do everything ovl_write_iter() does and call iter_file_splice_write() on +* the real file. +*/ +static ssize_t ovl_splice_write (struct pipe_inode_info *pipe,struct file *out, +loff_t *ppos,size_t len,unsigned int flags) +{ +struct fd real; +const struct cred *old_cred; +struct inode *inode =file_inode (out); +struct inode *realinode =ovl_inode_real (inode); +ssize_t ret; + +inode_lock (inode); +/* Update mode */ +ovl_copyattr (realinode, inode); + ret =file_remove_privs (out); +if (ret) + goto out_unlock; + + ret =ovl_real_fdget (out, &real); +if (ret) + goto out_unlock; + + old_cred =ovl_override_creds (inode->i_sb); +file_start_write (real.file); + + ret =iter_file_splice_write (pipe, real.file, ppos, len, flags); + +file_end_write (real.file); +/* Update size */ +ovl_copyattr (realinode, inode); +revert_creds (old_cred); +fdput (real); + +out_unlock: +inode_unlock (inode); + +return ret; +} +static int ovl_fsync (struct file *file,loff_t start,loff_t end,int datasync) {struct fd real;
@@ -731,7 +776,7 @@ const struct file_operations ovl_file_op .compat_ioctl = ovl_compat_ioctl, #endif .splice_read = generic_file_splice_read, - .splice_write = iter_file_splice_write, + .splice_write = ovl_splice_write, .copy_file_range = ovl_copy_file_range, .remap_file_range = ovl_remap_file_range,
Greg Kroah-Hartman
maintainerPATCH 5/130 gfs2: release iopen glock early in evict
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit 49462e2be119d38c5eb5759d0d1b712df3a41239 ]
Before this patch, evict would clear the iopen glock's gl_object after releasing the inode glock. In the meantime, another process could reuse the same block and thus glocks for a new inode. It would lock the inode glock (exclusively), and then the iopen glock (shared). The shared locking mode doesn't provide any ordering against the evict, so by the time the iopen glock is reused, evict may not have gotten to setting gl_object to NULL.
Fix that by releasing the iopen glock before the inode glock in gfs2_evict_inode.
--- fs/gfs2/super.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
fs/gfs2/super.c +7 -7
@@ -1438,13 +1438,6 @@ static void gfs2_evict_inode(struct inode *inode)gfs2_ordered_del_inode (ip);clear_inode (inode);gfs2_dir_hash_inval (ip); -if (ip->i_gl) { -glock_clear_object (ip->i_gl, ip); -wait_on_bit_io (&ip->i_flags,GIF_GLOP_PENDING ,TASK_UNINTERRUPTIBLE ); -gfs2_glock_add_to_lru (ip->i_gl); -gfs2_glock_put_eventually (ip->i_gl); - ip->i_gl =NULL ; - }if (gfs2_holder_initialized (&ip->i_iopen_gh)) {struct gfs2_glock *gl = ip->i_iopen_gh.gh_gl;
@@ -1457,6 +1450,13 @@ static void gfs2_evict_inode(struct inode *inode)gfs2_holder_uninit (&ip->i_iopen_gh);gfs2_glock_put_eventually (gl); } +if (ip->i_gl) { +glock_clear_object (ip->i_gl, ip); +wait_on_bit_io (&ip->i_flags,GIF_GLOP_PENDING ,TASK_UNINTERRUPTIBLE ); +gfs2_glock_add_to_lru (ip->i_gl); +gfs2_glock_put_eventually (ip->i_gl); + ip->i_gl =NULL ; + } }static struct inode *gfs2_alloc_inode (struct super_block *sb)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 6/130 gfs2: Fix length of holes reported at end-of-file
In reply to Greg Kroah-HartmanFrom: Andreas Gruenbacher <[email protected]>
[ Upstream commit f3506eee81d1f700d9ee2d2f4a88fddb669ec032 ]
Fix the length of holes reported at the end of a file: the length is relative to the beginning of the extent, not the seek position which is rounded down to the filesystem block size.
This bug went unnoticed for some time, but is now caught by the following assertion in iomap_iter_done():
WARN_ON_ONCE(iter->iomap.offset + iter->iomap.length <= iter->pos)
--- fs/gfs2/bmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/gfs2/bmap.c +1 -1
@@ -940,7 +940,7 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length,else if (height == ip->i_height) ret =gfs2_hole_size (inode, lblock, len, mp, iomap);else - iomap->length = size - pos; + iomap->length = size - iomap->offset; }else if (flags &IOMAP_WRITE ) {u64 alloc_size;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 7/130 powerpc/pseries/ddw: Revert "Extend upper limit for huge DMA window for persistent memory"
In reply to Greg Kroah-HartmanFrom: Alexey Kardashevskiy <[email protected]>
[ Upstream commit 2d33f5504490a9d90924476dbccd4a5349ee1ad0 ]
This reverts commit 54fc3c681ded9437e4548e2501dc1136b23cfa9a which does not allow 1:1 mapping even for the system RAM which is usually possible.
--- arch/powerpc/platforms/pseries/iommu.c | 9 --------- 1 file changed, 9 deletions(-)
arch/powerpc/platforms/pseries/iommu.c +0 -9
@@ -1034,15 +1034,6 @@ static phys_addr_t ddw_memory_hotplug_max(void)phys_addr_t max_addr =memory_hotplug_max ();struct device_node *memory; -/* -* The "ibm,pmemory" can appear anywhere in the address space. -* Assuming it is still backed by page structs, set the upper limit -* for the huge DMA window as MAX_PHYSMEM_BITS. -*/ -if (of_find_node_by_type (NULL ,"ibm,pmemory" )) -return (sizeof (phys_addr_t) *8 <=MAX_PHYSMEM_BITS ) ? - (phys_addr_t) -1 : (1ULL <<MAX_PHYSMEM_BITS ); -for_each_node_by_type (memory,"memory" ) {unsigned long start, size;int n_mem_addr_cells, n_mem_size_cells, len;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 8/130 drm/sun4i: fix unmet dependency on RESET_CONTROLLER for PHY_SUN6I_MIPI_DPHY
In reply to Greg Kroah-HartmanFrom: Julian Braha <[email protected]>
[ Upstream commit bb162bb2b4394108c8f055d1b115735331205e28 ]
When PHY_SUN6I_MIPI_DPHY is selected, and RESET_CONTROLLER is not selected, Kbuild gives the following warning:
WARNING: unmet direct dependencies detected for PHY_SUN6I_MIPI_DPHY
Depends on [n]: (ARCH_SUNXI [=n] || COMPILE_TEST [=y]) && HAS_IOMEM [=y] && COMMON_CLK [=y] && RESET_CONTROLLER [=n] Selected by [y]:
- DRM_SUN6I_DSI [=y] && HAS_IOMEM [=y] && DRM_SUN4I [=y]
This is because DRM_SUN6I_DSI selects PHY_SUN6I_MIPI_DPHY without selecting or depending on RESET_CONTROLLER, despite PHY_SUN6I_MIPI_DPHY depending on RESET_CONTROLLER.
These unmet dependency bugs were detected by Kismet, a static analysis tool for Kconfig. Please advise if this is not the appropriate solution.
v2:
Fixed indentation to match the rest of the file.
--- drivers/gpu/drm/sun4i/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/sun4i/Kconfig +1 -0
@@ -46,6 +46,7 @@ config DRM_SUN6I_DSI default MACH_SUN8I select CRC_CCITT select DRM_MIPI_DSI + select RESET_CONTROLLER select PHY_SUN6I_MIPI_DPHY help Choose this option if you want have an Allwinner SoC with
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 9/130 mac80211: do not access the IV when it was stripped
In reply to Greg Kroah-HartmanFrom: Xing Song <[email protected]>
[ Upstream commit 77dfc2bc0bb4b8376ecd7a430f27a4a8fff6a5a0 ]
ieee80211_get_keyid() will return false value if IV has been stripped, such as return 0 for IP/ARP frames due to LLC header, and return -EINVAL for disassociation frames due to its length... etc. Don't try to access it if it's not present.
--- net/mac80211/rx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/rx.c +2 -1
@@ -1945,7 +1945,8 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)int keyid = rx->sta->ptk_idx; sta_ptk =rcu_dereference (rx->sta->ptk[keyid]); -if (ieee80211_has_protected (fc)) { +if (ieee80211_has_protected (fc) && + !(status->flag &RX_FLAG_IV_STRIPPED )) { cs = rx->sta->cipher_scheme; keyid =ieee80211_get_keyid (rx->skb, cs);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 10/130 net/smc: Transfer remaining wait queue entries during fallback
In reply to Greg Kroah-HartmanFrom: Wen Gu <[email protected]>
[ Upstream commit 2153bd1e3d3dbf6a3403572084ef6ed31c53c5f0 ]
The SMC fallback is incomplete currently. There may be some wait queue entries remaining in smc socket->wq, which should be removed to clcsocket->wq during the fallback.
For example, in nginx/wrk benchmark, this issue causes an all-zeros test result:
server: nginx -g 'daemon off;'
client: smc_run wrk -c 1 -t 1 -d 5 http://11.200.15.93/index.html
Running 5s test @ http://11.200.15.93/index.html
1 threads and 1 connections
Thread Stats Avg Stdev Max ± Stdev
Latency 0.00us 0.00us 0.00us -nan%
Req/Sec 0.00 0.00 0.00 -nan%
0 requests in 5.00s, 0.00B read
Requests/sec: 0.00
Transfer/sec: 0.00BThe reason for this all-zeros result is that when wrk used SMC to replace TCP, it added an eppoll_entry into smc socket->wq and expected to be notified if epoll events like EPOLL_IN/ EPOLL_OUT occurred on the smc socket.
However, once a fallback occurred, wrk switches to use clcsocket. Now it is clcsocket->wq instead of smc socket->wq which will be woken up. The eppoll_entry remaining in smc socket->wq does not work anymore and wrk stops the test.
This patch fixes this issue by removing remaining wait queue entries from smc socket->wq to clcsocket->wq during the fallback.
--- net/smc/af_smc.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
net/smc/af_smc.c +14 -0
@@ -513,12 +513,26 @@ static void smc_link_save_peer_info(struct smc_link *link,static void smc_switch_to_fallback (struct smc_sock *smc) { +wait_queue_head_t *smc_wait =sk_sleep (&smc->sk); +wait_queue_head_t *clc_wait =sk_sleep (smc->clcsock->sk); +unsigned long flags; + smc->use_fallback = true;if (smc->sk.sk_socket && smc->sk.sk_socket->file) { smc->clcsock->file = smc->sk.sk_socket->file; smc->clcsock->file->private_data = smc->clcsock; smc->clcsock->wq.fasync_list = smc->sk.sk_socket->wq.fasync_list; + +/* There may be some entries remaining in +* smc socket->wq, which should be removed +* to clcsocket->wq during the fallback. +*/ +spin_lock_irqsave (&smc_wait->lock, flags); +spin_lock (&clc_wait->lock); +list_splice_init (&smc_wait->head, &clc_wait->head); +spin_unlock (&clc_wait->lock); +spin_unlock_irqrestore (&smc_wait->lock, flags); } }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 11/130 atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait
In reply to Greg Kroah-HartmanFrom: Zekun Shen <[email protected]>
[ Upstream commit b922f622592af76b57cbc566eaeccda0b31a3496 ]
This bug report shows up when running our research tools. The reports is SOOB read, but it seems SOOB write is also possible a few lines below.
In details, fw.len and sw.len are inputs coming from io. A len over the size of self->rpc triggers SOOB. The patch fixes the bugs by adding sanity checks.
The bugs are triggerable with compromised/malfunctioning devices. They are potentially exploitable given they first leak up to 0xffff bytes and able to overwrite the region later.
The patch is tested with QEMU emulater.
This is NOT tested with a real device.
Attached is the log we found by fuzzing.
BUG: KASAN: slab-out-of-bounds in hw_atl_utils_fw_upload_dwords+0x393/0x3c0 [atlantic] Read of size 4 at addr ffff888016260b08 by task modprobe/213 CPU: 0 PID: 213 Comm: modprobe Not tainted 5.6.0 #1 Call Trace: dump_stack+0x76/0xa0 print_address_description.constprop.0+0x16/0x200 ? hw_atl_utils_fw_upload_dwords+0x393/0x3c0 [atlantic] ? hw_atl_utils_fw_upload_dwords+0x393/0x3c0 [atlantic] __kasan_report.cold+0x37/0x7c ? aq_hw_read_reg_bit+0x60/0x70 [atlantic] ? hw_atl_utils_fw_upload_dwords+0x393/0x3c0 [atlantic] kasan_report+0xe/0x20 hw_atl_utils_fw_upload_dwords+0x393/0x3c0 [atlantic] hw_atl_utils_fw_rpc_call+0x95/0x130 [atlantic] hw_atl_utils_fw_rpc_wait+0x176/0x210 [atlantic] hw_atl_utils_mpi_create+0x229/0x2e0 [atlantic] ? hw_atl_utils_fw_rpc_wait+0x210/0x210 [atlantic] ? hw_atl_utils_initfw+0x9f/0x1c8 [atlantic] hw_atl_utils_initfw+0x12a/0x1c8 [atlantic] aq_nic_ndev_register+0x88/0x650 [atlantic] ? aq_nic_ndev_init+0x235/0x3c0 [atlantic] aq_pci_probe+0x731/0x9b0 [atlantic] ? aq_pci_func_init+0xc0/0xc0 [atlantic] local_pci_probe+0xd3/0x160 pci_device_probe+0x23f/0x3e0
--- .../ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c +10 -0
@@ -559,6 +559,11 @@ int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self, goto err_exit;if (fw.len ==0xFFFFU ) { +if (sw.len >sizeof (self->rpc)) { +printk (KERN_INFO "Invalid sw len: %x\n" , sw.len); + err = -EINVAL ; + goto err_exit; + } err =hw_atl_utils_fw_rpc_call (self, sw.len);if (err <0 ) goto err_exit;
@@ -567,6 +572,11 @@ int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self,if (rpc) {if (fw.len) { +if (fw.len >sizeof (self->rpc)) { +printk (KERN_INFO "Invalid fw len: %x\n" , fw.len); + err = -EINVAL ; + goto err_exit; + } err = hw_atl_utils_fw_downld_dwords(self, self->rpc_addr,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 12/130 net: return correct error code
In reply to Greg Kroah-HartmanFrom: liuguoqiang <[email protected]>
[ Upstream commit 6def480181f15f6d9ec812bca8cbc62451ba314c ]
When kmemdup called failed and register_net_sysctl return NULL, should return ENOMEM instead of ENOBUFS
--- net/ipv4/devinet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/devinet.c +1 -1
@@ -2582,7 +2582,7 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name, free:kfree (t); out: -return -ENOBUFS ; +return -ENOMEM ; } static void __devinet_sysctl_unregister(struct net *net,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 13/130 platform/x86: thinkpad_acpi: Add support for dual fan control
In reply to Greg Kroah-HartmanFrom: Jimmy Wang <[email protected]>
[ Upstream commit 1f338954a5fbe21eb22b4223141e31f2a26366d5 ]
This adds dual fan control for P1 / X1 Extreme Gen4
--- drivers/platform/x86/thinkpad_acpi.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/thinkpad_acpi.c +1 -0
@@ -8805,6 +8805,7 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = {TPACPI_Q_LNV3 ('N' ,'2' ,'E' ,TPACPI_FAN_2CTL ),/* P1 / X1 Extreme (1st gen) */ TPACPI_Q_LNV3 ('N' ,'2' ,'O' ,TPACPI_FAN_2CTL ),/* P1 / X1 Extreme (2nd gen) */ TPACPI_Q_LNV3 ('N' ,'2' ,'V' ,TPACPI_FAN_2CTL ),/* P1 / X1 Extreme (3nd gen) */ +TPACPI_Q_LNV3 ('N' ,'4' ,'0' ,TPACPI_FAN_2CTL ),/* P1 / X1 Extreme (4nd gen) */ TPACPI_Q_LNV3 ('N' ,'3' ,'0' ,TPACPI_FAN_2CTL ),/* P15 (1st gen) / P15v (1st gen) */ TPACPI_Q_LNV3('N', '3', '2', TPACPI_FAN_2CTL), /* X1 Carbon (9th gen) */ };
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 14/130 platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep
In reply to Greg Kroah-HartmanFrom: Slark Xiao <[email protected]>
[ Upstream commit 39f53292181081d35174a581a98441de5da22bc9 ]
When WWAN device wake from S3 deep, under thinkpad platform, WWAN would be disabled. This disable status could be checked by command 'nmcli r wwan' or 'rfkill list'.
Issue analysis as below:
When host resume from S3 deep, thinkpad_acpi driver would
call hotkey_resume() function. Finnaly, it will use wan_get_status to check the current status of WWAN device. During this resume progress, wan_get_status would always return off even WWAN boot up completely.
In patch V2, Hans said 'sw_state should be unchanged
after a suspend/resume. It's better to drop the tpacpi_rfk_update_swstate call all together from the resume path'.
And it's confimed by Lenovo that GWAN is no longer
available from WHL generation because the design does not match with current pin control.
--- drivers/platform/x86/thinkpad_acpi.c | 12 ------------ 1 file changed, 12 deletions(-)
drivers/platform/x86/thinkpad_acpi.c +0 -12
@@ -1170,15 +1170,6 @@ static int tpacpi_rfk_update_swstate(const struct tpacpi_rfk *tp_rfk)return status; } -/* Query FW and update rfkill sw state for all rfkill switches */ -static void tpacpi_rfk_update_swstate_all (void ) -{ -unsigned int i; - -for (i =0 ; i <TPACPI_RFK_SW_MAX ; i++) -tpacpi_rfk_update_swstate (tpacpi_rfkill_switches[i]); -} -/* * Sync the HW-blocking state of all rfkill switches, * do notice it causes the rfkill core to schedule uevents
@@ -3121,9 +3112,6 @@ static void tpacpi_send_radiosw_update(void)if (wlsw ==TPACPI_RFK_RADIO_OFF )tpacpi_rfk_update_hwblock_state (true); -/* Sync sw blocking state */ -tpacpi_rfk_update_swstate_all (); -/* Sync hw blocking state last if it is hw-unblocked */ if (wlsw ==TPACPI_RFK_RADIO_ON )tpacpi_rfk_update_hwblock_state (false);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 15/130 s390/setup: avoid using memblock_enforce_memory_limit
In reply to Greg Kroah-HartmanFrom: Vasily Gorbik <[email protected]>
[ Upstream commit 5dbc4cb4667457b0c53bcd7bff11500b3c362975 ]
There is a difference in how architectures treat "mem=" option. For some that is an amount of online memory, for s390 and x86 this is the limiting max address. Some memblock api like memblock_enforce_memory_limit() take limit argument and explicitly treat it as the size of online memory, and use __find_max_addr to convert it to an actual max address. Current s390 usage:
memblock_enforce_memory_limit(memblock_end_of_DRAM());
yields different results depending on presence of memory holes (offline memory blocks in between online memory). If there are no memory holes limit == max_addr in memblock_enforce_memory_limit() and it does trim online memory and reserved memory regions. With memory holes present it actually does nothing.
Since we already use memblock_remove() explicitly to trim online memory regions to potential limit (think mem=, kdump, addressing limits, etc.) drop the usage of memblock_enforce_memory_limit() altogether. Trimming reserved regions should not be required, since we now use memblock_set_current_limit() to limit allocations and any explicit memory reservations above the limit is an actual problem we should not hide.
--- arch/s390/kernel/setup.c | 3 --- 1 file changed, 3 deletions(-)
arch/s390/kernel/setup.c +0 -3
@@ -845,9 +845,6 @@ static void __init setup_memory(void)storage_key_init_range (start, end);psw_set_key (PAGE_DEFAULT_KEY ); - -/* Only cosmetics */ -memblock_enforce_memory_limit (memblock_end_of_DRAM ()); }/*
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 16/130 btrfs: check-integrity: fix a warning on write caching disabled disk
In reply to Greg Kroah-HartmanFrom: Wang Yugui <[email protected]>
[ Upstream commit a91cf0ffbc244792e0b3ecf7d0fddb2f344b461f ]
When a disk has write caching disabled, we skip submission of a bio with flush and sync requests before writing the superblock, since it's not needed. However when the integrity checker is enabled, this results in reports that there are metadata blocks referred by a superblock that were not properly flushed. So don't skip the bio submission only when the integrity checker is enabled for the sake of simplicity, since this is a debug tool and not meant for use in non-debug builds.
fstests/btrfs/220 trigger a check-integrity warning like the following when CONFIG_BTRFS_FS_CHECK_INTEGRITY=y and the disk with WCE=0.
btrfs: attempt to write superblock which references block M @5242880 (sdb2/5242880/0) which is not flushed out of disk's write cache (block flush_gen=1, dev->flush_gen=0)!
------------[ cut here ]------------ WARNING: CPU: 28 PID: 843680 at fs/btrfs/check-integrity.c:2196 btrfsic_process_written_superblock+0x22a/0x2a0 [btrfs] CPU: 28 PID: 843680 Comm: umount Not tainted 5.15.0-0.rc5.39.el8.x86_64 #1 Hardware name: Dell Inc. Precision T7610/0NK70N, BIOS A18 09/11/2019 RIP: 0010:btrfsic_process_written_superblock+0x22a/0x2a0 [btrfs] RSP: 0018:ffffb642afb47940 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 RDX: 00000000ffffffff RSI: ffff8b722fc97d00 RDI: ffff8b722fc97d00 RBP: ffff8b5601c00000 R08: 0000000000000000 R09: c0000000ffff7fff R10: 0000000000000001 R11: ffffb642afb476f8 R12: ffffffffffffffff R13: ffffb642afb47974 R14: ffff8b5499254c00 R15: 0000000000000003 FS: 00007f00a06d4080(0000) GS:ffff8b722fc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff5cff5ff0 CR3: 00000001c0c2a006 CR4: 00000000001706e0 Call Trace: btrfsic_process_written_block+0x2f7/0x850 [btrfs] __btrfsic_submit_bio.part.19+0x310/0x330 [btrfs] ? bio_associate_blkg_from_css+0xa4/0x2c0 btrfsic_submit_bio+0x18/0x30 [btrfs] write_dev_supers+0x81/0x2a0 [btrfs] ? find_get_pages_range_tag+0x219/0x280 ? pagevec_lookup_range_tag+0x24/0x30 ? __filemap_fdatawait_range+0x6d/0xf0 ? __raw_callee_save___native_queued_spin_unlock+0x11/0x1e ? find_first_extent_bit+0x9b/0x160 [btrfs] ? __raw_callee_save___native_queued_spin_unlock+0x11/0x1e write_all_supers+0x1b3/0xa70 [btrfs] ? __raw_callee_save___native_queued_spin_unlock+0x11/0x1e btrfs_commit_transaction+0x59d/0xac0 [btrfs] close_ctree+0x11d/0x339 [btrfs] generic_shutdown_super+0x71/0x110 kill_anon_super+0x14/0x30 btrfs_kill_super+0x12/0x20 [btrfs] deactivate_locked_super+0x31/0x70 cleanup_mnt+0xb8/0x140 task_work_run+0x6d/0xb0 exit_to_user_mode_prepare+0x1f0/0x200 syscall_exit_to_user_mode+0x12/0x30 do_syscall_64+0x46/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f009f711dfb RSP: 002b:00007fff5cff7928 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 000055b68c6c9970 RCX: 00007f009f711dfb RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000055b68c6c9b50 RBP: 0000000000000000 R08: 000055b68c6ca900 R09: 00007f009f795580 R10: 0000000000000000 R11: 0000000000000246 R12: 000055b68c6c9b50 R13: 00007f00a04bf184 R14: 0000000000000000 R15: 00000000ffffffff ---[ end trace 2c4b82abcef9eec4 ]--- S-65536(sdb2/65536/1) --> M-1064960(sdb2/1064960/1)
--- fs/btrfs/disk-io.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
fs/btrfs/disk-io.c +13 -1
@@ -3692,11 +3692,23 @@ static void btrfs_end_empty_barrier(struct bio *bio)*/ static void write_dev_flush (struct btrfs_device *device) { -struct request_queue *q =bdev_get_queue (device->bdev);struct bio *bio = device->flush_bio; +#ifndef CONFIG_BTRFS_FS_CHECK_INTEGRITY +/* +* When a disk has write caching disabled, we skip submission of a bio +* with flush and sync requests before writing the superblock, since +* it's not needed. However when the integrity checker is enabled, this +* results in reports that there are metadata blocks referred by a +* superblock that were not properly flushed. So don't skip the bio +* submission only when the integrity checker is enabled for the sake +* of simplicity, since this is a debug tool and not meant for use in +* non-debug builds. +*/ +struct request_queue *q =bdev_get_queue (device->bdev);if (!test_bit (QUEUE_FLAG_WC , &q->queue_flags))return ; +#endif bio_reset (bio); bio->bi_end_io = btrfs_end_empty_barrier;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 17/130 thermal: core: Reset previous low and high trip during thermal zone init
In reply to Greg Kroah-HartmanFrom: Manaf Meethalavalappu Pallikunhi <[email protected]>
[ Upstream commit 99b63316c39988039965693f5f43d8b4ccb1c86c ]
During the suspend is in process, thermal_zone_device_update bails out thermal zone re-evaluation for any sensor trip violation without setting next valid trip to that sensor. It assumes during resume it will re-evaluate same thermal zone and update trip. But when it is in suspend temperature goes down and on resume path while updating thermal zone if temperature is less than previously violated trip, thermal zone set trip function evaluates the same previous high and previous low trip as new high and low trip. Since there is no change in high/low trip, it bails out from thermal zone set trip API without setting any trip. It leads to a case where sensor high trip or low trip is disabled forever even though thermal zone has a valid high or low trip.
During thermal zone device init, reset thermal zone previous high and low trip. It resolves above mentioned scenario.
--- drivers/thermal/thermal_core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/thermal/thermal_core.c +2 -0
@@ -474,6 +474,8 @@ static void thermal_zone_device_init(struct thermal_zone_device *tz) {struct thermal_instance *pos; tz->temperature =THERMAL_TEMP_INVALID ; + tz->prev_low_trip = -INT_MAX ; + tz->prev_high_trip =INT_MAX ;list_for_each_entry (pos, &tz->thermal_instances, tz_node) pos->initialized = false; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 18/130 scsi: iscsi: Unblock session then wake up error handler
In reply to Greg Kroah-HartmanFrom: Mike Christie <[email protected]>
[ Upstream commit a0c2f8b6709a9a4af175497ca65f93804f57b248 ]
We can race where iscsi_session_recovery_timedout() has woken up the error handler thread and it's now setting the devices to offline, and session_recovery_timedout()'s call to scsi_target_unblock() is also trying to set the device's state to transport-offline. We can then get a mix of states.
For the case where we can't relogin we want the devices to be in transport-offline so when we have repaired the connection __iscsi_unblock_session() can set the state back to running.
Set the device state then call into libiscsi to wake up the error handler.
--- drivers/scsi/scsi_transport_iscsi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/scsi_transport_iscsi.c +3 -3
@@ -1909,12 +1909,12 @@ static void session_recovery_timedout(struct work_struct *work) }spin_unlock_irqrestore (&session->lock, flags); -if (session->transport->session_recovery_timedout) - session->transport->session_recovery_timedout (session); -ISCSI_DBG_TRANS_SESSION (session,"Unblocking SCSI target\n" );scsi_target_unblock (&session->dev,SDEV_TRANSPORT_OFFLINE );ISCSI_DBG_TRANS_SESSION (session,"Completed unblocking SCSI target\n" ); + +if (session->transport->session_recovery_timedout) + session->transport->session_recovery_timedout (session); }static void __iscsi_unblock_session (struct work_struct *work)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 19/130 drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again
In reply to Greg Kroah-HartmanFrom: shaoyunl <[email protected]>
[ Upstream commit 2cf49e00d40d5132e3d067b5aa6d84791929ab15 ]
In SRIOV configuration, the reset may failed to bring asic back to normal but stop cpsch already been called, the start_cpsch will not be called since there is no resume in this case. When reset been triggered again, driver should avoid to do uninitialization again.
--- drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +5 -0
@@ -1207,6 +1207,11 @@ static int stop_cpsch(struct device_queue_manager *dqm)bool hanging;dqm_lock (dqm); +if (!dqm->sched_running) { +dqm_unlock (dqm); +return 0 ; + } +if (!dqm->is_hws_hang)unmap_queues_cpsch (dqm,KFD_UNMAP_QUEUES_FILTER_ALL_QUEUES ,0 ); hanging = dqm->is_hws_hang || dqm->is_resetting;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 20/130 drm/amd/amdgpu: fix potential memleak
In reply to Greg Kroah-HartmanFrom: Bernard Zhao <[email protected]>
[ Upstream commit 27dfaedc0d321b4ea4e10c53e4679d6911ab17aa ]
In function amdgpu_get_xgmi_hive, when kobject_init_and_add failed There is a potential memleak if not call kobject_put.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c +1 -0
@@ -358,6 +358,7 @@ struct amdgpu_hive_info *amdgpu_get_xgmi_hive(struct amdgpu_device *adev) "%s", "xgmi_hive_info");if (ret) {dev_err (adev->dev,"XGMI: failed initializing kobject for xgmi hive\n" ); +kobject_put (&hive->kobj);kfree (hive); hive =NULL ; goto pro_end;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 21/130 ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
[ Upstream commit 1527f69204fe35f341cb599f1cb01bd02daf4374 ]
AMD requires that the SATA controller be configured for devsleep in order for S0i3 entry to work properly.
commit b1a9585cc396 ("ata: ahci: Enable DEVSLP by default on x86 with SLP_S0") sets up a kernel policy to enable devsleep on Intel mobile platforms that are using s0ix. Add the PCI ID for the SATA controller in Green Sardine platforms to extend this policy by default for AMD based systems using s0i3 as well.
--- drivers/ata/ahci.c | 1 + 1 file changed, 1 insertion(+)
drivers/ata/ahci.c +1 -0
@@ -442,6 +442,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {/* AMD */ { PCI_VDEVICE(AMD, 0x7800), board_ahci }, /* AMD Hudson-2 */ { PCI_VDEVICE(AMD, 0x7900), board_ahci }, /* AMD CZ */ + { PCI_VDEVICE(AMD, 0x7901), board_ahci_mobile }, /* AMD Green Sardine *//* AMD is using RAID class only for ahci controllers */ { PCI_VENDOR_ID_AMD, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_STORAGE_RAID << 8, 0xffffff, board_ahci },
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 22/130 ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()
In reply to Greg Kroah-HartmanFrom: Teng Qi <[email protected]>
[ Upstream commit a66998e0fbf213d47d02813b9679426129d0d114 ]
The if statement:
if (port >= DSAF_GE_NUM)
return;
limits the value of port less than DSAF_GE_NUM (i.e., 8). However, if the value of port is 6 or 7, an array overflow could occur:
port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off;
because the length of dsaf_dev->mac_cb is DSAF_MAX_PORT_NUM (i.e., 6).
To fix this possible array overflow, we first check port and if it is greater than or equal to DSAF_MAX_PORT_NUM, the function returns.
--- drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c +4 -0
@@ -400,6 +400,10 @@ static void hns_dsaf_ge_srst_by_port(struct dsaf_device *dsaf_dev, u32 port,return ;if (!HNS_DSAF_IS_DEBUG (dsaf_dev)) { +/* DSAF_MAX_PORT_NUM is 6, but DSAF_GE_NUM is 8. +We need check to prevent array overflow */ +if (port >=DSAF_MAX_PORT_NUM ) +return ; reg_val_1 =0x1 << port; port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off;/* there is difference between V1 and V2 in register.*/
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 23/130 ipv6: check return value of ipv6_skip_exthdr
In reply to Greg Kroah-HartmanFrom: Jordy Zomer <[email protected]>
[ Upstream commit 5f9c55c8066bcd93ac25234a02585701fe2e31df ]
The offset value is used in pointer math on skb->data. Since ipv6_skip_exthdr may return -1 the pointer to uh and th may not point to the actual udp and tcp headers and potentially overwrite other stuff. This is why I think this should be checked.
EDIT: added {}'s, thanks Kees
--- net/ipv6/esp6.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/ipv6/esp6.c +6 -0
@@ -808,6 +808,12 @@ int esp6_input_done2(struct sk_buff *skb, int err)struct tcphdr *th; offset =ipv6_skip_exthdr (skb, offset, &nexthdr, &frag_off); + +if (offset <0 ) { + err = -EINVAL ; + goto out; + } + uh = (void *)(skb->data + offset); th = (void *)(skb->data + offset); hdr_len += offset;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 24/130 net: tulip: de4x5: fix the problem that the array lp->phy[8] may be out of bound
In reply to Greg Kroah-HartmanFrom: zhangyue <[email protected]>
[ Upstream commit 61217be886b5f7402843677e4be7e7e83de9cb41 ]
In line 5001, if all id in the array 'lp->phy[8]' is not 0, when the 'for' end, the 'k' is 8.
At this time, the array 'lp->phy[8]' may be out of bound.
--- drivers/net/ethernet/dec/tulip/de4x5.c | 30 +++++++++++++++----------- 1 file changed, 17 insertions(+), 13 deletions(-)
drivers/net/ethernet/dec/tulip/de4x5.c +17 -13
@@ -4997,19 +4997,23 @@ mii_get_phy(struct net_device *dev) }if ((j == limit) && (i <DE4X5_MAX_MII )) {for (k=0 ; k <DE4X5_MAX_PHY && lp->phy[k].id; k++); - lp->phy[k].addr = i; - lp->phy[k].id = id; - lp->phy[k].spd.reg =GENERIC_REG ;/* ANLPA register */ - lp->phy[k].spd.mask =GENERIC_MASK ;/* 100Mb/s technologies */ - lp->phy[k].spd.value =GENERIC_VALUE ;/* TX & T4, H/F Duplex */ - lp->mii_cnt++; - lp->active++; -printk ("%s: Using generic MII device control. If the board doesn't operate,\nplease mail the following dump to the author:\n" , dev->name); - j = de4x5_debug; - de4x5_debug |=DEBUG_MII ; -de4x5_dbg_mii (dev, k); - de4x5_debug = j; -printk ("\n" ); +if (k <DE4X5_MAX_PHY ) { + lp->phy[k].addr = i; + lp->phy[k].id = id; + lp->phy[k].spd.reg =GENERIC_REG ;/* ANLPA register */ + lp->phy[k].spd.mask =GENERIC_MASK ;/* 100Mb/s technologies */ + lp->phy[k].spd.value =GENERIC_VALUE ;/* TX & T4, H/F Duplex */ + lp->mii_cnt++; + lp->active++; +printk ("%s: Using generic MII device control. If the board doesn't operate,\nplease mail the following dump to the author:\n" , dev->name); + j = de4x5_debug; + de4x5_debug |=DEBUG_MII ; +de4x5_dbg_mii (dev, k); + de4x5_debug = j; +printk ("\n" ); + }else { + goto purgatory; + } } } purgatory:
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 25/130 net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock()
In reply to Greg Kroah-HartmanFrom: Teng Qi <[email protected]>
[ Upstream commit 0fa68da72c3be09e06dd833258ee89c33374195f ]
The definition of macro MOTO_SROM_BUG is:
#define MOTO_SROM_BUG (lp->active == 8 && (get_unaligned_le32(
dev->dev_addr) & 0x00ffffff) == 0x3e0008)
and the if statement
if (MOTO_SROM_BUG) lp->active = 0;
using this macro indicates lp->active could be 8. If lp->active is 8 and the second comparison of this macro is false. lp->active will remain 8 in:
lp->phy[lp->active].gep = (*p ? p : NULL); p += (2 * (*p) + 1); lp->phy[lp->active].rst = (*p ? p : NULL); p += (2 * (*p) + 1); lp->phy[lp->active].mc = get_unaligned_le16(p); p += 2; lp->phy[lp->active].ana = get_unaligned_le16(p); p += 2; lp->phy[lp->active].fdx = get_unaligned_le16(p); p += 2; lp->phy[lp->active].ttm = get_unaligned_le16(p); p += 2; lp->phy[lp->active].mci = *p;
However, the length of array lp->phy is 8, so array overflows can occur. To fix these possible array overflows, we first check lp->active and then return -EINVAL if it is greater or equal to ARRAY_SIZE(lp->phy) (i.e. 8).
--- drivers/net/ethernet/dec/tulip/de4x5.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/dec/tulip/de4x5.c +4 -0
@@ -4706,6 +4706,10 @@ type3_infoblock(struct net_device *dev, u_char count, u_char *p) lp->ibn =3 ; lp->active = *p++;if (MOTO_SROM_BUG ) lp->active =0 ; +/* if (MOTO_SROM_BUG) statement indicates lp->active could +* be 8 (i.e. the size of array lp->phy) */ +if (WARN_ON (lp->active >=ARRAY_SIZE (lp->phy))) +return -EINVAL ; lp->phy[lp->active].gep = (*p ? p :NULL ); p += (2 * (*p) +1 ); lp->phy[lp->active].rst = (*p ? p :NULL ); p += (2 * (*p) +1 ); lp->phy[lp->active].mc =get_unaligned_le16 (p); p +=2 ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 26/130 perf inject: Fix ARM SPE handling
In reply to Greg Kroah-HartmanFrom: German Gomez <[email protected]>
[ Upstream commit 9e1a8d9f683260d50e0a14176d3f7c46a93b2700 ]
'perf inject' is currently not working for Arm SPE. When you try to run 'perf inject' and 'perf report' with a perf.data file that contains SPE traces, the tool reports a "Bad address" error:
# ./perf record -e arm_spe_0/ts_enable=1,store_filter=1,branch_filter=1,load_filter=1/ -a -- sleep 1 # ./perf inject -i perf.data -o perf.inject.data --itrace # ./perf report -i perf.inject.data --stdio
0x42c00 [0x8]: failed to process type: 9 [Bad address] Error:
failed to process sample
As far as I know, the issue was first spotted in [1], but 'perf inject' was not yet injecting the samples. This patch does something similar to what cs_etm does for injecting the samples [2], but for SPE.
[1] https://patchwork.kernel.org/project/linux-arm-kernel/cover/[email protected]/#24117339
[2] https://git.kernel.org/pub/scm/linux/kernel/git/acme/linux.git/tree/tools/perf/util/cs-etm.c?h=perf/core&id=133fe2e617e48ca0948983329f43877064ffda3e#n1196
--- tools/perf/util/arm-spe.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
tools/perf/util/arm-spe.c +15 -0
@@ -48,6 +48,7 @@ struct arm_spe {u8 timeless_decoding;u8 data_queued; +u64 sample_type;u8 sample_flc;u8 sample_llc;u8 sample_tlb;
@@ -244,6 +245,12 @@ static void arm_spe_prep_sample(struct arm_spe *spe, event->sample.header.size =sizeof (struct perf_event_header ); } +static int arm_spe__inject_event (union perf_event *event,struct perf_sample *sample,u64 type) +{ + event->header.size =perf_event__sample_event_size (sample, type,0 ); +return perf_event__synthesize_sample (event, type,0 , sample); +} + static inline int arm_spe_deliver_synth_event(struct arm_spe *spe, struct arm_spe_queue *speq __maybe_unused,
@@ -252,6 +259,12 @@ arm_spe_deliver_synth_event(struct arm_spe *spe, {int ret; +if (spe->synth_opts.inject) { + ret =arm_spe__inject_event (event, sample, spe->sample_type); +if (ret) +return ret; + } + ret =perf_session__deliver_synth_event (spe->session, event, sample);if (ret)pr_err ("ARM SPE: failed to deliver event, error %d\n" , ret);
@@ -809,6 +822,8 @@ arm_spe_synth_events(struct arm_spe *spe, struct perf_session *session)else attr.sample_type |=PERF_SAMPLE_TIME ; + spe->sample_type = attr.sample_type; + attr.exclude_user = evsel->core.attr.exclude_user; attr.exclude_kernel = evsel->core.attr.exclude_kernel; attr.exclude_hv = evsel->core.attr.exclude_hv;
Signature · 9 lines
2.33.0 _______________________________________________ linux-arm-kernel mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Greg Kroah-Hartman
maintainerPATCH 27/130 perf hist: Fix memory leak of a perf_hpp_fmt
In reply to Greg Kroah-HartmanFrom: Ian Rogers <[email protected]>
[ Upstream commit 0ca1f534a776cc7d42f2c33da4732b74ec2790cd ]
perf_hpp__column_unregister() removes an entry from a list but doesn't free the memory causing a memory leak spotted by leak sanitizer.
Add the free while at the same time reducing the scope of the function to static.
--- tools/perf/ui/hist.c | 28 ++++++++++++++-------------- tools/perf/util/hist.h | 1 - 2 files changed, 14 insertions(+), 15 deletions(-)
tools/perf/ui/hist.c +14 -14
@@ -535,6 +535,18 @@ struct perf_hpp_list perf_hpp_list = {#undef __HPP_SORT_ACC_FN#undef __HPP_SORT_RAW_FN +static void fmt_free (struct perf_hpp_fmt *fmt) +{ +/* +* At this point fmt should be completely +* unhooked, if not it's a bug. +*/ +BUG_ON (!list_empty (&fmt->list)); +BUG_ON (!list_empty (&fmt->sort_list)); + +if (fmt->free) + fmt->free (fmt); +}void perf_hpp__init (void ) {
@@ -598,9 +610,10 @@ void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list,list_add (&format->sort_list, &list->sorts); } -void perf_hpp__column_unregister (struct perf_hpp_fmt *format) +static void perf_hpp__column_unregister (struct perf_hpp_fmt *format) {list_del_init (&format->list); +fmt_free (format); }void perf_hpp__cancel_cumulate (void )
@@ -672,19 +685,6 @@ void perf_hpp__append_sort_keys(struct perf_hpp_list *list) } -static void fmt_free (struct perf_hpp_fmt *fmt) -{ -/* -* At this point fmt should be completely -* unhooked, if not it's a bug. -*/ -BUG_ON (!list_empty (&fmt->list)); -BUG_ON (!list_empty (&fmt->sort_list)); - -if (fmt->free) - fmt->free (fmt); -} -void perf_hpp__reset_output_field (struct perf_hpp_list *list) {struct perf_hpp_fmt *fmt, *tmp;
tools/perf/util/hist.h +0 -1
@@ -362,7 +362,6 @@ enum { };void perf_hpp__init (void ); -void perf_hpp__column_unregister (struct perf_hpp_fmt *format);void perf_hpp__cancel_cumulate (void );void perf_hpp__setup_output_field (struct perf_hpp_list *list);void perf_hpp__reset_output_field (struct perf_hpp_list *list);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 28/130 perf report: Fix memory leaks around perf_tip()
In reply to Greg Kroah-HartmanFrom: Ian Rogers <[email protected]>
[ Upstream commit d9fc706108c15f8bc2d4ccccf8e50f74830fabd9 ]
perf_tip() may allocate memory or use a literal, this means memory wasn't freed if allocated. Change the API so that literals aren't used.
At the same time add missing frees for system_path. These issues were spotted using leak sanitizer.
--- tools/perf/builtin-report.c | 15 +++++++++------ tools/perf/util/util.c | 14 +++++++------- tools/perf/util/util.h | 2 +- 3 files changed, 17 insertions(+), 14 deletions(-)
tools/perf/builtin-report.c +9 -6
@@ -610,14 +610,17 @@ static int report__browse_hists(struct report *rep)int ret;struct perf_session *session = rep->session;struct evlist *evlist = session->evlist; -const char *help =perf_tip (system_path (TIPDIR )); +char *help =NULL , *path =NULL ; -if (help ==NULL ) { + path =system_path (TIPDIR ); +if (perf_tip (&help, path) || help ==NULL ) {/* fallback for people who don't install perf ;-) */ - help =perf_tip (DOCDIR ); -if (help ==NULL ) - help ="Cannot load tips.txt file, please install perf!" ; +free (path); + path =system_path (DOCDIR ); +if (perf_tip (&help, path) || help ==NULL ) + help =strdup ("Cannot load tips.txt file, please install perf!" ); } +free (path);switch (use_browser) {case 1 :
@@ -644,7 +647,7 @@ static int report__browse_hists(struct report *rep) ret =perf_evlist__tty_browse_hists (evlist, rep, help);break ; } - +free (help);return ret; }
tools/perf/util/util.c +7 -7
@@ -379,32 +379,32 @@ fetch_kernel_version(unsigned int *puint, char *str,return 0 ; } -const char *perf_tip (const char *dirpath) +int perf_tip (char **strp,const char *dirpath) {struct strlist *tips;struct str_node *node; -char *tip =NULL ;struct strlist_config conf = { .dirname = dirpath, .file_only = true, }; +int ret =0 ; + *strp =NULL ; tips =strlist__new ("tips.txt" , &conf);if (tips ==NULL ) -return errno ==ENOENT ?NULL : -"Tip: check path of tips.txt or get more memory! ;-p" ; +return -errno;if (strlist__nr_entries (tips) ==0 ) goto out; node =strlist__entry (tips,random () %strlist__nr_entries (tips)); -if (asprintf (&tip,"Tip: %s" , node->s) <0 ) - tip = (char *)"Tip: get more memory! ;-)" ; +if (asprintf (strp,"Tip: %s" , node->s) <0 ) + ret = -ENOMEM ; out:strlist__delete (tips); -return tip; +return ret; }char *perf_exe (char *buf,int len)
tools/perf/util/util.h +1 -1
@@ -39,7 +39,7 @@ int fetch_kernel_version(unsigned int *puint,#define KVER_FMT "%d.%d.%d"#define KVER_PARAM (x) KVER_VERSION(x), KVER_PATCHLEVEL(x), KVER_SUBLEVEL(x) -const char *perf_tip (const char *dirpath); +int perf_tip (char **strp,const char *dirpath);#ifndef HAVE_SCHED_GETCPU_SUPPORT int sched_getcpu (void );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 29/130 net/smc: Avoid warning of possible recursive locking
In reply to Greg Kroah-HartmanFrom: Wen Gu <[email protected]>
[ Upstream commit 7a61432dc81375be06b02f0061247d3efbdfce3a ]
Possible recursive locking is detected by lockdep when SMC falls back to TCP. The corresponding warnings are as follows:
============================================
WARNING: possible recursive locking detected
5.16.0-rc1+ #18 Tainted: G E
--------------------------------------------
wrk/1391 is trying to acquire lock:
ffff975246c8e7d8 (&ei->socket.wq.wait){..-.}-{3:3}, at: smc_switch_to_fallback+0x109/0x250 [smc]
but task is already holding lock:
ffff975246c8f918 (&ei->socket.wq.wait){..-.}-{3:3}, at: smc_switch_to_fallback+0xfe/0x250 [smc]
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&ei->socket.wq.wait);
lock(&ei->socket.wq.wait);
*** DEADLOCK ***
May be due to missing lock nesting notation
2 locks held by wrk/1391:
#0: ffff975246040130 (sk_lock-AF_SMC){+.+.}-{0:0}, at: smc_connect+0x43/0x150 [smc] #1: ffff975246c8f918 (&ei->socket.wq.wait){..-.}-{3:3}, at: smc_switch_to_fallback+0xfe/0x250 [smc]
stack backtrace: Call Trace: <TASK> dump_stack_lvl+0x56/0x7b __lock_acquire+0x951/0x11f0 lock_acquire+0x27a/0x320 ? smc_switch_to_fallback+0x109/0x250 [smc] ? smc_switch_to_fallback+0xfe/0x250 [smc] _raw_spin_lock_irq+0x3b/0x80 ? smc_switch_to_fallback+0x109/0x250 [smc] smc_switch_to_fallback+0x109/0x250 [smc] smc_connect_fallback+0xe/0x30 [smc] __smc_connect+0xcf/0x1090 [smc] ? mark_held_locks+0x61/0x80 ? __local_bh_enable_ip+0x77/0xe0 ? lockdep_hardirqs_on+0xbf/0x130 ? smc_connect+0x12a/0x150 [smc] smc_connect+0x12a/0x150 [smc] __sys_connect+0x8a/0xc0 ? syscall_enter_from_user_mode+0x20/0x70 __x64_sys_connect+0x16/0x20 do_syscall_64+0x34/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
The nested locking in smc_switch_to_fallback() is considered to possibly cause a deadlock because smc_wait->lock and clc_wait->lock are the same type of lock. But actually it is safe so far since there is no other place trying to obtain smc_wait->lock when clc_wait->lock is held. So the patch replaces spin_lock() with spin_lock_nested() to avoid false report by lockdep.
--- net/smc/af_smc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/smc/af_smc.c +1 -1
@@ -529,7 +529,7 @@ static void smc_switch_to_fallback(struct smc_sock *smc)* to clcsocket->wq during the fallback. */ spin_lock_irqsave (&smc_wait->lock, flags); -spin_lock (&clc_wait->lock); +spin_lock_nested (&clc_wait->lock,SINGLE_DEPTH_NESTING );list_splice_init (&smc_wait->head, &clc_wait->head);spin_unlock (&clc_wait->lock);spin_unlock_irqrestore (&smc_wait->lock, flags);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 30/130 ACPI: Add stubs for wakeup handler functions
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
[ Upstream commit e9380df851878cee71df5a1c7611584421527f7e ]
The commit ddfd9dcf270c ("ACPI: PM: Add acpi_[un]register_wakeup_handler()") added new functions for drivers to use during the s2idle wakeup path, but didn't add stubs for when CONFIG_ACPI wasn't set.
Add those stubs in for other drivers to be able to use.
--- include/linux/acpi.h | 9 +++++++++ 1 file changed, 9 insertions(+)
include/linux/acpi.h +9 -0
@@ -953,6 +953,15 @@ static inline struct acpi_device *acpi_resource_consumer(struct resource *res) return NULL; } +static inline int acpi_register_wakeup_handler (int wake_irq, +bool (*wakeup)(void *context),void *context) +{ +return -ENXIO ; +} + +static inline void acpi_unregister_wakeup_handler ( +bool (*wakeup)(void *context),void *context) { } +#endif /* !CONFIG_ACPI */ #ifdef CONFIG_ACPI_HOTPLUG_IOAPIC
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 31/130 vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
In reply to Greg Kroah-HartmanFrom: Stephen Suryaputra <[email protected]>
commit ee201011c1e1563c114a55c86eb164b236f18e84 upstream.
IPCB/IP6CB need to be initialized when processing outbound v4 or v6 pkts in the codepath of vrf device xmit function so that leftover garbage doesn't cause futher code that uses the CB to incorrectly process the pkt.
One occasion of the issue might occur when MPLS route uses the vrf device as the outgoing device such as when the route is added using "ip -f mpls route add <label> dev <vrf>" command.
The problems seems to exist since day one. Hence I put the day one commits on the Fixes tags.
--- drivers/net/vrf.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/vrf.c +2 -0
@@ -497,6 +497,7 @@ static netdev_tx_t vrf_process_v6_outbou/* strip the ethernet header added for pass through VRF device */ __skb_pull (skb,skb_network_offset (skb)); +memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); ret =vrf_ip6_local_out (net, skb->sk, skb);if (unlikely (net_xmit_eval (ret))) dev->stats.tx_errors++;
@@ -580,6 +581,7 @@ static netdev_tx_t vrf_process_v4_outbou RT_SCOPE_LINK); } +memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); ret =vrf_ip_local_out (dev_net (skb_dst (skb)->dev), skb->sk, skb);if (unlikely (net_xmit_eval (ret))) vrf_dev->stats.tx_errors++;
Greg Kroah-Hartman
maintainerPATCH 32/130 kprobes: Limit max data_size of the kretprobe instances
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
commit 6bbfa44116689469267f1a6e3d233b52114139d2 upstream.
The 'kprobe::data_size' is unsigned, thus it can not be negative. But if user sets it enough big number (e.g. (size_t)-8), the result of 'data_size
+ sizeof(struct kretprobe_instance)' becomes smaller than sizeof(struct kretprobe_instance) or zero. In result, the kretprobe_instance are allocated without enough memory, and kretprobe accesses outside of allocated memory.
To avoid this issue, introduce a max limitation of the kretprobe::data_size. 4KB per instance should be OK.
--- include/linux/kprobes.h | 2 ++ kernel/kprobes.c | 3 +++ 2 files changed, 5 insertions(+)
include/linux/kprobes.h +2 -0
@@ -155,6 +155,8 @@ struct kretprobe {raw_spinlock_t lock; }; +#define KRETPROBE_MAX_DATA_SIZE 4096 + struct kretprobe_instance { union { struct hlist_node hlist;
kernel/kprobes.c +3 -0
@@ -2137,6 +2137,9 @@ int register_kretprobe(struct kretprobe } } +if (rp->data_size >KRETPROBE_MAX_DATA_SIZE ) +return -E2BIG ; + rp->kp.pre_handler = pre_handler_kretprobe; rp->kp.post_handler =NULL ; rp->kp.fault_handler =NULL ;
Greg Kroah-Hartman
maintainerPATCH 33/130 rt2x00: do not mark device gone on EPROTO errors during start
In reply to Greg Kroah-HartmanFrom: Stanislaw Gruszka <[email protected]>
commit ed53ae75693096f1c10b4561edd31a07b631bd72 upstream.
As reported by Exuvo is possible that we have lot's of EPROTO errors during device start i.e. firmware load. But after that device works correctly. Hence marking device gone by few EPROTO errors done by commit e383c70474db ("rt2x00: check number of EPROTO errors") caused regression - Exuvo device stop working after kernel update. To fix disable the check during device start.
--- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c +3 -0
@@ -25,6 +25,9 @@ static bool rt2x00usb_check_usb_error(stif (status == -ENODEV || status == -ENOENT )return true; +if (!test_bit (DEVICE_STATE_STARTED , &rt2x00dev->flags)) +return false; +if (status == -EPROTO || status == -ETIMEDOUT ) rt2x00dev->num_proto_errs++;else
Greg Kroah-Hartman
maintainerPATCH 34/130 ipmi: Move remove_work to dedicated workqueue
In reply to Greg Kroah-HartmanFrom: Ioanna Alifieraki <[email protected]>
commit 1d49eb91e86e8c1c1614c72e3e958b6b7e2472a9 upstream.
Currently when removing an ipmi_user the removal is deferred as a work on the system's workqueue. Although this guarantees the free operation will occur in non atomic context, it can race with the ipmi_msghandler module removal (see [1]) . In case a remove_user work is scheduled for removal and shortly after ipmi_msghandler module is removed we can end up in a situation where the module is removed fist and when the work is executed the system crashes with :
BUG: unable to handle page fault for address: ffffffffc05c3450
PF: supervisor instruction fetch in kernel mode
PF: error_code(0x0010) - not-present page
because the pages of the module are gone. In cleanup_ipmi() there is no easy way to detect if there are any pending works to flush them before removing the module. This patch creates a separate workqueue and schedules the remove_work works on it. When removing the module the workqueue is drained when destroyed to avoid the race.
[1] https://bugs.launchpad.net/bugs/1950666
Message-Id: <[email protected]>
--- drivers/char/ipmi/ipmi_msghandler.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/char/ipmi/ipmi_msghandler.c +12 -1
@@ -203,6 +203,8 @@ struct ipmi_user {struct work_struct remove_work; }; +struct workqueue_struct *remove_work_wq; +static struct ipmi_user *acquire_ipmi_user (struct ipmi_user *user,int *index) __acquires(user->release_barrier) {
@@ -1272,7 +1274,7 @@ static void free_user(struct kref *ref) struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);/* SRCU cleanup must happen in task context. */ -schedule_work (&user->remove_work); +queue_work (remove_work_wq, &user->remove_work); }static void _ipmi_destroy_user (struct ipmi_user *user)
@@ -5166,6 +5168,13 @@ static int ipmi_init_msghandler(void)atomic_notifier_chain_register (&panic_notifier_list, &panic_block); + remove_work_wq =create_singlethread_workqueue ("ipmi-msghandler-remove-wq" ); +if (!remove_work_wq) { +pr_err ("unable to create ipmi-msghandler-remove-wq workqueue" ); + rv = -ENOMEM ; + goto out; + } + initialized = true; out:
@@ -5191,6 +5200,8 @@ static void __exit cleanup_ipmi(void)int count;if (initialized) { +destroy_workqueue (remove_work_wq); +atomic_notifier_chain_unregister (&panic_notifier_list, &panic_block);
Greg Kroah-Hartman
maintainerPATCH 35/130 cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink()
In reply to Greg Kroah-HartmanFrom: Xiongfeng Wang <[email protected]>
commit 2c1b5a84669d2477d8fffe9136e86a2cff591729 upstream.
When I hot added a CPU, I found 'cpufreq' directory was not created below /sys/devices/system/cpu/cpuX/.
It is because get_cpu_device() failed in add_cpu_dev_symlink().
cpufreq_add_dev() is the .add_dev callback of a CPU subsys interface. It will be called when the CPU device registered into the system. The call chain is as follows:
register_cpu()
->device_register()
->device_add()
->bus_probe_device()
->cpufreq_add_dev()But only after the CPU device has been registered, we can get the CPU device by get_cpu_device(), otherwise it will return NULL.
Since we already have the CPU device in cpufreq_add_dev(), pass it to add_cpu_dev_symlink().
I noticed that the 'kobj' of the CPU device has been added into the system before cpufreq_add_dev().
--- drivers/cpufreq/cpufreq.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/cpufreq/cpufreq.c +4 -5
@@ -1004,10 +1004,9 @@ static struct kobj_type ktype_cpufreq = .release = cpufreq_sysfs_release, }; -static void add_cpu_dev_symlink (struct cpufreq_policy *policy,unsigned int cpu) +static void add_cpu_dev_symlink (struct cpufreq_policy *policy,unsigned int cpu, +struct device *dev) { -struct device *dev =get_cpu_device (cpu); -if (unlikely (!dev))return ;
@@ -1391,7 +1390,7 @@ static int cpufreq_online(unsigned int cif (new_policy) {for_each_cpu (j, policy->related_cpus) {per_cpu (cpufreq_cpu_data, j) = policy; -add_cpu_dev_symlink (policy, j); +add_cpu_dev_symlink (policy, j,get_cpu_device (j)); } policy->min_freq_req = kzalloc(2 * sizeof(*policy->min_freq_req),
@@ -1553,7 +1552,7 @@ static int cpufreq_add_dev(struct device/* Create sysfs link on CPU registration */ policy =per_cpu (cpufreq_cpu_data, cpu);if (policy) -add_cpu_dev_symlink (policy, cpu); +add_cpu_dev_symlink (policy, cpu, dev);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 36/130 s390/pci: move pseudo-MMIO to prevent MIO overlap
In reply to Greg Kroah-HartmanFrom: Niklas Schnelle <[email protected]>
commit 52d04d408185b7aa47628d2339c28ec70074e0ae upstream.
When running without MIO support, with pci=nomio or for devices which are not MIO-capable the zPCI subsystem generates pseudo-MMIO addresses to allow access to PCI BARs via MMIO based Linux APIs even though the platform uses function handles and BAR numbers.
This is done by stashing an index into our global IOMAP array which contains the function handle in the 16 most significant bits of the addresses returned by ioremap() always setting the most significant bit.
On the other hand the MIO addresses assigned by the platform for use, while requiring special instructions, allow PCI access with virtually mapped physical addresses. Now the problem is that these MIO addresses and our own pseudo-MMIO addresses may overlap, while functionally this would not be a problem by itself this overlap is detected by common code as both address types are added as resources in the iomem_resource tree. This leads to the overlapping resource claim of either the MIO capable or non-MIO capable devices with being rejected.
Since PCI is tightly coupled to the use of the iomem_resource tree, see for example the code for request_mem_region(), we can't reasonably get rid of the overlap being detected by keeping our pseudo-MMIO addresses out of the iomem_resource tree.
Instead let's move the range used by our own pseudo-MMIO addresses by starting at (1UL << 62) and only using addresses below (1UL << 63) thus avoiding the range currently used for MIO addresses.
--- arch/s390/include/asm/pci_io.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/s390/include/asm/pci_io.h +4 -3
@@ -14,12 +14,13 @@/* I/O Map */ #define ZPCI_IOMAP_SHIFT 48 -#define ZPCI_IOMAP_ADDR_BASE 0x8000000000000000UL +#define ZPCI_IOMAP_ADDR_SHIFT 62 +#define ZPCI_IOMAP_ADDR_BASE (1UL << ZPCI_IOMAP_ADDR_SHIFT)#define ZPCI_IOMAP_ADDR_OFF_MASK ((1UL << ZPCI_IOMAP_SHIFT) - 1)#define ZPCI_IOMAP_MAX_ENTRIES \ - ((ULONG_MAX - ZPCI_IOMAP_ADDR_BASE + 1) / (1UL << ZPCI_IOMAP_SHIFT)) + (1UL << (ZPCI_IOMAP_ADDR_SHIFT - ZPCI_IOMAP_SHIFT))#define ZPCI_IOMAP_ADDR_IDX_MASK \ - (~ZPCI_IOMAP_ADDR_OFF_MASK - ZPCI_IOMAP_ADDR_BASE) + ((ZPCI_IOMAP_ADDR_BASE - 1) & ~ZPCI_IOMAP_ADDR_OFF_MASK)struct zpci_iomap_entry {u32 fh;
Greg Kroah-Hartman
maintainerPATCH 37/130 fget: check that the fd still exists after getting a ref to it
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 054aa8d439b9185d4f5eb9a90282d1ce74772969 upstream.
Jann Horn points out that there is another possible race wrt Unix domain socket garbage collection, somewhat reminiscent of the one fixed in commit cbcf01128d0a ("af_unix: fix garbage collect vs MSG_PEEK").
See the extended comment about the garbage collection requirements added to unix_peek_fds() by that commit for details.
The race comes from how we can locklessly look up a file descriptor just as it is in the process of being closed, and with the right artificial timing (Jann added a few strategic 'mdelay(500)' calls to do that), the Unix domain socket garbage collector could see the reference count decrement of the close() happen before fget() took its reference to the file and the file was attached onto a new file descriptor.
This is all (intentionally) correct on the 'struct file *' side, with RCU lookups and lockless reference counting very much part of the design. Getting that reference count out of order isn't a problem per se.
But the garbage collector can get confused by seeing this situation of having seen a file not having any remaining external references and then seeing it being attached to an fd.
In commit cbcf01128d0a ("af_unix: fix garbage collect vs MSG_PEEK") the fix was to serialize the file descriptor install with the garbage collector by taking and releasing the unix_gc_lock.
That's not really an option here, but since this all happens when we are in the process of looking up a file descriptor, we can instead simply just re-check that the file hasn't been closed in the meantime, and just re-do the lookup if we raced with a concurrent close() of the same file descriptor.
--- fs/file.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/file.c +4 -0
@@ -834,6 +834,10 @@ loop: file =NULL ; else if (!get_file_rcu_many(file, refs)) goto loop; + else if (__fcheck_files(files, fd) != file) { +fput_many (file, refs); + goto loop; + } }rcu_read_unlock ();
Greg Kroah-Hartman
maintainerPATCH 38/130 sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
commit 6c8ad7e8cf29eb55836e7a0215f967746ab2b504 upstream.
When the rmmod sata_fsl.ko command is executed in the PPC64 GNU/Linux, a bug is reported:
==================================================================
BUG: Unable to handle kernel data access on read at 0x80000800805b502c Oops: Kernel access of bad area, sig: 11 [#1] NIP [c0000000000388a4] .ioread32+0x4/0x20 LR [80000000000c6034] .sata_fsl_port_stop+0x44/0xe0 [sata_fsl] Call Trace: .free_irq+0x1c/0x4e0 (unreliable) .ata_host_stop+0x74/0xd0 [libata] .release_nodes+0x330/0x3f0 .device_release_driver_internal+0x178/0x2c0 .driver_detach+0x64/0xd0 .bus_remove_driver+0x70/0xf0 .driver_unregister+0x38/0x80 .platform_driver_unregister+0x14/0x30 .fsl_sata_driver_exit+0x18/0xa20 [sata_fsl] .__se_sys_delete_module+0x1ec/0x2d0 .system_call_exception+0xfc/0x1f0 system_call_common+0xf8/0x200 ==================================================================
The triggering of the BUG is shown in the following stack:
driver_detach
device_release_driver_internal
__device_release_driver
drv->remove(dev) --> platform_drv_remove/platform_remove
drv->remove(dev) --> sata_fsl_remove
iounmap(host_priv->hcr_base); <---- unmap
kfree(host_priv); <---- free
devres_release_all
release_nodes
dr->node.release(dev, dr->data) --> ata_host_stop
ap->ops->port_stop(ap) --> sata_fsl_port_stop
ioread32(hcr_base + HCONTROL) <---- UAF
host->ops->host_stop(host)The iounmap(host_priv->hcr_base) and kfree(host_priv) functions should not be executed in drv->remove. These functions should be executed in host_stop after port_stop. Therefore, we move these functions to the new function sata_fsl_host_stop and bind the new function to host_stop.
--- drivers/ata/sata_fsl.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/ata/sata_fsl.c +10 -2
@@ -1394,6 +1394,14 @@ static int sata_fsl_init_controller(strureturn 0 ; } +static void sata_fsl_host_stop (struct ata_host *host) +{ +struct sata_fsl_host_priv *host_priv = host->private_data; + +iounmap (host_priv->hcr_base); +kfree (host_priv); +} +/* * scsi mid-layer and libata interface structures */
@@ -1426,6 +1434,8 @@ static struct ata_port_operations sata_f .port_start = sata_fsl_port_start, .port_stop = sata_fsl_port_stop, + .host_stop = sata_fsl_host_stop, + .pmp_attach = sata_fsl_pmp_attach, .pmp_detach = sata_fsl_pmp_detach, };
@@ -1558,8 +1568,6 @@ static int sata_fsl_remove(struct platfoata_host_detach (host);irq_dispose_mapping (host_priv->irq); -iounmap (host_priv->hcr_base); -kfree (host_priv);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 39/130 sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
commit 6f48394cf1f3e8486591ad98c11cdadb8f1ef2ad upstream.
Trying to remove the fsl-sata module in the PPC64 GNU/Linux leads to the following warning:
------------[ cut here ]------------ remove_proc_entry: removing non-empty directory 'irq/69', leaking at least 'fsl-sata[ff0221000.sata]' WARNING: CPU: 3 PID: 1048 at fs/proc/generic.c:722 .remove_proc_entry+0x20c/0x220 IRQMASK: 0 NIP [c00000000033826c] .remove_proc_entry+0x20c/0x220 LR [c000000000338268] .remove_proc_entry+0x208/0x220 Call Trace: .remove_proc_entry+0x208/0x220 (unreliable) .unregister_irq_proc+0x104/0x140 .free_desc+0x44/0xb0 .irq_free_descs+0x9c/0xf0 .irq_dispose_mapping+0x64/0xa0 .sata_fsl_remove+0x58/0xa0 [sata_fsl] .platform_drv_remove+0x40/0x90 .device_release_driver_internal+0x160/0x2c0 .driver_detach+0x64/0xd0 .bus_remove_driver+0x70/0xf0 .driver_unregister+0x38/0x80 .platform_driver_unregister+0x14/0x30 .fsl_sata_driver_exit+0x18/0xa20 [sata_fsl] ---[ end trace 0ea876d4076908f5 ]---
The driver creates the mapping by calling irq_of_parse_and_map(), so it also has to dispose the mapping. But the easy way out is to simply use platform_get_irq() instead of irq_of_parse_map(). Also we should adapt return value checking and propagate error values.
In this case the mapping is not managed by the device but by the of core, so the device has not to dispose the mapping.
--- drivers/ata/sata_fsl.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/ata/sata_fsl.c +3 -5
@@ -1490,9 +1490,9 @@ static int sata_fsl_probe(struct platfor host_priv->ssr_base = ssr_base; host_priv->csr_base = csr_base; - irq =irq_of_parse_and_map (ofdev->dev.of_node,0 ); -if (!irq) { -dev_err (&ofdev->dev,"invalid irq from platform\n" ); + irq =platform_get_irq (ofdev,0 ); +if (irq <0 ) { + retval = irq; goto error_exit_with_cleanup; } host_priv->irq = irq;
@@ -1567,8 +1567,6 @@ static int sata_fsl_remove(struct platfoata_host_detach (host); -irq_dispose_mapping (host_priv->irq); -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 40/130 ipv6: fix memory leak in fib6_rule_suppress
In reply to Greg Kroah-HartmanFrom: msizanoen1 <[email protected]>
commit cdef485217d30382f3bf6448c54b4401648fe3f1 upstream.
The kernel leaks memory when a fib rule is present in IPv6 nftables firewall rules and a suppress_prefix rule is present in the IPv6 routing rules (used by certain tools such as wg-quick). In such scenarios, every incoming packet will leak an allocation in ip6_dst_cache slab cache.
After some hours of bpftrace-ing and source code reading, I tracked down the issue to ca7a03c41753 ("ipv6: do not free rt if FIB_LOOKUP_NOREF is set on suppress rule").
The problem with that change is that the generic args->flags always have FIB_LOOKUP_NOREF set[1][2] but the IPv6-specific flag RT6_LOOKUP_F_DST_NOREF might not be, leading to fib6_rule_suppress not decreasing the refcount when needed.
How to reproduce:
- Add the following nftables rule to a prerouting chain:
meta nfproto ipv6 fib saddr . mark . iif oif missing drop
This can be done with:
sudo nft create table inet test
sudo nft create chain inet test test_chain '{ type filter hook prerouting priority filter + 10; policy accept; }' sudo nft add rule inet test test_chain meta nfproto ipv6 fib saddr . mark . iif oif missing drop
- Run:
sudo ip -6 rule add table main suppress_prefixlength 0
- Watch sudo slabtop -o | grep ip6_dst_cache to see memory usage increase
with every incoming ipv6 packet.
This patch exposes the protocol-specific flags to the protocol specific suppress function, and check the protocol-specific flags argument for RT6_LOOKUP_F_DST_NOREF instead of the generic FIB_LOOKUP_NOREF when decreasing the refcount, like this.
[1]: https://github.com/torvalds/linux/blob/ca7a03c4175366a92cee0ccc4fec0038c3266e26/net/ipv6/fib6_rules.c#L71
[2]: https://github.com/torvalds/linux/blob/ca7a03c4175366a92cee0ccc4fec0038c3266e26/net/ipv6/fib6_rules.c#L99
--- include/net/fib_rules.h | 4 +++- net/core/fib_rules.c | 2 +- net/ipv4/fib_rules.c | 1 + net/ipv6/fib6_rules.c | 4 ++-- 4 files changed, 7 insertions(+), 4 deletions(-)
include/net/fib_rules.h +3 -1
@@ -69,7 +69,7 @@ struct fib_rules_ops {int (*action)(struct fib_rule *,struct flowi *,int ,struct fib_lookup_arg *); -bool (*suppress)(struct fib_rule *, +bool (*suppress)(struct fib_rule *,int ,struct fib_lookup_arg *);int (*match)(struct fib_rule *,struct flowi *,int );
@@ -218,7 +218,9 @@ INDIRECT_CALLABLE_DECLARE(int fib4_rule_ struct fib_lookup_arg *arg)); INDIRECT_CALLABLE_DECLARE(bool fib6_rule_suppress(struct fib_rule *rule, +int flags,struct fib_lookup_arg *arg)); INDIRECT_CALLABLE_DECLARE(bool fib4_rule_suppress(struct fib_rule *rule, +int flags,struct fib_lookup_arg *arg));#endif
net/core/fib_rules.c +1 -1
@@ -323,7 +323,7 @@ jumped:if (!err && ops->suppress &&INDIRECT_CALL_MT (ops->suppress, fib6_rule_suppress, fib4_rule_suppress, - rule, arg)) + rule, flags, arg))continue ;if (err != -EAGAIN ) {
net/ipv4/fib_rules.c +1 -0
@@ -141,6 +141,7 @@ INDIRECT_CALLABLE_SCOPE int fib4_rule_ac } INDIRECT_CALLABLE_SCOPE bool fib4_rule_suppress(struct fib_rule *rule, +int flags,struct fib_lookup_arg *arg) {struct fib_result *result = (struct fib_result *) arg->result;
net/ipv6/fib6_rules.c +2 -2
@@ -267,6 +267,7 @@ INDIRECT_CALLABLE_SCOPE int fib6_rule_ac } INDIRECT_CALLABLE_SCOPE bool fib6_rule_suppress(struct fib_rule *rule, +int flags,struct fib_lookup_arg *arg) {struct fib6_result *res = arg->result;
@@ -294,8 +295,7 @@ INDIRECT_CALLABLE_SCOPE bool fib6_rule_sreturn false; suppress_route: -if (!(arg->flags &FIB_LOOKUP_NOREF )) -ip6_rt_put (rt); +ip6_rt_put_flags (rt, flags);return true; }
Greg Kroah-Hartman
maintainerPATCH 41/130 drm/amd/display: Allow DSC on supported MST branch devices
In reply to Greg Kroah-HartmanFrom: Nicholas Kazlauskas <[email protected]>
commit 94ebc035456a4ccacfbbef60c444079a256623ad upstream.
[Why]
When trying to lightup two 4k60 non-DSC displays behind a branch device that supports DSC we can't lightup both at once due to bandwidth limitations - each requires 48 VCPI slots but we only have 63.
[How]
The workaround already exists in the code but is guarded by a CONFIG that cannot be set by the user and shouldn't need to be.
Check for specific branch device IDs to device whether to enable the workaround for multiple display scenarios.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 20 +++++++++--- 1 file changed, 16 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +16 -4
@@ -36,6 +36,8 @@#include "dm_helpers.h" #include "dc_link_ddc.h" +#include "ddc_service_types.h" +#include "dpcd_defs.h" #include "i2caux_interface.h" #if defined(CONFIG_DEBUG_FS )
@@ -152,6 +154,16 @@ static const struct drm_connector_funcs };#if defined(CONFIG_DRM_AMD_DC_DCN ) +static bool needs_dsc_aux_workaround (struct dc_link *link) +{ +if (link->dpcd_caps.branch_dev_id ==DP_BRANCH_DEVICE_ID_90CC24 && + (link->dpcd_caps.dpcd_rev.raw ==DPCD_REV_14 || link->dpcd_caps.dpcd_rev.raw ==DPCD_REV_12 ) && + link->dpcd_caps.sink_count.bits.SINK_COUNT >=2 ) +return true; + +return false; +} +static bool validate_dsc_caps_on_connector (struct amdgpu_dm_connector *aconnector) {struct dc_sink *dc_sink = aconnector->dc_sink;
@@ -159,7 +171,7 @@ static bool validate_dsc_caps_on_connectu8 dsc_caps[16 ] = {0 }; aconnector->dsc_aux =drm_dp_mst_dsc_aux_for_port (port); -#if defined(CONFIG_HP_HOOK_WORKAROUND ) +/* * drm_dp_mst_dsc_aux_for_port() will return NULL for certain configs * because it only check the dsc/fec caps of the "port variable" and not the dock
@@ -169,10 +181,10 @@ static bool validate_dsc_caps_on_connect* Workaround: explicitly check the use case above and use the mst dock's aux as dsc_aux * */ - -if (!aconnector->dsc_aux && !port->parent->port_parent) +if (!aconnector->dsc_aux && !port->parent->port_parent && +needs_dsc_aux_workaround (aconnector->dc_link)) aconnector->dsc_aux = &aconnector->mst_port->dm_dp_aux.aux; -#endif +if (!aconnector->dsc_aux)return false;
Greg Kroah-Hartman
maintainerPATCH 42/130 KVM: Disallow user memslot with size that exceeds "unsigned long"
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 6b285a5587506bae084cf9a3ed5aa491d623b91b upstream.
Reject userspace memslots whose size exceeds the storage capacity of an "unsigned long". KVM's uAPI takes the size as u64 to support large slots on 64-bit hosts, but does not account for the size being truncated on 32-bit hosts in various flows. The access_ok() check on the userspace virtual address in particular casts the size to "unsigned long" and will check the wrong number of bytes.
KVM doesn't actually support slots whose size doesn't fit in an "unsigned long", e.g. KVM's internal kvm_memory_slot.npages is an "unsigned long", not a "u64", and misc arch specific code follows that behavior.
Message-Id: <[email protected]>
--- virt/kvm/kvm_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
virt/kvm/kvm_main.c +2 -1
@@ -1297,7 +1297,8 @@ int __kvm_set_memory_region(struct kvm * id = (u16 )mem->slot;/* General sanity checks */ -if (mem->memory_size & (PAGE_SIZE -1 )) +if ((mem->memory_size & (PAGE_SIZE -1 )) || + (mem->memory_size != (unsigned long )mem->memory_size))return -EINVAL ;if (mem->guest_phys_addr & (PAGE_SIZE -1 ))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 43/130 KVM: nVMX: Flush current VPID (L1 vs. L2) for KVM_REQ_TLB_FLUSH_GUEST
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 2b4a5a5d56881ece3c66b9a9a8943a6f41bd7349 upstream.
Flush the current VPID when handling KVM_REQ_TLB_FLUSH_GUEST instead of always flushing vpid01. Any TLB flush that is triggered when L2 is active is scoped to L2's VPID (if it has one), e.g. if L2 toggles CR4.PGE and L1 doesn't intercept PGE writes, then KVM's emulation of the TLB flush needs to be applied to L2's VPID.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
arch/x86/kvm/vmx/vmx.c +14 -9
@@ -2908,6 +2908,13 @@ static void vmx_flush_tlb_all(struct kvm } } +static inline int vmx_get_current_vpid (struct kvm_vcpu *vcpu) +{ +if (is_guest_mode (vcpu)) +return nested_get_vpid02 (vcpu); +return to_vmx (vcpu)->vpid; +} +static void vmx_flush_tlb_current (struct kvm_vcpu *vcpu) {struct kvm_mmu *mmu = vcpu->arch.mmu;
@@ -2920,31 +2927,29 @@ static void vmx_flush_tlb_current(structif (enable_ept)ept_sync_context (construct_eptp (vcpu, root_hpa, mmu->shadow_root_level)); -else if (!is_guest_mode (vcpu)) -vpid_sync_context (to_vmx (vcpu)->vpid);else -vpid_sync_context (nested_get_vpid02 (vcpu)); +vpid_sync_context (vmx_get_current_vpid (vcpu)); }static void vmx_flush_tlb_gva (struct kvm_vcpu *vcpu,gva_t addr) {/* -* vpid_sync_vcpu_addr() is a nop if vmx->vpid==0, see the comment in +* vpid_sync_vcpu_addr() is a nop if vpid==0, see the comment in * vmx_flush_tlb_guest() for an explanation of why this is ok. */ -vpid_sync_vcpu_addr (to_vmx (vcpu)->vpid, addr); +vpid_sync_vcpu_addr (vmx_get_current_vpid (vcpu), addr); }static void vmx_flush_tlb_guest (struct kvm_vcpu *vcpu) {/* -* vpid_sync_context() is a nop if vmx->vpid==0, e.g. if enable_vpid==0 -* or a vpid couldn't be allocated for this vCPU. VM-Enter and VM-Exit -* are required to flush GVA->{G,H}PA mappings from the TLB if vpid is +* vpid_sync_context() is a nop if vpid==0, e.g. if enable_vpid==0 or a +* vpid couldn't be allocated for this vCPU. VM-Enter and VM-Exit are +* required to flush GVA->{G,H}PA mappings from the TLB if vpid is * disabled (VM-Enter with vpid enabled and vpid==0 is disallowed), * i.e. no explicit INVVPID is necessary. */ -vpid_sync_context (to_vmx (vcpu)->vpid); +vpid_sync_context (vmx_get_current_vpid (vcpu)); }void vmx_ept_load_pdptrs (struct kvm_vcpu *vcpu)
Greg Kroah-Hartman
maintainerPATCH 44/130 KVM: x86: Use a stable condition around all VT-d PI paths
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit 53b7ca1a359389276c76fbc9e1009d8626a17e40 upstream.
Currently, checks for whether VT-d PI can be used refer to the current status of the feature in the current vCPU; or they more or less pick vCPU 0 in case a specific vCPU is not available.
However, these checks do not attempt to synchronize with changes to the IRTE. In particular, there is no path that updates the IRTE when APICv is re-activated on vCPU 0; and there is no path to wakeup a CPU that has APICv disabled, if the wakeup occurs because of an IRTE that points to a posted interrupt.
To fix this, always go through the VT-d PI path as long as there are assigned devices and APICv is available on both the host and the VM side. Since the relevant condition was copied over three times, take the hint and factor it into a separate function.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/posted_intr.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
arch/x86/kvm/vmx/posted_intr.c +11 -9
@@ -5,6 +5,7 @@#include <asm/cpu.h> #include "lapic.h" +#include "irq.h" #include "posted_intr.h" #include "trace.h" #include "vmx.h"
@@ -77,13 +78,18 @@ after_clear_sn:pi_set_on (pi_desc); } +static bool vmx_can_use_vtd_pi (struct kvm *kvm) +{ +return irqchip_in_kernel (kvm) && enable_apicv && +kvm_arch_has_assigned_device (kvm) && +irq_remapping_cap (IRQ_POSTING_CAP ); +} +void vmx_vcpu_pi_put (struct kvm_vcpu *vcpu) {struct pi_desc *pi_desc =vcpu_to_pi_desc (vcpu); -if (!kvm_arch_has_assigned_device (vcpu->kvm) || - !irq_remapping_cap (IRQ_POSTING_CAP ) || - !kvm_vcpu_apicv_active (vcpu)) +if (!vmx_can_use_vtd_pi (vcpu->kvm))return ;/* Set SN when the vCPU is preempted */
@@ -141,9 +147,7 @@ int pi_pre_block(struct kvm_vcpu *vcpu)struct pi_desc old, new;struct pi_desc *pi_desc =vcpu_to_pi_desc (vcpu); -if (!kvm_arch_has_assigned_device (vcpu->kvm) || - !irq_remapping_cap (IRQ_POSTING_CAP ) || - !kvm_vcpu_apicv_active (vcpu)) +if (!vmx_can_use_vtd_pi (vcpu->kvm))return 0 ;WARN_ON (irqs_disabled ());
@@ -256,9 +260,7 @@ int pi_update_irte(struct kvm *kvm, unsistruct vcpu_data vcpu_info;int idx, ret =0 ; -if (!kvm_arch_has_assigned_device (kvm) || - !irq_remapping_cap (IRQ_POSTING_CAP ) || - !kvm_vcpu_apicv_active (kvm->vcpus[0 ])) +if (!vmx_can_use_vtd_pi (kvm))return 0 ; idx =srcu_read_lock (&kvm->irq_srcu);
Greg Kroah-Hartman
maintainerPATCH 45/130 KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 to 1
In reply to Greg Kroah-HartmanFrom: Catalin Marinas <[email protected]>
commit 1f80d15020d7f130194821feb1432b67648c632d upstream.
Having a signed (1 << 31) constant for TCR_EL2_RES1 and CPTR_EL2_TCPAC causes the upper 32-bit to be set to 1 when assigning them to a 64-bit variable. Bit 32 in TCR_EL2 is no longer RES0 in ARMv8.7: with FEAT_LPA2 it changes the meaning of bits 49:48 and 9:8 in the stage 1 EL2 page table entries. As a result of the sign-extension, a non-VHE kernel can no longer boot on a model with ARMv8.7 enabled.
CPTR_EL2 still has the top 32 bits RES0 but we should preempt any future problems
Make these top bit constants unsigned as per commit df655b75c43f ("arm64: KVM: Avoid setting the upper 32 bits of VTCR_EL2 to 1").
--- arch/arm64/include/asm/kvm_arm.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/include/asm/kvm_arm.h +2 -2
@@ -83,7 +83,7 @@#define HCR_HOST_VHE_FLAGS (HCR_RW | HCR_TGE | HCR_E2H)/* TCR_EL2 Registers bits */ -#define TCR_EL2_RES1 ((1 << 31) | (1 << 23)) +#define TCR_EL2_RES1 ((1U << 31) | (1 << 23))#define TCR_EL2_TBI (1 << 20)#define TCR_EL2_PS_SHIFT 16#define TCR_EL2_PS_MASK (7 << TCR_EL2_PS_SHIFT)
@@ -268,7 +268,7 @@#define CPTR_EL2_TFP_SHIFT 10/* Hyp Coprocessor Trap Register */ -#define CPTR_EL2_TCPAC (1 << 31) +#define CPTR_EL2_TCPAC (1U << 31)#define CPTR_EL2_TAM (1 << 30)#define CPTR_EL2_TTA (1 << 20)#define CPTR_EL2_TFP (1 << CPTR_EL2_TFP_SHIFT)
Greg Kroah-Hartman
maintainerPATCH 46/130 KVM: X86: Use vcpu->arch.walk_mmu for kvm_mmu_invlpg()
In reply to Greg Kroah-HartmanFrom: Lai Jiangshan <[email protected]>
commit 05b29633c7a956d5675f5fbba70db0d26aa5e73e upstream.
INVLPG operates on guest virtual address, which are represented by vcpu->arch.walk_mmu. In nested virtualization scenarios, kvm_mmu_invlpg() was using the wrong MMU structure; if L2's invlpg were emulated by L0 (in practice, it hardly happen) when nested two-dimensional paging is enabled, the call to ->tlb_flush_gva() would be skipped and the hardware TLB entry would not be invalidated.
Message-Id: <[email protected]>
--- arch/x86/kvm/mmu/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/mmu/mmu.c +1 -1
@@ -5152,7 +5152,7 @@ EXPORT_SYMBOL_GPL(kvm_mmu_invalidate_gvavoid kvm_mmu_invlpg (struct kvm_vcpu *vcpu,gva_t gva) { -kvm_mmu_invalidate_gva (vcpu, vcpu->arch.mmu, gva,INVALID_PAGE ); +kvm_mmu_invalidate_gva (vcpu, vcpu->arch.walk_mmu, gva,INVALID_PAGE ); ++vcpu->stat.invlpg; }EXPORT_SYMBOL_GPL (kvm_mmu_invlpg);
Greg Kroah-Hartman
maintainerPATCH 47/130 tracing/histograms: String compares should not care about signed values
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 450fec13d9170127678f991698ac1a5b05c02e2f upstream.
When comparing two strings for the "onmatch" histogram trigger, fields that are strings use string comparisons, which do not care about being signed or not.
Do not fail to match two string fields if one is unsigned char array and the other is a signed char array.
--- kernel/trace/trace_events_hist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace_events_hist.c +1 -1
@@ -3344,7 +3344,7 @@ static int check_synth_field(struct syntif (strcmp (field->type, hist_field->type) !=0 ) {if (field->size != hist_field->size || - field->is_signed != hist_field->is_signed) + (!field->is_string && field->is_signed != hist_field->is_signed))return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 48/130 drm/amdkfd: separate kfd_iommu_resume from kfd_resume
In reply to Greg Kroah-HartmanFrom: James Zhu <[email protected]>
commit fefc01f042f44ede373ee66773b8238dd8fdcb55 upstream.
Separate kfd_iommu_resume from kfd_resume for fine-tuning of amdgpu device init/resume/reset/recovery sequence.
v2: squash in fix for !CONFIG_HSA_AMD
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 1 + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 12 ++++++++---- 2 files changed, 9 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h +1 -0
@@ -262,6 +262,7 @@ bool kgd2kfd_device_init(struct kfd_dev const struct kgd2kfd_shared_resources *gpu_resources);void kgd2kfd_device_exit (struct kfd_dev *kfd);void kgd2kfd_suspend (struct kfd_dev *kfd,bool run_pm); +int kgd2kfd_resume_iommu (struct kfd_dev *kfd);int kgd2kfd_resume (struct kfd_dev *kfd,bool run_pm);int kgd2kfd_pre_reset (struct kfd_dev *kfd);int kgd2kfd_post_reset (struct kfd_dev *kfd);
drivers/gpu/drm/amd/amdkfd/kfd_device.c +8 -4
@@ -896,17 +896,21 @@ int kgd2kfd_resume(struct kfd_dev *kfd,return ret; } -static int kfd_resume (struct kfd_dev *kfd) +int kgd2kfd_resume_iommu (struct kfd_dev *kfd) {int err =0 ; err =kfd_iommu_resume (kfd); -if (err) { +if (err)dev_err (kfd_device,"Failed to resume IOMMU for device %x:%x\n" , kfd->pdev->vendor, kfd->pdev->device); -return err; - } +return err; +} + +static int kfd_resume (struct kfd_dev *kfd) +{ +int err =0 ; err = kfd->dqm->ops.start (kfd->dqm);if (err) {
Greg Kroah-Hartman
maintainerPATCH 49/130 drm/amdgpu: add amdgpu_amdkfd_resume_iommu
In reply to Greg Kroah-HartmanFrom: James Zhu <[email protected]>
commit 8066008482e533e91934bee49765bf8b4a7c40db upstream.
Add amdgpu_amdkfd_resume_iommu for amdgpu.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 10 ++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 1 + 2 files changed, 11 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +10 -0
@@ -194,6 +194,16 @@ void amdgpu_amdkfd_suspend(struct amdgpukgd2kfd_suspend (adev->kfd.dev, run_pm); } +int amdgpu_amdkfd_resume_iommu (struct amdgpu_device *adev) +{ +int r =0 ; + +if (adev->kfd.dev) + r =kgd2kfd_resume_iommu (adev->kfd.dev); + +return r; +} +int amdgpu_amdkfd_resume (struct amdgpu_device *adev,bool run_pm) {int r =0 ;
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h +1 -0
@@ -126,6 +126,7 @@ int amdgpu_amdkfd_init(void);void amdgpu_amdkfd_fini (void );void amdgpu_amdkfd_suspend (struct amdgpu_device *adev,bool run_pm); +int amdgpu_amdkfd_resume_iommu (struct amdgpu_device *adev);int amdgpu_amdkfd_resume (struct amdgpu_device *adev,bool run_pm);void amdgpu_amdkfd_interrupt (struct amdgpu_device *adev,const void *ih_ring_entry);
Greg Kroah-Hartman
maintainerPATCH 50/130 drm/amdgpu: move iommu_resume before ip init/resume
In reply to Greg Kroah-HartmanFrom: James Zhu <[email protected]>
commit f02abeb0779700c308e661a412451b38962b8a0b upstream.
Separate iommu_resume from kfd_resume, and move it before other amdgpu ip init/resume.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +12 -0
@@ -2220,6 +2220,10 @@ static int amdgpu_device_ip_init(structif (r) goto init_failed; + r =amdgpu_amdkfd_resume_iommu (adev); +if (r) + goto init_failed; + r =amdgpu_device_ip_hw_init_phase1 (adev);if (r) goto init_failed;
@@ -2913,6 +2917,10 @@ static int amdgpu_device_ip_resume(struc {int r; + r =amdgpu_amdkfd_resume_iommu (adev); +if (r) +return r; + r =amdgpu_device_ip_resume_phase1 (adev);if (r)return r;
@@ -4296,6 +4304,10 @@ static int amdgpu_do_asic_reset(struct aif (!r) {dev_info (tmp_adev->dev,"GPU reset succeeded, trying to resume\n" ); + r =amdgpu_amdkfd_resume_iommu (tmp_adev); +if (r) + goto out; + r =amdgpu_device_ip_resume_phase1 (tmp_adev);if (r) goto out;
Greg Kroah-Hartman
maintainerPATCH 51/130 drm/amdgpu: init iommu after amdkfd device init
In reply to Greg Kroah-HartmanFrom: Yifan Zhang <[email protected]>
commit 714d9e4574d54596973ee3b0624ee4a16264d700 upstream.
This patch is to fix clinfo failure in Raven/Picasso:
Number of platforms: 1
Platform Profile: FULL_PROFILE
Platform Version: OpenCL 2.2 AMD-APP (3364.0) Platform Name: AMD Accelerated Parallel Processing Platform Vendor: Advanced Micro Devices, Inc. Platform Extensions: cl_khr_icd cl_amd_event_callback
Platform Name: AMD Accelerated Parallel Processing Number of devices: 0
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +4 -4
@@ -2220,10 +2220,6 @@ static int amdgpu_device_ip_init(structif (r) goto init_failed; - r =amdgpu_amdkfd_resume_iommu (adev); -if (r) - goto init_failed; - r =amdgpu_device_ip_hw_init_phase1 (adev);if (r) goto init_failed;
@@ -2259,6 +2255,10 @@ static int amdgpu_device_ip_init(structamdgpu_xgmi_add_device (adev);amdgpu_amdkfd_device_init (adev); + r =amdgpu_amdkfd_resume_iommu (adev); +if (r) + goto init_failed; +amdgpu_fru_get_product_info (adev); init_failed:
Greg Kroah-Hartman
maintainerPATCH 52/130 drm/amdkfd: fix boot failure when iommu is disabled in Picasso.
In reply to Greg Kroah-HartmanFrom: Yifan Zhang <[email protected]>
commit afd18180c07026f94a80ff024acef5f4159084a4 upstream.
When IOMMU disabled in sbios and kfd in iommuv2 path, iommuv2 init will fail. But this failure should not block amdgpu driver init.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ---- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 3 +++ 2 files changed, 3 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +0 -4
@@ -2255,10 +2255,6 @@ static int amdgpu_device_ip_init(structamdgpu_xgmi_add_device (adev);amdgpu_amdkfd_device_init (adev); - r =amdgpu_amdkfd_resume_iommu (adev); -if (r) - goto init_failed; -amdgpu_fru_get_product_info (adev); init_failed:
drivers/gpu/drm/amd/amdkfd/kfd_device.c +3 -0
@@ -751,6 +751,9 @@ bool kgd2kfd_device_init(struct kfd_devkfd_cwsr_init (kfd); +if (kgd2kfd_resume_iommu (kfd)) + goto device_iommu_error; +if (kfd_resume (kfd)) goto kfd_resume_error;
Greg Kroah-Hartman
maintainerPATCH 53/130 wireguard: selftests: increase default dmesg log size
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit 03ff1b1def73f817e196bf96ab36ac259490bd7c upstream.
The selftests currently parse the kernel log at the end to track potential memory leaks. With these tests now reading off the end of the buffer, due to recent optimizations, some creation messages were lost, making the tests think that there was a free without an alloc. Fix this by increasing the kernel log size.
--- tools/testing/selftests/wireguard/qemu/kernel.config | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/wireguard/qemu/kernel.config +1 -0
@@ -66,6 +66,7 @@ CONFIG_PROC_SYSCTL=y CONFIG_SYSFS=y CONFIG_TMPFS=y CONFIG_CONSOLE_LOGLEVEL_DEFAULT=15 +CONFIG_LOG_BUF_SHIFT=18 CONFIG_PRINTK_TIME=y CONFIG_BLK_DEV_INITRD=y CONFIG_LEGACY_VSYSCALL_NONE=y
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 54/130 wireguard: allowedips: add missing __rcu annotation to satisfy sparse
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit ae9287811ba75571cd69505d50ab0e612ace8572 upstream.
A __rcu annotation got lost during refactoring, which caused sparse to become enraged.
--- drivers/net/wireguard/allowedips.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireguard/allowedips.c +1 -1
@@ -163,7 +163,7 @@ static bool node_placement(struct allowereturn exact; } -static inline void connect_node (struct allowedips_node **parent,u8 bit,struct allowedips_node *node) +static inline void connect_node (struct allowedips_node __rcu **parent,u8 bit,struct allowedips_node *node) { node->parent_bit_packed = (unsigned long )parent | bit;rcu_assign_pointer (*parent, node);
Greg Kroah-Hartman
maintainerPATCH 55/130 wireguard: selftests: actually test for routing loops
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit 782c72af567fc2ef09bd7615d0307f24de72c7e0 upstream.
We previously removed the restriction on looping to self, and then added a test to make sure the kernel didn't blow up during a routing loop. The kernel didn't blow up, thankfully, but on certain architectures where skb fragmentation is easier, such as ppc64, the skbs weren't actually being discarded after a few rounds through. But the test wasn't catching this. So actually test explicitly for massive increases in tx to see if we have a routing loop. Note that the actual loop problem will need to be addressed in a different commit.
--- tools/testing/selftests/wireguard/netns.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
tools/testing/selftests/wireguard/netns.sh +5 -1
@@ -276,7 +276,11 @@ n0 ping -W 1 -c 1 192.168.241.2 n1 wg set wg0 peer "$pub2" endpoint 192.168.241.2:7 ip2 link del wg0 ip2 link del wg1 -! n0 ping -W 1 -c 10 -f 192.168.241.2 || false # Should not crash kernel +read _ _ tx_bytes_before < <(n0 wg show wg1 transfer) +! n0 ping -W 1 -c 10 -f 192.168.241.2 || false +sleep 1 +read _ _ tx_bytes_after < <(n0 wg show wg1 transfer) +(( tx_bytes_after - tx_bytes_before < 70000 )) ip0 link del wg1 ip1 link del wg0
Greg Kroah-Hartman
maintainerPATCH 56/130 wireguard: selftests: rename DEBUG_PI_LIST to DEBUG_PLIST
In reply to Greg Kroah-HartmanFrom: Li Zhijian <[email protected]>
commit 7e938beb8321d34f040557b8915b228af125f73c upstream.
DEBUG_PI_LIST was renamed to DEBUG_PLIST since 8e18faeac3 ("lib/plist:
rename DEBUG_PI_LIST to DEBUG_PLIST").
--- tools/testing/selftests/wireguard/qemu/debug.config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/wireguard/qemu/debug.config +1 -1
@@ -48,7 +48,7 @@ CONFIG_DEBUG_ATOMIC_SLEEP=y CONFIG_TRACE_IRQFLAGS=y CONFIG_DEBUG_BUGVERBOSE=y CONFIG_DEBUG_LIST=y -CONFIG_DEBUG_PI_LIST=y +CONFIG_DEBUG_PLIST=y CONFIG_PROVE_RCU=y CONFIG_SPARSE_RCU_POINTER=y CONFIG_RCU_CPU_STALL_TIMEOUT=21
Greg Kroah-Hartman
maintainerPATCH 57/130 wireguard: device: reset peer src endpoint when netns exits
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit 20ae1d6aa159eb91a9bf09ff92ccaa94dbea92c2 upstream.
Each peer's endpoint contains a dst_cache entry that takes a reference to another netdev. When the containing namespace exits, we take down the socket and prevent future sockets from being created (by setting creating_net to NULL), which removes that potential reference on the netns. However, it doesn't release references to the netns that a netdev cached in dst_cache might be taking, so the netns still might fail to exit. Since the socket is gimped anyway, we can simply clear all the dst_caches (by way of clearing the endpoint src), which will release all references.
However, the current dst_cache_reset function only releases those references lazily. But it turns out that all of our usages of wg_socket_clear_peer_endpoint_src are called from contexts that are not exactly high-speed or bottle-necked. For example, when there's connection difficulty, or when userspace is reconfiguring the interface. And in particular for this patch, when the netns is exiting. So for those cases, it makes more sense to call dst_release immediately. For that, we add a small helper function to dst_cache.
This patch also adds a test to netns.sh from Hangbin Liu to ensure this doesn't regress.
--- drivers/net/wireguard/device.c | 3 +++ drivers/net/wireguard/socket.c | 2 +- include/net/dst_cache.h | 11 +++++++++++ net/core/dst_cache.c | 19 +++++++++++++++++++ tools/testing/selftests/wireguard/netns.sh | 24 +++++++++++++++++++++++- 5 files changed, 57 insertions(+), 2 deletions(-)
drivers/net/wireguard/device.c +3 -0
@@ -398,6 +398,7 @@ static struct rtnl_link_ops link_ops __rstatic void wg_netns_pre_exit (struct net *net) {struct wg_device *wg; +struct wg_peer *peer;rtnl_lock ();list_for_each_entry (wg, &device_list, device_list) {
@@ -407,6 +408,8 @@ static void wg_netns_pre_exit(struct netmutex_lock (&wg->device_update_lock);rcu_assign_pointer (wg->creating_net,NULL );wg_socket_reinit (wg,NULL ,NULL ); +list_for_each_entry (peer, &wg->peer_list, peer_list) +wg_socket_clear_peer_endpoint_src (peer);mutex_unlock (&wg->device_update_lock); } }
drivers/net/wireguard/socket.c +1 -1
@@ -308,7 +308,7 @@ void wg_socket_clear_peer_endpoint_src(s {write_lock_bh (&peer->endpoint_lock);memset (&peer->endpoint.src6,0 ,sizeof (peer->endpoint.src6)); -dst_cache_reset (&peer->endpoint_cache); +dst_cache_reset_now (&peer->endpoint_cache);write_unlock_bh (&peer->endpoint_lock); }
include/net/dst_cache.h +11 -0
@@ -80,6 +80,17 @@ static inline void dst_cache_reset(struc }/** +* dst_cache_reset_now - invalidate the cache contents immediately +* @dst_cache: the cache +* +* The caller must be sure there are no concurrent users, as this frees +* all dst_cache users immediately, rather than waiting for the next +* per-cpu usage like dst_cache_reset does. Most callers should use the +* higher speed lazily-freed dst_cache_reset function instead. +*/ +void dst_cache_reset_now (struct dst_cache *dst_cache); + +/** * dst_cache_init - initialize the cache, allocating the required storage * @dst_cache: the cache * @gfp: allocation flags
net/core/dst_cache.c +19 -0
@@ -162,3 +162,22 @@ void dst_cache_destroy(struct dst_cachefree_percpu (dst_cache->cache); }EXPORT_SYMBOL_GPL (dst_cache_destroy); + +void dst_cache_reset_now (struct dst_cache *dst_cache) +{ +int i; + +if (!dst_cache->cache) +return ; + + dst_cache->reset_ts = jiffies; +for_each_possible_cpu (i) { +struct dst_cache_pcpu *idst =per_cpu_ptr (dst_cache->cache, i); +struct dst_entry *dst = idst->dst; + + idst->cookie =0 ; + idst->dst =NULL ; +dst_release (dst); + } +} +EXPORT_SYMBOL_GPL (dst_cache_reset_now);
tools/testing/selftests/wireguard/netns.sh +23 -1
@@ -613,6 +613,28 @@ ip0 link set wg0 up kill $ncat_pid ip0 link del wg0 +# Ensure that dst_cache references don't outlive netns lifetime +ip1 link add dev wg0 type wireguard +ip2 link add dev wg0 type wireguard +configure_peers +ip1 link add veth1 type veth peer name veth2 +ip1 link set veth2 netns $netns2 +ip1 addr add fd00:aa::1/64 dev veth1 +ip2 addr add fd00:aa::2/64 dev veth2 +ip1 link set veth1 up +ip2 link set veth2 up +waitiface $netns1 veth1 +waitiface $netns2 veth2 +ip1 -6 route add default dev veth1 via fd00:aa::2 +ip2 -6 route add default dev veth2 via fd00:aa::1 +n1 wg set wg0 peer "$pub2" endpoint [fd00:aa::2]:2 +n2 wg set wg0 peer "$pub1" endpoint [fd00:aa::1]:1 +n1 ping6 -c 1 fd00::2 +pp ip netns delete $netns1 +pp ip netns delete $netns2 +pp ip netns add $netns1 +pp ip netns add $netns2 + # Ensure there aren't circular reference loops ip1 link add wg1 type wireguard ip2 link add wg2 type wireguard
@@ -631,7 +653,7 @@ while read -t 0.1 -r line 2>/dev/null || done < /dev/kmsg alldeleted=1 for object in "${!objects[@]}"; do - if [[ ${objects["$object"]} != *createddestroyed ]]; then + if [[ ${objects["$object"]} != *createddestroyed && ${objects["$object"]} != *createdcreateddestroyeddestroyed ]]; then echo "Error: $object: merely ${objects["$object"]}" >&3 alldeleted=0 fi
Greg Kroah-Hartman
maintainerPATCH 58/130 wireguard: receive: use ring buffer for incoming handshakes
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit 886fcee939adb5e2af92741b90643a59f2b54f97 upstream.
Apparently the spinlock on incoming_handshake's skb_queue is highly contended, and a torrent of handshake or cookie packets can bring the data plane to its knees, simply by virtue of enqueueing the handshake packets to be processed asynchronously. So, we try switching this to a ring buffer to hopefully have less lock contention. This alleviates the problem somewhat, though it still isn't perfect, so future patches will have to improve this further. However, it at least doesn't completely diminish the data plane.
--- drivers/net/wireguard/device.c | 36 ++++++++++++++++++------------------ drivers/net/wireguard/device.h | 9 +++------ drivers/net/wireguard/queueing.c | 6 +++--- drivers/net/wireguard/queueing.h | 2 +- drivers/net/wireguard/receive.c | 27 ++++++++++++--------------- 5 files changed, 37 insertions(+), 43 deletions(-)
drivers/net/wireguard/device.c +18 -18
@@ -98,6 +98,7 @@ static int wg_stop(struct net_device *de {struct wg_device *wg =netdev_priv (dev);struct wg_peer *peer; +struct sk_buff *skb;mutex_lock (&wg->device_update_lock);list_for_each_entry (peer, &wg->peer_list, peer_list) {
@@ -108,7 +109,9 @@ static int wg_stop(struct net_device *dewg_noise_reset_last_sent_handshake (&peer->last_sent_handshake); }mutex_unlock (&wg->device_update_lock); -skb_queue_purge (&wg->incoming_handshakes); +while ((skb =ptr_ring_consume (&wg->handshake_queue.ring)) !=NULL ) +kfree_skb (skb); +atomic_set (&wg->handshake_queue_len,0 );wg_socket_reinit (wg,NULL ,NULL );return 0 ; }
@@ -235,14 +238,13 @@ static void wg_destruct(struct net_devicdestroy_workqueue (wg->handshake_receive_wq);destroy_workqueue (wg->handshake_send_wq);destroy_workqueue (wg->packet_crypt_wq); -wg_packet_queue_free (&wg->decrypt_queue); -wg_packet_queue_free (&wg->encrypt_queue); +wg_packet_queue_free (&wg->handshake_queue, true); +wg_packet_queue_free (&wg->decrypt_queue, false); +wg_packet_queue_free (&wg->encrypt_queue, false);rcu_barrier ();/* Wait for all the peers to be actually freed. */ wg_ratelimiter_uninit ();memzero_explicit (&wg->static_identity,sizeof (wg->static_identity)); -skb_queue_purge (&wg->incoming_handshakes);free_percpu (dev->tstats); -free_percpu (wg->incoming_handshakes_worker);kvfree (wg->index_hashtable);kvfree (wg->peer_hashtable);mutex_unlock (&wg->device_update_lock);
@@ -298,7 +300,6 @@ static int wg_newlink(struct net *src_neinit_rwsem (&wg->static_identity.lock);mutex_init (&wg->socket_update_lock);mutex_init (&wg->device_update_lock); -skb_queue_head_init (&wg->incoming_handshakes);wg_allowedips_init (&wg->peer_allowedips);wg_cookie_checker_init (&wg->cookie_checker, wg);INIT_LIST_HEAD (&wg->peer_list);
@@ -316,16 +317,10 @@ static int wg_newlink(struct net *src_neif (!dev->tstats) goto err_free_index_hashtable; - wg->incoming_handshakes_worker = -wg_packet_percpu_multicore_worker_alloc ( - wg_packet_handshake_receive_worker, wg); -if (!wg->incoming_handshakes_worker) - goto err_free_tstats; - wg->handshake_receive_wq =alloc_workqueue ("wg-kex-%s" ,WQ_CPU_INTENSIVE |WQ_FREEZABLE ,0 , dev->name);if (!wg->handshake_receive_wq) - goto err_free_incoming_handshakes; + goto err_free_tstats; wg->handshake_send_wq =alloc_workqueue ("wg-kex-%s" ,WQ_UNBOUND |WQ_FREEZABLE ,0 , dev->name);
@@ -347,10 +342,15 @@ static int wg_newlink(struct net *src_neif (ret <0 ) goto err_free_encrypt_queue; - ret =wg_ratelimiter_init (); + ret =wg_packet_queue_init (&wg->handshake_queue, wg_packet_handshake_receive_worker, +MAX_QUEUED_INCOMING_HANDSHAKES );if (ret <0 ) goto err_free_decrypt_queue; + ret =wg_ratelimiter_init (); +if (ret <0 ) + goto err_free_handshake_queue; + ret =register_netdevice (dev);if (ret <0 ) goto err_uninit_ratelimiter;
@@ -367,18 +367,18 @@ static int wg_newlink(struct net *src_ne err_uninit_ratelimiter:wg_ratelimiter_uninit (); +err_free_handshake_queue: +wg_packet_queue_free (&wg->handshake_queue, false); err_free_decrypt_queue: -wg_packet_queue_free (&wg->decrypt_queue); +wg_packet_queue_free (&wg->decrypt_queue, false); err_free_encrypt_queue: -wg_packet_queue_free (&wg->encrypt_queue); +wg_packet_queue_free (&wg->encrypt_queue, false); err_destroy_packet_crypt:destroy_workqueue (wg->packet_crypt_wq); err_destroy_handshake_send:destroy_workqueue (wg->handshake_send_wq); err_destroy_handshake_receive:destroy_workqueue (wg->handshake_receive_wq); -err_free_incoming_handshakes: -free_percpu (wg->incoming_handshakes_worker); err_free_tstats:free_percpu (dev->tstats); err_free_index_hashtable:
drivers/net/wireguard/device.h +3 -6
@@ -39,21 +39,18 @@ struct prev_queue {struct wg_device {struct net_device *dev; -struct crypt_queue encrypt_queue, decrypt_queue; +struct crypt_queue encrypt_queue, decrypt_queue, handshake_queue;struct sock __rcu *sock4, *sock6;struct net __rcu *creating_net;struct noise_static_identity static_identity; -struct workqueue_struct *handshake_receive_wq, *handshake_send_wq; -struct workqueue_struct *packet_crypt_wq; -struct sk_buff_head incoming_handshakes; -int incoming_handshake_cpu; -struct multicore_worker __percpu *incoming_handshakes_worker; +struct workqueue_struct *packet_crypt_wq,*handshake_receive_wq, *handshake_send_wq;struct cookie_checker cookie_checker;struct pubkey_hashtable *peer_hashtable;struct index_hashtable *index_hashtable;struct allowedips peer_allowedips;struct mutex device_update_lock, socket_update_lock;struct list_head device_list, peer_list; +atomic_t handshake_queue_len;unsigned int num_peers, device_update_gen;u32 fwmark;u16 incoming_port;
drivers/net/wireguard/queueing.c +3 -3
@@ -38,11 +38,11 @@ int wg_packet_queue_init(struct crypt_qureturn 0 ; } -void wg_packet_queue_free (struct crypt_queue *queue) +void wg_packet_queue_free (struct crypt_queue *queue,bool purge) {free_percpu (queue->worker); -WARN_ON (!__ptr_ring_empty (&queue->ring)); -ptr_ring_cleanup (&queue->ring,NULL ); +WARN_ON (!purge && !__ptr_ring_empty (&queue->ring)); +ptr_ring_cleanup (&queue->ring, purge ? (void (*)(void *))kfree_skb :NULL ); }#define NEXT (skb) ((skb)->prev)
drivers/net/wireguard/queueing.h +1 -1
@@ -23,7 +23,7 @@ struct sk_buff;/* queueing.c APIs: */ int wg_packet_queue_init (struct crypt_queue *queue,work_func_t function,unsigned int len); -void wg_packet_queue_free (struct crypt_queue *queue); +void wg_packet_queue_free (struct crypt_queue *queue,bool purge);struct multicore_worker __percpu *wg_packet_percpu_multicore_worker_alloc (work_func_t function,void *ptr);
drivers/net/wireguard/receive.c +12 -15
@@ -116,8 +116,8 @@ static void wg_receive_handshake_packet(return ; } - under_load =skb_queue_len (&wg->incoming_handshakes) >= -MAX_QUEUED_INCOMING_HANDSHAKES /8 ; + under_load =atomic_read (&wg->handshake_queue_len) >= +MAX_QUEUED_INCOMING_HANDSHAKES /8 ;if (under_load) { last_under_load =ktime_get_coarse_boottime_ns (); }else if (last_under_load) {
@@ -212,13 +212,14 @@ static void wg_receive_handshake_packet(void wg_packet_handshake_receive_worker (struct work_struct *work) { - struct wg_device *wg = container_of(work, struct multicore_worker, - work)->ptr; + struct crypt_queue *queue = container_of(work, struct multicore_worker, work)->ptr; + struct wg_device *wg = container_of(queue, struct wg_device, handshake_queue);struct sk_buff *skb; -while ((skb =skb_dequeue (&wg->incoming_handshakes)) !=NULL ) { +while ((skb =ptr_ring_consume_bh (&queue->ring)) !=NULL ) {wg_receive_handshake_packet (wg, skb);dev_kfree_skb (skb); +atomic_dec (&wg->handshake_queue_len);cond_resched (); } }
@@ -554,21 +555,17 @@ void wg_packet_receive(struct wg_devicecase cpu_to_le32 (MESSAGE_HANDSHAKE_RESPONSE ):case cpu_to_le32 (MESSAGE_HANDSHAKE_COOKIE ): {int cpu; - -if (skb_queue_len (&wg->incoming_handshakes) > -MAX_QUEUED_INCOMING_HANDSHAKES || -unlikely (!rng_is_initialized ())) { +if (unlikely (!rng_is_initialized () || +ptr_ring_produce_bh (&wg->handshake_queue.ring, skb))) {net_dbg_skb_ratelimited ("%s: Dropping handshake packet from %pISpfsc\n" , wg->dev->name, skb); goto err; } -skb_queue_tail (&wg->incoming_handshakes, skb); -/* Queues up a call to packet_process_queued_handshake_ -* packets(skb): -*/ - cpu =wg_cpumask_next_online (&wg->incoming_handshake_cpu); +atomic_inc (&wg->handshake_queue_len); + cpu =wg_cpumask_next_online (&wg->handshake_queue.last_cpu); +/* Queues up a call to packet_process_queued_handshake_packets(skb): */ queue_work_on (cpu, wg->handshake_receive_wq, - &per_cpu_ptr (wg->incoming_handshakes_worker, cpu)->work); + &per_cpu_ptr (wg->handshake_queue.worker, cpu)->work);break ; }case cpu_to_le32 (MESSAGE_DATA ):
Greg Kroah-Hartman
maintainerPATCH 59/130 wireguard: receive: drop handshakes if queue lock is contended
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit fb32f4f606c17b869805d7cede8b03d78339b50a upstream.
If we're being delivered packets from multiple CPUs so quickly that the ring lock is contended for CPU tries, then it's safe to assume that the queue is near capacity anyway, so just drop the packet rather than spinning. This helps deal with multicore DoS that can interfere with data path performance. It _still_ does not completely fix the issue, but it again chips away at it.
--- drivers/net/wireguard/receive.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/net/wireguard/receive.c +13 -3
@@ -554,9 +554,19 @@ void wg_packet_receive(struct wg_devicecase cpu_to_le32 (MESSAGE_HANDSHAKE_INITIATION ):case cpu_to_le32 (MESSAGE_HANDSHAKE_RESPONSE ):case cpu_to_le32 (MESSAGE_HANDSHAKE_COOKIE ): { -int cpu; -if (unlikely (!rng_is_initialized () || -ptr_ring_produce_bh (&wg->handshake_queue.ring, skb))) { +int cpu, ret = -EBUSY ; + +if (unlikely (!rng_is_initialized ())) + goto drop; +if (atomic_read (&wg->handshake_queue_len) >MAX_QUEUED_INCOMING_HANDSHAKES /2 ) { +if (spin_trylock_bh (&wg->handshake_queue.ring.producer_lock)) { + ret =__ptr_ring_produce (&wg->handshake_queue.ring, skb); +spin_unlock_bh (&wg->handshake_queue.ring.producer_lock); + } + }else + ret =ptr_ring_produce_bh (&wg->handshake_queue.ring, skb); +if (ret) { + drop:net_dbg_skb_ratelimited ("%s: Dropping handshake packet from %pISpfsc\n" , wg->dev->name, skb); goto err;
Greg Kroah-Hartman
maintainerPATCH 60/130 wireguard: ratelimiter: use kvcalloc() instead of kvzalloc()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
commit 4e3fd721710553832460c179c2ee5ce67ef7f1e0 upstream.
Use 2-factor argument form kvcalloc() instead of kvzalloc().
[Jason: Gustavo's link above is for KSPP, but this isn't actually a
security fix, as table_size is bounded to 8192 anyway, and gcc realizes this, so the codegen comes out to be about the same.]
--- drivers/net/wireguard/ratelimiter.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireguard/ratelimiter.c +2 -2
@@ -176,12 +176,12 @@ int wg_ratelimiter_init(void) (1U << 14) / sizeof(struct hlist_head))); max_entries = table_size *8 ; - table_v4 =kvzalloc (table_size *sizeof (*table_v4),GFP_KERNEL ); + table_v4 =kvcalloc (table_size,sizeof (*table_v4),GFP_KERNEL );if (unlikely (!table_v4)) goto err_kmemcache;#if IS_ENABLED (CONFIG_IPV6 ) - table_v6 =kvzalloc (table_size *sizeof (*table_v6),GFP_KERNEL ); + table_v6 =kvcalloc (table_size,sizeof (*table_v6),GFP_KERNEL );if (unlikely (!table_v6)) {kvfree (table_v4); goto err_kmemcache;
Greg Kroah-Hartman
maintainerPATCH 61/130 i2c: stm32f7: flush TX FIFO upon transfer errors
In reply to Greg Kroah-HartmanFrom: Alain Volmat <[email protected]>
commit 0c21d02ca469574d2082379db52d1a27b99eed0c upstream.
While handling an error during transfer (ex: NACK), it could happen that the driver has already written data into TXDR before the transfer get stopped.
This commit add TXDR Flush after end of transfer in case of error to avoid sending a wrong data on any other slave upon next transfer.
--- drivers/i2c/busses/i2c-stm32f7.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-stm32f7.c +19 -1
@@ -1665,6 +1665,16 @@ static int stm32f7_i2c_xfer(struct i2c_a time_left =wait_for_completion_timeout (&i2c_dev->complete, i2c_dev->adap.timeout); ret = f7_msg->result; +if (ret) { +/* +* It is possible that some unsent data have already been +* written into TXDR. To avoid sending old data in a +* further transfer, flush TXDR in case of any error +*/ +writel_relaxed (STM32F7_I2C_ISR_TXE , + i2c_dev->base +STM32F7_I2C_ISR ); + goto pm_free; + }if (!time_left) { dev_dbg(i2c_dev->dev, "Access to slave 0x%x timed out\n",
@@ -1713,8 +1723,16 @@ static int stm32f7_i2c_smbus_xfer(struct timeout =wait_for_completion_timeout (&i2c_dev->complete, i2c_dev->adap.timeout); ret = f7_msg->result; -if (ret) +if (ret) { +/* +* It is possible that some unsent data have already been +* written into TXDR. To avoid sending old data in a +* further transfer, flush TXDR in case of any error +*/ +writel_relaxed (STM32F7_I2C_ISR_TXE , + i2c_dev->base +STM32F7_I2C_ISR ); goto pm_free; + }if (!timeout) {dev_dbg (dev,"Access to slave 0x%x timed out\n" , f7_msg->addr);
Greg Kroah-Hartman
maintainerPATCH 62/130 i2c: stm32f7: recover the bus on access timeout
In reply to Greg Kroah-HartmanFrom: Alain Volmat <[email protected]>
commit b933d1faf8fa30d16171bcff404e39c41b2a7c84 upstream.
When getting an access timeout, ensure that the bus is in a proper state prior to returning the error.
--- drivers/i2c/busses/i2c-stm32f7.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/i2c/busses/i2c-stm32f7.c +2 -0
@@ -1681,6 +1681,7 @@ static int stm32f7_i2c_xfer(struct i2c_a i2c_dev->msg->addr);if (i2c_dev->use_dma)dmaengine_terminate_all (dma->chan_using); +stm32f7_i2c_wait_free_bus (i2c_dev); ret = -ETIMEDOUT ; }
@@ -1738,6 +1739,7 @@ static int stm32f7_i2c_smbus_xfer(structdev_dbg (dev,"Access to slave 0x%x timed out\n" , f7_msg->addr);if (i2c_dev->use_dma)dmaengine_terminate_all (dma->chan_using); +stm32f7_i2c_wait_free_bus (i2c_dev); ret = -ETIMEDOUT ; goto pm_free; }
Greg Kroah-Hartman
maintainerPATCH 63/130 i2c: stm32f7: stop dma transfer in case of NACK
In reply to Greg Kroah-HartmanFrom: Alain Volmat <[email protected]>
commit 31b90a95ccbbb4b628578ac17e3b3cc8eeacfe31 upstream.
In case of receiving a NACK, the dma transfer should be stopped to avoid feeding data into the FIFO.
Also ensure to properly return the proper error code and avoid waiting for the end of the dma completion in case of error happening during the transmission.
--- drivers/i2c/busses/i2c-stm32f7.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-stm32f7.c +7 -2
@@ -1472,6 +1472,7 @@ static irqreturn_t stm32f7_i2c_isr_event {struct stm32f7_i2c_dev *i2c_dev = data;struct stm32f7_i2c_msg *f7_msg = &i2c_dev->f7_msg; +struct stm32_i2c_dma *dma = i2c_dev->dma;void __iomem *base = i2c_dev->base;u32 status, mask;int ret =IRQ_HANDLED ;
@@ -1497,6 +1498,10 @@ static irqreturn_t stm32f7_i2c_isr_eventdev_dbg (i2c_dev->dev,"<%s>: Receive NACK (addr %x)\n" , __func__, f7_msg->addr);writel_relaxed (STM32F7_I2C_ICR_NACKCF , base +STM32F7_I2C_ICR ); +if (i2c_dev->use_dma) { +stm32f7_i2c_disable_dma_req (i2c_dev); +dmaengine_terminate_all (dma->chan_using); + } f7_msg->result = -ENXIO ; }
@@ -1512,7 +1517,7 @@ static irqreturn_t stm32f7_i2c_isr_event/* Clear STOP flag */ writel_relaxed (STM32F7_I2C_ICR_STOPCF , base +STM32F7_I2C_ICR ); -if (i2c_dev->use_dma) { +if (i2c_dev->use_dma && !f7_msg->result) { ret =IRQ_WAKE_THREAD ; }else { i2c_dev->master_mode = false;
@@ -1525,7 +1530,7 @@ static irqreturn_t stm32f7_i2c_isr_eventif (f7_msg->stop) { mask =STM32F7_I2C_CR2_STOP ;stm32f7_i2c_set_bits (base +STM32F7_I2C_CR2 , mask); - }else if (i2c_dev->use_dma) { + }else if (i2c_dev->use_dma && !f7_msg->result) { ret =IRQ_WAKE_THREAD ; }else if (f7_msg->smbus) {stm32f7_i2c_smbus_rep_start (i2c_dev);
Greg Kroah-Hartman
maintainerPATCH 64/130 i2c: cbus-gpio: set atomic transfer callback
In reply to Greg Kroah-HartmanFrom: Aaro Koskinen <[email protected]>
commit b12764695c3fcade145890b67f82f8b139174cc7 upstream.
CBUS transfers have always been atomic, but after commit 63b96983a5dd ("i2c: core: introduce callbacks for atomic transfers") we started to see warnings during e.g. poweroff as the atomic callback is not explicitly set. Fix that.
Fixes the following WARNING seen during Nokia N810 power down:
[ 786.570617] reboot: Power down [ 786.573913] ------------[ cut here ]------------ [ 786.578826] WARNING: CPU: 0 PID: 672 at drivers/i2c/i2c-core.h:40 i2c_smbus_xfer+0x100/0x110 [ 786.587799] No atomic I2C transfer handler for 'i2c-2'
--- drivers/i2c/busses/i2c-cbus-gpio.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-cbus-gpio.c +3 -2
@@ -195,8 +195,9 @@ static u32 cbus_i2c_func(struct i2c_adap }static const struct i2c_algorithm cbus_i2c_algo = { - .smbus_xfer = cbus_i2c_smbus_xfer, - .functionality = cbus_i2c_func, + .smbus_xfer = cbus_i2c_smbus_xfer, + .smbus_xfer_atomic = cbus_i2c_smbus_xfer, + .functionality = cbus_i2c_func, };static int cbus_i2c_remove (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 65/130 natsemi: xtensa: fix section mismatch warnings
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
commit b0f38e15979fa8851e88e8aa371367f264e7b6e9 upstream.
Fix section mismatch warnings in xtsonic. The first one appears to be bogus and after fixing the second one, the first one is gone.
WARNING: modpost: vmlinux.o(.text+0x529adc): Section mismatch in reference from the function sonic_get_stats() to the function .init.text:set_reset_devices() The function sonic_get_stats() references
the function __init set_reset_devices().
This is often because sonic_get_stats lacks a __init
annotation or the annotation of set_reset_devices is wrong.
WARNING: modpost: vmlinux.o(.text+0x529b3b): Section mismatch in reference from the function xtsonic_probe() to the function .init.text:sonic_probe1() The function xtsonic_probe() references
the function __init sonic_probe1().
This is often because xtsonic_probe lacks a __init
annotation or the annotation of sonic_probe1 is wrong.
--- drivers/net/ethernet/natsemi/xtsonic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/natsemi/xtsonic.c +1 -1
@@ -120,7 +120,7 @@ static const struct net_device_ops xtson .ndo_set_mac_address = eth_mac_addr, }; -static int __init sonic_probe1 (struct net_device *dev) +static int sonic_probe1 (struct net_device *dev) {unsigned int silicon_revision;struct sonic_local *lp =netdev_priv (dev);
Greg Kroah-Hartman
maintainerPATCH 66/130 tcp: fix page frag corruption on page fault
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
commit dacb5d8875cc6cd3a553363b4d6f06760fcbe70c upstream.
Steffen reported a TCP stream corruption for HTTP requests served by the apache web-server using a cifs mount-point and memory mapping the relevant file.
The root cause is quite similar to the one addressed by commit 20eb4f29b602 ("net: fix sk_page_frag() recursion from memory reclaim"). Here the nested access to the task page frag is caused by a page fault on the (mmapped) user-space memory buffer coming from the cifs file.
The page fault handler performs an smb transaction on a different socket, inside the same process context. Since sk->sk_allaction for such socket does not prevent the usage for the task_frag, the nested allocation modify "under the hood" the page frag in use by the outer sendmsg call, corrupting the stream.
The overall relevant stack trace looks like the following:
httpd 78268 [001] 3461630.850950: probe:tcp_sendmsg_locked:
ffffffff91461d91 tcp_sendmsg_locked+0x1
ffffffff91462b57 tcp_sendmsg+0x27
ffffffff9139814e sock_sendmsg+0x3e
ffffffffc06dfe1d smb_send_kvec+0x28
[...]
ffffffffc06cfaf8 cifs_readpages+0x213
ffffffff90e83c4b read_pages+0x6b
ffffffff90e83f31 __do_page_cache_readahead+0x1c1
ffffffff90e79e98 filemap_fault+0x788
ffffffff90eb0458 __do_fault+0x38
ffffffff90eb5280 do_fault+0x1a0
ffffffff90eb7c84 __handle_mm_fault+0x4d4
ffffffff90eb8093 handle_mm_fault+0xc3
ffffffff90c74f6d __do_page_fault+0x1ed
ffffffff90c75277 do_page_fault+0x37
ffffffff9160111e page_fault+0x1e
ffffffff9109e7b5 copyin+0x25
ffffffff9109eb40 _copy_from_iter_full+0xe0
ffffffff91462370 tcp_sendmsg_locked+0x5e0
ffffffff91462370 tcp_sendmsg_locked+0x5e0
ffffffff91462b57 tcp_sendmsg+0x27
ffffffff9139815c sock_sendmsg+0x4c
ffffffff913981f7 sock_write_iter+0x97
ffffffff90f2cc56 do_iter_readv_writev+0x156
ffffffff90f2dff0 do_iter_write+0x80
ffffffff90f2e1c3 vfs_writev+0xa3
ffffffff90f2e27c do_writev+0x5c
ffffffff90c042bb do_syscall_64+0x5b
ffffffff916000ad entry_SYSCALL_64_after_hwframe+0x65The cifs filesystem rightfully sets sk_allocations to GFP_NOFS, we can avoid the nesting using the sk page frag for allocation lacking the __GFP_FS flag. Do not define an additional mm-helper for that, as this is strictly tied to the sk page frag usage.
v1 -> v2:
- use a stricted sk_page_frag() check instead of reordering the code (Eric)
--- include/net/sock.h | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
include/net/sock.h +8 -5
@@ -2322,19 +2322,22 @@ struct sk_buff *sk_stream_alloc_skb(stru* @sk: socket * * Use the per task page_frag instead of the per socket one for -* optimization when we know that we're in the normal context and owns +* optimization when we know that we're in process context and own * everything that's associated with %current. * -* gfpflags_allow_blocking() isn't enough here as direct reclaim may nest -* inside other socket operations and end up recursing into sk_page_frag() -* while it's already in use. +* Both direct reclaim and page faults can nest inside other +* socket operations and end up recursing into sk_page_frag() +* while it's already in use: explicitly avoid task page_frag +* usage if the caller is potentially doing any of them. +* This assumes that page fault handlers use the GFP_NOFS flags. * * Return: a per task page_frag if context allows that, * otherwise a per socket one. */ static inline struct page_frag *sk_page_frag (struct sock *sk) { -if (gfpflags_normal_context (sk->sk_allocation)) +if ((sk->sk_allocation & (__GFP_DIRECT_RECLAIM | __GFP_MEMALLOC | __GFP_FS)) == + (__GFP_DIRECT_RECLAIM | __GFP_FS))return ¤t->task_frag;return &sk->sk_frag;
Greg Kroah-Hartman
maintainerPATCH 67/130 net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
In reply to Greg Kroah-HartmanFrom: Zhou Qingyang <[email protected]>
commit e2dabc4f7e7b60299c20a36d6a7b24ed9bf8e572 upstream.
In qlcnic_83xx_add_rings(), the indirect function of ahw->hw_ops->alloc_mbx_args will be called to allocate memory for cmd.req.arg, and there is a dereference of it in qlcnic_83xx_add_rings(), which could lead to a NULL pointer dereference on failure of the indirect function like qlcnic_83xx_alloc_mbx_args().
Fix this bug by adding a check of alloc_mbx_args(), this patch imitates the logic of mbx_cmd()'s failure handling.
This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs.
Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug.
Builds with CONFIG_QLCNIC=m show no new warnings, and our static analyzer no longer warns about this code.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +8 -2
@@ -1077,8 +1077,14 @@ static int qlcnic_83xx_add_rings(struct sds_mbx_size =sizeof (struct qlcnic_sds_mbx ); context_id = recv_ctx->context_id; num_sds = adapter->drv_sds_rings -QLCNIC_MAX_SDS_RINGS ; - ahw->hw_ops->alloc_mbx_args (&cmd, adapter, -QLCNIC_CMD_ADD_RCV_RINGS ); + err = ahw->hw_ops->alloc_mbx_args (&cmd, adapter, +QLCNIC_CMD_ADD_RCV_RINGS ); +if (err) { +dev_err (&adapter->pdev->dev, +"Failed to alloc mbx args %d\n" , err); +return err; + } + cmd.req.arg[1 ] =0 | (num_sds <<8 ) | (context_id <<16 );/* set up status rings, mbx 2-81 */
Greg Kroah-Hartman
maintainerPATCH 68/130 net: mpls: Fix notifications when deleting a device
In reply to Greg Kroah-HartmanFrom: Benjamin Poirier <[email protected]>
commit 7d4741eacdefa5f0475431645b56baf00784df1f upstream.
There are various problems related to netlink notifications for mpls route changes in response to interfaces being deleted:
* delete interface of only nexthop
DELROUTE notification is missing RTA_OIF attribute
* delete interface of non-last nexthop
NEWROUTE notification is missing entirely
* delete interface of last nexthop
DELROUTE notification is missing nexthop
All of these problems stem from the fact that existing routes are modified in-place before sending a notification. Restructure mpls_ifdown() to avoid changing the route in the DELROUTE cases and to create a copy in the NEWROUTE case.
--- net/mpls/af_mpls.c | 68 ++++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 52 insertions(+), 16 deletions(-)
net/mpls/af_mpls.c +52 -16
@@ -1490,22 +1490,52 @@ static void mpls_dev_destroy_rcu(structkfree (mdev); } -static void mpls_ifdown (struct net_device *dev,int event) +static int mpls_ifdown (struct net_device *dev,int event) {struct mpls_route __rcu **platform_label;struct net *net =dev_net (dev); -u8 alive, deleted;unsigned index; platform_label =rtnl_dereference (net->mpls.platform_label);for (index =0 ; index < net->mpls.platform_labels; index++) {struct mpls_route *rt =rtnl_dereference (platform_label[index]); +bool nh_del = false; +u8 alive =0 ;if (!rt)continue ; - alive =0 ; - deleted =0 ; +if (event ==NETDEV_UNREGISTER ) { +u8 deleted =0 ; + +for_nexthops (rt) { +struct net_device *nh_dev = +rtnl_dereference (nh->nh_dev); + +if (!nh_dev || nh_dev == dev) + deleted++; +if (nh_dev == dev) + nh_del = true; + }endfor_nexthops (rt); + +/* if there are no more nexthops, delete the route */ +if (deleted == rt->rt_nhn) { +mpls_route_update (net, index,NULL ,NULL ); +continue ; + } + +if (nh_del) { +size_t size =sizeof (*rt) + rt->rt_nhn * + rt->rt_nh_size; +struct mpls_route *orig = rt; + + rt =kmalloc (size,GFP_KERNEL ); +if (!rt) +return -ENOMEM ; +memcpy (rt, orig, size); + } + } +change_nexthops (rt) {unsigned int nh_flags = nh->nh_flags;
@@ -1529,16 +1559,15 @@ static void mpls_ifdown(struct net_devic next:if (!(nh_flags & (RTNH_F_DEAD |RTNH_F_LINKDOWN ))) alive++; -if (!rtnl_dereference (nh->nh_dev)) - deleted++; }endfor_nexthops (rt);WRITE_ONCE (rt->rt_nhn_alive, alive); -/* if there are no more nexthops, delete the route */ -if (event ==NETDEV_UNREGISTER && deleted == rt->rt_nhn) -mpls_route_update (net, index,NULL ,NULL ); +if (nh_del) +mpls_route_update (net, index, rt,NULL ); } + +return 0 ; }static void mpls_ifup (struct net_device *dev,unsigned int flags)
@@ -1596,8 +1625,12 @@ static int mpls_dev_notify(struct notifireturn NOTIFY_OK ;switch (event) { +int err; +case NETDEV_DOWN : -mpls_ifdown (dev, event); + err =mpls_ifdown (dev, event); +if (err) +return notifier_from_errno (err);break ;case NETDEV_UP : flags =dev_get_flags (dev);
@@ -1608,13 +1641,18 @@ static int mpls_dev_notify(struct notifibreak ;case NETDEV_CHANGE : flags =dev_get_flags (dev); -if (flags & (IFF_RUNNING |IFF_LOWER_UP )) +if (flags & (IFF_RUNNING |IFF_LOWER_UP )) {mpls_ifup (dev,RTNH_F_DEAD |RTNH_F_LINKDOWN ); -else -mpls_ifdown (dev, event); + }else { + err =mpls_ifdown (dev, event); +if (err) +return notifier_from_errno (err); + }break ;case NETDEV_UNREGISTER : -mpls_ifdown (dev, event); + err =mpls_ifdown (dev, event); +if (err) +return notifier_from_errno (err); mdev =mpls_dev_get (dev);if (mdev) {mpls_dev_sysctl_unregister (dev, mdev);
@@ -1625,8 +1663,6 @@ static int mpls_dev_notify(struct notificase NETDEV_CHANGENAME : mdev =mpls_dev_get (dev);if (mdev) { -int err; -mpls_dev_sysctl_unregister (dev, mdev); err =mpls_dev_sysctl_register (dev, mdev);if (err)
Greg Kroah-Hartman
maintainerPATCH 69/130 siphash: use _unaligned version by default
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit f7e5b9bfa6c8820407b64eabc1f29c9a87e8993d upstream.
On ARM v6 and later, we define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS because the ordinary load/store instructions (ldr, ldrh, ldrb) can tolerate any misalignment of the memory address. However, load/store double and load/store multiple instructions (ldrd, ldm) may still only be used on memory addresses that are 32-bit aligned, and so we have to use the CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS macro with care, or we may end up with a severe performance hit due to alignment traps that require fixups by the kernel. Testing shows that this currently happens with clang-13 but not gcc-11. In theory, any compiler version can produce this bug or other problems, as we are dealing with undefined behavior in C99 even on architectures that support this in hardware, see also https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100363.
Fortunately, the get_unaligned() accessors do the right thing: when building for ARMv6 or later, the compiler will emit unaligned accesses using the ordinary load/store instructions (but avoid the ones that require 32-bit alignment). When building for older ARM, those accessors will emit the appropriate sequence of ldrb/mov/orr instructions. And on architectures that can truly tolerate any kind of misalignment, the get_unaligned() accessors resolve to the leXX_to_cpup accessors that operate on aligned addresses.
Since the compiler will in fact emit ldrd or ldm instructions when building this code for ARM v6 or later, the solution is to use the unaligned accessors unconditionally on architectures where this is known to be fast. The _aligned version of the hash function is however still needed to get the best performance on architectures that cannot do any unaligned access in hardware.
This new version avoids the undefined behavior and should produce the fastest hash on all architectures we support.
--- include/linux/siphash.h | 14 ++++---------- lib/siphash.c | 12 ++++++------ 2 files changed, 10 insertions(+), 16 deletions(-)
include/linux/siphash.h +4 -10
@@ -27,9 +27,7 @@ static inline bool siphash_key_is_zero(c }u64 __siphash_aligned (const void *data,size_t len,const siphash_key_t *key); -#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS u64 __siphash_unaligned (const void *data,size_t len,const siphash_key_t *key); -#endif u64 siphash_1u64 (const u64 a,const siphash_key_t *key);u64 siphash_2u64 (const u64 a,const u64 b,const siphash_key_t *key);
@@ -82,10 +80,9 @@ static inline u64 ___siphash_aligned(constatic inline u64 siphash (const void *data,size_t len,const siphash_key_t *key) { -#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -if (!IS_ALIGNED ((unsigned long )data,SIPHASH_ALIGNMENT )) +if (IS_ENABLED (CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS ) || + !IS_ALIGNED ((unsigned long )data,SIPHASH_ALIGNMENT ))return __siphash_unaligned (data, len, key); -#endif return ___siphash_aligned (data, len, key); }
@@ -96,10 +93,8 @@ typedef struct {u32 __hsiphash_aligned (const void *data,size_t len,const hsiphash_key_t *key); -#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS u32 __hsiphash_unaligned (const void *data,size_t len,const hsiphash_key_t *key); -#endif u32 hsiphash_1u32 (const u32 a,const hsiphash_key_t *key);u32 hsiphash_2u32 (const u32 a,const u32 b,const hsiphash_key_t *key);
@@ -135,10 +130,9 @@ static inline u32 ___hsiphash_aligned(costatic inline u32 hsiphash (const void *data,size_t len,const hsiphash_key_t *key) { -#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -if (!IS_ALIGNED ((unsigned long )data,HSIPHASH_ALIGNMENT )) +if (IS_ENABLED (CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS ) || + !IS_ALIGNED ((unsigned long )data,HSIPHASH_ALIGNMENT ))return __hsiphash_unaligned (data, len, key); -#endif return ___hsiphash_aligned (data, len, key); }
lib/siphash.c +6 -6
@@ -49,6 +49,7 @@SIPROUND ; \return (v0 ^ v1) ^ (v2 ^ v3); +#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS u64 __siphash_aligned (const void *data,size_t len,const siphash_key_t *key) {const u8 *end = data + len - (len %sizeof (u64));
@@ -80,8 +81,8 @@ u64 __siphash_aligned(const void *data,POSTAMBLE }EXPORT_SYMBOL (__siphash_aligned ); +#endif -#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS u64 __siphash_unaligned (const void *data,size_t len,const siphash_key_t *key) {const u8 *end = data + len - (len %sizeof (u64));
@@ -113,7 +114,6 @@ u64 __siphash_unaligned(const void *data POSTAMBLE }EXPORT_SYMBOL (__siphash_unaligned); -#endif /** * siphash_1u64 - compute 64-bit siphash PRF value of a u64
@@ -250,6 +250,7 @@ EXPORT_SYMBOL(siphash_3u32);HSIPROUND ; \return (v0 ^ v1) ^ (v2 ^ v3); +#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS u32 __hsiphash_aligned (const void *data,size_t len,const hsiphash_key_t *key) {const u8 *end = data + len - (len %sizeof (u64));
@@ -280,8 +281,8 @@ u32 __hsiphash_aligned(const void *data,HPOSTAMBLE }EXPORT_SYMBOL (__hsiphash_aligned ); +#endif -#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS u32 __hsiphash_unaligned (const void *data,size_t len,const hsiphash_key_t *key) {
@@ -313,7 +314,6 @@ u32 __hsiphash_unaligned(const void *dat HPOSTAMBLE }EXPORT_SYMBOL (__hsiphash_unaligned); -#endif /** * hsiphash_1u32 - compute 64-bit hsiphash PRF value of a u32
@@ -418,6 +418,7 @@ EXPORT_SYMBOL(hsiphash_4u32);HSIPROUND ; \return v1 ^ v3; +#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS u32 __hsiphash_aligned (const void *data,size_t len,const hsiphash_key_t *key) {const u8 *end = data + len - (len %sizeof (u32));
@@ -438,8 +439,8 @@ u32 __hsiphash_aligned(const void *data,HPOSTAMBLE }EXPORT_SYMBOL (__hsiphash_aligned ); +#endif -#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS u32 __hsiphash_unaligned (const void *data,size_t len,const hsiphash_key_t *key) {
@@ -461,7 +462,6 @@ u32 __hsiphash_unaligned(const void *dat HPOSTAMBLE }EXPORT_SYMBOL (__hsiphash_unaligned); -#endif /** * hsiphash_1u32 - compute 32-bit hsiphash PRF value of a u32
Greg Kroah-Hartman
maintainerPATCH 70/130 arm64: ftrace: add missing BTIs
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
commit 35b6b28e69985eafb20b3b2c7bd6eca452b56b53 upstream.
When branch target identifiers are in use, code reachable via an indirect branch requires a BTI landing pad at the branch target site.
When building FTRACE_WITH_REGS atop patchable-function-entry, we miss BTIs at the start start of the ftrace_caller and ftrace_regs_caller trampolines, and when these are called from a module via a PLT (which will use a BR X16), we will encounter a BTI failure, e.g.
| # insmod lkdtm.ko | lkdtm: No crash points registered, enable through debugfs | # echo function_graph > /sys/kernel/debug/tracing/current_tracer | # cat /sys/kernel/debug/provoke-crash/DIRECT | Unhandled 64-bit el1h sync exception on CPU0, ESR 0x34000001 -- BTI | CPU: 0 PID: 174 Comm: cat Not tainted 5.16.0-rc2-dirty #3 | Hardware name: linux,dummy-virt (DT) | pstate: 60400405 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=jc) | pc : ftrace_caller+0x0/0x3c | lr : lkdtm_debugfs_open+0xc/0x20 [lkdtm] | sp : ffff800012e43b00 | x29: ffff800012e43b00 x28: 0000000000000000 x27: ffff800012e43c88 | x26: 0000000000000000 x25: 0000000000000000 x24: ffff0000c171f200 | x23: ffff0000c27b1e00 x22: ffff0000c2265240 x21: ffff0000c23c8c30 | x20: ffff8000090ba380 x19: 0000000000000000 x18: 0000000000000000 | x17: 0000000000000000 x16: ffff80001002bb4c x15: 0000000000000000 | x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000900ff0 | x11: ffff0000c4166310 x10: ffff800012e43b00 x9 : ffff8000104f2384 | x8 : 0000000000000001 x7 : 0000000000000000 x6 : 000000000000003f | x5 : 0000000000000040 x4 : ffff800012e43af0 x3 : 0000000000000001 | x2 : ffff8000090b0000 x1 : ffff0000c171f200 x0 : ffff0000c23c8c30 | Kernel panic - not syncing: Unhandled exception | CPU: 0 PID: 174 Comm: cat Not tainted 5.16.0-rc2-dirty #3 | Hardware name: linux,dummy-virt (DT) | Call trace: | dump_backtrace+0x0/0x1a4 | show_stack+0x24/0x30 | dump_stack_lvl+0x68/0x84 | dump_stack+0x1c/0x38 | panic+0x168/0x360 | arm64_exit_nmi.isra.0+0x0/0x80 | el1h_64_sync_handler+0x68/0xd4 | el1h_64_sync+0x78/0x7c | ftrace_caller+0x0/0x3c | do_dentry_open+0x134/0x3b0 | vfs_open+0x38/0x44 | path_openat+0x89c/0xe40 | do_filp_open+0x8c/0x13c | do_sys_openat2+0xbc/0x174 | __arm64_sys_openat+0x6c/0xbc | invoke_syscall+0x50/0x120 | el0_svc_common.constprop.0+0xdc/0x100 | do_el0_svc+0x84/0xa0 | el0_svc+0x28/0x80 | el0t_64_sync_handler+0xa8/0x130 | el0t_64_sync+0x1a0/0x1a4 | SMP: stopping secondary CPUs | Kernel Offset: disabled | CPU features: 0x0,00000f42,da660c5f | Memory Limit: none | ---[ end Kernel panic - not syncing: Unhandled exception ]---
Fix this by adding the required BTI C, as we only require these to be reachable via BL for direct calls or BR X16/X17 for PLTs. For now, these are open-coded in the function prologue, matching the style of the __hwasan_tag_mismatch trampoline.
In future we may wish to consider adding a new SYM_CODE_START_*() variant which has an implicit BTI.
When ftrace is built atop mcount, the trampolines are marked with SYM_FUNC_START(), and so get an implicit BTI. We may need to change these over to SYM_CODE_START() in future for RELIABLE_STACKTRACE, in case we need to apply special care aroud the return address being rewritten.
--- arch/arm64/kernel/entry-ftrace.S | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm64/kernel/entry-ftrace.S +6 -0
@@ -77,11 +77,17 @@ .endm SYM_CODE_START(ftrace_regs_caller) +#ifdef BTI_C + BTI_C +#endif ftrace_regs_entry 1 b ftrace_common SYM_CODE_END(ftrace_regs_caller) SYM_CODE_START(ftrace_caller) +#ifdef BTI_C + BTI_C +#endif ftrace_regs_entry 0 b ftrace_common SYM_CODE_END(ftrace_caller)
Greg Kroah-Hartman
maintainerPATCH 71/130 net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
In reply to Greg Kroah-HartmanFrom: Zhou Qingyang <[email protected]>
commit addad7643142f500080417dd7272f49b7a185570 upstream.
In mlx4_en_try_alloc_resources(), mlx4_en_copy_priv() is called and tmp->tx_cq will be freed on the error path of mlx4_en_copy_priv(). After that mlx4_en_alloc_resources() is called and there is a dereference of &tmp->tx_cq[t][i] in mlx4_en_alloc_resources(), which could lead to a use after free problem on failure of mlx4_en_copy_priv().
Fix this bug by adding a check of mlx4_en_copy_priv()
This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs.
Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug.
Builds with CONFIG_MLX4_EN=m show no new warnings, and our static analyzer no longer warns about this code.
--- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx4/en_netdev.c +7 -2
@@ -2276,9 +2276,14 @@ int mlx4_en_try_alloc_resources(struct m bool carry_xdp_prog) {struct bpf_prog *xdp_prog; -int i, t; +int i, t, ret; -mlx4_en_copy_priv (tmp, priv, prof); + ret =mlx4_en_copy_priv (tmp, priv, prof); +if (ret) { +en_warn (priv,"%s: mlx4_en_copy_priv() failed, return\n" , + __func__); +return ret; + }if (mlx4_en_alloc_resources (tmp)) { en_warn(priv,
Greg Kroah-Hartman
maintainerPATCH 72/130 selftests: net: Correct case name
In reply to Greg Kroah-HartmanFrom: Li Zhijian <[email protected]>
commit a05431b22be819d75db72ca3d44381d18a37b092 upstream.
ipv6_addr_bind/ipv4_addr_bind are function names. Previously, bind test would not be run by default due to the wrong case names
--- tools/testing/selftests/net/fcnal-test.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/net/fcnal-test.sh +2 -2
@@ -3911,8 +3911,8 @@ EOF ################################################################################ # main -TESTS_IPV4="ipv4_ping ipv4_tcp ipv4_udp ipv4_addr_bind ipv4_runtime ipv4_netfilter" -TESTS_IPV6="ipv6_ping ipv6_tcp ipv6_udp ipv6_addr_bind ipv6_runtime ipv6_netfilter" +TESTS_IPV4="ipv4_ping ipv4_tcp ipv4_udp ipv4_bind ipv4_runtime ipv4_netfilter" +TESTS_IPV6="ipv6_ping ipv6_tcp ipv6_udp ipv6_bind ipv6_runtime ipv6_netfilter" TESTS_OTHER="use_cases" PAUSE_ON_FAIL=no
Greg Kroah-Hartman
maintainerPATCH 73/130 mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
commit 6e53d6d26920d5221d3f4d4f5ffdd629ea69aa5c upstream.
Fix the following NULL pointer dereference in mt7915_get_phy_mode routine adding an ibss interface to the mt7915 driver.
[ 101.137097] wlan0: Trigger new scan to find an IBSS to join [ 102.827039] wlan0: Creating new IBSS network, BSSID 26:a4:50:1a:6e:69 [ 103.064756] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 103.073670] Mem abort info: [ 103.076520] ESR = 0x96000005 [ 103.079614] EC = 0x25: DABT (current EL), IL = 32 bits [ 103.084934] SET = 0, FnV = 0 [ 103.088042] EA = 0, S1PTW = 0 [ 103.091215] Data abort info: [ 103.094104] ISV = 0, ISS = 0x00000005 [ 103.098041] CM = 0, WnR = 0 [ 103.101044] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000460b1000 [ 103.107565] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 103.116590] Internal error: Oops: 96000005 [#1] SMP [ 103.189066] CPU: 1 PID: 333 Comm: kworker/u4:3 Not tainted 5.10.75 #0 [ 103.195498] Hardware name: MediaTek MT7622 RFB1 board (DT) [ 103.201124] Workqueue: phy0 ieee80211_iface_work [mac80211] [ 103.206695] pstate: 20000005 (nzCv daif -PAN -UAO -TCO BTYPE=--) [ 103.212705] pc : mt7915_get_phy_mode+0x68/0x120 [mt7915e] [ 103.218103] lr : mt7915_mcu_add_bss_info+0x11c/0x760 [mt7915e] [ 103.223927] sp : ffffffc011cdb9e0 [ 103.227235] x29: ffffffc011cdb9e0 x28: ffffff8006563098 [ 103.232545] x27: ffffff8005f4da22 x26: ffffff800685ac40 [ 103.237855] x25: 0000000000000001 x24: 000000000000011f [ 103.243165] x23: ffffff8005f4e260 x22: ffffff8006567918 [ 103.248475] x21: ffffff8005f4df80 x20: ffffff800685ac58 [ 103.253785] x19: ffffff8006744400 x18: 0000000000000000 [ 103.259094] x17: 0000000000000000 x16: 0000000000000001 [ 103.264403] x15: 000899c3a2d9d2e4 x14: 000899bdc3c3a1c8 [ 103.269713] x13: 0000000000000000 x12: 0000000000000000 [ 103.275024] x11: ffffffc010e30c20 x10: 0000000000000000 [ 103.280333] x9 : 0000000000000050 x8 : ffffff8006567d88 [ 103.285642] x7 : ffffff8006563b5c x6 : ffffff8006563b44 [ 103.290952] x5 : 0000000000000002 x4 : 0000000000000001 [ 103.296262] x3 : 0000000000000001 x2 : 0000000000000001 [ 103.301572] x1 : 0000000000000000 x0 : 0000000000000011 [ 103.306882] Call trace: [ 103.309328] mt7915_get_phy_mode+0x68/0x120 [mt7915e] [ 103.314378] mt7915_bss_info_changed+0x198/0x200 [mt7915e] [ 103.319941] ieee80211_bss_info_change_notify+0x128/0x290 [mac80211] [ 103.326360] __ieee80211_sta_join_ibss+0x308/0x6c4 [mac80211] [ 103.332171] ieee80211_sta_create_ibss+0x8c/0x10c [mac80211] [ 103.337895] ieee80211_ibss_work+0x3dc/0x614 [mac80211] [ 103.343185] ieee80211_iface_work+0x388/0x3f0 [mac80211] [ 103.348495] process_one_work+0x288/0x690 [ 103.352499] worker_thread+0x70/0x464 [ 103.356157] kthread+0x144/0x150 [ 103.359380] ret_from_fork+0x10/0x18 [ 103.362952] Code: 394008c3 52800220 394000e4 7100007f (39400023)
--- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +2 -2
@@ -182,7 +182,7 @@ mt7915_get_phy_mode(struct mt7915_dev *dif (ht_cap->ht_supported) mode |=PHY_MODE_GN ; -if (he_cap->has_he) +if (he_cap && he_cap->has_he) mode |=PHY_MODE_AX_24G ; }else if (band ==NL80211_BAND_5GHZ ) { mode |=PHY_MODE_A ;
@@ -193,7 +193,7 @@ mt7915_get_phy_mode(struct mt7915_dev *dif (vht_cap->vht_supported) mode |=PHY_MODE_AC ; -if (he_cap->has_he) +if (he_cap && he_cap->has_he) mode |=PHY_MODE_AX_5G ; }
Greg Kroah-Hartman
maintainerPATCH 74/130 ASoC: tegra: Fix wrong value type in ADMAIF
In reply to Greg Kroah-HartmanFrom: Sameer Pujar <[email protected]>
commit 884c6cb3b7030f75c46e55b9e625d2372708c306 upstream.
The enum controls are expected to use enumerated value type. Update relevant references in control get/put callbacks.
--- sound/soc/tegra/tegra210_admaif.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/tegra/tegra210_admaif.c +2 -2
@@ -430,7 +430,7 @@ static int tegra_admaif_get_control(strustruct snd_soc_component *cmpnt =snd_soc_kcontrol_component (kcontrol);struct soc_enum *ec = (struct soc_enum *)kcontrol->private_value;struct tegra_admaif *admaif =snd_soc_component_get_drvdata (cmpnt); -long *uctl_val = &ucontrol->value.integer.value[0 ]; +unsigned int *uctl_val = &ucontrol->value.enumerated.item[0 ];if (strstr (kcontrol->id.name,"Playback Mono To Stereo" )) *uctl_val = admaif->mono_to_stereo[ADMAIF_TX_PATH ][ec->reg];
@@ -450,7 +450,7 @@ static int tegra_admaif_put_control(strustruct snd_soc_component *cmpnt =snd_soc_kcontrol_component (kcontrol);struct soc_enum *ec = (struct soc_enum *)kcontrol->private_value;struct tegra_admaif *admaif =snd_soc_component_get_drvdata (cmpnt); -int value = ucontrol->value.integer.value[0 ]; +unsigned int value = ucontrol->value.enumerated.item[0 ];if (strstr (kcontrol->id.name,"Playback Mono To Stereo" )) admaif->mono_to_stereo[ADMAIF_TX_PATH ][ec->reg] = value;
Greg Kroah-Hartman
maintainerPATCH 75/130 ASoC: tegra: Fix wrong value type in I2S
In reply to Greg Kroah-HartmanFrom: Sameer Pujar <[email protected]>
commit 8a2c2fa0c5331445c801e9241f2bb4e0e2a895a8 upstream.
The enum controls are expected to use enumerated value type. Update relevant references in control get/put callbacks.
--- sound/soc/tegra/tegra210_i2s.c | 42 +++++++++++++++++++++++------------------ 1 file changed, 24 insertions(+), 18 deletions(-)
sound/soc/tegra/tegra210_i2s.c +24 -18
@@ -317,24 +317,27 @@ static int tegra210_i2s_get_control(stru {struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol);struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); -long *uctl_val = &ucontrol->value.integer.value[0 ];if (strstr (kcontrol->id.name,"Loopback" )) - *uctl_val = i2s->loopback; + ucontrol->value.integer.value[0 ] = i2s->loopback;else if (strstr (kcontrol->id.name,"FSYNC Width" )) - *uctl_val = i2s->fsync_width; + ucontrol->value.integer.value[0 ] = i2s->fsync_width;else if (strstr (kcontrol->id.name,"Capture Stereo To Mono" )) - *uctl_val = i2s->stereo_to_mono[I2S_TX_PATH ]; + ucontrol->value.enumerated.item[0 ] = + i2s->stereo_to_mono[I2S_TX_PATH ];else if (strstr (kcontrol->id.name,"Capture Mono To Stereo" )) - *uctl_val = i2s->mono_to_stereo[I2S_TX_PATH ]; + ucontrol->value.enumerated.item[0 ] = + i2s->mono_to_stereo[I2S_TX_PATH ];else if (strstr (kcontrol->id.name,"Playback Stereo To Mono" )) - *uctl_val = i2s->stereo_to_mono[I2S_RX_PATH ]; + ucontrol->value.enumerated.item[0 ] = + i2s->stereo_to_mono[I2S_RX_PATH ];else if (strstr (kcontrol->id.name,"Playback Mono To Stereo" )) - *uctl_val = i2s->mono_to_stereo[I2S_RX_PATH ]; + ucontrol->value.enumerated.item[0 ] = + i2s->mono_to_stereo[I2S_RX_PATH ];else if (strstr (kcontrol->id.name,"Playback FIFO Threshold" )) - *uctl_val = i2s->rx_fifo_th; + ucontrol->value.integer.value[0 ] = i2s->rx_fifo_th;else if (strstr (kcontrol->id.name,"BCLK Ratio" )) - *uctl_val = i2s->bclk_ratio; + ucontrol->value.integer.value[0 ] = i2s->bclk_ratio;return 0 ; }
@@ -344,10 +347,9 @@ static int tegra210_i2s_put_control(stru {struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol);struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); -int value = ucontrol->value.integer.value[0 ];if (strstr (kcontrol->id.name,"Loopback" )) { - i2s->loopback = value; + i2s->loopback = ucontrol->value.integer.value[0 ]; regmap_update_bits(i2s->regmap, TEGRA210_I2S_CTRL, I2S_CTRL_LPBK_MASK,
@@ -362,24 +364,28 @@ static int tegra210_i2s_put_control(stru* cases mixer control is used to update custom values. A value * of "N" here means, width is "N + 1" bit clock wide. */ - i2s->fsync_width = value; + i2s->fsync_width = ucontrol->value.integer.value[0 ];regmap_update_bits (i2s->regmap,TEGRA210_I2S_CTRL ,I2S_CTRL_FSYNC_WIDTH_MASK , i2s->fsync_width <<I2S_FSYNC_WIDTH_SHIFT ); }else if (strstr (kcontrol->id.name,"Capture Stereo To Mono" )) { - i2s->stereo_to_mono[I2S_TX_PATH ] = value; + i2s->stereo_to_mono[I2S_TX_PATH ] = + ucontrol->value.enumerated.item[0 ]; }else if (strstr (kcontrol->id.name,"Capture Mono To Stereo" )) { - i2s->mono_to_stereo[I2S_TX_PATH ] = value; + i2s->mono_to_stereo[I2S_TX_PATH ] = + ucontrol->value.enumerated.item[0 ]; }else if (strstr (kcontrol->id.name,"Playback Stereo To Mono" )) { - i2s->stereo_to_mono[I2S_RX_PATH ] = value; + i2s->stereo_to_mono[I2S_RX_PATH ] = + ucontrol->value.enumerated.item[0 ]; }else if (strstr (kcontrol->id.name,"Playback Mono To Stereo" )) { - i2s->mono_to_stereo[I2S_RX_PATH ] = value; + i2s->mono_to_stereo[I2S_RX_PATH ] = + ucontrol->value.enumerated.item[0 ]; }else if (strstr (kcontrol->id.name,"Playback FIFO Threshold" )) { - i2s->rx_fifo_th = value; + i2s->rx_fifo_th = ucontrol->value.integer.value[0 ]; }else if (strstr (kcontrol->id.name,"BCLK Ratio" )) { - i2s->bclk_ratio = value; + i2s->bclk_ratio = ucontrol->value.integer.value[0 ]; }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 76/130 ASoC: tegra: Fix wrong value type in DMIC
In reply to Greg Kroah-HartmanFrom: Sameer Pujar <[email protected]>
commit 559d234569a998a4004de1bd1f12da5487fb826e upstream.
The enum controls are expected to use enumerated value type. Update relevant references in control get/put callbacks.
--- sound/soc/tegra/tegra210_dmic.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-)
sound/soc/tegra/tegra210_dmic.c +11 -12
@@ -165,15 +165,15 @@ static int tegra210_dmic_get_control(strif (strstr (kcontrol->id.name,"Boost Gain Volume" )) ucontrol->value.integer.value[0 ] = dmic->boost_gain;else if (strstr (kcontrol->id.name,"Channel Select" )) - ucontrol->value.integer.value[0 ] = dmic->ch_select; + ucontrol->value.enumerated.item[0 ] = dmic->ch_select;else if (strstr (kcontrol->id.name,"Mono To Stereo" )) - ucontrol->value.integer.value[0 ] = dmic->mono_to_stereo; + ucontrol->value.enumerated.item[0 ] = dmic->mono_to_stereo;else if (strstr (kcontrol->id.name,"Stereo To Mono" )) - ucontrol->value.integer.value[0 ] = dmic->stereo_to_mono; + ucontrol->value.enumerated.item[0 ] = dmic->stereo_to_mono;else if (strstr (kcontrol->id.name,"OSR Value" )) - ucontrol->value.integer.value[0 ] = dmic->osr_val; + ucontrol->value.enumerated.item[0 ] = dmic->osr_val;else if (strstr (kcontrol->id.name,"LR Polarity Select" )) - ucontrol->value.integer.value[0 ] = dmic->lrsel; + ucontrol->value.enumerated.item[0 ] = dmic->lrsel;return 0 ; }
@@ -183,20 +183,19 @@ static int tegra210_dmic_put_control(str {struct snd_soc_component *comp =snd_soc_kcontrol_component (kcontrol);struct tegra210_dmic *dmic =snd_soc_component_get_drvdata (comp); -int value = ucontrol->value.integer.value[0 ];if (strstr (kcontrol->id.name,"Boost Gain Volume" )) - dmic->boost_gain = value; + dmic->boost_gain = ucontrol->value.integer.value[0 ];else if (strstr (kcontrol->id.name,"Channel Select" )) - dmic->ch_select = ucontrol->value.integer.value[0 ]; + dmic->ch_select = ucontrol->value.enumerated.item[0 ];else if (strstr (kcontrol->id.name,"Mono To Stereo" )) - dmic->mono_to_stereo = value; + dmic->mono_to_stereo = ucontrol->value.enumerated.item[0 ];else if (strstr (kcontrol->id.name,"Stereo To Mono" )) - dmic->stereo_to_mono = value; + dmic->stereo_to_mono = ucontrol->value.enumerated.item[0 ];else if (strstr (kcontrol->id.name,"OSR Value" )) - dmic->osr_val = value; + dmic->osr_val = ucontrol->value.enumerated.item[0 ];else if (strstr (kcontrol->id.name,"LR Polarity Select" )) - dmic->lrsel = value; + dmic->lrsel = ucontrol->value.enumerated.item[0 ];return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 77/130 ASoC: tegra: Fix wrong value type in DSPK
In reply to Greg Kroah-HartmanFrom: Sameer Pujar <[email protected]>
commit 3aa0d5c8bb3f5ef622ec2764823f551a1f630711 upstream.
The enum controls are expected to use enumerated value type. Update relevant references in control get/put callbacks.
--- sound/soc/tegra/tegra186_dspk.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-)
sound/soc/tegra/tegra186_dspk.c +11 -12
@@ -35,15 +35,15 @@ static int tegra186_dspk_get_control(strif (strstr (kcontrol->id.name,"FIFO Threshold" )) ucontrol->value.integer.value[0 ] = dspk->rx_fifo_th;else if (strstr (kcontrol->id.name,"OSR Value" )) - ucontrol->value.integer.value[0 ] = dspk->osr_val; + ucontrol->value.enumerated.item[0 ] = dspk->osr_val;else if (strstr (kcontrol->id.name,"LR Polarity Select" )) - ucontrol->value.integer.value[0 ] = dspk->lrsel; + ucontrol->value.enumerated.item[0 ] = dspk->lrsel;else if (strstr (kcontrol->id.name,"Channel Select" )) - ucontrol->value.integer.value[0 ] = dspk->ch_sel; + ucontrol->value.enumerated.item[0 ] = dspk->ch_sel;else if (strstr (kcontrol->id.name,"Mono To Stereo" )) - ucontrol->value.integer.value[0 ] = dspk->mono_to_stereo; + ucontrol->value.enumerated.item[0 ] = dspk->mono_to_stereo;else if (strstr (kcontrol->id.name,"Stereo To Mono" )) - ucontrol->value.integer.value[0 ] = dspk->stereo_to_mono; + ucontrol->value.enumerated.item[0 ] = dspk->stereo_to_mono;return 0 ; }
@@ -53,20 +53,19 @@ static int tegra186_dspk_put_control(str {struct snd_soc_component *codec =snd_soc_kcontrol_component (kcontrol);struct tegra186_dspk *dspk =snd_soc_component_get_drvdata (codec); -int val = ucontrol->value.integer.value[0 ];if (strstr (kcontrol->id.name,"FIFO Threshold" )) - dspk->rx_fifo_th = val; + dspk->rx_fifo_th = ucontrol->value.integer.value[0 ];else if (strstr (kcontrol->id.name,"OSR Value" )) - dspk->osr_val = val; + dspk->osr_val = ucontrol->value.enumerated.item[0 ];else if (strstr (kcontrol->id.name,"LR Polarity Select" )) - dspk->lrsel = val; + dspk->lrsel = ucontrol->value.enumerated.item[0 ];else if (strstr (kcontrol->id.name,"Channel Select" )) - dspk->ch_sel = val; + dspk->ch_sel = ucontrol->value.enumerated.item[0 ];else if (strstr (kcontrol->id.name,"Mono To Stereo" )) - dspk->mono_to_stereo = val; + dspk->mono_to_stereo = ucontrol->value.enumerated.item[0 ];else if (strstr (kcontrol->id.name,"Stereo To Mono" )) - dspk->stereo_to_mono = val; + dspk->stereo_to_mono = ucontrol->value.enumerated.item[0 ];return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 78/130 ASoC: tegra: Fix kcontrol put callback in ADMAIF
In reply to Greg Kroah-HartmanFrom: Sameer Pujar <[email protected]>
commit e2b87a18a60c02d0dcd1de801d669587e516cc4d upstream.
The kcontrol put callback is expected to return 1 when there is change in HW or when the update is acknowledged by driver. This would ensure that change notifications are sent to subscribed applications. Update the ADMAIF driver accordingly.
--- sound/soc/tegra/tegra210_admaif.c | 138 ++++++++++++++++++++++++++++++-------- 1 file changed, 109 insertions(+), 29 deletions(-)
sound/soc/tegra/tegra210_admaif.c +109 -29
@@ -424,46 +424,122 @@ static const struct snd_soc_dai_ops tegr .trigger = tegra_admaif_trigger, }; -static int tegra_admaif_get_control (struct snd_kcontrol *kcontrol, -struct snd_ctl_elem_value *ucontrol) +static int tegra210_admaif_pget_mono_to_stereo (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) {struct snd_soc_component *cmpnt =snd_soc_kcontrol_component (kcontrol); +struct tegra_admaif *admaif =snd_soc_component_get_drvdata (cmpnt);struct soc_enum *ec = (struct soc_enum *)kcontrol->private_value; + + ucontrol->value.enumerated.item[0 ] = + admaif->mono_to_stereo[ADMAIF_TX_PATH ][ec->reg]; + +return 0 ; +} + +static int tegra210_admaif_pput_mono_to_stereo (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *cmpnt =snd_soc_kcontrol_component (kcontrol);struct tegra_admaif *admaif =snd_soc_component_get_drvdata (cmpnt); -unsigned int *uctl_val = &ucontrol->value.enumerated.item[0 ]; +struct soc_enum *ec = (struct soc_enum *)kcontrol->private_value; +unsigned int value = ucontrol->value.enumerated.item[0 ]; -if (strstr (kcontrol->id.name,"Playback Mono To Stereo" )) - *uctl_val = admaif->mono_to_stereo[ADMAIF_TX_PATH ][ec->reg]; -else if (strstr (kcontrol->id.name,"Capture Mono To Stereo" )) - *uctl_val = admaif->mono_to_stereo[ADMAIF_RX_PATH ][ec->reg]; -else if (strstr (kcontrol->id.name,"Playback Stereo To Mono" )) - *uctl_val = admaif->stereo_to_mono[ADMAIF_TX_PATH ][ec->reg]; -else if (strstr (kcontrol->id.name,"Capture Stereo To Mono" )) - *uctl_val = admaif->stereo_to_mono[ADMAIF_RX_PATH ][ec->reg]; +if (value == admaif->mono_to_stereo[ADMAIF_TX_PATH ][ec->reg]) +return 0 ; + + admaif->mono_to_stereo[ADMAIF_TX_PATH ][ec->reg] = value; + +return 1 ; +} + +static int tegra210_admaif_cget_mono_to_stereo (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *cmpnt =snd_soc_kcontrol_component (kcontrol); +struct tegra_admaif *admaif =snd_soc_component_get_drvdata (cmpnt); +struct soc_enum *ec = (struct soc_enum *)kcontrol->private_value; + + ucontrol->value.enumerated.item[0 ] = + admaif->mono_to_stereo[ADMAIF_RX_PATH ][ec->reg];return 0 ; } -static int tegra_admaif_put_control (struct snd_kcontrol *kcontrol, -struct snd_ctl_elem_value *ucontrol) +static int tegra210_admaif_cput_mono_to_stereo (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) {struct snd_soc_component *cmpnt =snd_soc_kcontrol_component (kcontrol); +struct tegra_admaif *admaif =snd_soc_component_get_drvdata (cmpnt);struct soc_enum *ec = (struct soc_enum *)kcontrol->private_value; +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == admaif->mono_to_stereo[ADMAIF_RX_PATH ][ec->reg]) +return 0 ; + + admaif->mono_to_stereo[ADMAIF_RX_PATH ][ec->reg] = value; + +return 1 ; +} + +static int tegra210_admaif_pget_stereo_to_mono (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *cmpnt =snd_soc_kcontrol_component (kcontrol);struct tegra_admaif *admaif =snd_soc_component_get_drvdata (cmpnt); +struct soc_enum *ec = (struct soc_enum *)kcontrol->private_value; + + ucontrol->value.enumerated.item[0 ] = + admaif->stereo_to_mono[ADMAIF_TX_PATH ][ec->reg]; + +return 0 ; +} + +static int tegra210_admaif_pput_stereo_to_mono (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *cmpnt =snd_soc_kcontrol_component (kcontrol); +struct tegra_admaif *admaif =snd_soc_component_get_drvdata (cmpnt); +struct soc_enum *ec = (struct soc_enum *)kcontrol->private_value;unsigned int value = ucontrol->value.enumerated.item[0 ]; -if (strstr (kcontrol->id.name,"Playback Mono To Stereo" )) - admaif->mono_to_stereo[ADMAIF_TX_PATH ][ec->reg] = value; -else if (strstr (kcontrol->id.name,"Capture Mono To Stereo" )) - admaif->mono_to_stereo[ADMAIF_RX_PATH ][ec->reg] = value; -else if (strstr (kcontrol->id.name,"Playback Stereo To Mono" )) - admaif->stereo_to_mono[ADMAIF_TX_PATH ][ec->reg] = value; -else if (strstr (kcontrol->id.name,"Capture Stereo To Mono" )) - admaif->stereo_to_mono[ADMAIF_RX_PATH ][ec->reg] = value; +if (value == admaif->stereo_to_mono[ADMAIF_TX_PATH ][ec->reg]) +return 0 ; + + admaif->stereo_to_mono[ADMAIF_TX_PATH ][ec->reg] = value; + +return 1 ; +} + +static int tegra210_admaif_cget_stereo_to_mono (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *cmpnt =snd_soc_kcontrol_component (kcontrol); +struct tegra_admaif *admaif =snd_soc_component_get_drvdata (cmpnt); +struct soc_enum *ec = (struct soc_enum *)kcontrol->private_value; + + ucontrol->value.enumerated.item[0 ] = + admaif->stereo_to_mono[ADMAIF_RX_PATH ][ec->reg];return 0 ; } +static int tegra210_admaif_cput_stereo_to_mono (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *cmpnt =snd_soc_kcontrol_component (kcontrol); +struct tegra_admaif *admaif =snd_soc_component_get_drvdata (cmpnt); +struct soc_enum *ec = (struct soc_enum *)kcontrol->private_value; +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == admaif->stereo_to_mono[ADMAIF_RX_PATH ][ec->reg]) +return 0 ; + + admaif->stereo_to_mono[ADMAIF_RX_PATH ][ec->reg] = value; + +return 1 ; +} +static int tegra_admaif_dai_probe (struct snd_soc_dai *dai) {struct tegra_admaif *admaif =snd_soc_dai_get_drvdata (dai);
@@ -559,17 +635,21 @@ static const char * const tegra_admaif_m }#define TEGRA_ADMAIF_CIF_CTRL (reg) \ - NV_SOC_ENUM_EXT("ADMAIF" #reg " Playback Mono To Stereo", reg - 1,\ - tegra_admaif_get_control, tegra_admaif_put_control, \ + NV_SOC_ENUM_EXT("ADMAIF" #reg " Playback Mono To Stereo", reg - 1, \ + tegra210_admaif_pget_mono_to_stereo, \ + tegra210_admaif_pput_mono_to_stereo, \ tegra_admaif_mono_conv_text), \ - NV_SOC_ENUM_EXT("ADMAIF" #reg " Playback Stereo To Mono", reg - 1,\ - tegra_admaif_get_control, tegra_admaif_put_control, \ + NV_SOC_ENUM_EXT("ADMAIF" #reg " Playback Stereo To Mono", reg - 1, \ + tegra210_admaif_pget_stereo_to_mono, \ + tegra210_admaif_pput_stereo_to_mono, \ tegra_admaif_stereo_conv_text), \ - NV_SOC_ENUM_EXT("ADMAIF" #reg " Capture Mono To Stereo", reg - 1, \ - tegra_admaif_get_control, tegra_admaif_put_control, \ + NV_SOC_ENUM_EXT("ADMAIF" #reg " Capture Mono To Stereo", reg - 1, \ + tegra210_admaif_cget_mono_to_stereo, \ + tegra210_admaif_cput_mono_to_stereo, \ tegra_admaif_mono_conv_text), \ - NV_SOC_ENUM_EXT("ADMAIF" #reg " Capture Stereo To Mono", reg - 1, \ - tegra_admaif_get_control, tegra_admaif_put_control, \ + NV_SOC_ENUM_EXT("ADMAIF" #reg " Capture Stereo To Mono", reg - 1, \ + tegra210_admaif_cget_stereo_to_mono, \ + tegra210_admaif_cput_stereo_to_mono, \ tegra_admaif_stereo_conv_text)static struct snd_kcontrol_new tegra210_admaif_controls[] = {
Greg Kroah-Hartman
maintainerPATCH 79/130 ASoC: tegra: Fix kcontrol put callback in I2S
In reply to Greg Kroah-HartmanFrom: Sameer Pujar <[email protected]>
commit f21a9df3f7cb0005947679d7b9237c90574e229a upstream.
The kcontrol put callback is expected to return 1 when there is change in HW or when the update is acknowledged by driver. This would ensure that change notifications are sent to subscribed applications. Update the I2S driver accordingly.
--- sound/soc/tegra/tegra210_i2s.c | 322 ++++++++++++++++++++++++++++++----------- 1 file changed, 236 insertions(+), 86 deletions(-)
sound/soc/tegra/tegra210_i2s.c +236 -86
@@ -302,91 +302,235 @@ static int tegra210_i2s_set_tdm_slot(strreturn 0 ; } -static int tegra210_i2s_set_dai_bclk_ratio (struct snd_soc_dai *dai, -unsigned int ratio) +static int tegra210_i2s_get_loopback (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) { -struct tegra210_i2s *i2s =snd_soc_dai_get_drvdata (dai); +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); - i2s->bclk_ratio = ratio; + ucontrol->value.integer.value[0 ] = i2s->loopback;return 0 ; } -static int tegra210_i2s_get_control (struct snd_kcontrol *kcontrol, -struct snd_ctl_elem_value *ucontrol) +static int tegra210_i2s_put_loopback (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) {struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol);struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); +int value = ucontrol->value.integer.value[0 ]; -if (strstr (kcontrol->id.name,"Loopback" )) - ucontrol->value.integer.value[0 ] = i2s->loopback; -else if (strstr (kcontrol->id.name,"FSYNC Width" )) - ucontrol->value.integer.value[0 ] = i2s->fsync_width; -else if (strstr (kcontrol->id.name,"Capture Stereo To Mono" )) - ucontrol->value.enumerated.item[0 ] = - i2s->stereo_to_mono[I2S_TX_PATH ]; -else if (strstr (kcontrol->id.name,"Capture Mono To Stereo" )) - ucontrol->value.enumerated.item[0 ] = - i2s->mono_to_stereo[I2S_TX_PATH ]; -else if (strstr (kcontrol->id.name,"Playback Stereo To Mono" )) - ucontrol->value.enumerated.item[0 ] = - i2s->stereo_to_mono[I2S_RX_PATH ]; -else if (strstr (kcontrol->id.name,"Playback Mono To Stereo" )) - ucontrol->value.enumerated.item[0 ] = - i2s->mono_to_stereo[I2S_RX_PATH ]; -else if (strstr (kcontrol->id.name,"Playback FIFO Threshold" )) - ucontrol->value.integer.value[0 ] = i2s->rx_fifo_th; -else if (strstr (kcontrol->id.name,"BCLK Ratio" )) - ucontrol->value.integer.value[0 ] = i2s->bclk_ratio; - -return 0 ; -} - -static int tegra210_i2s_put_control (struct snd_kcontrol *kcontrol, -struct snd_ctl_elem_value *ucontrol) -{ -struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); -struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); - -if (strstr (kcontrol->id.name,"Loopback" )) { - i2s->loopback = ucontrol->value.integer.value[0 ]; - -regmap_update_bits (i2s->regmap,TEGRA210_I2S_CTRL , -I2S_CTRL_LPBK_MASK , - i2s->loopback <<I2S_CTRL_LPBK_SHIFT ); - - }else if (strstr (kcontrol->id.name,"FSYNC Width" )) { -/* -* Frame sync width is used only for FSYNC modes and not -* applicable for LRCK modes. Reset value for this field is "0", -* which means the width is one bit clock wide. -* The width requirement may depend on the codec and in such -* cases mixer control is used to update custom values. A value -* of "N" here means, width is "N + 1" bit clock wide. -*/ - i2s->fsync_width = ucontrol->value.integer.value[0 ]; - -regmap_update_bits (i2s->regmap,TEGRA210_I2S_CTRL , -I2S_CTRL_FSYNC_WIDTH_MASK , - i2s->fsync_width <<I2S_FSYNC_WIDTH_SHIFT ); - - }else if (strstr (kcontrol->id.name,"Capture Stereo To Mono" )) { - i2s->stereo_to_mono[I2S_TX_PATH ] = - ucontrol->value.enumerated.item[0 ]; - }else if (strstr (kcontrol->id.name,"Capture Mono To Stereo" )) { - i2s->mono_to_stereo[I2S_TX_PATH ] = - ucontrol->value.enumerated.item[0 ]; - }else if (strstr (kcontrol->id.name,"Playback Stereo To Mono" )) { - i2s->stereo_to_mono[I2S_RX_PATH ] = - ucontrol->value.enumerated.item[0 ]; - }else if (strstr (kcontrol->id.name,"Playback Mono To Stereo" )) { - i2s->mono_to_stereo[I2S_RX_PATH ] = - ucontrol->value.enumerated.item[0 ]; - }else if (strstr (kcontrol->id.name,"Playback FIFO Threshold" )) { - i2s->rx_fifo_th = ucontrol->value.integer.value[0 ]; - }else if (strstr (kcontrol->id.name,"BCLK Ratio" )) { - i2s->bclk_ratio = ucontrol->value.integer.value[0 ]; - } +if (value == i2s->loopback) +return 0 ; + + i2s->loopback = value; + +regmap_update_bits (i2s->regmap,TEGRA210_I2S_CTRL ,I2S_CTRL_LPBK_MASK , + i2s->loopback <<I2S_CTRL_LPBK_SHIFT ); + +return 1 ; +} + +static int tegra210_i2s_get_fsync_width (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); + + ucontrol->value.integer.value[0 ] = i2s->fsync_width; + +return 0 ; +} + +static int tegra210_i2s_put_fsync_width (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); +int value = ucontrol->value.integer.value[0 ]; + +if (value == i2s->fsync_width) +return 0 ; + + i2s->fsync_width = value; + +/* +* Frame sync width is used only for FSYNC modes and not +* applicable for LRCK modes. Reset value for this field is "0", +* which means the width is one bit clock wide. +* The width requirement may depend on the codec and in such +* cases mixer control is used to update custom values. A value +* of "N" here means, width is "N + 1" bit clock wide. +*/ +regmap_update_bits (i2s->regmap,TEGRA210_I2S_CTRL , +I2S_CTRL_FSYNC_WIDTH_MASK , + i2s->fsync_width <<I2S_FSYNC_WIDTH_SHIFT ); + +return 1 ; +} + +static int tegra210_i2s_cget_stereo_to_mono (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); + + ucontrol->value.enumerated.item[0 ] = i2s->stereo_to_mono[I2S_TX_PATH ]; + +return 0 ; +} + +static int tegra210_i2s_cput_stereo_to_mono (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == i2s->stereo_to_mono[I2S_TX_PATH ]) +return 0 ; + + i2s->stereo_to_mono[I2S_TX_PATH ] = value; + +return 1 ; +} + +static int tegra210_i2s_cget_mono_to_stereo (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); + + ucontrol->value.enumerated.item[0 ] = i2s->mono_to_stereo[I2S_TX_PATH ]; + +return 0 ; +} + +static int tegra210_i2s_cput_mono_to_stereo (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == i2s->mono_to_stereo[I2S_TX_PATH ]) +return 0 ; + + i2s->mono_to_stereo[I2S_TX_PATH ] = value; + +return 1 ; +} + +static int tegra210_i2s_pget_stereo_to_mono (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); + + ucontrol->value.enumerated.item[0 ] = i2s->stereo_to_mono[I2S_RX_PATH ]; + +return 0 ; +} + +static int tegra210_i2s_pput_stereo_to_mono (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == i2s->stereo_to_mono[I2S_RX_PATH ]) +return 0 ; + + i2s->stereo_to_mono[I2S_RX_PATH ] = value; + +return 1 ; +} + +static int tegra210_i2s_pget_mono_to_stereo (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); + + ucontrol->value.enumerated.item[0 ] = i2s->mono_to_stereo[I2S_RX_PATH ]; + +return 0 ; +} + +static int tegra210_i2s_pput_mono_to_stereo (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == i2s->mono_to_stereo[I2S_RX_PATH ]) +return 0 ; + + i2s->mono_to_stereo[I2S_RX_PATH ] = value; + +return 1 ; +} + +static int tegra210_i2s_pget_fifo_th (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); + + ucontrol->value.integer.value[0 ] = i2s->rx_fifo_th; + +return 0 ; +} + +static int tegra210_i2s_pput_fifo_th (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); +int value = ucontrol->value.integer.value[0 ]; + +if (value == i2s->rx_fifo_th) +return 0 ; + + i2s->rx_fifo_th = value; + +return 1 ; +} + +static int tegra210_i2s_get_bclk_ratio (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); + + ucontrol->value.integer.value[0 ] = i2s->bclk_ratio; + +return 0 ; +} + +static int tegra210_i2s_put_bclk_ratio (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *compnt =snd_soc_kcontrol_component (kcontrol); +struct tegra210_i2s *i2s =snd_soc_component_get_drvdata (compnt); +int value = ucontrol->value.integer.value[0 ]; + +if (value == i2s->bclk_ratio) +return 0 ; + + i2s->bclk_ratio = value; + +return 1 ; +} + +static int tegra210_i2s_set_dai_bclk_ratio (struct snd_soc_dai *dai, +unsigned int ratio) +{ +struct tegra210_i2s *i2s =snd_soc_dai_get_drvdata (dai); + + i2s->bclk_ratio = ratio;return 0 ; }
@@ -604,22 +748,28 @@ static const struct soc_enum tegra210_i2 tegra210_i2s_stereo_conv_text);static const struct snd_kcontrol_new tegra210_i2s_controls[] = { -SOC_SINGLE_EXT ("Loopback" ,0 ,0 ,1 ,0 , tegra210_i2s_get_control, - tegra210_i2s_put_control), -SOC_SINGLE_EXT ("FSYNC Width" ,0 ,0 ,255 ,0 , tegra210_i2s_get_control, - tegra210_i2s_put_control), +SOC_SINGLE_EXT ("Loopback" ,0 ,0 ,1 ,0 , tegra210_i2s_get_loopback, + tegra210_i2s_put_loopback), +SOC_SINGLE_EXT ("FSYNC Width" ,0 ,0 ,255 ,0 , + tegra210_i2s_get_fsync_width, + tegra210_i2s_put_fsync_width),SOC_ENUM_EXT ("Capture Stereo To Mono" , tegra210_i2s_stereo_conv_enum, - tegra210_i2s_get_control, tegra210_i2s_put_control), + tegra210_i2s_cget_stereo_to_mono, + tegra210_i2s_cput_stereo_to_mono),SOC_ENUM_EXT ("Capture Mono To Stereo" , tegra210_i2s_mono_conv_enum, - tegra210_i2s_get_control, tegra210_i2s_put_control), + tegra210_i2s_cget_mono_to_stereo, + tegra210_i2s_cput_mono_to_stereo),SOC_ENUM_EXT ("Playback Stereo To Mono" , tegra210_i2s_stereo_conv_enum, - tegra210_i2s_get_control, tegra210_i2s_put_control), + tegra210_i2s_pget_mono_to_stereo, + tegra210_i2s_pput_mono_to_stereo),SOC_ENUM_EXT ("Playback Mono To Stereo" , tegra210_i2s_mono_conv_enum, - tegra210_i2s_get_control, tegra210_i2s_put_control), + tegra210_i2s_pget_stereo_to_mono, + tegra210_i2s_pput_stereo_to_mono),SOC_SINGLE_EXT ("Playback FIFO Threshold" ,0 ,0 ,I2S_RX_FIFO_DEPTH -1 , -0 , tegra210_i2s_get_control, tegra210_i2s_put_control), -SOC_SINGLE_EXT ("BCLK Ratio" ,0 ,0 ,INT_MAX ,0 , tegra210_i2s_get_control, - tegra210_i2s_put_control), +0 , tegra210_i2s_pget_fifo_th, tegra210_i2s_pput_fifo_th), +SOC_SINGLE_EXT ("BCLK Ratio" ,0 ,0 ,INT_MAX ,0 , + tegra210_i2s_get_bclk_ratio, + tegra210_i2s_put_bclk_ratio), };static const struct snd_soc_dapm_widget tegra210_i2s_widgets[] = {
Greg Kroah-Hartman
maintainerPATCH 80/130 ASoC: tegra: Fix kcontrol put callback in DMIC
In reply to Greg Kroah-HartmanFrom: Sameer Pujar <[email protected]>
commit a347dfa10262fa0a10e2b1970ea0194e3d4a3251 upstream.
The kcontrol put callback is expected to return 1 when there is change in HW or when the update is acknowledged by driver. This would ensure that change notifications are sent to subscribed applications. Update the DMIC driver accordingly.
--- sound/soc/tegra/tegra210_dmic.c | 183 ++++++++++++++++++++++++++++++++-------- 1 file changed, 149 insertions(+), 34 deletions(-)
sound/soc/tegra/tegra210_dmic.c +149 -34
@@ -156,50 +156,162 @@ static int tegra210_dmic_hw_params(strucreturn 0 ; } -static int tegra210_dmic_get_control (struct snd_kcontrol *kcontrol, +static int tegra210_dmic_get_boost_gain (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *comp =snd_soc_kcontrol_component (kcontrol); +struct tegra210_dmic *dmic =snd_soc_component_get_drvdata (comp); + + ucontrol->value.integer.value[0 ] = dmic->boost_gain; + +return 0 ; +} + +static int tegra210_dmic_put_boost_gain (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *comp =snd_soc_kcontrol_component (kcontrol); +struct tegra210_dmic *dmic =snd_soc_component_get_drvdata (comp); +int value = ucontrol->value.integer.value[0 ]; + +if (value == dmic->boost_gain) +return 0 ; + + dmic->boost_gain = value; + +return 1 ; +} + +static int tegra210_dmic_get_ch_select (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *comp =snd_soc_kcontrol_component (kcontrol); +struct tegra210_dmic *dmic =snd_soc_component_get_drvdata (comp); + + ucontrol->value.enumerated.item[0 ] = dmic->ch_select; + +return 0 ; +} + +static int tegra210_dmic_put_ch_select (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *comp =snd_soc_kcontrol_component (kcontrol); +struct tegra210_dmic *dmic =snd_soc_component_get_drvdata (comp); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == dmic->ch_select) +return 0 ; + + dmic->ch_select = value; + +return 1 ; +} + +static int tegra210_dmic_get_mono_to_stereo (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *comp =snd_soc_kcontrol_component (kcontrol); +struct tegra210_dmic *dmic =snd_soc_component_get_drvdata (comp); + + ucontrol->value.enumerated.item[0 ] = dmic->mono_to_stereo; + +return 0 ; +} + +static int tegra210_dmic_put_mono_to_stereo (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *comp =snd_soc_kcontrol_component (kcontrol); +struct tegra210_dmic *dmic =snd_soc_component_get_drvdata (comp); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == dmic->mono_to_stereo) +return 0 ; + + dmic->mono_to_stereo = value; + +return 1 ; +} + +static int tegra210_dmic_get_stereo_to_mono (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *comp =snd_soc_kcontrol_component (kcontrol); +struct tegra210_dmic *dmic =snd_soc_component_get_drvdata (comp); + + ucontrol->value.enumerated.item[0 ] = dmic->stereo_to_mono; + +return 0 ; +} + +static int tegra210_dmic_put_stereo_to_mono (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *comp =snd_soc_kcontrol_component (kcontrol); +struct tegra210_dmic *dmic =snd_soc_component_get_drvdata (comp); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == dmic->stereo_to_mono) +return 0 ; + + dmic->stereo_to_mono = value; + +return 1 ; +} + +static int tegra210_dmic_get_osr_val (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_value *ucontrol) {struct snd_soc_component *comp =snd_soc_kcontrol_component (kcontrol);struct tegra210_dmic *dmic =snd_soc_component_get_drvdata (comp); -if (strstr (kcontrol->id.name,"Boost Gain Volume" )) - ucontrol->value.integer.value[0 ] = dmic->boost_gain; -else if (strstr (kcontrol->id.name,"Channel Select" )) - ucontrol->value.enumerated.item[0 ] = dmic->ch_select; -else if (strstr (kcontrol->id.name,"Mono To Stereo" )) - ucontrol->value.enumerated.item[0 ] = dmic->mono_to_stereo; -else if (strstr (kcontrol->id.name,"Stereo To Mono" )) - ucontrol->value.enumerated.item[0 ] = dmic->stereo_to_mono; -else if (strstr (kcontrol->id.name,"OSR Value" )) - ucontrol->value.enumerated.item[0 ] = dmic->osr_val; -else if (strstr (kcontrol->id.name,"LR Polarity Select" )) - ucontrol->value.enumerated.item[0 ] = dmic->lrsel; + ucontrol->value.enumerated.item[0 ] = dmic->osr_val;return 0 ; } -static int tegra210_dmic_put_control (struct snd_kcontrol *kcontrol, +static int tegra210_dmic_put_osr_val (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *comp =snd_soc_kcontrol_component (kcontrol); +struct tegra210_dmic *dmic =snd_soc_component_get_drvdata (comp); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == dmic->osr_val) +return 0 ; + + dmic->osr_val = value; + +return 1 ; +} + +static int tegra210_dmic_get_pol_sel (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_value *ucontrol) {struct snd_soc_component *comp =snd_soc_kcontrol_component (kcontrol);struct tegra210_dmic *dmic =snd_soc_component_get_drvdata (comp); -if (strstr (kcontrol->id.name,"Boost Gain Volume" )) - dmic->boost_gain = ucontrol->value.integer.value[0 ]; -else if (strstr (kcontrol->id.name,"Channel Select" )) - dmic->ch_select = ucontrol->value.enumerated.item[0 ]; -else if (strstr (kcontrol->id.name,"Mono To Stereo" )) - dmic->mono_to_stereo = ucontrol->value.enumerated.item[0 ]; -else if (strstr (kcontrol->id.name,"Stereo To Mono" )) - dmic->stereo_to_mono = ucontrol->value.enumerated.item[0 ]; -else if (strstr (kcontrol->id.name,"OSR Value" )) - dmic->osr_val = ucontrol->value.enumerated.item[0 ]; -else if (strstr (kcontrol->id.name,"LR Polarity Select" )) - dmic->lrsel = ucontrol->value.enumerated.item[0 ]; + ucontrol->value.enumerated.item[0 ] = dmic->lrsel;return 0 ; } +static int tegra210_dmic_put_pol_sel (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *comp =snd_soc_kcontrol_component (kcontrol); +struct tegra210_dmic *dmic =snd_soc_component_get_drvdata (comp); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == dmic->lrsel) +return 0 ; + + dmic->lrsel = value; + +return 1 ; +} +static const struct snd_soc_dai_ops tegra210_dmic_dai_ops = { .hw_params = tegra210_dmic_hw_params, };
@@ -286,19 +398,22 @@ static const struct soc_enum tegra210_dmstatic const struct snd_kcontrol_new tegra210_dmic_controls[] = {SOC_SINGLE_EXT ("Boost Gain Volume" ,0 ,0 ,MAX_BOOST_GAIN ,0 , - tegra210_dmic_get_control, tegra210_dmic_put_control), + tegra210_dmic_get_boost_gain, + tegra210_dmic_put_boost_gain),SOC_ENUM_EXT ("Channel Select" , tegra210_dmic_ch_enum, - tegra210_dmic_get_control, tegra210_dmic_put_control), + tegra210_dmic_get_ch_select, tegra210_dmic_put_ch_select),SOC_ENUM_EXT ("Mono To Stereo" , - tegra210_dmic_mono_conv_enum, tegra210_dmic_get_control, - tegra210_dmic_put_control), + tegra210_dmic_mono_conv_enum, + tegra210_dmic_get_mono_to_stereo, + tegra210_dmic_put_mono_to_stereo),SOC_ENUM_EXT ("Stereo To Mono" , - tegra210_dmic_stereo_conv_enum, tegra210_dmic_get_control, - tegra210_dmic_put_control), + tegra210_dmic_stereo_conv_enum, + tegra210_dmic_get_stereo_to_mono, + tegra210_dmic_put_stereo_to_mono),SOC_ENUM_EXT ("OSR Value" , tegra210_dmic_osr_enum, - tegra210_dmic_get_control, tegra210_dmic_put_control), + tegra210_dmic_get_osr_val, tegra210_dmic_put_osr_val),SOC_ENUM_EXT ("LR Polarity Select" , tegra210_dmic_lrsel_enum, - tegra210_dmic_get_control, tegra210_dmic_put_control), + tegra210_dmic_get_pol_sel, tegra210_dmic_put_pol_sel), };static const struct snd_soc_component_driver tegra210_dmic_compnt = {
Greg Kroah-Hartman
maintainerPATCH 81/130 ASoC: tegra: Fix kcontrol put callback in DSPK
In reply to Greg Kroah-HartmanFrom: Sameer Pujar <[email protected]>
commit d6202a57e79d102271d38c34481fedc9d4c79694 upstream.
The kcontrol put callback is expected to return 1 when there is change in HW or when the update is acknowledged by driver. This would ensure that change notifications are sent to subscribed applications. Update the DSPK driver accordingly.
--- sound/soc/tegra/tegra186_dspk.c | 178 ++++++++++++++++++++++++++++++++-------- 1 file changed, 146 insertions(+), 32 deletions(-)
sound/soc/tegra/tegra186_dspk.c +146 -32
@@ -26,50 +26,162 @@ static const struct reg_default tegra186 { TEGRA186_DSPK_CODEC_CTRL, 0x03000000 }, }; -static int tegra186_dspk_get_control (struct snd_kcontrol *kcontrol, +static int tegra186_dspk_get_fifo_th (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_value *ucontrol) {struct snd_soc_component *codec =snd_soc_kcontrol_component (kcontrol);struct tegra186_dspk *dspk =snd_soc_component_get_drvdata (codec); -if (strstr (kcontrol->id.name,"FIFO Threshold" )) - ucontrol->value.integer.value[0 ] = dspk->rx_fifo_th; -else if (strstr (kcontrol->id.name,"OSR Value" )) - ucontrol->value.enumerated.item[0 ] = dspk->osr_val; -else if (strstr (kcontrol->id.name,"LR Polarity Select" )) - ucontrol->value.enumerated.item[0 ] = dspk->lrsel; -else if (strstr (kcontrol->id.name,"Channel Select" )) - ucontrol->value.enumerated.item[0 ] = dspk->ch_sel; -else if (strstr (kcontrol->id.name,"Mono To Stereo" )) - ucontrol->value.enumerated.item[0 ] = dspk->mono_to_stereo; -else if (strstr (kcontrol->id.name,"Stereo To Mono" )) - ucontrol->value.enumerated.item[0 ] = dspk->stereo_to_mono; + ucontrol->value.integer.value[0 ] = dspk->rx_fifo_th;return 0 ; } -static int tegra186_dspk_put_control (struct snd_kcontrol *kcontrol, +static int tegra186_dspk_put_fifo_th (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_value *ucontrol) {struct snd_soc_component *codec =snd_soc_kcontrol_component (kcontrol);struct tegra186_dspk *dspk =snd_soc_component_get_drvdata (codec); +int value = ucontrol->value.integer.value[0 ]; -if (strstr (kcontrol->id.name,"FIFO Threshold" )) - dspk->rx_fifo_th = ucontrol->value.integer.value[0 ]; -else if (strstr (kcontrol->id.name,"OSR Value" )) - dspk->osr_val = ucontrol->value.enumerated.item[0 ]; -else if (strstr (kcontrol->id.name,"LR Polarity Select" )) - dspk->lrsel = ucontrol->value.enumerated.item[0 ]; -else if (strstr (kcontrol->id.name,"Channel Select" )) - dspk->ch_sel = ucontrol->value.enumerated.item[0 ]; -else if (strstr (kcontrol->id.name,"Mono To Stereo" )) - dspk->mono_to_stereo = ucontrol->value.enumerated.item[0 ]; -else if (strstr (kcontrol->id.name,"Stereo To Mono" )) - dspk->stereo_to_mono = ucontrol->value.enumerated.item[0 ]; +if (value == dspk->rx_fifo_th) +return 0 ; + + dspk->rx_fifo_th = value; + +return 1 ; +} + +static int tegra186_dspk_get_osr_val (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *codec =snd_soc_kcontrol_component (kcontrol); +struct tegra186_dspk *dspk =snd_soc_component_get_drvdata (codec); + + ucontrol->value.enumerated.item[0 ] = dspk->osr_val; + +return 0 ; +} + +static int tegra186_dspk_put_osr_val (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *codec =snd_soc_kcontrol_component (kcontrol); +struct tegra186_dspk *dspk =snd_soc_component_get_drvdata (codec); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == dspk->osr_val) +return 0 ; + + dspk->osr_val = value; + +return 1 ; +} + +static int tegra186_dspk_get_pol_sel (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *codec =snd_soc_kcontrol_component (kcontrol); +struct tegra186_dspk *dspk =snd_soc_component_get_drvdata (codec); + + ucontrol->value.enumerated.item[0 ] = dspk->lrsel; + +return 0 ; +} + +static int tegra186_dspk_put_pol_sel (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *codec =snd_soc_kcontrol_component (kcontrol); +struct tegra186_dspk *dspk =snd_soc_component_get_drvdata (codec); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == dspk->lrsel) +return 0 ; + + dspk->lrsel = value; + +return 1 ; +} + +static int tegra186_dspk_get_ch_sel (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *codec =snd_soc_kcontrol_component (kcontrol); +struct tegra186_dspk *dspk =snd_soc_component_get_drvdata (codec); + + ucontrol->value.enumerated.item[0 ] = dspk->ch_sel; + +return 0 ; +} + +static int tegra186_dspk_put_ch_sel (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *codec =snd_soc_kcontrol_component (kcontrol); +struct tegra186_dspk *dspk =snd_soc_component_get_drvdata (codec); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == dspk->ch_sel) +return 0 ; + + dspk->ch_sel = value; + +return 1 ; +} + +static int tegra186_dspk_get_mono_to_stereo (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *codec =snd_soc_kcontrol_component (kcontrol); +struct tegra186_dspk *dspk =snd_soc_component_get_drvdata (codec); + + ucontrol->value.enumerated.item[0 ] = dspk->mono_to_stereo; + +return 0 ; +} + +static int tegra186_dspk_put_mono_to_stereo (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *codec =snd_soc_kcontrol_component (kcontrol); +struct tegra186_dspk *dspk =snd_soc_component_get_drvdata (codec); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == dspk->mono_to_stereo) +return 0 ; + + dspk->mono_to_stereo = value; + +return 1 ; +} + +static int tegra186_dspk_get_stereo_to_mono (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *codec =snd_soc_kcontrol_component (kcontrol); +struct tegra186_dspk *dspk =snd_soc_component_get_drvdata (codec); + + ucontrol->value.enumerated.item[0 ] = dspk->stereo_to_mono;return 0 ; } +static int tegra186_dspk_put_stereo_to_mono (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *codec =snd_soc_kcontrol_component (kcontrol); +struct tegra186_dspk *dspk =snd_soc_component_get_drvdata (codec); +unsigned int value = ucontrol->value.enumerated.item[0 ]; + +if (value == dspk->stereo_to_mono) +return 0 ; + + dspk->stereo_to_mono = value; + +return 1 ; +} +static int __maybe_unused tegra186_dspk_runtime_suspend (struct device *dev) {struct tegra186_dspk *dspk =dev_get_drvdata (dev);
@@ -278,17 +390,19 @@ static const struct soc_enum tegra186_dsstatic const struct snd_kcontrol_new tegrat186_dspk_controls[] = {SOC_SINGLE_EXT ("FIFO Threshold" ,SND_SOC_NOPM ,0 ,TEGRA186_DSPK_RX_FIFO_DEPTH -1 ,0 , - tegra186_dspk_get_control, tegra186_dspk_put_control), + tegra186_dspk_get_fifo_th, tegra186_dspk_put_fifo_th),SOC_ENUM_EXT ("OSR Value" , tegra186_dspk_osr_enum, - tegra186_dspk_get_control, tegra186_dspk_put_control), + tegra186_dspk_get_osr_val, tegra186_dspk_put_osr_val),SOC_ENUM_EXT ("LR Polarity Select" , tegra186_dspk_lrsel_enum, - tegra186_dspk_get_control, tegra186_dspk_put_control), + tegra186_dspk_get_pol_sel, tegra186_dspk_put_pol_sel),SOC_ENUM_EXT ("Channel Select" , tegra186_dspk_ch_sel_enum, - tegra186_dspk_get_control, tegra186_dspk_put_control), + tegra186_dspk_get_ch_sel, tegra186_dspk_put_ch_sel),SOC_ENUM_EXT ("Mono To Stereo" , tegra186_dspk_mono_conv_enum, - tegra186_dspk_get_control, tegra186_dspk_put_control), + tegra186_dspk_get_mono_to_stereo, + tegra186_dspk_put_mono_to_stereo),SOC_ENUM_EXT ("Stereo To Mono" , tegra186_dspk_stereo_conv_enum, - tegra186_dspk_get_control, tegra186_dspk_put_control), + tegra186_dspk_get_stereo_to_mono, + tegra186_dspk_put_stereo_to_mono), };static const struct snd_soc_component_driver tegra186_dspk_cmpnt = {
Greg Kroah-Hartman
maintainerPATCH 82/130 ASoC: tegra: Fix kcontrol put callback in AHUB
In reply to Greg Kroah-HartmanFrom: Sameer Pujar <[email protected]>
commit a4e37950c9e9b126f9cbee79b8ab94a94646dcf1 upstream.
The kcontrol put callback is expected to return 1 when there is change in HW or when the update is acknowledged by driver. This would ensure that change notifications are sent to subscribed applications. Update the AHUB driver accordingly.
--- sound/soc/tegra/tegra210_ahub.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
sound/soc/tegra/tegra210_ahub.c +7 -4
@@ -62,6 +62,7 @@ static int tegra_ahub_put_value_enum(strunsigned int *item = uctl->value.enumerated.item;unsigned int value = e->values[item[0 ]];unsigned int i, bit_pos, reg_idx =0 , reg_val =0 ; +int change =0 ;if (item[0 ] >= e->items)return -EINVAL ;
@@ -86,12 +87,14 @@ static int tegra_ahub_put_value_enum(str/* Update widget power if state has changed */ if (snd_soc_component_test_bits (cmpnt, update[i].reg, - update[i].mask, update[i].val)) -snd_soc_dapm_mux_update_power (dapm, kctl, item[0 ], e, - &update[i]); + update[i].mask, + update[i].val)) + change |=snd_soc_dapm_mux_update_power (dapm, kctl, + item[0 ], e, + &update[i]); } -return 0 ; +return change; }static struct snd_soc_dai_driver tegra210_ahub_dais[] = {
Greg Kroah-Hartman
maintainerPATCH 83/130 rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
In reply to Greg Kroah-HartmanFrom: Eiichi Tsukata <[email protected]>
commit ca77fba821351190777b236ce749d7c4d353102e upstream.
Need to call rxrpc_put_peer() for bundle candidate before kfree() as it holds a ref to rxrpc_peer.
[DH: v2: Changed to abstract out the bundle freeing code into a function]
--- net/rxrpc/conn_client.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
net/rxrpc/conn_client.c +9 -5
@@ -135,16 +135,20 @@ struct rxrpc_bundle *rxrpc_get_bundle(streturn bundle; } +static void rxrpc_free_bundle (struct rxrpc_bundle *bundle) +{ +rxrpc_put_peer (bundle->params.peer); +kfree (bundle); +} +void rxrpc_put_bundle (struct rxrpc_bundle *bundle) {unsigned int d = bundle->debug_id;unsigned int u =atomic_dec_return (&bundle->usage);_debug ("PUT B=%x %u" , d, u); -if (u ==0 ) { -rxrpc_put_peer (bundle->params.peer); -kfree (bundle); - } +if (u ==0 ) +rxrpc_free_bundle (bundle); }/*
@@ -334,7 +338,7 @@ static struct rxrpc_bundle *rxrpc_look_ureturn candidate; found_bundle_free: -kfree (candidate); +rxrpc_free_bundle (candidate); found_bundle:rxrpc_get_bundle (bundle);spin_unlock (&local->client_bundles_lock);
Greg Kroah-Hartman
maintainerPATCH 84/130 rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
In reply to Greg Kroah-HartmanFrom: Eiichi Tsukata <[email protected]>
commit beacff50edbd6c9659a6f15fc7f6126909fade29 upstream.
Need to call rxrpc_put_local() for peer candidate before kfree() as it holds a ref to rxrpc_local.
[DH: v2: Changed to abstract the peer freeing code out into a function]
--- net/rxrpc/peer_object.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
net/rxrpc/peer_object.c +9 -5
@@ -299,6 +299,12 @@ static struct rxrpc_peer *rxrpc_create_preturn peer; } +static void rxrpc_free_peer (struct rxrpc_peer *peer) +{ +rxrpc_put_local (peer->local); +kfree_rcu (peer, rcu); +} +/* * Set up a new incoming peer. There shouldn't be any other matching peers * since we've already done a search in the list from the non-reentrant context
@@ -365,7 +371,7 @@ struct rxrpc_peer *rxrpc_lookup_peer(strspin_unlock_bh (&rxnet->peer_hash_lock);if (peer) -kfree (candidate); +rxrpc_free_peer (candidate);else peer = candidate; }
@@ -420,8 +426,7 @@ static void __rxrpc_put_peer(struct rxrplist_del_init (&peer->keepalive_link);spin_unlock_bh (&rxnet->peer_hash_lock); -rxrpc_put_local (peer->local); -kfree_rcu (peer, rcu); +rxrpc_free_peer (peer); }/*
@@ -457,8 +462,7 @@ void rxrpc_put_peer_locked(struct rxrpc_if (n ==0 ) {hash_del_rcu (&peer->hash_link);list_del_init (&peer->keepalive_link); -rxrpc_put_local (peer->local); -kfree_rcu (peer, rcu); +rxrpc_free_peer (peer); } }
Greg Kroah-Hartman
maintainerPATCH 85/130 ALSA: intel-dsp-config: add quirk for CML devices based on ES8336 codec
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
commit ae26c08e6c8071ba8febb0c7c0829da96c75248c upstream.
We've added quirks for ESS8336 but missed CML, add quirks for both LP and H versions.
--- sound/hda/intel-dsp-config.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/hda/intel-dsp-config.c +10 -0
@@ -251,6 +251,11 @@ static const struct config_entry config_ .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, .device = 0x02c8, }, + { + .flags = FLAG_SOF, + .device = 0x02c8, + .codec_hid = "ESSX8336", + },/* Cometlake-H */ { .flags = FLAG_SOF,
@@ -275,6 +280,11 @@ static const struct config_entry config_ .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, .device = 0x06c8, }, + { + .flags = FLAG_SOF, + .device = 0x06c8, + .codec_hid = "ESSX8336", + },#endif /* Icelake */
Greg Kroah-Hartman
maintainerPATCH 86/130 net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ is available
In reply to Greg Kroah-HartmanFrom: Sven Schuchmann <[email protected]>
commit 817b653160db9852d5a0498a31f047e18ce27e5b upstream.
On most systems request for IRQ 0 will fail, phylib will print an error message and fall back to polling. To fix this set the phydev->irq to PHY_POLL if no IRQ is available.
--- drivers/net/usb/lan78xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/usb/lan78xx.c +1 -1
@@ -2128,7 +2128,7 @@ static int lan78xx_phy_init(struct lan78if (dev->domain_data.phyirq >0 ) phydev->irq = dev->domain_data.phyirq;else - phydev->irq =0 ; + phydev->irq =PHY_POLL ;netdev_dbg (dev->net,"phydev->irq = %d\n" , phydev->irq);/* set to AUTOMDIX */
Greg Kroah-Hartman
maintainerPATCH 87/130 net: marvell: mvpp2: Fix the computation of shared CPUs
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit b83f5ac7d922e69a109261f5f940eebbd4e514c4 upstream.
'bitmap_fill()' fills a bitmap one 'long' at a time. It is likely that an exact number of bits is expected.
Use 'bitmap_set()' instead in order not to set unexpected bits.
--- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +1 -1
@@ -6918,7 +6918,7 @@ static int mvpp2_probe(struct platform_d shared =num_present_cpus () - priv->nthreads;if (shared >0 ) -bitmap_fill (&priv->lock_map, +bitmap_set (&priv->lock_map,0 ,min_t (int, shared,MVPP2_MAX_THREADS ));for (i =0 ; i <MVPP2_MAX_THREADS ; i++) {
Greg Kroah-Hartman
maintainerPATCH 88/130 dpaa2-eth: destroy workqueue at the end of remove function
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
commit f4a8adbfe4841491b60c14fe610571e1422359f9 upstream.
The commit c55211892f46 ("dpaa2-eth: support PTP Sync packet one-step timestamping") forgets to destroy workqueue at the end of remove function.
Fix this by adding destroy_workqueue before fsl_mc_portal_free and free_netdev.
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +2 -0
@@ -4432,6 +4432,8 @@ static int dpaa2_eth_remove(struct fsl_mfsl_mc_portal_free (priv->mc_io); +destroy_workqueue (priv->dpaa2_ptp_wq); +dev_dbg (net_dev->dev.parent,"Removed interface %s\n" , net_dev->name);free_netdev (net_dev);
Greg Kroah-Hartman
maintainerPATCH 89/130 net: annotate data-races on txq->xmit_lock_owner
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 7a10d8c810cfad3e79372d7d1c77899d86cd6662 upstream.
syzbot found that __dev_queue_xmit() is reading txq->xmit_lock_owner without annotations.
No serious issue there, let's document what is happening there.
BUG: KCSAN: data-race in __dev_queue_xmit / __dev_queue_xmit
write to 0xffff888139d09484 of 4 bytes by interrupt on cpu 0:
__netif_tx_unlock include/linux/netdevice.h:4437 [inline] __dev_queue_xmit+0x948/0xf70 net/core/dev.c:4229 dev_queue_xmit_accel+0x19/0x20 net/core/dev.c:4265 macvlan_queue_xmit drivers/net/macvlan.c:543 [inline] macvlan_start_xmit+0x2b3/0x3d0 drivers/net/macvlan.c:567 __netdev_start_xmit include/linux/netdevice.h:4987 [inline] netdev_start_xmit include/linux/netdevice.h:5001 [inline] xmit_one+0x105/0x2f0 net/core/dev.c:3590 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3606 sch_direct_xmit+0x1b2/0x7c0 net/sched/sch_generic.c:342 __dev_xmit_skb+0x83d/0x1370 net/core/dev.c:3817 __dev_queue_xmit+0x590/0xf70 net/core/dev.c:4194 dev_queue_xmit+0x13/0x20 net/core/dev.c:4259 neigh_hh_output include/net/neighbour.h:511 [inline] neigh_output include/net/neighbour.h:525 [inline] ip6_finish_output2+0x995/0xbb0 net/ipv6/ip6_output.c:126 __ip6_finish_output net/ipv6/ip6_output.c:191 [inline] ip6_finish_output+0x444/0x4c0 net/ipv6/ip6_output.c:201 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0x10e/0x210 net/ipv6/ip6_output.c:224 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] ndisc_send_skb+0x486/0x610 net/ipv6/ndisc.c:508 ndisc_send_rs+0x3b0/0x3e0 net/ipv6/ndisc.c:702 addrconf_rs_timer+0x370/0x540 net/ipv6/addrconf.c:3898 call_timer_fn+0x2e/0x240 kernel/time/timer.c:1421 expire_timers+0x116/0x240 kernel/time/timer.c:1466 __run_timers+0x368/0x410 kernel/time/timer.c:1734 run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1747 __do_softirq+0x158/0x2de kernel/softirq.c:558 __irq_exit_rcu kernel/softirq.c:636 [inline] irq_exit_rcu+0x37/0x70 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x3e/0xb0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20
read to 0xffff888139d09484 of 4 bytes by interrupt on cpu 1:
__dev_queue_xmit+0x5e3/0xf70 net/core/dev.c:4213 dev_queue_xmit_accel+0x19/0x20 net/core/dev.c:4265 macvlan_queue_xmit drivers/net/macvlan.c:543 [inline] macvlan_start_xmit+0x2b3/0x3d0 drivers/net/macvlan.c:567 __netdev_start_xmit include/linux/netdevice.h:4987 [inline] netdev_start_xmit include/linux/netdevice.h:5001 [inline] xmit_one+0x105/0x2f0 net/core/dev.c:3590 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3606 sch_direct_xmit+0x1b2/0x7c0 net/sched/sch_generic.c:342 __dev_xmit_skb+0x83d/0x1370 net/core/dev.c:3817 __dev_queue_xmit+0x590/0xf70 net/core/dev.c:4194 dev_queue_xmit+0x13/0x20 net/core/dev.c:4259 neigh_resolve_output+0x3db/0x410 net/core/neighbour.c:1523 neigh_output include/net/neighbour.h:527 [inline] ip6_finish_output2+0x9be/0xbb0 net/ipv6/ip6_output.c:126 __ip6_finish_output net/ipv6/ip6_output.c:191 [inline] ip6_finish_output+0x444/0x4c0 net/ipv6/ip6_output.c:201 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0x10e/0x210 net/ipv6/ip6_output.c:224 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] ndisc_send_skb+0x486/0x610 net/ipv6/ndisc.c:508 ndisc_send_rs+0x3b0/0x3e0 net/ipv6/ndisc.c:702 addrconf_rs_timer+0x370/0x540 net/ipv6/addrconf.c:3898 call_timer_fn+0x2e/0x240 kernel/time/timer.c:1421 expire_timers+0x116/0x240 kernel/time/timer.c:1466 __run_timers+0x368/0x410 kernel/time/timer.c:1734 run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1747 __do_softirq+0x158/0x2de kernel/softirq.c:558 __irq_exit_rcu kernel/softirq.c:636 [inline] irq_exit_rcu+0x37/0x70 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x8d/0xb0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 kcsan_setup_watchpoint+0x94/0x420 kernel/kcsan/core.c:443 folio_test_anon include/linux/page-flags.h:581 [inline] PageAnon include/linux/page-flags.h:586 [inline] zap_pte_range+0x5ac/0x10e0 mm/memory.c:1347 zap_pmd_range mm/memory.c:1467 [inline] zap_pud_range mm/memory.c:1496 [inline] zap_p4d_range mm/memory.c:1517 [inline] unmap_page_range+0x2dc/0x3d0 mm/memory.c:1538 unmap_single_vma+0x157/0x210 mm/memory.c:1583 unmap_vmas+0xd0/0x180 mm/memory.c:1615 exit_mmap+0x23d/0x470 mm/mmap.c:3170 __mmput+0x27/0x1b0 kernel/fork.c:1113 mmput+0x3d/0x50 kernel/fork.c:1134 exit_mm+0xdb/0x170 kernel/exit.c:507 do_exit+0x608/0x17a0 kernel/exit.c:819 do_group_exit+0xce/0x180 kernel/exit.c:929 get_signal+0xfc3/0x1550 kernel/signal.c:2852 arch_do_signal_or_restart+0x8c/0x2e0 arch/x86/kernel/signal.c:868 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x113/0x190 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:300 do_syscall_64+0x50/0xd0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0x00000000 -> 0xffffffff
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 28712 Comm: syz-executor.0 Tainted: G W 5.16.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
--- include/linux/netdevice.h | 19 +++++++++++++------ net/core/dev.c | 5 ++++- 2 files changed, 17 insertions(+), 7 deletions(-)
include/linux/netdevice.h +13 -6
@@ -4212,7 +4212,8 @@ static inline u32 netif_msg_init(int debstatic inline void __netif_tx_lock (struct netdev_queue *txq,int cpu) {spin_lock (&txq->_xmit_lock); - txq->xmit_lock_owner = cpu; +/* Pairs with READ_ONCE() in __dev_queue_xmit() */ +WRITE_ONCE (txq->xmit_lock_owner, cpu); }static inline bool __netif_tx_acquire (struct netdev_queue *txq)
@@ -4229,26 +4230,32 @@ static inline void __netif_tx_release(ststatic inline void __netif_tx_lock_bh (struct netdev_queue *txq) {spin_lock_bh (&txq->_xmit_lock); - txq->xmit_lock_owner =smp_processor_id (); +/* Pairs with READ_ONCE() in __dev_queue_xmit() */ +WRITE_ONCE (txq->xmit_lock_owner,smp_processor_id ()); }static inline bool __netif_tx_trylock (struct netdev_queue *txq) {bool ok =spin_trylock (&txq->_xmit_lock); -if (likely (ok)) - txq->xmit_lock_owner =smp_processor_id (); + +if (likely (ok)) { +/* Pairs with READ_ONCE() in __dev_queue_xmit() */ +WRITE_ONCE (txq->xmit_lock_owner,smp_processor_id ()); + }return ok; }static inline void __netif_tx_unlock (struct netdev_queue *txq) { - txq->xmit_lock_owner =-1 ; +/* Pairs with READ_ONCE() in __dev_queue_xmit() */ +WRITE_ONCE (txq->xmit_lock_owner,-1 );spin_unlock (&txq->_xmit_lock); }static inline void __netif_tx_unlock_bh (struct netdev_queue *txq) { - txq->xmit_lock_owner =-1 ; +/* Pairs with READ_ONCE() in __dev_queue_xmit() */ +WRITE_ONCE (txq->xmit_lock_owner,-1 );spin_unlock_bh (&txq->_xmit_lock); }
net/core/dev.c +4 -1
@@ -4147,7 +4147,10 @@ static int __dev_queue_xmit(struct sk_buif (dev->flags &IFF_UP ) {int cpu =smp_processor_id ();/* ok because BHs are off */ -if (txq->xmit_lock_owner != cpu) { +/* Other cpus might concurrently change txq->xmit_lock_owner +* to -1 or to their cpu id, but not to our id. +*/ +if (READ_ONCE (txq->xmit_lock_owner) != cpu) {if (dev_xmit_recursion ()) goto recursion_alert;
Greg Kroah-Hartman
maintainerPATCH 90/130 ipv4: convert fib_num_tclassid_users to atomic_t
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 213f5f8f31f10aa1e83187ae20fb7fa4e626b724 upstream.
Before commit faa041a40b9f ("ipv4: Create cleanup helper for fib_nh") changes to net->ipv4.fib_num_tclassid_users were protected by RTNL.
After the change, this is no longer the case, as free_fib_info_rcu() runs after rcu grace period, without rtnl being held.
--- include/net/ip_fib.h | 2 +- include/net/netns/ipv4.h | 2 +- net/ipv4/fib_frontend.c | 2 +- net/ipv4/fib_rules.c | 4 ++-- net/ipv4/fib_semantics.c | 4 ++-- 5 files changed, 7 insertions(+), 7 deletions(-)
include/net/ip_fib.h +1 -1
@@ -437,7 +437,7 @@ int fib_validate_source(struct sk_buff *#ifdef CONFIG_IP_ROUTE_CLASSID static inline int fib_num_tclassid_users (struct net *net) { -return net->ipv4.fib_num_tclassid_users; +return atomic_read (&net->ipv4.fib_num_tclassid_users); }#else static inline int fib_num_tclassid_users (struct net *net)
include/net/netns/ipv4.h +1 -1
@@ -61,7 +61,7 @@ struct netns_ipv4 {#endif bool fib_has_custom_local_routes;#ifdef CONFIG_IP_ROUTE_CLASSID -int fib_num_tclassid_users; +atomic_t fib_num_tclassid_users;#endif struct hlist_head *fib_table_hash;bool fib_offload_disabled;
net/ipv4/fib_frontend.c +1 -1
@@ -1578,7 +1578,7 @@ static int __net_init fib_net_init(strucint error;#ifdef CONFIG_IP_ROUTE_CLASSID - net->ipv4.fib_num_tclassid_users =0 ; +atomic_set (&net->ipv4.fib_num_tclassid_users,0 );#endif error =ip_fib_net_init (net);if (error <0 )
net/ipv4/fib_rules.c +2 -2
@@ -264,7 +264,7 @@ static int fib4_rule_configure(struct fiif (tb[FRA_FLOW ]) { rule4->tclassid =nla_get_u32 (tb[FRA_FLOW ]);if (rule4->tclassid) - net->ipv4.fib_num_tclassid_users++; +atomic_inc (&net->ipv4.fib_num_tclassid_users); }#endif
@@ -296,7 +296,7 @@ static int fib4_rule_delete(struct fib_r#ifdef CONFIG_IP_ROUTE_CLASSID if (((struct fib4_rule *)rule)->tclassid) - net->ipv4.fib_num_tclassid_users--; +atomic_dec (&net->ipv4.fib_num_tclassid_users);#endif net->ipv4.fib_has_custom_rules = true;
net/ipv4/fib_semantics.c +2 -2
@@ -222,7 +222,7 @@ void fib_nh_release(struct net *net, str {#ifdef CONFIG_IP_ROUTE_CLASSID if (fib_nh->nh_tclassid) - net->ipv4.fib_num_tclassid_users--; +atomic_dec (&net->ipv4.fib_num_tclassid_users);#endif fib_nh_common_release (&fib_nh->nh_common); }
@@ -633,7 +633,7 @@ int fib_nh_init(struct net *net, struct#ifdef CONFIG_IP_ROUTE_CLASSID nh->nh_tclassid = cfg->fc_flow;if (nh->nh_tclassid) - net->ipv4.fib_num_tclassid_users++; +atomic_inc (&net->ipv4.fib_num_tclassid_users);#endif #ifdef CONFIG_IP_ROUTE_MULTIPATH nh->fib_nh_weight = nh_weight;
Greg Kroah-Hartman
maintainerPATCH 91/130 net/smc: fix wrong list_del in smc_lgr_cleanup_early
In reply to Greg Kroah-HartmanFrom: Dust Li <[email protected]>
commit 789b6cc2a5f9123b9c549b886fdc47c865cfe0ba upstream.
smc_lgr_cleanup_early() meant to delete the link
group from the link group list, but it deleted
the list head by mistake.
This may cause memory corruption since we didn't remove the real link group from the list and later memseted the link group structure.
We got a list corruption panic when testing:
[ 231.277259] list_del corruption. prev->next should be ffff8881398a8000, but was 0000000000000000 [ 231.278222] ------------[ cut here ]------------
[ 231.278726] kernel BUG at lib/list_debug.c:53!
[ 231.279326] invalid opcode: 0000 [#1] SMP NOPTI
[ 231.279803] CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.10.46+ #435
[ 231.280466] Hardware name: Alibaba Cloud ECS, BIOS 8c24b4c 04/01/2014
[ 231.281248] Workqueue: events smc_link_down_work
[ 231.281732] RIP: 0010:__list_del_entry_valid+0x70/0x90
[ 231.282258] Code: 4c 60 82 e8 7d cc 6a 00 0f 0b 48 89 fe 48 c7 c7 88 4c
60 82 e8 6c cc 6a 00 0f 0b 48 89 fe 48 c7 c7 c0 4c 60 82 e8 5b cc 6a 00 <0f>
0b 48 89 fe 48 c7 c7 00 4d 60 82 e8 4a cc 6a 00 0f 0b cc cc cc
[ 231.284146] RSP: 0018:ffffc90000033d58 EFLAGS: 00010292
[ 231.284685] RAX: 0000000000000054 RBX: ffff8881398a8000 RCX: 0000000000000000
[ 231.285415] RDX: 0000000000000001 RSI: ffff88813bc18040 RDI: ffff88813bc18040
[ 231.286141] RBP: ffffffff8305ad40 R08: 0000000000000003 R09: 0000000000000001
[ 231.286873] R10: ffffffff82803da0 R11: ffffc90000033b90 R12: 0000000000000001
[ 231.287606] R13: 0000000000000000 R14: ffff8881398a8000 R15: 0000000000000003
[ 231.288337] FS: 0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 [ 231.289160] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 231.289754] CR2: 0000000000e72058 CR3: 000000010fa96006 CR4: 00000000003706f0
[ 231.290485] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 231.291211] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 231.291940] Call Trace:
[ 231.292211] smc_lgr_terminate_sched+0x53/0xa0
[ 231.292677] smc_switch_conns+0x75/0x6b0
[ 231.293085] ? update_load_avg+0x1a6/0x590
[ 231.293517] ? ttwu_do_wakeup+0x17/0x150
[ 231.293907] ? update_load_avg+0x1a6/0x590
[ 231.294317] ? newidle_balance+0xca/0x3d0
[ 231.294716] smcr_link_down+0x50/0x1a0
[ 231.295090] ? __wake_up_common_lock+0x77/0x90
[ 231.295534] smc_link_down_work+0x46/0x60
[ 231.295933] process_one_work+0x18b/0x350
--- net/smc/smc_core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
net/smc/smc_core.c +3 -4
@@ -204,18 +204,17 @@ static void smc_lgr_unregister_conn(struvoid smc_lgr_cleanup_early (struct smc_connection *conn) {struct smc_link_group *lgr = conn->lgr; -struct list_head *lgr_list;spinlock_t *lgr_lock;if (!lgr)return ;smc_conn_free (conn); - lgr_list =smc_lgr_list_head (lgr, &lgr_lock); +smc_lgr_list_head (lgr, &lgr_lock);spin_lock_bh (lgr_lock);/* do not use this link group for new connections */ -if (!list_empty (lgr_list)) -list_del_init (lgr_list); +if (!list_empty (&lgr->list)) +list_del_init (&lgr->list);spin_unlock_bh (lgr_lock);__smc_lgr_terminate (lgr, true); }
Greg Kroah-Hartman
maintainerPATCH 92/130 net/rds: correct socket tunable error in rds_tcp_tune()
In reply to Greg Kroah-HartmanFrom: William Kucharski <[email protected]>
commit 19f36edf14bcdb783aef3af8217df96f76a8ce34 upstream.
Correct an error where setting /proc/sys/net/rds/tcp/rds_tcp_rcvbuf would instead modify the socket's sk_sndbuf and would leave sk_rcvbuf untouched.
--- net/rds/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rds/tcp.c +1 -1
@@ -500,7 +500,7 @@ void rds_tcp_tune(struct socket *sock) sk->sk_userlocks |=SOCK_SNDBUF_LOCK ; }if (rtn->rcvbuf_size >0 ) { - sk->sk_sndbuf = rtn->rcvbuf_size; + sk->sk_rcvbuf = rtn->rcvbuf_size; sk->sk_userlocks |=SOCK_RCVBUF_LOCK ; }release_sock (sk);
Greg Kroah-Hartman
maintainerPATCH 93/130 net/smc: Keep smc_close_final rc during active close
In reply to Greg Kroah-HartmanFrom: Tony Lu <[email protected]>
commit 00e158fb91dfaff3f94746f260d11f1a4853506e upstream.
When smc_close_final() returns error, the return code overwrites by kernel_sock_shutdown() in smc_close_active(). The return code of smc_close_final() is more important than kernel_sock_shutdown(), and it will pass to userspace directly.
Fix it by keeping both return codes, if smc_close_final() raises an error, return it or kernel_sock_shutdown()'s.
--- net/smc/smc_close.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/smc/smc_close.c +6 -2
@@ -195,6 +195,7 @@ int smc_close_active(struct smc_sock *smint old_state;long timeout;int rc =0 ; +int rc1 =0 ; timeout = current->flags &PF_EXITING ? 0 : sock_flag(sk, SOCK_LINGER) ?
@@ -232,8 +233,11 @@ again:/* actively shutdown clcsock before peer close it, * prevent peer from entering TIME_WAIT state. */ -if (smc->clcsock && smc->clcsock->sk) - rc =kernel_sock_shutdown (smc->clcsock,SHUT_RDWR ); +if (smc->clcsock && smc->clcsock->sk) { + rc1 =kernel_sock_shutdown (smc->clcsock, +SHUT_RDWR ); + rc = rc ? rc : rc1; + } }else {/* peer event has changed the state */ goto again;
Greg Kroah-Hartman
maintainerPATCH 94/130 drm/msm/a6xx: Allocate enough space for GMU registers
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
commit b4d25abf9720b69a03465b09d0d62d1998ed6708 upstream.
In commit 142639a52a01 ("drm/msm/a6xx: fix crashstate capture for A650") we changed a6xx_get_gmu_registers() to read 3 sets of registers. Unfortunately, we didn't change the memory allocation for the array. That leads to a KASAN warning (this was on the chromeos-5.4 kernel, which has the problematic commit backported to it):
BUG: KASAN: slab-out-of-bounds in _a6xx_get_gmu_registers+0x144/0x430 Write of size 8 at addr ffffff80c89432b0 by task A618-worker/209 CPU: 5 PID: 209 Comm: A618-worker Tainted: G W 5.4.156-lockdep #22 Hardware name: Google Lazor Limozeen without Touchscreen (rev5 - rev8) (DT) Call trace: dump_backtrace+0x0/0x248 show_stack+0x20/0x2c dump_stack+0x128/0x1ec print_address_description+0x88/0x4a0 __kasan_report+0xfc/0x120 kasan_report+0x10/0x18 __asan_report_store8_noabort+0x1c/0x24 _a6xx_get_gmu_registers+0x144/0x430 a6xx_gpu_state_get+0x330/0x25d4 msm_gpu_crashstate_capture+0xa0/0x84c recover_worker+0x328/0x838 kthread_worker_fn+0x32c/0x574 kthread+0x2dc/0x39c ret_from_fork+0x10/0x18 Allocated by task 209: __kasan_kmalloc+0xfc/0x1c4 kasan_kmalloc+0xc/0x14 kmem_cache_alloc_trace+0x1f0/0x2a0 a6xx_gpu_state_get+0x164/0x25d4 msm_gpu_crashstate_capture+0xa0/0x84c recover_worker+0x328/0x838 kthread_worker_fn+0x32c/0x574 kthread+0x2dc/0x39c ret_from_fork+0x10/0x18
--- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +2 -2
@@ -777,12 +777,12 @@ static void a6xx_get_gmu_registers(strucstruct a6xx_gpu *a6xx_gpu =to_a6xx_gpu (adreno_gpu); a6xx_state->gmu_registers =state_kcalloc (a6xx_state, -2 ,sizeof (*a6xx_state->gmu_registers)); +3 ,sizeof (*a6xx_state->gmu_registers));if (!a6xx_state->gmu_registers)return ; - a6xx_state->nr_gmu_registers =2 ; + a6xx_state->nr_gmu_registers =3 ;/* Get the CX GMU registers from AHB */ _a6xx_get_gmu_registers(gpu, a6xx_state, &a6xx_gmu_reglist[0],
Greg Kroah-Hartman
maintainerPATCH 95/130 drm/msm: Do hw_init() before capturing GPU state
In reply to Greg Kroah-HartmanFrom: Rob Clark <[email protected]>
commit e4840d537c2c6b1189d4de16ee0f4820e069dcea upstream.
In particular, we need to ensure all the necessary blocks are switched to 64b mode (a5xx+) otherwise the high bits of the address of the BO to snapshot state into will be ignored, resulting in:
*** gpu fault: ttbr0=0000000000000000 iova=0000000000012000 dir=READ type=TRANSLATION source=CP (0,0,0,0) platform 506a000.gmu: [drm:a6xx_gmu_set_oob] *ERROR* Timeout waiting for GMU OOB set BOOT_SLUMBER: 0x0
--- drivers/gpu/drm/msm/msm_debugfs.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/msm/msm_debugfs.c +1 -0
@@ -77,6 +77,7 @@ static int msm_gpu_open(struct inode *in goto free_priv;pm_runtime_get_sync (&gpu->pdev->dev); +msm_gpu_hw_init (gpu); show_priv->state = gpu->funcs->gpu_state_get (gpu);pm_runtime_put_sync (&gpu->pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 96/130 atlantic: Increase delay for fw transactions
In reply to Greg Kroah-HartmanFrom: Dmitry Bogdanov <[email protected]>
commit aa1dcb5646fdf34a15763facf4bf5e482a2814ca upstream.
The max waiting period (of 1 ms) while reading the data from FW shared buffer is too small for certain types of data (e.g., stats). There's a chance that FW could be updating buffer at the same time and driver would be unsuccessful in reading data. Firmware manual recommends to have 1 sec timeout to fix this issue.
--- drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c +5 -2
@@ -84,7 +84,7 @@ static int hw_atl2_shared_buffer_read_blif (cnt >AQ_A2_FW_READ_TRY_MAX )return -ETIME ;if (tid1.transaction_cnt_a != tid1.transaction_cnt_b) -udelay (1 ); +mdelay (1 ); }while (tid1.transaction_cnt_a != tid1.transaction_cnt_b);hw_atl2_mif_shared_buf_read (self, offset, (u32 *)data, dwords);
@@ -339,8 +339,11 @@ static int aq_a2_fw_update_stats(struct {struct hw_atl2_priv *priv = (struct hw_atl2_priv *)self->priv;struct statistics_s stats; +int err; -hw_atl2_shared_buffer_read_safe (self, stats, &stats); + err =hw_atl2_shared_buffer_read_safe (self, stats, &stats); +if (err) +return err;#define AQ_SDELTA (_N_, _F_) (self->curr_stats._N_ += \ stats.msm._F_ - priv->last_stats.msm._F_)
Greg Kroah-Hartman
maintainerPATCH 97/130 atlatnic: enable Nbase-t speeds with base-t
In reply to Greg Kroah-HartmanFrom: Nikita Danilov <[email protected]>
commit aa685acd98eae25d5351e30288d6cfb65b9c80a5 upstream.
When 2.5G is advertised, N-Base should be advertised against the T-base caps. N5G is out of use in baseline code and driver should treat both 5G and N5G (and also 2.5G and N2.5G) equally from user perspective.
--- drivers/net/ethernet/aquantia/atlantic/aq_common.h | 25 ++++------ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c | 3 - drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c | 4 - 3 files changed, 13 insertions(+), 19 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_common.h +12 -13
@@ -53,20 +53,19 @@#define AQ_NIC_RATE_10G BIT(0)#define AQ_NIC_RATE_5G BIT(1) -#define AQ_NIC_RATE_5GSR BIT(2) -#define AQ_NIC_RATE_2G5 BIT(3) -#define AQ_NIC_RATE_1G BIT(4) -#define AQ_NIC_RATE_100M BIT(5) -#define AQ_NIC_RATE_10M BIT(6) -#define AQ_NIC_RATE_1G_HALF BIT(7) -#define AQ_NIC_RATE_100M_HALF BIT(8) -#define AQ_NIC_RATE_10M_HALF BIT(9) +#define AQ_NIC_RATE_2G5 BIT(2) +#define AQ_NIC_RATE_1G BIT(3) +#define AQ_NIC_RATE_100M BIT(4) +#define AQ_NIC_RATE_10M BIT(5) +#define AQ_NIC_RATE_1G_HALF BIT(6) +#define AQ_NIC_RATE_100M_HALF BIT(7) +#define AQ_NIC_RATE_10M_HALF BIT(8) -#define AQ_NIC_RATE_EEE_10G BIT(10) -#define AQ_NIC_RATE_EEE_5G BIT(11) -#define AQ_NIC_RATE_EEE_2G5 BIT(12) -#define AQ_NIC_RATE_EEE_1G BIT(13) -#define AQ_NIC_RATE_EEE_100M BIT(14) +#define AQ_NIC_RATE_EEE_10G BIT(9) +#define AQ_NIC_RATE_EEE_5G BIT(10) +#define AQ_NIC_RATE_EEE_2G5 BIT(11) +#define AQ_NIC_RATE_EEE_1G BIT(12) +#define AQ_NIC_RATE_EEE_100M BIT(13)#define AQ_NIC_RATE_EEE_MSK (AQ_NIC_RATE_EEE_10G |\ AQ_NIC_RATE_EEE_5G |\ AQ_NIC_RATE_EEE_2G5 |\
drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c +0 -3
@@ -132,9 +132,6 @@ static enum hw_atl_fw2x_rate link_speed_if (speed &AQ_NIC_RATE_5G ) rate |=FW2X_RATE_5G ; -if (speed &AQ_NIC_RATE_5GSR ) - rate |=FW2X_RATE_5G ; -if (speed &AQ_NIC_RATE_2G5 ) rate |=FW2X_RATE_2G5 ;
drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c +1 -3
@@ -154,7 +154,7 @@ static void a2_link_speed_mask2fw(u32 sp { link_options->rate_10G = !!(speed &AQ_NIC_RATE_10G ); link_options->rate_5G = !!(speed &AQ_NIC_RATE_5G ); - link_options->rate_N5G = !!(speed &AQ_NIC_RATE_5GSR ); + link_options->rate_N5G = link_options->rate_5G; link_options->rate_2P5G = !!(speed &AQ_NIC_RATE_2G5 ); link_options->rate_N2P5G = link_options->rate_2P5G; link_options->rate_1G = !!(speed &AQ_NIC_RATE_1G );
@@ -192,8 +192,6 @@ static u32 a2_fw_lkp_to_mask(struct lkp_ rate |=AQ_NIC_RATE_10G ;if (lkp_link_caps->rate_5G) rate |=AQ_NIC_RATE_5G ; -if (lkp_link_caps->rate_N5G) - rate |=AQ_NIC_RATE_5GSR ;if (lkp_link_caps->rate_2P5G) rate |=AQ_NIC_RATE_2G5 ;if (lkp_link_caps->rate_1G)
Greg Kroah-Hartman
maintainerPATCH 98/130 atlantic: Fix to display FW bundle version instead of FW mac version.
In reply to Greg Kroah-HartmanFrom: Sameer Saurabh <[email protected]>
commit 2465c802232bc8d2b5bd83b55b08d05c11808704 upstream.
The correct way to reflect firmware version is to use bundle version. Hence populating the same instead of MAC fw version.
--- drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c +3 -3
@@ -500,9 +500,9 @@ u32 hw_atl2_utils_get_fw_version(structhw_atl2_shared_buffer_read_safe (self, version, &version);/* A2 FW version is stored in reverse order */ -return version.mac.major <<24 | - version.mac.minor <<16 | - version.mac.build; +return version.bundle.major <<24 | + version.bundle.minor <<16 | + version.bundle.build; } int hw_atl2_utils_get_action_resolve_table_caps(struct aq_hw_s *self,
Greg Kroah-Hartman
maintainerPATCH 99/130 atlantic: Add missing DIDs and fix 115c.
In reply to Greg Kroah-HartmanFrom: Nikita Danilov <[email protected]>
commit 413d5e09caa5a11da9c7d72401ba0588466a04c0 upstream.
At the late production stages new dev ids were introduced. These are now in production, so its important for the driver to recognize these. And also fix the board caps for AQC115C adapter.
--- drivers/net/ethernet/aquantia/atlantic/aq_common.h | 2 + drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 7 +++++- drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c | 17 +++++++++++++++ drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.h | 2 + 4 files changed, 27 insertions(+), 1 deletion(-)
drivers/net/ethernet/aquantia/atlantic/aq_common.h +2 -0
@@ -40,10 +40,12 @@#define AQ_DEVICE_ID_AQC113DEV 0x00C0#define AQ_DEVICE_ID_AQC113CS 0x94C0 +#define AQ_DEVICE_ID_AQC113CA 0x34C0#define AQ_DEVICE_ID_AQC114CS 0x93C0#define AQ_DEVICE_ID_AQC113 0x04C0#define AQ_DEVICE_ID_AQC113C 0x14C0#define AQ_DEVICE_ID_AQC115C 0x12C0 +#define AQ_DEVICE_ID_AQC116C 0x11C0#define HW_ATL_NIC_NAME "Marvell (aQuantia) AQtion 10Gbit Network Adapter"
drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +6 -1
@@ -49,6 +49,8 @@ static const struct pci_device_id aq_pci { PCI_VDEVICE(AQUANTIA, AQ_DEVICE_ID_AQC113), }, { PCI_VDEVICE(AQUANTIA, AQ_DEVICE_ID_AQC113C), }, { PCI_VDEVICE(AQUANTIA, AQ_DEVICE_ID_AQC115C), }, + { PCI_VDEVICE(AQUANTIA, AQ_DEVICE_ID_AQC113CA), }, + { PCI_VDEVICE(AQUANTIA, AQ_DEVICE_ID_AQC116C), }, {} };
@@ -85,7 +87,10 @@ static const struct aq_board_revision_s { AQ_DEVICE_ID_AQC113CS, AQ_HWREV_ANY, &hw_atl2_ops, &hw_atl2_caps_aqc113, }, { AQ_DEVICE_ID_AQC114CS, AQ_HWREV_ANY, &hw_atl2_ops, &hw_atl2_caps_aqc113, }, { AQ_DEVICE_ID_AQC113C, AQ_HWREV_ANY, &hw_atl2_ops, &hw_atl2_caps_aqc113, }, - { AQ_DEVICE_ID_AQC115C, AQ_HWREV_ANY, &hw_atl2_ops, &hw_atl2_caps_aqc113, }, + { AQ_DEVICE_ID_AQC115C, AQ_HWREV_ANY, &hw_atl2_ops, &hw_atl2_caps_aqc115c, }, + { AQ_DEVICE_ID_AQC113CA, AQ_HWREV_ANY, &hw_atl2_ops, &hw_atl2_caps_aqc113, }, + { AQ_DEVICE_ID_AQC116C, AQ_HWREV_ANY, &hw_atl2_ops, &hw_atl2_caps_aqc116c, }, + };MODULE_DEVICE_TABLE (pci, aq_pci_tbl);
drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c +17 -0
@@ -72,6 +72,23 @@ const struct aq_hw_caps_s hw_atl2_caps_a AQ_NIC_RATE_10M_HALF, }; +const struct aq_hw_caps_s hw_atl2_caps_aqc115c = { +DEFAULT_BOARD_BASIC_CAPABILITIES , + .media_type =AQ_HW_MEDIA_TYPE_TP , + .link_speed_msk =AQ_NIC_RATE_2G5 | +AQ_NIC_RATE_1G | +AQ_NIC_RATE_100M | +AQ_NIC_RATE_10M , +}; + +const struct aq_hw_caps_s hw_atl2_caps_aqc116c = { +DEFAULT_BOARD_BASIC_CAPABILITIES , + .media_type =AQ_HW_MEDIA_TYPE_TP , + .link_speed_msk =AQ_NIC_RATE_1G | +AQ_NIC_RATE_100M | +AQ_NIC_RATE_10M , +}; +static u32 hw_atl2_sem_act_rslvr_get (struct aq_hw_s *self) {return hw_atl_reg_glb_cpu_sem_get (self,HW_ATL2_FW_SM_ACT_RSLVR );
drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.h +2 -0
@@ -9,6 +9,8 @@#include "aq_common.h" extern const struct aq_hw_caps_s hw_atl2_caps_aqc113; +extern const struct aq_hw_caps_s hw_atl2_caps_aqc115c; +extern const struct aq_hw_caps_s hw_atl2_caps_aqc116c;extern const struct aq_hw_ops hw_atl2_ops;#endif /* HW_ATL2_H */
Greg Kroah-Hartman
maintainerPATCH 100/130 Remove Half duplex mode speed capabilities.
In reply to Greg Kroah-HartmanFrom: Sameer Saurabh <[email protected]>
commit 03fa512189eb9b55ded5f3e81ad638315555b340 upstream.
Since Half Duplex mode has been deprecated by the firmware, driver should not advertise Half Duplex speed in ethtool support link speed values.
--- drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c +1 -4
@@ -65,11 +65,8 @@ const struct aq_hw_caps_s hw_atl2_caps_aAQ_NIC_RATE_5G |AQ_NIC_RATE_2G5 |AQ_NIC_RATE_1G | -AQ_NIC_RATE_1G_HALF |AQ_NIC_RATE_100M | -AQ_NIC_RATE_100M_HALF | -AQ_NIC_RATE_10M | - AQ_NIC_RATE_10M_HALF, + AQ_NIC_RATE_10M, }; const struct aq_hw_caps_s hw_atl2_caps_aqc115c = {
Greg Kroah-Hartman
maintainerPATCH 101/130 atlantic: Fix statistics logic for production hardware
In reply to Greg Kroah-HartmanFrom: Dmitry Bogdanov <[email protected]>
commit 2087ced0fc3a6d45203925750a2b1bcd5402e639 upstream.
B0 is the main and widespread device revision of atlantic2 HW. In the current state, driver will incorrectly fetch the statistics for this revision.
--- drivers/net/ethernet/aquantia/atlantic/aq_hw.h | 2 drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 10 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c | 15 + drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils.h | 38 +++ drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c | 101 ++++++++-- 5 files changed, 139 insertions(+), 27 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_hw.h +2 -0
@@ -80,6 +80,8 @@ struct aq_hw_link_status_s { };struct aq_stats_s { +u64 brc; +u64 btc;u64 uprc;u64 mprc;u64 bprc;
drivers/net/ethernet/aquantia/atlantic/aq_nic.c +8 -2
@@ -903,8 +903,14 @@ u64 *aq_nic_get_stats(struct aq_nic_s *s data[++i] = stats->mbtc; data[++i] = stats->bbrc; data[++i] = stats->bbtc; - data[++i] = stats->ubrc + stats->mbrc + stats->bbrc; - data[++i] = stats->ubtc + stats->mbtc + stats->bbtc; +if (stats->brc) + data[++i] = stats->brc; +else + data[++i] = stats->ubrc + stats->mbrc + stats->bbrc; +if (stats->btc) + data[++i] = stats->btc; +else + data[++i] = stats->ubtc + stats->mbtc + stats->bbtc; data[++i] = stats->dma_pkt_rc; data[++i] = stats->dma_pkt_tc; data[++i] = stats->dma_oct_rc;
drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c +13 -2
@@ -867,12 +867,20 @@ static int hw_atl_fw1x_deinit(struct aq_int hw_atl_utils_update_stats (struct aq_hw_s *self) {struct aq_stats_s *cs = &self->curr_stats; +struct aq_stats_s curr_stats = *cs;struct hw_atl_utils_mbox mbox; +bool corrupted_stats = false;hw_atl_utils_mpi_read_stats (self, &mbox); -#define AQ_SDELTA (_N_) (self->curr_stats._N_ += \ - mbox.stats._N_ - self->last_stats._N_) +#define AQ_SDELTA (_N_) \ +do { \ + if (!corrupted_stats && \ + ((s64)(mbox.stats._N_ - self->last_stats._N_)) >= 0) \ + curr_stats._N_ += mbox.stats._N_ - self->last_stats._N_; \ + else \ + corrupted_stats = true; \ +} while (0)if (self->aq_link_status.mbps) {AQ_SDELTA (uprc);
@@ -892,6 +900,9 @@ int hw_atl_utils_update_stats(struct aq_AQ_SDELTA (bbrc);AQ_SDELTA (bbtc);AQ_SDELTA (dpc); + +if (!corrupted_stats) + *cs = curr_stats; }#undef AQ_SDELTA
drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils.h +34 -4
@@ -239,7 +239,8 @@ struct version_s {u8 minor;u16 build; } phy; -u32 rsvd; + u32 drv_iface_ver:4; + u32 rsvd:28; };struct link_status_s {
@@ -424,7 +425,7 @@ struct cable_diag_status_s {u16 rsvd2; }; -struct statistics_s { +struct statistics_a0_s {struct {u32 link_up;u32 link_down;
@@ -457,6 +458,33 @@ struct statistics_s {u32 reserve_fw_gap; }; +struct __packed statistics_b0_s { +u64 rx_good_octets; +u64 rx_pause_frames; +u64 rx_good_frames; +u64 rx_errors; +u64 rx_unicast_frames; +u64 rx_multicast_frames; +u64 rx_broadcast_frames; + +u64 tx_good_octets; +u64 tx_pause_frames; +u64 tx_good_frames; +u64 tx_errors; +u64 tx_unicast_frames; +u64 tx_multicast_frames; +u64 tx_broadcast_frames; + +u32 main_loop_cycles; +}; + +struct __packed statistics_s { +union __packed { +struct statistics_a0_s a0; +struct statistics_b0_s b0; + }; +}; +struct filter_caps_s {u8 l2_filters_base_index:6 ;u8 flexible_filter_mask:2 ;
@@ -545,7 +573,7 @@ struct management_status_s {u32 rsvd5; }; -struct fw_interface_out { +struct __packed fw_interface_out {struct transaction_counter_s transaction_id;struct version_s version;struct link_status_s link_status;
@@ -569,7 +597,6 @@ struct fw_interface_out {struct core_dump_s core_dump;u32 rsvd11;struct statistics_s stats; -u32 rsvd12;struct filter_caps_s filter_caps;struct device_caps_s device_caps;u32 rsvd13;
@@ -592,6 +619,9 @@ struct fw_interface_out {#define AQ_HOST_MODE_LOW_POWER 3U#define AQ_HOST_MODE_SHUTDOWN 4U +#define AQ_A2_FW_INTERFACE_A0 0 +#define AQ_A2_FW_INTERFACE_B0 1 +int hw_atl2_utils_initfw (struct aq_hw_s *self,const struct aq_fw_ops **fw_ops);int hw_atl2_utils_soft_reset (struct aq_hw_s *self);
drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c +82 -19
117 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 102/130 atlantic: Remove warn trace message.
In reply to Greg Kroah-HartmanFrom: Sameer Saurabh <[email protected]>
commit 060a0fb721ec5bbe02ae322e434ec87dc25ed6e9 upstream.
Remove the warn trace message - it's not a correct check here, because the function can still be called on the device in DOWN state
--- drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 3 --- 1 file changed, 3 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_vec.c +0 -3
@@ -362,9 +362,6 @@ unsigned int aq_vec_get_sw_stats(struct {unsigned int count; -WARN_ONCE (!aq_vec_is_valid_tc (self, tc), -"Invalid tc %u (#rx=%u, #tx=%u)\n" , - tc, self->rx_rings, self->tx_rings);if (!aq_vec_is_valid_tc (self, tc))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 103/130 KVM: x86/pmu: Fix reserved bits for AMD PerfEvtSeln register
In reply to Greg Kroah-HartmanFrom: Like Xu <[email protected]>
[ Upstream commit cb1d220da0faa5ca0deb93449aff953f0c2cce6d ]
If we run the following perf command in an AMD Milan guest:
perf stat \ -e cpu/event=0x1d0/ \ -e cpu/event=0x1c7/ \ -e cpu/umask=0x1f,event=0x18e/ \ -e cpu/umask=0x7,event=0x18e/ \ -e cpu/umask=0x18,event=0x18e/ \ ./workload
dmesg will report a #GP warning from an unchecked MSR access error on MSR_F15H_PERF_CTLx.
This is because according to APM (Revision: 4.03) Figure 13-7, the bits [35:32] of AMD PerfEvtSeln register is a part of the event select encoding, which extends the EVENT_SELECT field from 8 bits to 12 bits.
Opportunistically update pmu->reserved_bits for reserved bit 19.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/svm/pmu.c +1 -1
@@ -274,7 +274,7 @@ static void amd_pmu_refresh(struct kvm_vcpu *vcpu) pmu->nr_arch_gp_counters =AMD64_NUM_COUNTERS ; pmu->counter_bitmask[KVM_PMC_GP ] = ((u64 )1 <<48 ) -1 ; - pmu->reserved_bits =0xffffffff00200000ull ; + pmu->reserved_bits =0xfffffff000280000ull ; pmu->version =1 ;/* not applicable to AMD; but clean them to prevent any fall out */ pmu->counter_bitmask[KVM_PMC_FIXED ] =0 ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 104/130 KVM: VMX: Set failure code in prepare_vmcs02()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit bfbb307c628676929c2d329da0daf9d22afa8ad2 ]
The error paths in the prepare_vmcs02() function are supposed to set *entry_failure_code but this path does not. It leads to using an uninitialized variable in the caller.
Message-Id: <20211130125337.GB24578@kili>
--- arch/x86/kvm/vmx/nested.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/kvm/vmx/nested.c +3 -1
@@ -2619,8 +2619,10 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,if ((vmcs12->vm_entry_controls &VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL ) &&WARN_ON_ONCE (kvm_set_msr (vcpu,MSR_CORE_PERF_GLOBAL_CTRL , - vmcs12->guest_ia32_perf_global_ctrl))) + vmcs12->guest_ia32_perf_global_ctrl))) { + *entry_failure_code =ENTRY_FAIL_DEFAULT ;return -EINVAL ; + }kvm_rsp_write (vcpu, vmcs12->guest_rsp);kvm_rip_write (vcpu, vmcs12->guest_rip);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 105/130 x86/sev: Fix SEV-ES INS/OUTS instructions for word, dword, and qword
In reply to Greg Kroah-HartmanFrom: Michael Sterritt <[email protected]>
[ Upstream commit 1d5379d0475419085d3575bd9155f2e558e96390 ]
Properly type the operands being passed to __put_user()/__get_user(). Otherwise, these routines truncate data for dependent instructions (e.g., INSW) and only read/write one byte.
This has been tested by sending a string with REP OUTSW to a port and then reading it back in with REP INSW on the same port.
Previous behavior was to only send and receive the first char of the size. For example, word operations for "abcd" would only read/write "ac". With change, the full string is now written and read back.
--- arch/x86/kernel/sev-es.c | 57 +++++++++++++++++++++++++++------------- 1 file changed, 39 insertions(+), 18 deletions(-)
arch/x86/kernel/sev-es.c +39 -18
@@ -260,11 +260,6 @@ static enum es_result vc_write_mem(struct es_em_ctxt *ctxt, char *dst, char *buf, size_t size) { unsigned long error_code = X86_PF_PROT | X86_PF_WRITE; -char __user *target = (char __user *)dst; -u64 d8; -u32 d4; -u16 d2; -u8 d1;/* * This function uses __put_user() independent of whether kernel or user
@@ -286,26 +281,42 @@ static enum es_result vc_write_mem(struct es_em_ctxt *ctxt,* instructions here would cause infinite nesting. */ switch (size) { -case 1 : +case 1 : { +u8 d1; +u8 __user *target = (u8 __user *)dst; +memcpy (&d1, buf,1 );if (__put_user (d1, target)) goto fault;break ; -case 2 : + } +case 2 : { +u16 d2; +u16 __user *target = (u16 __user *)dst; +memcpy (&d2, buf,2 );if (__put_user (d2, target)) goto fault;break ; -case 4 : + } +case 4 : { +u32 d4; +u32 __user *target = (u32 __user *)dst; +memcpy (&d4, buf,4 );if (__put_user (d4, target)) goto fault;break ; -case 8 : + } +case 8 : { +u64 d8; +u64 __user *target = (u64 __user *)dst; +memcpy (&d8, buf,8 );if (__put_user (d8, target)) goto fault;break ; + }default :WARN_ONCE (1 ,"%s: Invalid size: %zu\n" , __func__, size);return ES_UNSUPPORTED ;
@@ -328,11 +339,6 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt, char *src, char *buf, size_t size) { unsigned long error_code = X86_PF_PROT; -char __user *s = (char __user *)src; -u64 d8; -u32 d4; -u16 d2; -u8 d1;/* * This function uses __get_user() independent of whether kernel or user
@@ -354,26 +360,41 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt,* instructions here would cause infinite nesting. */ switch (size) { -case 1 : +case 1 : { +u8 d1; +u8 __user *s = (u8 __user *)src; +if (__get_user (d1, s)) goto fault;memcpy (buf, &d1,1 );break ; -case 2 : + } +case 2 : { +u16 d2; +u16 __user *s = (u16 __user *)src; +if (__get_user (d2, s)) goto fault;memcpy (buf, &d2,2 );break ; -case 4 : + } +case 4 : { +u32 d4; +u32 __user *s = (u32 __user *)src; +if (__get_user (d4, s)) goto fault;memcpy (buf, &d4,4 );break ; -case 8 : + } +case 8 : { +u64 d8; +u64 __user *s = (u64 __user *)src;if (__get_user (d8, s)) goto fault;memcpy (buf, &d8,8 );break ; + }default :WARN_ONCE (1 ,"%s: Invalid size: %zu\n" , __func__, size);return ES_UNSUPPORTED ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 106/130 x86/entry: Use the correct fence macro after swapgs in kernel CR3
In reply to Greg Kroah-HartmanFrom: Lai Jiangshan <[email protected]>
[ Upstream commit 1367afaa2ee90d1c956dfc224e199fcb3ff3f8cc ]
The commit
c75890700455 ("x86/entry/64: Remove unneeded kernel CR3 switching")
removed a CR3 write in the faulting path of load_gs_index().
But the path's FENCE_SWAPGS_USER_ENTRY has no fence operation if PTI is enabled, see spectre_v1_select_mitigation().
Rather, it depended on the serializing CR3 write of SWITCH_TO_KERNEL_CR3 and since it got removed, add a FENCE_SWAPGS_KERNEL_ENTRY call to make sure speculation is blocked.
[ bp: Massage commit message and comment. ]
--- arch/x86/entry/entry_64.S | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
arch/x86/entry/entry_64.S +8 -7
@@ -1035,11 +1035,6 @@ SYM_CODE_START_LOCAL(error_entry) pushq %r12 ret -.Lerror_entry_done_lfence: - FENCE_SWAPGS_KERNEL_ENTRY -.Lerror_entry_done: - ret - /* * There are two places in the kernel that can potentially fault with * usergs. Handle them here. B stepping K8s sometimes report a
@@ -1062,8 +1057,14 @@ SYM_CODE_START_LOCAL(error_entry) * .Lgs_change's error handler with kernel gsbase. */ SWAPGS - FENCE_SWAPGS_USER_ENTRY - jmp .Lerror_entry_done + + /* + * Issue an LFENCE to prevent GS speculation, regardless of whether it is a + * kernel or user gsbase. + */ +.Lerror_entry_done_lfence: + FENCE_SWAPGS_KERNEL_ENTRY + ret .Lbstep_iret: /* Fix truncated RIP */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 107/130 x86/xen: Add xenpv_restore_regs_and_return_to_usermode()
In reply to Greg Kroah-HartmanFrom: Lai Jiangshan <[email protected]>
[ Upstream commit 5c8f6a2e316efebb3ba93d8c1af258155dcf5632 ]
In the native case, PER_CPU_VAR(cpu_tss_rw + TSS_sp0) is the trampoline stack. But XEN pv doesn't use trampoline stack, so PER_CPU_VAR(cpu_tss_rw + TSS_sp0) is also the kernel stack.
In that case, source and destination stacks are identical, which means that reusing swapgs_restore_regs_and_return_to_usermode() in XEN pv would cause %rsp to move up to the top of the kernel stack and leave the IRET frame below %rsp.
This is dangerous as it can be corrupted if #NMI / #MC hit as either of these events occurring in the middle of the stack pushing would clobber data on the (original) stack.
And, with XEN pv, swapgs_restore_regs_and_return_to_usermode() pushing the IRET frame on to the original address is useless and error-prone when there is any future attempt to modify the code.
[ bp: Massage commit message. ]
--- arch/x86/entry/entry_64.S | 4 ++++ arch/x86/xen/xen-asm.S | 20 ++++++++++++++++++++ 2 files changed, 24 insertions(+)
arch/x86/entry/entry_64.S +4 -0
@@ -575,6 +575,10 @@ SYM_INNER_LABEL(swapgs_restore_regs_and_return_to_usermode, SYM_L_GLOBAL) ud2 1: #endif +#ifdef CONFIG_XEN_PV + ALTERNATIVE "", "jmp xenpv_restore_regs_and_return_to_usermode", X86_FEATURE_XENPV +#endif + POP_REGS pop_rdi=0 /*
arch/x86/xen/xen-asm.S +20 -0
@@ -19,6 +19,7 @@ #include <linux/init.h> #include <linux/linkage.h> +#include <../entry/calling.h> /* * Enable events. This clears the event mask and tests the pending
@@ -235,6 +236,25 @@ SYM_CODE_START(xen_sysret64) jmp hypercall_iret SYM_CODE_END(xen_sysret64) +/* + * XEN pv doesn't use trampoline stack, PER_CPU_VAR(cpu_tss_rw + TSS_sp0) is + * also the kernel stack. Reusing swapgs_restore_regs_and_return_to_usermode() + * in XEN pv would cause %rsp to move up to the top of the kernel stack and + * leave the IRET frame below %rsp, which is dangerous to be corrupted if #NMI + * interrupts. And swapgs_restore_regs_and_return_to_usermode() pushing the IRET + * frame at the same address is useless. + */ +SYM_CODE_START(xenpv_restore_regs_and_return_to_usermode) + UNWIND_HINT_REGS + POP_REGS + + /* stackleak_erase() can work safely on the kernel stack. */ + STACKLEAK_ERASE_NOCLOBBER + + addq $8, %rsp /* skip regs->orig_ax */ + jmp xen_iret +SYM_CODE_END(xenpv_restore_regs_and_return_to_usermode) + /* * Xen handles syscall callbacks much like ordinary exceptions, which * means we have:
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 108/130 sched/uclamp: Fix rq->uclamp_max not set on first enqueue
In reply to Greg Kroah-HartmanFrom: Qais Yousef <[email protected]>
[ Upstream commit 315c4f884800c45cb6bd8c90422fad554a8b9588 ]
Commit d81ae8aac85c ("sched/uclamp: Fix initialization of struct uclamp_rq") introduced a bug where uclamp_max of the rq is not reset to match the woken up task's uclamp_max when the rq is idle.
The code was relying on rq->uclamp_max initialized to zero, so on first enqueue
static inline void uclamp_rq_inc_id(struct rq *rq, struct task_struct *p,
enum uclamp_id clamp_id)
{
...
if (uc_se->value > READ_ONCE(uc_rq->value))
WRITE_ONCE(uc_rq->value, uc_se->value);
}was actually resetting it. But since commit d81ae8aac85c changed the default to 1024, this no longer works. And since rq->uclamp_flags is also initialized to 0, neither above code path nor uclamp_idle_reset() update the rq->uclamp_max on first wake up from idle.
This is only visible from first wake up(s) until the first dequeue to idle after enabling the static key. And it only matters if the uclamp_max of this task is < 1024 since only then its uclamp_max will be effectively ignored.
Fix it by properly initializing rq->uclamp_flags = UCLAMP_FLAG_IDLE to ensure uclamp_idle_reset() is called which then will update the rq uclamp_max value as expected.
--- kernel/sched/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/core.c +1 -1
@@ -1526,7 +1526,7 @@ static void __init init_uclamp_rq(struct rq *rq) }; } - rq->uclamp_flags =0 ; + rq->uclamp_flags =UCLAMP_FLAG_IDLE ; }static void __init init_uclamp (void )
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 109/130 x86/pv: Switch SWAPGS to ALTERNATIVE
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
[ Upstream commit 53c9d9240944088274aadbbbafc6138ca462db4f ]
SWAPGS is used only for interrupts coming from user mode or for returning to user mode. So there is no reason to use the PARAVIRT framework, as it can easily be replaced by an ALTERNATIVE depending on X86_FEATURE_XENPV.
There are several instances using the PV-aware SWAPGS macro in paths which are never executed in a Xen PV guest. Replace those with the plain swapgs instruction. For SWAPGS_UNSAFE_STACK the same applies.
--- arch/x86/entry/entry_64.S | 10 +++++----- arch/x86/include/asm/irqflags.h | 20 ++++++++------------ arch/x86/include/asm/paravirt.h | 20 -------------------- arch/x86/include/asm/paravirt_types.h | 2 -- arch/x86/kernel/asm-offsets_64.c | 1 - arch/x86/kernel/paravirt.c | 1 - arch/x86/kernel/paravirt_patch.c | 3 --- arch/x86/xen/enlighten_pv.c | 3 --- 8 files changed, 13 insertions(+), 47 deletions(-)
arch/x86/entry/entry_64.S +5 -5
@@ -673,7 +673,7 @@ native_irq_return_ldt: */ pushq %rdi /* Stash user RDI */ - SWAPGS /* to kernel GS */ + swapgs /* to kernel GS */ SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi /* to kernel CR3 */ movq PER_CPU_VAR(espfix_waddr), %rdi
@@ -703,7 +703,7 @@ native_irq_return_ldt: orq PER_CPU_VAR(espfix_stack), %rax SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi - SWAPGS /* to user GS */ + swapgs /* to user GS */ popq %rdi /* Restore user RDI */ movq %rax, %rsp
@@ -947,7 +947,7 @@ SYM_CODE_START_LOCAL(paranoid_entry) ret .Lparanoid_entry_swapgs: - SWAPGS + swapgs /* * The above SAVE_AND_SWITCH_TO_KERNEL_CR3 macro doesn't do an
@@ -1005,7 +1005,7 @@ SYM_CODE_START_LOCAL(paranoid_exit) jnz restore_regs_and_return_to_kernel /* We are returning to a context with user GSBASE */ - SWAPGS_UNSAFE_STACK + swapgs jmp restore_regs_and_return_to_kernel SYM_CODE_END(paranoid_exit)
@@ -1431,7 +1431,7 @@ nmi_no_fsgsbase: jnz nmi_restore nmi_swapgs: - SWAPGS_UNSAFE_STACK + swapgs nmi_restore: POP_REGS
arch/x86/include/asm/irqflags.h +8 -12
@@ -131,18 +131,6 @@ static __always_inline unsigned long arch_local_irq_save(void)#define SAVE_FLAGS (x) pushfq; popq %rax#endif -#define SWAPGS swapgs -/* -* Currently paravirt can't handle swapgs nicely when we -* don't have a stack we can rely on (such as a user space -* stack). So we either find a way around these or just fault -* and emulate if a guest tries to call swapgs directly. -* -* Either way, this is a good way to document that we don't -* have a reliable stack. x86_64 only. -*/ -#define SWAPGS_UNSAFE_STACK swapgs -#define INTERRUPT_RETURN jmp native_iret#define USERGS_SYSRET64 \ swapgs; \
@@ -170,6 +158,14 @@ static __always_inline int arch_irqs_disabled(void)return arch_irqs_disabled_flags (flags); } +#else +#ifdef CONFIG_X86_64 +#ifdef CONFIG_XEN_PV +#define SWAPGS ALTERNATIVE "swapgs", "", X86_FEATURE_XENPV +#else +#define SWAPGS swapgs +#endif +#endif #endif /* !__ASSEMBLY__ */ #endif
arch/x86/include/asm/paravirt.h +0 -20
@@ -776,26 +776,6 @@ extern void default_banner(void);#ifdef CONFIG_X86_64 #ifdef CONFIG_PARAVIRT_XXL -/* -* If swapgs is used while the userspace stack is still current, -* there's no way to call a pvop. The PV replacement *must* be -* inlined, or the swapgs instruction must be trapped and emulated. -*/ -#define SWAPGS_UNSAFE_STACK \ - PARA_SITE(PARA_PATCH(PV_CPU_swapgs), swapgs) - -/* -* Note: swapgs is very special, and in practise is either going to be -* implemented with a single "swapgs" instruction or something very -* special. Either way, we don't need to save any registers for -* it. -*/ -#define SWAPGS \ - PARA_SITE(PARA_PATCH(PV_CPU_swapgs), \ - ANNOTATE_RETPOLINE_SAFE; \ - call PARA_INDIRECT(pv_ops+PV_CPU_swapgs); \ - ) -#define USERGS_SYSRET64 \ PARA_SITE(PARA_PATCH(PV_CPU_usergs_sysret64), \ ANNOTATE_RETPOLINE_SAFE; \
arch/x86/include/asm/paravirt_types.h +0 -2
@@ -169,8 +169,6 @@ struct pv_cpu_ops {frame set up. */ void (*iret)(void ); -void (*swapgs)(void ); -void (*start_context_switch)(struct task_struct *prev);void (*end_context_switch)(struct task_struct *next);#endif
arch/x86/kernel/asm-offsets_64.c +0 -1
@@ -15,7 +15,6 @@ int main(void)#ifdef CONFIG_PARAVIRT_XXL OFFSET (PV_CPU_usergs_sysret64, paravirt_patch_template, cpu.usergs_sysret64); -OFFSET (PV_CPU_swapgs, paravirt_patch_template, cpu.swapgs);#ifdef CONFIG_DEBUG_ENTRY OFFSET (PV_IRQ_save_fl, paravirt_patch_template, irq.save_fl);#endif
arch/x86/kernel/paravirt.c +0 -1
@@ -312,7 +312,6 @@ struct paravirt_patch_template pv_ops = { .cpu.usergs_sysret64 = native_usergs_sysret64, .cpu.iret = native_iret, - .cpu.swapgs = native_swapgs, #ifdef CONFIG_X86_IOPL_IOPERM .cpu.invalidate_io_bitmap = native_tss_invalidate_io_bitmap,
arch/x86/kernel/paravirt_patch.c +0 -3
@@ -28,7 +28,6 @@ struct patch_xxl {const unsigned char irq_restore_fl[2 ];const unsigned char cpu_wbinvd[2 ];const unsigned char cpu_usergs_sysret64[6 ]; -const unsigned char cpu_swapgs[3 ];const unsigned char mov64[3 ]; };
@@ -43,7 +42,6 @@ static const struct patch_xxl patch_data_xxl = { .cpu_wbinvd = { 0x0f, 0x09 }, // wbinvd .cpu_usergs_sysret64 = { 0x0f, 0x01, 0xf8, 0x48, 0x0f, 0x07 }, // swapgs; sysretq - .cpu_swapgs = { 0x0f, 0x01, 0xf8 }, // swapgs .mov64 = { 0x48, 0x89, 0xf8 }, // mov %rdi, %rax };
@@ -86,7 +84,6 @@ unsigned int native_patch(u8 type, void *insn_buff, unsigned long addr,PATCH_CASE (mmu, write_cr3, xxl, insn_buff, len);PATCH_CASE (cpu, usergs_sysret64, xxl, insn_buff, len); -PATCH_CASE (cpu, swapgs, xxl, insn_buff, len);PATCH_CASE (cpu, wbinvd, xxl, insn_buff, len);#endif
arch/x86/xen/enlighten_pv.c +0 -3
@@ -1083,9 +1083,6 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = {#endif .io_delay = xen_io_delay, -/* Xen takes care of %gs when switching to usermode for us */ - .swapgs = paravirt_nop, - .start_context_switch = paravirt_start_context_switch, .end_context_switch = xen_end_context_switch, };
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 110/130 x86/entry: Add a fence for kernel entry SWAPGS in paranoid_entry()
In reply to Greg Kroah-HartmanFrom: Lai Jiangshan <[email protected]>
[ Upstream commit c07e45553da1808aa802e9f0ffa8108cfeaf7a17 ]
Commit
18ec54fdd6d18 ("x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations")
added FENCE_SWAPGS_{KERNEL|USER}_ENTRY for conditional SWAPGS. In paranoid_entry(), it uses only FENCE_SWAPGS_KERNEL_ENTRY for both branches. This is because the fence is required for both cases since the CR3 write is conditional even when PTI is enabled.
But
96b2371413e8f ("x86/entry/64: Switch CR3 before SWAPGS in paranoid entry")
changed the order of SWAPGS and the CR3 write. And it missed the needed FENCE_SWAPGS_KERNEL_ENTRY for the user gsbase case.
Add it back by changing the branches so that FENCE_SWAPGS_KERNEL_ENTRY can cover both branches.
[ bp: Massage, fix typos, remove obsolete comment while at it. ]
--- arch/x86/entry/entry_64.S | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
arch/x86/entry/entry_64.S +5 -11
@@ -936,6 +936,7 @@ SYM_CODE_START_LOCAL(paranoid_entry) .Lparanoid_entry_checkgs: /* EBX = 1 -> kernel GSBASE active, no restore required */ movl $1, %ebx + /* * The kernel-enforced convention is a negative GSBASE indicates * a kernel value. No SWAPGS needed on entry and exit.
@@ -943,21 +944,14 @@ SYM_CODE_START_LOCAL(paranoid_entry) movl $MSR_GS_BASE, %ecx rdmsr testl %edx, %edx - jns .Lparanoid_entry_swapgs - ret + js .Lparanoid_kernel_gsbase -.Lparanoid_entry_swapgs: + /* EBX = 0 -> SWAPGS required on exit */ + xorl %ebx, %ebx swapgs +.Lparanoid_kernel_gsbase: - /* - * The above SAVE_AND_SWITCH_TO_KERNEL_CR3 macro doesn't do an - * unconditional CR3 write, even in the PTI case. So do an lfence - * to prevent GS speculation, regardless of whether PTI is enabled. - */ FENCE_SWAPGS_KERNEL_ENTRY - - /* EBX = 0 -> SWAPGS required on exit */ - xorl %ebx, %ebx ret SYM_CODE_END(paranoid_entry)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 111/130 parisc: Fix KBUILD_IMAGE for self-extracting kernel
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 1d7c29b77725d05faff6754d2f5e7c147aedcf93 upstream.
Default KBUILD_IMAGE to $(boot)/bzImage if a self-extracting (CONFIG_PARISC_SELF_EXTRACT=y) kernel is to be built. This fixes the bindeb-pkg make target.
--- arch/parisc/Makefile | 5 +++++ 1 file changed, 5 insertions(+)
arch/parisc/Makefile +5 -0
@@ -17,7 +17,12 @@ # Mike Shaver, Helge Deller and Martin K. Petersen # +ifdef CONFIG_PARISC_SELF_EXTRACT +boot := arch/parisc/boot +KBUILD_IMAGE := $(boot)/bzImage +else KBUILD_IMAGE := vmlinuz +endif NM = sh $(srctree)/arch/parisc/nm CHECKFLAGS += -D__hppa__=1
Greg Kroah-Hartman
maintainerPATCH 112/130 parisc: Fix "make install" on newer debian releases
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 0f9fee4cdebfbe695c297e5b603a275e2557c1cc upstream.
On newer debian releases the debian-provided "installkernel" script is installed in /usr/sbin. Fix the kernel install.sh script to look for the script in this directory as well.
--- arch/parisc/install.sh | 1 + 1 file changed, 1 insertion(+)
arch/parisc/install.sh +1 -0
@@ -39,6 +39,7 @@ verify "$3" if [ -n "${INSTALLKERNEL}" ]; then if [ -x ~/bin/${INSTALLKERNEL} ]; then exec ~/bin/${INSTALLKERNEL} "$@"; fi if [ -x /sbin/${INSTALLKERNEL} ]; then exec /sbin/${INSTALLKERNEL} "$@"; fi + if [ -x /usr/sbin/${INSTALLKERNEL} ]; then exec /usr/sbin/${INSTALLKERNEL} "$@"; fi fi # Default install
Greg Kroah-Hartman
maintainerPATCH 113/130 vgacon: Propagate console boot parameters before calling `vc_resize
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit 3dfac26e2ef29ff2abc2a75aa4cd48fce25a2c4b upstream.
Fix a division by zero in `vgacon_resize' with a backtrace like:
vgacon_resizevc_do_resizevgacon_initdo_bind_con_driverdo_unbind_con_driverfbcon_fb_unbinddo_unregister_framebufferdo_register_framebufferregister_framebuffer__drm_fb_helper_initial_config_and_unlockdrm_helper_hpd_irq_eventdw_hdmi_irqirq_thread
kthread
caused by `c->vc_cell_height' not having been initialized. This has only started to trigger with commit 860dafa90259 ("vt: Fix character height handling with VT_RESIZEX"), however the ultimate offender is commit 50ec42edd978 ("[PATCH] Detaching fbcon: fix vgacon to allow retaking of the console").
Said commit has added a call to vc_resize' whenever vgacon_init' is called with the init' argument set to 0, which did not happen before. And the call is made before a key vgacon boot parameter retrieved in vgacon_startup' has been propagated in vgacon_init' for vc_resize' to use to the console structure being worked on. Previously the parameter was c->vc_font.height' and now it is c->vc_cell_height'.
In this particular scenario the registration of fbcon has failed and vt resorts to vgacon. Now fbcon does have initialized c->vc_font.height' somehow, unlike c->vc_cell_height', which is why this code did not crash before, but either way the boot parameters should have been copied to the console structure ahead of the call to vc_resize' rather than afterwards, so that first the call has a chance to use them and second they do not change the console structure to something possibly different from what was used by vc_resize'.
Move the propagation of the vgacon boot parameters ahead of the call to `vc_resize' then. Adjust the comment accordingly.
--- drivers/video/console/vgacon.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/video/console/vgacon.c +9 -5
@@ -370,11 +370,17 @@ static void vgacon_init(struct vc_data *struct uni_pagedir *p;/* -* We cannot be loaded as a module, therefore init is always 1, -* but vgacon_init can be called more than once, and init will -* not be 1. +* We cannot be loaded as a module, therefore init will be 1 +* if we are the default console, however if we are a fallback +* console, for example if fbcon has failed registration, then +* init will be 0, so we need to make sure our boot parameters +* have been copied to the console structure for vgacon_resize +* ultimately called by vc_resize. Any subsequent calls to +* vgacon_init init will have init set to 0 too. */ c->vc_can_do_color = vga_can_do_color; + c->vc_scan_lines = vga_scan_lines; + c->vc_font.height = c->vc_cell_height = vga_video_font_height;/* set dimensions manually if init != 0 since vc_resize() will fail */ if (init) {
@@ -383,8 +389,6 @@ static void vgacon_init(struct vc_data * }else vc_resize (c, vga_video_num_columns, vga_video_num_lines); - c->vc_scan_lines = vga_scan_lines; - c->vc_font.height = c->vc_cell_height = vga_video_font_height; c->vc_complement_mask =0x7700 ;if (vga_512_chars) c->vc_hi_font_mask =0x0800 ;
Greg Kroah-Hartman
maintainerPATCH 114/130 xhci: Fix commad ring abort, write all 64 bits to CRCR register.
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 09f736aa95476631227d2dc0e6b9aeee1ad7ed58 upstream.
Turns out some xHC controllers require all 64 bits in the CRCR register to be written to execute a command abort.
The lower 32 bits containing the command abort bit is written first. In case the command ring stops before we write the upper 32 bits then hardware may use these upper bits to set the commnd ring dequeue pointer.
Solve this by making sure the upper 32 bits contain a valid command ring dequeue pointer.
The original patch that only wrote the first 32 to stop the ring went to stable, so this fix should go there as well.
--- drivers/usb/host/xhci-ring.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/usb/host/xhci-ring.c +14 -7
@@ -342,7 +342,9 @@ static void xhci_handle_stopped_cmd_ring/* Must be called with xhci->lock held, releases and aquires lock back */ static int xhci_abort_cmd_ring (struct xhci_hcd *xhci,unsigned long flags) { -u32 temp_32; +struct xhci_segment *new_seg = xhci->cmd_ring->deq_seg; +union xhci_trb *new_deq = xhci->cmd_ring->dequeue; +u64 crcr;int ret;xhci_dbg (xhci,"Abort command ring\n" );
@@ -351,13 +353,18 @@ static int xhci_abort_cmd_ring(struct xh/* * The control bits like command stop, abort are located in lower -* dword of the command ring control register. Limit the write -* to the lower dword to avoid corrupting the command ring pointer -* in case if the command ring is stopped by the time upper dword -* is written. +* dword of the command ring control register. +* Some controllers require all 64 bits to be written to abort the ring. +* Make sure the upper dword is valid, pointing to the next command, +* avoiding corrupting the command ring pointer in case the command ring +* is stopped by the time the upper dword is written. */ - temp_32 =readl (&xhci->op_regs->cmd_ring); -writel (temp_32 |CMD_RING_ABORT , &xhci->op_regs->cmd_ring); +next_trb (xhci,NULL , &new_seg, &new_deq); +if (trb_is_link (new_deq)) +next_trb (xhci,NULL , &new_seg, &new_deq); + + crcr =xhci_trb_virt_to_dma (new_seg, new_deq); +xhci_write_64 (xhci, crcr |CMD_RING_ABORT , &xhci->op_regs->cmd_ring);/* Section 4.6.1.2 of xHCI 1.0 spec says software should also time the * completion of the Command Abort operation. If CRR is not negated in 5
Greg Kroah-Hartman
maintainerPATCH 115/130 USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub
In reply to Greg Kroah-HartmanFrom: Ole Ernst <[email protected]>
commit d2a004037c3c6afd36d40c384d2905f47cd51c57 upstream.
This is another branded 8153 device that doesn't work well with LPM:
r8152 2-2.1:1.0 enp0s13f0u2u1: Stop submitting intr, status -71
Disable LPM to resolve the issue.
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -435,6 +435,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x1532, 0x0116), .driver_info = USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + /* Lenovo Powered USB-C Travel Hub (4X90S92381, RTL8153 GigE) */ + { USB_DEVICE(0x17ef, 0x721e), .driver_info = USB_QUIRK_NO_LPM }, + /* Lenovo ThinkCenter A630Z TI024Gen3 usb-audio */ { USB_DEVICE(0x17ef, 0xa012), .driver_info = USB_QUIRK_DISCONNECT_SUSPEND },
Greg Kroah-Hartman
maintainerPATCH 116/130 usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
In reply to Greg Kroah-HartmanFrom: Badhri Jagan Sridharan <[email protected]>
commit fbcd13df1e78eb2ba83a3c160eefe2d6f574beaf upstream.
Stub from the spec:
"4.5.2.2.4.2 Exiting from AttachWait.SNK State
A Sink shall transition to Unattached.SNK when the state of both the CC1 and CC2 pins is SNK.Open for at least tPDDebounce. A DRP shall transition to Unattached.SRC when the state of both the CC1 and CC2 pins is SNK.Open for at least tPDDebounce."
This change makes TCPM to wait in SNK_DEBOUNCED state until CC1 and CC2 pins is SNK.Open for at least tPDDebounce. Previously, TCPM resets the port if vbus is not present in PD_T_PS_SOURCE_ON. This causes TCPM to loop continuously when connected to a faulty power source that does not present vbus. Waiting in SNK_DEBOUNCED also ensures that TCPM is adherant to "4.5.2.2.4.2 Exiting from AttachWait.SNK State" requirements.
[ 6169.280751] CC1: 0 -> 0, CC2: 0 -> 5 [state TOGGLING, polarity 0, connected] [ 6169.280759] state change TOGGLING -> SNK_ATTACH_WAIT [rev2 NONE_AMS] [ 6169.280771] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @ 170 ms [rev2 NONE_AMS] [ 6169.282427] CC1: 0 -> 0, CC2: 5 -> 5 [state SNK_ATTACH_WAIT, polarity 0, connected] [ 6169.450825] state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED [delayed 170 ms] [ 6169.450834] pending state change SNK_DEBOUNCED -> PORT_RESET @ 480 ms [rev2 NONE_AMS] [ 6169.930892] state change SNK_DEBOUNCED -> PORT_RESET [delayed 480 ms] [ 6169.931296] disable vbus discharge ret:0 [ 6169.931301] Setting usb_comm capable false [ 6169.932783] Setting voltage/current limit 0 mV 0 mA [ 6169.932802] polarity 0 [ 6169.933706] Requesting mux state 0, usb-role 0, orientation 0 [ 6169.936689] cc:=0 [ 6169.936812] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev2 NONE_AMS] [ 6169.937157] CC1: 0 -> 0, CC2: 5 -> 0 [state PORT_RESET, polarity 0, disconnected] [ 6170.036880] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms] [ 6170.036890] state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED [rev2 NONE_AMS] [ 6170.036896] Start toggling [ 6170.041412] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected] [ 6170.042973] CC1: 0 -> 0, CC2: 0 -> 5 [state TOGGLING, polarity 0, connected] [ 6170.042976] state change TOGGLING -> SNK_ATTACH_WAIT [rev2 NONE_AMS] [ 6170.042981] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @ 170 ms [rev2 NONE_AMS] [ 6170.213014] state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED [delayed 170 ms] [ 6170.213019] pending state change SNK_DEBOUNCED -> PORT_RESET @ 480 ms [rev2 NONE_AMS] [ 6170.693068] state change SNK_DEBOUNCED -> PORT_RESET [delayed 480 ms] [ 6170.693304] disable vbus discharge ret:0 [ 6170.693308] Setting usb_comm capable false [ 6170.695193] Setting voltage/current limit 0 mV 0 mA [ 6170.695210] polarity 0 [ 6170.695990] Requesting mux state 0, usb-role 0, orientation 0 [ 6170.701896] cc:=0 [ 6170.702181] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev2 NONE_AMS] [ 6170.703343] CC1: 0 -> 0, CC2: 5 -> 0 [state PORT_RESET, polarity 0, disconnected]
--- drivers/usb/typec/tcpm/tcpm.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/usb/typec/tcpm/tcpm.c +0 -4
@@ -3293,11 +3293,7 @@ static void run_state_machine(struct tcptcpm_try_src (port) ?SRC_TRY :SNK_ATTACHED , 0); - else -/* Wait for VBUS, but not forever */ -tcpm_set_state (port ,PORT_RESET ,PD_T_PS_SOURCE_ON );break ; -case SRC_TRY : port->try_src_count++;tcpm_set_cc (port,tcpm_rp_cc (port));
Greg Kroah-Hartman
maintainerPATCH 117/130 x86/tsc: Add a timer to make sure TSC_adjust is always checked
In reply to Greg Kroah-HartmanFrom: Feng Tang <[email protected]>
commit c7719e79347803b8e3b6b50da8c6db410a3012b5 upstream.
The TSC_ADJUST register is checked every time a CPU enters idle state, but Thomas Gleixner mentioned there is still a caveat that a system won't enter idle [1], either because it's too busy or configured purposely to not enter idle.
Setup a periodic timer (every 10 minutes) to make sure the check is happening on a regular base.
[1] https://lore.kernel.org/lkml/[email protected]/
--- arch/x86/kernel/tsc_sync.c | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+)
arch/x86/kernel/tsc_sync.c +41 -0
@@ -30,6 +30,7 @@ struct tsc_adjust { }; static DEFINE_PER_CPU(struct tsc_adjust, tsc_adjust); +static struct timer_list tsc_sync_check_timer;/* * TSC's on different sockets may be reset asynchronously.
@@ -77,6 +78,46 @@ void tsc_verify_tsc_adjust(bool resume) } } +/* +* Normally the tsc_sync will be checked every time system enters idle +* state, but there is still caveat that a system won't enter idle, +* either because it's too busy or configured purposely to not enter +* idle. +* +* So setup a periodic timer (every 10 minutes) to make sure the check +* is always on. +*/ + +#define SYNC_CHECK_INTERVAL (HZ * 600) + +static void tsc_sync_check_timer_fn (struct timer_list *unused) +{ +int next_cpu; + +tsc_verify_tsc_adjust (false); + +/* Run the check for all onlined CPUs in turn */ + next_cpu =cpumask_next (raw_smp_processor_id (), cpu_online_mask); +if (next_cpu >= nr_cpu_ids) + next_cpu =cpumask_first (cpu_online_mask); + + tsc_sync_check_timer.expires +=SYNC_CHECK_INTERVAL ; +add_timer_on (&tsc_sync_check_timer, next_cpu); +} + +static int __init start_sync_check_timer (void ) +{ +if (!cpu_feature_enabled (X86_FEATURE_TSC_ADJUST ) || tsc_clocksource_reliable) +return 0 ; + +timer_setup (&tsc_sync_check_timer, tsc_sync_check_timer_fn,0 ); + tsc_sync_check_timer.expires = jiffies +SYNC_CHECK_INTERVAL ; +add_timer (&tsc_sync_check_timer); + +return 0 ; +} +late_initcall (start_sync_check_timer); +static void tsc_sanitize_first_cpu (struct tsc_adjust *cur,s64 bootval,unsigned int cpu,bool bootcpu) {
Greg Kroah-Hartman
maintainerPATCH 118/130 x86/tsc: Disable clocksource watchdog for TSC on qualified platorms
In reply to Greg Kroah-HartmanFrom: Feng Tang <[email protected]>
commit b50db7095fe002fa3e16605546cba66bf1b68a3e upstream.
There are cases that the TSC clocksource is wrongly judged as unstable by the clocksource watchdog mechanism which tries to validate the TSC against HPET, PM_TIMER or jiffies. While there is hardly a general reliable way to check the validity of a watchdog, Thomas Gleixner proposed [1]:
"I'm inclined to lift that requirement when the CPU has:
1) X86_FEATURE_CONSTANT_TSC
2) X86_FEATURE_NONSTOP_TSC
3) X86_FEATURE_NONSTOP_TSC_S3
4) X86_FEATURE_TSC_ADJUST
5) At max. 4 sockets
After two decades of horrors we're finally at a point where TSC seems to be halfway reliable and less abused by BIOS tinkerers. TSC_ADJUST was really key as we can now detect even small modifications reliably and the important point is that we can cure them as well (not pretty but better than all other options)."
As feature #3 X86_FEATURE_NONSTOP_TSC_S3 only exists on several generations of Atom processorz, and is always coupled with X86_FEATURE_CONSTANT_TSC and X86_FEATURE_NONSTOP_TSC, skip checking it, and also be more defensive to use maximal 2 sockets.
The check is done inside tsc_init() before registering 'tsc-early' and 'tsc' clocksources, as there were cases that both of them had been wrongly judged as unreliable.
For more background of tsc/watchdog, there is a good summary in [2]
[tglx} Update vs. jiffies:
On systems where the only remaining clocksource aside of TSC is jiffies there is no way to make this work because that creates a circular dependency. Jiffies accuracy depends on not missing a periodic timer interrupt, which is not guaranteed. That could be detected by TSC, but as TSC is not trusted this cannot be compensated. The consequence is a circulus vitiosus which results in shutting down TSC and falling back to the jiffies clocksource which is even more unreliable.
[1]. https://lore.kernel.org/lkml/[email protected]/
[2]. https://lore.kernel.org/lkml/[email protected]/
[ tglx: Refine comment and amend changelog ]
--- arch/x86/kernel/tsc.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-)
arch/x86/kernel/tsc.c +24 -4
@@ -1178,6 +1178,12 @@ void mark_tsc_unstable(char *reason)EXPORT_SYMBOL_GPL (mark_tsc_unstable); +static void __init tsc_disable_clocksource_watchdog (void ) +{ + clocksource_tsc_early.flags &= ~CLOCK_SOURCE_MUST_VERIFY ; + clocksource_tsc.flags &= ~CLOCK_SOURCE_MUST_VERIFY ; +} +static void __init check_system_tsc_reliable (void ) {#if defined(CONFIG_MGEODEGX1 ) || defined(CONFIG_MGEODE_LX ) || defined(CONFIG_X86_GENERIC )
@@ -1194,6 +1200,23 @@ static void __init check_system_tsc_reli#endif if (boot_cpu_has (X86_FEATURE_TSC_RELIABLE )) tsc_clocksource_reliable =1 ; + +/* +* Disable the clocksource watchdog when the system has: +* - TSC running at constant frequency +* - TSC which does not stop in C-States +* - the TSC_ADJUST register which allows to detect even minimal +* modifications +* - not more than two sockets. As the number of sockets cannot be +* evaluated at the early boot stage where this has to be +* invoked, check the number of online memory nodes as a +* fallback solution which is an reasonable estimate. +*/ +if (boot_cpu_has (X86_FEATURE_CONSTANT_TSC ) && +boot_cpu_has (X86_FEATURE_NONSTOP_TSC ) && +boot_cpu_has (X86_FEATURE_TSC_ADJUST ) && + nr_online_nodes <=2 ) +tsc_disable_clocksource_watchdog (); }/*
@@ -1385,9 +1408,6 @@ static int __init init_tsc_clocksource(vif (tsc_unstable) goto unreg; -if (tsc_clocksource_reliable || no_tsc_watchdog) - clocksource_tsc.flags &= ~CLOCK_SOURCE_MUST_VERIFY ; -if (boot_cpu_has (X86_FEATURE_NONSTOP_TSC_S3 )) clocksource_tsc.flags |=CLOCK_SOURCE_SUSPEND_NONSTOP ;
@@ -1525,7 +1545,7 @@ void __init tsc_init(void) }if (tsc_clocksource_reliable || no_tsc_watchdog) - clocksource_tsc_early.flags &= ~CLOCK_SOURCE_MUST_VERIFY ; +tsc_disable_clocksource_watchdog ();clocksource_register_khz (&clocksource_tsc_early, tsc_khz);detect_art ();
Greg Kroah-Hartman
maintainerPATCH 119/130 x86/64/mm: Map all kernel memory into trampoline_pgd
In reply to Greg Kroah-HartmanFrom: Joerg Roedel <[email protected]>
commit 51523ed1c26758de1af7e58730a656875f72f783 upstream.
The trampoline_pgd only maps the 0xfffffff000000000-0xffffffffffffffff range of kernel memory (with 4-level paging). This range contains the kernel's text+data+bss mappings and the module mapping space but not the direct mapping and the vmalloc area.
This is enough to get the application processors out of real-mode, but for code that switches back to real-mode the trampoline_pgd is missing important parts of the address space. For example, consider this code from arch/x86/kernel/reboot.c, function machine_real_restart() for a 64-bit kernel:
#ifdef CONFIG_X86_32
load_cr3(initial_page_table);
#else
write_cr3(real_mode_header->trampoline_pgd);
/* Exiting long mode will fail if CR4.PCIDE is set. */
if (boot_cpu_has(X86_FEATURE_PCID))
cr4_clear_bits(X86_CR4_PCIDE);
#endif
/* Jump to the identity-mapped low memory code */
#ifdef CONFIG_X86_32
asm volatile("jmpl *%0" : :
"rm" (real_mode_header->machine_real_restart_asm),
"a" (type));
#else
asm volatile("ljmpl *%0" : :
"m" (real_mode_header->machine_real_restart_asm),
"D" (type));
#endifThe code switches to the trampoline_pgd, which unmaps the direct mapping and also the kernel stack. The call to cr4_clear_bits() will find no stack and crash the machine. The real_mode_header pointer below points into the direct mapping, and dereferencing it also causes a crash.
The reason this does not crash always is only that kernel mappings are global and the CR3 switch does not flush those mappings. But if theses mappings are not in the TLB already, the above code will crash before it can jump to the real-mode stub.
Extend the trampoline_pgd to contain all kernel mappings to prevent these crashes and to make code which runs on this page-table more robust.
--- arch/x86/realmode/init.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
arch/x86/realmode/init.c +11 -1
@@ -70,6 +70,7 @@ static void __init setup_real_mode(void)#ifdef CONFIG_X86_64 u64 *trampoline_pgd;u64 efer; +int i;#endif base = (unsigned char *)real_mode_header;
@@ -126,8 +127,17 @@ static void __init setup_real_mode(void) trampoline_header->flags =0 ; trampoline_pgd = (u64 *)__va (real_mode_header->trampoline_pgd); + +/* Map the real mode stub as virtual == physical */ trampoline_pgd[0 ] = trampoline_pgd_entry.pgd; - trampoline_pgd[511 ] = init_top_pgt[511 ].pgd; + +/* +* Include the entirety of the kernel mapping into the trampoline +* PGD. This way, all mappings present in the normal kernel page +* tables are usable while running on trampoline_pgd. +*/ +for (i =pgd_index (__PAGE_OFFSET); i <PTRS_PER_PGD ; i++) + trampoline_pgd[i] = init_top_pgt[i].pgd;#endif sme_sev_setup_real_mode (trampoline_header);
Greg Kroah-Hartman
maintainerPATCH 120/130 tty: serial: msm_serial: Deactivate RX DMA for polling support
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit 7492ffc90fa126afb67d4392d56cb4134780194a upstream.
The CONSOLE_POLLING mode is used for tools like k(g)db. In this kind of setup, it is often sharing a serial device with the normal system console. This is usually no problem because the polling helpers can consume input values directly (when in kgdb context) and the normal Linux handlers can only consume new input values after kgdb switched back.
This is not true anymore when RX DMA is enabled for UARTDM controllers. Single input values can no longer be received correctly. Instead following seems to happen:
* on 1. input, some old input is read (continuously)
* on 2. input, two old inputs are read (continuously)
* on 3. input, three old input values are read (continuously)
* on 4. input, 4 previous inputs are received
This repeats then for each group of 4 input values.
This behavior changes slightly depending on what state the controller was when the first input was received. But this makes working with kgdb basically impossible because control messages are always corrupted when kgdboc tries to parse them.
RX DMA should therefore be off when CONSOLE_POLLING is enabled to avoid these kind of problems. No such problem was noticed for TX DMA.
--- drivers/tty/serial/msm_serial.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/tty/serial/msm_serial.c +3 -0
@@ -599,6 +599,9 @@ static void msm_start_rx_dma(struct msm_u32 val;int ret; +if (IS_ENABLED (CONFIG_CONSOLE_POLL )) +return ; +if (!dma->chan)return ;
Greg Kroah-Hartman
maintainerPATCH 121/130 serial: pl011: Add ACPI SBSA UART match id
In reply to Greg Kroah-HartmanFrom: Pierre Gondois <[email protected]>
commit ac442a077acf9a6bf1db4320ec0c3f303be092b3 upstream.
The document 'ACPI for Arm Components 1.0' defines the following _HID mappings:
-'Prime cell UART (PL011)': ARMH0011
-'SBSA UART': ARMHB000
Use the sbsa-uart driver when a device is described with the 'ARMHB000' _HID.
Note:
PL011 devices currently use the sbsa-uart driver instead of the uart-pl011 driver. Indeed, PL011 devices are not bound to a clock in ACPI. It is not possible to change their baudrate.
--- drivers/tty/serial/amba-pl011.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/amba-pl011.c +1 -0
@@ -2791,6 +2791,7 @@ MODULE_DEVICE_TABLE(of, sbsa_uart_of_matstatic const struct acpi_device_id sbsa_uart_acpi_match[] = { {"ARMH0011" ,0 }, + {"ARMHB000" ,0 }, {}, };MODULE_DEVICE_TABLE (acpi, sbsa_uart_acpi_match);
Greg Kroah-Hartman
maintainerPATCH 122/130 serial: tegra: Change lower tolerance baud rate limit for tegra20 and tegra30
In reply to Greg Kroah-HartmanFrom: Patrik John <[email protected]>
commit b40de7469ef135161c80af0e8c462298cc5dac00 upstream.
The current implementation uses 0 as lower limit for the baud rate tolerance for tegra20 and tegra30 chips which causes isses on UART initialization as soon as baud rate clock is lower than required even when within the standard UART tolerance of +/- 4%.
This fix aligns the implementation with the initial commit description of +/- 4% tolerance for tegra chips other than tegra186 and tegra194.
--- drivers/tty/serial/serial-tegra.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/serial/serial-tegra.c +2 -2
@@ -1501,7 +1501,7 @@ static struct tegra_uart_chip_data tegra .fifo_mode_enable_status = false, .uart_max_port = 5, .max_dma_burst_bytes = 4, - .error_tolerance_low_range = 0, + .error_tolerance_low_range = -4, .error_tolerance_high_range = 4, };
@@ -1512,7 +1512,7 @@ static struct tegra_uart_chip_data tegra .fifo_mode_enable_status = false, .uart_max_port = 5, .max_dma_burst_bytes = 4, - .error_tolerance_low_range = 0, + .error_tolerance_low_range = -4, .error_tolerance_high_range = 4, };
Greg Kroah-Hartman
maintainerPATCH 123/130 serial: core: fix transmit-buffer reset and memleak
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 00de977f9e0aa9760d9a79d1e41ff780f74e3424 upstream.
Commit 761ed4a94582 ("tty: serial_core: convert uart_close to use tty_port_close") converted serial core to use tty_port_close() but failed to notice that the transmit buffer still needs to be freed on final close.
Not freeing the transmit buffer means that the buffer is no longer cleared on next open so that any ioctl() waiting for the buffer to drain might wait indefinitely (e.g. on termios changes) or that stale data can end up being transmitted in case tx is restarted.
Furthermore, the buffer of any port that has been opened would leak on driver unbind.
Note that the port lock is held when clearing the buffer pointer due to the ldisc race worked around by commit a5ba1d95e46e ("uart: fix race between uart_put_char() and uart_shutdown()").
Also note that the tty-port shutdown() callback is not called for console ports so it is not strictly necessary to free the buffer page after releasing the lock (cf. d72402145ace ("tty/serial: do not free trasnmit buffer page under port lock")).
--- drivers/tty/serial/serial_core.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/tty/serial/serial_core.c +12 -1
@@ -1576,6 +1576,7 @@ static void uart_tty_port_shutdown(struc { struct uart_state *state = container_of(port, struct uart_state, port);struct uart_port *uport =uart_port_check (state); +char *buf;/* * At this point, we stop accepting input. To do this, we
@@ -1597,8 +1598,18 @@ static void uart_tty_port_shutdown(struc*/ tty_port_set_suspended (port,0 ); -uart_change_pm (state,UART_PM_STATE_OFF ); +/* +* Free the transmit buffer. +*/ +spin_lock_irq (&uport->lock); + buf = state->xmit.buf; + state->xmit.buf =NULL ; +spin_unlock_irq (&uport->lock); + +if (buf) +free_page ((unsigned long )buf); +uart_change_pm (state,UART_PM_STATE_OFF ); }static void uart_wait_until_sent (struct tty_struct *tty,int timeout)
Greg Kroah-Hartman
maintainerPATCH 124/130 serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array
In reply to Greg Kroah-HartmanFrom: Jay Dolan <[email protected]>
commit c525c5d2437f93520388920baac6d9340c65d239 upstream.
Fix error in table for PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S that caused it and PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4 to be missing their fourth port.
--- drivers/tty/serial/8250/8250_pci.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/tty/serial/8250/8250_pci.c +8 -1
@@ -2317,11 +2317,18 @@ static struct pci_serial_quirk pci_seria .setup = pci_pericom_setup_four_at_eight, }, { - .vendor = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S, + .vendor = PCI_VENDOR_ID_ACCESIO, .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4, .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, .setup = pci_pericom_setup_four_at_eight, + }, + { + .vendor = PCI_VENDOR_ID_ACCESIO, + .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .setup = pci_pericom_setup_four_at_eight, }, { .vendor = PCI_VENDOR_ID_ACCESIO,
Greg Kroah-Hartman
maintainerPATCH 125/130 serial: 8250_pci: rewrite pericom_do_set_divisor()
In reply to Greg Kroah-HartmanFrom: Jay Dolan <[email protected]>
commit bb1201d4b38ec67bd9a871cf86b0cc10f28b15b5 upstream.
Have pericom_do_set_divisor() use the uartclk instead of a hard coded value to work with different speed crystals. Tested with 14.7456 and 24 MHz crystals.
Have pericom_do_set_divisor() always calculate the divisor rather than call serial8250_do_set_divisor() for rates below baud_base.
Do not write registers or call serial8250_do_set_divisor() if valid divisors could not be found.
--- drivers/tty/serial/8250/8250_pci.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-)
drivers/tty/serial/8250/8250_pci.c +17 -13
@@ -1349,29 +1349,33 @@ pericom_do_set_divisor(struct uart_port {int scr;int lcr; -int actual_baud; -int tolerance; -for (scr =5 ; scr <=15 ; scr++) { - actual_baud =921600 *16 / scr; - tolerance = actual_baud /50 ; +for (scr =16 ; scr >4 ; scr--) { +unsigned int maxrate = port->uartclk / scr; +unsigned int divisor =max (maxrate / baud,1U ); +int delta = maxrate / divisor - baud; -if ((baud < actual_baud + tolerance) && - (baud > actual_baud - tolerance)) { +if (baud > maxrate + baud /50 ) +continue ; +if (delta > baud /50 ) + divisor++; + +if (divisor >0xffff ) +continue ; + +/* Update delta due to possible divisor change */ + delta = maxrate / divisor - baud; +if (abs (delta) < baud /50 ) { lcr =serial_port_in (port,UART_LCR );serial_port_out (port,UART_LCR , lcr |0x80 ); - -serial_port_out (port,UART_DLL ,1 ); -serial_port_out (port,UART_DLM ,0 ); +serial_port_out (port,UART_DLL , divisor &0xff ); +serial_port_out (port,UART_DLM , divisor >>8 &0xff );serial_port_out (port,2 ,16 - scr);serial_port_out (port,UART_LCR , lcr);return ; - }else if (baud > actual_baud) { -break ; } } -serial8250_do_set_divisor (port, baud, quot, quot_frac); } static int pci_pericom_setup(struct serial_private *priv, const struct pciserial_board *board,
Greg Kroah-Hartman
maintainerPATCH 126/130 serial: 8250: Fix RTS modem control while in rs485 mode
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit f85e04503f369b3f2be28c83fc48b74e19936ebc upstream.
Commit f45709df7731 ("serial: 8250: Don't touch RTS modem control while in rs485 mode") sought to prevent user space from interfering with rs485 communication by ignoring a TIOCMSET ioctl() which changes RTS polarity.
It did so in serial8250_do_set_mctrl(), which turns out to be too deep in the call stack: When a uart_port is opened, RTS polarity is set by the rs485-aware function uart_port_dtr_rts(). It calls down to serial8250_do_set_mctrl() and that particular RTS polarity change should *not* be ignored.
The user-visible result is that on 8250_omap ports which use rs485 with inverse polarity (RTS bit in MCR register is 1 to receive, 0 to send), a newly opened port initially sets up RTS for sending instead of receiving. That's because omap_8250_startup() sets the cached value up->mcr to 0 and omap_8250_restore_regs() subsequently writes it to the MCR register. Due to the commit, serial8250_do_set_mctrl() preserves that incorrect register value:
do_sys_openat2
do_filp_open
path_openat
vfs_open
do_dentry_open
chrdev_open
tty_open
uart_open
tty_port_open
uart_port_activate
uart_startup
uart_port_startup
serial8250_startup
omap_8250_startup # up->mcr = 0
uart_change_speed
serial8250_set_termios
omap_8250_set_termios
omap_8250_restore_regs
serial8250_out_MCR # up->mcr written
tty_port_block_til_ready
uart_dtr_rts
uart_port_dtr_rts
serial8250_set_mctrl
omap8250_set_mctrl
serial8250_do_set_mctrl # mcr[1] = 1 ignoredFix by intercepting RTS changes from user space in uart_tiocmset() instead.
--- drivers/tty/serial/8250/8250_port.c | 7 ------- drivers/tty/serial/serial_core.c | 5 +++++ 2 files changed, 5 insertions(+), 7 deletions(-)
drivers/tty/serial/8250/8250_port.c +0 -7
@@ -2029,13 +2029,6 @@ void serial8250_do_set_mctrl(struct uartstruct uart_8250_port *up =up_to_u8250p (port);unsigned char mcr; -if (port->rs485.flags &SER_RS485_ENABLED ) { -if (serial8250_in_MCR (up) &UART_MCR_RTS ) - mctrl |=TIOCM_RTS ; -else - mctrl &= ~TIOCM_RTS ; - } - mcr =serial8250_TIOCM_to_MCR (mctrl); mcr = (mcr & up->mcr_mask) | up->mcr_force | up->mcr;
drivers/tty/serial/serial_core.c +5 -0
@@ -1102,6 +1102,11 @@ uart_tiocmset(struct tty_struct *tty, un goto out;if (!tty_io_error (tty)) { +if (uport->rs485.flags &SER_RS485_ENABLED ) { + set &= ~TIOCM_RTS ; + clear &= ~TIOCM_RTS ; + } +uart_update_mctrl (uport, set, clear); ret =0 ; }
Greg Kroah-Hartman
maintainerPATCH 127/130 iwlwifi: mvm: retry init flow if failed
In reply to Greg Kroah-HartmanFrom: Mordechay Goodstein <[email protected]>
commit 5283dd677e52af9db6fe6ad11b2f12220d519d0c upstream.
In some very rare cases the init flow may fail. In many cases, this is recoverable, so we can retry. Implement a loop to retry two more times after the first attempt failed.
This can happen in two different situations, namely during probe and during mac80211 start. For the first case, a simple loop is enough. For the second case, we need to add a flag to prevent mac80211 from trying to restart it as well, leaving full control with the driver.
--- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 22 +++++++++++++------- drivers/net/wireless/intel/iwlwifi/iwl-drv.h | 3 ++ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 24 +++++++++++++++++++++- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 3 ++ drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 3 ++ 5 files changed, 47 insertions(+), 8 deletions(-)
drivers/net/wireless/intel/iwlwifi/iwl-drv.c +15 -7
@@ -1303,23 +1303,31 @@ _iwl_op_mode_start(struct iwl_drv *drv,const struct iwl_op_mode_ops *ops = op->ops;struct dentry *dbgfs_dir =NULL ;struct iwl_op_mode *op_mode =NULL ; +int retry, max_retry = !!iwlwifi_mod_params.fw_restart *IWL_MAX_INIT_RETRY ; + +for (retry =0 ; retry <= max_retry; retry++) {#ifdef CONFIG_IWLWIFI_DEBUGFS - drv->dbgfs_op_mode =debugfs_create_dir (op->name, - drv->dbgfs_drv); - dbgfs_dir = drv->dbgfs_op_mode; + drv->dbgfs_op_mode =debugfs_create_dir (op->name, + drv->dbgfs_drv); + dbgfs_dir = drv->dbgfs_op_mode;#endif - op_mode = ops->start (drv->trans, drv->trans->cfg, &drv->fw, dbgfs_dir); + op_mode = ops->start (drv->trans, drv->trans->cfg, + &drv->fw, dbgfs_dir); + +if (op_mode) +return op_mode; + +IWL_ERR (drv,"retry init count %d\n" , retry);#ifdef CONFIG_IWLWIFI_DEBUGFS -if (!op_mode) {debugfs_remove_recursive (drv->dbgfs_op_mode); drv->dbgfs_op_mode =NULL ; - }#endif + } -return op_mode; +return NULL ; }static void _iwl_op_mode_stop (struct iwl_drv *drv)
drivers/net/wireless/intel/iwlwifi/iwl-drv.h +3 -0
@@ -144,4 +144,7 @@ void iwl_drv_stop(struct iwl_drv *drv);#define IWL_EXPORT_SYMBOL (sym)#endif +/* max retry for init flow */ +#define IWL_MAX_INIT_RETRY 2 +#endif /* __iwl_drv_h__ */
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +23 -1
@@ -71,6 +71,7 @@#include <net/ieee80211_radiotap.h> #include <net/tcp.h> +#include "iwl-drv.h" #include "iwl-op-mode.h" #include "iwl-io.h" #include "mvm.h"
@@ -1163,9 +1164,30 @@ static int iwl_mvm_mac_start(struct ieee {struct iwl_mvm *mvm =IWL_MAC80211_GET_MVM (hw);int ret; +int retry, max_retry =0 ;mutex_lock (&mvm->mutex); - ret =__iwl_mvm_mac_start (mvm); + +/* we are starting the mac not in error flow, and restart is enabled */ +if (!test_bit (IWL_MVM_STATUS_HW_RESTART_REQUESTED , &mvm->status) && + iwlwifi_mod_params.fw_restart) { + max_retry =IWL_MAX_INIT_RETRY ; +/* +* This will prevent mac80211 recovery flows to trigger during +* init failures +*/ +set_bit (IWL_MVM_STATUS_STARTING , &mvm->status); + } + +for (retry =0 ; retry <= max_retry; retry++) { + ret =__iwl_mvm_mac_start (mvm); +if (!ret) +break ; + +IWL_ERR (mvm,"mac start retry %d\n" , retry); + } +clear_bit (IWL_MVM_STATUS_STARTING , &mvm->status); +mutex_unlock (&mvm->mutex);return ret;
drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +3 -0
@@ -1162,6 +1162,8 @@ struct iwl_mvm {* @IWL_MVM_STATUS_FIRMWARE_RUNNING: firmware is running * @IWL_MVM_STATUS_NEED_FLUSH_P2P: need to flush P2P bcast STA * @IWL_MVM_STATUS_IN_D3: in D3 (or at least about to go into it) +* @IWL_MVM_STATUS_STARTING: starting mac, +* used to disable restart flow while in STARTING state */ enum iwl_mvm_status {IWL_MVM_STATUS_HW_RFKILL ,
@@ -1173,6 +1175,7 @@ enum iwl_mvm_status {IWL_MVM_STATUS_FIRMWARE_RUNNING ,IWL_MVM_STATUS_NEED_FLUSH_P2P ,IWL_MVM_STATUS_IN_D3 , + IWL_MVM_STATUS_STARTING, };/* Keep track of completed init configuration */
drivers/net/wireless/intel/iwlwifi/mvm/ops.c +3 -0
@@ -1295,6 +1295,9 @@ void iwl_mvm_nic_restart(struct iwl_mvm*/ if (!mvm->fw_restart && fw_error) {iwl_fw_error_collect (&mvm->fwrt); + }else if (test_bit (IWL_MVM_STATUS_STARTING , + &mvm->status)) { +IWL_ERR (mvm,"Starting mac, retry will be triggered anyway\n" ); }else if (test_bit (IWL_MVM_STATUS_IN_HW_RESTART , &mvm->status)) {struct iwl_mvm_reprobe *reprobe;
Greg Kroah-Hartman
maintainerPATCH 128/130 parisc: Mark cr16 CPU clocksource unstable on all SMP machines
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit afdb4a5b1d340e4afffc65daa21cc71890d7d589 upstream.
In commit c8c3735997a3 ("parisc: Enhance detection of synchronous cr16 clocksources") I assumed that CPUs on the same physical core are syncronous. While booting up the kernel on two different C8000 machines, one with a dual-core PA8800 and one with a dual-core PA8900 CPU, this turned out to be wrong. The symptom was that I saw a jump in the internal clocks printed to the syslog and strange overall behaviour. On machines which have 4 cores (2 dual-cores) the problem isn't visible, because the current logic already marked the cr16 clocksource unstable in this case.
This patch now marks the cr16 interval timers unstable if we have more than one CPU in the system, and it fixes this issue.
--- arch/parisc/kernel/time.c | 24 +++++------------------- 1 file changed, 5 insertions(+), 19 deletions(-)
arch/parisc/kernel/time.c +5 -19
@@ -252,27 +252,13 @@ void __init time_init(void)static int __init init_cr16_clocksource (void ) {/* -* The cr16 interval timers are not syncronized across CPUs on -* different sockets, so mark them unstable and lower rating on -* multi-socket SMP systems. +* The cr16 interval timers are not syncronized across CPUs, even if +* they share the same socket. */ if (num_online_cpus () >1 && !running_on_qemu) { -int cpu; -unsigned long cpu0_loc; - cpu0_loc =per_cpu (cpu_data,0 ).cpu_loc; - -for_each_online_cpu (cpu) { -if (cpu ==0 ) -continue ; -if ((cpu0_loc !=0 ) && - (cpu0_loc ==per_cpu (cpu_data, cpu).cpu_loc)) -continue ; - - clocksource_cr16.name ="cr16_unstable" ; - clocksource_cr16.flags =CLOCK_SOURCE_UNSTABLE ; - clocksource_cr16.rating =0 ; -break ; - } + clocksource_cr16.name ="cr16_unstable" ; + clocksource_cr16.flags =CLOCK_SOURCE_UNSTABLE ; + clocksource_cr16.rating =0 ; }/* XXX: We may want to mark sched_clock stable here if cr16 clocks are
Greg Kroah-Hartman
maintainerPATCH 129/130 net/tls: Fix authentication failure in CCM mode
In reply to Greg Kroah-HartmanFrom: Tianjia Zhang <[email protected]>
commit 5961060692f8b17cd2080620a3d27b95d2ae05ca upstream.
When the TLS cipher suite uses CCM mode, including AES CCM and SM4 CCM, the first byte of the B0 block is flags, and the real IV starts from the second byte. The XOR operation of the IV and rec_seq should be skip this byte, that is, add the iv_offset.
--- net/tls/tls_sw.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/tls/tls_sw.c +2 -2
@@ -515,7 +515,7 @@ static int tls_do_encryption(struct sockmemcpy (&rec->iv_data[iv_offset], tls_ctx->tx.iv, prot->iv_size + prot->salt_size); -xor_iv_with_seq (prot->version, rec->iv_data, tls_ctx->tx.rec_seq); +xor_iv_with_seq (prot->version, rec->iv_data + iv_offset, tls_ctx->tx.rec_seq); sge->offset += prot->prepend_size; sge->length -= prot->prepend_size;
@@ -1487,7 +1487,7 @@ static int decrypt_internal(struct sockelse memcpy (iv + iv_offset, tls_ctx->rx.iv, prot->salt_size); -xor_iv_with_seq (prot->version, iv, tls_ctx->rx.rec_seq); +xor_iv_with_seq (prot->version, iv + iv_offset, tls_ctx->rx.rec_seq);/* Prepare AAD */ tls_make_aad(aad, rxm->full_len - prot->overhead_size +
Greg Kroah-Hartman
maintainerPATCH 130/130 ipmi: msghandler: Make symbol remove_work_wq static
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
commit 5a3ba99b62d8486de0316334e72ac620d4b94fdd upstream.
The sparse tool complains as follows:
drivers/char/ipmi/ipmi_msghandler.c:194:25: warning:
symbol 'remove_work_wq' was not declared. Should it be static?
This symbol is not used outside of ipmi_msghandler.c, so marks it static.
Message-Id: <[email protected]>
--- drivers/char/ipmi/ipmi_msghandler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/ipmi/ipmi_msghandler.c +1 -1
@@ -203,7 +203,7 @@ struct ipmi_user {struct work_struct remove_work; }; -struct workqueue_struct *remove_work_wq; +static struct workqueue_struct *remove_work_wq;static struct ipmi_user *acquire_ipmi_user (struct ipmi_user *user,int *index) __acquires(user->release_barrier)
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.84 release. There are 130 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 08 Dec 2021 14:55:37 +0000. Anything received after that time might be too late.
Building i386:allyesconfig ... failed
--------------
Error log:
x86_64-linux-ld: drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.o: in function `amdgpu_amdkfd_resume_iommu':
amdgpu_amdkfd.c:(.text+0x2b3): undefined reference to `kgd2kfd_resume_iommu'
Building i386:allmodconfig ... failed
--------------
Error log:
ERROR: modpost: "kgd2kfd_resume_iommu" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
The same error is seen for alpha:allmodconfig, arm:allmodconfig, mips:allmodconfig, parisc:allmodconfig, riscv32:allmodconfig, riscv64:allmodconfig, s390:allmodconfig, sparc64:allmodconfig, and xtensa:allmodconfig.
Guenter
Greg Kroah-Hartman
maintainerQuoted 21 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.84 release. There are 130 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 08 Dec 2021 14:55:37 +0000. Anything received after that time might be too late.
Building i386:allyesconfig ... failed
--------------
Error log:
x86_64-linux-ld:drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.o: in function `amdgpu_amdkfd_resume_iommu':
amdgpu_amdkfd.c:(.text+0x2b3): undefined reference to `kgd2kfd_resume_iommu'Building i386:allmodconfig ... failed
--------------
Error log:
ERROR: modpost: "kgd2kfd_resume_iommu" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
Quoted 4 lines
The same error is seen for alpha:allmodconfig, arm:allmodconfig, mips:allmodconfig, parisc:allmodconfig, riscv32:allmodconfig, riscv64:allmodconfig, s390:allmodconfig, sparc64:allmodconfig, and xtensa:allmodconfig.
Thanks for the report, should be fixed in -rc2
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.84 release. There are 130 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 08 Dec 2021 14:55:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.84-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.84 release. There are 130 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 08 Dec 2021 14:55:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.84-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.84 release. There are 130 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 08 Dec 2021 14:55:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.84-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Built for 5.10.84-rc1, and compile failure on arm64 and x86:
Kernel repo:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-5.10.y
Version: 5.10.84-rc1
Commit: ea2293709b3cac4bdfcb88ad67605c58264608df
Compiler: gcc version 7.3.0 (GCC)
--------------------------------------------------------------------
Kernel build failed, error log:
ERROR: modpost: "kgd2kfd_resume_iommu" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! make[1]: *** [scripts/Makefile.modpost:124: modules-only.symvers] Error 1 make[1]: *** Deleting file 'modules-only.symvers'
make: *** [Makefile:1413: modules] Error 2
make: *** Waiting for unfinished jobs....
--------------------------------------------------------------------
Greg Kroah-Hartman
maintainerQuoted 41 lines · Samuel Zou
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.84 release. There are 130 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 08 Dec 2021 14:55:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.84-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Built for 5.10.84-rc1, and compile failure on arm64 and x86:
Kernel repo:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-5.10.y
Version: 5.10.84-rc1
Commit:ea2293709b3cac4bdfcb88ad67605c58264608df
Compiler: gcc version 7.3.0 (GCC)--------------------------------------------------------------------
Kernel build failed, error log:
ERROR: modpost: "kgd2kfd_resume_iommu" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
make[1]: *** [scripts/Makefile.modpost:124: modules-only.symvers] Error 1 make[1]: *** Deleting file 'modules-only.symvers'
make: *** [Makefile:1413: modules] Error 2
make: *** Waiting for unfinished jobs....
Quoted 3 lines
--------------------------------------------------------------------
Tested-by Hulk Robot <[email protected]>
Thanks for the report, should be fixed in -rc2
greg k-h
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.84 release. There are 130 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 08 Dec 2021 14:55:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.84-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Regression found while building allmodconfig for the following arch
- i386 (allmodconfig) with gcc-10 / gcc-11
- mips (allmodconfig) with gcc-10 / gcc-11
- powerpc (allmodconfig) with gcc-10 / gcc-11
- parisc (allmodconfig) with gcc-10 / gcc-11
- riscv (allmodconfig) with gcc-10 / gcc-11
- sh (allmodconfig) with gcc-10 / gcc-11
- s390 (allmodconfig) with gcc-10 / gcc-11
metadata:
git branch: linux-5.10.y
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git commit: ea2293709b3cac4bdfcb88ad67605c58264608df
git describe: v5.10.83-131-gea2293709b3c
toolchain: gcc-10 / gcc-11
kernel-config: https://builds.tuxbuild.com/21vHJb50DPJcjJuLnT8DzL6vvkn/config
build location: https://builds.tuxbuild.com/21dB06iPvDP58giSGHdE5W3Qc68/
build error:
--------------
make --silent --keep-going --jobs=8 O=/home/tuxbuild/.cache/tuxmake/builds/current ARCH=i386 CROSS_COMPILE=i686-linux-gnu- 'CC=sccache i686-linux-gnu-gcc' 'HOSTCC=sccache gcc'
ERROR: modpost: "kgd2kfd_resume_iommu" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! make[2]: *** [/builds/linux/scripts/Makefile.modpost:124:
modules-only.symvers] Error 1
make[2]: *** Deleting file 'modules-only.symvers' make[2]: Target '__modpost' not remade because of errors. make[1]: *** [/builds/linux/Makefile:1413: modules] Error 2
step to reproduce:
------------------
tuxmake --runtime podman --target-arch i386 --toolchain gcc-11 --kconfig allmodconfig
--
Linaro LKFT
https://lkft.linaro.org
Greg Kroah-Hartman
maintainerQuoted 57 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.84 release. There are 130 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 08 Dec 2021 14:55:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.84-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Regression found while building allmodconfig for the following arch
- i386 (allmodconfig) with gcc-10 / gcc-11
- mips (allmodconfig) with gcc-10 / gcc-11
- powerpc (allmodconfig) with gcc-10 / gcc-11
- parisc (allmodconfig) with gcc-10 / gcc-11
- riscv (allmodconfig) with gcc-10 / gcc-11
- sh (allmodconfig) with gcc-10 / gcc-11
- s390 (allmodconfig) with gcc-10 / gcc-11metadata:
git branch: linux-5.10.y
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git commit:ea2293709b3cac4bdfcb88ad67605c58264608df
git describe: v5.10.83-131-gea2293709b3c
toolchain: gcc-10 / gcc-11
kernel-config: https://builds.tuxbuild.com/21vHJb50DPJcjJuLnT8DzL6vvkn/config
build location: https://builds.tuxbuild.com/21dB06iPvDP58giSGHdE5W3Qc68/build error:
--------------
make --silent --keep-going --jobs=8 O=/home/tuxbuild/.cache/tuxmake/builds/current ARCH=i386 CROSS_COMPILE=i686-linux-gnu- 'CC=sccache i686-linux-gnu-gcc' 'HOSTCC=sccache gcc'
ERROR: modpost: "kgd2kfd_resume_iommu" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! make[2]: *** [/builds/linux/scripts/Makefile.modpost:124:
modules-only.symvers] Error 1
make[2]: *** Deleting file 'modules-only.symvers' make[2]: Target '__modpost' not remade because of errors. make[1]: *** [/builds/linux/Makefile:1413: modules] Error 2
Quoted 8 lines
step to reproduce:
------------------
tuxmake --runtime podman --target-arch i386 --toolchain gcc-11 --kconfig allmodconfig--
Linaro LKFT
https://lkft.linaro.org
Thanks for the report, should be fixed in -rc2
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.84 release. There are 130 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 08 Dec 2021 14:55:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.84-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
5.10.84-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.84 release. There are 130 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 08 Dec 2021 14:55:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.84-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.10:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
75 tests: 75 pass, 0 failLinux version: 5.10.84-rc1-gea2293709b3c
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon