5.15.51-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 5.15.51-rc1 review
This is the start of the stable review cycle for the 5.15.51 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jun 2022 11:19:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.51-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.51-rc1
Jason A. Donenfeld <[email protected]>
powerpc/pseries: wire up rng during setup_arch()
Masahiro Yamada <[email protected]>
kbuild: link vmlinux only once for CONFIG_TRIM_UNUSED_KSYMS (2nd attempt)
Dexuan Cui <[email protected]>
dma-direct: use the correct size for dma_set_encrypted()
Adrian Hunter <[email protected]>
perf build-id: Fix caching files with a wrong build ID
Jason A. Donenfeld <[email protected]>
random: update comment from copy_to_user() -> copy_to_iter()
Stefan Wahren <[email protected]>
ARM: dts: bcm2711-rpi-400: Fix GPIO line names
Masahiro Yamada <[email protected]>
modpost: fix section mismatch check for exported init/exit sections
Miaoqian Lin <[email protected]>
ARM: cns3xxx: Fix refcount leak in cns3xxx_init
Miaoqian Lin <[email protected]>
memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings
Miaoqian Lin <[email protected]>
ARM: Fix refcount leak in axxia_boot_secondary
Miaoqian Lin <[email protected]>
soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe
Miaoqian Lin <[email protected]>
ARM: exynos: Fix refcount leak in exynos_map_pmu
Aswath Govindraju <[email protected]>
arm64: dts: ti: k3-am64-main: Remove support for HS400 speed mode
Lucas Stach <[email protected]>
ARM: dts: imx6qdl: correct PU regulator ramp delay
Alexander Stein <[email protected]>
ARM: dts: imx7: Move hsic_phy power domain to HSIC PHY node
Kuogee Hsieh <[email protected]>
drm/msm/dp: Always clear mask bits to disable interrupts at dp_ctrl_reset_irq_ctrl()
Jason A. Donenfeld <[email protected]>
powerpc/powernv: wire up rng during setup_arch
Andrew Donnellan <[email protected]>
powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address
Naveen N. Rao <[email protected]>
powerpc: Enable execve syscall exit tracepoint
Jason A. Donenfeld <[email protected]>
powerpc/microwatt: wire up rng during setup_arch()
Helge Deller <[email protected]>
parisc: Enable ARCH_HAS_STRICT_MODULE_RWX
Helge Deller <[email protected]>
parisc/stifb: Fix fb_is_primary_device() only available with CONFIG_FB_STI
Liang He <[email protected]>
xtensa: Fix refcount leak bug in time.c
Liang He <[email protected]>
xtensa: xtfpga: Fix refcount leak bug in setup
Jialin Zhang <[email protected]>
iio: adc: ti-ads131e08: add missing fwnode_handle_put() in ads131e08_alloc_channels()
Miaoqian Lin <[email protected]>
iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client
Jialin Zhang <[email protected]>
iio: adc: rzg2l_adc: add missing fwnode_handle_put() in rzg2l_adc_parse_properties()
Hans de Goede <[email protected]>
iio: adc: axp288: Override TS pin bias current for some models
Yannick Brosseau <[email protected]>
iio: adc: stm32: Fix IRQs on STM32F4 by removing custom spurious IRQs message
Yannick Brosseau <[email protected]>
iio: adc: stm32: Fix ADCs iteration in irq handler
Linus Walleij <[email protected]>
iio: afe: rescale: Fix boolean logic bug
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value)
Olivier Moysan <[email protected]>
iio: adc: stm32: fix maximum clock rate for stm32mp15x
Vincent Whitchurch <[email protected]>
iio: trigger: sysfs: fix use-after-free on remove
Zheyu Ma <[email protected]>
iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up()
Haibo Chen <[email protected]>
iio: accel: mma8452: ignore the return value of reset operation
Dmitry Rokosov <[email protected]>
iio:accel:mxc4005: rearrange iio trigger get and register
Dmitry Rokosov <[email protected]>
iio:accel:bma180: rearrange iio trigger get and register
Dmitry Rokosov <[email protected]>
iio:accel:kxcjk-1013: rearrange iio trigger get and register
Dmitry Rokosov <[email protected]>
iio:chemical:ccs811: rearrange iio trigger get and register
Dmitry Rokosov <[email protected]>
iio:humidity:hts221: rearrange iio trigger get and register
Jaegeuk Kim <[email protected]>
f2fs: attach inline_data after setting compression
Josef Bacik <[email protected]>
btrfs: fix deadlock with fsync+fiemap+transaction commit
Zygo Blaxell <[email protected]>
btrfs: don't set lock_owner when locking extent buffer for reading
Geert Uytterhoeven <[email protected]>
dt-bindings: usb: ehci: Increase the number of PHYs
Geert Uytterhoeven <[email protected]>
dt-bindings: usb: ohci: Increase the number of PHYs
Xu Yang <[email protected]>
usb: chipidea: udc: check request status before setting device address
Alan Stern <[email protected]>
USB: gadget: Fix double-free bug in raw_gadget driver
Alan Stern <[email protected]>
usb: gadget: Fix non-unique driver names in raw-gadget driver
Utkarsh Patel <[email protected]>
xhci-pci: Allow host runtime PM as default for Intel Meteor Lake xHCI
Tanveer Alam <[email protected]>
xhci-pci: Allow host runtime PM as default for Intel Raptor Lake xHCI
Mathias Nyman <[email protected]>
xhci: turn off port power in shutdown
Andy Shevchenko <[email protected]>
usb: typec: wcove: Drop wrong dependency to INTEL_SOC_PMIC
Baruch Siach <[email protected]>
iio: adc: vf610: fix conversion mode sysfs node name
Linus Walleij <[email protected]>
iio: magnetometer: yas530: Fix memchr_inv() misuse
Haibo Chen <[email protected]>
iio: mma8452: fix probe fail when device tree compatible is used.
Thomas Richter <[email protected]>
s390/cpumf: Handle events cycles and instructions identical
Dan Carpenter <[email protected]>
gpio: winbond: Fix error code in winbond_gpio_get()
Christoph Hellwig <[email protected]>
nvme: move the Samsung X5 quirk entry to the core quirks
Enzo Matsumiya <[email protected]>
nvme-pci: add NO APST quirk for Kioxia device
Jakub Kicinski <[email protected]>
sock: redo the psock vs ULP protection check
Jakub Kicinski <[email protected]>
Revert "net/tls: fix tls_sk_proto_close executed repeatedly"
Stephan Gerhold <[email protected]>
virtio_net: fix xdp_rxq_info bug after suspend/resume
Kai-Heng Feng <[email protected]>
igb: Make DMA faster when CPU is active on the PCIe link
Aidan MacDonald <[email protected]>
regmap-irq: Fix offset/index mismatch in read_sub_irq_data()
Aidan MacDonald <[email protected]>
regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips
Anatolii Gerasymenko <[email protected]>
ice: ethtool: advertise 1000M speeds properly
David Howells <[email protected]>
afs: Fix dynamic root getattr
huhai <[email protected]>
MIPS: Remove repetitive increase irq_err_count
Julien Grall <[email protected]>
x86/xen: Remove undefined behavior in setup_features()
Jason Andryuk <[email protected]>
xen-blkfront: Handle NULL gendisk
Jie2x Zhou <[email protected]>
selftests: netfilter: correct PKTGEN_SCRIPT_PATHS in nft_concat_range.sh
Gerd Hoffmann <[email protected]>
udmabuf: add back sanity check
Ziyang Xuan <[email protected]>
net/tls: fix tls_sk_proto_close executed repeatedly
Eric Dumazet <[email protected]>
erspan: do not assume transport header is always set
Leo Yan <[email protected]>
perf arm-spe: Don't set data source if it's not a memory operation
Kuogee Hsieh <[email protected]>
drm/msm/dp: force link training for display resolution change
Kuogee Hsieh <[email protected]>
drm/msm/dp: do not initialize phy until plugin interrupt received
Kuogee Hsieh <[email protected]>
drm/msm/dp: dp_link_parse_sink_count() return immediately if aux read failed
Bjorn Andersson <[email protected]>
drm/msm/dp: Drop now unused hpd_high member
Kuogee Hsieh <[email protected]>
drm/msm/dp: check core_initialized before disable interrupts at dp_display_unbind()
Miaoqian Lin <[email protected]>
drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf
Peilin Ye <[email protected]>
net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
Ivan Vecera <[email protected]>
ethtool: Fix get module eeprom fallback
Jay Vosburgh <[email protected]>
bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
Lorenzo Bianconi <[email protected]>
igb: fix a use-after-free issue in igb_clean_tx_ring
Hoang Le <[email protected]>
tipc: fix use-after-free Read in tipc_named_reinit
Eric Dumazet <[email protected]>
net: fix data-race in dev_isalive()
Sebastian Andrzej Siewior <[email protected]>
net: Write lock dev_base_lock without disabling bottom halves.
Quentin Perret <[email protected]>
KVM: arm64: Prevent kmemleak from accessing pKVM memory
Claudiu Manoil <[email protected]>
phy: aquantia: Fix AN when higher speeds than 1G are not advertised
Saurabh Sengar <[email protected]>
scsi: storvsc: Correct reporting of Hyper-V I/O size limits
Jakub Sitnicki <[email protected]>
bpf, x86: Fix tail call count offset calculation on bpf2bpf call
Samuel Holland <[email protected]>
drm/sun4i: Fix crash during suspend after component bind failure
Jon Maxwell <[email protected]>
bpf: Fix request_sock leak in sk lookup helpers
Jonathan Marek <[email protected]>
drm/msm: use for_each_sgtable_sg to iterate over scatterlist
Ciara Loftus <[email protected]>
xsk: Fix generic transmit when completion queue reservation fails
Sergey Gorenko <[email protected]>
scsi: iscsi: Exclude zero from the endpoint ID range
Rob Clark <[email protected]>
drm/msm: Switch ordering of runpm put vs devfreq_idle
Damien Le Moal <[email protected]>
scsi: scsi_debug: Fix zone transition to full condition
Florian Westphal <[email protected]>
netfilter: use get_random_u32 instead of prandom
Maximilian Luz <[email protected]>
drm/msm: Fix double pm_runtime_disable() call
Rob Clark <[email protected]>
drm/msm: Ensure mmap offset is initialized
Macpaul Lin <[email protected]>
USB: serial: option: add Quectel RM500K module support
Yonglin Tan <[email protected]>
USB: serial: option: add Quectel EM05-G modem
Carlo Lobrano <[email protected]>
USB: serial: option: add Telit LE910Cx 0x1250 composition
Johan Hovold <[email protected]>
USB: serial: pl2303: add support for more HXN (G) types
Ville Syrjälä <[email protected]>
drm/i915: Implement w/a 22010492432 for adl-s
Masami Hiramatsu (Google) <[email protected]>
tracing/kprobes: Check whether get_kretprobe() returns NULL in kretprobe_dispatcher()
Mikulas Patocka <[email protected]>
dm mirror log: clear log bits up to BITS_PER_LONG boundary
Nikos Tsironis <[email protected]>
dm era: commit metadata in postsuspend after worker stops
Edward Wu <[email protected]>
ata: libata: add qc->flags in ata_qc_complete_template tracepoint
Sascha Hauer <[email protected]>
mtd: rawnand: gpmi: Fix setting busy timeout setting
Joerg Roedel <[email protected]>
MAINTAINERS: Add new IOMMU development mailing list
Demi Marie Obenour <[email protected]>
xen/gntdev: Avoid blocking in unmap_grant_pages()
Mengqi Zhang <[email protected]>
mmc: mediatek: wait dma stop bit reset to 0
Chevron Li <[email protected]>
mmc: sdhci-pci-o2micro: Fix card detect by dealing with debouncing
Tyrel Datwyler <[email protected]>
scsi: ibmvfc: Allocate/free queue resource only during probe/remove
Tyrel Datwyler <[email protected]>
scsi: ibmvfc: Store vhost pointer during subcrq allocation
David Sterba <[email protected]>
btrfs: add error messages to all unrecognized mount options
Qu Wenruo <[email protected]>
btrfs: prevent remounting to v1 space cache for subpage mount
Filipe Manana <[email protected]>
btrfs: fix hang during unmount when block group reclaim task is running
Dominique Martinet <[email protected]>
9p: fix fid refcount leak in v9fs_vfs_get_link
Dominique Martinet <[email protected]>
9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl
Tyler Hicks <[email protected]>
9p: Fix refcounting during full path walks for fid lookups
Rosemarie O'Riorden <[email protected]>
net: openvswitch: fix parsing of nw_proto for IPv6 fragments
Tim Crawford <[email protected]>
ALSA: hda/realtek: Add quirk for Clevo NS50PU
Tim Crawford <[email protected]>
ALSA: hda/realtek: Add quirk for Clevo PD70PNT
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Apply fixup for Lenovo Yoga Duet 7 properly
Kailang Yang <[email protected]>
ALSA: hda/realtek - ALC897 headset MIC no sound
Soham Sen <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Fix missing beep setup
Takashi Iwai <[email protected]>
ALSA: hda/via: Fix missing beep setup
Jason A. Donenfeld <[email protected]>
random: quiet urandom warning ratelimit suppression message
Jason A. Donenfeld <[email protected]>
random: schedule mix_interrupt_randomness() less often
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-iio-vf610 | 2 +- .../devicetree/bindings/usb/generic-ehci.yaml | 3 +- .../devicetree/bindings/usb/generic-ohci.yaml | 3 +- MAINTAINERS | 11 ++ Makefile | 6 +- arch/arm/boot/dts/bcm2711-rpi-400.dts | 6 +- arch/arm/boot/dts/imx6qdl.dtsi | 2 +- arch/arm/boot/dts/imx7s.dtsi | 2 +- arch/arm/mach-axxia/platsmp.c | 1 + arch/arm/mach-cns3xxx/core.c | 2 + arch/arm/mach-exynos/exynos.c | 1 + arch/arm64/boot/dts/ti/k3-am64-main.dtsi | 2 - arch/arm64/kvm/arm.c | 6 +- arch/mips/vr41xx/common/icu.c | 2 - arch/parisc/Kconfig | 1 + arch/parisc/include/asm/fb.h | 2 +- arch/powerpc/kernel/process.c | 2 +- arch/powerpc/kernel/rtas.c | 11 +- arch/powerpc/platforms/microwatt/microwatt.h | 7 + arch/powerpc/platforms/microwatt/rng.c | 10 +- arch/powerpc/platforms/microwatt/setup.c | 8 ++ arch/powerpc/platforms/powernv/powernv.h | 2 + arch/powerpc/platforms/powernv/rng.c | 52 ++++--- arch/powerpc/platforms/powernv/setup.c | 2 + arch/powerpc/platforms/pseries/pseries.h | 2 + arch/powerpc/platforms/pseries/rng.c | 11 +- arch/powerpc/platforms/pseries/setup.c | 2 + arch/s390/kernel/perf_cpum_cf.c | 22 ++- arch/x86/net/bpf_jit_comp.c | 3 +- arch/xtensa/kernel/time.c | 1 + arch/xtensa/platforms/xtfpga/setup.c | 1 + drivers/base/regmap/regmap-irq.c | 8 +- drivers/block/xen-blkfront.c | 19 ++- drivers/char/random.c | 6 +- drivers/dma-buf/udmabuf.c | 5 +- drivers/gpio/gpio-vr41xx.c | 2 - drivers/gpio/gpio-winbond.c | 7 +- drivers/gpu/drm/i915/display/intel_dpll_mgr.c | 4 +- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 3 +- drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 2 + drivers/gpu/drm/msm/dp/dp_ctrl.c | 118 ++++++++-------- drivers/gpu/drm/msm/dp/dp_ctrl.h | 10 +- drivers/gpu/drm/msm/dp/dp_display.c | 127 +++++++++-------- drivers/gpu/drm/msm/dp/dp_hpd.c | 2 - drivers/gpu/drm/msm/dp/dp_hpd.h | 2 - drivers/gpu/drm/msm/dp/dp_link.c | 19 ++- drivers/gpu/drm/msm/msm_drv.c | 2 +- drivers/gpu/drm/msm/msm_drv.h | 1 + drivers/gpu/drm/msm/msm_gem_prime.c | 15 ++ drivers/gpu/drm/msm/msm_gpu.c | 3 +- drivers/gpu/drm/msm/msm_iommu.c | 2 +- drivers/gpu/drm/sun4i/sun4i_drv.c | 4 +- drivers/iio/accel/bma180.c | 3 +- drivers/iio/accel/kxcjk-1013.c | 4 +- drivers/iio/accel/mma8452.c | 22 +-- drivers/iio/accel/mxc4005.c | 4 +- drivers/iio/adc/adi-axi-adc.c | 3 + drivers/iio/adc/axp288_adc.c | 8 ++ drivers/iio/adc/rzg2l_adc.c | 8 +- drivers/iio/adc/stm32-adc-core.c | 9 +- drivers/iio/adc/stm32-adc.c | 10 -- drivers/iio/adc/ti-ads131e08.c | 10 +- drivers/iio/afe/iio-rescale.c | 2 +- drivers/iio/chemical/ccs811.c | 4 +- drivers/iio/gyro/mpu3050-core.c | 1 + drivers/iio/humidity/hts221_buffer.c | 5 +- drivers/iio/imu/inv_icm42600/inv_icm42600.h | 1 + drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 2 +- drivers/iio/magnetometer/yamaha-yas530.c | 2 +- drivers/iio/trigger/iio-trig-sysfs.c | 1 + drivers/md/dm-era-target.c | 8 +- drivers/md/dm-log.c | 2 +- drivers/memory/samsung/exynos5422-dmc.c | 29 ++-- drivers/mmc/host/mtk-sd.c | 20 +-- drivers/mmc/host/sdhci-pci-o2micro.c | 2 + drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +- drivers/net/bonding/bond_main.c | 4 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 39 ++++- drivers/net/ethernet/intel/igb/igb_main.c | 19 +-- drivers/net/phy/aquantia_main.c | 15 +- drivers/net/virtio_net.c | 25 +--- drivers/nvme/host/core.c | 28 ++++ drivers/nvme/host/pci.c | 4 - drivers/scsi/ibmvscsi/ibmvfc.c | 82 ++++++++--- drivers/scsi/ibmvscsi/ibmvfc.h | 2 +- drivers/scsi/scsi_debug.c | 22 ++- drivers/scsi/scsi_transport_iscsi.c | 7 +- drivers/scsi/storvsc_drv.c | 27 +++- drivers/soc/bcm/brcmstb/pm/pm-arm.c | 1 + drivers/usb/chipidea/udc.c | 3 + drivers/usb/gadget/legacy/raw_gadget.c | 63 ++++++--- drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-pci.c | 6 +- drivers/usb/host/xhci.c | 15 +- drivers/usb/host/xhci.h | 2 + drivers/usb/serial/option.c | 6 + drivers/usb/serial/pl2303.c | 29 ++-- drivers/usb/typec/tcpm/Kconfig | 1 - drivers/video/console/sticore.c | 2 + drivers/xen/features.c | 2 +- drivers/xen/gntdev-common.h | 7 + drivers/xen/gntdev.c | 157 ++++++++++++++------- fs/9p/fid.c | 22 ++- fs/9p/vfs_inode.c | 8 +- fs/9p/vfs_inode_dotl.c | 3 + fs/afs/inode.c | 3 +- fs/btrfs/disk-io.c | 13 +- fs/btrfs/file.c | 67 +++++++-- fs/btrfs/locking.c | 3 - fs/btrfs/super.c | 47 +++++- fs/f2fs/namei.c | 17 ++- include/linux/ratelimit_types.h | 12 +- include/net/inet_sock.h | 5 + include/trace/events/libata.h | 1 + kernel/dma/direct.c | 5 +- kernel/trace/trace_kprobe.c | 11 +- net/core/dev.c | 40 +++--- net/core/filter.c | 34 ++++- net/core/link_watch.c | 4 +- net/core/net-sysfs.c | 1 + net/core/rtnetlink.c | 8 +- net/core/skmsg.c | 5 + net/ethtool/eeprom.c | 2 +- net/hsr/hsr_device.c | 6 +- net/ipv4/ip_gre.c | 15 +- net/ipv4/tcp_bpf.c | 3 - net/ipv6/ip6_gre.c | 15 +- net/netfilter/nft_meta.c | 13 +- net/netfilter/nft_numgen.c | 12 +- net/openvswitch/flow.c | 2 +- net/sched/sch_netem.c | 4 +- net/tipc/core.c | 3 +- net/tls/tls_main.c | 2 + net/xdp/xsk.c | 16 ++- scripts/mod/modpost.c | 2 +- sound/pci/hda/hda_auto_parser.c | 7 +- sound/pci/hda/hda_local.h | 1 + sound/pci/hda/patch_conexant.c | 4 +- sound/pci/hda/patch_realtek.c | 36 ++++- sound/pci/hda/patch_via.c | 4 +- tools/perf/util/arm-spe.c | 22 ++- tools/perf/util/build-id.c | 28 ++++ .../selftests/netfilter/nft_concat_range.sh | 2 +- 143 files changed, 1209 insertions(+), 580 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/135 random: schedule mix_interrupt_randomness() less often
From: Jason A. Donenfeld <[email protected]>
commit 534d2eaf1970274150596fdd2bf552721e65d6b2 upstream.
It used to be that mix_interrupt_randomness() would credit 1 bit each time it ran, and so add_interrupt_randomness() would schedule mix() to run every 64 interrupts, a fairly arbitrary number, but nonetheless considered to be a decent enough conservative estimate.
Since e3e33fc2ea7f ("random: do not use input pool from hard IRQs"), mix() is now able to credit multiple bits, depending on the number of calls to add(). This was done for reasons separate from this commit, but it has the nice side effect of enabling this patch to schedule mix() less often.
Currently the rules are:
a) Credit 1 bit for every 64 calls to add().
b) Schedule mix() once a second that add() is called.
c) Schedule mix() once every 64 calls to add().
Rules (a) and (c) no longer need to be coupled. It's still important to have _some_ value in (c), so that we don't "over-saturate" the fast pool, but the once per second we get from rule (b) is a plenty enough baseline. So, by increasing the 64 in rule (c) to something larger, we avoid calling queue_work_on() as frequently during irq storms.
This commit changes that 64 in rule (c) to be 1024, which means we schedule mix() 16 times less often. And it does *not* need to change the 64 in rule (a).
--- drivers/char/random.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/random.c +1 -1
@@ -1000,7 +1000,7 @@ void add_interrupt_randomness(int irq)if (new_count &MIX_INFLIGHT )return ; -if (new_count <64 && !time_is_before_jiffies (fast_pool->last +HZ )) +if (new_count <1024 && !time_is_before_jiffies (fast_pool->last +HZ ))return ;if (unlikely (!fast_pool->mix.func))
Greg Kroah-Hartman
maintainerPATCH 2/135 random: quiet urandom warning ratelimit suppression message
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit c01d4d0a82b71857be7449380338bc53dde2da92 upstream.
random.c ratelimits how much it warns about uninitialized urandom reads using __ratelimit(). When the RNG is finally initialized, it prints the number of missed messages due to ratelimiting.
It has been this way since that functionality was introduced back in 2018. Recently, cc1e127bfa95 ("random: remove ratelimiting for in-kernel unseeded randomness") put a bit more stress on the urandom ratelimiting, which teased out a bug in the implementation.
Specifically, when under pressure, __ratelimit() will print its own message and reset the count back to 0, making the final message at the end less useful. Secondly, it does so as a pr_warn(), which apparently is undesirable for people's CI.
Fortunately, __ratelimit() has the RATELIMIT_MSG_ON_RELEASE flag exactly for this purpose, so we set the flag.
--- drivers/char/random.c | 2 +- include/linux/ratelimit_types.h | 12 ++++++++---- 2 files changed, 9 insertions(+), 5 deletions(-)
drivers/char/random.c +1 -1
@@ -88,7 +88,7 @@ static RAW_NOTIFIER_HEAD(random_ready_ch/* Control how we warn userspace. */ static struct ratelimit_state urandom_warning = -RATELIMIT_STATE_INIT ("warn_urandom_randomness" ,HZ ,3 ); +RATELIMIT_STATE_INIT_FLAGS ("urandom_warning" ,HZ ,3 ,RATELIMIT_MSG_ON_RELEASE );static int ratelimit_disable__read_mostly =IS_ENABLED (CONFIG_WARN_ALL_UNSEEDED_RANDOM );module_param_named (ratelimit_disable, ratelimit_disable, int,0644 );
include/linux/ratelimit_types.h +8 -4
@@ -23,12 +23,16 @@ struct ratelimit_state {unsigned long flags; }; -#define RATELIMIT_STATE_INIT (name, interval_init, burst_init) { \ - .lock = __RAW_SPIN_LOCK_UNLOCKED(name.lock), \ - .interval = interval_init, \ - .burst = burst_init, \ +#define RATELIMIT_STATE_INIT_FLAGS (name, interval_init, burst_init, flags_init) { \ + .lock = __RAW_SPIN_LOCK_UNLOCKED(name.lock), \ + .interval = interval_init, \ + .burst = burst_init, \ + .flags = flags_init, \ } +#define RATELIMIT_STATE_INIT (name, interval_init, burst_init) \ + RATELIMIT_STATE_INIT_FLAGS(name, interval_init, burst_init, 0) +#define RATELIMIT_STATE_INIT_DISABLED \ RATELIMIT_STATE_INIT(ratelimit_state, 0, DEFAULT_RATELIMIT_BURST)
Greg Kroah-Hartman
maintainerPATCH 3/135 ALSA: hda/via: Fix missing beep setup
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit c7807b27d510e5aa53c8a120cfc02c33c24ebb5f upstream.
Like the previous fix for Conexant codec, the beep_nid has to be set up before calling snd_hda_gen_parse_auto_config(); otherwise it'd miss the path setup.
Fix the call order for addressing the missing beep setup.
--- sound/pci/hda/patch_via.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/patch_via.c +2 -2
@@ -520,11 +520,11 @@ static int via_parse_auto_config(structif (err <0 )return err; - err =snd_hda_gen_parse_auto_config (codec, &spec->gen.autocfg); + err =auto_parse_beep (codec);if (err <0 )return err; - err =auto_parse_beep (codec); + err =snd_hda_gen_parse_auto_config (codec, &spec->gen.autocfg);if (err <0 )return err;
Greg Kroah-Hartman
maintainerPATCH 4/135 ALSA: hda/conexant: Fix missing beep setup
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 5faa0bc69102f3a4c605581564c367be5eb94dfa upstream.
Currently the Conexant codec driver sets up the beep NID after calling snd_hda_gen_parse_auto_config(). It turned out that this results in the insufficient setup for the beep control, as the generic parser handles the fake path in snd_hda_gen_parse_auto_config() only if the beep_nid is set up beforehand.
For dealing with the beep widget properly, call cx_auto_parse_beep() before snd_hda_gen_parse_auto_config() call.
--- sound/pci/hda/patch_conexant.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/patch_conexant.c +2 -2
@@ -1079,11 +1079,11 @@ static int patch_conexant_auto(struct hdif (err <0 ) goto error; - err =snd_hda_gen_parse_auto_config (codec, &spec->gen.autocfg); + err =cx_auto_parse_beep (codec);if (err <0 ) goto error; - err =cx_auto_parse_beep (codec); + err =snd_hda_gen_parse_auto_config (codec, &spec->gen.autocfg);if (err <0 ) goto error;
Greg Kroah-Hartman
maintainerPATCH 5/135 ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop
In reply to Greg Kroah-HartmanFrom: Soham Sen <[email protected]>
commit b2e6b3d9bbb0a59ba7c710cc06e44cc548301f5f upstream.
The HP Omen 15 laptop needs a quirk to toggle the mute LED. It already is implemented for a different variant of the HP Omen laptop so a fixup entry is needed for this variant.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -8830,6 +8830,7 @@ static const struct snd_pci_quirk alc269 ALC285_FIXUP_HP_GPIO_AMP_INIT),SND_PCI_QUIRK (0x103c ,0x8783 ,"HP ZBook Fury 15 G7 Mobile Workstation" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ), +SND_PCI_QUIRK (0x103c ,0x8787 ,"HP OMEN 15" ,ALC285_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x8788 ,"HP OMEN 15" ,ALC285_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x87c8 ,"HP" ,ALC287_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x87e5, "HP ProBook 440 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
Greg Kroah-Hartman
maintainerPATCH 6/135 ALSA: hda/realtek - ALC897 headset MIC no sound
In reply to Greg Kroah-HartmanFrom: Kailang Yang <[email protected]>
commit fe6900bd8156467365bd5b976df64928fdebfeb0 upstream.
There is not have Headset Mic verb table in BIOS default.
So, it will have recording issue from headset MIC.
Add the verb table value without jack detect. It will turn on Headset Mic.
--- sound/pci/hda/patch_realtek.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/pci/hda/patch_realtek.c +9 -0
@@ -10522,6 +10522,7 @@ enum {ALC668_FIXUP_MIC_DET_COEF ,ALC897_FIXUP_LENOVO_HEADSET_MIC ,ALC897_FIXUP_HEADSET_MIC_PIN , + ALC897_FIXUP_HP_HSMIC_VERB, }; static const struct hda_fixup alc662_fixups[] = {
@@ -10941,6 +10942,13 @@ static const struct hda_fixup alc662_fix .chained = true, .chain_id =ALC897_FIXUP_LENOVO_HEADSET_MIC }, + [ALC897_FIXUP_HP_HSMIC_VERB] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x19 ,0x01a1913c },/* use as headset mic, without its own jack detect */ + { } + }, + }, };static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -10966,6 +10974,7 @@ static const struct snd_pci_quirk alc662SND_PCI_QUIRK (0x1028 ,0x0698 ,"Dell" ,ALC668_FIXUP_DELL_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1028 ,0x069f ,"Dell" ,ALC668_FIXUP_DELL_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x103c ,0x1632 ,"HP RP5800" ,ALC662_FIXUP_HP_RP5800 ), +SND_PCI_QUIRK (0x103c ,0x8719 ,"HP" ,ALC897_FIXUP_HP_HSMIC_VERB ),SND_PCI_QUIRK (0x103c ,0x873e ,"HP" ,ALC671_FIXUP_HP_HEADSET_MIC2 ),SND_PCI_QUIRK (0x103c ,0x885f ,"HP 288 Pro G8" ,ALC671_FIXUP_HP_HEADSET_MIC2 ), SND_PCI_QUIRK(0x1043, 0x1080, "Asus UX501VW", ALC668_FIXUP_HEADSET_MODE),
Greg Kroah-Hartman
maintainerPATCH 7/135 ALSA: hda/realtek: Apply fixup for Lenovo Yoga Duet 7 properly
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 56ec3e755bd1041d35bdec020a99b327697ee470 upstream.
It turned out that Lenovo shipped two completely different products with the very same PCI SSID, where both require different quirks; namely, Lenovo C940 has already the fixup for its speaker (ALC298_FIXUP_LENOVO_SPK_VOLUME) with the PCI SSID 17aa:3818, while Yoga Duet 7 has also the very same PCI SSID but requires a different quirk, ALC287_FIXUP_YOGA7_14TIL_SPEAKERS.
Fortunately, both are with different codecs (C940 with ALC298 and Duet 7 with ALC287), hence we can apply different fixes by checking the codec ID. This patch implements that special fixup function.
For easier handling, the internal function for applying a specific fixup entry is exported as __snd_hda_apply_fixup(), so that it can be called from the codec driver. The rest is simply calling it with a different fixup ID depending on the codec ID.
--- sound/pci/hda/hda_auto_parser.c | 7 ++++--- sound/pci/hda/hda_local.h | 1 + sound/pci/hda/patch_realtek.c | 24 +++++++++++++++++++++++- 3 files changed, 28 insertions(+), 4 deletions(-)
sound/pci/hda/hda_auto_parser.c +4 -3
@@ -823,7 +823,7 @@ static void set_pin_targets(struct hda_csnd_hda_set_pin_ctl_cache (codec, cfg->nid, cfg->val); } -static void apply_fixup (struct hda_codec *codec,int id,int action,int depth) +void __snd_hda_apply_fixup (struct hda_codec *codec,int id,int action,int depth) {const char *modelname = codec->fixup_name;
@@ -833,7 +833,7 @@ static void apply_fixup(struct hda_codecif (++depth >10 )break ;if (fix->chained_before) -apply_fixup (codec, fix->chain_id, action, depth +1 ); +__snd_hda_apply_fixup (codec, fix->chain_id, action, depth +1 );switch (fix->type) {case HDA_FIXUP_PINS :
@@ -874,6 +874,7 @@ static void apply_fixup(struct hda_codec id = fix->chain_id; } } +EXPORT_SYMBOL_GPL (__snd_hda_apply_fixup);/** * snd_hda_apply_fixup - Apply the fixup chain with the given action
@@ -883,7 +884,7 @@ static void apply_fixup(struct hda_codecvoid snd_hda_apply_fixup (struct hda_codec *codec,int action) {if (codec->fixup_list) -apply_fixup (codec, codec->fixup_id, action,0 ); +__snd_hda_apply_fixup (codec, codec->fixup_id, action,0 ); }EXPORT_SYMBOL_GPL (snd_hda_apply_fixup);
sound/pci/hda/hda_local.h +1 -0
@@ -350,6 +350,7 @@ void snd_hda_apply_verbs(struct hda_codevoid snd_hda_apply_pincfgs (struct hda_codec *codec,const struct hda_pintbl *cfg);void snd_hda_apply_fixup (struct hda_codec *codec,int action); +void __snd_hda_apply_fixup (struct hda_codec *codec,int id,int action,int depth); void snd_hda_pick_fixup(struct hda_codec *codec, const struct hda_model_fixup *models, const struct snd_pci_quirk *quirk,
sound/pci/hda/patch_realtek.c +23 -1
@@ -6883,6 +6883,7 @@ enum {ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS ,ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS , +ALC298_FIXUP_LENOVO_C940_DUET7 ,ALC287_FIXUP_13S_GEN2_SPEAKERS ,ALC256_FIXUP_SET_COEF_DEFAULTS , ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
@@ -6892,6 +6893,23 @@ enum { ALC285_FIXUP_LEGION_Y9000X_AUTOMUTE, }; +/* A special fixup for Lenovo C940 and Yoga Duet 7; +* both have the very same PCI SSID, and we need to apply different fixups +* depending on the codec ID +*/ +static void alc298_fixup_lenovo_c940_duet7 (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +int id; + +if (codec->core.vendor_id ==0x10ec0298 ) + id =ALC298_FIXUP_LENOVO_SPK_VOLUME ;/* C940 */ +else + id =ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ;/* Duet 7 */ +__snd_hda_apply_fixup (codec, id, action,0 ); +} +static const struct hda_fixup alc269_fixups[] = { [ALC269_FIXUP_GPIO2 ] = { .type =HDA_FIXUP_FUNC ,
@@ -8591,6 +8609,10 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id = ALC269_FIXUP_HEADSET_MODE, }, + [ALC298_FIXUP_LENOVO_C940_DUET7] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc298_fixup_lenovo_c940_duet7, + }, [ALC287_FIXUP_13S_GEN2_SPEAKERS] = { .type = HDA_FIXUP_VERBS, .v.verbs = (const struct hda_verb []) {
@@ -9060,7 +9082,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x31af ,"ThinkCentre Station" ,ALC623_FIXUP_LENOVO_THINKSTATION_P340 ),SND_PCI_QUIRK (0x17aa ,0x3802 ,"Lenovo Yoga DuetITL 2021" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3813 ,"Legion 7i 15IMHG05" ,ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS ), -SND_PCI_QUIRK (0x17aa ,0x3818 ,"Lenovo C940" ,ALC298_FIXUP_LENOVO_SPK_VOLUME ), +SND_PCI_QUIRK (0x17aa ,0x3818 ,"Lenovo C940 / Yoga Duet 7" ,ALC298_FIXUP_LENOVO_C940_DUET7 ),SND_PCI_QUIRK (0x17aa ,0x3819 ,"Lenovo 13s Gen2 ITL" ,ALC287_FIXUP_13S_GEN2_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3820 ,"Yoga Duet 7 13ITL6" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ), SND_PCI_QUIRK(0x17aa, 0x3824, "Legion Y9000X 2020", ALC285_FIXUP_LEGION_Y9000X_SPEAKERS),
Greg Kroah-Hartman
maintainerPATCH 8/135 ALSA: hda/realtek: Add quirk for Clevo PD70PNT
In reply to Greg Kroah-HartmanFrom: Tim Crawford <[email protected]>
commit d49951219b0249d3eff49e4f02e0de82357bc8a0 upstream.
Fixes speaker output and headset detection on Clevo PD70PNT.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -2629,6 +2629,7 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x1558 ,0x67e1 ,"Clevo PB71[DE][CDF]" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ),SND_PCI_QUIRK (0x1558 ,0x67e5 ,"Clevo PC70D[PRS](?:-D|-G)?" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ),SND_PCI_QUIRK (0x1558 ,0x67f1 ,"Clevo PC70H[PRS]" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ), +SND_PCI_QUIRK (0x1558 ,0x67f5 ,"Clevo PD70PN[NRT]" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ),SND_PCI_QUIRK (0x1558 ,0x70d1 ,"Clevo PC70[ER][CDF]" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ),SND_PCI_QUIRK (0x1558 ,0x7714 ,"Clevo X170SM" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ), SND_PCI_QUIRK(0x1558, 0x7715, "Clevo X170KM-G", ALC1220_FIXUP_CLEVO_PB51ED),
Greg Kroah-Hartman
maintainerPATCH 9/135 ALSA: hda/realtek: Add quirk for Clevo NS50PU
In reply to Greg Kroah-HartmanFrom: Tim Crawford <[email protected]>
commit 627ce0d68eb4b53e995b08089fa9da1e513ec5ba upstream.
Fixes headset detection on Clevo NS50PU.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9000,6 +9000,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1558 ,0x70f3 ,"Clevo NH77DPQ" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x70f4 ,"Clevo NH77EPY" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x70f6 ,"Clevo NH77DPQ-Y" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0x1558 ,0x7716 ,"Clevo NS50PU" ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x8228 ,"Clevo NR40BU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x8520 ,"Clevo NH50D[CD]" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1558, 0x8521, "Clevo NH77D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
Greg Kroah-Hartman
maintainerPATCH 10/135 net: openvswitch: fix parsing of nw_proto for IPv6 fragments
In reply to Greg Kroah-HartmanFrom: Rosemarie O'Riorden <[email protected]>
commit 12378a5a75e33f34f8586706eb61cca9e6d4690c upstream.
When a packet enters the OVS datapath and does not match any existing flows installed in the kernel flow cache, the packet will be sent to userspace to be parsed, and a new flow will be created. The kernel and OVS rely on each other to parse packet fields in the same way so that packets will be handled properly.
As per the design document linked below, OVS expects all later IPv6 fragments to have nw_proto=44 in the flow key, so they can be correctly matched on OpenFlow rules. OpenFlow controllers create pipelines based on this design.
This behavior was changed by the commit in the Fixes tag so that nw_proto equals the next_header field of the last extension header. However, there is no counterpart for this change in OVS userspace, meaning that this field is parsed differently between OVS and the kernel. This is a problem because OVS creates actions based on what is parsed in userspace, but the kernel-provided flow key is used as a match criteria, as described in Documentation/networking/openvswitch.rst. This leads to issues such as packets incorrectly matching on a flow and thus the wrong list of actions being applied to the packet. Such changes in packet parsing cannot be implemented without breaking the userspace.
The offending commit is partially reverted to restore the expected behavior.
The change technically made sense and there is a good reason that it was implemented, but it does not comply with the original design of OVS. If in the future someone wants to implement such a change, then it must be user-configurable and disabled by default to preserve backwards compatibility with existing OVS versions.
--- net/openvswitch/flow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/openvswitch/flow.c +1 -1
@@ -266,7 +266,7 @@ static int parse_ipv6hdr(struct sk_buffif (flags &IP6_FH_F_FRAG ) {if (frag_off) { key->ip.frag =OVS_FRAG_TYPE_LATER ; - key->ip.proto = nexthdr; + key->ip.proto =NEXTHDR_FRAGMENT ;return 0 ; } key->ip.frag =OVS_FRAG_TYPE_FIRST ;
Greg Kroah-Hartman
maintainerPATCH 11/135 9p: Fix refcounting during full path walks for fid lookups
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
commit 2a3dcbccd64ba35c045fac92272ff981c4cbef44 upstream.
Decrement the refcount of the parent dentry's fid after walking each path component during a full path walk for a lookup. Failure to do so can lead to fids that are not clunked until the filesystem is unmounted, as indicated by this warning:
9pnet: found fid 3 not clunked
The improper refcounting after walking resulted in open(2) returning -EIO on any directories underneath the mount point when using the virtio transport. When using the fd transport, there's no apparent issue until the filesytem is unmounted and the warning above is emitted to the logs.
In some cases, the user may not yet be attached to the filesystem and a new root fid, associated with the user, is created and attached to the root dentry before the full path walk is performed. Increment the new root fid's refcount to two in that situation so that it can be safely decremented to one after it is used for the walk operation. The new fid will still be attached to the root dentry when v9fs_fid_lookup_with_uid() returns so a final refcount of one is correct/expected.
--- fs/9p/fid.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-)
fs/9p/fid.c +9 -13
@@ -151,7 +151,7 @@ static struct p9_fid *v9fs_fid_lookup_wiconst unsigned char **wnames, *uname;int i, n, l, clone, access;struct v9fs_session_info *v9ses; -struct p9_fid *fid, *old_fid =NULL ; +struct p9_fid *fid, *old_fid; v9ses =v9fs_dentry2v9ses (dentry); access = v9ses->flags &V9FS_ACCESS_MASK ;
@@ -193,13 +193,12 @@ static struct p9_fid *v9fs_fid_lookup_wiif (IS_ERR (fid))return fid; +refcount_inc (&fid->count);v9fs_fid_add (dentry->d_sb->s_root, fid); }/* If we are root ourself just return that */ -if (dentry->d_sb->s_root == dentry) { -refcount_inc (&fid->count); +if (dentry->d_sb->s_root == dentry)return fid; - }/* * Do a multipath walk with attached root. * When walking parent we need to make sure we
@@ -211,6 +210,7 @@ static struct p9_fid *v9fs_fid_lookup_wi fid =ERR_PTR (n); goto err_out; } + old_fid = fid; clone =1 ; i =0 ;while (i < n) {
@@ -220,19 +220,15 @@ static struct p9_fid *v9fs_fid_lookup_wi* walk to ensure none of the patch component change */ fid =p9_client_walk (fid, l, &wnames[i], clone); +/* non-cloning walk will return the same fid */ +if (fid != old_fid) { +p9_client_clunk (old_fid); + old_fid = fid; + }if (IS_ERR (fid)) { -if (old_fid) { -/* -* If we fail, clunk fid which are mapping -* to path component and not the last component -* of the path. -*/ -p9_client_clunk (old_fid); - }kfree (wnames); goto err_out; } - old_fid = fid; i += l; clone =0 ; }
Greg Kroah-Hartman
maintainerPATCH 12/135 9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl
In reply to Greg Kroah-HartmanFrom: Dominique Martinet <[email protected]>
commit beca774fc51a9ba8abbc869cf0c3d965ff17cd24 upstream.
We need to release directory fid if we fail halfway through open
This fixes fid leaking with xfstests generic 531
--- fs/9p/vfs_inode_dotl.c | 3 +++ 1 file changed, 3 insertions(+)
fs/9p/vfs_inode_dotl.c +3 -0
@@ -276,6 +276,7 @@ v9fs_vfs_atomic_open_dotl(struct inode *if (IS_ERR (ofid)) { err =PTR_ERR (ofid);p9_debug (P9_DEBUG_VFS ,"p9_client_walk failed %d\n" , err); +p9_client_clunk (dfid); goto out; }
@@ -287,6 +288,7 @@ v9fs_vfs_atomic_open_dotl(struct inode *if (err) {p9_debug (P9_DEBUG_VFS ,"Failed to get acl values in creat %d\n" , err); +p9_client_clunk (dfid); goto error; } err = p9_client_create_dotl(ofid, name, v9fs_open_to_dotl_flags(flags),
@@ -294,6 +296,7 @@ v9fs_vfs_atomic_open_dotl(struct inode *if (err <0 ) {p9_debug (P9_DEBUG_VFS ,"p9_client_open_dotl failed in creat %d\n" , err); +p9_client_clunk (dfid); goto error; }v9fs_invalidate_inode_attr (dir);
Greg Kroah-Hartman
maintainerPATCH 13/135 9p: fix fid refcount leak in v9fs_vfs_get_link
In reply to Greg Kroah-HartmanFrom: Dominique Martinet <[email protected]>
commit e5690f263208c5abce7451370b7786eb25b405eb upstream.
we check for protocol version later than required, after a fid has been obtained. Just move the version check earlier.
--- fs/9p/vfs_inode.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/9p/vfs_inode.c +4 -4
@@ -1228,15 +1228,15 @@ static const char *v9fs_vfs_get_link(strreturn ERR_PTR (-ECHILD ); v9ses =v9fs_dentry2v9ses (dentry); - fid =v9fs_fid_lookup (dentry); +if (!v9fs_proto_dotu (v9ses)) +return ERR_PTR (-EBADF ); +p9_debug (P9_DEBUG_VFS ,"%pd\n" , dentry); + fid =v9fs_fid_lookup (dentry);if (IS_ERR (fid))return ERR_CAST (fid); -if (!v9fs_proto_dotu (v9ses)) -return ERR_PTR (-EBADF ); - st =p9_client_stat (fid);p9_client_clunk (fid);if (IS_ERR (st))
Greg Kroah-Hartman
maintainerPATCH 14/135 btrfs: fix hang during unmount when block group reclaim task is running
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 31e70e527806c546a72262f2fc3d982ee23c42d3 upstream.
When we start an unmount, at close_ctree(), if we have the reclaim task running and in the middle of a data block group relocation, we can trigger a deadlock when stopping an async reclaim task, producing a trace like the following:
[629724.498185] task:kworker/u16:7 state:D stack: 0 pid:681170 ppid: 2 flags:0x00004000 [629724.499760] Workqueue: events_unbound btrfs_async_reclaim_metadata_space [btrfs] [629724.501267] Call Trace: [629724.501759] <TASK> [629724.502174] __schedule+0x3cb/0xed0 [629724.502842] schedule+0x4e/0xb0 [629724.503447] btrfs_wait_on_delayed_iputs+0x7c/0xc0 [btrfs] [629724.504534] ? prepare_to_wait_exclusive+0xc0/0xc0 [629724.505442] flush_space+0x423/0x630 [btrfs] [629724.506296] ? rcu_read_unlock_trace_special+0x20/0x50 [629724.507259] ? lock_release+0x220/0x4a0 [629724.507932] ? btrfs_get_alloc_profile+0xb3/0x290 [btrfs] [629724.508940] ? do_raw_spin_unlock+0x4b/0xa0 [629724.509688] btrfs_async_reclaim_metadata_space+0x139/0x320 [btrfs] [629724.510922] process_one_work+0x252/0x5a0 [629724.511694] ? process_one_work+0x5a0/0x5a0 [629724.512508] worker_thread+0x52/0x3b0 [629724.513220] ? process_one_work+0x5a0/0x5a0 [629724.514021] kthread+0xf2/0x120 [629724.514627] ? kthread_complete_and_exit+0x20/0x20 [629724.515526] ret_from_fork+0x22/0x30 [629724.516236] </TASK> [629724.516694] task:umount state:D stack: 0 pid:719055 ppid:695412 flags:0x00004000 [629724.518269] Call Trace: [629724.518746] <TASK> [629724.519160] __schedule+0x3cb/0xed0 [629724.519835] schedule+0x4e/0xb0 [629724.520467] schedule_timeout+0xed/0x130 [629724.521221] ? lock_release+0x220/0x4a0 [629724.521946] ? lock_acquired+0x19c/0x420 [629724.522662] ? trace_hardirqs_on+0x1b/0xe0 [629724.523411] __wait_for_common+0xaf/0x1f0 [629724.524189] ? usleep_range_state+0xb0/0xb0 [629724.524997] __flush_work+0x26d/0x530 [629724.525698] ? flush_workqueue_prep_pwqs+0x140/0x140 [629724.526580] ? lock_acquire+0x1a0/0x310 [629724.527324] __cancel_work_timer+0x137/0x1c0 [629724.528190] close_ctree+0xfd/0x531 [btrfs] [629724.529000] ? evict_inodes+0x166/0x1c0 [629724.529510] generic_shutdown_super+0x74/0x120 [629724.530103] kill_anon_super+0x14/0x30 [629724.530611] btrfs_kill_super+0x12/0x20 [btrfs] [629724.531246] deactivate_locked_super+0x31/0xa0 [629724.531817] cleanup_mnt+0x147/0x1c0 [629724.532319] task_work_run+0x5c/0xa0 [629724.532984] exit_to_user_mode_prepare+0x1a6/0x1b0 [629724.533598] syscall_exit_to_user_mode+0x16/0x40 [629724.534200] do_syscall_64+0x48/0x90 [629724.534667] entry_SYSCALL_64_after_hwframe+0x44/0xae [629724.535318] RIP: 0033:0x7fa2b90437a7 [629724.535804] RSP: 002b:00007ffe0b7e4458 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [629724.536912] RAX: 0000000000000000 RBX: 00007fa2b9182264 RCX: 00007fa2b90437a7 [629724.538156] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000555d6cf20dd0 [629724.539053] RBP: 0000555d6cf20ba0 R08: 0000000000000000 R09: 00007ffe0b7e3200 [629724.539956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [629724.540883] R13: 0000555d6cf20dd0 R14: 0000555d6cf20cb0 R15: 0000000000000000 [629724.541796] </TASK>
This happens because:
1) Before entering close_ctree() we have the async block group reclaim task running and relocating a data block group;
2) There's an async metadata (or data) space reclaim task running;
3) We enter close_ctree() and park the cleaner kthread;
4) The async space reclaim task is at flush_space() and runs all the existing delayed iputs;
5) Before the async space reclaim task calls btrfs_wait_on_delayed_iputs(), the block group reclaim task which is doing the data block group relocation, creates a delayed iput at replace_file_extents() (called when COWing leaves that have file extent items pointing to relocated data extents, during the merging phase of relocation roots);
6) The async reclaim space reclaim task blocks at btrfs_wait_on_delayed_iputs(), since we have a new delayed iput;
7) The task at close_ctree() then calls cancel_work_sync() to stop the async space reclaim task, but it blocks since that task is waiting for the delayed iput to be run;
8) The delayed iput is never run because the cleaner kthread is parked, and no one else runs delayed iputs, resulting in a hang.
So fix this by stopping the async block group reclaim task before we park the cleaner kthread.
--- fs/btrfs/disk-io.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
fs/btrfs/disk-io.c +11 -2
@@ -4360,6 +4360,17 @@ void __cold close_ctree(struct btrfs_fs_int ret;set_bit (BTRFS_FS_CLOSING_START , &fs_info->flags); + +/* +* We may have the reclaim task running and relocating a data block group, +* in which case it may create delayed iputs. So stop it before we park +* the cleaner kthread otherwise we can get new delayed iputs after +* parking the cleaner, and that can make the async reclaim task to hang +* if it's waiting for delayed iputs to complete, since the cleaner is +* parked and can not run delayed iputs - this will make us hang when +* trying to stop the async reclaim task. +*/ +cancel_work_sync (&fs_info->reclaim_bgs_work);/* * We don't want the cleaner to start new transactions, add more delayed * iputs, etc. while we're closing. We can't use kthread_stop() yet
@@ -4400,8 +4411,6 @@ void __cold close_ctree(struct btrfs_fs_cancel_work_sync (&fs_info->async_data_reclaim_work);cancel_work_sync (&fs_info->preempt_reclaim_work); -cancel_work_sync (&fs_info->reclaim_bgs_work); -/* Cancel or finish ongoing discard work */ btrfs_discard_cleanup (fs_info);
Greg Kroah-Hartman
maintainerPATCH 15/135 btrfs: prevent remounting to v1 space cache for subpage mount
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 0591f04036218d572d54349ea8c7914ad9c82b2b upstream.
Upstream commit 9f73f1aef98b ("btrfs: force v2 space cache usage for subpage mount") forces subpage mount to use v2 cache, to avoid deprecated v1 cache which doesn't support subpage properly.
But there is a loophole that user can still remount to v1 cache.
The existing check will only give users a warning, but does not really prevent to do the remount.
Although remounting to v1 will not cause any problems since the v1 cache will always be marked invalid when mounted with a different page size, it's still better to prevent v1 cache at all for subpage mounts.
--- fs/btrfs/super.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/btrfs/super.c +8 -0
@@ -1917,6 +1917,14 @@ static int btrfs_remount(struct super_blif (ret) goto restore; +/* V1 cache is not supported for subpage mount. */ +if (fs_info->sectorsize <PAGE_SIZE &&btrfs_test_opt (fs_info,SPACE_CACHE )) { +btrfs_warn (fs_info, +"v1 space cache is not supported for page size %lu with sectorsize %u" , +PAGE_SIZE , fs_info->sectorsize); + ret = -EINVAL ; + goto restore; + }btrfs_remount_begin (fs_info, old_opts, *flags);btrfs_resize_thread_pool (fs_info, fs_info->thread_pool_size, old_thread_pool_size);
Greg Kroah-Hartman
maintainerPATCH 16/135 btrfs: add error messages to all unrecognized mount options
In reply to Greg Kroah-HartmanFrom: David Sterba <[email protected]>
commit e3a4167c880cf889f66887a152799df4d609dd21 upstream.
Almost none of the errors stemming from a valid mount option but wrong value prints a descriptive message which would help to identify why mount failed. Like in the linked report:
$ uname -r v4.19 $ mount -o compress=zstd /dev/sdb /mnt mount: /mnt: wrong fs type, bad option, bad superblock on /dev/sdb, missing codepage or helper program, or other error. $ dmesg ... BTRFS error (device sdb): open_ctree failed
Errors caused by memory allocation failures are left out as it's not a user error so reporting that would be confusing.
--- fs/btrfs/super.c | 39 ++++++++++++++++++++++++++++++++------- 1 file changed, 32 insertions(+), 7 deletions(-)
fs/btrfs/super.c +32 -7
@@ -712,6 +712,8 @@ int btrfs_parse_options(struct btrfs_fs_ compress_force = false; no_compress++; }else { +btrfs_err (info,"unrecognized compression value %s" , + args[0 ].from); ret = -EINVAL ; goto out; }
@@ -770,8 +772,11 @@ int btrfs_parse_options(struct btrfs_fs_case Opt_thread_pool: ret =match_int (&args[0 ], &intarg);if (ret) { +btrfs_err (info,"unrecognized thread_pool value %s" , + args[0 ].from); goto out; }else if (intarg ==0 ) { +btrfs_err (info,"invalid value 0 for thread_pool" ); ret = -EINVAL ; goto out; }
@@ -832,8 +837,11 @@ int btrfs_parse_options(struct btrfs_fs_break ;case Opt_ratio: ret =match_int (&args[0 ], &intarg); -if (ret) +if (ret) { +btrfs_err (info,"unrecognized metadata_ratio value %s" , + args[0 ].from); goto out; + } info->metadata_ratio = intarg;btrfs_info (info,"metadata ratio %u" , info->metadata_ratio);
@@ -850,6 +858,8 @@ int btrfs_parse_options(struct btrfs_fs_btrfs_set_and_info (info,DISCARD_ASYNC ,"turning on async discard" ); }else { +btrfs_err (info,"unrecognized discard mode value %s" , + args[0 ].from); ret = -EINVAL ; goto out; }
@@ -874,6 +884,8 @@ int btrfs_parse_options(struct btrfs_fs_btrfs_set_and_info (info,FREE_SPACE_TREE ,"enabling free space tree" ); }else { +btrfs_err (info,"unrecognized space_cache value %s" , + args[0 ].from); ret = -EINVAL ; goto out; }
@@ -943,8 +955,12 @@ int btrfs_parse_options(struct btrfs_fs_break ;case Opt_check_integrity_print_mask: ret =match_int (&args[0 ], &intarg); -if (ret) +if (ret) { +btrfs_err (info, +"unrecognized check_integrity_print_mask value %s" , + args[0 ].from); goto out; + } info->check_integrity_print_mask = intarg;btrfs_info (info,"check_integrity_print_mask 0x%x" , info->check_integrity_print_mask);
@@ -959,13 +975,15 @@ int btrfs_parse_options(struct btrfs_fs_ goto out;#endif case Opt_fatal_errors: -if (strcmp (args[0 ].from,"panic" ) ==0 ) +if (strcmp (args[0 ].from,"panic" ) ==0 ) {btrfs_set_opt (info->mount_opt,PANIC_ON_FATAL_ERROR ); -else if (strcmp (args[0 ].from,"bug" ) ==0 ) + }else if (strcmp (args[0 ].from,"bug" ) ==0 ) {btrfs_clear_opt (info->mount_opt,PANIC_ON_FATAL_ERROR ); -else { + }else { +btrfs_err (info,"unrecognized fatal_errors value %s" , + args[0 ].from); ret = -EINVAL ; goto out; }
@@ -973,8 +991,12 @@ int btrfs_parse_options(struct btrfs_fs_case Opt_commit_interval: intarg =0 ; ret =match_int (&args[0 ], &intarg); -if (ret) +if (ret) { +btrfs_err (info,"unrecognized commit_interval value %s" , + args[0 ].from); + ret = -EINVAL ; goto out; + }if (intarg ==0 ) { btrfs_info(info, "using default commit interval %us",
@@ -988,8 +1010,11 @@ int btrfs_parse_options(struct btrfs_fs_break ;case Opt_rescue: ret =parse_rescue_options (info, args[0 ].from); -if (ret <0 ) +if (ret <0 ) { +btrfs_err (info,"unrecognized rescue value %s" , + args[0 ].from); goto out; + }break ;#ifdef CONFIG_BTRFS_DEBUG case Opt_fragment_all:
Greg Kroah-Hartman
maintainerPATCH 17/135 scsi: ibmvfc: Store vhost pointer during subcrq allocation
In reply to Greg Kroah-HartmanFrom: Tyrel Datwyler <[email protected]>
commit aeaadcde1a60138bceb65de3cdaeec78170b4459 upstream.
Currently the back pointer from a queue to the vhost adapter isn't set until after subcrq interrupt registration. The value is available when a queue is first allocated and can/should be also set for primary and async queues as well as subcrqs.
This fixes a crash observed during kexec/kdump on Power 9 with legacy XICS interrupt controller where a pending subcrq interrupt from the previous kernel can be replayed immediately upon IRQ registration resulting in dereference of a garbage backpointer in ibmvfc_interrupt_scsi().
Kernel attempted to read user page (58) - exploit attempt? (uid: 0)
BUG: Kernel NULL pointer dereference on read at 0x00000058 Faulting instruction address: 0xc008000003216a08 Oops: Kernel access of bad area, sig: 11 [#1] ... NIP [c008000003216a08] ibmvfc_interrupt_scsi+0x40/0xb0 [ibmvfc] LR [c0000000082079e8] __handle_irq_event_percpu+0x98/0x270 Call Trace:
[c000000047fa3d80] [c0000000123e6180] 0xc0000000123e6180 (unreliable) [c000000047fa3df0] [c0000000082079e8] __handle_irq_event_percpu+0x98/0x270 [c000000047fa3ea0] [c000000008207d18] handle_irq_event+0x98/0x188 [c000000047fa3ef0] [c00000000820f564] handle_fasteoi_irq+0xc4/0x310 [c000000047fa3f40] [c000000008205c60] generic_handle_irq+0x50/0x80 [c000000047fa3f60] [c000000008015c40] __do_irq+0x70/0x1a0 [c000000047fa3f90] [c000000008016d7c] __do_IRQ+0x9c/0x130 [c000000014622f60] [0000000020000000] 0x20000000
[c000000014622ff0] [c000000008016e50] do_IRQ+0x40/0xa0
[c000000014623020] [c000000008017044] replay_soft_interrupts+0x194/0x2f0 [c000000014623210] [c0000000080172a8] arch_local_irq_restore+0x108/0x170 [c000000014623240] [c000000008eb1008] _raw_spin_unlock_irqrestore+0x58/0xb0 [c000000014623270] [c00000000820b12c] __setup_irq+0x49c/0x9f0 [c000000014623310] [c00000000820b7c0] request_threaded_irq+0x140/0x230 [c000000014623380] [c008000003212a50] ibmvfc_register_scsi_channel+0x1e8/0x2f0 [ibmvfc] [c000000014623450] [c008000003213d1c] ibmvfc_init_sub_crqs+0xc4/0x1f0 [ibmvfc] [c0000000146234d0] [c0080000032145a8] ibmvfc_reset_crq+0x150/0x210 [ibmvfc] [c000000014623550] [c0080000032147c8] ibmvfc_init_crq+0x160/0x280 [ibmvfc] [c0000000146235f0] [c00800000321a9cc] ibmvfc_probe+0x2a4/0x530 [ibmvfc]
--- drivers/scsi/ibmvscsi/ibmvfc.c | 3 ++- drivers/scsi/ibmvscsi/ibmvfc.h | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/ibmvscsi/ibmvfc.c +2 -1
@@ -5680,6 +5680,8 @@ static int ibmvfc_alloc_queue(struct ibm queue->cur =0 ; queue->fmt = fmt; queue->size =PAGE_SIZE / fmt_size; + + queue->vhost = vhost;return 0 ; }
@@ -5788,7 +5790,6 @@ static int ibmvfc_register_scsi_channel( } scrq->hwq_id = index; - scrq->vhost = vhost;LEAVE ;return 0 ;
drivers/scsi/ibmvscsi/ibmvfc.h +1 -1
@@ -789,6 +789,7 @@ struct ibmvfc_queue {spinlock_t _lock;spinlock_t *q_lock; +struct ibmvfc_host *vhost;struct ibmvfc_event_pool evt_pool;struct list_head sent;struct list_head free;
@@ -797,7 +798,6 @@ struct ibmvfc_queue {union ibmvfc_iu cancel_rsp;/* Sub-CRQ fields */ -struct ibmvfc_host *vhost;unsigned long cookie;unsigned long vios_cookie;unsigned long hw_irq;
Greg Kroah-Hartman
maintainerPATCH 18/135 scsi: ibmvfc: Allocate/free queue resource only during probe/remove
In reply to Greg Kroah-HartmanFrom: Tyrel Datwyler <[email protected]>
commit 72ea7fe0db73d65c7d977208842d8ade9b823de9 upstream.
Currently, the sub-queues and event pool resources are allocated/freed for every CRQ connection event such as reset and LPM. This exposes the driver to a couple issues. First the inefficiency of freeing and reallocating memory that can simply be resued after being sanitized. Further, a system under memory pressue runs the risk of allocation failures that could result in a crippled driver. Finally, there is a race window where command submission/compeletion can try to pull/return elements from/to an event pool that is being deleted or already has been deleted due to the lack of host state around freeing/allocating resources. The following is an example of list corruption following a live partition migration (LPM):
Oops: Exception in kernel mode, sig: 5 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in: vfat fat isofs cdrom ext4 mbcache jbd2 nft_counter nft_compat nf_tables nfnetlink rpadlpar_io rpaphp xsk_diag nfsv3 nfs_acl nfs lockd grace fscache netfs rfkill bonding tls sunrpc pseries_rng drm drm_panel_orientation_quirks xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc scsi_transport_fc ibmveth vmx_crypto dm_multipath dm_mirror dm_region_hash dm_log dm_mod ipmi_devintf ipmi_msghandler fuse
CPU: 0 PID: 2108 Comm: ibmvfc_0 Kdump: loaded Not tainted 5.14.0-70.9.1.el9_0.ppc64le #1
NIP: c0000000007c4bb0 LR: c0000000007c4bac CTR: 00000000005b9a10
REGS: c00000025c10b760 TRAP: 0700 Not tainted (5.14.0-70.9.1.el9_0.ppc64le)
MSR: 800000000282b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 2800028f XER: 0000000f
CFAR: c0000000001f55bc IRQMASK: 0
GPR00: c0000000007c4bac c00000025c10ba00 c000000002a47c00 000000000000004e
GPR04: c0000031e3006f88 c0000031e308bd00 c00000025c10b768 0000000000000027
GPR08: 0000000000000000 c0000031e3009dc0 00000031e0eb0000 0000000000000000
GPR12: c0000031e2ffffa8 c000000002dd0000 c000000000187108 c00000020fcee2c0
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 0000000000000000 0000000000000000 0000000000000000 c008000002f81300
GPR24: 5deadbeef0000100 5deadbeef0000122 c000000263ba6910 c00000024cc88000
GPR28: 000000000000003c c0000002430a0000 c0000002430ac300 000000000000c300
NIP [c0000000007c4bb0] __list_del_entry_valid+0x90/0x100
LR [c0000000007c4bac] __list_del_entry_valid+0x8c/0x100
Call Trace:
[c00000025c10ba00] [c0000000007c4bac] __list_del_entry_valid+0x8c/0x100 (unreliable)
[c00000025c10ba60] [c008000002f42284] ibmvfc_free_queue+0xec/0x210 [ibmvfc]
[c00000025c10bb10] [c008000002f4246c] ibmvfc_deregister_scsi_channel+0xc4/0x160 [ibmvfc]
[c00000025c10bba0] [c008000002f42580] ibmvfc_release_sub_crqs+0x78/0x130 [ibmvfc]
[c00000025c10bc20] [c008000002f4f6cc] ibmvfc_do_work+0x5c4/0xc70 [ibmvfc]
[c00000025c10bce0] [c008000002f4fdec] ibmvfc_work+0x74/0x1e8 [ibmvfc]
[c00000025c10bda0] [c0000000001872b8] kthread+0x1b8/0x1c0
[c00000025c10be10] [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64
Instruction dump:
40820034 38600001 38210060 4e800020 7c0802a6 7c641b78 3c62fe7a 7d254b78
3863b590 f8010070 4ba309cd 60000000 <0fe00000> 7c0802a6 3c62fe7a 3863b640
---[ end trace 11a2b65a92f8b66c ]---ibmvfc 30000003: Send warning. Receive queue closed, will retry.
Add registration/deregistration helpers that are called instead during connection resets to sanitize and reconfigure the queues.
--- drivers/scsi/ibmvscsi/ibmvfc.c | 79 ++++++++++++++++++++++++++++++++--------- 1 file changed, 62 insertions(+), 17 deletions(-)
drivers/scsi/ibmvscsi/ibmvfc.c +62 -17
@@ -160,8 +160,8 @@ static void ibmvfc_npiv_logout(struct ibstatic void ibmvfc_tgt_implicit_logout_and_del (struct ibmvfc_target *);static void ibmvfc_tgt_move_login (struct ibmvfc_target *); -static void ibmvfc_release_sub_crqs (struct ibmvfc_host *); -static void ibmvfc_init_sub_crqs (struct ibmvfc_host *); +static void ibmvfc_dereg_sub_crqs (struct ibmvfc_host *); +static void ibmvfc_reg_sub_crqs (struct ibmvfc_host *);static const char *unknown_error ="unknown error" ;
@@ -917,7 +917,7 @@ static int ibmvfc_reenable_crq_queue(strstruct vio_dev *vdev =to_vio_dev (vhost->dev);unsigned long flags; -ibmvfc_release_sub_crqs (vhost); +ibmvfc_dereg_sub_crqs (vhost);/* Re-enable the CRQ */ do {
@@ -936,7 +936,7 @@ static int ibmvfc_reenable_crq_queue(strspin_unlock (vhost->crq.q_lock);spin_unlock_irqrestore (vhost->host->host_lock, flags); -ibmvfc_init_sub_crqs (vhost); +ibmvfc_reg_sub_crqs (vhost);return rc; }
@@ -955,7 +955,7 @@ static int ibmvfc_reset_crq(struct ibmvfstruct vio_dev *vdev =to_vio_dev (vhost->dev);struct ibmvfc_queue *crq = &vhost->crq; -ibmvfc_release_sub_crqs (vhost); +ibmvfc_dereg_sub_crqs (vhost);/* Close the CRQ */ do {
@@ -988,7 +988,7 @@ static int ibmvfc_reset_crq(struct ibmvfspin_unlock (vhost->crq.q_lock);spin_unlock_irqrestore (vhost->host->host_lock, flags); -ibmvfc_init_sub_crqs (vhost); +ibmvfc_reg_sub_crqs (vhost);return rc; }
@@ -5757,9 +5757,6 @@ static int ibmvfc_register_scsi_channel(ENTER ; -if (ibmvfc_alloc_queue (vhost, scrq,IBMVFC_SUB_CRQ_FMT )) -return -ENOMEM ; - rc =h_reg_sub_crq (vdev->unit_address, scrq->msg_token,PAGE_SIZE , &scrq->cookie, &scrq->hw_irq);
@@ -5799,7 +5796,6 @@ irq_failed: rc =plpar_hcall_norets (H_FREE_SUB_CRQ , vdev->unit_address, scrq->cookie); }while (rtas_busy_delay (rc)); reg_failed: -ibmvfc_free_queue (vhost, scrq);LEAVE ;return rc; }
@@ -5825,12 +5821,50 @@ static void ibmvfc_deregister_scsi_channif (rc)dev_err (dev,"Failed to free sub-crq[%d]: rc=%ld\n" , index, rc); -ibmvfc_free_queue (vhost, scrq); +/* Clean out the queue */ +memset (scrq->msgs.crq,0 ,PAGE_SIZE ); + scrq->cur =0 ; + +LEAVE ; +} + +static void ibmvfc_reg_sub_crqs (struct ibmvfc_host *vhost) +{ +int i, j; + +ENTER ; +if (!vhost->mq_enabled || !vhost->scsi_scrqs.scrqs) +return ; + +for (i =0 ; i < nr_scsi_hw_queues; i++) { +if (ibmvfc_register_scsi_channel (vhost, i)) { +for (j = i; j >0 ; j--) +ibmvfc_deregister_scsi_channel (vhost, j -1 ); + vhost->do_enquiry =0 ; +return ; + } + } + +LEAVE ; +} + +static void ibmvfc_dereg_sub_crqs (struct ibmvfc_host *vhost) +{ +int i; + +ENTER ; +if (!vhost->mq_enabled || !vhost->scsi_scrqs.scrqs) +return ; + +for (i =0 ; i < nr_scsi_hw_queues; i++) +ibmvfc_deregister_scsi_channel (vhost, i); +LEAVE ; }static void ibmvfc_init_sub_crqs (struct ibmvfc_host *vhost) { +struct ibmvfc_queue *scrq;int i, j;ENTER ;
@@ -5846,30 +5880,41 @@ static void ibmvfc_init_sub_crqs(struct }for (i =0 ; i < nr_scsi_hw_queues; i++) { -if (ibmvfc_register_scsi_channel (vhost, i)) { -for (j = i; j >0 ; j--) -ibmvfc_deregister_scsi_channel (vhost, j -1 ); + scrq = &vhost->scsi_scrqs.scrqs[i]; +if (ibmvfc_alloc_queue (vhost, scrq,IBMVFC_SUB_CRQ_FMT )) { +for (j = i; j >0 ; j--) { + scrq = &vhost->scsi_scrqs.scrqs[j -1 ]; +ibmvfc_free_queue (vhost, scrq); + }kfree (vhost->scsi_scrqs.scrqs); vhost->scsi_scrqs.scrqs =NULL ; vhost->scsi_scrqs.active_queues =0 ; vhost->do_enquiry =0 ; -break ; + vhost->mq_enabled =0 ; +return ; } } +ibmvfc_reg_sub_crqs (vhost); +LEAVE ; }static void ibmvfc_release_sub_crqs (struct ibmvfc_host *vhost) { +struct ibmvfc_queue *scrq;int i;ENTER ;if (!vhost->scsi_scrqs.scrqs)return ; -for (i =0 ; i < nr_scsi_hw_queues; i++) -ibmvfc_deregister_scsi_channel (vhost, i); +ibmvfc_dereg_sub_crqs (vhost); + +for (i =0 ; i < nr_scsi_hw_queues; i++) { + scrq = &vhost->scsi_scrqs.scrqs[i]; +ibmvfc_free_queue (vhost, scrq); + }kfree (vhost->scsi_scrqs.scrqs); vhost->scsi_scrqs.scrqs =NULL ;
Greg Kroah-Hartman
maintainerPATCH 19/135 mmc: sdhci-pci-o2micro: Fix card detect by dealing with debouncing
In reply to Greg Kroah-HartmanFrom: Chevron Li <[email protected]>
commit e591fcf6b4e39335c9b128b17738fcd2fdd278ae upstream.
The result from ->get_cd() may be incorrect as the card detect debouncing isn't managed correctly. Let's fix it.
--- drivers/mmc/host/sdhci-pci-o2micro.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mmc/host/sdhci-pci-o2micro.c +2 -0
@@ -147,6 +147,8 @@ static int sdhci_o2_get_cd(struct mmc_hoif (!(sdhci_readw (host,O2_PLL_DLL_WDT_CONTROL1 ) &O2_PLL_LOCK_STATUS ))sdhci_o2_enable_internal_clock (host); +else +sdhci_o2_wait_card_detect_stable (host);return !!(sdhci_readl (host,SDHCI_PRESENT_STATE ) &SDHCI_CARD_PRESENT ); }
Greg Kroah-Hartman
maintainerPATCH 20/135 mmc: mediatek: wait dma stop bit reset to 0
In reply to Greg Kroah-HartmanFrom: Mengqi Zhang <[email protected]>
commit 89bcd9a64b849380ef57e3032b307574e48db524 upstream.
MediaTek IP requires that after dma stop, it need to wait this dma stop bit auto-reset to 0. When bus is in high loading state, it will take a while for the dma stop complete. If there is no waiting operation here, when program runs to clear fifo and reset, bus will hang.
In addition, there should be no return in msdc_data_xfer_next() if there is data need be transferred, because no matter what error occurs here, it should continue to excute to the following mmc_request_done. Otherwise the core layer may wait complete forever.
--- drivers/mmc/host/mtk-sd.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
drivers/mmc/host/mtk-sd.c +12 -8
@@ -1355,7 +1355,7 @@ static void msdc_data_xfer_next(struct mmsdc_request_done (host, mrq); } -static bool msdc_data_xfer_done (struct msdc_host *host,u32 events, +static void msdc_data_xfer_done (struct msdc_host *host,u32 events,struct mmc_request *mrq,struct mmc_data *data) {struct mmc_command *stop;
@@ -1375,7 +1375,7 @@ static bool msdc_data_xfer_done(struct mspin_unlock_irqrestore (&host->lock, flags);if (done) -return true; +return ; stop = data->stop;if (check_data || (stop && stop->error)) {
@@ -1384,12 +1384,15 @@ static bool msdc_data_xfer_done(struct msdr_set_field (host->base +MSDC_DMA_CTRL ,MSDC_DMA_CTRL_STOP ,1 ); + ret =readl_poll_timeout_atomic (host->base +MSDC_DMA_CTRL , val, + !(val &MSDC_DMA_CTRL_STOP ),1 ,20000 ); +if (ret) +dev_dbg (host->dev,"DMA stop timed out\n" ); + ret =readl_poll_timeout_atomic (host->base +MSDC_DMA_CFG , val, !(val &MSDC_DMA_CFG_STS ),1 ,20000 ); -if (ret) { -dev_dbg (host->dev,"DMA stop timed out\n" ); -return false; - } +if (ret) +dev_dbg (host->dev,"DMA inactive timed out\n" );sdr_clr_bits (host->base +MSDC_INTEN , data_ints_mask);dev_dbg (host->dev,"DMA stop\n" );
@@ -1414,9 +1417,7 @@ static bool msdc_data_xfer_done(struct m }msdc_data_xfer_next (host, mrq); - done = true; } -return done; }static void msdc_set_buswidth (struct msdc_host *host,u32 width)
@@ -2347,6 +2348,9 @@ static void msdc_cqe_disable(struct mmc_if (recovery) {sdr_set_field (host->base +MSDC_DMA_CTRL ,MSDC_DMA_CTRL_STOP ,1 ); +if (WARN_ON (readl_poll_timeout (host->base +MSDC_DMA_CTRL , val, + !(val &MSDC_DMA_CTRL_STOP ),1 ,3000 ))) +return ;if (WARN_ON (readl_poll_timeout (host->base +MSDC_DMA_CFG , val, !(val &MSDC_DMA_CFG_STS ),1 ,3000 )))return ;
Greg Kroah-Hartman
maintainerPATCH 21/135 xen/gntdev: Avoid blocking in unmap_grant_pages()
In reply to Greg Kroah-HartmanFrom: Demi Marie Obenour <[email protected]>
commit dbe97cff7dd9f0f75c524afdd55ad46be3d15295 upstream.
unmap_grant_pages() currently waits for the pages to no longer be used. In https://github.com/QubesOS/qubes-issues/issues/7481, this lead to a deadlock against i915: i915 was waiting for gntdev's MMU notifier to finish, while gntdev was waiting for i915 to free its pages. I also believe this is responsible for various deadlocks I have experienced in the past.
Avoid these problems by making unmap_grant_pages async. This requires making it return void, as any errors will not be available when the function returns. Fortunately, the only use of the return value is a WARN_ON(), which can be replaced by a WARN_ON when the error is detected. Additionally, a failed call will not prevent further calls from being made, but this is harmless.
Because unmap_grant_pages is now async, the grant handle will be sent to INVALID_GRANT_HANDLE too late to prevent multiple unmaps of the same handle. Instead, a separate bool array is allocated for this purpose. This wastes memory, but stuffing this information in padding bytes is too fragile. Furthermore, it is necessary to grab a reference to the map before making the asynchronous call, and release the reference when the call returns.
It is also necessary to guard against reentrancy in gntdev_map_put(), and to handle the case where userspace tries to map a mapping whose contents have not all been freed yet.
--- drivers/xen/gntdev-common.h | 7 + drivers/xen/gntdev.c | 157 +++++++++++++++++++++++++++++--------------- 2 files changed, 113 insertions(+), 51 deletions(-)
drivers/xen/gntdev-common.h +7 -0
@@ -16,6 +16,7 @@#include <linux/mmu_notifier.h> #include <linux/types.h> #include <xen/interface/event_channel.h> +#include <xen/grant_table.h> struct gntdev_dmabuf_priv ;
@@ -56,6 +57,7 @@ struct gntdev_grant_map {struct gnttab_unmap_grant_ref *unmap_ops;struct gnttab_map_grant_ref *kmap_ops;struct gnttab_unmap_grant_ref *kunmap_ops; +bool *being_removed;struct page **pages;unsigned long pages_vm_start;
@@ -73,6 +75,11 @@ struct gntdev_grant_map {/* Needed to avoid allocation in gnttab_dma_free_pages(). */ xen_pfn_t *frames;#endif + +/* Number of live grants */ +atomic_t live_grants; +/* Needed to avoid allocation in __unmap_grant_pages */ +struct gntab_unmap_queue_data unmap_data; }; struct gntdev_grant_map *gntdev_alloc_map(struct gntdev_priv *priv, int count,
drivers/xen/gntdev.c +106 -51
273 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 22/135 MAINTAINERS: Add new IOMMU development mailing list
In reply to Greg Kroah-HartmanFrom: Joerg Roedel <[email protected]>
commit c242507c1b895646b4a25060df13b6214805759f upstream.
The IOMMU mailing list will move from lists.linux-foundation.org to lists.linux.dev. The hard switch of the archive will happen on July 5th, but add the new list now already so that people start using the list when sending patches. After July 5th the old list will disappear.
--- MAINTAINERS | 11 +++++++++++ 1 file changed, 11 insertions(+)
MAINTAINERS +11 -0
@@ -434,6 +434,7 @@ ACPI VIOT DRIVER M: Jean-Philippe Brucker <[email protected]> L: [email protected] L: [email protected] +L: [email protected] S: Maintained F: drivers/acpi/viot.c F: include/linux/acpi_viot.h
@@ -941,6 +942,7 @@ AMD IOMMU (AMD-VI) M: Joerg Roedel <[email protected]> R: Suravee Suthikulpanit <[email protected]> L: [email protected] +L: [email protected] S: Maintained T: git git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu.git F: drivers/iommu/amd/
@@ -5602,6 +5604,7 @@ M: Christoph Hellwig <[email protected]> M: Marek Szyprowski <[email protected]> R: Robin Murphy <[email protected]> L: [email protected] +L: [email protected] S: Supported W: http://git.infradead.org/users/hch/dma-mapping.git T: git git://git.infradead.org/users/hch/dma-mapping.git
@@ -5614,6 +5617,7 @@ F: kernel/dma/ DMA MAPPING BENCHMARK M: Barry Song <[email protected]> L: [email protected] +L: [email protected] F: kernel/dma/map_benchmark.c F: tools/testing/selftests/dma/
@@ -7115,6 +7119,7 @@ F: drivers/gpu/drm/exynos/exynos_dp* EXYNOS SYSMMU (IOMMU) driver M: Marek Szyprowski <[email protected]> L: [email protected] +L: [email protected] S: Maintained F: drivers/iommu/exynos-iommu.c
@@ -9457,6 +9462,7 @@ INTEL IOMMU (VT-d) M: David Woodhouse <[email protected]> M: Lu Baolu <[email protected]> L: [email protected] +L: [email protected] S: Supported T: git git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu.git F: drivers/iommu/intel/
@@ -9793,6 +9799,7 @@ IOMMU DRIVERS M: Joerg Roedel <[email protected]> M: Will Deacon <[email protected]> L: [email protected] +L: [email protected] S: Maintained T: git git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu.git F: Documentation/devicetree/bindings/iommu/
@@ -11795,6 +11802,7 @@ F: drivers/i2c/busses/i2c-mt65xx.c MEDIATEK IOMMU DRIVER M: Yong Wu <[email protected]> L: [email protected] +L: [email protected] L: [email protected] (moderated for non-subscribers) S: Supported F: Documentation/devicetree/bindings/iommu/mediatek*
@@ -15554,6 +15562,7 @@ F: drivers/i2c/busses/i2c-qcom-cci.c QUALCOMM IOMMU M: Rob Clark <[email protected]> L: [email protected] +L: [email protected] L: [email protected] S: Maintained F: drivers/iommu/arm/arm-smmu/qcom_iommu.c
@@ -17982,6 +17991,7 @@ F: arch/x86/boot/video* SWIOTLB SUBSYSTEM M: Christoph Hellwig <[email protected]> L: [email protected] +L: [email protected] S: Supported W: http://git.infradead.org/users/hch/dma-mapping.git T: git git://git.infradead.org/users/hch/dma-mapping.git
@@ -20562,6 +20572,7 @@ M: Juergen Gross <[email protected]> M: Stefano Stabellini <[email protected]> L: [email protected] (moderated for non-subscribers) L: [email protected] +L: [email protected] S: Supported F: arch/x86/xen/*swiotlb* F: drivers/xen/*swiotlb*
Greg Kroah-Hartman
maintainerPATCH 23/135 mtd: rawnand: gpmi: Fix setting busy timeout setting
In reply to Greg Kroah-HartmanFrom: Sascha Hauer <[email protected]>
commit 06781a5026350cde699d2d10c9914a25c1524f45 upstream.
The DEVICE_BUSY_TIMEOUT value is described in the Reference Manual as:
| Timeout waiting for NAND Ready/Busy or ATA IRQ. Used in WAIT_FOR_READY | mode. This value is the number of GPMI_CLK cycles multiplied by 4096.
So instead of multiplying the value in cycles with 4096, we have to divide it by that value. Use DIV_ROUND_UP to make sure we are on the safe side, especially when the calculated value in cycles is smaller than 4096 as typically the case.
This bug likely never triggered because any timeout != 0 usually will do. In my case the busy timeout in cycles was originally calculated as 2408, which multiplied with 4096 is 0x968000. The lower 16 bits were taken for the 16 bit wide register field, so the register value was 0x8000. With 2970bf5a32f0 ("mtd: rawnand: gpmi: fix controller timings setting") however the value in cycles became 2384, which multiplied with 4096 is 0x950000. The lower 16 bit are 0x0 now resulting in an intermediate timeout when reading from NAND.
--- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +1 -1
@@ -685,7 +685,7 @@ static void gpmi_nfc_compute_timings(str hw->timing0 =BF_GPMI_TIMING0_ADDRESS_SETUP (addr_setup_cycles) |BF_GPMI_TIMING0_DATA_HOLD (data_hold_cycles) |BF_GPMI_TIMING0_DATA_SETUP (data_setup_cycles); - hw->timing1 =BF_GPMI_TIMING1_BUSY_TIMEOUT (busy_timeout_cycles *4096 ); + hw->timing1 =BF_GPMI_TIMING1_BUSY_TIMEOUT (DIV_ROUND_UP (busy_timeout_cycles,4096 ));/* * Derive NFC ideal delay from {3}:
Greg Kroah-Hartman
maintainerPATCH 24/135 ata: libata: add qc->flags in ata_qc_complete_template tracepoint
In reply to Greg Kroah-HartmanFrom: Edward Wu <[email protected]>
commit 540a92bfe6dab7310b9df2e488ba247d784d0163 upstream.
Add flags value to check the result of ata completion
--- include/trace/events/libata.h | 1 + 1 file changed, 1 insertion(+)
include/trace/events/libata.h +1 -0
@@ -249,6 +249,7 @@ DECLARE_EVENT_CLASS(ata_qc_complete_temp __entry->hob_feature = qc->result_tf.hob_feature; __entry->nsect = qc->result_tf.nsect; __entry->hob_nsect = qc->result_tf.hob_nsect; + __entry->flags = qc->flags; ), TP_printk("ata_port=%u ata_dev=%u tag=%d flags=%s status=%s " \
Greg Kroah-Hartman
maintainerPATCH 25/135 dm era: commit metadata in postsuspend after worker stops
In reply to Greg Kroah-HartmanFrom: Nikos Tsironis <[email protected]>
commit 9ae6e8b1c9bbf6874163d1243e393137313762b7 upstream.
During postsuspend dm-era does the following:
1. Archives the current era
2. Commits the metadata, as part of the RPC call for archiving the current era
3. Stops the worker
Until the worker stops, it might write to the metadata again. Moreover, these writes are not flushed to disk immediately, but are cached by the dm-bufio client, which writes them back asynchronously.
As a result, the committed metadata of a suspended dm-era device might not be consistent with the in-core metadata.
In some cases, this can result in the corruption of the on-disk metadata. Suppose the following sequence of events:
1. Load a new table, e.g. a snapshot-origin table, to a device with a dm-era table
2. Suspend the device
3. dm-era commits its metadata, but the worker does a few more metadata writes until it stops, as part of digesting an archived writeset
4. These writes are cached by the dm-bufio client
5. Load the dm-era table to another device.
6. The new instance of the dm-era target loads the committed, on-disk metadata, which don't include the extra writes done by the worker after the metadata commit.
7. Resume the new device
8. The new dm-era target instance starts using the metadata
9. Resume the original device
10. The destructor of the old dm-era target instance is called and destroys the dm-bufio client, which results in flushing the cached writes to disk
11. These writes might overwrite the writes done by the new dm-era instance, hence corrupting its metadata.
Fix this by committing the metadata after the worker stops running.
stop_worker uses flush_workqueue to flush the current work. However, the work item may re-queue itself and flush_workqueue doesn't wait for re-queued works to finish.
This could result in the worker changing the metadata after they have been committed, or writing to the metadata concurrently with the commit in the postsuspend thread.
Use drain_workqueue instead, which waits until the work and all re-queued works finish.
--- drivers/md/dm-era-target.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/md/dm-era-target.c +7 -1
@@ -1400,7 +1400,7 @@ static void start_worker(struct era *erastatic void stop_worker (struct era *era) {atomic_set (&era->suspended,1 ); -flush_workqueue (era->wq); +drain_workqueue (era->wq); }/*----------------------------------------------------------------
@@ -1570,6 +1570,12 @@ static void era_postsuspend(struct dm_ta }stop_worker (era); + + r =metadata_commit (era->md); +if (r) { +DMERR ("%s: metadata_commit failed" , __func__); +/* FIXME: fail mode */ + } }static int era_preresume (struct dm_target *ti)
Greg Kroah-Hartman
maintainerPATCH 26/135 dm mirror log: clear log bits up to BITS_PER_LONG boundary
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 90736eb3232d208ee048493f371075e4272e0944 upstream.
Commit 85e123c27d5c ("dm mirror log: round up region bitmap size to BITS_PER_LONG") introduced a regression on 64-bit architectures in the lvm testsuite tests: lvcreate-mirror, mirror-names and vgsplit-operation.
If the device is shrunk, we need to clear log bits beyond the end of the device. The code clears bits up to a 32-bit boundary and then calculates lc->sync_count by summing set bits up to a 64-bit boundary (the commit changed that; previously, this boundary was 32-bit too). So, it was using some non-zeroed bits in the calculation and this caused misbehavior.
Fix this regression by clearing bits up to BITS_PER_LONG boundary.
--- drivers/md/dm-log.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-log.c +1 -1
@@ -615,7 +615,7 @@ static int disk_resume(struct dm_dirty_llog_clear_bit (lc, lc->clean_bits, i);/* clear any old bits -- device has shrunk */ -for (i = lc->region_count; i % (sizeof (*lc->clean_bits) <<BYTE_SHIFT ); i++) +for (i = lc->region_count; i %BITS_PER_LONG ; i++)log_clear_bit (lc, lc->clean_bits, i);/* copy clean across to sync */
Greg Kroah-Hartman
maintainerPATCH 27/135 tracing/kprobes: Check whether get_kretprobe() returns NULL in kretprobe_dispatcher()
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu (Google) <[email protected]>
commit cc72b72073ac982a954d3b43519ca1c28f03c27c upstream.
There is a small chance that get_kretprobe(ri) returns NULL in kretprobe_dispatcher() when another CPU unregisters the kretprobe right after __kretprobe_trampoline_handler().
To avoid this issue, kretprobe_dispatcher() checks the get_kretprobe() return value again. And if it is NULL, it returns soon because that kretprobe is under unregistering process.
This issue has been introduced when the kretprobe is decoupled from the struct kretprobe_instance by commit d741bf41d7c7 ("kprobes: Remove kretprobe hash"). Before that commit, the struct kretprob_instance::rp directly points the kretprobe and it is never be NULL.
--- kernel/trace/trace_kprobe.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
kernel/trace/trace_kprobe.c +10 -1
@@ -1733,8 +1733,17 @@ static int kretprobe_dispatcher(struct kretprobe_instance *ri, struct pt_regs *regs) { struct kretprobe *rp = get_kretprobe(ri); - struct trace_kprobe *tk = container_of(rp, struct trace_kprobe, rp); +struct trace_kprobe *tk; +/* +* There is a small chance that get_kretprobe(ri) returns NULL when +* the kretprobe is unregister on another CPU between kretprobe's +* trampoline_handler and this function. +*/ +if (unlikely (!rp)) +return 0 ; + + tk = container_of(rp, struct trace_kprobe, rp);raw_cpu_inc (*tk->nhit);if (trace_probe_test_flag (&tk->tp,TP_FLAG_TRACE ))
Greg Kroah-Hartman
maintainerPATCH 28/135 drm/i915: Implement w/a 22010492432 for adl-s
In reply to Greg Kroah-HartmanFrom: Ville Syrjälä <[email protected]>
commit 13bd259b64bb58ae130923ada42ebc19bf3f2fa2 upstream.
adl-s needs the combo PLL DCO fraction w/a as well. Gets us slightly more accurate clock out of the PLL.
--- drivers/gpu/drm/i915/display/intel_dpll_mgr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/display/intel_dpll_mgr.c +2 -2
@@ -2434,7 +2434,7 @@ static void icl_wrpll_params_populate(st }/* -* Display WA #22010492432: ehl, tgl, adl-p +* Display WA #22010492432: ehl, tgl, adl-s, adl-p * Program half of the nominal DCO divider fraction value. */ static bool
@@ -2442,7 +2442,7 @@ ehl_combo_pll_div_frac_wa_needed(struct {return ((IS_PLATFORM (i915,INTEL_ELKHARTLAKE ) &&IS_JSL_EHL_DISPLAY_STEP (i915,STEP_B0 ,STEP_FOREVER )) || -IS_TIGERLAKE (i915) ||IS_ALDERLAKE_P (i915)) && +IS_TIGERLAKE (i915) ||IS_ALDERLAKE_S (i915) ||IS_ALDERLAKE_P (i915)) && i915->dpll.ref_clks.nssc ==38400 ; }
Greg Kroah-Hartman
maintainerPATCH 29/135 USB: serial: pl2303: add support for more HXN (G) types
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit ae60aac59a9ad8ab64a4b07de509a534a75b6bac upstream.
Add support for further HXN (G) type devices (GT variant, GL variant, GS variant and GR) and document the bcdDevice mapping.
Note that the TA and TB types use the same bcdDevice as some GT and GE variants, respectively, but that the HX status request can be used to determine which is which.
Also note that we currently do not distinguish between the various HXN
(G) types in the driver but that this may change eventually (e.g. when adding GPIO support).
--- drivers/usb/serial/pl2303.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-)
drivers/usb/serial/pl2303.c +17 -12
@@ -436,22 +436,27 @@ static int pl2303_detect_type(struct usbbreak ;case 0x200 :switch (bcdDevice) { -case 0x100 : +case 0x100 :/* GC */ case 0x105 : +return TYPE_HXN ; +case 0x300 :/* GT / TA */ +if (pl2303_supports_hx_status (serial)) +return TYPE_TA ; + fallthrough;case 0x305 : +case 0x400 :/* GL */ case 0x405 : +return TYPE_HXN ; +case 0x500 :/* GE / TB */ +if (pl2303_supports_hx_status (serial)) +return TYPE_TB ; + fallthrough; +case 0x505 : +case 0x600 :/* GS */ case 0x605 : -/* -* Assume it's an HXN-type if the device doesn't -* support the old read request value. -*/ -if (!pl2303_supports_hx_status (serial)) -return TYPE_HXN ; -break ; -case 0x300 : -return TYPE_TA ; -case 0x500 : -return TYPE_TB ; +case 0x700 :/* GR */ +case 0x705 : +return TYPE_HXN ; }break ; }
Greg Kroah-Hartman
maintainerPATCH 30/135 USB: serial: option: add Telit LE910Cx 0x1250 composition
In reply to Greg Kroah-HartmanFrom: Carlo Lobrano <[email protected]>
commit 342fc0c3b345525da21112bd0478a0dc741598ea upstream.
Add support for the following Telit LE910Cx composition:
0x1250: rmnet, tty, tty, tty, tty
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -1279,6 +1279,7 @@ static const struct usb_device_id option .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */ .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x1250, 0xff, 0x00, 0x00) }, /* Telit LE910Cx (rmnet) */ { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
Greg Kroah-Hartman
maintainerPATCH 31/135 USB: serial: option: add Quectel EM05-G modem
In reply to Greg Kroah-HartmanFrom: Yonglin Tan <[email protected]>
commit 33b29dbb39bcbd0a96e440646396bbf670b914fa upstream.
The EM05-G modem has 2 USB configurations that are configurable via the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with the following interfaces, respectively:
"RMNET" : AT + DIAG + NMEA + Modem + QMI
"MBIM" : MBIM + AT + DIAG + NMEA + Modem
The detailed description of the USB configuration for each mode as follows:
RMNET Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=030a Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
MBIM Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=030a Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -252,6 +252,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EG95 0x0195#define QUECTEL_PRODUCT_BG96 0x0296#define QUECTEL_PRODUCT_EP06 0x0306 +#define QUECTEL_PRODUCT_EM05G 0x030a#define QUECTEL_PRODUCT_EM12 0x0512#define QUECTEL_PRODUCT_RM500Q 0x0800#define QUECTEL_PRODUCT_EC200S_CN 0x6002
@@ -1134,6 +1135,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff), .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff), + .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff), .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
Greg Kroah-Hartman
maintainerPATCH 32/135 USB: serial: option: add Quectel RM500K module support
In reply to Greg Kroah-HartmanFrom: Macpaul Lin <[email protected]>
commit 15b694e96c31807d8515aacfa687a1e8a4fbbadc upstream.
Add usb product id of the Quectel RM500K module.
RM500K provides 2 mandatory interfaces to Linux host after enumeration.
- /dev/ttyUSB5: this is a serial interface for control path. User needs to write AT commands to this device node to query status, set APN, set PIN code, and enable/disable the data connection to 5G network.
- ethX: this is the data path provided as a RNDIS devices. After the data connection has been established, Linux host can access 5G data network via this interface.
"RNDIS": RNDIS + ADB + AT (/dev/ttyUSB5) + MODEM COMs
usb-devices output for 0x7001:
T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=7001 Rev=00.01 S: Manufacturer=MediaTek Inc. S: Product=USB DATA CARD S: SerialNumber=869206050009672 C: #Ifs=10 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=02 Prot=ff Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -257,6 +257,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_RM500Q 0x0800#define QUECTEL_PRODUCT_EC200S_CN 0x6002#define QUECTEL_PRODUCT_EC200T 0x6026 +#define QUECTEL_PRODUCT_RM500K 0x7001#define CMOTECH_VENDOR_ID 0x16d8#define CMOTECH_PRODUCT_6001 0x6001
@@ -1150,6 +1151,7 @@ static const struct usb_device_id option .driver_info = ZLP }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
Greg Kroah-Hartman
maintainerPATCH 33/135 drm/msm: Ensure mmap offset is initialized
In reply to Greg Kroah-HartmanFrom: Rob Clark <[email protected]>
[ Upstream commit 036d20726c30267724416e966c9f92db07de8081 ]
If a GEM object is allocated, and then exported as a dma-buf fd which is mmap'd before or without the GEM buffer being directly mmap'd, the vma_node could be unitialized. This leads to a situation where the CPU mapping is not correctly torn down in drm_vma_node_unmap().
--- drivers/gpu/drm/msm/msm_drv.c | 2 +- drivers/gpu/drm/msm/msm_drv.h | 1 + drivers/gpu/drm/msm/msm_gem_prime.c | 15 +++++++++++++++ 3 files changed, 17 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_drv.c +1 -1
@@ -1102,7 +1102,7 @@ static const struct drm_driver msm_driver = { .prime_handle_to_fd = drm_gem_prime_handle_to_fd, .prime_fd_to_handle = drm_gem_prime_fd_to_handle, .gem_prime_import_sg_table = msm_gem_prime_import_sg_table, - .gem_prime_mmap = drm_gem_prime_mmap, + .gem_prime_mmap = msm_gem_prime_mmap,#ifdef CONFIG_DEBUG_FS .debugfs_init = msm_debugfs_init,#endif
drivers/gpu/drm/msm/msm_drv.h +1 -0
@@ -298,6 +298,7 @@ unsigned long msm_gem_shrinker_shrink(struct drm_device *dev, unsigned long nr_tvoid msm_gem_shrinker_init (struct drm_device *dev);void msm_gem_shrinker_cleanup (struct drm_device *dev); +int msm_gem_prime_mmap (struct drm_gem_object *obj,struct vm_area_struct *vma);struct sg_table *msm_gem_prime_get_sg_table (struct drm_gem_object *obj);int msm_gem_prime_vmap (struct drm_gem_object *obj,struct dma_buf_map *map);void msm_gem_prime_vunmap (struct drm_gem_object *obj,struct dma_buf_map *map);
drivers/gpu/drm/msm/msm_gem_prime.c +15 -0
@@ -11,6 +11,21 @@#include "msm_drv.h" #include "msm_gem.h" +int msm_gem_prime_mmap (struct drm_gem_object *obj,struct vm_area_struct *vma) +{ +int ret; + +/* Ensure the mmap offset is initialized. We lazily initialize it, +* so if it has not been first mmap'd directly as a GEM object, the +* mmap offset will not be already initialized. +*/ + ret =drm_gem_create_mmap_offset (obj); +if (ret) +return ret; + +return drm_gem_prime_mmap (obj, vma); +} +struct sg_table *msm_gem_prime_get_sg_table (struct drm_gem_object *obj) {struct msm_gem_object *msm_obj =to_msm_bo (obj);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 34/135 drm/msm: Fix double pm_runtime_disable() call
In reply to Greg Kroah-HartmanFrom: Maximilian Luz <[email protected]>
[ Upstream commit ce0db505bc0c51ef5e9ba446c660de7e26f78f29 ]
Following commit 17e822f7591f ("drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init, cleanup}"), any call to adreno_unbind() will disable runtime PM twice, as indicated by the call trees below:
adreno_unbind()
-> pm_runtime_force_suspend()
-> pm_runtime_disable()
adreno_unbind()
-> gpu->funcs->destroy() [= aNxx_destroy()]
-> adreno_gpu_cleanup()
-> pm_runtime_disable()
Note that pm_runtime_force_suspend() is called right before gpu->funcs->destroy() and both functions are called unconditionally.
With recent addition of the eDP AUX bus code, this problem manifests itself when the eDP panel cannot be found yet and probing is deferred. On the first probe attempt, we disable runtime PM twice as described above. This then causes any later probe attempt to fail with
[drm:adreno_load_gpu [msm]] *ERROR* Couldn't power up the GPU: -13
preventing the driver from loading.
As there seem to be scenarios where the aNxx_destroy() functions are not called from adreno_unbind(), simply removing pm_runtime_disable() from inside adreno_unbind() does not seem to be the proper fix. This is what commit 17e822f7591f ("drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init, cleanup}") intended to fix. Therefore, instead check whether runtime PM is still enabled, and only disable it in that case.
--- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/adreno_gpu.c +2 -1
@@ -958,7 +958,8 @@ void adreno_gpu_cleanup(struct adreno_gpu *adreno_gpu)for (i =0 ; i <ARRAY_SIZE (adreno_gpu->info->fw); i++)release_firmware (adreno_gpu->fw[i]); -pm_runtime_disable (&priv->gpu_pdev->dev); +if (pm_runtime_enabled (&priv->gpu_pdev->dev)) +pm_runtime_disable (&priv->gpu_pdev->dev);msm_gpu_cleanup (&adreno_gpu->base); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 35/135 netfilter: use get_random_u32 instead of prandom
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit b1fd94e704571f98b21027340eecf821b2bdffba ]
bh might occur while updating per-cpu rnd_state from user context, ie. local_out path.
BUG: using smp_processor_id() in preemptible [00000000] code: nginx/2725 caller is nft_ng_random_eval+0x24/0x54 [nft_numgen] Call Trace: check_preemption_disabled+0xde/0xe0 nft_ng_random_eval+0x24/0x54 [nft_numgen]
Use the random driver instead, this also avoids need for local prandom state. Moreover, prandom now uses the random driver since d4150779e60f ("random32: use real rng for non-deterministic randomness").
Based on earlier patch from Pablo Neira.
--- net/netfilter/nft_meta.c | 13 ++----------- net/netfilter/nft_numgen.c | 12 +++--------- 2 files changed, 5 insertions(+), 20 deletions(-)
net/netfilter/nft_meta.c +2 -11
@@ -14,6 +14,7 @@#include <linux/in.h> #include <linux/ip.h> #include <linux/ipv6.h> +#include <linux/random.h> #include <linux/smp.h> #include <linux/static_key.h> #include <net/dst.h>
@@ -32,8 +33,6 @@#define NFT_META_SECS_PER_DAY 86400#define NFT_META_DAYS_PER_WEEK 7 -static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state); -static u8 nft_meta_weekday (void ) {time64_t secs =ktime_get_real_seconds ();
@@ -267,13 +266,6 @@ static bool nft_meta_get_eval_ifname(enum nft_meta_keys key, u32 *dest,return true; } -static noinline u32 nft_prandom_u32(void) -{ -struct rnd_state *state =this_cpu_ptr (&nft_prandom_state); - -return prandom_u32_state (state); -} -#ifdef CONFIG_IP_ROUTE_CLASSID static noinline boolnft_meta_get_eval_rtclassid (const struct sk_buff *skb,u32 *dest)
@@ -385,7 +377,7 @@ void nft_meta_get_eval(const struct nft_expr *expr,break ;#endif case NFT_META_PRANDOM : - *dest =nft_prandom_u32 (); + *dest =get_random_u32 ();break ;#ifdef CONFIG_XFRM case NFT_META_SECPATH :
@@ -514,7 +506,6 @@ int nft_meta_get_init(const struct nft_ctx *ctx, len =IFNAMSIZ ;break ;case NFT_META_PRANDOM : -prandom_init_once (&nft_prandom_state); len =sizeof (u32);break ;#ifdef CONFIG_XFRM
net/netfilter/nft_numgen.c +3 -9
@@ -9,12 +9,11 @@#include <linux/netlink.h> #include <linux/netfilter.h> #include <linux/netfilter/nf_tables.h> +#include <linux/random.h> #include <linux/static_key.h> #include <net/netfilter/nf_tables.h> #include <net/netfilter/nf_tables_core.h> -static DEFINE_PER_CPU(struct rnd_state, nft_numgen_prandom_state); -struct nft_ng_inc {u8 dreg;u32 modulus;
@@ -104,12 +103,9 @@ struct nft_ng_random {u32 offset; }; -static u32 nft_ng_random_gen (struct nft_ng_random *priv) +static u32 nft_ng_random_gen (const struct nft_ng_random *priv) { -struct rnd_state *state =this_cpu_ptr (&nft_numgen_prandom_state); - -return reciprocal_scale (prandom_u32_state (state), priv->modulus) + - priv->offset; +return reciprocal_scale (get_random_u32 (), priv->modulus) + priv->offset; } static void nft_ng_random_eval(const struct nft_expr *expr,
@@ -137,8 +133,6 @@ static int nft_ng_random_init(const struct nft_ctx *ctx,if (priv->offset + priv->modulus -1 < priv->offset)return -EOVERFLOW ; -prandom_init_once (&nft_numgen_prandom_state); -return nft_parse_register_store (ctx, tb[NFTA_NG_DREG ], &priv->dreg,NULL ,NFT_DATA_VALUE ,sizeof (u32)); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 36/135 scsi: scsi_debug: Fix zone transition to full condition
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit 566d3c57eb526f32951af15866086e236ce1fc8a ]
When a write command to a sequential write required or sequential write preferred zone result in the zone write pointer reaching the end of the zone, the zone condition must be set to full AND the number of implicitly or explicitly open zones updated to have a correct accounting for zone resources. However, the function zbc_inc_wp() only sets the zone condition to full without updating the open zone counters, resulting in a zone state machine breakage.
Introduce the helper function zbc_set_zone_full() and use it in zbc_inc_wp() to correctly transition zones to the full condition.
--- drivers/scsi/scsi_debug.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
drivers/scsi/scsi_debug.c +20 -2
@@ -2747,6 +2747,24 @@ static void zbc_open_zone(struct sdebug_dev_info *devip, } } +static inline void zbc_set_zone_full (struct sdebug_dev_info *devip, +struct sdeb_zone_state *zsp) +{ +switch (zsp->z_cond) { +case ZC2_IMPLICIT_OPEN : + devip->nr_imp_open--; +break ; +case ZC3_EXPLICIT_OPEN : + devip->nr_exp_open--; +break ; +default : +WARN_ONCE (true,"Invalid zone %llu condition %x\n" , + zsp->z_start, zsp->z_cond); +break ; + } + zsp->z_cond =ZC5_FULL ; +} +static void zbc_inc_wp (struct sdebug_dev_info *devip,unsigned long long lba,unsigned int num) {
@@ -2759,7 +2777,7 @@ static void zbc_inc_wp(struct sdebug_dev_info *devip,if (zsp->z_type ==ZBC_ZONE_TYPE_SWR ) { zsp->z_wp += num;if (zsp->z_wp >= zend) - zsp->z_cond =ZC5_FULL ; +zbc_set_zone_full (devip, zsp);return ; }
@@ -2778,7 +2796,7 @@ static void zbc_inc_wp(struct sdebug_dev_info *devip, n = num; }if (zsp->z_wp >= zend) - zsp->z_cond =ZC5_FULL ; +zbc_set_zone_full (devip, zsp); num -= n; lba += n;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 37/135 drm/msm: Switch ordering of runpm put vs devfreq_idle
In reply to Greg Kroah-HartmanFrom: Rob Clark <[email protected]>
[ Upstream commit 49e477610087a02c3604061b8f3ee3a25a493987 ]
In msm_devfreq_suspend() we cancel idle_work synchronously so that it doesn't run after we power of the hw or in the resume path. But this means that we want to ensure that idle_work is not scheduled *after* we no longer hold a runpm ref. So switch the ordering of pm_runtime_put() vs msm_devfreq_idle().
v2. Only move the runpm _put_autosuspend, and not the _mark_last_busy()
--- drivers/gpu/drm/msm/msm_gpu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_gpu.c +2 -1
@@ -658,7 +658,6 @@ static void retire_submit(struct msm_gpu *gpu, struct msm_ringbuffer *ring,msm_submit_retire (submit);pm_runtime_mark_last_busy (&gpu->pdev->dev); -pm_runtime_put_autosuspend (&gpu->pdev->dev);spin_lock_irqsave (&ring->submit_lock, flags);list_del (&submit->node);
@@ -672,6 +671,8 @@ static void retire_submit(struct msm_gpu *gpu, struct msm_ringbuffer *ring,msm_devfreq_idle (gpu);mutex_unlock (&gpu->active_lock); +pm_runtime_put_autosuspend (&gpu->pdev->dev); +msm_gem_submit_put (submit); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 38/135 scsi: iscsi: Exclude zero from the endpoint ID range
In reply to Greg Kroah-HartmanFrom: Sergey Gorenko <[email protected]>
[ Upstream commit f6eed15f3ea76596ccc689331e1cc850b999133b ]
The kernel returns an endpoint ID as r.ep_connect_ret.handle in the iscsi_uevent. The iscsid validates a received endpoint ID and treats zero as an error. The commit referenced in the fixes line changed the endpoint ID range, and zero is always assigned to the first endpoint ID. So, the first attempt to create a new iSER connection always fails.
--- drivers/scsi/scsi_transport_iscsi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/scsi/scsi_transport_iscsi.c +6 -1
@@ -213,7 +213,12 @@ iscsi_create_endpoint(int dd_size)return NULL ;mutex_lock (&iscsi_ep_idr_mutex); - id =idr_alloc (&iscsi_ep_idr, ep,0 ,-1 ,GFP_NOIO ); + +/* +* First endpoint id should be 1 to comply with user space +* applications (iscsid). +*/ + id =idr_alloc (&iscsi_ep_idr, ep,1 ,-1 ,GFP_NOIO );if (id <0 ) {mutex_unlock (&iscsi_ep_idr_mutex); printk(KERN_ERR "Could not allocate endpoint ID. Error %d.\n",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 39/135 xsk: Fix generic transmit when completion queue reservation fails
In reply to Greg Kroah-HartmanFrom: Ciara Loftus <[email protected]>
[ Upstream commit a6e944f25cdbe6b82275402b8bc9a55ad7aac10b ]
Two points of potential failure in the generic transmit function are:
1. completion queue (cq) reservation failure.
2. skb allocation failure
Originally the cq reservation was performed first, followed by the skb allocation. Commit 675716400da6 ("xdp: fix possible cq entry leak") reversed the order because at the time there was no mechanism available to undo the cq reservation which could have led to possible cq entry leaks in the event of skb allocation failure. However if the skb allocation is performed first and the cq reservation then fails, the xsk skb destructor is called which blindly adds the skb address to the already full cq leading to undefined behavior.
This commit restores the original order (cq reservation followed by skb allocation) and uses the xskq_prod_cancel helper to undo the cq reserve in event of skb allocation failure.
--- net/xdp/xsk.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
net/xdp/xsk.c +9 -7
@@ -553,12 +553,6 @@ static int xsk_generic_xmit(struct sock *sk) goto out; } - skb =xsk_build_skb (xs, &desc); -if (IS_ERR (skb)) { - err =PTR_ERR (skb); - goto out; - } -/* This is the backpressure mechanism for the Tx path. * Reserve space in the completion queue and only proceed * if there is space in it. This avoids having to implement
@@ -567,11 +561,19 @@ static int xsk_generic_xmit(struct sock *sk)spin_lock_irqsave (&xs->pool->cq_lock, flags);if (xskq_prod_reserve (xs->pool->cq)) {spin_unlock_irqrestore (&xs->pool->cq_lock, flags); -kfree_skb (skb); goto out; }spin_unlock_irqrestore (&xs->pool->cq_lock, flags); + skb =xsk_build_skb (xs, &desc); +if (IS_ERR (skb)) { + err =PTR_ERR (skb); +spin_lock_irqsave (&xs->pool->cq_lock, flags); +xskq_prod_cancel (xs->pool->cq); +spin_unlock_irqrestore (&xs->pool->cq_lock, flags); + goto out; + } + err =__dev_direct_xmit (skb, xs->queue_id);if (err ==NETDEV_TX_BUSY ) {/* Tell user-space to retry the send */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 40/135 drm/msm: use for_each_sgtable_sg to iterate over scatterlist
In reply to Greg Kroah-HartmanFrom: Jonathan Marek <[email protected]>
[ Upstream commit 62b5e322fb6cc5a5a91fdeba0e4e57e75d9f4387 ]
The dma_map_sgtable() call (used to invalidate cache) overwrites sgt->nents with 1, so msm_iommu_pagetable_map maps only the first physical segment.
To fix this problem use for_each_sgtable_sg(), which uses orig_nents.
--- drivers/gpu/drm/msm/msm_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_iommu.c +1 -1
@@ -58,7 +58,7 @@ static int msm_iommu_pagetable_map(struct msm_mmu *mmu, u64 iova,u64 addr = iova;unsigned int i; -for_each_sg (sgt->sgl, sg, sgt->nents, i) { +for_each_sgtable_sg (sgt, sg, i) {size_t size = sg->length;phys_addr_t phys =sg_phys (sg);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 41/135 bpf: Fix request_sock leak in sk lookup helpers
In reply to Greg Kroah-HartmanFrom: Jon Maxwell <[email protected]>
[ Upstream commit 3046a827316c0e55fc563b4fb78c93b9ca5c7c37 ]
A customer reported a request_socket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was finding the request_socket but returning the parent LISTEN socket via sk_to_full_sk() without decrementing the child request socket 1st, resulting in request_sock slab object leak. This patch retains the existing behaviour of returning full socks to the caller but it also decrements the child request_socket if one is present before doing so to prevent the leak.
Thanks to Curtis Taylor for all the help in diagnosing and testing this. And thanks to Antoine Tenart for the reproducer and patch input.
v2 of this patch contains, refactor as per Daniel Borkmann's suggestions to validate RCU flags on the listen socket so that it balances with bpf_sk_release() and update comments as per Martin KaFai Lau's suggestion. One small change to Daniels suggestion, put "sk = sk2" under "if (sk2 != sk)" to avoid an extra instruction.
--- net/core/filter.c | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-)
net/core/filter.c +28 -6
@@ -6209,10 +6209,21 @@ __bpf_sk_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, ifindex, proto, netns_id, flags);if (sk) { - sk =sk_to_full_sk (sk); -if (!sk_fullsock (sk)) { +struct sock *sk2 =sk_to_full_sk (sk); + +/* sk_to_full_sk() may return (sk)->rsk_listener, so make sure the original sk +* sock refcnt is decremented to prevent a request_sock leak. +*/ +if (!sk_fullsock (sk2)) + sk2 =NULL ; +if (sk2 != sk) {sock_gen_put (sk); -return NULL ; +/* Ensure there is no need to bump sk2 refcnt */ +if (unlikely (sk2 && !sock_flag (sk2,SOCK_RCU_FREE ))) { +WARN_ONCE (1 ,"Found non-RCU, unreferenced socket!" ); +return NULL ; + } + sk = sk2; } }
@@ -6246,10 +6257,21 @@ bpf_sk_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, flags);if (sk) { - sk =sk_to_full_sk (sk); -if (!sk_fullsock (sk)) { +struct sock *sk2 =sk_to_full_sk (sk); + +/* sk_to_full_sk() may return (sk)->rsk_listener, so make sure the original sk +* sock refcnt is decremented to prevent a request_sock leak. +*/ +if (!sk_fullsock (sk2)) + sk2 =NULL ; +if (sk2 != sk) {sock_gen_put (sk); -return NULL ; +/* Ensure there is no need to bump sk2 refcnt */ +if (unlikely (sk2 && !sock_flag (sk2,SOCK_RCU_FREE ))) { +WARN_ONCE (1 ,"Found non-RCU, unreferenced socket!" ); +return NULL ; + } + sk = sk2; } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 42/135 drm/sun4i: Fix crash during suspend after component bind failure
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
[ Upstream commit 1342b5b23da9559a1578978eaff7f797d8a87d91 ]
If the component driver fails to bind, or is unbound, the driver data for the top-level platform device points to a freed drm_device. If the system is then suspended, the driver passes this dangling pointer to drm_mode_config_helper_suspend(), which crashes.
Fix this by only setting the driver data while the platform driver holds a reference to the drm_device.
--- drivers/gpu/drm/sun4i/sun4i_drv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/sun4i/sun4i_drv.c +3 -1
@@ -72,7 +72,6 @@ static int sun4i_drv_bind(struct device *dev) goto free_drm; } -dev_set_drvdata (dev, drm); drm->dev_private = drv;INIT_LIST_HEAD (&drv->frontend_list);INIT_LIST_HEAD (&drv->engine_list);
@@ -113,6 +112,8 @@ static int sun4i_drv_bind(struct device *dev)drm_fbdev_generic_setup (drm,32 ); +dev_set_drvdata (dev, drm); +return 0 ; finish_poll:
@@ -129,6 +130,7 @@ static void sun4i_drv_unbind(struct device *dev) {struct drm_device *drm =dev_get_drvdata (dev); +dev_set_drvdata (dev,NULL );drm_dev_unregister (drm);drm_kms_helper_poll_fini (drm);drm_atomic_helper_shutdown (drm);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 43/135 bpf, x86: Fix tail call count offset calculation on bpf2bpf call
In reply to Greg Kroah-HartmanFrom: Jakub Sitnicki <[email protected]>
[ Upstream commit ff672c67ee7635ca1e28fb13729e8ef0d1f08ce5 ]
On x86-64 the tail call count is passed from one BPF function to another through %rax. Additionally, on function entry, the tail call count value is stored on stack right after the BPF program stack, due to register shortage.
The stored count is later loaded from stack either when performing a tail call - to check if we have not reached the tail call limit - or before calling another BPF function call in order to pass it via %rax.
In the latter case, we miscalculate the offset at which the tail call count was stored on function entry. The JIT does not take into account that the allocated BPF program stack is always a multiple of 8 on x86, while the actual stack depth does not have to be.
This leads to a load from an offset that belongs to the BPF stack, as shown in the example below:
SEC("tc")
int entry(struct __sk_buff *skb)
{
/* Have data on stack which size is not a multiple of 8 */
volatile char arr[1] = {};
return subprog_tail(skb);
}int entry(struct __sk_buff * skb):
0: (b4) w2 = 0
1: (73) *(u8 *)(r10 -1) = r2
2: (85) call pc+1#bpf_prog_ce2f79bb5f3e06dd_F
3: (95) exit
int entry(struct __sk_buff * skb):
0xffffffffa0201788: nop DWORD PTR [rax+rax*1+0x0] 0xffffffffa020178d: xor eax,eax 0xffffffffa020178f: push rbp 0xffffffffa0201790: mov rbp,rsp 0xffffffffa0201793: sub rsp,0x8 0xffffffffa020179a: push rax 0xffffffffa020179b: xor esi,esi 0xffffffffa020179d: mov BYTE PTR [rbp-0x1],sil 0xffffffffa02017a1: mov rax,QWORD PTR [rbp-0x9] !!! tail call count 0xffffffffa02017a8: call 0xffffffffa02017d8 !!! is at rbp-0x10 0xffffffffa02017ad: leave 0xffffffffa02017ae: ret
Fix it by rounding up the BPF stack depth to a multiple of 8, when calculating the tail call count offset on stack.
--- arch/x86/net/bpf_jit_comp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/net/bpf_jit_comp.c +2 -1
@@ -1440,8 +1440,9 @@ st: if (is_imm8(insn->off))case BPF_JMP |BPF_CALL : func = (u8 *) __bpf_call_base + imm32;if (tail_call_reachable) { +/* mov rax, qword ptr [rbp - rounded_stack_depth - 8] */ EMIT3_off32 (0x48 ,0x8B ,0x85 , - -(bpf_prog->aux->stack_depth +8 )); + -round_up (bpf_prog->aux->stack_depth,8 ) -8 );if (!imm32 ||emit_call (&prog, func, image + addrs[i -1 ] +7 ))return -EINVAL ; }else {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 44/135 scsi: storvsc: Correct reporting of Hyper-V I/O size limits
In reply to Greg Kroah-HartmanFrom: Saurabh Sengar <[email protected]>
[ Upstream commit 1d3e0980782fbafaf93285779fd3905e4f866802 ]
Current code is based on the idea that the max number of SGL entries also determines the max size of an I/O request. While this idea was true in older versions of the storvsc driver when SGL entry length was limited to 4 Kbytes, commit 3d9c3dcc58e9 ("scsi: storvsc: Enable scatterlist entry lengths > 4Kbytes") removed that limitation. It's now theoretically possible for the block layer to send requests that exceed the maximum size supported by Hyper-V. This problem doesn't currently happen in practice because the block layer defaults to a 512 Kbyte maximum, while Hyper-V in Azure supports 2 Mbyte I/O sizes. But some future configuration of Hyper-V could have a smaller max I/O size, and the block layer could exceed that max.
Fix this by correctly setting max_sectors as well as sg_tablesize to reflect the maximum I/O size that Hyper-V reports. While allowing I/O sizes larger than the block layer default of 512 Kbytes doesn’t provide any noticeable performance benefit in the tests we ran, it's still appropriate to report the correct underlying Hyper-V capabilities to the Linux block layer.
Also tweak the virt_boundary_mask to reflect that the required alignment derives from Hyper-V communication using a 4 Kbyte page size, and not on the guest page size, which might be bigger (eg. ARM64).
--- drivers/scsi/storvsc_drv.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-)
drivers/scsi/storvsc_drv.c +22 -5
@@ -1907,7 +1907,7 @@ static struct scsi_host_template scsi_driver = { .cmd_per_lun = 2048, .this_id = -1,/* Ensure there are no gaps in presented sgls */ - .virt_boundary_mask = PAGE_SIZE-1, + .virt_boundary_mask = HV_HYP_PAGE_SIZE - 1, .no_write_same = 1, .track_queue_depth = 1, .change_queue_depth = storvsc_change_queue_depth,
@@ -1961,6 +1961,7 @@ static int storvsc_probe(struct hv_device *device,int max_targets;int max_channels;int max_sub_channels =0 ; +u32 max_xfer_bytes;/* * Based on the windows host we are running on,
@@ -2049,12 +2050,28 @@ static int storvsc_probe(struct hv_device *device, }/* max cmd length */ host->max_cmd_len =STORVSC_MAX_CMD_LEN ; -/* -* set the table size based on the info we got -* from the host. +* Any reasonable Hyper-V configuration should provide +* max_transfer_bytes value aligning to HV_HYP_PAGE_SIZE, +* protecting it from any weird value. +*/ + max_xfer_bytes =round_down (stor_device->max_transfer_bytes,HV_HYP_PAGE_SIZE ); +/* max_hw_sectors_kb */ + host->max_sectors = max_xfer_bytes >>9 ; +/* +* There are 2 requirements for Hyper-V storvsc sgl segments, +* based on which the below calculation for max segments is +* done: +* +* 1. Except for the first and last sgl segment, all sgl segments +* should be align to HV_HYP_PAGE_SIZE, that also means the +* maximum number of segments in a sgl can be calculated by +* dividing the total max transfer length by HV_HYP_PAGE_SIZE. +* +* 2. Except for the first and last, each entry in the SGL must +* have an offset that is a multiple of HV_HYP_PAGE_SIZE. */ - host->sg_tablesize = (stor_device->max_transfer_bytes >>PAGE_SHIFT ); + host->sg_tablesize = (max_xfer_bytes >>HV_HYP_PAGE_SHIFT ) +1 ;/* * For non-IDE disks, the host supports multiple channels. * Set the number of HW queues we are supporting.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 45/135 phy: aquantia: Fix AN when higher speeds than 1G are not advertised
In reply to Greg Kroah-HartmanFrom: Claudiu Manoil <[email protected]>
[ Upstream commit 9b7fd1670a94a57d974795acebde843a5c1a354e ]
Even when the eth port is resticted to work with speeds not higher than 1G, and so the eth driver is requesting the phy (via phylink) to advertise up to 1000BASET support, the aquantia phy device is still advertising for 2.5G and 5G speeds.
Clear these advertising defaults when requested.
--- drivers/net/phy/aquantia_main.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
drivers/net/phy/aquantia_main.c +14 -1
@@ -34,6 +34,8 @@#define MDIO_AN_VEND_PROV 0xc400#define MDIO_AN_VEND_PROV_1000BASET_FULL BIT(15)#define MDIO_AN_VEND_PROV_1000BASET_HALF BIT(14) +#define MDIO_AN_VEND_PROV_5000BASET_FULL BIT(11) +#define MDIO_AN_VEND_PROV_2500BASET_FULL BIT(10)#define MDIO_AN_VEND_PROV_DOWNSHIFT_EN BIT(4)#define MDIO_AN_VEND_PROV_DOWNSHIFT_MASK GENMASK(3, 0)#define MDIO_AN_VEND_PROV_DOWNSHIFT_DFLT 4
@@ -231,9 +233,20 @@ static int aqr_config_aneg(struct phy_device *phydev) phydev->advertising)) reg |=MDIO_AN_VEND_PROV_1000BASET_HALF ; +/* Handle the case when the 2.5G and 5G speeds are not advertised */ +if (linkmode_test_bit (ETHTOOL_LINK_MODE_2500baseT_Full_BIT, + phydev->advertising)) + reg |=MDIO_AN_VEND_PROV_2500BASET_FULL ; + +if (linkmode_test_bit (ETHTOOL_LINK_MODE_5000baseT_Full_BIT, + phydev->advertising)) + reg |=MDIO_AN_VEND_PROV_5000BASET_FULL ; + ret =phy_modify_mmd_changed (phydev,MDIO_MMD_AN ,MDIO_AN_VEND_PROV ,MDIO_AN_VEND_PROV_1000BASET_HALF | -MDIO_AN_VEND_PROV_1000BASET_FULL , reg); +MDIO_AN_VEND_PROV_1000BASET_FULL | +MDIO_AN_VEND_PROV_2500BASET_FULL | +MDIO_AN_VEND_PROV_5000BASET_FULL , reg);if (ret <0 )return ret;if (ret >0 )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 46/135 KVM: arm64: Prevent kmemleak from accessing pKVM memory
In reply to Greg Kroah-HartmanFrom: Quentin Perret <[email protected]>
[ Upstream commit 56961c6331463cce2d84d0f973177a517fb33a82 ]
Commit a7259df76702 ("memblock: make memblock_find_in_range method private") changed the API using which memory is reserved for the pKVM hypervisor. However, memblock_phys_alloc() differs from the original API in terms of kmemleak semantics -- the old one didn't report the reserved regions to kmemleak while the new one does. Unfortunately, when protected KVM is enabled, all kernel accesses to pKVM-private memory result in a fatal exception, which can now happen because of kmemleak scans:
$ echo scan > /sys/kernel/debug/kmemleak [ 34.991354] kvm [304]: nVHE hyp BUG at: [<ffff800008fa3750>] __kvm_nvhe_handle_host_mem_abort+0x270/0x290! [ 34.991580] kvm [304]: Hyp Offset: 0xfffe8be807e00000 [ 34.991813] Kernel panic - not syncing: HYP panic: [ 34.991813] PS:600003c9 PC:0000f418011a3750 ESR:00000000f2000800 [ 34.991813] FAR:ffff000439200000 HPFAR:0000000004792000 PAR:0000000000000000 [ 34.991813] VCPU:0000000000000000 [ 34.993660] CPU: 0 PID: 304 Comm: bash Not tainted 5.19.0-rc2 #102 [ 34.994059] Hardware name: linux,dummy-virt (DT) [ 34.994452] Call trace: [ 34.994641] dump_backtrace.part.0+0xcc/0xe0 [ 34.994932] show_stack+0x18/0x6c [ 34.995094] dump_stack_lvl+0x68/0x84 [ 34.995276] dump_stack+0x18/0x34 [ 34.995484] panic+0x16c/0x354 [ 34.995673] __hyp_pgtable_total_pages+0x0/0x60 [ 34.995933] scan_block+0x74/0x12c [ 34.996129] scan_gray_list+0xd8/0x19c [ 34.996332] kmemleak_scan+0x2c8/0x580 [ 34.996535] kmemleak_write+0x340/0x4a0 [ 34.996744] full_proxy_write+0x60/0xbc [ 34.996967] vfs_write+0xc4/0x2b0 [ 34.997136] ksys_write+0x68/0xf4 [ 34.997311] __arm64_sys_write+0x20/0x2c [ 34.997532] invoke_syscall+0x48/0x114 [ 34.997779] el0_svc_common.constprop.0+0x44/0xec [ 34.998029] do_el0_svc+0x2c/0xc0 [ 34.998205] el0_svc+0x2c/0x84 [ 34.998421] el0t_64_sync_handler+0xf4/0x100 [ 34.998653] el0t_64_sync+0x18c/0x190 [ 34.999252] SMP: stopping secondary CPUs [ 35.000034] Kernel Offset: disabled [ 35.000261] CPU features: 0x800,00007831,00001086 [ 35.000642] Memory Limit: none [ 35.001329] ---[ end Kernel panic - not syncing: HYP panic: [ 35.001329] PS:600003c9 PC:0000f418011a3750 ESR:00000000f2000800 [ 35.001329] FAR:ffff000439200000 HPFAR:0000000004792000 PAR:0000000000000000 [ 35.001329] VCPU:0000000000000000 ]---
Fix this by explicitly excluding the hypervisor's memory pool from kmemleak like we already do for the hyp BSS.
--- arch/arm64/kvm/arm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/kvm/arm.c +3 -3
@@ -2011,11 +2011,11 @@ static int finalize_hyp_mode(void)return 0 ;/* -* Exclude HYP BSS from kmemleak so that it doesn't get peeked -* at, which would end badly once the section is inaccessible. -* None of other sections should ever be introspected. +* Exclude HYP sections from kmemleak so that they don't get peeked +* at, which would end badly once inaccessible. */ kmemleak_free_part (__hyp_bss_start, __hyp_bss_end - __hyp_bss_start); +kmemleak_free_part (__va (hyp_mem_base), hyp_mem_size);return pkvm_drop_host_privileges (); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 47/135 net: Write lock dev_base_lock without disabling bottom halves.
In reply to Greg Kroah-HartmanFrom: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit fd888e85fe6b661e78044dddfec0be5271afa626 ]
The writer acquires dev_base_lock with disabled bottom halves. The reader can acquire dev_base_lock without disabling bottom halves because there is no writer in softirq context.
On PREEMPT_RT the softirqs are preemptible and local_bh_disable() acts as a lock to ensure that resources, that are protected by disabling bottom halves, remain protected.
This leads to a circular locking dependency if the lock acquired with disabled bottom halves (as in write_lock_bh()) and somewhere else with enabled bottom halves (as by read_lock() in netstat_show()) followed by disabling bottom halves (cxgb_get_stats() -> t4_wr_mbox_meat_timeout() -> spin_lock_bh()). This is the reverse locking order.
All read_lock() invocation are from sysfs callback which are not invoked from softirq context. Therefore there is no need to disable bottom halves while acquiring a write lock.
Acquire the write lock of dev_base_lock without disabling bottom halves.
--- net/core/dev.c | 16 ++++++++-------- net/core/link_watch.c | 4 ++-- net/core/rtnetlink.c | 8 ++++---- net/hsr/hsr_device.c | 6 +++--- 4 files changed, 17 insertions(+), 17 deletions(-)
net/core/dev.c +8 -8
@@ -365,12 +365,12 @@ static void list_netdevice(struct net_device *dev)ASSERT_RTNL (); -write_lock_bh (&dev_base_lock); +write_lock (&dev_base_lock);list_add_tail_rcu (&dev->dev_list, &net->dev_base_head);netdev_name_node_add (net, dev->name_node);hlist_add_head_rcu (&dev->index_hlist,dev_index_hash (net, dev->ifindex)); -write_unlock_bh (&dev_base_lock); +write_unlock (&dev_base_lock);dev_base_seq_inc (net); }
@@ -383,11 +383,11 @@ static void unlist_netdevice(struct net_device *dev)ASSERT_RTNL ();/* Unlink dev from the device chain */ -write_lock_bh (&dev_base_lock); +write_lock (&dev_base_lock);list_del_rcu (&dev->dev_list);netdev_name_node_del (dev->name_node);hlist_del_rcu (&dev->index_hlist); -write_unlock_bh (&dev_base_lock); +write_unlock (&dev_base_lock);dev_base_seq_inc (dev_net (dev)); }
@@ -1266,15 +1266,15 @@ int dev_change_name(struct net_device *dev, const char *newname)netdev_adjacent_rename_links (dev, oldname); -write_lock_bh (&dev_base_lock); +write_lock (&dev_base_lock);netdev_name_node_del (dev->name_node); -write_unlock_bh (&dev_base_lock); +write_unlock (&dev_base_lock);synchronize_rcu (); -write_lock_bh (&dev_base_lock); +write_lock (&dev_base_lock);netdev_name_node_add (net, dev->name_node); -write_unlock_bh (&dev_base_lock); +write_unlock (&dev_base_lock); ret =call_netdevice_notifiers (NETDEV_CHANGENAME , dev); ret =notifier_to_errno (ret);
net/core/link_watch.c +2 -2
@@ -55,7 +55,7 @@ static void rfc2863_policy(struct net_device *dev)if (operstate == dev->operstate)return ; -write_lock_bh (&dev_base_lock); +write_lock (&dev_base_lock);switch (dev->link_mode) {case IF_LINK_MODE_TESTING :
@@ -74,7 +74,7 @@ static void rfc2863_policy(struct net_device *dev) dev->operstate = operstate; -write_unlock_bh (&dev_base_lock); +write_unlock (&dev_base_lock); }
net/core/rtnetlink.c +4 -4
@@ -842,9 +842,9 @@ static void set_operstate(struct net_device *dev, unsigned char transition) }if (dev->operstate != operstate) { -write_lock_bh (&dev_base_lock); +write_lock (&dev_base_lock); dev->operstate = operstate; -write_unlock_bh (&dev_base_lock); +write_unlock (&dev_base_lock);netdev_state_change (dev); } }
@@ -2781,11 +2781,11 @@ static int do_setlink(const struct sk_buff *skb,if (tb[IFLA_LINKMODE ]) {unsigned char value =nla_get_u8 (tb[IFLA_LINKMODE ]); -write_lock_bh (&dev_base_lock); +write_lock (&dev_base_lock);if (dev->link_mode ^ value) status |=DO_SETLINK_NOTIFY ; dev->link_mode = value; -write_unlock_bh (&dev_base_lock); +write_unlock (&dev_base_lock); }if (tb[IFLA_VFINFO_LIST ]) {
net/hsr/hsr_device.c +3 -3
@@ -30,13 +30,13 @@ static bool is_slave_up(struct net_device *dev)static void __hsr_set_operstate (struct net_device *dev,int transition) { -write_lock_bh (&dev_base_lock); +write_lock (&dev_base_lock);if (dev->operstate != transition) { dev->operstate = transition; -write_unlock_bh (&dev_base_lock); +write_unlock (&dev_base_lock);netdev_state_change (dev); }else { -write_unlock_bh (&dev_base_lock); +write_unlock (&dev_base_lock); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 48/135 net: fix data-race in dev_isalive()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit cc26c2661fefea215f41edb665193324a5f99021 ]
dev_isalive() is called under RTNL or dev_base_lock protection.
This means that changes to dev->reg_state should be done with both locks held.
syzbot reported:
BUG: KCSAN: data-race in register_netdevice / type_show
write to 0xffff888144ecf518 of 1 bytes by task 20886 on cpu 0:
register_netdevice+0xb9f/0xdf0 net/core/dev.c:10050 lapbeth_new_device drivers/net/wan/lapbether.c:414 [inline] lapbeth_device_event+0x4a0/0x6c0 drivers/net/wan/lapbether.c:456 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0x53/0xb0 kernel/notifier.c:455 __dev_notify_flags+0x1d6/0x3a0 dev_change_flags+0xa2/0xc0 net/core/dev.c:8607 do_setlink+0x778/0x2230 net/core/rtnetlink.c:2780 __rtnl_newlink net/core/rtnetlink.c:3546 [inline] rtnl_newlink+0x114c/0x16a0 net/core/rtnetlink.c:3593 rtnetlink_rcv_msg+0x811/0x8c0 net/core/rtnetlink.c:6089 netlink_rcv_skb+0x13e/0x240 net/netlink/af_netlink.c:2501 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:6107 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x58a/0x660 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x661/0x750 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] __sys_sendto+0x21e/0x2c0 net/socket.c:2119 __do_sys_sendto net/socket.c:2131 [inline] __se_sys_sendto net/socket.c:2127 [inline] __x64_sys_sendto+0x74/0x90 net/socket.c:2127 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
read to 0xffff888144ecf518 of 1 bytes by task 20423 on cpu 1:
dev_isalive net/core/net-sysfs.c:38 [inline] netdev_show net/core/net-sysfs.c:50 [inline] type_show+0x24/0x90 net/core/net-sysfs.c:112 dev_attr_show+0x35/0x90 drivers/base/core.c:2095 sysfs_kf_seq_show+0x175/0x240 fs/sysfs/file.c:59 kernfs_seq_show+0x75/0x80 fs/kernfs/file.c:162 seq_read_iter+0x2c3/0x8e0 fs/seq_file.c:230 kernfs_fop_read_iter+0xd1/0x2f0 fs/kernfs/file.c:235 call_read_iter include/linux/fs.h:2052 [inline] new_sync_read fs/read_write.c:401 [inline] vfs_read+0x5a5/0x6a0 fs/read_write.c:482 ksys_read+0xe8/0x1a0 fs/read_write.c:620 __do_sys_read fs/read_write.c:630 [inline] __se_sys_read fs/read_write.c:628 [inline] __x64_sys_read+0x3e/0x50 fs/read_write.c:628 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
value changed: 0x00 -> 0x01
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 20423 Comm: udevd Tainted: G W 5.19.0-rc2-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
--- net/core/dev.c | 28 ++++++++++++++++------------ net/core/net-sysfs.c | 1 + 2 files changed, 17 insertions(+), 12 deletions(-)
net/core/dev.c +16 -12
@@ -378,16 +378,18 @@ static void list_netdevice(struct net_device *dev)/* Device list removal * caller must respect a RCU grace period before freeing/reusing dev */ -static void unlist_netdevice (struct net_device *dev) +static void unlist_netdevice (struct net_device *dev,bool lock) {ASSERT_RTNL ();/* Unlink dev from the device chain */ -write_lock (&dev_base_lock); +if (lock) +write_lock (&dev_base_lock);list_del_rcu (&dev->dev_list);netdev_name_node_del (dev->name_node);hlist_del_rcu (&dev->index_hlist); -write_unlock (&dev_base_lock); +if (lock) +write_unlock (&dev_base_lock);dev_base_seq_inc (dev_net (dev)); }
@@ -10319,11 +10321,11 @@ int register_netdevice(struct net_device *dev) goto err_uninit; ret =netdev_register_kobject (dev); -if (ret) { - dev->reg_state =NETREG_UNREGISTERED ; +write_lock (&dev_base_lock); + dev->reg_state = ret ?NETREG_UNREGISTERED :NETREG_REGISTERED ; +write_unlock (&dev_base_lock); +if (ret) goto err_uninit; - } - dev->reg_state =NETREG_REGISTERED ;__netdev_update_features (dev);
@@ -10483,8 +10485,6 @@ static void netdev_wait_allrefs(struct net_device *dev)unsigned long rebroadcast_time, warning_time;int wait =0 , refcnt; -linkwatch_forget_dev (dev); - rebroadcast_time = warning_time = jiffies; refcnt =netdev_refcnt_read (dev);
@@ -10598,7 +10598,10 @@ void netdev_run_todo(void)continue ; } +write_lock (&dev_base_lock); dev->reg_state =NETREG_UNREGISTERED ; +write_unlock (&dev_base_lock); +linkwatch_forget_dev (dev);netdev_wait_allrefs (dev);
@@ -11043,9 +11046,10 @@ void unregister_netdevice_many(struct list_head *head)list_for_each_entry (dev, head, unreg_list) {/* And unlink it from device chain. */ -unlist_netdevice (dev); - +write_lock (&dev_base_lock); +unlist_netdevice (dev, false); dev->reg_state =NETREG_UNREGISTERING ; +write_unlock (&dev_base_lock); }flush_all_backlogs ();
@@ -11190,7 +11194,7 @@ int __dev_change_net_namespace(struct net_device *dev, struct net *net,dev_close (dev);/* And unlink it from device chain */ -unlist_netdevice (dev); +unlist_netdevice (dev, true);synchronize_net ();
net/core/net-sysfs.c +1 -0
@@ -32,6 +32,7 @@ static const char fmt_dec[] = "%d\n";static const char fmt_ulong[] ="%lu\n" ;static const char fmt_u64[] ="%llu\n" ; +/* Caller holds RTNL or dev_base_lock */ static inline int dev_isalive (const struct net_device *dev) {return dev->reg_state <=NETREG_REGISTERED ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 49/135 tipc: fix use-after-free Read in tipc_named_reinit
In reply to Greg Kroah-HartmanFrom: Hoang Le <[email protected]>
[ Upstream commit 911600bf5a5e84bfda4d33ee32acc75ecf6159f0 ]
syzbot found the following issue on:
==================================================================
BUG: KASAN: use-after-free in tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413 Read of size 8 at addr ffff88805299a000 by task kworker/1:9/23764 CPU: 1 PID: 23764 Comm: kworker/1:9 Not tainted 5.18.0-rc4-syzkaller-00878-g17d49e6e8012 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events tipc_net_finalize_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413 tipc_net_finalize+0x234/0x3d0 net/tipc/net.c:138 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 </TASK>
[...]
==================================================================
In the commitd966ddcc3821 ("tipc: fix a deadlock when flushing scheduled work"), the cancel_work_sync() function just to make sure ONLY the work tipc_net_finalize_work() is executing/pending on any CPU completed before tipc namespace is destroyed through tipc_exit_net(). But this function is not guaranteed the work is the last queued. So, the destroyed instance may be accessed in the work which will try to enqueue later.
In order to completely fix, we re-order the calling of cancel_work_sync() to make sure the work tipc_net_finalize_work() was last queued and it must be completed by calling cancel_work_sync().
--- net/tipc/core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/tipc/core.c +1 -2
@@ -109,10 +109,9 @@ static void __net_exit tipc_exit_net(struct net *net)struct tipc_net *tn =tipc_net (net);tipc_detach_loopback (net); +tipc_net_stop (net);/* Make sure the tipc_net_finalize_work() finished */ cancel_work_sync (&tn->work); -tipc_net_stop (net); -tipc_bcast_stop (net);tipc_nametbl_stop (net);tipc_sk_rht_destroy (net);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 50/135 igb: fix a use-after-free issue in igb_clean_tx_ring
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 3f6a57ee8544ec3982f8a3cbcbf4aea7d47eb9ec ]
Fix the following use-after-free bug in igb_clean_tx_ring routine when the NIC is running in XDP mode. The issue can be triggered redirecting traffic into the igb NIC and then closing the device while the traffic is flowing.
[ 73.322719] CPU: 1 PID: 487 Comm: xdp_redirect Not tainted 5.18.3-apu2 #9 [ 73.330639] Hardware name: PC Engines APU2/APU2, BIOS 4.0.7 02/28/2017 [ 73.337434] RIP: 0010:refcount_warn_saturate+0xa7/0xf0 [ 73.362283] RSP: 0018:ffffc9000081f798 EFLAGS: 00010282 [ 73.367761] RAX: 0000000000000000 RBX: ffffc90000420f80 RCX: 0000000000000000 [ 73.375200] RDX: ffff88811ad22d00 RSI: ffff88811ad171e0 RDI: ffff88811ad171e0 [ 73.382590] RBP: 0000000000000900 R08: ffffffff82298f28 R09: 0000000000000058 [ 73.390008] R10: 0000000000000219 R11: ffffffff82280f40 R12: 0000000000000090 [ 73.397356] R13: ffff888102343a40 R14: ffff88810359e0e4 R15: 0000000000000000 [ 73.404806] FS: 00007ff38d31d740(0000) GS:ffff88811ad00000(0000) knlGS:0000000000000000 [ 73.413129] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 73.419096] CR2: 000055cff35f13f8 CR3: 0000000106391000 CR4: 00000000000406e0 [ 73.426565] Call Trace: [ 73.429087] <TASK> [ 73.431314] igb_clean_tx_ring+0x43/0x140 [igb] [ 73.436002] igb_down+0x1d7/0x220 [igb] [ 73.439974] __igb_close+0x3c/0x120 [igb] [ 73.444118] igb_xdp+0x10c/0x150 [igb] [ 73.447983] ? igb_pci_sriov_configure+0x70/0x70 [igb] [ 73.453362] dev_xdp_install+0xda/0x110 [ 73.457371] dev_xdp_attach+0x1da/0x550 [ 73.461369] do_setlink+0xfd0/0x10f0 [ 73.465166] ? __nla_validate_parse+0x89/0xc70 [ 73.469714] rtnl_setlink+0x11a/0x1e0 [ 73.473547] rtnetlink_rcv_msg+0x145/0x3d0 [ 73.477709] ? rtnl_calcit.isra.0+0x130/0x130 [ 73.482258] netlink_rcv_skb+0x8d/0x110 [ 73.486229] netlink_unicast+0x230/0x340 [ 73.490317] netlink_sendmsg+0x215/0x470 [ 73.494395] __sys_sendto+0x179/0x190 [ 73.498268] ? move_addr_to_user+0x37/0x70 [ 73.502547] ? __sys_getsockname+0x84/0xe0 [ 73.506853] ? netlink_setsockopt+0x1c1/0x4a0 [ 73.511349] ? __sys_setsockopt+0xc8/0x1d0 [ 73.515636] __x64_sys_sendto+0x20/0x30 [ 73.519603] do_syscall_64+0x3b/0x80 [ 73.523399] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 73.528712] RIP: 0033:0x7ff38d41f20c [ 73.551866] RSP: 002b:00007fff3b945a68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 73.559640] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff38d41f20c [ 73.567066] RDX: 0000000000000034 RSI: 00007fff3b945b30 RDI: 0000000000000003 [ 73.574457] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 [ 73.581852] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff3b945ab0 [ 73.589179] R13: 0000000000000000 R14: 0000000000000003 R15: 00007fff3b945b30 [ 73.596545] </TASK> [ 73.598842] ---[ end trace 0000000000000000 ]---
--- drivers/net/ethernet/intel/igb/igb_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/igb/igb_main.c +5 -2
@@ -4819,8 +4819,11 @@ static void igb_clean_tx_ring(struct igb_ring *tx_ring)while (i != tx_ring->next_to_use) {union e1000_adv_tx_desc *eop_desc, *tx_desc; -/* Free all the Tx ring sk_buffs */ -dev_kfree_skb_any (tx_buffer->skb); +/* Free all the Tx ring sk_buffs or xdp frames */ +if (tx_buffer->type ==IGB_TYPE_SKB ) +dev_kfree_skb_any (tx_buffer->skb); +else +xdp_return_frame (tx_buffer->xdpf);/* unmap skb header data */ dma_unmap_single(tx_ring->dev,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 51/135 bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
In reply to Greg Kroah-HartmanFrom: Jay Vosburgh <[email protected]>
[ Upstream commit 7a9214f3d88cfdb099f3896e102a306b316d8707 ]
The bonding ARP monitor fails to decrement send_peer_notif, the number of peer notifications (gratuitous ARP or ND) to be sent. This results in a continuous series of notifications.
Correct this by decrementing the counter for each notification.
--- drivers/net/bonding/bond_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +3 -1
@@ -3474,9 +3474,11 @@ static void bond_activebackup_arp_mon(struct bonding *bond)if (!rtnl_trylock ())return ; -if (should_notify_peers) +if (should_notify_peers) { + bond->send_peer_notif--;call_netdevice_notifiers (NETDEV_NOTIFY_PEERS , bond->dev); + }if (should_notify_rtnl) {bond_slave_state_notify (bond);bond_slave_link_notify (bond);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 52/135 ethtool: Fix get module eeprom fallback
In reply to Greg Kroah-HartmanFrom: Ivan Vecera <[email protected]>
[ Upstream commit a3bb7b63813f674fb62bac321cdd897cc62de094 ]
Function fallback_set_params() checks if the module type returned by a driver is ETH_MODULE_SFF_8079 and in this case it assumes that buffer returns a concatenated content of page A0h and A2h. The check is wrong because the correct type is ETH_MODULE_SFF_8472.
--- net/ethtool/eeprom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ethtool/eeprom.c +1 -1
@@ -36,7 +36,7 @@ static int fallback_set_params(struct eeprom_req_info *request,if (request->page) offset = request->page *ETH_MODULE_EEPROM_PAGE_LEN + offset; -if (modinfo->type ==ETH_MODULE_SFF_8079 && +if (modinfo->type ==ETH_MODULE_SFF_8472 && request->i2c_address ==0x51 ) offset +=ETH_MODULE_EEPROM_PAGE_LEN *2 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 53/135 net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
In reply to Greg Kroah-HartmanFrom: Peilin Ye <[email protected]>
[ Upstream commit a2b1a5d40bd12b44322c2ccd40bb0ec1699708b6 ]
As reported by Yuming, currently tc always show a latency of UINT_MAX for netem Qdisc's on 32-bit platforms:
$ tc qdisc add dev dummy0 root netem latency 100ms
$ tc qdisc show dev dummy0
qdisc netem 8001: root refcnt 2 limit 1000 delay 275s 275s
^^^^^^^^^^^^^^^^Let us take a closer look at netem_dump():
qopt.latency = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->latency,
UINT_MAX);qopt.latency is __u32, psched_tdiff_t is signed long, (psched_tdiff_t)(UINT_MAX) is negative for 32-bit platforms, so qopt.latency is always UINT_MAX.
Fix it by using psched_time_t (u64) instead.
Note: confusingly, users have two ways to specify 'latency':
1. normally, via '__u32 latency' in struct tc_netem_qopt;
2. via the TCA_NETEM_LATENCY64 attribute, which is s64.
For the second case, theoretically 'latency' could be negative. This patch ignores that corner case, since it is broken (i.e. assigning a negative s64 to __u32) anyways, and should be handled separately.
Thanks Ted Lin for the analysis [1] .
[1] https://github.com/raspberrypi/linux/issues/3512
--- net/sched/sch_netem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sched/sch_netem.c +2 -2
@@ -1146,9 +1146,9 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)struct tc_netem_rate rate;struct tc_netem_slot slot; - qopt.latency =min_t (psched_tdiff_t,PSCHED_NS2TICKS (q->latency), + qopt.latency =min_t (psched_time_t,PSCHED_NS2TICKS (q->latency),UINT_MAX ); - qopt.jitter =min_t (psched_tdiff_t,PSCHED_NS2TICKS (q->jitter), + qopt.jitter =min_t (psched_time_t,PSCHED_NS2TICKS (q->jitter),UINT_MAX ); qopt.limit = q->limit; qopt.loss = q->loss;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 54/135 drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit b9cc4598607cb7f7eae5c75fc1e3209cd52ff5e0 ]
of_graph_get_remote_node() returns remote device node pointer with refcount incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
Patchwork: https://patchwork.freedesktop.org/patch/488473/
--- drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +2 -0
@@ -223,6 +223,7 @@ static int mdp4_modeset_init_intf(struct mdp4_kms *mdp4_kms, encoder =mdp4_lcdc_encoder_init (dev, panel_node);if (IS_ERR (encoder)) {DRM_DEV_ERROR (dev->dev,"failed to construct LCDC encoder\n" ); +of_node_put (panel_node);return PTR_ERR (encoder); }
@@ -232,6 +233,7 @@ static int mdp4_modeset_init_intf(struct mdp4_kms *mdp4_kms, connector =mdp4_lvds_connector_init (dev, panel_node, encoder);if (IS_ERR (connector)) {DRM_DEV_ERROR (dev->dev,"failed to initialize LVDS connector\n" ); +of_node_put (panel_node);return PTR_ERR (connector); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 55/135 drm/msm/dp: check core_initialized before disable interrupts at dp_display_unbind()
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit d80c3ba0ac247791a4ed7a0cd865a64906c8906a ]
During msm initialize phase, dp_display_unbind() will be called to undo initializations had been done by dp_display_bind() previously if there is error happen at msm_drm_bind. In this case, core_initialized flag had to be check to make sure clocks is on before update DP controller register to disable HPD interrupts. Otherwise system will crash due to below NOC fatal error.
QTISECLIB [01f01a7ad]CNOC2 ERROR: ERRLOG0_LOW = 0x00061007 QTISECLIB [01f01a7ad]GEM_NOC ERROR: ERRLOG0_LOW = 0x00001007 QTISECLIB [01f0371a0]CNOC2 ERROR: ERRLOG0_HIGH = 0x00000003 QTISECLIB [01f055297]GEM_NOC ERROR: ERRLOG0_HIGH = 0x00000003 QTISECLIB [01f072beb]CNOC2 ERROR: ERRLOG1_LOW = 0x00000024 QTISECLIB [01f0914b8]GEM_NOC ERROR: ERRLOG1_LOW = 0x00000042 QTISECLIB [01f0ae639]CNOC2 ERROR: ERRLOG1_HIGH = 0x00004002 QTISECLIB [01f0cc73f]GEM_NOC ERROR: ERRLOG1_HIGH = 0x00004002 QTISECLIB [01f0ea092]CNOC2 ERROR: ERRLOG2_LOW = 0x0009020c QTISECLIB [01f10895f]GEM_NOC ERROR: ERRLOG2_LOW = 0x0ae9020c QTISECLIB [01f125ae1]CNOC2 ERROR: ERRLOG2_HIGH = 0x00000000 QTISECLIB [01f143be7]GEM_NOC ERROR: ERRLOG2_HIGH = 0x00000000 QTISECLIB [01f16153a]CNOC2 ERROR: ERRLOG3_LOW = 0x00000000 QTISECLIB [01f17fe07]GEM_NOC ERROR: ERRLOG3_LOW = 0x00000000 QTISECLIB [01f19cf89]CNOC2 ERROR: ERRLOG3_HIGH = 0x00000000 QTISECLIB [01f1bb08e]GEM_NOC ERROR: ERRLOG3_HIGH = 0x00000000 QTISECLIB [01f1d8a31]CNOC2 ERROR: SBM1 FAULTINSTATUS0_LOW = 0x00000002 QTISECLIB [01f1f72a4]GEM_NOC ERROR: SBM0 FAULTINSTATUS0_LOW = 0x00000001 QTISECLIB [01f21a217]CNOC3 ERROR: ERRLOG0_LOW = 0x00000006 QTISECLIB [01f23dfd3]NOC error fatal
changes in v2:
-- drop the first patch (drm/msm: enable msm irq after all initializations are done successfully at msm_drm_init()) since the problem had been fixed by other patch
Patchwork: https://patchwork.freedesktop.org/patch/488387/
--- drivers/gpu/drm/msm/dp/dp_display.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/dp/dp_display.c +2 -1
@@ -260,7 +260,8 @@ static void dp_display_unbind(struct device *dev, struct device *master, struct dp_display_private, dp_display);/* disable all HPD interrupts */ -dp_catalog_hpd_config_intr (dp->catalog,DP_DP_HPD_INT_MASK , false); +if (dp->core_initialized) +dp_catalog_hpd_config_intr (dp->catalog,DP_DP_HPD_INT_MASK , false);kthread_stop (dp->ev_tsk);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 56/135 drm/msm/dp: Drop now unused hpd_high member
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit fabae667b1263216be53e0230cd3966a9a1963a4 ]
Since '8ede2ecc3e5e ("drm/msm/dp: Add DP compliance tests on Snapdragon Chipsets")' the hpd_high member of struct dp_usbpd has been write-only.
Let's clean up the code a little bit by removing the writes as well.
--- drivers/gpu/drm/msm/dp/dp_display.c | 6 ------ drivers/gpu/drm/msm/dp/dp_hpd.c | 2 -- drivers/gpu/drm/msm/dp/dp_hpd.h | 2 -- 3 files changed, 10 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +0 -6
@@ -547,11 +547,8 @@ static int dp_hpd_plug_handle(struct dp_display_private *dp, u32 data) dp->hpd_state =ST_CONNECT_PENDING ; - hpd->hpd_high =1 ; - ret =dp_display_usbpd_configure_cb (&dp->pdev->dev);if (ret) {/* link train failed */ - hpd->hpd_high =0 ; dp->hpd_state =ST_DISCONNECTED ;if (ret == -ECONNRESET ) {/* cable unplugged */
@@ -628,7 +625,6 @@ static int dp_hpd_unplug_handle(struct dp_display_private *dp, u32 data)/* triggered by irq_hdp with sink_count = 0 */ if (dp->link->sink_count ==0 ) {dp_ctrl_off_phy (dp->ctrl); - hpd->hpd_high =0 ; dp->core_initialized = false; }mutex_unlock (&dp->event_mutex);
@@ -652,8 +648,6 @@ static int dp_hpd_unplug_handle(struct dp_display_private *dp, u32 data)/* disable HPD plug interrupts */ dp_catalog_hpd_config_intr (dp->catalog,DP_DP_HPD_PLUG_INT_MASK , false); - hpd->hpd_high =0 ; -/* * We don't need separate work for disconnect as * connect/attention interrupts are disabled
drivers/gpu/drm/msm/dp/dp_hpd.c +0 -2
@@ -32,8 +32,6 @@ int dp_hpd_connect(struct dp_usbpd *dp_usbpd, bool hpd) hpd_priv = container_of(dp_usbpd, struct dp_hpd_private, dp_usbpd); - dp_usbpd->hpd_high = hpd; -if (!hpd_priv->dp_cb || !hpd_priv->dp_cb->configure || !hpd_priv->dp_cb->disconnect) {pr_err ("hpd dp_cb not initialized\n" );
drivers/gpu/drm/msm/dp/dp_hpd.h +0 -2
@@ -26,7 +26,6 @@ enum plug_orientation {* @multi_func: multi-function preferred * @usb_config_req: request to switch to usb * @exit_dp_mode: request exit from displayport mode -* @hpd_high: Hot Plug Detect signal is high. * @hpd_irq: Change in the status since last message * @alt_mode_cfg_done: bool to specify alt mode status * @debug_en: bool to specify debug mode
@@ -39,7 +38,6 @@ struct dp_usbpd {bool multi_func;bool usb_config_req;bool exit_dp_mode; -bool hpd_high;bool hpd_irq;bool alt_mode_cfg_done;bool debug_en;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 57/135 drm/msm/dp: dp_link_parse_sink_count() return immediately if aux read failed
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit f61550b3864b9578527c28cf9c465316ac1566e1 ]
Add checking aux read/write status at both dp_link_parse_sink_count() and dp_link_parse_sink_status_filed() to avoid long timeout delay if dp aux read/write failed at timeout due to cable unplugged.
Changes in V4:
-- split this patch as stand alone patch
Changes in v5:
-- rebase on msm-next branch
--- drivers/gpu/drm/msm/dp/dp_display.c | 12 +++++++++--- drivers/gpu/drm/msm/dp/dp_link.c | 19 ++++++++++++++----- 2 files changed, 23 insertions(+), 8 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +9 -3
@@ -712,9 +712,15 @@ static int dp_irq_hpd_handle(struct dp_display_private *dp, u32 data)return 0 ; } - ret =dp_display_usbpd_attention_cb (&dp->pdev->dev); -if (ret == -ECONNRESET ) {/* cable unplugged */ - dp->core_initialized = false; +/* +* dp core (ahb/aux clks) must be initialized before +* irq_hpd be handled +*/ +if (dp->core_initialized) { + ret =dp_display_usbpd_attention_cb (&dp->pdev->dev); +if (ret == -ECONNRESET ) {/* cable unplugged */ + dp->core_initialized = false; + } }DRM_DEBUG_DP ("hpd_state=%d\n" , state);
drivers/gpu/drm/msm/dp/dp_link.c +14 -5
@@ -737,18 +737,25 @@ static int dp_link_parse_sink_count(struct dp_link *dp_link)return 0 ; } -static void dp_link_parse_sink_status_field (struct dp_link_private *link) +static int dp_link_parse_sink_status_field (struct dp_link_private *link) {int len =0 ; link->prev_sink_count = link->dp_link.sink_count; -dp_link_parse_sink_count (&link->dp_link); + len =dp_link_parse_sink_count (&link->dp_link); +if (len <0 ) { +DRM_ERROR ("DP parse sink count failed\n" ); +return len; + } len =drm_dp_dpcd_read_link_status (link->aux, link->link_status); -if (len <DP_LINK_STATUS_SIZE ) +if (len <DP_LINK_STATUS_SIZE ) {DRM_ERROR ("DP link status read failed\n" ); -dp_link_parse_request (link); +return len; + } + +return dp_link_parse_request (link); }/**
@@ -1023,7 +1030,9 @@ int dp_link_process_request(struct dp_link *dp_link)dp_link_reset_data (link); -dp_link_parse_sink_status_field (link); + ret =dp_link_parse_sink_status_field (link); +if (ret) +return ret;if (link->request.test_requested ==DP_TEST_LINK_EDID_READ ) { dp_link->sink_request |=DP_TEST_LINK_EDID_READ ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 58/135 drm/msm/dp: do not initialize phy until plugin interrupt received
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit 989ebe7bc4463002c210db0010c8475797a9098f ]
Current DP drivers have regulators, clocks, irq and phy are grouped together within a function and executed not in a symmetric manner. This increase difficulty of code maintenance and limited code scalability. This patch divides the driver life cycle of operation into four states, resume (including booting up), dongle plugin, dongle unplugged and suspend. Regulators, core clocks and irq are grouped together and enabled at resume (or booting up) so that the DP controller is armed and ready to receive HPD plugin interrupts. HPD plugin interrupt is generated when a dongle plugs into DUT (device under test). Once HPD plugin interrupt is received, DP controller will initialize phy so that dpcd read/write will function and following link training can be proceeded successfully. DP phy will be disabled after main link is teared down at end of unplugged HPD interrupt handle triggered by dongle unplugged out of DUT. Finally regulators, code clocks and irq are disabled at corresponding suspension.
Changes in V2:
-- removed unnecessary dp_ctrl NULL check
-- removed unnecessary phy init_count and power_count DRM_DEBUG_DP logs -- remove flip parameter out of dp_ctrl_irq_enable()
-- add fixes tag
Changes in V3:
-- call dp_display_host_phy_init() instead of dp_ctrl_phy_init() at
dp_display_host_init() for eDP
Changes in V4:
-- rewording commit text to match this commit changes
Changes in V5:
-- rebase on top of msm-next branch
Changes in V6:
-- delete flip variable
Changes in V7:
-- dp_ctrl_irq_enable/disabe() merged into dp_ctrl_reset_irq_ctrl()
Changes in V8:
-- add more detail comment regrading dp phy at dp_display_host_init()
Changes in V9:
-- remove set phy_initialized to false when -ECONNRESET detected
Changes in v10:
-- group into one series
Changes in v11:
-- drop drm/msm/dp: dp_link_parse_sink_count() return immediately
if aux read
Changes in v12:
-- move dp_display_host_phy_exit() after dp_display_host_deinit()
Changes in v13:
-- do not execute phy_init until plugged_in interrupt for edp, same as DP.
Changes in v14:
-- remove redundant dp->core_initialized = false form dp_pm_suspend.
Changes in v15:
-- remove core_initialized flag check at both host_init and host_deinit
Changes in v16:
-- remove dp_display_host_phy_exit core_initialized=false at dp_pm_suspend
Changes in v17:
-- remove core_initialized checking before execute attention_cb()
Changes in v18:
-- remove core_initialized checking at dp_pm_suspend
--- drivers/gpu/drm/msm/dp/dp_ctrl.c | 80 ++++++++------------ drivers/gpu/drm/msm/dp/dp_ctrl.h | 8 +- drivers/gpu/drm/msm/dp/dp_display.c | 111 ++++++++++++++-------------- 3 files changed, 92 insertions(+), 107 deletions(-)
drivers/gpu/drm/msm/dp/dp_ctrl.c +30 -50
@@ -1348,60 +1348,44 @@ static int dp_ctrl_enable_stream_clocks(struct dp_ctrl_private *ctrl)return ret; } -int dp_ctrl_host_init (struct dp_ctrl *dp_ctrl,bool flip,bool reset) +void dp_ctrl_reset_irq_ctrl (struct dp_ctrl *dp_ctrl,bool enable) +{ +struct dp_ctrl_private *ctrl; + + ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl); + +dp_catalog_ctrl_reset (ctrl->catalog); + +if (enable) +dp_catalog_ctrl_enable_irq (ctrl->catalog, enable); +} + +void dp_ctrl_phy_init (struct dp_ctrl *dp_ctrl) {struct dp_ctrl_private *ctrl;struct dp_io *dp_io;struct phy *phy; -if (!dp_ctrl) { -DRM_ERROR ("Invalid input data\n" ); -return -EINVAL ; - } - ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl); dp_io = &ctrl->parser->io; phy = dp_io->phy; - ctrl->dp_ctrl.orientation = flip; - -if (reset) -dp_catalog_ctrl_reset (ctrl->catalog); - -DRM_DEBUG_DP ("flip=%d\n" , flip);dp_catalog_ctrl_phy_reset (ctrl->catalog);phy_init (phy); -dp_catalog_ctrl_enable_irq (ctrl->catalog, true); - -return 0 ; } -/** -* dp_ctrl_host_deinit() - Uninitialize DP controller -* @dp_ctrl: Display Port Driver data -* -* Perform required steps to uninitialize DP controller -* and its resources. -*/ -void dp_ctrl_host_deinit (struct dp_ctrl *dp_ctrl) +void dp_ctrl_phy_exit (struct dp_ctrl *dp_ctrl) {struct dp_ctrl_private *ctrl;struct dp_io *dp_io;struct phy *phy; -if (!dp_ctrl) { -DRM_ERROR ("Invalid input data\n" ); -return ; - } - ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl); dp_io = &ctrl->parser->io; phy = dp_io->phy; -dp_catalog_ctrl_enable_irq (ctrl->catalog, false); +dp_catalog_ctrl_phy_reset (ctrl->catalog);phy_exit (phy); - -DRM_DEBUG_DP ("Host deinitialized successfully\n" ); }static bool dp_ctrl_use_fixed_nvid (struct dp_ctrl_private *ctrl)
@@ -1471,7 +1455,10 @@ static int dp_ctrl_deinitialize_mainlink(struct dp_ctrl_private *ctrl) }phy_power_off (phy); + +/* aux channel down, reinit phy */ phy_exit (phy); +phy_init (phy);return 0 ; }
@@ -1877,8 +1864,14 @@ int dp_ctrl_off_link_stream(struct dp_ctrl *dp_ctrl)return ret; } +DRM_DEBUG_DP ("Before, phy=%x init_count=%d power_on=%d\n" , + (u32 )(uintptr_t )phy, phy->init_count, phy->power_count); +phy_power_off (phy); +DRM_DEBUG_DP ("After, phy=%x init_count=%d power_on=%d\n" , + (u32 )(uintptr_t )phy, phy->init_count, phy->power_count); +/* aux channel down, reinit phy */ phy_exit (phy);phy_init (phy);
@@ -1887,23 +1880,6 @@ int dp_ctrl_off_link_stream(struct dp_ctrl *dp_ctrl)return ret; } -void dp_ctrl_off_phy (struct dp_ctrl *dp_ctrl) -{ -struct dp_ctrl_private *ctrl; -struct dp_io *dp_io; -struct phy *phy; - - ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl); - dp_io = &ctrl->parser->io; - phy = dp_io->phy; - -dp_catalog_ctrl_reset (ctrl->catalog); - -phy_exit (phy); - -DRM_DEBUG_DP ("DP off phy done\n" ); -} -int dp_ctrl_off (struct dp_ctrl *dp_ctrl) {struct dp_ctrl_private *ctrl;
@@ -1931,10 +1907,14 @@ int dp_ctrl_off(struct dp_ctrl *dp_ctrl)DRM_ERROR ("Failed to disable link clocks. ret=%d\n" , ret); } +DRM_DEBUG_DP ("Before, phy=%x init_count=%d power_on=%d\n" , + (u32 )(uintptr_t )phy, phy->init_count, phy->power_count); +phy_power_off (phy); -phy_exit (phy); -DRM_DEBUG_DP ("DP off done\n" ); +DRM_DEBUG_DP ("After, phy=%x init_count=%d power_on=%d\n" , + (u32 )(uintptr_t )phy, phy->init_count, phy->power_count); +return ret; }
drivers/gpu/drm/msm/dp/dp_ctrl.h +5 -3
@@ -19,12 +19,9 @@ struct dp_ctrl {u32 pixel_rate; }; -int dp_ctrl_host_init (struct dp_ctrl *dp_ctrl,bool flip,bool reset); -void dp_ctrl_host_deinit (struct dp_ctrl *dp_ctrl);int dp_ctrl_on_link (struct dp_ctrl *dp_ctrl);int dp_ctrl_on_stream (struct dp_ctrl *dp_ctrl);int dp_ctrl_off_link_stream (struct dp_ctrl *dp_ctrl); -void dp_ctrl_off_phy (struct dp_ctrl *dp_ctrl);int dp_ctrl_off (struct dp_ctrl *dp_ctrl);void dp_ctrl_push_idle (struct dp_ctrl *dp_ctrl);void dp_ctrl_isr (struct dp_ctrl *dp_ctrl);
@@ -34,4 +31,9 @@ struct dp_ctrl *dp_ctrl_get(struct device *dev, struct dp_link *link, struct dp_power *power, struct dp_catalog *catalog, struct dp_parser *parser); +void dp_ctrl_reset_irq_ctrl (struct dp_ctrl *dp_ctrl,bool enable); +void dp_ctrl_phy_init (struct dp_ctrl *dp_ctrl); +void dp_ctrl_phy_exit (struct dp_ctrl *dp_ctrl); +void dp_ctrl_irq_phy_exit (struct dp_ctrl *dp_ctrl); +#endif /* _DP_CTRL_H_ */
drivers/gpu/drm/msm/dp/dp_display.c +57 -54
212 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 59/135 drm/msm/dp: force link training for display resolution change
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit a6e2af64a79afa7f1b29375b5231e840a84bb845 ]
Display resolution change is implemented through drm modeset. Older modeset (resolution) has to be disabled first before newer modeset (resolution) can be enabled. Display disable will turn off both pixel clock and main link clock so that main link have to be re-trained during display enable to have new video stream flow again. At current implementation, display enable function manually kicks up irq_hpd_handle which will read panel link status and start link training if link status is not in sync state.
However, there is rare case that a particular panel links status keep staying in sync for some period of time after main link had been shut down previously at display disabled. In this case, main link retraining will not be executed by irq_hdp_handle(). Hence video stream of newer display resolution will fail to be transmitted to panel due to main link is not in sync between host and panel.
This patch will bypass irq_hpd_handle() in favor of directly call dp_ctrl_on_stream() to always perform link training in regardless of main link status. So that no unexpected exception resolution change failure cases will happen. Also this implementation are more efficient than manual kicking off irq_hpd_handle function.
Changes in v2:
-- set force_link_train flag on DP only (is_edp == false)
Changes in v3:
-- revise commit text
-- add Fixes tag
Changes in v4:
-- revise commit text
Changes in v5:
-- fix spelling at commit text
Changes in v6:
-- split dp_ctrl_on_stream() for phy test case
-- revise commit text for modeset
Changes in v7:
-- drop 0 assignment at local variable (ret = 0)
Changes in v8:
-- add patch to remove pixel_rate from dp_ctrl
Changes in v9:
-- forward declare dp_ctrl_on_stream_phy_test_report()
Patchwork: https://patchwork.freedesktop.org/patch/489895/
--- drivers/gpu/drm/msm/dp/dp_ctrl.c | 33 ++++++++++++++++++++++------- drivers/gpu/drm/msm/dp/dp_ctrl.h | 2 +- drivers/gpu/drm/msm/dp/dp_display.c | 13 ++++++------ 3 files changed, 32 insertions(+), 16 deletions(-)
drivers/gpu/drm/msm/dp/dp_ctrl.c +25 -8
@@ -1488,6 +1488,8 @@ static int dp_ctrl_link_maintenance(struct dp_ctrl_private *ctrl)return ret; } +static int dp_ctrl_on_stream_phy_test_report (struct dp_ctrl *dp_ctrl); +static int dp_ctrl_process_phy_test_request (struct dp_ctrl_private *ctrl) {int ret =0 ;
@@ -1510,7 +1512,7 @@ static int dp_ctrl_process_phy_test_request(struct dp_ctrl_private *ctrl) ret =dp_ctrl_on_link (&ctrl->dp_ctrl);if (!ret) - ret =dp_ctrl_on_stream (&ctrl->dp_ctrl); + ret =dp_ctrl_on_stream_phy_test_report (&ctrl->dp_ctrl);else DRM_ERROR ("failed to enable DP link controller\n" );
@@ -1765,7 +1767,27 @@ static int dp_ctrl_link_retrain(struct dp_ctrl_private *ctrl)return dp_ctrl_setup_main_link (ctrl, &training_step); } -int dp_ctrl_on_stream (struct dp_ctrl *dp_ctrl) +static int dp_ctrl_on_stream_phy_test_report (struct dp_ctrl *dp_ctrl) +{ +int ret; +struct dp_ctrl_private *ctrl; + + ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl); + + ctrl->dp_ctrl.pixel_rate = ctrl->panel->dp_mode.drm_mode.clock; + + ret =dp_ctrl_enable_stream_clocks (ctrl); +if (ret) { +DRM_ERROR ("Failed to start pixel clocks. ret=%d\n" , ret); +return ret; + } + +dp_ctrl_send_phy_test_pattern (ctrl); + +return 0 ; +} + +int dp_ctrl_on_stream (struct dp_ctrl *dp_ctrl,bool force_link_train) {int ret =0 ;bool mainlink_ready = false;
@@ -1796,12 +1818,7 @@ int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl) goto end; } -if (ctrl->link->sink_request &DP_TEST_LINK_PHY_TEST_PATTERN ) { -dp_ctrl_send_phy_test_pattern (ctrl); -return 0 ; - } - -if (!dp_ctrl_channel_eq_ok (ctrl)) +if (force_link_train || !dp_ctrl_channel_eq_ok (ctrl))dp_ctrl_link_retrain (ctrl);/* stop txing train pattern to end link training */
drivers/gpu/drm/msm/dp/dp_ctrl.h +1 -1
@@ -20,7 +20,7 @@ struct dp_ctrl { };int dp_ctrl_on_link (struct dp_ctrl *dp_ctrl); -int dp_ctrl_on_stream (struct dp_ctrl *dp_ctrl); +int dp_ctrl_on_stream (struct dp_ctrl *dp_ctrl,bool force_link_train);int dp_ctrl_off_link_stream (struct dp_ctrl *dp_ctrl);int dp_ctrl_off (struct dp_ctrl *dp_ctrl);void dp_ctrl_push_idle (struct dp_ctrl *dp_ctrl);
drivers/gpu/drm/msm/dp/dp_display.c +6 -7
@@ -865,7 +865,7 @@ static int dp_display_enable(struct dp_display_private *dp, u32 data)return 0 ; } - rc =dp_ctrl_on_stream (dp->ctrl); + rc =dp_ctrl_on_stream (dp->ctrl, data);if (!rc) dp_display->power_on = true;
@@ -1512,6 +1512,7 @@ int msm_dp_display_enable(struct msm_dp *dp, struct drm_encoder *encoder)int rc =0 ;struct dp_display_private *dp_display;u32 state; +bool force_link_train = false; dp_display = container_of(dp, struct dp_display_private, dp_display);if (!dp_display->dp_mode.drm_mode.clock) {
@@ -1540,10 +1541,12 @@ int msm_dp_display_enable(struct msm_dp *dp, struct drm_encoder *encoder) state = dp_display->hpd_state; -if (state ==ST_DISPLAY_OFF ) +if (state ==ST_DISPLAY_OFF ) {dp_display_host_phy_init (dp_display); + force_link_train = true; + } -dp_display_enable (dp_display,0 ); +dp_display_enable (dp_display, force_link_train); rc =dp_display_post_enable (dp);if (rc) {
@@ -1552,10 +1555,6 @@ int msm_dp_display_enable(struct msm_dp *dp, struct drm_encoder *encoder)dp_display_unprepare (dp); } -/* manual kick off plug event to train link */ -if (state ==ST_DISPLAY_OFF ) -dp_add_event (dp_display,EV_IRQ_HPD_INT ,0 ,0 ); -/* completed connection */ dp_display->hpd_state =ST_CONNECTED ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 60/135 perf arm-spe: Dont set data source if its not a memory operation
In reply to Greg Kroah-HartmanFrom: Leo Yan <[email protected]>
[ Upstream commit 51ba539f5bdb5a8cc7b1dedd5e73ac54564a7602 ]
Except for memory load and store operations, ARM SPE records also can support other operation types, bug when set the data source field the current code assumes a record is a either load operation or store operation, this leads to wrongly synthesize memory samples.
This patch strictly checks the record operation type, it only sets data source only for the operation types ARM_SPE_LD and ARM_SPE_ST, otherwise, returns zero for data source. Therefore, we can synthesize memory samples only when data source is a non-zero value, the function arm_spe__is_memory_event() is useless and removed.
--- tools/perf/util/arm-spe.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-)
tools/perf/util/arm-spe.c +8 -14
@@ -312,26 +312,16 @@ static int arm_spe__synth_branch_sample(struct arm_spe_queue *speq,return arm_spe_deliver_synth_event (spe, speq, event, &sample); } -#define SPE_MEM_TYPE (ARM_SPE_L1D_ACCESS | ARM_SPE_L1D_MISS | \ - ARM_SPE_LLC_ACCESS | ARM_SPE_LLC_MISS | \ - ARM_SPE_REMOTE_ACCESS) - -static bool arm_spe__is_memory_event (enum arm_spe_sample_type type) -{ -if (type &SPE_MEM_TYPE ) -return true; - -return false; -} -static u64 arm_spe__synth_data_source (const struct arm_spe_record *record) {union perf_mem_data_src data_src = {0 };if (record->op ==ARM_SPE_LD ) data_src.mem_op =PERF_MEM_OP_LOAD ; -else +else if (record->op ==ARM_SPE_ST ) data_src.mem_op =PERF_MEM_OP_STORE ; +else +return 0 ;if (record->type & (ARM_SPE_LLC_ACCESS |ARM_SPE_LLC_MISS )) { data_src.mem_lvl =PERF_MEM_LVL_L3 ;
@@ -435,7 +425,11 @@ static int arm_spe_sample(struct arm_spe_queue *speq)return err; } -if (spe->sample_memory &&arm_spe__is_memory_event (record->type)) { +/* +* When data_src is zero it means the record is not a memory operation, +* skip to synthesize memory sample for this case. +*/ +if (spe->sample_memory && data_src) { err =arm_spe__synth_mem_sample (speq, spe->memory_id, data_src);if (err)return err;
Signature · 9 lines
2.35.1 _______________________________________________ linux-arm-kernel mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Greg Kroah-Hartman
maintainerPATCH 61/135 erspan: do not assume transport header is always set
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 301bd140ed0b24f0da660874c7e8a47dad8c8222 ]
Rewrite tests in ip6erspan_tunnel_xmit() and erspan_fb_xmit() to not assume transport header is set.
syzbot reported:
WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 skb_transport_header include/linux/skbuff.h:2911 [inline] WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963 Modules linked in: CPU: 0 PID: 1350 Comm: aoe_tx0 Not tainted 5.19.0-rc2-syzkaller-00160-g274295c6e53f #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 RIP: 0010:skb_transport_header include/linux/skbuff.h:2911 [inline] RIP: 0010:ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963 Code: 0f 47 f0 40 88 b5 7f fe ff ff e8 8c 16 4b f9 89 de bf ff ff ff ff e8 a0 12 4b f9 66 83 fb ff 0f 85 1d f1 ff ff e8 71 16 4b f9 <0f> 0b e9 43 f0 ff ff e8 65 16 4b f9 48 8d 85 30 ff ff ff ba 60 00 RSP: 0018:ffffc90005daf910 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 RDX: ffff88801f032100 RSI: ffffffff882e8d3f RDI: 0000000000000003 RBP: ffffc90005dafab8 R08: 0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000000 R12: ffff888024f21d40 R13: 000000000000a288 R14: 00000000000000b0 R15: ffff888025a2e000 FS: 0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2e425000 CR3: 000000006d099000 CR4: 0000000000152ef0 Call Trace: <TASK> __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one net/core/dev.c:3588 [inline] dev_hard_start_xmit+0x188/0x880 net/core/dev.c:3604 sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3815 [inline] __dev_queue_xmit+0x14a1/0x3900 net/core/dev.c:4219 dev_queue_xmit include/linux/netdevice.h:2994 [inline] tx+0x6a/0xc0 drivers/block/aoe/aoenet.c:63 kthread+0x1e7/0x3b0 drivers/block/aoe/aoecmd.c:1229 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK>
--- net/ipv4/ip_gre.c | 15 ++++++++++----- net/ipv6/ip6_gre.c | 15 ++++++++++----- 2 files changed, 20 insertions(+), 10 deletions(-)
net/ipv4/ip_gre.c +10 -5
@@ -524,7 +524,6 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)int tunnel_hlen;int version;int nhoff; -int thoff; tun_info =skb_tunnel_info (skb); if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) ||
@@ -558,10 +557,16 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev) (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff)) truncate = true; - thoff =skb_transport_header (skb) -skb_mac_header (skb); -if (skb->protocol ==htons (ETH_P_IPV6 ) && - (ntohs (ipv6_hdr (skb)->payload_len) > skb->len - thoff)) - truncate = true; +if (skb->protocol ==htons (ETH_P_IPV6 )) { +int thoff; + +if (skb_transport_header_was_set (skb)) + thoff =skb_transport_header (skb) -skb_mac_header (skb); +else + thoff = nhoff +sizeof (struct ipv6hdr ); +if (ntohs (ipv6_hdr (skb)->payload_len) > skb->len - thoff) + truncate = true; + }if (version ==1 ) { erspan_build_header(skb, ntohl(tunnel_id_to_key32(key->tun_id)),
net/ipv6/ip6_gre.c +10 -5
@@ -944,7 +944,6 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,__be16 proto;__u32 mtu;int nhoff; -int thoff;if (!pskb_inet_may_pull (skb)) goto tx_err;
@@ -965,10 +964,16 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff)) truncate = true; - thoff =skb_transport_header (skb) -skb_mac_header (skb); -if (skb->protocol ==htons (ETH_P_IPV6 ) && - (ntohs (ipv6_hdr (skb)->payload_len) > skb->len - thoff)) - truncate = true; +if (skb->protocol ==htons (ETH_P_IPV6 )) { +int thoff; + +if (skb_transport_header_was_set (skb)) + thoff =skb_transport_header (skb) -skb_mac_header (skb); +else + thoff = nhoff +sizeof (struct ipv6hdr ); +if (ntohs (ipv6_hdr (skb)->payload_len) > skb->len - thoff) + truncate = true; + }if (skb_cow_head (skb, dev->needed_headroom ?: t->hlen)) goto tx_err;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 62/135 net/tls: fix tls_sk_proto_close executed repeatedly
In reply to Greg Kroah-HartmanFrom: Ziyang Xuan <[email protected]>
[ Upstream commit 69135c572d1f84261a6de2a1268513a7e71753e2 ]
After setting the sock ktls, update ctx->sk_proto to sock->sk_prot by tls_update(), so now ctx->sk_proto->close is tls_sk_proto_close(). When close the sock, tls_sk_proto_close() is called for sock->sk_prot->close is tls_sk_proto_close(). But ctx->sk_proto->close() will be executed later in tls_sk_proto_close(). Thus tls_sk_proto_close() executed repeatedly occurred. That will trigger the following bug.
=================================================================
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 net/tls/tls_main.c:306 Call Trace: <TASK> tls_sk_proto_close+0x356/0xaf0 net/tls/tls_main.c:329 inet_release+0x12e/0x280 net/ipv4/af_inet.c:428 __sock_release+0xcd/0x280 net/socket.c:650 sock_close+0x18/0x20 net/socket.c:1365
Updating a proto which is same with sock->sk_prot is incorrect. Add proto and sock->sk_prot equality check at the head of tls_update() to fix it.
--- net/tls/tls_main.c | 3 +++ 1 file changed, 3 insertions(+)
net/tls/tls_main.c +3 -0
@@ -790,6 +790,9 @@ static void tls_update(struct sock *sk, struct proto *p, {struct tls_context *ctx; +if (sk->sk_prot == p) +return ; + ctx =tls_get_ctx (sk);if (likely (ctx)) { ctx->sk_write_space = write_space;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 63/135 udmabuf: add back sanity check
In reply to Greg Kroah-HartmanFrom: Gerd Hoffmann <[email protected]>
[ Upstream commit 05b252cccb2e5c3f56119d25de684b4f810ba40a ]
Check vm_fault->pgoff before using it. When we removed the warning, we also removed the check.
--- drivers/dma-buf/udmabuf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/dma-buf/udmabuf.c +4 -1
@@ -32,8 +32,11 @@ static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf) {struct vm_area_struct *vma = vmf->vma;struct udmabuf *ubuf = vma->vm_private_data; +pgoff_t pgoff = vmf->pgoff; - vmf->page = ubuf->pages[vmf->pgoff]; +if (pgoff >= ubuf->pagecount) +return VM_FAULT_SIGBUS ; + vmf->page = ubuf->pages[pgoff];get_page (vmf->page);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 64/135 selftests: netfilter: correct PKTGEN_SCRIPT_PATHS in nft_concat_range.sh
In reply to Greg Kroah-HartmanFrom: Jie2x Zhou <[email protected]>
[ Upstream commit 5d79d8af8dec58bf709b3124d09d9572edd9c617 ]
Before change:
make -C netfilter
TEST: performance
net,port [SKIP]
perf not supported
port,net [SKIP]
perf not supported
net6,port [SKIP]
perf not supported
port,proto [SKIP]
perf not supported
net6,port,mac [SKIP]
perf not supported
net6,port,mac,proto [SKIP]
perf not supported
net,mac [SKIP]
perf not supported
After change:
net,mac [ OK ]
baseline (drop from netdev hook): 2061098pps
baseline hash (non-ranged entries): 1606741pps
baseline rbtree (match on first field only): 1191607pps
set with 1000 full, ranged entries: 1639119ppsok 8 selftests: netfilter: nft_concat_range.sh
--- tools/testing/selftests/netfilter/nft_concat_range.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/netfilter/nft_concat_range.sh +1 -1
@@ -31,7 +31,7 @@ BUGS="flush_remove_add reload" # List of possible paths to pktgen script from kernel tree for performance tests PKTGEN_SCRIPT_PATHS=" - ../../../samples/pktgen/pktgen_bench_xmit_mode_netif_receive.sh + ../../../../samples/pktgen/pktgen_bench_xmit_mode_netif_receive.sh pktgen/pktgen_bench_xmit_mode_netif_receive.sh" # Definition of set types:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 65/135 xen-blkfront: Handle NULL gendisk
In reply to Greg Kroah-HartmanFrom: Jason Andryuk <[email protected]>
[ Upstream commit f9710c357e5bbf64d7ce45ba0bc75a52222491c1 ]
When a VBD is not fully created and then closed, the kernel can have a NULL pointer dereference:
The reproducer is trivial:
[user@dom0 ~]$ sudo xl block-attach work backend=sys-usb vdev=xvdi target=/dev/sdz [user@dom0 ~]$ xl block-list work
Vdev BE handle state evt-ch ring-ref BE-path 51712 0 241 4 -1 -1 /local/domain/0/backend/vbd/241/51712 51728 0 241 4 -1 -1 /local/domain/0/backend/vbd/241/51728 51744 0 241 4 -1 -1 /local/domain/0/backend/vbd/241/51744 51760 0 241 4 -1 -1 /local/domain/0/backend/vbd/241/51760 51840 3 241 3 -1 -1 /local/domain/3/backend/vbd/241/51840
^ note state, the /dev/sdz doesn't exist in the backend
[user@dom0 ~]$ sudo xl block-detach work xvdi
[user@dom0 ~]$ xl block-list work
Vdev BE handle state evt-ch ring-ref BE-path
work is an invalid domain identifier
And its console has:
BUG: kernel NULL pointer dereference, address: 0000000000000050 PGD 80000000edebb067 P4D 80000000edebb067 PUD edec2067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 52 Comm: xenwatch Not tainted 5.16.18-2.43.fc32.qubes.x86_64 #1 RIP: 0010:blk_mq_stop_hw_queues+0x5/0x40 Code: 00 48 83 e0 fd 83 c3 01 48 89 85 a8 00 00 00 41 39 5c 24 50 77 c0 5b 5d 41 5c 41 5d c3 c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 <8b> 47 50 85 c0 74 32 41 54 49 89 fc 55 53 31 db 49 8b 44 24 48 48 RSP: 0018:ffffc90000bcfe98 EFLAGS: 00010293 RAX: ffffffffc0008370 RBX: 0000000000000005 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000000 RBP: ffff88800775f000 R08: 0000000000000001 R09: ffff888006e620b8 R10: ffff888006e620b0 R11: f000000000000000 R12: ffff8880bff39000 R13: ffff8880bff39000 R14: 0000000000000000 R15: ffff88800604be00 FS: 0000000000000000(0000) GS:ffff8880f3300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000050 CR3: 00000000e932e002 CR4: 00000000003706e0 Call Trace: <TASK> blkback_changed+0x95/0x137 [xen_blkfront] ? read_reply+0x160/0x160 xenwatch_thread+0xc0/0x1a0 ? do_wait_intr_irq+0xa0/0xa0 kthread+0x16b/0x190 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 </TASK> Modules linked in: snd_seq_dummy snd_hrtimer snd_seq snd_seq_device snd_timer snd soundcore ipt_REJECT nf_reject_ipv4 xt_state xt_conntrack nft_counter nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat nf_tables nfnetlink intel_rapl_msr intel_rapl_common crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel xen_netfront pcspkr xen_scsiback target_core_mod xen_netback xen_privcmd xen_gntdev xen_gntalloc xen_blkback xen_evtchn ipmi_devintf ipmi_msghandler fuse bpf_preload ip_tables overlay xen_blkfront CR2: 0000000000000050 ---[ end trace 7bc9597fd06ae89d ]--- RIP: 0010:blk_mq_stop_hw_queues+0x5/0x40 Code: 00 48 83 e0 fd 83 c3 01 48 89 85 a8 00 00 00 41 39 5c 24 50 77 c0 5b 5d 41 5c 41 5d c3 c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 <8b> 47 50 85 c0 74 32 41 54 49 89 fc 55 53 31 db 49 8b 44 24 48 48 RSP: 0018:ffffc90000bcfe98 EFLAGS: 00010293 RAX: ffffffffc0008370 RBX: 0000000000000005 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000000 RBP: ffff88800775f000 R08: 0000000000000001 R09: ffff888006e620b8 R10: ffff888006e620b0 R11: f000000000000000 R12: ffff8880bff39000 R13: ffff8880bff39000 R14: 0000000000000000 R15: ffff88800604be00 FS: 0000000000000000(0000) GS:ffff8880f3300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000050 CR3: 00000000e932e002 CR4: 00000000003706e0 Kernel panic - not syncing: Fatal exception
Kernel Offset: disabled
info->rq and info->gd are only set in blkfront_connect(), which is called for state 4 (XenbusStateConnected). Guard against using NULL variables in blkfront_closing() to avoid the issue.
The rest of blkfront_closing looks okay. If info->nr_rings is 0, then for_each_rinfo won't do anything.
blkfront_remove also needs to check for non-NULL pointers before cleaning up the gendisk and request queue.
--- drivers/block/xen-blkfront.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
drivers/block/xen-blkfront.c +12 -7
@@ -2140,9 +2140,11 @@ static void blkfront_closing(struct blkfront_info *info)return ;/* No more blkif_request(). */ -blk_mq_stop_hw_queues (info->rq); -blk_mark_disk_dead (info->gd); -set_capacity (info->gd,0 ); +if (info->rq && info->gd) { +blk_mq_stop_hw_queues (info->rq); +blk_mark_disk_dead (info->gd); +set_capacity (info->gd,0 ); + }for_each_rinfo (info, rinfo, i) {/* No more gnttab callback work. */
@@ -2478,16 +2480,19 @@ static int blkfront_remove(struct xenbus_device *xbdev)dev_dbg (&xbdev->dev,"%s removed" , xbdev->nodename); -del_gendisk (info->gd); +if (info->gd) +del_gendisk (info->gd);mutex_lock (&blkfront_mutex);list_del (&info->info_list);mutex_unlock (&blkfront_mutex);blkif_free (info,0 ); -xlbd_release_minors (info->gd->first_minor, info->gd->minors); -blk_cleanup_disk (info->gd); -blk_mq_free_tag_set (&info->tag_set); +if (info->gd) { +xlbd_release_minors (info->gd->first_minor, info->gd->minors); +blk_cleanup_disk (info->gd); +blk_mq_free_tag_set (&info->tag_set); + }kfree (info);return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 66/135 x86/xen: Remove undefined behavior in setup_features()
In reply to Greg Kroah-HartmanFrom: Julien Grall <[email protected]>
[ Upstream commit ecb6237fa397b7b810d798ad19322eca466dbab1 ]
1 << 31 is undefined. So switch to 1U << 31.
--- drivers/xen/features.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/xen/features.c +1 -1
@@ -42,7 +42,7 @@ void xen_setup_features(void)if (HYPERVISOR_xen_version (XENVER_get_features, &fi) <0 )break ;for (j =0 ; j <32 ; j++) - xen_features[i *32 + j] = !!(fi.submap &1 <<j); + xen_features[i *32 + j] = !!(fi.submap &1U << j); }if (xen_pv_domain ()) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 67/135 MIPS: Remove repetitive increase irq_err_count
In reply to Greg Kroah-HartmanFrom: huhai <[email protected]>
[ Upstream commit c81aba8fde2aee4f5778ebab3a1d51bd2ef48e4c ]
commit 979934da9e7a ("[PATCH] mips: update IRQ handling for vr41xx") added a function irq_dispatch, and it'll increase irq_err_count when the get_irq callback returns a negative value, but increase irq_err_count in get_irq was not removed.
And also, modpost complains once gpio-vr41xx drivers become modules.
ERROR: modpost: "irq_err_count" [drivers/gpio/gpio-vr41xx.ko] undefined!
So it would be a good idea to remove repetitive increase irq_err_count in get_irq callback.
--- arch/mips/vr41xx/common/icu.c | 2 -- drivers/gpio/gpio-vr41xx.c | 2 -- 2 files changed, 4 deletions(-)
arch/mips/vr41xx/common/icu.c +0 -2
@@ -640,8 +640,6 @@ static int icu_get_irq(unsigned int irq)printk (KERN_ERR "spurious ICU interrupt: %04x,%04x\n" , pend1, pend2); -atomic_inc (&irq_err_count); -return -1 ; }
drivers/gpio/gpio-vr41xx.c +0 -2
@@ -217,8 +217,6 @@ static int giu_get_irq(unsigned int irq)printk (KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n" , maskl, pendl, maskh, pendh); -atomic_inc (&irq_err_count); -return -EINVAL ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 68/135 afs: Fix dynamic root getattr
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit cb78d1b5efffe4cf97e16766329dd7358aed3deb ]
The recent patch to make afs_getattr consult the server didn't account for the pseudo-inodes employed by the dynamic root-type afs superblock not having a volume or a server to access, and thus an oops occurs if such a directory is stat'd.
Fix this by checking to see if the vnode->volume pointer actually points anywhere before following it in afs_getattr().
This can be tested by stat'ing a directory in /afs. It may be sufficient just to do "ls /afs" and the oops looks something like:
BUG: kernel NULL pointer dereference, address: 0000000000000020
...
RIP: 0010:afs_getattr+0x8b/0x14b
...
Call Trace:
<TASK>
vfs_statx+0x79/0xf5
vfs_fstatat+0x49/0x62--- fs/afs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/afs/inode.c +2 -1
@@ -733,7 +733,8 @@ int afs_getattr(struct user_namespace *mnt_userns, const struct path *path,_enter ("{ ino=%lu v=%u }" , inode->i_ino, inode->i_generation); -if (!(query_flags &AT_STATX_DONT_SYNC ) && +if (vnode->volume && + !(query_flags &AT_STATX_DONT_SYNC ) && !test_bit (AFS_VNODE_CB_PROMISED , &vnode->flags)) { key =afs_request_key (vnode->volume->cell);if (IS_ERR (key))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 69/135 ice: ethtool: advertise 1000M speeds properly
In reply to Greg Kroah-HartmanFrom: Anatolii Gerasymenko <[email protected]>
[ Upstream commit c3d184c83ff4b80167e34edfc3d21df424bf27ff ]
In current implementation ice_update_phy_type enables all link modes for selected speed. This approach doesn't work for 1000M speeds, because both copper (1000baseT) and optical (1000baseX) standards cannot be enabled at once.
Fix this, by adding the function ice_set_phy_type_from_speed() for 1000M speeds.
--- drivers/net/ethernet/intel/ice/ice_ethtool.c | 39 +++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_ethtool.c +38 -1
@@ -2150,6 +2150,42 @@ ice_setup_autoneg(struct ice_port_info *p, struct ethtool_link_ksettings *ks,return err; } +/** +* ice_set_phy_type_from_speed - set phy_types based on speeds +* and advertised modes +* @ks: ethtool link ksettings struct +* @phy_type_low: pointer to the lower part of phy_type +* @phy_type_high: pointer to the higher part of phy_type +* @adv_link_speed: targeted link speeds bitmap +*/ +static void +ice_set_phy_type_from_speed (const struct ethtool_link_ksettings *ks, +u64 *phy_type_low,u64 *phy_type_high, +u16 adv_link_speed) +{ +/* Handle 1000M speed in a special way because ice_update_phy_type +* enables all link modes, but having mixed copper and optical +* standards is not supported. +*/ + adv_link_speed &= ~ICE_AQ_LINK_SPEED_1000MB ; + +if (ethtool_link_ksettings_test_link_mode (ks, advertising, + 1000baseT_Full)) + *phy_type_low |=ICE_PHY_TYPE_LOW_1000BASE_T | +ICE_PHY_TYPE_LOW_1G_SGMII ; + +if (ethtool_link_ksettings_test_link_mode (ks, advertising, + 1000baseKX_Full)) + *phy_type_low |=ICE_PHY_TYPE_LOW_1000BASE_KX ; + +if (ethtool_link_ksettings_test_link_mode (ks, advertising, + 1000baseX_Full)) + *phy_type_low |=ICE_PHY_TYPE_LOW_1000BASE_SX | +ICE_PHY_TYPE_LOW_1000BASE_LX ; + +ice_update_phy_type (phy_type_low, phy_type_high, adv_link_speed); +} +/** * ice_set_link_ksettings - Set Speed and Duplex * @netdev: network interface device structure
@@ -2286,7 +2322,8 @@ ice_set_link_ksettings(struct net_device *netdev, adv_link_speed = curr_link_speed;/* Convert the advertise link speeds to their corresponded PHY_TYPE */ -ice_update_phy_type (&phy_type_low, &phy_type_high, adv_link_speed); +ice_set_phy_type_from_speed (ks, &phy_type_low, &phy_type_high, + adv_link_speed);if (!autoneg_changed && adv_link_speed == curr_link_speed) {netdev_info (netdev,"Nothing changed, exiting without setting anything.\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 70/135 regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips
In reply to Greg Kroah-HartmanFrom: Aidan MacDonald <[email protected]>
[ Upstream commit 485037ae9a095491beb7f893c909a76cc4f9d1e7 ]
When enabling a type_in_mask irq, the type_buf contents must be AND'd with the mask of the IRQ we're enabling to avoid enabling other IRQs by accident, which can happen if several type_in_mask irqs share a mask register.
--- drivers/base/regmap/regmap-irq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/base/regmap/regmap-irq.c +3 -2
@@ -252,6 +252,7 @@ static void regmap_irq_enable(struct irq_data *data)struct regmap_irq_chip_data *d =irq_data_get_irq_chip_data (data);struct regmap *map = d->map;const struct regmap_irq *irq_data =irq_to_regmap_irq (d, data->hwirq); +unsigned int reg = irq_data->reg_offset / map->reg_stride;unsigned int mask, type; type = irq_data->type.type_falling_val | irq_data->type.type_rising_val;
@@ -268,14 +269,14 @@ static void regmap_irq_enable(struct irq_data *data)* at the corresponding offset in regmap_irq_set_type(). */ if (d->chip->type_in_mask && type) - mask = d->type_buf[irq_data->reg_offset / map->reg_stride]; + mask = d->type_buf[reg] & irq_data->mask;else mask = irq_data->mask;if (d->chip->clear_on_unmask) d->clear_status = true; - d->mask_buf[irq_data->reg_offset / map->reg_stride] &= ~mask; + d->mask_buf[reg] &= ~mask; }static void regmap_irq_disable (struct irq_data *data)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 71/135 regmap-irq: Fix offset/index mismatch in read_sub_irq_data()
In reply to Greg Kroah-HartmanFrom: Aidan MacDonald <[email protected]>
[ Upstream commit 3f05010f243be06478a9b11cfce0ce994f5a0890 ]
We need to divide the sub-irq status register offset by register stride to get an index for the status buffer to avoid an out of bounds write when the register stride is greater than 1.
--- drivers/base/regmap/regmap-irq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/base/regmap/regmap-irq.c +2 -1
@@ -387,6 +387,7 @@ static inline int read_sub_irq_data(struct regmap_irq_chip_data *data, subreg = &chip->sub_reg_offsets[b];for (i =0 ; i < subreg->num_regs; i++) {unsigned int offset = subreg->offset[i]; +unsigned int index = offset / map->reg_stride;if (chip->not_fixed_stride) ret = regmap_read(map,
@@ -395,7 +396,7 @@ static inline int read_sub_irq_data(struct regmap_irq_chip_data *data,else ret =regmap_read (map, chip->status_base + offset, - &data->status_buf[offset]); + &data->status_buf[index]);if (ret)break ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 72/135 igb: Make DMA faster when CPU is active on the PCIe link
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit 4e0effd9007ea0be31f7488611eb3824b4541554 ]
Intel I210 on some Intel Alder Lake platforms can only achieve ~750Mbps Tx speed via iperf. The RR2DCDELAY shows around 0x2xxx DMA delay, which will be significantly lower when 1) ASPM is disabled or 2) SoC package c-state stays above PC3. When the RR2DCDELAY is around 0x1xxx the Tx speed can reach to ~950Mbps.
According to the I210 datasheet "8.26.1 PCIe Misc. Register - PCIEMISC", "DMA Idle Indication" doesn't seem to tie to DMA coalesce anymore, so set it to 1b for "DMA is considered idle when there is no Rx or Tx AND when there are no TLPs indicating that CPU is active detected on the PCIe link (such as the host executes CSR or Configuration register read or write operation)" and performing Tx should also fall under "active CPU on PCIe link" case.
In addition to that, commit b6e0c419f040 ("igb: Move DMA Coalescing init code to separate function.") seems to wrongly changed from enabling E1000_PCIEMISC_LX_DECISION to disabling it, also fix that.
--- drivers/net/ethernet/intel/igb/igb_main.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/igb/igb_main.c +5 -7
@@ -9823,11 +9823,10 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba)struct e1000_hw *hw = &adapter->hw;u32 dmac_thr;u16 hwm; +u32 reg;if (hw->mac.type > e1000_82580) {if (adapter->flags &IGB_FLAG_DMAC ) { -u32 reg; -/* force threshold to 0. */ wr32 (E1000_DMCTXTH ,0 );
@@ -9860,7 +9859,6 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba)/* Disable BMC-to-OS Watchdog Enable */ if (hw->mac.type != e1000_i354) reg &= ~E1000_DMACR_DC_BMC2OSW_EN ; -wr32 (E1000_DMACR , reg);/* no lower threshold to disable
@@ -9877,12 +9875,12 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba)*/ wr32 (E1000_DMCTXTH , (IGB_MIN_TXPBSIZE - (IGB_TX_BUF_4096 + adapter->max_frame_size)) >>6 ); + } -/* make low power state decision controlled -* by DMA coal -*/ +if (hw->mac.type >= e1000_i210 || + (adapter->flags &IGB_FLAG_DMAC )) { reg =rd32 (E1000_PCIEMISC ); - reg &= ~E1000_PCIEMISC_LX_DECISION ; + reg |=E1000_PCIEMISC_LX_DECISION ;wr32 (E1000_PCIEMISC , reg); }/* endif adapter->dmac is not disabled */ }else if (hw->mac.type == e1000_82580) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 73/135 virtio_net: fix xdp_rxq_info bug after suspend/resume
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
[ Upstream commit 8af52fe9fd3bf5e7478da99193c0632276e1dfce ]
The following sequence currently causes a driver bug warning when using virtio_net:
# ip link set eth0 up # echo mem > /sys/power/state (or e.g. # rtcwake -s 10 -m mem) <resume> # ip link set eth0 down
Missing register, driver bug
WARNING: CPU: 0 PID: 375 at net/core/xdp.c:138 xdp_rxq_info_unreg+0x58/0x60 Call trace: xdp_rxq_info_unreg+0x58/0x60 virtnet_close+0x58/0xac __dev_close_many+0xac/0x140 __dev_change_flags+0xd8/0x210 dev_change_flags+0x24/0x64 do_setlink+0x230/0xdd0 ...
This happens because virtnet_freeze() frees the receive_queue completely (including struct xdp_rxq_info) but does not call xdp_rxq_info_unreg(). Similarly, virtnet_restore() sets up the receive_queue again but does not call xdp_rxq_info_reg().
Actually, parts of virtnet_freeze_down() and virtnet_restore_up() are almost identical to virtnet_close() and virtnet_open(): only the calls to xdp_rxq_info_(un)reg() are missing. This means that we can fix this easily and avoid such problems in the future by just calling virtnet_close()/open() from the freeze/restore handlers.
Aside from adding the missing xdp_rxq_info calls the only difference is that the refill work is only cancelled if netif_running(). However, this should not make any functional difference since the refill work should only be active if the network interface is actually up.
--- drivers/net/virtio_net.c | 25 ++++++------------------- 1 file changed, 6 insertions(+), 19 deletions(-)
drivers/net/virtio_net.c +6 -19
@@ -2431,7 +2431,6 @@ static const struct ethtool_ops virtnet_ethtool_ops = {static void virtnet_freeze_down (struct virtio_device *vdev) {struct virtnet_info *vi = vdev->priv; -int i;/* Make sure no work handler is accessing the device */ flush_work (&vi->config_work);
@@ -2439,14 +2438,8 @@ static void virtnet_freeze_down(struct virtio_device *vdev)netif_tx_lock_bh (vi->dev);netif_device_detach (vi->dev);netif_tx_unlock_bh (vi->dev); -cancel_delayed_work_sync (&vi->refill); - -if (netif_running (vi->dev)) { -for (i =0 ; i < vi->max_queue_pairs; i++) { -napi_disable (&vi->rq[i].napi); -virtnet_napi_tx_disable (&vi->sq[i].napi); - } - } +if (netif_running (vi->dev)) +virtnet_close (vi->dev); }static int init_vqs (struct virtnet_info *vi);
@@ -2454,7 +2447,7 @@ static int init_vqs(struct virtnet_info *vi);static int virtnet_restore_up (struct virtio_device *vdev) {struct virtnet_info *vi = vdev->priv; -int err, i; +int err; err =init_vqs (vi);if (err)
@@ -2463,15 +2456,9 @@ static int virtnet_restore_up(struct virtio_device *vdev)virtio_device_ready (vdev);if (netif_running (vi->dev)) { -for (i =0 ; i < vi->curr_queue_pairs; i++) -if (!try_fill_recv (vi, &vi->rq[i],GFP_KERNEL )) -schedule_delayed_work (&vi->refill,0 ); - -for (i =0 ; i < vi->max_queue_pairs; i++) { -virtnet_napi_enable (vi->rq[i].vq, &vi->rq[i].napi); -virtnet_napi_tx_enable (vi, vi->sq[i].vq, - &vi->sq[i].napi); - } + err =virtnet_open (vi->dev); +if (err) +return err; }netif_tx_lock_bh (vi->dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 74/135 Revert "net/tls: fix tls_sk_proto_close executed repeatedly"
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit 1b205d948fbb06a7613d87dcea0ff5fd8a08ed91 ]
This reverts commit 69135c572d1f84261a6de2a1268513a7e71753e2.
This commit was just papering over the issue, ULP should not get ->update() called with its own sk_prot. Each ULP would need to add this check.
--- net/tls/tls_main.c | 3 --- 1 file changed, 3 deletions(-)
net/tls/tls_main.c +0 -3
@@ -790,9 +790,6 @@ static void tls_update(struct sock *sk, struct proto *p, {struct tls_context *ctx; -if (sk->sk_prot == p) -return ; - ctx =tls_get_ctx (sk);if (likely (ctx)) { ctx->sk_write_space = write_space;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 75/135 sock: redo the psock vs ULP protection check
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit e34a07c0ae3906f97eb18df50902e2a01c1015b6 ]
Commit 8a59f9d1e3d4 ("sock: Introduce sk->sk_prot->psock_update_sk_prot()") has moved the inet_csk_has_ulp(sk) check from sk_psock_init() to the new tcp_bpf_update_proto() function. I'm guessing that this was done to allow creating psocks for non-inet sockets.
Unfortunately the destruction path for psock includes the ULP unwind, so we need to fail the sk_psock_init() itself. Otherwise if ULP is already present we'll notice that later, and call tcp_update_ulp() with the sk_proto of the ULP itself, which will most likely result in the ULP looping its callbacks.
--- include/net/inet_sock.h | 5 +++++ net/core/skmsg.c | 5 +++++ net/ipv4/tcp_bpf.c | 3 --- net/tls/tls_main.c | 2 ++ 4 files changed, 12 insertions(+), 3 deletions(-)
include/net/inet_sock.h +5 -0
@@ -252,6 +252,11 @@ struct inet_sock {#define IP_CMSG_CHECKSUM BIT(7)#define IP_CMSG_RECVFRAGSIZE BIT(8) +static inline bool sk_is_inet (struct sock *sk) +{ +return sk->sk_family ==AF_INET || sk->sk_family ==AF_INET6 ; +} +/** * sk_to_full_sk - Access to a full socket * @sk: pointer to a socket
net/core/skmsg.c +5 -0
@@ -695,6 +695,11 @@ struct sk_psock *sk_psock_init(struct sock *sk, int node)write_lock_bh (&sk->sk_callback_lock); +if (sk_is_inet (sk) &&inet_csk_has_ulp (sk)) { + psock =ERR_PTR (-EINVAL ); + goto out; + } +if (sk->sk_user_data) { psock =ERR_PTR (-EBUSY ); goto out;
net/ipv4/tcp_bpf.c +0 -3
@@ -612,9 +612,6 @@ int tcp_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore)return 0 ; } -if (inet_csk_has_ulp (sk)) -return -EINVAL ; -if (sk->sk_family ==AF_INET6 ) {if (tcp_bpf_assert_proto_ops (psock->sk_proto))return -EINVAL ;
net/tls/tls_main.c +2 -0
@@ -790,6 +790,8 @@ static void tls_update(struct sock *sk, struct proto *p, {struct tls_context *ctx; +WARN_ON_ONCE (sk->sk_prot == p); + ctx =tls_get_ctx (sk);if (likely (ctx)) { ctx->sk_write_space = write_space;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 76/135 nvme-pci: add NO APST quirk for Kioxia device
In reply to Greg Kroah-HartmanFrom: Enzo Matsumiya <[email protected]>
[ Upstream commit 5a6254d55e2a9f7919ead8580d7aa0c7a382b26a ]
This particular Kioxia device times out and aborts I/O during any load, but it's more easily observable with discards (fstrim).
The device gets to a state that is also not possible to use "nvme set-feature" to disable APST.
Booting with nvme_core.default_ps_max_latency=0 solves the issue.
We had a dozen or so of these devices behaving this same way in customer environments.
--- drivers/nvme/host/core.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/nvme/host/core.c +14 -0
@@ -2475,6 +2475,20 @@ static const struct nvme_core_quirk_entry core_quirks[] = { .vid = 0x14a4, .fr = "22301111", .quirks = NVME_QUIRK_SIMPLE_SUSPEND, + }, + { +/* +* This Kioxia CD6-V Series / HPE PE8030 device times out and +* aborts I/O during any load, but more easily reproducible +* with discards (fstrim). +* +* The device is left in a state where it is also not possible +* to use "nvme set-feature" to disable APST, but booting with +* nvme_core.default_ps_max_latency=0 works. +*/ + .vid = 0x1e0f, + .mn = "KCD6XVUL6T40", + .quirks = NVME_QUIRK_NO_APST, } };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 77/135 nvme: move the Samsung X5 quirk entry to the core quirks
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit e6487833182a8a0187f0292aca542fc163ccd03e ]
This device shares the PCI ID with the Samsung 970 Evo Plus that does not need or want the quirks. Move the the quirk entry to the core table based on the model number instead.
--- drivers/nvme/host/core.c | 14 ++++++++++++++ drivers/nvme/host/pci.c | 4 ---- 2 files changed, 14 insertions(+), 4 deletions(-)
drivers/nvme/host/core.c +14 -0
@@ -2489,6 +2489,20 @@ static const struct nvme_core_quirk_entry core_quirks[] = { .vid = 0x1e0f, .mn = "KCD6XVUL6T40", .quirks = NVME_QUIRK_NO_APST, + }, + { +/* +* The external Samsung X5 SSD fails initialization without a +* delay before checking if it is ready and has a whole set of +* other problems. To make this even more interesting, it +* shares the PCI ID with internal Samsung 970 Evo Plus that +* does not need or want these quirks. +*/ + .vid = 0x144d, + .mn = "Samsung Portable SSD X5", + .quirks = NVME_QUIRK_DELAY_BEFORE_CHK_RDY | + NVME_QUIRK_NO_DEEPEST_PS | + NVME_QUIRK_IGNORE_DEV_SUBNQN, } };
drivers/nvme/host/pci.c +0 -4
@@ -3380,10 +3380,6 @@ static const struct pci_device_id nvme_id_table[] = { NVME_QUIRK_128_BYTES_SQES | NVME_QUIRK_SHARED_TAGS | NVME_QUIRK_SKIP_CID_GEN }, - { PCI_DEVICE(0x144d, 0xa808), /* Samsung X5 */ - .driver_data =NVME_QUIRK_DELAY_BEFORE_CHK_RDY | -NVME_QUIRK_NO_DEEPEST_PS | - NVME_QUIRK_IGNORE_DEV_SUBNQN, }, { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) }, { 0, } };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 78/135 gpio: winbond: Fix error code in winbond_gpio_get()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 9ca766eaea2e87b8b773bff04ee56c055cb76d4e ]
This error path returns 1, but it should instead propagate the negative error code from winbond_sio_enter().
--- drivers/gpio/gpio-winbond.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpio/gpio-winbond.c +4 -3
@@ -385,12 +385,13 @@ static int winbond_gpio_get(struct gpio_chip *gc, unsigned int offset)unsigned long *base =gpiochip_get_data (gc);const struct winbond_gpio_info *info;bool val; +int ret;winbond_gpio_get_info (&offset, &info); - val =winbond_sio_enter (*base); -if (val) -return val; + ret =winbond_sio_enter (*base); +if (ret) +return ret;winbond_sio_select_logical (*base, info->dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 79/135 s390/cpumf: Handle events cycles and instructions identical
In reply to Greg Kroah-HartmanFrom: Thomas Richter <[email protected]>
[ Upstream commit be857b7f77d130dbbd47c91fc35198b040f35865 ]
Events CPU_CYCLES and INSTRUCTIONS can be submitted with two different perf_event attribute::type values:
- PERF_TYPE_HARDWARE: when invoked via perf tool predefined events name cycles or cpu-cycles or instructions.
- pmu->type: when invoked via perf tool event name cpu_cf/CPU_CYLCES/ or cpu_cf/INSTRUCTIONS/. This invocation also selects the PMU to which the event belongs.
Handle both type of invocations identical for events CPU_CYLCES and INSTRUCTIONS. They address the same hardware.
The result is different when event modifier exclude_kernel is also set. Invocation with event modifier for user space event counting fails.
Output before:
# perf stat -e cpum_cf/cpu_cycles/u -- true
Performance counter stats for 'true':
<not supported> cpum_cf/cpu_cycles/u
0.000761033 seconds time elapsed
0.000076000 seconds user
0.000725000 seconds sys#
Output after:
# perf stat -e cpum_cf/cpu_cycles/u -- true
Performance counter stats for 'true':
349,613 cpum_cf/cpu_cycles/u
0.000844143 seconds time elapsed
0.000079000 seconds user
0.000800000 seconds sys#
--- arch/s390/kernel/perf_cpum_cf.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-)
arch/s390/kernel/perf_cpum_cf.c +21 -1
@@ -516,6 +516,26 @@ static int __hw_perf_event_init(struct perf_event *event, unsigned int type)return err; } +/* Events CPU_CYLCES and INSTRUCTIONS can be submitted with two different +* attribute::type values: +* - PERF_TYPE_HARDWARE: +* - pmu->type: +* Handle both type of invocations identical. They address the same hardware. +* The result is different when event modifiers exclude_kernel and/or +* exclude_user are also set. +*/ +static int cpumf_pmu_event_type (struct perf_event *event) +{ +u64 ev = event->attr.config; + +if (cpumf_generic_events_basic[PERF_COUNT_HW_CPU_CYCLES ] == ev || + cpumf_generic_events_basic[PERF_COUNT_HW_INSTRUCTIONS ] == ev || + cpumf_generic_events_user[PERF_COUNT_HW_CPU_CYCLES ] == ev || + cpumf_generic_events_user[PERF_COUNT_HW_INSTRUCTIONS ] == ev) +return PERF_TYPE_HARDWARE ; +return PERF_TYPE_RAW ; +} +static int cpumf_pmu_event_init (struct perf_event *event) {unsigned int type = event->attr.type;
@@ -525,7 +545,7 @@ static int cpumf_pmu_event_init(struct perf_event *event) err =__hw_perf_event_init (event, type); else if (event->pmu->type == type)/* Registered as unknown PMU */ - err =__hw_perf_event_init (event,PERF_TYPE_RAW ); + err =__hw_perf_event_init (event,cpumf_pmu_event_type (event)); else return -ENOENT;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 80/135 iio: mma8452: fix probe fail when device tree compatible is used.
In reply to Greg Kroah-HartmanFrom: Haibo Chen <[email protected]>
[ Upstream commit fe18894930a025617114aa8ca0adbf94d5bffe89 ]
Correct the logic for the probe. First check of_match_table, if not meet, then check i2c_driver.id_table. If both not meet, then return fail.
--- drivers/iio/accel/mma8452.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/iio/accel/mma8452.c +7 -5
@@ -1539,11 +1539,13 @@ static int mma8452_probe(struct i2c_client *client,mutex_init (&data->lock); data->chip_info =device_get_match_data (&client->dev); -if (!data->chip_info && id) { - data->chip_info = &mma_chip_info_table[id->driver_data]; - }else { -dev_err (&client->dev,"unknown device model\n" ); -return -ENODEV ; +if (!data->chip_info) { +if (id) { + data->chip_info = &mma_chip_info_table[id->driver_data]; + }else { +dev_err (&client->dev,"unknown device model\n" ); +return -ENODEV ; + } } data->vdd_reg =devm_regulator_get (&client->dev,"vdd" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 81/135 iio: magnetometer: yas530: Fix memchr_inv() misuse
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
[ Upstream commit bb52d3691db8cf24cea049235223f3599778f264 ]
The call to check if the calibration is all zeroes is doing it wrong: memchr_inv() returns NULL if the the calibration contains all zeroes, but the check is for != NULL.
Fix it up. It's probably not an urgent fix because the inner check for BIT(7) in data[13] will save us. But fix it.
--- drivers/iio/magnetometer/yamaha-yas530.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/magnetometer/yamaha-yas530.c +1 -1
@@ -639,7 +639,7 @@ static int yas532_get_calibration_data(struct yas5xx *yas5xx)dev_dbg (yas5xx->dev,"calibration data: %*ph\n" ,14 , data);/* Sanity check, is this all zeroes? */ -if (memchr_inv (data,0x00 ,13 )) { +if (memchr_inv (data,0x00 ,13 ) ==NULL ) {if (!(data[13 ] &BIT (7 )))dev_warn (yas5xx->dev,"calibration is blank!\n" ); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 82/135 iio: adc: vf610: fix conversion mode sysfs node name
In reply to Greg Kroah-HartmanFrom: Baruch Siach <[email protected]>
[ Upstream commit f1a633b15cd5371a2a83f02c513984e51132dd68 ]
The documentation missed the "in_" prefix for this IIO_SHARED_BY_DIR entry.
--- Documentation/ABI/testing/sysfs-bus-iio-vf610 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/ABI/testing/sysfs-bus-iio-vf610 +1 -1
@@ -1,4 +1,4 @@ -What: /sys/bus/iio/devices/iio:deviceX/conversion_mode +What: /sys/bus/iio/devices/iio:deviceX/in_conversion_mode KernelVersion: 4.2 Contact: [email protected] Description:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 83/135 usb: typec: wcove: Drop wrong dependency to INTEL_SOC_PMIC
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 9ef165406308515dcf2e3f6e97b39a1c56d86db5 ]
Intel SoC PMIC is a generic name for all PMICs that are used on Intel platforms. In particular, INTEL_SOC_PMIC kernel configuration option refers to Crystal Cove PMIC, which has never been a part of any Intel Broxton hardware. Drop wrong dependency from Kconfig.
Note, the correct dependency is satisfied via ACPI PMIC OpRegion driver, which the Type-C depends on.
--- drivers/usb/typec/tcpm/Kconfig | 1 - 1 file changed, 1 deletion(-)
drivers/usb/typec/tcpm/Kconfig +0 -1
@@ -56,7 +56,6 @@ config TYPEC_WCOVE tristate "Intel WhiskeyCove PMIC USB Type-C PHY driver" depends on ACPI depends on MFD_INTEL_PMC_BXT - depends on INTEL_SOC_PMIC depends on BXT_WC_PMIC_OPREGION help This driver adds support for USB Type-C on Intel Broxton platforms
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 84/135 xhci: turn off port power in shutdown
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 83810f84ecf11dfc5a9414a8b762c3501b328185 upstream.
If ports are not turned off in shutdown then runtime suspended self-powered USB devices may survive in U3 link state over S5.
During subsequent boot, if firmware sends an IPC command to program the port in DISCONNECT state, it will time out, causing significant delay in the boot time.
Turning off roothub port power is also recommended in xhci specification 4.19.4 "Port Power" in the additional note.
--- drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci.c | 15 +++++++++++++-- drivers/usb/host/xhci.h | 2 ++ 3 files changed, 16 insertions(+), 3 deletions(-)
drivers/usb/host/xhci-hub.c +1 -1
@@ -652,7 +652,7 @@ struct xhci_hub *xhci_get_rhub(struct us* It will release and re-aquire the lock while calling ACPI * method. */ -static void xhci_set_port_power (struct xhci_hcd *xhci,struct usb_hcd *hcd, +void xhci_set_port_power (struct xhci_hcd *xhci,struct usb_hcd *hcd,u16 index,bool on,unsigned long *flags) __must_hold(&xhci->lock) {
drivers/usb/host/xhci.c +13 -2
@@ -774,6 +774,8 @@ static void xhci_stop(struct usb_hcd *hcvoid xhci_shutdown (struct usb_hcd *hcd) {struct xhci_hcd *xhci =hcd_to_xhci (hcd); +unsigned long flags; +int i;if (xhci->quirks &XHCI_SPURIOUS_REBOOT )usb_disable_xhci_ports (to_pci_dev (hcd->self.sysdev));
@@ -789,12 +791,21 @@ void xhci_shutdown(struct usb_hcd *hcd)del_timer_sync (&xhci->shared_hcd->rh_timer); } -spin_lock_irq (&xhci->lock); +spin_lock_irqsave (&xhci->lock, flags);xhci_halt (xhci); + +/* Power off USB2 ports*/ +for (i =0 ; i < xhci->usb2_rhub.num_ports; i++) +xhci_set_port_power (xhci, xhci->main_hcd, i, false, &flags); + +/* Power off USB3 ports*/ +for (i =0 ; i < xhci->usb3_rhub.num_ports; i++) +xhci_set_port_power (xhci, xhci->shared_hcd, i, false, &flags); +/* Workaround for spurious wakeups at shutdown with HSW */ if (xhci->quirks &XHCI_SPURIOUS_WAKEUP )xhci_reset (xhci,XHCI_RESET_SHORT_USEC ); -spin_unlock_irq (&xhci->lock); +spin_unlock_irqrestore (&xhci->lock, flags);xhci_cleanup_msix (xhci);
drivers/usb/host/xhci.h +2 -0
@@ -2174,6 +2174,8 @@ int xhci_hub_control(struct usb_hcd *hcdint xhci_hub_status_data (struct usb_hcd *hcd,char *buf);int xhci_find_raw_port_number (struct usb_hcd *hcd,int port1);struct xhci_hub *xhci_get_rhub (struct usb_hcd *hcd); +void xhci_set_port_power (struct xhci_hcd *xhci,struct usb_hcd *hcd,u16 index, +bool on,unsigned long *flags);void xhci_hc_died (struct xhci_hcd *xhci);
Greg Kroah-Hartman
maintainerPATCH 85/135 xhci-pci: Allow host runtime PM as default for Intel Raptor Lake xHCI
In reply to Greg Kroah-HartmanFrom: Tanveer Alam <[email protected]>
commit 7516da47a349e74de623243a27f9b8a91446bf4f upstream.
In the same way as Intel Alder Lake TCSS (Type-C Subsystem) the Raptor Lake TCSS xHCI needs to be runtime suspended whenever possible to allow the TCSS hardware block to enter D3cold and thus save energy.
--- drivers/usb/host/xhci-pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-pci.c +3 -1
@@ -61,6 +61,7 @@#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI 0x461e#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_XHCI 0x464e#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI 0x51ed +#define PCI_DEVICE_ID_INTEL_RAPTOR_LAKE_XHCI 0xa71e#define PCI_DEVICE_ID_AMD_RENOIR_XHCI 0x1639#define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9
@@ -270,7 +271,8 @@ static void xhci_pci_quirks(struct devic pdev->device ==PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_XHCI || - pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI)) + pdev->device ==PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_RAPTOR_LAKE_XHCI)) xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
Greg Kroah-Hartman
maintainerPATCH 86/135 xhci-pci: Allow host runtime PM as default for Intel Meteor Lake xHCI
In reply to Greg Kroah-HartmanFrom: Utkarsh Patel <[email protected]>
commit 8ffdc53a60049f3930afe161dc51c67959c8d83d upstream.
Meteor Lake TCSS(Type-C Subsystem) xHCI needs to be runtime suspended whenever possible to allow the TCSS hardware block to enter D3cold and thus save energy.
--- drivers/usb/host/xhci-pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-pci.c +3 -1
@@ -62,6 +62,7 @@#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_XHCI 0x464e#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI 0x51ed#define PCI_DEVICE_ID_INTEL_RAPTOR_LAKE_XHCI 0xa71e +#define PCI_DEVICE_ID_INTEL_METEOR_LAKE_XHCI 0x7ec0#define PCI_DEVICE_ID_AMD_RENOIR_XHCI 0x1639#define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9
@@ -272,7 +273,8 @@ static void xhci_pci_quirks(struct devic pdev->device ==PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI || - pdev->device == PCI_DEVICE_ID_INTEL_RAPTOR_LAKE_XHCI)) + pdev->device ==PCI_DEVICE_ID_INTEL_RAPTOR_LAKE_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_METEOR_LAKE_XHCI)) xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
Greg Kroah-Hartman
maintainerPATCH 87/135 usb: gadget: Fix non-unique driver names in raw-gadget driver
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit f2d8c2606825317b77db1f9ba0fc26ef26160b30 upstream.
In a report for a separate bug (which has already been fixed by commit 5f0b5f4d50fa "usb: gadget: fix race when gadget driver register via ioctl") in the raw-gadget driver, the syzbot console log included error messages caused by attempted registration of a new driver with the same name as an existing driver:
Quoted 3 lines
kobject_add_internalfailed for raw-gadget with-EEXIST, don't try to register things with the same name in the same directory. UDC core: USB Raw Gadget: driver registration failed: -17
misc raw-gadget: fail,usb_gadget_register_driverreturned -17
These errors arise because raw_gadget.c registers a separate UDC driver for each of the UDC instances it creates, but these drivers all have the same name: "raw-gadget". Until recently this wasn't a problem, but when the "gadget" bus was added and UDC drivers were registered on this bus, it became possible for name conflicts to cause the registrations to fail. The reason is simply that the bus code in the driver core uses the driver name as a sysfs directory name (e.g., /sys/bus/gadget/drivers/raw-gadget/), and you can't create two directories with the same pathname.
To fix this problem, the driver names used by raw-gadget are made distinct by appending a unique ID number: "raw-gadget.N", with a different value of N for each driver instance. And to avoid the proliferation of error handling code in the raw_ioctl_init() routine, the error return paths are refactored into the common pattern (goto statements leading to cleanup code at the end of the routine).
--- drivers/usb/gadget/legacy/raw_gadget.c | 62 ++++++++++++++++++++++++--------- 1 file changed, 46 insertions(+), 16 deletions(-)
drivers/usb/gadget/legacy/raw_gadget.c +46 -16
@@ -11,6 +11,7 @@#include <linux/ctype.h> #include <linux/debugfs.h> #include <linux/delay.h> +#include <linux/idr.h> #include <linux/kref.h> #include <linux/miscdevice.h> #include <linux/module.h>
@@ -36,6 +37,9 @@ MODULE_LICENSE("GPL");/*----------------------------------------------------------------------*/ +static DEFINE_IDA (driver_id_numbers); +#define DRIVER_DRIVER_NAME_LENGTH_MAX 32 +#define RAW_EVENT_QUEUE_SIZE 16struct raw_event_queue {
@@ -161,6 +165,9 @@ struct raw_dev {/* Reference to misc device: */ struct device *dev; +/* Make driver names unique */ +int driver_id_number; +/* Protected by lock: */ enum dev_state state;bool gadget_registered;
@@ -189,6 +196,7 @@ static struct raw_dev *dev_new(void)spin_lock_init (&dev->lock);init_completion (&dev->ep0_done);raw_event_queue_init (&dev->queue); + dev->driver_id_number =-1 ;return dev; }
@@ -199,6 +207,9 @@ static void dev_free(struct kref *kref)kfree (dev->udc_name);kfree (dev->driver.udc_name); +kfree (dev->driver.driver.name); +if (dev->driver_id_number >=0 ) +ida_free (&driver_id_numbers, dev->driver_id_number);if (dev->req) {if (dev->ep0_urb_queued)usb_ep_dequeue (dev->gadget->ep0, dev->req);
@@ -422,6 +433,7 @@ static int raw_ioctl_init(struct raw_devstruct usb_raw_init arg;char *udc_driver_name;char *udc_device_name; +char *driver_driver_name;unsigned long flags;if (copy_from_user (&arg, (void __user *)value,sizeof (arg)))
@@ -440,36 +452,44 @@ static int raw_ioctl_init(struct raw_devreturn -EINVAL ; } + ret =ida_alloc (&driver_id_numbers,GFP_KERNEL ); +if (ret <0 ) +return ret; + dev->driver_id_number = ret; + + driver_driver_name =kmalloc (DRIVER_DRIVER_NAME_LENGTH_MAX ,GFP_KERNEL ); +if (!driver_driver_name) { + ret = -ENOMEM ; + goto out_free_driver_id_number; + } +snprintf (driver_driver_name,DRIVER_DRIVER_NAME_LENGTH_MAX , +DRIVER_NAME ".%d" , dev->driver_id_number); + udc_driver_name =kmalloc (UDC_NAME_LENGTH_MAX ,GFP_KERNEL ); -if (!udc_driver_name) -return -ENOMEM ; +if (!udc_driver_name) { + ret = -ENOMEM ; + goto out_free_driver_driver_name; + } ret =strscpy (udc_driver_name, &arg.driver_name[0 ],UDC_NAME_LENGTH_MAX ); -if (ret <0 ) { -kfree (udc_driver_name); -return ret; - } +if (ret <0 ) + goto out_free_udc_driver_name; ret =0 ; udc_device_name =kmalloc (UDC_NAME_LENGTH_MAX ,GFP_KERNEL );if (!udc_device_name) { -kfree (udc_driver_name); -return -ENOMEM ; + ret = -ENOMEM ; + goto out_free_udc_driver_name; } ret =strscpy (udc_device_name, &arg.device_name[0 ],UDC_NAME_LENGTH_MAX ); -if (ret <0 ) { -kfree (udc_driver_name); -kfree (udc_device_name); -return ret; - } +if (ret <0 ) + goto out_free_udc_device_name; ret =0 ;spin_lock_irqsave (&dev->lock, flags);if (dev->state !=STATE_DEV_OPENED ) {dev_dbg (dev->dev,"fail, device is not opened\n" ); -kfree (udc_driver_name); -kfree (udc_device_name); ret = -EINVAL ; goto out_unlock; }
@@ -484,14 +504,24 @@ static int raw_ioctl_init(struct raw_dev dev->driver.suspend = gadget_suspend; dev->driver.resume = gadget_resume; dev->driver.reset = gadget_reset; - dev->driver.driver.name =DRIVER_NAME ; + dev->driver.driver.name = driver_driver_name; dev->driver.udc_name = udc_device_name; dev->driver.match_existing_only =1 ; dev->state =STATE_DEV_INITIALIZED ; +spin_unlock_irqrestore (&dev->lock, flags); +return ret; out_unlock:spin_unlock_irqrestore (&dev->lock, flags); +out_free_udc_device_name: +kfree (udc_device_name); +out_free_udc_driver_name: +kfree (udc_driver_name); +out_free_driver_driver_name: +kfree (driver_driver_name); +out_free_driver_id_number: +ida_free (&driver_id_numbers, dev->driver_id_number);return ret; }
Greg Kroah-Hartman
maintainerPATCH 88/135 USB: gadget: Fix double-free bug in raw_gadget driver
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit 90bc2af24638659da56397ff835f3c95a948f991 upstream.
Re-reading a recently merged fix to the raw_gadget driver showed that it inadvertently introduced a double-free bug in a failure pathway. If raw_ioctl_init() encounters an error after the driver ID number has been allocated, it deallocates the ID number before returning. But when dev_free() runs later on, it will then try to deallocate the ID number a second time.
Closely related to this issue is another error in the recent fix: The ID number is stored in the raw_dev structure before the code checks to see whether the structure has already been initialized, in which case the new ID number would overwrite the earlier value.
The solution to both bugs is to keep the new ID number in a local variable, and store it in the raw_dev structure only after the check for prior initialization. No errors can occur after that point, so the double-free will never happen.
--- drivers/usb/gadget/legacy/raw_gadget.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/usb/gadget/legacy/raw_gadget.c +7 -6
@@ -430,6 +430,7 @@ out_put:static int raw_ioctl_init (struct raw_dev *dev,unsigned long value) {int ret =0 ; +int driver_id_number;struct usb_raw_init arg;char *udc_driver_name;char *udc_device_name;
@@ -452,10 +453,9 @@ static int raw_ioctl_init(struct raw_devreturn -EINVAL ; } - ret =ida_alloc (&driver_id_numbers,GFP_KERNEL ); -if (ret <0 ) -return ret; - dev->driver_id_number = ret; + driver_id_number =ida_alloc (&driver_id_numbers,GFP_KERNEL ); +if (driver_id_number <0 ) +return driver_id_number; driver_driver_name =kmalloc (DRIVER_DRIVER_NAME_LENGTH_MAX ,GFP_KERNEL );if (!driver_driver_name) {
@@ -463,7 +463,7 @@ static int raw_ioctl_init(struct raw_dev goto out_free_driver_id_number; }snprintf (driver_driver_name,DRIVER_DRIVER_NAME_LENGTH_MAX , -DRIVER_NAME ".%d" , dev->driver_id_number); +DRIVER_NAME ".%d" , driver_id_number); udc_driver_name =kmalloc (UDC_NAME_LENGTH_MAX ,GFP_KERNEL );if (!udc_driver_name) {
@@ -507,6 +507,7 @@ static int raw_ioctl_init(struct raw_dev dev->driver.driver.name = driver_driver_name; dev->driver.udc_name = udc_device_name; dev->driver.match_existing_only =1 ; + dev->driver_id_number = driver_id_number; dev->state =STATE_DEV_INITIALIZED ;spin_unlock_irqrestore (&dev->lock, flags);
@@ -521,7 +522,7 @@ out_free_udc_driver_name: out_free_driver_driver_name:kfree (driver_driver_name); out_free_driver_id_number: -ida_free (&driver_id_numbers, dev->driver_id_number); +ida_free (&driver_id_numbers, driver_id_number);return ret; }
Greg Kroah-Hartman
maintainerPATCH 89/135 usb: chipidea: udc: check request status before setting device address
In reply to Greg Kroah-HartmanFrom: Xu Yang <[email protected]>
commit b24346a240b36cfc4df194d145463874985aa29b upstream.
The complete() function may be called even though request is not completed. In this case, it's necessary to check request status so as not to set device address wrongly.
--- drivers/usb/chipidea/udc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/chipidea/udc.c +3 -0
@@ -1040,6 +1040,9 @@ isr_setup_status_complete(struct usb_epstruct ci_hdrc *ci = req->context;unsigned long flags; +if (req->status <0 ) +return ; +if (ci->setaddr) {hw_usb_set_address (ci, ci->address); ci->setaddr = false;
Greg Kroah-Hartman
maintainerPATCH 90/135 dt-bindings: usb: ohci: Increase the number of PHYs
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit 0f074c1c95ea496dc91279b6c4b9845a337517fa upstream.
"make dtbs_check":
arch/arm/boot/dts/r8a77470-iwg23s-sbc.dtb: usb@ee080000: phys: [[17, 0], [31]] is too long
From schema: Documentation/devicetree/bindings/usb/generic-ohci.yaml
arch/arm/boot/dts/r8a77470-iwg23s-sbc.dtb: usb@ee0c0000: phys: [[17, 1], [33], [21, 0]] is too long
From schema: Documentation/devicetree/bindings/usb/generic-ohci.yaml
Some USB OHCI controllers (e.g. on the Renesas RZ/G1C SoC) have multiple PHYs. Increase the maximum number of PHYs to 3, which is sufficient for now.
--- Documentation/devicetree/bindings/usb/generic-ohci.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
Documentation/devicetree/bindings/usb/generic-ohci.yaml +2 -1
@@ -102,7 +102,8 @@ properties: Overrides the detected port count phys: - maxItems: 1 + minItems: 1 + maxItems: 3 phy-names: const: usb
Greg Kroah-Hartman
maintainerPATCH 91/135 dt-bindings: usb: ehci: Increase the number of PHYs
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit 9faa1c8f92f33daad9db96944139de225cefa199 upstream.
"make dtbs_check":
arch/arm/boot/dts/r8a77470-iwg23s-sbc.dtb: usb@ee080100: phys: [[17, 0], [31]] is too long
From schema: Documentation/devicetree/bindings/usb/generic-ehci.yaml
arch/arm/boot/dts/r8a77470-iwg23s-sbc.dtb: usb@ee0c0100: phys: [[17, 1], [33], [21, 0]] is too long
From schema: Documentation/devicetree/bindings/usb/generic-ehci.yaml
Some USB EHCI controllers (e.g. on the Renesas RZ/G1C SoC) have multiple PHYs. Increase the maximum number of PHYs to 3, which is sufficient for now.
--- Documentation/devicetree/bindings/usb/generic-ehci.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
Documentation/devicetree/bindings/usb/generic-ehci.yaml +2 -1
@@ -135,7 +135,8 @@ properties: Phandle of a companion. phys: - maxItems: 1 + minItems: 1 + maxItems: 3 phy-names: const: usb
Greg Kroah-Hartman
maintainerPATCH 92/135 btrfs: dont set lock_owner when locking extent buffer for reading
In reply to Greg Kroah-HartmanFrom: Zygo Blaxell <[email protected]>
commit 97e86631bccddfbbe0c13f9a9605cdef11d31296 upstream.
In 196d59ab9ccc "btrfs: switch extent buffer tree lock to rw_semaphore" the functions for tree read locking were rewritten, and in the process the read lock functions started setting eb->lock_owner = current->pid. Previously lock_owner was only set in tree write lock functions.
Read locks are shared, so they don't have exclusive ownership of the underlying object, so setting lock_owner to any single value for a read lock makes no sense. It's mostly harmless because write locks and read locks are mutually exclusive, and none of the existing code in btrfs (btrfs_init_new_buffer and print_eb_refs_lock) cares what nonsense is written in lock_owner when no writer is holding the lock.
KCSAN does care, and will complain about the data race incessantly. Remove the assignments in the read lock functions because they're useless noise.
--- fs/btrfs/locking.c | 3 --- 1 file changed, 3 deletions(-)
fs/btrfs/locking.c +0 -3
@@ -45,7 +45,6 @@ void __btrfs_tree_read_lock(struct exten start_ns =ktime_get_ns ();down_read_nested (&eb->lock, nest); - eb->lock_owner = current->pid;trace_btrfs_tree_read_lock (eb, start_ns); }
@@ -62,7 +61,6 @@ void btrfs_tree_read_lock(struct extent_int btrfs_try_tree_read_lock (struct extent_buffer *eb) {if (down_read_trylock (&eb->lock)) { - eb->lock_owner = current->pid;trace_btrfs_try_tree_read_lock (eb);return 1 ; }
@@ -90,7 +88,6 @@ int btrfs_try_tree_write_lock(struct extvoid btrfs_tree_read_unlock (struct extent_buffer *eb) {trace_btrfs_tree_read_unlock (eb); - eb->lock_owner =0 ;up_read (&eb->lock); }
Greg Kroah-Hartman
maintainerPATCH 93/135 btrfs: fix deadlock with fsync+fiemap+transaction commit
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit bf7ba8ee759b7b7a34787ddd8dc3f190a3d7fa24 upstream.
We are hitting the following deadlock in production occasionally
Task 1 Task 2 Task 3 Task 4 Task 5
fsync(A) start trans start commit falloc(A) lock 5m-10m start trans wait for commit
fiemap(A)
lock 0-10m
wait for 5m-10m
(have 0-5m locked)
have btrfs_need_log_full_commit !full_sync wait_ordered_extents finish_ordered_io(A) lock 0-5m DEADLOCK
We have an existing dependency of file extent lock -> transaction. However in fsync if we tried to do the fast logging, but then had to fall back to committing the transaction, we will be forced to call btrfs_wait_ordered_range() to make sure all of our extents are updated.
This creates a dependency of transaction -> file extent lock, because btrfs_finish_ordered_io() will need to take the file extent lock in order to run the ordered extents.
Fix this by stopping the transaction if we have to do the full commit and we attempted to do the fast logging. Then attach to the transaction and commit it if we need to.
--- fs/btrfs/file.c | 67 +++++++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 52 insertions(+), 15 deletions(-)
fs/btrfs/file.c +52 -15
@@ -2337,25 +2337,62 @@ int btrfs_sync_file(struct file *file, l*/ btrfs_inode_unlock (inode,BTRFS_ILOCK_MMAP ); -if (ret !=BTRFS_NO_LOG_SYNC ) { +if (ret ==BTRFS_NO_LOG_SYNC ) { + ret =btrfs_end_transaction (trans); + goto out; + } + +/* We successfully logged the inode, attempt to sync the log. */ +if (!ret) { + ret =btrfs_sync_log (trans, root, &ctx);if (!ret) { - ret =btrfs_sync_log (trans, root, &ctx); -if (!ret) { - ret =btrfs_end_transaction (trans); - goto out; - } + ret =btrfs_end_transaction (trans); + goto out; } -if (!full_sync) { - ret =btrfs_wait_ordered_range (inode, start, len); -if (ret) { -btrfs_end_transaction (trans); - goto out; - } - } - ret =btrfs_commit_transaction (trans); - }else { + } + +/* +* At this point we need to commit the transaction because we had +* btrfs_need_log_full_commit() or some other error. +* +* If we didn't do a full sync we have to stop the trans handle, wait on +* the ordered extents, start it again and commit the transaction. If +* we attempt to wait on the ordered extents here we could deadlock with +* something like fallocate() that is holding the extent lock trying to +* start a transaction while some other thread is trying to commit the +* transaction while we (fsync) are currently holding the transaction +* open. +*/ +if (!full_sync) { ret =btrfs_end_transaction (trans); +if (ret) + goto out; + ret =btrfs_wait_ordered_range (inode, start, len); +if (ret) + goto out; + +/* +* This is safe to use here because we're only interested in +* making sure the transaction that had the ordered extents is +* committed. We aren't waiting on anything past this point, +* we're purely getting the transaction and committing it. +*/ + trans =btrfs_attach_transaction_barrier (root); +if (IS_ERR (trans)) { + ret =PTR_ERR (trans); + +/* +* We committed the transaction and there's no currently +* running transaction, this means everything we care +* about made it to disk and we are done. +*/ +if (ret == -ENOENT ) + ret =0 ; + goto out; + } } + + ret =btrfs_commit_transaction (trans); out:ASSERT (list_empty (&ctx.list)); err =file_check_and_advance_wb_err (file);
Greg Kroah-Hartman
maintainerPATCH 94/135 f2fs: attach inline_data after setting compression
In reply to Greg Kroah-HartmanFrom: Jaegeuk Kim <[email protected]>
commit 4cde00d50707c2ef6647b9b96b2cb40b6eb24397 upstream.
This fixes the below corruption.
[345393.335389] F2FS-fs (vdb): sanity_check_inode: inode (ino=6d0, mode=33206) should not have inline_data, run fsck to fix
--- fs/f2fs/namei.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
fs/f2fs/namei.c +11 -6
@@ -91,8 +91,6 @@ static struct inode *f2fs_new_inode(struif (test_opt (sbi,INLINE_XATTR ))set_inode_flag (inode,FI_INLINE_XATTR ); -if (test_opt (sbi,INLINE_DATA ) &&f2fs_may_inline_data (inode)) -set_inode_flag (inode,FI_INLINE_DATA );if (f2fs_may_inline_dentry (inode))set_inode_flag (inode,FI_INLINE_DENTRY );
@@ -109,10 +107,6 @@ static struct inode *f2fs_new_inode(struf2fs_init_extent_tree (inode,NULL ); -stat_inc_inline_xattr (inode); -stat_inc_inline_inode (inode); -stat_inc_inline_dir (inode); -F2FS_I (inode)->i_flags =f2fs_mask_flags (mode,F2FS_I (dir)->i_flags &F2FS_FL_INHERITED );
@@ -129,6 +123,14 @@ static struct inode *f2fs_new_inode(struset_compress_context (inode); } +/* Should enable inline_data after compression set */ +if (test_opt (sbi,INLINE_DATA ) &&f2fs_may_inline_data (inode)) +set_inode_flag (inode,FI_INLINE_DATA ); + +stat_inc_inline_xattr (inode); +stat_inc_inline_inode (inode); +stat_inc_inline_dir (inode); +f2fs_set_inode_flags (inode);trace_f2fs_new_inode (inode,0 );
@@ -327,6 +329,9 @@ static void set_compress_inode(struct f2if (!is_extension_exist (name, ext[i], false))continue ; +/* Do not use inline_data with compression */ +stat_dec_inline_inode (inode); +clear_inode_flag (inode,FI_INLINE_DATA );set_compress_context (inode);return ; }
Greg Kroah-Hartman
maintainerPATCH 95/135 iio:humidity:hts221: rearrange iio trigger get and register
In reply to Greg Kroah-HartmanFrom: Dmitry Rokosov <[email protected]>
commit 10b9c2c33ac706face458feab8965f11743c98c0 upstream.
IIO trigger interface function iio_trigger_get() should be called after iio_trigger_register() (or its devm analogue) strictly, because of iio_trigger_get() acquires module refcnt based on the trigger->owner pointer, which is initialized inside iio_trigger_register() to THIS_MODULE.
If this call order is wrong, the next iio_trigger_put() (from sysfs callback or "delete module" path) will dereference "default" module refcnt, which is incorrect behaviour.
--- drivers/iio/humidity/hts221_buffer.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/iio/humidity/hts221_buffer.c +4 -1
@@ -135,9 +135,12 @@ int hts221_allocate_trigger(struct iio_diio_trigger_set_drvdata (hw->trig, iio_dev); hw->trig->ops = &hts221_trigger_ops; + + err =devm_iio_trigger_register (hw->dev, hw->trig); + iio_dev->trig =iio_trigger_get (hw->trig); -return devm_iio_trigger_register (hw->dev, hw->trig); +return err; }static int hts221_buffer_preenable (struct iio_dev *iio_dev)
Greg Kroah-Hartman
maintainerPATCH 96/135 iio:chemical:ccs811: rearrange iio trigger get and register
In reply to Greg Kroah-HartmanFrom: Dmitry Rokosov <[email protected]>
commit d710359c0b445e8c03e24f19ae2fb79ce7282260 upstream.
IIO trigger interface function iio_trigger_get() should be called after iio_trigger_register() (or its devm analogue) strictly, because of iio_trigger_get() acquires module refcnt based on the trigger->owner pointer, which is initialized inside iio_trigger_register() to THIS_MODULE.
If this call order is wrong, the next iio_trigger_put() (from sysfs callback or "delete module" path) will dereference "default" module refcnt, which is incorrect behaviour.
--- drivers/iio/chemical/ccs811.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/chemical/ccs811.c +2 -2
@@ -499,11 +499,11 @@ static int ccs811_probe(struct i2c_clien data->drdy_trig->ops = &ccs811_trigger_ops;iio_trigger_set_drvdata (data->drdy_trig, indio_dev); - indio_dev->trig = data->drdy_trig; -iio_trigger_get (indio_dev->trig); ret =iio_trigger_register (data->drdy_trig);if (ret) goto err_poweroff; + + indio_dev->trig =iio_trigger_get (data->drdy_trig); } ret = iio_triggered_buffer_setup(indio_dev, NULL,
Greg Kroah-Hartman
maintainerPATCH 97/135 iio:accel:kxcjk-1013: rearrange iio trigger get and register
In reply to Greg Kroah-HartmanFrom: Dmitry Rokosov <[email protected]>
commit ed302925d708f2f97ae5e9fd6c56c16bb34f6629 upstream.
IIO trigger interface function iio_trigger_get() should be called after iio_trigger_register() (or its devm analogue) strictly, because of iio_trigger_get() acquires module refcnt based on the trigger->owner pointer, which is initialized inside iio_trigger_register() to THIS_MODULE.
If this call order is wrong, the next iio_trigger_put() (from sysfs callback or "delete module" path) will dereference "default" module refcnt, which is incorrect behaviour.
--- drivers/iio/accel/kxcjk-1013.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/accel/kxcjk-1013.c +2 -2
@@ -1553,12 +1553,12 @@ static int kxcjk1013_probe(struct i2c_cl data->dready_trig->ops = &kxcjk1013_trigger_ops;iio_trigger_set_drvdata (data->dready_trig, indio_dev); - indio_dev->trig = data->dready_trig; -iio_trigger_get (indio_dev->trig); ret =iio_trigger_register (data->dready_trig);if (ret) goto err_poweroff; + indio_dev->trig =iio_trigger_get (data->dready_trig); + data->motion_trig->ops = &kxcjk1013_trigger_ops;iio_trigger_set_drvdata (data->motion_trig, indio_dev); ret =iio_trigger_register (data->motion_trig);
Greg Kroah-Hartman
maintainerPATCH 98/135 iio:accel:bma180: rearrange iio trigger get and register
In reply to Greg Kroah-HartmanFrom: Dmitry Rokosov <[email protected]>
commit e5f3205b04d7f95a2ef43bce4b454a7f264d6923 upstream.
IIO trigger interface function iio_trigger_get() should be called after iio_trigger_register() (or its devm analogue) strictly, because of iio_trigger_get() acquires module refcnt based on the trigger->owner pointer, which is initialized inside iio_trigger_register() to THIS_MODULE.
If this call order is wrong, the next iio_trigger_put() (from sysfs callback or "delete module" path) will dereference "default" module refcnt, which is incorrect behaviour.
--- drivers/iio/accel/bma180.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/iio/accel/bma180.c +2 -1
@@ -1006,11 +1006,12 @@ static int bma180_probe(struct i2c_clien data->trig->ops = &bma180_trigger_ops;iio_trigger_set_drvdata (data->trig, indio_dev); - indio_dev->trig =iio_trigger_get (data->trig); ret =iio_trigger_register (data->trig);if (ret) goto err_trigger_free; + + indio_dev->trig =iio_trigger_get (data->trig); } ret = iio_triggered_buffer_setup(indio_dev, NULL,
Greg Kroah-Hartman
maintainerPATCH 99/135 iio:accel:mxc4005: rearrange iio trigger get and register
In reply to Greg Kroah-HartmanFrom: Dmitry Rokosov <[email protected]>
commit 9354c224c9b4f55847a0de3e968cba2ebf15af3b upstream.
IIO trigger interface function iio_trigger_get() should be called after iio_trigger_register() (or its devm analogue) strictly, because of iio_trigger_get() acquires module refcnt based on the trigger->owner pointer, which is initialized inside iio_trigger_register() to THIS_MODULE.
If this call order is wrong, the next iio_trigger_put() (from sysfs callback or "delete module" path) will dereference "default" module refcnt, which is incorrect behaviour.
--- drivers/iio/accel/mxc4005.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/accel/mxc4005.c +2 -2
@@ -456,8 +456,6 @@ static int mxc4005_probe(struct i2c_clie data->dready_trig->ops = &mxc4005_trigger_ops;iio_trigger_set_drvdata (data->dready_trig, indio_dev); - indio_dev->trig = data->dready_trig; -iio_trigger_get (indio_dev->trig); ret =devm_iio_trigger_register (&client->dev, data->dready_trig);if (ret) {
@@ -465,6 +463,8 @@ static int mxc4005_probe(struct i2c_clie "failed to register trigger\n");return ret; } + + indio_dev->trig =iio_trigger_get (data->dready_trig); }return devm_iio_device_register (&client->dev, indio_dev);
Greg Kroah-Hartman
maintainerPATCH 100/135 iio: accel: mma8452: ignore the return value of reset operation
In reply to Greg Kroah-HartmanFrom: Haibo Chen <[email protected]>
commit bf745142cc0a3e1723f9207fb0c073c88464b7b4 upstream.
On fxls8471, after set the reset bit, the device will reset immediately, will not give ACK. So ignore the return value of this reset operation, let the following code logic to check whether the reset operation works.
--- drivers/iio/accel/mma8452.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/iio/accel/mma8452.c +7 -3
@@ -1493,10 +1493,14 @@ static int mma8452_reset(struct i2c_clieint i;int ret; - ret =i2c_smbus_write_byte_data (client,MMA8452_CTRL_REG2 , +/* +* Find on fxls8471, after config reset bit, it reset immediately, +* and will not give ACK, so here do not check the return value. +* The following code will read the reset register, and check whether +* this reset works. +*/ +i2c_smbus_write_byte_data (client,MMA8452_CTRL_REG2 ,MMA8452_CTRL_REG2_RST ); -if (ret <0 ) -return ret;for (i =0 ; i <10 ; i++) {usleep_range (100 ,200 );
Greg Kroah-Hartman
maintainerPATCH 101/135 iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up()
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
commit b2f5ad97645e1deb5ca9bcb7090084b92cae35d2 upstream.
The driver should disable regulators when fails at regmap_update_bits().
--- drivers/iio/gyro/mpu3050-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/gyro/mpu3050-core.c +1 -0
@@ -876,6 +876,7 @@ static int mpu3050_power_up(struct mpu30 ret =regmap_update_bits (mpu3050->map,MPU3050_PWR_MGM ,MPU3050_PWR_MGM_SLEEP ,0 );if (ret) { +regulator_bulk_disable (ARRAY_SIZE (mpu3050->regs), mpu3050->regs);dev_err (mpu3050->dev,"error setting power mode\n" );return ret; }
Greg Kroah-Hartman
maintainerPATCH 102/135 iio: trigger: sysfs: fix use-after-free on remove
In reply to Greg Kroah-HartmanFrom: Vincent Whitchurch <[email protected]>
commit 78601726d4a59a291acc5a52da1d3a0a6831e4e8 upstream.
Ensure that the irq_work has completed before the trigger is freed.
==================================================================
BUG: KASAN: use-after-free in irq_work_run_list Read of size 8 at addr 0000000064702248 by task python3/25 Call Trace: irq_work_run_list irq_work_tick update_process_times tick_sched_handle tick_sched_timer __hrtimer_run_queues hrtimer_interrupt Allocated by task 25: kmem_cache_alloc_trace iio_sysfs_trig_add dev_attr_store sysfs_kf_write kernfs_fop_write_iter new_sync_write vfs_write ksys_write sys_write Freed by task 25: kfree iio_sysfs_trig_remove dev_attr_store sysfs_kf_write kernfs_fop_write_iter new_sync_write vfs_write ksys_write sys_write
==================================================================
--- drivers/iio/trigger/iio-trig-sysfs.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/trigger/iio-trig-sysfs.c +1 -0
@@ -195,6 +195,7 @@ static int iio_sysfs_trigger_remove(int }iio_trigger_unregister (t->trig); +irq_work_sync (&t->work);iio_trigger_free (t->trig);list_del (&t->l);
Greg Kroah-Hartman
maintainerPATCH 103/135 iio: adc: stm32: fix maximum clock rate for stm32mp15x
In reply to Greg Kroah-HartmanFrom: Olivier Moysan <[email protected]>
commit 990539486e7e311fb5dab1bf4d85d1a8973ae644 upstream.
Change maximum STM32 ADC input clock rate to 36MHz, as specified in STM32MP15x datasheets.
--- drivers/iio/adc/stm32-adc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/stm32-adc-core.c +1 -1
@@ -809,7 +809,7 @@ static const struct stm32_adc_priv_cfg sstatic const struct stm32_adc_priv_cfg stm32mp1_adc_priv_cfg = { .regs = &stm32h7_adc_common_regs, .clk_sel = stm32h7_adc_clk_sel, - .max_clk_rate_hz =40000000 , + .max_clk_rate_hz =36000000 , .has_syscfg =HAS_VBOOSTER |HAS_ANASWVDD , .num_irqs =2 , };
Greg Kroah-Hartman
maintainerPATCH 104/135 iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value)
In reply to Greg Kroah-HartmanFrom: Jean-Baptiste Maneyrol <[email protected]>
commit 106b391e1b859100a3f38f0ad874236e9be06bde upstream.
The 0 value used for INV_CHIP_ICM42600 was not working since the match in i2c/spi was checking against NULL value.
To keep this check, add a first INV_CHIP_INVALID 0 value as safe guard.
--- drivers/iio/imu/inv_icm42600/inv_icm42600.h | 1 + drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/iio/imu/inv_icm42600/inv_icm42600.h +1 -0
@@ -17,6 +17,7 @@#include "inv_icm42600_buffer.h" enum inv_icm42600_chip { +INV_CHIP_INVALID ,INV_CHIP_ICM42600 ,INV_CHIP_ICM42602 ,INV_CHIP_ICM42605 ,
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +1 -1
@@ -565,7 +565,7 @@ int inv_icm42600_core_probe(struct regmabool open_drain;int ret; -if (chip <0 || chip >=INV_CHIP_NB ) { +if (chip <=INV_CHIP_INVALID || chip >=INV_CHIP_NB ) {dev_err (dev,"invalid chip = %d\n" , chip);return -ENODEV ; }
Greg Kroah-Hartman
maintainerPATCH 105/135 iio: afe: rescale: Fix boolean logic bug
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
commit 9decacd8b3a432316d61c4366f302e63384cb08d upstream.
When introducing support for processed channels I needed to invert the expression:
if (!iio_channel_has_info(schan, IIO_CHAN_INFO_RAW) ||
!iio_channel_has_info(schan, IIO_CHAN_INFO_SCALE))
dev_err(dev, "source channel does not support raw/scale\n");To the inverse, meaning detect when we can usse raw+scale rather than when we can not. This was the result:
if (iio_channel_has_info(schan, IIO_CHAN_INFO_RAW) ||
iio_channel_has_info(schan, IIO_CHAN_INFO_SCALE))
dev_info(dev, "using raw+scale source channel\n");Ooops. Spot the error. Yep old George Boole came up and bit me. That should be an &&.
The current code "mostly works" because we have not run into systems supporting only raw but not scale or only scale but not raw, and I doubt there are few using the rescaler on anything such, but let's fix the logic.
--- drivers/iio/afe/iio-rescale.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/afe/iio-rescale.c +1 -1
@@ -148,7 +148,7 @@ static int rescale_configure_channel(str chan->ext_info = rescale->ext_info; chan->type = rescale->cfg->type; -if (iio_channel_has_info (schan,IIO_CHAN_INFO_RAW ) || +if (iio_channel_has_info (schan,IIO_CHAN_INFO_RAW ) &&iio_channel_has_info (schan,IIO_CHAN_INFO_SCALE )) {dev_info (dev,"using raw+scale source channel\n" ); }else if (iio_channel_has_info (schan,IIO_CHAN_INFO_PROCESSED )) {
Greg Kroah-Hartman
maintainerPATCH 106/135 iio: adc: stm32: Fix ADCs iteration in irq handler
In reply to Greg Kroah-HartmanFrom: Yannick Brosseau <[email protected]>
commit d2214cca4d3eadc74eac9e30301ec7cad5355f00 upstream.
The irq handler was only checking the mask for the first ADCs in the case of the F4 and H7 generation, since it was iterating up to the num_irq value. This patch add the maximum number of ADC in the common register, which map to the number of entries of eoc_msk and ovr_msk in stm32_adc_common_regs. This allow the handler to check all ADCs in that module.
Tested on a STM32F429NIH6.
--- drivers/iio/adc/stm32-adc-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/iio/adc/stm32-adc-core.c +6 -1
@@ -64,6 +64,7 @@ struct stm32_adc_priv;* @max_clk_rate_hz: maximum analog clock rate (Hz, from datasheet) * @has_syscfg: SYSCFG capability flags * @num_irqs: number of interrupt lines +* @num_adcs: maximum number of ADC instances in the common registers */ struct stm32_adc_priv_cfg {const struct stm32_adc_common_regs *regs;
@@ -71,6 +72,7 @@ struct stm32_adc_priv_cfg {u32 max_clk_rate_hz;unsigned int has_syscfg;unsigned int num_irqs; +unsigned int num_adcs; };/**
@@ -352,7 +354,7 @@ static void stm32_adc_irq_handler(struct* before invoking the interrupt handler (e.g. call ISR only for * IRQ-enabled ADCs). */ -for (i =0 ; i < priv->cfg->num_irqs; i++) { +for (i =0 ; i < priv->cfg->num_adcs; i++) {if ((status & priv->cfg->regs->eoc_msk[i] &&stm32_adc_eoc_enabled (priv, i)) || (status & priv->cfg->regs->ovr_msk[i]))
@@ -796,6 +798,7 @@ static const struct stm32_adc_priv_cfg s .clk_sel = stm32f4_adc_clk_sel, .max_clk_rate_hz = 36000000, .num_irqs = 1, + .num_adcs = 3, };static const struct stm32_adc_priv_cfg stm32h7_adc_priv_cfg = {
@@ -804,6 +807,7 @@ static const struct stm32_adc_priv_cfg s .max_clk_rate_hz = 36000000, .has_syscfg = HAS_VBOOSTER, .num_irqs = 1, + .num_adcs = 2, };static const struct stm32_adc_priv_cfg stm32mp1_adc_priv_cfg = {
@@ -812,6 +816,7 @@ static const struct stm32_adc_priv_cfg s .max_clk_rate_hz = 36000000, .has_syscfg = HAS_VBOOSTER | HAS_ANASWVDD, .num_irqs = 2, + .num_adcs = 2, };static const struct of_device_id stm32_adc_of_match[] = {
Greg Kroah-Hartman
maintainerPATCH 107/135 iio: adc: stm32: Fix IRQs on STM32F4 by removing custom spurious IRQs message
In reply to Greg Kroah-HartmanFrom: Yannick Brosseau <[email protected]>
commit 99bded02dae5e1e2312813506c41dc8db2fb656c upstream.
The check for spurious IRQs introduced in 695e2f5c289bb assumed that the bits in the control and status registers are aligned. This is true for the H7 and MP1 version, but not the F4. The interrupt was then never handled on the F4.
Instead of increasing the complexity of the comparison and check each bit specifically, we remove this check completely and rely on the generic handler for spurious IRQs.
--- drivers/iio/adc/stm32-adc.c | 10 ---------- 1 file changed, 10 deletions(-)
drivers/iio/adc/stm32-adc.c +0 -10
@@ -1259,7 +1259,6 @@ static irqreturn_t stm32_adc_threaded_isstruct stm32_adc *adc =iio_priv (indio_dev);const struct stm32_adc_regspec *regs = adc->cfg->regs;u32 status =stm32_adc_readl (adc, regs->isr_eoc.reg); -u32 mask =stm32_adc_readl (adc, regs->ier_eoc.reg);/* Check ovr status right now, as ovr mask should be already disabled */ if (status & regs->isr_ovr.mask) {
@@ -1274,11 +1273,6 @@ static irqreturn_t stm32_adc_threaded_isreturn IRQ_HANDLED ; } -if (!(status & mask)) -dev_err_ratelimited (&indio_dev->dev, -"Unexpected IRQ: IER=0x%08x, ISR=0x%08x\n" , - mask, status); -return IRQ_NONE ; }
@@ -1288,10 +1282,6 @@ static irqreturn_t stm32_adc_isr(int irqstruct stm32_adc *adc =iio_priv (indio_dev);const struct stm32_adc_regspec *regs = adc->cfg->regs;u32 status =stm32_adc_readl (adc, regs->isr_eoc.reg); -u32 mask =stm32_adc_readl (adc, regs->ier_eoc.reg); - -if (!(status & mask)) -return IRQ_WAKE_THREAD ;if (status & regs->isr_ovr.mask) {/*
Greg Kroah-Hartman
maintainerPATCH 108/135 iio: adc: axp288: Override TS pin bias current for some models
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 048058399f19d43cf21de9f5d36cd8144337d004 upstream.
Since commit 9bcf15f75cac ("iio: adc: axp288: Fix TS-pin handling") we preserve the bias current set by the firmware at boot. This fixes issues we were seeing on various models.
Some models like the Nuvision Solo 10 Draw tablet actually need the old hardcoded 80ųA bias current for battery temperature monitoring to work properly.
Add a quirk entry for the Nuvision Solo 10 Draw to the DMI quirk table to restore setting the bias current to 80ųA on this model.
--- drivers/iio/adc/axp288_adc.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/iio/adc/axp288_adc.c +8 -0
@@ -196,6 +196,14 @@ static const struct dmi_system_id axp288 }, .driver_data = (void *)(uintptr_t)AXP288_ADC_TS_BIAS_80UA, }, + { + /* Nuvision Solo 10 Draw */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "TMAX"), + DMI_MATCH(DMI_PRODUCT_NAME, "TM101W610L"), + }, + .driver_data = (void *)(uintptr_t)AXP288_ADC_TS_BIAS_80UA, + }, {} };
Greg Kroah-Hartman
maintainerPATCH 109/135 iio: adc: rzg2l_adc: add missing fwnode_handle_put() in rzg2l_adc_parse_properties()
In reply to Greg Kroah-HartmanFrom: Jialin Zhang <[email protected]>
commit d836715f588ea15f905f607c27bc693587058db4 upstream.
fwnode_handle_put() should be used when terminating device_for_each_child_node() iteration with break or return to prevent stale device node references from being left behind.
--- drivers/iio/adc/rzg2l_adc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/iio/adc/rzg2l_adc.c +6 -2
@@ -334,11 +334,15 @@ static int rzg2l_adc_parse_properties(st i =0 ;device_for_each_child_node (&pdev->dev, fwnode) { ret =fwnode_property_read_u32 (fwnode,"reg" , &channel); -if (ret) +if (ret) { +fwnode_handle_put (fwnode);return ret; + } -if (channel >=RZG2L_ADC_MAX_CHANNELS ) +if (channel >=RZG2L_ADC_MAX_CHANNELS ) { +fwnode_handle_put (fwnode);return -EINVAL ; + } chan_array[i].type =IIO_VOLTAGE ; chan_array[i].indexed =1 ;
Greg Kroah-Hartman
maintainerPATCH 110/135 iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
commit ada7b0c0dedafd7d059115adf49e48acba3153a8 upstream.
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/iio/adc/adi-axi-adc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/iio/adc/adi-axi-adc.c +3 -0
@@ -322,16 +322,19 @@ static struct adi_axi_adc_client *adi_axif (!try_module_get (cl->dev->driver->owner)) {mutex_unlock (®istered_clients_lock); +of_node_put (cln);return ERR_PTR (-ENODEV ); }get_device (cl->dev); cl->info = info;mutex_unlock (®istered_clients_lock); +of_node_put (cln);return cl; }mutex_unlock (®istered_clients_lock); +of_node_put (cln);return ERR_PTR (-EPROBE_DEFER ); }
Greg Kroah-Hartman
maintainerPATCH 111/135 iio: adc: ti-ads131e08: add missing fwnode_handle_put() in ads131e08_alloc_channels()
In reply to Greg Kroah-HartmanFrom: Jialin Zhang <[email protected]>
commit 47dcf770abc793f347a65a24c24d550c936f08b0 upstream.
fwnode_handle_put() should be used when terminating device_for_each_child_node() iteration with break or return to prevent stale device node references from being left behind.
--- drivers/iio/adc/ti-ads131e08.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/iio/adc/ti-ads131e08.c +7 -3
@@ -739,7 +739,7 @@ static int ads131e08_alloc_channels(strudevice_for_each_child_node (dev, node) { ret =fwnode_property_read_u32 (node,"reg" , &channel);if (ret) -return ret; + goto err_child_out; ret =fwnode_property_read_u32 (node,"ti,gain" , &tmp);if (ret) {
@@ -747,7 +747,7 @@ static int ads131e08_alloc_channels(stru }else { ret =ads131e08_pga_gain_to_field_value (st, tmp);if (ret <0 ) -return ret; + goto err_child_out; channel_config[i].pga_gain = tmp; }
@@ -758,7 +758,7 @@ static int ads131e08_alloc_channels(stru }else { ret =ads131e08_validate_channel_mux (st, tmp);if (ret) -return ret; + goto err_child_out; channel_config[i].mux = tmp; }
@@ -784,6 +784,10 @@ static int ads131e08_alloc_channels(stru st->channel_config = channel_config;return 0 ; + +err_child_out: +fwnode_handle_put (node); +return ret; }static void ads131e08_regulator_disable (void *data)
Greg Kroah-Hartman
maintainerPATCH 112/135 xtensa: xtfpga: Fix refcount leak bug in setup
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
commit 173940b3ae40114d4179c251a98ee039dc9cd5b3 upstream.
In machine_setup(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore.
Message-Id: <[email protected]>
--- arch/xtensa/platforms/xtfpga/setup.c | 1 + 1 file changed, 1 insertion(+)
arch/xtensa/platforms/xtfpga/setup.c +1 -0
@@ -133,6 +133,7 @@ static int __init machine_setup(void)if ((eth =of_find_compatible_node (eth,NULL ,"opencores,ethoc" )))update_local_mac (eth); +of_node_put (eth);return 0 ; }arch_initcall (machine_setup);
Greg Kroah-Hartman
maintainerPATCH 113/135 xtensa: Fix refcount leak bug in time.c
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
commit a0117dc956429f2ede17b323046e1968d1849150 upstream.
In calibrate_ccount(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore.
Message-Id: <[email protected]>
--- arch/xtensa/kernel/time.c | 1 + 1 file changed, 1 insertion(+)
arch/xtensa/kernel/time.c +1 -0
@@ -154,6 +154,7 @@ static void __init calibrate_ccount(void cpu =of_find_compatible_node (NULL ,NULL ,"cdns,xtensa-cpu" );if (cpu) { clk =of_clk_get (cpu,0 ); +of_node_put (cpu);if (!IS_ERR (clk)) { ccount_freq =clk_get_rate (clk);return ;
Greg Kroah-Hartman
maintainerPATCH 114/135 parisc/stifb: Fix fb_is_primary_device() only available with CONFIG_FB_STI
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 1d0811b03eb30b2f0793acaa96c6ce90b8b9c87a upstream.
Fix this build error noticed by the kernel test robot:
drivers/video/console/sticore.c:1132:5: error: redefinition of 'fb_is_primary_device'
arch/parisc/include/asm/fb.h:18:19: note: previous definition of 'fb_is_primary_device'
--- arch/parisc/include/asm/fb.h | 2 +- drivers/video/console/sticore.c | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-)
arch/parisc/include/asm/fb.h +1 -1
@@ -12,7 +12,7 @@ static inline void fb_pgprotect(struct fpgprot_val (vma->vm_page_prot) |= _PAGE_NO_CACHE; } -#if defined(CONFIG_STI_CONSOLE ) || defined(CONFIG_FB_STI ) +#if defined(CONFIG_FB_STI )int fb_is_primary_device (struct fb_info *info);#else static inline int fb_is_primary_device (struct fb_info *info)
drivers/video/console/sticore.c +2 -0
@@ -1127,6 +1127,7 @@ int sti_call(const struct sti_struct *streturn ret; } +#if defined(CONFIG_FB_STI )/* check if given fb_info is the primary device */ int fb_is_primary_device (struct fb_info *info) {
@@ -1142,6 +1143,7 @@ int fb_is_primary_device(struct fb_info return (sti->info == info); }EXPORT_SYMBOL (fb_is_primary_device); +#endif MODULE_AUTHOR ("Philipp Rumpf, Helge Deller, Thomas Bogendoerfer" );MODULE_DESCRIPTION ("Core STI driver for HP's NGLE series graphics cards in HP PARISC machines" );
Greg Kroah-Hartman
maintainerPATCH 115/135 parisc: Enable ARCH_HAS_STRICT_MODULE_RWX
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 0a1355db36718178becd2bfe728a023933d73123 upstream.
Fix a boot crash on a c8000 machine as reported by Dave. Basically it changes patch_map() to return an alias mapping to the to-be-patched code in order to prevent writing to write-protected memory.
--- arch/parisc/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/parisc/Kconfig +1 -0
@@ -9,6 +9,7 @@ config PARISC select ARCH_WANT_FRAME_POINTERS select ARCH_HAS_ELF_RANDOMIZE select ARCH_HAS_STRICT_KERNEL_RWX + select ARCH_HAS_STRICT_MODULE_RWX select ARCH_HAS_UBSAN_SANITIZE_ALL select ARCH_NO_SG_CHAIN select ARCH_SUPPORTS_HUGETLBFS if PA20
Greg Kroah-Hartman
maintainerPATCH 116/135 powerpc/microwatt: wire up rng during setup_arch()
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit 20a9689b3607456d92c6fb764501f6a95950b098 upstream.
The platform's RNG must be available before random_init() in order to be useful for initial seeding, which in turn means that it needs to be called from setup_arch(), rather than from an init call. Fortunately, each platform already has a setup_arch function pointer, which means it's easy to wire this up. This commit also removes some noisy log messages that don't add much.
--- arch/powerpc/platforms/microwatt/microwatt.h | 7 +++++++ arch/powerpc/platforms/microwatt/rng.c | 10 +++------- arch/powerpc/platforms/microwatt/setup.c | 8 ++++++++ 3 files changed, 18 insertions(+), 7 deletions(-) create mode 100644 arch/powerpc/platforms/microwatt/microwatt.h
arch/powerpc/platforms/microwatt/microwatt.h new file +7 -0
@@ -0,0 +1,7 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _MICROWATT_H +#define _MICROWATT_H + +void microwatt_rng_init (void ); + +#endif /* _MICROWATT_H */
arch/powerpc/platforms/microwatt/rng.c +3 -7
@@ -11,6 +11,7 @@#include <asm/archrandom.h> #include <asm/cputable.h> #include <asm/machdep.h> +#include "microwatt.h" #define DARN_ERR 0xFFFFFFFFFFFFFFFFul
@@ -29,7 +30,7 @@ static int microwatt_get_random_darn(unsigned long *v)return 1 ; } -static __init int rng_init (void ) +void __init microwatt_rng_init (void ) {unsigned long val;int i;
@@ -37,12 +38,7 @@ static __init int rng_init(void)for (i =0 ; i <10 ; i++) {if (microwatt_get_random_darn (&val)) { ppc_md.get_random_seed = microwatt_get_random_darn; -return 0 ; +return ; } } - -pr_warn ("Unable to use DARN for get_random_seed()\n" ); - -return -EIO ; } -machine_subsys_initcall(, rng_init);
arch/powerpc/platforms/microwatt/setup.c +8 -0
@@ -16,6 +16,8 @@#include <asm/xics.h> #include <asm/udbg.h> +#include "microwatt.h" +static void __init microwatt_init_IRQ (void ) {xics_init ();
@@ -32,10 +34,16 @@ static int __init microwatt_populate(void) }machine_arch_initcall (microwatt, microwatt_populate); +static void __init microwatt_setup_arch (void ) +{ +microwatt_rng_init (); +} +define_machine (microwatt) { .name = "microwatt", .probe = microwatt_probe, .init_IRQ = microwatt_init_IRQ, + .setup_arch = microwatt_setup_arch, .progress = udbg_progress, .calibrate_decr = generic_calibrate_decr, };
Signature · 1 line
2.36.1
Greg Kroah-Hartman
maintainerPATCH 117/135 powerpc: Enable execve syscall exit tracepoint
In reply to Greg Kroah-HartmanFrom: Naveen N. Rao <[email protected]>
commit ec6d0dde71d760aa60316f8d1c9a1b0d99213529 upstream.
On execve[at], we are zero'ing out most of the thread register state including gpr[0], which contains the syscall number. Due to this, we fail to trigger the syscall exit tracepoint properly. Fix this by retaining gpr[0] in the thread register state.
Before this patch:
# tail /sys/kernel/debug/tracing/trace cat-123 [000] ..... 61.449351: sys_execve(filename: 7fffa6b23448, argv: 7fffa6b233e0, envp: 7fffa6b233f8) cat-124 [000] ..... 62.428481: sys_execve(filename: 7fffa6b23448, argv: 7fffa6b233e0, envp: 7fffa6b233f8) echo-125 [000] ..... 65.813702: sys_execve(filename: 7fffa6b23378, argv: 7fffa6b233a0, envp: 7fffa6b233b0) echo-125 [000] ..... 65.822214: sys_execveat(fd: 0, filename: 1009ac48, argv: 7ffff65d0c98, envp: 7ffff65d0ca8, flags: 0)
After this patch:
# tail /sys/kernel/debug/tracing/trace cat-127 [000] ..... 100.416262: sys_execve(filename: 7fffa41b3448, argv: 7fffa41b33e0, envp: 7fffa41b33f8) cat-127 [000] ..... 100.418203: sys_execve -> 0x0 echo-128 [000] ..... 103.873968: sys_execve(filename: 7fffa41b3378, argv: 7fffa41b33a0, envp: 7fffa41b33b0) echo-128 [000] ..... 103.875102: sys_execve -> 0x0 echo-128 [000] ..... 103.882097: sys_execveat(fd: 0, filename: 1009ac48, argv: 7fffd10d2148, envp: 7fffd10d2158, flags: 0) echo-128 [000] ..... 103.883225: sys_execveat -> 0x0
--- arch/powerpc/kernel/process.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/process.c +1 -1
@@ -1818,7 +1818,7 @@ void start_thread(struct pt_regs *regs,tm_reclaim_current (0 );#endif -memset (regs->gpr,0 ,sizeof (regs->gpr)); +memset (®s->gpr[1 ],0 ,sizeof (regs->gpr) -sizeof (regs->gpr[0 ])); regs->ctr =0 ; regs->link =0 ; regs->xer =0 ;
Greg Kroah-Hartman
maintainerPATCH 118/135 powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address
In reply to Greg Kroah-HartmanFrom: Andrew Donnellan <[email protected]>
commit 7bc08056a6dabc3a1442216daf527edf61ac24b6 upstream.
Add a special case to block_rtas_call() to allow the ibm,platform-dump RTAS call through the RTAS filter if the buffer address is 0.
According to PAPR, ibm,platform-dump is called with a null buffer address to notify the platform firmware that processing of a particular dump is finished.
Without this, on a pseries machine with CONFIG_PPC_RTAS_FILTER enabled, an application such as rtas_errd that is attempting to retrieve a dump will encounter an error at the end of the retrieval process.
--- arch/powerpc/kernel/rtas.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
arch/powerpc/kernel/rtas.c +10 -1
@@ -983,7 +983,7 @@ static struct rtas_filter rtas_filters[] { "get-time-of-day", -1, -1, -1, -1, -1 }, { "ibm,get-vpd", -1, 0, -1, 1, 2 }, { "ibm,lpar-perftools", -1, 2, 3, -1, -1 }, - { "ibm,platform-dump", -1, 4, 5, -1, -1 }, + { "ibm,platform-dump", -1, 4, 5, -1, -1 }, /* Special cased */ { "ibm,read-slot-reset-state", -1, -1, -1, -1, -1 }, { "ibm,scan-log-dump", -1, 0, 1, -1, -1 }, { "ibm,set-dynamic-indicator", -1, 2, -1, -1, -1 },
@@ -1032,6 +1032,15 @@ static bool block_rtas_call(int token, i size =1 ; end = base + size -1 ; + +/* +* Special case for ibm,platform-dump - NULL buffer +* address is used to indicate end of dump processing +*/ +if (!strcmp (f->name,"ibm,platform-dump" ) && + base ==0 ) +return false; +if (!in_rmo_buf (base, end)) goto err; }
Greg Kroah-Hartman
maintainerPATCH 119/135 powerpc/powernv: wire up rng during setup_arch
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit f3eac426657d985b97c92fa5f7ae1d43f04721f3 upstream.
The platform's RNG must be available before random_init() in order to be useful for initial seeding, which in turn means that it needs to be called from setup_arch(), rather than from an init call.
Complicating things, however, is that POWER8 systems need some per-cpu state and kmalloc, which isn't available at this stage. So we split things up into an early phase and a later opportunistic phase. This commit also removes some noisy log messages that don't add much.
--- arch/powerpc/platforms/powernv/powernv.h | 2 + arch/powerpc/platforms/powernv/rng.c | 52 +++++++++++++++++++++---------- arch/powerpc/platforms/powernv/setup.c | 2 + 3 files changed, 40 insertions(+), 16 deletions(-)
arch/powerpc/platforms/powernv/powernv.h +2 -0
@@ -42,4 +42,6 @@ ssize_t memcons_copy(struct memcons *mc,u32 memcons_get_size (struct memcons *mc);struct memcons *memcons_init (struct device_node *node,const char *mc_prop_name); +void pnv_rng_init (void ); +#endif /* _POWERNV_H */
arch/powerpc/platforms/powernv/rng.c +36 -16
90 lines not on this page · raw message
arch/powerpc/platforms/powernv/setup.c +2 -0
@@ -190,6 +190,8 @@ static void __init pnv_setup_arch(void)pnv_check_guarded_cores ();/* XXX PMCS */ + +pnv_rng_init (); }static void __init pnv_init (void )
Greg Kroah-Hartman
maintainerPATCH 120/135 drm/msm/dp: Always clear mask bits to disable interrupts at dp_ctrl_reset_irq_ctrl()
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
commit 993a2adc6e2e94a0a7b5bfc054eda90ac95f62c3 upstream.
dp_catalog_ctrl_reset() will software reset DP controller. But it will not reset programmable registers to default value. DP driver still have to clear mask bits to interrupt status registers to disable interrupts after software reset of controller.
At current implementation, dp_ctrl_reset_irq_ctrl() will software reset dp controller but did not call dp_catalog_ctrl_enable_irq(false) to clear hpd related interrupt mask bits to disable hpd related interrupts due to it mistakenly think hpd related interrupt mask bits will be cleared by software reset of dp controller automatically. This mistake may cause system to crash during suspending procedure due to unexpected irq fired and trigger event thread to access dp controller registers with controller clocks are disabled.
This patch fixes system crash during suspending problem by removing "enable" flag condition checking at dp_ctrl_reset_irq_ctrl() so that hpd related interrupt mask bits are cleared to prevent unexpected from happening.
Changes in v2:
-- add more details commit text
Changes in v3:
-- add synchrons_irq()
-- add atomic_t suspended
Changes in v4:
-- correct Fixes's commit ID
-- remove synchrons_irq()
Changes in v5:
-- revise commit text
Changes in v6:
-- add event_lock to protect "suspended"
Changes in v7:
-- delete "suspended" flag
Patchwork: https://patchwork.freedesktop.org/patch/486591/
--- drivers/gpu/drm/msm/dp/dp_ctrl.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/dp/dp_ctrl.c +7 -2
@@ -1356,8 +1356,13 @@ void dp_ctrl_reset_irq_ctrl(struct dp_ctdp_catalog_ctrl_reset (ctrl->catalog); -if (enable) -dp_catalog_ctrl_enable_irq (ctrl->catalog, enable); +/* +* all dp controller programmable registers will not +* be reset to default value after DP_SW_RESET +* therefore interrupt mask bits have to be updated +* to enable/disable interrupts +*/ +dp_catalog_ctrl_enable_irq (ctrl->catalog, enable); }void dp_ctrl_phy_init (struct dp_ctrl *dp_ctrl)
Greg Kroah-Hartman
maintainerPATCH 121/135 ARM: dts: imx7: Move hsic_phy power domain to HSIC PHY node
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
commit 552ca27929ab28b341ae9b2629f0de3a84c98ee8 upstream.
Move the power domain to its actual user. This keeps the power domain enabled even when the USB host is runtime suspended. This is necessary to detect any downstream events, like device attach.
--- arch/arm/boot/dts/imx7s.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx7s.dtsi +1 -1
@@ -104,6 +104,7 @@ compatible = "usb-nop-xceiv"; clocks = <&clks IMX7D_USB_HSIC_ROOT_CLK>; clock-names = "main_clk"; + power-domains = <&pgc_hsic_phy>; #phy-cells = <0>; };
@@ -1135,7 +1136,6 @@ compatible = "fsl,imx7d-usb", "fsl,imx27-usb"; reg = <0x30b30000 0x200>; interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>; - power-domains = <&pgc_hsic_phy>; clocks = <&clks IMX7D_USB_CTRL_CLK>; fsl,usbphy = <&usbphynop3>; fsl,usbmisc = <&usbmisc3 0>;
Greg Kroah-Hartman
maintainerPATCH 122/135 ARM: dts: imx6qdl: correct PU regulator ramp delay
In reply to Greg Kroah-HartmanFrom: Lucas Stach <[email protected]>
commit 93a8ba2a619816d631bd69e9ce2172b4d7a481b8 upstream.
Contrary to what was believed at the time, the ramp delay of 150us is not plenty for the PU LDO with the default step time of 512 pulses of the 24MHz clock. Measurements have shown that after enabling the LDO the voltage on VDDPU_CAP jumps to ~750mV in the first step and after that the regulator executes the normal ramp up as defined by the step size control.
This means it takes the regulator between 360us and 370us to ramp up to the nominal 1.15V voltage for this power domain. With the old setting of the ramp delay the power up of the PU GPC domain would happen in the middle of the regulator ramp with the voltage being at around 900mV. Apparently this was enough for most units to properly power up the peripherals in the domain and execute the reset. Some units however, fail to power up properly, especially when the chip is at a low temperature. In that case any access to the GPU registers would yield an incorrect result with no way to recover from this situation.
Change the ramp delay to 380us to cover the measured ramp up time with a bit of additional slack.
--- arch/arm/boot/dts/imx6qdl.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx6qdl.dtsi +1 -1
@@ -763,7 +763,7 @@ regulator-name = "vddpu"; regulator-min-microvolt = <725000>; regulator-max-microvolt = <1450000>; - regulator-enable-ramp-delay = <150>; + regulator-enable-ramp-delay = <380>; anatop-reg-offset = <0x140>; anatop-vol-bit-shift = <9>; anatop-vol-bit-width = <5>;
Greg Kroah-Hartman
maintainerPATCH 123/135 arm64: dts: ti: k3-am64-main: Remove support for HS400 speed mode
In reply to Greg Kroah-HartmanFrom: Aswath Govindraju <[email protected]>
commit 0c0af88f3f318e73237f7fadd02d0bf2b6c996bb upstream.
AM64 SoC, does not support HS400 and HS200 is the maximum supported speed mode[1]. Therefore, fix the device tree node to reflect the same.
[1] - https://www.ti.com/lit/ds/symlink/am6442.pdf
(SPRSP56C – JANUARY 2021 – REVISED FEBRUARY 2022)
--- arch/arm64/boot/dts/ti/k3-am64-main.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm64/boot/dts/ti/k3-am64-main.dtsi +0 -2
@@ -456,13 +456,11 @@ clock-names = "clk_ahb", "clk_xin"; mmc-ddr-1_8v; mmc-hs200-1_8v; - mmc-hs400-1_8v; ti,trm-icp = <0x2>; ti,otap-del-sel-legacy = <0x0>; ti,otap-del-sel-mmc-hs = <0x0>; ti,otap-del-sel-ddr52 = <0x6>; ti,otap-del-sel-hs200 = <0x7>; - ti,otap-del-sel-hs400 = <0x4>; }; sdhci1: mmc@fa00000 {
Greg Kroah-Hartman
maintainerPATCH 124/135 ARM: exynos: Fix refcount leak in exynos_map_pmu
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
commit c4c79525042a4a7df96b73477feaf232fe44ae81 upstream.
of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. of_node_put() checks null pointer.
--- arch/arm/mach-exynos/exynos.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-exynos/exynos.c +1 -0
@@ -149,6 +149,7 @@ static void exynos_map_pmu(void) np =of_find_matching_node (NULL , exynos_dt_pmu_match);if (np) pmu_base_addr =of_iomap (np,0 ); +of_node_put (np); }static void __init exynos_init_irq (void )
Greg Kroah-Hartman
maintainerPATCH 125/135 soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
commit 37d838de369b07b596c19ff3662bf0293fdb09ee upstream.
of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
In brcmstb_init_sram, it pass dn to of_address_to_resource(), of_address_to_resource() will call of_find_device_by_node() to take reference, so we should release the reference returned by of_find_matching_node().
--- drivers/soc/bcm/brcmstb/pm/pm-arm.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/bcm/brcmstb/pm/pm-arm.c +1 -0
@@ -783,6 +783,7 @@ static int brcmstb_pm_probe(struct platf } ret =brcmstb_init_sram (dn); +of_node_put (dn);if (ret) {pr_err ("error setting up SRAM for PM\n" );return ret;
Greg Kroah-Hartman
maintainerPATCH 126/135 ARM: Fix refcount leak in axxia_boot_secondary
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
commit 7c7ff68daa93d8c4cdea482da4f2429c0398fcde upstream.
of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
--- arch/arm/mach-axxia/platsmp.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-axxia/platsmp.c +1 -0
@@ -39,6 +39,7 @@ static int axxia_boot_secondary(unsignedreturn -ENOENT ; syscon =of_iomap (syscon_np,0 ); +of_node_put (syscon_np);if (!syscon)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 127/135 memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
commit 1332661e09304b7b8e84e5edc11811ba08d12abe upstream.
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. This function doesn't call of_node_put() in some error paths. To unify the structure, Add put_node label and goto it on errors.
--- drivers/memory/samsung/exynos5422-dmc.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-)
drivers/memory/samsung/exynos5422-dmc.c +18 -11
@@ -1187,33 +1187,39 @@ static int of_get_dram_timings(struct ex dmc->timing_row =devm_kmalloc_array (dmc->dev,TIMING_COUNT ,sizeof (u32),GFP_KERNEL ); -if (!dmc->timing_row) -return -ENOMEM ; +if (!dmc->timing_row) { + ret = -ENOMEM ; + goto put_node; + } dmc->timing_data =devm_kmalloc_array (dmc->dev,TIMING_COUNT ,sizeof (u32),GFP_KERNEL ); -if (!dmc->timing_data) -return -ENOMEM ; +if (!dmc->timing_data) { + ret = -ENOMEM ; + goto put_node; + } dmc->timing_power =devm_kmalloc_array (dmc->dev,TIMING_COUNT ,sizeof (u32),GFP_KERNEL ); -if (!dmc->timing_power) -return -ENOMEM ; +if (!dmc->timing_power) { + ret = -ENOMEM ; + goto put_node; + } dmc->timings =of_lpddr3_get_ddr_timings (np_ddr, dmc->dev,DDR_TYPE_LPDDR3 , &dmc->timings_arr_size);if (!dmc->timings) { -of_node_put (np_ddr);dev_warn (dmc->dev,"could not get timings from DT\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_node; } dmc->min_tck =of_lpddr3_get_min_tck (np_ddr, dmc->dev);if (!dmc->min_tck) { -of_node_put (np_ddr);dev_warn (dmc->dev,"could not get tck from DT\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_node; }/* Sorted array of OPPs with frequency ascending */
@@ -1227,13 +1233,14 @@ static int of_get_dram_timings(struct ex clk_period_ps); } -of_node_put (np_ddr);/* Take the highest frequency's timings as 'bypass' */ dmc->bypass_timing_row = dmc->timing_row[idx -1 ]; dmc->bypass_timing_data = dmc->timing_data[idx -1 ]; dmc->bypass_timing_power = dmc->timing_power[idx -1 ]; +put_node: +of_node_put (np_ddr);return ret; }
Greg Kroah-Hartman
maintainerPATCH 128/135 ARM: cns3xxx: Fix refcount leak in cns3xxx_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
commit 1ba904b6b16e08de5aed7c1349838d9cd0d178c5 upstream.
of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
--- arch/arm/mach-cns3xxx/core.c | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/mach-cns3xxx/core.c +2 -0
@@ -372,6 +372,7 @@ static void __init cns3xxx_init(void)/* De-Asscer SATA Reset */ cns3xxx_pwr_soft_rst (CNS3XXX_PWR_SOFTWARE_RST (SATA )); } +of_node_put (dn); dn =of_find_compatible_node (NULL ,NULL ,"cavium,cns3420-sdhci" );if (of_device_is_available (dn)) {
@@ -385,6 +386,7 @@ static void __init cns3xxx_init(void)cns3xxx_pwr_clk_en (CNS3XXX_PWR_CLK_EN (SDIO ));cns3xxx_pwr_soft_rst (CNS3XXX_PWR_SOFTWARE_RST (SDIO )); } +of_node_put (dn); pm_power_off = cns3xxx_power_off;
Greg Kroah-Hartman
maintainerPATCH 129/135 modpost: fix section mismatch check for exported init/exit sections
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
commit 28438794aba47a27e922857d27b31b74e8559143 upstream.
Since commit f02e8a6596b7 ("module: Sort exported symbols"), EXPORT_SYMBOL* is placed in the individual section ___ksymtab(_gpl)+<sym> (3 leading underscores instead of 2).
Since then, modpost cannot detect the bad combination of EXPORT_SYMBOL and __init/__exit.
Fix the .fromsec field.
--- scripts/mod/modpost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/mod/modpost.c +1 -1
@@ -1108,7 +1108,7 @@ static const struct sectioncheck section },/* Do not export init/exit functions or data */ { - .fromsec = { "__ksymtab*", NULL }, + .fromsec = { "___ksymtab*", NULL }, .bad_tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL }, .mismatch = EXPORT_TO_INIT_EXIT, .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
Greg Kroah-Hartman
maintainerPATCH 130/135 ARM: dts: bcm2711-rpi-400: Fix GPIO line names
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
commit b9b6d4c925604b70d007feb4c77b8cc4c038d2da upstream.
The GPIO expander line names has been fixed in the vendor tree last year, so upstream these changes.
--- arch/arm/boot/dts/bcm2711-rpi-400.dts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/bcm2711-rpi-400.dts +3 -3
@@ -28,12 +28,12 @@ &expgpio { gpio-line-names = "BT_ON", "WL_ON", - "", + "PWR_LED_OFF", "GLOBAL_RESET", "VDD_SD_IO_SEL", - "CAM_GPIO", + "GLOBAL_SHUTDOWN", "SD_PWR_ON", - "SD_OC_N"; + "SHUTDOWN_REQUEST"; }; &genet_mdio {
Greg Kroah-Hartman
maintainerPATCH 131/135 random: update comment from copy_to_user() -> copy_to_iter()
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit 63b8ea5e4f1a87dea4d3114293fc8e96a8f193d7 upstream.
This comment wasn't updated when we moved from read() to read_iter(), so this patch makes the trivial fix.
--- drivers/char/random.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/random.c +1 -1
@@ -452,7 +452,7 @@ static ssize_t get_random_bytes_user(str/* * Immediately overwrite the ChaCha key at index 4 with random -* bytes, in case userspace causes copy_to_user() below to sleep +* bytes, in case userspace causes copy_to_iter() below to sleep * forever, so that we still retain forward secrecy in that case. */ crng_make_state (chacha_state, (u8 *)&chacha_state[4 ],CHACHA_KEY_SIZE );
Greg Kroah-Hartman
maintainerPATCH 132/135 perf build-id: Fix caching files with a wrong build ID
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
commit ab66fdace8581ef3b4e7cf5381a168ed4058d779 upstream.
Build ID events associate a file name with a build ID. However, when using perf inject, there is no guarantee that the file on the current machine at the current time has that build ID. Fix by comparing the build IDs and skip adding to the cache if they are different.
Example:
$ echo "int main() {return 0;}" > prog.c
$ gcc -o prog prog.c
$ perf record --buildid-all ./prog
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.019 MB perf.data ]
$ file-buildid() { file $1 | awk -F= '{print $2}' | awk -F, '{print $1}' ; }
$ file-buildid prog
444ad9be165d8058a48ce2ffb4e9f55854a3293e
$ file-buildid ~/.debug/$(pwd)/prog/444ad9be165d8058a48ce2ffb4e9f55854a3293e/elf
444ad9be165d8058a48ce2ffb4e9f55854a3293e
$ echo "int main() {return 1;}" > prog.c
$ gcc -o prog prog.c
$ file-buildid prog
885524d5aaa24008a3e2b06caa3ea95d013c0fc5Before:
$ perf buildid-cache --purge $(pwd)/prog $ perf inject -i perf.data -o junk $ file-buildid ~/.debug/$(pwd)/prog/444ad9be165d8058a48ce2ffb4e9f55854a3293e/elf 885524d5aaa24008a3e2b06caa3ea95d013c0fc5 $
After:
$ perf buildid-cache --purge $(pwd)/prog $ perf inject -i perf.data -o junk $ file-buildid ~/.debug/$(pwd)/prog/444ad9be165d8058a48ce2ffb4e9f55854a3293e/elf
$
--- tools/perf/util/build-id.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
tools/perf/util/build-id.c +28 -0
@@ -872,6 +872,30 @@ out_free:return err; } +static int filename__read_build_id_ns (const char *filename, +struct build_id *bid, +struct nsinfo *nsi) +{ +struct nscookie nsc; +int ret; + +nsinfo__mountns_enter (nsi, &nsc); + ret =filename__read_build_id (filename, bid); +nsinfo__mountns_exit (&nsc); + +return ret; +} + +static bool dso__build_id_mismatch (struct dso *dso,const char *name) +{ +struct build_id bid; + +if (filename__read_build_id_ns (name, &bid, dso->nsinfo) <0 ) +return false; + +return !dso__build_id_equal (dso, &bid); +} +static int dso__cache_build_id (struct dso *dso,struct machine *machine,void *priv__maybe_unused ) {
@@ -886,6 +910,10 @@ static int dso__cache_build_id(struct ds is_kallsyms = true; name = machine->mmap_name; } + +if (!is_kallsyms &&dso__build_id_mismatch (dso, name)) +return 0 ; +return build_id_cache__add_b (&dso->bid, name, dso->nsinfo, is_kallsyms, is_vdso); }
Greg Kroah-Hartman
maintainerPATCH 133/135 dma-direct: use the correct size for dma_set_encrypted()
In reply to Greg Kroah-HartmanFrom: Dexuan Cui <[email protected]>
commit 3be4562584bba603f33863a00c1c32eecf772ee6 upstream.
The third parameter of dma_set_encrypted() is a size in bytes rather than the number of pages.
--- kernel/dma/direct.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
kernel/dma/direct.c +2 -3
@@ -323,7 +323,7 @@ void dma_direct_free(struct device *dev, }else {if (IS_ENABLED (CONFIG_ARCH_HAS_DMA_CLEAR_UNCACHED ))arch_dma_clear_uncached (cpu_addr, size); -if (dma_set_encrypted (dev, cpu_addr,1 << page_order)) +if (dma_set_encrypted (dev, cpu_addr, size))return ; }
@@ -360,7 +360,6 @@ void dma_direct_free_pages(struct device struct page *page, dma_addr_t dma_addr, enum dma_data_direction dir) { - unsigned int page_order = get_order(size); void *vaddr = page_address(page);/* If cpu_addr is not from an atomic pool, dma_free_from_pool() fails */
@@ -368,7 +367,7 @@ void dma_direct_free_pages(struct device dma_free_from_pool(dev, vaddr, size))return ; -if (dma_set_encrypted (dev, vaddr,1 << page_order)) +if (dma_set_encrypted (dev, vaddr, size))return ;__dma_direct_free_pages (dev, page, size); }
Greg Kroah-Hartman
maintainerPATCH 134/135 kbuild: link vmlinux only once for CONFIG_TRIM_UNUSED_KSYMS (2nd attempt)
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
commit 53632ba87d9f302a8d97a11ec2f4f4eec7bb75ea upstream.
If CONFIG_TRIM_UNUSED_KSYMS is enabled and the kernel is built from a pristine state, the vmlinux is linked twice.
Commit 3fdc7d3fe4c0 ("kbuild: link vmlinux only once for CONFIG_TRIM_UNUSED_KSYMS") explains why this happens, but it did not fix the issue at all.
Now I realized I had applied a wrong patch.
In v1 patch [1], the autoksyms_recursive target correctly recurses to "$(MAKE) -f $(srctree)/Makefile autoksyms_recursive".
In v2 patch [2], I accidentally dropped the diff line, and it recurses to "$(MAKE) -f $(srctree)/Makefile vmlinux".
Restore the code I intended in v1.
[1]: https://lore.kernel.org/linux-kbuild/[email protected]/
[2]: https://lore.kernel.org/linux-kbuild/[email protected]/
--- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Makefile +1 -1
@@ -1163,7 +1163,7 @@ KBUILD_MODULES := 1 autoksyms_recursive: descend modules.order $(Q)$(CONFIG_SHELL) $(srctree)/scripts/adjust_autoksyms.sh \ - "$(MAKE) -f $(srctree)/Makefile vmlinux" + "$(MAKE) -f $(srctree)/Makefile autoksyms_recursive" endif autoksyms_h := $(if $(CONFIG_TRIM_UNUSED_KSYMS), include/generated/autoksyms.h)
Greg Kroah-Hartman
maintainerPATCH 135/135 powerpc/pseries: wire up rng during setup_arch()
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit e561e472a3d441753bd012333b057f48fef1045b upstream.
The platform's RNG must be available before random_init() in order to be useful for initial seeding, which in turn means that it needs to be called from setup_arch(), rather than from an init call. Fortunately, each platform already has a setup_arch function pointer, which means it's easy to wire this up. This commit also removes some noisy log messages that don't add much.
--- arch/powerpc/platforms/pseries/pseries.h | 2 ++ arch/powerpc/platforms/pseries/rng.c | 11 +++-------- arch/powerpc/platforms/pseries/setup.c | 2 ++ 3 files changed, 7 insertions(+), 8 deletions(-)
arch/powerpc/platforms/pseries/pseries.h +2 -0
@@ -115,4 +115,6 @@ extern u32 pseries_security_flavor;void pseries_setup_security_mitigations (void );void pseries_lpar_read_hblkrm_characteristics (void ); +void pseries_rng_init (void ); +#endif /* _PSERIES_PSERIES_H */
arch/powerpc/platforms/pseries/rng.c +3 -8
@@ -10,6 +10,7 @@#include <asm/archrandom.h> #include <asm/machdep.h> #include <asm/plpar_wrappers.h> +#include "pseries.h" static int pseries_get_random_long (unsigned long *v)
@@ -24,19 +25,13 @@ static int pseries_get_random_long(unsigreturn 0 ; } -static __init int rng_init (void ) +void __init pseries_rng_init (void ) {struct device_node *dn; dn =of_find_compatible_node (NULL ,NULL ,"ibm,random" );if (!dn) -return -ENODEV ; - -pr_info ("Registering arch random hook.\n" ); - +return ; ppc_md.get_random_seed = pseries_get_random_long; -of_node_put (dn); -return 0 ; } -machine_subsys_initcall (pseries, rng_init);
arch/powerpc/platforms/pseries/setup.c +2 -0
@@ -840,6 +840,8 @@ static void __init pSeries_setup_arch(voif (swiotlb_force ==SWIOTLB_FORCE ) ppc_swiotlb_enable =1 ; + +pseries_rng_init (); }static void pseries_panic (char *str)
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.51 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jun 2022 11:19:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.51-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.15:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
114 tests: 114 pass, 0 failLinux version: 5.15.51-rc1-g2c21dc5c2cb6
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.51 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jun 2022 11:19:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.51-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:
Signature · 1 line
Florian
Hello!
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.51 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jun 2022 11:19:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.51-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro's test farm.
The following new warnings have been found while building ixp4xx_defconfig for Arm combinations with GCC:
WARNING: modpost: vmlinux.o(___ksymtab_gpl+ixp4xx_irq_init+0x0): Section mismatch in reference from the variable __ksymtab_ixp4xx_irq_init to the function .init.text:ixp4xx_irq_init() The symbol ixp4xx_irq_init is exported and annotated __init
Fix this by removing the __init annotation of ixp4xx_irq_init or drop the export.
WARNING: modpost: vmlinux.o(___ksymtab_gpl+ixp4xx_timer_setup+0x0): Section mismatch in reference from the variable __ksymtab_ixp4xx_timer_setup to the function .init.text:ixp4xx_timer_setup() The symbol ixp4xx_timer_setup is exported and annotated __init
Fix this by removing the __init annotation of ixp4xx_timer_setup or drop the export.
## Build
* kernel: 5.15.51-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.15.y
* git commit: 2c21dc5c2cb635c1b549c0f3eb0ff3d3744be11a
* git describe: v5.15.50-136-g2c21dc5c2cb6
* test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.15.y/build/v5.15.50-136-g2c21dc5c2cb6
## No test regressions (compared to v5.15.48-116-g18a33c8dabb8)
## Metric Regressions (compared to v5.15.48-116-g18a33c8dabb8)
* arm, build
- gcc-8-ixp4xx_defconfig-warnings
- gcc-9-ixp4xx_defconfig-warnings
- gcc-10-ixp4xx_defconfig-warnings
- gcc-11-ixp4xx_defconfig-warnings
## No test fixes (compared to v5.15.48-116-g18a33c8dabb8)
## No metric fixes (compared to v5.15.48-116-g18a33c8dabb8)
## Test result summary
total: 122583, pass: 109673, fail: 286, skip: 12014, xfail: 610
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 314 total, 314 passed, 0 failed
* arm64: 58 total, 58 passed, 0 failed
* i386: 52 total, 49 passed, 3 failed
* mips: 37 total, 37 passed, 0 failed
* parisc: 12 total, 12 passed, 0 failed
* powerpc: 54 total, 54 passed, 0 failed
* riscv: 22 total, 22 passed, 0 failed
* s390: 21 total, 21 passed, 0 failed
* sh: 24 total, 24 passed, 0 failed
* sparc: 12 total, 12 passed, 0 failed
* x86_64: 56 total, 55 passed, 1 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-open-posix-tests
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* packetdrill
* perf
* rcutorture
* ssuite
* v4l2-compliance
* vdso
Greetings!
Daniel Díaz
[email protected]
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 24 lines · Daniel Díaz
Hello!
Quoted 14 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.51 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jun 2022 11:19:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.51-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below.Quoted 3 lines
thanks,
greg k-h
Results from Linaro's test farm.
The following new warnings have been found while buildingixp4xx_defconfigfor Arm combinations with GCC:
Quoted 8 lines
WARNING: modpost:
vmlinux.o(___ksymtab_gpl+ixp4xx_irq_init+0x0): Section mismatch in reference from the variable__ksymtab_ixp4xx_irq_initto the function .init.text:ixp4xx_irq_init() The symbolixp4xx_irq_initis exported and annotated__init
Fix this by removing the__initannotation ofixp4xx_irq_initor drop the export.WARNING: modpost:
vmlinux.o(___ksymtab_gpl+ixp4xx_timer_setup+0x0): Section mismatch in reference from the variable__ksymtab_ixp4xx_timer_setupto the function .init.text:ixp4xx_timer_setup() The symbolixp4xx_timer_setupis exported and annotated__init
Fix this by removing the__initannotation ofixp4xx_timer_setupor drop the export.
This is a side effect of commit 03c1120b3d9c ("modpost: fix section mismatch check for exported init/exit sections") which exposes the above problems.
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.51 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jun 2022 11:19:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.51-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.51 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jun 2022 11:19:09 +0000. Anything received after that time might be too late.
Build results:
total: 159 pass: 159 fail: 0 Qemu test results: total: 488 pass: 488 fail: 0
Guenter
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.51 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Successfully cross-compiled for arm (multi_v7_defconfig, GCC 12.1.0, armv7 with neon FPU) and arm64 (bcm2711_defconfig, GCC 12.1.0).
But I see a warning on arm64 build:
CC [M] drivers/staging/r8188eu/core/rtw_br_ext.o CC [M] net/batman-adv/tvlv.o
In function '__nat25_add_pppoe_tag',
inlined from 'nat25_db_handle' at drivers/staging/r8188eu/core/rtw_br_ext.c:520:11:
drivers/staging/r8188eu/core/rtw_br_ext.c:83:9: warning: 'memcpy' reading between 2052 and 9220 bytes from a region of size 40 [-Wstringop-overread]
83 | memcpy((unsigned char *)ph->tag, tag, data_len);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/staging/r8188eu/core/rtw_br_ext.c: In function 'nat25_db_handle':drivers/staging/r8188eu/core/rtw_br_ext.c:489:63: note: source object 'tag_buf' of size 40
489 | unsigned char tag_buf[40];
| ^~~~~~~
Introduced by commit 15865124feed88 ("staging: r8188eu: introduce new core dir for RTL8188eu driver").
Anyway,
Signature · 1 line
An old man doll... just what I always wanted! - Clara
Greg Kroah-Hartman
maintainerQuoted 19 lines · Bagas Sanjaya
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.51 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Successfully cross-compiled for arm (
multi_v7_defconfig, GCC 12.1.0, armv7 with neon FPU) and arm64 (bcm2711_defconfig, GCC 12.1.0).But I see a warning on arm64 build:
CC [M]
drivers/staging/r8188eu/core/rtw_br_ext.oCC [M]net/batman-adv/tvlv.o
In function '__nat25_add_pppoe_tag',inlined from 'nat25_db_handle' at drivers/staging/r8188eu/core/rtw_br_ext.c:520:11: drivers/staging/r8188eu/core/rtw_br_ext.c:83:9: warning: 'memcpy' reading between 2052 and 9220 bytes from a region of size 40 [-Wstringop-overread] 83 | memcpy((unsigned char *)ph->tag, tag, data_len); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Quoted 7 lines
drivers/staging/r8188eu/core/rtw_br_ext.c: In function 'nat25_db_handle':drivers/staging/r8188eu/core/rtw_br_ext.c:489:63: note: source object 'tag_buf' of size 40
489 | unsigned char tag_buf[40];
| ^~~~~~~Introduced by commit
15865124feed88("staging: r8188eu: introduce new core dir for RTL8188eu driver").
That is due to gcc-12 stuff.
thanks for testing.
thanks,
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.51 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jun 2022 11:19:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.51-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.51 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jun 2022 11:19:09 +0000. Anything received after that time might be too late.
Build test (gcc version 11.3.1 20220627):
mips: 62 configs -> no failure
arm: 99 configs -> no failure
arm64: 3 configs -> no failurex86_64: 4 configs -> no failure
alpha allmodconfig -> no failure
csky allmodconfig -> no failure
powerpc allmodconfig -> no failure
riscv allmodconfig -> no failure
s390 allmodconfig -> no failure
xtensa allmodconfig -> no failure
Boot test:x86_64: Booted on my test laptop. No regression.x86_64: Booted on qemu. No regression. [1]
arm64: Booted on rpi4b (4GB model). No regression. [2]
mips: Booted on ci20 board. No regression. [3]
[1]. https://openqa.qa.codethink.co.uk/tests/1403
[2]. https://openqa.qa.codethink.co.uk/tests/1408
[3]. https://openqa.qa.codethink.co.uk/tests/1410
--
Regards
Sudip