5.15.63-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainerPATCH 172/244 clk: ti: Stop using legacy clkctrl names for omap4 and 5
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit 255584b138343d4a28c6d25bd82d04b09460d672 ]
With the addition of clock-output-names, we can now unify the internal clock naming for omap4 and 5 to follow the other TI SoCs.
We are still using legacy clkctrl names for omap4 and 5 based on the clock manager name which is wrong. Instead, we want to use the clkctrl clock based naming.
We must now also drop the legacy TI_CLK_CLKCTRL_COMPAT quirk for the clkctrl clock.
This change will allow further devicetree warning cleanup as already done for am3/4 and dra7.
--- drivers/clk/ti/clk-44xx.c | 210 +++++++++++++++++++------------------- drivers/clk/ti/clk-54xx.c | 160 ++++++++++++++--------------- drivers/clk/ti/clkctrl.c | 4 - 3 files changed, 185 insertions(+), 189 deletions(-)
drivers/clk/ti/clk-44xx.c +105 -105
@@ -56,7 +56,7 @@ static const struct omap_clkctrl_bit_data omap4_aess_bit_data[] __initconst = { };static const char *const omap4_func_dmic_abe_gfclk_parents[]__initconst = { -"abe_cm:clk:0018:26" , +"abe-clkctrl:0018:26" ,"pad_clks_ck" ,"slimbus_clk" ,NULL ,
@@ -76,7 +76,7 @@ static const struct omap_clkctrl_bit_data omap4_dmic_bit_data[] __initconst = { };static const char *const omap4_func_mcasp_abe_gfclk_parents[]__initconst = { -"abe_cm:clk:0020:26" , +"abe-clkctrl:0020:26" ,"pad_clks_ck" ,"slimbus_clk" ,NULL ,
@@ -89,7 +89,7 @@ static const struct omap_clkctrl_bit_data omap4_mcasp_bit_data[] __initconst = { };static const char *const omap4_func_mcbsp1_gfclk_parents[]__initconst = { -"abe_cm:clk:0028:26" , +"abe-clkctrl:0028:26" ,"pad_clks_ck" ,"slimbus_clk" ,NULL ,
@@ -102,7 +102,7 @@ static const struct omap_clkctrl_bit_data omap4_mcbsp1_bit_data[] __initconst = };static const char *const omap4_func_mcbsp2_gfclk_parents[]__initconst = { -"abe_cm:clk:0030:26" , +"abe-clkctrl:0030:26" ,"pad_clks_ck" ,"slimbus_clk" ,NULL ,
@@ -115,7 +115,7 @@ static const struct omap_clkctrl_bit_data omap4_mcbsp2_bit_data[] __initconst = };static const char *const omap4_func_mcbsp3_gfclk_parents[]__initconst = { -"abe_cm:clk:0038:26" , +"abe-clkctrl:0038:26" ,"pad_clks_ck" ,"slimbus_clk" ,NULL ,
@@ -183,18 +183,18 @@ static const struct omap_clkctrl_bit_data omap4_timer8_bit_data[] __initconst =static const struct omap_clkctrl_reg_data omap4_abe_clkctrl_regs[]__initconst = { {OMAP4_L4_ABE_CLKCTRL ,NULL ,0 ,"ocp_abe_iclk" }, - {OMAP4_AESS_CLKCTRL , omap4_aess_bit_data,CLKF_SW_SUP ,"abe_cm:clk:0008:24" }, + {OMAP4_AESS_CLKCTRL , omap4_aess_bit_data,CLKF_SW_SUP ,"abe-clkctrl:0008:24" }, {OMAP4_MCPDM_CLKCTRL ,NULL ,CLKF_SW_SUP ,"pad_clks_ck" }, - {OMAP4_DMIC_CLKCTRL , omap4_dmic_bit_data,CLKF_SW_SUP ,"abe_cm:clk:0018:24" }, - {OMAP4_MCASP_CLKCTRL , omap4_mcasp_bit_data,CLKF_SW_SUP ,"abe_cm:clk:0020:24" }, - {OMAP4_MCBSP1_CLKCTRL , omap4_mcbsp1_bit_data,CLKF_SW_SUP ,"abe_cm:clk:0028:24" }, - {OMAP4_MCBSP2_CLKCTRL , omap4_mcbsp2_bit_data,CLKF_SW_SUP ,"abe_cm:clk:0030:24" }, - {OMAP4_MCBSP3_CLKCTRL , omap4_mcbsp3_bit_data,CLKF_SW_SUP ,"abe_cm:clk:0038:24" }, - {OMAP4_SLIMBUS1_CLKCTRL , omap4_slimbus1_bit_data,CLKF_SW_SUP ,"abe_cm:clk:0040:8" }, - {OMAP4_TIMER5_CLKCTRL , omap4_timer5_bit_data,CLKF_SW_SUP ,"abe_cm:clk:0048:24" }, - {OMAP4_TIMER6_CLKCTRL , omap4_timer6_bit_data,CLKF_SW_SUP ,"abe_cm:clk:0050:24" }, - {OMAP4_TIMER7_CLKCTRL , omap4_timer7_bit_data,CLKF_SW_SUP ,"abe_cm:clk:0058:24" }, - {OMAP4_TIMER8_CLKCTRL , omap4_timer8_bit_data,CLKF_SW_SUP ,"abe_cm:clk:0060:24" }, + {OMAP4_DMIC_CLKCTRL , omap4_dmic_bit_data,CLKF_SW_SUP ,"abe-clkctrl:0018:24" }, + {OMAP4_MCASP_CLKCTRL , omap4_mcasp_bit_data,CLKF_SW_SUP ,"abe-clkctrl:0020:24" }, + {OMAP4_MCBSP1_CLKCTRL , omap4_mcbsp1_bit_data,CLKF_SW_SUP ,"abe-clkctrl:0028:24" }, + {OMAP4_MCBSP2_CLKCTRL , omap4_mcbsp2_bit_data,CLKF_SW_SUP ,"abe-clkctrl:0030:24" }, + {OMAP4_MCBSP3_CLKCTRL , omap4_mcbsp3_bit_data,CLKF_SW_SUP ,"abe-clkctrl:0038:24" }, + {OMAP4_SLIMBUS1_CLKCTRL , omap4_slimbus1_bit_data,CLKF_SW_SUP ,"abe-clkctrl:0040:8" }, + {OMAP4_TIMER5_CLKCTRL , omap4_timer5_bit_data,CLKF_SW_SUP ,"abe-clkctrl:0048:24" }, + {OMAP4_TIMER6_CLKCTRL , omap4_timer6_bit_data,CLKF_SW_SUP ,"abe-clkctrl:0050:24" }, + {OMAP4_TIMER7_CLKCTRL , omap4_timer7_bit_data,CLKF_SW_SUP ,"abe-clkctrl:0058:24" }, + {OMAP4_TIMER8_CLKCTRL , omap4_timer8_bit_data,CLKF_SW_SUP ,"abe-clkctrl:0060:24" }, {OMAP4_WD_TIMER3_CLKCTRL ,NULL ,CLKF_SW_SUP ,"sys_32k_ck" }, {0 }, };
@@ -287,7 +287,7 @@ static const struct omap_clkctrl_bit_data omap4_fdif_bit_data[] __initconst = {static const struct omap_clkctrl_reg_data omap4_iss_clkctrl_regs[]__initconst = { {OMAP4_ISS_CLKCTRL , omap4_iss_bit_data,CLKF_SW_SUP ,"ducati_clk_mux_ck" }, - {OMAP4_FDIF_CLKCTRL , omap4_fdif_bit_data,CLKF_SW_SUP ,"iss_cm:clk:0008:24" }, + {OMAP4_FDIF_CLKCTRL , omap4_fdif_bit_data,CLKF_SW_SUP ,"iss-clkctrl:0008:24" }, {0 }, };
@@ -320,7 +320,7 @@ static const struct omap_clkctrl_bit_data omap4_dss_core_bit_data[] __initconst };static const struct omap_clkctrl_reg_data omap4_l3_dss_clkctrl_regs[]__initconst = { - {OMAP4_DSS_CORE_CLKCTRL , omap4_dss_core_bit_data,CLKF_SW_SUP ,"l3_dss_cm:clk:0000:8" }, + {OMAP4_DSS_CORE_CLKCTRL , omap4_dss_core_bit_data,CLKF_SW_SUP ,"l3-dss-clkctrl:0000:8" }, {0 }, };
@@ -336,7 +336,7 @@ static const struct omap_clkctrl_bit_data omap4_gpu_bit_data[] __initconst = { };static const struct omap_clkctrl_reg_data omap4_l3_gfx_clkctrl_regs[]__initconst = { - {OMAP4_GPU_CLKCTRL , omap4_gpu_bit_data,CLKF_SW_SUP ,"l3_gfx_cm:clk:0000:24" }, + {OMAP4_GPU_CLKCTRL , omap4_gpu_bit_data,CLKF_SW_SUP ,"l3-gfx-clkctrl:0000:24" }, {0 }, };
@@ -372,12 +372,12 @@ static const struct omap_clkctrl_bit_data omap4_hsi_bit_data[] __initconst = { };static const char *const omap4_usb_host_hs_utmi_p1_clk_parents[]__initconst = { -"l3_init_cm:clk:0038:24" , +"l3-init-clkctrl:0038:24" ,NULL , };static const char *const omap4_usb_host_hs_utmi_p2_clk_parents[]__initconst = { -"l3_init_cm:clk:0038:25" , +"l3-init-clkctrl:0038:25" ,NULL , };
@@ -418,7 +418,7 @@ static const struct omap_clkctrl_bit_data omap4_usb_host_hs_bit_data[] __initcon };static const char *const omap4_usb_otg_hs_xclk_parents[]__initconst = { -"l3_init_cm:clk:0040:24" , +"l3-init-clkctrl:0040:24" ,NULL , };
@@ -452,14 +452,14 @@ static const struct omap_clkctrl_bit_data omap4_ocp2scp_usb_phy_bit_data[] __ini };static const struct omap_clkctrl_reg_data omap4_l3_init_clkctrl_regs[]__initconst = { - {OMAP4_MMC1_CLKCTRL , omap4_mmc1_bit_data,CLKF_SW_SUP ,"l3_init_cm:clk:0008:24" }, - {OMAP4_MMC2_CLKCTRL , omap4_mmc2_bit_data,CLKF_SW_SUP ,"l3_init_cm:clk:0010:24" }, - {OMAP4_HSI_CLKCTRL , omap4_hsi_bit_data,CLKF_HW_SUP ,"l3_init_cm:clk:0018:24" }, + {OMAP4_MMC1_CLKCTRL , omap4_mmc1_bit_data,CLKF_SW_SUP ,"l3-init-clkctrl:0008:24" }, + {OMAP4_MMC2_CLKCTRL , omap4_mmc2_bit_data,CLKF_SW_SUP ,"l3-init-clkctrl:0010:24" }, + {OMAP4_HSI_CLKCTRL , omap4_hsi_bit_data,CLKF_HW_SUP ,"l3-init-clkctrl:0018:24" }, {OMAP4_USB_HOST_HS_CLKCTRL , omap4_usb_host_hs_bit_data,CLKF_SW_SUP ,"init_60m_fclk" }, {OMAP4_USB_OTG_HS_CLKCTRL , omap4_usb_otg_hs_bit_data,CLKF_HW_SUP ,"l3_div_ck" }, {OMAP4_USB_TLL_HS_CLKCTRL , omap4_usb_tll_hs_bit_data,CLKF_HW_SUP ,"l4_div_ck" }, {OMAP4_USB_HOST_FS_CLKCTRL ,NULL ,CLKF_SW_SUP ,"func_48mc_fclk" }, - {OMAP4_OCP2SCP_USB_PHY_CLKCTRL , omap4_ocp2scp_usb_phy_bit_data,CLKF_HW_SUP ,"l3_init_cm:clk:00c0:8" }, + {OMAP4_OCP2SCP_USB_PHY_CLKCTRL , omap4_ocp2scp_usb_phy_bit_data,CLKF_HW_SUP ,"l3-init-clkctrl:00c0:8" }, {0 }, };
@@ -530,7 +530,7 @@ static const struct omap_clkctrl_bit_data omap4_gpio6_bit_data[] __initconst = { };static const char *const omap4_per_mcbsp4_gfclk_parents[]__initconst = { -"l4_per_cm:clk:00c0:26" , +"l4-per-clkctrl:00c0:26" ,"pad_clks_ck" ,NULL , };
@@ -570,12 +570,12 @@ static const struct omap_clkctrl_bit_data omap4_slimbus2_bit_data[] __initconst };static const struct omap_clkctrl_reg_data omap4_l4_per_clkctrl_regs[]__initconst = { - {OMAP4_TIMER10_CLKCTRL , omap4_timer10_bit_data,CLKF_SW_SUP ,"l4_per_cm:clk:0008:24" }, - {OMAP4_TIMER11_CLKCTRL , omap4_timer11_bit_data,CLKF_SW_SUP ,"l4_per_cm:clk:0010:24" }, - {OMAP4_TIMER2_CLKCTRL , omap4_timer2_bit_data,CLKF_SW_SUP ,"l4_per_cm:clk:0018:24" }, - {OMAP4_TIMER3_CLKCTRL , omap4_timer3_bit_data,CLKF_SW_SUP ,"l4_per_cm:clk:0020:24" }, - {OMAP4_TIMER4_CLKCTRL , omap4_timer4_bit_data,CLKF_SW_SUP ,"l4_per_cm:clk:0028:24" }, - {OMAP4_TIMER9_CLKCTRL , omap4_timer9_bit_data,CLKF_SW_SUP ,"l4_per_cm:clk:0030:24" }, + {OMAP4_TIMER10_CLKCTRL , omap4_timer10_bit_data,CLKF_SW_SUP ,"l4-per-clkctrl:0008:24" }, + {OMAP4_TIMER11_CLKCTRL , omap4_timer11_bit_data,CLKF_SW_SUP ,"l4-per-clkctrl:0010:24" }, + {OMAP4_TIMER2_CLKCTRL , omap4_timer2_bit_data,CLKF_SW_SUP ,"l4-per-clkctrl:0018:24" }, + {OMAP4_TIMER3_CLKCTRL , omap4_timer3_bit_data,CLKF_SW_SUP ,"l4-per-clkctrl:0020:24" }, + {OMAP4_TIMER4_CLKCTRL , omap4_timer4_bit_data,CLKF_SW_SUP ,"l4-per-clkctrl:0028:24" }, + {OMAP4_TIMER9_CLKCTRL , omap4_timer9_bit_data,CLKF_SW_SUP ,"l4-per-clkctrl:0030:24" }, {OMAP4_ELM_CLKCTRL ,NULL ,0 ,"l4_div_ck" }, {OMAP4_GPIO2_CLKCTRL , omap4_gpio2_bit_data,CLKF_HW_SUP ,"l4_div_ck" }, {OMAP4_GPIO3_CLKCTRL , omap4_gpio3_bit_data,CLKF_HW_SUP ,"l4_div_ck" },
@@ -588,14 +588,14 @@ static const struct omap_clkctrl_reg_data omap4_l4_per_clkctrl_regs[] __initcons { OMAP4_I2C3_CLKCTRL, NULL, CLKF_SW_SUP, "func_96m_fclk" }, { OMAP4_I2C4_CLKCTRL, NULL, CLKF_SW_SUP, "func_96m_fclk" }, { OMAP4_L4_PER_CLKCTRL, NULL, 0, "l4_div_ck" }, - { OMAP4_MCBSP4_CLKCTRL, omap4_mcbsp4_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:00c0:24" }, + { OMAP4_MCBSP4_CLKCTRL, omap4_mcbsp4_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:00c0:24" }, { OMAP4_MCSPI1_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, { OMAP4_MCSPI2_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, { OMAP4_MCSPI3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, { OMAP4_MCSPI4_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, { OMAP4_MMC3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, { OMAP4_MMC4_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, - { OMAP4_SLIMBUS2_CLKCTRL, omap4_slimbus2_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0118:8" }, + { OMAP4_SLIMBUS2_CLKCTRL, omap4_slimbus2_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0118:8" }, { OMAP4_UART1_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, { OMAP4_UART2_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, { OMAP4_UART3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
@@ -630,7 +630,7 @@ static const struct omap_clkctrl_reg_data omap4_l4_wkup_clkctrl_regs[] __initcon { OMAP4_L4_WKUP_CLKCTRL, NULL, 0, "l4_wkup_clk_mux_ck" }, { OMAP4_WD_TIMER2_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, { OMAP4_GPIO1_CLKCTRL, omap4_gpio1_bit_data, CLKF_HW_SUP, "l4_wkup_clk_mux_ck" }, - { OMAP4_TIMER1_CLKCTRL, omap4_timer1_bit_data, CLKF_SW_SUP, "l4_wkup_cm:clk:0020:24" }, + { OMAP4_TIMER1_CLKCTRL, omap4_timer1_bit_data, CLKF_SW_SUP, "l4-wkup-clkctrl:0020:24" }, { OMAP4_COUNTER_32K_CLKCTRL, NULL, 0, "sys_32k_ck" }, { OMAP4_KBD_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, { 0 },
@@ -644,7 +644,7 @@ static const char * const omap4_pmd_stm_clock_mux_ck_parents[] __initconst = { };static const char *const omap4_trace_clk_div_div_ck_parents[]__initconst = { -"emu_sys_cm:clk:0000:22" , +"emu-sys-clkctrl:0000:22" ,NULL , };
@@ -662,7 +662,7 @@ static const struct omap_clkctrl_div_data omap4_trace_clk_div_div_ck_data __init };static const char *const omap4_stm_clk_div_ck_parents[]__initconst = { -"emu_sys_cm:clk:0000:20" , +"emu-sys-clkctrl:0000:20" ,NULL , };
@@ -716,73 +716,73 @@ static struct ti_dt_clk omap44xx_clks[] = {* hwmod support. Once hwmod is removed, these can be removed * also. */ -DT_CLK (NULL ,"aess_fclk" ,"abe_cm:0008:24" ), -DT_CLK (NULL ,"cm2_dm10_mux" ,"l4_per_cm:0008:24" ), -DT_CLK (NULL ,"cm2_dm11_mux" ,"l4_per_cm:0010:24" ), -DT_CLK (NULL ,"cm2_dm2_mux" ,"l4_per_cm:0018:24" ), -DT_CLK (NULL ,"cm2_dm3_mux" ,"l4_per_cm:0020:24" ), -DT_CLK (NULL ,"cm2_dm4_mux" ,"l4_per_cm:0028:24" ), -DT_CLK (NULL ,"cm2_dm9_mux" ,"l4_per_cm:0030:24" ), -DT_CLK (NULL ,"dmic_sync_mux_ck" ,"abe_cm:0018:26" ), -DT_CLK (NULL ,"dmt1_clk_mux" ,"l4_wkup_cm:0020:24" ), -DT_CLK (NULL ,"dss_48mhz_clk" ,"l3_dss_cm:0000:9" ), -DT_CLK (NULL ,"dss_dss_clk" ,"l3_dss_cm:0000:8" ), -DT_CLK (NULL ,"dss_sys_clk" ,"l3_dss_cm:0000:10" ), -DT_CLK (NULL ,"dss_tv_clk" ,"l3_dss_cm:0000:11" ), -DT_CLK (NULL ,"fdif_fck" ,"iss_cm:0008:24" ), -DT_CLK (NULL ,"func_dmic_abe_gfclk" ,"abe_cm:0018:24" ), -DT_CLK (NULL ,"func_mcasp_abe_gfclk" ,"abe_cm:0020:24" ), -DT_CLK (NULL ,"func_mcbsp1_gfclk" ,"abe_cm:0028:24" ), -DT_CLK (NULL ,"func_mcbsp2_gfclk" ,"abe_cm:0030:24" ), -DT_CLK (NULL ,"func_mcbsp3_gfclk" ,"abe_cm:0038:24" ), -DT_CLK (NULL ,"gpio1_dbclk" ,"l4_wkup_cm:0018:8" ), -DT_CLK (NULL ,"gpio2_dbclk" ,"l4_per_cm:0040:8" ), -DT_CLK (NULL ,"gpio3_dbclk" ,"l4_per_cm:0048:8" ), -DT_CLK (NULL ,"gpio4_dbclk" ,"l4_per_cm:0050:8" ), -DT_CLK (NULL ,"gpio5_dbclk" ,"l4_per_cm:0058:8" ), -DT_CLK (NULL ,"gpio6_dbclk" ,"l4_per_cm:0060:8" ), -DT_CLK (NULL ,"hsi_fck" ,"l3_init_cm:0018:24" ), -DT_CLK (NULL ,"hsmmc1_fclk" ,"l3_init_cm:0008:24" ), -DT_CLK (NULL ,"hsmmc2_fclk" ,"l3_init_cm:0010:24" ), -DT_CLK (NULL ,"iss_ctrlclk" ,"iss_cm:0000:8" ), -DT_CLK (NULL ,"mcasp_sync_mux_ck" ,"abe_cm:0020:26" ), -DT_CLK (NULL ,"mcbsp1_sync_mux_ck" ,"abe_cm:0028:26" ), -DT_CLK (NULL ,"mcbsp2_sync_mux_ck" ,"abe_cm:0030:26" ), -DT_CLK (NULL ,"mcbsp3_sync_mux_ck" ,"abe_cm:0038:26" ), -DT_CLK (NULL ,"mcbsp4_sync_mux_ck" ,"l4_per_cm:00c0:26" ), -DT_CLK (NULL ,"ocp2scp_usb_phy_phy_48m" ,"l3_init_cm:00c0:8" ), -DT_CLK (NULL ,"otg_60m_gfclk" ,"l3_init_cm:0040:24" ), -DT_CLK (NULL ,"per_mcbsp4_gfclk" ,"l4_per_cm:00c0:24" ), -DT_CLK (NULL ,"pmd_stm_clock_mux_ck" ,"emu_sys_cm:0000:20" ), -DT_CLK (NULL ,"pmd_trace_clk_mux_ck" ,"emu_sys_cm:0000:22" ), -DT_CLK (NULL ,"sgx_clk_mux" ,"l3_gfx_cm:0000:24" ), -DT_CLK (NULL ,"slimbus1_fclk_0" ,"abe_cm:0040:8" ), -DT_CLK (NULL ,"slimbus1_fclk_1" ,"abe_cm:0040:9" ), -DT_CLK (NULL ,"slimbus1_fclk_2" ,"abe_cm:0040:10" ), -DT_CLK (NULL ,"slimbus1_slimbus_clk" ,"abe_cm:0040:11" ), -DT_CLK (NULL ,"slimbus2_fclk_0" ,"l4_per_cm:0118:8" ), -DT_CLK (NULL ,"slimbus2_fclk_1" ,"l4_per_cm:0118:9" ), -DT_CLK (NULL ,"slimbus2_slimbus_clk" ,"l4_per_cm:0118:10" ), -DT_CLK (NULL ,"stm_clk_div_ck" ,"emu_sys_cm:0000:27" ), -DT_CLK (NULL ,"timer5_sync_mux" ,"abe_cm:0048:24" ), -DT_CLK (NULL ,"timer6_sync_mux" ,"abe_cm:0050:24" ), -DT_CLK (NULL ,"timer7_sync_mux" ,"abe_cm:0058:24" ), -DT_CLK (NULL ,"timer8_sync_mux" ,"abe_cm:0060:24" ), -DT_CLK (NULL ,"trace_clk_div_div_ck" ,"emu_sys_cm:0000:24" ), -DT_CLK (NULL ,"usb_host_hs_func48mclk" ,"l3_init_cm:0038:15" ), -DT_CLK (NULL ,"usb_host_hs_hsic480m_p1_clk" ,"l3_init_cm:0038:13" ), -DT_CLK (NULL ,"usb_host_hs_hsic480m_p2_clk" ,"l3_init_cm:0038:14" ), -DT_CLK (NULL ,"usb_host_hs_hsic60m_p1_clk" ,"l3_init_cm:0038:11" ), -DT_CLK (NULL ,"usb_host_hs_hsic60m_p2_clk" ,"l3_init_cm:0038:12" ), -DT_CLK (NULL ,"usb_host_hs_utmi_p1_clk" ,"l3_init_cm:0038:8" ), -DT_CLK (NULL ,"usb_host_hs_utmi_p2_clk" ,"l3_init_cm:0038:9" ), -DT_CLK (NULL ,"usb_host_hs_utmi_p3_clk" ,"l3_init_cm:0038:10" ), -DT_CLK (NULL ,"usb_otg_hs_xclk" ,"l3_init_cm:0040:8" ), -DT_CLK (NULL ,"usb_tll_hs_usb_ch0_clk" ,"l3_init_cm:0048:8" ), -DT_CLK (NULL ,"usb_tll_hs_usb_ch1_clk" ,"l3_init_cm:0048:9" ), -DT_CLK (NULL ,"usb_tll_hs_usb_ch2_clk" ,"l3_init_cm:0048:10" ), -DT_CLK (NULL ,"utmi_p1_gfclk" ,"l3_init_cm:0038:24" ), -DT_CLK (NULL ,"utmi_p2_gfclk" ,"l3_init_cm:0038:25" ), +DT_CLK (NULL ,"aess_fclk" ,"abe-clkctrl:0008:24" ), +DT_CLK (NULL ,"cm2_dm10_mux" ,"l4-per-clkctrl:0008:24" ), +DT_CLK (NULL ,"cm2_dm11_mux" ,"l4-per-clkctrl:0010:24" ), +DT_CLK (NULL ,"cm2_dm2_mux" ,"l4-per-clkctrl:0018:24" ), +DT_CLK (NULL ,"cm2_dm3_mux" ,"l4-per-clkctrl:0020:24" ), +DT_CLK (NULL ,"cm2_dm4_mux" ,"l4-per-clkctrl:0028:24" ), +DT_CLK (NULL ,"cm2_dm9_mux" ,"l4-per-clkctrl:0030:24" ), +DT_CLK (NULL ,"dmic_sync_mux_ck" ,"abe-clkctrl:0018:26" ), +DT_CLK (NULL ,"dmt1_clk_mux" ,"l4-wkup-clkctrl:0020:24" ), +DT_CLK (NULL ,"dss_48mhz_clk" ,"l3-dss-clkctrl:0000:9" ), +DT_CLK (NULL ,"dss_dss_clk" ,"l3-dss-clkctrl:0000:8" ), +DT_CLK (NULL ,"dss_sys_clk" ,"l3-dss-clkctrl:0000:10" ), +DT_CLK (NULL ,"dss_tv_clk" ,"l3-dss-clkctrl:0000:11" ), +DT_CLK (NULL ,"fdif_fck" ,"iss-clkctrl:0008:24" ), +DT_CLK (NULL ,"func_dmic_abe_gfclk" ,"abe-clkctrl:0018:24" ), +DT_CLK (NULL ,"func_mcasp_abe_gfclk" ,"abe-clkctrl:0020:24" ), +DT_CLK (NULL ,"func_mcbsp1_gfclk" ,"abe-clkctrl:0028:24" ), +DT_CLK (NULL ,"func_mcbsp2_gfclk" ,"abe-clkctrl:0030:24" ), +DT_CLK (NULL ,"func_mcbsp3_gfclk" ,"abe-clkctrl:0038:24" ), +DT_CLK (NULL ,"gpio1_dbclk" ,"l4-wkup-clkctrl:0018:8" ), +DT_CLK (NULL ,"gpio2_dbclk" ,"l4-per-clkctrl:0040:8" ), +DT_CLK (NULL ,"gpio3_dbclk" ,"l4-per-clkctrl:0048:8" ), +DT_CLK (NULL ,"gpio4_dbclk" ,"l4-per-clkctrl:0050:8" ), +DT_CLK (NULL ,"gpio5_dbclk" ,"l4-per-clkctrl:0058:8" ), +DT_CLK (NULL ,"gpio6_dbclk" ,"l4-per-clkctrl:0060:8" ), +DT_CLK (NULL ,"hsi_fck" ,"l3-init-clkctrl:0018:24" ), +DT_CLK (NULL ,"hsmmc1_fclk" ,"l3-init-clkctrl:0008:24" ), +DT_CLK (NULL ,"hsmmc2_fclk" ,"l3-init-clkctrl:0010:24" ), +DT_CLK (NULL ,"iss_ctrlclk" ,"iss-clkctrl:0000:8" ), +DT_CLK (NULL ,"mcasp_sync_mux_ck" ,"abe-clkctrl:0020:26" ), +DT_CLK (NULL ,"mcbsp1_sync_mux_ck" ,"abe-clkctrl:0028:26" ), +DT_CLK (NULL ,"mcbsp2_sync_mux_ck" ,"abe-clkctrl:0030:26" ), +DT_CLK (NULL ,"mcbsp3_sync_mux_ck" ,"abe-clkctrl:0038:26" ), +DT_CLK (NULL ,"mcbsp4_sync_mux_ck" ,"l4-per-clkctrl:00c0:26" ), +DT_CLK (NULL ,"ocp2scp_usb_phy_phy_48m" ,"l3-init-clkctrl:00c0:8" ), +DT_CLK (NULL ,"otg_60m_gfclk" ,"l3-init-clkctrl:0040:24" ), +DT_CLK (NULL ,"per_mcbsp4_gfclk" ,"l4-per-clkctrl:00c0:24" ), +DT_CLK (NULL ,"pmd_stm_clock_mux_ck" ,"emu-sys-clkctrl:0000:20" ), +DT_CLK (NULL ,"pmd_trace_clk_mux_ck" ,"emu-sys-clkctrl:0000:22" ), +DT_CLK (NULL ,"sgx_clk_mux" ,"l3-gfx-clkctrl:0000:24" ), +DT_CLK (NULL ,"slimbus1_fclk_0" ,"abe-clkctrl:0040:8" ), +DT_CLK (NULL ,"slimbus1_fclk_1" ,"abe-clkctrl:0040:9" ), +DT_CLK (NULL ,"slimbus1_fclk_2" ,"abe-clkctrl:0040:10" ), +DT_CLK (NULL ,"slimbus1_slimbus_clk" ,"abe-clkctrl:0040:11" ), +DT_CLK (NULL ,"slimbus2_fclk_0" ,"l4-per-clkctrl:0118:8" ), +DT_CLK (NULL ,"slimbus2_fclk_1" ,"l4-per-clkctrl:0118:9" ), +DT_CLK (NULL ,"slimbus2_slimbus_clk" ,"l4-per-clkctrl:0118:10" ), +DT_CLK (NULL ,"stm_clk_div_ck" ,"emu-sys-clkctrl:0000:27" ), +DT_CLK (NULL ,"timer5_sync_mux" ,"abe-clkctrl:0048:24" ), +DT_CLK (NULL ,"timer6_sync_mux" ,"abe-clkctrl:0050:24" ), +DT_CLK (NULL ,"timer7_sync_mux" ,"abe-clkctrl:0058:24" ), +DT_CLK (NULL ,"timer8_sync_mux" ,"abe-clkctrl:0060:24" ), +DT_CLK (NULL ,"trace_clk_div_div_ck" ,"emu-sys-clkctrl:0000:24" ), +DT_CLK (NULL ,"usb_host_hs_func48mclk" ,"l3-init-clkctrl:0038:15" ), +DT_CLK (NULL ,"usb_host_hs_hsic480m_p1_clk" ,"l3-init-clkctrl:0038:13" ), +DT_CLK (NULL ,"usb_host_hs_hsic480m_p2_clk" ,"l3-init-clkctrl:0038:14" ), +DT_CLK (NULL ,"usb_host_hs_hsic60m_p1_clk" ,"l3-init-clkctrl:0038:11" ), +DT_CLK (NULL ,"usb_host_hs_hsic60m_p2_clk" ,"l3-init-clkctrl:0038:12" ), +DT_CLK (NULL ,"usb_host_hs_utmi_p1_clk" ,"l3-init-clkctrl:0038:8" ), +DT_CLK (NULL ,"usb_host_hs_utmi_p2_clk" ,"l3-init-clkctrl:0038:9" ), +DT_CLK (NULL ,"usb_host_hs_utmi_p3_clk" ,"l3_init-clkctrl:0038:10" ), +DT_CLK (NULL ,"usb_otg_hs_xclk" ,"l3-init-clkctrl:0040:8" ), +DT_CLK (NULL ,"usb_tll_hs_usb_ch0_clk" ,"l3-init-clkctrl:0048:8" ), +DT_CLK (NULL ,"usb_tll_hs_usb_ch1_clk" ,"l3-init-clkctrl:0048:9" ), +DT_CLK (NULL ,"usb_tll_hs_usb_ch2_clk" ,"l3-init-clkctrl:0048:10" ), +DT_CLK (NULL ,"utmi_p1_gfclk" ,"l3-init-clkctrl:0038:24" ), +DT_CLK (NULL ,"utmi_p2_gfclk" ,"l3-init-clkctrl:0038:25" ), { .node_name = NULL }, };
drivers/clk/ti/clk-54xx.c +80 -80
249 lines not on this page · raw message
drivers/clk/ti/clkctrl.c +0 -4
@@ -511,10 +511,6 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node)char *c;u16 soc_mask =0 ; -if (!(ti_clk_get_features ()->flags &TI_CLK_CLKCTRL_COMPAT ) && -of_node_name_eq (node,"clk" )) - ti_clk_features.flags |=TI_CLK_CLKCTRL_COMPAT ; - addrp =of_get_address (node,0 ,NULL ,NULL ); addr = (u32 )of_translate_address (node, addrp);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 173/244 scsi: ufs: ufs-mediatek: Fix the timing of configuring device regulators
In reply to Greg Kroah-HartmanFrom: Po-Wen Kao <[email protected]>
[ Upstream commit 3fd23b8dfb54d9b74eba6dfdd3225db3ac116785 ]
Currently the LPM configurations of device regulators may not work since VCC is not disabled yet while ufs_mtk_vreg_set_lpm() is executed.
Fix this by changing the timing of invoking ufs_mtk_vreg_set_lpm().
--- drivers/scsi/ufs/ufs-mediatek.c | 58 ++++++++++++++++++++++++++++++--- 1 file changed, 53 insertions(+), 5 deletions(-)
drivers/scsi/ufs/ufs-mediatek.c +53 -5
@@ -949,7 +949,6 @@ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op)* ufshcd_suspend() re-enabling regulators while vreg is still * in low-power mode. */ -ufs_mtk_vreg_set_lpm (hba, true); err =ufs_mtk_mphy_power_on (hba, false);if (err) goto fail;
@@ -973,12 +972,13 @@ static int ufs_mtk_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op) {int err; +if (hba->ufshcd_state !=UFSHCD_STATE_OPERATIONAL ) +ufs_mtk_vreg_set_lpm (hba, false); + err =ufs_mtk_mphy_power_on (hba, true);if (err) goto fail; -ufs_mtk_vreg_set_lpm (hba, false); -if (ufshcd_is_link_hibern8 (hba)) { err =ufs_mtk_link_set_hpm (hba);if (err)
@@ -1139,9 +1139,57 @@ static int ufs_mtk_remove(struct platform_device *pdev)return 0 ; } +int ufs_mtk_system_suspend (struct device *dev) +{ +struct ufs_hba *hba =dev_get_drvdata (dev); +int ret; + + ret =ufshcd_system_suspend (dev); +if (ret) +return ret; + +ufs_mtk_vreg_set_lpm (hba, true); + +return 0 ; +} + +int ufs_mtk_system_resume (struct device *dev) +{ +struct ufs_hba *hba =dev_get_drvdata (dev); + +ufs_mtk_vreg_set_lpm (hba, false); + +return ufshcd_system_resume (dev); +} + +int ufs_mtk_runtime_suspend (struct device *dev) +{ +struct ufs_hba *hba =dev_get_drvdata (dev); +int ret =0 ; + + ret =ufshcd_runtime_suspend (dev); +if (ret) +return ret; + +ufs_mtk_vreg_set_lpm (hba, true); + +return 0 ; +} + +int ufs_mtk_runtime_resume (struct device *dev) +{ +struct ufs_hba *hba =dev_get_drvdata (dev); + +ufs_mtk_vreg_set_lpm (hba, false); + +return ufshcd_runtime_resume (dev); +} +static const struct dev_pm_ops ufs_mtk_pm_ops = { - SET_SYSTEM_SLEEP_PM_OPS(ufshcd_system_suspend, ufshcd_system_resume) -SET_RUNTIME_PM_OPS (ufshcd_runtime_suspend, ufshcd_runtime_resume,NULL ) + SET_SYSTEM_SLEEP_PM_OPS(ufs_mtk_system_suspend, + ufs_mtk_system_resume) +SET_RUNTIME_PM_OPS (ufs_mtk_runtime_suspend, + ufs_mtk_runtime_resume,NULL ) .prepare = ufshcd_suspend_prepare, .complete = ufshcd_resume_complete, };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 174/244 usb: host: ohci-ppc-of: Fix refcount leak bug
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 40a959d7042bb7711e404ad2318b30e9f92c6b9b ]
In ohci_hcd_ppc_of_probe(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore.
--- drivers/usb/host/ohci-ppc-of.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/ohci-ppc-of.c +1 -0
@@ -169,6 +169,7 @@ static int ohci_hcd_ppc_of_probe(struct platform_device *op)release_mem_region (res.start,0x4 ); }else pr_debug ("%s: cannot get ehci offset from fdt\n" , __FILE__); +of_node_put (np); }irq_dispose_mapping (irq);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 175/244 usb: renesas: Fix refcount leak bug
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 9d6d5303c39b8bc182475b22f45504106a07f086 ]
In usbhs_rza1_hardware_init(), of_find_node_by_name() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore.
--- drivers/usb/renesas_usbhs/rza.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/renesas_usbhs/rza.c +4 -0
@@ -23,6 +23,10 @@ static int usbhs_rza1_hardware_init(struct platform_device *pdev) extal_clk =of_find_node_by_name (NULL ,"extal" );of_property_read_u32 (usb_x1_clk,"clock-frequency" , &freq_usb);of_property_read_u32 (extal_clk,"clock-frequency" , &freq_extal); + +of_node_put (usb_x1_clk); +of_node_put (extal_clk); +if (freq_usb ==0 ) {if (freq_extal ==12000000 ) {/* Select 12MHz XTAL */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 176/244 usb: dwc2: gadget: remove D+ pull-up while no vbus with usb-role-switch
In reply to Greg Kroah-HartmanFrom: Amelie Delaunay <[email protected]>
[ Upstream commit db638c6500abaffb8f7770b2a69c40d003d54ae1 ]
When using usb-role-switch, D+ pull-up is set as soon as DTCL_SFTDISCON is cleared, whatever the vbus valid signal state is. The pull-up should not be set when vbus isn't present (this is determined by the drd controller).
This patch ensures that B-Session (so Peripheral role + vbus valid signal) is valid before clearing the DCTL_SFTDISCON bit when role switch is used. Keep original behavior when usb-role-switch isn't used.
--- drivers/usb/dwc2/gadget.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/dwc2/gadget.c +2 -1
@@ -3594,7 +3594,8 @@ void dwc2_hsotg_core_disconnect(struct dwc2_hsotg *hsotg)void dwc2_hsotg_core_connect (struct dwc2_hsotg *hsotg) {/* remove the soft-disconnect and let's go */ -dwc2_clear_bit (hsotg,DCTL ,DCTL_SFTDISCON ); +if (!hsotg->role_sw || (dwc2_readl (hsotg,GOTGCTL ) &GOTGCTL_BSESVLD )) +dwc2_clear_bit (hsotg,DCTL ,DCTL_SFTDISCON ); }/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 177/244 vboxguest: Do not use devm for irq
In reply to Greg Kroah-HartmanFrom: Pascal Terjan <[email protected]>
[ Upstream commit 6169525b76764acb81918aa387ac168fb9a55575 ]
When relying on devm it doesn't get freed early enough which causes the following warning when unloading the module:
[249348.837181] remove_proc_entry: removing non-empty directory 'irq/20', leaking at least 'vboxguest' [249348.837219] WARNING: CPU: 0 PID: 6708 at fs/proc/generic.c:715 remove_proc_entry+0x119/0x140
[249348.837379] Call Trace: [249348.837385] unregister_irq_proc+0xbd/0xe0 [249348.837392] free_desc+0x23/0x60 [249348.837396] irq_free_descs+0x4a/0x70 [249348.837401] irq_domain_free_irqs+0x160/0x1a0 [249348.837452] mp_unmap_irq+0x5c/0x60 [249348.837458] acpi_unregister_gsi_ioapic+0x29/0x40 [249348.837463] acpi_unregister_gsi+0x17/0x30 [249348.837467] acpi_pci_irq_disable+0xbf/0xe0 [249348.837473] pcibios_disable_device+0x20/0x30 [249348.837478] pci_disable_device+0xef/0x120 [249348.837482] vbg_pci_remove+0x6c/0x70 [vboxguest]
--- drivers/virt/vboxguest/vboxguest_linux.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/virt/vboxguest/vboxguest_linux.c +6 -3
@@ -356,8 +356,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) goto err_vbg_core_exit; } - ret =devm_request_irq (dev, pci->irq, vbg_core_isr,IRQF_SHARED , -DEVICE_NAME , gdev); + ret =request_irq (pci->irq, vbg_core_isr,IRQF_SHARED ,DEVICE_NAME , + gdev);if (ret) {vbg_err ("vboxguest: Error requesting irq: %d\n" , ret); goto err_vbg_core_exit;
@@ -367,7 +367,7 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)if (ret) {vbg_err ("vboxguest: Error misc_register %s failed: %d\n" ,DEVICE_NAME , ret); - goto err_vbg_core_exit; + goto err_free_irq; } ret =misc_register (&gdev->misc_device_user);
@@ -403,6 +403,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)misc_deregister (&gdev->misc_device_user); err_unregister_misc_device:misc_deregister (&gdev->misc_device); +err_free_irq: +free_irq (pci->irq, gdev); err_vbg_core_exit:vbg_core_exit (gdev); err_disable_pcidev:
@@ -419,6 +421,7 @@ static void vbg_pci_remove(struct pci_dev *pci) vbg_gdev =NULL ;mutex_unlock (&vbg_gdev_mutex); +free_irq (pci->irq, gdev);device_remove_file (gdev->dev, &dev_attr_host_features);device_remove_file (gdev->dev, &dev_attr_host_version);misc_deregister (&gdev->misc_device_user);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 178/244 clk: qcom: ipq8074: dont disable gcc_sleep_clk_src
In reply to Greg Kroah-HartmanFrom: Robert Marko <[email protected]>
[ Upstream commit 1bf7305e79aab095196131bdc87a97796e0e3fac ]
Once the usb sleep clocks are disabled, clock framework is trying to disable the sleep clock source also.
However, it seems that it cannot be disabled and trying to do so produces:
[ 245.436390] ------------[ cut here ]------------ [ 245.441233] gcc_sleep_clk_src status stuck at 'on' [ 245.441254] WARNING: CPU: 2 PID: 223 at clk_branch_wait+0x130/0x140 [ 245.450435] Modules linked in: xhci_plat_hcd xhci_hcd dwc3 dwc3_qcom leds_gpio [ 245.456601] CPU: 2 PID: 223 Comm: sh Not tainted 5.18.0-rc4 #215 [ 245.463889] Hardware name: Xiaomi AX9000 (DT) [ 245.470050] pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 245.474307] pc : clk_branch_wait+0x130/0x140 [ 245.481073] lr : clk_branch_wait+0x130/0x140 [ 245.485588] sp : ffffffc009f2bad0 [ 245.489838] x29: ffffffc009f2bad0 x28: ffffff8003e6c800 x27: 0000000000000000 [ 245.493057] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800226ef20 [ 245.500175] x23: ffffffc0089ff550 x22: 0000000000000000 x21: ffffffc008476ad0 [ 245.507294] x20: 0000000000000000 x19: ffffffc00965ac70 x18: fffffffffffc51a7 [ 245.514413] x17: 68702e3030303837 x16: 3a6d726f6674616c x15: ffffffc089f2b777 [ 245.521531] x14: ffffffc0095c9d18 x13: 0000000000000129 x12: 0000000000000129 [ 245.528649] x11: 00000000ffffffea x10: ffffffc009621d18 x9 : 0000000000000001 [ 245.535767] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : 0000000000000001 [ 245.542885] x5 : ffffff803fdca6d8 x4 : 0000000000000000 x3 : 0000000000000027 [ 245.550002] x2 : 0000000000000027 x1 : 0000000000000023 x0 : 0000000000000026 [ 245.557122] Call trace: [ 245.564229] clk_branch_wait+0x130/0x140 [ 245.566490] clk_branch2_disable+0x2c/0x40 [ 245.570656] clk_core_disable+0x60/0xb0 [ 245.574561] clk_core_disable+0x68/0xb0 [ 245.578293] clk_disable+0x30/0x50 [ 245.582113] dwc3_qcom_remove+0x60/0xc0 [dwc3_qcom] [ 245.585588] platform_remove+0x28/0x60 [ 245.590361] device_remove+0x4c/0x80 [ 245.594179] device_release_driver_internal+0x1dc/0x230 [ 245.597914] device_driver_detach+0x18/0x30 [ 245.602861] unbind_store+0xec/0x110 [ 245.607027] drv_attr_store+0x24/0x40 [ 245.610847] sysfs_kf_write+0x44/0x60 [ 245.614405] kernfs_fop_write_iter+0x128/0x1c0 [ 245.618052] new_sync_write+0xc0/0x130 [ 245.622391] vfs_write+0x1d4/0x2a0 [ 245.626123] ksys_write+0x58/0xe0 [ 245.629508] __arm64_sys_write+0x1c/0x30 [ 245.632895] invoke_syscall.constprop.0+0x5c/0x110 [ 245.636890] do_el0_svc+0xa0/0x150 [ 245.641488] el0_svc+0x18/0x60 [ 245.644872] el0t_64_sync_handler+0xa4/0x130 [ 245.647914] el0t_64_sync+0x174/0x178 [ 245.652340] ---[ end trace 0000000000000000 ]---
So, add CLK_IS_CRITICAL flag to the clock so that the kernel won't try to disable the sleep clock.
--- drivers/clk/qcom/gcc-ipq8074.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/qcom/gcc-ipq8074.c +1 -0
@@ -662,6 +662,7 @@ static struct clk_branch gcc_sleep_clk_src = { }, .num_parents = 1, .ops = &clk_branch2_ops, + .flags = CLK_IS_CRITICAL, }, }, };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 179/244 uacce: Handle parent device removal or parent driver module rmmod
In reply to Greg Kroah-HartmanFrom: Jean-Philippe Brucker <[email protected]>
[ Upstream commit 80fc671bcc0173836e9032b0c698ea74c13b9d7c ]
The uacce driver must deal with a possible removal of the parent device or parent driver module rmmod at any time.
Although uacce_remove(), called on device removal and on driver unbind, prevents future use of the uacce fops by removing the cdev, fops that were called before that point may still be running.
Serialize uacce_fops_open() and uacce_remove() with uacce->mutex. Serialize other fops against uacce_remove() with q->mutex. Since we need to protect uacce_fops_poll() which gets called on the fast path, replace uacce->queues_lock with q->mutex to improve scalability. The other fops are only used during setup.
uacce_queue_is_valid(), checked under q->mutex or uacce->mutex, denotes whether uacce_remove() has disabled all queues. If that is the case, don't go any further since the parent device is being removed and uacce->ops should not be called anymore.
--- drivers/misc/uacce/uacce.c | 133 ++++++++++++++++++++++++------------- include/linux/uacce.h | 6 +- 2 files changed, 91 insertions(+), 48 deletions(-)
drivers/misc/uacce/uacce.c +87 -46
@@ -9,43 +9,38 @@static struct class *uacce_class;static dev_t uacce_devt; -static DEFINE_MUTEX (uacce_mutex);static DEFINE_XARRAY_ALLOC (uacce_xa); -static int uacce_start_queue (struct uacce_queue *q) +/* +* If the parent driver or the device disappears, the queue state is invalid and +* ops are not usable anymore. +*/ +static bool uacce_queue_is_valid (struct uacce_queue *q) { -int ret =0 ; +return q->state ==UACCE_Q_INIT || q->state ==UACCE_Q_STARTED ; +} -mutex_lock (&uacce_mutex); +static int uacce_start_queue (struct uacce_queue *q) +{ +int ret; -if (q->state !=UACCE_Q_INIT ) { - ret = -EINVAL ; - goto out_with_lock; - } +if (q->state !=UACCE_Q_INIT ) +return -EINVAL ;if (q->uacce->ops->start_queue) { ret = q->uacce->ops->start_queue (q);if (ret <0 ) - goto out_with_lock; +return ret; } q->state =UACCE_Q_STARTED ; - -out_with_lock: -mutex_unlock (&uacce_mutex); - -return ret; +return 0 ; }static int uacce_put_queue (struct uacce_queue *q) {struct uacce_device *uacce = q->uacce; -mutex_lock (&uacce_mutex); - -if (q->state ==UACCE_Q_ZOMBIE ) - goto out; -if ((q->state ==UACCE_Q_STARTED ) && uacce->ops->stop_queue) uacce->ops->stop_queue (q);
@@ -54,8 +49,6 @@ static int uacce_put_queue(struct uacce_queue *q) uacce->ops->put_queue (q); q->state =UACCE_Q_ZOMBIE ; -out: -mutex_unlock (&uacce_mutex);return 0 ; }
@@ -65,20 +58,36 @@ static long uacce_fops_unl_ioctl(struct file *filep, {struct uacce_queue *q = filep->private_data;struct uacce_device *uacce = q->uacce; +long ret = -ENXIO ; + +/* +* uacce->ops->ioctl() may take the mmap_lock when copying arg to/from +* user. Avoid a circular lock dependency with uacce_fops_mmap(), which +* gets called with mmap_lock held, by taking uacce->mutex instead of +* q->mutex. Doing this in uacce_fops_mmap() is not possible because +* uacce_fops_open() calls iommu_sva_bind_device(), which takes +* mmap_lock, while holding uacce->mutex. +*/ +mutex_lock (&uacce->mutex); +if (!uacce_queue_is_valid (q)) + goto out_unlock;switch (cmd) {case UACCE_CMD_START_Q : -return uacce_start_queue (q); - + ret =uacce_start_queue (q); +break ;case UACCE_CMD_PUT_Q : -return uacce_put_queue (q); - + ret =uacce_put_queue (q); +break ;default : -if (!uacce->ops->ioctl) -return -EINVAL ; - -return uacce->ops->ioctl (q, cmd, arg); +if (uacce->ops->ioctl) + ret = uacce->ops->ioctl (q, cmd, arg); +else + ret = -EINVAL ; } +out_unlock: +mutex_unlock (&uacce->mutex); +return ret; }#ifdef CONFIG_COMPAT
@@ -136,6 +145,13 @@ static int uacce_fops_open(struct inode *inode, struct file *filep)if (!q)return -ENOMEM ; +mutex_lock (&uacce->mutex); + +if (!uacce->parent) { + ret = -EINVAL ; + goto out_with_mem; + } + ret =uacce_bind_queue (uacce, q);if (ret) goto out_with_mem;
@@ -152,10 +168,9 @@ static int uacce_fops_open(struct inode *inode, struct file *filep) filep->private_data = q; uacce->inode = inode; q->state =UACCE_Q_INIT ; - -mutex_lock (&uacce->queues_lock); +mutex_init (&q->mutex);list_add (&q->list, &uacce->queues); -mutex_unlock (&uacce->queues_lock); +mutex_unlock (&uacce->mutex);return 0 ;
@@ -163,18 +178,20 @@ static int uacce_fops_open(struct inode *inode, struct file *filep)uacce_unbind_queue (q); out_with_mem:kfree (q); +mutex_unlock (&uacce->mutex);return ret; }static int uacce_fops_release (struct inode *inode,struct file *filep) {struct uacce_queue *q = filep->private_data; +struct uacce_device *uacce = q->uacce; -mutex_lock (&q->uacce->queues_lock); -list_del (&q->list); -mutex_unlock (&q->uacce->queues_lock); +mutex_lock (&uacce->mutex);uacce_put_queue (q);uacce_unbind_queue (q); +list_del (&q->list); +mutex_unlock (&uacce->mutex);kfree (q);return 0 ;
@@ -217,10 +234,9 @@ static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma) vma->vm_private_data = q; qfr->type = type; -mutex_lock (&uacce_mutex); - -if (q->state !=UACCE_Q_INIT && q->state !=UACCE_Q_STARTED ) { - ret = -EINVAL ; +mutex_lock (&q->mutex); +if (!uacce_queue_is_valid (q)) { + ret = -ENXIO ; goto out_with_lock; }
@@ -248,12 +264,12 @@ static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma) } q->qfrs[type] = qfr; -mutex_unlock (&uacce_mutex); +mutex_unlock (&q->mutex);return ret; out_with_lock: -mutex_unlock (&uacce_mutex); +mutex_unlock (&q->mutex);kfree (qfr);return ret; }
@@ -262,12 +278,20 @@ static __poll_t uacce_fops_poll(struct file *file, poll_table *wait) {struct uacce_queue *q = file->private_data;struct uacce_device *uacce = q->uacce; +__poll_t ret =0 ; + +mutex_lock (&q->mutex); +if (!uacce_queue_is_valid (q)) + goto out_unlock;poll_wait (file, &q->wait, wait); +if (uacce->ops->is_q_updated && uacce->ops->is_q_updated (q)) -return EPOLLIN |EPOLLRDNORM ; + ret =EPOLLIN |EPOLLRDNORM ; -return 0 ; +out_unlock: +mutex_unlock (&q->mutex); +return ret; }static const struct file_operations uacce_fops = {
@@ -450,7 +474,7 @@ struct uacce_device *uacce_alloc(struct device *parent, goto err_with_uacce;INIT_LIST_HEAD (&uacce->queues); -mutex_init (&uacce->queues_lock); +mutex_init (&uacce->mutex);device_initialize (&uacce->dev); uacce->dev.devt =MKDEV (MAJOR (uacce_devt), uacce->dev_id); uacce->dev.class = uacce_class;
@@ -507,13 +531,23 @@ void uacce_remove(struct uacce_device *uacce)if (uacce->inode)unmap_mapping_range (uacce->inode->i_mapping,0 ,0 ,1 ); +/* +* uacce_fops_open() may be running concurrently, even after we remove +* the cdev. Holding uacce->mutex ensures that open() does not obtain a +* removed uacce device. +*/ +mutex_lock (&uacce->mutex);/* ensure no open queue remains */ -mutex_lock (&uacce->queues_lock);list_for_each_entry_safe (q, next_q, &uacce->queues, list) { +/* +* Taking q->mutex ensures that fops do not use the defunct +* uacce->ops after the queue is disabled. +*/ +mutex_lock (&q->mutex);uacce_put_queue (q); +mutex_unlock (&q->mutex);uacce_unbind_queue (q); } -mutex_unlock (&uacce->queues_lock);/* disable sva now since no opened queues */ uacce_disable_sva (uacce);
@@ -521,6 +555,13 @@ void uacce_remove(struct uacce_device *uacce)if (uacce->cdev)cdev_device_del (uacce->cdev, &uacce->dev);xa_erase (&uacce_xa, uacce->dev_id); +/* +* uacce exists as long as there are open fds, but ops will be freed +* now. Ensure that bugs cause NULL deref rather than use-after-free. +*/ + uacce->ops =NULL ; + uacce->parent =NULL ; +mutex_unlock (&uacce->mutex);put_device (&uacce->dev); }EXPORT_SYMBOL_GPL (uacce_remove);
include/linux/uacce.h +4 -2
@@ -70,6 +70,7 @@ enum uacce_q_state {* @wait: wait queue head * @list: index into uacce queues list * @qfrs: pointer of qfr regions +* @mutex: protects queue state * @state: queue state machine * @pasid: pasid associated to the mm * @handle: iommu_sva handle returned by iommu_sva_bind_device()
@@ -80,6 +81,7 @@ struct uacce_queue {wait_queue_head_t wait;struct list_head list;struct uacce_qfile_region *qfrs[UACCE_MAX_REGION ]; +struct mutex mutex;enum uacce_q_state state;u32 pasid;struct iommu_sva *handle;
@@ -97,9 +99,9 @@ struct uacce_queue {* @dev_id: id of the uacce device * @cdev: cdev of the uacce * @dev: dev of the uacce +* @mutex: protects uacce operation * @priv: private pointer of the uacce * @queues: list of queues -* @queues_lock: lock for queues list * @inode: core vfs */ struct uacce_device {
@@ -113,9 +115,9 @@ struct uacce_device {u32 dev_id;struct cdev *cdev;struct device dev; +struct mutex mutex;void *priv;struct list_head queues; -struct mutex queues_lock;struct inode *inode; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 180/244 zram: do not lookup algorithm in backends table
In reply to Greg Kroah-HartmanFrom: Sergey Senozhatsky <[email protected]>
[ Upstream commit dc89997264de565999a1cb55db3f295d3a8e457b ]
Always use crypto_has_comp() so that crypto can lookup module, call usermodhelper to load the modules, wait for usermodhelper to finish and so on. Otherwise crypto will do all of these steps under CPU hot-plug lock and this looks like too much stuff to handle under the CPU hot-plug lock. Besides this can end up in a deadlock when usermodhelper triggers a code path that attempts to lock the CPU hot-plug lock, that zram already holds.
An example of such deadlock:
- path A. zram grabs CPU hot-plug lock, execs /sbin/modprobe from crypto and waits for modprobe to finish
disksize_store
zcomp_create
__cpuhp_state_add_instance
__cpuhp_state_add_instance_cpuslocked
zcomp_cpu_up_prepare
crypto_alloc_base
crypto_alg_mod_lookup
call_usermodehelper_exec
wait_for_completion_killable
do_wait_for_common
schedule
- path B. async work kthread that brings in scsi device. It wants to register CPUHP states at some point, and it needs the CPU hot-plug lock for that, which is owned by zram.
async_run_entry_fn
scsi_probe_and_add_lun
scsi_mq_alloc_queue
blk_mq_init_queue
blk_mq_init_allocated_queue
blk_mq_realloc_hw_ctxs
__cpuhp_state_add_instance
__cpuhp_state_add_instance_cpuslocked
mutex_lock
schedule
- path C. modprobe sleeps, waiting for all aync works to finish.
load_module
do_init_module
async_synchronize_full
async_synchronize_cookie_domain
schedule
--- drivers/block/zram/zcomp.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/block/zram/zcomp.c +5 -6
@@ -63,12 +63,6 @@ static int zcomp_strm_init(struct zcomp_strm *zstrm, struct zcomp *comp)bool zcomp_available_algorithm (const char *comp) { -int i; - - i =sysfs_match_string (backends, comp); -if (i >=0 ) -return true; -/* * Crypto does not ignore a trailing new line symbol, * so make sure you don't supply a string containing
@@ -217,6 +211,11 @@ struct zcomp *zcomp_create(const char *compress)struct zcomp *comp;int error; +/* +* Crypto API will execute /sbin/modprobe if the compression module +* is not loaded yet. We must do it here, otherwise we are about to +* call /sbin/modprobe under CPU hot-plug lock. +*/ if (!zcomp_available_algorithm (compress))return ERR_PTR (-EINVAL );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 181/244 clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description
In reply to Greg Kroah-HartmanFrom: Vladimir Zapolskiy <[email protected]>
[ Upstream commit 94bed9bb05c7850ff5d80b87cc29004901f37956 ]
After merging lucid and trion pll functions in commit 0b01489475c6 ("clk: qcom: clk-alpha-pll: same regs and ops for trion and lucid") the function clk_trion_pll_configure() is left with an old description header, which results in a W=2 compile time warning, fix it.
--- drivers/clk/qcom/clk-alpha-pll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/qcom/clk-alpha-pll.c +1 -1
@@ -1420,7 +1420,7 @@ const struct clk_ops clk_alpha_pll_postdiv_fabia_ops = {EXPORT_SYMBOL_GPL (clk_alpha_pll_postdiv_fabia_ops);/** -* clk_lucid_pll_configure - configure the lucid pll +* clk_trion_pll_configure - configure the trion pll * * @pll: clk alpha pll * @regmap: register map
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 182/244 scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit f8191d40aa612981ce897e66cda6a88db8df17bb ]
Malformed user input to debugfs results in buffer overflow crashes. Adapt input string lengths to fit within internal buffers, leaving space for NULL terminators.
--- drivers/scsi/lpfc/lpfc_debugfs.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/scsi/lpfc/lpfc_debugfs.c +10 -10
@@ -2607,8 +2607,8 @@ lpfc_debugfs_multixripools_write(struct file *file, const char __user *buf,struct lpfc_sli4_hdw_queue *qp;struct lpfc_multixri_pool *multixri_pool; -if (nbytes >64 ) - nbytes =64 ; +if (nbytes >sizeof (mybuf) -1 ) + nbytes =sizeof (mybuf) -1 ;memset (mybuf,0 ,sizeof (mybuf));
@@ -2688,8 +2688,8 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,if (!phba->targetport)return -ENXIO ; -if (nbytes >64 ) - nbytes =64 ; +if (nbytes >sizeof (mybuf) -1 ) + nbytes =sizeof (mybuf) -1 ;memset (mybuf,0 ,sizeof (mybuf));
@@ -2826,8 +2826,8 @@ lpfc_debugfs_ioktime_write(struct file *file, const char __user *buf,char mybuf[64 ];char *pbuf; -if (nbytes >64 ) - nbytes =64 ; +if (nbytes >sizeof (mybuf) -1 ) + nbytes =sizeof (mybuf) -1 ;memset (mybuf,0 ,sizeof (mybuf));
@@ -2954,8 +2954,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf,char mybuf[64 ];char *pbuf; -if (nbytes >63 ) - nbytes =63 ; +if (nbytes >sizeof (mybuf) -1 ) + nbytes =sizeof (mybuf) -1 ;memset (mybuf,0 ,sizeof (mybuf));
@@ -3060,8 +3060,8 @@ lpfc_debugfs_hdwqstat_write(struct file *file, const char __user *buf,char *pbuf;int i; -if (nbytes >64 ) - nbytes =64 ; +if (nbytes >sizeof (mybuf) -1 ) + nbytes =sizeof (mybuf) -1 ;memset (mybuf,0 ,sizeof (mybuf));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 183/244 scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 2f67dc7970bce3529edce93a0a14234d88b3fcd5 ]
There is no corresponding free routine if lpfc_sli4_issue_wqe fails to issue the CMF WQE in lpfc_issue_cmf_sync_wqe.
If ret_val is non-zero, then free the iocbq request structure.
--- drivers/scsi/lpfc/lpfc_sli.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_sli.c +3 -1
@@ -2012,10 +2012,12 @@ lpfc_issue_cmf_sync_wqe(struct lpfc_hba *phba, u32 ms, u64 total) sync_buf->cmd_flag |=LPFC_IO_CMF ; ret_val =lpfc_sli4_issue_wqe (phba, &phba->sli4_hba.hdwq[0 ], sync_buf); -if (ret_val) +if (ret_val) {lpfc_printf_log (phba,KERN_INFO ,LOG_CGN_MGMT ,"6214 Cannot issue CMF_SYNC_WQE: x%x\n" , ret_val); +__lpfc_sli_release_iocbq (phba, sync_buf); + } out_unlock:spin_unlock_irqrestore (&phba->hbalock, iflags);return ret_val;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 184/244 gadgetfs: ep_io - wait until IRQ finishes
In reply to Greg Kroah-HartmanFrom: Jozef Martiniak <[email protected]>
[ Upstream commit 04cb742d4d8f30dc2e83b46ac317eec09191c68e ]
after usb_ep_queue() if wait_for_completion_interruptible() is interrupted we need to wait until IRQ gets finished.
Otherwise complete() from epio_complete() can corrupt stack.
--- drivers/usb/gadget/legacy/inode.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/gadget/legacy/inode.c +1 -0
@@ -362,6 +362,7 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len)spin_unlock_irq (&epdata->dev->lock);DBG (epdata->dev,"endpoint gone\n" ); +wait_for_completion (&done); epdata->status = -ENODEV ; } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 185/244 coresight: etm4x: avoid build failure with unrolled loops
In reply to Greg Kroah-HartmanFrom: Nick Desaulniers <[email protected]>
[ Upstream commit 4d45bc82df667ad9e9cb8361830e54fc1264e993 ]
When the following configs are enabled:
* CORESIGHT
* CORESIGHT_SOURCE_ETM4X
* UBSAN
* UBSAN_TRAP
Clang fails assemble the kernel with the error:
<instantiation>:1:7: error: expected constant expression in '.inst' directive
.inst (0xd5200000|((((2) << 19) | ((1) << 16) | (((((((((((0x160 + (i * 4))))) >> 2))) >> 7) & 0x7)) << 12) | ((((((((((0x160 + (i * 4))))) >> 2))) & 0xf)) << 8) | (((((((((((0x160 + (i * 4))))) >> 2))) >> 4) & 0x7)) << 5)))|(.L__reg_num_x8))
^
drivers/hwtracing/coresight/coresight-etm4x-core.c:702:4: note: while in macro instantiationetm4x_relaxed_read32(csa, TRCCNTVRn(i));
^drivers/hwtracing/coresight/coresight-etm4x.h:403:4: note: expanded from macro 'etm4x_relaxed_read32' read_etm4x_sysreg_offset((offset), false)))
^drivers/hwtracing/coresight/coresight-etm4x.h:383:12: note: expanded from macro 'read_etm4x_sysreg_offset'
__val = read_etm4x_sysreg_const_offset((offset)); \
^drivers/hwtracing/coresight/coresight-etm4x.h:149:2: note: expanded from macro 'read_etm4x_sysreg_const_offset' READ_ETM4x_REG(ETM4x_OFFSET_TO_REG(offset))
^drivers/hwtracing/coresight/coresight-etm4x.h:144:2: note: expanded from macro 'READ_ETM4x_REG' read_sysreg_s(ETM4x_REG_NUM_TO_SYSREG((reg)))
^arch/arm64/include/asm/sysreg.h:1108:15: note: expanded from macro 'read_sysreg_s'
asm volatile(__mrs_s("%0", r) : "=r" (__val)); \
^arch/arm64/include/asm/sysreg.h:1074:2: note: expanded from macro '__mrs_s'
" mrs_s " v ", " __stringify(r) "\n" \
^
Consider the definitions of TRCSSCSRn and TRCCNTVRn:drivers/hwtracing/coresight/coresight-etm4x.h:56
#define TRCCNTVRn(n) (0x160 + (n * 4))drivers/hwtracing/coresight/coresight-etm4x.h:81
#define TRCSSCSRn(n) (0x2A0 + (n * 4))
Where the macro parameter is expanded to i; a loop induction variable from etm4_disable_hw.
When any compiler can determine that loops may be unrolled, then the __builtin_constant_p check in read_etm4x_sysreg_offset() defined in drivers/hwtracing/coresight/coresight-etm4x.h may evaluate to true. This can lead to the expression (0x160 + (i * 4)) being passed to read_etm4x_sysreg_const_offset. Via the trace above, this is passed through READ_ETM4x_REG, read_sysreg_s, and finally to __mrs_s where it is string-ified and used directly in inline asm.
Regardless of which compiler or compiler options determine whether a loop can or can't be unrolled, which determines whether __builtin_constant_p evaluates to true when passed an expression using a loop induction variable, it is NEVER safe to allow the preprocessor to construct inline asm like:
asm volatile (".inst (0x160 + (i * 4))" : "=r"(__val));
^ expected constant expression
Instead of read_etm4x_sysreg_offset() using __builtin_constant_p(), use __is_constexpr from include/linux/const.h instead to ensure only expressions that are valid integer constant expressions get passed through to read_sysreg_s().
This is not a bug in clang; it's a potentially unsafe use of the macro arguments in read_etm4x_sysreg_offset dependent on __builtin_constant_p.
--- drivers/hwtracing/coresight/coresight-etm4x.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/hwtracing/coresight/coresight-etm4x.h +2 -1
@@ -7,6 +7,7 @@#define _CORESIGHT_CORESIGHT_ETM_H#include <asm/local.h> +#include <linux/const.h> #include <linux/spinlock.h> #include <linux/types.h> #include "coresight-priv.h"
@@ -417,7 +418,7 @@ ({ \ u64 __val; \ \ - if (__builtin_constant_p((offset))) \ + if (__is_constexpr((offset))) \ __val = read_etm4x_sysreg_const_offset((offset)); \ else \ __val = etm4x_sysreg_read((offset), true, (_64bit)); \
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 186/244 habanalabs/gaudi: fix shift out of bounds
In reply to Greg Kroah-HartmanFrom: Ofir Bitton <[email protected]>
[ Upstream commit 01622098aeb05a5efbb727199bbc2a4653393255 ]
When validating NIC queues, queue offset calculation must be performed only for NIC queues.
--- drivers/misc/habanalabs/gaudi/gaudi.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/misc/habanalabs/gaudi/gaudi.c +9 -7
@@ -5744,15 +5744,17 @@ static int gaudi_parse_cb_no_ext_queue(struct hl_device *hdev, {struct asic_fixed_properties *asic_prop = &hdev->asic_prop;struct gaudi_device *gaudi = hdev->asic_specific; -u32 nic_mask_q_id =1 << (HW_CAP_NIC_SHIFT + - ((parser->hw_queue_id -GAUDI_QUEUE_ID_NIC_0_0 ) >>2 )); +u32 nic_queue_offset, nic_mask_q_id;if ((parser->hw_queue_id >=GAUDI_QUEUE_ID_NIC_0_0 ) && - (parser->hw_queue_id <=GAUDI_QUEUE_ID_NIC_9_3 ) && - (!(gaudi->hw_cap_initialized & nic_mask_q_id))) { -dev_err (hdev->dev,"h/w queue %d is disabled\n" , - parser->hw_queue_id); -return -EINVAL ; + (parser->hw_queue_id <=GAUDI_QUEUE_ID_NIC_9_3 )) { + nic_queue_offset = parser->hw_queue_id -GAUDI_QUEUE_ID_NIC_0_0 ; + nic_mask_q_id =1 << (HW_CAP_NIC_SHIFT + (nic_queue_offset >>2 )); + +if (!(gaudi->hw_cap_initialized & nic_mask_q_id)) { +dev_err (hdev->dev,"h/w queue %d is disabled\n" , parser->hw_queue_id); +return -EINVAL ; + } }/* For internal queue jobs just check if CB address is valid */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 187/244 habanalabs/gaudi: mask constant value before cast
In reply to Greg Kroah-HartmanFrom: Oded Gabbay <[email protected]>
[ Upstream commit e3f49437a2e0221a387ecd192d742ae1434e1e3a ]
This fixes a sparse warning of
"cast truncates bits from constant value"
--- drivers/misc/habanalabs/gaudi/gaudi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/misc/habanalabs/gaudi/gaudi.c +4 -4
@@ -3318,19 +3318,19 @@ static void gaudi_init_nic_qman(struct hl_device *hdev, u32 nic_offset,u32 nic_qm_err_cfg, irq_handler_offset;u32 q_off; - mtr_base_en_lo =lower_32_bits (CFG_BASE + + mtr_base_en_lo =lower_32_bits ((CFG_BASE &U32_MAX ) + mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0); mtr_base_en_hi =upper_32_bits (CFG_BASE + mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0); - so_base_en_lo =lower_32_bits (CFG_BASE + + so_base_en_lo =lower_32_bits ((CFG_BASE &U32_MAX ) + mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_SOB_OBJ_0); so_base_en_hi =upper_32_bits (CFG_BASE + mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_SOB_OBJ_0); - mtr_base_ws_lo =lower_32_bits (CFG_BASE + + mtr_base_ws_lo =lower_32_bits ((CFG_BASE &U32_MAX ) + mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0); mtr_base_ws_hi =upper_32_bits (CFG_BASE + mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0); - so_base_ws_lo =lower_32_bits (CFG_BASE + + so_base_ws_lo =lower_32_bits ((CFG_BASE &U32_MAX ) + mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_SOB_OBJ_0); so_base_ws_hi =upper_32_bits (CFG_BASE + mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_SOB_OBJ_0);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 188/244 mmc: tmio: avoid glitches when resetting
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit 2e586f8a5b0ed4a525014a692923ac96f6647816 ]
If we reset because of an error, we need to preserve values for the clock frequency. Otherwise, glitches may be seen on the bus.
To achieve that, we introduce a 'preserve' parameter to the reset function and the IP core specific reset callbacks to handle everything accordingly.
--- drivers/mmc/host/renesas_sdhi_core.c | 29 ++++++++++++++-------------- drivers/mmc/host/tmio_mmc.c | 2 +- drivers/mmc/host/tmio_mmc.h | 6 +++++- drivers/mmc/host/tmio_mmc_core.c | 28 +++++++++++++++++++++------ 4 files changed, 42 insertions(+), 23 deletions(-)
drivers/mmc/host/renesas_sdhi_core.c +14 -15
@@ -51,9 +51,6 @@#define HOST_MODE_GEN3_32BIT (HOST_MODE_GEN3_WMODE | HOST_MODE_GEN3_BUSWIDTH)#define HOST_MODE_GEN3_64BIT 0 -#define CTL_SDIF_MODE 0xe6 -#define SDIF_MODE_HS400 BIT(0) -#define SDHI_VER_GEN2_SDR50 0x490c#define SDHI_VER_RZ_A1 0x820b/* very old datasheets said 0x490c for SDR104, too. They are wrong! */
@@ -550,23 +547,25 @@ static void renesas_sdhi_scc_reset(struct tmio_mmc_host *host, struct renesas_sd }/* only populated for TMIO_MMC_MIN_RCAR2 */ -static void renesas_sdhi_reset (struct tmio_mmc_host *host) +static void renesas_sdhi_reset (struct tmio_mmc_host *host,bool preserve) {struct renesas_sdhi *priv =host_to_priv (host);int ret;u16 val; -if (priv->rstc) { -reset_control_reset (priv->rstc); -/* Unknown why but without polling reset status, it will hang */ -read_poll_timeout (reset_control_status, ret, ret ==0 ,1 ,100 , - false, priv->rstc); -/* At least SDHI_VER_GEN2_SDR50 needs manual release of reset */ -sd_ctrl_write16 (host,CTL_RESET_SD ,0x0001 ); - priv->needs_adjust_hs400 = false; -renesas_sdhi_set_clock (host, host->clk_cache); - }else if (priv->scc_ctl) { -renesas_sdhi_scc_reset (host, priv); +if (!preserve) { +if (priv->rstc) { +reset_control_reset (priv->rstc); +/* Unknown why but without polling reset status, it will hang */ +read_poll_timeout (reset_control_status, ret, ret ==0 ,1 ,100 , + false, priv->rstc); +/* At least SDHI_VER_GEN2_SDR50 needs manual release of reset */ +sd_ctrl_write16 (host,CTL_RESET_SD ,0x0001 ); + priv->needs_adjust_hs400 = false; +renesas_sdhi_set_clock (host, host->clk_cache); + }else if (priv->scc_ctl) { +renesas_sdhi_scc_reset (host, priv); + } }if (sd_ctrl_read16 (host,CTL_VERSION ) >=SDHI_VER_GEN3_SD ) {
drivers/mmc/host/tmio_mmc.c +1 -1
@@ -75,7 +75,7 @@ static void tmio_mmc_set_clock(struct tmio_mmc_host *host,tmio_mmc_clk_start (host); } -static void tmio_mmc_reset (struct tmio_mmc_host *host) +static void tmio_mmc_reset (struct tmio_mmc_host *host,bool preserve) {sd_ctrl_write16 (host,CTL_RESET_SDIO ,0x0000 );usleep_range (10000 ,11000 );
drivers/mmc/host/tmio_mmc.h +5 -1
@@ -42,6 +42,7 @@#define CTL_DMA_ENABLE 0xd8#define CTL_RESET_SD 0xe0#define CTL_VERSION 0xe2 +#define CTL_SDIF_MODE 0xe6/* only known on R-Car 2+ */ /* Definitions for values the CTL_STOP_INTERNAL_ACTION register can take */ #define TMIO_STOP_STP BIT(0)
@@ -98,6 +99,9 @@/* Definitions for values the CTL_DMA_ENABLE register can take */ #define DMA_ENABLE_DMASDRW BIT(1) +/* Definitions for values the CTL_SDIF_MODE register can take */ +#define SDIF_MODE_HS400 BIT(0)/* only known on R-Car 2+ */ +/* Define some IRQ masks */ /* This is the mask used at reset by the chip */ #define TMIO_MASK_ALL 0x837f031d
@@ -181,7 +185,7 @@ struct tmio_mmc_host {int (*multi_io_quirk)(struct mmc_card *card,unsigned int direction,int blk_size);int (*write16_hook)(struct tmio_mmc_host *host,int addr); -void (*reset)(struct tmio_mmc_host *host); +void (*reset)(struct tmio_mmc_host *host,bool preserve);bool (*check_retune)(struct tmio_mmc_host *host,struct mmc_request *mrq);void (*fixup_request)(struct tmio_mmc_host *host,struct mmc_request *mrq);unsigned int (*get_timeout_cycles)(struct tmio_mmc_host *host);
drivers/mmc/host/tmio_mmc_core.c +22 -6
@@ -179,8 +179,17 @@ static void tmio_mmc_set_bus_width(struct tmio_mmc_host *host,sd_ctrl_write16 (host,CTL_SD_MEM_CARD_OPT , reg); } -static void tmio_mmc_reset (struct tmio_mmc_host *host) +static void tmio_mmc_reset (struct tmio_mmc_host *host,bool preserve) { +u16 card_opt, clk_ctrl, sdif_mode; + +if (preserve) { + card_opt =sd_ctrl_read16 (host,CTL_SD_MEM_CARD_OPT ); + clk_ctrl =sd_ctrl_read16 (host,CTL_SD_CARD_CLK_CTL ); +if (host->pdata->flags &TMIO_MMC_MIN_RCAR2 ) + sdif_mode =sd_ctrl_read16 (host,CTL_SDIF_MODE ); + } +/* FIXME - should we set stop clock reg here */ sd_ctrl_write16 (host,CTL_RESET_SD ,0x0000 );usleep_range (10000 ,11000 );
@@ -190,7 +199,7 @@ static void tmio_mmc_reset(struct tmio_mmc_host *host)tmio_mmc_abort_dma (host);if (host->reset) - host->reset (host); + host->reset (host, preserve);sd_ctrl_write32_as_16_and_16 (host,CTL_IRQ_MASK , host->sdcard_irq_mask_all); host->sdcard_irq_mask = host->sdcard_irq_mask_all;
@@ -206,6 +215,13 @@ static void tmio_mmc_reset(struct tmio_mmc_host *host)sd_ctrl_write16 (host,CTL_TRANSACTION_CTL ,0x0001 ); } +if (preserve) { +sd_ctrl_write16 (host,CTL_SD_MEM_CARD_OPT , card_opt); +sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , clk_ctrl); +if (host->pdata->flags &TMIO_MMC_MIN_RCAR2 ) +sd_ctrl_write16 (host,CTL_SDIF_MODE , sdif_mode); + } +if (host->mmc->card)mmc_retune_needed (host->mmc); }
@@ -248,7 +264,7 @@ static void tmio_mmc_reset_work(struct work_struct *work)spin_unlock_irqrestore (&host->lock, flags); -tmio_mmc_reset (host); +tmio_mmc_reset (host, true);/* Ready for new calls */ host->mrq =NULL ;
@@ -961,7 +977,7 @@ static void tmio_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)tmio_mmc_power_off (host);/* For R-Car Gen2+, we need to reset SDHI specific SCC */ if (host->pdata->flags &TMIO_MMC_MIN_RCAR2 ) -tmio_mmc_reset (host); +tmio_mmc_reset (host, false); host->set_clock (host,0 );break ;
@@ -1189,7 +1205,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host) _host->sdcard_irq_mask_all =TMIO_MASK_ALL ; _host->set_clock (_host,0 ); -tmio_mmc_reset (_host); +tmio_mmc_reset (_host, false);spin_lock_init (&_host->lock);mutex_init (&_host->ios_lock);
@@ -1285,7 +1301,7 @@ int tmio_mmc_host_runtime_resume(struct device *dev)struct tmio_mmc_host *host =dev_get_drvdata (dev);tmio_mmc_clk_enable (host); -tmio_mmc_reset (host); +tmio_mmc_reset (host, false);if (host->clk_cache) host->set_clock (host, host->clk_cache);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 189/244 pinctrl: intel: Check against matching data instead of ACPI companion
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit c551bd81d198bf1dcd4398d5454acdc0309dbe77 ]
In some cases we may get a platform device that has ACPI companion which is different to the pin control described in the ACPI tables. This is primarily happens when device is instantiated by board file.
In order to allow this device being enumerated, refactor intel_pinctrl_get_soc_data() to check the matching data instead of ACPI companion.
--- drivers/pinctrl/intel/pinctrl-intel.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/pinctrl/intel/pinctrl-intel.c +6 -8
@@ -1626,16 +1626,14 @@ EXPORT_SYMBOL_GPL(intel_pinctrl_probe_by_uid);const struct intel_pinctrl_soc_data *intel_pinctrl_get_soc_data (struct platform_device *pdev) { +const struct intel_pinctrl_soc_data *const *table;const struct intel_pinctrl_soc_data *data =NULL ; -const struct intel_pinctrl_soc_data **table; -struct acpi_device *adev; -unsigned int i; - adev =ACPI_COMPANION (&pdev->dev); -if (adev) { -const void *match =device_get_match_data (&pdev->dev); + table =device_get_match_data (&pdev->dev); +if (table) { +struct acpi_device *adev =ACPI_COMPANION (&pdev->dev); +unsigned int i; - table = (const struct intel_pinctrl_soc_data **)match;for (i =0 ; table[i]; i++) {if (!strcmp (adev->pnp.unique_id, table[i]->uid)) { data = table[i];
@@ -1649,7 +1647,7 @@ const struct intel_pinctrl_soc_data *intel_pinctrl_get_soc_data(struct platform_if (!id)return ERR_PTR (-ENODEV ); - table = (const struct intel_pinctrl_soc_data **)id->driver_data; + table = (const struct intel_pinctrl_soc_data *const *)id->driver_data; data = table[pdev->id]; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 190/244 cxl: Fix a memory leak in an error handling path
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 3a15b45b5454da862376b5d69a4967f5c6fa1368 ]
A bitmap_zalloc() must be balanced by a corresponding bitmap_free() in the error handling path of afu_allocate_irqs().
--- drivers/misc/cxl/irq.c | 1 + 1 file changed, 1 insertion(+)
drivers/misc/cxl/irq.c +1 -0
@@ -349,6 +349,7 @@ int afu_allocate_irqs(struct cxl_context *ctx, u32 count) out: cxl_ops->release_irq_ranges (&ctx->irqs, ctx->afu->adapter); +bitmap_free (ctx->irq_bitmap);afu_irq_name_free (ctx);return -ENOMEM ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 191/244 PCI/ACPI: Guard ARM64-specific mcfg_quirks
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
[ Upstream commit 40a6cc141b4b9580de140bcb3e893445708acc5d ]
Guard ARM64-specific quirks with CONFIG_ARM64 to avoid build errors, since mcfg_quirks will be shared by more than one architectures.
--- drivers/acpi/pci_mcfg.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/pci_mcfg.c +3 -0
@@ -41,6 +41,8 @@ struct mcfg_fixup { static struct mcfg_fixup mcfg_quirks[] = {/* { OEM_ID, OEM_TABLE_ID, REV, SEGMENT, BUS_RANGE, ops, cfgres }, */ +#ifdef CONFIG_ARM64 +#define AL_ECAM (table_id, rev, seg, ops) \ { "AMAZON", table_id, rev, seg, MCFG_BUS_ANY, ops }
@@ -169,6 +171,7 @@ static struct mcfg_fixup mcfg_quirks[] = {ALTRA_ECAM_QUIRK (1 ,13 ),ALTRA_ECAM_QUIRK (1 ,14 ), ALTRA_ECAM_QUIRK(1, 15), +#endif /* ARM64 */ };static char mcfg_oem_id[ACPI_OEM_ID_SIZE ];
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 192/244 um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
[ Upstream commit dda520d07b95072a0b63f6c52a8eb566d08ea897 ]
QEMU has a -no-reboot option, which halts instead of reboots when the guest asks to reboot. This is invaluable when used with CONFIG_PANIC_TIMEOUT=-1 (and panic_on_warn), because it allows panics and warnings to be caught immediately in CI. Implement this in UML too, by way of a basic setup param.
--- arch/um/os-Linux/skas/process.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
arch/um/os-Linux/skas/process.c +16 -1
@@ -5,6 +5,7 @@*/ #include <stdlib.h> +#include <stdbool.h> #include <unistd.h> #include <sched.h> #include <errno.h>
@@ -707,10 +708,24 @@ void halt_skas(void)UML_LONGJMP (&initial_jmpbuf,INIT_JMP_HALT ); } +static bool noreboot; + +static int __init noreboot_cmd_param (char *str,int *add) +{ + noreboot = true; +return 0 ; +} + +__uml_setup ("noreboot" , noreboot_cmd_param, +"noreboot\n" +" Rather than rebooting, exit always, akin to QEMU's -no-reboot option.\n" +" This is useful if you're using CONFIG_PANIC_TIMEOUT in order to catch\n" +" crashes in CI\n" ); +void reboot_skas (void ) {block_signals_trace (); -UML_LONGJMP (&initial_jmpbuf,INIT_JMP_REBOOT ); +UML_LONGJMP (&initial_jmpbuf, noreboot ?INIT_JMP_HALT :INIT_JMP_REBOOT ); }void __switch_mm (struct mm_id *mm_idp)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 193/244 dmaengine: dw-axi-dmac: do not print NULL LLI during error
In reply to Greg Kroah-HartmanFrom: Ben Dooks <[email protected]>
[ Upstream commit 86cb0defe0e275453bc39e856bb523eb425a6537 ]
During debugging we have seen an issue where axi_chan_dump_lli() is passed a NULL LLI pointer which ends up causing an OOPS due to trying to get fields from it. Simply print NULL LLI and exit to avoid this.
--- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +5 -0
@@ -944,6 +944,11 @@ static int dw_axi_dma_chan_slave_config(struct dma_chan *dchan,static void axi_chan_dump_lli (struct axi_dma_chan *chan,struct axi_dma_hw_desc *desc) { +if (!desc->lli) { +dev_err (dchan2dev (&chan->vc.chan),"NULL LLI\n" ); +return ; + } + dev_err(dchan2dev(&chan->vc.chan), "SAR: 0x%llx DAR: 0x%llx LLP: 0x%llx BTS 0x%x CTL: 0x%x:%08x", le64_to_cpu(desc->lli->sar),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 194/244 dmaengine: dw-axi-dmac: ignore interrupt if no descriptor
In reply to Greg Kroah-HartmanFrom: Ben Dooks <[email protected]>
[ Upstream commit 820f5ce999d2f99961e88c16d65cd26764df0590 ]
If the channel has no descriptor and the interrupt is raised then the kernel will OOPS. Check the result of vchan_next_desc() in the handler axi_chan_block_xfer_complete() to avoid the error happening.
--- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +6 -0
@@ -1016,6 +1016,11 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan)/* The completed descriptor currently is in the head of vc list */ vd =vchan_next_desc (&chan->vc); +if (!vd) { +dev_err (chan2dev (chan),"BUG: %s, IRQ with no descriptors\n" , +axi_chan_name (chan)); + goto out; + }if (chan->cyclic) { desc =vd_to_axi_desc (vd);
@@ -1045,6 +1050,7 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan)axi_chan_start_first_queued (chan); } +out:spin_unlock_irqrestore (&chan->vc.lock, flags); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 195/244 RDMA/rxe: Limit the number of calls to each tasklet
In reply to Greg Kroah-HartmanFrom: Bob Pearson <[email protected]>
[ Upstream commit eff6d998ca297cb0b2e53b032a56cf8e04dd8b17 ]
Limit the maximum number of calls to each tasklet from rxe_do_task() before yielding the cpu. When the limit is reached reschedule the tasklet and exit the calling loop. This patch prevents one tasklet from consuming 100% of a cpu core and causing a deadlock or soft lockup.
--- drivers/infiniband/sw/rxe/rxe_param.h | 6 ++++++ drivers/infiniband/sw/rxe/rxe_task.c | 16 ++++++++++++---- 2 files changed, 18 insertions(+), 4 deletions(-)
drivers/infiniband/sw/rxe/rxe_param.h +6 -0
@@ -103,6 +103,12 @@ enum rxe_device_param {RXE_INFLIGHT_SKBS_PER_QP_HIGH =64 ,RXE_INFLIGHT_SKBS_PER_QP_LOW =16 , +/* Max number of interations of each tasklet +* before yielding the cpu to let other +* work make progress +*/ +RXE_MAX_ITERATIONS =1024 , +/* Delay before calling arbiter timer */ RXE_NSEC_ARB_TIMER_DELAY = 200,
drivers/infiniband/sw/rxe/rxe_task.c +12 -4
@@ -8,7 +8,7 @@#include <linux/interrupt.h> #include <linux/hardirq.h> -#include "rxe_task.h" +#include "rxe.h" int __rxe_do_task (struct rxe_task *task)
@@ -34,6 +34,7 @@ void rxe_do_task(struct tasklet_struct *t)int ret;unsigned long flags;struct rxe_task *task =from_tasklet (task, t, tasklet); +unsigned int iterations =RXE_MAX_ITERATIONS ;spin_lock_irqsave (&task->state_lock, flags);switch (task->state) {
@@ -62,13 +63,20 @@ void rxe_do_task(struct tasklet_struct *t)spin_lock_irqsave (&task->state_lock, flags);switch (task->state) {case TASK_STATE_BUSY : -if (ret) +if (ret) { task->state =TASK_STATE_START ; -else + }else if (iterations--) { cont =1 ; + }else { +/* reschedule the tasklet and exit +* the loop to give up the cpu +*/ +tasklet_schedule (&task->tasklet); + task->state =TASK_STATE_START ; + }break ; -/* soneone tried to run the task since the last time we called +/* someone tried to run the task since the last time we called * func, so we will call one more time regardless of the * return value */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 196/244 csky/kprobe: reclaim insn_slot on kprobe unregistration
In reply to Greg Kroah-HartmanFrom: Liao Chang <[email protected]>
[ Upstream commit a2310c74d418deca0f1d749c45f1f43162510f51 ]
On kprobe registration kernel allocate one insn_slot for new kprobe, but it forget to reclaim the insn_slot on unregistration, leading to a potential leakage.
--- arch/csky/kernel/probes/kprobes.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/csky/kernel/probes/kprobes.c +4 -0
@@ -124,6 +124,10 @@ void __kprobes arch_disarm_kprobe(struct kprobe *p)void __kprobes arch_remove_kprobe (struct kprobe *p) { +if (p->ainsn.api.insn) { +free_insn_slot (p->ainsn.api.insn,0 ); + p->ainsn.api.insn =NULL ; + } }static void __kprobes save_previous_kprobe (struct kprobe_ctlblk *kcb)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 197/244 selftests/kprobe: Do not test for GRP/ without event failures
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
[ Upstream commit f5eab65ff2b76449286d18efc7fee3e0b72f7d9b ]
A new feature is added where kprobes (and other probes) do not need to explicitly state the event name when creating a probe. The event name will come from what is being attached.
That is:
# echo 'p:foo/ vfs_read' > kprobe_events
Will no longer error, but instead create an event:
# cat kprobe_events p:foo/p_vfs_read_0 vfs_read
This should not be tested as an error case anymore. Remove it from the selftest as now this feature "breaks" the selftest as it no longer fails as expected.
--- .../selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc | 1 - 1 file changed, 1 deletion(-)
tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc +0 -1
@@ -21,7 +21,6 @@ check_error 'p:^/bar vfs_read' # NO_GROUP_NAME check_error 'p:^12345678901234567890123456789012345678901234567890123456789012345/bar vfs_read' # GROUP_TOO_LONG check_error 'p:^foo.1/bar vfs_read' # BAD_GROUP_NAME -check_error 'p:foo/^ vfs_read' # NO_EVENT_NAME check_error 'p:foo/^12345678901234567890123456789012345678901234567890123456789012345 vfs_read' # EVENT_TOO_LONG check_error 'p:foo/^bar.1 vfs_read' # BAD_EVENT_NAME
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 198/244 dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit 1e42f82cbec7b2cc4873751e7791e6611901c5fc ]
It's not allowed to quit remove early without cleaning up completely. Otherwise this results in resource leaks that probably yield graver problems later. Here for example some tasklets might survive the lifetime of the sprd-dma device and access sdev which is freed after .remove() returns.
As none of the device freeing requires an active device, just ignore the return value of pm_runtime_get_sync().
--- drivers/dma/sprd-dma.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/dma/sprd-dma.c +1 -4
@@ -1236,11 +1236,8 @@ static int sprd_dma_remove(struct platform_device *pdev) {struct sprd_dma_dev *sdev =platform_get_drvdata (pdev);struct sprd_dma_chn *c, *cn; -int ret; - ret =pm_runtime_get_sync (&pdev->dev); -if (ret <0 ) -return ret; +pm_runtime_get_sync (&pdev->dev);/* explicitly free the irq */ if (sdev->irq >0 )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 199/244 openrisc: io: Define iounmap argument as volatile
In reply to Greg Kroah-HartmanFrom: Stafford Horne <[email protected]>
[ Upstream commit 52e0ea900202d23843daee8f7089817e81dd3dd7 ]
When OpenRISC enables PCI it allows for more drivers to be compiled resulting in exposing the following with -Werror.
drivers/video/fbdev/riva/fbdev.c: In function 'rivafb_probe':
drivers/video/fbdev/riva/fbdev.c:2062:42: error:
passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type
drivers/video/fbdev/nvidia/nvidia.c: In function 'nvidiafb_probe':
drivers/video/fbdev/nvidia/nvidia.c:1414:20: error:
passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type
drivers/scsi/aic7xxx/aic7xxx_osm.c: In function 'ahc_platform_free':
drivers/scsi/aic7xxx/aic7xxx_osm.c:1231:41: error:
passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type
Most architectures define the iounmap argument to be volatile. To fix this issue we do the same for OpenRISC. This patch must go before PCI is enabled on OpenRISC to avoid any compile failures.
--- arch/openrisc/include/asm/io.h | 2 +- arch/openrisc/mm/ioremap.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/openrisc/include/asm/io.h +1 -1
@@ -31,7 +31,7 @@void __iomem *ioremap (phys_addr_t offset,unsigned long size);#define iounmap iounmap -extern void iounmap (void __iomem *addr); +extern void iounmap (volatile void __iomem *addr);#include <asm-generic/io.h>
arch/openrisc/mm/ioremap.c +1 -1
@@ -77,7 +77,7 @@ void __iomem *__ref ioremap(phys_addr_t addr, unsigned long size) }EXPORT_SYMBOL (ioremap); -void iounmap (void __iomem *addr) +void iounmap (volatile void __iomem *addr) {/* If the page is from the fixmap pool then we just clear out * the fixmap mapping.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 200/244 phy: samsung: phy-exynos-pcie: sanitize init/power_on callbacks
In reply to Greg Kroah-HartmanFrom: Marek Szyprowski <[email protected]>
[ Upstream commit f2812227bb07e2eaee74253f11cea1576945df31 ]
The exynos-pcie driver called phy_power_on() before phy_init() for some historical reasons. However the generic PHY framework assumes that the proper sequence is to call phy_init() first, then phy_power_on(). The operations done by both functions should be considered as one action and as such they are called by the exynos-pcie driver (without doing anything between them). The initialization is just a sequence of register writes, which cannot be altered without breaking the hardware operation.
To match the generic PHY framework requirement, simply move all register writes to the phy_init()/phy_exit() and drop power_on()/power_off() callbacks. This way the driver will also work with the old (incorrect) PHY initialization call sequence.
--- drivers/phy/samsung/phy-exynos-pcie.c | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-)
drivers/phy/samsung/phy-exynos-pcie.c +9 -16
@@ -51,6 +51,13 @@ static int exynos5433_pcie_phy_init(struct phy *phy) {struct exynos_pcie_phy *ep =phy_get_drvdata (phy); +regmap_update_bits (ep->pmureg,EXYNOS5433_PMU_PCIE_PHY_OFFSET , +BIT (0 ),1 ); +regmap_update_bits (ep->fsysreg,PCIE_EXYNOS5433_PHY_GLOBAL_RESET , +PCIE_APP_REQ_EXIT_L1_MODE ,0 ); +regmap_update_bits (ep->fsysreg,PCIE_EXYNOS5433_PHY_L1SUB_CM_CON , +PCIE_REFCLK_GATING_EN ,0 ); +regmap_update_bits (ep->fsysreg,PCIE_EXYNOS5433_PHY_COMMON_RESET ,PCIE_PHY_RESET ,1 ); regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_MAC_RESET,
@@ -109,20 +116,7 @@ static int exynos5433_pcie_phy_init(struct phy *phy)return 0 ; } -static int exynos5433_pcie_phy_power_on (struct phy *phy) -{ -struct exynos_pcie_phy *ep =phy_get_drvdata (phy); - -regmap_update_bits (ep->pmureg,EXYNOS5433_PMU_PCIE_PHY_OFFSET , -BIT (0 ),1 ); -regmap_update_bits (ep->fsysreg,PCIE_EXYNOS5433_PHY_GLOBAL_RESET , -PCIE_APP_REQ_EXIT_L1_MODE ,0 ); -regmap_update_bits (ep->fsysreg,PCIE_EXYNOS5433_PHY_L1SUB_CM_CON , -PCIE_REFCLK_GATING_EN ,0 ); -return 0 ; -} - -static int exynos5433_pcie_phy_power_off (struct phy *phy) +static int exynos5433_pcie_phy_exit (struct phy *phy) {struct exynos_pcie_phy *ep =phy_get_drvdata (phy);
@@ -135,8 +129,7 @@ static int exynos5433_pcie_phy_power_off(struct phy *phy)static const struct phy_ops exynos5433_phy_ops = { .init = exynos5433_pcie_phy_init, - .power_on = exynos5433_pcie_phy_power_on, - .power_off = exynos5433_pcie_phy_power_off, + .exit = exynos5433_pcie_phy_exit, .owner =THIS_MODULE , };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 201/244 md: Notify sysfs sync_completed in md_reap_sync_thread()
In reply to Greg Kroah-HartmanFrom: Logan Gunthorpe <[email protected]>
[ Upstream commit 9973f0fa7d20269fe6fefe6333997fb5914449c1 ]
The mdadm test 07layouts randomly produces a kernel hung task deadlock. The deadlock is caused by the suspend_lo/suspend_hi files being set by the mdadm background process during reshape and not being cleared because the process hangs. (Leaving aside the issue of the fragility of freezing kernel tasks by buggy userspace processes...)
When the background mdadm process hangs it, is waiting (without a timeout) on a change to the sync_completed file signalling that the reshape has completed. The process is woken up a couple times when the reshape finishes but it is woken up before MD_RECOVERY_RUNNING is cleared so sync_completed_show() reports 0 instead of "none".
To fix this, notify the sysfs file in md_reap_sync_thread() after MD_RECOVERY_RUNNING has been cleared. This wakes up mdadm and causes it to continue and write to suspend_lo/suspend_hi to allow IO to continue.
--- drivers/md/md.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/md.c +1 -0
@@ -9467,6 +9467,7 @@ void md_reap_sync_thread(struct mddev *mddev)wake_up (&resync_wait);/* flag recovery needed just to double check */ set_bit (MD_RECOVERY_NEEDED , &mddev->recovery); +sysfs_notify_dirent_safe (mddev->sysfs_completed);sysfs_notify_dirent_safe (mddev->sysfs_action);md_new_event (mddev);if (mddev->event_work.func)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 202/244 nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit 533d2e8b4d5e4c89772a0adce913525fb86cbbee ]
We probably need nvmet_tcp_wq to have MEM_RECLAIM as we are sending/receiving for the socket from works on this workqueue. Also this eliminates lockdep complaints:
--
[ 6174.010200] workqueue: WQ_MEM_RECLAIM nvmet-wq:nvmet_tcp_release_queue_work [nvmet_tcp] is flushing !WQ_MEM_RECLAIM nvmet_tcp_wq:nvmet_tcp_io_work [nvmet_tcp] [ 6174.010216] WARNING: CPU: 20 PID: 14456 at kernel/workqueue.c:2628
check_flush_dependency+0x110/0x14c
--- drivers/nvme/target/tcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/target/tcp.c +2 -1
@@ -1834,7 +1834,8 @@ static int __init nvmet_tcp_init(void) {int ret; - nvmet_tcp_wq =alloc_workqueue ("nvmet_tcp_wq" ,WQ_HIGHPRI ,0 ); + nvmet_tcp_wq =alloc_workqueue ("nvmet_tcp_wq" , +WQ_MEM_RECLAIM |WQ_HIGHPRI ,0 );if (!nvmet_tcp_wq)return -ENOMEM ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 203/244 drivers:md:fix a potential use-after-free bug
In reply to Greg Kroah-HartmanFrom: Wentao_Liang <[email protected]>
[ Upstream commit 104212471b1c1817b311771d817fb692af983173 ]
In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and may cause sh to be released. However, sh is subsequently used in lines 2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an use-after-free bug.
It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of the function.
--- drivers/md/raid5.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/raid5.c +1 -1
@@ -2864,10 +2864,10 @@ static void raid5_end_write_request(struct bio *bi)if (!test_and_clear_bit (R5_DOUBLE_LOCKED , &sh->dev[i].flags))clear_bit (R5_LOCKED , &sh->dev[i].flags);set_bit (STRIPE_HANDLE , &sh->state); -raid5_release_stripe (sh);if (sh->batch_head && sh != sh->batch_head)raid5_release_stripe (sh->batch_head); +raid5_release_stripe (sh); }static void raid5_error (struct mddev *mddev,struct md_rdev *rdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 204/244 ext4: avoid remove directory when directory is corrupted
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
[ Upstream commit b24e77ef1c6d4dbf42749ad4903c97539cc9755a ]
Now if check directoy entry is corrupted, ext4_empty_dir may return true then directory will be removed when file system mounted with "errors=continue". In order not to make things worse just return false when directory is corrupted.
--- fs/ext4/namei.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
fs/ext4/namei.c +2 -5
@@ -3090,11 +3090,8 @@ bool ext4_empty_dir(struct inode *inode) de = (struct ext4_dir_entry_2 *) (bh->b_data + (offset & (sb->s_blocksize -1 )));if (ext4_check_dir_entry (inode,NULL , de, bh, - bh->b_data, bh->b_size, offset)) { - offset = (offset | (sb->s_blocksize -1 )) +1 ; -continue ; - } -if (le32_to_cpu (de->inode)) { + bh->b_data, bh->b_size, offset) || +le32_to_cpu (de->inode)) {brelse (bh);return false; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 205/244 ext4: avoid resizing to a partial cluster size
In reply to Greg Kroah-HartmanFrom: Kiselev, Oleg <[email protected]>
[ Upstream commit 69cb8e9d8cd97cdf5e293b26d70a9dee3e35e6bd ]
This patch avoids an attempt to resize the filesystem to an unaligned cluster boundary. An online resize to a size that is not integral to cluster size results in the last iteration attempting to grow the fs by a negative amount, which trips a BUG_ON and leaves the fs with a corrupted in-memory superblock.
--- fs/ext4/resize.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/ext4/resize.c +10 -0
@@ -1977,6 +1977,16 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count) }brelse (bh); +/* +* For bigalloc, trim the requested size to the nearest cluster +* boundary to avoid creating an unusable filesystem. We do this +* silently, instead of returning an error, to avoid breaking +* callers that blindly resize the filesystem to the full size of +* the underlying block device. +*/ +if (ext4_has_feature_bigalloc (sb)) + n_blocks_count &= ~((1 <<EXT4_CLUSTER_BITS (sb)) -1 ); + retry: o_blocks_count =ext4_blocks_count (es);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 206/244 lib/list_debug.c: Detect uninitialized lists
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit 0cc011c576aaa4de505046f7a6c90933d7c749a9 ]
In some circumstances, attempts are made to add entries to or to remove entries from an uninitialized list. A prime example is amdgpu_bo_vm_destroy(): It is indirectly called from ttm_bo_init_reserved() if that function fails, and tries to remove an entry from a list. However, that list is only initialized in amdgpu_bo_create_vm() after the call to ttm_bo_init_reserved() returned success. This results in crashes such as
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 1479 Comm: chrome Not tainted 5.10.110-15768-g29a72e65dae5 Hardware name: Google Grunt/Grunt, BIOS Google_Grunt.11031.149.0 07/15/2020 RIP: 0010:__list_del_entry_valid+0x26/0x7d ... Call Trace: amdgpu_bo_vm_destroy+0x48/0x8b ttm_bo_init_reserved+0x1d7/0x1e0 amdgpu_bo_create+0x212/0x476 ? amdgpu_bo_user_destroy+0x23/0x23 ? kmem_cache_alloc+0x60/0x271 amdgpu_bo_create_vm+0x40/0x7d amdgpu_vm_pt_create+0xe8/0x24b ...
Check if the list's prev and next pointers are NULL to catch such problems.
--- lib/list_debug.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
lib/list_debug.c +10 -2
@@ -20,7 +20,11 @@ bool __list_add_valid(struct list_head *new, struct list_head *prev, struct list_head *next) { - if (CHECK_DATA_CORRUPTION(next->prev != prev, + if (CHECK_DATA_CORRUPTION(prev == NULL, + "list_add corruption. prev is NULL.\n") || + CHECK_DATA_CORRUPTION(next == NULL, + "list_add corruption. next is NULL.\n") || + CHECK_DATA_CORRUPTION(next->prev != prev, "list_add corruption. next->prev should be prev (%px), but was %px. (next=%px).\n", prev, next->prev, next) || CHECK_DATA_CORRUPTION(prev->next != next,
@@ -42,7 +46,11 @@ bool __list_del_entry_valid(struct list_head *entry) prev = entry->prev; next = entry->next; -if (CHECK_DATA_CORRUPTION (next ==LIST_POISON1 , +if (CHECK_DATA_CORRUPTION (next ==NULL , +"list_del corruption, %px->next is NULL\n" , entry) || +CHECK_DATA_CORRUPTION (prev ==NULL , +"list_del corruption, %px->prev is NULL\n" , entry) || +CHECK_DATA_CORRUPTION (next ==LIST_POISON1 ,"list_del corruption, %px->next is LIST_POISON1 (%px)\n" , entry,LIST_POISON1 ) || CHECK_DATA_CORRUPTION(prev == LIST_POISON2,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 207/244 tty: serial: Fix refcount leak bug in ucc_uart.c
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit d24d7bb2cd947676f9b71fb944d045e09b8b282f ]
In soc_info(), of_find_node_by_type() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore.
--- drivers/tty/serial/ucc_uart.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/serial/ucc_uart.c +2 -0
@@ -1137,6 +1137,8 @@ static unsigned int soc_info(unsigned int *rev_h, unsigned int *rev_l)/* No compatible property, so try the name. */ soc_string = np->name; +of_node_put (np); +/* Extract the SOC number from the "PowerPC," string */ if ((sscanf (soc_string,"PowerPC,%u" , &soc) !=1 ) || !soc)return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 208/244 KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings
In reply to Greg Kroah-HartmanFrom: Fabiano Rosas <[email protected]>
[ Upstream commit 9981bace85d816ed8724ac46e49285e8488d29e6 ]
At debugfs/kvm/<pid>/vcpu0/timings we show how long each part of the code takes to run:
$ cat /sys/kernel/debug/kvm/*-*/vcpu0/timings rm_entry: 123785 49398892 118 4898 rm_intr: 123780 6075890 22 390 rm_exit: 0 0 0 0 <-- NOK guest: 123780 46732919988 402 9997638 cede: 0 0 0 0 <-- OK, no cede napping in P9
The "rm_exit" is always showing zero because it is the last one and end_timing does not increment the counter of the previous entry.
We can fix it by calling accumulate_time again instead of end_timing. That way the counter gets incremented. The rest of the arithmetic can be ignored because there are no timing points after this and the accumulators are reset before the next round.
--- arch/powerpc/kvm/book3s_hv_p9_entry.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
arch/powerpc/kvm/book3s_hv_p9_entry.c +2 -11
@@ -7,15 +7,6 @@#include <asm/ppc-opcode.h> #ifdef CONFIG_KVM_BOOK3S_HV_EXIT_TIMING -static void __start_timing (struct kvm_vcpu *vcpu,struct kvmhv_tb_accumulator *next) -{ -struct kvmppc_vcore *vc = vcpu->arch.vcore; -u64 tb =mftb () - vc->tb_offset_applied; - - vcpu->arch.cur_activity = next; - vcpu->arch.cur_tb_start = tb; -} -static void __accumulate_time (struct kvm_vcpu *vcpu,struct kvmhv_tb_accumulator *next) {struct kvmppc_vcore *vc = vcpu->arch.vcore;
@@ -47,8 +38,8 @@ static void __accumulate_time(struct kvm_vcpu *vcpu, struct kvmhv_tb_accumulator curr->seqcount = seq + 2; } -#define start_timing (vcpu, next) __start_timing(vcpu, next) -#define end_timing (vcpu) __start_timing(vcpu, NULL) +#define start_timing (vcpu, next) __accumulate_time(vcpu, next) +#define end_timing (vcpu) __accumulate_time(vcpu, NULL)#define accumulate_time (vcpu, next) __accumulate_time(vcpu, next)#else #define start_timing (vcpu, next) do {} while (0)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 209/244 vfio: Clear the caps->buf to NULL after free
In reply to Greg Kroah-HartmanFrom: Schspa Shi <[email protected]>
[ Upstream commit 6641085e8d7b3f061911517f79a2a15a0a21b97b ]
On buffer resize failure, vfio_info_cap_add() will free the buffer, report zero for the size, and return -ENOMEM. As additional hardening, also clear the buffer pointer to prevent any chance of a double free.
--- drivers/vfio/vfio.c | 1 + 1 file changed, 1 insertion(+)
drivers/vfio/vfio.c +1 -0
@@ -1850,6 +1850,7 @@ struct vfio_info_cap_header *vfio_info_cap_add(struct vfio_info_cap *caps, buf =krealloc (caps->buf, caps->size + size,GFP_KERNEL );if (!buf) {kfree (caps->buf); + caps->buf =NULL ; caps->size =0 ;return ERR_PTR (-ENOMEM ); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 210/244 mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 7a9f743ceead60ed454c46fbc3085ee9a79cbebb ]
We should call of_node_put() for the reference 'uctl_node' returned by of_get_parent() which will increase the refcount. Otherwise, there will be a refcount leak bug.
--- arch/mips/cavium-octeon/octeon-platform.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/mips/cavium-octeon/octeon-platform.c +2 -1
@@ -86,11 +86,12 @@ static void octeon2_usb_clocks_start(struct device *dev) "refclk-frequency", &clock_rate);if (i) {dev_err (dev,"No UCTL \"refclk-frequency\"\n" ); +of_node_put (uctl_node); goto exit; } i =of_property_read_string (uctl_node,"refclk-type" , &clock_type); - +of_node_put (uctl_node);if (!i &&strcmp ("crystal" , clock_type) ==0 ) is_crystal_clock = true; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 211/244 iommu/io-pgtable-arm-v7s: Add a quirk to allow pgtable PA up to 35bit
In reply to Greg Kroah-HartmanFrom: Yunfei Wang <[email protected]>
[ Upstream commit bfdd231374181254742c5e2faef0bef2d30c0ee4 ]
Single memory zone feature will remove ZONE_DMA32 and ZONE_DMA and cause pgtable PA size larger than 32bit.
Since Mediatek IOMMU hardware support at most 35bit PA in pgtable, so add a quirk to allow the PA of pgtables support up to bit35.
--- drivers/iommu/io-pgtable-arm-v7s.c | 75 ++++++++++++++++++++++-------- include/linux/io-pgtable.h | 15 ++++-- 2 files changed, 66 insertions(+), 24 deletions(-)
drivers/iommu/io-pgtable-arm-v7s.c +56 -19
@@ -182,14 +182,8 @@ static bool arm_v7s_is_mtk_enabled(struct io_pgtable_cfg *cfg) (cfg->quirks &IO_PGTABLE_QUIRK_ARM_MTK_EXT ); } -static arm_v7s_iopte paddr_to_iopte (phys_addr_t paddr,int lvl, -struct io_pgtable_cfg *cfg) +static arm_v7s_iopte to_mtk_iopte (phys_addr_t paddr,arm_v7s_iopte pte) { -arm_v7s_iopte pte = paddr &ARM_V7S_LVL_MASK (lvl); - -if (!arm_v7s_is_mtk_enabled (cfg)) -return pte; -if (paddr &BIT_ULL (32 )) pte |=ARM_V7S_ATTR_MTK_PA_BIT32 ;if (paddr &BIT_ULL (33 ))
@@ -199,6 +193,17 @@ static arm_v7s_iopte paddr_to_iopte(phys_addr_t paddr, int lvl,return pte; } +static arm_v7s_iopte paddr_to_iopte (phys_addr_t paddr,int lvl, +struct io_pgtable_cfg *cfg) +{ +arm_v7s_iopte pte = paddr &ARM_V7S_LVL_MASK (lvl); + +if (arm_v7s_is_mtk_enabled (cfg)) +return to_mtk_iopte (paddr, pte); + +return pte; +} +static phys_addr_t iopte_to_paddr (arm_v7s_iopte pte,int lvl,struct io_pgtable_cfg *cfg) {
@@ -240,10 +245,17 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,dma_addr_t dma;size_t size =ARM_V7S_TABLE_SIZE (lvl, cfg);void *table =NULL ; +gfp_t gfp_l1; + +/* +* ARM_MTK_TTBR_EXT extend the translation table base support larger +* memory address. +*/ + gfp_l1 = cfg->quirks &IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ? +GFP_KERNEL :ARM_V7S_TABLE_GFP_DMA ;if (lvl ==1 ) - table = (void *)__get_free_pages ( - __GFP_ZERO |ARM_V7S_TABLE_GFP_DMA ,get_order (size)); + table = (void *)__get_free_pages (gfp_l1 | __GFP_ZERO,get_order (size));else if (lvl ==2 ) table =kmem_cache_zalloc (data->l2_tables, gfp);
@@ -251,7 +263,8 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,return NULL ; phys =virt_to_phys (table); -if (phys != (arm_v7s_iopte )phys) { +if (cfg->quirks &IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ? + phys >= (1ULL << cfg->oas) : phys != (arm_v7s_iopte )phys) {/* Doesn't fit in PTE */ dev_err (dev,"Page table does not fit in PTE: %pa" , &phys); goto out_free;
@@ -457,9 +470,14 @@ static arm_v7s_iopte arm_v7s_install_table(arm_v7s_iopte *table,arm_v7s_iopte curr, struct io_pgtable_cfg *cfg) { + phys_addr_t phys = virt_to_phys(table);arm_v7s_iopte old, new; - new =virt_to_phys (table) |ARM_V7S_PTE_TYPE_TABLE ; + new = phys |ARM_V7S_PTE_TYPE_TABLE ; + +if (cfg->quirks &IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ) + new =to_mtk_iopte (phys, new); +if (cfg->quirks &IO_PGTABLE_QUIRK_ARM_NS ) new |=ARM_V7S_ATTR_NS_TABLE ;
@@ -779,6 +797,8 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg, void *cookie) {struct arm_v7s_io_pgtable *data; +slab_flags_t slab_flag; +phys_addr_t paddr;if (cfg->ias > (arm_v7s_is_mtk_enabled (cfg) ?34 :ARM_V7S_ADDR_BITS ))return NULL ;
@@ -788,7 +808,8 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg,if (cfg->quirks & ~(IO_PGTABLE_QUIRK_ARM_NS |IO_PGTABLE_QUIRK_NO_PERMS | -IO_PGTABLE_QUIRK_ARM_MTK_EXT )) +IO_PGTABLE_QUIRK_ARM_MTK_EXT | +IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ))return NULL ;/* If ARM_MTK_4GB is enabled, the NO_PERMS is also expected. */
@@ -796,15 +817,27 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg, !(cfg->quirks & IO_PGTABLE_QUIRK_NO_PERMS))return NULL ; +if ((cfg->quirks &IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ) && + !arm_v7s_is_mtk_enabled (cfg)) +return NULL ; + data =kmalloc (sizeof (*data),GFP_KERNEL );if (!data)return NULL ;spin_lock_init (&data->split_lock); + +/* +* ARM_MTK_TTBR_EXT extend the translation table base support larger +* memory address. +*/ + slab_flag = cfg->quirks &IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ? +0 :ARM_V7S_TABLE_SLAB_FLAGS ; + data->l2_tables =kmem_cache_create ("io-pgtable_armv7s_l2" ,ARM_V7S_TABLE_SIZE (2 , cfg),ARM_V7S_TABLE_SIZE (2 , cfg), -ARM_V7S_TABLE_SLAB_FLAGS ,NULL ); + slab_flag,NULL );if (!data->l2_tables) goto out_free_data;
@@ -850,12 +883,16 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg,wmb ();/* TTBR */ - cfg->arm_v7s_cfg.ttbr =virt_to_phys (data->pgd) |ARM_V7S_TTBR_S | - (cfg->coherent_walk ? (ARM_V7S_TTBR_NOS | -ARM_V7S_TTBR_IRGN_ATTR (ARM_V7S_RGN_WBWA ) | -ARM_V7S_TTBR_ORGN_ATTR (ARM_V7S_RGN_WBWA )) : - (ARM_V7S_TTBR_IRGN_ATTR (ARM_V7S_RGN_NC ) | -ARM_V7S_TTBR_ORGN_ATTR (ARM_V7S_RGN_NC ))); + paddr =virt_to_phys (data->pgd); +if (arm_v7s_is_mtk_enabled (cfg)) + cfg->arm_v7s_cfg.ttbr = paddr |upper_32_bits (paddr); +else + cfg->arm_v7s_cfg.ttbr = paddr |ARM_V7S_TTBR_S | + (cfg->coherent_walk ? (ARM_V7S_TTBR_NOS | +ARM_V7S_TTBR_IRGN_ATTR (ARM_V7S_RGN_WBWA ) | +ARM_V7S_TTBR_ORGN_ATTR (ARM_V7S_RGN_WBWA )) : + (ARM_V7S_TTBR_IRGN_ATTR (ARM_V7S_RGN_NC ) | +ARM_V7S_TTBR_ORGN_ATTR (ARM_V7S_RGN_NC )));return &data->iop; out_free_data:
include/linux/io-pgtable.h +10 -5
@@ -74,17 +74,22 @@ struct io_pgtable_cfg {* to support up to 35 bits PA where the bit32, bit33 and bit34 are * encoded in the bit9, bit4 and bit5 of the PTE respectively. * +* IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT: (ARM v7s format) MediaTek IOMMUs +* extend the translation table base support up to 35 bits PA, the +* encoding format is same with IO_PGTABLE_QUIRK_ARM_MTK_EXT. +* * IO_PGTABLE_QUIRK_ARM_TTBR1: (ARM LPAE format) Configure the table * for use in the upper half of a split address space. * * IO_PGTABLE_QUIRK_ARM_OUTER_WBWA: Override the outer-cacheability * attributes set in the TCR for a non-coherent page-table walker. */ -#define IO_PGTABLE_QUIRK_ARM_NS BIT(0) -#define IO_PGTABLE_QUIRK_NO_PERMS BIT(1) -#define IO_PGTABLE_QUIRK_ARM_MTK_EXT BIT(3) -#define IO_PGTABLE_QUIRK_ARM_TTBR1 BIT(5) -#define IO_PGTABLE_QUIRK_ARM_OUTER_WBWA BIT(6) +#define IO_PGTABLE_QUIRK_ARM_NS BIT(0) +#define IO_PGTABLE_QUIRK_NO_PERMS BIT(1) +#define IO_PGTABLE_QUIRK_ARM_MTK_EXT BIT(3) +#define IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT BIT(4) +#define IO_PGTABLE_QUIRK_ARM_TTBR1 BIT(5) +#define IO_PGTABLE_QUIRK_ARM_OUTER_WBWA BIT(6)unsigned long quirks;unsigned long pgsize_bitmap;unsigned int ias;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 212/244 modules: Ensure natural alignment for .altinstructions and __bug_table sections
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
[ Upstream commit 87c482bdfa79f378297d92af49cdf265be199df5 ]
In the kernel image vmlinux.lds.S linker scripts the .altinstructions and __bug_table sections are 4- or 8-byte aligned because they hold 32- and/or 64-bit values.
Most architectures use altinstructions and BUG() or WARN() in modules as well, but in the module linker script (module.lds.S) those sections are currently missing. As consequence the linker will store their content byte-aligned by default, which then can lead to unnecessary unaligned memory accesses by the CPU when those tables are processed at runtime.
Usually unaligned memory accesses are unnoticed, because either the hardware (as on x86 CPUs) or in-kernel exception handlers (e.g. on parisc or sparc) emulate and fix them up at runtime. Nevertheless, such unaligned accesses introduce a performance penalty and can even crash the kernel if there is a bug in the unalignment exception handlers (which happened once to me on the parisc architecture and which is why I noticed that issue at all).
This patch fixes a non-critical issue and might be backported at any time. It's trivial and shouldn't introduce any regression because it simply tells the linker to use a different (8-byte alignment) for those sections by default.
--- scripts/module.lds.S | 2 ++ 1 file changed, 2 insertions(+)
scripts/module.lds.S +2 -0
@@ -27,6 +27,8 @@ SECTIONS { .ctors 0 : ALIGN(8) { *(SORT(.ctors.*)) *(.ctors) } .init_array 0 : ALIGN(8) { *(SORT(.init_array.*)) *(.init_array) } + .altinstructions 0 : ALIGN(8) { KEEP(*(.altinstructions)) } + __bug_table 0 : ALIGN(8) { KEEP(*(__bug_table)) } __jump_table 0 : ALIGN(8) { KEEP(*(__jump_table)) } __patchable_function_entries : { *(__patchable_function_entries) }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 213/244 ASoC: rsnd: care default case on rsnd_ssiu_busif_err_irq_ctrl()
In reply to Greg Kroah-HartmanFrom: Kuninori Morimoto <[email protected]>
[ Upstream commit ef30911d3c39fd57884c348c29b9cbff88def155 ]
Before, ssiu.c didn't care SSI5-8, thus,
commit b1384d4c95088d0 ("ASoC: rsnd: care default case on rsnd_ssiu_busif_err_status_clear()") cares it for status clear.
But we should care it for error irq handling, too. This patch cares it.
--- sound/soc/sh/rcar/ssiu.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/sh/rcar/ssiu.c +2 -0
@@ -67,6 +67,8 @@ static void rsnd_ssiu_busif_err_irq_ctrl(struct rsnd_mod *mod, int enable) shift =1 ; offset =1 ;break ; +default : +return ; }for (i =0 ; i <4 ; i++) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 214/244 riscv: dts: sifive: Add fu540 topology information
In reply to Greg Kroah-HartmanFrom: Conor Dooley <[email protected]>
[ Upstream commit af8f260abc608c06e4466a282b53f1e2dc09f042 ]
The fu540 has no cpu-map node, so tools like hwloc cannot correctly parse the topology. Add the node using the existing node labels.
--- arch/riscv/boot/dts/sifive/fu540-c000.dtsi | 24 ++++++++++++++++++++++ 1 file changed, 24 insertions(+)
arch/riscv/boot/dts/sifive/fu540-c000.dtsi +24 -0
@@ -133,6 +133,30 @@ interrupt-controller; }; }; + + cpu-map { + cluster0 { + core0 { + cpu = <&cpu0>; + }; + + core1 { + cpu = <&cpu1>; + }; + + core2 { + cpu = <&cpu2>; + }; + + core3 { + cpu = <&cpu3>; + }; + + core4 { + cpu = <&cpu4>; + }; + }; + }; }; soc { #address-cells = <2>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 215/244 riscv: dts: sifive: Add fu740 topology information
In reply to Greg Kroah-HartmanFrom: Conor Dooley <[email protected]>
[ Upstream commit bf6cd1c01c959a31002dfa6784c0d8caffed4cf1 ]
The fu740 has no cpu-map node, so tools like hwloc cannot correctly parse the topology. Add the node using the existing node labels.
--- arch/riscv/boot/dts/sifive/fu740-c000.dtsi | 24 ++++++++++++++++++++++ 1 file changed, 24 insertions(+)
arch/riscv/boot/dts/sifive/fu740-c000.dtsi +24 -0
@@ -134,6 +134,30 @@ interrupt-controller; }; }; + + cpu-map { + cluster0 { + core0 { + cpu = <&cpu0>; + }; + + core1 { + cpu = <&cpu1>; + }; + + core2 { + cpu = <&cpu2>; + }; + + core3 { + cpu = <&cpu3>; + }; + + core4 { + cpu = <&cpu4>; + }; + }; + }; }; soc { #address-cells = <2>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 216/244 riscv: dts: canaan: Add k210 topology information
In reply to Greg Kroah-HartmanFrom: Conor Dooley <[email protected]>
[ Upstream commit d9d193dea8666bbf69fc21c5bdcdabaa34a466e3 ]
The k210 has no cpu-map node, so tools like hwloc cannot correctly parse the topology. Add the node using the existing node labels.
--- arch/riscv/boot/dts/canaan/k210.dtsi | 12 ++++++++++++ 1 file changed, 12 insertions(+)
arch/riscv/boot/dts/canaan/k210.dtsi +12 -0
@@ -65,6 +65,18 @@ compatible = "riscv,cpu-intc"; }; }; + + cpu-map { + cluster0 { + core0 { + cpu = <&cpu0>; + }; + + core1 { + cpu = <&cpu1>; + }; + }; + }; }; sram: memory@80000000 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 217/244 riscv: mmap with PROT_WRITE but no PROT_READ is invalid
In reply to Greg Kroah-HartmanFrom: Celeste Liu <[email protected]>
[ Upstream commit 2139619bcad7ac44cc8f6f749089120594056613 ]
As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3, write but not read is "Reserved for future use.". For now, they are not valid. In the current code, -wx is marked as invalid, but -w- is not marked as invalid.
This patch refines that judgment.
--- arch/riscv/kernel/sys_riscv.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/riscv/kernel/sys_riscv.c +2 -3
@@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,if (unlikely (offset & (~PAGE_MASK >> page_shift_offset)))return -EINVAL ; -if ((prot &PROT_WRITE ) && (prot &PROT_EXEC )) -if (unlikely (!(prot &PROT_READ ))) -return -EINVAL ; +if (unlikely ((prot &PROT_WRITE ) && !(prot &PROT_READ ))) +return -EINVAL ;return ksys_mmap_pgoff (addr, len, prot, flags, fd, offset >> (PAGE_SHIFT - page_shift_offset));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 218/244 RISC-V: Add fast call path of crash_kexec()
In reply to Greg Kroah-HartmanFrom: Xianting Tian <[email protected]>
[ Upstream commit 3f1901110a89b0e2e13adb2ac8d1a7102879ea98 ]
Currently, almost all archs (x86, arm64, mips...) support fast call of crash_kexec() when "regs && kexec_should_crash()" is true. But RISC-V not, it can only enter crash system via panic(). However panic() doesn't pass the regs of the real accident scene to crash_kexec(), it caused we can't get accurate backtrace via gdb,
$ riscv64-linux-gnu-gdb vmlinux vmcore Reading symbols from vmlinux... [New LWP 95] #0 console_unlock () at kernel/printk/printk.c:2557 2557 if (do_cond_resched) (gdb) bt #0 console_unlock () at kernel/printk/printk.c:2557 #1 0x0000000000000000 in ?? ()
With the patch we can get the accurate backtrace,
$ riscv64-linux-gnu-gdb vmlinux vmcore Reading symbols from vmlinux... [New LWP 95] #0 0xffffffe00063a4e0 in test_thread (data=<optimized out>) at drivers/test_crash.c:81 81 *(int *)p = 0xdead; (gdb) (gdb) bt #0 0xffffffe00064d5c0 in test_thread (data=<optimized out>) at drivers/test_crash.c:81 #1 0x0000000000000000 in ?? ()
Test code to produce NULL address dereference in test_crash.c,
void *p = NULL; *(int *)p = 0xdead;
--- arch/riscv/kernel/traps.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/riscv/kernel/traps.c +4 -0
@@ -16,6 +16,7 @@#include <linux/mm.h> #include <linux/module.h> #include <linux/irq.h> +#include <linux/kexec.h> #include <asm/asm-prototypes.h> #include <asm/bug.h>
@@ -44,6 +45,9 @@ void die(struct pt_regs *regs, const char *str) ret =notify_die (DIE_OOPS , str, regs,0 , regs->cause,SIGSEGV ); +if (regs &&kexec_should_crash (current)) +crash_kexec (regs); +bust_spinlocks (0 );add_taint (TAINT_DIE ,LOCKDEP_NOW_UNRELIABLE );spin_unlock_irq (&die_lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 219/244 watchdog: export lockup_detector_reconfigure
In reply to Greg Kroah-HartmanFrom: Laurent Dufour <[email protected]>
[ Upstream commit 7c56a8733d0a2a4be2438a7512566e5ce552fccf ]
In some circumstances it may be interesting to reconfigure the watchdog from inside the kernel.
On PowerPC, this may helpful before and after a LPAR migration (LPM) is initiated, because it implies some latencies, watchdog, and especially NMI watchdog is expected to be triggered during this operation. Reconfiguring the watchdog with a factor, would prevent it to happen too frequently during LPM.
Rename lockup_detector_reconfigure() as __lockup_detector_reconfigure() and create a new function lockup_detector_reconfigure() calling __lockup_detector_reconfigure() under the protection of watchdog_mutex.
--- include/linux/nmi.h | 2 ++ kernel/watchdog.c | 21 ++++++++++++++++----- 2 files changed, 18 insertions(+), 5 deletions(-)
include/linux/nmi.h +2 -0
@@ -122,6 +122,8 @@ int watchdog_nmi_probe(void);int watchdog_nmi_enable (unsigned int cpu);void watchdog_nmi_disable (unsigned int cpu); +void lockup_detector_reconfigure (void ); +/** * touch_nmi_watchdog - restart NMI watchdog timeout. *
kernel/watchdog.c +16 -5
@@ -537,7 +537,7 @@ int lockup_detector_offline_cpu(unsigned int cpu)return 0 ; } -static void lockup_detector_reconfigure (void ) +static void __lockup_detector_reconfigure (void ) {cpus_read_lock ();watchdog_nmi_stop ();
@@ -557,6 +557,13 @@ static void lockup_detector_reconfigure(void)__lockup_detector_cleanup (); } +void lockup_detector_reconfigure (void ) +{ +mutex_lock (&watchdog_mutex); +__lockup_detector_reconfigure (); +mutex_unlock (&watchdog_mutex); +} +/* * Create the watchdog infrastructure and configure the detector(s). */
@@ -573,13 +580,13 @@ static __init void lockup_detector_setup(void)return ;mutex_lock (&watchdog_mutex); -lockup_detector_reconfigure (); +__lockup_detector_reconfigure (); softlockup_initialized = true; mutex_unlock(&watchdog_mutex); }#else /* CONFIG_SOFTLOCKUP_DETECTOR */ -static void lockup_detector_reconfigure (void ) +static void __lockup_detector_reconfigure (void ) {cpus_read_lock ();watchdog_nmi_stop ();
@@ -587,9 +594,13 @@ static void lockup_detector_reconfigure(void)watchdog_nmi_start (); cpus_read_unlock(); } +void lockup_detector_reconfigure (void ) +{ +__lockup_detector_reconfigure (); +}static inline void lockup_detector_setup (void ) { -lockup_detector_reconfigure (); +__lockup_detector_reconfigure (); }#endif /* !CONFIG_SOFTLOCKUP_DETECTOR */
@@ -629,7 +640,7 @@ static void proc_watchdog_update(void) {/* Remove impossible cpus to keep sysctl output clean. */ cpumask_and (&watchdog_cpumask, &watchdog_cpumask, cpu_possible_mask); -lockup_detector_reconfigure (); +__lockup_detector_reconfigure (); }/*
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 220/244 powerpc/32: Set an IBAT covering up to _einittext during init
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit 2a0fb3c155c97c75176e557d61f8e66c1bd9b735 ]
Always set an IBAT covering up to _einittext during init because when CONFIG_MODULES is not selected there is no reason to have an exception handler for kernel instruction TLB misses.
It implies DBAT and IBAT are now totaly independent, IBATs are set by setibat() and DBAT by setbat().
This allows to revert commit 9bb162fa26ed ("powerpc/603: Fix boot failure with DEBUG_PAGEALLOC and KFENCE")
--- arch/powerpc/kernel/head_book3s_32.S | 4 ++-- arch/powerpc/mm/book3s32/mmu.c | 10 ++++------ 2 files changed, 6 insertions(+), 8 deletions(-)
arch/powerpc/kernel/head_book3s_32.S +2 -2
@@ -421,14 +421,14 @@ InstructionTLBMiss: */ /* Get PTE (linux-style) and check access */ mfspr r3,SPRN_IMISS -#if defined(CONFIG_MODULES) || defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_KFENCE) +#ifdef CONFIG_MODULES lis r1, TASK_SIZE@h /* check if kernel address */ cmplw 0,r1,r3 #endif mfspr r2, SPRN_SDR1 li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC | _PAGE_USER rlwinm r2, r2, 28, 0xfffff000 -#if defined(CONFIG_MODULES) || defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_KFENCE) +#ifdef CONFIG_MODULES bgt- 112f lis r2, (swapper_pg_dir - PAGE_OFFSET)@ha /* if kernel address, use */ li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC
arch/powerpc/mm/book3s32/mmu.c +4 -6
@@ -160,7 +160,10 @@ unsigned long __init mmu_mapin_ram(unsigned long base, unsigned long top) {unsigned long done;unsigned long border = (unsigned long )__init_begin -PAGE_OFFSET ; +unsigned long size; + size =roundup_pow_of_two ((unsigned long )_einittext -PAGE_OFFSET ); +setibat (0 ,PAGE_OFFSET ,0 , size,PAGE_KERNEL_X );if (debug_pagealloc_enabled_or_kfence () || __map_without_bats) {pr_debug_once ("Read-Write memory mapped without BATs\n" );
@@ -246,10 +249,9 @@ void mmu_mark_rodata_ro(void) }/* -* Set up one of the I/D BAT (block address translation) register pairs. +* Set up one of the D BAT (block address translation) register pairs. * The parameters are not checked; in particular size must be a power * of 2 between 128k and 256M. -* On 603+, only set IBAT when _PAGE_EXEC is set */ void __init setbat (int index,unsigned long virt,phys_addr_t phys,unsigned int size,pgprot_t prot)
@@ -285,10 +287,6 @@ void __init setbat(int index, unsigned long virt, phys_addr_t phys,/* G bit must be zero in IBATs */ flags &= ~_PAGE_EXEC; } -if (flags & _PAGE_EXEC) - bat[0 ] = bat[1 ]; -else - bat[0 ].batu = bat[0 ].batl =0 ; bat_addrs[index].start = virt; bat_addrs[index].limit = virt + ((bl +1 ) <<17 ) -1 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 221/244 powerpc/32: Dont always pass -mcpu=powerpc to the compiler
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit 446cda1b21d9a6b3697fe399c6a3a00ff4a285f5 ]
Since commit 4bf4f42a2feb ("powerpc/kbuild: Set default generic machine type for 32-bit compile"), when building a 32 bits kernel with a bi-arch version of GCC, or when building a book3s/32 kernel, the option -mcpu=powerpc is passed to GCC at all time, relying on it being eventually overriden by a subsequent -mcpu=xxxx.
But when building the same kernel with a 32 bits only version of GCC, that is not done, relying on gcc being built with the expected default CPU.
This logic has two problems. First, it is a bit fragile to rely on whether the GCC version is bi-arch or not, because today we can have bi-arch versions of GCC configured with a 32 bits default. Second, there are some versions of GCC which don't support -mcpu=powerpc, for instance for e500 SPE-only versions.
So, stop relying on this approximative logic and allow the user to decide whether he/she wants to use the toolchain's default CPU or if he/she wants to set one, and allow only possible CPUs based on the selected target.
--- arch/powerpc/Makefile | 26 +------------------------- arch/powerpc/platforms/Kconfig.cputype | 21 ++++++++++++++++++--- 2 files changed, 19 insertions(+), 28 deletions(-)
arch/powerpc/Makefile +1 -25
@@ -17,23 +17,6 @@ HAS_BIARCH := $(call cc-option-yn, -m32) # Set default 32 bits cross compilers for vdso and boot wrapper CROSS32_COMPILE ?= -ifeq ($(HAS_BIARCH),y) -ifeq ($(CROSS32_COMPILE),) -ifdef CONFIG_PPC32 -# These options will be overridden by any -mcpu option that the CPU -# or platform code sets later on the command line, but they are needed -# to set a sane 32-bit cpu target for the 64-bit cross compiler which -# may default to the wrong ISA. -KBUILD_CFLAGS += -mcpu=powerpc -KBUILD_AFLAGS += -mcpu=powerpc -endif -endif -endif - -ifdef CONFIG_PPC_BOOK3S_32 -KBUILD_CFLAGS += -mcpu=powerpc -endif - # If we're on a ppc/ppc64/ppc64le machine use that defconfig, otherwise just use # ppc64_defconfig because we have nothing better to go on. uname := $(shell uname -m)
@@ -185,6 +168,7 @@ endif endif CFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU)) +AFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU)) # Altivec option not allowed with e500mc64 in GCC. ifdef CONFIG_ALTIVEC
@@ -195,14 +179,6 @@ endif CFLAGS-$(CONFIG_E5500_CPU) += $(E5500_CPU) CFLAGS-$(CONFIG_E6500_CPU) += $(call cc-option,-mcpu=e6500,$(E5500_CPU)) -ifdef CONFIG_PPC32 -ifdef CONFIG_PPC_E500MC -CFLAGS-y += $(call cc-option,-mcpu=e500mc,-mcpu=powerpc) -else -CFLAGS-$(CONFIG_E500) += $(call cc-option,-mcpu=8540 -msoft-float,-mcpu=powerpc) -endif -endif - asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1) KBUILD_CPPFLAGS += -I $(srctree)/arch/$(ARCH) $(asinstr)
arch/powerpc/platforms/Kconfig.cputype +18 -3
@@ -137,9 +137,9 @@ config GENERIC_CPU depends on PPC64 && CPU_LITTLE_ENDIAN select ARCH_HAS_FAST_MULTIPLIER -config GENERIC_CPU +config POWERPC_CPU bool "Generic 32 bits powerpc" - depends on PPC32 && !PPC_8xx + depends on PPC32 && !PPC_8xx && !PPC_85xx config CELL_CPU bool "Cell Broadband Engine"
@@ -193,11 +193,23 @@ config G4_CPU depends on PPC_BOOK3S_32 select ALTIVEC +config E500_CPU + bool "e500 (8540)" + depends on PPC_85xx && !PPC_E500MC + +config E500MC_CPU + bool "e500mc" + depends on PPC_85xx && PPC_E500MC + +config TOOLCHAIN_DEFAULT_CPU + bool "Rely on the toolchain's implicit default CPU" + depends on PPC32 + endchoice config TARGET_CPU_BOOL bool - default !GENERIC_CPU + default !GENERIC_CPU && !TOOLCHAIN_DEFAULT_CPU config TARGET_CPU string
@@ -212,6 +224,9 @@ config TARGET_CPU default "e300c2" if E300C2_CPU default "e300c3" if E300C3_CPU default "G4" if G4_CPU + default "8540" if E500_CPU + default "e500mc" if E500MC_CPU + default "powerpc" if POWERPC_CPU config PPC_BOOK3S def_bool y
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 222/244 ovl: warn if trusted xattr creation fails
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
[ Upstream commit b10b85fe5149ee8b39fbbf86095b303632dde2cd ]
When mounting overlayfs in an unprivileged user namespace, trusted xattr creation will fail. This will lead to failures in some file operations, e.g. in the following situation:
mkdir lower upper work merged
mkdir lower/directory
mount -toverlay -olowerdir=lower,upperdir=upper,workdir=work none merged rmdir merged/directory
mkdir merged/directory
The last mkdir will fail:
mkdir: cannot create directory 'merged/directory': Input/output error
The cause for these failures is currently extremely non-obvious and hard to debug. Hence, warn the user and suggest using the userxattr mount option, if it is not already supplied and xattr creation fails during the self-check.
--- fs/overlayfs/super.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/overlayfs/super.c +5 -2
@@ -1413,11 +1413,12 @@ static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs,*/ err =ovl_do_setxattr (ofs, ofs->workdir,OVL_XATTR_OPAQUE ,"0" ,1 );if (err) { +pr_warn ("failed to set xattr on upper\n" ); ofs->noxattr = true;if (ofs->config.index || ofs->config.metacopy) { ofs->config.index = false; ofs->config.metacopy = false; -pr_warn ("upper fs does not support xattr, falling back to index=off,metacopy=off.\n" ); +pr_warn ("...falling back to index=off,metacopy=off.\n" ); }/* * xattr support is required for persistent st_ino.
@@ -1425,8 +1426,10 @@ static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs,*/ if (ofs->config.xino ==OVL_XINO_AUTO ) { ofs->config.xino =OVL_XINO_OFF ; -pr_warn ("upper fs does not support xattr, falling back to xino=off.\n" ); +pr_warn ("...falling back to xino=off.\n" ); } +if (err == -EPERM && !ofs->config.userxattr) +pr_info ("try mounting with 'userxattr' option\n" ); err =0 ; }else {ovl_do_removexattr (ofs, ofs->workdir,OVL_XATTR_OPAQUE );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 223/244 powerpc/ioda/iommu/debugfs: Generate unique debugfs entries
In reply to Greg Kroah-HartmanFrom: Alexey Kardashevskiy <[email protected]>
[ Upstream commit d73b46c3c1449bf27f793b9d9ee86ed70c7a7163 ]
The iommu_table::it_index is a LIOBN which is not initialized on PowerNV as it is not used except IOMMU debugfs where it is used for a node name.
This initializes it_index witn a unique number to avoid warnings and have a node for every iommu_table.
This should not cause any behavioral change without CONFIG_IOMMU_DEBUGFS.
--- arch/powerpc/platforms/powernv/pci-ioda.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/platforms/powernv/pci-ioda.c +2 -0
@@ -1618,6 +1618,7 @@ static void pnv_pci_ioda1_setup_dma_pe(struct pnv_phb *phb, tbl->it_ops = &pnv_ioda1_iommu_ops; pe->table_group.tce32_start = tbl->it_offset << tbl->it_page_shift; pe->table_group.tce32_size = tbl->it_size << tbl->it_page_shift; + tbl->it_index = (phb->hose->global_number <<16 ) | pe->pe_number;if (!iommu_init_table (tbl, phb->hose->node,0 ,0 ))panic ("Failed to initialize iommu table" );
@@ -1788,6 +1789,7 @@ static long pnv_pci_ioda2_setup_default_config(struct pnv_ioda_pe *pe) res_end =min (window_size,SZ_4G ) >> tbl->it_page_shift; } + tbl->it_index = (pe->phb->hose->global_number <<16 ) | pe->pe_number;if (iommu_init_table (tbl, pe->phb->hose->node, res_start, res_end)) rc =pnv_pci_ioda2_set_window (&pe->table_group,0 , tbl);else
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 224/244 ALSA: core: Add async signal helpers
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit ef34a0ae7a2654bc9e58675e36898217fb2799d8 ]
Currently the call of kill_fasync() from an interrupt handler might lead to potential spin deadlocks, as spotted by syzkaller. Unfortunately, it's not so trivial to fix this lock chain as it's involved with the tasklist_lock that is touched in allover places.
As a temporary workaround, this patch provides the way to defer the async signal notification in a work. The new helper functions, snd_fasync_helper() and snd_kill_faync() are replacements for fasync_helper() and kill_fasync(), respectively. In addition, snd_fasync_free() needs to be called at the destructor of the relevant file object.
--- include/sound/core.h | 8 ++++ sound/core/misc.c | 94 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 102 insertions(+)
include/sound/core.h +8 -0
@@ -501,4 +501,12 @@ snd_pci_quirk_lookup_id(u16 vendor, u16 device, }#endif +/* async signal helpers */ +struct snd_fasync ; + +int snd_fasync_helper (int fd,struct file *file,int on, +struct snd_fasync **fasyncp); +void snd_kill_fasync (struct snd_fasync *fasync,int signal,int poll); +void snd_fasync_free (struct snd_fasync *fasync); +#endif /* __SOUND_CORE_H */
sound/core/misc.c +94 -0
103 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 225/244 ALSA: timer: Use deferred fasync helper
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 95cc637c1afd83fb7dd3d7c8a53710488f4caf9c ]
For avoiding the potential deadlock via kill_fasync() call, use the new fasync helpers to defer the invocation from PCI API. Note that it's merely a workaround.
--- sound/core/timer.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
sound/core/timer.c +6 -5
@@ -83,7 +83,7 @@ struct snd_timer_user {unsigned int filter;struct timespec64 tstamp;/* trigger tstamp */ wait_queue_head_t qchange_sleep; -struct fasync_struct *fasync; +struct snd_fasync *fasync;struct mutex ioctl_lock; };
@@ -1345,7 +1345,7 @@ static void snd_timer_user_interrupt(struct snd_timer_instance *timeri, } __wake:spin_unlock (&tu->qlock); -kill_fasync (&tu->fasync,SIGIO ,POLL_IN ); +snd_kill_fasync (tu->fasync,SIGIO ,POLL_IN );wake_up (&tu->qchange_sleep); }
@@ -1383,7 +1383,7 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri,spin_lock_irqsave (&tu->qlock, flags);snd_timer_user_append_to_tqueue (tu, &r1);spin_unlock_irqrestore (&tu->qlock, flags); -kill_fasync (&tu->fasync,SIGIO ,POLL_IN ); +snd_kill_fasync (tu->fasync,SIGIO ,POLL_IN );wake_up (&tu->qchange_sleep); }
@@ -1453,7 +1453,7 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri,spin_unlock (&tu->qlock);if (append ==0 )return ; -kill_fasync (&tu->fasync,SIGIO ,POLL_IN ); +snd_kill_fasync (tu->fasync,SIGIO ,POLL_IN );wake_up (&tu->qchange_sleep); }
@@ -1521,6 +1521,7 @@ static int snd_timer_user_release(struct inode *inode, struct file *file)snd_timer_instance_free (tu->timeri); }mutex_unlock (&tu->ioctl_lock); +snd_fasync_free (tu->fasync);kfree (tu->queue);kfree (tu->tqueue);kfree (tu);
@@ -2135,7 +2136,7 @@ static int snd_timer_user_fasync(int fd, struct file * file, int on)struct snd_timer_user *tu; tu = file->private_data; -return fasync_helper (fd, file, on, &tu->fasync); +return snd_fasync_helper (fd, file, on, &tu->fasync); } static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 226/244 ALSA: control: Use deferred fasync helper
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 4a971e84a7ae10a38d875cd2d4e487c8d1682ca3 ]
For avoiding the potential deadlock via kill_fasync() call, use the new fasync helpers to defer the invocation from the control API. Note that it's merely a workaround.
Another note: although we haven't received reports about the deadlock with the control API, the deadlock is still potentially possible, and it's better to align the behavior with other core APIs (PCM and timer); so let's move altogether.
--- include/sound/control.h | 2 +- sound/core/control.c | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-)
include/sound/control.h +1 -1
@@ -109,7 +109,7 @@ struct snd_ctl_file {int preferred_subdevice[SND_CTL_SUBDEV_ITEMS ];wait_queue_head_t change_sleep;spinlock_t read_lock; -struct fasync_struct *fasync; +struct snd_fasync *fasync;int subscribed;/* read interface is activated */ struct list_head events;/* waiting events for read */ };
sound/core/control.c +4 -3
@@ -127,6 +127,7 @@ static int snd_ctl_release(struct inode *inode, struct file *file)if (control->vd[idx].owner == ctl) control->vd[idx].owner =NULL ;up_write (&card->controls_rwsem); +snd_fasync_free (ctl->fasync);snd_ctl_empty_read_queue (ctl);put_pid (ctl->pid);kfree (ctl);
@@ -181,7 +182,7 @@ void snd_ctl_notify(struct snd_card *card, unsigned int mask, _found:wake_up (&ctl->change_sleep);spin_unlock (&ctl->read_lock); -kill_fasync (&ctl->fasync,SIGIO ,POLL_IN ); +snd_kill_fasync (ctl->fasync,SIGIO ,POLL_IN ); }read_unlock_irqrestore (&card->ctl_files_rwlock, flags); }
@@ -2002,7 +2003,7 @@ static int snd_ctl_fasync(int fd, struct file * file, int on)struct snd_ctl_file *ctl; ctl = file->private_data; -return fasync_helper (fd, file, on, &ctl->fasync); +return snd_fasync_helper (fd, file, on, &ctl->fasync); }/* return the preferred subdevice number if already assigned;
@@ -2170,7 +2171,7 @@ static int snd_ctl_dev_disconnect(struct snd_device *device)read_lock_irqsave (&card->ctl_files_rwlock, flags);list_for_each_entry (ctl, &card->ctl_files, list) {wake_up (&ctl->change_sleep); -kill_fasync (&ctl->fasync,SIGIO ,POLL_ERR ); +snd_kill_fasync (ctl->fasync,SIGIO ,POLL_ERR ); }read_unlock_irqrestore (&card->ctl_files_rwlock, flags);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 227/244 f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 141170b759e03958f296033bb7001be62d1d363b ]
As Dipanjan Das <[email protected]> reported, syzkaller found a f2fs bug as below:
RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295 Call Trace: write_all_xattrs fs/f2fs/xattr.c:487 [inline] __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743 f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790 f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86 __vfs_setxattr+0x115/0x180 fs/xattr.c:182 __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216 __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277 vfs_setxattr+0x13f/0x330 fs/xattr.c:303 setxattr+0x146/0x160 fs/xattr.c:611 path_setxattr+0x1a7/0x1d0 fs/xattr.c:630 __do_sys_lsetxattr fs/xattr.c:653 [inline] __se_sys_lsetxattr fs/xattr.c:649 [inline] __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
NAT entry and nat bitmap can be inconsistent, e.g. one nid is free in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it may trigger BUG_ON() in f2fs_new_node_page(), fix it.
--- fs/f2fs/node.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/f2fs/node.c +5 -1
@@ -1291,7 +1291,11 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs)dec_valid_node_count (sbi, dn->inode, !ofs); goto fail; } -f2fs_bug_on (sbi, new_ni.blk_addr !=NULL_ADDR ); +if (unlikely (new_ni.blk_addr !=NULL_ADDR )) { + err = -EFSCORRUPTED ; +set_sbi_flag (sbi,SBI_NEED_FSCK ); + goto fail; + }#endif new_ni.nid = dn->nid; new_ni.ino = dn->inode->i_ino;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 228/244 f2fs: fix to do sanity check on segment type in build_sit_entries()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 09beadf289d6e300553e60d6e76f13c0427ecab3 ]
As Wenqing Liu <[email protected]> reported in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=216285
RIP: 0010:memcpy_erms+0x6/0x10 f2fs_update_meta_page+0x84/0x570 [f2fs] change_curseg.constprop.0+0x159/0xbd0 [f2fs] f2fs_do_replace_block+0x5c7/0x18a0 [f2fs] f2fs_replace_block+0xeb/0x180 [f2fs] recover_data+0x1abd/0x6f50 [f2fs] f2fs_recover_fsync_data+0x12ce/0x3250 [f2fs] f2fs_fill_super+0x4459/0x6190 [f2fs] mount_bdev+0x2cf/0x3b0 legacy_get_tree+0xed/0x1d0 vfs_get_tree+0x81/0x2b0 path_mount+0x47e/0x19d0 do_mount+0xce/0xf0 __x64_sys_mount+0x12c/0x1a0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd
The root cause is segment type is invalid, so in f2fs_do_replace_block(), f2fs accesses f2fs_sm_info::curseg_array with out-of-range segment type, result in accessing invalid curseg->sum_blk during memcpy in f2fs_update_meta_page(). Fix this by adding sanity check on segment type in build_sit_entries().
--- fs/f2fs/segment.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
fs/f2fs/segment.c +13 -0
@@ -4537,6 +4537,12 @@ static int build_sit_entries(struct f2fs_sb_info *sbi)return err;seg_info_from_raw_sit (se, &sit); +if (se->type >=NR_PERSISTENT_LOG ) { +f2fs_err (sbi,"Invalid segment type: %u, segno: %u" , + se->type, start); +return -EFSCORRUPTED ; + } + sit_valid_blocks[SE_PAGETYPE (se)] += se->valid_blocks;if (f2fs_block_unit_discard (sbi)) {
@@ -4585,6 +4591,13 @@ static int build_sit_entries(struct f2fs_sb_info *sbi)break ;seg_info_from_raw_sit (se, &sit); +if (se->type >=NR_PERSISTENT_LOG ) { +f2fs_err (sbi,"Invalid segment type: %u, segno: %u" , + se->type, start); + err = -EFSCORRUPTED ; +break ; + } + sit_valid_blocks[SE_PAGETYPE (se)] += se->valid_blocks;if (f2fs_block_unit_discard (sbi)) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 229/244 smb3: check xattr value length earlier
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
[ Upstream commit 5fa2cffba0b82336a2244d941322eb1627ff787b ]
Coverity complains about assigning a pointer based on value length before checking that value length goes beyond the end of the SMB. Although this is even more unlikely as value length is a single byte, and the pointer is not dereferenced until laterm, it is clearer to check the lengths first.
Addresses-Coverity: 1467704 ("Speculative execution data leak")
--- fs/cifs/smb2ops.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/cifs/smb2ops.c +3 -2
@@ -1105,9 +1105,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,size_t name_len, value_len, user_name_len;while (src_size >0 ) { - name = &src->ea_data[0 ]; name_len = (size_t )src->ea_name_length; - value = &src->ea_data[src->ea_name_length +1 ]; value_len = (size_t )le16_to_cpu (src->ea_value_length);if (name_len ==0 )
@@ -1119,6 +1117,9 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, goto out; } + name = &src->ea_data[0 ]; + value = &src->ea_data[src->ea_name_length +1 ]; +if (ea_name) {if (ea_name_len == name_len &&memcmp (ea_name, name, name_len) ==0 ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 230/244 powerpc/64: Init jump labels before parse_early_param()
In reply to Greg Kroah-HartmanFrom: Zhouyi Zhou <[email protected]>
[ Upstream commit ca829e05d3d4f728810cc5e4b468d9ebc7745eb3 ]
On 64-bit, calling jump_label_init() in setup_feature_keys() is too late because static keys may be used in subroutines of parse_early_param() which is again subroutine of early_init_devtree().
For example booting with "threadirqs":
static_key_enable_cpuslocked(): static key '0xc000000002953260' used before call to jump_label_init()
WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xfc/0x120
...
NIP static_key_enable_cpuslocked+0xfc/0x120
LR static_key_enable_cpuslocked+0xf8/0x120
Call Trace:
static_key_enable_cpuslocked+0xf8/0x120 (unreliable)
static_key_enable+0x30/0x50
setup_forced_irqthreads+0x28/0x40
do_early_param+0xa0/0x108
parse_args+0x290/0x4e0
parse_early_options+0x48/0x5c
parse_early_param+0x58/0x84
early_init_devtree+0xd4/0x518
early_setup+0xb4/0x214So call jump_label_init() just before parse_early_param() in early_init_devtree().
--- arch/powerpc/kernel/prom.c | 7 +++++++ 1 file changed, 7 insertions(+)
arch/powerpc/kernel/prom.c +7 -0
@@ -751,6 +751,13 @@ void __init early_init_devtree(void *params)of_scan_flat_dt (early_init_dt_scan_root,NULL );of_scan_flat_dt (early_init_dt_scan_memory_ppc,NULL ); +/* +* As generic code authors expect to be able to use static keys +* in early_param() handlers, we initialize the static keys just +* before parsing early params (it's fine to call jump_label_init() +* more than once). +*/ +jump_label_init ();parse_early_param ();/* make sure we've parsed cmdline for mem= before this */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 231/244 venus: pm_helpers: Fix warning in OPP during probe
In reply to Greg Kroah-HartmanFrom: Stanimir Varbanov <[email protected]>
[ Upstream commit 1d95af02f23031c2e1cca7607c514b86ce85bc6e ]
Fix the following WARN triggered during Venus driver probe on 5.19.0-rc8-next-20220728:
WARNING: CPU: 7 PID: 339 at drivers/opp/core.c:2471 dev_pm_opp_set_config+0x49c/0x610 Modules linked in: qcom_spmi_adc5 rtc_pm8xxx qcom_spmi_adc_tm5 leds_qcom_lpg led_class_multicolor qcom_pon qcom_vadc_common venus_core(+) qcom_spmi_temp_alarm v4l2_mem2mem videobuf2_v4l2 msm(+) videobuf2_common crct10dif_ce spi_geni_qcom snd_soc_sm8250 i2c_qcom_geni gpu_sched snd_soc_qcom_common videodev qcom_q6v5_pas soundwire_qcom drm_dp_aux_bus qcom_stats drm_display_helper qcom_pil_info soundwire_bus snd_soc_lpass_va_macro mc qcom_q6v5 phy_qcom_snps_femto_v2 qcom_rng snd_soc_lpass_macro_common snd_soc_lpass_wsa_macro lpass_gfm_sm8250 slimbus qcom_sysmon qcom_common qcom_glink_smem qmi_helpers qcom_wdt mdt_loader socinfo icc_osm_l3 display_connector drm_kms_helper qnoc_sm8250 drm fuse ip_tables x_tables ipv6 CPU: 7 PID: 339 Comm: systemd-udevd Not tainted 5.19.0-rc8-next-20220728 #4 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : dev_pm_opp_set_config+0x49c/0x610 lr : dev_pm_opp_set_config+0x58/0x610 sp : ffff8000093c3710 x29: ffff8000093c3710 x28: ffffbca3959d82b8 x27: ffff8000093c3d00 x26: ffffbca3959d8e08 x25: ffff4396cac98118 x24: ffff4396c0e24810 x23: ffff4396c4272c40 x22: ffff4396c0e24810 x21: ffff8000093c3810 x20: ffff4396cac36800 x19: ffff4396cac96800 x18: 0000000000000000 x17: 0000000000000003 x16: ffffbca3f4edf198 x15: 0000001cba64a858 x14: 0000000000000180 x13: 000000000000017e x12: 0000000000000000 x11: 0000000000000002 x10: 0000000000000a60 x9 : ffff8000093c35c0 x8 : ffff4396c4273700 x7 : ffff43983efca6c0 x6 : ffff43983efca640 x5 : 00000000410fd0d0 x4 : ffff4396c4272c40 x3 : ffffbca3f5d1e008 x2 : 0000000000000000 x1 : ffff4396c2421600 x0 : ffff4396cac96860 Call trace: dev_pm_opp_set_config+0x49c/0x610 devm_pm_opp_set_config+0x18/0x70 vcodec_domains_get+0xb8/0x1638 [venus_core] core_get_v4+0x1d8/0x218 [venus_core] venus_probe+0xf4/0x468 [venus_core] platform_probe+0x68/0xd8 really_probe+0xbc/0x2a8 __driver_probe_device+0x78/0xe0 driver_probe_device+0x3c/0xf0 __driver_attach+0x70/0x120 bus_for_each_dev+0x70/0xc0 driver_attach+0x24/0x30 bus_add_driver+0x150/0x200 driver_register+0x64/0x120 __platform_driver_register+0x28/0x38 qcom_venus_driver_init+0x24/0x1000 [venus_core] do_one_initcall+0x54/0x1c8 do_init_module+0x44/0x1d0 load_module+0x16c8/0x1aa0 __do_sys_finit_module+0xbc/0x110 __arm64_sys_finit_module+0x20/0x30 invoke_syscall+0x44/0x108 el0_svc_common.constprop.0+0xcc/0xf0 do_el0_svc+0x2c/0xb8 el0_svc+0x2c/0x88 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x18c/0x190 qcom-venus: probe of aa00000.video-codec failed with error -16
The fix is re-ordering the code related to OPP core. The OPP core expects all configuration options to be provided before the OPP table is added.
--- drivers/media/platform/qcom/venus/pm_helpers.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/media/platform/qcom/venus/pm_helpers.c +5 -5
@@ -875,7 +875,7 @@ static int vcodec_domains_get(struct venus_core *core) } skip_pmdomains: -if (!core->has_opp_table) +if (!core->res->opp_pmdomain)return 0 ;/* Attach the power domain for setting performance state */
@@ -1007,6 +1007,10 @@ static int core_get_v4(struct venus_core *core)if (ret)return ret; + ret =vcodec_domains_get (core); +if (ret) +return ret; +if (core->res->opp_pmdomain) { ret =devm_pm_opp_of_add_table (dev);if (!ret) {
@@ -1017,10 +1021,6 @@ static int core_get_v4(struct venus_core *core) } } - ret =vcodec_domains_get (core); -if (ret) -return ret; -return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 232/244 video: fbdev: i740fb: Check the argument of i740_calc_vclk()
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 40bf722f8064f50200b8c4f8946cd625b441dda9 ]
Since the user can control the arguments of the ioctl() from the user space, under special arguments that may result in a divide-by-zero bug.
If the user provides an improper 'pixclock' value that makes the argumet of i740_calc_vclk() less than 'I740_RFREQ_FIX', it will cause a divide-by-zero bug in:
drivers/video/fbdev/i740fb.c:353 p_best = min(15, ilog2(I740_MAX_VCO_FREQ / (freq / I740_RFREQ_FIX)));
The following log can reveal it:
divide error: 0000 [#1] PREEMPT SMP KASAN PTI
RIP: 0010:i740_calc_vclk drivers/video/fbdev/i740fb.c:353 [inline] RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:646 [inline] RIP: 0010:i740fb_set_par+0x163f/0x3b70 drivers/video/fbdev/i740fb.c:742 Call Trace: fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189
Fix this by checking the argument of i740_calc_vclk() first.
--- drivers/video/fbdev/i740fb.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/video/fbdev/i740fb.c +7 -2
@@ -400,7 +400,7 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var,u32 xres, right, hslen, left, xtotal;u32 yres, lower, vslen, upper, ytotal;u32 vxres, xoffset, vyres, yoffset; -u32 bpp, base, dacspeed24, mem; +u32 bpp, base, dacspeed24, mem, freq;u8 r7;int i;
@@ -643,7 +643,12 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var, par->atc[VGA_ATC_OVERSCAN ] =0 ;/* Calculate VCLK that most closely matches the requested dot clock */ -i740_calc_vclk ((((u32 )1e9 ) / var->pixclock) * (u32)(1e3 ), par); + freq = (((u32 )1e9 ) / var->pixclock) * (u32)(1e3 ); +if (freq <I740_RFREQ_FIX ) { +fb_dbg (info,"invalid pixclock\n" ); + freq =I740_RFREQ_FIX ; + } +i740_calc_vclk (freq, par);/* Since we program the clocks ourselves, always use VCLK2. */ par->misc |=0x0C ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 233/244 MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 74de14fe05dd6b151d73cb0c73c8ec874cbdcde6 ]
When CONFIG_XPA is enabled, Clang warns:
arch/mips/mm/tlbex.c:629:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context]
if (cpu_has_rixi && !!_PAGE_NO_EXEC) {
^
arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC'
# define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT)
^
arch/mips/mm/tlbex.c:2568:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context]
if (!cpu_has_rixi || !_PAGE_NO_EXEC) {
^
arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC'
# define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT)
^
2 errors generated._PAGE_NO_EXEC can be '0' or '1 << _PAGE_NO_EXEC_SHIFT' depending on the build and runtime configuration, which is what the negation operators are trying to convey. To silence the warning, explicitly compare against 0 so the result of the '<<' operator is not implicitly converted to a boolean.
According to its documentation, GCC enables -Wint-in-bool-context with -Wall but this warning is not visible when building the same configuration with GCC. It appears GCC only warns when compiling C++, not C, although the documentation makes no note of this:
https://godbolt.org/z/x39q3brxf
--- arch/mips/mm/tlbex.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/mips/mm/tlbex.c +2 -2
@@ -634,7 +634,7 @@ static __maybe_unused void build_convert_pte_to_entrylo(u32 **p,return ; } -if (cpu_has_rixi && !!_PAGE_NO_EXEC) { +if (cpu_has_rixi && _PAGE_NO_EXEC !=0 ) {if (fill_includes_sw_bits) {UASM_i_ROTR (p, reg, reg,ilog2 (_PAGE_GLOBAL)); }else {
@@ -2573,7 +2573,7 @@ static void check_pabits(void)unsigned long entry;unsigned pabits, fillbits; -if (!cpu_has_rixi || !_PAGE_NO_EXEC) { +if (!cpu_has_rixi || _PAGE_NO_EXEC ==0 ) {/* * We'll only be making use of the fact that we can rotate bits * into the fill if the CPU supports RIXI, so don't bother
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 234/244 can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once()
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
commit 8ef49f7f8244424adcf4a546dba4cbbeb0b09c09 upstream.
We should warn user-space that it is doing something wrong when trying to activate sessions with identical parameters but WARN_ON_ONCE macro can not be used here as it serves a different purpose.
So it would be good to replace it with netdev_warn_once() message.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- net/can/j1939/socket.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/can/j1939/socket.c +4 -1
@@ -178,7 +178,10 @@ activate_next:if (!first)return ; -if (WARN_ON_ONCE (j1939_session_activate (first))) { +if (j1939_session_activate (first)) { +netdev_warn_once (first->priv->ndev, +"%s: 0x%p: Identical session is already activated.\n" , + __func__, first); first->err = -EBUSY ; goto activate_next; }else {
Greg Kroah-Hartman
maintainerPATCH 235/244 scsi: ufs: ufs-mediatek: Fix build error and type mismatch
In reply to Greg Kroah-HartmanFrom: Ren Zhijie <[email protected]>
commit f54912b228a8df6c0133e31bc75628677bb8c6e5 upstream.
If CONFIG_PM_SLEEP is not set.
make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu-, will fail:
drivers/ufs/host/ufs-mediatek.c: In function ‘ufs_mtk_vreg_fix_vcc’:drivers/ufs/host/ufs-mediatek.c:688:46: warning: format ‘%u’ expects argument of type ‘unsigned int’, but argument 4 has type ‘long unsigned int’ [-Wformat=]
snprintf(vcc_name, MAX_VCC_NAME, "vcc-opt%u", res.a1);
~^ ~~~~~~
%lu
drivers/ufs/host/ufs-mediatek.c: In function ‘ufs_mtk_system_suspend’:
drivers/ufs/host/ufs-mediatek.c:1371:8: error: implicit declaration of function ‘ufshcd_system_suspend’; did you mean ‘ufs_mtk_system_suspend’? [-Werror=implicit-function-declaration]
ret = ufshcd_system_suspend(dev);
^~~~~~~~~~~~~~~~~~~~~
ufs_mtk_system_suspend
drivers/ufs/host/ufs-mediatek.c: In function ‘ufs_mtk_system_resume’:
drivers/ufs/host/ufs-mediatek.c:1386:9: error: implicit declaration of function ‘ufshcd_system_resume’; did you mean ‘ufs_mtk_system_resume’? [-Werror=implicit-function-declaration]
return ufshcd_system_resume(dev);
^~~~~~~~~~~~~~~~~~~~
ufs_mtk_system_resumecc1: some warnings being treated as errors
The declaration of func "ufshcd_system_suspend()" depends on CONFIG_PM_SLEEP, so the function wrapper ufs_mtk_system_suspend() should wrapped by CONFIG_PM_SLEEP too.
--- drivers/scsi/ufs/ufs-mediatek.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/ufs/ufs-mediatek.c +2 -0
@@ -1139,6 +1139,7 @@ static int ufs_mtk_remove(struct platforreturn 0 ; } +#ifdef CONFIG_PM_SLEEP int ufs_mtk_system_suspend (struct device *dev) {struct ufs_hba *hba =dev_get_drvdata (dev);
@@ -1161,6 +1162,7 @@ int ufs_mtk_system_resume(struct device return ufshcd_system_resume(dev); } +#endif int ufs_mtk_runtime_suspend (struct device *dev) {
Greg Kroah-Hartman
maintainerPATCH 236/244 xfs: flush inodegc workqueue tasks before cancel
In reply to Greg Kroah-HartmanFrom: Brian Foster <[email protected]>
[ Upstream commit 6191cf3ad59fda5901160633fef8e41b064a5246 ]
The xfs_inodegc_stop() helper performs a high level flush of pending work on the percpu queues and then runs a cancel_work_sync() on each of the percpu work tasks to ensure all work has completed before returning. While cancel_work_sync() waits for wq tasks to complete, it does not guarantee work tasks have started. This means that the _stop() helper can queue and instantly cancel a wq task without having completed the associated work. This can be observed by tracepoint inspection of a simple "rm -f <file>; fsfreeze -f <mnt>" test:
xfs_destroy_inode: ... ino 0x83 ... xfs_inode_set_need_inactive: ... ino 0x83 ... xfs_inodegc_stop: ... ... xfs_inodegc_start: ... xfs_inodegc_worker: ... xfs_inode_inactivating: ... ino 0x83 ...
The first few lines show that the inode is removed and need inactive state set, but the inactivation work has not completed before the inodegc mechanism stops. The inactivation doesn't actually occur until the fs is unfrozen and the gc mechanism starts back up. Note that this test requires fsfreeze to reproduce because xfs_freeze indirectly invokes xfs_fs_statfs(), which calls xfs_inodegc_flush().
When this occurs, the workqueue try_to_grab_pending() logic first tries to steal the pending bit, which does not succeed because the bit has been set by queue_work_on(). Subsequently, it checks for association of a pool workqueue from the work item under the pool lock. This association is set at the point a work item is queued and cleared when dequeued for processing. If the association exists, the work item is removed from the queue and cancel_work_sync() returns true. If the pwq association is cleared, the remove attempt assumes the task is busy and retries (eventually returning false to the caller after waiting for the work task to complete).
To avoid this race, we can flush each work item explicitly before cancel. However, since the _queue_all() already schedules each underlying work item, the workqueue level helpers are sufficient to achieve the same ordering effect. E.g., the inodegc enabled flag prevents scheduling any further work in the _stop() case. Use the drain_workqueue() helper in this particular case to make the intent a bit more self explanatory.
--- fs/xfs/xfs_icache.c | 22 ++++------------------ 1 file changed, 4 insertions(+), 18 deletions(-)
fs/xfs/xfs_icache.c +4 -18
@@ -1872,28 +1872,20 @@ xfs_inodegc_worker( }/* -* Force all currently queued inode inactivation work to run immediately, and -* wait for the work to finish. Two pass - queue all the work first pass, wait -* for it in a second pass. +* Force all currently queued inode inactivation work to run immediately and +* wait for the work to finish. */ void xfs_inodegc_flush (struct xfs_mount *mp) { -struct xfs_inodegc *gc; -int cpu; -if (!xfs_is_inodegc_enabled (mp))return ;trace_xfs_inodegc_flush (mp, __return_address);xfs_inodegc_queue_all (mp); - -for_each_online_cpu (cpu) { - gc =per_cpu_ptr (mp->m_inodegc, cpu); -flush_work (&gc->work); - } +flush_workqueue (mp->m_inodegc_wq); }/*
@@ -1904,18 +1896,12 @@ voidxfs_inodegc_stop ( struct xfs_mount *mp) { -struct xfs_inodegc *gc; -int cpu; -if (!xfs_clear_inodegc_enabled (mp))return ;xfs_inodegc_queue_all (mp); +drain_workqueue (mp->m_inodegc_wq); -for_each_online_cpu (cpu) { - gc =per_cpu_ptr (mp->m_inodegc, cpu); -cancel_work_sync (&gc->work); - }trace_xfs_inodegc_stop (mp, __return_address); }
Greg Kroah-Hartman
maintainerPATCH 237/244 xfs: reserve quota for dir expansion when linking/unlinking files
In reply to Greg Kroah-HartmanFrom: "Darrick J. Wong" <[email protected]>
[ Upstream commit 871b9316e7a778ff97bdc34fdb2f2977f616651d ]
XFS does not reserve quota for directory expansion when linking or unlinking children from a directory. This means that we don't reject the expansion with EDQUOT when we're at or near a hard limit, which means that unprivileged userspace can use link()/unlink() to exceed quota.
The fix for this is nuanced -- link operations don't always expand the directory, and we allow a link to proceed with no space reservation if we don't need to add a block to the directory to handle the addition. Unlink operations generally do not expand the directory (you'd have to free a block and then cause a btree split) and we can defer the directory block freeing if there is no space reservation.
Moreover, there is a further bug in that we do not trigger the blockgc workers to try to clear space when we're out of quota.
To fix both cases, create a new xfs_trans_alloc_dir function that allocates the transaction, locks and joins the inodes, and reserves quota for the directory. If there isn't sufficient space or quota, we'll switch the caller to reservationless mode. This should prevent quota usage overruns with the least restriction in functionality.
--- fs/xfs/xfs_inode.c | 46 ++++++++++------------------ fs/xfs/xfs_trans.c | 86 +++++++++++++++++++++++++++++++++++++++++++++++++++++ fs/xfs/xfs_trans.h | 3 + 3 files changed, 106 insertions(+), 29 deletions(-)
fs/xfs/xfs_inode.c +17 -29
@@ -1223,7 +1223,7 @@ xfs_link( {xfs_mount_t *mp = tdp->i_mount;xfs_trans_t *tp; -int error; +int error, nospace_error =0 ;int resblks;trace_xfs_link (tdp, target_name);
@@ -1242,19 +1242,11 @@ xfs_link( goto std_return; resblks =XFS_LINK_SPACE_RES (mp, target_name->len); - error =xfs_trans_alloc (mp, &M_RES (mp)->tr_link, resblks,0 ,0 , &tp); -if (error == -ENOSPC ) { - resblks =0 ; - error =xfs_trans_alloc (mp, &M_RES (mp)->tr_link,0 ,0 ,0 , &tp); - } + error =xfs_trans_alloc_dir (tdp, &M_RES (mp)->tr_link, sip, &resblks, + &tp, &nospace_error);if (error) goto std_return; -xfs_lock_two_inodes (sip,XFS_ILOCK_EXCL , tdp,XFS_ILOCK_EXCL ); - -xfs_trans_ijoin (tp, sip,XFS_ILOCK_EXCL ); -xfs_trans_ijoin (tp, tdp,XFS_ILOCK_EXCL ); - error =xfs_iext_count_may_overflow (tdp,XFS_DATA_FORK ,XFS_IEXT_DIR_MANIP_CNT (mp));if (error)
@@ -1312,6 +1304,8 @@ xfs_link( error_return:xfs_trans_cancel (tp); std_return: +if (error == -ENOSPC && nospace_error) + error = nospace_error;return error; }
@@ -2761,6 +2755,7 @@ xfs_remove(xfs_mount_t *mp = dp->i_mount;xfs_trans_t *tp =NULL ;int is_dir =S_ISDIR (VFS_I (ip)->i_mode); +int dontcare;int error =0 ;uint resblks;
@@ -2778,31 +2773,24 @@ xfs_remove( goto std_return;/* -* We try to get the real space reservation first, -* allowing for directory btree deletion(s) implying -* possible bmap insert(s). If we can't get the space -* reservation then we use 0 instead, and avoid the bmap -* btree insert(s) in the directory code by, if the bmap -* insert tries to happen, instead trimming the LAST -* block from the directory. +* We try to get the real space reservation first, allowing for +* directory btree deletion(s) implying possible bmap insert(s). If we +* can't get the space reservation then we use 0 instead, and avoid the +* bmap btree insert(s) in the directory code by, if the bmap insert +* tries to happen, instead trimming the LAST block from the directory. +* +* Ignore EDQUOT and ENOSPC being returned via nospace_error because +* the directory code can handle a reservationless update and we don't +* want to prevent a user from trying to free space by deleting things. */ resblks =XFS_REMOVE_SPACE_RES (mp); - error =xfs_trans_alloc (mp, &M_RES (mp)->tr_remove, resblks,0 ,0 , &tp); -if (error == -ENOSPC ) { - resblks =0 ; - error =xfs_trans_alloc (mp, &M_RES (mp)->tr_remove,0 ,0 ,0 , - &tp); - } + error =xfs_trans_alloc_dir (dp, &M_RES (mp)->tr_remove, ip, &resblks, + &tp, &dontcare);if (error) {ASSERT (error != -ENOSPC ); goto std_return; } -xfs_lock_two_inodes (dp,XFS_ILOCK_EXCL , ip,XFS_ILOCK_EXCL ); - -xfs_trans_ijoin (tp, dp,XFS_ILOCK_EXCL ); -xfs_trans_ijoin (tp, ip,XFS_ILOCK_EXCL ); -/* * If we're removing a directory perform some additional validation. */
fs/xfs/xfs_trans.c +86 -0
89 lines not on this page · raw message
fs/xfs/xfs_trans.h +3 -0
@@ -265,6 +265,9 @@ int xfs_trans_alloc_icreate(struct xfs_mint xfs_trans_alloc_ichange (struct xfs_inode *ip,struct xfs_dquot *udqp,struct xfs_dquot *gdqp,struct xfs_dquot *pdqp,bool force,struct xfs_trans **tpp); +int xfs_trans_alloc_dir (struct xfs_inode *dp,struct xfs_trans_res *resv, +struct xfs_inode *ip,unsigned int *dblocks, +struct xfs_trans **tpp,int *nospace_error);static inline void xfs_trans_set_context(
Greg Kroah-Hartman
maintainerPATCH 238/244 xfs: reserve quota for target dir expansion when renaming files
In reply to Greg Kroah-HartmanFrom: "Darrick J. Wong" <[email protected]>
[ Upstream commit 41667260bc84db4dfe566e3f6ab6da5293d60d8d ]
XFS does not reserve quota for directory expansion when renaming children into a directory. This means that we don't reject the expansion with EDQUOT when we're at or near a hard limit, which means that unprivileged userspace can use rename() to exceed quota.
Rename operations don't always expand the target directory, and we allow a rename to proceed with no space reservation if we don't need to add a block to the target directory to handle the addition. Moreover, the unlink operation on the source directory generally does not expand the directory (you'd have to free a block and then cause a btree split) and it's probably of little consequence to leave the corner case that renaming a file out of a directory can increase its size.
As with link and unlink, there is a further bug in that we do not trigger the blockgc workers to try to clear space when we're out of quota.
Because rename is its own special tricky animal, we'll patch xfs_rename directly to reserve quota to the rename transaction. We'll leave cleaning up the rest of xfs_rename for the metadata directory tree patchset.
--- fs/xfs/xfs_inode.c | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-)
fs/xfs/xfs_inode.c +32 -1
@@ -3103,7 +3103,8 @@ xfs_rename(bool new_parent = (src_dp != target_dp);bool src_is_directory =S_ISDIR (VFS_I (src_ip)->i_mode);int spaceres; -int error; +bool retried = false; +int error, nospace_error =0 ;trace_xfs_rename (src_dp, target_dp, src_name, target_name);
@@ -3127,9 +3128,12 @@ xfs_rename(xfs_sort_for_rename (src_dp, target_dp, src_ip, target_ip, wip, inodes, &num_inodes); +retry: + nospace_error =0 ; spaceres =XFS_RENAME_SPACE_RES (mp, target_name->len); error =xfs_trans_alloc (mp, &M_RES (mp)->tr_rename, spaceres,0 ,0 , &tp);if (error == -ENOSPC ) { + nospace_error = error; spaceres =0 ; error =xfs_trans_alloc (mp, &M_RES (mp)->tr_rename,0 ,0 ,0 , &tp);
@@ -3184,6 +3188,31 @@ xfs_rename( spaceres);/* +* Try to reserve quota to handle an expansion of the target directory. +* We'll allow the rename to continue in reservationless mode if we hit +* a space usage constraint. If we trigger reservationless mode, save +* the errno if there isn't any free space in the target directory. +*/ +if (spaceres !=0 ) { + error =xfs_trans_reserve_quota_nblks (tp, target_dp, spaceres, +0 , false); +if (error == -EDQUOT || error == -ENOSPC ) { +if (!retried) { +xfs_trans_cancel (tp); +xfs_blockgc_free_quota (target_dp,0 ); + retried = true; + goto retry; + } + + nospace_error = error; + spaceres =0 ; + error =0 ; + } +if (error) + goto out_trans_cancel; + } + +/* * Check for expected errors before we dirty the transaction * so we can return an error without a transaction abort. *
@@ -3429,6 +3458,8 @@ out_trans_cancel: out_release_wip:if (wip)xfs_irele (wip); +if (error == -ENOSPC && nospace_error) + error = nospace_error;return error; }
Greg Kroah-Hartman
maintainerPATCH 239/244 xfs: remove infinite loop when reserving free block pool
In reply to Greg Kroah-HartmanFrom: "Darrick J. Wong" <[email protected]>
[ Upstream commit 15f04fdc75aaaa1cccb0b8b3af1be290e118a7bc ]
Infinite loops in kernel code are scary. Calls to xfs_reserve_blocks should be rare (people should just use the defaults!) so we really don't need to try so hard. Simplify the logic here by removing the infinite loop.
--- fs/xfs/xfs_fsops.c | 50 ++++++++++++++++++++------------------------------ 1 file changed, 20 insertions(+), 30 deletions(-)
fs/xfs/xfs_fsops.c +20 -30
@@ -430,46 +430,36 @@ xfs_reserve_blocks(* If the request is larger than the current reservation, reserve the * blocks before we update the reserve counters. Sample m_fdblocks and * perform a partial reservation if the request exceeds free space. +* +* The code below estimates how many blocks it can request from +* fdblocks to stash in the reserve pool. This is a classic TOCTOU +* race since fdblocks updates are not always coordinated via +* m_sb_lock. */ - error = -ENOSPC ; -do { - free =percpu_counter_sum (&mp->m_fdblocks) - + free =percpu_counter_sum (&mp->m_fdblocks) -xfs_fdblocks_unavailable (mp); -if (free <=0 ) -break ; - - delta = request - mp->m_resblks; - lcounter = free - delta; -if (lcounter <0 ) -/* We can't satisfy the request, just get what we can */ - fdblks_delta = free; -else - fdblks_delta = delta; - + delta = request - mp->m_resblks; +if (delta >0 && free >0 ) {/* * We'll either succeed in getting space from the free block -* count or we'll get an ENOSPC. If we get a ENOSPC, it means -* things changed while we were calculating fdblks_delta and so -* we should try again to see if there is anything left to -* reserve. -* -* Don't set the reserved flag here - we don't want to reserve -* the extra reserve blocks from the reserve..... +* count or we'll get an ENOSPC. Don't set the reserved flag +* here - we don't want to reserve the extra reserve blocks +* from the reserve. */ + fdblks_delta =min (free, delta);spin_unlock (&mp->m_sb_lock); error =xfs_mod_fdblocks (mp, -fdblks_delta,0 );spin_lock (&mp->m_sb_lock); - }while (error == -ENOSPC ); -/* -* Update the reserve counters if blocks have been successfully -* allocated. -*/ -if (!error && fdblks_delta) { - mp->m_resblks += fdblks_delta; - mp->m_resblks_avail += fdblks_delta; +/* +* Update the reserve counters if blocks have been successfully +* allocated. +*/ +if (!error) { + mp->m_resblks += fdblks_delta; + mp->m_resblks_avail += fdblks_delta; + } } - out:if (outval) { outval->resblks = mp->m_resblks;
Greg Kroah-Hartman
maintainerPATCH 240/244 xfs: always succeed at setting the reserve pool size
In reply to Greg Kroah-HartmanFrom: "Darrick J. Wong" <[email protected]>
[ Upstream commit 0baa2657dc4d79202148be79a3dc36c35f425060 ]
Nowadays, xfs_mod_fdblocks will always choose to fill the reserve pool with freed blocks before adding to fdblocks. Therefore, we can change the behavior of xfs_reserve_blocks slightly -- setting the target size of the pool should always succeed, since a deficiency will eventually be made up as blocks get freed.
--- fs/xfs/xfs_fsops.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/xfs/xfs_fsops.c +5 -4
@@ -434,11 +434,14 @@ xfs_reserve_blocks(* The code below estimates how many blocks it can request from * fdblocks to stash in the reserve pool. This is a classic TOCTOU * race since fdblocks updates are not always coordinated via -* m_sb_lock. +* m_sb_lock. Set the reserve size even if there's not enough free +* space to fill it because mod_fdblocks will refill an undersized +* reserve when it can. */ free =percpu_counter_sum (&mp->m_fdblocks) -xfs_fdblocks_unavailable (mp); delta = request - mp->m_resblks; + mp->m_resblks = request;if (delta >0 && free >0 ) {/* * We'll either succeed in getting space from the free block
@@ -455,10 +458,8 @@ xfs_reserve_blocks(* Update the reserve counters if blocks have been successfully * allocated. */ -if (!error) { - mp->m_resblks += fdblks_delta; +if (!error) mp->m_resblks_avail += fdblks_delta; - } } out:if (outval) {
Greg Kroah-Hartman
maintainerPATCH 241/244 xfs: fix overfilling of reserve pool
In reply to Greg Kroah-HartmanFrom: "Darrick J. Wong" <[email protected]>
[ Upstream commit 82be38bcf8a2e056b4c99ce79a3827fa743df6ec ]
Due to cycling of m_sb_lock, it's possible for multiple callers of xfs_reserve_blocks to race at changing the pool size, subtracting blocks from fdblocks, and actually putting it in the pool. The result of all this is that we can overfill the reserve pool to hilarious levels.
xfs_mod_fdblocks, when called with a positive value, already knows how to take freed blocks and either fill the reserve until it's full, or put them in fdblocks. Use that instead of setting m_resblks_avail directly.
--- fs/xfs/xfs_fsops.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
fs/xfs/xfs_fsops.c +6 -7
@@ -448,18 +448,17 @@ xfs_reserve_blocks(* count or we'll get an ENOSPC. Don't set the reserved flag * here - we don't want to reserve the extra reserve blocks * from the reserve. +* +* The desired reserve size can change after we drop the lock. +* Use mod_fdblocks to put the space into the reserve or into +* fdblocks as appropriate. */ fdblks_delta =min (free, delta);spin_unlock (&mp->m_sb_lock); error =xfs_mod_fdblocks (mp, -fdblks_delta,0 ); -spin_lock (&mp->m_sb_lock); - -/* -* Update the reserve counters if blocks have been successfully -* allocated. -*/ if (!error) - mp->m_resblks_avail += fdblks_delta; +xfs_mod_fdblocks (mp, fdblks_delta,0 ); +spin_lock (&mp->m_sb_lock); } out:if (outval) {
Greg Kroah-Hartman
maintainerPATCH 242/244 xfs: fix soft lockup via spinning in filestream ag selection loop
In reply to Greg Kroah-HartmanFrom: Brian Foster <[email protected]>
[ Upstream commit f650df7171b882dca737ddbbeb414100b31f16af ]
The filestream AG selection loop uses pagf data to aid in AG selection, which depends on pagf initialization. If the in-core structure is not initialized, the caller invokes the AGF read path to do so and carries on. If another task enters the loop and finds a pagf init already in progress, the AGF read returns -EAGAIN and the task continues the loop. This does not increment the current ag index, however, which means the task spins on the current AGF buffer until unlocked.
If the AGF read I/O submitted by the initial task happens to be delayed for whatever reason, this results in soft lockup warnings via the spinning task. This is reproduced by xfs/170. To avoid this problem, fix the AGF trylock failure path to properly iterate to the next AG. If a task iterates all AGs without making progress, the trylock behavior is dropped in favor of blocking locks and thus a soft lockup is no longer possible.
--- fs/xfs/xfs_filestream.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/xfs/xfs_filestream.c +4 -3
@@ -128,11 +128,12 @@ xfs_filestream_pick_ag(if (!pag->pagf_init) { err =xfs_alloc_pagf_init (mp,NULL , ag, trylock);if (err) { -xfs_perag_put (pag); -if (err != -EAGAIN ) +if (err != -EAGAIN ) { +xfs_perag_put (pag);return err; + }/* Couldn't lock the AGF, skip this AG. */ -continue ; + goto next_ag; } }
Greg Kroah-Hartman
maintainerPATCH 243/244 xfs: revert "xfs: actually bump warning counts when we send warnings"
In reply to Greg Kroah-HartmanFrom: Eric Sandeen <[email protected]>
[ Upstream commit bc37e4fb5cac2925b2e286b1f1d4fc2b519f7d92 ]
This reverts commit 4b8628d57b725b32616965e66975fcdebe008fe7.
XFS quota has had the concept of a "quota warning limit" since the earliest Irix implementation, but a mechanism for incrementing the warning counter was never implemented, as documented in the xfs_quota(8) man page. We do know from the historical archive that it was never incremented at runtime during quota reservation operations.
With this commit, the warning counter quickly increments for every allocation attempt after the user has crossed a quote soft limit threshold, and this in turn transitions the user to hard quota failures, rendering soft quota thresholds and timers useless. This was reported as a regression by users.
Because the intended behavior of this warning counter has never been understood or documented, and the result of this change is a regression in soft quota functionality, revert this commit to make soft quota limits and timers operable again.
--- fs/xfs/xfs_trans_dquot.c | 1 - 1 file changed, 1 deletion(-)
fs/xfs/xfs_trans_dquot.c +0 -1
@@ -603,7 +603,6 @@ xfs_dqresv_check(return QUOTA_NL_ISOFTLONGWARN ; } - res->warnings++;return QUOTA_NL_ISOFTWARN ; }
Greg Kroah-Hartman
maintainerPATCH 244/244 xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP*
In reply to Greg Kroah-HartmanFrom: "Darrick J. Wong" <[email protected]>
[ Upstream commit 29d650f7e3ab55283b89c9f5883d0c256ce478b5 ]
Syzbot tripped over the following complaint from the kernel:
WARNING: CPU: 2 PID: 15402 at mm/util.c:597 kvmalloc_node+0x11e/0x125 mm/util.c:597
While trying to run XFS_IOC_GETBMAP against the following structure:
struct getbmap fubar = {
.bmv_count = 0x22dae649,
};Obviously, this is a crazy huge value since the next thing that the ioctl would do is allocate 37GB of memory. This is enough to make kvmalloc mad, but isn't large enough to trip the validation functions. In other words, I'm fussing with checks that were **already sufficient** because that's easier than dealing with 644 internal bug reports. Yes, that's right, six hundred and forty-four.
--- fs/xfs/xfs_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/xfs/xfs_ioctl.c +1 -1
@@ -1545,7 +1545,7 @@ xfs_ioc_getbmap(if (bmx.bmv_count <2 )return -EINVAL ; -if (bmx.bmv_count >ULONG_MAX / recsize) +if (bmx.bmv_count >=INT_MAX / recsize)return -ENOMEM ; buf =kvzalloc (bmx.bmv_count *sizeof (*buf),GFP_KERNEL );
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.63 release. There are 244 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 25 Aug 2022 08:00:15 +0000. Anything received after that time might be too late.
Build results:
total: 159 pass: 158 fail: 1 Failed builds: um:defconfig Qemu test results: total: 485 pass: 485 fail: 0
arch/um/kernel/um_arch.c:440:6: error: redefinition of 'apply_returns'
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.63 release. There are 244 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 25 Aug 2022 08:00:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.63-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah